diff --git a/src/port/stm32h563/Makefile b/src/port/stm32h563/Makefile
index 0ab8105..b8e9afe 100644
--- a/src/port/stm32h563/Makefile
+++ b/src/port/stm32h563/Makefile
@@ -20,6 +20,9 @@ ENABLE_SSH ?= 0
 # MQTT support: set ENABLE_MQTT=1 to include wolfMQTT client (requires TLS)
 ENABLE_MQTT ?= 0
 
+# MQTT Broker: set ENABLE_MQTT_BROKER=1 to include wolfMQTT broker (requires TLS)
+ENABLE_MQTT_BROKER ?= 0
+
 # Library paths - default to sibling directories (clone alongside pattern)
 WOLFSSL_ROOT ?= $(ROOT)/../wolfssl
 WOLFSSH_ROOT ?= $(ROOT)/../wolfssh
@@ -198,17 +201,63 @@ SRCS += $(WOLFMQTT_SRCS)
 
 # wolfMQTT objects use relaxed warnings + MQTT/SSL include paths + user_settings.h
 $(WOLFMQTT_ROOT)/%.o: $(WOLFMQTT_ROOT)/%.c
-	$(CC) $(CFLAGS_WOLFSSL) -DENABLE_MQTT -DWOLFSSL_USER_SETTINGS -DWOLFMQTT_USER_SETTINGS -I$(WOLFMQTT_ROOT) -I$(WOLFSSL_ROOT) -c $< -o $@
+	$(CC) $(CFLAGS_WOLFSSL) -DENABLE_MQTT -DWOLFSSL_USER_SETTINGS -DWOLFMQTT_USER_SETTINGS $(if $(filter 1,$(ENABLE_MQTT_BROKER)),-DENABLE_MQTT_BROKER) -I$(WOLFMQTT_ROOT) -I$(WOLFSSL_ROOT) -I$(ROOT)/src -c $< -o $@
 
 endif # ENABLE_MQTT
 
+# -----------------------------------------------------------------------------
+# MQTT Broker Support (wolfMQTT broker) - requires TLS
+# -----------------------------------------------------------------------------
+ifeq ($(ENABLE_MQTT_BROKER),1)
+
+# MQTT Broker requires TLS
+ifeq ($(ENABLE_TLS),0)
+  $(error ENABLE_MQTT_BROKER=1 requires ENABLE_TLS=1)
+endif
+
+# Validate wolfMQTT exists
+ifeq ($(wildcard $(WOLFMQTT_ROOT)/wolfmqtt/mqtt_broker.h),)
+  $(error wolfMQTT (with broker) not found at $(WOLFMQTT_ROOT). Clone it: git clone https://github.com/wolfSSL/wolfMQTT.git)
+endif
+
+CFLAGS += -DENABLE_MQTT_BROKER
+CFLAGS += -DWOLFMQTT_USER_SETTINGS
+CFLAGS += -I$(WOLFMQTT_ROOT)
+
+# MQTT broker wrapper
+SRCS += mqtt_broker.c
+
+# wolfMQTT broker source files
+# Note: mqtt_client.c is needed by broker internals (MqttClient_Init, etc.)
+WOLFMQTT_BROKER_SRCS := \
+    $(WOLFMQTT_ROOT)/src/mqtt_broker.c
+
+# Only add shared wolfMQTT sources if MQTT client is not already enabled
+ifneq ($(ENABLE_MQTT),1)
+WOLFMQTT_BROKER_SRCS += \
+    $(WOLFMQTT_ROOT)/src/mqtt_client.c \
+    $(WOLFMQTT_ROOT)/src/mqtt_packet.c \
+    $(WOLFMQTT_ROOT)/src/mqtt_socket.c
+endif
+
+SRCS += $(WOLFMQTT_BROKER_SRCS)
+
+# wolfMQTT objects use relaxed warnings + include paths + user_settings.h
+# Only define this pattern rule if MQTT client didn't already define it
+ifneq ($(ENABLE_MQTT),1)
+$(WOLFMQTT_ROOT)/%.o: $(WOLFMQTT_ROOT)/%.c
+	$(CC) $(CFLAGS_WOLFSSL) -DENABLE_MQTT_BROKER -DWOLFSSL_USER_SETTINGS -DWOLFMQTT_USER_SETTINGS -I$(WOLFMQTT_ROOT) -I$(WOLFSSL_ROOT) -I$(ROOT)/src -c $< -o $@
+endif
+
+endif # ENABLE_MQTT_BROKER
+
 # -----------------------------------------------------------------------------
 # Build rules
 # -----------------------------------------------------------------------------
 OBJS := $(patsubst %.c,%.o,$(SRCS))
 
