diff --git a/Software/AGENTS.md b/Software/AGENTS.md
index 849478e..6539fb3 100644
--- a/Software/AGENTS.md
+++ b/Software/AGENTS.md
@@ -517,7 +517,7 @@ Software/
 ├── AGENTS.md  Doxyfile  instructions.md
 ├── CMakeLists.txt            top-level ESP-IDF project
 ├── sdkconfig.defaults        C++23, exceptions off, flash/NVS encryption
-├── partitions.csv            includes an encrypted NVS partition
+├── partitions.csv            nvs, otadata, ota_0/ota_1, dsp blob, nvs_keys
 ├── .cursor/rules/*.mdc
 ├── main/                     imperative shell entry (app_main)
 ├── components/
diff --git a/Software/README.md b/Software/README.md
index f5fd905..1f04cdd 100644
--- a/Software/README.md
+++ b/Software/README.md
@@ -120,7 +120,7 @@ Wire schemas: [`docs/manual/ch-api.tex`](docs/manual/ch-api.tex) · C++ API:
 | `components/secure_store/` | Encrypted NVS: credentials, profiles, presets |
 | `components/net/` | Wi-Fi, HTTP server, gzipped web UI |
 | `sdkconfig.defaults` | C++23, NVS + flash encryption (dev mode) |
-| `partitions.csv` | `nvs` + `nvs_keys` partitions |
+| `partitions.csv` | `nvs`, `otadata`, dual OTA (`ota_0`/`ota_1`), `dsp` blob, `nvs_keys` |
 | `docs/manual/` | LaTeX technical manual |
 | `docs/security-flash-nvs.md` | Encryption + device HIL checklist |
 | `docs/TODO.md` | Completed tasks + HIL backlog |
diff --git a/Software/docs/security-flash-nvs.md b/Software/docs/security-flash-nvs.md
index 76948ce..4a988d0 100644
--- a/Software/docs/security-flash-nvs.md
+++ b/Software/docs/security-flash-nvs.md
@@ -8,7 +8,7 @@ preset index in the `digiradio` NVS namespace. Firmware **0.8.3+** enables:
 | Flash encryption | `CONFIG_SECURE_FLASH_ENC_ENABLED` | On-chip transparent flash ciphertext |
 | Mode (default) | `CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT` | Plaintext download still allowed for bring-up |
 | NVS encryption | `CONFIG_NVS_ENCRYPTION` | XTS-AES over NVS entries; keys in `nvs_keys` partition |
-| Partition table | `partitions.csv` | `nvs` @ 0x9000, `nvs_keys` @ 0xf000 |
+| Partition table | `partitions.csv` | `nvs`, `otadata`, `ota_0`/`ota_1`, `dsp`, `nvs_keys` |
 
 Implementation: `secure_store::initEncryptedStorage()` (called from
 `NetBootstrap` before any `NvsSecureStore` access). With `CONFIG_NVS_ENCRYPTION`,
diff --git a/Software/partitions.csv b/Software/partitions.csv
index a933b46..ef30d74 100644
--- a/Software/partitions.csv
+++ b/Software/partitions.csv
@@ -1,7 +1,13 @@
-# DigiRadio partition table
-# nvs_keys supports NVS encryption (enable in secure-store slice).
-# Name,   Type, SubType,  Offset,  Size, Flags
-nvs,      data, nvs,      0x9000,  0x6000,
-nvs_keys, data, nvs_keys, 0xf000,  0x1000,
-phy_init, data, phy,      0x10000, 0x1000,
-factory,  app,  factory,  0x20000, 0x180000,
+# DigiRadio partition table (4 MB flash — ESP32-S3-WROOM-1)
+# ota_0 + ota_1: dual OTA app slots (equal size, 64 KiB aligned).
+# dsp: updatable ADAU1701 program blob (task 3.1).
+# nvs_keys: NVS encryption keys (secure-store slice).
+# First flash after this layout: idf.py erase-flash flash (wired), not OTA.
+# Name,   Type, SubType,  Offset,   Size, Flags
+nvs,      data, nvs,      0x9000,   0x6000,
+otadata,  data, ota,      0xf000,   0x2000,
+nvs_keys, data, nvs_keys, 0x11000,  0x1000,
+phy_init, data, phy,      0x12000,  0x1000,
+ota_0,    app,  ota_0,    0x20000,  0x1B0000,
+ota_1,    app,  ota_1,    0x1D0000, 0x1B0000,
+dsp,      data, 0x40,     0x380000, 0x40000,
diff --git a/Software/sdkconfig.defaults b/Software/sdkconfig.defaults
index 1964aaf..68b9a6b 100644
--- a/Software/sdkconfig.defaults
+++ b/Software/sdkconfig.defaults
@@ -4,10 +4,13 @@
 
 CONFIG_IDF_TARGET="esp32s3"
 
-# Custom partition table (nvs + nvs_keys for encrypted storage)
+# Custom partition table (nvs, otadata, OTA slots, dsp blob, nvs_keys)
 CONFIG_PARTITION_TABLE_CUSTOM=y
 CONFIG_PARTITION_TABLE_CUSTOM_FILENAME="partitions.csv"
 
+# OTA rollback: mark app valid only after esp_ota_mark_app_valid_cancel_rollback()
+CONFIG_BOOTLOADER_APP_ROLLBACK_ENABLE=y
+
 # Flash encryption — DEVELOPMENT mode (re-flash plaintext until eFuse policy set)
 CONFIG_SECURE_FLASH_ENC_ENABLED=y
 CONFIG_SECURE_FLASH_ENCRYPTION_MODE_DEVELOPMENT=y