diff --git a/src/cli/cli_config.h b/src/cli/cli_config.h
index ac9b5e1cc..0eb9b2d08 100644
--- a/src/cli/cli_config.h
+++ b/src/cli/cli_config.h
@@ -196,4 +196,14 @@
 #define OPENTHREAD_CONFIG_CLI_REGISTER_IP6_RECV_CALLBACK 0
 #endif
 
+/**
+ * @def OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE
+ *
+ * Define to 1 to enable BLE secure support.
+ *
+ */
+#ifndef OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE
+#define OPENTHREAD_CONFIG_CLI_BLE_SECURE_ENABLE 0
+#endif
+
 #endif // CONFIG_CLI_H_
diff --git a/src/core/config/ip6.h b/src/core/config/ip6.h
index 94cfaa5b7..263190033 100644
--- a/src/core/config/ip6.h
+++ b/src/core/config/ip6.h
@@ -46,6 +46,7 @@
  */
 
 #include "config/border_routing.h"
+#include "config/misc.h"
 
 /**
  * @def OPENTHREAD_CONFIG_IP6_MAX_EXT_UCAST_ADDRS
@@ -188,8 +189,8 @@
  * Define as 1 to enable support for TLS over TCP.
  *
  */
-#if (OPENTHREAD_CONFIG_TCP_ENABLE || OPENTHREAD_CONFIG_BLE_TCAT_ENABLE) && !defined(OPENTHREAD_CONFIG_TLS_ENABLE)
-#define OPENTHREAD_CONFIG_TLS_ENABLE 1
+#ifndef OPENTHREAD_CONFIG_TLS_ENABLE
+#define OPENTHREAD_CONFIG_TLS_ENABLE (OPENTHREAD_CONFIG_TCP_ENABLE || OPENTHREAD_CONFIG_BLE_TCAT_ENABLE)
 #endif
 
 /**
diff --git a/src/core/config/misc.h b/src/core/config/misc.h
index c39fa8410..b04e32ea6 100644
--- a/src/core/config/misc.h
+++ b/src/core/config/misc.h
@@ -582,6 +582,16 @@
 #define OPENTHREAD_CONFIG_OPERATIONAL_DATASET_AUTO_INIT 0
 #endif
 
+/**
+ * @def OPENTHREAD_CONFIG_BLE_TCAT_ENABLE
+ *
+ * Define to 1 to enable TCAT over BLE support.
+ *
+ */
+#ifndef OPENTHREAD_CONFIG_BLE_TCAT_ENABLE
+#define OPENTHREAD_CONFIG_BLE_TCAT_ENABLE 0
+#endif
+
 /**
  * @}
  *