diff --git a/components/esp_system/port/soc/esp32c5/system_internal.c b/components/esp_system/port/soc/esp32c5/system_internal.c
index d1a00ba93ca..4246b0c7c6a 100644
--- a/components/esp_system/port/soc/esp32c5/system_internal.c
+++ b/components/esp_system/port/soc/esp32c5/system_internal.c
@@ -85,21 +85,24 @@ void esp_system_reset_modules_on_exit(void)
     // all the peripherals are reset at the same time, which triggers a hardware SEC reset. The SEC reset
     // causes the crypto -> APB path to be reset, but the APB -> crypto path is not reset. This asymmetry
     // results in the crypto module hanging and refusing all access.
+#if !CONFIG_SECURE_ENABLE_TEE
+    // Avoid resetting the TEE-protected crypto peripherals as it would lead to an APM fault
     SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
     SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
     SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
     SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
     SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
+#endif // !CONFIG_SECURE_ENABLE_TEE
+    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
+    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
+    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
+    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
 
     // UART's sclk is controlled in the PCR register and does not reset with the UART module. The ROM missed enabling
     // it when initializing the ROM UART. If it is not turned on, it will trigger LP_WDT in the ROM.
diff --git a/components/esp_system/port/soc/esp32c6/system_internal.c b/components/esp_system/port/soc/esp32c6/system_internal.c
index 17ffd0df04f..dd818d49b1b 100644
--- a/components/esp_system/port/soc/esp32c6/system_internal.c
+++ b/components/esp_system/port/soc/esp32c6/system_internal.c
@@ -71,19 +71,22 @@ void esp_system_reset_modules_on_exit(void)
 
     // Reset crypto peripherals. This ensures a clean state for the crypto peripherals after a CPU restart
     // and hence avoiding any possibility with crypto failure in ROM security workflows.
+#if !CONFIG_SECURE_ENABLE_TEE
+    // Avoid resetting the TEE-protected crypto peripherals as it would lead to an APM fault
     SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
     SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
     SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
     SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
     SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
+#endif // !CONFIG_SECURE_ENABLE_TEE
+    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
+    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
 
     CLEAR_PERI_REG_MASK(PCR_REGDMA_CONF_REG, PCR_REGDMA_RST_EN);
 
diff --git a/components/esp_system/port/soc/esp32c61/system_internal.c b/components/esp_system/port/soc/esp32c61/system_internal.c
index 095a19e20b0..1dbf60ddccd 100644
--- a/components/esp_system/port/soc/esp32c61/system_internal.c
+++ b/components/esp_system/port/soc/esp32c61/system_internal.c
@@ -86,13 +86,16 @@ void esp_system_reset_modules_on_exit(void)
     // all the peripherals are reset at the same time, which triggers a hardware SEC reset. The SEC reset
     // causes the crypto -> APB path to be reset, but the APB -> crypto path is not reset. This asymmetry
     // results in the crypto module hanging and refusing all access.
+#if !CONFIG_SECURE_ENABLE_TEE
+    // Avoid resetting the TEE-protected crypto peripherals as it would lead to an APM fault
     SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
     SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
+#endif // !CONFIG_SECURE_ENABLE_TEE
+    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
+    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
 
     // UART's sclk is controlled in the PCR register and does not reset with the UART module. The ROM missed enabling
     // it when initializing the ROM UART. If it is not turned on, it will trigger LP_WDT in the ROM.
diff --git a/components/esp_system/port/soc/esp32h2/system_internal.c b/components/esp_system/port/soc/esp32h2/system_internal.c
index 6a471aff8ff..8c6c6fbfafe 100644
--- a/components/esp_system/port/soc/esp32h2/system_internal.c
+++ b/components/esp_system/port/soc/esp32h2/system_internal.c
@@ -68,21 +68,24 @@ void esp_system_reset_modules_on_exit(void)
 
     // Reset crypto peripherals. This ensures a clean state for the crypto peripherals after a CPU restart
     // and hence avoiding any possibility with crypto failure in ROM security workflows.
+#if !CONFIG_SECURE_ENABLE_TEE
+    // Avoid resetting the TEE-protected crypto peripherals as it would lead to an APM fault
     SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
     SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
     SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
     SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
     SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
     CLEAR_PERI_REG_MASK(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
+#endif // !CONFIG_SECURE_ENABLE_TEE
+    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
+    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
+    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
+    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
 
