diff --git a/.github/workflows/docker_img.yaml b/.github/workflows/docker_img.yaml
index b706dbcac39e42..73c45ee303a756 100644
--- a/.github/workflows/docker_img.yaml
+++ b/.github/workflows/docker_img.yaml
@@ -42,7 +42,12 @@ jobs:
                     - "-esp32"
                     - "-esp32-qemu"
                     - "-infineon"
-                    - "-imx"
+                    # NOTE: imx image requires too much space for GitHub-hosted runners. It fails with:
+                    # ```
+                    # ....
+                    # ApplyLayer exit status 1 stdout:  stderr: write /opt/fsl-imx-xwayland/5.15-kirkstone/sysroots/armv8a-poky-linux/opt/ltp/testcases/bin/fanotify15: no space left on device
+                    # ```
+                    # - "-imx"
                     - "-k32w"
                     - "-mbed-os"
                     - "-nrf-platform"
diff --git a/.github/workflows/examples-nrfconnect.yaml b/.github/workflows/examples-nrfconnect.yaml
index 3c110ce1ccece7..5da513c70de6ba 100644
--- a/.github/workflows/examples-nrfconnect.yaml
+++ b/.github/workflows/examples-nrfconnect.yaml
@@ -95,15 +95,6 @@ jobs:
                     nrfconnect nrf52840dk_nrf52840 lock-app \
                     examples/lock-app/nrfconnect/build/zephyr/zephyr.elf \
                     /tmp/bloat_reports/
-            - name: Build example nRF Connect SDK Lighting App on nRF52840 DK
-              if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
-              timeout-minutes: 15
-              run: |
-                  scripts/examples/nrfconnect_example.sh lighting-app nrf52840dk_nrf52840
-                  .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
-                    nrfconnect nrf52840dk_nrf52840 lighting-app \
-                    examples/lighting-app/nrfconnect/build/zephyr/zephyr.elf \
-                    /tmp/bloat_reports/
             - name: Build example nRF Connect SDK Lighting App on nRF52840 Dongle
               if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
               timeout-minutes: 15
@@ -122,6 +113,15 @@ jobs:
                     nrfconnect nrf52840dk_nrf52840+rpc lighting-app \
                     examples/lighting-app/nrfconnect/build/zephyr/zephyr.elf \
                     /tmp/bloat_reports/
+            - name: Build example nRF Connect SDK Light Switch App on nRF52840 DK
+              if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
+              timeout-minutes: 15
+              run: |
+                  scripts/examples/nrfconnect_example.sh light-switch-app nrf52840dk_nrf52840
+                  .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
+                    nrfconnect nrf52840dk_nrf52840 light-switch-app \
+                    examples/light-switch-app/nrfconnect/build/zephyr/zephyr.elf \
+                    /tmp/bloat_reports/
             - name: Build example nRF Connect SDK Shell on nRF52840 DK
               if: github.event_name == 'push' || steps.changed_paths.outputs.shell == 'true'
               timeout-minutes: 15
@@ -140,24 +140,6 @@ jobs:
                     nrfconnect nrf52840dk_nrf52840 pigweed-app \
                     examples/pigweed-app/nrfconnect/build/zephyr/zephyr.elf \
                     /tmp/bloat_reports/
-            - name: Build example nRF Connect SDK Lock App on nRF5340 DK
-              if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
-              timeout-minutes: 15
-              run: |
-                  scripts/examples/nrfconnect_example.sh lock-app nrf5340dk_nrf5340_cpuapp
-                  .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
-                    nrfconnect nrf5340dk_nrf5340_cpuapp lock-app \
-                    examples/lock-app/nrfconnect/build/zephyr/zephyr.elf \
-                    /tmp/bloat_reports/
-            - name: Build example nRF Connect SDK Lighting App on nRF5340 DK
-              if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
-              timeout-minutes: 15
-              run: |
-                  scripts/examples/nrfconnect_example.sh lighting-app nrf5340dk_nrf5340_cpuapp
-                  .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
-                    nrfconnect nrf5340dk_nrf5340_cpuapp lighting-app \
-                    examples/lighting-app/nrfconnect/build/zephyr/zephyr.elf \
-                    /tmp/bloat_reports/
             - name: Build example nRF Connect SDK Pump App on nRF52840 DK
               if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
               timeout-minutes: 15
@@ -192,6 +174,24 @@ jobs:
                     nrfconnect nrf52840dk_nrf52840 all-clusters-minimal-app \
                     examples/all-clusters-minimal-app/nrfconnect/build/zephyr/zephyr.elf \
                     /tmp/bloat_reports/
+            - name: Build example nRF Connect SDK Lock App on nRF5340 DK
+              if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
+              timeout-minutes: 15
+              run: |
+                  scripts/examples/nrfconnect_example.sh lock-app nrf5340dk_nrf5340_cpuapp
+                  .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
+                    nrfconnect nrf5340dk_nrf5340_cpuapp lock-app \
+                    examples/lock-app/nrfconnect/build/zephyr/zephyr.elf \
+                    /tmp/bloat_reports/
+            - name: Build example nRF Connect SDK Lighting App on nRF5340 DK
+              if: github.event_name == 'push' || steps.changed_paths.outputs.nrfconnect == 'true'
+              timeout-minutes: 15
+              run: |
+                  scripts/examples/nrfconnect_example.sh lighting-app nrf5340dk_nrf5340_cpuapp
+                  .environment/pigweed-venv/bin/python3 scripts/tools/memory/gh_sizes.py \
+                    nrfconnect nrf5340dk_nrf5340_cpuapp lighting-app \
+                    examples/lighting-app/nrfconnect/build/zephyr/zephyr.elf \
+                    /tmp/bloat_reports/
             - name: Run unit tests for Zephyr native_posix_64 platform
               if: github.event_name == 'push' || steps.changed_paths.outputs.tests == 'true'
               timeout-minutes: 15
diff --git a/config/esp32/components/chip/Kconfig b/config/esp32/components/chip/Kconfig
index 4a6cc6dd6e889e..55cafa1c8a07a8 100644
--- a/config/esp32/components/chip/Kconfig
+++ b/config/esp32/components/chip/Kconfig
@@ -387,6 +387,7 @@ menu "CHIP Device Layer"
     menu "WiFi AP Options"
 
         config ENABLE_WIFI_AP
+            depends on ESP_WIFI_SOFTAP_SUPPORT
             bool "Enable CHIP WIFI AP"
             default y
             help
diff --git a/docs/guides/BUILDING.md b/docs/guides/BUILDING.md
index 5bcd865ca5db1b..00bf6d97a581f9 100644
--- a/docs/guides/BUILDING.md
+++ b/docs/guides/BUILDING.md
@@ -8,7 +8,7 @@ Tested on:
 
 -   macOS 10.15
 -   Debian 11
--   Ubuntu 20.04 LTS
+-   Ubuntu 22.04 LTS
 
 Build system features:
 
@@ -81,9 +81,8 @@ dependency.
 
 ### Installing prerequisites on Raspberry Pi 4
 
-Using `rpi-imager`, install the Ubuntu _21.04_ 64-bit _server_ OS for arm64
-architectures on a micro SD card. This release will have bluez 5.55 or newer
-which is required for BLE functionality.
+Using `rpi-imager`, install the Ubuntu _22.04_ 64-bit _server_ OS for arm64
+architectures on a micro SD card.
 
 Boot the SD card, login with the default user account "ubuntu" and password
 "ubuntu", then proceed with
diff --git a/examples/all-clusters-app/esp32/main/Kconfig.projbuild b/examples/all-clusters-app/esp32/main/Kconfig.projbuild
index 8791a80a443e71..22edca7a03b264 100644
--- a/examples/all-clusters-app/esp32/main/Kconfig.projbuild
+++ b/examples/all-clusters-app/esp32/main/Kconfig.projbuild
@@ -53,6 +53,7 @@ menu "Demo"
 
       config RENDEZVOUS_MODE_SOFTAP
           bool "Soft-AP"
+          select ESP_WIFI_SOFTAP_SUPPORT
       config RENDEZVOUS_MODE_BLE
           bool "BLE"
           depends on BT_ENABLED
@@ -60,6 +61,7 @@ menu "Demo"
           bool "On-Network"
       config RENDEZVOUS_MODE_SOFTAP_ON_NETWORK
           bool "Soft-AP / On-Network"
+          select ESP_WIFI_SOFTAP_SUPPORT
       config RENDEZVOUS_MODE_BLE_ON_NETWORK
           bool "BLE / On-Network"
     endchoice
diff --git a/examples/all-clusters-app/esp32/sdkconfig.defaults b/examples/all-clusters-app/esp32/sdkconfig.defaults
index 5f996f40946d68..a9c28a1a863a25 100644
--- a/examples/all-clusters-app/esp32/sdkconfig.defaults
+++ b/examples/all-clusters-app/esp32/sdkconfig.defaults
@@ -53,3 +53,6 @@ CONFIG_LWIP_HOOK_ND6_GET_GW_DEFAULT=y
 # Serial Flasher config
 CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
 CONFIG_ESPTOOLPY_FLASHSIZE="4MB"
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/all-clusters-minimal-app/esp32/main/Kconfig.projbuild b/examples/all-clusters-minimal-app/esp32/main/Kconfig.projbuild
index 8791a80a443e71..22edca7a03b264 100644
--- a/examples/all-clusters-minimal-app/esp32/main/Kconfig.projbuild
+++ b/examples/all-clusters-minimal-app/esp32/main/Kconfig.projbuild
@@ -53,6 +53,7 @@ menu "Demo"
 
       config RENDEZVOUS_MODE_SOFTAP
           bool "Soft-AP"
+          select ESP_WIFI_SOFTAP_SUPPORT
       config RENDEZVOUS_MODE_BLE
           bool "BLE"
           depends on BT_ENABLED
@@ -60,6 +61,7 @@ menu "Demo"
           bool "On-Network"
       config RENDEZVOUS_MODE_SOFTAP_ON_NETWORK
           bool "Soft-AP / On-Network"
+          select ESP_WIFI_SOFTAP_SUPPORT
       config RENDEZVOUS_MODE_BLE_ON_NETWORK
           bool "BLE / On-Network"
     endchoice
diff --git a/examples/all-clusters-minimal-app/esp32/sdkconfig.defaults b/examples/all-clusters-minimal-app/esp32/sdkconfig.defaults
index 5f996f40946d68..a9c28a1a863a25 100644
--- a/examples/all-clusters-minimal-app/esp32/sdkconfig.defaults
+++ b/examples/all-clusters-minimal-app/esp32/sdkconfig.defaults
@@ -53,3 +53,6 @@ CONFIG_LWIP_HOOK_ND6_GET_GW_DEFAULT=y
 # Serial Flasher config
 CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
 CONFIG_ESPTOOLPY_FLASHSIZE="4MB"
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/bridge-app/esp32/sdkconfig.defaults b/examples/bridge-app/esp32/sdkconfig.defaults
index 6a6589e1040577..d76496f541c9ba 100644
--- a/examples/bridge-app/esp32/sdkconfig.defaults
+++ b/examples/bridge-app/esp32/sdkconfig.defaults
@@ -39,3 +39,6 @@ CONFIG_PARTITION_TABLE_FILENAME="partitions.csv"
 
