diff --git a/examples/client/client.c b/examples/client/client.c
index 16c40612290..abcbecb42e9 100644
--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -3465,6 +3465,12 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
         err_sys("unable to load static memory");
     }
 
+#if defined(WOLFSSL_NO_MALLOC) && !defined(NO_MAIN_DRIVER)
+    /* only the standalone program may publish a pool of its own */
+    if (wolfSSL_GetGlobalHeapHint() == NULL)
+        wolfSSL_SetGlobalHeapHint(heap);
+#endif
+
 #if defined(WOLFSSL_STATIC_MEMORY) && \
     defined(WOLFSSL_STATIC_MEMORY_DEBUG_CALLBACK)
     wolfSSL_SetDebugMemoryCb(ExampleDebugMemoryCb);
@@ -5156,6 +5162,13 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
     (void) useVerifyCb;
     (void) customVerifyCert;
 
+#if defined(WOLFSSL_STATIC_MEMORY) && defined(WOLFSSL_NO_MALLOC) && \
+    !defined(NO_MAIN_DRIVER)
+    /* the pool backing the hint is on this function's stack */
+    if (wolfSSL_GetGlobalHeapHint() == (void*)heap)
+        wolfSSL_SetGlobalHeapHint(NULL);
+#endif
+
     WOLFSSL_RETURN_FROM_THREAD(0);
 }
 
diff --git a/examples/server/server.c b/examples/server/server.c
index 41ada9fc131..617f78214c0 100644
--- a/examples/server/server.c
+++ b/examples/server/server.c
@@ -1835,6 +1835,7 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
         WOLFSSL_MEM_STATS mem_stats;
     #endif
     #endif
+    WOLFSSL_HEAP_HINT *heap = NULL;
 #endif
 #if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES)
     int onlyKeyShare = 0;
@@ -2826,9 +2827,19 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
                                                   WOLFMEM_IO_POOL_FIXED));
     #endif /* DEBUG_WOLFSSL */
 
-    if (wolfSSL_CTX_load_static_memory(&ctx, method, memory, sizeof(memory),0,1)
-            != WOLFSSL_SUCCESS)
-        err_sys_ex(catastrophic, "unable to load static memory and create ctx");
+    if (wc_LoadStaticMemory(&heap, memory, sizeof(memory), 0, 1) != 0)
+        err_sys_ex(catastrophic, "unable to load static memory");
+
+#if defined(WOLFSSL_NO_MALLOC) && !defined(NO_MAIN_DRIVER)
+    /* only the standalone program may publish a pool of its own */
+    if (wolfSSL_GetGlobalHeapHint() == NULL)
+        wolfSSL_SetGlobalHeapHint(heap);
+#endif
+
+    if (method != NULL)
+        ctx = wolfSSL_CTX_new_ex(method(heap), heap);
+    if (ctx == NULL)
+        err_sys_ex(catastrophic, "unable to get ctx");
 
     /* load in a buffer for IO */
     if (wolfSSL_CTX_load_static_memory(&ctx, NULL, memoryIO, sizeof(memoryIO),
@@ -4249,6 +4260,13 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
 #if defined(WOLFSSL_CALLBACKS) && defined(WOLFSSL_EARLY_DATA)
     (void) earlyData;
 #endif
+#if defined(WOLFSSL_STATIC_MEMORY) && defined(WOLFSSL_NO_MALLOC) && \
+    !defined(NO_MAIN_DRIVER)
+    /* the pool backing the hint is on this function's stack */
+    if (wolfSSL_GetGlobalHeapHint() == (void*)heap)
+        wolfSSL_SetGlobalHeapHint(NULL);
+#endif
+
     WOLFSSL_RETURN_FROM_THREAD(0);
 }
 
diff --git a/tests/unit-mcdc/test_asn_ext_whitebox.c b/tests/unit-mcdc/test_asn_ext_whitebox.c
index c93822ea588..de9731d6e26 100644
--- a/tests/unit-mcdc/test_asn_ext_whitebox.c
+++ b/tests/unit-mcdc/test_asn_ext_whitebox.c
@@ -2737,7 +2737,7 @@ static void wb_decode_cert_req_version(void) { WB_NOTE("WOLFSSL_CERT_REQ off; sk
  * Section 26: ParseCert() RSA public key store [:23263-:23267]
  * (best-effort -- see file-header RESIDUAL note for operands 2/3).
  * ------------------------------------------------------------------------- */
-#if (!defined(WOLFSSL_NO_MALLOC) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
+#if (!defined(WC_ASN_NO_HEAP) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
     defined(WOLFSSL_DYN_CERT)
 static void wb_parse_cert_rsa_pubkey(void)
 {
@@ -2761,7 +2761,7 @@ static void wb_parse_cert_rsa_pubkey(void)
     FreeDecodedCert(&cert);
 }
 #else
-static void wb_parse_cert_rsa_pubkey(void) { WB_NOTE("WOLFSSL_NO_MALLOC build; ParseCert copy-out skipped"); }
+static void wb_parse_cert_rsa_pubkey(void) { WB_NOTE("WC_ASN_NO_HEAP build; ParseCert copy-out skipped"); }
 #endif
 