     // UART's sclk is controlled in the PCR register and does not reset with the UART module. The ROM missed enabling
     // it when initializing the ROM UART. If it is not turned on, it will trigger LP_WDT in the ROM.
diff --git a/components/esp_tee/include/esp_tee.h b/components/esp_tee/include/esp_tee.h
index a529928897a..63fee82cb56 100644
--- a/components/esp_tee/include/esp_tee.h
+++ b/components/esp_tee/include/esp_tee.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -43,7 +43,9 @@ typedef struct {
     uint32_t magic_word;
     uint32_t api_major_version;
     uint32_t api_minor_version;
-    uint32_t reserved[3];
+    uint32_t reserved[2];
+    /* Heap poisoning API */
+    void *ns_heap_poison_fill;
     /* TEE-related fields */
     void *s_int_handler;
     /* REE-related fields */
diff --git a/components/esp_tee/src/esp_secure_service_wrapper.c b/components/esp_tee/src/esp_secure_service_wrapper.c
index 04f1cc02cf0..e01214439b1 100644
--- a/components/esp_tee/src/esp_secure_service_wrapper.c
+++ b/components/esp_tee/src/esp_secure_service_wrapper.c
@@ -256,10 +256,20 @@ esp_err_t __wrap_esp_ds_start_sign(const void *message,
     if (esp_ds_ctx != NULL) {
         *esp_ds_ctx = malloc(sizeof(esp_ds_context_t));
         if (!*esp_ds_ctx) {
+            esp_crypto_ds_lock_release();
             return ESP_ERR_NO_MEM;
         }
     }
-    return esp_tee_service_call(5, SS_ESP_DS_START_SIGN, message, data, key_id, esp_ds_ctx);
+
+    esp_err_t err = esp_tee_service_call(5, SS_ESP_DS_START_SIGN, message, data, key_id, esp_ds_ctx);
+    if (err != ESP_OK) {
+        if (esp_ds_ctx != NULL) {
+            free(*esp_ds_ctx);
+            *esp_ds_ctx = NULL;
+        }
+        esp_crypto_ds_lock_release();
+    }
+    return err;
 }
 
 bool __wrap_esp_ds_is_busy(void)
diff --git a/components/esp_tee/src/esp_tee_config.c b/components/esp_tee/src/esp_tee_config.c
index 22fd9f7f2ce..b4eeafdab83 100644
--- a/components/esp_tee/src/esp_tee_config.c
+++ b/components/esp_tee/src/esp_tee_config.c
@@ -1,11 +1,12 @@
 /*
- * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
 
 #include <stdarg.h>
 #include "esp_tee.h"
+#include "sdkconfig.h"
 
 /* U-mode interrupt handler */
 extern int _tee_interrupt_handler(void);
@@ -20,6 +21,13 @@ extern uint32_t _rodata_reserved_start;
 /* REE DROM end */
 extern uint32_t _rodata_reserved_end;
 
+#if CONFIG_HEAP_TLSF_USE_ROM_IMPL && (CONFIG_HEAP_POISONING_LIGHT || CONFIG_HEAP_POISONING_COMPREHENSIVE)
+extern void multi_heap_internal_poison_fill_region(void *start, size_t size, bool is_free);
+#define HEAP_POISON_FILL    ((void *)&multi_heap_internal_poison_fill_region)
+#else
+#define HEAP_POISON_FILL    NULL
+#endif
+
 esp_tee_config_t esp_tee_app_config __attribute__((section(".esp_tee_app_cfg"))) = {
     .magic_word = ESP_TEE_APP_CFG_MAGIC,
     .api_major_version = ESP_TEE_API_MAJOR_VER,
@@ -35,4 +43,5 @@ esp_tee_config_t esp_tee_app_config __attribute__((section(".esp_tee_app_cfg")))
     .ns_irom_end = &_instruction_reserved_end,
     .ns_drom_start = &_rodata_reserved_start,
     .ns_drom_end = &_rodata_reserved_end,
+    .ns_heap_poison_fill = HEAP_POISON_FILL,
 };
diff --git a/components/esp_tee/subproject/main/CMakeLists.txt b/components/esp_tee/subproject/main/CMakeLists.txt
index 6cd569cfa31..db190377b81 100644
--- a/components/esp_tee/subproject/main/CMakeLists.txt
+++ b/components/esp_tee/subproject/main/CMakeLists.txt
@@ -25,10 +25,10 @@ endif()
 # SoC specific implementation for TEE
 list(APPEND srcs "soc/${target}/esp_tee_secure_sys_cfg.c"
                  "soc/${target}/esp_tee_pmp_pma_prot_cfg.c"
-                 "soc/${target}/esp_tee_apm_prot_cfg.c"
-                 "soc/${target}/esp_tee_crypto_reset.c")
+                 "soc/${target}/esp_tee_apm_prot_cfg.c")
 
