diff --git a/components/esp_security/src/init.c b/components/esp_security/src/init.c
index 237bb03753..8413e5b351 100644
--- a/components/esp_security/src/init.c
+++ b/components/esp_security/src/init.c
@@ -102,10 +102,13 @@ ESP_SYSTEM_INIT_FN(esp_security_init, SECONDARY, BIT(0), 103)
 
 #if !CONFIG_SECURE_BOOT_SKIP_WRITE_PROTECTION_SCA
 // C5
-#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS
+#if SOC_ECDSA_SUPPORT_CURVE_P384 && !CONFIG_SECURE_BOOT_ECDSA_KEY_LEN_384_BITS && !CONFIG_IDF_TARGET_ESP32P4
     // Since SECURE_BOOT_SHA384_EN, XTS_DPA_PSEUDO_LEVEL, and ECC_FORCE_CONST_TIME share the
     // same write-protection bit, these efuses should only be write-protected after all of
     // them have been programmed.
+    // Note: ESP32-P4 lacks WR_DIS_SECURE_BOOT_SHA384_EN bit, so it relies on software protection
+    // in the efuse write APIs (see esp_efuse_api.c) to prevent unauthorized programming of
+    // SECURE_BOOT_SHA384_EN when Secure Boot using SHA-256 is enabled.
     err = esp_efuse_write_field_bit(ESP_EFUSE_WR_DIS_SECURE_BOOT_SHA384_EN);
     if (err != ESP_OK) {
         ESP_LOGE(TAG, "Failed to write protect the SECURE_BOOT_SHA384_EN efuse bit.");