diff --git a/.github/workflows/os-check.yml b/.github/workflows/os-check.yml
index 724fa8191db..30d99ae0423 100644
--- a/.github/workflows/os-check.yml
+++ b/.github/workflows/os-check.yml
@@ -55,6 +55,8 @@ jobs:
             CPPFLAGS=''-DWC_RNG_SEED_CB -DWOLFSSL_NO_GETPID'' ',
           # PKCS#7 with RSA-PSS (CMS RSASSA-PSS signers)
           '--enable-pkcs7 CPPFLAGS=-DWC_RSA_PSS',
+          # PKCS#7 without RSA-PSS
+          '--enable-pkcs7',
           '--enable-opensslextra CPPFLAGS=''-DWOLFSSL_NO_CA_NAMES'' ',
           '--enable-opensslextra=x509small',
           'CPPFLAGS=''-DWOLFSSL_EXTRA'' ',
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index 135163dd25d..643bc4b1545 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -5437,7 +5437,9 @@ static int wc_PKCS7_ParseSignerInfo(wc_PKCS7* pkcs7, byte* in, word32 inSz,
                 /* Only parse params when still inside the AlgorithmIdentifier;
                  * when optional params are absent, idx is already past the sequence. */
                 else if (algoContentStart + (word32)algoSeqLen > idx) {
+#if defined(WC_RSA_PSS) && !defined(NO_RSA)
                     word32 paramsStart = idx;
+#endif
                     byte paramTag;
                     int paramLen = 0;
                     if (GetASNTag(in, &idx, &paramTag, inSz) != 0 ||