diff --git a/components/esp_rom/esp32c2/ld/esp32c2.rom.eco4.ld b/components/esp_rom/esp32c2/ld/esp32c2.rom.eco4.ld
index df398b3a6e..a975807211 100644
--- a/components/esp_rom/esp32c2/ld/esp32c2.rom.eco4.ld
+++ b/components/esp_rom/esp32c2/ld/esp32c2.rom.eco4.ld
@@ -60,7 +60,7 @@ hal_crypto_set_key_entry = 0x40001e18;
 /*pm_stop = 0x40001e38;*/
 hal_set_sta_tbtt = 0x40001e4c;
 //pm_update_next_tbtt = 0x40001e50;
-pm_set_sleep_type = 0x40001e54;
+//pm_set_sleep_type = 0x40001e54;
 /*pm_tx_null_data_done_process = 0x40001eb0;*/
 //pm_tx_data_process = 0x40001eb4;
 /*pm_attach = 0x40001eb8;*/
@@ -80,7 +80,7 @@ tsf_hal_set_tbtt_start_time = 0x40001f38;
 ieee80211_ampdu_reorder = 0x40001fb0;
 ieee80211_encap_esfbuf = 0x40001fb8;
 ieee80211_output_process = 0x40001fc4;
-sta_input = 0x40001fcc;
+//sta_input = 0x40001fcc;
 ieee80211_classify = 0x40001fe0;
 ieee80211_crypto_decap = 0x40001ff8;
 //ieee80211_ccmp_decrypt = 0x4000200c;
diff --git a/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld b/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld
index 2530904497..e759344295 100644
--- a/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld
+++ b/components/esp_rom/esp32c5/ld/esp32c5.rom.eco3.ld
@@ -26,8 +26,8 @@ lmacDisableTransmit = 0x40000cd4;
 pm_check_state = 0x40000d48;
 //pm_set_beacon_filter = 0x40000d6c;
 //pm_is_in_wifi_slice_threshold = 0x40000d70;
-pm_keep_alive = 0x40000d78;
-pm_process_tim = 0x40000da8;
+//pm_keep_alive = 0x40000d78;
+//pm_process_tim = 0x40000da8;
 //pm_tbtt_process = 0x40000dbc;
 //pm_tx_data_process = 0x40000dd8;
 pm_twt_process = 0x40000de8;
@@ -49,7 +49,7 @@ ppRxProtoProc = 0x40000e90;
 //wDev_ProcessRxSucData = 0x40000fe0;
 esp_test_tx_process_complete = 0x40001030;
 pm_get_tbtt_count = 0x4000151c;
-pm_enable_max_idle_timer = 0x400015b8;
+//pm_enable_max_idle_timer = 0x400015b8;
 //pm_beacon_offset_check = 0x400015cc;
 pm_beacon_offset_get_average = 0x400015d0;
 pm_beacon_offset_get_expect = 0x400015d4;
diff --git a/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld b/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld
index 7e498f0847..0c7d024d67 100644
--- a/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld
+++ b/components/esp_rom/esp32c5/ld/esp32c5.rom.pp.ld
@@ -134,7 +134,7 @@ pm_rx_data_process = 0x40000db0;
 pm_sleep = 0x40000db4;
 pm_sleep_for = 0x40000db8;
 //pm_tbtt_process = 0x40000dbc;
-pm_tx_data_done_process = 0x40000dc0;
+//pm_tx_data_done_process = 0x40000dc0;
 pm_allow_tx = 0x40000dc4;
 pm_extend_tbtt_adaptive_servo = 0x40000dc8;
 pm_scale_listen_interval = 0x40000dcc;
diff --git a/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld b/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
index 45688e3dd0..65455157bd 100644
--- a/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
+++ b/components/esp_rom/esp32c61/ld/esp32c61.rom.eco4.ld
@@ -25,7 +25,7 @@ lmacDisableTransmit = 0x40000c44;
 pm_check_state = 0x40000cb4;
 pm_set_beacon_filter = 0x40000cd8;
 //pm_is_in_wifi_slice_threshold = 0x40000cdc;
-pm_keep_alive = 0x40000ce4;
+//pm_keep_alive = 0x40000ce4;
 pm_process_tim = 0x40000d14;
 pm_tbtt_process = 0x40000d28;
 pm_tx_data_process = 0x40000d44;
@@ -52,7 +52,7 @@ pm_beacon_offset_check = 0x40001564;
 pm_beacon_offset_get_average = 0x40001568;
 pm_beacon_offset_get_expect = 0x4000156c;
 pm_beacon_offset_get_params = 0x40001570;
-pm_enable_max_idle_timer = 0x40001578;
+//pm_enable_max_idle_timer = 0x40001578;
 
