diff --git a/components/esp_tee/include/private/esp_tee_binary.h b/components/esp_tee/include/private/esp_tee_binary.h
index 8845462e6a5..8fa52fed464 100644
--- a/components/esp_tee/include/private/esp_tee_binary.h
+++ b/components/esp_tee/include/private/esp_tee_binary.h
@@ -48,6 +48,22 @@ extern "C" {
 #error "CONFIG_SECURE_TEE_INTR_STACK_SIZE must be 16-byte (0x10) aligned"
 #endif
 
+#if ((CONFIG_SECURE_TEE_IROM_SIZE) % SOC_MMU_PAGE_SIZE)
+#error "CONFIG_SECURE_TEE_IROM_SIZE must be a multiple of SOC_MMU_PAGE_SIZE"
+#endif
+
+#if ((CONFIG_SECURE_TEE_DROM_SIZE) % SOC_MMU_PAGE_SIZE)
+#error "CONFIG_SECURE_TEE_DROM_SIZE must be a multiple of SOC_MMU_PAGE_SIZE"
+#endif
+
+/* With HAL assertions disabled (level 0), a failed HAL_ASSERT() expands to
+ * __builtin_unreachable(): the compiler then optimizes assuming the asserted
+ * preconditions always hold, turning any unvalidated HAL input into undefined
+ * behavior. The TEE must never be built this way. */
+#if CONFIG_SECURE_ENABLE_TEE && (CONFIG_HAL_DEFAULT_ASSERTION_LEVEL < 1)
+#error "ESP-TEE requires HAL assertions (CONFIG_HAL_DEFAULT_ASSERTION_LEVEL >= 1)"
+#endif
+
 /* TEE Secure Storage partition label and NVS namespace */
 #define ESP_TEE_SEC_STG_PART_LABEL    "secure_storage"
 #define ESP_TEE_SEC_STG_NVS_NAMESPACE "tee_sec_stg_ns"
diff --git a/components/esp_tee/subproject/main/core/esp_secure_services_iram.c b/components/esp_tee/subproject/main/core/esp_secure_services_iram.c
index e2dae3d090e..c0e46323c99 100644
--- a/components/esp_tee/subproject/main/core/esp_secure_services_iram.c
+++ b/components/esp_tee/subproject/main/core/esp_secure_services_iram.c
@@ -276,11 +276,6 @@ esp_err_t _ss_esp_tee_sec_storage_ecdsa_sign_pbkdf2(const esp_tee_sec_storage_pb
 
 /* ---------------------------------------------- MMU HAL ------------------------------------------------- */
 
-/* Gates for REE-supplied external-flash address ranges. The HAL maps whole pages,
- * so validate the page-rounded span it will actually touch (not the raw byte len)
- * and require page-aligned addresses, so a sub-page or misaligned request cannot
- * smuggle in an adjacent TEE page. mmu_hal_check_valid_ext_vaddr_region() must be
- * enforced HERE, at the boundary: it rejects out-of-window (aliased) vaddrs. */
 static bool tee_ree_ext_vaddr_ok(uint32_t mmu_id, uint32_t vaddr, uint32_t len)
 {
     uint32_t page = mmu_hal_pages_to_bytes(mmu_id, 1);
@@ -333,8 +328,6 @@ void _ss_mmu_hal_unmap_region(uint32_t mmu_id, uint32_t vaddr, uint32_t len)
 
 bool _ss_mmu_hal_vaddr_to_paddr(uint32_t mmu_id, uint32_t vaddr, uint32_t *out_paddr, mmu_target_t *out_target)
 {
-    /* Same aliasing gate as map/unmap; translation itself is page-granular and
-     * vaddr need not be aligned, so validate the page containing it. */
     uint32_t page = mmu_hal_pages_to_bytes(mmu_id, 1);
     bool valid_addr = (tee_ree_ext_vaddr_ok(mmu_id, ALIGN_DOWN(vaddr, page), 1) &&
                        esp_tee_buf_in_ree(out_paddr, sizeof(uint32_t)) &&