diff --git a/include/psa/crypto.h b/include/psa/crypto.h
index 77ade6c89..6ff001318 100644
--- a/include/psa/crypto.h
+++ b/include/psa/crypto.h
@@ -3068,9 +3068,9 @@ psa_status_t psa_generator_read(psa_crypto_generator_t *generator,
  * The generator's capacity is decreased by the number of bytes read.
  *
  * \param[in] attributes    The attributes for the new key.
+ * \param[in,out] generator The generator object to read from.
  * \param[out] handle       On success, a handle to the newly created key.
  *                          \c 0 on failure.
- * \param[in,out] generator The generator object to read from.
  *
  * \retval #PSA_SUCCESS
  *         Success.
@@ -3099,8 +3099,8 @@ psa_status_t psa_generator_read(psa_crypto_generator_t *generator,
  *         results in this error code.
  */
 psa_status_t psa_generate_derived_key(const psa_key_attributes_t *attributes,
-                                      psa_key_handle_t *handle,
-                                      psa_crypto_generator_t *generator);
+                                      psa_crypto_generator_t *generator,
+                                      psa_key_handle_t *handle);
 
 /** Abort a generator.
  *
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 6a4f180c4..b0b7de10f 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -4409,8 +4409,8 @@ exit:
 }
 
 psa_status_t psa_generate_derived_key( const psa_key_attributes_t *attributes,
-                                       psa_key_handle_t *handle,
-                                       psa_crypto_generator_t *generator )
+                                       psa_crypto_generator_t *generator,
+                                       psa_key_handle_t *handle )
 {
     psa_status_t status;
     psa_key_slot_t *slot = NULL;
diff --git a/programs/psa/key_ladder_demo.c b/programs/psa/key_ladder_demo.c
index 523668e13..82e79a978 100644
--- a/programs/psa/key_ladder_demo.c
+++ b/programs/psa/key_ladder_demo.c
@@ -306,8 +306,8 @@ static psa_status_t derive_key_ladder( const char *ladder[],
         *key_handle = 0;
         /* Use the generator obtained from the parent key to create
          * the next intermediate key. */
-        PSA_CHECK( psa_generate_derived_key( &attributes, key_handle,
-                                             &generator ) );
+        PSA_CHECK( psa_generate_derived_key( &attributes, &generator,
+                                             key_handle ) );
         PSA_CHECK( psa_generator_abort( &generator ) );
     }
 
@@ -343,8 +343,8 @@ static psa_status_t derive_wrapping_key( psa_key_usage_t usage,
                    WRAPPING_KEY_SALT, WRAPPING_KEY_SALT_LENGTH,
                    NULL, 0,
                    PSA_BITS_TO_BYTES( WRAPPING_KEY_BITS ) ) );
-    PSA_CHECK( psa_generate_derived_key( &attributes, wrapping_key_handle,
-                                         &generator ) );
+    PSA_CHECK( psa_generate_derived_key( &attributes, &generator,
+                                         wrapping_key_handle ) );
 
 exit:
     psa_generator_abort( &generator );
diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function
index 6002da088..740cb11b3 100644
--- a/tests/suites/test_suite_psa_crypto.function
+++ b/tests/suites/test_suite_psa_crypto.function
@@ -4358,8 +4358,8 @@ void derive_key_exercise( int alg_arg,
     psa_set_key_algorithm( &attributes, derived_alg );
     psa_set_key_type( &attributes, derived_type );
     psa_set_key_bits( &attributes, derived_bits );
-    PSA_ASSERT( psa_generate_derived_key( &attributes, &derived_handle,
-                                          &generator ) );
+    PSA_ASSERT( psa_generate_derived_key( &attributes, &generator,
+                                          &derived_handle ) );
 
     /* Test the key information */
     PSA_ASSERT( psa_get_key_attributes( derived_handle, &got_attributes ) );
@@ -4429,16 +4429,16 @@ void derive_key_export( int alg_arg,
     psa_set_key_algorithm( &derived_attributes, 0 );
     psa_set_key_type( &derived_attributes, PSA_KEY_TYPE_RAW_DATA );
     psa_set_key_bits( &derived_attributes, PSA_BYTES_TO_BITS( bytes1 ) );
-    PSA_ASSERT( psa_generate_derived_key( &derived_attributes, &derived_handle,
-                                          &generator ) );
+    PSA_ASSERT( psa_generate_derived_key( &derived_attributes, &generator,
+                                          &derived_handle ) );
     PSA_ASSERT( psa_export_key( derived_handle,
                                 export_buffer, bytes1,
                                 &length ) );
     TEST_EQUAL( length, bytes1 );
     PSA_ASSERT( psa_destroy_key( derived_handle ) );
     psa_set_key_bits( &derived_attributes, PSA_BYTES_TO_BITS( bytes2 ) );
-    PSA_ASSERT( psa_generate_derived_key( &derived_attributes, &derived_handle,
-                                          &generator ) );
+    PSA_ASSERT( psa_generate_derived_key( &derived_attributes, &generator,
+                                          &derived_handle ) );
     PSA_ASSERT( psa_export_key( derived_handle,
                                 export_buffer + bytes1, bytes2,
                                 &length ) );
@@ -4921,8 +4921,8 @@ void persistent_key_load_key_from_storage( data_t *data,
                 PSA_ASSERT( psa_key_derivation_input_bytes(
                                 &generator, PSA_KDF_STEP_INFO,
                                 NULL, 0 ) );
-                PSA_ASSERT( psa_generate_derived_key( &attributes, &handle,
-                                                      &generator ) );
+                PSA_ASSERT( psa_generate_derived_key( &attributes, &generator,
+                                                      &handle ) );
                 PSA_ASSERT( psa_generator_abort( &generator ) );
                 PSA_ASSERT( psa_destroy_key( base_key ) );
                 base_key = 0;