-list(APPEND srcs "soc/common/esp_tee_apm_intr.c")
+list(APPEND srcs "soc/common/esp_tee_apm_intr.c"
+                 "soc/common/esp_tee_crypto_reset.c")
 
 if(CONFIG_SOC_AES_SUPPORTED)
     list(APPEND srcs "soc/common/esp_tee_aes_intr.c")
diff --git a/components/esp_tee/subproject/main/common/multi_heap.c b/components/esp_tee/subproject/main/common/multi_heap.c
index 536a4ae5cec..0eccfdd5c36 100644
--- a/components/esp_tee/subproject/main/common/multi_heap.c
+++ b/components/esp_tee/subproject/main/common/multi_heap.c
@@ -10,10 +10,16 @@
 #include "esp_rom_sys.h"
 #include "tlsf_block_functions.h"
 #include "multi_heap.h"
+#include "esp_tee.h"
 
 /* Handle to a registered TEE heap */
 static multi_heap_handle_t tee_heap;
 
+static inline void tee_heap_set_poison(bool enable)
+{
+    tlsf_poison_fill_pfunc_set(enable ? (poison_fill_pfunc_t)esp_tee_app_config.ns_heap_poison_fill : NULL);
+}
+
 inline static void multi_heap_assert(bool condition, const char *format, int line, intptr_t address)
 {
     /* Can't use libc assert() here as it calls printf() which can cause another malloc() for a newlib lock.
@@ -142,7 +148,10 @@ void esp_tee_heap_free(void *p)
 
     tee_heap->free_bytes += tlsf_block_size(p);
     tee_heap->free_bytes += tlsf_alloc_overhead();
+
+    tee_heap_set_poison(false);
     tlsf_free(tee_heap->heap_data, p);
+    tee_heap_set_poison(true);
 }
 
 void *malloc(size_t size)
@@ -166,7 +175,10 @@ void *realloc(void* ptr, size_t size)
     }
 
     size_t previous_block_size = tlsf_block_size(ptr);
+    tee_heap_set_poison(false);
     void *result = tlsf_realloc(tee_heap->heap_data, ptr, size);
+    tee_heap_set_poison(true);
+
     if (result) {
         /* No need to subtract the tlsf_alloc_overhead() as it has already
          * been subtracted when allocating the block at first with malloc */
diff --git a/components/esp_tee/subproject/main/core/esp_secure_services.c b/components/esp_tee/subproject/main/core/esp_secure_services.c
index ee176d437ab..b56b0c7c28c 100644
--- a/components/esp_tee/subproject/main/core/esp_secure_services.c
+++ b/components/esp_tee/subproject/main/core/esp_secure_services.c
@@ -583,6 +583,13 @@ int _ss_esp_tee_ota_end(void)
 
 /* ---------------------------------------------- Secure Storage ------------------------------------------------- */
 
+/* NOTE: The key-name pointers here (cfg->id/ctx->key_id) are REE-supplied, NULL-terminated
+ * NVS key names used read-only for key lookup (NVS compares them with strncmp bounded to
+ * NVS_KEY_NAME_MAX_SIZE-1) — never written through, never used as a register base.
+ * Pointing one at TEE memory yields at most a load-fault DoS or a useless presence oracle,
+ * so they are left unchecked. Argument checks cost code size and add latency to every
+ * service call, so we keep only the ones that close a real REE->TEE read/write/control-flow gap.
+ */
 esp_err_t _ss_esp_tee_sec_storage_clear_key(const char *key_id)
 {
     return esp_tee_sec_storage_clear_key(key_id);
diff --git a/components/esp_tee/subproject/main/core/esp_secure_services_iram.c b/components/esp_tee/subproject/main/core/esp_secure_services_iram.c
index 7280d074749..b5030720fc4 100644
--- a/components/esp_tee/subproject/main/core/esp_secure_services_iram.c
+++ b/components/esp_tee/subproject/main/core/esp_secure_services_iram.c
@@ -145,6 +145,15 @@ void _ss_esprv_int_set_vectored(int rv_int_num, bool vectored)
 
