diff --git a/subsys/net/openthread/Kconfig b/subsys/net/openthread/Kconfig
index f1ba34aba7fb..722192c70a74 100644
--- a/subsys/net/openthread/Kconfig
+++ b/subsys/net/openthread/Kconfig
@@ -35,6 +35,7 @@ config OPENTHREAD_NRF_SECURITY_PSA
 	select NRF_SECURITY
 	select MBEDTLS_ENABLE_HEAP if !OPENTHREAD_COPROCESSOR_RCP
 	select MBEDTLS_TLS_LIBRARY if (OPENTHREAD_JOINER || OPENTHREAD_COMMISSIONER || OPENTHREAD_COAPS)
+	select MBEDTLS_PEM_PARSE_C if (OPENTHREAD_COAPS || OPENTHREAD_BLE_TCAT)
 	select PSA_WANT_ALG_HKDF
 	select PSA_WANT_ALG_CCM
 	select PSA_WANT_ALG_CMAC
diff --git a/subsys/net/openthread/Kconfig.defconfig b/subsys/net/openthread/Kconfig.defconfig
index b7a609ecb082..8c46d6de81be 100644
--- a/subsys/net/openthread/Kconfig.defconfig
+++ b/subsys/net/openthread/Kconfig.defconfig
@@ -105,6 +105,9 @@ choice OPENTHREAD_SECURITY
 	default OPENTHREAD_NRF_SECURITY_CHOICE if SOC_NRF54H20_CPUAPP
 endchoice
 
+config MBEDTLS_PROMPTLESS
+	default n
+
 config MBEDTLS_SSL_PROTO_DTLS
 	bool
 	default n if !(OPENTHREAD_JOINER || OPENTHREAD_COMMISSIONER || OPENTHREAD_COAPS)
@@ -257,6 +260,12 @@ if OPENTHREAD_THREAD_VERSION_1_4
 config OPENTHREAD_TCP_ENABLE
 	default y
 
+config OPENTHREAD_CLI_TCP_ENABLE
+	default n
+
+config OPENTHREAD_DNS_CLIENT_OVER_TCP
+	default y
+
 endif # OPENTHREAD_THREAD_VERSION_1_4
 
 if OPENTHREAD_COPROCESSOR_RCP