diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c153b0af6..e9ba613eef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,7 +56,6 @@ jobs:
           ninja-build
       - name: Configure
         # TODO: png: https://github.com/stepmania/stepmania/issues/1881
-        # TODO: tomcrypt: https://github.com/stepmania/stepmania/issues/1885
         run: cmake -G Ninja -B build
           -DWITH_SYSTEM_FFMPEG=ON
           -DWITH_SYSTEM_GLEW=ON
@@ -66,7 +65,7 @@ jobs:
           -DWITH_SYSTEM_OGG=ON
           -DWITH_SYSTEM_PCRE=ON
           -DWITH_SYSTEM_PNG=OFF
-          -DWITH_SYSTEM_TOMCRYPT=OFF
+          -DWITH_SYSTEM_TOMCRYPT=ON
           -DWITH_SYSTEM_TOMMATH=ON
           -DWITH_SYSTEM_ZLIB=ON
       - name: Build
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 72cb54a493..0dfbdf5f6d 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -681,6 +681,9 @@ elseif(NOT WITH_SYSTEM_PNG)
   list(APPEND SM_INCLUDE_DIRS "${SM_EXTERN_DIR}/libpng/include")
 endif()
 
+if(NOT WITH_SYSTEM_TOMCRYPT)
+  list(APPEND SM_INCLUDE_DIRS "${SM_SRC_DIR}/libtomcrypt/src/headers")
+endif()
 
 target_include_directories("${SM_EXE_NAME}" PUBLIC ${SM_INCLUDE_DIRS})
 
diff --git a/src/CryptHelpers.h b/src/CryptHelpers.h
index 5171f54e2f..c09daf8824 100644
--- a/src/CryptHelpers.h
+++ b/src/CryptHelpers.h
@@ -3,7 +3,7 @@
 
 #if !defined(DISABLE_CRYPTO)
 
-#include "libtomcrypt/src/headers/tomcrypt.h"
+#include <tomcrypt.h>
 
 class PRNGWrapper
 {
diff --git a/src/CryptManager.cpp b/src/CryptManager.cpp
index f61b467760..fa882d51bd 100644
--- a/src/CryptManager.cpp
+++ b/src/CryptManager.cpp
@@ -1,4 +1,7 @@
 #include "global.h"
+
+#include <tomcrypt.h>
+
 #include "CryptManager.h"
 #include "RageUtil.h"
 #include "RageLog.h"
@@ -9,8 +12,6 @@
 #include "LuaReference.h"
 #include "LuaManager.h"
 
-#include "libtomcrypt/src/headers/tomcrypt.h"
-
 CryptManager*	CRYPTMAN	= nullptr;	// global and accessible from anywhere in our program
 
 static const RString PRIVATE_KEY_PATH = "Data/private.rsa";