 /* ---------------------------------------------- RTC_WDT ------------------------------------------------- */
 
+static bool is_wdt_dev_valid(const void *dev)
+{
+    return (dev == (const void *)&TIMERG0)
+#if TIMG_LL_GET(INST_NUM) >= 2
+           || (dev == (const void *)&TIMERG1)
+#endif
+           || (dev == (const void *)RWDT_DEV_GET());
+}
+
 void _ss_wdt_hal_init(wdt_hal_context_t *hal, wdt_inst_t wdt_inst, uint32_t prescaler, bool enable_intr)
 {
     bool valid_addr = esp_tee_buf_in_ree(hal, sizeof(wdt_hal_context_t));
@@ -159,7 +168,8 @@ void _ss_wdt_hal_init(wdt_hal_context_t *hal, wdt_inst_t wdt_inst, uint32_t pres
 
 void _ss_wdt_hal_deinit(wdt_hal_context_t *hal)
 {
-    bool valid_addr = esp_tee_buf_in_ree(hal, sizeof(wdt_hal_context_t));
+    bool valid_addr = (esp_tee_buf_in_ree(hal, sizeof(wdt_hal_context_t)) &&
+                       is_wdt_dev_valid(hal->mwdt_dev));
 
     if (!valid_addr) {
         return;
@@ -171,6 +181,14 @@ void _ss_wdt_hal_deinit(wdt_hal_context_t *hal)
 
 /* ---------------------------------------------- Secure Storage ------------------------------------------------- */
 
+/* NOTE: The key-name pointers here (cfg->id/ctx->key_id) are REE-supplied, NULL-terminated
+ * NVS key names used read-only for key lookup (NVS compares them with strncmp bounded to
+ * NVS_KEY_NAME_MAX_SIZE-1) — never written through, never used as a register base.
+ * Pointing one at TEE memory yields at most a load-fault DoS or a useless presence oracle,
+ * so they are left unchecked. Argument checks cost code size and add latency to every
+ * service call, so we keep only the ones that close a real REE->TEE read/write/control-flow gap.
+ * The buffers alongside these ARE validated, since the TEE reads/writes them.
+ */
 esp_err_t _ss_esp_tee_sec_storage_ecdsa_sign(const esp_tee_sec_storage_key_cfg_t *cfg, const uint8_t *hash, size_t hlen, esp_tee_sec_storage_ecdsa_sign_t *out_sign)
 {
     bool valid_addr = (esp_tee_buf_in_ree(cfg, sizeof(esp_tee_sec_storage_key_cfg_t)) &&
@@ -337,7 +355,10 @@ static bool is_flash_addr_readable(uint32_t paddr, uint32_t len)
 
 static bool is_spi_host_in_ree(spi_flash_host_inst_t *host)
 {
-    return esp_tee_buf_in_ree(host, sizeof(spi_flash_hal_context_t));
+    const spi_flash_hal_context_t *ctx = (const spi_flash_hal_context_t *)host;
+
+    return (esp_tee_buf_in_ree(host, sizeof(spi_flash_hal_context_t)) &&
+            ctx->spi == spi_flash_ll_get_hw(SPI1_HOST));
 }
 
 static bool is_spi_trans_valid(spi_flash_host_inst_t *host, spi_flash_trans_t *trans)
diff --git a/components/esp_tee/subproject/main/core/esp_tee_intr.c b/components/esp_tee/subproject/main/core/esp_tee_intr.c
index db5a8f59154..3cf75328c40 100644
--- a/components/esp_tee/subproject/main/core/esp_tee_intr.c
+++ b/components/esp_tee/subproject/main/core/esp_tee_intr.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2024-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2024-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -12,6 +12,7 @@
 #include "soc/periph_defs.h"
 #include "soc/interrupts.h"
 #include "soc/interrupt_reg.h"
+#include "soc/soc_caps.h"
 
