diff --git a/components/esp_hal_security/test_apps/crypto/main/key_manager/test_key_manager.c b/components/esp_hal_security/test_apps/crypto/main/key_manager/test_key_manager.c
index 05a18be9b7d..45eddcfd82e 100644
--- a/components/esp_hal_security/test_apps/crypto/main/key_manager/test_key_manager.c
+++ b/components/esp_hal_security/test_apps/crypto/main/key_manager/test_key_manager.c
@@ -641,28 +641,6 @@ static void key_mgr_test_hmac_ecdh1_mode(void)
 #endif /* SOC_KEY_MANAGER_HMAC_KEY_DEPLOY */
 
 #if SOC_KEY_MANAGER_FE_KEY_DEPLOY && SOC_KEY_MANAGER_FE_KEY_DEPLOY_XTS_AES_128
-/* Common XTS-AES verify body. Used by both the AES-mode and ECDH1-mode XTS
- * tests, which carry their own struct types but share the same plaintext +
- * expected-ciphertext layout. */
-static void verify_xts_aes_test_data(const uint8_t *plaintext_data,
-                                     const test_xts_data_t *xts_test_data)
-{
-    const esp_partition_t *partition = get_test_storage_partition();
-    ESP_ERROR_CHECK(esp_partition_erase_range(partition, 0, partition->size));
-
-    uint8_t read_data[128];
-    for (int i = 0; i < TEST_COUNT; i++) {
-        memset(read_data, 0, sizeof(read_data));
-        uint32_t address = xts_test_data[i].data_offset;
-        uint32_t data_size = xts_test_data[i].data_size;
-
-        ESP_ERROR_CHECK(esp_flash_write_encrypted(NULL, address, plaintext_data, data_size));
-        ESP_ERROR_CHECK(esp_flash_read(NULL, read_data, address, data_size));
-
-        TEST_ASSERT_EQUAL_HEX8_ARRAY(xts_test_data[i].ciphertext, read_data, data_size);
-    }
-}
-
 static void key_mgr_test_xts_aes_128_ecdh1_mode(void)
 {
     static esp_key_mgr_ecdh1_key_config_t key_config;
diff --git a/components/esp_security/src/esp_key_mgr.c b/components/esp_security/src/esp_key_mgr.c
index d0b739e55c0..eb2696b9043 100644
--- a/components/esp_security/src/esp_key_mgr.c
+++ b/components/esp_security/src/esp_key_mgr.c
@@ -795,6 +795,7 @@ typedef struct ecdh1_deploy {
     const esp_key_mgr_ecdh1_key_config_t *key_config;
     esp_key_mgr_key_recovery_info_t *key_info;
     bool huk_deployed;
+    bool multi_stage_deployment;
 } ecdh1_deploy_config_t;
 
 static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config)
@@ -817,7 +818,7 @@ static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config)
         ESP_LOGD(TAG, "HUK deployed successfully");
     }
 
-    uint8_t key_recovery_info_index = is_multi_stage_key_purpose(config->key_purpose) ? 0 : 1;
+    uint8_t key_recovery_info_index = config->multi_stage_deployment ? 1 : 0;
 
     uint8_t *key_recovery_info = config->key_info->key_info[key_recovery_info_index].info;
 
@@ -868,7 +869,7 @@ static esp_err_t key_mgr_deploy_key_ecdh1_mode(ecdh1_deploy_config_t *config)
     // Check if key deployment validation should be skipped for this purpose
     // Primary purposes in multi-stage deployments skip validation after the first stage
     // because the key is not yet completely deployed.
-    if (!is_multi_stage_key_purpose(config->key_purpose)) {
+    if (!multi_stage_deployment_key_purpose(config->key_purpose)) {
         if (!key_mgr_hal_is_key_deployment_valid(key_type, key_len)) {
             ESP_LOGE(TAG, "Key deployment is not valid");
             return ESP_FAIL;
@@ -920,9 +921,10 @@ esp_err_t esp_key_mgr_deploy_key_in_ecdh1_mode(const esp_key_mgr_ecdh1_key_confi
 
     ecdh1_deploy_config.huk_deployed = true;
 
-    if (is_multi_stage_key_purpose(ecdh1_deploy_config.key_purpose)) {
+    if (multi_stage_deployment_key_purpose(ecdh1_deploy_config.key_purpose)) {
         ecdh1_deploy_config.key_purpose = get_secondary_key_purpose(ecdh1_deploy_config.key_purpose);
         ecdh1_deploy_config.k1_G = key_config->k1_G[1];
+        ecdh1_deploy_config.multi_stage_deployment = true;
         esp_ret = key_mgr_deploy_key_ecdh1_mode(&ecdh1_deploy_config);
         if (esp_ret != ESP_OK) {
             ESP_LOGE(TAG, "Key deployment in ECDH1 mode failed");