 all: app.bin
-	@echo "Built with TZEN=$(TZEN) ENABLE_TLS=$(ENABLE_TLS) ENABLE_HTTPS=$(ENABLE_HTTPS) ENABLE_SSH=$(ENABLE_SSH) ENABLE_MQTT=$(ENABLE_MQTT)"
+	@echo "Built with TZEN=$(TZEN) ENABLE_TLS=$(ENABLE_TLS) ENABLE_HTTPS=$(ENABLE_HTTPS) ENABLE_SSH=$(ENABLE_SSH) ENABLE_MQTT=$(ENABLE_MQTT) ENABLE_MQTT_BROKER=$(ENABLE_MQTT_BROKER)"
 ifeq ($(ENABLE_TLS),1)
 	@echo "  wolfSSL: $(WOLFSSL_ROOT)"
 endif
@@ -216,7 +265,10 @@ ifeq ($(ENABLE_SSH),1)
 	@echo "  wolfSSH: $(WOLFSSH_ROOT)"
 endif
 ifeq ($(ENABLE_MQTT),1)
-	@echo "  wolfMQTT: $(WOLFMQTT_ROOT)"
+	@echo "  wolfMQTT (client): $(WOLFMQTT_ROOT)"
+endif
+ifeq ($(ENABLE_MQTT_BROKER),1)
+	@echo "  wolfMQTT (broker): $(WOLFMQTT_ROOT)"
 endif
 
 app.elf: $(OBJS) $(LDSCRIPT)
@@ -230,7 +282,7 @@ app.bin: app.elf
 
 # wolfSSL objects use relaxed warnings + user_settings.h + include paths
 $(WOLFSSL_ROOT)/%.o: $(WOLFSSL_ROOT)/%.c
-	$(CC) $(CFLAGS_WOLFSSL) -DWOLFSSL_USER_SETTINGS $(if $(filter 1,$(ENABLE_SSH)),-DENABLE_SSH) -I$(WOLFSSL_ROOT) -c $< -o $@
+	$(CC) $(CFLAGS_WOLFSSL) -DWOLFSSL_USER_SETTINGS $(if $(filter 1,$(ENABLE_SSH)),-DENABLE_SSH) $(if $(filter 1,$(ENABLE_MQTT_BROKER)),-DENABLE_MQTT_BROKER) -I$(WOLFSSL_ROOT) -c $< -o $@
 
 clean:
 	rm -f *.o app.elf app.bin
@@ -246,6 +298,9 @@ endif
 ifeq ($(ENABLE_MQTT),1)
 	rm -f $(WOLFMQTT_ROOT)/src/*.o
 endif
+ifeq ($(ENABLE_MQTT_BROKER),1)
+	rm -f $(WOLFMQTT_ROOT)/src/*.o
+endif
 
 # Verify what features are compiled into the binary
 verify: app.bin
@@ -255,9 +310,10 @@ verify: app.bin
 	@strings app.bin | grep -q "Initializing HTTPS server" && echo "  ✓ HTTPS server enabled" || echo "  ✗ HTTPS server disabled"
 	@strings app.bin | grep -q "Initializing SSH server" && echo "  ✓ SSH server enabled" || echo "  ✗ SSH server disabled"
 	@strings app.bin | grep -q "Initializing MQTT client" && echo "  ✓ MQTT client enabled" || echo "  ✗ MQTT client disabled"
+	@strings app.bin | grep -q "MQTT Broker: Initializing" && echo "  ✓ MQTT broker enabled" || echo "  ✗ MQTT broker disabled"
 	@echo ""
 	@echo "Binary size: $$(ls -lh app.bin | awk '{print $$5}')"
-	@echo "Build flags: TZEN=$(TZEN) ENABLE_TLS=$(ENABLE_TLS) ENABLE_HTTPS=$(ENABLE_HTTPS) ENABLE_SSH=$(ENABLE_SSH) ENABLE_MQTT=$(ENABLE_MQTT)"
+	@echo "Build flags: TZEN=$(TZEN) ENABLE_TLS=$(ENABLE_TLS) ENABLE_HTTPS=$(ENABLE_HTTPS) ENABLE_SSH=$(ENABLE_SSH) ENABLE_MQTT=$(ENABLE_MQTT) ENABLE_MQTT_BROKER=$(ENABLE_MQTT_BROKER)"
 
