diff --git a/tests/api/test_ossl_mac.c b/tests/api/test_ossl_mac.c
index d1bd1df896..b1783dc882 100644
--- a/tests/api/test_ossl_mac.c
+++ b/tests/api/test_ossl_mac.c
@@ -28,12 +28,29 @@
     #include <wolfcrypt/src/misc.c>
 #endif
 
+/* Included standalone after tests/unit.h has completed the
+ * <wolfssl/ssl.h> parse: hmac.h must provide the EVP_* declarations by
+ * itself, like OpenSSL's hmac.h; see test_wolfSSL_hmac_includes_evp. */
 #include <wolfssl/openssl/hmac.h>
 #include <wolfssl/openssl/cmac.h>
 #include <wolfssl/wolfcrypt/types.h>
 #include <tests/api/api.h>
 #include <tests/api/test_ossl_mac.h>
 
+#if defined(OPENSSL_EXTRA) && !defined(NO_SHA256)
+/* Referencing an EVP_* symbol pins the include contract above. */
+static const WOLFSSL_EVP_MD* (*ossl_mac_evp_md_ref)(void) = EVP_sha256;
+#endif
+
+int test_wolfSSL_hmac_includes_evp(void)
+{
+    EXPECT_DECLS;
+#if defined(OPENSSL_EXTRA) && !defined(NO_SHA256)
+    ExpectNotNull(ossl_mac_evp_md_ref());
+#endif
+    return EXPECT_RESULT();
+}
+
 /*******************************************************************************
  * MAC OpenSSL compatibility API Testing
  ******************************************************************************/
diff --git a/tests/api/test_ossl_mac.h b/tests/api/test_ossl_mac.h
index 4441bef65b..88ff90feed 100644
--- a/tests/api/test_ossl_mac.h
+++ b/tests/api/test_ossl_mac.h
@@ -24,12 +24,14 @@
 
 #include <tests/api/api_decl.h>
 
+int test_wolfSSL_hmac_includes_evp(void);
 int test_wolfSSL_HMAC_CTX(void);
 int test_wolfSSL_HMAC_CTX_cleanup_zeroize(void);
 int test_wolfSSL_HMAC(void);
 int test_wolfSSL_CMAC(void);
 
 #define TEST_OSSL_MAC_DECLS                             \
+    TEST_DECL_GROUP("ossl_mac", test_wolfSSL_hmac_includes_evp), \
     TEST_DECL_GROUP("ossl_mac", test_wolfSSL_HMAC_CTX), \
     TEST_DECL_GROUP("ossl_mac", test_wolfSSL_HMAC_CTX_cleanup_zeroize), \
     TEST_DECL_GROUP("ossl_mac", test_wolfSSL_HMAC),     \
diff --git a/wolfssl/openssl/hmac.h b/wolfssl/openssl/hmac.h
index 30cf58ad64..6407b733e3 100644
--- a/wolfssl/openssl/hmac.h
+++ b/wolfssl/openssl/hmac.h
@@ -37,10 +37,12 @@
 
 #include <wolfssl/openssl/compat_types.h>
 #include <wolfssl/openssl/opensslv.h>
-/* OpenSSL's hmac.h pulls in evp.h; mirror it, but only on standalone
- * include (WOLFSSL_SSL_H unset) to avoid an include cycle during
- * wolfssl/ssl.h's own parse. */
-#ifndef WOLFSSL_SSL_H
+/* OpenSSL's hmac.h pulls in evp.h; mirror it, except while wolfssl/ssl.h
+ * is itself being parsed (it includes hmac.h, and evp.h would cycle back
+ * into the partially declared openssl/ssl.h). WOLFSSL_SSL_H_PARSING is
+ * set around wolfssl/ssl.h's own hmac.h include only, so any include of
+ * this header before or after a completed ssl.h parse gets evp.h. */
+#ifndef WOLFSSL_SSL_H_PARSING
 #include <wolfssl/openssl/evp.h>
 #endif
 
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index a18ff1d1c5..fb30497358 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -99,7 +99,12 @@
 #if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL))
     #include <wolfssl/openssl/bn.h>
     #ifndef WOLFCRYPT_ONLY
+        /* Tell hmac.h that wolfssl/ssl.h is still being parsed, so it
+         * must not include evp.h (which leads back into openssl/ssl.h
+         * and would see this header only partially declared). */
+        #define WOLFSSL_SSL_H_PARSING
         #include <wolfssl/openssl/hmac.h>
+        #undef WOLFSSL_SSL_H_PARSING
     #endif
     #if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_DIRECT)
         #include <wolfssl/openssl/cmac.h>