diff --git a/common/ota.yaml b/common/ota.yaml
index 9b35495..8e04f57 100644
--- a/common/ota.yaml
+++ b/common/ota.yaml
@@ -2,3 +2,7 @@
 ota:
   - platform: esphome
     password: !secret ota_password
+    # migration to encrypted OTA (api key): once every device encrypts,
+    # remove allow_plaintext_upload together with the password
+    encryption:
+      allow_plaintext_upload: true
diff --git a/common/ota_esp32.yaml b/common/ota_esp32.yaml
index 6b1cbd2..2f0990c 100644
--- a/common/ota_esp32.yaml
+++ b/common/ota_esp32.yaml
@@ -3,4 +3,8 @@ ota:
   - platform: esphome
     id: ota_esphome
     password: !secret ota_password
+    # migration to encrypted OTA (api key): once every device encrypts,
+    # remove allow_plaintext_upload together with the password
+    encryption:
+      allow_plaintext_upload: true
     allow_partition_access: true