diff --git a/components/esptool_py/Kconfig.projbuild b/components/esptool_py/Kconfig.projbuild
index 1709369b5a..b81a69ab8c 100644
--- a/components/esptool_py/Kconfig.projbuild
+++ b/components/esptool_py/Kconfig.projbuild
@@ -157,12 +157,16 @@ menu "Serial flasher config"
 
     config ESPTOOLPY_FLASHSIZE_DETECT
         bool "Detect flash size when flashing bootloader"
-        default y
+        default n
         help
             If this option is set, flashing the project will automatically detect
             the flash size of the target chip and update the bootloader image
             before it is flashed.
 
+            Enabling this option turns off the image protection against corruption
+            by a SHA256 digest. Updating the bootloader image before flashing would
+            invalidate the digest.
+
     choice ESPTOOLPY_BEFORE
         prompt "Before flashing"
         default ESPTOOLPY_BEFORE_RESET
diff --git a/components/esptool_py/project_include.cmake b/components/esptool_py/project_include.cmake
index fee433ea1d..2d1f4babd6 100644
--- a/components/esptool_py/project_include.cmake
+++ b/components/esptool_py/project_include.cmake
@@ -26,14 +26,14 @@ set(ESPFLASHSIZE ${CONFIG_ESPTOOLPY_FLASHSIZE})
 
 set(ESPTOOLPY_CHIP "${chip_model}")
 
-set(ESPTOOLPY_FLASH_OPTIONS
+set(esptool_elf2image_args
     --flash_mode ${ESPFLASHMODE}
     --flash_freq ${ESPFLASHFREQ}
     --flash_size ${ESPFLASHSIZE}
     )
 
 if(NOT BOOTLOADER_BUILD)
-    set(esptool_elf2image_args --elf-sha256-offset 0xb0)
+    list(APPEND esptool_elf2image_args --elf-sha256-offset 0xb0)
 endif()
 
 if(NOT CONFIG_SECURE_BOOT_ALLOW_SHORT_APP_PARTITION AND
@@ -59,9 +59,14 @@ if(min_rev)
 endif()
 
 if(CONFIG_ESPTOOLPY_FLASHSIZE_DETECT)
-    # Set ESPFLASHSIZE to 'detect' *after* elf2image options are generated,
+    # Set ESPFLASHSIZE to 'detect' *after* esptool_elf2image_args are generated,
     # as elf2image can't have 'detect' as an option...
     set(ESPFLASHSIZE detect)
+
+    # Flash size detection updates the image header which would invalidate the appended
+    # SHA256 digest. Therefore, a digest is not appended in that case.
+    # This argument requires esptool>=4.1.
+    set(esptool_elf2image_args --dont-append-digest)
 endif()
 
 if(CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME)
@@ -87,7 +92,7 @@ set(PROJECT_BIN "${elf_name}.bin")
 #
 if(CONFIG_APP_BUILD_GENERATE_BINARIES)
     add_custom_command(OUTPUT "${build_dir}/.bin_timestamp"
-        COMMAND ${ESPTOOLPY} elf2image ${ESPTOOLPY_FLASH_OPTIONS} ${esptool_elf2image_args}
+        COMMAND ${ESPTOOLPY} elf2image ${esptool_elf2image_args}
             -o "${build_dir}/${unsigned_project_binary}" "${elf_dir}/${elf}"
         COMMAND ${CMAKE_COMMAND} -E echo "Generated ${build_dir}/${unsigned_project_binary}"
         COMMAND ${CMAKE_COMMAND} -E md5sum "${build_dir}/${unsigned_project_binary}" > "${build_dir}/.bin_timestamp"
@@ -183,7 +188,8 @@ if(CONFIG_ESPTOOLPY_NO_STUB)
 endif()
 
 idf_component_set_property(esptool_py FLASH_ARGS "${esptool_flash_main_args}")
-idf_component_set_property(esptool_py FLASH_SUB_ARGS "${ESPTOOLPY_FLASH_OPTIONS}")
+idf_component_set_property(esptool_py FLASH_SUB_ARGS "--flash_mode ${ESPFLASHMODE} --flash_freq ${ESPFLASHFREQ} \
+--flash_size ${ESPFLASHSIZE}")
 
 function(esptool_py_partition_needs_encryption retencrypted partition_name)
     # Check if encryption is enabled