diff --git a/components/bt/controller/esp32c6/esp_bt_cfg.h b/components/bt/controller/esp32c6/esp_bt_cfg.h
index 6621c28cb4..27b12ca3fd 100644
--- a/components/bt/controller/esp32c6/esp_bt_cfg.h
+++ b/components/bt/controller/esp32c6/esp_bt_cfg.h
@@ -40,6 +40,7 @@ extern "C" {
     #define DEFAULT_BT_LE_HCI_EVT_HI_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_COUNT)
     #define DEFAULT_BT_LE_HCI_EVT_LO_BUF_COUNT MYNEWT_VAL(BLE_TRANSPORT_EVT_DISCARDABLE_COUNT)
     #define DEFAULT_BT_LE_POWER_CONTROL_ENABLED    MYNEWT_VAL(BLE_POWER_CONTROL)
+    #define DEFAULT_BT_LE_SUBRATE_ENABLED MYNEWT_VAL(BLE_CONN_SUBRATING)
     #if defined(CONFIG_BT_NIMBLE_50_FEATURE_SUPPORT)
     #define DEFAULT_BT_LE_50_FEATURE_SUPPORT (1)
     #else
@@ -144,6 +145,8 @@ extern "C" {
         #define DEFAULT_BT_LE_HCI_UART_CTS_PIN (-1)
         #define DEFAULT_BT_LE_HCI_UART_RTS_PIN (-1)
     #endif
+
+    #define DEFAULT_BT_LE_SUBRATE_ENABLED 0
 #endif
 
 #define DEFAULT_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF CONFIG_BT_LE_COEX_PHY_CODED_TX_RX_TLIM_EFF
diff --git a/components/bt/host/nimble/Kconfig.in b/components/bt/host/nimble/Kconfig.in
index 9a06cf30f8..dbb3edc3e1 100644
--- a/components/bt/host/nimble/Kconfig.in
+++ b/components/bt/host/nimble/Kconfig.in
@@ -690,40 +690,38 @@ if BT_NIMBLE_50_FEATURE_SUPPORT
         default n
         help
             Enable support for Connectionless and Connection Oriented Direction Finding
-
-    menuconfig BT_NIMBLE_GATT_CACHING
-        bool "Enable GATT caching"
-        depends on BT_NIMBLE_ENABLED && BT_NIMBLE_50_FEATURE_SUPPORT
-        select BT_NIMBLE_DYNAMIC_SERVICE
-        help
-            Enable GATT caching
-    config BT_NIMBLE_GATT_CACHING_MAX_CONNS
-        int "Maximum connections to be cached"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 1
-        help
-            Set this option to set the upper limit on number of connections to be cached.
-    config BT_NIMBLE_GATT_CACHING_MAX_SVCS
-        int "Maximum number of services per connection"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 64
-        help
-            Set this option to set the upper limit on number of services per connection to be cached.
-    config BT_NIMBLE_GATT_CACHING_MAX_CHRS
-        int "Maximum number of characteristics per connection"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 64
-        help
-            Set this option to set the upper limit on number of characteristics per connection to be cached.
-    config BT_NIMBLE_GATT_CACHING_MAX_DSCS
-        int "Maximum number of descriptors per connection"
-        depends on BT_NIMBLE_GATT_CACHING
-        default 64
-        help
-            Set this option to set the upper limit on number of descriptors per connection to be cached.
 endif
 
-
+menuconfig BT_NIMBLE_GATT_CACHING
+    bool "Enable GATT caching"
+    depends on BT_NIMBLE_ENABLED
+    select BT_NIMBLE_DYNAMIC_SERVICE
+    help
+        Enable GATT caching
+config BT_NIMBLE_GATT_CACHING_MAX_CONNS
+    int "Maximum connections to be cached"
+    depends on BT_NIMBLE_GATT_CACHING
+    default BT_NIMBLE_MAX_CONNECTIONS
+    help
+        Set this option to set the upper limit on number of connections to be cached.
+config BT_NIMBLE_GATT_CACHING_MAX_SVCS
+    int "Maximum number of services per connection"
+    depends on BT_NIMBLE_GATT_CACHING
+    default 64
+    help
+        Set this option to set the upper limit on number of services per connection to be cached.
+config BT_NIMBLE_GATT_CACHING_MAX_CHRS
+    int "Maximum number of characteristics per connection"
+    depends on BT_NIMBLE_GATT_CACHING
+    default 64
+    help
+        Set this option to set the upper limit on number of characteristics per connection to be cached.
+config BT_NIMBLE_GATT_CACHING_MAX_DSCS
+    int "Maximum number of descriptors per connection"
+    depends on BT_NIMBLE_GATT_CACHING
+    default 64
+    help
+        Set this option to set the upper limit on number of descriptors per connection to be cached.
 config BT_NIMBLE_GATT_CACHING_DISABLE_AUTO
     bool "Do not start discovery procedure automatically upon receiving Out of Sync"
     depends on BT_NIMBLE_GATT_CACHING
@@ -935,6 +933,12 @@ menu "GAP Service"
         help
             Enable the LE GATT Security Level Characteristic
 
