diff --git a/Makefile b/Makefile
index d482310..c244413 100644
--- a/Makefile
+++ b/Makefile
@@ -211,6 +211,7 @@
 ##
 TFA_SRC := $(ROOT_DIR)/trusted-firmware-a
 TFA_OUT := $(OUT_DIR)/trusted-firmware-a
+TFA_STAMP := $(TFA_OUT)/trusted-firmware-a.stamp
 TFA_TOOLCHAIN ?= gcc-9.2
 TFA_VERBOSE ?= $(VERBOSE)
 $(eval $(call define_toolchain,$(TFA_TOOLCHAIN),TFA_))
@@ -231,8 +232,11 @@
 .PHONY: tfa
 tfa: $(TFA_OUT)/qemu/release/bl1.bin $(TFA_OUT)/qemu/release/bl2.bin $(TFA_OUT)/qemu/release/bl31.bin
 
-$(TFA_OUT)/qemu/release/bl1.bin $(TFA_OUT)/qemu/release/bl2.bin $(TFA_OUT)/qemu/release/bl31.bin &: FORCE
+# This should use grouped targets, but we don't have make 4.3 in our CI.
+$(TFA_OUT)/qemu/release/bl1.bin $(TFA_OUT)/qemu/release/bl2.bin $(TFA_OUT)/qemu/release/bl31.bin: $(TFA_STAMP)
+$(TFA_STAMP): FORCE
 	+ $(TFA_MAKE) all
+	touch $(TFA_STAMP)
 
 .PHONY: tfa_clean
 tfa_clean: