diff --git a/MODULE.bazel b/MODULE.bazel
index d3afd78ff..93847f91d 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -114,7 +114,7 @@ new_git_repository(
 new_git_repository(
     name = "lwip",
     build_file = "//src/rp2_common/pico_lwip:lwip.BUILD",
-    commit = "0a0452b2c39bdd91e252aef045c115f88f6ca773",  # keep-in-sync-with-submodule: lib/lwip
+    commit = "77dcd25a72509eb83f72b033d219b1d40cd8eb95",  # keep-in-sync-with-submodule: lib/lwip
     remote = "https://github.com/lwip-tcpip/lwip.git",
 )
 
diff --git a/docs/index.h b/docs/index.h
index a4f88a431..be52f6a0d 100644
--- a/docs/index.h
+++ b/docs/index.h
@@ -80,6 +80,7 @@
  * \defgroup tinyusb_device tinyusb_device
  * \defgroup tinyusb_host tinyusb_host
  * \endcond
+ * \cond pico_mbedtls \defgroup pico_mbedtls pico_mbedtls \endcond
  * @}
  *
  * \defgroup networking Networking Libraries
diff --git a/lib/lwip b/lib/lwip
index 0a0452b2c..77dcd25a7 160000
--- a/lib/lwip
+++ b/lib/lwip
@@ -1 +1 @@
-Subproject commit 0a0452b2c39bdd91e252aef045c115f88f6ca773
+Subproject commit 77dcd25a72509eb83f72b033d219b1d40cd8eb95
diff --git a/src/rp2_common/pico_btstack/CMakeLists.txt b/src/rp2_common/pico_btstack/CMakeLists.txt
index dcfcad4fe..7c277bd67 100644
--- a/src/rp2_common/pico_btstack/CMakeLists.txt
+++ b/src/rp2_common/pico_btstack/CMakeLists.txt
@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_BTSTACK_PATH, Path to an alternative version of btstack overriding the version in pico-sdk/libs/btstack. Can be passed to cmake or set in your environment, type=string, group=pico_btstack
 if (DEFINED ENV{PICO_BTSTACK_PATH} AND (NOT PICO_BTSTACK_PATH))
     set(PICO_BTSTACK_PATH $ENV{PICO_BTSTACK_PATH})
     message("Using PICO_BTSTACK_PATH from environment ('${PICO_BTSTACK_PATH}')")
diff --git a/src/rp2_common/pico_cyw43_driver/CMakeLists.txt b/src/rp2_common/pico_cyw43_driver/CMakeLists.txt
index 289a22ab4..13ac2043c 100644
--- a/src/rp2_common/pico_cyw43_driver/CMakeLists.txt
+++ b/src/rp2_common/pico_cyw43_driver/CMakeLists.txt
@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_CYW43_DRIVER_PATH, Path to an alternative version of cyw43-driver overriding the version in pico-sdk/libs/cyw43-driver, type=string, group=pico_cyw43_driver
 if (DEFINED ENV{PICO_CYW43_DRIVER_PATH} AND (NOT PICO_CYW43_DRIVER_PATH))
     set(PICO_CYW43_DRIVER_PATH $ENV{PICO_CYW43_DRIVER_PATH})
     message("Using PICO_CYW43_DRIVER_PATH from environment ('${PICO_CYW43_DRIVER_PATH}')")
diff --git a/src/rp2_common/pico_lwip/CMakeLists.txt b/src/rp2_common/pico_lwip/CMakeLists.txt
index e412f3727..e22b7e4f7 100644
--- a/src/rp2_common/pico_lwip/CMakeLists.txt
+++ b/src/rp2_common/pico_lwip/CMakeLists.txt
@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_LWIP_PATH, Path to an alternative version of lwip overriding the version in pico-sdk/libs/lwip. Can be passed to cmake or set in your environment, type=string, group=pico_lwip
 if (DEFINED ENV{PICO_LWIP_PATH} AND (NOT PICO_LWIP_PATH))
     set(PICO_LWIP_PATH $ENV{PICO_LWIP_PATH})