 CONFIG_LWIP_HOOK_IP6_ROUTE_DEFAULT=y
 CONFIG_LWIP_HOOK_ND6_GET_GW_DEFAULT=y
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/chef/efr32/BUILD.gn b/examples/chef/efr32/BUILD.gn
index 662933081bc331..e23b747fcad1dd 100644
--- a/examples/chef/efr32/BUILD.gn
+++ b/examples/chef/efr32/BUILD.gn
@@ -207,6 +207,7 @@ efr32_executable("chef_app") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/examples/chef/esp32/main/Kconfig.projbuild b/examples/chef/esp32/main/Kconfig.projbuild
index 307b7f6ccb83bc..695222b7f43c45 100644
--- a/examples/chef/esp32/main/Kconfig.projbuild
+++ b/examples/chef/esp32/main/Kconfig.projbuild
@@ -55,6 +55,7 @@ menu "Demo"
           bool "Bypass"
       config RENDEZVOUS_MODE_SOFTAP
           bool "Soft-AP"
+          select ESP_WIFI_SOFTAP_SUPPORT
       config RENDEZVOUS_MODE_BLE
           bool "BLE"
           depends on BT_ENABLED
@@ -62,6 +63,7 @@ menu "Demo"
           bool "On-Network"
       config RENDEZVOUS_MODE_SOFTAP_ON_NETWORK
           bool "Soft-AP / On-Network"
+          select ESP_WIFI_SOFTAP_SUPPORT
       config RENDEZVOUS_MODE_BLE_ON_NETWORK
           bool "BLE / On-Network"
     endchoice
diff --git a/examples/chef/esp32/sdkconfig.defaults b/examples/chef/esp32/sdkconfig.defaults
index ab2bb7c5dcb419..a3a1d8a272b8b3 100644
--- a/examples/chef/esp32/sdkconfig.defaults
+++ b/examples/chef/esp32/sdkconfig.defaults
@@ -47,3 +47,6 @@ CONFIG_STACK_CHECK=y
 # Serial Flasher config
 CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
 CONFIG_ESPTOOLPY_FLASHSIZE="4MB"
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/common/pigweed/protos/device_service.options b/examples/common/pigweed/protos/device_service.options
index b5f9da673ff778..a0798688c38a84 100644
--- a/examples/common/pigweed/protos/device_service.options
+++ b/examples/common/pigweed/protos/device_service.options
@@ -5,3 +5,4 @@ chip.rpc.PairingInfo.qr_code max_size:256
 chip.rpc.PairingInfo.qr_code_url max_size:256
 chip.rpc.SpakeInfo.verifier max_size:97  // kSpake2p_VerifierSerialized_Length
 chip.rpc.SpakeInfo.salt max_size:32      // kSpake2p_Max_PBKDF_Salt_Length
+chip.rpc.MetadataForProvider.tlv max_size:512 // length defined in chip spec 11.20.6.7
diff --git a/examples/common/pigweed/protos/device_service.proto b/examples/common/pigweed/protos/device_service.proto
index 1c13d7d7281f14..6903e4a9055414 100644
--- a/examples/common/pigweed/protos/device_service.proto
+++ b/examples/common/pigweed/protos/device_service.proto
@@ -41,10 +41,15 @@ message PairingState {
   bool pairing_enabled = 1;
 }
 
+message MetadataForProvider {
+  bytes tlv = 1;
+}
+
 service Device {
   rpc FactoryReset(pw.protobuf.Empty) returns (pw.protobuf.Empty){}
   rpc Reboot(pw.protobuf.Empty) returns (pw.protobuf.Empty){}
   rpc TriggerOta(pw.protobuf.Empty) returns (pw.protobuf.Empty){}
+  rpc SetOtaMetadataForProvider(MetadataForProvider) returns (pw.protobuf.Empty){}
   rpc GetDeviceInfo(pw.protobuf.Empty) returns (DeviceInfo){}
   rpc GetDeviceState(pw.protobuf.Empty) returns (DeviceState){}
   rpc SetPairingState(PairingState) returns (pw.protobuf.Empty){}
diff --git a/examples/common/pigweed/rpc_services/Device.h b/examples/common/pigweed/rpc_services/Device.h
index d3d5afd165810d..4a80cb44516236 100644
--- a/examples/common/pigweed/rpc_services/Device.h
+++ b/examples/common/pigweed/rpc_services/Device.h
@@ -223,7 +223,7 @@ class Device : public pw_rpc::nanopb::Device::Service<Device>
 
     virtual pw::Status TriggerOta(const pw_protobuf_Empty & request, pw_protobuf_Empty & response)
     {
-#if CONFIG_CHIP_OTA_REQUESTOR
+#if CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
         chip::DeviceLayer::PlatformMgr().ScheduleWork(
             [](intptr_t) {
                 chip::OTARequestorInterface * requestor = chip::GetRequestorInstance();
@@ -238,10 +238,33 @@ class Device : public pw_rpc::nanopb::Device::Service<Device>
             },
             reinterpret_cast<intptr_t>(nullptr));
         return pw::OkStatus();
-#else
+#else  // CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
         ChipLogError(AppServer, "Trigger OTA requested, but OTA requestor not compiled in.");
         return pw::Status::Unimplemented();
-#endif
+#endif // CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
+    }
+
+    virtual pw::Status SetOtaMetadataForProvider(const chip_rpc_MetadataForProvider & request, pw_protobuf_Empty & response)
+    {
+#if CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
+        chip::OTARequestorInterface * requestor = chip::GetRequestorInstance();
+        if (requestor == nullptr)
+        {
+            ChipLogError(SoftwareUpdate, "Can't get the CASESessionManager");
+            return pw::Status::Unavailable();
+        }
+        else if (sizeof(metadataForProviderBuffer) < request.tlv.size)
+        {
+            return pw::Status::ResourceExhausted();
+        }
+        memcpy(metadataForProviderBuffer, request.tlv.bytes, request.tlv.size);
+        DeviceLayer::StackLock lock;
+        requestor->SetMetadataForProvider(chip::ByteSpan(metadataForProviderBuffer, request.tlv.size));
+        return pw::OkStatus();
+#else  // CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
+        ChipLogError(AppServer, "OTA set metadata for provider requested, but OTA requestor not compiled in.");
+        return pw::Status::Unimplemented();
+#endif // CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
     }
 
     virtual pw::Status SetPairingState(const chip_rpc_PairingState & request, pw_protobuf_Empty & response)
@@ -415,6 +438,10 @@ class Device : public pw_rpc::nanopb::Device::Service<Device>
     }
 
 private:
+#if CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
+    static constexpr size_t kMaxMetadataForProviderLength = 512; // length defined in chip spec 11.20.6.7
+    uint8_t metadataForProviderBuffer[kMaxMetadataForProviderLength];
+#endif // CHIP_DEVICE_CONFIG_ENABLE_OTA_REQUESTOR
     Internal::CommissionableDataProviderRpcWrapper mCommissionableDataProvider;
 };
 
diff --git a/examples/light-switch-app/efr32/BUILD.gn b/examples/light-switch-app/efr32/BUILD.gn
index 3118b7a6dadc18..2d628f537f9f6e 100644
--- a/examples/light-switch-app/efr32/BUILD.gn
+++ b/examples/light-switch-app/efr32/BUILD.gn
@@ -200,6 +200,7 @@ efr32_executable("light_switch_app") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/examples/light-switch-app/esp32/sdkconfig.defaults b/examples/light-switch-app/esp32/sdkconfig.defaults
index f8d119e98c2bec..4e780d862ad614 100644
--- a/examples/light-switch-app/esp32/sdkconfig.defaults
+++ b/examples/light-switch-app/esp32/sdkconfig.defaults
@@ -45,4 +45,7 @@ CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
 CONFIG_ESPTOOLPY_FLASHSIZE="4MB"
 
 #enable debug shell
-CONFIG_ENABLE_CHIP_SHELL=y
\ No newline at end of file
+CONFIG_ENABLE_CHIP_SHELL=y
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/light-switch-app/nrfconnect/CMakeLists.txt b/examples/light-switch-app/nrfconnect/CMakeLists.txt
index 865b8262749bb9..3a0084efa79c42 100644
--- a/examples/light-switch-app/nrfconnect/CMakeLists.txt
+++ b/examples/light-switch-app/nrfconnect/CMakeLists.txt
@@ -60,7 +60,7 @@ target_sources(app PRIVATE
                main/BindingHandler.cpp
                ${GEN_DIR}/light-switch-app/zap-generated/callback-stub.cpp
                ${GEN_DIR}/light-switch-app/zap-generated/IMClusterCommandHandler.cpp
-               ${NRFCONNECT_COMMON}/util/LEDWidget.cpp
+               ${NRFCONNECT_COMMON}/util/LEDWidget.cpp)
 
 
 if(CONFIG_CHIP_OTA_REQUESTOR)
diff --git a/examples/lighting-app/efr32/BUILD.gn b/examples/lighting-app/efr32/BUILD.gn
index 76430e8586e8d3..fbd5a88a7909b9 100644
--- a/examples/lighting-app/efr32/BUILD.gn
+++ b/examples/lighting-app/efr32/BUILD.gn
@@ -205,6 +205,7 @@ efr32_executable("lighting_app") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/examples/lighting-app/esp32/sdkconfig.defaults b/examples/lighting-app/esp32/sdkconfig.defaults
index 23a3766c340c04..e051a3f2b37aee 100644
--- a/examples/lighting-app/esp32/sdkconfig.defaults
+++ b/examples/lighting-app/esp32/sdkconfig.defaults
@@ -43,3 +43,6 @@ CONFIG_LWIP_HOOK_ND6_GET_GW_DEFAULT=y
 # Serial Flasher config
 CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
 CONFIG_ESPTOOLPY_FLASHSIZE="4MB"
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/lock-app/efr32/BUILD.gn b/examples/lock-app/efr32/BUILD.gn
index bb6530f56e5313..e76b9cd48f1d1e 100644
--- a/examples/lock-app/efr32/BUILD.gn
+++ b/examples/lock-app/efr32/BUILD.gn
@@ -202,6 +202,7 @@ efr32_executable("lock_app") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/examples/lock-app/esp32/sdkconfig.defaults b/examples/lock-app/esp32/sdkconfig.defaults
index c9b513d752fc6c..d53bfc85c76c22 100644
--- a/examples/lock-app/esp32/sdkconfig.defaults
+++ b/examples/lock-app/esp32/sdkconfig.defaults
@@ -43,3 +43,6 @@ CONFIG_LWIP_HOOK_ND6_GET_GW_DEFAULT=y
 
 #Lock app PID
 CONFIG_DEVICE_PRODUCT_ID=0x8006
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/ota-provider-app/esp32/sdkconfig.defaults b/examples/ota-provider-app/esp32/sdkconfig.defaults
index 537c6deab2897f..7fce894e5a80d8 100644
--- a/examples/ota-provider-app/esp32/sdkconfig.defaults
+++ b/examples/ota-provider-app/esp32/sdkconfig.defaults
@@ -58,3 +58,6 @@ CONFIG_USE_TEST_SETUP_DISCRIMINATOR=0xF01
 
 # Enable chip shell
 CONFIG_ENABLE_CHIP_SHELL=y
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/ota-requestor-app/esp32/sdkconfig.defaults b/examples/ota-requestor-app/esp32/sdkconfig.defaults
index beec4822b35cdf..17b6e378f65ca9 100644
--- a/examples/ota-requestor-app/esp32/sdkconfig.defaults
+++ b/examples/ota-requestor-app/esp32/sdkconfig.defaults
@@ -59,3 +59,6 @@ CONFIG_DEVICE_SOFTWARE_VERSION_NUMBER=2
 
 # Enable Chip Shell
 CONFIG_ENABLE_CHIP_SHELL=y
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/platform/efr32/init_efrPlatform.cpp b/examples/platform/efr32/init_efrPlatform.cpp
index a0e33702b40e68..36ee0018e8a814 100644
--- a/examples/platform/efr32/init_efrPlatform.cpp
+++ b/examples/platform/efr32/init_efrPlatform.cpp
@@ -68,7 +68,8 @@ void init_efrPlatform(void)
 #endif
 
 #if CHIP_ENABLE_OPENTHREAD
-    sl_ot_sys_init();
+    efr32RadioInit();
+    efr32AlarmInit();
 #endif // CHIP_ENABLE_OPENTHREAD
 }
 
diff --git a/examples/shell/shell_common/BUILD.gn b/examples/shell/shell_common/BUILD.gn
index d4b57df2f969ee..d601f0b54764b8 100644
--- a/examples/shell/shell_common/BUILD.gn
+++ b/examples/shell/shell_common/BUILD.gn
@@ -52,17 +52,10 @@ static_library("shell_common") {
 
   if (chip_enable_openthread &&
       (current_os == "freertos" || current_os == "zephyr")) {
-    if (chip_openthread_ftd) {
-      public_deps += [
-        "${chip_root}/third_party/openthread/repo:libopenthread-cli-ftd",
-        "${chip_root}/third_party/openthread/repo:libopenthread-ftd",
-      ]
-    } else {
-      public_deps += [
-        "${chip_root}/third_party/openthread/repo:libopenthread-cli-mtd",
-        "${chip_root}/third_party/openthread/repo:libopenthread-mtd",
-      ]
-    }
+    public_deps += [
+      "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread_cli",
+    ]
   }
 
