diff --git a/boot/optee-os/Config.in b/boot/optee-os/Config.in
index ea16550b72..b998228121 100644
--- a/boot/optee-os/Config.in
+++ b/boot/optee-os/Config.in
@@ -61,6 +61,15 @@ config BR2_TARGET_OPTEE_OS_NEEDS_DTC
 	  Select this option if your OP-TEE OS platform configuration
 	  requires the Device Tree compiler to be available.
 
+config BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY
+	bool "OP-TEE OS needs host-python-cryptography"
+	depends on BR2_PACKAGE_HOST_RUSTC_ARCH_SUPPORTS
+	help
+	  OP-TEE OS version below 3.16 used python-pycryptodomex
+	  package in python scripts. Newer version uses
+	  python-cryptography. Select this option if optee-os needs
+	  python-cryptography to be built.
+
 config BR2_TARGET_OPTEE_OS_CORE
 	bool "Build core"
 	default y
diff --git a/boot/optee-os/optee-os.mk b/boot/optee-os/optee-os.mk
index 9f76d8450e..5313a1badc 100644
--- a/boot/optee-os/optee-os.mk
+++ b/boot/optee-os/optee-os.mk
@@ -21,7 +21,13 @@ else
 OPTEE_OS_SITE = $(call github,OP-TEE,optee_os,$(OPTEE_OS_VERSION))
 endif
 
-OPTEE_OS_DEPENDENCIES = host-openssl host-python3 host-python-pycryptodomex host-python-pyelftools
+OPTEE_OS_DEPENDENCIES = host-openssl host-python3 host-python-pyelftools
+
+ifeq ($(BR2_TARGET_OPTEE_OS_NEEDS_PYTHON_CRYPTOGRAPHY),y)
+OPTEE_OS_DEPENDENCIES += host-python-cryptography
+else
+OPTEE_OS_DEPENDENCIES += host-python-pycryptodomex
+endif
 
 ifeq ($(BR2_TARGET_OPTEE_OS_NEEDS_DTC),y)
 OPTEE_OS_DEPENDENCIES += host-dtc