diff --git a/.github/workflows/README.md b/.github/workflows/README.md
index 463e3a85..498f4bd3 100644
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -7,7 +7,7 @@ full M33MU emulator matrix, which runs on every pull request (and nightly).
 
 | Tier | Trigger | Purpose |
 |------|---------|---------|
-| **Fast (per-PR)** | every PR; push to master/main/dev/churn | host unit suites (one check each), Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
+| **Fast (per-PR)** | every PR; push to master/main/dev/churn | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
 | **M33MU matrix** | every PR; push to master/main/wolfTrust-dev; `cron: 0 8 * * *`; `workflow_dispatch` | full M33MU emulator matrix (see below) |
 
 The M33MU workflow (`m33mu.yml`) runs the full matrix on every pull request,
diff --git a/.github/workflows/c99-compliance.yml b/.github/workflows/c99-compliance.yml
new file mode 100644
index 00000000..cd89ccd2
--- /dev/null
+++ b/.github/workflows/c99-compliance.yml
@@ -0,0 +1,34 @@
+name: C99 Compliance
+
+on:
+  push:
+    branches: [master, main, 'release/**', wolfTrust-dev, wolftfm-l3, wolfpsa-v5.9.1-ci]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  c99-check:
+    name: ISO C99 (${{ matrix.cc }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        cc: [gcc, clang]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize test dependencies
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git config --global url."https://github.com/".insteadOf git@github.com:
+          git submodule update --init --recursive
+      - name: Build and run existing host suites as ISO C99
+        run: make c99-check CC=${{ matrix.cc }}
diff --git a/.github/workflows/empty-brace-scan.yml b/.github/workflows/empty-brace-scan.yml
new file mode 100644
index 00000000..c8697b73
--- /dev/null
+++ b/.github/workflows/empty-brace-scan.yml
@@ -0,0 +1,21 @@
+name: Empty Brace Scope Scan
+
+on:
+  push:
+    branches: [master, main, 'release/**', wolfTrust-dev, wolftfm-l3, wolfpsa-v5.9.1-ci]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  empty-brace-scan:
+    name: Empty Brace Scope Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for bare C scope blocks
+        run: python3 scripts/check-empty-brace-scopes.py
diff --git a/.github/workflows/house-style.yml b/.github/workflows/house-style.yml
new file mode 100644
index 00000000..47e28136
--- /dev/null
+++ b/.github/workflows/house-style.yml
@@ -0,0 +1,21 @@
+name: House Style
+
+on:
+  push:
+    branches: [master, main, 'release/**', wolfTrust-dev, wolftfm-l3, wolfpsa-v5.9.1-ci]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  house-style:
+    name: C house-style conventions
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check structured control flow and source conventions
+        run: sh scripts/check_house_style.sh
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index e0564367..ad1f5499 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -10,6 +10,15 @@ permissions:
   issues: write
 
 jobs:
+  c99:
+    uses: ./.github/workflows/c99-compliance.yml
+
+  house-style:
+    uses: ./.github/workflows/house-style.yml
+
+  empty-brace-scan:
+    uses: ./.github/workflows/empty-brace-scan.yml
+
   unit:
     uses: ./.github/workflows/unit-tests.yml
 
diff --git a/Makefile b/Makefile
index cd8d8848..2f20f808 100644
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ include mk/common.mk
 
 .DEFAULT_GOAL := all
 
-.PHONY: all secure-image size-report test test-conformance test-target test-hardware fetch-psa-ff-tests \
+.PHONY: all secure-image size-report test c99-check test-conformance test-target test-hardware fetch-psa-ff-tests \
 		clean firmware-stm32h563 run-stm32h563 run-stm32h563-tui run-stm32h563-uarts \
 		test-domain-host test-domain-compilers test-domain-sanitize \
 		test-domain-valgrind test-manifest-host test-manifest-compilers \
@@ -42,6 +42,25 @@ all: $(ARCH_DEFAULT_GOALS)
 test:
 	@$(MAKE) --no-print-directory -C tests/host test
 
+C99_CFLAGS := -std=c99 -pedantic-errors -Werror=vla \
+	-D_POSIX_C_SOURCE=200809L
+C99_CC_VERSION := $(shell $(CC) --version 2>/dev/null)
+ifneq ($(findstring clang,$(C99_CC_VERSION)),)
+C99_CFLAGS += -Wno-newline-eof \
+	--system-header-prefix=wolfssl/ \
+	--system-header-prefix=wolfhsm/
+else
+C99_CFLAGS += -isystem $(abspath $(WOLFSSL_DIR)) \
+	-isystem $(abspath $(WOLFHSM_DIR))
+endif
+
+c99-check:
+	@CC="$(CC)" sh tests/c99/check.sh
+	@$(MAKE) --no-print-directory -C tests/host test \
+		TEST_KIND=c99 CC="$(CC)" \
+		BUILD_ROOT="$(abspath $(BUILD_DIR))/c99" \
+		EXTRA_CFLAGS="$(C99_CFLAGS)"
+
 # FF-M target-only scenarios (partition restart, cross-domain isolation) that
 # need a real Cortex-M execution model. Separate from `make test` (host-only),
 # like `make test-conformance`. Auto-detect an M33MU emulator (or set
diff --git a/docs/Coding-Standard.md b/docs/Coding-Standard.md
new file mode 100644
index 00000000..c394c0d6
--- /dev/null
+++ b/docs/Coding-Standard.md
@@ -0,0 +1,40 @@
+# C Coding Standard
+
+wolfTrust adheres to the wolfSSL coding standards and targets ISO C99, with
+project-specific no-`goto` and no-standalone-scope rules. The aim is to keep
+the code straightforward to assess in a future MISRA C:2023 or DO-178 process.
+These checks improve readiness; they are not a claim of MISRA compliance or
+certification evidence.
+
+## Required rules
+
+- Compile project C as ISO C99. Variable-length arrays are prohibited.
+- Do not use `goto`. Use structured control flow and status-gated fallthrough
+  cleanup.
+- Do not use standalone brace blocks solely to shorten a variable's lifetime.
+- Use C comments (`/* ... */`), spaces in core source, and no trailing
+  whitespace. Preserve existing section-banner style when editing nearby code.
+- Explicitly erase sensitive buffers that must be cleared. Existing secure-
+  erasure routines use volatile byte writes; record that approach as a
+  deviation in any formal MISRA compliance plan.
+- Use `WT_STATIC_ASSERT()` for file-scope compile-time checks; `_Static_assert`
+  is C11 and is not permitted.
+
+Runnable tests follow the no-`goto` and no-standalone-scope rules. Vendored
+submodules keep their upstream coding standards. The pinned wolfHSM callback
+ABI requires anonymous aggregate support in dependency headers; formal
+qualification must record that boundary as a dependency deviation. The strict
+C99 host gate does not compile ARM-only source; target inline assembly and
+compiler intrinsics require separate platform qualification.
+
+## Automated checks
+
+- `sh scripts/check_house_style.sh`
+- `python3 scripts/check-empty-brace-scopes.py`
+- `make c99-check CC=clang` or `make c99-check CC=gcc`
+
+The C99 check first compiles a valid C99 probe and verifies that the compiler
+rejects C11-only syntax and variable-length arrays. It then builds and runs
+the existing host suites with strict C99 flags.
+
+The matching GitHub Actions workflows run these gates on every pull request.
diff --git a/docs/_Sidebar.md b/docs/_Sidebar.md
index cc2bf41f..0f4160f8 100644
--- a/docs/_Sidebar.md
+++ b/docs/_Sidebar.md
@@ -12,5 +12,6 @@
 - [[Porting]]
 - [[Building]]
 - [[Testing]]
+- [[Coding Standard]]
 - [[Project Structure]]
 - [[STM32H5 Guide]]
diff --git a/include/wolftrust/static_assert.h b/include/wolftrust/static_assert.h
new file mode 100644
index 00000000..8933a48a
--- /dev/null
+++ b/include/wolftrust/static_assert.h
@@ -0,0 +1,31 @@
+/* static_assert.h
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfTrust.
+ *
+ * wolfTrust is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfTrust is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef WOLFTRUST_STATIC_ASSERT_H
+#define WOLFTRUST_STATIC_ASSERT_H
+
+/* File-scope compile-time assertion that remains valid under ISO C99. */
+#define WT_STATIC_ASSERT_JOIN_INNER(a, b) a##b
+#define WT_STATIC_ASSERT_JOIN(a, b) WT_STATIC_ASSERT_JOIN_INNER(a, b)
+#define WT_STATIC_ASSERT(condition, message) \
+    typedef char WT_STATIC_ASSERT_JOIN(wt_static_assert_, __LINE__) \
+        [(condition) ? 1 : -1]
+
+#endif /* WOLFTRUST_STATIC_ASSERT_H */
diff --git a/mk/common.mk b/mk/common.mk
index 0d2e7896..3ccd88d0 100644
--- a/mk/common.mk
+++ b/mk/common.mk
@@ -69,7 +69,7 @@ SECURE_CFLAGS_COSE := -I$(WOLFCOSE_DIR)/include \
     -DWOLFCOSE_ENABLE_EAT_PSA_SIGN1_ISSUE
 endif
 
