diff --git a/.github/workflows/test-wolfhsm-simulator.yml b/.github/workflows/test-wolfhsm-simulator.yml
index c0a05b414e..9c97719af7 100644
--- a/.github/workflows/test-wolfhsm-simulator.yml
+++ b/.github/workflows/test-wolfhsm-simulator.yml
@@ -92,7 +92,9 @@ jobs:
           cd lib/wolfHSM/examples/posix/wh_posix_server
           if [ "${{ matrix.config.posix_server_nvminit }}" = "true" ]; then
             tmpfile=$(mktemp)
-            echo "obj 1 0xFFFF 0x0000 \"cert CA\" ../../../../../test-dummy-ca/root-cert.der" >> $tmpfile
+            # The server maps root CA ID 1 from client 1 to NVM ID 0x6101
+            # (cert type 0x6, client 1, ID 1)
+            echo "obj 0x6101 0xFFFF 0x0000 \"cert CA\" ../../../../../test-dummy-ca/root-cert.der" >> $tmpfile
             ./Build/wh_posix_server.elf --type tcp --nvminit $tmpfile &
           else
             # --flags=0x100 sets the WH_NVM_FLAGS_USAGE_VERIFY flag
@@ -108,8 +110,10 @@ jobs:
         run: |
           make -C lib/wolfHSM/tools/whnvmtool
           tmpfile=$(mktemp)
-          echo "obj 1 0xFFFF 0x0000 \"cert CA\" test-dummy-ca/root-cert.der" >> $tmpfile
-          ./lib/wolfHSM/tools/whnvmtool/whnvmtool --image=wolfBoot_wolfHSM_NVM.bin --size=16348 --invert-erased-byte $tmpfile
+          # Root CA at NVM ID 0x6101, the sim HAL default. --size must match
+          # partition_size in hal/sim.c
+          echo "obj 0x6101 0xFFFF 0x0000 \"cert CA\" test-dummy-ca/root-cert.der" >> $tmpfile
+          ./lib/wolfHSM/tools/whnvmtool/whnvmtool --image=wolfBoot_wolfHSM_NVM.bin --size=16384 --invert-erased-byte $tmpfile
 
       # Run the sunny day update test against the server
       - name: Run sunny day update test
diff --git a/arch.mk b/arch.mk
index 38f1c682c7..31b3818ee3 100644
--- a/arch.mk
+++ b/arch.mk
@@ -2630,6 +2630,9 @@ ifeq ($(ARCH), AURIX)
       # Older HT GCC 4.6 also flags WOLFBOOT_HDR_GET_U32() on byte arrays as
       # type-punning
       CFLAGS += -Wno-strict-aliasing
+      # HT TriCore GCC 4.9 flags a false maybe-uninitialized warning in
+      # wolfSSL's DirStringNext()
+      CFLAGS += -Wno-maybe-uninitialized
     endif
 
