diff --git a/components/bt/controller/esp32c6/esp_bt_cfg.h b/components/bt/controller/esp32c6/esp_bt_cfg.h
index 6621c28cb4..27b12ca3fd 100644
--- a/components/bt/controller/esp32c6/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c6/esp_bt_cfg.h
@@ -40,6 +40,7 @@ extern "C" {
     #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
     #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
     #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #define DEFAULT_BT_LE_SUBRATE_ENABLED MYNEWT_VAL(BLE_CONN_SUBRATING)
     #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
     #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
     #else
@@ -144,6 +145,8 @@ extern "C" {
         #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
         #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
     #endif
+
+    #define DEFAULT_BT_LE_SUBRATE_ENABLED 0
 #endif
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index 5902fba3ec..959f925b75 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -683,46 +683,45 @@ if BT_NIMBLE_50_FEATURE_SUPPORT
         default n
         help
             Enable support for Connectionless and Connection Oriented Direction Finding
-
-    menuconfig BT_NIMBLE_GATT_CACHING
-        bool "Enable GATT caching"
-        depends on BT_NIMBLE_ENABLED && BT_NIMBLE_50_FEATURE_SUPPORT
-        select BT_NIMBLE_DYNAMIC_SERVICE
-        help
-                Enable GATT caching
-    config BT_NIMBLE_GATT_CACHING_MAX_CONNS
-        int "Maximum connections to be cached"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 1
-        help
-            Set this option to set the upper limit on number of connections to be cached.
-    config BT_NIMBLE_GATT_CACHING_MAX_SVCS
-        int "Maximum number of services per connection"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 64
-        help
-            Set this option to set the upper limit on number of services per connection to be cached.
-    config BT_NIMBLE_GATT_CACHING_MAX_CHRS
-        int "Maximum number of characteristics per connection"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 64
-        help
-            Set this option to set the upper limit on number of characteristics per connection to be cached.
-    config BT_NIMBLE_GATT_CACHING_MAX_DSCS
-        int "Maximum number of descriptors per connection"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 64
-        help
-            Set this option to set the upper limit on number of descriptors per connection to be cached.
-    config BT_NIMBLE_GATT_CACHING_DISABLE_AUTO
-        bool "Do not start discovery procedure automatically upon receiving Out of Sync"
-        depends on BT_NIMBLE_GATT_CACHING
-        default n
-        help
-            When client receives ATT out-of-sync error message, it will not automatically start the discovery procedure
-            to correct the invalid cache.
 endif
 
+menuconfig BT_NIMBLE_GATT_CACHING
+    bool "Enable GATT caching"
+    depends on BT_NIMBLE_ENABLED
+    select BT_NIMBLE_DYNAMIC_SERVICE
+    help
+        Enable GATT caching
+config BT_NIMBLE_GATT_CACHING_MAX_CONNS
+    int "Maximum connections to be cached"
+    depends on BT_NIMBLE_GATT_CACHING
+    default BT_NIMBLE_MAX_CONNECTIONS
+    help
+        Set this option to set the upper limit on number of connections to be cached.
+config BT_NIMBLE_GATT_CACHING_MAX_SVCS
+    int "Maximum number of services per connection"
+    depends on BT_NIMBLE_GATT_CACHING
+    default 64
+    help
+        Set this option to set the upper limit on number of services per connection to be cached.
+config BT_NIMBLE_GATT_CACHING_MAX_CHRS
+    int "Maximum number of characteristics per connection"
+    depends on BT_NIMBLE_GATT_CACHING
+    default 64
+    help
+        Set this option to set the upper limit on number of characteristics per connection to be cached.
+config BT_NIMBLE_GATT_CACHING_MAX_DSCS
+    int "Maximum number of descriptors per connection"
+    depends on BT_NIMBLE_GATT_CACHING
+    default 64
+    help
+        Set this option to set the upper limit on number of descriptors per connection to be cached.
+config BT_NIMBLE_GATT_CACHING_DISABLE_AUTO
+    bool "Do not start discovery procedure automatically upon receiving Out of Sync"
+    depends on BT_NIMBLE_GATT_CACHING
+    default n
+    help
+        When client receives ATT out-of-sync error message, it will not automatically start the discovery procedure
+        to correct the invalid cache.
 
 config BT_NIMBLE_WHITELIST_SIZE
     int "BLE white list size"
@@ -927,6 +926,12 @@ menu "GAP Service"
         help
             Enable the LE GATT Security Level Characteristic
 
