diff --git a/vendor/rnode_firmware/BLESerial.cpp b/vendor/rnode_firmware/BLESerial.cpp
index 64fedc3..4e85bdb 100644
--- a/vendor/rnode_firmware/BLESerial.cpp
+++ b/vendor/rnode_firmware/BLESerial.cpp
@@ -34,6 +34,15 @@ void BLESerial::onPassKeyNotify(uint32_t passkey) { bt_passkey_notify_callback(p
 bool BLESerial::onSecurityRequest() { return bt_security_request_callback(); }
 void BLESerial::onAuthenticationComplete(esp_ble_auth_cmpl_t auth_result) { bt_authentication_complete_callback(auth_result); }
 void BLESerial::onConnect(BLEServer *server) { bt_connect_callback(server); }
+
+void BLESerial::onConnect(BLEServer *server, esp_ble_gatts_cb_param_t *param) {
+  // Request link encryption immediately so bonding completes before the
+  // host app touches the encrypted serial characteristics. Without this,
+  // the first connect from an unbonded host fails mid-operation while the
+  // OS pairing dialog runs, and only a second attempt succeeds.
+  esp_ble_set_encryption(param->connect.remote_bda, ESP_BLE_SEC_ENCRYPT_MITM);
+}
+
 void BLESerial::onDisconnect(BLEServer *server) { bt_disconnect_callback(server); ble_server->startAdvertising(); }
 bool BLESerial::onConfirmPIN(uint32_t pin) { return bt_confirm_pin_callback(pin); };
 bool BLESerial::connected() { return ble_server->getConnectedCount() > 0; }
diff --git a/vendor/rnode_firmware/BLESerial.h b/vendor/rnode_firmware/BLESerial.h
index f845b56..5a65906 100644
--- a/vendor/rnode_firmware/BLESerial.h
+++ b/vendor/rnode_firmware/BLESerial.h
@@ -91,6 +91,7 @@ public:
   size_t print(const char *value);
   void flush();
   void onConnect(BLEServer *server);
+  void onConnect(BLEServer *server, esp_ble_gatts_cb_param_t *param);
   void onDisconnect(BLEServer *server);
 
   uint32_t onPassKeyRequest();
diff --git a/vendor/rnode_firmware/TDeckUI.h b/vendor/rnode_firmware/TDeckUI.h
index efe4112..542fde0 100644
--- a/vendor/rnode_firmware/TDeckUI.h
+++ b/vendor/rnode_firmware/TDeckUI.h
@@ -439,16 +439,22 @@ void td_draw_idle_content() {
   td_canvas->print(abuf);
   y += 16;
 
-  signed char t_snr = (signed char)last_snr_raw;
-  float snr = ((int)t_snr) * 0.25f;
+  // last_rssi is -292 (sentinel) until a packet has actually been received
   char sigbuf[32];
-  snprintf(sigbuf, sizeof(sigbuf), "RSSI %d   SNR %.1f", last_rssi, snr);
+  float rssi_pct = 0.0f;
+  if (radio_online && last_rssi > -200) {
+    signed char t_snr = (signed char)last_snr_raw;
+    float snr = ((int)t_snr) * 0.25f;
+    snprintf(sigbuf, sizeof(sigbuf), "RSSI %d   SNR %.1f", last_rssi, snr);
+    rssi_pct = ((float)(last_rssi - S_RSSI_MIN) / S_RSSI_SPAN) * 100.0f;
+  } else {
+    snprintf(sigbuf, sizeof(sigbuf), "RSSI --   SNR --");
+  }
   td_canvas->setTextColor(TD_CLR_TEXT_PRIMARY);
   td_canvas->setCursor(x, y);
   td_canvas->print(sigbuf);
   y += 12;
 
-  float rssi_pct = ((float)(last_rssi - S_RSSI_MIN) / S_RSSI_SPAN) * 100.0f;
   td_draw_gradient_bar(x, y, TD_LEFT_W - 16, 10, rssi_pct);
 }
 
@@ -477,11 +483,6 @@ void td_draw_pairing_screen() {
     }
     y += 58;
   }
-
-  td_canvas->setTextSize(1);
-  td_canvas->setTextColor(TD_CLR_TEXT_SECONDARY);
-  td_canvas->setCursor(x, y);
-  td_canvas->print("Confirm this code on the connecting device.");
 }
 
 void td_draw_error_screen() {