diff --git a/modules/openthread/platform/diag.c b/modules/openthread/platform/diag.c
index 79f4e38984af..3bd4b549536b 100644
--- a/modules/openthread/platform/diag.c
+++ b/modules/openthread/platform/diag.c
@@ -90,10 +90,16 @@ otError otPlatDiagProcess(otInstance *aInstance, uint8_t aArgsLength, char *aArg
 
 void otPlatDiagModeSet(bool aMode)
 {
+	otError error;
+
 	sDiagMode = aMode;
 
 	if (!sDiagMode) {
-		otPlatRadioSleep(NULL);
+		error = otPlatRadioSleep(NULL);
+		if (error != OT_ERROR_NONE) {
+			otPlatLog(OT_LOG_LEVEL_WARN, OT_LOG_REGION_PLATFORM,
+				  "%s failed (%d)", "otPlatRadioSleep", error);
+		}
 	}
 }
 
@@ -345,6 +351,7 @@ static otError startModCarrier(otInstance *aInstance, uint8_t aArgsLength, char
 void otPlatDiagAlarmCallback(otInstance *aInstance)
 {
 	uint32_t now;
+	otError error;
 	otRadioFrame *txPacket;
 	const uint16_t diag_packet_len = 30;
 
@@ -370,7 +377,11 @@ void otPlatDiagAlarmCallback(otInstance *aInstance)
 				txPacket->mPsdu[i] = i;
 			}
 
-			otPlatRadioTransmit(aInstance, txPacket);
+			error = otPlatRadioTransmit(aInstance, txPacket);
+			if (error != OT_ERROR_NONE) {
+				otPlatLog(OT_LOG_LEVEL_WARN, OT_LOG_REGION_PLATFORM,
+					  "%s failed (%d)", "otPlatRadioTransmit", error);
+			}
 
 			if (sTxCount != -1) {
 				sTxCount--;
@@ -405,8 +416,11 @@ static otError processTransmit(otInstance *aInstance, uint8_t aArgsLength, char
 		otPlatAlarmMilliStop(aInstance);
 		diag_output("diagnostic message transmission is stopped\r\n");
 		sTransmitMode = DIAG_TRANSMIT_MODE_IDLE;
-		otPlatRadioReceive(aInstance, sChannel);
-
+		error = otPlatRadioReceive(aInstance, sChannel);
+		if (error != OT_ERROR_NONE) {
+			otPlatLog(OT_LOG_LEVEL_WARN, OT_LOG_REGION_PLATFORM,
+				  "%s failed (%d)", "otPlatRadioReceive", error);
+		}
 	} else if (strcmp(aArgs[0], "start") == 0) {
 		if (sTransmitMode != DIAG_TRANSMIT_MODE_IDLE) {
 			return OT_ERROR_INVALID_STATE;
diff --git a/subsys/net/openthread/rpc/server/ot_rpc_netdiag.c b/subsys/net/openthread/rpc/server/ot_rpc_netdiag.c
index e204b94ed187..03a102c51357 100644
--- a/subsys/net/openthread/rpc/server/ot_rpc_netdiag.c
+++ b/subsys/net/openthread/rpc/server/ot_rpc_netdiag.c
@@ -72,6 +72,7 @@ static size_t ot_rpc_network_diag_tlv_size(otNetworkDiagTlv *aNetworkDiagTlv)
 static void ot_rpc_encode_network_diag_tlv(struct nrf_rpc_cbor_ctx *ctx,
 					   otNetworkDiagTlv *aNetworkDiagTlv)
 {
+	uint8_t mode;
 	nrf_rpc_encode_uint(ctx, aNetworkDiagTlv->mType);
 
 	switch (aNetworkDiagTlv->mType) {
@@ -83,7 +84,7 @@ static void ot_rpc_encode_network_diag_tlv(struct nrf_rpc_cbor_ctx *ctx,
 		nrf_rpc_encode_buffer(ctx, aNetworkDiagTlv->mData.mEui64.m8, OT_EXT_ADDRESS_SIZE);
 		break;
 	case OT_NETWORK_DIAGNOSTIC_TLV_MODE:
-		uint8_t mode = 0;
+		mode = 0;
 
