diff --git a/variants/esp32/esp32-common.ini b/variants/esp32/esp32-common.ini
index 813519b2c..78977756e 100644
--- a/variants/esp32/esp32-common.ini
+++ b/variants/esp32/esp32-common.ini
@@ -232,7 +232,12 @@ custom_sdkconfig =
   CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE=n
   CONFIG_MBEDTLS_ECP_DP_SECP192R1_ENABLED=n
   CONFIG_MBEDTLS_ECP_DP_SECP224R1_ENABLED=n
-  CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=n
+  ; Required, do not disable. Let's Encrypt "Generation Y" chains (used by
+  ; mqtt.meshtastic.org since 2026-07-29) sign a P-256 leaf with the P-384
+  ; intermediate YE1 under ISRG Root YE. Without this curve mbedtls cannot
+  ; parse the chain and every TLS handshake fails with
+  ; MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE (-0x3A00). Costs ~4 kB flash. (#11316)
+  CONFIG_MBEDTLS_ECP_DP_SECP384R1_ENABLED=y
   CONFIG_MBEDTLS_ECP_DP_SECP521R1_ENABLED=n
   CONFIG_MBEDTLS_ECP_DP_SECP192K1_ENABLED=n
   CONFIG_MBEDTLS_ECP_DP_SECP224K1_ENABLED=n