diff --git a/components/esp_hal_security/esp32s2/include/hal/crypto_dma_ll.h b/components/esp_hal_security/esp32s2/include/hal/crypto_dma_ll.h
index 85b4a72d6ff..ff212f0b3ce 100644
--- a/components/esp_hal_security/esp32s2/include/hal/crypto_dma_ll.h
+++ b/components/esp_hal_security/esp32s2/include/hal/crypto_dma_ll.h
@@ -70,8 +70,8 @@ static inline void crypto_dma_ll_reset_register(void)
  */
 static inline void crypto_dma_ll_reset(void)
 {
-    SET_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
-    CLEAR_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
+    SET_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_IN_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
+    CLEAR_PERI_REG_MASK(CRYPTO_DMA_CONF0_REG, CONF0_REG_AHBM_RST | CONF0_REG_IN_RST | CONF0_REG_OUT_RST | CONF0_REG_AHBM_FIFO_RST);
 }
 
 /**
diff --git a/components/mbedtls/port/aes/dma/esp_aes_dma_core.c b/components/mbedtls/port/aes/dma/esp_aes_dma_core.c
index b73a5ed9b44..d109998756a 100644
--- a/components/mbedtls/port/aes/dma/esp_aes_dma_core.c
+++ b/components/mbedtls/port/aes/dma/esp_aes_dma_core.c
@@ -1057,6 +1057,26 @@ int esp_aes_process_dma(esp_aes_context *ctx, const unsigned char *input, unsign
         return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH;
     }
 
+#if SOC_AES_CRYPTO_DMA && CONFIG_SPIRAM
+    /* The Crypto DMA in-channel stalls indefinitely (no descriptor error is raised) when a
+       receive descriptor list transitions from a buffer in external RAM to one in internal
+       RAM. Avoid linking the internal stream buffer descriptor after external-RAM data
+       descriptors by processing the block-aligned part and the trailing partial block as
+       two separate DMA operations. */
+    if (block_bytes > 0 && stream_bytes > 0 && esp_ptr_external_ram(output)) {
+        ret = esp_aes_process_dma(ctx, input, output, block_bytes, NULL);
+        if (ret != 0) {
+            mbedtls_platform_zeroize(output, len);
+            return ret;
+        }
+        ret = esp_aes_process_dma(ctx, input + block_bytes, output + block_bytes, stream_bytes, stream_out);
+        if (ret != 0) {
+            mbedtls_platform_zeroize(output, len);
+        }
+        return ret;
+    }
+#endif /* SOC_AES_CRYPTO_DMA && CONFIG_SPIRAM */
+
     if (block_bytes > 0) {
         /* Flush cache if input in external ram */
 #if (CONFIG_SPIRAM && SOC_PSRAM_DMA_CAPABLE)
diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/test_aes_params.h b/components/mbedtls/test_apps/mbedtls_ut/main/test_aes_params.h
index 0280212806d..1680f5bb4c8 100644
--- a/components/mbedtls/test_apps/mbedtls_ut/main/test_aes_params.h
+++ b/components/mbedtls/test_apps/mbedtls_ut/main/test_aes_params.h
@@ -8,11 +8,15 @@
 
 #include <stdint.h>
 
-#define TEST_AES_CTR_DATA_LEN       (32 * 200)
+#define TEST_AES_CTR_DATA_LEN       (32 * 200 + 33)
 
 /* Full reference ciphertext for AES-128-CTR with key=0x1E*16, IV=0x2F*16,
- * plaintext=0x26*6400. Used to validate the entire ciphertext (not just the
- * tail) in aes_ctr_alignment_test and aes_psram_one_buf_ctr_test. */
+ * plaintext=0x26*6433. The length is deliberately not a multiple of the AES
+ * block size so that the trailing partial block handling is exercised, and
+ * the block-aligned part (6432 bytes) is a multiple of the PSRAM cache line
+ * size so that the direct external-RAM DMA path is taken. Used to validate
+ * the entire ciphertext in aes_ctr_alignment_test and
+ * aes_psram_one_buf_ctr_test. */
 static const uint8_t expected_cipher_ctr[] = {
     0xe8, 0x1d, 0x27, 0x57, 0x8d, 0x46, 0xd7, 0x62,
     0xf7, 0x13, 0x77, 0x35, 0x6b, 0x73, 0xe6, 0x95,
@@ -814,6 +818,11 @@ static const uint8_t expected_cipher_ctr[] = {
     0xcf, 0x8a, 0x8d, 0x73, 0x8c, 0x6b, 0xfa, 0x4d,
     0xd6, 0xc4, 0x18, 0x49, 0xdd, 0xc6, 0xbf, 0xc2,
     0xb9, 0xf0, 0x09, 0x69, 0x45, 0x42, 0xc6, 0x05,
+    0x5f, 0x42, 0xf6, 0x3b, 0x8e, 0x11, 0x43, 0xc8,
+    0xc7, 0xd9, 0x85, 0xf3, 0xdc, 0x39, 0x6b, 0x33,
+    0x98, 0x8c, 0xc0, 0xf5, 0x92, 0xb4, 0x04, 0xf9,
+    0x2f, 0xdf, 0x12, 0xc0, 0xa1, 0xd2, 0xdc, 0x71,
+    0x88,
 };
 