 phy_get_rc_dout = 0x40001058;
 phy_rc_cal = 0x4000105c;
diff --git a/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld b/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld
index f11f406e68..8577f3a056 100644
--- a/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld
+++ b/components/esp_rom/esp32c61/ld/esp32c61.rom.pp.ld
@@ -131,7 +131,7 @@ pm_rx_data_process = 0x40000d1c;
 pm_sleep = 0x40000d20;
 pm_sleep_for = 0x40000d24;
 //pm_tbtt_process = 0x40000d28;
-pm_tx_data_done_process = 0x40000d2c;
+//pm_tx_data_done_process = 0x40000d2c;
 pm_allow_tx = 0x40000d30;
 pm_extend_tbtt_adaptive_servo = 0x40000d34;
 pm_scale_listen_interval = 0x40000d38;
diff --git a/components/esp_wifi/Kconfig b/components/esp_wifi/Kconfig
index f1d7256957..733632bdd4 100644
--- a/components/esp_wifi/Kconfig
+++ b/components/esp_wifi/Kconfig
@@ -881,6 +881,13 @@ menu "Wi-Fi"
                 This option enables assert checks to verify that modem RF power state
                 is correctly cleared before pmu sleep.
 
+        config ESP_WIFI_PASSIVE_HIDDEN_AP_SUPPORT
+            bool "Support station connection to hidden APs using passive scan when country policy is auto"
+            default n
+            help
+                Select this option to enable/disable support for station connections
+                to hidden APs using passive scan when the country policy is set to auto.
+
     endif # wifi enabled
 
 endmenu # Wi-Fi
diff --git a/components/esp_wifi/include/esp_private/wifi.h b/components/esp_wifi/include/esp_private/wifi.h
index e8e6dc2830..c53a28dbd4 100644
--- a/components/esp_wifi/include/esp_private/wifi.h
+++ b/components/esp_wifi/include/esp_private/wifi.h
@@ -499,6 +499,9 @@ esp_err_t esp_wifi_internal_get_config_channel(wifi_interface_t ifx, uint8_t *pr
   *
   * @return
   *    - ESP_OK: succeed
+  *    - ESP_ERR_INVALID_ARG : invalid argument
+  *    - ESP_ERR_WIFI_NOT_STARTED : WiFi is not started by esp_wifi_start
+  *    - ESP_ERR_WIFI_NOT_CONNECT : No connection between STA and AP
   */
 esp_err_t esp_wifi_internal_get_negotiated_channel(wifi_interface_t ifx, uint8_t aid, uint8_t *primary, uint8_t *second);
 
@@ -510,6 +513,9 @@ esp_err_t esp_wifi_internal_get_negotiated_channel(wifi_interface_t ifx, uint8_t
   *
   * @return
   *    - ESP_OK: succeed
+  *    - ESP_ERR_INVALID_ARG : invalid argument
+  *    - ESP_ERR_WIFI_NOT_STARTED : WiFi is not started by esp_wifi_start
+  *    - ESP_ERR_WIFI_NOT_CONNECT : No connection between STA and AP
   */
 esp_err_t esp_wifi_internal_get_negotiated_bandwidth(wifi_interface_t ifx, uint8_t aid, uint8_t *bw);
 
diff --git a/components/esp_wifi/include/esp_wifi.h b/components/esp_wifi/include/esp_wifi.h
index 9152c68d27..d479b3663a 100644
--- a/components/esp_wifi/include/esp_wifi.h
+++ b/components/esp_wifi/include/esp_wifi.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -284,6 +284,12 @@ extern wifi_osi_funcs_t g_wifi_osi_funcs;
 #define WIFI_ENABLE_BSS_MAX_IDLE 0
 #endif
 
