diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index f1bcdf83628..069b15c4672 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -1423,7 +1423,7 @@ menu "mbedTLS"
 
             config MBEDTLS_CONSTANT_TIME_PRIME_GEN
                 bool "Constant-time prime generation"
-                default y
+                default n
                 help
                     Use mbedtls' constant-time small-factor test (a
                     constant-time GCD against the product of all odd primes up
@@ -1440,9 +1440,9 @@ menu "mbedTLS"
 
                     If disabled, the variable-time trial division that mbedtls
                     used before versions 3.6.7/4.1.1 is used instead,
-                    restoring key generation performance. Only consider
-                    disabling this if no untrusted code running on the device
-                    could observe the timing of key generation operations.
+                    restoring key generation performance.
+
+                    Please see issue: https://github.com/Mbed-TLS/mbedtls/issues/10830
 
         endmenu # Security hardening
 
diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h
index 3c9856aa0a2..f275cd51e84 100644
--- a/components/mbedtls/port/include/mbedtls/esp_config.h
+++ b/components/mbedtls/port/include/mbedtls/esp_config.h
@@ -261,7 +261,7 @@
 /* mbedtls 4.1.1 made the small-factor test used in prime
  * generation constant-time, which slows RSA key generation down roughly
  * tenfold and starves the idle task (the computation never yields the CPU).
- * The constant-time variant is the default; when it is explicitly disabled,
+ * The non constant-time variant is the default; when it is disabled,
  * fall back to the variable-time trial division from earlier releases. See
  * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in
  * tf-psa-crypto/drivers/builtin/src/bignum.c.