-SECURE_CFLAGS := $(CPU_FLAGS) -ffreestanding -fno-builtin -nostdlib -Os -g \
+SECURE_CFLAGS := $(CPU_FLAGS) -std=c99 -ffreestanding -fno-builtin -nostdlib -Os -g \
     -ffunction-sections -fdata-sections -Wall -Wextra \
     -I$(ROOT)/include -I$(PORT_DIR) \
     -DWT_TIMESLICE_MS=$(WT_TIMESLICE_MS) \
diff --git a/scripts/check-c-comments.py b/scripts/check-c-comments.py
new file mode 100644
index 00000000..f71719a5
--- /dev/null
+++ b/scripts/check-c-comments.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""Find C++ comments in tracked C files without mistaking URLs for comments."""
+
+import subprocess
+import sys
+from pathlib import Path
+
+
+def scan_line(line, in_block, quote):
+    index = 0
+    while index < len(line):
+        if in_block:
+            end = line.find("*/", index)
+            if end < 0:
+                return False, True, quote
+            in_block = False
+            index = end + 2
+        elif quote:
+            if line[index] == "\\":
+                index += 2
+            elif line[index] == quote:
+                quote = None
+                index += 1
+            else:
+                index += 1
+        elif line.startswith("/*", index):
+            in_block = True
+            index += 2
+        elif line.startswith("//", index):
+            return True, in_block, quote
+        elif line[index] in ('"', "'"):
+            quote = line[index]
+            index += 1
+        else:
+            index += 1
+
+    if quote and not line.endswith("\\"):
+        quote = None
+    return False, in_block, quote
+
+
+def main():
+    paths = subprocess.check_output(
+        ["git", "ls-files", "-z", "--", "*.c", "*.h"]
+    ).split(b"\0")
+    found = False
+    for raw_path in filter(None, paths):
+        path = Path(raw_path.decode(sys.getfilesystemencoding()))
+        in_block = False
+        quote = None
+        for number, line in enumerate(
+            path.read_text(encoding="utf-8", errors="replace").splitlines(), 1
+        ):
+            comment, in_block, quote = scan_line(line, in_block, quote)
+            if comment:
+                print(f"{path}:{number}: C++ comment")
+                found = True
+    return 1 if found else 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except (OSError, subprocess.CalledProcessError) as error:
+        print(error, file=sys.stderr)
+        raise SystemExit(2)
diff --git a/scripts/check-empty-brace-scopes.py b/scripts/check-empty-brace-scopes.py
new file mode 100644
index 00000000..b7329cfe
--- /dev/null
+++ b/scripts/check-empty-brace-scopes.py
@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""Reject standalone C scope blocks used only to limit variable lifetime."""
+
+from __future__ import annotations
+
+import os
+import re
+import sys
+from pathlib import Path
+
+
+C_EXTENSIONS = {".c", ".h"}
+SKIP_DIRS = {
+    ".git",
+    ".github",
+    ".dSYM",
+    "__pycache__",
+    "build",
+    "builddir",
+    "cmake-build-debug",
+    "cmake-build-release",
+    "Debug",
+    "Release",
+}
+
+BRACE_LINE = re.compile(r"^\s*\{")
+CONTROL_PREFIX = re.compile(
+    r"^(?:\}\s*)?(?:else\b(?:\s+if\b)?|if\b|for\b|while\b|switch\b|do\b)"
+)
+TYPE_PREFIX = re.compile(r"^(?:typedef\s+)?(?:struct|union|enum)\b")
+
+
+def strip_line_comment(line: str) -> str:
+    """Remove simple // comments without trying to parse C strings."""
+    return line.split("//", 1)[0].strip()
+
+
+def is_comment_only(line: str) -> bool:
+    stripped = line.strip()
+    return (
+        stripped.startswith("/*")
+        or stripped.startswith("*")
+        or stripped == "*/"
+    )
+
+
+def previous_code_line(lines: list[str], index: int) -> tuple[int, str] | None:
+    """Return the previous non-empty, non-preprocessor code line."""
+    for prev_index in range(index - 1, -1, -1):
+        if is_comment_only(lines[prev_index]):
+            continue
+        stripped = strip_line_comment(lines[prev_index])
+        if not stripped:
+            continue
+        if stripped.startswith("#"):
+            continue
+        return prev_index + 1, stripped
+    return None
+
+
+def is_allowed_open_brace(previous: str | None) -> bool:
+    if previous is None:
+        return True
+
+    if CONTROL_PREFIX.match(previous):
+        return True
+    if previous.startswith("case ") or previous.startswith("default:"):
+        return True
+    if TYPE_PREFIX.match(previous) and ";" not in previous:
+        return True
+
+    # Function definitions and multi-line control headers normally end in ')'
+    # on the line before the opening brace. Function calls end in ');' instead.
+    if previous.endswith(")") and not previous.endswith(";)"):
+        return True
+
+    # Aggregate initializers and macro continuations can place the brace alone.
+    if previous.endswith(("{", "=", ",", "(", "[", "\\")):
+        return True
+
+    return False
+
+
+def iter_c_files(paths: list[Path]) -> list[Path]:
+    files: list[Path] = []
+
+    for path in paths:
+        if not path.exists():
+            continue
+        if path.is_file():
+            if path.suffix in C_EXTENSIONS:
+                files.append(path)
+            continue
+
+        for root, dirs, names in os.walk(path):
+            dirs[:] = [
+                d for d in dirs
+                if d not in SKIP_DIRS and not d.endswith(".dSYM")
+            ]
+            for name in names:
+                candidate = Path(root) / name
+                if candidate.suffix in C_EXTENSIONS:
+                    files.append(candidate)
+
+    return sorted(set(files))
+
+
+def scan_file(path: Path) -> list[tuple[Path, int, int, str | None]]:
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except UnicodeDecodeError:
+        lines = path.read_text(encoding="latin-1").splitlines()
+
+    findings: list[tuple[Path, int, int, str | None]] = []
+    for index, line in enumerate(lines):
+        if not BRACE_LINE.match(line):
+            continue
+        previous = previous_code_line(lines, index)
+        previous_text = previous[1] if previous else None
+        if is_allowed_open_brace(previous_text):
+            continue
+        column = line.index("{") + 1
+        findings.append((path, index + 1, column, previous_text))
+
+    return findings
+
+
+def emit_finding(path: Path, line: int, column: int, previous: str | None) -> None:
+    message = "standalone scope block is not allowed"
+    if os.environ.get("GITHUB_ACTIONS") == "true":
+        print(f"::error file={path},line={line},col={column}::{message}")
+    print(f"{path}:{line}:{column}: {message}")
+    if previous:
+        print(f"  previous code: {previous}")
+
+
+def main(argv: list[str]) -> int:
+    roots = [Path(arg) for arg in argv] if argv else [
+        Path("src"),
+        Path("include"),
+        Path("port"),
+        Path("tests"),
+        Path("test"),
+        Path("examples"),
+        Path("tools"),
+        Path("wolfspdm"),
+    ]
+    files = iter_c_files(roots)
+    findings: list[tuple[Path, int, int, str | None]] = []
+    for path in files:
+        findings.extend(scan_file(path))
+
+    if findings:
+        print("Bare C scope block(s) found. Use normal control flow and cleanup at the end of the function instead.")
+        for finding in findings:
+            emit_finding(*finding)
+        return 1
+
+    print(f"OK: scanned {len(files)} C source/header file(s); no bare scope blocks found.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))
diff --git a/scripts/check_house_style.sh b/scripts/check_house_style.sh
new file mode 100644
index 00000000..7b6b6ece
--- /dev/null
+++ b/scripts/check_house_style.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+# wolfTrust checks for the required wolfSSL C coding conventions.
+
+status=0
+tab=$(printf '\t')
+
+report() {
+    matches=$2
+    if [ -n "$matches" ]; then
+        printf '\nFAIL: %s\n' "$1"
+        printf '%s\n' "$matches"
+        status=1
+    fi
+}
+
+# Structured control flow only. Cleanup uses status-gated fallthrough.
+matches=$(git grep -nw goto -- '*.c' '*.h' || true)
+report "goto is banned; use structured fallthrough cleanup" "$matches"
+
+# C source uses C comments. The scanner ignores strings and block comments.
+scan_status=0
+matches=$(python3 scripts/check-c-comments.py) || scan_status=$?
+if [ "$scan_status" -gt 1 ]; then
+    exit "$scan_status"
+fi
+report "C++ // comments are banned; use /* ... */" "$matches"
+
+# Core library and port code use spaces; integration fixtures retain upstream
+# formatting where required.
+matches=$(git grep -nE "$tab" -- \
+    ':(glob)src/**/*.[ch]' \
+    ':(glob)include/**/*.[ch]' \
+    ':(glob)port/**/*.[ch]' || true)
+report "tabs are banned in core C sources; use spaces" "$matches"
+
+matches=$(git grep -nE ' +$' -- '*.c' '*.h' || true)
+report "trailing whitespace" "$matches"
+
+if [ "$status" -ne 0 ]; then
+    printf '\nHouse-style check failed.\n'
+    exit 1
+fi
+printf 'House-style check passed.\n'
diff --git a/src/arch/armv8m/coroutine_armv8m.c b/src/arch/armv8m/coroutine_armv8m.c
index 3acbb629..ec4becc1 100644
--- a/src/arch/armv8m/coroutine_armv8m.c
+++ b/src/arch/armv8m/coroutine_armv8m.c
@@ -23,6 +23,7 @@
 #include "wolftrust/ffm_domain.h"
 #include "wolftrust/platform.h"
 #include "wolftrust/arch.h"
+#include "wolftrust/static_assert.h"
 
 #include <stddef.h>
 #include <stdint.h>
@@ -34,15 +35,15 @@ extern void wt_platform_panic(void);
 #define WT_CO_UNPRIV_OFFSET     40
 #define WT_CO_EXCRET_OFFSET     44
 