 # Show memory usage
 size: app.elf
@@ -290,6 +346,7 @@ help:
 	@echo "  ENABLE_HTTPS=1  Enable HTTPS web server (requires TLS)"
 	@echo "  ENABLE_SSH=1    Enable SSH server (requires TLS + wolfSSH)"
 	@echo "  ENABLE_MQTT=1   Enable MQTT client (requires TLS + wolfMQTT)"
+	@echo "  ENABLE_MQTT_BROKER=1 Enable MQTT broker (requires TLS + wolfMQTT)"
 	@echo "  WOLFSSL_ROOT=   Path to wolfSSL (default: ../wolfssl)"
 	@echo "  WOLFSSH_ROOT=   Path to wolfSSH (default: ../wolfssh)"
 	@echo "  WOLFMQTT_ROOT=  Path to wolfMQTT (default: ../wolfmqtt)"
@@ -302,7 +359,8 @@ help:
 	@echo "  make ENABLE_TLS=1 ENABLE_HTTPS=1                            # TLS + HTTPS web (port 443)"
 	@echo "  make ENABLE_TLS=1 ENABLE_SSH=1                              # TLS + SSH shell (port 22)"
 	@echo "  make ENABLE_TLS=1 ENABLE_MQTT=1                             # TLS + MQTT client"
-	@echo "  make ENABLE_TLS=1 ENABLE_HTTPS=1 ENABLE_SSH=1 ENABLE_MQTT=1 # Full featured"
+	@echo "  make ENABLE_TLS=1 ENABLE_MQTT_BROKER=1                       # TLS + MQTT broker"
+	@echo "  make ENABLE_TLS=1 ENABLE_HTTPS=1 ENABLE_SSH=1 ENABLE_MQTT=1 ENABLE_MQTT_BROKER=1 # Full featured"
 	@echo ""
 	@echo "Full Build Command (recommended):"
 	@echo "  CC=arm-none-eabi-gcc OBJCOPY=arm-none-eabi-objcopy \\"
@@ -314,5 +372,6 @@ help:
 	@echo "  curl -k https://<ip>/                          # HTTPS web server"
 	@echo "  ssh admin@<ip>                                 # SSH (password: wolfip)"
 	@echo "  mosquitto_sub -h test.mosquitto.org -t 'wolfip/status' -v  # MQTT subscribe"
+	@echo "  mosquitto_pub -h <ip> -p 8883 --cafile /dev/null --insecure -t test -m hello  # MQTT broker publish"
 
 .PHONY: help
diff --git a/src/port/stm32h563/config.h b/src/port/stm32h563/config.h
index b3f5f79..7c2b79b 100644
--- a/src/port/stm32h563/config.h
+++ b/src/port/stm32h563/config.h
@@ -28,11 +28,11 @@
 #define ETHERNET
 #define LINK_MTU                1536
 
-#define MAX_TCPSOCKETS          12   /* Need enough for listen + accepted sockets */
+#define MAX_TCPSOCKETS          17   /* 12 base + 5 for MQTT broker (listen + 4 clients) */
 #define MAX_UDPSOCKETS          2
 #define MAX_ICMPSOCKETS         1    /* Reduced from 2 */
-#define RXBUF_SIZE              (LINK_MTU * 8)   /* Reduced from 16 */
-#define TXBUF_SIZE              (LINK_MTU * 8)   /* Reduced from 16 */
+#define RXBUF_SIZE              (LINK_MTU * 4)   /* Reduced for RAM fit with broker */
+#define TXBUF_SIZE              (LINK_MTU * 4)   /* Reduced for RAM fit with broker */
 
