diff --git a/Integrations/ESPHome/AIR-1.yaml b/Integrations/ESPHome/AIR-1.yaml
index 60ffefa..454b4ce 100644
--- a/Integrations/ESPHome/AIR-1.yaml
+++ b/Integrations/ESPHome/AIR-1.yaml
@@ -37,7 +37,7 @@ logger:
 ota:
   - platform: esphome
     id: ota_esphome
-    password: "apolloautomation"
+    password: ${ota_password}
 
 wifi:
   ap:
diff --git a/Integrations/ESPHome/AIR-1_BLE.yaml b/Integrations/ESPHome/AIR-1_BLE.yaml
index 5ec6d3c..424fd2f 100644
--- a/Integrations/ESPHome/AIR-1_BLE.yaml
+++ b/Integrations/ESPHome/AIR-1_BLE.yaml
@@ -33,7 +33,7 @@ dashboard_import:
 
 ota:
   - platform: esphome
-    password: "apolloautomation"
+    password: ${ota_password}
     id: ota_esphome
 
 bluetooth_proxy:
diff --git a/Integrations/ESPHome/Core.yaml b/Integrations/ESPHome/Core.yaml
index 64a2eba..721a5da 100644
--- a/Integrations/ESPHome/Core.yaml
+++ b/Integrations/ESPHome/Core.yaml
@@ -2,6 +2,10 @@ substitutions:
   name: apollo-air-1
   version: "26.3.2.1"
   device_description: ${name} made by Apollo Automation - version ${version}.
+  # Default OTA password. Override in your device YAML by re-declaring
+  # `substitutions: { ota_password: !secret <name>_ota_password }` so each
+  # device on your network uses a unique secret instead of the shared default.
+  ota_password: "apolloautomation"
 
 esp32:
   variant: esp32c3