diff --git a/scripts/all-core.sh b/scripts/all-core.sh
index a9070a8e20..5f7aa65343 100644
--- a/scripts/all-core.sh
+++ b/scripts/all-core.sh
@@ -281,6 +281,8 @@ setup_quiet_wrappers()
     # Note that the cmake wrapper breaks unless we use an absolute path here.
     if [[ -e ${PWD}/framework/scripts/quiet ]]; then
         export PATH=${PWD}/framework/scripts/quiet:$PATH
+        # pass on our own QUIET setting to the wrappers
+        export QUIET
     fi
 }
 
@@ -661,10 +663,18 @@ pre_restore_files () {
     # the ones checked into git, take care not to modify them. Whatever
     # this function leaves behind is what the script will restore before
     # each component.
-    case "$(head -n1 Makefile)" in
+    if ! in_mbedtls_repo; then
+        return
+    fi
+    local makefiles="library/Makefile programs/Makefile programs/fuzz/Makefile tests/Makefile"
+    if in_3_6_branch; then
+        makefiles="Makefile $makefiles"
+    fi
+    # No root Makefile in development, use the one in library
+    case "$(head -n1 library/Makefile)" in
         *[Gg]enerated*)
-            git update-index --no-skip-worktree Makefile library/Makefile programs/Makefile tests/Makefile programs/fuzz/Makefile
-            git checkout -- Makefile library/Makefile programs/Makefile tests/Makefile programs/fuzz/Makefile
+            git update-index --no-skip-worktree $makefiles
+            git checkout -- $makefiles
             ;;
     esac
 }
@@ -887,11 +897,7 @@ pre_generate_files() {
     # since make doesn't have proper dependencies, remove any possibly outdate
     # file that might be around before generating fresh ones
     $MAKE_COMMAND neat
-    if [ $QUIET -eq 1 ]; then
-        $MAKE_COMMAND generated_files >/dev/null
-    else
-        $MAKE_COMMAND generated_files
-    fi
+    $MAKE_COMMAND generated_files
 }
 
 pre_load_helpers () {
diff --git a/scripts/check_names.py b/scripts/check_names.py
index 1afbb8a131..df9e68d6d2 100755
--- a/scripts/check_names.py
+++ b/scripts/check_names.py
@@ -51,6 +51,16 @@
 from mbedtls_framework import build_tree
 
 
+class MaxLevelFilter(logging.Filter):
+    """Allow records with level <= max_level."""
+    def __init__(self, max_level):
+        super().__init__()
+        self.max_level = max_level
+
+    def filter(self, record):
+        return record.levelno <= self.max_level
+
+
 # Naming patterns to check against. These are defined outside the NameCheck
 # class for ease of modification.
 PUBLIC_MACRO_PATTERN = r"^(MBEDTLS|PSA|TF_PSA_CRYPTO)_[0-9A-Z_]*[0-9A-Z]$"
@@ -791,11 +801,13 @@ def parse_symbols(self):
             source_dir = os.getcwd()
             build_dir = tempfile.mkdtemp()
             os.chdir(build_dir)
-            subprocess.run(
+            result = subprocess.run(
                 ["cmake", "-DGEN_FILES=ON", source_dir],
                 universal_newlines=True,
+                stdout=subprocess.PIPE,
                 check=True
             )
+            self.log.debug(result.stdout)
             subprocess.run(
                 ["cmake", "--build", "."],
                 env=my_environment,
@@ -813,7 +825,7 @@ def parse_symbols(self):
             os.chdir(source_dir)
             shutil.rmtree(build_dir)
         except subprocess.CalledProcessError as error:
-            self.log.debug(error.output)
+            self.log.error(error.output)
             raise error
         finally:
             # Put back the original config regardless of there being errors.
@@ -962,11 +974,13 @@ def parse_symbols(self):
             source_dir = os.getcwd()
             build_dir = tempfile.mkdtemp()
             os.chdir(build_dir)
-            subprocess.run(
+            result = subprocess.run(
                 ["cmake", "-DGEN_FILES=ON", source_dir],
                 universal_newlines=True,
+                stdout=subprocess.PIPE,
                 check=True
             )
+            self.log.debug(result.stdout)
             subprocess.run(
                 ["cmake", "--build", "."],
                 env=my_environment,
@@ -1178,15 +1192,28 @@ def main():
     parser.add_argument(
         "-q", "--quiet",
         action="store_true",
-        help="hide unnecessary text, explanations, and highlights"
+        help="only print warnings and errors"
     )
 
     args = parser.parse_args()
 
     # Configure the global logger, which is then passed to the classes below
     log = logging.getLogger()
-    log.setLevel(logging.DEBUG if args.verbose else logging.INFO)
-    log.addHandler(logging.StreamHandler())
+    log.setLevel(logging.DEBUG if args.verbose else
+                 logging.INFO if not args.quiet else
+                 logging.WARN)
+
+    # stdout handler: DEBUG/INFO only
+    h_out = logging.StreamHandler(sys.stdout)
+    h_out.setLevel(logging.DEBUG)
+    h_out.addFilter(MaxLevelFilter(logging.INFO))
+
+    # stderr handler: WARNING and above
+    h_err = logging.StreamHandler(sys.stderr)
+    h_err.setLevel(logging.WARNING)
+
+    log.addHandler(h_out)
+    log.addHandler(h_err)
 
     try:
         if build_tree.looks_like_tf_psa_crypto_root(os.getcwd()):
diff --git a/scripts/quiet/quiet.sh b/scripts/quiet/quiet.sh
index 0f26184d0d..be00d3bd8d 100644
--- a/scripts/quiet/quiet.sh
+++ b/scripts/quiet/quiet.sh
@@ -21,6 +21,11 @@
 # NO_SILENCE - a regex that describes the commandline arguments for which output will not
 #              be silenced, e.g. " --version | test ". In this example, "make lib test" will
 #              not be silent, but "make lib" will be.
+#
+# It optionally uses the following variable:
+#
+# QUIET - if set to a non-zero value, don't even print the command being invoked
+: ${QUIET:=0}
 
 # Identify path to original tool. There is an edge-case here where the quiet wrapper is on the path via
 # a symlink or relative path, but "type -ap" yields the wrapper with it's normalised path. We use
@@ -48,7 +53,7 @@ print_quoted_args() {
     done
 }
 
-if [[ ! " $* " =~ " --version " ]]; then
+if [[ ! " $* " =~ " --version " ]] && [[ "$QUIET" -eq "0" ]]; then
     # Display the command being invoked - if it succeeds, this is all that will
     # be displayed. Don't do this for invocations with --version, because
     # this output is often parsed by scripts, so we don't want to modify it.