-_Static_assert(offsetof(struct wt_co, sp) == WT_CO_SP_OFFSET,
+WT_STATIC_ASSERT(offsetof(struct wt_co, sp) == WT_CO_SP_OFFSET,
                "struct wt_co: sp must be at offset 0");
-_Static_assert(offsetof(struct wt_co, stack_base) == WT_CO_STACK_BASE_OFFSET,
+WT_STATIC_ASSERT(offsetof(struct wt_co, stack_base) == WT_CO_STACK_BASE_OFFSET,
                "struct wt_co: stack_base must be at offset 4");
-_Static_assert(offsetof(struct wt_co, unprivileged) == WT_CO_UNPRIV_OFFSET,
+WT_STATIC_ASSERT(offsetof(struct wt_co, unprivileged) == WT_CO_UNPRIV_OFFSET,
                "struct wt_co: unprivileged must match PendSV asm offset");
-_Static_assert(offsetof(struct wt_co, exc_return) == WT_CO_EXCRET_OFFSET,
+WT_STATIC_ASSERT(offsetof(struct wt_co, exc_return) == WT_CO_EXCRET_OFFSET,
                "struct wt_co: exc_return must match PendSV asm offset");
-_Static_assert(sizeof(uintptr_t) == 4,
+WT_STATIC_ASSERT(sizeof(uintptr_t) == 4,
                "wt_co struct layout assumes 32-bit pointers");
 
 #define WT_EXC_RETURN_S_THREAD_MSP 0xFFFFFFF9u
diff --git a/src/arch/armv8m/guest_context_armv8m.c b/src/arch/armv8m/guest_context_armv8m.c
index fff85819..35990918 100644
--- a/src/arch/armv8m/guest_context_armv8m.c
+++ b/src/arch/armv8m/guest_context_armv8m.c
@@ -30,6 +30,7 @@
 #include "wolftrust/arch/armv8m/core_regs.h"
 #include "wolftrust/spm_transport.h"
 #include "wolftrust/monitor.h"
+#include "wolftrust/static_assert.h"
 
 #include "memory_map.h"
 
@@ -50,19 +51,19 @@
 #define WT_EXC_RETURN_SECURITY_MASK        0x40u
 #define WT_EXC_RETURN_SPSEL_PSP            0x04u
 
-_Static_assert(WT_GUEST_CONTEXT_PSP_NS_OFFSET == 32U, "unexpected psp_ns offset");
-_Static_assert(WT_GUEST_CONTEXT_MSP_NS_OFFSET == 36U, "unexpected msp_ns offset");
-_Static_assert(WT_GUEST_CONTEXT_CONTROL_NS_OFFSET == 44U, "unexpected control_ns offset");
-_Static_assert(WT_GUEST_CONTEXT_EXC_RETURN_OFFSET == 48U, "unexpected exc_return offset");
-_Static_assert(WT_GUEST_CONTEXT_PSP_NS_OFFSET == offsetof(wt_guest_context_t, psp_ns),
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_PSP_NS_OFFSET == 32U, "unexpected psp_ns offset");
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_MSP_NS_OFFSET == 36U, "unexpected msp_ns offset");
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_CONTROL_NS_OFFSET == 44U, "unexpected control_ns offset");
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_EXC_RETURN_OFFSET == 48U, "unexpected exc_return offset");
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_PSP_NS_OFFSET == offsetof(wt_guest_context_t, psp_ns),
                "wt_guest_context_t layout changed");
-_Static_assert(WT_GUEST_CONTEXT_MSP_NS_OFFSET == offsetof(wt_guest_context_t, msp_ns),
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_MSP_NS_OFFSET == offsetof(wt_guest_context_t, msp_ns),
                "wt_guest_context_t layout changed");
-_Static_assert(WT_GUEST_CONTEXT_CONTROL_NS_OFFSET == offsetof(wt_guest_context_t, control_ns),
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_CONTROL_NS_OFFSET == offsetof(wt_guest_context_t, control_ns),
                "wt_guest_context_t layout changed");
-_Static_assert(WT_GUEST_CONTEXT_EXC_RETURN_OFFSET == offsetof(wt_guest_context_t, exc_return),
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_EXC_RETURN_OFFSET == offsetof(wt_guest_context_t, exc_return),
                "wt_guest_context_t layout changed");
-_Static_assert(WT_GUEST_CONTEXT_PSPLIM_NS_OFFSET == offsetof(wt_guest_context_t, psplim_ns),
+WT_STATIC_ASSERT(WT_GUEST_CONTEXT_PSPLIM_NS_OFFSET == offsetof(wt_guest_context_t, psplim_ns),
                "wt_guest_context_t layout changed");
 
 /* Referenced by inline asm in SysTick_Handler; mark used so -Os does
diff --git a/src/services/wolfhsm/runner/user_settings.h b/src/services/wolfhsm/runner/user_settings.h
index 1a1a5184..b84f2bf0 100644
--- a/src/services/wolfhsm/runner/user_settings.h
+++ b/src/services/wolfhsm/runner/user_settings.h
@@ -89,6 +89,10 @@
  * ---------------------------------------------------------------------- */
 #define SIZEOF_LONG_LONG 8
 
+/* wolfHSM's pinned wolfCrypt callback ABI uses anonymous aggregates. Keep
+ * that required dependency extension explicit when wolfTrust builds as C99. */
+#define HAVE_ANONYMOUS_INLINE_AGGREGATES 1
+
 /* -------------------------------------------------------------------------
  * Math backend: SP Cortex-M.
  *
diff --git a/src/services/wolfhsm/wt_hsm.c b/src/services/wolfhsm/wt_hsm.c
index 3808a294..98169fda 100644
--- a/src/services/wolfhsm/wt_hsm.c
+++ b/src/services/wolfhsm/wt_hsm.c
@@ -70,6 +70,7 @@
 #include "wolftrust/services/hsm.h"
 #include "wolftrust/services/hsm_relay.h"
 #include "wolftrust/services/vault_service.h"
+#include "wolftrust/static_assert.h"
 
 #include "wolftrust/port_nvm.h"
 #include "psa/lifecycle.h"
@@ -607,7 +608,7 @@ int wt_hsm_guest_init(wt_guest_id_t guest_id,
  * server to completion, and returns the captured response. The server's
  * transport callbacks below only ever touch secure memory.
  * ====================================================================== */
-_Static_assert(sizeof(whCommHeader) + WOLFHSM_CFG_COMM_DATA_LEN <=
+WT_STATIC_ASSERT(sizeof(whCommHeader) + WOLFHSM_CFG_COMM_DATA_LEN <=
                    WT_HSM_RELAY_MSG_MAX,
                "wolfHSM packet exceeds the relay capture buffer");
 
diff --git a/tests/c99/check.sh b/tests/c99/check.sh
new file mode 100644
index 00000000..e7079962
--- /dev/null
+++ b/tests/c99/check.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+# Confirm the compiler gate accepts ISO C99 and rejects C11 syntax and VLAs.
+set -eu
+
+compiler=${CC:-cc}
+flags='-std=c99 -pedantic-errors -Werror=vla -Wall -Wextra -Werror -fsyntax-only'
+
+"$compiler" $flags -Iinclude tests/c99/valid.c
+if "$compiler" $flags tests/c99/invalid_c11.c >/dev/null 2>&1; then
+    printf '%s\n' 'C99 gate accepted C11-only syntax' >&2
+    exit 1
+fi
+if "$compiler" $flags tests/c99/invalid_vla.c >/dev/null 2>&1; then
+    printf '%s\n' 'C99 gate accepted a variable-length array' >&2
+    exit 1
+fi
+printf '%s\n' 'C99 compiler gate passed.'
diff --git a/tests/c99/invalid_c11.c b/tests/c99/invalid_c11.c
new file mode 100644
index 00000000..f5615af6
--- /dev/null
+++ b/tests/c99/invalid_c11.c
@@ -0,0 +1,4 @@
+int wt_c11_probe(int value)
+{
+    return _Generic(value, int: 1, default: 0);
+}
diff --git a/tests/c99/invalid_vla.c b/tests/c99/invalid_vla.c
new file mode 100644
index 00000000..b94743df
--- /dev/null
+++ b/tests/c99/invalid_vla.c
@@ -0,0 +1,6 @@
+int wt_vla_probe(int count)
+{
+    int values[count];
+    values[0] = count;
+    return values[0];
+}
diff --git a/tests/c99/valid.c b/tests/c99/valid.c
new file mode 100644
index 00000000..d4068c1c
--- /dev/null
+++ b/tests/c99/valid.c
@@ -0,0 +1,19 @@
+#include "wolftrust/static_assert.h"
+
+#if !defined(__STDC_VERSION__) || (__STDC_VERSION__ != 199901L)
+#error "ISO C99 is required"
+#endif
+
+struct wt_c99_probe {
+    int first;
+    int second;
+};
+
+WT_STATIC_ASSERT(sizeof(struct wt_c99_probe) >= 2 * sizeof(int),
+                 "probe layout");
+
+int wt_c99_probe(void)
+{
+    const struct wt_c99_probe probe = { .first = 1, .second = 2 };
+    return probe.first + probe.second;
+}
diff --git a/tests/firmware/stm32h563-vnet/Makefile b/tests/firmware/stm32h563-vnet/Makefile
index 4b34c62c..96a0f114 100644
--- a/tests/firmware/stm32h563-vnet/Makefile
+++ b/tests/firmware/stm32h563-vnet/Makefile
@@ -59,7 +59,7 @@ CPU_FLAGS := -mcpu=cortex-m33 -mthumb -mgeneral-regs-only
 # Guest CFLAGS. -I order matters: our wolfip_config/ overrides
 # lib/wolfIP/config.h. wolfIP itself needs the lib/wolfIP root for
 # `#include "wolfip.h"`-from-its-own-srcs.
-GUEST_CFLAGS := $(CPU_FLAGS) -ffreestanding -fno-builtin -nostdlib -O2 -g \
+GUEST_CFLAGS := $(CPU_FLAGS) -std=c99 -ffreestanding -fno-builtin -nostdlib -O2 -g \
     -Wall -Wextra -mno-unaligned-access \
     -ffunction-sections -fdata-sections \
     -I$(ROOT)/include \
diff --git a/tests/firmware/stm32h563-vnet/nonsecure/guest.c b/tests/firmware/stm32h563-vnet/nonsecure/guest.c
index 3115ac52..20577a80 100644
--- a/tests/firmware/stm32h563-vnet/nonsecure/guest.c
+++ b/tests/firmware/stm32h563-vnet/nonsecure/guest.c
@@ -309,24 +309,22 @@ static int run_guest(uint32_t guest_id)
     int sock = -1;
     int last_seq = 0;
     int next_seq = 1;
+    int tries;
+    volatile uint32_t spin;
     uint32_t next_ping_ms = 200;  /* first ping after a short ARP window */
     uint8_t rx_buf[64];
+    uint8_t mac_ram[6];
 
     wt_uart_puts(id->banner);
 
