diff --git a/etc/cmake/options.cmake b/etc/cmake/options.cmake
index 4b6c0bb7c97..75fdc1ef43c 100644
--- a/etc/cmake/options.cmake
+++ b/etc/cmake/options.cmake
@@ -108,7 +108,7 @@ if(OTBR_TREL)
     target_compile_definitions(otbr-config INTERFACE OTBR_ENABLE_TREL=1)
 endif()
 
-option(OTBR_EPSKC "Enable ephemeral PSKc" ON)
+option(OTBR_EPSKC "Enable ephemeral PSKc" OFF)
 if (OTBR_EPSKC)
     target_compile_definitions(otbr-config INTERFACE OTBR_ENABLE_EPSKC=1)
 else()
diff --git a/etc/docker/Dockerfile b/etc/docker/Dockerfile
index b4eed1f92cd..3af9860b0d0 100644
--- a/etc/docker/Dockerfile
+++ b/etc/docker/Dockerfile
@@ -32,6 +32,7 @@ ARG INFRA_IF_NAME
 ARG BORDER_ROUTING
 ARG BACKBONE_ROUTER
 ARG OT_BACKBONE_CI
+ARG OTBR_EPSKC
 ARG OTBR_OPTIONS
 ARG DNS64
 ARG NAT64
@@ -48,6 +49,7 @@ ENV INFRA_IF_NAME=${INFRA_IF_NAME:-eth0}
 ENV BORDER_ROUTING=${BORDER_ROUTING:-1}
 ENV BACKBONE_ROUTER=${BACKBONE_ROUTER:-1}
 ENV OT_BACKBONE_CI=${OT_BACKBONE_CI:-0}
+ENV OTBR_EPSKC=${OTBR_EPSKC:-0}
 ENV OTBR_MDNS=${MDNS:-mDNSResponder}
 ENV OTBR_OPTIONS=${OTBR_OPTIONS}
 ENV DEBIAN_FRONTEND noninteractive
diff --git a/script/_otbr b/script/_otbr
index dbccc73c88c..8ca65722adc 100644
--- a/script/_otbr
+++ b/script/_otbr
@@ -36,6 +36,9 @@ readonly OTBR_OPTIONS
 REFERENCE_DEVICE="${REFERENCE_DEVICE:-0}"
 readonly REFERENCE_DEVICE
 
+OTBR_EPSKC="${OTBR_EPSKC:-0}"
+readonly OTBR_EPSKC
+
 otbr_uninstall()
 {
     if have systemctl; then
@@ -106,6 +109,16 @@ otbr_install()
         fi
     fi
 
+    if [[ ${OTBR_EPSKC} == "1" ]]; then
+        otbr_options+=(
+            "-DOTBR_EPSKC=ON"
+        )
+    else
+        otbr_options+=(
+            "-DOTBR_EPSKC=OFF"
+        )
+    fi
+
     if [[ ${REFERENCE_DEVICE} == "1" ]]; then
         otbr_options+=(
             "-DOTBR_NO_AUTO_ATTACH=1"
diff --git a/src/border_agent/border_agent.cpp b/src/border_agent/border_agent.cpp
index f8a1e0fc218..4b22fd0dd22 100644
--- a/src/border_agent/border_agent.cpp
+++ b/src/border_agent/border_agent.cpp
@@ -69,9 +69,11 @@
 
 namespace otbr {
 
-static const char    kBorderAgentServiceType[]      = "_meshcop._udp";   ///< Border agent service type of mDNS
-static const char    kBorderAgentEpskcServiceType[] = "_meshcop-e._udp"; ///< Border agent ePSKc service
-static constexpr int kBorderAgentServiceDummyPort   = 49152;
+static const char kBorderAgentServiceType[] = "_meshcop._udp"; ///< Border agent service type of mDNS
+#if OTBR_ENABLE_EPSKC
+static const char kBorderAgentEpskcServiceType[] = "_meshcop-e._udp"; ///< Border agent ePSKc service
+#endif
+static constexpr int kBorderAgentServiceDummyPort = 49152;
 
 /**
  * Locators
@@ -226,7 +228,9 @@ void BorderAgent::Start(void)
     mServiceInstanceName = GetServiceInstanceNameWithExtAddr(mBaseServiceInstanceName);
     UpdateMeshCopService();
 
+#if OTBR_ENABLE_EPSKC
     otBorderAgentSetEphemeralKeyCallback(mHost.GetInstance(), BorderAgent::HandleEpskcStateChanged, this);
+#endif
 }
 
 void BorderAgent::Stop(void)
@@ -235,6 +239,7 @@ void BorderAgent::Stop(void)
     UnpublishMeshCopService();
 }
 
