diff --git a/components/mbedtls/CMakeLists.txt b/components/mbedtls/CMakeLists.txt
index e71884fc80..e112a04f83 100644
--- a/components/mbedtls/CMakeLists.txt
+++ b/components/mbedtls/CMakeLists.txt
@@ -3,6 +3,10 @@ idf_build_get_property(python PYTHON)
 
 set(priv_requires soc esp_hw_support)
 
+# Variable DISABLE_PACKAGE_CONFIG_AND_INSTALL is set to true to use old policy for mbedtls/pkgconfig.
+# if set to false, we need to set policy in mbedtls/mbedtls/pkgconfig.CMakeLists
+set(DISABLE_PACKAGE_CONFIG_AND_INSTALL true)
+
 if(NOT BOOTLOADER_BUILD)
     list(APPEND priv_requires esp_pm)
 endif()
diff --git a/components/mbedtls/mbedtls b/components/mbedtls/mbedtls
index 2b8e772fc1..4cfd2256ee 160000
--- a/components/mbedtls/mbedtls
+++ b/components/mbedtls/mbedtls
@@ -1 +1 @@
-Subproject commit 2b8e772fc1cb0732cda3bae7d1e9d6f4cfaf63d9
+Subproject commit 4cfd2256ee068ba931a6e332ad7b55639812d225
diff --git a/tools/ci/check_public_headers_exceptions.txt b/tools/ci/check_public_headers_exceptions.txt
index e5b8bf7f30..1c2e85ff8b 100644
--- a/tools/ci/check_public_headers_exceptions.txt
+++ b/tools/ci/check_public_headers_exceptions.txt
@@ -48,6 +48,7 @@ components/wpa_supplicant/esp_supplicant/include/
 components/mbedtls/port/include/
 components/mbedtls/mbedtls/include/mbedtls/
 components/mbedtls/mbedtls/include/psa/
+components/mbedtls/mbedtls/3rdparty/everest/include/
 
 components/coap/
 components/nghttp/