     /* SERVICE_VNET may be mid-quarantine (a faulted partition restarting
      * under its manifest policy); a transient failure heals, so retry. */
-    {
-        int tries;
-        volatile uint32_t spin;
-
-        rc = -1;
-        for (tries = 0; tries < 50 && rc != 0; tries++) {
-            rc = wt_vnet_psa_open(&g_vnet, WT_VNET_SERVICE_SID,
-                                  WT_VNET_SERVICE_VERSION, &info);
-            if (rc != 0) {
-                for (spin = 0; spin < 200000u; spin++) { }
-            }
+    rc = -1;
+    for (tries = 0; tries < 50 && rc != 0; tries++) {
+        rc = wt_vnet_psa_open(&g_vnet, WT_VNET_SERVICE_SID,
+                              WT_VNET_SERVICE_VERSION, &info);
+        if (rc != 0) {
+            for (spin = 0; spin < 200000u; spin++) { }
         }
     }
     if (rc != 0) { wt_uart_puts("vnet open failed\r\n"); return -1; }
@@ -338,11 +336,8 @@ static int run_guest(uint32_t guest_id)
      * flash, so passing &id->mac (which lives in .rodata) into the call
      * would feed the switch a zeroed MAC. The on-target wolfTrust build
      * works either way; this is the emulator-compatible path. */
-    {
-        uint8_t mac_ram[6];
-        memcpy(mac_ram, id->mac, 6);
-        rc = wt_vnet_psa_set_mac(&g_vnet, mac_ram);
-    }
+    memcpy(mac_ram, id->mac, 6);
+    rc = wt_vnet_psa_set_mac(&g_vnet, mac_ram);
     if (rc != 0) {
         wt_uart_puts("vnet set_mac failed rc=");
         wt_uart_put_u32((uint32_t)(-rc));
diff --git a/tests/firmware/stm32h563/Makefile b/tests/firmware/stm32h563/Makefile
index 64d215f0..bfff957d 100644
--- a/tests/firmware/stm32h563/Makefile
+++ b/tests/firmware/stm32h563/Makefile
@@ -11,7 +11,7 @@ TARGET ?= stm32h563
 PORT_HEADERS := $(wildcard $(PORT_DIR)/*.h)
 
 CPU_FLAGS := -mcpu=cortex-m33 -mthumb -mgeneral-regs-only
-CFLAGS_COMMON := $(CPU_FLAGS) -ffreestanding -fno-builtin -nostdlib -O0 -g -Wall -Wextra
+CFLAGS_COMMON := $(CPU_FLAGS) -std=c99 -ffreestanding -fno-builtin -nostdlib -O0 -g -Wall -Wextra
 CFLAGS_COMMON += -I$(ROOT)/include -I$(PORT_DIR) -I$(ROOT)/lib/wolfhal
 WT_TIMESLICE_MS ?= 2
 EMU_TIMEOUT ?= 300
@@ -130,7 +130,7 @@ HSM_DEFS_GUEST += -DWOLFSSL_ARMASM -DWOLFSSL_ARMASM_NO_HW_CRYPTO \
 endif
 endif
 # Switch secure ELF to -Os: wolfCrypt is too slow at -O0 for embedded use.
-SECURE_CFLAGS := $(CPU_FLAGS) -ffreestanding -fno-builtin -nostdlib -Os -g \
+SECURE_CFLAGS := $(CPU_FLAGS) -std=c99 -ffreestanding -fno-builtin -nostdlib -Os -g \
     -Wall -Wextra \
     -I$(ROOT)/include -I$(PORT_DIR) \
     -DWT_TIMESLICE_MS=$(WT_TIMESLICE_MS) \
@@ -142,7 +142,7 @@ SECURE_CFLAGS := $(CPU_FLAGS) -ffreestanding -fno-builtin -nostdlib -Os -g \
     -DWHAL_CFG_STM32H5_RNG_DIRECT_API_MAPPING \
     -mcmse \
     $(HSM_INCLUDES_SECURE) $(HSM_DEFS_SECURE)
-NONSECURE_CFLAGS := $(CPU_FLAGS) -ffreestanding -fno-builtin -nostdlib -Os -g \
+NONSECURE_CFLAGS := $(CPU_FLAGS) -std=c99 -ffreestanding -fno-builtin -nostdlib -Os -g \
     -Wall -Wextra \
     -mno-unaligned-access \
     -ffunction-sections -fdata-sections \
diff --git a/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c b/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c
index 0ca23c9e..10fcb916 100644
--- a/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c
+++ b/tests/firmware/zephyr-stm32h5/apps/freertos_guest1/main.c
@@ -409,16 +409,12 @@ static void crypto_task(void *arg)
 
     (void)arg;
 
-    if (guest_crypto_init() != 0) {
-        goto heartbeat;
+    if (guest_crypto_init() == 0) {
+        run_ffm_sha256_kat();
+        run_ffm_rng();
+        run_psa_smoke();
+        run_ffm_negatives();
     }
-
-    run_ffm_sha256_kat();
-    run_ffm_rng();
-    run_psa_smoke();
-    run_ffm_negatives();
-
-heartbeat:
     for (;;) {
         busy_delay(WT_FREERTOS_HEARTBEAT_SPIN);
         uart_puts("freertos_guest1: heartbeat ");
diff --git a/tests/fuzz/Makefile b/tests/fuzz/Makefile
index d02f7cfb..239696f8 100644
--- a/tests/fuzz/Makefile
+++ b/tests/fuzz/Makefile
@@ -23,7 +23,7 @@ BUILD_DIR ?= build
 FUZZ_TIME ?= 30
 MAX_LEN ?= 4096
 
-CFLAGS := -std=c11 -O1 -g -Wall -Wextra -pedantic -I$(ROOT)/include \
+CFLAGS := -std=c99 -O1 -g -Wall -Wextra -pedantic -I$(ROOT)/include \
     -fsanitize=fuzzer,address -fno-omit-frame-pointer $(EXTRA_CFLAGS)
 LDFLAGS := -fsanitize=fuzzer,address $(EXTRA_LDFLAGS)
 
diff --git a/tests/host/Makefile b/tests/host/Makefile
index 49afe1ab..575d2531 100644
--- a/tests/host/Makefile
+++ b/tests/host/Makefile
@@ -23,6 +23,7 @@ BUILD_ROOT ?= build
 TEST_KIND ?= unit
 LOG_FILE ?= $(BUILD_ROOT)/logs/$(TEST_KIND).log
 VERBOSE ?= 0
+EXTRA_CFLAGS ?=
 
