The default firmware, with encrypted credential storage and signature-verified OTA updates. Every feature of the standard build is present — this is not a stripped-down variant.
What's different
Two changes, both aimed at the same thing: keeping what's on the device readable only by the device, and keeping firmware installable only by you.
1. Encrypted credential storage
Your Wi-Fi password, the Home Assistant API encryption key and every saved setting normally sit in a plain-text region of the chip's flash. On this build they are encrypted with keys derived from a hardware key inside the chip, which is never written to flash and cannot be read back by software.
The practical effect: dumping the flash chip no longer reveals your Wi-Fi password. That matters for a device mounted on a wall, in a shared or rented space, or one you eventually resell or throw away.
2. Signature-verified updates
Each release is signed with a private key held only by this project's build pipeline. Before installing an update the device checks that signature and refuses anything that does not match. A spoofed or compromised update server cannot install firmware on your Satellite1.
Kept, not removed: the voice assistant, Sendspin multi-room audio, wake word detection, Wi-Fi provisioning over USB and Bluetooth, the ESPHome dashboard OTA path, the beta update channel and the USB serial console all behave exactly as on the standard build.
Before you flash One-way
Some of this is permanent, and getting back off this build needs a USB cable rather than a click in Home Assistant. Please read this rather than skim it.
A hardware key is burned in on first boot, permanently.
The device generates its own encryption key and writes it into a one-time-programmable block inside the chip. That block can never be erased, reused or read out. It is unique to each device.
Your settings are wiped once, on the first hardened boot.
Existing settings were saved unencrypted and cannot be read once encryption is on. The device comes up needing Wi-Fi provisioning again, and Home Assistant will ask you to re-adopt it.
Going back to a standard build requires a USB cable.
This device installs only firmware carrying a valid signature, and the standard releases are unsigned — so it will refuse them. The switch back cannot be done over the air from Home Assistant or the ESPHome dashboard. You will need physical access to the device and a computer running Chrome or Edge. Nothing is bricked and USB flashing is never restricted, but decide before you mount the device somewhere you would rather not reach again.
Going back wipes your settings a second time.
A standard build cannot read the encrypted storage, so switching in either direction is a re-provisioning event. The burned key is simply left unused afterwards.
This device will not appear as adoptable in the ESPHome dashboard.
Dashboard adoption would hand it the standard configuration and quietly undo both protections, so it is deliberately switched off. Updates arrive through the update entity in Home Assistant as usual.
Updates come only from this project's signed releases.
A firmware you build yourself will not install over the air unless you sign it with the same key. USB flashing is never restricted, so you always have a way in.
If you build your own firmware — from this repository or with your own modifications — install the standard variant instead, or generate your own signing key and use it in config/satellite1.secure.yaml. Otherwise your first self-built update will be refused by the device.
Install Firmware
Connect your Satellite1 via USB and click below. This build has no radar support.
Your browser does not support Web Serial.
Please use Google Chrome or Microsoft Edge.
Installation steps
Connect your Satellite1 to your computer via USB
Click the "Install Satellite1 Hardened" button above
Select the correct serial port when prompted
Wait for the installation to complete
Enter your home Wi-Fi credentials when the installer prompts for them
Add the device to Home Assistant
Note: first-time installation erases the device. Existing Satellite1 devices can move to this build over the air from Home Assistant, but will need re-provisioning afterwards. Moving back is USB-only — see the consequences above.
What this does not protect against
Worth being straight about the limits. Neither change is enforced by the chip's hardware, so someone who can physically connect a cable can still flash firmware of their own — and firmware running on the device can ask the chip to decrypt its storage. This build raises the cost of reading your credentials from "read the flash chip" to "write and flash custom firmware to that specific device."
Closing that last gap needs Secure Boot or a permanently disabled USB download mode. Both are irreversible with no recovery path if anything goes wrong, and neither is enabled here — a bricked voice assistant is a worse outcome than the risk it removes.
This firmware is intended for home networks and is not hardened for exposure to untrusted networks. Keep the device on a trusted or dedicated IoT network segment either way.