diff --git a/CHANGELOG.md b/CHANGELOG.md
index f0d7b2e155e..c174cda3a9e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -29,6 +29,7 @@
 - Library scans no longer re-read books whose title and author could not be read last time; they keep their filename until the file changes or you use the Library's refresh, which retries them.
 - Fewer SD card writes: session state and reading stats are no longer rewritten when nothing changed, and the reading percentage shown on Home is saved once when you leave a book instead of every 10 pages.
 - Far fewer SD card writes when saving your place: EPUB progress now alternates between two small slot files that are overwritten in place, so a save costs about 2 sector writes instead of roughly a dozen, and a save that would store the position already on the card (such as closing a book without turning a page) writes nothing. Your place is now saved every 30 page turns or 15 minutes of reading instead of every 10 pages or 5 minutes; leaving the book or putting the device to sleep still saves it immediately, so only a crash, reset or dead battery can lose more pages than before. A save interrupted by power loss falls back to the previous save. TXT and XTC progress and the Home reading percentage are also overwritten in place instead of being truncated and rewritten.
+- Firmware is about 32 KB smaller: wolfSSL no longer builds its debug trace messages in. Builds with `-DFREEINK_WOLFSSL_DEBUG` still include them.
 
 ### Fixed
 
diff --git a/lib/KOReaderSync/KOReaderSyncClient.cpp b/lib/KOReaderSync/KOReaderSyncClient.cpp
index 8736c4280e6..ada3c3b8fb5 100644
--- a/lib/KOReaderSync/KOReaderSyncClient.cpp
+++ b/lib/KOReaderSync/KOReaderSyncClient.cpp
@@ -23,10 +23,10 @@
 
 #include "KOReaderCredentialStore.h"
 
-#ifndef SIMULATOR
-// wolfSSL is built with DEBUG_WOLFSSL, whose Arduino backend expects the app to
-// provide this print hook (the stock definition lives in <wolfssl.h>, which no
-// translation unit here includes). Route it through the firmware logger, same
+#if !defined(SIMULATOR) && defined(FREEINK_WOLFSSL_DEBUG)
+// With FREEINK_WOLFSSL_DEBUG, wolfSSL is built with DEBUG_WOLFSSL, whose Arduino
+// backend expects the app to provide this print hook (the stock definition lives
+// in <wolfssl.h>, which no translation unit here includes). Route it through the firmware logger, same
 // as upstream CrossPoint's HttpDownloader.cpp.
 extern "C" void wolfSSL_Arduino_Serial_Print(const char* const msg) { LOG_DBG("WOLFSSL", "%s", msg); }
 #endif
diff --git a/scripts/patch_wolfssl.py b/scripts/patch_wolfssl.py
index 7b5689c172f..51f0b2845fe 100644
--- a/scripts/patch_wolfssl.py
+++ b/scripts/patch_wolfssl.py
@@ -14,6 +14,11 @@
 #endif
 #undef FP_MAX_BITS
 #define FP_MAX_BITS 8192
+/* Arduino-wolfSSL turns on DEBUG_WOLFSSL, which compiles every WOLFSSL_MSG and
+   WOLFSSL_ENTER trace string into flash. Keep it only for FREEINK_WOLFSSL_DEBUG. */
+#ifndef FREEINK_WOLFSSL_DEBUG
+#undef DEBUG_WOLFSSL
+#endif
 """