 #define MAX_NEIGHBORS            16
 
diff --git a/src/port/stm32h563/main.c b/src/port/stm32h563/main.c
index e9fe260..84cadd6 100644
--- a/src/port/stm32h563/main.c
+++ b/src/port/stm32h563/main.c
@@ -45,6 +45,12 @@
 #include "mqtt_client.h"
 #endif
 
+#ifdef ENABLE_MQTT_BROKER
+#include "mqtt_broker.h"
+/* Defined in mqtt_broker.c, updated from main loop tick */
+extern volatile unsigned long broker_uptime_sec;
+#endif
+
 #ifdef ENABLE_TLS
 
 /* Google IP for TLS client test (run: dig +short google.com) */
@@ -688,6 +694,19 @@ int main(void)
     }
 #endif
 
+#ifdef ENABLE_MQTT_BROKER
+    uart_puts("Initializing MQTT broker...\n");
+    {
+        mqtt_broker_config_t broker_config = {
+            .port = 8883,
+            .use_tls = 1
+        };
+        if (mqtt_broker_init(IPStack, &broker_config, uart_puts) < 0) {
+            uart_puts("ERROR: MQTT broker init failed\n");
+        }
+    }
+#endif
+
     uart_puts("Entering main loop. Ready for connections!\n");
     uart_puts("Loop starting...\n");
 