 /* ------------------------------------------------------------------------- *
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 03dabdf94a9..626ed332c6d 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -24080,7 +24080,7 @@ static int DecodeCertReq(DecodedCert* cert, int* criticalExt)
 int ParseCert(DecodedCert* cert, int type, int verify, void* cm)
 {
     int   ret;
-#if (!defined(WOLFSSL_NO_MALLOC) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
+#if (!defined(WC_ASN_NO_HEAP) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
     defined(WOLFSSL_DYN_CERT)
     char* ptr;
 #endif
@@ -24089,9 +24089,9 @@ int ParseCert(DecodedCert* cert, int type, int verify, void* cm)
     if (ret < 0)
         return ret;
 
-#if (!defined(WOLFSSL_NO_MALLOC) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
+#if (!defined(WC_ASN_NO_HEAP) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
     defined(WOLFSSL_DYN_CERT)
-    /* cert->subjectCN not stored as copy of WOLFSSL_NO_MALLOC defined */
+    /* cert->subjectCN not stored as a copy when there is no allocator */
     if (cert->subjectCNLen > 0) {
         ptr = (char*)XMALLOC((size_t)cert->subjectCNLen + 1, cert->heap,
                               DYNAMIC_TYPE_SUBJECT_CN);
@@ -24104,9 +24104,12 @@ int ParseCert(DecodedCert* cert, int type, int verify, void* cm)
     }
 #endif
 
-#if (!defined(WOLFSSL_NO_MALLOC) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
+/* WC_ASN_NO_HEAP, not WOLFSSL_NO_MALLOC: a static-memory build defines the
+ * latter but still has an allocator, and StoreKey() copies the non-RSA keys
+ * on the same condition. Skipping the copy here leaves Signer.publicKey NULL,
+ * so every chain verify under an RSA CA fails BAD_FUNC_ARG. */
+#if (!defined(WC_ASN_NO_HEAP) && !defined(NO_WOLFSSL_CM_VERIFY)) || \
     defined(WOLFSSL_DYN_CERT)
-    /* cert->publicKey not stored as copy if WOLFSSL_NO_MALLOC defined */
     if ((cert->keyOID == RSAk
     #ifdef WC_RSA_PSS
          || cert->keyOID == RSAPSSk
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index e4407f710d8..c5d41b4abfc 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -1529,6 +1529,11 @@ static WC_MAYBE_UNUSED Aes* test_AesGcmNew(void* heap, int declaredDevId,
         #else
             static byte gTestMemory[576*1024];  /* ML-DSA full mem */
         #endif
+    #elif defined(WOLFSSL_NO_MALLOC) && defined(OPENSSL_EXTRA) && \
+          !defined(BENCH_EMBEDDED)
+        /* No malloc, so the compatibility layer's NULL-heap allocations come
+         * out of this pool as well, not the system heap. */
+        static byte gTestMemory[1024*1024];
     #elif defined(BENCH_EMBEDDED)
         static byte gTestMemory[14000];
     #elif defined(WOLFSSL_CERT_EXT)
@@ -2354,7 +2359,7 @@ options: [-s max_relative_stack_bytes] [-m max_relative_heap_memory_bytes]\n\
         printf("unable to load static memory.\n");
         EXIT_TEST(EXIT_FAILURE);
     }
-    #ifndef OPENSSL_EXTRA
+    #if !defined(OPENSSL_EXTRA) || defined(WOLFSSL_NO_MALLOC)
     wolfSSL_SetGlobalHeapHint(HEAP_HINT);
     #endif
 #endif
@@ -29695,6 +29700,15 @@ static wc_test_ret_t cert_no_malloc_test(void)
             ret = WC_TEST_RET_ENC_NC;
         }
     }
+#else
+    /* With an allocator the RSA key is copied out, so a Signer built from this
+     * cert keeps a public key of its own. */
+    if ((ret == 0) && ((cert.pubKeyStored != 1) ||
+                       (((wc_ptr_t)cert.publicKey >= (wc_ptr_t)cert.source) &&
+                        ((wc_ptr_t)cert.publicKey <
+                            (wc_ptr_t)cert.source + cert.maxIdx)))) {
+        ret = WC_TEST_RET_ENC_NC;
+    }
 #endif
     FreeDecodedCert(&cert);
 #endif