diff --git a/configure.ac b/configure.ac
index 48993b57ed..5a085cbe88 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9041,6 +9041,13 @@ then
     ENABLED_ALPN=yes
 fi
 
+# Mosquitto calls SSL_CTX_set_alpn_protos() unconditionally for its
+# bridge_alpn option, so the OpenSSL-compat ALPN surface has to be present.
+if test "x$ENABLED_MOSQUITTO" = "xyes"
+then
+    ENABLED_ALPN=yes
+fi
+
 if test "x$ENABLED_ALPN" = "xyes"
 then
     AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_ALPN"
diff --git a/src/ssl_api_ext.c b/src/ssl_api_ext.c
index 2be0da0375..87dfeefa24 100644
--- a/src/ssl_api_ext.c
+++ b/src/ssl_api_ext.c
@@ -2659,6 +2659,9 @@ int wolfSSL_set1_curves_list(WOLFSSL* ssl, const char* names)
 
 #ifdef OPENSSL_EXTRA
 
+#ifdef HAVE_ALPN
+#ifndef NO_BIO
+
 /* Set the ALPN protocol list, in wire format, on the context.
  *
  * @param [in] ctx    SSL/TLS context object.
@@ -2712,8 +2715,6 @@ int wolfSSL_CTX_set_alpn_protos(WOLFSSL_CTX *ctx, const unsigned char *p,
 }
 
 
-#ifdef HAVE_ALPN
-#ifndef NO_BIO
 /* Convert a wire-format ALPN protocol list into a comma-separated string.
  *
  * The wire format is a sequence of entries, each a length byte followed by
diff --git a/tests/api.c b/tests/api.c
index 2304f24f86..dce20b91ac 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -18078,12 +18078,14 @@ static int test_wolfSSL_set_options(void)
 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
     char appData[] = "extra msg";
 #endif
-#ifdef OPENSSL_EXTRA
+#if defined(OPENSSL_EXTRA) && defined(HAVE_ALPN) && !defined(NO_BIO)
     unsigned char protos[] = {
         7, 't', 'l', 's', '/', '1', '.', '2',
         8, 'h', 't', 't', 'p', '/', '1', '.', '1'
     };
     unsigned int len = sizeof(protos);
+#endif
+#ifdef OPENSSL_EXTRA
     void *arg = (void *)TEST_ARG;
 #endif
 
@@ -18168,12 +18170,14 @@ static int test_wolfSSL_set_options(void)
 #ifdef OPENSSL_EXTRA
     ExpectTrue(wolfSSL_set_msg_callback(ssl, msg_cb) == WOLFSSL_SUCCESS);
     wolfSSL_set_msg_callback_arg(ssl, arg);
+#if defined(HAVE_ALPN) && !defined(NO_BIO)
 #ifdef WOLFSSL_ERROR_CODE_OPENSSL
     ExpectTrue(wolfSSL_CTX_set_alpn_protos(ctx, protos, len) == 0);
 #else
     ExpectTrue(wolfSSL_CTX_set_alpn_protos(ctx, protos, len) == WOLFSSL_SUCCESS);
 #endif
 #endif
+#endif
 
 #if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) || \
     defined(WOLFSSL_MYSQL_COMPATIBLE) || defined(OPENSSL_ALL) || \
diff --git a/tests/api/test_ssl_ext.c b/tests/api/test_ssl_ext.c
index 132485c2be..727c9847dc 100644
--- a/tests/api/test_ssl_ext.c
+++ b/tests/api/test_ssl_ext.c
@@ -947,7 +947,8 @@ int test_wolfSSL_CTX_set_servername_arg_inval_ext(void)
 int test_wolfSSL_CTX_set_alpn_protos_inval_ext(void)
 {
     EXPECT_DECLS;
-#if defined(OPENSSL_EXTRA) && !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
+#if defined(OPENSSL_EXTRA) && !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS) \
+    && defined(HAVE_ALPN) && !defined(NO_BIO)
     WOLFSSL_CTX* ctx = NULL;
     const unsigned char protos[] = { 2, 'h', '2' };
 #if defined(WOLFSSL_ERROR_CODE_OPENSSL)
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index 14507d1688..e09a2195e6 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -6008,10 +6008,12 @@ WOLFSSL_API int wolfSSL_CTX_set_msg_callback_arg(WOLFSSL_CTX *ctx, void* arg);
 WOLFSSL_API int wolfSSL_set_msg_callback_arg(WOLFSSL *ssl, void* arg);
 WOLFSSL_API unsigned long wolfSSL_ERR_peek_error_line_data(const char **file,
     int *line, const char **data, int *flags);
+#if defined(HAVE_ALPN) && !defined(NO_BIO)
 WOLFSSL_API int wolfSSL_CTX_set_alpn_protos(WOLFSSL_CTX *ctx,
     const unsigned char *protos, unsigned int protos_len);
 WOLFSSL_API int wolfSSL_set_alpn_protos(WOLFSSL* ssl,
         const unsigned char* protos, unsigned int protos_len);
+#endif /* HAVE_ALPN && !NO_BIO */
 WOLFSSL_API void *wolfSSL_OPENSSL_memdup(const void *data,
     size_t siz, const char* file, int line);
 WOLFSSL_API void wolfSSL_OPENSSL_cleanse(void *ptr, size_t len);