 ifeq ($(VERBOSE),1)
 SUBMAKE_FLAGS := --no-print-directory
@@ -57,6 +58,7 @@ test:
 		if [ "$(VERBOSE)" = "1" ]; then \
 			if $(MAKE) $(SUBMAKE_FLAGS) -C $$suite clean run \
 				CC="$(CC)" BUILD_DIR="$(BUILD_ROOT)/$$suite" \
+				EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 				2>&1 | tee "$$suite_log"; then \
 				status=0; \
 			else \
@@ -65,6 +67,7 @@ test:
 		else \
 			if $(MAKE) $(SUBMAKE_FLAGS) -C $$suite clean run \
 				CC="$(CC)" BUILD_DIR="$(BUILD_ROOT)/$$suite" \
+				EXTRA_CFLAGS="$(EXTRA_CFLAGS)" \
 				> "$$suite_log" 2>&1; then \
 				status=0; \
 			else \
diff --git a/tests/host/attestation/Makefile b/tests/host/attestation/Makefile
index 4e34c544..5d9a2b65 100644
--- a/tests/host/attestation/Makefile
+++ b/tests/host/attestation/Makefile
@@ -33,9 +33,10 @@ CFLAGS := \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
     -I$(WOLFCOSE)/include \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 # wolfCOSE sources are not -pedantic/-Werror clean under this profile; build
 # them with the warnings relaxed while keeping wolfTrust + test code strict.
diff --git a/tests/host/attestation/user_settings.h b/tests/host/attestation/user_settings.h
index 4d6dafa3..c7e8c8d5 100644
--- a/tests/host/attestation/user_settings.h
+++ b/tests/host/attestation/user_settings.h
@@ -28,7 +28,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/attestation_golden/Makefile b/tests/host/attestation_golden/Makefile
index 949f962c..fface47c 100644
--- a/tests/host/attestation_golden/Makefile
+++ b/tests/host/attestation_golden/Makefile
@@ -41,9 +41,10 @@ CFLAGS := \
     -I$(WOLFSSL) \
     -I$(WOLFHSM) \
     -I$(WOLFCOSE)/include \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 # wolfCOSE sources are not -pedantic/-Werror clean under this profile; build
 # them with the warnings relaxed while keeping wolfTrust + test code strict.
diff --git a/tests/host/attestation_golden/user_settings.h b/tests/host/attestation_golden/user_settings.h
index 4d6dafa3..c7e8c8d5 100644
--- a/tests/host/attestation_golden/user_settings.h
+++ b/tests/host/attestation_golden/user_settings.h
@@ -28,7 +28,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/attestation_iak/user_settings.h b/tests/host/attestation_iak/user_settings.h
index 1a2596c4..ac358fb8 100644
--- a/tests/host/attestation_iak/user_settings.h
+++ b/tests/host/attestation_iak/user_settings.h
@@ -27,7 +27,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/attestation_negatives/Makefile b/tests/host/attestation_negatives/Makefile
index 2a740a64..9b60f1dc 100644
--- a/tests/host/attestation_negatives/Makefile
+++ b/tests/host/attestation_negatives/Makefile
@@ -43,9 +43,10 @@ CFLAGS := \
     -I$(WOLFHSM) \
     -I$(WOLFCOSE)/include \
     -I$(GUEST) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 # wolfCOSE sources are not -pedantic/-Werror clean under this profile; build
 # them with the warnings relaxed while keeping wolfTrust + test code strict.
diff --git a/tests/host/attestation_negatives/user_settings.h b/tests/host/attestation_negatives/user_settings.h
index 4d6dafa3..c7e8c8d5 100644
--- a/tests/host/attestation_negatives/user_settings.h
+++ b/tests/host/attestation_negatives/user_settings.h
@@ -28,7 +28,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/attestation_replay/Makefile b/tests/host/attestation_replay/Makefile
index d6d00f4e..dfe2a744 100644
--- a/tests/host/attestation_replay/Makefile
+++ b/tests/host/attestation_replay/Makefile
@@ -43,9 +43,10 @@ CFLAGS := \
     -I$(WOLFHSM) \
     -I$(WOLFCOSE)/include \
     -I$(GUEST) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 # wolfCOSE sources are not -pedantic/-Werror clean under this profile; build
 # them with the warnings relaxed while keeping wolfTrust + test code strict.
diff --git a/tests/host/attestation_replay/user_settings.h b/tests/host/attestation_replay/user_settings.h
index 4d6dafa3..c7e8c8d5 100644
--- a/tests/host/attestation_replay/user_settings.h
+++ b/tests/host/attestation_replay/user_settings.h
@@ -28,7 +28,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/attestation_service/Makefile b/tests/host/attestation_service/Makefile
index 34a38659..b0738f1a 100644
--- a/tests/host/attestation_service/Makefile
+++ b/tests/host/attestation_service/Makefile
@@ -31,7 +31,7 @@ CFLAGS := \
     -I$(ROOT)/tests/host/wolfhsm_loopback \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/attestation_token/Makefile b/tests/host/attestation_token/Makefile
index 6042c361..77d838a3 100644
--- a/tests/host/attestation_token/Makefile
+++ b/tests/host/attestation_token/Makefile
@@ -43,9 +43,10 @@ CFLAGS := \
     -I$(WOLFHSM) \
     -I$(WOLFCOSE)/include \
     -I$(GUEST) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 # wolfCOSE sources are not -pedantic/-Werror clean under this profile; build
 # them with the warnings relaxed while keeping wolfTrust + test code strict.
diff --git a/tests/host/attestation_token/user_settings.h b/tests/host/attestation_token/user_settings.h
index 4d6dafa3..c7e8c8d5 100644
--- a/tests/host/attestation_token/user_settings.h
+++ b/tests/host/attestation_token/user_settings.h
@@ -28,7 +28,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/boot_handoff/Makefile b/tests/host/boot_handoff/Makefile
index b5a88144..361e0b9c 100644
--- a/tests/host/boot_handoff/Makefile
+++ b/tests/host/boot_handoff/Makefile
@@ -26,7 +26,7 @@ BUILD_DIR ?= build
 
 CFLAGS := \
     -I$(ROOT)/include \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic
 CFLAGS += $(EXTRA_CFLAGS)
 
 MKHANDOFF := $(ROOT)/tools/handoff/mkhandoff.py
diff --git a/tests/host/boot_handoff/main.c b/tests/host/boot_handoff/main.c
index c53cca13..138b300a 100644
--- a/tests/host/boot_handoff/main.c
+++ b/tests/host/boot_handoff/main.c
@@ -26,6 +26,7 @@
 #include "wolftrust/boot_handoff.h"
 #include "wolftrust/platform.h"
 #include "wolftrust/arch.h"
+#include "wolftrust/static_assert.h"
 
 #include <stddef.h>
 #include <stdio.h>
@@ -33,21 +34,21 @@
 
 #define REGION_SIZE 64u
 
-_Static_assert(sizeof(wt_boot_handoff_t) == 56u, "record is 56 bytes");
-_Static_assert(offsetof(wt_boot_handoff_t, magic) == 0u, "magic offset");
-_Static_assert(offsetof(wt_boot_handoff_t, magic_inverse) == 4u,
+WT_STATIC_ASSERT(sizeof(wt_boot_handoff_t) == 56u, "record is 56 bytes");
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, magic) == 0u, "magic offset");
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, magic_inverse) == 4u,
                "magic_inverse offset");
-_Static_assert(offsetof(wt_boot_handoff_t, version) == 8u, "version offset");
-_Static_assert(offsetof(wt_boot_handoff_t, size) == 10u, "size offset");
-_Static_assert(offsetof(wt_boot_handoff_t, lifecycle) == 12u,
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, version) == 8u, "version offset");
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, size) == 10u, "size offset");
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, lifecycle) == 12u,
                "lifecycle offset");
-_Static_assert(offsetof(wt_boot_handoff_t, image_version) == 16u,
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, image_version) == 16u,
                "image_version offset");
-_Static_assert(offsetof(wt_boot_handoff_t, hash_algorithm) == 20u,
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, hash_algorithm) == 20u,
                "hash_algorithm offset");
-_Static_assert(offsetof(wt_boot_handoff_t, measurement_size) == 22u,
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, measurement_size) == 22u,
                "measurement_size offset");
-_Static_assert(offsetof(wt_boot_handoff_t, measurement) == 24u,
+WT_STATIC_ASSERT(offsetof(wt_boot_handoff_t, measurement) == 24u,
                "measurement offset");
 
 static uint8_t g_region[REGION_SIZE];
diff --git a/tests/host/domain/Makefile b/tests/host/domain/Makefile
index 55edea79..16cfdcfd 100644
--- a/tests/host/domain/Makefile
+++ b/tests/host/domain/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 
diff --git a/tests/host/ffm/Makefile b/tests/host/ffm/Makefile
index c098ccf7..8ab6b533 100644
--- a/tests/host/ffm/Makefile
+++ b/tests/host/ffm/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_ffm
diff --git a/tests/host/ffm_domain/Makefile b/tests/host/ffm_domain/Makefile
index 48d79ee9..57486121 100644
--- a/tests/host/ffm_domain/Makefile
+++ b/tests/host/ffm_domain/Makefile
@@ -25,7 +25,7 @@ BUILD_DIR ?= build
 
 CFLAGS := \
     -I$(ROOT)/include \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic
 CFLAGS += $(EXTRA_CFLAGS)
 
 _WT_SRCS := $(ROOT)/src/ffm_domain.c
diff --git a/tests/host/ffm_veneer/Makefile b/tests/host/ffm_veneer/Makefile
index 7d578807..6d5d2fc4 100644
--- a/tests/host/ffm_veneer/Makefile
+++ b/tests/host/ffm_veneer/Makefile
@@ -31,9 +31,10 @@ CFLAGS := \
     -I$(ROOT)/tests/host/wolfhsm_loopback \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 _WT_SRCS := \
     $(ROOT)/src/ffm.c \
diff --git a/tests/host/flash_nvm/Makefile b/tests/host/flash_nvm/Makefile
index 19810c3f..2a173d1f 100644
--- a/tests/host/flash_nvm/Makefile
+++ b/tests/host/flash_nvm/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -DWT_CONF_NVM_HOST_TEST \
     -I$(ROOT)/include -I$(ROOT)/port/stm32h563/conformance $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
diff --git a/tests/host/fwu_service/Makefile b/tests/host/fwu_service/Makefile
index a7d383ac..9c24f5c3 100644
--- a/tests/host/fwu_service/Makefile
+++ b/tests/host/fwu_service/Makefile
@@ -28,7 +28,7 @@ CFLAGS := \
     -I. \
     -I$(ROOT)/include \
     -I$(WOLFHSM) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/guest_verify/Makefile b/tests/host/guest_verify/Makefile
index f286ea09..5baea147 100644
--- a/tests/host/guest_verify/Makefile
+++ b/tests/host/guest_verify/Makefile
@@ -29,7 +29,7 @@ CFLAGS := \
     -I. \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/ipc/Makefile b/tests/host/ipc/Makefile
index 4571f092..32c0a384 100644
--- a/tests/host/ipc/Makefile
+++ b/tests/host/ipc/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_ipc
diff --git a/tests/host/keystore_isolation/user_settings.h b/tests/host/keystore_isolation/user_settings.h
index 1a2596c4..ac358fb8 100644
--- a/tests/host/keystore_isolation/user_settings.h
+++ b/tests/host/keystore_isolation/user_settings.h
@@ -27,7 +27,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/lifecycle/Makefile b/tests/host/lifecycle/Makefile
index 80ae8ff6..92568302 100644
--- a/tests/host/lifecycle/Makefile
+++ b/tests/host/lifecycle/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_lifecycle
diff --git a/tests/host/manifest/Makefile b/tests/host/manifest/Makefile
index cc08df83..3c992ebd 100644
--- a/tests/host/manifest/Makefile
+++ b/tests/host/manifest/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 
diff --git a/tests/host/manifest/test_generator.py b/tests/host/manifest/test_generator.py
index 0e70cdbb..11d53a03 100644
--- a/tests/host/manifest/test_generator.py
+++ b/tests/host/manifest/test_generator.py
@@ -45,7 +45,7 @@ def run_generator(self, source, output, supported_features="0x5"):
     def compile_generated(self, output, executable):
         command = shlex.split(os.environ.get("CC", "cc"))
         command.extend([
-            "-std=c11", "-Wall", "-Wextra", "-Werror", "-pedantic",
+            "-std=c99", "-Wall", "-Wextra", "-Werror", "-pedantic",
             "-I" + str(ROOT / "include"), "-I" + str(output),
             str(ROOT / "src" / "domain.c"),
             str(ROOT / "src" / "manifest.c"),
diff --git a/tests/host/negatives/Makefile b/tests/host/negatives/Makefile
index fcb10e2b..50733446 100644
--- a/tests/host/negatives/Makefile
+++ b/tests/host/negatives/Makefile
@@ -34,9 +34,10 @@ CFLAGS := \
     -I$(ROOT)/include \
     -I$(WOLFHSM) \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 _WT_SRCS := \
     $(ROOT)/src/ffm.c \
diff --git a/tests/host/negatives/user_settings.h b/tests/host/negatives/user_settings.h
index 0e250649..0aa5c1f3 100644
--- a/tests/host/negatives/user_settings.h
+++ b/tests/host/negatives/user_settings.h
@@ -27,7 +27,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/port_binding/Makefile b/tests/host/port_binding/Makefile
index 94d3e78d..1408fe74 100644
--- a/tests/host/port_binding/Makefile
+++ b/tests/host/port_binding/Makefile
@@ -25,7 +25,7 @@ BUILD_DIR ?= build
 