   if (chip_shell_cmd_server) {
diff --git a/examples/temperature-measurement-app/esp32/sdkconfig.defaults b/examples/temperature-measurement-app/esp32/sdkconfig.defaults
index 4659af909a144f..dcd05c0734f36a 100644
--- a/examples/temperature-measurement-app/esp32/sdkconfig.defaults
+++ b/examples/temperature-measurement-app/esp32/sdkconfig.defaults
@@ -84,3 +84,6 @@ CONFIG_ESP_MAIN_TASK_STACK_SIZE=4096
 #enable lwIP route hooks
 CONFIG_LWIP_HOOK_IP6_ROUTE_DEFAULT=y
 CONFIG_LWIP_HOOK_ND6_GET_GW_DEFAULT=y
+
+# Disable softap support by default
+CONFIG_ESP_WIFI_SOFTAP_SUPPORT=n
diff --git a/examples/thermostat/efr32/BUILD.gn b/examples/thermostat/efr32/BUILD.gn
index fe2be76adf88a8..7e4e923992ff70 100644
--- a/examples/thermostat/efr32/BUILD.gn
+++ b/examples/thermostat/efr32/BUILD.gn
@@ -196,6 +196,7 @@ efr32_executable("thermostat_app") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/examples/window-app/efr32/BUILD.gn b/examples/window-app/efr32/BUILD.gn
index 7d2bfbec6dca1f..a9aa7cf402911c 100644
--- a/examples/window-app/efr32/BUILD.gn
+++ b/examples/window-app/efr32/BUILD.gn
@@ -188,6 +188,7 @@ efr32_executable("window_app") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/integrations/docker/images/chip-build-nrf-platform/Dockerfile b/integrations/docker/images/chip-build-nrf-platform/Dockerfile
index f27f0813c748b3..280534cac6c9fe 100644
--- a/integrations/docker/images/chip-build-nrf-platform/Dockerfile
+++ b/integrations/docker/images/chip-build-nrf-platform/Dockerfile
@@ -61,7 +61,7 @@ RUN set -x \
     && (apt-get remove -fy python3-yaml && apt-get autoremove || exit 0) \
     && python3 -m pip install -U --no-cache-dir cmake==3.22.5 \
     && python3 -m pip install --no-cache-dir -r /opt/NordicSemiconductor/nrfconnect/zephyr/scripts/requirements.txt \
-    && python3 -m pip install --no-cache-dir -r /opt/NordicSemiconductor/nrfconnect/nrf/scripts/requirements.txt \
+    && python3 -m pip install --no-cache-dir -r /opt/NordicSemiconductor/nrfconnect/nrf/scripts/requirements-build.txt \
     && python3 -m pip install --no-cache-dir -r /opt/NordicSemiconductor/nrfconnect/bootloader/mcuboot/scripts/requirements.txt \
     && : # last line
 
diff --git a/integrations/docker/images/chip-build/version b/integrations/docker/images/chip-build/version
index 49d7460faee434..b22b98316c9f22 100644
--- a/integrations/docker/images/chip-build/version
+++ b/integrations/docker/images/chip-build/version
@@ -1 +1 @@
-0.5.95 Version bump reason: add libnl-dev libs to chip-build image
+0.5.96 Version bump reason: add libnl-dev libs to chip-build image
diff --git a/scripts/requirements.esp32.txt b/scripts/requirements.esp32.txt
index c870b03a23cd56..4bf5479986c5a2 100644
--- a/scripts/requirements.esp32.txt
+++ b/scripts/requirements.esp32.txt
@@ -1,12 +1,12 @@
-click>=7.0
-future>=0.15.2
-pyparsing>=2.0.3,<2.4.0
-idf-component-manager>=0.2.99-beta
-gdbgui==0.13.2.0
-pygdbmi<=0.9.0.2
-reedsolo>=1.5.3,<=1.5.4
-bitstring>=3.1.6
-ecdsa>=0.16.0
-kconfiglib==13.7.1
-construct==2.10.54
-python-socketio<5
+click>=7.0 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+future>=0.15.2 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+pyparsing>=2.0.3,<2.4.0 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+idf-component-manager>=0.2.99-beta ; platform_machine != 'aarch64' and sys_platform == 'linux'
+gdbgui==0.13.2.0 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+pygdbmi<=0.9.0.2 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+reedsolo>=1.5.3,<=1.5.4 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+bitstring>=3.1.6 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+ecdsa>=0.16.0 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+kconfiglib==13.7.1 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+construct==2.10.54 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+python-socketio<5 ; platform_machine != 'aarch64' and sys_platform == 'linux'
diff --git a/src/app/clusters/ota-requestor/DefaultOTARequestor.cpp b/src/app/clusters/ota-requestor/DefaultOTARequestor.cpp
index f31bb2e0c5408a..f96b85ed9b4963 100644
--- a/src/app/clusters/ota-requestor/DefaultOTARequestor.cpp
+++ b/src/app/clusters/ota-requestor/DefaultOTARequestor.cpp
@@ -767,6 +767,7 @@ CHIP_ERROR DefaultOTARequestor::SendQueryImageRequest(Messaging::ExchangeManager
         args.location.SetValue(CharSpan("XX", strlen("XX")));
     }
 
+    args.metadataForProvider = mMetadataForProvider;
     Controller::OtaSoftwareUpdateProviderCluster cluster(exchangeMgr, sessionHandle, mProviderLocation.Value().endpoint);
 
     return cluster.InvokeCommand(args, this, OnQueryImageResponse, OnQueryImageFailure);
diff --git a/src/app/clusters/ota-requestor/DefaultOTARequestor.h b/src/app/clusters/ota-requestor/DefaultOTARequestor.h
index 9f9902858c3141..938f2be59f671a 100644
--- a/src/app/clusters/ota-requestor/DefaultOTARequestor.h
+++ b/src/app/clusters/ota-requestor/DefaultOTARequestor.h
@@ -92,6 +92,10 @@ class DefaultOTARequestor : public OTARequestorInterface, public BDXDownloader::
 
     void GetProviderLocation(Optional<ProviderLocationType> & providerLocation) override { providerLocation = mProviderLocation; }
 
+    // Set the metadata value for the provider to be used in the next query and OTA update process
+    // NOTE: Does not persist across reboot.
+    void SetMetadataForProvider(ByteSpan metadataForProvider) override { mMetadataForProvider.SetValue(metadataForProvider); }
+
     // Add a default OTA provider to the cached list
     CHIP_ERROR AddDefaultOtaProvider(const ProviderLocationType & providerLocation) override;
 
@@ -319,6 +323,7 @@ class DefaultOTARequestor : public OTARequestorInterface, public BDXDownloader::
     BDXDownloader * mBdxDownloader           = nullptr; // TODO: this should be OTADownloader
     BDXMessenger mBdxMessenger;                         // TODO: ideally this is held by the application
     uint8_t mUpdateTokenBuffer[kMaxUpdateTokenLen];
+    Optional<ByteSpan> mMetadataForProvider;
     ByteSpan mUpdateToken;
     uint32_t mCurrentVersion = 0;
     uint32_t mTargetVersion  = 0;
diff --git a/src/app/clusters/ota-requestor/OTARequestorInterface.h b/src/app/clusters/ota-requestor/OTARequestorInterface.h
index f24563d36c3c79..bd09f833971cc0 100644
--- a/src/app/clusters/ota-requestor/OTARequestorInterface.h
+++ b/src/app/clusters/ota-requestor/OTARequestorInterface.h
@@ -203,6 +203,9 @@ class OTARequestorInterface
     // Set the provider location to be used in the next query and OTA update process
     virtual void SetCurrentProviderLocation(ProviderLocationType providerLocation) = 0;
 
+    // Set the metadata value for the provider to be used in the next query and OTA update process
+    virtual void SetMetadataForProvider(chip::ByteSpan metadataForProvider) = 0;
+
     // If there is an OTA update in progress, returns the provider location for the current OTA update, otherwise, returns the
     // provider location that was last used
     virtual void GetProviderLocation(Optional<ProviderLocationType> & providerLocation) = 0;
diff --git a/src/crypto/CHIPCryptoPAL.cpp b/src/crypto/CHIPCryptoPAL.cpp
index ec2e415806c23b..859f5809e4b742 100644
--- a/src/crypto/CHIPCryptoPAL.cpp
+++ b/src/crypto/CHIPCryptoPAL.cpp
@@ -1092,5 +1092,28 @@ CHIP_ERROR GenerateCertificateSigningRequest(const P256Keypair * keypair, Mutabl
     return err;
 }
 
+CHIP_ERROR VerifyCertificateSigningRequestFormat(const uint8_t * csr, size_t csr_length)
+{
+    // Ensure we have enough size to validate header
+    VerifyOrReturnError((csr_length >= 16) && (csr_length <= kMAX_CSR_Length), CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+    Reader reader(csr, csr_length);
+
+    // Ensure we have an outermost SEQUENCE
+    uint8_t seq_header = 0;
+    ReturnErrorOnFailure(reader.Read8(&seq_header).StatusCode());
+    VerifyOrReturnError(seq_header == kSeqTag, CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+    uint8_t seq_length = 0;
+    VerifyOrReturnError(ReadDerLength(reader, seq_length) == CHIP_NO_ERROR, CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+    // Ensure that outer length matches sequence length + tag overhead, otherwise
+    // we have trailing garbage
+    size_t header_overhead = (seq_length <= 127) ? 2 : 3;
+    VerifyOrReturnError(csr_length == (seq_length + header_overhead), CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+    return CHIP_NO_ERROR;
+}
+
 } // namespace Crypto
 } // namespace chip
diff --git a/src/crypto/CHIPCryptoPAL.h b/src/crypto/CHIPCryptoPAL.h
index ea67c59a5765c1..544a554dcb31eb 100644
--- a/src/crypto/CHIPCryptoPAL.h
+++ b/src/crypto/CHIPCryptoPAL.h
@@ -640,8 +640,23 @@ CHIP_ERROR AES_CCM_decrypt(const uint8_t * ciphertext, size_t ciphertext_length,
  **/
 CHIP_ERROR GenerateCertificateSigningRequest(const P256Keypair * keypair, MutableByteSpan & csr_span);
 
+/**
+ * @brief Common code to validate ASN.1 format/size of a CSR, used by VerifyCertificateSigningRequest.
+ *
+ * Ensures it's not obviously malformed and doesn't have trailing garbage.
+ *
+ * @param csr CSR in DER format
+ * @param csr_length The length of the CSR buffer
+ * @return CHIP_ERROR_UNSUPPORTED_CERT_FORMAT on invalid format, CHIP_NO_ERROR otherwise.
+ */
+CHIP_ERROR VerifyCertificateSigningRequestFormat(const uint8_t * csr, size_t csr_length);
+
 /**
  * @brief Verify the Certificate Signing Request (CSR). If successfully verified, it outputs the public key from the CSR.
+ *
+ * The CSR is valid if the format is correct, the signature validates with the embedded public
+ * key, and there is no trailing garbage data.
+ *
  * @param csr CSR in DER format
  * @param csr_length The length of the CSR
  * @param pubkey The public key from the verified CSR
diff --git a/src/crypto/CHIPCryptoPALOpenSSL.cpp b/src/crypto/CHIPCryptoPALOpenSSL.cpp
index 761294d0cc84ee..d1211bccbc5da2 100644
--- a/src/crypto/CHIPCryptoPALOpenSSL.cpp
+++ b/src/crypto/CHIPCryptoPALOpenSSL.cpp
@@ -1254,6 +1254,8 @@ CHIP_ERROR P256Keypair::NewCertificateSigningRequest(uint8_t * out_csr, size_t &
 
 CHIP_ERROR VerifyCertificateSigningRequest(const uint8_t * csr, size_t csr_length, P256PublicKey & pubkey)
 {
+    ReturnErrorOnFailure(VerifyCertificateSigningRequestFormat(csr, csr_length));
+
     ERR_clear_error();
     CHIP_ERROR error = CHIP_NO_ERROR;
     int result       = 0;
diff --git a/src/crypto/CHIPCryptoPALTinyCrypt.cpp b/src/crypto/CHIPCryptoPALTinyCrypt.cpp
index ae166a294744fc..aa9df451cc692a 100644
--- a/src/crypto/CHIPCryptoPALTinyCrypt.cpp
+++ b/src/crypto/CHIPCryptoPALTinyCrypt.cpp
@@ -777,6 +777,8 @@ CHIP_ERROR P256Keypair::NewCertificateSigningRequest(uint8_t * out_csr, size_t &
 CHIP_ERROR VerifyCertificateSigningRequest(const uint8_t * csr_buf, size_t csr_length, P256PublicKey & pubkey)
 {
 #if defined(MBEDTLS_X509_CSR_PARSE_C)
+    ReturnErrorOnFailure(VerifyCertificateSigningRequestFormat(csr_buf, csr_length));
+
     // TODO: For some embedded targets, mbedTLS library doesn't have mbedtls_x509_csr_parse_der, and mbedtls_x509_csr_parse_free.
     //       Taking a step back, embedded targets likely will not process CSR requests. Adding this action item to reevaluate
     //       this if there's a need for this processing for embedded targets.
diff --git a/src/crypto/CHIPCryptoPALmbedTLS.cpp b/src/crypto/CHIPCryptoPALmbedTLS.cpp
index 9bce7e94430796..dfbd993f023d8d 100644
--- a/src/crypto/CHIPCryptoPALmbedTLS.cpp
+++ b/src/crypto/CHIPCryptoPALmbedTLS.cpp
@@ -889,6 +889,8 @@ CHIP_ERROR P256Keypair::NewCertificateSigningRequest(uint8_t * out_csr, size_t &
 CHIP_ERROR VerifyCertificateSigningRequest(const uint8_t * csr_buf, size_t csr_length, P256PublicKey & pubkey)
 {
 #if defined(MBEDTLS_X509_CSR_PARSE_C)
+    ReturnErrorOnFailure(VerifyCertificateSigningRequestFormat(csr_buf, csr_length));
+
     // TODO: For some embedded targets, mbedTLS library doesn't have mbedtls_x509_csr_parse_der, and mbedtls_x509_csr_parse_free.
     //       Taking a step back, embedded targets likely will not process CSR requests. Adding this action item to reevaluate
     //       this if there's a need for this processing for embedded targets.
diff --git a/src/crypto/tests/CHIPCryptoPALTest.cpp b/src/crypto/tests/CHIPCryptoPALTest.cpp
index 8c76468e6158ea..485ead2cf99322 100644
--- a/src/crypto/tests/CHIPCryptoPALTest.cpp
+++ b/src/crypto/tests/CHIPCryptoPALTest.cpp
@@ -1034,6 +1034,170 @@ static void TestP256_Keygen(nlTestSuite * inSuite, void * inContext)
     NL_TEST_ASSERT(inSuite, keypair.Pubkey().ECDSA_validate_msg_signature(test_msg, msglen, test_sig) == CHIP_NO_ERROR);
 }
 