@@ -750,6 +769,14 @@ int main(void)
         }
 #endif
 
+#ifdef ENABLE_MQTT_BROKER
+        /* Poll MQTT broker */
+        mqtt_broker_poll();
+
+        /* Update broker uptime counter (approximate seconds from tick) */
+        broker_uptime_sec = (unsigned long)(tick / 1000);
+#endif
+
 #ifdef ENABLE_TLS
         /* TLS client test: connect to Google after network settles */
         if (!tls_client_test_started && tick > 5000) {
diff --git a/src/port/stm32h563/mqtt_broker.c b/src/port/stm32h563/mqtt_broker.c
new file mode 100644
index 0000000..b770ed6
--- /dev/null
+++ b/src/port/stm32h563/mqtt_broker.c
@@ -0,0 +1,311 @@
+/* mqtt_broker.c
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#include "mqtt_broker.h"
+#include <wolfmqtt/mqtt_broker.h>
+#include <wolfmqtt/mqtt_socket.h>
+#include <wolfssl/ssl.h>
+#include <string.h>
+
+#include "certs.h"
+
+/* Configuration defaults */
+#define DEFAULT_BROKER_PORT_TLS     8883
+#define DEFAULT_BROKER_PORT_PLAIN   1883
+
+/* Broker state machine */
+typedef enum {
+    BROKER_STATE_IDLE,
+    BROKER_STATE_INIT,
+    BROKER_STATE_STARTING,
+    BROKER_STATE_RUNNING,
+    BROKER_STATE_ERROR
+} broker_state_t;
+
+/* Global uptime counter (updated by main loop) */
+volatile unsigned long broker_uptime_sec = 0;
+
+/* Broker context */
+static struct {
+    struct wolfIP *stack;
+    MqttBroker broker;
+    MqttBrokerNet net;
+    WOLFSSL_CTX *ssl_ctx;
+    broker_state_t state;
+    mqtt_broker_debug_cb debug_cb;
+    uint16_t port;
+    int use_tls;
+    int initialized;
+} ctx;
+
+/* wolfSSL TLS socket callbacks from wolfMQTT (mqtt_socket.c).
+ * These route through MqttNet per-client callbacks, which in turn
+ * call the broker's BrokerWolfIP_Read/Write via MqttBrokerNet. */
+extern int MqttSocket_TlsSocketReceive(WOLFSSL* ssl, char *buf, int sz,
+    void *ptr);
+extern int MqttSocket_TlsSocketSend(WOLFSSL* ssl, char *buf, int sz,
+    void *ptr);
+
+/* Debug output helper */
+static void debug_print(const char *msg)
+{
+    if (ctx.debug_cb) {
+        ctx.debug_cb(msg);
+    }
+}
+
+/* Format number to string (no printf on bare-metal) */
+static void uint_to_str(uint32_t val, char *buf)
+{
+    char tmp[12];
+    int i = 0;
+    int j = 0;
+
+    if (val == 0) {
+        buf[0] = '0';
+        buf[1] = '\0';
+        return;
+    }
+
+    while (val > 0) {
+        tmp[i++] = '0' + (val % 10);
+        val /= 10;
+    }
+
+    while (i > 0) {
+        buf[j++] = tmp[--i];
+    }
+    buf[j] = '\0';
+}
+
+/* Initialize TLS context for broker (server-side) */
+static int broker_tls_init(void)
+{
+    ctx.ssl_ctx = wolfSSL_CTX_new(wolfTLSv1_3_server_method());
+    if (!ctx.ssl_ctx) {
+        debug_print("MQTT Broker: TLS context create failed\n");
+        return -1;
+    }
+
+    /* Load server certificate from embedded PEM */
+    if (wolfSSL_CTX_use_certificate_buffer(ctx.ssl_ctx,
+            (const unsigned char *)server_cert_pem,
+            (long)server_cert_pem_len,
+            WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) {
+        debug_print("MQTT Broker: Load cert failed\n");
+        wolfSSL_CTX_free(ctx.ssl_ctx);
+        ctx.ssl_ctx = NULL;
+        return -1;
+    }
+
+    /* Load server private key from embedded PEM */
+    if (wolfSSL_CTX_use_PrivateKey_buffer(ctx.ssl_ctx,
+            (const unsigned char *)server_key_pem,
+            (long)server_key_pem_len,
+            WOLFSSL_FILETYPE_PEM) != WOLFSSL_SUCCESS) {
+        debug_print("MQTT Broker: Load key failed\n");
+        wolfSSL_CTX_free(ctx.ssl_ctx);
+        ctx.ssl_ctx = NULL;
+        return -1;
+    }
+
+    /* Set wolfSSL I/O callbacks to route through the broker's MqttNet layer.
+     * The chain is: wolfSSL -> MqttSocket_TlsSocketReceive/Send ->
+     * MqttNet.read/write (per-client) -> broker->net.read/write ->
+     * BrokerWolfIP_Read/Write -> wolfIP_sock_recv/send.
+     * Do NOT use wolfSSL_SetIO_wolfIP_CTX here - that would bypass
+     * the MqttNet layer and break the broker's per-client routing. */
+    wolfSSL_CTX_SetIORecv(ctx.ssl_ctx, MqttSocket_TlsSocketReceive);
+    wolfSSL_CTX_SetIOSend(ctx.ssl_ctx, MqttSocket_TlsSocketSend);
+
+    debug_print("MQTT Broker: TLS initialized (TLS 1.3, ECC P-256)\n");
+    return 0;
+}
+
+/* Handle init state */
+static int handle_init(void)
+{
+    int ret;
+
+    /* Initialize wolfIP broker network callbacks */
+    ret = MqttBrokerNet_wolfIP_Init(&ctx.net, ctx.stack);
+    if (ret != 0) {
+        debug_print("MQTT Broker: Net init failed\n");
+        ctx.state = BROKER_STATE_ERROR;
+        return -1;
+    }
+
+    /* Initialize broker */
+    ret = MqttBroker_Init(&ctx.broker, &ctx.net);
+    if (ret != 0) {
+        debug_print("MQTT Broker: Init failed\n");
+        ctx.state = BROKER_STATE_ERROR;
+        return -1;
+    }
+
+    /* Configure broker */
+    ctx.broker.port = ctx.port;
+
+    /* Set up TLS if enabled */
+    if (ctx.use_tls) {
+        ctx.broker.use_tls = 1;
+
+        if (broker_tls_init() < 0) {
+            ctx.state = BROKER_STATE_ERROR;