 static const uint8_t long_input[] = {
diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes.c b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes.c
index 448ccf5dd62..e472b0f5c76 100644
--- a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes.c
+++ b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes.c
@@ -1853,7 +1853,11 @@ void aes_psram_one_buf_ctr_test(void)
     uint8_t nonce[16];
     uint8_t key[16];
     psa_status_t status;
+#if CONFIG_MBEDTLS_HARDWARE_AES
     size_t SZ = TEST_AES_CTR_DATA_LEN;
+#else
+    size_t SZ = TEST_AES_CTR_DATA_LEN - (TEST_AES_CTR_DATA_LEN % 16);
+#endif
     size_t ALIGNMENT_SIZE_BYTES = 32;
     memset(nonce, 0x2F, 16);
     memset(key, 0x1E, 16);
diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes_gcm.c b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes_gcm.c
index 0f3eff9d3c0..635d7d304bc 100644
--- a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes_gcm.c
+++ b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_aes_gcm.c
@@ -12,6 +12,7 @@
 #include "sdkconfig.h"
 #include "esp_heap_caps.h"
 #include "test_utils.h"
+#include "test_aes_params.h"
 #include "ccomp_timer.h"
 #include "sys/param.h"
 #include "crypto_performance.h"
@@ -987,4 +988,78 @@ TEST_CASE("mbedtls AES GCM - Different Authentication Tag lengths", "[aes-gcm]")
     free(input);
 }
 
+#ifdef CONFIG_SPIRAM_USE_MALLOC
+
+static void aes_gcm_psram_test(size_t len)
+{
+    psa_key_id_t key_id;
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    psa_status_t status;
+    uint8_t key[16];
+    uint8_t nonce[12];
+    uint8_t aad[16];
+    const size_t out_len = len + 16;
+    size_t olen = 0;
+
+    memset(key, 0x44, sizeof(key));
+    memset(nonce, 0xEE, sizeof(nonce));
+    memset(aad, 0x76, sizeof(aad));
+
+    status = psa_crypto_init();
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
+
+    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
+    psa_set_key_algorithm(&attributes, PSA_ALG_GCM);
+    psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
+    psa_set_key_bits(&attributes, 128);
+    status = psa_import_key(&attributes, key, sizeof(key), &key_id);
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
+
+    uint8_t *plaintext = heap_caps_malloc(len, MALLOC_CAP_8BIT | MALLOC_CAP_SPIRAM);
+    uint8_t *ciphertext = heap_caps_malloc(out_len, MALLOC_CAP_8BIT | MALLOC_CAP_SPIRAM);
+    uint8_t *decryptedtext = heap_caps_malloc(len, MALLOC_CAP_8BIT | MALLOC_CAP_SPIRAM);
+    uint8_t *ref_plaintext = heap_caps_malloc(len, MALLOC_CAP_8BIT | MALLOC_CAP_INTERNAL | MALLOC_CAP_DMA);
+    uint8_t *ref_ciphertext = heap_caps_malloc(out_len, MALLOC_CAP_8BIT | MALLOC_CAP_INTERNAL | MALLOC_CAP_DMA);
+
+    TEST_ASSERT_NOT_NULL(plaintext);
+    TEST_ASSERT_NOT_NULL(ciphertext);
+    TEST_ASSERT_NOT_NULL(decryptedtext);
+    TEST_ASSERT_NOT_NULL(ref_plaintext);
+    TEST_ASSERT_NOT_NULL(ref_ciphertext);
+
+    memset(plaintext, 0xAA, len);
+    memset(ref_plaintext, 0xAA, len);
+
+    status = psa_aead_encrypt(key_id, PSA_ALG_GCM, nonce, sizeof(nonce), aad, sizeof(aad),
+                              ref_plaintext, len, ref_ciphertext, out_len, &olen);
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
+    TEST_ASSERT_EQUAL(out_len, olen);
+
+    status = psa_aead_encrypt(key_id, PSA_ALG_GCM, nonce, sizeof(nonce), aad, sizeof(aad),
+                              plaintext, len, ciphertext, out_len, &olen);
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
+    TEST_ASSERT_EQUAL(out_len, olen);
+    TEST_ASSERT_EQUAL_HEX8_ARRAY(ref_ciphertext, ciphertext, out_len);
+
+    status = psa_aead_decrypt(key_id, PSA_ALG_GCM, nonce, sizeof(nonce), aad, sizeof(aad),
+                              ciphertext, out_len, decryptedtext, len, &olen);
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
+    TEST_ASSERT_EQUAL(len, olen);
+    TEST_ASSERT_EQUAL_HEX8_ARRAY(plaintext, decryptedtext, len);
+
+    psa_destroy_key(key_id);
+    heap_caps_free(plaintext);
+    heap_caps_free(ciphertext);
+    heap_caps_free(decryptedtext);
+    heap_caps_free(ref_plaintext);
+    heap_caps_free(ref_ciphertext);
+}
+
+TEST_CASE("mbedtls AES GCM PSRAM tests", "[aes-gcm]")
+{
+    aes_gcm_psram_test(TEST_AES_CTR_DATA_LEN);
+}
+
+#endif // CONFIG_SPIRAM_USE_MALLOC
+
 #endif //CONFIG_MBEDTLS_HARDWARE_AES