diff --git a/components/bt/esp_ble_mesh/mesh_core/beacon.c b/components/bt/esp_ble_mesh/mesh_core/beacon.c
index 31d09aa05a..981f88edcd 100644
--- a/components/bt/esp_ble_mesh/mesh_core/beacon.c
+++ b/components/bt/esp_ble_mesh/mesh_core/beacon.c
@@ -374,9 +374,19 @@ static void secure_beacon_recv(struct net_buf_simple *buf)
 
     cache_add(data, sub);
 
-    /* If we have NetKey0 accept initiation only from it */
+    /* Spec v1.0.1, Section 3.8.4:
+     * If a node on a primary subnet receives an update on
+     * the primary subnet, it shall propagate the IV update
+     * to all other subnets. If a node on a primary subnet
+     * receives an IV update on any other subnet, the update
+     * shall be ignored.
+     * If a node on a primary subnet receives an key update
+     * on any other subnet, the update shall not be ignored.
+     */
     if (bt_mesh_primary_subnet_exist() &&
-            sub->net_idx != BLE_MESH_KEY_PRIMARY) {
+        sub->net_idx != BLE_MESH_KEY_PRIMARY &&
+        BLE_MESH_IV_UPDATE(flags) &&
+        !BLE_MESH_KEY_REFRESH(flags)) {
         BT_WARN("Ignoring secure beacon on non-primary subnet");
         goto update_stats;
     }
@@ -390,7 +400,15 @@ static void secure_beacon_recv(struct net_buf_simple *buf)
         bt_mesh_beacon_ivu_initiator(false);
     }
 
-    iv_change = bt_mesh_net_iv_update(iv_index, BLE_MESH_IV_UPDATE(flags));
+    /* If a node on a primary subnet receives an IV update on any other subnet,
+     * the IV update shall be ignored. And if a node on a non-primary subnet
+     * receives an IV update on primary subnet, the IV update shall be ignored,
+     * because it doesn't have a primary network key.
+     */
+    if ((bt_mesh_primary_subnet_exist() && sub->net_idx == BLE_MESH_KEY_PRIMARY) ||
+        (!bt_mesh_primary_subnet_exist() && sub->net_idx != BLE_MESH_KEY_PRIMARY)) {
+        iv_change = bt_mesh_net_iv_update(iv_index, BLE_MESH_IV_UPDATE(flags));
+    }
 
     kr_change = bt_mesh_kr_update(sub, BLE_MESH_KEY_REFRESH(flags), new_key);
     if (kr_change) {
diff --git a/components/bt/esp_ble_mesh/mesh_core/cfg_srv.c b/components/bt/esp_ble_mesh/mesh_core/cfg_srv.c
index 7a0c52a8e7..2818936d91 100644
--- a/components/bt/esp_ble_mesh/mesh_core/cfg_srv.c
+++ b/components/bt/esp_ble_mesh/mesh_core/cfg_srv.c
@@ -252,7 +252,7 @@ static uint8_t _mod_pub_set(struct bt_mesh_model *model, uint16_t pub_addr,
         return STATUS_SUCCESS;
     }
 
-    /* For case MESH/NODE/CFG/MP/BI-03-C, need to check if appkey 
+    /* For case MESH/NODE/CFG/MP/BI-03-C, need to check if appkey
      * is bound to model identified by the ModelIdentifier.
      */
     if (!bt_mesh_app_key_find(app_idx) ||
diff --git a/components/bt/esp_ble_mesh/mesh_core/prov.c b/components/bt/esp_ble_mesh/mesh_core/prov.c
index f9de1e271c..c18c6949cf 100644
--- a/components/bt/esp_ble_mesh/mesh_core/prov.c
+++ b/components/bt/esp_ble_mesh/mesh_core/prov.c
@@ -1672,7 +1672,7 @@ int bt_mesh_pb_gatt_recv(struct bt_mesh_conn *conn, struct net_buf_simple *buf)
 
     /* For case MESH/NODE/PROV/BI-03-C, if the link is closed, when the node receive
      * a Provisioning PDU , it will send a Provisioning Failed PDU with the Error Code
-     * field set to Unexpected PDU(0x03). 
+     * field set to Unexpected PDU(0x03).
      */
     if (bt_mesh_atomic_test_bit(link.flags, LINK_INVALID)) {
         BT_WARN("Unexpected msg 0x%02x on invalid link", type);