diff --git a/hal/stm32_tz.c b/hal/stm32_tz.c
index 46863d0a..1152817c 100644
--- a/hal/stm32_tz.c
+++ b/hal/stm32_tz.c
@@ -291,7 +291,7 @@ void hal_tz_sau_init(void)
     /* SAU is set up before staging. Set up all areas as secure. */
 
     /* Non-secure callable: NSC functions area */
-    sau_init_region(0, 0x0C038000, 0x0C040000, 1);
+    sau_init_region(0, 0x0C040000, 0x0C05FFFF, 1);
 
     /* Secure: application flash area (first bank) */
     sau_init_region(1, WOLFBOOT_PARTITION_BOOT_ADDRESS, FLASH_BANK2_BASE - 1, 0);
diff --git a/hal/stm32h5.ld b/hal/stm32h5.ld
index 153ec715..78071638 100644
--- a/hal/stm32h5.ld
+++ b/hal/stm32h5.ld
@@ -1,12 +1,12 @@
 MEMORY
 {
     /* If FLASH_KEYVAULT or FLASH_NSC length is adjusted FLASH length needs adjusted too */
-    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x1E000 - 0x2000
+    FLASH (rx) :    ORIGIN = @WOLFBOOT_ORIGIN@, LENGTH = @BOOTLOADER_PARTITION_SIZE@ - 0x20000
     RAM (rwx) :     ORIGIN = 0x30000000, LENGTH = 0x20000
     RAM_KV (rw):    ORIGIN = 0x30020000, LENGTH = 0x10000
     RAM_HEAP (rw):  ORIGIN = 0x30030000, LENGTH = 0x10000 /* 64KB Heap for wolfcrypt/PKCS11 */
-    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH), LENGTH = 0x1E000
-    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH) + LENGTH(FLASH_KEYVAULT), LENGTH = 0x2000
+    FLASH_KEYVAULT(rw): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH), LENGTH = 0x1C000
+    FLASH_NSC(rx): ORIGIN = @WOLFBOOT_ORIGIN@ + LENGTH(FLASH) + LENGTH(FLASH_KEYVAULT), LENGTH = 0x4000
 }
 
 SECTIONS
diff --git a/src/pkcs11_store.c b/src/pkcs11_store.c
index 3d517424..c15cf4aa 100644
--- a/src/pkcs11_store.c
+++ b/src/pkcs11_store.c
@@ -60,8 +60,9 @@
 extern uint32_t _flash_keyvault;
 extern uint32_t _flash_keyvault_size;
 
-static uint8_t *vault_base = (uint8_t*)&_flash_keyvault;
-static uint32_t vault_size = (uint32_t)&_flash_keyvault_size;
+#define vault_base ((uint8_t*)&_flash_keyvault)
+#define vault_size ((uint32_t)&_flash_keyvault_size)
+
 
 /* Back-end for malloc, used by wolfPKCS11 */
 extern unsigned int _start_heap; /* From linker script: heap memory */
diff --git a/test-app/Makefile b/test-app/Makefile
index e7bf329f..5d35498b 100644
--- a/test-app/Makefile
+++ b/test-app/Makefile
@@ -6,12 +6,12 @@
 TARGET?=none
 ARCH?=ARM
 MCUXPRESSO_CMSIS?=$(MCUXPRESSO)/CMSIS
-CFLAGS+=-I. -I..
 ifeq ($(TZEN),1)
   # wcs directory contains a user_settings.h, which will conflict with
   # the one in the include directory if the test app needs it (e.g. wolfHSM)
   CFLAGS+=-I./wcs
 endif
+CFLAGS+=-I. -I..
 DEBUG?=1
 DELTA_DATA_SIZE?=2000
 USE_GCC?=1
diff --git a/test-app/wcs/user_settings.h b/test-app/wcs/user_settings.h
index fb85bf6f..f3796f33 100644
--- a/test-app/wcs/user_settings.h
+++ b/test-app/wcs/user_settings.h
@@ -136,7 +136,13 @@ extern int tolower(int c);
 #define BENCH_EMBEDDED
 
 #ifdef SECURE_PKCS11
-#define CUSTOM_RAND_GENERATE_BLOCK wcs_get_random
+
+static inline int wcs_cmse_get_random(unsigned char* output, int sz)
+{
+    return wcs_get_random(output, sz);
+}
+
+#define CUSTOM_RAND_GENERATE_BLOCK wcs_cmse_get_random
 #endif
 
 /* Disable VLAs */