 CFLAGS := \
     -I$(ROOT)/include \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic
 CFLAGS += $(EXTRA_CFLAGS)
 
 SRCS := $(ROOT)/src/partition.c main.c
diff --git a/tests/host/ps_service/Makefile b/tests/host/ps_service/Makefile
index 9fcfd9fd..524a6963 100644
--- a/tests/host/ps_service/Makefile
+++ b/tests/host/ps_service/Makefile
@@ -34,7 +34,7 @@ CFLAGS := \
     -I$(ROOT)/include \
     -I$(WOLFHSM) \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/psa_ff_upstream/Makefile b/tests/host/psa_ff_upstream/Makefile
index 1e6e5267..5ee97b22 100644
--- a/tests/host/psa_ff_upstream/Makefile
+++ b/tests/host/psa_ff_upstream/Makefile
@@ -31,7 +31,7 @@ ARM_TESTS := $(foreach id,$(ARM_TEST_IDS),\
 ARM_TEST_INCLUDES := $(foreach id,$(ARM_TEST_IDS),\
     -I$(ARM_API)/ff/ipc/test_$(id))
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -include psa/client.h -DNONSECURE_TEST_BUILD -DIPC \
     -DSERVER_TEST_DISPATCHER_SID=0x0000FB01U \
     -DSERVER_TEST_DISPATCHER_VERSION=1U \
@@ -48,6 +48,7 @@ CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I. -I$(ROOT)/include $(ARM_TEST_INCLUDES) \
     -I$(ARM_API)/val/nspe -I$(ARM_API)/val/common \
     -I$(ARM_API)/platform/targets/common/nspe
+CFLAGS += $(EXTRA_CFLAGS)
 TEST := $(BUILD_DIR)/test_psa_ff_upstream
 SRCS := $(ROOT)/src/ffm.c $(ROOT)/src/ffm_api.c $(ROOT)/src/ipc.c \
     main.c $(ARM_TESTS)
diff --git a/tests/host/psa_ffm_client/Makefile b/tests/host/psa_ffm_client/Makefile
index b3209299..837f2b50 100644
--- a/tests/host/psa_ffm_client/Makefile
+++ b/tests/host/psa_ffm_client/Makefile
@@ -31,9 +31,10 @@ CFLAGS := \
     -I$(ROOT)/tests/host/wolfhsm_loopback \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 _WT_SRCS := \
     $(ROOT)/src/ffm.c \
diff --git a/tests/host/psa_ffm_client/main.c b/tests/host/psa_ffm_client/main.c
index 1288e458..f163c6c7 100644
--- a/tests/host/psa_ffm_client/main.c
+++ b/tests/host/psa_ffm_client/main.c
@@ -36,10 +36,11 @@
 #include "psa_manifest/sid.h"
 #include "wolftrust/ffm_veneer.h"
 #include "psa/client.h"
+#include "wolftrust/static_assert.h"
 
 /* The advertised public maximum must be deliverable: one marshalled request
  * (header + block) fits the IPC transfer budget exactly at the boundary. */
-_Static_assert(sizeof(wt_fwu_req_t) + PSA_FWU_MAX_WRITE_SIZE <=
+WT_STATIC_ASSERT(sizeof(wt_fwu_req_t) + PSA_FWU_MAX_WRITE_SIZE <=
                WT_FFM_TRANSFER_BYTES,
                "PSA_FWU_MAX_WRITE_SIZE exceeds the IPC transfer budget");
 #include "psa_manifest/pid.h"
diff --git a/tests/host/psa_headers/Makefile b/tests/host/psa_headers/Makefile
index 7590f5c1..1f341bd4 100644
--- a/tests/host/psa_headers/Makefile
+++ b/tests/host/psa_headers/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_psa_headers
diff --git a/tests/host/psa_headers/main.c b/tests/host/psa_headers/main.c
index 894707c7..03c02b12 100644
--- a/tests/host/psa_headers/main.c
+++ b/tests/host/psa_headers/main.c
@@ -27,48 +27,49 @@
 #include "psa/service.h"
 #include "psa/client.h"
 #include "psa/lifecycle.h"
+#include "wolftrust/static_assert.h"
 
 #include <stddef.h>
 #include <stdio.h>
 
-_Static_assert(PSA_SUCCESS == 0, "PSA_SUCCESS");
-_Static_assert(PSA_ERROR_PROGRAMMER_ERROR == -129, "PROGRAMMER_ERROR");
-_Static_assert(PSA_ERROR_CONNECTION_REFUSED == -130, "CONNECTION_REFUSED");
-_Static_assert(PSA_ERROR_CONNECTION_BUSY == -131, "CONNECTION_BUSY");
-_Static_assert(PSA_ERROR_GENERIC_ERROR == -132, "GENERIC_ERROR");
-_Static_assert(PSA_ERROR_NOT_PERMITTED == -133, "NOT_PERMITTED");
-_Static_assert(PSA_ERROR_NOT_SUPPORTED == -134, "NOT_SUPPORTED");
-_Static_assert(PSA_ERROR_INVALID_ARGUMENT == -135, "INVALID_ARGUMENT");
-_Static_assert(PSA_ERROR_INVALID_HANDLE == -136, "INVALID_HANDLE");
-_Static_assert(PSA_ERROR_BAD_STATE == -137, "BAD_STATE");
-_Static_assert(PSA_ERROR_BUFFER_TOO_SMALL == -138, "BUFFER_TOO_SMALL");
-_Static_assert(PSA_ERROR_ALREADY_EXISTS == -139, "ALREADY_EXISTS");
-_Static_assert(PSA_ERROR_DOES_NOT_EXIST == -140, "DOES_NOT_EXIST");
-_Static_assert(PSA_ERROR_INSUFFICIENT_MEMORY == -141, "INSUFFICIENT_MEMORY");
-_Static_assert(PSA_ERROR_INSUFFICIENT_STORAGE == -142, "INSUFFICIENT_STORAGE");
-_Static_assert(PSA_ERROR_INSUFFICIENT_DATA == -143, "INSUFFICIENT_DATA");
-_Static_assert(PSA_ERROR_SERVICE_FAILURE == -144, "SERVICE_FAILURE");
-_Static_assert(PSA_ERROR_COMMUNICATION_FAILURE == -145, "COMMUNICATION_FAILURE");
-_Static_assert(PSA_ERROR_STORAGE_FAILURE == -146, "STORAGE_FAILURE");
-_Static_assert(PSA_ERROR_HARDWARE_FAILURE == -147, "HARDWARE_FAILURE");
-_Static_assert(PSA_ERROR_INVALID_SIGNATURE == -149, "INVALID_SIGNATURE");
-_Static_assert(PSA_ERROR_CORRUPTION_DETECTED == -151, "CORRUPTION_DETECTED");
-_Static_assert(PSA_ERROR_DATA_CORRUPT == -152, "DATA_CORRUPT");
-_Static_assert(PSA_ERROR_DATA_INVALID == -153, "DATA_INVALID");
-_Static_assert(PSA_OPERATION_INCOMPLETE == -248, "OPERATION_INCOMPLETE");
+WT_STATIC_ASSERT(PSA_SUCCESS == 0, "PSA_SUCCESS");
+WT_STATIC_ASSERT(PSA_ERROR_PROGRAMMER_ERROR == -129, "PROGRAMMER_ERROR");
+WT_STATIC_ASSERT(PSA_ERROR_CONNECTION_REFUSED == -130, "CONNECTION_REFUSED");
+WT_STATIC_ASSERT(PSA_ERROR_CONNECTION_BUSY == -131, "CONNECTION_BUSY");
+WT_STATIC_ASSERT(PSA_ERROR_GENERIC_ERROR == -132, "GENERIC_ERROR");
+WT_STATIC_ASSERT(PSA_ERROR_NOT_PERMITTED == -133, "NOT_PERMITTED");
+WT_STATIC_ASSERT(PSA_ERROR_NOT_SUPPORTED == -134, "NOT_SUPPORTED");
+WT_STATIC_ASSERT(PSA_ERROR_INVALID_ARGUMENT == -135, "INVALID_ARGUMENT");
+WT_STATIC_ASSERT(PSA_ERROR_INVALID_HANDLE == -136, "INVALID_HANDLE");
+WT_STATIC_ASSERT(PSA_ERROR_BAD_STATE == -137, "BAD_STATE");
+WT_STATIC_ASSERT(PSA_ERROR_BUFFER_TOO_SMALL == -138, "BUFFER_TOO_SMALL");
+WT_STATIC_ASSERT(PSA_ERROR_ALREADY_EXISTS == -139, "ALREADY_EXISTS");
+WT_STATIC_ASSERT(PSA_ERROR_DOES_NOT_EXIST == -140, "DOES_NOT_EXIST");
+WT_STATIC_ASSERT(PSA_ERROR_INSUFFICIENT_MEMORY == -141, "INSUFFICIENT_MEMORY");
+WT_STATIC_ASSERT(PSA_ERROR_INSUFFICIENT_STORAGE == -142, "INSUFFICIENT_STORAGE");
+WT_STATIC_ASSERT(PSA_ERROR_INSUFFICIENT_DATA == -143, "INSUFFICIENT_DATA");
+WT_STATIC_ASSERT(PSA_ERROR_SERVICE_FAILURE == -144, "SERVICE_FAILURE");
+WT_STATIC_ASSERT(PSA_ERROR_COMMUNICATION_FAILURE == -145, "COMMUNICATION_FAILURE");
+WT_STATIC_ASSERT(PSA_ERROR_STORAGE_FAILURE == -146, "STORAGE_FAILURE");
+WT_STATIC_ASSERT(PSA_ERROR_HARDWARE_FAILURE == -147, "HARDWARE_FAILURE");
+WT_STATIC_ASSERT(PSA_ERROR_INVALID_SIGNATURE == -149, "INVALID_SIGNATURE");
+WT_STATIC_ASSERT(PSA_ERROR_CORRUPTION_DETECTED == -151, "CORRUPTION_DETECTED");
+WT_STATIC_ASSERT(PSA_ERROR_DATA_CORRUPT == -152, "DATA_CORRUPT");
+WT_STATIC_ASSERT(PSA_ERROR_DATA_INVALID == -153, "DATA_INVALID");
+WT_STATIC_ASSERT(PSA_OPERATION_INCOMPLETE == -248, "OPERATION_INCOMPLETE");
 
