diff --git a/esphome/shelly-ble-proxy.yaml b/esphome/shelly-ble-proxy.yaml
index 513b9b82..3a551b9d 100644
--- a/esphome/shelly-ble-proxy.yaml
+++ b/esphome/shelly-ble-proxy.yaml
@@ -27,24 +27,37 @@ esp32:
   framework:
     type: esp-idf # required for a stable bluetooth_proxy
 
+# DEBUG globally, with the BLE stack turned up to VERBOSE so a GATT connection
+# attempt logs its progress and failure reason (esp32_ble_client) — the detail
+# shelly-manager needs to diagnose why provisioning a Shelly over BLE fails.
 logger:
-  level: INFO
+  level: DEBUG
+  logs:
+    esp32_ble_client: VERBOSE
+    esp32_ble_tracker: DEBUG
+    bluetooth_proxy: DEBUG
 
-# ESPHome native API — how the ble-agent connects. The encryption key is the
-# handoff to the ble-agent (BLE_PROXY_NOISE_PSK there must equal this value).
+# ESPHome native API — how shelly-manager's native client connects. The
+# encryption key is the shared fleet Noise PSK (Ble__Discovery__Key there must
+# equal this value).
 api:
   encryption:
     key: !secret shelly_ble_proxy_api_key
 
-# No OTA and no fallback AP/captive_portal, deliberately — this is a fixed,
-# low-value proxy: updates and any WiFi-recovery are done by re-flashing over USB.
+# OTA enabled so the config can be iterated remotely (no more USB re-flash per
+# change). Bootstrapping it costs one USB flash; after that, push over WiFi from
+# the ESPHome Device Builder. Set shelly_ble_proxy_ota_password in the dashboard
+# secrets before flashing.
+ota:
+  - platform: esphome
+    password: !secret shelly_ble_proxy_ota_password
+
 wifi:
   ssid: !secret iot_wifi_ssid
   password: !secret iot_wifi_password
 
 # The IoT VLAN advertises a global IPv6 prefix (RA/SLAAC). Enable IPv6 so this
 # device is dual-stack like the rest of the segment, rather than v4-only.
-# Requires a re-flash over USB to take effect (no OTA on this device).
 network:
   enable_ipv6: true