diff --git a/configure.ac b/configure.ac
index 9588bce7438b04..112589123c32e2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1996,6 +1996,7 @@ Makefile
 examples/Makefile
 third_party/Makefile
 third_party/lwip/Makefile
+third_party/mbedtls/Makefile
 src/Makefile
 src/include/Makefile
 src/ble/Makefile
@@ -2018,10 +2019,6 @@ src/platform/Makefile
 tests/Makefile
 ])
 
-if test "${nl_with_mbedtls}" = "internal"; then
-AC_CONFIG_FILES([third_party/mbedtls/Makefile])
-fi
-
 #
 # Generate the auto-generated files for the package
 #
@@ -2093,7 +2090,7 @@ AC_MSG_NOTICE([
   LwIP compile flags                               : ${LWIP_CPPFLAGS:--}
   LwIP link flags                                  : ${LWIP_LDFLAGS:--}
   LwIP link libraries                              : ${LWIP_LIBS:--}
-  mbedTLS source                                   : ${nl_with_mbedtls}
+  mbedTLS source                                   : ${nl_with_mbedtls:--}
   mbedTLS compile flags                            : ${MBEDTLS_CPPFLAGS:--}
   mbedTLS link flags                               : ${MBEDTLS_LDFLAGS:--}
   mbedTLS link libraries                           : ${MBEDTLS_LIBS:--}
diff --git a/third_party/Makefile.am b/third_party/Makefile.am
index 9b8fc5f78a4d38..20c70980fba9fd 100644
--- a/third_party/Makefile.am
+++ b/third_party/Makefile.am
@@ -32,6 +32,7 @@ EXTRA_DIST                                   = \
 
 DIST_SUBDIRS                                 = \
     lwip                                       \
+    mbedtls                                    \
     $(NULL)
 
 # <any of the third-party packages listed in repos.conf>_SUBDIRS are
diff --git a/third_party/mbedtls/Makefile.am b/third_party/mbedtls/Makefile.am
index d935d28614142f..f9e8aec53107d2 100644
--- a/third_party/mbedtls/Makefile.am
+++ b/third_party/mbedtls/Makefile.am
@@ -23,9 +23,14 @@
 
 include $(abs_top_nlbuild_autotools_dir)/automake/pre.am
 
+if CHIP_WITH_MBEDTLS_INTERNAL
+
 lib_LIBRARIES                                                                  = libmbedtls.a
 
-libmbedtls_a_SOURCES                                                           = \
+# Never include the mbedTLS sources in a distribution; they always will get pulled from upstream
+# via git operations, hence the 'nodist_' qualifier.
+
+nodist_libmbedtls_a_SOURCES                                                    = \
     repo/library/aes.c                      \
     repo/library/pem.c                      \
     repo/library/aesni.c                    \
@@ -104,7 +109,7 @@ libmbedtls_a_SOURCES                                                           =
     $(NULL)
 
 if !CONFIG_DEVICE_LAYER
-libmbedtls_a_SOURCES                                                          += \
+nodist_libmbedtls_a_SOURCES                                                   += \
     repo/library/entropy_poll.c             \
     repo/library/timing.c                   \
     $(NULL)
@@ -115,4 +120,6 @@ libmbedtls_a_CPPFLAGS                                                          =
     $(MBEDTLS_CPPFLAGS)                                                          \
     $(NULL)
 
+endif # CHIP_WITH_MBEDTLS_INTERNAL
+
 include $(abs_top_nlbuild_autotools_dir)/automake/post.am