diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 890fee43b2..d5ce7a55b4 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -83,9 +83,12 @@ static void mbedtls_async_hardware_ssl_aead_callback(int success, void *context)
 /**
  * @brief Return whether the transform has explicit async hardware AEAD metadata.
  *
- * @todo Extend the provider dispatch behind this metadata for AES-256-GCM,
- * AES-CCM, AES-CCM-8, and ChaCha20-Poly1305. Until then those algorithms are
- * intentional fail-closed stubs instead of PSA/software fallbacks.
+ * AES-GCM and ChaCha20-Poly1305 transforms are represented through the
+ * generic async AEAD boundary. Providers that do not implement a classified
+ * algorithm fail closed instead of falling back to PSA/software.
+ *
+ * @todo Extend this direct transform configuration path for AES-CCM and
+ * AES-CCM-8 once those suites are wired through this helper.
  */
 static int mbedtls_async_hardware_ssl_transform_has_aead(
     const mbedtls_ssl_transform *transform)
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index e9a6fe71be..0a2f83aa16 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -7761,10 +7761,10 @@ static mbedtls_tls_prf_types tls_prf_get_type(mbedtls_ssl_tls_prf_cb *tls_prf)
 /**
  * @brief Map Mbed TLS/PSA record parameters to async hardware TLS AEAD capabilities.
  *
- * @todo Wire AES-256-GCM, AES-CCM, AES-CCM-8, and ChaCha20-Poly1305 to
- * hardware-backed provider operations. They are classified here so production
- * hardware builds fail closed through the generic AEAD boundary instead of
- * silently falling back to PSA/software.
+ * TLS 1.2 AEAD transforms are classified into the generic async hardware
+ * provider algorithm IDs. Providers that do not implement a classified
+ * algorithm fail closed through the generic AEAD boundary instead of silently
+ * falling back to PSA/software.
  */
 static int mbedtls_async_hardware_tls_aead_from_transform(psa_key_type_t key_type,
                                                  size_t keylen,
diff --git a/tf-psa-crypto b/tf-psa-crypto
index 0d37f22725..2a327c5e75 160000
--- a/tf-psa-crypto
+++ b/tf-psa-crypto
@@ -1 +1 @@
-Subproject commit 0d37f227257545bca1dc9cceacbd65a79688aded
+Subproject commit 2a327c5e75f1c87d205370fc967732e674a22a69