diff --git a/ChangeLog.d/aesce-include.txt b/ChangeLog.d/aesce-include.txt
new file mode 100644
index 000000000000..bda1188bea03
--- /dev/null
+++ b/ChangeLog.d/aesce-include.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix compilation errors in `aesce.c` in some Visual Studio builds.
+     Fixes Mbed-TLS/TF-PSA-Crypto#548.
diff --git a/library/aesce.c b/library/aesce.c
index 6a9e0a1c6bd0..bd9c4839683f 100644
--- a/library/aesce.c
+++ b/library/aesce.c
@@ -5,6 +5,10 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
+#include "common.h"
+
+#if defined(MBEDTLS_AESCE_C)
+
 #if defined(__clang__) &&  (__clang_major__ >= 4)
 
 /* Ideally, we would simply use MBEDTLS_ARCH_IS_ARMV8_A in the following #if,
@@ -39,9 +43,6 @@
 #endif /* defined(__clang__) &&  (__clang_major__ >= 4) */
 
 #include <string.h>
-#include "common.h"
-
-#if defined(MBEDTLS_AESCE_C)
 
 #include "aesce.h"
 
diff --git a/library/base64.c b/library/base64.c
index 388fa9f388e5..25c960a8ce02 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -5,8 +5,6 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
-#include <limits.h>
-
 #include "common.h"
 
 #if defined(MBEDTLS_BASE64_C)
@@ -16,6 +14,7 @@
 #include "constant_time_internal.h"
 #include "mbedtls/error.h"
 
+#include <limits.h>
 #include <stdint.h>
 
 #if defined(MBEDTLS_SELF_TEST)
diff --git a/library/constant_time.c b/library/constant_time.c
index d212ddfd8104..afea99c7ec47 100644
--- a/library/constant_time.c
+++ b/library/constant_time.c
@@ -10,15 +10,14 @@
  * might be translated to branches by some compilers on some platforms.
  */
 
-#include <stdint.h>
-#include <limits.h>
-
 #include "common.h"
 #include "constant_time_internal.h"
 #include "mbedtls/constant_time.h"
 #include "mbedtls/error.h"
 #include "mbedtls/platform_util.h"
 
+#include <limits.h>
+#include <stdint.h>
 #include <string.h>
 
 #if !defined(MBEDTLS_CT_ASM)
diff --git a/library/sha256.c b/library/sha256.c
index 159acccaeb38..c2a5f9c93b87 100644
--- a/library/sha256.c
+++ b/library/sha256.c
@@ -10,6 +10,15 @@
  *  http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
  */
 
+/* Ensure that SIG_SETMASK is defined when -std=c99 is used. */
+#if !defined(_GNU_SOURCE)
+#define _GNU_SOURCE
+#endif
+
+#include "common.h"
+
+#if defined(MBEDTLS_SHA256_C) || defined(MBEDTLS_SHA224_C)
+
 #if defined(__clang__) &&  (__clang_major__ >= 4)
 
 /* Ideally, we would simply use MBEDTLS_ARCH_IS_ARMV8_A in the following #if,
@@ -43,15 +52,6 @@
 
 #endif /* defined(__clang__) &&  (__clang_major__ >= 4) */
 
-/* Ensure that SIG_SETMASK is defined when -std=c99 is used. */
-#if !defined(_GNU_SOURCE)
-#define _GNU_SOURCE
-#endif
-
-#include "common.h"
-
-#if defined(MBEDTLS_SHA256_C) || defined(MBEDTLS_SHA224_C)
-
 #include "mbedtls/sha256.h"
 #include "mbedtls/platform_util.h"
 #include "mbedtls/error.h"
diff --git a/library/sha512.c b/library/sha512.c
index 6dcea8da5d5c..c7c2d92aeffa 100644
--- a/library/sha512.c
+++ b/library/sha512.c
@@ -10,6 +10,10 @@
  *  http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
  */
 
+#include "common.h"
+
+#if defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_SHA384_C)
+
 #if defined(__aarch64__) && !defined(__ARM_FEATURE_SHA512) && \
     defined(__clang__) && __clang_major__ >= 7
 /* TODO: Re-consider above after https://reviews.llvm.org/D131064 merged.
@@ -26,10 +30,6 @@
 #define MBEDTLS_ENABLE_ARM_SHA3_EXTENSIONS_COMPILER_FLAG
 #endif
 
-#include "common.h"
-
-#if defined(MBEDTLS_SHA512_C) || defined(MBEDTLS_SHA384_C)
-
 #include "mbedtls/sha512.h"
 #include "mbedtls/platform_util.h"
 #include "mbedtls/error.h"