     # Set TC3_CFG_DFLASH_SINGLE_ENDED=1 for devices with DFLASH provisioned in single
diff --git a/docs/wolfHSM.md b/docs/wolfHSM.md
index a58177362f..dd3b052a93 100644
--- a/docs/wolfHSM.md
+++ b/docs/wolfHSM.md
@@ -94,7 +94,7 @@ This section describes the exposed configuration options available for wolfHSM i
 - `WOLFHSM_CLIENT_ID` (default 1): Client ID wolfBoot presents to the HSM server during the connection handshake. Must match the client ID the server provisions the wolfBoot public key under, e.g. the whnvmtool `key <clientId> ...` field or the example POSIX TCP server's `--client <id>` argument. Client mode only.
 - `WOLFHSM_CFG_COMM_DATA_LEN` (default 5000): Size in bytes of the wolfHSM message data payload. The default fits a whole DER certificate chain or the largest ML-DSA keys/signatures in a single message. Targets with a smaller transport slot must lower it in their `.config`. In server mode the value is currently only applied to `SIGN=ML_DSA` builds; other server builds use the wolfHSM library default.
 - `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS` (default 8): Maximum number of trusted root CA NVM IDs accepted for certificate chain verification; bounds the length of the HAL `hsmNvmIdCertRootCAList` and of `WOLFHSM_NVM_ROOT_CA_LIST`. Part of the client-server wire format (see note below).
-- `WOLFHSM_NVM_ROOT_CA_LIST` (default: HAL-provided list, `{ 1 }` for in-tree HALs): Overrides the NVM IDs of the trusted root CA certificates used for certificate chain verification. Takes a comma-separated initializer with no quotes and no spaces, e.g. `WOLFHSM_NVM_ROOT_CA_LIST=1,2,3`. The list length must not exceed `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS`. Only used when `CERT_CHAIN_VERIFY=1`.
+- `WOLFHSM_NVM_ROOT_CA_LIST`: Overrides the NVM IDs of the trusted root CA certificates used for certificate chain verification. Takes a comma-separated initializer with no quotes and no spaces, e.g. `WOLFHSM_NVM_ROOT_CA_LIST=1,2,3`. Client mode takes the client's cert IDs (e.g. `1`); server mode takes full NVM IDs (e.g. `0x6101`). The list length must not exceed `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS`. Only used when `CERT_CHAIN_VERIFY=1`.
 - `WOLFHSM_NVM_IMAGE` (default 1): Set to 0 to skip wolfHSM NVM image generation. Used by targets that do not provision keys from a pre-built NVM image, e.g. because the HAL loads the verification key into the server's key cache at boot (PIC32CZ).
 - `USER_NVM_INIT`: Path to a user-provided whnvmtool `.nvminit` file used to generate the wolfHSM NVM image in place of the default auto-generated one. Also re-enables NVM image generation when user-provided keys (`USER_PRIVATE_KEY`, `USER_PUBLIC_KEY`, `USER_CERT_CHAIN`) would otherwise skip it.
 
@@ -122,7 +122,7 @@ In addition to the standard wolfBoot HAL functions, wolfHSM-enabled platforms mu
 - `hsmDevIdHash`: The HSM device ID for hash operations. This is used to identify the HSM device to wolfBoot.
 - `hsmDevIdPubKey`: The HSM device ID for public key operations. This is used to identify the HSM device to wolfBoot.
 - `hsmKeyIdPubKey`: The HSM key ID for public key operations. This is used to identify the key to use for public key operations.
-- `hsmNvmIdCertRootCAList` / `hsmNvmIdCertRootCACount`: Array of NVM IDs identifying the trusted root CA certificate(s) and its element count. Only used when building with `WOLFBOOT_CERT_CHAIN_VERIFY`. The chain in the firmware header may anchor to any of the listed roots; the count is bounded by `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS`. Each in-tree HAL provides a default of `{ 1 }`; override the list with the `WOLFHSM_NVM_ROOT_CA_LIST` build option, which is propagated to the HAL as `-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST=...` (see [Build Options](#build-options-config)).
+- `hsmNvmIdCertRootCAList` / `hsmNvmIdCertRootCACount`: Array of NVM IDs identifying the trusted root CA certificate(s) and its element count. Only used when building with `WOLFBOOT_CERT_CHAIN_VERIFY`. The chain in the firmware header may anchor to any of the listed roots; the count is bounded by `WOLFHSM_CFG_CERT_MAX_VERIFY_ROOTS`. In-tree HALs default to `{ 1 }` in client mode, which the server maps to NVM ID `0x6101` for client 1 (cert type `0x6`, client 1, ID 1), and to `{ 0x6101 }` in server mode, which uses full NVM IDs; override the list with the `WOLFHSM_NVM_ROOT_CA_LIST` build option, which is propagated to the HAL as `-DWOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST=...` (see [Build Options](#build-options-config)).
 
