diff --git a/components/openthread/lib b/components/openthread/lib
index 656dc95b36..28a452bc4d 160000
--- a/components/openthread/lib
+++ b/components/openthread/lib
@@ -1 +1 @@
-Subproject commit 656dc95b36de89a5164667e675f9a8121399bde6
+Subproject commit 28a452bc4d613354761a4a5912769798f070af75
diff --git a/components/openthread/openthread b/components/openthread/openthread
index 03933d9b76..9b887f6bd1 160000
--- a/components/openthread/openthread
+++ b/components/openthread/openthread
@@ -1 +1 @@
-Subproject commit 03933d9b76cb7075cc29a6648b42b217971f82a5
+Subproject commit 9b887f6bd1437170fc9bcb726f32185ccb3cb841
diff --git a/components/openthread/private_include/openthread-core-esp32x-ftd-config.h b/components/openthread/private_include/openthread-core-esp32x-ftd-config.h
index 655d27d940..2c9b84e818 100644
--- a/components/openthread/private_include/openthread-core-esp32x-ftd-config.h
+++ b/components/openthread/private_include/openthread-core-esp32x-ftd-config.h
@@ -899,7 +899,7 @@
 #endif
 
 /**
- * @OPENTHREAD_CONFIG_DELAY_AWARE_QUEUE_MANAGEMENT_MARK_ECN_INTERVAL
+ * @def OPENTHREAD_CONFIG_DELAY_AWARE_QUEUE_MANAGEMENT_MARK_ECN_INTERVAL
  *
  * Specifies the time-in-queue threshold interval in milliseconds to mark ECN on a message if it is ECN-capable or
  * drop the message if not ECN-capable.
@@ -908,10 +908,34 @@
 #define OPENTHREAD_CONFIG_DELAY_AWARE_QUEUE_MANAGEMENT_MARK_ECN_INTERVAL 1000
 #endif
 
+/**
+ * @def OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE
+ *
+ * Define to 1 if you want to make MAC keys exportable.
+ */
+#define OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE 1
+
+/**
+ * @def OPENTHREAD_CONFIG_CRYPTO_LIB
+ *
+ * Selects the crypto backend library for OpenThread.
+ *
+ * There are several options available
+ * - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
+ * - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
+ * - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
+ */
+#define OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
+// TODO: Remove when https://github.com/openthread/openthread/pull/12638 is merged
+#define OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE 1
+
+/**
+ * @def OPENTHREAD_CONFIG_MESHCOP_STEERING_DATA_API_ENABLE
+ *
+ * Define as 1 to enable the MeshCoP Steering Data public APIs (in `openthread/steering_data.h`).
+ */
+#define OPENTHREAD_CONFIG_MESHCOP_STEERING_DATA_API_ENABLE 1
+
 #ifndef OPENTHREAD_CONFIG_THREAD_VERSION
 #define OPENTHREAD_CONFIG_THREAD_VERSION OT_THREAD_VERSION_1_4
 #endif
-
-#define OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE 1
-
-#define OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
diff --git a/components/openthread/private_include/openthread-core-esp32x-mtd-config.h b/components/openthread/private_include/openthread-core-esp32x-mtd-config.h
index 650b0a9732..e3279f4314 100644
--- a/components/openthread/private_include/openthread-core-esp32x-mtd-config.h
+++ b/components/openthread/private_include/openthread-core-esp32x-mtd-config.h
@@ -504,6 +504,34 @@
 #define OPENTHREAD_CONFIG_PARENT_SEARCH_RSS_THRESHOLD CONFIG_OPENTHREAD_PARENT_SEARCH_RSS_THRESHOLD
 #endif
 
+/**
+ * @def OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE
+ *
+ * Define to 1 if you want to make MAC keys exportable.
+ */
 #define OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE 1
 
+/**
+ * @def OPENTHREAD_CONFIG_CRYPTO_LIB
+ *
+ * Selects the crypto backend library for OpenThread.
+ *
+ * There are several options available
+ * - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_MBEDTLS
+ * - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
+ * - @sa OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
+ */
 #define OPENTHREAD_CONFIG_CRYPTO_LIB OPENTHREAD_CONFIG_CRYPTO_LIB_PSA
+// TODO: Remove when https://github.com/openthread/openthread/pull/12638 is merged
+#define OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE 1
+
+/**
+ * @def OPENTHREAD_CONFIG_MESHCOP_STEERING_DATA_API_ENABLE
+ *
+ * Define as 1 to enable the MeshCoP Steering Data public APIs (in `openthread/steering_data.h`).
+ */
+#define OPENTHREAD_CONFIG_MESHCOP_STEERING_DATA_API_ENABLE 1
+
+#ifndef OPENTHREAD_CONFIG_THREAD_VERSION
+#define OPENTHREAD_CONFIG_THREAD_VERSION OT_THREAD_VERSION_1_4
+#endif
diff --git a/components/openthread/sbom_openthread.yml b/components/openthread/sbom_openthread.yml
index d0dc17ff5e..8a79402605 100644
--- a/components/openthread/sbom_openthread.yml
+++ b/components/openthread/sbom_openthread.yml
@@ -5,4 +5,4 @@ supplier: 'Organization: Espressif Systems (Shanghai) CO LTD'
 originator: 'Organization: Google LLC'
 description: OpenThread released by Google is an open-source implementation of the Thread networking
 url: https://github.com/espressif/openthread
-hash: 03933d9b76cb7075cc29a6648b42b217971f82a5
+hash: 9b887f6bd1437170fc9bcb726f32185ccb3cb841
diff --git a/components/openthread/src/esp_openthread_netif_glue.c b/components/openthread/src/esp_openthread_netif_glue.c
index ff37ce1fb3..c49a260407 100644
--- a/components/openthread/src/esp_openthread_netif_glue.c
+++ b/components/openthread/src/esp_openthread_netif_glue.c
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2021-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2021-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -183,7 +183,21 @@ static esp_err_t openthread_netif_transmit(void *handle, void *buffer, size_t le
     otError ot_error = OT_ERROR_NONE;
 
     esp_openthread_task_switching_lock_acquire(portMAX_DELAY);
-    otMessage *message = otIp6NewMessage(esp_openthread_get_instance(), NULL);
+
+    otMessageSettings settings = {};
+    switch (otThreadGetDeviceRole(esp_openthread_get_instance()))
+    {
+    case OT_DEVICE_ROLE_DISABLED:
+        settings.mLinkSecurityEnabled = false;
+        settings.mPriority = OT_MESSAGE_PRIORITY_LOW;
+        break;
+    default:
+        settings.mLinkSecurityEnabled = true;
+        settings.mPriority = OT_MESSAGE_PRIORITY_NORMAL;
+        break;
+    }
+
+    otMessage *message = otIp6NewMessage(esp_openthread_get_instance(), &settings);
     if (message == NULL) {
         ESP_LOGE(OT_PLAT_LOG_TAG, "Failed to allocate OpenThread message");
         ExitNow(error = ESP_ERR_NO_MEM);