+    config BT_NIMBLE_SVC_GAP_RPA_ONLY
+        bool "Resolvable Private Address Only characteristic"
+        default n
+        help
+            Enable the Resolvable Private Address Only characteristic
+
 endmenu
 
 menu "BLE Services"
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 571c7246c7..b06d5c175a 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 571c7246c79dcec8ca91b10c351cd20a4edb7b54
+Subproject commit b06d5c175a42d2249a399da19472bb25763b98fc
diff --git a/components/bt/host/nimble/port/include/esp_nimble_cfg.h b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
index c7aeb38019..420cf27f9e 100644
--- a/components/bt/host/nimble/port/include/esp_nimble_cfg.h
+++ b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
@@ -1815,6 +1815,11 @@
         CONFIG_BT_NIMBLE_SVC_GAP_GATT_SECURITY_LEVEL
 #endif
 
+#ifndef MYNEWT_VAL_BLE_SVC_GAP_RPA_ONLY
+#define MYNEWT_VAL_BLE_SVC_GAP_RPA_ONLY \
+        CONFIG_BT_NIMBLE_SVC_GAP_RPA_ONLY
+#endif
+
 /*** nimble/transport */
 #ifndef MYNEWT_VAL_BLE_HCI_TRANSPORT_EMSPI
 #define MYNEWT_VAL_BLE_HCI_TRANSPORT_EMSPI (0)
diff --git a/components/bt/include/esp32c6/include/esp_bt.h b/components/bt/include/esp32c6/include/esp_bt.h
index a7e686c555..49232ef4a4 100644
--- a/components/bt/include/esp32c6/include/esp_bt.h
+++ b/components/bt/include/esp32c6/include/esp_bt.h
@@ -272,7 +272,7 @@ typedef struct {
     .ignore_wl_for_direct_adv   = 0,                                                    \
     .enable_pcl                 = DEFAULT_BT_LE_POWER_CONTROL_ENABLED,                  \
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
-    .enable_csr                 = 0,                                                    \
+    .enable_csr                 = DEFAULT_BT_LE_SUBRATE_ENABLED,                        \
     .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
     .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
     .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
diff --git a/examples/bluetooth/esp_hid_device/README.md b/examples/bluetooth/esp_hid_device/README.md
index a9c1966f42..e8648dc6da 100644
--- a/examples/bluetooth/esp_hid_device/README.md
+++ b/examples/bluetooth/esp_hid_device/README.md
@@ -92,5 +92,5 @@ I (50557) HID_DEV_DEMO: Send the volume
 
 ## Troubleshooting
 
-1. When using NimBLE stack, some iOS devices do not show the volume pop up. To fix this, please set CONFIG_BT_NIMBLE_SM_LVL to value 2. iOS needs Authenticated Pairing with Encryption to show up the pop ups.
+1. When using NimBLE stack, some iOS devices do not show the volume pop up. To fix this, please set CONFIG_BT_NIMBLE_SM_SC_LVL to value 2. iOS needs Authenticated Pairing with Encryption to show up the pop ups.
 2. For any technical queries, please open an [issue](https://github.com/espressif/esp-idf/issues) on GitHub. We will get back to you soon.
diff --git a/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c b/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
index 520c2a44ac..86de6e3590 100644
--- a/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
+++ b/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
@@ -994,7 +994,7 @@ nimble_hid_gap_event(struct ble_gap_event *event, void *arg)
 static esp_err_t start_nimble_scan(uint32_t seconds)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
index d3c6321ea5..ad3e43740a 100644
--- a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
@@ -145,7 +145,7 @@ static void
 ble_cts_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c b/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
index 616d8eecd5..3ceaffc07e 100644
--- a/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
@@ -183,7 +183,7 @@ static void
 enc_adv_data_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
index 2b4d3bf8d1..c2e1afed1e 100644
--- a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
@@ -263,7 +263,7 @@ static void
 ble_htp_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c b/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c
index b458b0d857..cec8b5c1aa 100644
--- a/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c
+++ b/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c
@@ -190,7 +190,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_periodic_sync/main/main.c b/examples/bluetooth/nimble/ble_periodic_sync/main/main.c
index 9ec68b3d5f..4ec6d98ec9 100644
--- a/examples/bluetooth/nimble/ble_periodic_sync/main/main.c
+++ b/examples/bluetooth/nimble/ble_periodic_sync/main/main.c
@@ -26,7 +26,7 @@ static void
 periodic_sync_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c b/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c
index 29016667a4..88b7ac4deb 100644
--- a/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c
@@ -187,7 +187,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
index 8bb8f158ad..a3bbfcbb67 100644
--- a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
@@ -180,7 +180,7 @@ static void
 ble_prox_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c b/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c
index 006190f5ff..1664d41100 100644
--- a/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c
+++ b/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c
@@ -127,7 +127,7 @@ static void
 ble_spp_client_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/blecent/main/main.c b/examples/bluetooth/nimble/blecent/main/main.c
index e8acc2174f..199c958ba1 100644
--- a/examples/bluetooth/nimble/blecent/main/main.c
+++ b/examples/bluetooth/nimble/blecent/main/main.c
@@ -433,7 +433,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c b/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c
index c365a1a783..2bfbf5e040 100644
--- a/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c
+++ b/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c
@@ -466,7 +466,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */