diff --git a/components/bt/controller/esp32/Kconfig.in b/components/bt/controller/esp32/Kconfig.in
index 1d7572cb08..8855fb062f 100644
--- a/components/bt/controller/esp32/Kconfig.in
+++ b/components/bt/controller/esp32/Kconfig.in
@@ -406,6 +406,15 @@ config BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX
         minimize collision of scan request PDUs from nultiple scanners. If scan backoff is disabled, in active
         scanning, scan request PDU will be sent every time when HW receives scannable ADV PDU.
 
+config BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+    bool "Enable enhanced Access Address check in CONNECT_IND"
+    default n
+    help
+        Enabling this option will add stricter verification of the Access Address in the CONNECT_IND PDU.
+        This improves security by ensuring that only connection requests with valid Access Addresses are accepted.
+        If disabled, only basic checks are applied, improving compatibility.
+
+
 config BTDM_BLE_ADV_REPORT_FLOW_CTRL_SUPP
     bool "BLE adv report flow control supported"
     depends on (BTDM_CTRL_MODE_BTDM || BTDM_CTRL_MODE_BLE_ONLY)
@@ -440,6 +449,23 @@ config BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD
         If you set `BTDM_BLE_ADV_REPORT_DISCARD_THRSHOLD` to a small value or printf every adv lost event, it
         may cause adv packets lost more.
 
+menu "BLE disconnect when instant passed"
+    config BTDM_BLE_LLCP_CONN_UPDATE
+        bool "BLE ACL connection update procedure"
+        depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed during connection update procedure.
+
+    config BTDM_BLE_LLCP_CHAN_MAP_UPDATE
+        bool "BLE ACL channel map update procedure"
+        depends on (BTDM_CTRL_MODE_BLE_ONLY || BTDM_CTRL_MODE_BTDM)
+        default n
+        help
+            If this option is enabled, Controller will terminate the connection
+            when instant passed in channel map update procedure.
+endmenu
 
 config BTDM_RESERVE_DRAM
     hex
diff --git a/components/bt/controller/lib_esp32 b/components/bt/controller/lib_esp32
index f5114d2a70..5c4a62c1d4 160000
--- a/components/bt/controller/lib_esp32
+++ b/components/bt/controller/lib_esp32
@@ -1 +1 @@
-Subproject commit f5114d2a70e33a352adc5a3ad5d44c8537aa13da
+Subproject commit 5c4a62c1d4577d1352d28708c790ba2b4f741842
diff --git a/components/bt/include/esp32/include/esp_bt.h b/components/bt/include/esp32/include/esp_bt.h
index a0897e57ee..10fdc683b0 100644
--- a/components/bt/include/esp32/include/esp_bt.h
+++ b/components/bt/include/esp32/include/esp_bt.h
@@ -55,7 +55,7 @@ extern "C" {
 *
 * @note Please do not modify this value.
 */
-#define ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL  0x20240722
+#define ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL  0x20241015
 
 /**
  * @brief Bluetooth Controller mode
@@ -178,6 +178,27 @@ the adv packet will be discarded until the memory is restored. */
 #else
 #define BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX  0
 #endif
+
+#ifdef CONFIG_BTDM_BLE_LLCP_CONN_UPDATE
+#define BTDM_BLE_LLCP_CONN_UPDATE (1<<0)
+#else
+#define BTDM_BLE_LLCP_CONN_UPDATE (0<<0)
+#endif
+
+#ifdef CONFIG_BTDM_BLE_LLCP_CHAN_MAP_UPDATE
+#define BTDM_BLE_LLCP_CHAN_MAP_UPDATE (1<<1)
+#else
+#define BTDM_BLE_LLCP_CHAN_MAP_UPDATE (0<<1)
+#endif
+
+#define BTDM_BLE_LLCP_DISC_FLAG (BTDM_BLE_LLCP_CONN_UPDATE | BTDM_BLE_LLCP_CHAN_MAP_UPDATE)
+
+#ifdef CONFIG_BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#define BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED CONFIG_BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS
+#else
+#define BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED 0
+#endif
+
 /**
 * @brief  Default Bluetooth Controller configuration
 */
@@ -206,6 +227,8 @@ the adv packet will be discarded until the memory is restored. */
     .hli = BTDM_CTRL_HLI,                                                  \
     .dup_list_refresh_period = SCAN_DUPL_CACHE_REFRESH_PERIOD,             \
     .ble_scan_backoff = BTDM_CTRL_SCAN_BACKOFF_UPPERLIMITMAX,              \
+    .ble_llcp_disc_flag = BTDM_BLE_LLCP_DISC_FLAG,                         \
+    .ble_aa_check = BTDM_CTRL_CHECK_CONNECT_IND_ACCESS_ADDRESS_ENABLED,    \
     .magic = ESP_BT_CONTROLLER_CONFIG_MAGIC_VAL,                           \
 }
 
@@ -258,6 +281,8 @@ typedef struct {
     bool hli;                               /*!< True if using high level interrupt; false otherwise. Configurable in menuconfig. */
     uint16_t dup_list_refresh_period;       /*!< Scan duplicate filtering list refresh period in seconds. Configurable in menuconfig.*/
     bool ble_scan_backoff;                  /*!< True if BLE scan backoff is enabled; false otherwise. Configurable in menuconfig.*/
+    uint8_t ble_llcp_disc_flag;             /*!< BLE disconnect flag when instant passed. Configurable in menuconfig. */
+    bool ble_aa_check;                      /*!< True if adds a verification step for the Access Address within the CONNECT_IND PDU; false otherwise. Configurable in menuconfig. */
     uint32_t magic;                         /*!< Magic number */
 } esp_bt_controller_config_t;