diff --git a/arm-runtimes/test-support/run_fvp.py b/arm-runtimes/test-support/run_fvp.py
index 2822f0bd..8f3f9563 100755
--- a/arm-runtimes/test-support/run_fvp.py
+++ b/arm-runtimes/test-support/run_fvp.py
@@ -12,22 +12,26 @@
 class FVP:
     model_exe: str
     tarmac_plugin: str
+    crypto_plugin: str
     cmdline_param: str
 
 MODELS = {
     "corstone-310": FVP(
         "Corstone-310/models/Linux64_GCC-9.3/FVP_Corstone_SSE-310",
         "Corstone-310/plugins/Linux64_GCC-9.3/TarmacTrace.so",
+        "FastModelsPortfolio_11.27/plugins/Linux64_GCC-9.3/Crypto.so",
         "cpu0.semihosting-cmd_line",
     ),
     "aem-a": FVP(
         "Base_RevC_AEMvA_pkg/models/Linux64_GCC-9.3/FVP_Base_RevC-2xAEMvA",
         "Base_RevC_AEMvA_pkg/plugins/Linux64_GCC-9.3/TarmacTrace.so",
+        "FastModelsPortfolio_11.27/plugins/Linux64_GCC-9.3/Crypto.so",
         "cluster0.cpu0.semihosting-cmd_line",
     ),
     "aem-r": FVP(
         "AEMv8R_base_pkg/models/Linux64_GCC-9.3/FVP_BaseR_AEMv8R",
         "AEMv8R_base_pkg/plugins/Linux64_GCC-9.3/TarmacTrace.so",
+        "FastModelsPortfolio_11.27/plugins/Linux64_GCC-9.3/Crypto.so",
         "cluster0.cpu0.semihosting-cmd_line",
     ),
 }
@@ -56,6 +60,7 @@ def run_fvp(
         command.extend(["--config-file", path.join(fvp_config_dir, config + ".cfg")])
     command.extend(["--application", image])
     command.extend(["--parameter", f"{model.cmdline_param}={shlex.join(arguments)}"])
+    command.extend(["--plugin", path.join(fvp_install_dir, model.crypto_plugin)])
     if tarmac_file is not None:
         command.extend([
             "--plugin",
diff --git a/docs/building-from-source.md b/docs/building-from-source.md
index c5baad80..ca44c172 100644
--- a/docs/building-from-source.md
+++ b/docs/building-from-source.md
@@ -47,11 +47,22 @@ which will prompt you to agree to their licenses. Some of the packages do not
 have installers, instead they place their license file into the
 `fvp/license_terms` directory, which you should read before continuing.
 
+The installer for the cryptography plugin requires a graphical display to run:
+it cannot run in a pure terminal session such as you might start via SSH. Also,
+it will prompt for a directory to install the plugin into. You should enter the
+pathname `fvp/install` relative to the root of your checkout. The installer
+will automatically append a subdirectory `FastModelsPortfolio_11.27` to the end
+of that, and respond with a warning such as 'Directory [...] not found (but in
+patch mode). Continue installation?' Say yes to this prompt, and continue
+clicking 'Next' until installation is complete.
+
 For non-interactive use (for example in CI systems), `get_fvps.sh` can be run
-with the `--non-interactive` option, which causes it to implcitly accept all of
-the EULAs. If you have previously downloaded and installed the FVPs outside of
-the source tree, you can set the `-DFVP_INSTALL_DIR=...` cmake option to set
-the path to them.
+with the `--non-interactive` option, which causes it to implicitly accept all
+of the EULAs and set up the correct install directories.
+
+If you have previously downloaded and installed the FVPs outside of the source
+tree, you can set the `-DFVP_INSTALL_DIR=...` cmake option to set the path to
+them.
 