+#if CONFIG_ESP_WIFI_PASSIVE_HIDDEN_AP_SUPPORT
+#define WIFI_ENABLE_PASSIVE_HIDDEN_AP (1<<9)
+#else
+#define WIFI_ENABLE_PASSIVE_HIDDEN_AP 0
+#endif
+
 #define CONFIG_FEATURE_WPA3_SAE_BIT     (1<<0)
 #define CONFIG_FEATURE_CACHE_TX_BUF_BIT (1<<1)
 #define CONFIG_FEATURE_FTM_INITIATOR_BIT (1<<2)
@@ -293,6 +299,7 @@ extern wifi_osi_funcs_t g_wifi_osi_funcs;
 #define CONFIG_FEATURE_11R_BIT (1<<6)
 #define CONFIG_FEATURE_WIFI_ENT_BIT (1<<7)
 #define CONFIG_FEATURE_BSS_MAX_IDLE_BIT (1<<8)
+#define CONFIG_FEATURE_WIFI_PASSIVE_HIDDEN_AP_BIT (1<<9)
 
 /* Set additional WiFi features and capabilities */
 #define WIFI_FEATURE_CAPS (WIFI_ENABLE_WPA3_SAE | \
@@ -303,7 +310,8 @@ extern wifi_osi_funcs_t g_wifi_osi_funcs;
                            WIFI_ENABLE_GMAC | \
                            WIFI_ENABLE_11R  | \
                            WIFI_ENABLE_ENTERPRISE | \
-                           WIFI_ENABLE_BSS_MAX_IDLE)
+                           WIFI_ENABLE_BSS_MAX_IDLE | \
+                           WIFI_ENABLE_PASSIVE_HIDDEN_AP)
 
 #define WIFI_INIT_CONFIG_DEFAULT() { \
     .osi_funcs = &g_wifi_osi_funcs, \
@@ -1589,6 +1597,8 @@ esp_err_t esp_wifi_sta_get_aid(uint16_t *aid);
   *
   * @return
   *    - ESP_OK: succeed
+  *    - ESP_ERR_WIFI_NOT_STARTED: WiFi is not started by esp_wifi_start
+  *    - ESP_ERR_WIFI_NOT_CONNECT: No connection between STA and AP
   */
 esp_err_t esp_wifi_sta_get_negotiated_phymode(wifi_phy_mode_t *phymode);
 
diff --git a/components/esp_wifi/include/esp_wifi_types_generic.h b/components/esp_wifi/include/esp_wifi_types_generic.h
index 784fb4ed2c..6406fbd64d 100644
--- a/components/esp_wifi/include/esp_wifi_types_generic.h
+++ b/components/esp_wifi/include/esp_wifi_types_generic.h
@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2015-2026 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -224,8 +224,14 @@ typedef struct {
   * @brief Channel bitmap for setting specific channels to be scanned
   */
 typedef struct {
-    uint16_t ghz_2_channels;     /**< Represents 2.4 GHz channels, that bits can be set as wifi_2g_channel_bit_t shown. */
-    uint32_t ghz_5_channels;     /**< Represents 5 GHz channels, that bits can be set as wifi_5g_channel_bit_t shown. */
+    uint16_t ghz_2_channels;     /**< Represents 2.4 GHz channels.
+                                      bit0: band bypass, 0: scan as bitmap, 1: bypass all channels of 2.4GHz.
+                                      bit1-bit14: represents channels can be set as wifi_2g_channel_bit_t shown.
+                                      bit15: reserved. */
+    uint32_t ghz_5_channels;     /**< Represents 5 GHz channels.
+                                      bit0: band bypass, 0: scan as bitmap, 1: bypass all channels of 5GHz.
+                                      bit1-bit28: represents channels can be set as wifi_5g_channel_bit_t shown.
+                                      bit29-bit31: reserved. */
 } wifi_scan_channel_bitmap_t;
 
