diff --git a/.config.ci b/.config.ci
index 346a7e9..e9593c0 100644
--- a/.config.ci
+++ b/.config.ci
@@ -2,7 +2,6 @@ CONFIG_ALL=n
 CONFIG_AUTOREMOVE=n
 CONFIG_AUTOREBUILD=n
 CONFIG_BUILD_LOG=y
-CONFIG_MBEDTLS_CCM_C=y
 CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED=y
 CONFIG_OPENTHREADBR_SHARED_MBEDTLS=y
 CONFIG_PACKAGE_matter-netman-mbedtls=m
diff --git a/service/matter-netman/Makefile b/service/matter-netman/Makefile
index e8af89c..09239f2 100644
--- a/service/matter-netman/Makefile
+++ b/service/matter-netman/Makefile
@@ -15,7 +15,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=matter-netman
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 PKG_SOURCE_URL:=https://github.com/project-chip/connectedhomeip.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBMODULES:=\
@@ -25,9 +25,9 @@ PKG_SOURCE_SUBMODULES:=\
   third_party/nlio/repo
 
 # Hash can be regenerated with make package/matter-netman/check FIXUP=1
-PKG_SOURCE_DATE:=2026-06-13
-PKG_SOURCE_VERSION:=b39eff6ed09e92344c3c6cc9a5a1b495a469bbfd
-PKG_MIRROR_HASH:=cc87d6df5cc945309bea4c810ba90081fa59dfaaa1daedf9fa199d17e3f313f8
+PKG_SOURCE_DATE:=2026-07-30
+PKG_SOURCE_VERSION:=72ecdc2bca57e99b3defea68eb3bcc5bd8bebdbd
+PKG_MIRROR_HASH:=6812910e012294a9b812bc7550e352e981627e8bec932d3634e098be68ebe7fb
 
 # Use local source dir for development
 # USE_SOURCE_DIR:=$(HOME)/workspace/connectedhomeip
@@ -50,18 +50,37 @@ define Package/matter-netman/default
   TITLE:=Matter Network Infrastructure Manager Daemon
   URL:=https://github.com/project-chip/connectedhomeip
   DEPENDS:=+libstdcpp +libatomic +libubus +libubox +jsonfilter
+  PROVIDES:=matter-netman
   USERID:=matter:matter
 endef
 
 define Package/matter-netman/default/description
   Matter Network Infrastructure Manager Daemon
   Integrates a router / access point with the Matter IoT ecosystem.
+
+  This is an uncertified build. It identifies itself with the Connectivity
+  Standards Alliance test vendor id 0xFFF1 and product id 0x8013, and it
+  attests with the Matter SDK's development attestation certificate for that
+  pair.
+
+  That certificate is shared, not unique to this device: the same one ships
+  in every build of the example, and its private key is published in the SDK
+  source. Device attestation therefore cannot distinguish this router from
+  any other node presenting the same credential, and successful attestation
+  says nothing about who built the device or what software is running on it.
+  The certificate also chains to a development root rather than a production
+  one, so whether a controller accepts it silently, warns, or refuses depends
+  on which roots that controller trusts.
+
+  The manufacturer and product names reported in Basic Information are read
+  from the firmware and describe who built it. They are accurate, and they
+  are not backed by any Matter certification.
 endef
 
 define Package/matter-netman-mbedtls
   $(Package/matter-netman/default)
   TITLE+= (mbedtls)
-  DEPENDS+= +PACKAGE_matter-netman-mbedtls:libmbedtls
+  DEPENDS+= +PACKAGE_matter-netman-mbedtls:libmbedtls +@MBEDTLS_CCM_C
   VARIANT:=mbedtls
   DEFAULT_VARIANT:=1
 endef
@@ -69,8 +88,9 @@ endef
 define Package/matter-netman-mbedtls/description
 $(Package/matter-netman/default/description)
 
-This variant of the package uses the mbedTLS crypto library,
-which must have the MBEDTLS_CCM_C option enabled.
+This variant of the package uses the mbedTLS crypto library. It turns on
+that library's MBEDTLS_CCM_C option, which OpenWrt leaves off by default
+and which the AES-CCM cipher of the Matter message layer requires.
 endef
 
 define Package/matter-netman-openssl