 #include "esp_tee.h"
 #include "esp_tee_intr.h"
@@ -34,6 +35,10 @@ static uint32_t protected_sources[INTR_SET_COUNT];
 
 bool esp_tee_is_intr_src_protected(int source)
 {
+    if (source < 0 || source >= ETS_MAX_INTR_SOURCE) {
+        return false;
+    }
+
     uint32_t base = source / INTR_SET_SIZE;
     uint32_t offset = source % INTR_SET_SIZE;
 
@@ -57,14 +62,9 @@ void tee_unhandled_interrupt(void *arg)
 /* Interrupt Matrix configuration API to call from non-secure world */
 void esp_tee_route_intr_matrix(int cpu_no, uint32_t model_num, uint32_t intr_num)
 {
-    if (esp_tee_is_intr_src_protected(model_num) || intr_num == TEE_SECURE_INUM) {
+    if (model_num >= ETS_MAX_INTR_SOURCE || esp_tee_is_intr_src_protected(model_num)) {
         return;
     }
-#if SOC_INT_CLIC_SUPPORTED
-    if (intr_num == TEE_PASS_INUM) {
-        return;
-    }
-#endif
 
     esp_rom_route_intr_matrix(cpu_no, model_num, intr_num);
     ESP_LOGV(TAG, "Connected src %d to int %d (cpu %d)", model_num, intr_num, cpu_no);
diff --git a/components/esp_tee/subproject/main/soc/common/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/common/esp_tee_crypto_reset.c
new file mode 100644
index 00000000000..a80429d6ecf
--- /dev/null
+++ b/components/esp_tee/subproject/main/soc/common/esp_tee_crypto_reset.c
@@ -0,0 +1,78 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#include "soc/soc_caps.h"
+
+#if SOC_AES_SUPPORTED
+#include "hal/aes_ll.h"
+#endif
+#if SOC_SHA_SUPPORTED
+#include "hal/sha_ll.h"
+#endif
+#if SOC_MPI_SUPPORTED
+#include "hal/mpi_ll.h"
+#endif
+#if SOC_ECC_SUPPORTED
+#include "hal/ecc_ll.h"
+#endif
+#if SOC_HMAC_SUPPORTED
+#include "hal/hmac_ll.h"
+#endif
+#if SOC_DIG_SIGN_SUPPORTED
+#include "hal/ds_ll.h"
+#endif
+#if SOC_ECDSA_SUPPORTED
+#include "hal/ecdsa_ll.h"
+#endif
+
+#include "esp_tee.h"
+
+void esp_tee_soc_reset_crypto_peripherals(void)
+{
+    /* Reset the crypto peripherals to a clean state and leave their clocks disabled; drivers re-enable on demand */
+#if SOC_AES_SUPPORTED
+    aes_ll_enable_bus_clock(true);
+    aes_ll_reset_register();
+    aes_ll_enable_bus_clock(false);
+#endif
+
+#if SOC_SHA_SUPPORTED
+    sha_ll_enable_bus_clock(true);
+    sha_ll_reset_register();
+    sha_ll_enable_bus_clock(false);
+#endif
+
+#if SOC_MPI_SUPPORTED
+    mpi_ll_enable_bus_clock(true);
+    mpi_ll_reset_register();
+    mpi_ll_enable_bus_clock(false);
+#endif
+
+#if SOC_ECC_SUPPORTED
+    ecc_ll_enable_bus_clock(true);
+    ecc_ll_reset_register();
+    ecc_ll_power_up();
+    ecc_ll_enable_bus_clock(false);
+#endif
+
+#if SOC_HMAC_SUPPORTED
+    hmac_ll_enable_bus_clock(true);
+    hmac_ll_reset_register();
+    hmac_ll_enable_bus_clock(false);
+#endif
+
+#if SOC_DIG_SIGN_SUPPORTED
+    ds_ll_enable_bus_clock(true);
+    ds_ll_reset_register();
+    ds_ll_enable_bus_clock(false);
+#endif
+
+#if SOC_ECDSA_SUPPORTED
+    ecdsa_ll_enable_bus_clock(true);
+    ecdsa_ll_reset_register();
+    ecdsa_ll_enable_bus_clock(false);
+#endif
+}
diff --git a/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c
deleted file mode 100644
index a9e1ec6062e..00000000000
--- a/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_crypto_reset.c
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
-#include "esp_tee.h"
-
-void esp_tee_soc_reset_crypto_peripherals(void)
-{
-    SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
-    SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
-}
diff --git a/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_secure_sys_cfg.c b/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_secure_sys_cfg.c
index a6bff015e23..b9a3ec04f75 100644
--- a/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_secure_sys_cfg.c
+++ b/components/esp_tee/subproject/main/soc/esp32c5/esp_tee_secure_sys_cfg.c
@@ -10,11 +10,6 @@
 #include "riscv/encoding.h"
 