+void TestCSR_Verify(nlTestSuite * inSuite, void * inContext)
+{
+    Crypto::P256PublicKey pubKey;
+    CHIP_ERROR err;
+
+    // First case: there is trailing garbage in the CSR
+    {
+        const uint8_t kBadTrailingGarbageCsr[255] = {
+            0x30, 0x81, 0xda, 0x30, 0x81, 0x81, 0x02, 0x01, 0x00, 0x30, 0x0e, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0b,
+            0x0c, 0x03, 0x43, 0x53, 0x41, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08,
+            0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x72, 0x48, 0xc0, 0x36, 0xf0, 0x12, 0x5f, 0xd1,
+            0x68, 0x92, 0x2d, 0xee, 0x57, 0x2b, 0x8e, 0x20, 0x9d, 0x97, 0xfa, 0x73, 0x92, 0xf1, 0xa0, 0x91, 0x0e, 0xfd, 0x04, 0x93,
+            0x66, 0x47, 0x3c, 0xa3, 0xf0, 0xa8, 0x47, 0xa1, 0xa3, 0x1e, 0x13, 0x3b, 0x67, 0x3b, 0x18, 0xca, 0x77, 0xd1, 0xea, 0xe3,
+            0x74, 0x93, 0x49, 0x8b, 0x9d, 0xdc, 0xef, 0xf9, 0xd5, 0x9b, 0x27, 0x19, 0xad, 0x6e, 0x90, 0xd2, 0xa0, 0x11, 0x30, 0x0f,
+            0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x0e, 0x31, 0x02, 0x30, 0x00, 0x30, 0x0a, 0x06, 0x08, 0x2a,
+            0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x6a, 0x2e, 0x15, 0x34, 0x1b, 0xde,
+            0xcb, 0x8f, 0xd2, 0xfd, 0x35, 0x03, 0x89, 0x0e, 0xed, 0x23, 0x54, 0xff, 0xcb, 0x79, 0xf9, 0xcb, 0x40, 0x33, 0x59, 0xb4,
+            0x27, 0x69, 0xeb, 0x07, 0x3b, 0xd5, 0x02, 0x21, 0x00, 0xb0, 0x25, 0xc9, 0xc2, 0x21, 0xe8, 0x54, 0xcc, 0x08, 0x12, 0xf5,
+            0x10, 0x3a, 0x0b, 0x25, 0x20, 0x0a, 0x61, 0x38, 0xc8, 0x6f, 0x82, 0xa7, 0x51, 0x84, 0x61, 0xae, 0x93, 0x69, 0xe4, 0x74,
+            0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+
+        Crypto::ClearSecretData(pubKey.Bytes(), pubKey.Length());
+
+        err = VerifyCertificateSigningRequest(&kBadTrailingGarbageCsr[0], sizeof(kBadTrailingGarbageCsr), pubKey);
+
+        // On first test case, check if CSRs are supported at all, and skip test if they are not.
+        if (err == CHIP_ERROR_UNSUPPORTED_CHIP_FEATURE)
+        {
+            ChipLogError(Crypto, "The current platform does not support CSR parsing.");
+            return;
+        }
+
+        NL_TEST_ASSERT(inSuite, err != CHIP_NO_ERROR);
+
+        err = VerifyCertificateSigningRequestFormat(&kBadTrailingGarbageCsr[0], sizeof(kBadTrailingGarbageCsr));
+        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+    }
+
+    // Second case: correct CSR
+    {
+        const uint8_t kGoodCsr[205] = {
+            0x30, 0x81, 0xca, 0x30, 0x70, 0x02, 0x01, 0x00, 0x30, 0x0e, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0a,
+            0x0c, 0x03, 0x43, 0x53, 0x52, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06,
+            0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xa3, 0xbe, 0xa1, 0xf5, 0x42, 0x01,
+            0x07, 0x3c, 0x4b, 0x75, 0x85, 0xd8, 0xe2, 0x98, 0xac, 0x2f, 0xf6, 0x98, 0xdb, 0xd9, 0x5b, 0xe0, 0x7e, 0xc1, 0x04,
+            0xd5, 0x73, 0xc5, 0xb0, 0x90, 0x77, 0x27, 0x00, 0x1e, 0x22, 0xc7, 0x89, 0x5e, 0x4d, 0x75, 0x07, 0x89, 0x82, 0x0f,
+            0x49, 0xb6, 0x59, 0xd5, 0xc5, 0x15, 0x7d, 0x93, 0xe6, 0x80, 0x5c, 0x70, 0x89, 0x0a, 0x43, 0x10, 0x3d, 0xeb, 0x3d,
+            0x4a, 0xa0, 0x00, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x05, 0x00, 0x03, 0x48,
+            0x00, 0x30, 0x45, 0x02, 0x20, 0x1d, 0x86, 0x21, 0xb4, 0xc2, 0xe1, 0xa9, 0xf3, 0xbc, 0xc8, 0x7c, 0xda, 0xb4, 0xb9,
+            0xc6, 0x8c, 0xd0, 0xe4, 0x9a, 0x9c, 0xef, 0x02, 0x93, 0x98, 0x27, 0x7e, 0x81, 0x21, 0x5d, 0x20, 0x9d, 0x32, 0x02,
+            0x21, 0x00, 0x8b, 0x6b, 0x49, 0xb6, 0x7d, 0x3e, 0x67, 0x9e, 0xb1, 0x22, 0xd3, 0x63, 0x82, 0x40, 0x4f, 0x49, 0xa4,
+            0xdc, 0x17, 0x35, 0xac, 0x4b, 0x7a, 0xbf, 0x52, 0x05, 0x58, 0x68, 0xe0, 0xaa, 0xd2, 0x8e,
+        };
+        const uint8_t kGoodCsrSubjectPublicKey[65] = {
+            0x04, 0xa3, 0xbe, 0xa1, 0xf5, 0x42, 0x01, 0x07, 0x3c, 0x4b, 0x75, 0x85, 0xd8, 0xe2, 0x98, 0xac, 0x2f,
+            0xf6, 0x98, 0xdb, 0xd9, 0x5b, 0xe0, 0x7e, 0xc1, 0x04, 0xd5, 0x73, 0xc5, 0xb0, 0x90, 0x77, 0x27, 0x00,
+            0x1e, 0x22, 0xc7, 0x89, 0x5e, 0x4d, 0x75, 0x07, 0x89, 0x82, 0x0f, 0x49, 0xb6, 0x59, 0xd5, 0xc5, 0x15,
+            0x7d, 0x93, 0xe6, 0x80, 0x5c, 0x70, 0x89, 0x0a, 0x43, 0x10, 0x3d, 0xeb, 0x3d, 0x4a,
+        };
+
+        Crypto::ClearSecretData(pubKey.Bytes(), pubKey.Length());
+
+        err = VerifyCertificateSigningRequestFormat(&kGoodCsr[0], sizeof(kGoodCsr));
+        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
+
+        err = VerifyCertificateSigningRequest(&kGoodCsr[0], sizeof(kGoodCsr), pubKey);
+        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
+
+        Crypto::P256PublicKey expected(kGoodCsrSubjectPublicKey);
+        NL_TEST_ASSERT(inSuite, pubKey.Matches(expected));
+    }
+
+    // Third case: bad signature
+    {
+        const uint8_t kBadSignatureSignatureCsr[205] = {
+            0x30, 0x81, 0xca, 0x30, 0x70, 0x02, 0x01, 0x00, 0x30, 0x0e, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0a,
+            0x0c, 0x03, 0x43, 0x53, 0x52, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06,
+            0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xa3, 0xbe, 0xa1, 0xf5, 0x42, 0x01,
+            0x07, 0x3c, 0x4b, 0x75, 0x85, 0xd8, 0xe2, 0x98, 0xac, 0x2f, 0xf6, 0x98, 0xdb, 0xd9, 0x5b, 0xe0, 0x7e, 0xc1, 0x04,
+            0xd5, 0x73, 0xc5, 0xb0, 0x90, 0x77, 0x27, 0x00, 0x1e, 0x22, 0xc7, 0x89, 0x5e, 0x4d, 0x75, 0x07, 0x89, 0x82, 0x0f,
+            0x49, 0xb6, 0x59, 0xd5, 0xc5, 0x15, 0x7d, 0x93, 0xe6, 0x80, 0x5c, 0x70, 0x89, 0x0a, 0x43, 0x10, 0x3d, 0xeb, 0x3d,
+            0x4a, 0xa0, 0x00, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x05, 0x00, 0x03, 0x48,
+            0x00, 0x30, 0x45, 0x02, 0x20, 0x1d, 0x86, 0x21, 0xb4, 0xc2, 0xe1, 0xa9, 0xf3, 0xbc, 0xc8, 0x7c, 0xda, 0xb4, 0xb9,
+            0xc6, 0x8c, 0xd0, 0xe4, 0x9a, 0x9c, 0xef, 0x02, 0x93, 0x98, 0x27, 0x7e, 0x81, 0x21, 0x5d, 0x20, 0x9d, 0x32, 0x02,
+            0x21, 0x00, 0x8b, 0x6b, 0x49, 0xb6, 0x7d, 0x3e, 0x67, 0x9e, 0xb1, 0x21, 0xd3, 0x63, 0x82, 0x40, 0x4f, 0x49, 0xa4,
+            0xdc, 0x17, 0x35, 0xac, 0x4b, 0x7a, 0xbf, 0x52, 0x05, 0x58, 0x68, 0xe0, 0xaa, 0xd2, 0x8e,
+        };
+
+        Crypto::ClearSecretData(pubKey.Bytes(), pubKey.Length());
+
+        err = VerifyCertificateSigningRequestFormat(&kBadSignatureSignatureCsr[0], sizeof(kBadSignatureSignatureCsr));
+        NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
+
+        err = VerifyCertificateSigningRequest(&kBadSignatureSignatureCsr[0], sizeof(kBadSignatureSignatureCsr), pubKey);
+        NL_TEST_ASSERT(inSuite, err != CHIP_NO_ERROR);
+    }
+
+    // Fourth case: CSR too big
+    {
+        const uint8_t kBadTooBigCsr[256] = {
+            0x30, 0x81, 0xda, 0x30, 0x81, 0x81, 0x02, 0x01, 0x00, 0x30, 0x0e, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0b,
+            0x0c, 0x03, 0x43, 0x53, 0x41, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08,
+            0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x72, 0x48, 0xc0, 0x36, 0xf0, 0x12, 0x5f, 0xd1,
+            0x68, 0x92, 0x2d, 0xee, 0x57, 0x2b, 0x8e, 0x20, 0x9d, 0x97, 0xfa, 0x73, 0x92, 0xf1, 0xa0, 0x91, 0x0e, 0xfd, 0x04, 0x93,
+            0x66, 0x47, 0x3c, 0xa3, 0xf0, 0xa8, 0x47, 0xa1, 0xa3, 0x1e, 0x13, 0x3b, 0x67, 0x3b, 0x18, 0xca, 0x77, 0xd1, 0xea, 0xe3,
+            0x74, 0x93, 0x49, 0x8b, 0x9d, 0xdc, 0xef, 0xf9, 0xd5, 0x9b, 0x27, 0x19, 0xad, 0x6e, 0x90, 0xd2, 0xa0, 0x11, 0x30, 0x0f,
+            0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x0e, 0x31, 0x02, 0x30, 0x00, 0x30, 0x0a, 0x06, 0x08, 0x2a,
+            0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x20, 0x6a, 0x2e, 0x15, 0x34, 0x1b, 0xde,
+            0xcb, 0x8f, 0xd2, 0xfd, 0x35, 0x03, 0x89, 0x0e, 0xed, 0x23, 0x54, 0xff, 0xcb, 0x79, 0xf9, 0xcb, 0x40, 0x33, 0x59, 0xb4,
+            0x27, 0x69, 0xeb, 0x07, 0x3b, 0xd5, 0x02, 0x21, 0x00, 0xb0, 0x25, 0xc9, 0xc2, 0x21, 0xe8, 0x54, 0xcc, 0x08, 0x12, 0xf5,
+            0x10, 0x3a, 0x0b, 0x25, 0x20, 0x0a, 0x61, 0x38, 0xc8, 0x6f, 0x82, 0xa7, 0x51, 0x84, 0x61, 0xae, 0x93, 0x69, 0xe4, 0x74,
+            0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
+        };
+
+        Crypto::ClearSecretData(pubKey.Bytes(), pubKey.Length());
+        err = VerifyCertificateSigningRequestFormat(&kBadTooBigCsr[0], sizeof(kBadTooBigCsr));
+        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+        err = VerifyCertificateSigningRequest(&kBadTooBigCsr[0], sizeof(kBadTooBigCsr), pubKey);
+        NL_TEST_ASSERT(inSuite, err != CHIP_NO_ERROR);
+    }
+
+    // Fifth case: obviously invalid CSR (1/2)
+    {
+        const uint8_t kTooSmallCsr[10] = { 0x30, 0x81, 0xda, 0x30, 0x81, 0x81, 0x02, 0x01, 0x00, 0x30 };
+
+        Crypto::ClearSecretData(pubKey.Bytes(), pubKey.Length());
+
+        err = VerifyCertificateSigningRequestFormat(&kTooSmallCsr[0], sizeof(kTooSmallCsr));
+        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+        err = VerifyCertificateSigningRequest(&kTooSmallCsr[0], sizeof(kTooSmallCsr), pubKey);
+        NL_TEST_ASSERT(inSuite, err != CHIP_NO_ERROR);
+    }
+
+    // Sixth case: obviously invalid CSR (2/2)
+    {
+        const uint8_t kNotSequenceCsr[205] = {
+            0x31, 0x81, 0xca, 0x30, 0x70, 0x02, 0x01, 0x00, 0x30, 0x0e, 0x31, 0x0c, 0x30, 0x0a, 0x06, 0x03, 0x55, 0x04, 0x0a,
+            0x0c, 0x03, 0x43, 0x53, 0x52, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06,
+            0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0xa3, 0xbe, 0xa1, 0xf5, 0x42, 0x01,
+            0x07, 0x3c, 0x4b, 0x75, 0x85, 0xd8, 0xe2, 0x98, 0xac, 0x2f, 0xf6, 0x98, 0xdb, 0xd9, 0x5b, 0xe0, 0x7e, 0xc1, 0x04,
+            0xd5, 0x73, 0xc5, 0xb0, 0x90, 0x77, 0x27, 0x00, 0x1e, 0x22, 0xc7, 0x89, 0x5e, 0x4d, 0x75, 0x07, 0x89, 0x82, 0x0f,
+            0x49, 0xb6, 0x59, 0xd5, 0xc5, 0x15, 0x7d, 0x93, 0xe6, 0x80, 0x5c, 0x70, 0x89, 0x0a, 0x43, 0x10, 0x3d, 0xeb, 0x3d,
+            0x4a, 0xa0, 0x00, 0x30, 0x0c, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x05, 0x00, 0x03, 0x48,
+            0x00, 0x30, 0x45, 0x02, 0x20, 0x1d, 0x86, 0x21, 0xb4, 0xc2, 0xe1, 0xa9, 0xf3, 0xbc, 0xc8, 0x7c, 0xda, 0xb4, 0xb9,
+            0xc6, 0x8c, 0xd0, 0xe4, 0x9a, 0x9c, 0xef, 0x02, 0x93, 0x98, 0x27, 0x7e, 0x81, 0x21, 0x5d, 0x20, 0x9d, 0x32, 0x02,
+            0x21, 0x00, 0x8b, 0x6b, 0x49, 0xb6, 0x7d, 0x3e, 0x67, 0x9e, 0xb1, 0x22, 0xd3, 0x63, 0x82, 0x40, 0x4f, 0x49, 0xa4,
+            0xdc, 0x17, 0x35, 0xac, 0x4b, 0x7a, 0xbf, 0x52, 0x05, 0x58, 0x68, 0xe0, 0xaa, 0xd2, 0x8e,
+        };
+
+        Crypto::ClearSecretData(pubKey.Bytes(), pubKey.Length());
+
+        err = VerifyCertificateSigningRequestFormat(&kNotSequenceCsr[0], sizeof(kNotSequenceCsr));
+        NL_TEST_ASSERT(inSuite, err == CHIP_ERROR_UNSUPPORTED_CERT_FORMAT);
+
+        err = VerifyCertificateSigningRequest(&kNotSequenceCsr[0], sizeof(kNotSequenceCsr), pubKey);
+        NL_TEST_ASSERT(inSuite, err != CHIP_NO_ERROR);
+    }
+}
+
 void TestCSR_GenDirect(nlTestSuite * inSuite, void * inContext)
 {
     uint8_t csrBuf[kMAX_CSR_Length];
@@ -2136,6 +2300,7 @@ static const nlTest sTests[] = {
     NL_TEST_DEF("Test adding entropy sources", TestAddEntropySources),
     NL_TEST_DEF("Test PBKDF2 SHA256", TestPBKDF2_SHA256_TestVectors),
     NL_TEST_DEF("Test P256 Keygen", TestP256_Keygen),
+    NL_TEST_DEF("Test CSR Verification + PK extraction", TestCSR_Verify),
     NL_TEST_DEF("Test CSR Generation via P256Keypair method", TestCSR_GenByKeypair),
     NL_TEST_DEF("Test Direct CSR Generation", TestCSR_GenDirect),
     NL_TEST_DEF("Test Keypair Serialize", TestKeypair_Serialize),
diff --git a/src/platform/EFR32/BUILD.gn b/src/platform/EFR32/BUILD.gn
index e406ce994eedee..1b5d6c45bbe3ba 100644
--- a/src/platform/EFR32/BUILD.gn
+++ b/src/platform/EFR32/BUILD.gn
@@ -100,7 +100,7 @@ static_library("EFR32") {
   if (chip_enable_openthread) {
     public_deps += [ "${chip_root}/third_party/openthread:openthread" ]
 
