diff --git a/components/esp_tee/subproject/components/tee_sec_storage/include/esp_tee_sec_storage.h b/components/esp_tee/subproject/components/tee_sec_storage/include/esp_tee_sec_storage.h
index ad12969df6f..594c61c8972 100644
--- a/components/esp_tee/subproject/components/tee_sec_storage/include/esp_tee_sec_storage.h
+++ b/components/esp_tee/subproject/components/tee_sec_storage/include/esp_tee_sec_storage.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -162,14 +162,16 @@ esp_err_t esp_tee_sec_storage_ecdsa_get_pubkey(const esp_tee_sec_storage_key_cfg
 /**
  * @brief Perform encryption using AES256-GCM with the key from secure storage
  *
- * @param[in]  ctx      Pointer to the AEAD operation context
- * @param[out] iv       Pointer to the output buffer for the generated initialization vector
- * @param[in]  iv_len   Length of the initialization vector buffer; must be exactly 12 bytes (96-bit IV, per NIST SP 800-38D)
- * @param[out] tag      Pointer to the authentication tag buffer
- * @param[in]  tag_len  Length of the authentication tag; must be 12 to 16 bytes (96- to 128-bit tag, per NIST SP 800-38D)
- * @param[out] output   Pointer to the output data buffer
+ * @param[in,out] ctx      Pointer to the AEAD operation context; the generated
+ *                         initialization vector is written to @p ctx->iv
+ * @param[out]    tag      Pointer to the authentication tag buffer
+ * @param[in]     tag_len  Length of the authentication tag; must be 12 to 16 bytes (96- to 128-bit tag, per NIST SP 800-38D)
+ * @param[out]    output   Pointer to the output data buffer
  *
- * @note Non-standard @p iv_len / @p tag_len values are rejected with ESP_ERR_INVALID_SIZE.
+ * @note The initialization vector is generated internally and is always
+ *       ::AES_GCM_SUPPORTED_IV_LEN bytes long (96-bit IV, per NIST SP 800-38D).
+ *       Read it from @p ctx->iv after the call and store it with the ciphertext.
+ * @note Non-standard @p tag_len values are rejected with ESP_ERR_INVALID_SIZE.
  *
  * @return esp_err_t ESP_OK on success, appropriate error code otherwise.
  */
@@ -178,14 +180,15 @@ esp_err_t esp_tee_sec_storage_aead_encrypt(esp_tee_sec_storage_aead_ctx_t *ctx,
 /**
  * @brief Perform decryption using AES256-GCM with the key from secure storage
  *
- * @param[in]  ctx      Pointer to the AEAD operation context
- * @param[in]  iv       Pointer to the initialization vector used during encryption
- * @param[in]  iv_len   Length of the initialization vector; must be exactly 12 bytes (96-bit IV, per NIST SP 800-38D)
+ * @param[in]  ctx      Pointer to the AEAD operation context; @p ctx->iv must hold
+ *                      the initialization vector used during encryption
  * @param[in]  tag      Pointer to the authentication tag buffer
  * @param[in]  tag_len  Length of the authentication tag; must be 12 to 16 bytes (96- to 128-bit tag, per NIST SP 800-38D)
  * @param[out] output   Pointer to the output data buffer
  *
- * @note Non-standard @p iv_len / @p tag_len values are rejected with ESP_ERR_INVALID_SIZE.
+ * @note The initialization vector is always ::AES_GCM_SUPPORTED_IV_LEN bytes long
+ *       (96-bit IV, per NIST SP 800-38D). Write it to @p ctx->iv before the call.
+ * @note Non-standard @p tag_len values are rejected with ESP_ERR_INVALID_SIZE.
  *
  * @return esp_err_t ESP_OK on success, appropriate error code otherwise.
  */
diff --git a/components/esp_tee/subproject/components/tee_sec_storage/tee_sec_storage.c b/components/esp_tee/subproject/components/tee_sec_storage/tee_sec_storage.c
index 7ff6655a628..1ff06c5004d 100644
--- a/components/esp_tee/subproject/components/tee_sec_storage/tee_sec_storage.c
+++ b/components/esp_tee/subproject/components/tee_sec_storage/tee_sec_storage.c
@@ -38,7 +38,6 @@
 #define AES256_GCM_IV_LEN                   12
 #define AES256_GCM_TAG_LEN_MIN              12   /* NIST SP800-38D general-use minimum (96-bit tag) */
 #define AES256_GCM_TAG_LEN_MAX              16   /* full GCM tag (128-bit) */
-#define ECDSA_SECP384R1_KEY_LEN             48
 #define ECDSA_SECP256R1_KEY_LEN             32
 #define ECDSA_SECP192R1_KEY_LEN             24
 
diff --git a/components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_sec_stg.c b/components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_sec_stg.c
index 285665636f2..01f1c660d0f 100644
--- a/components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_sec_stg.c
+++ b/components/esp_tee/test_apps/tee_test_fw/main/test_esp_tee_sec_stg.c
@@ -464,7 +464,7 @@ TEST_CASE("Test TEE Secure Storage - Host-generated keys", "[sec_storage_host_ke
 
     TEST_ESP_OK(esp_tee_sec_storage_clear_key(ecdsa_key_id0));
 
-    TEST_ESP_ERR(ESP_ERR_INVALID_STATE, esp_tee_sec_storage_clear_key(attest_key_id));
+    TEST_ESP_ERR(ESP_ERR_INVALID_ARG, esp_tee_sec_storage_clear_key(attest_key_id));
 
 #if CONFIG_SECURE_TEE_ATTESTATION
     uint8_t *token_buf = heap_caps_calloc(ESP_ATT_TK_BUF_SIZE, sizeof(uint8_t), MALLOC_CAP_8BIT | MALLOC_CAP_INTERNAL);
@@ -528,6 +528,7 @@ static void test_ecdsa_sign(mbedtls_ecp_group_id gid)
     mbedtls_mpi_init(&s);
 
     mbedtls_ecdsa_context ecdsa_context;
+    mbedtls_ecdsa_init(&ecdsa_context);
 
     TEST_ASSERT_MBEDTLS_OK(mbedtls_ecp_group_load(&ecdsa_context.MBEDTLS_PRIVATE(grp), gid));