+#if OTBR_ENABLE_EPSKC
 void BorderAgent::HandleEpskcStateChanged(void *aContext)
 {
     BorderAgent *borderAgent = static_cast<BorderAgent *>(aContext);
@@ -295,6 +300,7 @@ void BorderAgent::UnpublishEpskcService()
                       kBorderAgentEpskcServiceType);
     });
 }
+#endif
 
 void BorderAgent::HandleMdnsState(Mdns::Publisher::State aState)
 {
diff --git a/src/border_agent/border_agent.hpp b/src/border_agent/border_agent.hpp
index 58f84a058a9..5cf42317956 100644
--- a/src/border_agent/border_agent.hpp
+++ b/src/border_agent/border_agent.hpp
@@ -151,9 +151,11 @@ class BorderAgent : private NonCopyable
     std::string GetServiceInstanceNameWithExtAddr(const std::string &aServiceInstanceName) const;
     std::string GetAlternativeServiceInstanceName() const;
 
+#if OTBR_ENABLE_EPSKC
     static void HandleEpskcStateChanged(void *aContext);
     void        PublishEpskcService(void);
     void        UnpublishEpskcService(void);
+#endif
 
     otbr::Ncp::RcpHost &mHost;
     Mdns::Publisher    &mPublisher;
diff --git a/src/ncp/ncp_spinel.cpp b/src/ncp/ncp_spinel.cpp
index 21a1952778f..685bbcd8c2c 100644
--- a/src/ncp/ncp_spinel.cpp
+++ b/src/ncp/ncp_spinel.cpp
@@ -69,9 +69,10 @@ void NcpSpinel::GetDeviceRole(GetDeviceRoleHandler aHandler)
 {
     otError      error = OT_ERROR_NONE;
     spinel_tid_t tid   = GetNextTid();
-    va_list      args;
+    va_list      args  = {};
 
     error = mSpinelDriver->SendCommand(SPINEL_CMD_PROP_VALUE_GET, SPINEL_PROP_NET_ROLE, tid, nullptr, args);
+
     if (error != OT_ERROR_NONE)
     {
         FreeTid(tid);
diff --git a/third_party/openthread/CMakeLists.txt b/third_party/openthread/CMakeLists.txt
index 8ea4516e4e7..7280f50fc2c 100644
--- a/third_party/openthread/CMakeLists.txt
+++ b/third_party/openthread/CMakeLists.txt
@@ -31,7 +31,7 @@ set(OT_ANYCAST_LOCATOR ON CACHE STRING "enable anycast locator" FORCE)
 set(OT_BACKBONE_ROUTER ${OTBR_BACKBONE_ROUTER} CACHE STRING "Enable Backbone Router feature in OpenThread" FORCE)
 set(OT_BACKBONE_ROUTER_DUA_NDPROXYING ${OTBR_DUA_ROUTING} CACHE STRING "Configure DUA ND Proxy feature in OpenThread" FORCE)
 set(OT_BORDER_AGENT ON CACHE STRING "enable border agent" FORCE)
-set(OT_BORDER_AGENT_EPSKC ON CACHE STRING "enable border agent ephemeral PSKc" FORCE)
+set(OT_BORDER_AGENT_EPSKC ${OTBR_EPSKC} CACHE STRING "enable border agent ephemeral PSKc" FORCE)
 set(OT_BORDER_AGENT_ID ON CACHE STRING "enable border agent ID" FORCE)
 set(OT_BORDER_ROUTER ON CACHE STRING "enable border router feature" FORCE)
 set(OT_BORDER_ROUTING ${OTBR_BORDER_ROUTING} CACHE STRING "enable border routing feature" FORCE)
@@ -85,6 +85,10 @@ if (NOT OT_THREAD_VERSION STREQUAL "1.1")
     set(OT_LINK_METRICS_SUBJECT ON CACHE STRING "enable link metrics subject" FORCE)
 endif()
 
+if ((OT_BORDER_AGENT_EPSKC) AND (NOT OT_THREAD_VERSION STREQUAL "1.4"))
+    message(FATAL_ERROR "ePSKc requires Thread protocol version >= 1.4")
+endif()
+
 if (NOT OT_LOG_LEVEL)
     if (CMAKE_BUILD_TYPE STREQUAL "Debug")
         set(OT_LOG_LEVEL "DEBG" CACHE STRING "set OpenThread log level to DEBG" FORCE)