 #include "hal/apm_hal.h"
-#include "hal/aes_ll.h"
-#include "hal/sha_ll.h"
-#include "hal/hmac_ll.h"
-#include "hal/ds_ll.h"
-#include "hal/ecc_ll.h"
 
 #include "soc/clic_reg.h"
 #include "soc/interrupts.h"
@@ -109,12 +104,8 @@ void esp_tee_soc_secure_sys_init(void)
     esp_tee_protect_intr_src(ETS_SHA_INTR_SOURCE);          // SHA
     esp_tee_protect_intr_src(ETS_ECC_INTR_SOURCE);          // ECC
 
-    /* Disable protected crypto peripheral clocks; they will be toggled as needed when the peripheral is in use */
-    aes_ll_enable_bus_clock(false);
-    sha_ll_enable_bus_clock(false);
-    hmac_ll_enable_bus_clock(false);
-    ds_ll_enable_bus_clock(false);
-    ecc_ll_enable_bus_clock(false);
+    /* Reset the protected crypto peripherals and leave their clocks disabled */
+    esp_tee_soc_reset_crypto_peripherals();
 }
 
 IRAM_ATTR inline void esp_tee_switch_to_ree(uint32_t ns_entry_addr)
diff --git a/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c
deleted file mode 100644
index 1dde41e9401..00000000000
--- a/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_crypto_reset.c
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
-#include "esp_tee.h"
-
-void esp_tee_soc_reset_crypto_peripherals(void)
-{
-    SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
-    SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
-}
diff --git a/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_secure_sys_cfg.c b/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_secure_sys_cfg.c
index 71d0ae73666..8fc4c67aca1 100644
--- a/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_secure_sys_cfg.c
+++ b/components/esp_tee/subproject/main/soc/esp32c6/esp_tee_secure_sys_cfg.c
@@ -16,11 +16,6 @@
 #include "esp_cpu.h"
 #include "esp_log.h"
 #include "hal/apm_hal.h"
-#include "hal/aes_ll.h"
-#include "hal/sha_ll.h"
-#include "hal/hmac_ll.h"
-#include "hal/ds_ll.h"
-#include "hal/ecc_ll.h"
 
 #include "esp_tee.h"
 #include "esp_tee_intr.h"
@@ -95,12 +90,8 @@ void esp_tee_soc_secure_sys_init(void)
     esp_tee_protect_intr_src(ETS_SHA_INTR_SOURCE);          // SHA
     esp_tee_protect_intr_src(ETS_ECC_INTR_SOURCE);          // ECC
 
-    /* Disable protected crypto peripheral clocks; they will be toggled as needed when the peripheral is in use */
-    aes_ll_enable_bus_clock(false);
-    sha_ll_enable_bus_clock(false);
-    hmac_ll_enable_bus_clock(false);
-    ds_ll_enable_bus_clock(false);
-    ecc_ll_enable_bus_clock(false);
+    /* Reset the protected crypto peripherals and leave their clocks disabled */
+    esp_tee_soc_reset_crypto_peripherals();
 }
 
 IRAM_ATTR inline void esp_tee_switch_to_ree(uint32_t ree_entry_addr)
diff --git a/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c
deleted file mode 100644
index 58013ff3755..00000000000
--- a/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_crypto_reset.c
+++ /dev/null
@@ -1,22 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
-#include "esp_tee.h"
-
-void esp_tee_soc_reset_crypto_peripherals(void)
-{
-    SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
-}
diff --git a/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_secure_sys_cfg.c b/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_secure_sys_cfg.c
index b1e302bc9b4..8bcafb52ece 100644
--- a/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_secure_sys_cfg.c
+++ b/components/esp_tee/subproject/main/soc/esp32c61/esp_tee_secure_sys_cfg.c
@@ -10,9 +10,6 @@
 #include "riscv/encoding.h"
 
