diff --git a/components/bt/controller/esp32/Kconfig.in b/components/bt/controller/esp32/Kconfig.in
index d3c04a115f..9cf9fddb29 100644
--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@@ -459,6 +459,7 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
 
 config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
     bool "Enable enhanced Access Address check in CONNECT_IND"
+    depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
     default n
     help
         Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
diff --git a/components/bt/controller/esp32/bt.c b/components/bt/controller/esp32/bt.c
index d1a3ddadb1..dddcbfbaf0 100644
--- a/components/bt/controller/esp32/bt.c
+++ b/components/bt/controller/esp32/bt.c
@@ -252,6 +252,7 @@ extern uint32_t _bt_controller_data_end;
 extern void config_bt_funcs_reset(void);
 extern void config_ble_funcs_reset(void);
 extern void config_btdm_funcs_reset(void);
+extern void btdm_aa_check_enhance_enable(void);
 
 #ifdef CONFIG_BT_BLUEDROID_ENABLED
 extern void bt_stack_enableSecCtrlVsCmd(bool en);
@@ -1851,6 +1852,10 @@ static void patch_apply(void)
 #ifndef CONFIG_BTDM_CTRL_MODE_BR_EDR_ONLY
     config_ble_funcs_reset();
 #endif
+
+#if BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED
+    btdm_aa_check_enhance_enable();
+#endif
 }
 
 esp_err_t esp_bt_controller_enable(esp_bt_mode_t mode)
diff --git a/components/bt/controller/lib_esp32 b/components/bt/controller/lib_esp32
index b0ebfcf639..8243fcc96f 160000
--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
@@ -1 +1 @@
-Subproject commit b0ebfcf639d62e1d1926a9936e048405ebb48e7f
+Subproject commit 8243fcc96f88dc1f160447efbe9478bfccd21ebd