     message("Using PICO_LWIP_PATH from environment ('${PICO_LWIP_PATH}')")
diff --git a/src/rp2_common/pico_mbedtls/CMakeLists.txt b/src/rp2_common/pico_mbedtls/CMakeLists.txt
index 13976d6fb..ce5595629 100644
--- a/src/rp2_common/pico_mbedtls/CMakeLists.txt
+++ b/src/rp2_common/pico_mbedtls/CMakeLists.txt
@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_MBEDTLS_PATH, Path to an alternative version of mbedtls overriding the version in pico-sdk/libs/mbedtls. Can be passed to cmake or set in your environment, type=string, group=pico_mbedtls
 if (DEFINED ENV{PICO_MBEDTLS_PATH} AND (NOT PICO_MBEDTLS_PATH))
     set(PICO_MBEDTLS_PATH $ENV{PICO_MBEDTLS_PATH})
     message("Using PICO_MBEDTLS_PATH from environment ('${PICO_MBEDTLS_PATH}')")
diff --git a/src/rp2_common/pico_mbedtls/doc.h b/src/rp2_common/pico_mbedtls/doc.h
new file mode 100644
index 000000000..91591fc99
--- /dev/null
+++ b/src/rp2_common/pico_mbedtls/doc.h
@@ -0,0 +1,11 @@
+/**
+ * \defgroup pico_mbedtls pico_mbedtls
+ * \brief pico-sdk wrapper library for <a href="https://github.com/Mbed-TLS/mbedtls.git">mbedtls</a>
+ * the documentation for which is <a href="https://mbed-tls.readthedocs.io/en/latest/">here</a>.
+ *
+ * Builds mbedtls for pico-sdk and implements functions to take advantage of hardware support, if enabled in mbedtls_config.h
+ * 
+ * * \c \b MBEDTLS_ENTROPY_HARDWARE_ALT, implementation of a hardware entropy collector that uses \ref get_rand_64
+ * * \c \b MBEDTLS_SHA256_ALT, use SHA256 hardware acceleration. Only valid if LIB_PICO_SHA256 is defined (i.e. not available for rp2040)
+ *
+ */
diff --git a/src/rp2_common/pico_mbedtls/pico_mbedtls.c b/src/rp2_common/pico_mbedtls/pico_mbedtls.c
index 853d97cdf..03a41da47 100644
--- a/src/rp2_common/pico_mbedtls/pico_mbedtls.c
+++ b/src/rp2_common/pico_mbedtls/pico_mbedtls.c
@@ -27,7 +27,7 @@ int mbedtls_hardware_poll(void *data __unused, unsigned char *output, size_t len
 #error SHA256 hardware acceleration not supported
 #endif
 
-// PICO_CONFIG: PICO_MBEDTLS_SHA256_ALT_USE_DMA, Whether to use DMA for writing to hardware for the mbedtls SHA-256 hardware acceleration, type=int, default=1, group=pico_stdlib
+// PICO_CONFIG: PICO_MBEDTLS_SHA256_ALT_USE_DMA, Whether to use DMA for writing to hardware for the mbedtls SHA-256 hardware acceleration, type=int, default=1, group=pico_mbedtls
 #ifndef PICO_MBEDTLS_SHA256_ALT_USE_DMA
 #define PICO_MBEDTLS_SHA256_ALT_USE_DMA 1
 #endif
diff --git a/src/rp2_common/tinyusb/CMakeLists.txt b/src/rp2_common/tinyusb/CMakeLists.txt
index e305b36c0..88c79b8af 100644
--- a/src/rp2_common/tinyusb/CMakeLists.txt
+++ b/src/rp2_common/tinyusb/CMakeLists.txt
@@ -1,3 +1,4 @@
+# PICO_CMAKE_CONFIG: PICO_TINYUSB_PATH, Path to an alternative version of tinyusb overriding the version in pico-sdk/libs/tinyusb. Can be passed to cmake or set in your environment, type=string, group=tinyusb_device
 if (DEFINED ENV{PICO_TINYUSB_PATH} AND (NOT PICO_TINYUSB_PATH))
     set(PICO_TINYUSB_PATH $ENV{PICO_TINYUSB_PATH})
     message("Using PICO_TINYUSB_PATH from environment ('${PICO_TINYUSB_PATH}')")