 #include "hal/apm_hal.h"
-#include "hal/sha_ll.h"
-#include "hal/ecc_ll.h"
-#include "hal/ecdsa_ll.h"
 
 #include "soc/clic_reg.h"
 #include "soc/interrupts.h"
@@ -104,10 +101,8 @@ void esp_tee_soc_secure_sys_init(void)
     esp_tee_protect_intr_src(ETS_ECC_INTR_SOURCE);          // ECC
     esp_tee_protect_intr_src(ETS_ECDSA_INTR_SOURCE);        // ECDSA
 
-    /* Disable protected crypto peripheral clocks; they will be toggled as needed when the peripheral is in use */
-    sha_ll_enable_bus_clock(false);
-    ecc_ll_enable_bus_clock(false);
-    ecdsa_ll_enable_bus_clock(false);
+    /* Reset the protected crypto peripherals and leave their clocks disabled */
+    esp_tee_soc_reset_crypto_peripherals();
 }
 
 IRAM_ATTR inline void esp_tee_switch_to_ree(uint32_t ns_entry_addr)
diff --git a/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c b/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c
deleted file mode 100644
index 96a73fd8c46..00000000000
--- a/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_crypto_reset.c
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * SPDX-FileCopyrightText: 2026 Espressif Systems (Shanghai) CO LTD
- *
- * SPDX-License-Identifier: Apache-2.0
- */
-
-#include "soc/soc.h"
-#include "soc/pcr_reg.h"
-
-#include "esp_tee.h"
-
-void esp_tee_soc_reset_crypto_peripherals(void)
-{
-    SET_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
-    SET_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    SET_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    SET_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    SET_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    SET_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_AES_CONF_REG, PCR_AES_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_DS_CONF_REG, PCR_DS_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECC_CONF_REG, PCR_ECC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_ECDSA_CONF_REG, PCR_ECDSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_HMAC_CONF_REG, PCR_HMAC_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_RSA_CONF_REG, PCR_RSA_RST_EN);
-    CLEAR_PERI_REG_MASK(PCR_SHA_CONF_REG, PCR_SHA_RST_EN);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_PD);
-    REG_CLR_BIT(PCR_ECC_PD_CTRL_REG, PCR_ECC_MEM_FORCE_PD);
-}
diff --git a/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_secure_sys_cfg.c b/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_secure_sys_cfg.c
index 61da60223a0..1d7a86eacc4 100644
--- a/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_secure_sys_cfg.c
+++ b/components/esp_tee/subproject/main/soc/esp32h2/esp_tee_secure_sys_cfg.c
@@ -16,11 +16,6 @@
 #include "esp_cpu.h"
 #include "esp_log.h"
 #include "hal/apm_hal.h"
-#include "hal/aes_ll.h"
-#include "hal/sha_ll.h"
-#include "hal/hmac_ll.h"
-#include "hal/ds_ll.h"
-#include "hal/ecc_ll.h"
 
 #include "esp_tee.h"
 #include "esp_tee_intr.h"
@@ -93,12 +88,8 @@ void esp_tee_soc_secure_sys_init(void)
     esp_tee_protect_intr_src(ETS_SHA_INTR_SOURCE);          // SHA
     esp_tee_protect_intr_src(ETS_ECC_INTR_SOURCE);          // ECC
 
-    /* Disable protected crypto peripheral clocks; they will be toggled as needed when the peripheral is in use */
-    aes_ll_enable_bus_clock(false);
-    sha_ll_enable_bus_clock(false);
-    hmac_ll_enable_bus_clock(false);
-    ds_ll_enable_bus_clock(false);
-    ecc_ll_enable_bus_clock(false);
+    /* Reset the protected crypto peripherals and leave their clocks disabled */
+    esp_tee_soc_reset_crypto_peripherals();
 }
 
 IRAM_ATTR inline void esp_tee_switch_to_ree(uint32_t ree_entry_addr)