 /**
@@ -509,7 +515,7 @@ typedef enum {
   * @brief Configuration structure for BSS max idle
   */
 typedef struct {
-    uint16_t period;                /**< Sets BSS Max idle period (1 Unit = 1000TUs OR 1.024 Seconds). If there are no frames for this period from a STA, SoftAP will disassociate due to inactivity. Setting it to 0 disables the feature */
+    uint16_t period;                /**< Sets BSS Max idle period (1 Unit = 1000TUs OR 1.024 Seconds). If there are no frames for this period from a STA, SoftAP will disassociate due to inactivity. Setting it to 0 disables the feature. Minimum value will be 10 */
     bool protected_keep_alive;      /**< Requires clients to use protected keep alive frames for BSS Max Idle period */
 } wifi_bss_max_idle_config_t;
 
@@ -520,7 +526,7 @@ typedef struct {
     uint8_t ssid[32];                         /**< SSID of soft-AP. If ssid_len field is 0, this must be a Null terminated string. Otherwise, length is set according to ssid_len. */
     uint8_t password[64];                     /**< Password of soft-AP. */
     uint8_t ssid_len;                         /**< Optional length of SSID field. */
-    uint8_t channel;                          /**< Channel of soft-AP */
+    uint8_t channel;                          /**< Channel of soft-AP. Set to 0 for auto selection (min channel: typically 1 for 2.4G, 36 for 5G). Other invalid values return ESP_ERR_INVALID_ARG. */
     wifi_auth_mode_t authmode;                /**< Auth mode of soft-AP. Do not support AUTH_WEP, AUTH_WAPI_PSK and AUTH_OWE in soft-AP mode. When the auth mode is set to WPA2_PSK, WPA2_WPA3_PSK or WPA3_PSK, the pairwise cipher will be overwritten with WIFI_CIPHER_TYPE_CCMP by default, unless explicitly set.  */
     uint8_t ssid_hidden;                      /**< Broadcast SSID or not, default 0, broadcast the SSID */
     uint8_t max_connection;                   /**< Max number of stations allowed to connect in */
diff --git a/components/esp_wifi/lib b/components/esp_wifi/lib
index bb6d7baf16..66f601bdb2 160000
--- a/components/esp_wifi/lib
+++ b/components/esp_wifi/lib
@@ -1 +1 @@
-Subproject commit bb6d7baf164bd240bdd34947c3961a7bc457e96b
+Subproject commit 66f601bdb2c22f5387dd59eabae9572c4e7711b6
diff --git a/components/esp_wifi/test_apps/wifi_connect/main/test_bss_max_idle.c b/components/esp_wifi/test_apps/wifi_connect/main/test_bss_max_idle.c
index 7cd19b5c99..2cde199e7d 100644
--- a/components/esp_wifi/test_apps/wifi_connect/main/test_bss_max_idle.c
+++ b/components/esp_wifi/test_apps/wifi_connect/main/test_bss_max_idle.c
@@ -62,7 +62,8 @@ typedef u16 __bitwise be16;
 #define WIFI_FAIL                (1<<3)
 #define EMPH_STR(s) "****** "s" ******"
 
-#define MAX_IDLE_PERIOD      (5)
+//For station, max idle period is default 10 (1000TUs)
+#define MAX_IDLE_PERIOD      (10)
 #define ETHTYPE_IP            0x0800
 
 static const char* TAG = "test_bss_max_idle";
diff --git a/components/wpa_supplicant/src/common/nan_de.h b/components/wpa_supplicant/src/common/nan_de.h
index fcbf5c9fc6..577a7ffc83 100644
--- a/components/wpa_supplicant/src/common/nan_de.h
+++ b/components/wpa_supplicant/src/common/nan_de.h
@@ -17,7 +17,7 @@
 #ifndef ESP_SUPPLICANT
 #define NAN_DE_MAX_SERVICE 20
 #else
-#define NAN_DE_MAX_SERVICE 2
+#define NAN_DE_MAX_SERVICE 1
 #endif
 #endif /* NAN_DE_MAX_SERVICE */