diff --git a/sdkconfig.defaults b/sdkconfig.defaults
index 0ef90f6..03f4dec 100644
--- a/sdkconfig.defaults
+++ b/sdkconfig.defaults
@@ -212,8 +212,9 @@ CONFIG_MULTIMODAL_WS_JSON_TASK_STACK_BYTES=8192
 CONFIG_MULTIMODAL_WS_OPUS_TASK_STACK_BYTES=12288
 CONFIG_MULTIMODAL_WS_MSG_QUEUE_LEN=512
 CONFIG_MULTIMODAL_RECONNECT_DELAY_MS=2000
-# Keep both symbols for compatibility; defaults follow doc behavior.
-# Disable separate TX lock for stability; single lock avoids close/send race under high-frequency uplink.
+# Keep the separate TX lock so realtime uplink writes do not contend with the
+# WebSocket receive loop. TLS renegotiation is disabled below so a concurrent
+# write cannot inspect a dynamically released RX record counter.
 CONFIG_ESP_WS_CLIENT_SEPARATE_TX_LOCK=y
 CONFIG_ESP_WS_CLIENT_TX_LOCK_TIMEOUT_MS=2000
 # mbedTLS certificate parsing and dynamic record buffers otherwise compete for
@@ -222,6 +223,10 @@ CONFIG_ESP_WS_CLIENT_TX_LOCK_TIMEOUT_MS=2000
 # CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
 CONFIG_MBEDTLS_DEFAULT_MEM_ALLOC=y
 CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
+# TLS renegotiation is not used by the device's HTTPS/WSS clients. With dynamic
+# TLS buffers and concurrent WebSocket RX/TX, its write-side counter check can
+# observe a released RX buffer and dereference a null in_ctr pointer.
+# CONFIG_MBEDTLS_SSL_RENEGOTIATION is not set
 # Keep inbound TLS large enough for certificate handshake records while still
 # capping outbound request records. The token endpoint currently sends a
 # certificate handshake message larger than 4 KB, which mbedTLS reports as