diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index 52503d8124..97e0fdc21f 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -1232,6 +1232,15 @@ config BT_NIMBLE_GATTC_PROC_PREEMPTION_PROTECT
         can disrupt the GATT context,causing the service discovery callback to not be invoked.
         A temporary list is maintained to preserve the GATT context and use it in case of preemption.
 
+config BT_NIMBLE_GATTC_AUTO_PAIR
+    bool "Automatically pair upon receiving service request failure"
+    depends on BT_NIMBLE_ENABLED
+    default n
+    help
+        If enabled, when a service request (e.g. read, write) to a server fails, and the ATT
+        error suggests insufficient security, then the central will initiate pairing and retry
+        the service request.
+
 menu "Host-controller Transport"
     config BT_NIMBLE_TRANSPORT_UART
         bool "Enable Uart Transport"
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index cc3ac5416b..84e02a6b82 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit cc3ac5416b46e6e9363dae357378c03b4975cfdb
+Subproject commit 84e02a6b820734de411ae9bdc8829d8ef6128205
diff --git a/components/bt/host/nimble/port/include/esp_nimble_cfg.h b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
index 6c80ae750c..2d4879153f 100644
--- a/components/bt/host/nimble/port/include/esp_nimble_cfg.h
+++ b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
@@ -2010,6 +2010,14 @@
 #endif
 #endif
 
+#ifndef MYNEWT_VAL_BLE_GATTC_AUTO_PAIR
+#ifdef CONFIG_BT_NIMBLE_GATTC_AUTO_PAIR
+#define MYNEWT_VAL_BLE_GATTC_AUTO_PAIR CONFIG_BT_NIMBLE_GATTC_AUTO_PAIR
+#else
+#define MYNEWT_VAL_BLE_GATTC_AUTO_PAIR (0)
+#endif
+#endif
+
 #ifndef MYNEWT_VAL_BLE_HOST_ALLOW_CONNECT_WITH_SCAN
 #ifdef CONFIG_BT_NIMBLE_HOST_ALLOW_CONNECT_WITH_SCAN
 #define MYNEWT_VAL_BLE_HOST_ALLOW_CONNECT_WITH_SCAN CONFIG_BT_NIMBLE_HOST_ALLOW_CONNECT_WITH_SCAN