diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json
index 3d6ba63d48d..e19e49a41ab 100644
--- a/.github/configs/os-check-linux.json
+++ b/.github/configs/os-check-linux.json
@@ -321,6 +321,13 @@
 {"name": "rng-seed-device-fallback", "minutes": 1.1,
  "comment": "Nominated seed device that cannot be opened, so every test runs through the fallback to the default seed sources.",
  "configure": ["--with-rng-seed-device=/nonexistent/hwrng"]},
+{"name": "rng-custom-block-hashdrbg", "minutes": 1.0,
+ "comment": "fwTPM defines CUSTOM_RAND_GENERATE_BLOCK while HAVE_HASHDRBG remains enabled. Keep the custom RNG bypass buildable when both macros are present.",
+ "user_settings": "IDE/m33mu-falcon-verify/user_settings.h",
+ "configure": ["--enable-usersettings", "--disable-examples",
+  "--disable-crypttests", "--disable-shared",
+  "CPPFLAGS=-DWOLFCRYPT_ONLY -DHAVE_HASHDRBG -DWC_RESEED_INTERVAL=1000000 -DWOLFSSL_NO_GETPID"],
+ "check": false},
 {"name": "no-server-no-client-auth", "minutes": 1.0,
  "configure": ["CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_CLIENT_AUTH"]},
 {"name": "no-wolfssl-client", "minutes": 1.0,
diff --git a/wolfcrypt/src/random.c b/wolfcrypt/src/random.c
index b41e35ce562..48ebb28a32f 100644
--- a/wolfcrypt/src/random.c
+++ b/wolfcrypt/src/random.c
@@ -3107,7 +3107,8 @@ static WARN_UNUSED_RESULT int _InitRng(WC_RNG* rng,
             rng->flags &= ~WC_RNG_FLAG_FULL_MUTEX;
         }
     #endif
-    #if defined(HAVE_HASHDRBG) && !defined(NO_SHA256)
+    #if defined(HAVE_HASHDRBG) && !defined(CUSTOM_RAND_GENERATE_BLOCK)
+    #ifndef NO_SHA256
         if (rng->drbgType == WC_DRBG_SHA256) {
             if (drbg_instantiated) {
                 (void)Hash_DRBG_Uninstantiate(
@@ -3128,8 +3129,8 @@ static WARN_UNUSED_RESULT int _InitRng(WC_RNG* rng,
             rng->drbg_scratch = NULL;
             #endif /* WOLFSSL_SMALL_STACK_CACHE */
         }
-    #endif /* HAVE_HASHDRBG && !NO_SHA256 */
-    #if defined(HAVE_HASHDRBG) && defined(WOLFSSL_DRBG_SHA512)
+    #endif /* !NO_SHA256 */
+    #ifdef WOLFSSL_DRBG_SHA512
         if (rng->drbgType == WC_DRBG_SHA512) {
             if (drbg_instantiated) {
                 (void)Hash512_DRBG_Uninstantiate(
@@ -3149,11 +3150,12 @@ static WARN_UNUSED_RESULT int _InitRng(WC_RNG* rng,
             rng->drbg512_scratch = NULL;
             #endif /* WOLFSSL_SMALL_STACK_CACHE */
         }
-    #endif /* HAVE_HASHDRBG && WOLFSSL_DRBG_SHA512 */
+    #endif /* WOLFSSL_DRBG_SHA512 */
     #ifdef WOLFSSL_SMALL_STACK_CACHE
         XFREE(rng->newSeed_buf, rng->heap, DYNAMIC_TYPE_SEED);
         rng->newSeed_buf = NULL;
     #endif
+    #endif /* HAVE_HASHDRBG && !CUSTOM_RAND_GENERATE_BLOCK */
     }
 
     return ret;