+            return -1;
+        }
+
+        /* Assign pre-configured TLS context to broker */
+        ctx.broker.tls_ctx = ctx.ssl_ctx;
+    }
+
+    ctx.state = BROKER_STATE_STARTING;
+    return 0;
+}
+
+/* Handle starting state */
+static int handle_starting(void)
+{
+    int ret;
+
+    ret = MqttBroker_Start(&ctx.broker);
+    if (ret != 0) {
+        debug_print("MQTT Broker: Start failed\n");
+        ctx.state = BROKER_STATE_ERROR;
+        return -1;
+    }
+
+    debug_print("MQTT Broker: Running on port ");
+    {
+        char port_str[8];
+        uint_to_str(ctx.port, port_str);
+        debug_print(port_str);
+    }
+    if (ctx.use_tls) {
+        debug_print(" (TLS)");
+    }
+    debug_print("\n");
+
+    ctx.state = BROKER_STATE_RUNNING;
+    return 0;
+}
+
+/* Handle running state */
+static int handle_running(void)
+{
+    int ret;
+
+    ret = MqttBroker_Step(&ctx.broker);
+    if (ret < 0 && ret != MQTT_CODE_CONTINUE) {
+        debug_print("MQTT Broker: Step error\n");
+        ctx.state = BROKER_STATE_ERROR;
+        return -1;
+    }
+
+    return 0;
+}
+
+int mqtt_broker_init(struct wolfIP *stack,
+    const mqtt_broker_config_t *config, mqtt_broker_debug_cb debug)
+{
+    memset(&ctx, 0, sizeof(ctx));
+    ctx.stack = stack;
+    ctx.debug_cb = debug;
+    ctx.state = BROKER_STATE_IDLE;
+
+    /* Apply configuration */
+    if (config) {
+        if (config->port > 0) {
+            ctx.port = config->port;
+        }
+        ctx.use_tls = config->use_tls;
+    }
+
+    /* Apply defaults for unset values */
+    if (ctx.port == 0) {
+        ctx.port = ctx.use_tls ? DEFAULT_BROKER_PORT_TLS
+                               : DEFAULT_BROKER_PORT_PLAIN;
+    }
+
+    debug_print("MQTT Broker: Initializing\n");
+
+    ctx.initialized = 1;
+    ctx.state = BROKER_STATE_INIT;
+
+    return 0;
+}
+
+int mqtt_broker_poll(void)
+{
+    if (!ctx.initialized) {
+        return -1;
+    }
+
+    switch (ctx.state) {
+        case BROKER_STATE_IDLE:
+            break;
+
+        case BROKER_STATE_INIT:
+            handle_init();
+            break;
+
+        case BROKER_STATE_STARTING:
+            handle_starting();
+            break;
+
+        case BROKER_STATE_RUNNING:
+            handle_running();
+            break;
+
+        case BROKER_STATE_ERROR:
+            /* Clean up and return to idle */
+            MqttBroker_Free(&ctx.broker);
+            if (ctx.ssl_ctx) {
+                /* Note: MqttBroker_Free already frees tls_ctx,
+                 * so only free if broker didn't own it */
+                ctx.ssl_ctx = NULL;
+            }
+            ctx.state = BROKER_STATE_IDLE;
+            break;
+
+        default:
+            break;
+    }
+
+    return 0;
+}
+
+int mqtt_broker_is_running(void)
+{
+    return (ctx.state == BROKER_STATE_RUNNING);
+}
+
+const char *mqtt_broker_get_state_str(void)
+{
+    switch (ctx.state) {
+        case BROKER_STATE_IDLE:     return "IDLE";
+        case BROKER_STATE_INIT:     return "INIT";
+        case BROKER_STATE_STARTING: return "STARTING";
+        case BROKER_STATE_RUNNING:  return "RUNNING";
+        case BROKER_STATE_ERROR:    return "ERROR";
+        default:                    return "UNKNOWN";
+    }
+}
diff --git a/src/port/stm32h563/mqtt_broker.h b/src/port/stm32h563/mqtt_broker.h
new file mode 100644
index 0000000..6a73381
--- /dev/null
+++ b/src/port/stm32h563/mqtt_broker.h
@@ -0,0 +1,56 @@
+/* mqtt_broker.h
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfIP TCP/IP stack.
+ *
+ * wolfIP is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfIP is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+#ifndef MQTT_BROKER_STM32_H
+#define MQTT_BROKER_STM32_H
+
+#include "wolfip.h"
+#include <stdint.h>
+
+/* Debug callback type */
+typedef void (*mqtt_broker_debug_cb)(const char *msg);
+
+/* MQTT broker configuration */
+typedef struct {
+    uint16_t port;            /* Broker port (default: 8883 for TLS, 1883 plain) */
+    int use_tls;              /* Enable TLS (requires wolfSSL) */
+} mqtt_broker_config_t;
+
+/* Initialize MQTT broker
+ * stack: wolfIP stack instance
+ * config: broker configuration (NULL for defaults)
+ * debug: debug callback for status messages
+ * Returns 0 on success, -1 on failure */
+int mqtt_broker_init(struct wolfIP *stack,
+    const mqtt_broker_config_t *config, mqtt_broker_debug_cb debug);
+
+/* Poll MQTT broker - call from main loop
+ * Returns 0 on success */
+int mqtt_broker_poll(void);
+
+/* Check if MQTT broker is running
+ * Returns 1 if running, 0 otherwise */
+int mqtt_broker_is_running(void);
+
+/* Get MQTT broker state as string (for debugging) */
+const char *mqtt_broker_get_state_str(void);
+
+#endif /* MQTT_BROKER_STM32_H */
diff --git a/src/port/stm32h563/user_settings.h b/src/port/stm32h563/user_settings.h
index 7bb553b..c7b0727 100644
--- a/src/port/stm32h563/user_settings.h
+++ b/src/port/stm32h563/user_settings.h
@@ -220,6 +220,61 @@ int custom_rand_gen_block(unsigned char* output, unsigned int sz);
 #endif
 #endif
 
