diff --git a/config/tfa-base.yaml b/config/tfa-base.yaml
index 4bbd5ec6096f2c07dccb97042b10781c99cee4de..1d141a4af19b34ad7bc2c71c19c41d5f0721a4c7 100644
--- a/config/tfa-base.yaml
+++ b/config/tfa-base.yaml
@@ -22,6 +22,17 @@ build:
       ARM_DISABLE_TRUSTED_WDOG: 1
       FVP_HW_CONFIG_DTS: fdts/fvp-base-gicv3-psci-1t.dts
 
+    prebuild:
+      # tfa does not notice when parameters are changed and can therefore end up
+      # with stale compilation units. Let's work around that by saving the
+      # parameters and comparing to the last run. If they have changed, force a
+      # clean. Also works for the case where shrinkwrap.params doesn't exist.
+      - 'echo "${param:join_equal}" > ${param:builddir}/shrinkwrap.params.new'
+      - if ! cmp -s "${param:builddir}/shrinkwrap.params.new" "${param:builddir}/shrinkwrap.params"; then
+      -     make BUILD_BASE=${param:builddir} clean
+      - fi
+      - mv ${param:builddir}/shrinkwrap.params.new ${param:builddir}/shrinkwrap.params
+
     build:
       # tfa has makefile dependency bug that makes parallel make for more than
       # ~8 jobs unreliable, so limit it to 8.
diff --git a/shrinkwrap/utils/config.py b/shrinkwrap/utils/config.py
index 372b0c2cc5415d6a3e70f9722d6e45d31e6cf0e4..d1cfdf989c02ee15b9dff69bf67075cc010ded2d 100644
--- a/shrinkwrap/utils/config.py
+++ b/shrinkwrap/utils/config.py
@@ -344,7 +344,7 @@ def _string_has_macros(string):
 def _mk_params(params, separator):
 	pairs = [f'{k}' if v is None else f'{k}{separator}{v}'
 						for k, v in params.items()]
-	return ' '.join(pairs)
+	return ' '.join(sorted(pairs))
 
 
 def filename(name, rel=os.getcwd()):