diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc0/sp_layout.json b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc0/sp_layout.json
new file mode 100644
index 00000000..d0a4078e
--- /dev/null
+++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/files/tc0/sp_layout.json
@@ -0,0 +1,16 @@
+{
+	"secure-storage" : {
+		"image": "secure-storage.bin",
+		"pm": "secure-storage.dts"
+	},
+
+	"crypto" : {
+		"image": "crypto-sp.bin",
+		"pm": "crypto.dts"
+	},
+
+	"op-tee" : {
+		"image": "tee-pager_v2.bin",
+		"pm": "optee_manifest.dts"
+	}
+}
diff --git a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc
index bd35296e..ecfeed79 100644
--- a/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc
+++ b/meta-arm-bsp/recipes-bsp/trusted-firmware-a/trusted-firmware-a-tc0.inc
@@ -27,12 +27,24 @@ TFA_DEBUG = "1"
 TFA_SPD = "spmd"
 TFA_SPMD_SPM_AT_SEL2 = "1"
 
-# Set optee as SP. Set spmc manifest and sp layout file to optee
-DEPENDS += "optee-os"
+# Set optee, crypto-sp and secure-storage as the SP.
+# Set spmc manifest and sp layout file to match.
+DEPENDS += "optee-os crypto-sp secure-storage"
+SRC_URI_append = " file://sp_layout.json;subdir=sp_layout"
 
-TFA_SP_LAYOUT_FILE = "${RECIPE_SYSROOT}/lib/firmware/sp_layout.json"
-TFA_ARM_SPMC_MANIFEST_DTS = "plat/arm/board/tc0/fdts/tc0_spmc_optee_sp_manifest.dts"
+TFA_SP_LAYOUT_FILE = "${WORKDIR}/sp_layout/sp_layout.json"
+TFA_ARM_SPMC_MANIFEST_DTS = "plat/arm/board/tc0/fdts/tc0_spmc_ts_optee_sp_manifest.dts"
 
 EXTRA_OEMAKE += "SCP_BL2=${RECIPE_SYSROOT}/firmware/scp_ramfw.bin"
 EXTRA_OEMAKE += "TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 ARM_ROTPK_LOCATION=devel_rsa \
                      ROT_KEY=plat/arm/board/common/rotpk/arm_rotprivk_rsa.pem"
+
+do_compile_prepend() {
+    cp -t ${WORKDIR}/sp_layout \
+        ${RECIPE_SYSROOT}/${nonarch_base_libdir}/firmware/tee-pager_v2.bin \
+        ${RECIPE_SYSROOT}/${nonarch_base_libdir}/firmware/optee_manifest.dts \
+        ${RECIPE_SYSROOT}/firmware/secure-storage.bin \
+        ${RECIPE_SYSROOT}/firmware/secure-storage.dts \
+        ${RECIPE_SYSROOT}/firmware/crypto-sp.bin \
+        ${RECIPE_SYSROOT}/firmware/crypto.dts
+}