-_Static_assert(PSA_FRAMEWORK_VERSION == 0x0100U, "FRAMEWORK_VERSION 1.0");
+WT_STATIC_ASSERT(PSA_FRAMEWORK_VERSION == 0x0100U, "FRAMEWORK_VERSION 1.0");
 
-_Static_assert(PSA_LIFECYCLE_PSA_STATE_MASK == 0xff00U, "PSA_STATE_MASK");
-_Static_assert(PSA_LIFECYCLE_IMP_STATE_MASK == 0x00ffU, "IMP_STATE_MASK");
-_Static_assert(PSA_LIFECYCLE_UNKNOWN == 0x0000U, "UNKNOWN");
-_Static_assert(PSA_LIFECYCLE_SECURED == 0x3000U, "SECURED");
+WT_STATIC_ASSERT(PSA_LIFECYCLE_PSA_STATE_MASK == 0xff00U, "PSA_STATE_MASK");
+WT_STATIC_ASSERT(PSA_LIFECYCLE_IMP_STATE_MASK == 0x00ffU, "IMP_STATE_MASK");
+WT_STATIC_ASSERT(PSA_LIFECYCLE_UNKNOWN == 0x0000U, "UNKNOWN");
+WT_STATIC_ASSERT(PSA_LIFECYCLE_SECURED == 0x3000U, "SECURED");
 
 /* DEN0063 lays psa_msg_t out with type first and handle second; the SPM copies
  * the two together, so the order is load-bearing, not cosmetic. */
-_Static_assert(offsetof(psa_msg_t, type) < offsetof(psa_msg_t, handle),
+WT_STATIC_ASSERT(offsetof(psa_msg_t, type) < offsetof(psa_msg_t, handle),
                "psa_msg_t type precedes handle");
-_Static_assert(offsetof(psa_msg_t, type) == 0, "psa_msg_t type at offset 0");
+WT_STATIC_ASSERT(offsetof(psa_msg_t, type) == 0, "psa_msg_t type at offset 0");
 
 int main(void)
 {
diff --git a/tests/host/psa_storage_client/Makefile b/tests/host/psa_storage_client/Makefile
index 73f558c4..8442e4dc 100644
--- a/tests/host/psa_storage_client/Makefile
+++ b/tests/host/psa_storage_client/Makefile
@@ -34,7 +34,7 @@ CFLAGS := \
     -I$(ROOT)/include \
     -I$(WOLFHSM) \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/qcbor_shim/Makefile b/tests/host/qcbor_shim/Makefile
index 81509359..f9c8fdc6 100644
--- a/tests/host/qcbor_shim/Makefile
+++ b/tests/host/qcbor_shim/Makefile
@@ -35,9 +35,10 @@ CFLAGS := \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
     -I$(WOLFCOSE)/include \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
+include ../vendor_c99.mk
 
 COSE_CFLAGS := $(filter-out -Werror -pedantic,$(CFLAGS))
 
@@ -128,7 +129,7 @@ INTEROP_CFLAGS := \
     -DWOLFCOSE_ENABLE_DEPRECATED_ALGS \
     -I. -I$(ROOT)/include -I$(WOLFSSL) -I$(WOLFCOSE)/include \
     -I$(QCBOR_DIR)/inc -I$(QCBOR_DIR)/inc/qcbor \
-    -std=c11 -O0 -g -Wall -Wextra -Wno-unused-function -Wno-unused-parameter \
+    -std=c99 -O0 -g -Wall -Wextra -Wno-unused-function -Wno-unused-parameter \
     -Wno-implicit-function-declaration
 INTEROP_SRCS := \
     main.c \
diff --git a/tests/host/qcbor_shim/main.c b/tests/host/qcbor_shim/main.c
index 15db10f6..1dfdc1b6 100644
--- a/tests/host/qcbor_shim/main.c
+++ b/tests/host/qcbor_shim/main.c
@@ -167,6 +167,9 @@ int main(void)
     QCBOREncodeContext ec;
     UsefulBuf tbsBuf;
     UsefulBufC ub;
+    UsefulBufC pb;
+    UsefulBufC empty;
+    UsefulBufC plen;
     size_t payloadLen;
     size_t tokenLen = 0u;
     int i;
@@ -178,6 +181,7 @@ int main(void)
         0x40,
         0x45
     };
+    static const uint8_t two[] = { 0x01, 0x02 };
 
     if ((wc_InitRng(&rng) != 0) || (wc_ecc_init(&key) != 0) ||
         (wc_ecc_make_key(&rng, 32, &key) != 0)) {
@@ -240,18 +244,12 @@ int main(void)
     QCBOREncode_Init(&ec, tbsBuf);
     QCBOREncode_OpenArray(&ec);
     QCBOREncode_AddSZString(&ec, "Signature1");
-    {
-        UsefulBufC pb;
-        UsefulBufC empty;
-        UsefulBufC plen;
-        static const uint8_t two[] = { 0x01, 0x02 };
-        pb.ptr = two; pb.len = sizeof(two);
-        empty.ptr = NULL; empty.len = 0u;
-        plen.ptr = NULL; plen.len = 5u;
-        QCBOREncode_AddBytes(&ec, pb);
-        QCBOREncode_AddBytes(&ec, empty);
-        QCBOREncode_AddBytesLenOnly(&ec, plen);
-    }
+    pb.ptr = two; pb.len = sizeof(two);
+    empty.ptr = NULL; empty.len = 0u;
+    plen.ptr = NULL; plen.len = 5u;
+    QCBOREncode_AddBytes(&ec, pb);
+    QCBOREncode_AddBytes(&ec, empty);
+    QCBOREncode_AddBytesLenOnly(&ec, plen);
     QCBOREncode_CloseArray(&ec);
     ret = QCBOREncode_Finish(&ec, &tbsOut);
     check((ret == QCBOR_SUCCESS) && (tbsOut.len == sizeof(expected_tbs)) &&
diff --git a/tests/host/qcbor_shim/user_settings.h b/tests/host/qcbor_shim/user_settings.h
index 4d6dafa3..c7e8c8d5 100644
--- a/tests/host/qcbor_shim/user_settings.h
+++ b/tests/host/qcbor_shim/user_settings.h
@@ -28,7 +28,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/rollback/Makefile b/tests/host/rollback/Makefile
index 4b03d263..e7ceed4f 100644
--- a/tests/host/rollback/Makefile
+++ b/tests/host/rollback/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_rollback
diff --git a/tests/host/runtime_verify/Makefile b/tests/host/runtime_verify/Makefile
index bfeb7d91..1c972105 100644
--- a/tests/host/runtime_verify/Makefile
+++ b/tests/host/runtime_verify/Makefile
@@ -29,7 +29,7 @@ CFLAGS := \
     -I. \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/sp_layout/Makefile b/tests/host/sp_layout/Makefile
index e1574819..e1af3aed 100644
--- a/tests/host/sp_layout/Makefile
+++ b/tests/host/sp_layout/Makefile
@@ -24,8 +24,9 @@ CC ?= cc
 BUILD_DIR ?= build
 
 CFLAGS := \
+    -I$(ROOT)/include \
     -I$(ROOT)/port/stm32h563 \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic
 CFLAGS += $(EXTRA_CFLAGS)
 
 TEST_BIN := $(BUILD_DIR)/test_sp_layout
diff --git a/tests/host/sp_layout/main.c b/tests/host/sp_layout/main.c
index 8e2fd592..02515e43 100644
--- a/tests/host/sp_layout/main.c
+++ b/tests/host/sp_layout/main.c
@@ -25,40 +25,41 @@
  * fails here (and the matching ASSERT in secure.ld fails at link). */
 
 #include "memory_map.h"
+#include "wolftrust/static_assert.h"
 
 #include <stdio.h>
 
 /* Every Armv8-M MPU region base is 32-byte aligned. */
-_Static_assert((WT_SP_CRYPTO_STACK_BASE & 0x1FU) == 0U,
+WT_STATIC_ASSERT((WT_SP_CRYPTO_STACK_BASE & 0x1FU) == 0U,
                "crypto SP stack not 32-byte aligned");
-_Static_assert((WT_SP_ATTEST_STACK_BASE & 0x1FU) == 0U,
+WT_STATIC_ASSERT((WT_SP_ATTEST_STACK_BASE & 0x1FU) == 0U,
                "attest SP stack not 32-byte aligned");
-_Static_assert((WT_SP_SECURE_STACK_SIZE & 0x1FU) == 0U,
+WT_STATIC_ASSERT((WT_SP_SECURE_STACK_SIZE & 0x1FU) == 0U,
                "SP stack size not a 32-byte multiple");
 
