diff --git a/apps/csms/src/index.ts b/apps/csms/src/index.ts
index 870aee0..b6b03ac 100644
--- a/apps/csms/src/index.ts
+++ b/apps/csms/src/index.ts
@@ -85,8 +85,12 @@ app.get(
   '/ocpp/:chargePointId',
   upgradeWebSocket((c) => {
     const chargePointId = c.req.param('chargePointId')
+    if (!chargePointId) {
+      throw new Error('Missing chargePointId route param')
+    }
     const connInfo = getConnInfo(c)
-    return createOcppHandler(chargePointId, connInfo.remote.address)
+    const requestedProtocol = c.req.header('sec-websocket-protocol')
+    return createOcppHandler(chargePointId, connInfo.remote.address, requestedProtocol)
   }),
 )
 
diff --git a/apps/csms/src/ocpp/handler.ts b/apps/csms/src/ocpp/handler.ts
index dfe2988..5a96980 100644
--- a/apps/csms/src/ocpp/handler.ts
+++ b/apps/csms/src/ocpp/handler.ts
@@ -92,6 +92,26 @@ function sendCallError(
   )
 }
 
+function pickOcppSubprotocol(
+  negotiatedProtocol?: string | null,
+  requestedHeader?: string | null,
+) {
+  if (negotiatedProtocol && isSupportedOCPP(negotiatedProtocol)) {
+    return negotiatedProtocol
+  }
+
+  if (!requestedHeader) {
+    return null
+  }
+
+  const requestedProtocols = requestedHeader
+    .split(',')
+    .map((value) => value.trim())
+    .filter(Boolean)
+
+  return requestedProtocols.find((protocol) => isSupportedOCPP(protocol)) ?? null
+}
+
 /**
  * Factory that produces a hono-ws event handler object for a single
  * OCPP WebSocket connection.
@@ -99,7 +119,11 @@ function sendCallError(
  * Usage in route:
  *   upgradeWebSocket((c) => createOcppHandler(c.req.param('chargePointId'), remoteAddr))
  */
-export function createOcppHandler(chargePointIdentifier: string, remoteAddr?: string) {
+export function createOcppHandler(
+  chargePointIdentifier: string,
+  remoteAddr?: string,
+  requestedProtocolHeader?: string,
+) {
   const ctx: OcppConnectionContext = {
     chargePointIdentifier,
     isRegistered: false,
@@ -107,14 +131,14 @@ export function createOcppHandler(chargePointIdentifier: string, remoteAddr?: st
 
   return {
     onOpen(_evt: Event, ws: WSContext) {
-      const subProtocol = ws.protocol ?? 'unknown'
-      if (!isSupportedOCPP(subProtocol)) {
+      const subProtocol = pickOcppSubprotocol(ws.protocol, requestedProtocolHeader)
+      if (!subProtocol) {
         ws.close(1002, 'Unsupported subprotocol')
         return
       }
       ocppConnections.set(chargePointIdentifier, ws)
       console.log(
-        `[OCPP] ${chargePointIdentifier} connected` +
+        `[OCPP] ${chargePointIdentifier} connected (${subProtocol})` +
           (remoteAddr ? ` from ${remoteAddr}` : ''),
       )
     },
diff --git a/hardware/firmware/lib/mongoose/mongoose_config.h b/hardware/firmware/lib/mongoose/mongoose_config.h
index 910630d..e540434 100644
--- a/hardware/firmware/lib/mongoose/mongoose_config.h
+++ b/hardware/firmware/lib/mongoose/mongoose_config.h
@@ -1 +1,2 @@
 #define MG_ARCH MG_ARCH_ESP32
+#define MG_TLS MG_TLS_MBED // Use ESP-IDF built-in mbedTLS for WSS support