diff --git a/.github/workflows/firmware-ci.yml b/.github/workflows/firmware-ci.yml
index defda2b01..0a8e8fe38 100644
--- a/.github/workflows/firmware-ci.yml
+++ b/.github/workflows/firmware-ci.yml
@@ -53,7 +53,9 @@ jobs:
             sdkconfig: sdkconfig.defaults
             partition_table_name: partitions_display.csv
             size_warn_kb: 1100
-            size_limit_kb: 1152
+            # Current 8 MB image is 1163 KiB after USB onboarding. The OTA app
+            # partition is 2048 KiB; retain a 1200 KiB hard gate and warning.
+            size_limit_kb: 1200
             artifact_app: esp32-csi-node.bin
             artifact_pt: partition-table.bin
           - variant: 4mb
diff --git a/docs/adr/ADR-348-native-macos-usb-node-onboarding.md b/docs/adr/ADR-363-native-macos-usb-node-onboarding.md
similarity index 99%
rename from docs/adr/ADR-348-native-macos-usb-node-onboarding.md
rename to docs/adr/ADR-363-native-macos-usb-node-onboarding.md
index f1bb9652c..50ff63007 100644
--- a/docs/adr/ADR-348-native-macos-usb-node-onboarding.md
+++ b/docs/adr/ADR-363-native-macos-usb-node-onboarding.md
@@ -1,4 +1,4 @@
-# ADR 348: Native macOS USB node onboarding
+# ADR 363: Native macOS USB node onboarding
 
 ## Status
 
diff --git a/docs/adr/README.md b/docs/adr/README.md
index f3eeef3a3..c6e382052 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -115,7 +115,7 @@ Statuses: **Proposed** (under discussion), **Accepted** (approved and/or impleme
 | [ADR-344](ADR-344-adaptive-local-installation-discovery.md) | Adaptive Local Installation Discovery | Accepted (local software path) |
 | [ADR-346](ADR-346-fail-closed-edge-occupancy-evidence.md) | Fail closed ESP32 occupancy evidence | Accepted (C6 occupancy integrity qualified) |
 | [ADR-347](ADR-347-rate-aware-esp32-temporal-sensing.md) | Rate aware ESP32 temporal sensing | Accepted (C6 timing and transport qualified) |
-| [ADR-348](ADR-348-native-macos-usb-node-onboarding.md) | Native macOS USB node onboarding with nonce bound discovery and fresh server verification | Accepted and physically qualified on one ESP32 S3; C6 and signed distribution pending |
+| [ADR-363](ADR-363-native-macos-usb-node-onboarding.md) | Native macOS USB node onboarding with nonce bound discovery and fresh server verification | Accepted and physically qualified on one ESP32 S3; C6 and signed distribution pending |
 | [ADR-115](ADR-115-home-assistant-integration.md) | Home Assistant integration via MQTT auto-discovery + Matter bridge (HA-DISCO + HA-FABRIC + HA-MIND) | Accepted (MQTT track) / Proposed (Matter SDK P8b) |
 | [ADR-169](ADR-169-adam-mode-light-theme.md) | adam-mode — light theme toggle for the three.js realtime demo | Proposed |
 | [ADR-170](ADR-170-yoga-mode-pose-system.md) | yoga-mode — yoga pose detection, classification, and scoring for the three.js realtime demo | Proposed |
diff --git a/firmware/esp32-csi-node/README.md b/firmware/esp32-csi-node/README.md
index 1e5e70813..5f7505aae 100644
--- a/firmware/esp32-csi-node/README.md
+++ b/firmware/esp32-csi-node/README.md
@@ -32,7 +32,7 @@ matching chip build through the documented backup and flash process once. The
 USB protocol rejects public target addresses and invalid identifiers. New WiFi
 credentials are bounded, committed only in NVS, and never included in the
 receipt or diagnostic output. See
-[ADR 348](../../docs/adr/ADR-348-native-macos-usb-node-onboarding.md).
+[ADR 363](../../docs/adr/ADR-363-native-macos-usb-node-onboarding.md).
 
 On ESP32 C6, the default optional mmWave UART uses GPIO 4 and GPIO 5. Firmware
 refuses any mmWave configuration that overlaps the active console pins. This
diff --git a/v2/Cargo.lock b/v2/Cargo.lock
index 72660aa40..5e3102f90 100644
--- a/v2/Cargo.lock
+++ b/v2/Cargo.lock
@@ -9109,9 +9109,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.37"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "log",
  "once_cell",
@@ -9173,9 +9173,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",