+/* ------------------------------------------------------------------------- */
+/* wolfMQTT Broker Settings (when ENABLE_MQTT_BROKER=1) */
+/* ------------------------------------------------------------------------- */
+#ifdef ENABLE_MQTT_BROKER
+/* Enable the broker module */
+#define WOLFMQTT_BROKER
+
+/* Use wolfIP network backend */
+#define WOLFMQTT_WOLFIP
+
+/* Non-blocking mode for integration with wolfIP event loop */
+#define WOLFMQTT_NONBLOCK
+
+/* No standard I/O available on bare-metal */
+#define WOLFMQTT_NO_STDIO
+
+/* Disable error strings to save space */
+#define WOLFMQTT_NO_ERROR_STRINGS
+
+/* Static memory allocation (no malloc for broker structures) */
+#define WOLFMQTT_STATIC_MEMORY
+
+/* Use TLS for secure MQTT connections */
+#define ENABLE_MQTT_TLS
+
+/* Embedded-sized broker limits */
+#define BROKER_MAX_CLIENTS         4
+#define BROKER_MAX_SUBS           16
+#define BROKER_RX_BUF_SZ        1024
+#define BROKER_TX_BUF_SZ        1024
+#define BROKER_LISTEN_BACKLOG      4
+#define BROKER_MAX_RETAINED        4
+#define BROKER_MAX_PAYLOAD_LEN  1024
+
+/* Minimal logging (errors only) */
+#define BROKER_LOG_LEVEL_DEFAULT   1 /* BROKER_LOG_ERROR */
+
+/* Disable optional features to save space */
+#define WOLFMQTT_BROKER_NO_WILDCARDS
+#define WOLFMQTT_BROKER_NO_AUTH
+
+/* Time abstraction: use tick counter from main loop */
+extern volatile unsigned long broker_uptime_sec;
+#define WOLFMQTT_BROKER_GET_TIME_S() \
+    ((unsigned long)broker_uptime_sec)
+
+/* Define POSIX error codes for bare-metal */
+#ifndef EWOULDBLOCK
+#define EWOULDBLOCK 11
+#endif
+#ifndef EAGAIN
+#define EAGAIN 11
+#endif
+#endif /* ENABLE_MQTT_BROKER */
+
 #ifdef __cplusplus
 }
 #endif