diff --git a/components/esp-tls/CMakeLists.txt b/components/esp-tls/CMakeLists.txt
index 468456e67e..14a8503cd5 100644
--- a/components/esp-tls/CMakeLists.txt
+++ b/components/esp-tls/CMakeLists.txt
@@ -27,10 +27,7 @@ idf_component_register(SRCS "${srcs}"
 
 
 if(NOT ${IDF_TARGET} STREQUAL "linux")
-# Increase link multiplicity to get some lwip symbols correctly resolved by the linker
-# due to cyclic dependencies present in IDF for lwip/esp_netif/mbedtls
 idf_component_get_property(lwip lwip COMPONENT_LIB)
-set_property(TARGET ${lwip} APPEND PROPERTY LINK_INTERFACE_MULTIPLICITY 5)
 else()
     # For linux target, define ESP_TLS_WITH_LWIP if LWIP is enabled in the build
     if(CONFIG_LWIP_ENABLE)
diff --git a/components/esp_common/CMakeLists.txt b/components/esp_common/CMakeLists.txt
index 54d5d5ebd2..c16d2e772d 100644
--- a/components/esp_common/CMakeLists.txt
+++ b/components/esp_common/CMakeLists.txt
@@ -8,11 +8,17 @@ endif()
 
 set(srcs "src/esp_err_to_name.c")
 
-# Note: esp_ipc, esp_pm added as a public requirement to keep compatibility as to be located here.
 idf_component_register(SRCS "${srcs}"
                         INCLUDE_DIRS include
                         LDFRAGMENTS ${ldfragments})
 
+# Note: LINK_INTERFACE_MULTIPLICITY is needed to break circular static-library
+# dependencies in the component graph. The core cycle is:
+#   esp_system -> bootloader_support -> efuse -> esp_system
+# (efuse registers an ESP_SYSTEM_INIT_FN and calls esp_restart(), both of which
+# pull in esp_system).  Several more cycles exist through esp_partition, esp_mm,
+# and mbedtls.  All cycle-causing deps are already PRIV_REQUIRES, so the
+# multiplicity property on this universal dependency is the established fix.
 set_property(TARGET ${COMPONENT_LIB} APPEND PROPERTY LINK_INTERFACE_MULTIPLICITY 4)
 
 # List of components needed for the error codes list
diff --git a/components/mbedtls/CMakeLists.txt b/components/mbedtls/CMakeLists.txt
index 111fd3de5a..41ef73f641 100644
--- a/components/mbedtls/CMakeLists.txt
+++ b/components/mbedtls/CMakeLists.txt
@@ -343,7 +343,14 @@ endif()
 if(NOT ${IDF_TARGET} STREQUAL "linux")
     target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_hardware.c")
 endif()
-target_sources(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/esp_mem.c")
+# esp_mem.c defines esp_mbedtls_mem_calloc/free, which platform.c (inside the
+# 'builtin' archive) calls via MBEDTLS_PLATFORM_STD_CALLOC/FREE. Compiling
+# esp_mem.c directly into 'builtin' ensures the symbols are in the same archive
+# as their caller, avoiding any link-order dependency on a separate archive.
+# port/include (for esp_mem.h) and the IDF global includes (sdkconfig.h,
+# esp_attr.h, esp_heap_caps.h) are both available here via directory-level
+# include_directories set up by idf_component_register before add_subdirectory.
+target_sources(builtin PRIVATE "${COMPONENT_DIR}/port/esp_mem.c")
 
 if(CONFIG_SOC_AES_SUPPORTED)
     target_include_directories(tfpsacrypto PRIVATE "${COMPONENT_DIR}/port/aes/include")