-    deps += [ "${chip_root}/third_party/silabs:openthread_cli" ]
+    deps += [ "${chip_root}/third_party/openthread:openthread_cli" ]
 
     sources += [
       "../OpenThread/OpenThreadUtils.cpp",
diff --git a/src/platform/EFR32/CHIPCryptoPALPsaEfr32.cpp b/src/platform/EFR32/CHIPCryptoPALPsaEfr32.cpp
index 6077681f19eb57..27289aeea069aa 100644
--- a/src/platform/EFR32/CHIPCryptoPALPsaEfr32.cpp
+++ b/src/platform/EFR32/CHIPCryptoPALPsaEfr32.cpp
@@ -894,12 +894,16 @@ P256Keypair::~P256Keypair()
 CHIP_ERROR P256Keypair::NewCertificateSigningRequest(uint8_t * out_csr, size_t & csr_length) const
 {
     MutableByteSpan csr(out_csr, csr_length);
-    return GenerateCertificateSigningRequest(this, csr);
+    CHIP_ERROR err = GenerateCertificateSigningRequest(this, csr);
+    csr_length     = (CHIP_NO_ERROR == err) ? csr.size() : 0;
+    return err;
 }
 
 CHIP_ERROR VerifyCertificateSigningRequest(const uint8_t * csr_buf, size_t csr_length, P256PublicKey & pubkey)
 {
 #if defined(MBEDTLS_X509_CSR_PARSE_C)
+    ReturnErrorOnFailure(VerifyCertificateSigningRequestFormat(csr_buf, csr_length));
+
     // TODO: For some embedded targets, mbedTLS library doesn't have mbedtls_x509_csr_parse_der, and mbedtls_x509_csr_parse_free.
     //       Taking a step back, embedded targets likely will not process CSR requests. Adding this action item to reevaluate
     //       this if there's a need for this processing for embedded targets.
diff --git a/src/platform/EFR32/CHIPPlatformConfig.h b/src/platform/EFR32/CHIPPlatformConfig.h
index decc6c59602779..cffeb4645ec29d 100644
--- a/src/platform/EFR32/CHIPPlatformConfig.h
+++ b/src/platform/EFR32/CHIPPlatformConfig.h
@@ -57,7 +57,7 @@
 #endif // CHIP_CONFIG_MAX_UNSOLICITED_MESSAGE_HANDLERS
 
 #ifndef CHIP_CONFIG_MAX_EXCHANGE_CONTEXTS
-#define CHIP_CONFIG_MAX_EXCHANGE_CONTEXTS 8
+#define CHIP_CONFIG_MAX_EXCHANGE_CONTEXTS 20
 #endif // CHIP_CONFIG_MAX_EXCHANGE_CONTEXTS
 
 #ifndef CHIP_LOG_FILTERING
diff --git a/src/platform/EFR32/ConfigurationManagerImpl.cpp b/src/platform/EFR32/ConfigurationManagerImpl.cpp
index 64a66be824f61a..0dd8170da5d3b5 100644
--- a/src/platform/EFR32/ConfigurationManagerImpl.cpp
+++ b/src/platform/EFR32/ConfigurationManagerImpl.cpp
@@ -97,7 +97,7 @@ CHIP_ERROR ConfigurationManagerImpl::IncreaseBootCount(void)
     return EFR32Config::WriteConfigValue(EFR32Config::kConfigKey_BootCount, bootCount + 1);
 }
 
-uint32_t ConfigurationManagerImpl::GetBootReason(void)
+CHIP_ERROR ConfigurationManagerImpl::GetBootReason(uint32_t & bootReason)
 {
     // rebootCause is obtained at bootup.
     BootReasonType matterBootCause;
@@ -150,7 +150,8 @@ uint32_t ConfigurationManagerImpl::GetBootReason(void)
     matterBootCause = BootReasonType::kUnspecified;
 #endif
 
-    return to_underlying(matterBootCause);
+    bootReason = to_underlying(matterBootCause);
+    return CHIP_NO_ERROR;
 }
 
 CHIP_ERROR ConfigurationManagerImpl::GetTotalOperationalHours(uint32_t & totalOperationalHours)
diff --git a/src/platform/EFR32/ConfigurationManagerImpl.h b/src/platform/EFR32/ConfigurationManagerImpl.h
index aaebd3ea65ac91..2f40d8d260a363 100644
--- a/src/platform/EFR32/ConfigurationManagerImpl.h
+++ b/src/platform/EFR32/ConfigurationManagerImpl.h
@@ -40,7 +40,7 @@ class ConfigurationManagerImpl : public Internal::GenericConfigurationManagerImp
     // This returns an instance of this class.
     static ConfigurationManagerImpl & GetDefaultInstance();
 
