diff --git a/components/mbedtls/port/aes/esp_aes_common.c b/components/mbedtls/port/aes/esp_aes_common.c
index 976e2a71463..e5a37057dfa 100644
--- a/components/mbedtls/port/aes/esp_aes_common.c
+++ b/components/mbedtls/port/aes/esp_aes_common.c
@@ -6,7 +6,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2026 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
@@ -21,6 +21,7 @@
 #include "hal/aes_types.h"
 #include "soc/soc_caps.h"
 #include "psa/crypto.h"
+#include "mbedtls/platform_util.h"
 
 #include <string.h>
 
@@ -43,7 +44,7 @@ bool valid_key_length(const esp_aes_context *ctx)
 
 void esp_aes_init(esp_aes_context *ctx)
 {
-    bzero(ctx, sizeof(esp_aes_context));
+    memset(ctx, 0, sizeof(esp_aes_context));
 #if SOC_AES_SUPPORT_DMA && CONFIG_MBEDTLS_AES_USE_INTERRUPT
     esp_aes_intr_alloc();
 #endif
@@ -55,7 +56,7 @@ void esp_aes_free( esp_aes_context *ctx )
         return;
     }
 
-    bzero( ctx, sizeof( esp_aes_context ) );
+    mbedtls_platform_zeroize( ctx, sizeof( esp_aes_context ) );
 }
 
 /*
diff --git a/components/mbedtls/port/aes/esp_aes_gcm.c b/components/mbedtls/port/aes/esp_aes_gcm.c
index b118817ee43..4ffb820c430 100644
--- a/components/mbedtls/port/aes/esp_aes_gcm.c
+++ b/components/mbedtls/port/aes/esp_aes_gcm.c
@@ -6,7 +6,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  *
- * SPDX-FileContributor: 2016-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2016-2026 Espressif Systems (Shanghai) CO LTD
  */
 /*
  *  The AES block cipher was designed by Vincent Rijmen and Joan Daemen.
@@ -19,6 +19,7 @@
 #include "aes/esp_aes_gcm.h"
 #include "esp_aes_internal.h"
 #include "hal/aes_hal.h"
+#include "mbedtls/platform_util.h"
 
 #include "esp_heap_caps.h"
 #include "esp_log.h"
@@ -321,7 +322,7 @@ void esp_aes_gcm_init( esp_gcm_context *ctx)
         return;
     }
 
-    bzero(ctx, sizeof(esp_gcm_context));
+    memset(ctx, 0, sizeof(esp_gcm_context));
 
 #if SOC_AES_SUPPORT_DMA && CONFIG_MBEDTLS_AES_USE_INTERRUPT
     esp_aes_intr_alloc();
@@ -336,7 +337,7 @@ void esp_aes_gcm_free( esp_gcm_context *ctx)
     if (ctx == NULL) {
         return;
     }
-    bzero(ctx, sizeof(esp_gcm_context));
+    mbedtls_platform_zeroize(ctx, sizeof(esp_gcm_context));
 }
 
 /* Setup AES-GCM */
@@ -719,7 +720,7 @@ int esp_aes_gcm_auth_decrypt( esp_gcm_context *ctx,
     }
 
     if ( diff != 0 ) {
-        bzero( output, length );
+        mbedtls_platform_zeroize( output, length );
         return ( PSA_ERROR_INVALID_SIGNATURE );
     }
 
diff --git a/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_cmac.c b/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_cmac.c
index bd3f8bde0e4..0eaa6d1c1e5 100644
--- a/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_cmac.c
+++ b/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_cmac.c
@@ -392,12 +392,11 @@ psa_status_t esp_cmac_verify_finish(
 
     status = esp_cmac_finish(esp_cmac_ctx, actual_mac, sizeof(actual_mac), &actual_mac_length);
     if (status == PSA_SUCCESS) {
-        if (memcmp(actual_mac, mac, mac_length) == 0) {
-            return PSA_SUCCESS;
-        } else {
-            return PSA_ERROR_INVALID_SIGNATURE;
+        if (mbedtls_ct_memcmp(actual_mac, mac, mac_length) != 0) {
+            status = PSA_ERROR_INVALID_SIGNATURE;
         }
     }
 
+    mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
     return status;
 }
diff --git a/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c b/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c
index bbada5bd687..db6185a6505 100644
--- a/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c
+++ b/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_opaque.c
@@ -7,6 +7,7 @@
 #include <stdint.h>
 #include <string.h>
 #include "psa/crypto.h"
+#include "mbedtls/constant_time.h"
 #include "psa_crypto_driver_esp_hmac_opaque.h"
 #include "psa_crypto_driver_esp_opaque_common.h"
 #include "esp_efuse.h"
@@ -404,15 +405,14 @@ psa_status_t esp_hmac_verify_finish_opaque(
     size_t actual_mac_length = 0;
 
     status = esp_hmac_finish_opaque(esp_hmac_ctx, actual_mac, sizeof(actual_mac), &actual_mac_length);
-    if (status != PSA_SUCCESS) {
-        return status;
+    if (status == PSA_SUCCESS) {
+        if (mbedtls_ct_memcmp(mac, actual_mac, mac_length) != 0) {
+            status = PSA_ERROR_INVALID_SIGNATURE;
+        }
     }
 
-    if (memcmp(mac, actual_mac, mac_length) != 0) {
-        return PSA_ERROR_INVALID_SIGNATURE;
-    }
-
-    return PSA_SUCCESS;
+    mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
+    return status;
 }
 
 size_t esp_hmac_opaque_size_function(
diff --git a/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_transparent.c b/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_transparent.c
index 1ec7c8ea877..118d8ef55cf 100644
--- a/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_transparent.c
+++ b/components/mbedtls/port/psa_driver/esp_mac/psa_crypto_driver_esp_hmac_transparent.c
@@ -7,6 +7,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include "psa/crypto.h"
+#include "mbedtls/constant_time.h"
 #include "psa_crypto_driver_esp_hmac_transparent.h"
 #include "psa_crypto_driver_esp_sha.h"
 #include "psa_crypto_driver_esp_md5.h"
@@ -364,7 +365,7 @@ psa_status_t esp_hmac_verify_finish_transparent(
 
     status = esp_hmac_finish_transparent(esp_hmac_ctx, actual_mac, sizeof(actual_mac), &actual_mac_length);
     if (status == PSA_SUCCESS) {
-        if (memcmp(actual_mac, mac, mac_length) != 0) {
+        if (mbedtls_ct_memcmp(actual_mac, mac, mac_length) != 0) {
             status = PSA_ERROR_INVALID_SIGNATURE;
         }
     }