diff --git a/meta-arm/recipes-bsp/scp-firmware/files/optee-private-includes.patch b/meta-arm/recipes-bsp/scp-firmware/files/optee-private-includes.patch
new file mode 100644
index 00000000..c2d86022
--- /dev/null
+++ b/meta-arm/recipes-bsp/scp-firmware/files/optee-private-includes.patch
@@ -0,0 +1,34 @@
+Change the optee module includes to be private instead of public, so they don't get used
+in every build, which can result in compile failures as /core/include/ doesn't exit.
+
+For some reason this behaviour isn't deterministic, a ticket has been filed with upstream.
+
+Upstream-Status: Pending
+Signed-off-by: Ross Burton <ross.burton@arm.com>
+
+diff --git a/module/optee/console/CMakeLists.txt b/module/optee/console/CMakeLists.txt
+index aebb7cc79..942aa98c8 100644
+--- a/module/optee/console/CMakeLists.txt
++++ b/module/optee/console/CMakeLists.txt
+@@ -14,7 +14,7 @@ target_include_directories(${SCP_MODULE_TARGET}
+ # Those includes are needed for mutex definitnion that is used in optee_smt
+ # notification
+ target_include_directories(${SCP_MODULE_TARGET}
+-                           PUBLIC "${SCP_OPTEE_DIR}/core/arch/arm/include/"
++                           PRIVATE "${SCP_OPTEE_DIR}/core/arch/arm/include/"
+                                   "${SCP_OPTEE_DIR}/core/include/"
+                                   "${SCP_OPTEE_DIR}/lib/libutils/ext/include/"
+                                   "${SCP_OPTEE_DIR}/lib/libutee/include/")
+diff --git a/module/optee/mbx/CMakeLists.txt b/module/optee/mbx/CMakeLists.txt
+index 305fa42b7..783a7970c 100644
+--- a/module/optee/mbx/CMakeLists.txt
++++ b/module/optee/mbx/CMakeLists.txt
+@@ -15,7 +15,7 @@ target_include_directories(${SCP_MODULE_TARGET}
+ # Those includes are needed for mutex defifitnion that is used in optee_smt
+ # notification
+ target_include_directories(${SCP_MODULE_TARGET}
+-                           PUBLIC "${SCP_OPTEE_DIR}/core/include/"
++                           PRIVATE "${SCP_OPTEE_DIR}/core/include/"
+                                   "${SCP_OPTEE_DIR}/lib/libutils/ext/include/"
+                                   "${SCP_OPTEE_DIR}/lib/libutee/include/")
+ 
diff --git a/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.12.0.bb b/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.12.0.bb
index 25cd1dcd..58482cd3 100644
--- a/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.12.0.bb
+++ b/meta-arm/recipes-bsp/scp-firmware/scp-firmware_2.12.0.bb
@@ -7,9 +7,10 @@ LIC_FILES_CHKSUM = "file://license.md;beginline=5;md5=9db9e3d2fb8d9300a6c3d15101
                     file://contrib/cmsis/git/LICENSE.txt;md5=e3fc50a88d0a364313df4b21ef20c29e"
 
 SRC_URI_SCP_FIRMWARE ?= "gitsm://github.com/ARM-software/SCP-firmware.git;protocol=https"
-SRC_URI = "${SRC_URI_SCP_FIRMWARE};branch=${SRCBRANCH}"
-SRCBRANCH = "master"
+SRC_URI = "${SRC_URI_SCP_FIRMWARE};branch=${SRCBRANCH} \
+           file://optee-private-includes.patch"
 
+SRCBRANCH = "master"
 SRCREV  = "0c7236b1851d90124210a0414fd982dc55322c7c"
 
 PROVIDES += "virtual/control-processor-firmware"