diff --git a/main/ota_manager.c b/main/ota_manager.c
index 73de86b..0324b12 100644
--- a/main/ota_manager.c
+++ b/main/ota_manager.c
@@ -504,15 +504,15 @@ static void ota_download_task(void *arg)
 
     set_state(OTA_STATUS_DOWNLOADING, "Starting download...");
     ESP_LOGI(TAG, "Starting HTTPS OTA from: %s", s_release.download_url);
+    wifi_manager_set_power_save(false);
     rfid_manager_pause(true);
 
     esp_http_client_config_t http_cfg = {
         .url = s_release.download_url,
         .transport_type = HTTP_TRANSPORT_OVER_SSL,
         .timeout_ms = 45000,
-        .keep_alive_enable = true,
         .buffer_size = 4096,
-        .buffer_size_tx = 2048,
+        .buffer_size_tx = 1024,
         .cert_pem = s_isrg_root_x1_pem,
         .cert_len = sizeof(s_isrg_root_x1_pem),
     };
@@ -525,6 +525,7 @@ static void ota_download_task(void *arg)
     esp_err_t err = esp_https_ota_begin(&ota_cfg, &ota_handle);
     if (err != ESP_OK || ota_handle == NULL) {
         rfid_manager_pause(false);
+        wifi_manager_set_power_save(true);
         wifi_manager_release_net_lock();
         ESP_LOGE(TAG, "esp_https_ota_begin failed: %s", esp_err_to_name(err));
         set_state(OTA_STATUS_FAILED, "Failed to connect to image");
@@ -541,6 +542,7 @@ static void ota_download_task(void *arg)
             ESP_LOGW(TAG, "Incoming image has identical ELF SHA-256 as running app - aborting flash write");
             esp_https_ota_abort(ota_handle);
             rfid_manager_pause(false);
+            wifi_manager_set_power_save(true);
             wifi_manager_release_net_lock();
             set_state(OTA_STATUS_UP_TO_DATE, "Firmware is already up to date");
             s_ota_task_handle = NULL;
@@ -550,11 +552,13 @@ static void ota_download_task(void *arg)
     }
 
     int chunk_counter = 0;
+    int last_logged_step = -1;
     while (1) {
         if (s_cancel_requested) {
             ESP_LOGW(TAG, "OTA canceled by user");
             esp_https_ota_abort(ota_handle);
             rfid_manager_pause(false);
+            wifi_manager_set_power_save(true);
             wifi_manager_release_net_lock();
             set_state(OTA_STATUS_IDLE, "Update canceled");
             s_ota_task_handle = NULL;
@@ -572,6 +576,14 @@ static void ota_download_task(void *arg)
         if (read > 0) s_bytes_read = (size_t)read;
         if (total > 0) s_total_bytes = (size_t)total;
 
+        if (total > 0) {
+            int step = (read * 10) / total;
+            if (step != last_logged_step) {
+                last_logged_step = step;
+                ESP_LOGI(TAG, "OTA download: %d%% (%d / %d KB)", (read * 100) / total, read / 1024, total / 1024);
+            }
+        }
+
         /* Yield every 4 chunks (16 KB) to feed the task watchdog without throttling throughput */
         if (++chunk_counter % 4 == 0) {
             vTaskDelay(1);
@@ -579,6 +591,7 @@ static void ota_download_task(void *arg)
     }
 
     rfid_manager_pause(false);
+    wifi_manager_set_power_save(true);
 
     if (err == ESP_OK) {
         if (esp_https_ota_is_complete_data_received(ota_handle)) {
diff --git a/main/wifi_manager.c b/main/wifi_manager.c
index 1d2cc70..24e0afc 100644
--- a/main/wifi_manager.c
+++ b/main/wifi_manager.c
@@ -34,6 +34,7 @@ static SemaphoreHandle_t s_wifi_mux = NULL;
 static SemaphoreHandle_t s_net_lock = NULL;
 static bool s_manual_disconnect = false;
 static esp_netif_t *s_sta_netif = NULL;
+static bool s_power_save_enabled = true;
 
 
 /* ------------------------------------------------------------------ */
@@ -205,9 +206,14 @@ static void wifi_event_handler(void *arg, esp_event_base_t base, int32_t id, voi
             dns_fallback.ip.u_addr.ip4.addr = ESP_IP4TOADDR(8, 8, 8, 8);
             esp_netif_set_dns_info(s_sta_netif, ESP_NETIF_DNS_FALLBACK, &dns_fallback);
         }
-        /* Enable modem power saving when idle on station network */
-        esp_wifi_set_ps(WIFI_PS_MIN_MODEM);
-        ESP_LOGI(TAG, "Wi-Fi modem sleep enabled (WIFI_PS_MIN_MODEM: ~30-40 mA saved)");
+        /* Enable modem power saving only if power save is allowed */
+        if (s_power_save_enabled) {
+            esp_wifi_set_ps(WIFI_PS_MIN_MODEM);
+            ESP_LOGI(TAG, "Wi-Fi modem sleep enabled (WIFI_PS_MIN_MODEM: ~30-40 mA saved)");
+        } else {
+            esp_wifi_set_ps(WIFI_PS_NONE);
+            ESP_LOGI(TAG, "Wi-Fi power save disabled (WIFI_PS_NONE)");
+        }
     }
 }
 
@@ -510,8 +516,6 @@ esp_err_t wifi_manager_start(void)
     return ESP_OK;
 }
 
-static bool s_power_save_enabled = true;
-
 esp_err_t wifi_manager_acquire_net_lock(TickType_t timeout_ticks)
 {
     if (!s_net_lock) {
diff --git a/sdkconfig b/sdkconfig
index 79d39e1..7ee2012 100644
--- a/sdkconfig
+++ b/sdkconfig
@@ -1665,7 +1665,9 @@ CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC=y
 CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y
 CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
 CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
-# CONFIG_MBEDTLS_DYNAMIC_BUFFER is not set
+CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
+CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
+CONFIG_MBEDTLS_DYNAMIC_FREE_CA_CERT=y
 # CONFIG_MBEDTLS_DEBUG is not set
 
 #