ESPHome 2026.9 arrives today with a way to protect the secrets inside a firmware update as it crosses the home network. Encrypted transfers can use the same key that secures the device’s Home Assistant connection, preventing a listener on the network from reading the Wi-Fi credentials and other secrets embedded in the firmware.
There is an upgrade step to understand: the first update from older firmware still travels without encryption. After that, a device with an API encryption key offers encrypted updates automatically. Adding the update platform’s explicit encryption setting makes that protection mandatory, so neither side accepts a downgrade to an unencrypted transfer. J. Nick Koston contributes the work.
Firmware builds spend less time fetching and installing their tools because downloads and package extraction run in parallel. In the project’s ESP8266 build benchmark, package setup falls from 17.1 seconds to 10.3 seconds; that measures one stage of the build, rather than the whole compilation.
Before updating, makers using Modbus Controller should check the release notes for renamed or replaced command and polling options, and recheck any switch or output with a write offset. Some ESP32 devices also need attention: those with a custom address burned into the chip gain different Ethernet, Bluetooth or Thread/Zigbee addresses, which can require updated network reservations or pairing. Most ESP32 devices do not have that custom address.