diff --git a/components/control_plane/src/runtime/control_plane_ota.c b/components/control_plane/src/runtime/control_plane_ota.c
index 5af6f66..5e5c9e6 100644
--- a/components/control_plane/src/runtime/control_plane_ota.c
+++ b/components/control_plane/src/runtime/control_plane_ota.c
@@ -267,8 +267,10 @@ static bool control_plane_ota_runtime_is_idle(void)
     if (control_plane_multimodal_get_runtime_state(&state) != ESP_OK) {
         return true;
     }
-    return !state.has_active_task && !state.client_speech_active &&
-           !state.remote_responding &&
+    /* A duplex cloud task may remain in Listening between voice turns. OTA
+     * can retire and later restore that task once all real interaction has
+     * stopped. */
+    return !state.client_speech_active && !state.remote_responding &&
            !state.local_responding_started;
 }
 
@@ -558,6 +560,7 @@ static void control_plane_ota_worker(void *arg)
     }
     control_plane_ota_set_state(CONTROL_PLANE_OTA_STATE_IDLE, ESP_OK, -1);
     bool initial_check_pending = true;
+    bool resource_wait_logged = false;
 
     if (!control_plane_ota_wait_interruptible(CONTROL_PLANE_OTA_INITIAL_GATE_DELAY_MS)) {
         goto stopped;
@@ -565,6 +568,7 @@ static void control_plane_ota_worker(void *arg)
 
     while (!control_plane_ota_stop_is_requested()) {
         if (!control_plane_is_sta_connected()) {
+            resource_wait_logged = false;
             control_plane_ota_set_state(CONTROL_PLANE_OTA_STATE_WAITING_FOR_NETWORK,
                                         ESP_OK,
                                         -1);
@@ -581,9 +585,27 @@ static void control_plane_ota_worker(void *arg)
             control_plane_ota_set_state(CONTROL_PLANE_OTA_STATE_WAITING_FOR_RESOURCES,
                                         ESP_OK,
                                         -1);
+            if (!resource_wait_logged) {
+                resource_wait_logged = true;
+                control_plane_multimodal_runtime_state_t state = {0};
+                if (control_plane_multimodal_get_runtime_state(&state) == ESP_OK) {
+                    ESP_LOGI(TAG,
+                             "OTA check due; waiting for voice interaction: "
+                             "task=%d listening=%d speech=%d responding=%d "
+                             "local_responding=%d",
+                             state.has_active_task ? 1 : 0,
+                             state.server_listening ? 1 : 0,
+                             state.client_speech_active ? 1 : 0,
+                             state.remote_responding ? 1 : 0,
+                             state.local_responding_started ? 1 : 0);
+                } else {
+                    ESP_LOGI(TAG, "OTA check due; waiting for runtime resources");
+                }
+            }
             control_plane_ota_wait_interruptible(1000U);
             continue;
         }
+        resource_wait_logged = false;
         if (err != ESP_OK) {
             initial_check_pending = false;
             control_plane_ota_release_voice_window(&voice_window);
diff --git a/sdkconfig.defaults b/sdkconfig.defaults
index cf5fbf2..a861fc8 100644
--- a/sdkconfig.defaults
+++ b/sdkconfig.defaults
@@ -261,7 +261,7 @@ CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
 # certificate handshake message larger than 4 KB, which mbedTLS reports as
 # MBEDTLS_ERR_SSL_INVALID_RECORD (-0x7200) when the inbound cap is too small.
 CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y
-CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=8192
+CONFIG_MBEDTLS_SSL_IN_CONTENT_LEN=16384
 CONFIG_MBEDTLS_SSL_OUT_CONTENT_LEN=4096
 CONFIG_MBEDTLS_SSL_PROTO_TLS1_2=y
 # The firmware does not inspect the peer certificate after the handshake; avoid
diff --git a/version.txt b/version.txt
index 3eefcb9..6d7de6e 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.0.0
+1.0.2