diff --git a/lib/libesp32/Berry-HttpClientLight/src/HTTPUpdateLight.cpp b/lib/libesp32/Berry-HttpClientLight/src/HTTPUpdateLight.cpp
index 92e401662..93b1008db 100644
--- a/lib/libesp32/Berry-HttpClientLight/src/HTTPUpdateLight.cpp
+++ b/lib/libesp32/Berry-HttpClientLight/src/HTTPUpdateLight.cpp
@@ -229,17 +229,17 @@ HTTPUpdateResult HTTPUpdateLight::handleUpdate(HTTPClientLight& http, const Stri
 
     uint32_t http_connect_time = millis();
 
-    int code = http.GET();
-    int len = http.getSize();
+    int code = http.GET();      // 0 if ok or < 0 if error
+    int len = http.getSize();   // -1 if no info or > 0 when Content-Length is set by server
 
     // Add specific logging for Tasmota
-    if (len < 0) {
-      if (len <= -1000) {
-        AddLog(LOG_LEVEL_INFO, "OTA: TLS connection error %d after %d ms", -len - 1000, millis() - http_connect_time);
-      } else if (len == -1) {
+    if (len < 0) {              // -1 if no info or > 0 when Content-Length is set by server
+      if (code <= -1000) {      // BearSSL error 46 transformed to -1046
+        AddLog(LOG_LEVEL_INFO, "OTA: TLS connection error %d after %d ms", -code - 1000, millis() - http_connect_time);
+      } else if (code == -1) {  // HTTPC_ERROR_CONNECTION_REFUSED
         AddLog(LOG_LEVEL_INFO, "OTA: Connection timeout after %d ms", millis() - http_connect_time);
       } else {
-        AddLog(LOG_LEVEL_INFO, "OTA: Connection error %d after %d ms", len, millis() - http_connect_time);
+        AddLog(LOG_LEVEL_INFO, "OTA: Connection error %d after %d ms", code, millis() - http_connect_time);
       }
     } else {
       AddLog(LOG_LEVEL_DEBUG, PSTR("OTA: Connected in %d ms, stack low mark %d"),
diff --git a/tasmota/tasmota_support/support_command.ino b/tasmota/tasmota_support/support_command.ino
index 68f077ae5..07bdea9e4 100644
--- a/tasmota/tasmota_support/support_command.ino
+++ b/tasmota/tasmota_support/support_command.ino
@@ -1038,13 +1038,17 @@ void CmndSleep(void)
 
 }
 
-void CmndUpgrade(void)
-{
+void CmndUpgrade(void) {
   // Check if the payload is numerically 1, and had no trailing chars.
   //   e.g. "1foo" or "1.2.3" could fool us.
   // Check if the version we have been asked to upgrade to is higher than our current version.
   //   We also need at least 3 chars to make a valid version number string.
+  // Upload 1 - OTA upload binary
+  // Upload 2 - (ESP32 only) OTA upload safeboot binary if partition is present
   if (((1 == XdrvMailbox.data_len) && (1 == XdrvMailbox.payload)) || ((XdrvMailbox.data_len >= 3) && NewerVersion(XdrvMailbox.data))) {
+#ifdef ESP32
+    TasmotaGlobal.ota_factory = false;  // Reset in case of failed safeboot upgrade
+#endif  // ESP32 and WEBCLIENT_HTTPS
     TasmotaGlobal.ota_state_flag = 3;
     char stemp1[TOPSZ];
     Response_P(PSTR("{\"%s\":\"" D_JSON_VERSION " %s " D_JSON_FROM " %s\"}"), XdrvMailbox.command, TasmotaGlobal.version, GetOtaUrl(stemp1, sizeof(stemp1)));
diff --git a/tasmota/tasmota_support/support_tasmota.ino b/tasmota/tasmota_support/support_tasmota.ino
index 845f18766..0c2c29779 100644
--- a/tasmota/tasmota_support/support_tasmota.ino
+++ b/tasmota/tasmota_support/support_tasmota.ino
@@ -1403,6 +1403,7 @@ void Every250mSeconds(void)
             AddLog(LOG_LEVEL_INFO, "OTA: unsupported protocol");
             ota_result = -999;
           } else {
+            OTAclient.setConnectTimeout(USE_BERRY_WEBCLIENT_TIMEOUT);
             httpUpdateLight.rebootOnUpdate(false);
             httpUpdateLight.setFactory(TasmotaGlobal.ota_factory);
             ota_result = (HTTP_UPDATE_FAILED != httpUpdateLight.update(OTAclient, version));