-    uint32_t GetBootReason(void);
+    CHIP_ERROR GetBootReason(uint32_t & bootReason);
     CHIP_ERROR GetRebootCount(uint32_t & rebootCount);
     CHIP_ERROR IncreaseBootCount(void);
     CHIP_ERROR GetTotalOperationalHours(uint32_t & totalOperationalHours);
diff --git a/src/platform/EFR32/DiagnosticDataProviderImpl.cpp b/src/platform/EFR32/DiagnosticDataProviderImpl.cpp
index a6d4833b65fe4b..31858125a0665b 100644
--- a/src/platform/EFR32/DiagnosticDataProviderImpl.cpp
+++ b/src/platform/EFR32/DiagnosticDataProviderImpl.cpp
@@ -264,7 +264,8 @@ CHIP_ERROR DiagnosticDataProviderImpl::GetNetworkInterfaces(NetworkInterface **
         ifp->name          = CharSpan::fromCharString(ifp->Name);
         ifp->isOperational = true;
         Inet::InterfaceType interfaceType;
-        if (interfaceIterator.GetInterfaceType(interfaceType) == CHIP_NO_ERROR)
+        CHIP_ERROR err = interfaceIterator.GetInterfaceType(interfaceType);
+        if (err == CHIP_NO_ERROR || err == CHIP_ERROR_NOT_IMPLEMENTED)
         {
             switch (interfaceType)
             {
@@ -283,6 +284,9 @@ CHIP_ERROR DiagnosticDataProviderImpl::GetNetworkInterfaces(NetworkInterface **
             case Inet::InterfaceType::Cellular:
                 ifp->type = EMBER_ZCL_INTERFACE_TYPE_CELLULAR;
                 break;
+            default:
+                ifp->type = EMBER_ZCL_INTERFACE_TYPE_WI_FI;
+                break;
             }
         }
         else
diff --git a/src/platform/EFR32/Efr32PsaOpaqueKeypair.cpp b/src/platform/EFR32/Efr32PsaOpaqueKeypair.cpp
index b1c32dc028471d..da72af848bab51 100644
--- a/src/platform/EFR32/Efr32PsaOpaqueKeypair.cpp
+++ b/src/platform/EFR32/Efr32PsaOpaqueKeypair.cpp
@@ -407,7 +407,9 @@ CHIP_ERROR EFR32OpaqueP256Keypair::Deserialize(P256SerializedKeypair & input)
 CHIP_ERROR EFR32OpaqueP256Keypair::NewCertificateSigningRequest(uint8_t * out_csr, size_t & csr_length) const
 {
     MutableByteSpan csr(out_csr, csr_length);
-    return GenerateCertificateSigningRequest(this, csr);
+    CHIP_ERROR err = GenerateCertificateSigningRequest(this, csr);
+    csr_length     = (CHIP_NO_ERROR == err) ? csr.size() : 0;
+    return err;
 }
 
 CHIP_ERROR EFR32OpaqueP256Keypair::ECDSA_sign_msg(const uint8_t * msg, size_t msg_length, P256ECDSASignature & out_signature) const
diff --git a/src/platform/EFR32/InetPlatformConfig.h b/src/platform/EFR32/InetPlatformConfig.h
index 3e8bb9a2f6d229..fe3304fa5d9915 100644
--- a/src/platform/EFR32/InetPlatformConfig.h
+++ b/src/platform/EFR32/InetPlatformConfig.h
@@ -49,5 +49,5 @@
 #endif // INET_CONFIG_NUM_TCP_ENDPOINTS
 
 #ifndef INET_CONFIG_NUM_UDP_ENDPOINTS
-#define INET_CONFIG_NUM_UDP_ENDPOINTS 6
+#define INET_CONFIG_NUM_UDP_ENDPOINTS 20
 #endif // INET_CONFIG_NUM_UDP_ENDPOINTS
diff --git a/src/platform/ESP32/CHIPDevicePlatformConfig.h b/src/platform/ESP32/CHIPDevicePlatformConfig.h
index 3bc56162c00350..c40cd8c565e11d 100644
--- a/src/platform/ESP32/CHIPDevicePlatformConfig.h
+++ b/src/platform/ESP32/CHIPDevicePlatformConfig.h
@@ -59,11 +59,13 @@
 #define CHIP_DEVICE_CONFIG_MAX_SCAN_NETWORKS_RESULTS CONFIG_MAX_SCAN_NETWORKS_RESULTS
 #define CHIP_DEVICE_CONFIG_WIFI_SCAN_COMPLETION_TIMEOUT CONFIG_WIFI_SCAN_COMPLETION_TIMEOUT
 #define CHIP_DEVICE_CONFIG_WIFI_CONNECTIVITY_TIMEOUT CONFIG_WIFI_CONNECTIVITY_TIMEOUT
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 #define CHIP_DEVICE_CONFIG_WIFI_AP_SSID_PREFIX CONFIG_WIFI_AP_SSID_PREFIX
 #define CHIP_DEVICE_CONFIG_WIFI_AP_CHANNEL CONFIG_WIFI_AP_CHANNEL
 #define CHIP_DEVICE_CONFIG_WIFI_AP_MAX_STATIONS CONFIG_WIFI_AP_MAX_STATIONS
 #define CHIP_DEVICE_CONFIG_WIFI_AP_BEACON_INTERVAL CONFIG_WIFI_AP_BEACON_INTERVAL
 #define CHIP_DEVICE_CONFIG_WIFI_AP_IDLE_TIMEOUT CONFIG_WIFI_AP_IDLE_TIMEOUT
+#endif /* CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP */
 #define CHIP_DEVICE_CONFIG_ENABLE_WIFI_TELEMETRY CONFIG_ENABLE_WIFI_TELEMETRY
 #define CHIP_DEVICE_CONFIG_ENABLE_WIFI CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP | CHIP_DEVICE_CONFIG_ENABLE_WIFI_STATION
 #endif // CONFIG_IDF_TARGET_ESP32H2
diff --git a/src/platform/ESP32/ConnectivityManagerImpl.h b/src/platform/ESP32/ConnectivityManagerImpl.h
index 3bdd1418c23564..9c7f7774317318 100644
--- a/src/platform/ESP32/ConnectivityManagerImpl.h
+++ b/src/platform/ESP32/ConnectivityManagerImpl.h
@@ -109,15 +109,6 @@ class ConnectivityManagerImpl final : public ConnectivityManager,
     CHIP_ERROR _SetWiFiStationReconnectInterval(System::Clock::Timeout val);
     bool _IsWiFiStationProvisioned(void);
     void _ClearWiFiStationProvision(void);
-    WiFiAPMode _GetWiFiAPMode(void);
-    CHIP_ERROR _SetWiFiAPMode(WiFiAPMode val);
-    bool _IsWiFiAPActive(void);
-    bool _IsWiFiAPApplicationControlled(void);
-    void _DemandStartWiFiAP(void);
-    void _StopOnDemandWiFiAP(void);
-    void _MaintainOnDemandWiFiAP(void);
-    System::Clock::Timeout _GetWiFiAPIdleTimeout(void);
-    void _SetWiFiAPIdleTimeout(System::Clock::Timeout val);
     CHIP_ERROR _GetAndLogWiFiStatsCounters(void);
     bool _CanStartWiFiScan();
     void _OnWiFiScanDone();
@@ -126,13 +117,9 @@ class ConnectivityManagerImpl final : public ConnectivityManager,
     // ===== Private members reserved for use by this class only.
 
     System::Clock::Timestamp mLastStationConnectFailTime;
-    System::Clock::Timestamp mLastAPDemandTime;
     WiFiStationMode mWiFiStationMode;
     WiFiStationState mWiFiStationState;
-    WiFiAPMode mWiFiAPMode;
-    WiFiAPState mWiFiAPState;
     System::Clock::Timeout mWiFiStationReconnectInterval;
-    System::Clock::Timeout mWiFiAPIdleTimeout;
     BitFlags<Flags> mFlags;
 
     CHIP_ERROR InitWiFi(void);
@@ -144,10 +131,27 @@ class ConnectivityManagerImpl final : public ConnectivityManager,
     void ChangeWiFiStationState(WiFiStationState newState);
     static void DriveStationState(::chip::System::Layer * aLayer, void * aAppState);
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
+    WiFiAPMode _GetWiFiAPMode(void);
+    CHIP_ERROR _SetWiFiAPMode(WiFiAPMode val);
+    bool _IsWiFiAPActive(void);
+    void _DemandStartWiFiAP(void);
+    void _StopOnDemandWiFiAP(void);
+    void _MaintainOnDemandWiFiAP(void);
+    System::Clock::Timeout _GetWiFiAPIdleTimeout(void);
+    void _SetWiFiAPIdleTimeout(System::Clock::Timeout val);
+    bool _IsWiFiAPApplicationControlled(void);
+
+    System::Clock::Timestamp mLastAPDemandTime;
+    WiFiAPMode mWiFiAPMode;
+    WiFiAPState mWiFiAPState;
+    System::Clock::Timeout mWiFiAPIdleTimeout;
+
     void DriveAPState(void);
     CHIP_ERROR ConfigureWiFiAP(void);
     void ChangeWiFiAPState(WiFiAPState newState);
     static void DriveAPState(::chip::System::Layer * aLayer, void * aAppState);
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
     void UpdateInternetConnectivityState(void);
     void OnStationIPv4AddressAvailable(const ip_event_got_ip_t & got_ip);
@@ -174,16 +178,12 @@ inline bool ConnectivityManagerImpl::_IsWiFiStationConnected(void)
     return mWiFiStationState == kWiFiStationState_Connected;
 }
 
-inline bool ConnectivityManagerImpl::_IsWiFiAPApplicationControlled(void)
-{
-    return mWiFiAPMode == kWiFiAPMode_ApplicationControlled;
-}
-
 inline System::Clock::Timeout ConnectivityManagerImpl::_GetWiFiStationReconnectInterval(void)
 {
     return mWiFiStationReconnectInterval;
 }
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 inline ConnectivityManager::WiFiAPMode ConnectivityManagerImpl::_GetWiFiAPMode(void)
 {
     return mWiFiAPMode;
@@ -199,6 +199,12 @@ inline System::Clock::Timeout ConnectivityManagerImpl::_GetWiFiAPIdleTimeout(voi
     return mWiFiAPIdleTimeout;
 }
 
+inline bool ConnectivityManagerImpl::_IsWiFiAPApplicationControlled(void)
+{
+    return mWiFiAPMode == kWiFiAPMode_ApplicationControlled;
+}
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
+
 inline bool ConnectivityManagerImpl::_CanStartWiFiScan()
 {
     return mWiFiStationState != kWiFiStationState_Connecting;
diff --git a/src/platform/ESP32/ConnectivityManagerImpl_WiFi.cpp b/src/platform/ESP32/ConnectivityManagerImpl_WiFi.cpp
index f00c92803908aa..2eb2e1b3ad11e0 100644
--- a/src/platform/ESP32/ConnectivityManagerImpl_WiFi.cpp
+++ b/src/platform/ESP32/ConnectivityManagerImpl_WiFi.cpp
@@ -110,10 +110,13 @@ void ConnectivityManagerImpl::_ClearWiFiStationProvision(void)
         esp_wifi_set_config(WIFI_IF_STA, &stationConfig);
 
         DeviceLayer::SystemLayer().ScheduleWork(DriveStationState, NULL);
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
         DeviceLayer::SystemLayer().ScheduleWork(DriveAPState, NULL);
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
     }
 }
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 CHIP_ERROR ConnectivityManagerImpl::_SetWiFiAPMode(WiFiAPMode val)
 {
     CHIP_ERROR err = CHIP_NO_ERROR;
@@ -167,6 +170,7 @@ void ConnectivityManagerImpl::_SetWiFiAPIdleTimeout(System::Clock::Timeout val)
     mWiFiAPIdleTimeout = val;
     DeviceLayer::SystemLayer().ScheduleWork(DriveAPState, NULL);
 }
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
 #define WIFI_BAND_2_4GHZ 2400
 #define WIFI_BAND_5_0GHZ 5000
@@ -382,13 +386,17 @@ CHIP_ERROR ConnectivityManagerImpl::_GetAndLogWiFiStatsCounters(void)
 CHIP_ERROR ConnectivityManagerImpl::InitWiFi()
 {
     mLastStationConnectFailTime   = System::Clock::kZero;
-    mLastAPDemandTime             = System::Clock::kZero;
     mWiFiStationMode              = kWiFiStationMode_Disabled;
     mWiFiStationState             = kWiFiStationState_NotConnected;
-    mWiFiAPMode                   = kWiFiAPMode_Disabled;
-    mWiFiAPState                  = kWiFiAPState_NotActive;
     mWiFiStationReconnectInterval = System::Clock::Milliseconds32(CHIP_DEVICE_CONFIG_WIFI_STATION_RECONNECT_INTERVAL);
-    mWiFiAPIdleTimeout            = System::Clock::Milliseconds32(CHIP_DEVICE_CONFIG_WIFI_AP_IDLE_TIMEOUT);
+
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
+    mLastAPDemandTime  = System::Clock::kZero;
+    mWiFiAPMode        = kWiFiAPMode_Disabled;
+    mWiFiAPState       = kWiFiAPState_NotActive;
+    mWiFiAPIdleTimeout = System::Clock::Milliseconds32(CHIP_DEVICE_CONFIG_WIFI_AP_IDLE_TIMEOUT);
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
+
     mFlags.SetRaw(0);
 
     // TODO Initialize the Chip Addressing and Routing Module.
@@ -435,7 +443,10 @@ CHIP_ERROR ConnectivityManagerImpl::InitWiFi()
 
