diff --git a/vars/checkout_repo.groovy b/vars/checkout_repo.groovy
index 0276489a6..9d2be2782 100644
--- a/vars/checkout_repo.groovy
+++ b/vars/checkout_repo.groovy
@@ -18,6 +18,7 @@
  */
 
 import hudson.model.Result
+import hudson.plugins.git.GitSCM
 import hudson.scm.NullSCM
 import jenkins.model.CauseOfInterruption
 import org.jenkinsci.plugins.workflow.steps.FlowInterruptedException
@@ -74,16 +75,33 @@ Map<String, String> checkout_tls_repo(String branch) {
     try {
         def result = checkout_report_errors(scm_config)
 
-        dir('framework') {
-            if (env.TARGET_REPO == 'framework' && env.CHECKOUT_METHOD == 'scm') {
+        dir('tf-psa-crypto') {
+            if (env.TARGET_REPO == 'tf-psa-crypto' && env.CHECKOUT_METHOD == 'scm') {
                 checkout_report_errors(scm)
-            } else if (env.FRAMEWORK_REPO && env.FRAMEWORK_BRANCH) {
-                checkout_report_errors(parametrized_repo(env.FRAMEWORK_REPO, env.FRAMEWORK_BRANCH))
+            } else if (env.TF_PSA_CRYPTO_REPO && env.TF_PSA_CRYPTO_BRANCH) {
+                checkout_report_errors(parametrized_repo(env.TF_PSA_CRYPTO_REPO, env.TF_PSA_CRYPTO_BRANCH))
             } else {
-                echo 'Using default framework version'
+                echo 'Using default tf-psa-crypto version'
             }
         }
 
+        def framework_dirs = ['framework', 'tf-psa-crypto/framework']
+        if (env.TARGET_REPO == 'framework' && env.CHECKOUT_METHOD == 'scm') {
+            framework_dirs.each { framework_dir ->
+                dir(framework_dir) {
+                    checkout_report_errors(scm)
+                }
+            }
+        } else if (env.FRAMEWORK_REPO && env.FRAMEWORK_BRANCH) {
+            framework_dirs.each { framework_dir ->
+                dir(framework_dir) {
+                    checkout_report_errors(parametrized_repo(env.FRAMEWORK_REPO, env.FRAMEWORK_BRANCH))
+                }
+            }
+        } else {
+            echo 'Using default framework version'
+        }
+
         // After the clone, replicate it in the local config, so it is effective when running inside docker
         sh_or_bat '''
 git config url.git@github.com:.insteadOf https://github.com/ && \
@@ -112,18 +130,49 @@ Map<String, String> checkout_mbed_os_example_repo(String repo, String branch) {
     return checkout_report_errors(scm_config)
 }
 
+/** Produce an object that can be passed to {@code checkout} to make a shallow clone of the specified branch.
+ *
+ * @param repo
+ *     URL of the Git repo.
+ *
+ * @param branch
+ *     The branch / commit / tag to check out. Supports a variety of formats accepted by
+ *     {@code git rev-parse}, eg.:
+ *     <ul>
+ *         <li>{@code <branchName>}
+ *         <li>{@code refs/heads/<branchName>}
+ *         <li>{@code origin/<branchName>}
+ *         <li>{@code remotes/origin/<branchName>}
+ *         <li>{@code refs/remotes/origin/<branchName>}
+ *         <li>{@code <tagName>}
+ *         <li>{@code refs/tags/<tagName>}
+ *         <li>{@code refs/pull/<pullNr>/head}
+ *         <li>{@code <commitId>}
+ *         <li>{@code ${ENV_VARIABLE}}
+ *     </ul>
+ *     See also:
+ *     <a href="https://www.jenkins.io/doc/pipeline/steps/params/scmgit/#scmgit">
+ *     the documentation of the Git Plugin.
+ *     </a>
+ *
+ * @return
+ *     A {@link Map} representing a {@link GitSCM} object.
+ */
 Map<String, Object> parametrized_repo(String repo, String branch) {
+    String remoteRef = branch.replaceFirst('^((refs/)?remotes/)?origin/', '')
+    String localBranch = branch.replaceFirst('^(refs/)?(heads/|tags/|(remotes/)?origin/)?','')
     return [
         $class: 'GitSCM',
         userRemoteConfigs: [[
             url: repo,
+            refspec: "+$remoteRef:refs/remotes/origin/$localBranch",
             credentialsId: env.GIT_CREDENTIALS_ID
         ]],
         branches: [[name: branch]],
         extensions: [
             [$class: 'CloneOption', timeout: 60, honorRefspec: true, shallow: true],
             [$class: 'SubmoduleOption', recursiveSubmodules: true, parentCredentials: true, shallow: true],
-            [$class: 'LocalBranch', localBranch: '**'],
+            [$class: 'LocalBranch', localBranch: localBranch],
         ],
     ]
 }
diff --git a/vars/environ.groovy b/vars/environ.groovy
index 37b074a6c..7deb5a4f4 100644
--- a/vars/environ.groovy
+++ b/vars/environ.groovy
@@ -34,7 +34,7 @@ void set_pr_environment(String target_repo, boolean is_production) {
     env.JOB_TYPE = 'PR'
     env.TARGET_REPO = target_repo
     if (is_production) {
-        if (target_repo == 'framework') {
+        if (target_repo in ['framework', 'tf-psa-crypto']) {
             env.MBED_TLS_REPO = 'git@github.com:Mbed-TLS/mbedtls.git'
         }
         set_common_pr_production_environment()
diff --git a/vars/tf_psa_crypto.groovy b/vars/tf_psa_crypto.groovy
new file mode 100644
index 000000000..6adae3066
--- /dev/null
+++ b/vars/tf_psa_crypto.groovy
@@ -0,0 +1,3 @@
+void run_pr_job() {
+    mbedtls.run_pr_job('tf-psa-crypto', true, ['development'])
+}