 ### Client HAL Functions
 
@@ -255,9 +255,10 @@ When using wolfHSM server mode, no external server is required. wolfBoot include
 
 ```sh
 # Create a simulated NVM image for the POSIX flash file simulator containing the dummy root CA for cert chain verification.
-# You must build whnvmtool first if you haven't already, and ensure the file name matches the simulated NVM image file
-# name in hal/sim.c
-./lib/wolfHSM/tools/whnvmtool/whnvmtool --image=wolfBoot_wolfHSM_NVM.bin --size 16348 --invert-erased-byte tools/scripts/wolfBoot-wolfHSM-sim-dummy-certchain.nvminit
+# You must build whnvmtool first if you haven't already, and ensure the file name and partition size match the
+# simulated NVM image in hal/sim.c. The root CA goes at NVM ID 0x6101, the sim HAL's default root CA list.
+echo 'obj 0x6101 0xFFFF 0x0000 "cert CA" test-dummy-ca/root-cert.der' > sim-dummy-certchain.nvminit
+./lib/wolfHSM/tools/whnvmtool/whnvmtool --image=wolfBoot_wolfHSM_NVM.bin --size 16384 --invert-erased-byte sim-dummy-certchain.nvminit
 
 # Run the wolfBoot simulator with embedded wolfHSM server to stage an update
 ./wolfboot.elf update_trigger get_version
diff --git a/hal/aurix_tc3xx.c b/hal/aurix_tc3xx.c
index 466d7acf97..ea695be793 100644
--- a/hal/aurix_tc3xx.c
+++ b/hal/aurix_tc3xx.c
@@ -137,9 +137,11 @@ const uint16_t hsmNvmIdCertRootCACount  =
 const int      hsmDevIdHash             = HSM_DEVID;
 const int      hsmDevIdPubKey           = HSM_DEVID;
 /* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command
- * line) to override the default single-root list. */
+ * line) to override the default single-root list. The server uses full NVM
+ * IDs: 0x6101 is cert root 1 of client 1, matching
+ * tools/scripts/tc3xx/wolfBoot-wolfHSM-dummy-certchain.nvminit. */
 #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST
-#define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1
+#define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 0x6101
 #endif
 const whNvmId  hsmNvmIdCertRootCAList[] = { WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST };
 const uint16_t hsmNvmIdCertRootCACount  =
diff --git a/hal/sim.c b/hal/sim.c
index 63725aecba..f83e996bd5 100644
--- a/hal/sim.c
+++ b/hal/sim.c
@@ -303,9 +303,10 @@ whServerContext hsmServerCtx = {0};
 const int      hsmDevIdHash             = INVALID_DEVID;
 const int      hsmDevIdPubKey           = INVALID_DEVID;
 /* Set WOLFHSM_NVM_ROOT_CA_LIST=1,2,3 in .config (or pass on the make command
- * line) to override the default single-root list. */
+ * line) to override the default single-root list. The server uses full NVM
+ * IDs: 0x6101 is cert root 1 of client 1. */
 #ifndef WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST
-#define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 1
+#define WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST 0x6101
 #endif
 const whNvmId  hsmNvmIdCertRootCAList[] = { WOLFBOOT_WOLFHSM_NVM_ROOT_CA_LIST };
 const uint16_t hsmNvmIdCertRootCACount  =
diff --git a/lib/wolfHSM b/lib/wolfHSM
index 86dd6df045..8bb2b0f0fd 160000
--- a/lib/wolfHSM
+++ b/lib/wolfHSM
@@ -1 +1 @@
-Subproject commit 86dd6df04572b5d457da4a86f12750b93cf83bf4
+Subproject commit 8bb2b0f0fdcc18a9e9898017139f7bdc1cc16ecb
diff --git a/tools/scripts/tc3xx/wolfBoot-wolfHSM-dummy-certchain.nvminit b/tools/scripts/tc3xx/wolfBoot-wolfHSM-dummy-certchain.nvminit
index 8c4661434c..23d3bfd78b 100644
--- a/tools/scripts/tc3xx/wolfBoot-wolfHSM-dummy-certchain.nvminit
+++ b/tools/scripts/tc3xx/wolfBoot-wolfHSM-dummy-certchain.nvminit
@@ -1,2 +1,7 @@
 # NVM config file for wolfHSM whnvmtool to create NVM image based on generated keys
-obj 1 0xFFFF 0x0100 "cert CA" test-dummy-ca/root-cert.der
+#
+# The root CA ID is 0x6101: cert type (0x6), client 1, ID 1. The client portion
+# must match the wolfBoot client's WOLFHSM_CLIENT_ID (options.mk default 1).
+#
+# Flags 0x0901 = USAGE_VERIFY | NONMODIFIABLE | NONDESTROYABLE
+obj 0x6101 0xFFFF 0x0901 "cert CA" test-dummy-ca/root-cert.der