     // Queue work items to bootstrap the AP and station state machines once the Chip event loop is running.
     ReturnErrorOnFailure(DeviceLayer::SystemLayer().ScheduleWork(DriveStationState, NULL));
+
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
     ReturnErrorOnFailure(DeviceLayer::SystemLayer().ScheduleWork(DriveAPState, NULL));
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
     return CHIP_NO_ERROR;
 }
@@ -478,6 +489,7 @@ void ConnectivityManagerImpl::OnWiFiPlatformEvent(const ChipDeviceEvent * event)
                 ChipLogProgress(DeviceLayer, "WIFI_EVENT_STA_STOP");
                 DriveStationState();
                 break;
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
             case WIFI_EVENT_AP_START:
                 ChipLogProgress(DeviceLayer, "WIFI_EVENT_AP_START");
                 ChangeWiFiAPState(kWiFiAPState_Active);
@@ -492,6 +504,7 @@ void ConnectivityManagerImpl::OnWiFiPlatformEvent(const ChipDeviceEvent * event)
                 ChipLogProgress(DeviceLayer, "WIFI_EVENT_AP_STACONNECTED");
                 MaintainOnDemandWiFiAP();
                 break;
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
             default:
                 break;
             }
@@ -769,6 +782,7 @@ void ConnectivityManagerImpl::DriveStationState(::chip::System::Layer * aLayer,
     sInstance.DriveStationState();
 }
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 void ConnectivityManagerImpl::DriveAPState()
 {
     CHIP_ERROR err = CHIP_NO_ERROR;
@@ -952,6 +966,7 @@ void ConnectivityManagerImpl::DriveAPState(::chip::System::Layer * aLayer, void
 {
     sInstance.DriveAPState();
 }
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
 void ConnectivityManagerImpl::UpdateInternetConnectivityState(void)
 {
diff --git a/src/platform/ESP32/ESP32Utils.cpp b/src/platform/ESP32/ESP32Utils.cpp
index 9391ee586e3eb6..e6dd3ea4df09c3 100644
--- a/src/platform/ESP32/ESP32Utils.cpp
+++ b/src/platform/ESP32/ESP32Utils.cpp
@@ -38,6 +38,7 @@
 using namespace ::chip::DeviceLayer::Internal;
 using chip::DeviceLayer::Internal::DeviceNetworkInfo;
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 CHIP_ERROR ESP32Utils::IsAPEnabled(bool & apEnabled)
 {
     wifi_mode_t curWiFiMode;
@@ -53,6 +54,7 @@ CHIP_ERROR ESP32Utils::IsAPEnabled(bool & apEnabled)
 
     return CHIP_NO_ERROR;
 }
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
 CHIP_ERROR ESP32Utils::IsStationEnabled(bool & staEnabled)
 {
@@ -130,6 +132,7 @@ CHIP_ERROR ESP32Utils::EnableStationMode(void)
         return ESP32Utils::MapError(err);
     }
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
     // If station mode is not already enabled (implying the current mode is WIFI_MODE_AP), change
     // the mode to WIFI_MODE_APSTA.
     if (curWiFiMode == WIFI_MODE_AP)
@@ -144,15 +147,19 @@ CHIP_ERROR ESP32Utils::EnableStationMode(void)
             return ESP32Utils::MapError(err);
         }
     }
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
     return CHIP_NO_ERROR;
 }
 
 CHIP_ERROR ESP32Utils::SetAPMode(bool enabled)
 {
-    wifi_mode_t curWiFiMode, targetWiFiMode;
+    wifi_mode_t curWiFiMode;
+    wifi_mode_t targetWiFiMode = WIFI_MODE_STA;
 
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
     targetWiFiMode = (enabled) ? WIFI_MODE_APSTA : WIFI_MODE_STA;
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
 
     // Get the current ESP WiFI mode.
     esp_err_t err = esp_wifi_get_mode(&curWiFiMode);
diff --git a/src/platform/ESP32/ESP32Utils.h b/src/platform/ESP32/ESP32Utils.h
index 94a98e0f8b281e..716b85e8434d3a 100644
--- a/src/platform/ESP32/ESP32Utils.h
+++ b/src/platform/ESP32/ESP32Utils.h
@@ -29,7 +29,9 @@ namespace Internal {
 class ESP32Utils
 {
 public:
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
     static CHIP_ERROR IsAPEnabled(bool & apEnabled);
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
     static CHIP_ERROR IsStationEnabled(bool & staEnabled);
     static bool IsStationProvisioned(void);
     static CHIP_ERROR IsStationConnected(bool & connected);
diff --git a/src/platform/ESP32/PlatformManagerImpl.cpp b/src/platform/ESP32/PlatformManagerImpl.cpp
index c96caeb03934ef..d2254692924cca 100644
--- a/src/platform/ESP32/PlatformManagerImpl.cpp
+++ b/src/platform/ESP32/PlatformManagerImpl.cpp
@@ -84,8 +84,9 @@ CHIP_ERROR PlatformManagerImpl::_InitChipStack(void)
         wifi_init_config_t cfg;
         uint8_t ap_mac[6];
         wifi_mode_t mode;
-
+#if CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
         esp_netif_create_default_wifi_ap();
+#endif // CHIP_DEVICE_CONFIG_ENABLE_WIFI_AP
         esp_netif_create_default_wifi_sta();
 
         esp_event_handler_register(WIFI_EVENT, ESP_EVENT_ANY_ID, PlatformManagerImpl::HandleESPSystemEvent, NULL);
diff --git a/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.cpp b/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.cpp
index 00e7a063614bb9..e61edab6ebfd18 100644
--- a/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.cpp
+++ b/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.cpp
@@ -44,15 +44,14 @@ CHIP_ERROR KeyValueStoreManagerImpl::Init(void)
 
     for (uint8_t configID = 0; configID < mMaxEntryCount; configID++)
     {
-        char key[CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH];
-        memset(key, 0, sizeof(key));
-        size_t keyLength;
-        err = CYW30739Config::ReadConfigValueStr(CYW30739ConfigKey(Config::kChipKvsKey_KeyBase, configID), key, sizeof(key),
-                                                 keyLength);
+        KeyStorage keyStorage;
+        size_t keyStorageLength;
+        err = CYW30739Config::ReadConfigValueBin(CYW30739ConfigKey(Config::kChipKvsKey_KeyBase, configID), &keyStorage,
+                                                 sizeof(keyStorage), keyStorageLength);
         if (err != CHIP_NO_ERROR)
             continue;
 
-        KeyConfigIdEntry * entry = Platform::New<KeyConfigIdEntry>(configID, key, keyLength);
+        KeyConfigIdEntry * entry = Platform::New<KeyConfigIdEntry>(configID, keyStorage);
         VerifyOrExit(entry != nullptr, err = CHIP_ERROR_NO_MEMORY);
 
         slist_add_tail(entry, &mKeyConfigIdList);
@@ -75,14 +74,24 @@ CHIP_ERROR KeyValueStoreManagerImpl::_Get(const char * key, void * value, size_t
 
     VerifyOrReturnError(offset_bytes == 0, CHIP_ERROR_NOT_IMPLEMENTED);
 
-    const size_t keyLength = strnlen(key, CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH);
-    VerifyOrExit(keyLength != 0 && keyLength <= CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH &&
+    const size_t keyLength = strnlen(key, PersistentStorageDelegate::kKeyLengthMax);
+    VerifyOrExit(keyLength != 0 && keyLength <= PersistentStorageDelegate::kKeyLengthMax &&
                      value_size <= kMaxPersistedValueLengthSupported,
                  err = CHIP_ERROR_INVALID_ARGUMENT);
 
     entry = FindEntry(key);
     VerifyOrExit(entry != nullptr, err = CHIP_ERROR_PERSISTED_STORAGE_VALUE_NOT_FOUND);
-    VerifyOrExit(value_size != 0, err = CHIP_ERROR_BUFFER_TOO_SMALL);
+
+    if (value_size == 0 || entry->GetValueSize() == 0)
+    {
+        if (read_bytes_size != nullptr)
+            *read_bytes_size = 0;
+
+        if (value_size >= entry->GetValueSize())
+            ExitNow(err = CHIP_NO_ERROR);
+        else
+            ExitNow(err = CHIP_ERROR_BUFFER_TOO_SMALL);
+    }
 
     size_t byte_count;
     err = CYW30739Config::ReadConfigValueBin(entry->GetValueConfigKey(), value, value_size, byte_count);
@@ -94,6 +103,8 @@ CHIP_ERROR KeyValueStoreManagerImpl::_Get(const char * key, void * value, size_t
         *read_bytes_size = byte_count;
     }
 
+    VerifyOrExit(value_size >= entry->GetValueSize(), err = CHIP_ERROR_BUFFER_TOO_SMALL);
+
 exit:
     return err;
 }
@@ -101,10 +112,10 @@ CHIP_ERROR KeyValueStoreManagerImpl::_Get(const char * key, void * value, size_t
 CHIP_ERROR KeyValueStoreManagerImpl::_Put(const char * key, const void * value, size_t value_size)
 {
     CHIP_ERROR err = CHIP_NO_ERROR;
-    const KeyConfigIdEntry * entry;
+    KeyConfigIdEntry * entry;
 
-    const size_t keyLength = strnlen(key, CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH + 1);
-    VerifyOrExit(keyLength != 0 && keyLength <= CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH &&
+    const size_t keyLength = strnlen(key, PersistentStorageDelegate::kKeyLengthMax + 1);
+    VerifyOrExit(keyLength != 0 && keyLength <= PersistentStorageDelegate::kKeyLengthMax &&
                      value_size <= kMaxPersistedValueLengthSupported,
                  err = CHIP_ERROR_INVALID_ARGUMENT);
 
@@ -112,9 +123,13 @@ CHIP_ERROR KeyValueStoreManagerImpl::_Put(const char * key, const void * value,
     VerifyOrExit(entry != nullptr, ChipLogError(DeviceLayer, "%s AllocateEntry %s", __func__, ErrorStr(err));
                  err = CHIP_ERROR_NO_MEMORY);
 
-    SuccessOrExit(err = CYW30739Config::WriteConfigValueBin(entry->GetValueConfigKey(), value, value_size));
+    if (value_size != 0)
+    {
+        SuccessOrExit(err = CYW30739Config::WriteConfigValueBin(entry->GetValueConfigKey(), value, value_size));
+    }
 
-    SuccessOrExit(err = CYW30739Config::WriteConfigValueStr(entry->GetKeyConfigKey(), key, keyLength));
+    entry->SetValueSize(value_size);
+    SuccessOrExit(err = CYW30739Config::WriteConfigValueBin(entry->GetKeyConfigKey(), &entry->mStorage, sizeof(entry->mStorage)));
 
 exit:
     return err;
@@ -125,8 +140,8 @@ CHIP_ERROR KeyValueStoreManagerImpl::_Delete(const char * key)
     CHIP_ERROR err;
     KeyConfigIdEntry * entry;
 
-    const size_t keyLength = strnlen(key, CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH);
-    VerifyOrExit(keyLength != 0 && keyLength <= CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH, err = CHIP_ERROR_INVALID_ARGUMENT);
+    const size_t keyLength = strnlen(key, PersistentStorageDelegate::kKeyLengthMax);
+    VerifyOrExit(keyLength != 0 && keyLength <= PersistentStorageDelegate::kKeyLengthMax, err = CHIP_ERROR_INVALID_ARGUMENT);
 
     entry = FindEntry(key);
     VerifyOrExit(entry != nullptr, err = CHIP_ERROR_PERSISTED_STORAGE_VALUE_NOT_FOUND);
@@ -156,14 +171,13 @@ CHIP_ERROR KeyValueStoreManagerImpl::EraseAll(void)
     return CHIP_NO_ERROR;
 }
 
-KeyValueStoreManagerImpl::KeyConfigIdEntry::KeyConfigIdEntry(uint8_t configID, const char * key, size_t keyLength) :
-    mConfigID(configID)
+KeyValueStoreManagerImpl::KeyStorage::KeyStorage(const char * key, size_t keyLength) : mValueSize(0)
 {
     memset(mKey, 0, sizeof(mKey));
     memcpy(mKey, key, keyLength);
 }
 
-bool KeyValueStoreManagerImpl::KeyConfigIdEntry::IsMatchKey(const char * key) const
+bool KeyValueStoreManagerImpl::KeyStorage::IsMatchKey(const char * key) const
 {
     return strncmp(mKey, key, sizeof(mKey)) == 0;
 }
@@ -175,7 +189,7 @@ KeyValueStoreManagerImpl::KeyConfigIdEntry * KeyValueStoreManagerImpl::AllocateE
     ReturnErrorCodeIf(newEntry != nullptr, newEntry);
     ReturnErrorCodeIf(!freeConfigID.HasValue(), nullptr);
 
