diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index dc8463c..687c4d9 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -119,12 +119,25 @@ jobs:
       - name: install Mbed TLS
         if: matrix.tls_backend == 'mbedtls'
         run: brew install mbedtls
+      - name: diagnose Mbed TLS install (CI)
+        if: matrix.tls_backend == 'mbedtls'
+        run: |
+          echo "brew --prefix mbedtls: $(brew --prefix mbedtls)"
+          echo "brew --prefix (general): $(brew --prefix)"
+          echo "Listing MBEDTLS include (brew prefix):"
+          ls -la "$(brew --prefix mbedtls)/include" || true
+          echo "Listing /opt/homebrew/opt/mbedtls/include:"
+          ls -la /opt/homebrew/opt/mbedtls/include || true
+          echo "Listing /opt/homebrew/include:"
+          ls -la /opt/homebrew/include || true
+          echo "Make dry-run (show compile command):"
+          cd test && make -n test_mbedtls MBEDTLS_DIR=$(brew --prefix mbedtls) || true
       - name: build and run tests (OpenSSL)
         if: matrix.tls_backend == 'openssl'
         run: cd test && make
       - name: build and run tests (Mbed TLS)
         if: matrix.tls_backend == 'mbedtls'
-        run: cd test && make test_mbedtls && ./test_mbedtls
+        run: cd test && make test_mbedtls MBEDTLS_DIR=$(brew --prefix mbedtls) && ./test_mbedtls
       - name: run fuzz test target
         if: matrix.tls_backend == 'openssl'
         run: cd test && make fuzz_test