New firmware is available for the three Wi-Fi modules in the HomeMaster range. The Home Assistant API is now encrypted with a key that is unique to each device, and the device accepts its initial configuration only during a defined window after power-on.
| Module | Version | Update |
|---|---|---|
| MiniPLC | 1.2.0 | Over the air |
| MicroPLC | 1.2.0 | Over the air |
| OpenTherm Gateway | 1.2.0 | Over the air |
MicroPLC gains over-the-air updates in this release. Previously it had no update channel at all and the configuration had to be rebuilt by hand; it now checks for new firmware on the same schedule as the other two.
What changed
The API is encrypted, with a different key on every device
Until now the connection between a HomeMaster module and Home Assistant was unencrypted, and anything on the same network could talk to the device. The API is now encrypted, and a client has to hold the right key.
The key is not in the firmware. It is generated when you commission the device — when you press Take control in ESPHome Device Builder, Home Assistant creates the key and stores it. Every unit ends up with its own.
That design is deliberate. The factory firmware image is published openly and is byte-for-byte identical on every unit we ship. A key baked into it would be a key that every owner of a HomeMaster module — and everyone who downloads the image — already has. A shared secret is not a secret, so there is none to share.
Save the key. You need it if you ever move the device to a different Home Assistant instance, or re-add it after removing it. You can read it at any time from Device info → Show encryption key.
The setup window closes
A device that has never been configured has to accept configuration from whoever is setting it up. Previously that state lasted indefinitely: a module sitting on a shelf with no Wi-Fi credentials would keep waiting, and keep accepting, for as long as it was powered.
Now it waits 15 minutes. After that, new API clients are turned away and Bluetooth provisioning stops accepting Wi-Fi credentials.
If you need more time, or you are setting up a device that has been sitting powered for a while, power-cycle it — that opens a fresh 15-minute window. Provisioning over the USB port is unaffected and works at any time, because it already requires you to be standing at the device with a cable.
The fallback access point is gone
Previously, if the device lost contact with the router it would raise its own open Wi-Fi access point with a captive portal — including a path to load firmware. That hotspot came up without any action from the user and stayed available. The provisioning component limited the API and Bluetooth in time, but it did not control the access point.
In 1.2.0 the fallback access point and the captive portal are removed. Initial setup is through Improv at improv-wifi.com, over Bluetooth or USB. If the device cannot join the network after a router password change or a router replacement, power-cycle it: that opens a fresh 15-minute provisioning window, and you set Wi-Fi again through Improv.
MiniPLC: the built-in web page is gone
MiniPLC used to serve a small control page on port 80. It has been removed.
That page had no login, and unlike the API key and the update password it was not something the commissioning process could secure on your behalf — it would have stayed open for the life of the device. It also had no cross-site request protection, which meant an ordinary web page open in a browser on the same network could send commands to the module without ever touching the network itself.
If you use it, you can put it back. After adopting the device you hold the full configuration, so adding the web server again with auth: configured is a few lines of YAML.
Why now
The European Union's Radio Equipment Directive gained cybersecurity requirements for internet-connected radio equipment, applicable since 1 August 2025. Article 3(3)(d) is about network protection: equipment should not be usable to harm the network it sits on. The harmonised standard written against it, EN 18031-1, sets out mechanisms for access control, authentication and secure communication.
Four mechanisms address those requirements directly: access control, authentication, encrypted communication, and — with this update — the absence of an open fallback access point. The device cannot be left running in a state where none of that has been established.
Our conformity assessment against EN 18031-1 is complete. Updated Declarations of Conformity (version V1.2, with Article 3(3)(d) included) are published on each product page.
Before you update
ESPHome 2026.7.0 or later is required if you build the configuration yourself. The provisioning mechanism was introduced in that release, and the configuration will not compile on anything older. If you receive the update over the air you do not need to do anything.
Modbus users, take note. ESPHome 2026.7.0 reworked the Modbus component and changed two defaults: send_wait_time went from 250 ms to 2000 ms, and turnaround_time from 100 ms to 600 ms. If you have your own modbus_controller: blocks talking to HomeMaster expansion modules, check them after rebuilding.
MiniPLC with RTD inputs enabled: enabling the PT100/PT1000 channels takes over GPIO1 and GPIO3, which disables USB serial — including USB provisioning. On those installations the only way to reopen the setup window is to power-cycle the device and use Bluetooth.
How to update
All three modules check for new firmware every six hours, and again shortly after they connect to the network. When an update is found, Home Assistant shows it as an update entity — the installation is yours to trigger, nothing happens on its own.
Devices already adopted into Home Assistant keep their encryption key across the update. You do not need to commission them again.
Full details for each module are in its changelog: MiniPLC, MicroPLC, OpenTherm Gateway.
The eight expansion modules are not affected. They have no radio interface and their firmware is unchanged.