diff --git a/.gitignore b/.gitignore
index 847900a..6d8ec90 100644
--- a/.gitignore
+++ b/.gitignore
@@ -98,3 +98,4 @@ RADIO_AUDIT_INDEX.md
 RX_BUSY_LATCH_PLAN.md
 zephcore/SX126X_LBT_RX_DEBUG_HANDOFF.md
 PSRAM_HANDOFF.md
+BLE_AUDIT_INDEX.md
diff --git a/zephcore/adapters/ble/ZephyrBLE.cpp b/zephcore/adapters/ble/ZephyrBLE.cpp
index 95e5021..a22f216 100644
--- a/zephcore/adapters/ble/ZephyrBLE.cpp
+++ b/zephcore/adapters/ble/ZephyrBLE.cpp
@@ -22,7 +22,6 @@ LOG_MODULE_REGISTER(zephcore_ble, CONFIG_ZEPHCORE_BLE_LOG_LEVEL);
 #include <zephyr/bluetooth/conn.h>
 #include <zephyr/bluetooth/hci.h>
 #include <zephyr/bluetooth/services/nus.h>
-#include <zephyr/bluetooth/services/nus/inst.h>
 #include <zephyr/settings/settings.h>
 
 #include "ZephyrBLE.h"
@@ -188,12 +187,6 @@ BT_GATT_SERVICE_DEFINE(secure_nus_svc,
 		NULL, secure_nus_rx_write, NULL),
 );
 
-static sys_slist_t secure_nus_cbs_list = SYS_SLIST_STATIC_INIT(&secure_nus_cbs_list);
-STRUCT_SECTION_ITERABLE(bt_nus_inst, secure_nus) = {
-	.svc = &secure_nus_svc,
-	.cbs = &secure_nus_cbs_list,
-};
-
 /* ========== Work items ========== */
 
 static void tx_drain_work_fn(struct k_work *work);
diff --git a/zephcore/boards/common/zephcore_common.conf b/zephcore/boards/common/zephcore_common.conf
index a657625..0206ef0 100644
--- a/zephcore/boards/common/zephcore_common.conf
+++ b/zephcore/boards/common/zephcore_common.conf
@@ -65,8 +65,11 @@ CONFIG_MODEM_MODULES=y
 # ========== BLE Stack (common to ALL platforms) ==========
 CONFIG_BT=y
 CONFIG_BT_PERIPHERAL=y
-CONFIG_BT_ZEPHYR_NUS=y
-CONFIG_BT_ZEPHYR_NUS_DEFAULT_INSTANCE=n
+# Note: not using upstream BT_ZEPHYR_NUS service — its macro hardcodes
+# plaintext permissions on the CCC and RX char. We define our own NUS
+# service in adapters/ble/ZephyrBLE.cpp with BT_GATT_PERM_WRITE_AUTHEN
+# to force reactive pairing per Apple ADG §55. UUID macros from nus.h
+# are still used (header is always available regardless of Kconfig).
 CONFIG_BT_DEVICE_NAME="MeshCore"
 CONFIG_BT_DEVICE_NAME_DYNAMIC=y
 CONFIG_BT_DEVICE_NAME_MAX=29