 If the FVPs are not installed, tests which need them will be skipped, but QEMU
 tests will still be run, and all library variants will still be built.
diff --git a/fvp/get_fvps.sh b/fvp/get_fvps.sh
index aa1ccd4b..379a5a63 100755
--- a/fvp/get_fvps.sh
+++ b/fvp/get_fvps.sh
@@ -15,14 +15,18 @@ set -euxo pipefail
 args=$(getopt --options "" --longoptions "non-interactive" -- "${@}") || exit
 eval "set -- ${args}"
 
-INSTALLER_FLAGS_CORSTONE=""
-INSTALLER_FLAGS_CRYPTO=""
+# Change into the directory containing this script. We'll make
+# "download" and "install" subdirectories below that.
+cd "$(dirname "$0")"
+
+INSTALLER_FLAGS_CORSTONE=()
+INSTALLER_FLAGS_CRYPTO=()
 
 while true; do
     case "${1}" in
         (--non-interactive)
-            INSTALLER_FLAGS_CORSTONE="--i-agree-to-the-contained-eula --no-interactive --force"
-            INSTALLER_FLAGS_CRYPTO="--i-accept-the-end-user-license-agreement --basepath \"$(dirname \"$0\")\""
+            INSTALLER_FLAGS_CORSTONE=(--i-agree-to-the-contained-eula --no-interactive --force)
+            INSTALLER_FLAGS_CRYPTO=(--i-accept-the-end-user-license-agreement --basepath "$PWD/install")
             shift 1
         ;;
         (--)
@@ -34,17 +38,15 @@ while true; do
     esac
 done
 
-URL_CORSONE_310='https://developer.arm.com/-/media/Arm%20Developer%20Community/Downloads/OSS/FVP/Corstone-310/FVP_Corstone_SSE-310_11.24_13_Linux64.tgz?rev=c370b571bdff42d3a0152471eca3d798&hash=1E388EE3B6E8F675D02D2832DBE61946DEC0386A'
+URL_CORSTONE_310='https://developer.arm.com/-/media/Arm%20Developer%20Community/Downloads/OSS/FVP/Corstone-310/FVP_Corstone_SSE-310_11.24_13_Linux64.tgz?rev=c370b571bdff42d3a0152471eca3d798&hash=1E388EE3B6E8F675D02D2832DBE61946DEC0386A'
 URL_BASE_AEM_A='https://developer.arm.com/-/cdn-downloads/permalink/Fixed-Virtual-Platforms/FM-11.27/FVP_Base_RevC-2xAEMvA_11.27_19_Linux64.tgz'
 URL_BASE_AEM_R='https://developer.arm.com/-/cdn-downloads/permalink/Fixed-Virtual-Platforms/FM-11.27/FVP_Base_AEMv8R_11.27_19_Linux64.tgz'
 URL_CRYPTO='https://developer.arm.com/-/cdn-downloads/permalink/Fast-Models-Crypto-Plug-in/FM-11.27/FastModels_crypto_11.27.019_Linux64.tgz'
 
-cd "$(dirname "$0")"
-
 mkdir -p download
 pushd download
 DOWNLOAD_DIR="$(pwd)"
-wget --content-disposition --no-clobber "${URL_CORSONE_310}"
+wget --content-disposition --no-clobber "${URL_CORSTONE_310}"
 wget --content-disposition --no-clobber "${URL_BASE_AEM_A}"
 wget --content-disposition --no-clobber "${URL_BASE_AEM_R}"
 wget --content-disposition --no-clobber "${URL_CRYPTO}"
@@ -55,7 +57,7 @@ pushd install
 
 if [ ! -d "Corstone-310" ]; then
 tar -xf ${DOWNLOAD_DIR}/FVP_Corstone_SSE-310_11.24_13_Linux64.tgz
-./FVP_Corstone_SSE-310.sh --destination ./Corstone-310 $INSTALLER_FLAGS_CORSTONE
+./FVP_Corstone_SSE-310.sh --destination ./Corstone-310 "${INSTALLER_FLAGS_CORSTONE[@]}"
 fi
 
 if [ ! -d "Base_RevC_AEMvA_pkg" ]; then
@@ -72,9 +74,10 @@ if [ ! -d "FastModelsPortfolio_11.27" ]; then
 tar -xf ${DOWNLOAD_DIR}/FastModels_crypto_11.27.019_Linux64.tgz
 # SDDKW-93582: Non-interactive installation fails if cwd is different.
 pushd FastModels_crypto_11.27.019_Linux64
-# This installer doesn't allow providing a default path for interactive
-# installation.
-./setup.bin $INSTALLER_FLAGS_CRYPTO
+# This installer doesn't allow providing a default path for
+# interactive installation. The user will have to enter the install
+# directory as the target by hand.
+./setup.bin "${INSTALLER_FLAGS_CRYPTO[@]}"
 popd
 fi