diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig
index 2fc7f968f1f..f1bcdf83628 100644
--- a/components/mbedtls/Kconfig
+++ b/components/mbedtls/Kconfig
@@ -1419,6 +1419,33 @@ menu "mbedTLS"
                 priority level and any level from 1 to 3 can be selected (based on the availability).
                 Note: Higher value indicates high interrupt priority.
 
+        menu "Security hardening"
+
+            config MBEDTLS_CONSTANT_TIME_PRIME_GEN
+                bool "Constant-time prime generation"
+                default y
+                help
+                    Use mbedtls' constant-time small-factor test (a
+                    constant-time GCD against the product of all odd primes up
+                    to 997) when generating prime numbers, e.g. during RSA key
+                    generation.
+
+                    The constant-time implementation avoids a timing side
+                    channel in prime generation, but it makes RSA key
+                    generation roughly ten times slower, and its long
+                    non-yielding software computations can starve the idle
+                    task and trigger the task watchdog, so key generation code
+                    may need a larger watchdog timeout or the watchdog
+                    disabled.
+
+                    If disabled, the variable-time trial division that mbedtls
+                    used before versions 3.6.7/4.1.1 is used instead,
+                    restoring key generation performance. Only consider
+                    disabling this if no untrusted code running on the device
+                    could observe the timing of key generation operations.
+
+        endmenu # Security hardening
+
         config MBEDTLS_HARDWARE_AES
             bool "Enable hardware AES acceleration"
             default y
diff --git a/components/mbedtls/mbedtls b/components/mbedtls/mbedtls
index a2b32072ea8..ce3f3485a12 160000
--- a/components/mbedtls/mbedtls
+++ b/components/mbedtls/mbedtls
@@ -1 +1 @@
-Subproject commit a2b32072ea898afc1ed5b6caf6931e36028c91d6
+Subproject commit ce3f3485a121c100f58f36d700cb35b060f6e866
diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h
index a1c64d8697e..3c9856aa0a2 100644
--- a/components/mbedtls/port/include/mbedtls/esp_config.h
+++ b/components/mbedtls/port/include/mbedtls/esp_config.h
@@ -258,6 +258,18 @@
 #undef MBEDTLS_MPI_MUL_MPI_ALT
 #endif
 
+/* mbedtls 4.1.1 made the small-factor test used in prime
+ * generation constant-time, which slows RSA key generation down roughly
+ * tenfold and starves the idle task (the computation never yields the CPU).
+ * The constant-time variant is the default; when it is explicitly disabled,
+ * fall back to the variable-time trial division from earlier releases. See
+ * MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME in
+ * tf-psa-crypto/drivers/builtin/src/bignum.c.
+ */
+#ifndef CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
+#define MBEDTLS_MPI_PRIME_SIEVE_VARIABLE_TIME
+#endif
+
 #if defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY) || defined(CONFIG_MBEDTLS_HARDWARE_ECDSA_SIGN) || defined(CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN)
 #define ESP_ECDSA_DRIVER_ENABLED
 #ifdef CONFIG_MBEDTLS_HARDWARE_ECDSA_VERIFY
diff --git a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c
index 1330a5a1524..b2977ed0484 100644
--- a/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c
+++ b/components/mbedtls/test_apps/mbedtls_ut/main/test_psa_rsa.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2025-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Unlicense OR CC0-1.0
  */
@@ -8,6 +8,7 @@
 #include <string.h>
 
 #include "esp_log.h"
+#include "sdkconfig.h"
 
 #include "psa/crypto.h"
 #include "mbedtls/pk.h"
@@ -18,6 +19,10 @@
 #include "test_utils.h"
 #include "crypto_performance.h"
 
+#if CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT
+#include "esp_task_wdt.h"
+#endif
+
 typedef enum {
     PSA_RSA_KEY_SIZE_2048,
     PSA_RSA_KEY_SIZE_3072,
@@ -302,3 +307,45 @@ TEST_CASE("test performance RSA key operations", "[bignum]")
         keysize++;
     }
 }
+
+/* With constant-time prime generation the RSA-2048 key generation below takes
+ * over a minute on most targets (~86 s on ESP32-S3), exceeding the test
+ * timeout and starving the task watchdog, so only run it with the faster
+ * variable-time implementation.
+ */
+#if CONFIG_MBEDTLS_HARDWARE_MPI && !CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
+
+TEST_CASE("PSA RSA generate key", "[mbedtls][timeout=60]")
+{
+#if CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT
+    /* Check that generating keys doesn't starve the watchdog: long-running
+     * computations in key generation must not monopolize the CPU. */
+    esp_task_wdt_config_t twdt_config = {
+        .timeout_ms = 1000,
+        .idle_core_mask = (1 << 0), // Watch core 0 idle
+        .trigger_panic = true,
+    };
+    TEST_ASSERT_EQUAL(ESP_OK, esp_task_wdt_init(&twdt_config));
+#endif // CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT
+
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    psa_key_id_t key_id;
+
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_crypto_init());
+
+    psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
+    psa_set_key_algorithm(&attributes, PSA_ALG_RSA_PKCS1V15_CRYPT);
+    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
+    psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE);
+    psa_set_key_bits(&attributes, 2048);
+
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_generate_key(&attributes, &key_id));
+
+    TEST_ASSERT_EQUAL(PSA_SUCCESS, psa_destroy_key(key_id));
+    psa_reset_key_attributes(&attributes);
+
+#if CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT
+    TEST_ASSERT_EQUAL(ESP_OK, esp_task_wdt_deinit());
+#endif // CONFIG_MBEDTLS_MPI_USE_INTERRUPT && CONFIG_ESP_TASK_WDT_EN && !CONFIG_ESP_TASK_WDT_INIT
+}
+#endif // CONFIG_MBEDTLS_HARDWARE_MPI && !CONFIG_MBEDTLS_CONSTANT_TIME_PRIME_GEN
diff --git a/docs/en/api-reference/protocols/mbedtls.rst b/docs/en/api-reference/protocols/mbedtls.rst
index 5d576599dc6..aebcb3ad62c 100644
--- a/docs/en/api-reference/protocols/mbedtls.rst
+++ b/docs/en/api-reference/protocols/mbedtls.rst
@@ -417,5 +417,5 @@ Reducing Binary Size
 Under ``Component Config`` > ``mbedTLS``, several Mbed TLS features are enabled by default. These can be disabled if not needed to save code size. More information is available in the :ref:`Minimizing Binary Size <minimizing_binary_mbedtls>` documentation.
 
 
-.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.5/
+.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v4.1.1/
 .. _`Knowledge Base`: https://mbed-tls.readthedocs.io/en/latest/kb/
diff --git a/docs/zh_CN/api-reference/protocols/mbedtls.rst b/docs/zh_CN/api-reference/protocols/mbedtls.rst
index 74c0157cd1a..a134acc8389 100644
--- a/docs/zh_CN/api-reference/protocols/mbedtls.rst
+++ b/docs/zh_CN/api-reference/protocols/mbedtls.rst
@@ -417,5 +417,5 @@ Mbed TLS 配置系统支持预设配置。``Component Config`` > ``mbedTLS`` 中
 在 ``Component Config`` > ``mbedTLS`` 配置中，多个 Mbed TLS 功能已默认启用。如无需使用，可以禁用以减小固件大小。详情请参阅 :ref:`最小化固件大小 <minimizing_binary_mbedtls>`。
 
 
-.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v3.6.5/
+.. _`API Reference`: https://mbed-tls.readthedocs.io/projects/api/en/v4.1.1/
 .. _`Knowledge Base`: https://mbed-tls.readthedocs.io/en/latest/kb/