diff --git a/components/esp-tls/esp_tls.h b/components/esp-tls/esp_tls.h
index 3d7596959ec..3232aef5d60 100644
--- a/components/esp-tls/esp_tls.h
+++ b/components/esp-tls/esp_tls.h
@@ -161,7 +161,9 @@ typedef struct esp_tls_cfg {
     const unsigned char *clientkey_pem_buf; /*!< Client key legacy name */
     };
 
-    const esp_key_config_t *client_key;     /*!< Unified key config. Must remain valid for session lifetime */
+    const esp_key_config_t *client_key;     /*!< Unified key config. Must remain valid for session lifetime.
+                                                 Any PSA key referenced here remains owned by the caller; ESP-TLS does not
+                                                 destroy it on cleanup, so the application must release it with psa_destroy_key(). */
 
     union {
     unsigned int clientkey_bytes;           /*!< Size of client key pointed to by
@@ -315,7 +317,9 @@ typedef struct esp_tls_cfg_server {
     const unsigned char *serverkey_pem_buf;     /*!< Server key legacy name */
     };
 
-    const esp_key_config_t *server_key;         /*!< Unified key config. Must remain valid for session lifetime */
+    const esp_key_config_t *server_key;         /*!< Unified key config. Must remain valid for session lifetime.
+                                                     Any PSA key referenced here remains owned by the caller; ESP-TLS does not
+                                                     destroy it on cleanup, so the application must release it with psa_destroy_key(). */
 
     union {
     unsigned int serverkey_bytes;               /*!< Size of server key pointed to by
diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c
index dfede2a2118..20e0b9ecc19 100644
--- a/components/esp-tls/esp_tls_mbedtls.c
+++ b/components/esp-tls/esp_tls_mbedtls.c
@@ -476,7 +476,6 @@ void esp_mbedtls_cleanup(esp_tls_t *tls)
     if (!tls) {
         return;
     }
-
     if (tls->cacert_ptr != global_cacert) {
         mbedtls_x509_crt_free(tls->cacert_ptr);
     }
diff --git a/components/mbedtls/sdkconfig.rename b/components/mbedtls/sdkconfig.rename
index 580d93bb06f..704feb32cac 100644
--- a/components/mbedtls/sdkconfig.rename
+++ b/components/mbedtls/sdkconfig.rename
@@ -1,5 +1,3 @@
 # Renamed ATCA/SE ECDSA options to generic secure element (v6.0)
 CONFIG_MBEDTLS_ATCA_HW_ECDSA_SIGN      CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
 CONFIG_MBEDTLS_ATCA_HW_ECDSA_VERIFY    CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
-CONFIG_MBEDTLS_SE_HW_ECDSA_SIGN        CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED
-CONFIG_MBEDTLS_SE_HW_ECDSA_VERIFY      CONFIG_MBEDTLS_SECURE_ELEMENT_DRIVER_ENABLED