diff --git a/test-refactor/client-server/wh_test_crypto_ecc.c b/test-refactor/client-server/wh_test_crypto_ecc.c
index 7d3eeccbe..5371799f9 100644
--- a/test-refactor/client-server/wh_test_crypto_ecc.c
+++ b/test-refactor/client-server/wh_test_crypto_ecc.c
@@ -683,7 +683,12 @@ static int _whTest_CryptoEccMakeCacheKeyArgs(whClientContext* ctx)
     return ret;
 }
 
-#if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
+#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) || defined(WOLF_CRYPTO_CB_FIND)
+#define WH_TEST_ECC_LOCAL_KEYGEN
+#endif
+
+#if defined(WH_TEST_ECC_LOCAL_KEYGEN) && \
+    (!defined(NO_ECC_MAKE_PUB) || defined(HAVE_ECC_CHECK_KEY))
 
 /* Build a private-key-only ECC key bound to devId, along with a locally
  * generated reference keypair holding the public point it must derive to. */
@@ -721,6 +726,10 @@ static int whTest_MakePrivOnlyEccKey(int devId, WC_RNG* rng, ecc_key* refKey,
     return ret;
 }
 
+#endif /* WH_TEST_ECC_LOCAL_KEYGEN && \
+          (!NO_ECC_MAKE_PUB || HAVE_ECC_CHECK_KEY) */
+
+#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
 /* Compare an ecc_point against the public point of key */
 static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key)
 {
@@ -1030,8 +1039,9 @@ static int _whTest_CryptoEccMakePub(whClientContext* ctx)
     }
     return ret;
 }
+#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */
 
-#ifdef HAVE_ECC_CHECK_KEY
+#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
 /* Exercise WC_PK_TYPE_EC_CHECK_PUB_KEY: a private-only key, a full keypair, and
  * a keypair whose public point does not belong to its private scalar. */
 static int _whTest_CryptoEccCheckPubKey(whClientContext* ctx)
@@ -1219,9 +1229,7 @@ static int _whTest_CryptoEccCheckPubKey(whClientContext* ctx)
     }
     return ret;
 }
-#endif /* HAVE_ECC_CHECK_KEY */
-
-#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */
+#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */
 
 #if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
 
@@ -2420,11 +2428,13 @@ int whTest_Crypto_Ecc(whClientContext* ctx)
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccExportPublicKey(ctx));
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCacheKeyAndExportPublic(ctx));
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccMakeCacheKeyArgs(ctx));
-#if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
+#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccMakePub(ctx));
-#ifdef HAVE_ECC_CHECK_KEY
+#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */
+#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCheckPubKey(ctx));
-#endif /* HAVE_ECC_CHECK_KEY */
+#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */
+#if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccCrossVerify(ctx));
     WH_TEST_RETURN_ON_FAIL(_whTest_CryptoEccAsync(ctx));
 #endif /* !WOLF_CRYPTO_CB_ONLY_ECC */
diff --git a/test/wh_test_crypto.c b/test/wh_test_crypto.c
index 35aca8cac..30f0d535a 100644
--- a/test/wh_test_crypto.c
+++ b/test/wh_test_crypto.c
@@ -1912,7 +1912,16 @@ static int whTest_CryptoEcc(whClientContext* ctx, int devId, WC_RNG* rng)
     return ret;
 }
 
-#if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
+/* The make-pub and check-pub tests build their reference keys with software
+ * keygen on INVALID_DEVID keys. A callback-only client can only do that when
+ * a find callback routes the key to a device. */
+#if !defined(WOLF_CRYPTO_CB_ONLY_ECC) || defined(WOLF_CRYPTO_CB_FIND)
+#define WH_TEST_ECC_LOCAL_KEYGEN
+#endif
+
+#if defined(WH_TEST_ECC_LOCAL_KEYGEN) &&                         \
+    (!defined(NO_ECC_MAKE_PUB) || defined(HAVE_ECC_CHECK_KEY) || \
+     defined(WOLFHSM_CFG_DMA))
 
