diff --git a/.github/actions/deps/external/action.yml b/.github/actions/deps/external/action.yml
index 564c851cfc9..81e73f871ef 100644
--- a/.github/actions/deps/external/action.yml
+++ b/.github/actions/deps/external/action.yml
@@ -56,6 +56,16 @@ runs:
       uses: ./.github/actions/deps/python
       with:
         action: ${{ inputs.action }}
+    - name: Set ESP-IDF constraints path
+      if: inputs.port == 'espressif'
+      run: python3 -u tools/ci_set_idf_constraint.py
+      shell: bash
+
     - name: Install python dependencies
-      run: pip install -r requirements-dev.txt
+      run: |
+        if [ -n "${IDF_CONSTRAINT_FILE:-}" ] && [ -f "$IDF_CONSTRAINT_FILE" ]; then
+          pip install -c "$IDF_CONSTRAINT_FILE" -r requirements-dev.txt
+        else
+          pip install -r requirements-dev.txt
+        fi
       shell: bash
diff --git a/ports/espressif/Makefile b/ports/espressif/Makefile
index ebc4fa3a4e1..9e331740dd6 100644
--- a/ports/espressif/Makefile
+++ b/ports/espressif/Makefile
@@ -123,6 +123,9 @@ INC += \
 	-isystem esp-idf/components/soc/include \
 	-isystem esp-idf/components/soc/$(IDF_TARGET)/include \
 	-isystem esp-idf/components/soc/$(IDF_TARGET)/register \
+	-isystem esp-idf/components/soc/$(IDF_TARGET)/register/hw_ver3 \
+	-isystem esp-idf/components/soc/$(IDF_TARGET)/register/hw_ver2 \
+	-isystem esp-idf/components/soc/$(IDF_TARGET)/register/hw_ver1 \
 	-isystem esp-idf/components/spi_flash/include \
 	-isystem esp-idf/components/usb/include \
 	-isystem esp-idf/components/ulp/ulp_fsm/include \
diff --git a/ports/espressif/boards/ai_thinker_esp32-c3s-2m/mpconfigboard.mk b/ports/espressif/boards/ai_thinker_esp32-c3s-2m/mpconfigboard.mk
index 9ca2eee1577..da3e6a14496 100644
--- a/ports/espressif/boards/ai_thinker_esp32-c3s-2m/mpconfigboard.mk
+++ b/ports/espressif/boards/ai_thinker_esp32-c3s-2m/mpconfigboard.mk
@@ -10,5 +10,6 @@ CIRCUITPY_ESP_FLASH_SIZE = 2MB
 CIRCUITPY_DUALBANK = 0
 
 CIRCUITPY_JPEGIO = 0
+CIRCUITPY_CANIO = 0
 
 CIRCUITPY_ESP_USB_SERIAL_JTAG = 0
diff --git a/ports/espressif/esp-idf b/ports/espressif/esp-idf
index f4fddd2d05b..1d2c73f641a 160000
--- a/ports/espressif/esp-idf
+++ b/ports/espressif/esp-idf
@@ -1 +1 @@
-Subproject commit f4fddd2d05b44d1d606b546b596d17de0a73e9eb
+Subproject commit 1d2c73f641af70c24274e2d3e74641592bee97e5
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 566618d2c47..3c7e18b7bf0 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -25,8 +25,7 @@ intelhex
 # for building & testing natmods
 pyelftools
 
-# newer versions break ESP-IDF now
-cryptography<45
+cryptography
 
 # for web workflow minify
 minify_html
diff --git a/tools/ci_set_idf_constraint.py b/tools/ci_set_idf_constraint.py
new file mode 100644
index 00000000000..49c187f4587
--- /dev/null
+++ b/tools/ci_set_idf_constraint.py
@@ -0,0 +1,47 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 Adafruit Industries LLC
+#
+# SPDX-License-Identifier: MIT
+
+"""Set IDF_CONSTRAINT_FILE for CI.
+
+CI installs requirements-dev.txt for all ports, but on Espressif builds we must
+also apply the matching ESP-IDF constraints file so pip does not upgrade shared
+packages (for example click) beyond what ESP-IDF allows. This script derives the
+active ESP-IDF major.minor version from version.cmake and exports the exact
+constraints file path into GITHUB_ENV for later install steps.
+"""
+
+import os
+import pathlib
+import re
+
+TOP = pathlib.Path(__file__).resolve().parent.parent
+
+
+def main() -> None:
+    version_cmake = TOP / "ports" / "espressif" / "esp-idf" / "tools" / "cmake" / "version.cmake"
+    data = version_cmake.read_text(encoding="utf-8")
+
+    major = re.search(r"IDF_VERSION_MAJOR\s+(\d+)", data)
+    minor = re.search(r"IDF_VERSION_MINOR\s+(\d+)", data)
+    if major is None or minor is None:
+        raise RuntimeError(f"Unable to parse IDF version from {version_cmake}")
+
+    idf_tools_path = os.environ.get("IDF_TOOLS_PATH")
+    if not idf_tools_path:
+        raise RuntimeError("IDF_TOOLS_PATH is not set")
+
+    constraint = (
+        pathlib.Path(idf_tools_path) / f"espidf.constraints.v{major.group(1)}.{minor.group(1)}.txt"
+    )
+
+    github_env = os.environ.get("GITHUB_ENV")
+    if github_env:
+        with open(github_env, "a", encoding="utf-8") as f:
+            f.write(f"IDF_CONSTRAINT_FILE={constraint}\n")
+
+    print(f"Set IDF_CONSTRAINT_FILE={constraint}")
+
+
+if __name__ == "__main__":
+    main()