diff --git a/esphome/README.md b/esphome/README.md
index 8400dfb7..74652882 100644
--- a/esphome/README.md
+++ b/esphome/README.md
@@ -23,8 +23,6 @@ The dashboard's `secrets.yaml` (on the PVC — **not** in git) must define:
 ```yaml
 iot_wifi_ssid: "<IoT SSID>"
 iot_wifi_password: "<...>"
-shelly_ble_proxy_ap_password: "<recovery AP password, 8+ chars>"
-shelly_ble_proxy_ota_password: "<...>"
 # 32-byte base64 — dashboard "Generate", or: openssl rand -base64 32
 # This value is the handoff to the ble-agent (its BLE_PROXY_NOISE_PSK).
 shelly_ble_proxy_api_key: "<...>"
@@ -32,6 +30,7 @@ shelly_ble_proxy_api_key: "<...>"
 
 ## Flashing
 
-First flash is browser-side over USB (ESP Web Tools / Web Serial, Chrome/Edge):
-plug the Atom Echo into your computer, open the dashboard, **Install → Plug into
-this computer**. After that, updates are OTA.
+USB only — the config has no OTA and no recovery AP by design. Flash (and any
+later update or WiFi-recovery) is browser-side over USB (ESP Web Tools / Web
+Serial, Chrome/Edge): plug the Atom Echo into your computer, open the dashboard,
+**Install → Plug into this computer**.
diff --git a/esphome/shelly-ble-proxy.yaml b/esphome/shelly-ble-proxy.yaml
index 06c4575b..fc93e83c 100644
--- a/esphome/shelly-ble-proxy.yaml
+++ b/esphome/shelly-ble-proxy.yaml
@@ -36,18 +36,11 @@ api:
   encryption:
     key: !secret shelly_ble_proxy_api_key
 
-ota:
-  - platform: esphome
-    password: !secret shelly_ble_proxy_ota_password
-
+# No OTA and no fallback AP/captive_portal, deliberately — this is a fixed,
+# low-value proxy: updates and any WiFi-recovery are done by re-flashing over USB.
 wifi:
   ssid: !secret iot_wifi_ssid
   password: !secret iot_wifi_password
-  ap: # recovery AP if the IoT WiFi is down at boot
-    ssid: "${friendly_name} Setup"
-    password: !secret shelly_ble_proxy_ap_password
-
-captive_portal:
 
 # Active BLE proxy — enables the GATT connect + characteristic read/write that
 # Shelly's mOS RPC-over-BLE needs to provision a WiFi-less device