diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index 2fc7f968f1f..f1bcdf83628 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -1419,6 +1419,33 @@ menu "mbedTLS"
                 priority level and any level from 1 to 3 can be selected (based on the availability).
                 Note: Higher value indicates high interrupt priority.
 
+        menu "Security hardening"
+
+            config MBEDTLS_CONSTANT_TIME_PRIME_GEN
+                bool "Constant-time prime generation"
+                default y
+                help
+                    Use mbedtls' constant-time small-factor test (a
+                    constant-time GCD against the product of all odd primes up
+                    to 997) when generating prime numbers, e.g. during RSA key
+                    generation.
+
+                    The constant-time implementation avoids a timing side
+                    channel in prime generation, but it makes RSA key
+                    generation roughly ten times slower, and its long
+                    non-yielding software computations can starve the idle
+                    task and trigger the task watchdog, so key generation code
+                    may need a larger watchdog timeout or the watchdog
+                    disabled.
+
+                    If disabled, the variable-time trial division that mbedtls
+                    used before versions 3.6.7/4.1.1 is used instead,
+                    restoring key generation performance. Only consider
+                    disabling this if no untrusted code running on the device
+                    could observe the timing of key generation operations.
+
+        endmenu # Security hardening
+
         config MBEDTLS_HARDWARE_AES
             bool "Enable hardware AES acceleration"
             default y
diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h
index a1c64d8697e..3c9856aa0a2 100644
--- a/components/mbedtls/port/include/mbedtls/esp_config.h
+++ b/components/mbedtls/port/include/mbedtls/esp_config.h
@@ -258,6 +258,18 @@
 #undef MBEDTLS_MPI_MUL_MPI_ALT
 #endif
 
+/* mbedtls 4.1.1 made the small-factor test used in prime
+ * generation constant-time, which slows RSA key generation down roughly
+ * tenfold and starves the idle task (the computation never yields the CPU).
+ * The constant-time variant is the default; when it is explicitly disabled,
+ * fall back to the variable-time trial division from earlier releases. See
+ * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in
+ * tf-psa-crypto/drivers/builtin/src/bignum.c.
+ */
+#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
+#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME
+#endif
+
 #if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
 #define ESP_ECDSA_DRIVER_ENABLED
 #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY