diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index 7b3cd0b7ebe..5b9a47ed805 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -323,6 +323,17 @@ menu "GAP"
             Use this option to do host based Random Private Address resolution.
             This option is valid only for ESP32
 
+    config BT_NIMBLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN
+        bool "Resolve peer RPA while scanning"
+        default y
+        depends on BT_NIMBLE_HOST_BASED_PRIVACY
+        help
+            Enable this option to resolve peer Resolvable Private Addresses (RPAs)
+            to their identity addresses in scan results. This is useful when an
+            application needs to identify a peer while scanning, for example, to
+            match a bonded device. When disabled, scan results retain the peer's
+            on-air RPA, and the RPA is resolved when the connection is established.
+
     config BT_NIMBLE_HOST_ALLOW_CONNECT_WITH_SCAN
         bool "Allow Connections with scanning in progress"
         depends on BT_NIMBLE_ENABLED && !(IDF_TARGET_ESP32C2)
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 3c88ae27458..eac83cd6039 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 3c88ae2745887f2c7049665b69eb7e06194331a8
+Subproject commit eac83cd603991bcaf0ca8c892938ed94bba6399d
diff --git a/components/bt/host/nimble/port/include/esp_nimble_cfg.h b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
index 958dbcb8058..0bd7c1ce286 100644
--- a/components/bt/host/nimble/port/include/esp_nimble_cfg.h
+++ b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
@@ -1010,6 +1010,14 @@
 
 #endif
 
+#ifndef MYNEWT_VAL_BLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN
+#ifdef CONFIG_BT_NIMBLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN
+#define MYNEWT_VAL_BLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN (1)
+#else
+#define MYNEWT_VAL_BLE_HOST_BASED_PRIVACY_RESOLVE_ON_SCAN (0)
+#endif
+#endif
+
 #ifndef MYNEWT_VAL_BLE_RPA_TIMEOUT
 #define MYNEWT_VAL_BLE_RPA_TIMEOUT (CONFIG_BT_NIMBLE_RPA_TIMEOUT)
 #endif
diff --git a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
index 5f9870ab41a..82777588d2a 100644
--- a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
@@ -376,9 +376,21 @@ ble_cts_cent_connect_if_interesting(void *disc)
 #endif
 
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
+#endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
 #endif
 
 #if CONFIG_EXAMPLE_CI_ID && CONFIG_EXAMPLE_CI_PIPELINE_ID
diff --git a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
index 912517c17c8..af6ed6698ca 100644
--- a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
@@ -498,9 +498,21 @@ ble_htp_cent_connect_if_interesting(void *disc)
 #endif
 
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
+#endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
 #endif
 
 #if CONFIG_EXAMPLE_CI_ID && CONFIG_EXAMPLE_CI_PIPELINE_ID
diff --git a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
index 96d6cc8459f..202bef954b4 100644
--- a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
@@ -435,10 +435,23 @@ ble_prox_cent_connect_if_interesting(void *disc)
      * timeout.
      */
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
 #endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
+#endif
+
     rc = ble_gap_connect(own_addr_type, addr, 30000, NULL,
                          ble_prox_cent_gap_event, NULL);
     if (rc != 0) {
diff --git a/examples/bluetooth/nimble/blecent/main/main.c b/examples/bluetooth/nimble/blecent/main/main.c
index 75cf7008f5e..11e641db21f 100644
--- a/examples/bluetooth/nimble/blecent/main/main.c
+++ b/examples/bluetooth/nimble/blecent/main/main.c
@@ -678,9 +678,21 @@ blecent_connect_if_interesting(void *disc)
      * timeout.
      */
 #if CONFIG_EXAMPLE_EXTENDED_ADV
-    addr = &((struct ble_gap_ext_disc_desc *)disc)->addr;
+    struct ble_gap_ext_disc_desc *disc_desc = disc;
 #else
-    addr = &((struct ble_gap_disc_desc *)disc)->addr;
+    struct ble_gap_disc_desc *disc_desc = disc;
+#endif
+
+    addr = &disc_desc->addr;
+
+#if MYNEWT_VAL(BLE_HOST_BASED_PRIVACY)
+    /*
+     * With host-based privacy, the advertising report's peer address may be
+     * resolved to the identity address by the Host. The Controller does not
+     * perform peer RPA resolution, so use the current OTA address when
+     * initiating the connection.
+     */
+    addr = &disc_desc->ota_addr;
 #endif
 
 #if CONFIG_EXAMPLE_CI_ID && CONFIG_EXAMPLE_CI_PIPELINE_ID