 /* The carve stays inside the secure RAM window and above the guest region. */
-_Static_assert(WT_SP_SECURE_RAM_BASE >= WT_RAM_S_BASE,
+WT_STATIC_ASSERT(WT_SP_SECURE_RAM_BASE >= WT_RAM_S_BASE,
                "SP secure RAM below the secure RAM window");
-_Static_assert(WT_SP_SECURE_RAM_END <= (WT_RAM_S_BASE + WT_RAM_S_SIZE),
+WT_STATIC_ASSERT(WT_SP_SECURE_RAM_END <= (WT_RAM_S_BASE + WT_RAM_S_SIZE),
                "SP secure RAM overflows the secure RAM window");
 
 /* Partitions are contiguous and non-overlapping, filling the reserved region. */
-_Static_assert(WT_SP_SECURE_RAM_SIZE ==
+WT_STATIC_ASSERT(WT_SP_SECURE_RAM_SIZE ==
                    WT_SP_SECURE_STACK_SIZE * WT_SP_SECURE_STACK_COUNT,
                "SP secure RAM size does not match stack count");
-_Static_assert(WT_SP_CRYPTO_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
+WT_STATIC_ASSERT(WT_SP_CRYPTO_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
                    WT_SP_ATTEST_STACK_BASE,
                "crypto and attest SP stacks overlap or leave a gap");
-_Static_assert(WT_SP_ATTEST_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
+WT_STATIC_ASSERT(WT_SP_ATTEST_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
                    WT_SP_FF_SERVER_STACK_BASE,
                "attest and FF server SP stacks overlap or leave a gap");
-_Static_assert(WT_SP_FF_SERVER_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
+WT_STATIC_ASSERT(WT_SP_FF_SERVER_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
                    WT_SP_FF_DRIVER_STACK_BASE,
                "FF server and driver SP stacks overlap or leave a gap");
-_Static_assert(WT_SP_FF_DRIVER_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
+WT_STATIC_ASSERT(WT_SP_FF_DRIVER_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
                    WT_SP_FF_CLIENT_STACK_BASE,
                "FF driver and client SP stacks overlap or leave a gap");
-_Static_assert(WT_SP_FF_CLIENT_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
+WT_STATIC_ASSERT(WT_SP_FF_CLIENT_STACK_BASE + WT_SP_SECURE_STACK_SIZE ==
                    WT_SP_SECURE_RAM_END,
                "SP stacks do not fill the reserved region");
 
diff --git a/tests/host/sp_recovery/Makefile b/tests/host/sp_recovery/Makefile
index ccd84e1a..9a9faee2 100644
--- a/tests/host/sp_recovery/Makefile
+++ b/tests/host/sp_recovery/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_sp_recovery
diff --git a/tests/host/spm/Makefile b/tests/host/spm/Makefile
index dc842f0a..ee7d36a2 100644
--- a/tests/host/spm/Makefile
+++ b/tests/host/spm/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 
diff --git a/tests/host/spm_gate/Makefile b/tests/host/spm_gate/Makefile
index 24f7bac4..1ac96b46 100644
--- a/tests/host/spm_gate/Makefile
+++ b/tests/host/spm_gate/Makefile
@@ -21,7 +21,7 @@ ROOT := ../../..
 CC ?= cc
 BUILD_DIR ?= build
 
-CFLAGS := -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+CFLAGS := -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -I$(ROOT)/include $(EXTRA_CFLAGS)
 LDFLAGS := $(EXTRA_LDFLAGS)
 TEST := $(BUILD_DIR)/test_spm_gate
diff --git a/tests/host/storage_service/Makefile b/tests/host/storage_service/Makefile
index 0cf127f9..83f2ba5e 100644
--- a/tests/host/storage_service/Makefile
+++ b/tests/host/storage_service/Makefile
@@ -30,7 +30,7 @@ CFLAGS := \
     -I. \
     -I$(ROOT)/include \
     -I$(WOLFHSM) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/vault_service/Makefile b/tests/host/vault_service/Makefile
index b7ca9517..8dec8088 100644
--- a/tests/host/vault_service/Makefile
+++ b/tests/host/vault_service/Makefile
@@ -30,7 +30,7 @@ CFLAGS := \
     -I. \
     -I$(ROOT)/include \
     -I$(WOLFHSM) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/vendor_c99.mk b/tests/host/vendor_c99.mk
new file mode 100644
index 00000000..f1eb440c
--- /dev/null
+++ b/tests/host/vendor_c99.mk
@@ -0,0 +1,7 @@
+# Keep C99 diagnostics on wolfTrust code, not external dependency headers.
+ifneq ($(findstring clang,$(shell $(CC) --version 2>/dev/null)),)
+CFLAGS += --system-header-prefix=wolfssl/ \
+    --system-header-prefix=wolfhsm/
+else
+CFLAGS += -isystem $(WOLFSSL) $(if $(WOLFHSM),-isystem $(WOLFHSM))
+endif
diff --git a/tests/host/vnet/test_pool.c b/tests/host/vnet/test_pool.c
index 1b597c96..41128ea5 100644
--- a/tests/host/vnet/test_pool.c
+++ b/tests/host/vnet/test_pool.c
@@ -88,6 +88,7 @@ static int test_pool_double_release_and_stale(void)
 {
     vnet_pool_t p;
     uint16_t slot;
+    uint16_t s2;
     uint16_t gen0, gen1;
     vnet_pool_init(&p, g_storage, POOL_N);
 
@@ -100,15 +101,13 @@ static int test_pool_double_release_and_stale(void)
     T_EQ_INT(vnet_pool_release(&p, slot, gen0), WT_VNET_E_DOUBLE_RELEASE);
 
     /* Realloc same slot bumps gen. Old cookie must be rejected. */
-    {
-        uint16_t s2 = vnet_pool_alloc(&p, 20);
-        T_EQ_INT(s2, slot);
-        gen1 = g_storage[slot].gen;
-        T_CHECK(gen1 != gen0);
-        T_EQ_INT(vnet_pool_release(&p, slot, gen0), WT_VNET_E_STALE_COOKIE);
-        T_EQ_INT(vnet_pool_ref(&p, slot, gen0), WT_VNET_E_STALE_COOKIE);
-        T_EQ_INT(vnet_pool_release(&p, slot, gen1), 1);
-    }
+    s2 = vnet_pool_alloc(&p, 20);
+    T_EQ_INT(s2, slot);
+    gen1 = g_storage[slot].gen;
+    T_CHECK(gen1 != gen0);
+    T_EQ_INT(vnet_pool_release(&p, slot, gen0), WT_VNET_E_STALE_COOKIE);
+    T_EQ_INT(vnet_pool_ref(&p, slot, gen0), WT_VNET_E_STALE_COOKIE);
+    T_EQ_INT(vnet_pool_release(&p, slot, gen1), 1);
     return 0;
 }
 
diff --git a/tests/host/vnet_relay/Makefile b/tests/host/vnet_relay/Makefile
index 830cf517..351808dd 100644
--- a/tests/host/vnet_relay/Makefile
+++ b/tests/host/vnet_relay/Makefile
@@ -31,7 +31,7 @@ CFLAGS := \
     -I$(ROOT)/tests/host/wolfhsm_loopback \
     -I$(ROOT)/include \
     -I$(WOLFSSL) \
-    -std=c11 -O0 -g -Wall -Wextra -Werror -pedantic \
+    -std=c99 -O0 -g -Wall -Wextra -Werror -pedantic \
     -Wno-unused-function -Wno-unused-parameter
 CFLAGS += $(EXTRA_CFLAGS)
 
diff --git a/tests/host/wolfhsm_loopback/user_settings.h b/tests/host/wolfhsm_loopback/user_settings.h
index 1a2596c4..ac358fb8 100644
--- a/tests/host/wolfhsm_loopback/user_settings.h
+++ b/tests/host/wolfhsm_loopback/user_settings.h
@@ -27,7 +27,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>
 
diff --git a/tests/host/wolfhsm_relay/stubs/zephyr/logging/log.h b/tests/host/wolfhsm_relay/stubs/zephyr/logging/log.h
index 353326c6..d69f5c6f 100644
--- a/tests/host/wolfhsm_relay/stubs/zephyr/logging/log.h
+++ b/tests/host/wolfhsm_relay/stubs/zephyr/logging/log.h
@@ -21,7 +21,8 @@
 #ifndef WOLFTRUST_TEST_ZEPHYR_LOG_H
 #define WOLFTRUST_TEST_ZEPHYR_LOG_H
 
-#define LOG_MODULE_REGISTER(name, level)
+#define LOG_MODULE_REGISTER(name, level) \
+    extern int wt_test_log_module_##name
 #define LOG_ERR(...) ((void)0)
 #define LOG_WRN(...) ((void)0)
 #define LOG_INF(...) ((void)0)
diff --git a/tests/host/wolfhsm_relay/user_settings.h b/tests/host/wolfhsm_relay/user_settings.h
index 1a2596c4..ac358fb8 100644
--- a/tests/host/wolfhsm_relay/user_settings.h
+++ b/tests/host/wolfhsm_relay/user_settings.h
@@ -27,7 +27,7 @@
 #ifndef USER_SETTINGS_H
 #define USER_SETTINGS_H
 
-/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c11
+/* wc_ecc_get_curve_idx_from_name() calls strcasecmp(); under strict -std=c99
  * glibc only declares it from <strings.h>, so pull it in for this host build. */
 #include <strings.h>