diff --git a/src/commonlib/cbfs.c b/src/commonlib/cbfs.c
index 4379099ffe..a509bc9f61 100644
--- a/src/commonlib/cbfs.c
+++ b/src/commonlib/cbfs.c
@@ -18,6 +18,7 @@
 #include <commonlib/endian.h>
 #include <commonlib/helpers.h>
 #include <string.h>
+#include <vb2_sha.h>
 
 #if !defined(ERROR)
 #define ERROR(x...) printk(BIOS_ERR, "CBFS: " x)
diff --git a/src/security/tpm/tspi/tspi.c b/src/security/tpm/tspi/tspi.c
index e466eb87aa..4698a4dc8c 100644
--- a/src/security/tpm/tspi/tspi.c
+++ b/src/security/tpm/tspi/tspi.c
@@ -22,6 +22,7 @@
 #include <stdlib.h>
 #if CONFIG(VBOOT)
 #include <vb2_api.h>
+#include <vb2_sha.h>
 #include <assert.h>
 #endif
 
diff --git a/src/security/vboot/antirollback.h b/src/security/vboot/antirollback.h
index 6ea2c13a97..62d2e20f03 100644
--- a/src/security/vboot/antirollback.h
+++ b/src/security/vboot/antirollback.h
@@ -37,6 +37,7 @@
 
 #include <types.h>
 #include <security/tpm/tspi.h>
+#include <vb2_sha.h>
 
 struct vb2_context;
 enum vb2_pcr_digest;
diff --git a/util/cbfstool/Makefile.inc b/util/cbfstool/Makefile.inc
index 1787eb14c0..79285207b0 100644
--- a/util/cbfstool/Makefile.inc
+++ b/util/cbfstool/Makefile.inc
@@ -81,7 +81,6 @@ TOOLCPPFLAGS += -I$(top)/util/cbfstool
 TOOLCPPFLAGS += -I$(objutil)/cbfstool
 TOOLCPPFLAGS += -I$(top)/src/commonlib/include
 TOOLCPPFLAGS += -include $(top)/src/commonlib/include/commonlib/compiler.h
-TOOLCPPFLAGS += -DNEED_VB2_SHA_LIBRARY
 TOOLCPPFLAGS += -I$(VBOOT_SOURCE)/firmware/include
 TOOLCPPFLAGS += -I$(VBOOT_SOURCE)/firmware/2lib/include
 # UEFI header file support. It's not pretty, but that's what we currently
diff --git a/util/cbfstool/cbfs_image.c b/util/cbfstool/cbfs_image.c
index 5ff81309f4..5cbe1f185a 100644
--- a/util/cbfstool/cbfs_image.c
+++ b/util/cbfstool/cbfs_image.c
@@ -22,6 +22,7 @@
 #include <string.h>
 #include <strings.h>
 #include <commonlib/endian.h>
+#include <vb2_sha.h>
 
 #include "common.h"
 #include "cbfs_image.h"