diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index a4ad0eff59f..78f72ccf4bc 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -322,6 +322,17 @@ menu "GAP"
             Use this option to do host based Random Private Address resolution.
             This option is valid only for ESP32
 
+    config BT_NIMBLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN
+        bool "Resolve peer RPA while scanning"
+        default y
+        depends on BT_NIMBLE_HOST_BASED_PRIVACY
+        help
+            Enable this option to resolve peer Resolvable Private Addresses (RPAs)
+            to their identity addresses in scan results. This is useful when an
+            application needs to identify a peer while scanning, for example, to
+            match a bonded device. When disabled, scan results retain the peer's
+            on-air RPA, and the RPA is resolved when the connection is established.
+
     config BT_NIMBLE_HOST_ALLOW_CONNECT_WITH_SCAN
         bool "Allow Connections with scanning in progress"
         depends on BT_NIMBLE_ENABLED && !(IDF_TARGET_ESP32C2)
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 20357f36e58..2a74e09fab2 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 20357f36e581901cbc3db88d342b66a743429f60
+Subproject commit 2a74e09fab2bd39b50eee9babbd54eb42d84e703
diff --git a/components/bt/host/nimble/port/include/esp_nimble_cfg.h b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
index 0a1de86ac8a..ece586e7886 100644
--- a/components/bt/host/nimble/port/include/esp_nimble_cfg.h
+++ b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
@@ -989,6 +989,14 @@
 
 #endif
 
+#ifndef MYNEWT_VAL_BLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN
+#ifdef CONFIG_BT_NIMBLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN
+#define MYNEWT_VAL_BLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN (1)
+#else
+#define MYNEWT_VAL_BLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN (0)
+#endif
+#endif
+
 #ifndef MYNEWT_VAL_BLE_RPA_TIMEOUT
 #define MYNEWT_VAL_BLE_RPA_TIMEOUT (CONFIG_BT_NIMBLE_RPA_TIMEOUT)
 #endif
diff --git a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
index f2856d6f47d..53fdecacde7 100644
--- a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
@@ -346,10 +346,23 @@ ble_cts_cent_connect_if_interesting(void *disc)
      * timeout.
      */
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
 #endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
+#endif
+
     rc = ble_gap_connect(own_addr_type, addr, 30000, NULL,
                          ble_cts_cent_gap_event, NULL);
     if (rc != 0) {
diff --git a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
index 472643e5df1..27411b0b2bc 100644
--- a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
@@ -468,10 +468,23 @@ ble_htp_cent_connect_if_interesting(void *disc)
      * timeout.
      */
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
 #endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
+#endif
+
     rc = ble_gap_connect(own_addr_type, addr, 30000, NULL,
                          ble_htp_cent_gap_event, NULL);
     if (rc != 0) {
diff --git a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
index b5b584c1b98..2ae1b1ee431 100644
--- a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
@@ -356,10 +356,23 @@ ble_prox_cent_connect_if_interesting(void *disc)
      * timeout.
      */
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
 #endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
+#endif
+
     rc = ble_gap_connect(own_addr_type, addr, 30000, NULL,
                          ble_prox_cent_gap_event, NULL);
     if (rc != 0) {
diff --git a/examples/bluetooth/nimble/blecent/main/main.c b/examples/bluetooth/nimble/blecent/main/main.c
index 99851b6b5f9..9c1d39f0037 100644
--- a/examples/bluetooth/nimble/blecent/main/main.c
+++ b/examples/bluetooth/nimble/blecent/main/main.c
@@ -626,9 +626,21 @@ blecent_connect_if_interesting(void *disc)
      * timeout.
      */
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
+#endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
 #endif
 
     rc = ble_gap_connect(own_addr_type, addr, 30000, NULL,