 		WRITE_BIT(mode, 0, aNetworkDiagTlv->mData.mMode.mRxOnWhenIdle);
 		WRITE_BIT(mode, 1, aNetworkDiagTlv->mData.mMode.mDeviceType);
@@ -210,7 +211,7 @@ static void ot_rpc_encode_network_diag_tlv(struct nrf_rpc_cbor_ctx *ctx,
 		nrf_rpc_encode_uint(ctx, aNetworkDiagTlv->mData.mChildTable.mCount);
 		zcbor_list_start_encode(ctx->zs, aNetworkDiagTlv->mData.mChildTable.mCount);
 		for (int i = 0; i < aNetworkDiagTlv->mData.mChildTable.mCount; i++) {
-			uint8_t mode = 0;
+			mode = 0;
 
 			nrf_rpc_encode_uint(ctx,
 				aNetworkDiagTlv->mData.mChildTable.mTable[i].mTimeout);
diff --git a/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ecdsa.c b/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ecdsa.c
index 93a9180651da..33fc3b317b20 100644
--- a/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ecdsa.c
+++ b/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/ecdsa.c
@@ -370,6 +370,7 @@ static int run_deterministic_ecdsa_hmac_step(const struct sxhashalg *hashalg, si
 	uint8_t *V = K + digestsz;
 	uint8_t *T = V + digestsz;
 	uint8_t step = hmac_op->step;
+	size_t copylen;
 
 	switch (step) {
 	case 0: /* K = HMAC_K(V || 0x00 || privkey || h1) */
@@ -404,7 +405,7 @@ static int run_deterministic_ecdsa_hmac_step(const struct sxhashalg *hashalg, si
 		break;
 
 	case 5: /* T = T || V */
-		size_t copylen = MIN(digestsz, opsz - hmac_op->tlen);
+		copylen = MIN(digestsz, opsz - hmac_op->tlen);
 
 		memcpy(T + hmac_op->tlen, V, copylen);
 		hmac_op->tlen += copylen;
diff --git a/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c b/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c
index 14cc6a276845..128b42be5421 100644
--- a/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c
+++ b/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c
@@ -294,11 +294,14 @@ static psa_status_t get_kmu_slot_id_and_metadata(mbedtls_svc_key_id_t key_id,
 	return read_primary_slot_metadata(*slot_id, metadata);
 }
 
+#if defined(CONFIG_PSA_WANT_ALG_PURE_EDDSA) || defined(CONFIG_PSA_WANT_ALG_ED25519PH) || \
+	defined CONFIG_PSA_WANT_ALG_ECDSA || defined(CONFIG_PSA_WANT_ALG_HMAC)
 static bool can_sign(const psa_key_attributes_t *key_attr)
 {
 	return (psa_get_key_usage_flags(key_attr) & PSA_KEY_USAGE_SIGN_MESSAGE) ||
 	       (psa_get_key_usage_flags(key_attr) & PSA_KEY_USAGE_SIGN_HASH);
 }
+#endif /* defined(CONFIG_PSA_WANT_ALG_PURE_EDDSA) || define(CONFIG_PSA_WANT_ALG_ED25519PH) */
 
 /**
  * @brief Check provisioning state, and delete slots that were not completely provisioned.
diff --git a/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c b/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c
index 77c81e5ebb46..fcf305b47f8d 100644
--- a/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c
+++ b/subsys/nrf_security/src/drivers/cracen/cracenpsa/src/sign.c
@@ -38,6 +38,7 @@
 #define SI_PSA_IS_KEY_FLAG(flag, attr) ((flag) == (psa_get_key_usage_flags((attr)) & (flag)))
 #define SI_PSA_IS_KEY_TYPE(flag, attr) ((flag) == (psa_get_key_type((attr)) & (flag)))
 
+#if PSA_MAX_RSA_KEY_BITS > 0
 static int cracen_signature_set_hashalgo(const struct sxhashalg **hashalg, psa_algorithm_t alg)
 {
 	return hash_get_algo(PSA_ALG_SIGN_GET_HASH(alg), hashalg);
@@ -81,6 +82,7 @@ static int cracen_signature_set_hashalgo_from_digestsz(const struct sxhashalg **
 
 	return SX_OK;
 }
+#endif /* PSA_MAX_RSA_KEY_BITS > 0 */
 
 static int cracen_signature_prepare_ec_prvkey(struct si_sig_privkey *privkey, char *key_buffer,
 					      size_t key_buffer_size,
diff --git a/west.yml b/west.yml
index baa794cef5c9..10b6901af60f 100644
--- a/west.yml
+++ b/west.yml
@@ -144,7 +144,7 @@ manifest:
     - name: nrfxlib
       repo-path: sdk-nrfxlib
       path: nrfxlib
-      revision: 5df35f66f3c0a63a0b451499ee4466327b707a74
+      revision: 864943e7301aa90eb684829f10905e910e844f18
     - name: trusted-firmware-m
       repo-path: sdk-trusted-firmware-m
       path: modules/tee/tf-m/trusted-firmware-m