diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml
index c46f061..0c3deaf 100644
--- a/.github/workflows/python-app.yml
+++ b/.github/workflows/python-app.yml
@@ -40,6 +40,9 @@ jobs:
         uv run --no-sync pytest tests
 
   build-no-pqc:
+    # Regression coverage for issue #2659: a wolfSSL build without ML-KEM
+    # and ML-DSA must still import wolfcrypt.random successfully.
+
     runs-on: ubuntu-latest
     env:
       USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install
@@ -89,5 +92,7 @@ jobs:
       run: |
         uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'"
         uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'"
+    - name: Import smoke (regression for INVALID_DEVID)
+      run: uv run --no-sync python -c "from wolfcrypt.random import Random; Random()"
     - name: Run tests
       run: uv run --no-sync pytest tests
diff --git a/scripts/build_ffi.py b/scripts/build_ffi.py
index 3a6bbdc..26eae61 100644
--- a/scripts/build_ffi.py
+++ b/scripts/build_ffi.py
@@ -568,6 +568,8 @@ def build_ffi(local_wolfssl, features):
         extern int CRYPTO_CB_ENABLED;
 
         static const int INVALID_DEVID;
+        static const int WC_HW_E;
+        static const int CRYPTOCB_UNAVAILABLE;
 
         typedef unsigned char byte;
         typedef unsigned int word32;
@@ -771,7 +773,6 @@ def build_ffi(local_wolfssl, features):
 
         static const int ECC_PRIVATEONLY_E;
         static const int EXTKEYUSAGE_E;
-        static const int WC_HW_E;
         static const int WC_HW_WAIT_E;
 
         static const int PSS_SALTLEN_E;
@@ -799,7 +800,6 @@ def build_ffi(local_wolfssl, features):
         static const int PKCS7_NO_SIGNER_E;
         static const int WC_PKCS7_WANT_READ_E;
 
-        static const int CRYPTOCB_UNAVAILABLE;
         static const int PKCS7_SIGNEEDS_CHECK;
         static const int PSS_SALTLEN_RECOVER_E;
         static const int CHACHA_POLY_OVERFLOW;
@@ -1446,6 +1446,8 @@ def build_ffi(local_wolfssl, features):
         #     } cipher;
         # """
 
+        # wolfSSL names the input fields in/inSz; renamed here because "in" is a
+        # Python keyword. The layout must still match wc_CryptoInfo in cryptocb.h.
         cdef += """
             struct {
                 int type; /* enum wc_HashType */