diff --git a/components/ulp/test_apps/ulp_riscv/main/test_ulp_riscv_i2c.c b/components/ulp/test_apps/ulp_riscv/main/test_ulp_riscv_i2c.c
index 2be2e701c2f..41de501bd95 100644
--- a/components/ulp/test_apps/ulp_riscv/main/test_ulp_riscv_i2c.c
+++ b/components/ulp/test_apps/ulp_riscv/main/test_ulp_riscv_i2c.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -28,8 +28,8 @@ static void load_and_start_ulp_riscv_firmware(const uint8_t* ulp_bin, size_t ulp
     TEST_ASSERT(ulp_riscv_run() == ESP_OK);
 }
 
-#define I2C_SLAVE_SCL_IO     7                  /*!<I2C gpio number for SCL */
-#define I2C_SLAVE_SDA_IO     6                  /*!<I2C gpio number for SDA */
+#define I2C_SLAVE_SCL_IO     2                  /*!<I2C gpio number for SCL, must match RTC I2C master */
+#define I2C_SLAVE_SDA_IO     3                  /*!<I2C gpio number for SDA, must match RTC I2C master */
 #define I2C_SLAVE_NUM I2C_NUM_0                 /*!<I2C port number for slave dev */
 #define I2C_SLAVE_TX_BUF_LEN  (2*DATA_LENGTH)   /*!<I2C slave tx buffer size */
 #define I2C_SLAVE_RX_BUF_LEN  (2*DATA_LENGTH)   /*!<I2C slave rx buffer size */
@@ -81,6 +81,9 @@ static void i2c_master_write_read_test(void)
     while (ulp_read_test_reply == RISCV_COMMAND_INVALID) {
     }
 
+    /* Verify that the ULP I2C read succeeded */
+    TEST_ASSERT_EQUAL(RISCV_COMMAND_OK, ulp_read_test_reply & 0xFFFF);
+
     /* Verify the test data read by the DUT */
     uint8_t *read_data = (uint8_t*)&ulp_data_rd;
     ESP_LOGI(TAG, "Master read data:");
@@ -152,10 +155,20 @@ static void i2c_slave_read_write_test(void)
     /* Wait for DUT to write test data before reading it */
     unity_wait_for_signal("slave read");
 
+    /*
+     * The RTC I2C master sends a sub-register address byte before each transaction.
+     * The slave's RX buffer now contains:
+     *   [sub_reg_addr (read phase)] [sub_reg_addr (write phase)] [data_wr[0..N-1]]
+     * Drain the two stale sub-register address bytes before reading actual data.
+     */
+    uint8_t sub_reg_discard[2];
+    i2c_slave_read_buffer(I2C_SLAVE_NUM, sub_reg_discard, sizeof(sub_reg_discard), 2000 / portTICK_PERIOD_MS);
+
     /* Verify the test data written by the DUT */
     size_rd = i2c_slave_read_buffer(I2C_SLAVE_NUM, data_rd, RW_TEST_LENGTH, 10000 / portTICK_PERIOD_MS);
     ESP_LOGI(TAG, "Slave read data:");
     ESP_LOG_BUFFER_HEX(TAG, data_rd, size_rd);
+    TEST_ASSERT_EQUAL_INT(RW_TEST_LENGTH, size_rd);
     TEST_ASSERT_EQUAL_HEX8_ARRAY(expected_master_write_data, data_rd, RW_TEST_LENGTH);
 
     /* Clean up */
diff --git a/components/ulp/test_apps/ulp_riscv/main/ulp/test_main_i2c.c b/components/ulp/test_apps/ulp_riscv/main/ulp/test_main_i2c.c
index 8ab1394df85..90b6ae6eb2c 100644
--- a/components/ulp/test_apps/ulp_riscv/main/ulp/test_main_i2c.c
+++ b/components/ulp/test_apps/ulp_riscv/main/ulp/test_main_i2c.c
@@ -1,12 +1,11 @@
 /*
- * SPDX-FileCopyrightText: 2023-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2023-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
 #include <stdint.h>
 #include "ulp_test_shared.h"
-// #include "ulp_riscv.h"
 #include "ulp_riscv_utils.h"
 #include "ulp_riscv_i2c_ulp_core.h"
 
@@ -24,7 +23,7 @@ int main(void)
     /* Read from the I2C slave device */
     ulp_riscv_i2c_master_read_from_device(data_rd, RW_TEST_LENGTH);
 
-    /* Signal the main CPU once read is done */
+    /* Signal the main CPU that read is done */
     read_test_reply = RISCV_COMMAND_OK;
 
     /* Wait for write command from main CPU */
diff --git a/components/ulp/test_apps/ulp_riscv/main/ulp/ulp_test_shared.h b/components/ulp/test_apps/ulp_riscv/main/ulp/ulp_test_shared.h
index 33ef18e67a4..9d09c377ee5 100644
--- a/components/ulp/test_apps/ulp_riscv/main/ulp/ulp_test_shared.h
+++ b/components/ulp/test_apps/ulp_riscv/main/ulp/ulp_test_shared.h
@@ -11,8 +11,7 @@
 /* I2C test params */
 #define I2C_SLAVE_ADDRESS 0x28
 #define DATA_LENGTH 200
-// TODO: Updated the test to perform multi-byte read/write (IDFGH-11056)
-#define RW_TEST_LENGTH       1  /*!<Data length for r/w test, any value from 0-DATA_LENGTH*/
+#define RW_TEST_LENGTH       7  /*!<Data length for r/w test, prime and not divisible by any I2C FIFO size */
 
 typedef enum {
     RISCV_READ_WRITE_TEST = 1,
diff --git a/components/ulp/test_apps/ulp_riscv/sdkconfig.defaults b/components/ulp/test_apps/ulp_riscv/sdkconfig.defaults
index 73c24b77f10..25df4420eb7 100644
--- a/components/ulp/test_apps/ulp_riscv/sdkconfig.defaults
+++ b/components/ulp/test_apps/ulp_riscv/sdkconfig.defaults
@@ -3,3 +3,7 @@ CONFIG_ESP_TASK_WDT_EN=n
 CONFIG_ULP_COPROC_ENABLED=y
 CONFIG_ULP_COPROC_TYPE_RISCV=y
 CONFIG_ULP_COPROC_RESERVE_MEM=4096
+
+# RTC I2C timeout: default 500 cycles is too short for real I2C transactions.
+# At 17.5 MHz ULP clock, the first RX_DATA interrupt arrives after ~1140 cycles.
+CONFIG_ULP_RISCV_I2C_RW_TIMEOUT=5000