diff --git a/tests/api/test_mldsa_legacy.c b/tests/api/test_mldsa_legacy.c
index d02f486e96..03d3ce0728 100644
--- a/tests/api/test_mldsa_legacy.c
+++ b/tests/api/test_mldsa_legacy.c
@@ -89,7 +89,7 @@ wc_static_assert(sizeof(wc_dilithium_params) == sizeof(wc_MlDsaParams));
  * DILITHIUM_LEVEL{2,3,5}_*, DILITHIUM_ML_DSA_{44,65,87}_*) lives in its own
  * `#define` line in <dilithium.h>, so each is checked separately. */
 #define MLDSA_LEGACY_SIZE_ASSERT(LEGACY, CANONICAL) \
-    wc_static_assert(LEGACY == CANONICAL)
+    wc_static_assert((LEGACY) == (CANONICAL))
 
 /* LEVEL2 = ML-DSA-44 */
 MLDSA_LEGACY_SIZE_ASSERT(ML_DSA_LEVEL2_KEY_SIZE,           WC_MLDSA_44_KEY_SIZE);
diff --git a/wolfssl/wolfcrypt/wc_mldsa.h b/wolfssl/wolfcrypt/wc_mldsa.h
index 56c612ee0c..58a94bd771 100644
--- a/wolfssl/wolfcrypt/wc_mldsa.h
+++ b/wolfssl/wolfcrypt/wc_mldsa.h
@@ -54,6 +54,13 @@
     #include <wolfssl/wolfcrypt/cryptocb.h>
 #endif
 
+/* When WOLFSSL_MLDSA_FIPS204_DRAFT is enabled the legacy (pre-FIPS 204)
+ * no-context sign/verify API is required to handle draft-format signatures. */
+#if defined(WOLFSSL_MLDSA_FIPS204_DRAFT) && \
+    !defined(WOLFSSL_MLDSA_NO_CTX)
+    #define WOLFSSL_MLDSA_NO_CTX
+#endif
+
 /* TEMPORARY: pull in the legacy compatibility shim so its forward-arm
  * sub-config gate translation (legacy WOLFSSL_DILITHIUM_* /
  * WC_DILITHIUM_* -> canonical WOLFSSL_MLDSA_* / WC_MLDSA_*) and the
@@ -684,13 +691,6 @@ struct wc_MlDsaKey {
 #endif
 #endif
 
-/* When WOLFSSL_MLDSA_FIPS204_DRAFT is enabled the legacy (pre-FIPS 204)
- * no-context sign/verify API is required to handle draft-format signatures. */
-#if defined(WOLFSSL_MLDSA_FIPS204_DRAFT) && \
-    !defined(WOLFSSL_MLDSA_NO_CTX)
-    #define WOLFSSL_MLDSA_NO_CTX
-#endif
-
 /* Functions */
 
 #ifndef WOLFSSL_MLDSA_VERIFY_ONLY