diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index 265663ccf96..bb924a5bf25 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -540,6 +540,31 @@ menu "mbedTLS"
             priority level and any level from 1 to 3 can be selected (based on the availability).
             Note: Higher value indicates high interrupt priority.
 
+    menu "Security hardening"
+
+        config MBEDTLS_CONSTANT_TIME_PRIME_GEN
+            bool "Constant-time prime generation"
+            default n
+            help
+                Use mbedtls' constant-time small-factor test (a constant-time
+                GCD against the product of all odd primes up to 997) when
+                generating prime numbers, e.g. during RSA key generation.
+
+                The constant-time implementation avoids a timing side channel
+                in prime generation, but it makes RSA key generation roughly
+                ten times slower, and its long non-yielding software
+                computations can starve the idle task and trigger the task
+                watchdog, so key generation code may need a larger watchdog
+                timeout or the watchdog disabled.
+
+                If disabled, the variable-time trial division that mbedtls
+                used before version 3.6.7 is used instead, restoring key
+                generation performance.
+
+                Please see issue: https://github.com/Mbed-TLS/mbedtls/issues/10830
+
+    endmenu # Security hardening
+
     config MBEDTLS_HARDWARE_SHA
         bool "Enable hardware SHA acceleration"
         default y
diff --git a/components/mbedtls/mbedtls b/components/mbedtls/mbedtls
index 9d669eadb19..2b96dd8eebe 160000
--- a/components/mbedtls/mbedtls
+++ b/components/mbedtls/mbedtls
@@ -1 +1 @@
-Subproject commit 9d669eadb1955d348986b9280156710aaaadf79f
+Subproject commit 2b96dd8eebe880f304c69976b3c2fa0c5100cbb6
diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h
index a2df5264e02..3d7e86f44be 100644
--- a/components/mbedtls/port/include/mbedtls/esp_config.h
+++ b/components/mbedtls/port/include/mbedtls/esp_config.h
@@ -212,6 +212,17 @@
 #undef MBEDTLS_MPI_MUL_MPI_ALT
 #endif
 
+/* mbedtls 3.6.7 made the small-factor test used in prime generation
+ * constant-time, which slows RSA key generation down roughly tenfold and
+ * starves the idle task (the computation never yields the CPU). The
+ * non constant-time variant is the default; when it is disabled,
+ * fall back to the variable-time trial division from earlier releases. See
+ * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in library/bignum.c.
+ */
+#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
+#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME
+#endif
+
 #ifdef CONFIG_MBEDTLS_ATCA_HW_ECDSA_SIGN
 #define MBEDTLS_ECDSA_SIGN_ALT
 #endif
diff --git a/components/mbedtls/test_apps/main/test_rsa.c b/components/mbedtls/test_apps/main/test_rsa.c
index 457caaa45d6..f81b4084f0c 100644
--- a/components/mbedtls/test_apps/main/test_rsa.c
+++ b/components/mbedtls/test_apps/main/test_rsa.c
@@ -3,7 +3,7 @@
  * Focus on testing functionality where we use ESP32 hardware
  * accelerated crypto features
  *
- * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -570,6 +570,12 @@ static void rsa_key_operations(int keysize, bool check_performance, bool generat
 }
 
 
+/* With constant-time prime generation the RSA-2048 key generation below takes
+ * over a minute on most targets (~86 s on ESP32-S3), exceeding the test
+ * timeout and starving the task watchdog, so only run it with the faster
+ * variable-time implementation.
+ */
+#if !CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
 TEST_CASE("mbedtls RSA Generate Key", "[mbedtls][timeout=60]")
 {
 
@@ -607,5 +613,6 @@ TEST_CASE("mbedtls RSA Generate Key", "[mbedtls][timeout=60]")
 #endif // CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT
 
 }
+#endif // !CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
 
 #endif // CONFIG_MBEDTLS_HARDWARE_MPI
diff --git a/docs/en/api-reference/protocols/mbedtls.rst b/docs/en/api-reference/protocols/mbedtls.rst
index aac8ec8371a..d14e5831d0d 100644
--- a/docs/en/api-reference/protocols/mbedtls.rst
+++ b/docs/en/api-reference/protocols/mbedtls.rst
@@ -118,5 +118,5 @@ Reducing Binary Size
 Under ``Component Config -> mbedTLS``, there are multiple Mbed TLS features which are enabled by default but can be disabled if not needed to save code size. More information can be about this can be found in :ref:`Minimizing Binary Size <minimizing_binary_mbedtls>` docs.
 
 
-.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.6/
+.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.7/
 .. _`Knowledge Base`: https://mbed-tls.readthedocs.io/en/latest/kb/
diff --git a/docs/zh_CN/api-reference/protocols/mbedtls.rst b/docs/zh_CN/api-reference/protocols/mbedtls.rst
index f1a16383746..4c201e20bde 100644
--- a/docs/zh_CN/api-reference/protocols/mbedtls.rst
+++ b/docs/zh_CN/api-reference/protocols/mbedtls.rst
@@ -118,5 +118,5 @@ ESP-IDF 中的示例使用 :doc:`/api-reference/protocols/esp_tls`，为访问
 在 ``Component Config -> mbedTLS`` 中，有多个 Mbed TLS 功能默认为启用状态。如果不需要这些功能，可将其禁用以减小固件大小。要了解更多信息，请参考 :ref:`Minimizing Binary Size <minimizing_binary_mbedtls>` 文档。
 
 
-.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.6/
+.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.7/
 .. _`Knowledge Base`: https://mbed-tls.readthedocs.io/en/latest/kb/