diff --git a/components/esp_system/CMakeLists.txt b/components/esp_system/CMakeLists.txt
index 38f1032ed8..d2f97850ec 100644
--- a/components/esp_system/CMakeLists.txt
+++ b/components/esp_system/CMakeLists.txt
@@ -65,7 +65,7 @@ else()
 
     idf_component_register(SRCS "${srcs}"
                         INCLUDE_DIRS include
-                        PRIV_REQUIRES spi_flash esp_timer esp_mm esp_security
+                        PRIV_REQUIRES spi_flash esp_timer esp_mm
                                     # [refactor-todo] requirements due to init code,
                                     # should be removable once using component init functions
                                     # link-time registration is used.
diff --git a/components/esp_system/fpga_overrides_clk.c b/components/esp_system/fpga_overrides_clk.c
index cd2502cc26..1b1f9efad2 100644
--- a/components/esp_system/fpga_overrides_clk.c
+++ b/components/esp_system/fpga_overrides_clk.c
@@ -78,10 +78,6 @@ void esp_perip_clk_init(void)
 {
 }
 
-void esp_crypto_clk_init(void)
-{
-}
-
 /**
  * @brief No-op function, used to force linking this file
  *
diff --git a/components/esp_system/port/include/esp_clk_internal.h b/components/esp_system/port/include/esp_clk_internal.h
index 63cd3a28ff..88aea20109 100644
--- a/components/esp_system/port/include/esp_clk_internal.h
+++ b/components/esp_system/port/include/esp_clk_internal.h
@@ -44,14 +44,6 @@ void esp_clk_init(void);
  */
 void esp_perip_clk_init(void);
 
-/**
- * @brief Initialize the crypto clock
- *
- * Called from cpu_start.c, not intended to be called from other places.
- * This function configures the crypto clock.
- */
-void esp_crypto_clk_init(void);
-
 #if !CONFIG_IDF_TARGET_ESP32C2
 /* Selects an external clock source (32 kHz) for RTC.
  * Only internal use in unit test.
diff --git a/components/esp_system/system_init_fn.txt b/components/esp_system/system_init_fn.txt
index 42dc368893..72a52d5dfb 100644
--- a/components/esp_system/system_init_fn.txt
+++ b/components/esp_system/system_init_fn.txt
@@ -76,6 +76,9 @@ SECONDARY: 101: esp_hw_stack_guard_init in components/esp_system/hw_stack_guard.
 # RNG module clock was disabled in `esp_perip_clk_init`, if hw_random is used, need to re-ebnabled it in startup
 SECONDARY: 102: init_rng_clock in components/esp_hw_support/hw_random.c on BIT(0)
 
+# Security specific initializations
+SECONDARY: 103: esp_security_init in components/esp_security/src/init.c on BIT(0)
+
 # esp_sleep doesn't have init dependencies
 SECONDARY: 105: esp_sleep_startup_init in components/esp_hw_support/sleep_gpio.c on BIT(0)
 SECONDARY: 106: sleep_clock_startup_init in components/esp_hw_support/sleep_clock.c on BIT(0)
diff --git a/components/hal/test_apps/crypto/main/CMakeLists.txt b/components/hal/test_apps/crypto/main/CMakeLists.txt
index c9644c852e..23405b3458 100644
--- a/components/hal/test_apps/crypto/main/CMakeLists.txt
+++ b/components/hal/test_apps/crypto/main/CMakeLists.txt
@@ -23,8 +23,8 @@ endif()
 
 if(CONFIG_SOC_KEY_MANAGER_SUPPORTED)
    list(APPEND srcs "key_manager/test_key_manager.c"
-                    "$ENV{IDF_PATH}/components/esp_hw_support/esp_key_mgr.c")
-   list(APPEND priv_include_dirs "$ENV{IDF_PATH}/components/esp_hw_support/include")
+                    "$ENV{IDF_PATH}/components/esp_security/src/esp_key_mgr.c")
+   list(APPEND priv_include_dirs "$ENV{IDF_PATH}/components/esp_security/include")
 endif()
 
 if(CONFIG_SOC_AES_SUPPORTED)
@@ -74,7 +74,7 @@ if(CONFIG_SOC_SHA_SUPPORTED)
 endif()
 
 idf_component_register(SRCS ${srcs}
-                       PRIV_REQUIRES efuse mbedtls esp_mm bootloader_support spi_flash
+                       PRIV_REQUIRES efuse mbedtls esp_security esp_mm bootloader_support spi_flash
                        REQUIRES test_utils unity
                        WHOLE_ARCHIVE
                        PRIV_INCLUDE_DIRS "${priv_include_dirs}"
diff --git a/components/spi_flash/CMakeLists.txt b/components/spi_flash/CMakeLists.txt
index 7ab7d91324..147f01294f 100644
--- a/components/spi_flash/CMakeLists.txt
+++ b/components/spi_flash/CMakeLists.txt
@@ -52,9 +52,6 @@ else()
     set(priv_requires bootloader_support app_update soc esp_mm
                       esp_driver_gpio
     )
-    if(${target} STREQUAL "esp32s2")
-        list(APPEND priv_requires esp_security)
-    endif()
 endif()
 
 idf_component_register(SRCS "${srcs}"
diff --git a/tools/test_apps/system/g1_components/CMakeLists.txt b/tools/test_apps/system/g1_components/CMakeLists.txt
index eeaabadbaf..2215ef3e4b 100644
--- a/tools/test_apps/system/g1_components/CMakeLists.txt
+++ b/tools/test_apps/system/g1_components/CMakeLists.txt
@@ -91,6 +91,11 @@ set(extra_components_which_shouldnt_be_included
 
     # pthread is required by cxx. See [refactor-todo] about cxx, can it work without pthread?
     pthread
+
+    # esp_security is a private dependency of the following G1 components:
+    #    esp_hw_support
+    #    TODO: will be removed in IDF 6.x (see IDF-10733)
+    esp_security
 )
 
 set(expected_components
diff --git a/tools/test_apps/system/g1_components/check_dependencies.py b/tools/test_apps/system/g1_components/check_dependencies.py
index aebaf4b8c0..3f0e8e7c1b 100644
--- a/tools/test_apps/system/g1_components/check_dependencies.py
+++ b/tools/test_apps/system/g1_components/check_dependencies.py
@@ -11,7 +11,7 @@ g1_g0_components = ['hal', 'cxx', 'newlib', 'freertos', 'esp_hw_support', 'heap'
 
 expected_dep_violations = {'esp_system': ['esp_timer', 'bootloader_support', 'esp_pm'],
                            'spi_flash': ['bootloader_support', 'app_update', 'esp_driver_gpio'],
-                           'esp_hw_support': ['efuse', 'bootloader_support', 'esp_driver_gpio', 'esp_timer', 'esp_pm'],
+                           'esp_hw_support': ['efuse', 'bootloader_support', 'esp_driver_gpio', 'esp_timer', 'esp_pm', 'esp_security'],
                            'cxx': ['pthread']}