diff --git a/src/activities/settings/FontDownloadActivity.cpp b/src/activities/settings/FontDownloadActivity.cpp
index 869e740e..69dd36da 100644
--- a/src/activities/settings/FontDownloadActivity.cpp
+++ b/src/activities/settings/FontDownloadActivity.cpp
@@ -348,6 +348,13 @@ void FontDownloadActivity::downloadFamily(ManifestFamily& family) {
 
     std::string url = baseUrl_ + file.name;
 
+    // Give the previous TLS connection (manifest fetch on first iteration, or
+    // the previous file otherwise) time to fully release its socket and TLS
+    // buffers. Without this, http.GET() can fail immediately with -1
+    // (HTTPC_ERROR_CONNECTION_REFUSED) on the next request — same workaround
+    // the browser-driven install path uses in CrossPointWebServer.
+    delay(500);
+
     auto result = HttpDownloader::downloadToFile(url, stagedPath, [this](unsigned int downloaded, unsigned int total) {
       mappedInput.update();
       fileProgress_ = downloaded;
diff --git a/src/network/HttpDownloader.cpp b/src/network/HttpDownloader.cpp
index be044b52..070daa57 100644
--- a/src/network/HttpDownloader.cpp
+++ b/src/network/HttpDownloader.cpp
@@ -6,6 +6,7 @@
 #include <NetworkClientSecure.h>
 #include <StreamString.h>
 #include <base64.h>
+#include <esp_heap_caps.h>
 
 #include <cstring>
 #include <memory>
@@ -127,6 +128,8 @@ HttpDownloader::DownloadError HttpDownloader::downloadToFile(const std::string&
 
   LOG_DBG("HTTP", "Downloading: %s", url.c_str());
   LOG_DBG("HTTP", "Destination: %s", destPath.c_str());
+  LOG_DBG("HTTP", "Heap free: %u, largest block: %u", esp_get_free_heap_size(),
+          heap_caps_get_largest_free_block(MALLOC_CAP_DEFAULT));
 
   http.begin(*client, url.c_str());
   http.setReuse(false);