+    config BT_NIMBLE_SVC_GAP_RPA_ONLY
+        bool "Resolvable Private Address Only characteristic"
+        default n
+        help
+            Enable the Resolvable Private Address Only characteristic
+
 endmenu
 
 menu "BLE Services"
diff --git a/components/bt/host/nimble/nimble b/components/bt/host/nimble/nimble
index 0ea32c88c7..7d06b1c8ca 160000
--- a/components/bt/host/nimble/nimble
+++ b/components/bt/host/nimble/nimble
@@ -1 +1 @@
-Subproject commit 0ea32c88c7309ae2e06affd7708cab539818d098
+Subproject commit 7d06b1c8ca6dada6a6fa503a13d8393f7e63d233
diff --git a/components/bt/host/nimble/port/include/esp_nimble_cfg.h b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
index d1c2649294..c9d399ef0d 100644
--- a/components/bt/host/nimble/port/include/esp_nimble_cfg.h
+++ b/components/bt/host/nimble/port/include/esp_nimble_cfg.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -1818,6 +1818,11 @@
         CONFIG_BT_NIMBLE_SVC_GAP_GATT_SECURITY_LEVEL
 #endif
 
+#ifndef MYNEWT_VAL_BLE_SVC_GAP_RPA_ONLY
+#define MYNEWT_VAL_BLE_SVC_GAP_RPA_ONLY \
+        CONFIG_BT_NIMBLE_SVC_GAP_RPA_ONLY
+#endif
+
 /*** nimble/transport */
 #ifndef MYNEWT_VAL_BLE_HCI_TRANSPORT_EMSPI
 #define MYNEWT_VAL_BLE_HCI_TRANSPORT_EMSPI (0)
diff --git a/components/bt/include/esp32c6/include/esp_bt.h b/components/bt/include/esp32c6/include/esp_bt.h
index dc44f58e3d..bce1cb9c55 100644
--- a/components/bt/include/esp32c6/include/esp_bt.h
+++ b/components/bt/include/esp32c6/include/esp_bt.h
@@ -276,7 +276,7 @@ typedef struct {
     .ignore_wl_for_direct_adv   = 0,                                                    \
     .enable_pcl                 = DEFAULT_BT_LE_POWER_CONTROL_ENABLED,                  \
     .csa2_select                = DEFAULT_BT_LE_50_FEATURE_SUPPORT,                     \
-    .enable_csr                 = 0,                                                    \
+    .enable_csr                 = DEFAULT_BT_LE_SUBRATE_ENABLED,                        \
     .ble_aa_check               = DEFAULT_BT_LE_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS,  \
     .ble_llcp_disc_flag         = BT_LE_CTRL_LLCP_DISC_FLAG,                            \
     .scan_backoff_upperlimitmax = BT_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,                   \
diff --git a/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c b/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
index 9d03c4b0d0..a792ff5ec2 100644
--- a/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
+++ b/examples/bluetooth/esp_hid_host/main/esp_hid_gap.c
@@ -998,7 +998,7 @@ nimble_hid_gap_event(struct ble_gap_event *event, void *arg)
 static esp_err_t start_nimble_scan(uint32_t seconds)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
index d3c6321ea5..ad3e43740a 100644
--- a/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_cts/cts_cent/main/main.c
@@ -145,7 +145,7 @@ static void
 ble_cts_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c b/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
index 616d8eecd5..3ceaffc07e 100644
--- a/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_enc_adv_data/enc_adv_data_cent/main/main.c
@@ -183,7 +183,7 @@ static void
 enc_adv_data_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
index 2b4d3bf8d1..c2e1afed1e 100644
--- a/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_htp/htp_cent/main/main.c
@@ -263,7 +263,7 @@ static void
 ble_htp_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c b/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c
index b458b0d857..cec8b5c1aa 100644
--- a/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c
+++ b/examples/bluetooth/nimble/ble_l2cap_coc/coc_blecent/main/main.c
@@ -190,7 +190,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_periodic_sync/main/main.c b/examples/bluetooth/nimble/ble_periodic_sync/main/main.c
index 9ec68b3d5f..4ec6d98ec9 100644
--- a/examples/bluetooth/nimble/ble_periodic_sync/main/main.c
+++ b/examples/bluetooth/nimble/ble_periodic_sync/main/main.c
@@ -26,7 +26,7 @@ static void
 periodic_sync_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c b/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c
index 29016667a4..88b7ac4deb 100644
--- a/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_phy/phy_cent/main/main.c
@@ -187,7 +187,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
index 8bb8f158ad..a3bbfcbb67 100644
--- a/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
+++ b/examples/bluetooth/nimble/ble_proximity_sensor/proximity_sensor_cent/main/main.c
@@ -180,7 +180,7 @@ static void
 ble_prox_cent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c b/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c
index 006190f5ff..1664d41100 100644
--- a/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c
+++ b/examples/bluetooth/nimble/ble_spp/spp_client/main/main.c
@@ -127,7 +127,7 @@ static void
 ble_spp_client_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/blecent/main/main.c b/examples/bluetooth/nimble/blecent/main/main.c
index ab286ebae9..e2c37b1ffe 100644
--- a/examples/bluetooth/nimble/blecent/main/main.c
+++ b/examples/bluetooth/nimble/blecent/main/main.c
@@ -435,7 +435,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */
diff --git a/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c b/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c
index c365a1a783..2bfbf5e040 100644
--- a/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c
+++ b/examples/bluetooth/nimble/throughput_app/blecent_throughput/main/main.c
@@ -466,7 +466,7 @@ static void
 blecent_scan(void)
 {
     uint8_t own_addr_type;
-    struct ble_gap_disc_params disc_params;
+    struct ble_gap_disc_params disc_params = {0};
     int rc;
 
     /* Figure out address to use while advertising (no privacy for now) */