diff --git a/modules/mbedtls/Kconfig b/modules/mbedtls/Kconfig
index 80435e32994..d15c420f507 100644
--- a/modules/mbedtls/Kconfig
+++ b/modules/mbedtls/Kconfig
@@ -186,11 +186,12 @@ config MBEDTLS_ENABLE_HEAP
 	  in mbedtls. If this is enabled, and MBEDTLS_INIT is enabled then the
 	  Zephyr will, during the device startup, initialize the heap automatically.
 
+if MBEDTLS_ENABLE_HEAP
+
 config MBEDTLS_HEAP_SIZE
 	int "Heap size for mbed TLS"
 	default 10240 if OPENTHREAD_COMMISSIONER || OPENTHREAD_JOINER
 	default 512
-	depends on MBEDTLS_ENABLE_HEAP
 	help
 	  The mbedtls routines will use this heap if enabled.
 	  See ext/lib/crypto/mbedtls/include/mbedtls/config.h and
@@ -202,6 +203,15 @@ config MBEDTLS_HEAP_SIZE
 	  be needed. For some dedicated and specific usage of mbedtls API, the
 	  1000 bytes might be ok.
 
+config MBEDTLS_HEAP_CUSTOM_SECTION
+	bool "Use a custom section for the Mbed TLS heap"
+	help
+	  Place Mbed TLS heap in custom section, with tag ".mbedtls_heap".
+	  This can be used by custom linker scripts to relocate the Mbed TLS
+	  heap to a custom location, such as another SRAM region or external memory.
+
+endif # MBEDTLS_ENABLE_HEAP
+
 config MBEDTLS_INIT
 	bool "Initialize mbed TLS at boot"
 	default y
diff --git a/modules/mbedtls/zephyr_init.c b/modules/mbedtls/zephyr_init.c
index 1d7d3b40b76..7bc20497ecb 100644
--- a/modules/mbedtls/zephyr_init.c
+++ b/modules/mbedtls/zephyr_init.c
@@ -29,12 +29,12 @@
 	defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
 #include <mbedtls/memory_buffer_alloc.h>
 
-#if !defined(CONFIG_MBEDTLS_HEAP_SIZE)
-#error "Please set heap size to be used. Set value to CONFIG_MBEDTLS_HEAP_SIZE \
-option."
-#endif
-
-static unsigned char _mbedtls_heap[CONFIG_MBEDTLS_HEAP_SIZE];
+#ifdef CONFIG_MBEDTLS_HEAP_CUSTOM_SECTION
+#define HEAP_MEM_ATTRIBUTES Z_GENERIC_SECTION(.mbedtls_heap)
+#else
+#define HEAP_MEM_ATTRIBUTES
+#endif /* CONFIG_MBEDTLS_HEAP_CUSTOM_SECTION */
+static unsigned char _mbedtls_heap[CONFIG_MBEDTLS_HEAP_SIZE] HEAP_MEM_ATTRIBUTES;
 
 static void init_heap(void)
 {