 /* Build a private-key-only ECC key bound to devId, along with a locally
  * generated reference keypair holding the public point it must derive to.
@@ -1952,6 +1961,10 @@ static int whTest_MakePrivOnlyEccKey(int devId, WC_RNG* rng, ecc_key* refKey,
     return ret;
 }
 
+#endif /* WH_TEST_ECC_LOCAL_KEYGEN && \
+          (!NO_ECC_MAKE_PUB || HAVE_ECC_CHECK_KEY || WOLFHSM_CFG_DMA) */
+
+#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
 /* Compare an ecc_point against the public point of key */
 static int whTest_EccPointMatchesKey(ecc_point* point, ecc_key* key)
 {
@@ -2251,8 +2264,9 @@ static int whTest_CryptoEccMakePub(whClientContext* ctx, int devId, WC_RNG* rng)
     }
     return ret;
 }
+#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */
 
-#ifdef HAVE_ECC_CHECK_KEY
+#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
 /* Exercise WC_PK_TYPE_EC_CHECK_PUB_KEY: a private-only key, a full keypair, and
  * a keypair whose public point does not belong to its private scalar. */
 static int whTest_CryptoEccCheckPubKey(whClientContext* ctx, int devId,
@@ -2431,9 +2445,7 @@ static int whTest_CryptoEccCheckPubKey(whClientContext* ctx, int devId,
     }
     return ret;
 }
-#endif /* HAVE_ECC_CHECK_KEY */
-
-#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */
+#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */
 
 #ifdef WOLFHSM_CFG_DMA
 /* Generic-transport DMA smoke test: cache an ECC keypair, export the
@@ -2524,11 +2536,11 @@ static int whTest_CryptoEccExportPublicDma(whClientContext* ctx, int devId,
         wc_ecc_free(pubKey);
     }
 
-#if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
+#if defined(WH_TEST_ECC_LOCAL_KEYGEN)
     /* A resident PRIVATE-only key carries no public half, so the DMA public
      * export must derive it on the server first. Mirrors the non-DMA
-     * private-only export covered by whTest_CryptoEccMakePub. Skipped in
-     * CB_ONLY builds along with the software reference-key helper. */
+     * private-only export covered by whTest_CryptoEccMakePub. Skipped when
+     * the client cannot run the software reference-key helper. */
     if (ret == 0) {
         ecc_key refKey[1];
         ecc_key privOnlyKey[1];
@@ -2581,7 +2593,7 @@ static int whTest_CryptoEccExportPublicDma(whClientContext* ctx, int devId,
 #else
     /* devId is only consumed by the private-only sub-test above */
     (void)devId;
-#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */
+#endif /* WH_TEST_ECC_LOCAL_KEYGEN */
 
     if (!WH_KEYID_ISERASED(keyId)) {
         (void)wh_Client_KeyEvict(ctx, keyId);
@@ -18897,16 +18909,16 @@ int whTest_CryptoClientConfig(whClientConfig* config)
     if (ret == 0) {
         ret = whTest_CryptoEccCacheDuplicate(client);
     }
-#if !defined(WOLF_CRYPTO_CB_ONLY_ECC)
+#if !defined(NO_ECC_MAKE_PUB) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
     if (ret == 0) {
         ret = whTest_CryptoEccMakePub(client, WH_CLIENT_DEVID(client), rng);
     }
-#ifdef HAVE_ECC_CHECK_KEY
+#endif /* !NO_ECC_MAKE_PUB && WH_TEST_ECC_LOCAL_KEYGEN */
+#if defined(HAVE_ECC_CHECK_KEY) && defined(WH_TEST_ECC_LOCAL_KEYGEN)
     if (ret == 0) {
         ret = whTest_CryptoEccCheckPubKey(client, WH_CLIENT_DEVID(client), rng);
     }
-#endif /* HAVE_ECC_CHECK_KEY */
-#endif /* !WOLF_CRYPTO_CB_ONLY_ECC */
+#endif /* HAVE_ECC_CHECK_KEY && WH_TEST_ECC_LOCAL_KEYGEN */
 #if defined(HAVE_ECC_SIGN) && defined(HAVE_ECC_VERIFY) && \
     !defined(WOLF_CRYPTO_CB_ONLY_ECC)
     if (ret == 0) {