-    newEntry = Platform::New<KeyConfigIdEntry>(freeConfigID.Value(), key, keyLength);
+    newEntry = Platform::New<KeyConfigIdEntry>(freeConfigID.Value(), KeyStorage(key, keyLength));
     ReturnErrorCodeIf(newEntry == nullptr, nullptr);
 
     KeyConfigIdEntry * entry = static_cast<KeyConfigIdEntry *>(slist_tail(&mKeyConfigIdList));
@@ -220,7 +234,7 @@ KeyValueStoreManagerImpl::KeyConfigIdEntry * KeyValueStoreManagerImpl::FindEntry
     {
         entry = entry->Next();
 
-        if (entry->IsMatchKey(key))
+        if (entry->mStorage.IsMatchKey(key))
             return entry;
 
         if (freeConfigID != nullptr && !freeConfigID->HasValue() && entry != slist_tail(&mKeyConfigIdList))
diff --git a/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.h b/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.h
index a719bc6c2af7ac..5938bd28a56c98 100644
--- a/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.h
+++ b/src/platform/Infineon/CYW30739/KeyValueStoreManagerImpl.h
@@ -23,6 +23,7 @@
 
 #pragma once
 
+#include <lib/core/CHIPPersistentStorageDelegate.h>
 #include <platform/CHIPDeviceLayer.h>
 #include <slist.h>
 
@@ -56,11 +57,20 @@ class KeyValueStoreManagerImpl final : public KeyValueStoreManager
 
     static constexpr uint8_t mMaxEntryCount = 128;
 
-    struct KeyConfigIdEntry : public slist_node_t
+    struct KeyStorage
     {
-        KeyConfigIdEntry(uint8_t configID, const char * key, size_t keyLength);
+        KeyStorage(const char * key = nullptr, size_t keyLength = 0);
 
         bool IsMatchKey(const char * key) const;
+
+        size_t mValueSize;
+        char mKey[PersistentStorageDelegate::kKeyLengthMax];
+    };
+
+    struct KeyConfigIdEntry : public slist_node_t
+    {
+        KeyConfigIdEntry(uint8_t configID, const KeyStorage & keyStorage) : mConfigID(configID), mStorage(keyStorage) {}
+
         constexpr Config::Key GetValueConfigKey() const
         {
             return Internal::CYW30739ConfigKey(Config::kChipKvsValue_KeyBase, mConfigID);
@@ -71,9 +81,11 @@ class KeyValueStoreManagerImpl final : public KeyValueStoreManager
         }
         constexpr KeyConfigIdEntry * Next() const { return static_cast<KeyConfigIdEntry *>(next); }
         constexpr uint8_t NextConfigID() const { return mConfigID + 1; }
+        constexpr size_t GetValueSize() const { return mStorage.mValueSize; }
+        constexpr void SetValueSize(size_t valueSize) { mStorage.mValueSize = valueSize; }
 
         uint8_t mConfigID;
-        char mKey[CHIP_CONFIG_PERSISTED_STORAGE_MAX_KEY_LENGTH];
+        KeyStorage mStorage;
     };
 
     KeyConfigIdEntry * AllocateEntry(const char * key, size_t keyLength);
diff --git a/src/test_driver/efr32/BUILD.gn b/src/test_driver/efr32/BUILD.gn
index 45e4aff6fe40a7..1d6f87637a99db 100644
--- a/src/test_driver/efr32/BUILD.gn
+++ b/src/test_driver/efr32/BUILD.gn
@@ -96,6 +96,7 @@ efr32_executable("efr32_device_tests") {
   if (chip_enable_openthread) {
     deps += [
       "${chip_root}/third_party/openthread:openthread",
+      "${chip_root}/third_party/openthread:openthread-platform",
       "${examples_plat_dir}:efr-matter-shell",
     ]
   }
diff --git a/third_party/openthread/BUILD.gn b/third_party/openthread/BUILD.gn
index 752f245738a750..7a183e681867dc 100644
--- a/third_party/openthread/BUILD.gn
+++ b/third_party/openthread/BUILD.gn
@@ -8,7 +8,7 @@ declare_args() {
   chip_openthread_target = ""
 }
 
-group("openthread") {
+group("openthread-platform") {
   if (chip_openthread_target != "") {
     public_deps = [ chip_openthread_target ]
   } else {
@@ -16,10 +16,27 @@ group("openthread") {
       "${chip_root}/third_party/openthread/platforms:libopenthread-platform",
       "${chip_root}/third_party/openthread/platforms:libopenthread-platform-utils",
     ]
+  }
+}
+
+group("openthread") {
+  if (chip_openthread_target != "") {
+    public_deps = [ chip_openthread_target ]
+  } else {
+    if (chip_openthread_ftd) {
+      public_deps = [ "${openthread_root}:libopenthread-ftd" ]
+    } else {
+      public_deps = [ "${openthread_root}:libopenthread-mtd" ]
+    }
+  }
+}
+
+group("openthread_cli") {
+  if (chip_openthread_target == "") {
     if (chip_openthread_ftd) {
-      public_deps += [ "${openthread_root}:libopenthread-ftd" ]
+      public_deps = [ "${openthread_root}:libopenthread-cli-ftd" ]
     } else {
-      public_deps += [ "${openthread_root}:libopenthread-mtd" ]
+      public_deps = [ "${openthread_root}:libopenthread-cli-mtd" ]
     }
   }
 }
diff --git a/third_party/openthread/ot-efr32 b/third_party/openthread/ot-efr32
index fd77faf7a3443f..1e10a32228c96f 160000
--- a/third_party/openthread/ot-efr32
+++ b/third_party/openthread/ot-efr32
@@ -1 +1 @@
-Subproject commit fd77faf7a3443f7941dfd9e9713aea09eb08e9b9
+Subproject commit 1e10a32228c96f273603612ef7d5ce693ecdf887
diff --git a/third_party/silabs/BUILD.gn b/third_party/silabs/BUILD.gn
index c4f96d18d339f5..7e885642cdd6f2 100644
--- a/third_party/silabs/BUILD.gn
+++ b/third_party/silabs/BUILD.gn
@@ -31,18 +31,6 @@ group("efr32_sdk") {
   public_deps = [ efr32_sdk_target ]
 }
 
-if (chip_enable_openthread) {
-  group("openthread_cli") {
-    if (!use_silabs_thread_lib) {
-      if (chip_openthread_ftd) {
-        public_deps = [ "${sl_openthread_root}:libopenthread-cli-ftd" ]
-      } else {
-        public_deps = [ "${sl_openthread_root}:libopenthread-cli-mtd" ]
-      }
-    }
-  }
-}
-
 if (use_silabs_thread_lib) {
   config("libopenthread-platform_config") {
     include_dirs = [ "${sl_openthread_root}/examples/platforms" ]
@@ -74,7 +62,6 @@ if (use_silabs_thread_lib) {
       "RADIO_CONFIG_DMP_SUPPORT=1",
       "${efr32_board}=1",
       "${efr32_mcu}",
-      "USE_SL_THREAD_CERT_LIB",
       "OPENTHREAD_CORE_CONFIG_PLATFORM_CHECK_FILE=\"openthread-core-efr32-config-check.h\"",
     ]
 
@@ -88,7 +75,6 @@ if (use_silabs_thread_lib) {
 
   source_set("openthread_core_config_efr32") {
     sources = [
-      "${sl_openthread_root}/src/cli/cli_config.h",
       "${sl_ot_efr32_root}/src/src/openthread-core-efr32-config-check.h",
       "${sl_ot_efr32_root}/src/src/openthread-core-efr32-config.h",
     ]
@@ -102,37 +88,39 @@ if (use_silabs_thread_lib) {
   }
 
   source_set("ot-efr32-cert") {
-    sources = [
-      "${sl_openthread_root}/examples/apps/cli/cli_uart.cpp",
-      "${sl_openthread_root}/src/cli/cli.cpp",
-      "${sl_openthread_root}/src/cli/cli.hpp",
-      "${sl_openthread_root}/src/cli/cli_coap.cpp",
-      "${sl_openthread_root}/src/cli/cli_coap.hpp",
-      "${sl_openthread_root}/src/cli/cli_coap_secure.cpp",
-      "${sl_openthread_root}/src/cli/cli_coap_secure.hpp",
-      "${sl_openthread_root}/src/cli/cli_commissioner.cpp",
-      "${sl_openthread_root}/src/cli/cli_commissioner.hpp",
-      "${sl_openthread_root}/src/cli/cli_config.h",
-      "${sl_openthread_root}/src/cli/cli_dataset.cpp",
-      "${sl_openthread_root}/src/cli/cli_dataset.hpp",
-      "${sl_openthread_root}/src/cli/cli_history.cpp",
-      "${sl_openthread_root}/src/cli/cli_history.hpp",
-      "${sl_openthread_root}/src/cli/cli_joiner.cpp",
-      "${sl_openthread_root}/src/cli/cli_joiner.hpp",
-      "${sl_openthread_root}/src/cli/cli_network_data.cpp",
-      "${sl_openthread_root}/src/cli/cli_network_data.hpp",
-      "${sl_openthread_root}/src/cli/cli_output.cpp",
-      "${sl_openthread_root}/src/cli/cli_output.hpp",
-      "${sl_openthread_root}/src/cli/cli_srp_client.cpp",
-      "${sl_openthread_root}/src/cli/cli_srp_client.hpp",
-      "${sl_openthread_root}/src/cli/cli_srp_server.cpp",
-      "${sl_openthread_root}/src/cli/cli_srp_server.hpp",
-      "${sl_openthread_root}/src/cli/cli_tcp.cpp",
-      "${sl_openthread_root}/src/cli/cli_tcp.hpp",
-      "${sl_openthread_root}/src/cli/cli_udp.cpp",
-      "${sl_openthread_root}/src/cli/cli_udp.hpp",
-      "${sl_openthread_root}/src/cli/x509_cert_key.hpp",
-    ]
+    if (enable_openthread_cli) {
+      sources = [
+        "${sl_openthread_root}/examples/apps/cli/cli_uart.cpp",
+        "${sl_openthread_root}/src/cli/cli.cpp",
+        "${sl_openthread_root}/src/cli/cli.hpp",
+        "${sl_openthread_root}/src/cli/cli_coap.cpp",
+        "${sl_openthread_root}/src/cli/cli_coap.hpp",
+        "${sl_openthread_root}/src/cli/cli_coap_secure.cpp",
+        "${sl_openthread_root}/src/cli/cli_coap_secure.hpp",
+        "${sl_openthread_root}/src/cli/cli_commissioner.cpp",
+        "${sl_openthread_root}/src/cli/cli_commissioner.hpp",
+        "${sl_openthread_root}/src/cli/cli_config.h",
+        "${sl_openthread_root}/src/cli/cli_dataset.cpp",
+        "${sl_openthread_root}/src/cli/cli_dataset.hpp",
+        "${sl_openthread_root}/src/cli/cli_history.cpp",
+        "${sl_openthread_root}/src/cli/cli_history.hpp",
+        "${sl_openthread_root}/src/cli/cli_joiner.cpp",
+        "${sl_openthread_root}/src/cli/cli_joiner.hpp",
+        "${sl_openthread_root}/src/cli/cli_network_data.cpp",
+        "${sl_openthread_root}/src/cli/cli_network_data.hpp",
+        "${sl_openthread_root}/src/cli/cli_output.cpp",
+        "${sl_openthread_root}/src/cli/cli_output.hpp",
+        "${sl_openthread_root}/src/cli/cli_srp_client.cpp",
+        "${sl_openthread_root}/src/cli/cli_srp_client.hpp",
+        "${sl_openthread_root}/src/cli/cli_srp_server.cpp",
+        "${sl_openthread_root}/src/cli/cli_srp_server.hpp",
+        "${sl_openthread_root}/src/cli/cli_tcp.cpp",
+        "${sl_openthread_root}/src/cli/cli_tcp.hpp",
+        "${sl_openthread_root}/src/cli/cli_udp.cpp",
+        "${sl_openthread_root}/src/cli/cli_udp.hpp",
+        "${sl_openthread_root}/src/cli/x509_cert_key.hpp",
+      ]
+    }
 
     public_configs = [
       ":openthread_efr32_config",
@@ -143,7 +131,7 @@ if (use_silabs_thread_lib) {
       ":libopenthread-platform",
       ":openthread_core_config_efr32",
       "${segger_rtt_root}:segger_rtt",
-      "${sl_openthread_root}/include/openthread:openthread",
+      "${sl_openthread_root}/include/openthread:openthread-platform",
       "${sl_openthread_root}/src/core/:libopenthread_core_headers",
     ]