diff --git a/firmware/sdkconfig.defaults b/firmware/sdkconfig.defaults
index 32b07e4..b93aa5f 100644
--- a/firmware/sdkconfig.defaults
+++ b/firmware/sdkconfig.defaults
@@ -24,7 +24,20 @@ CONFIG_LOG_MAXIMUM_LEVEL_DEBUG=y
 # LFN on the heap keeps the working buffer off the (small) task stack.
 CONFIG_FATFS_LFN_HEAP=y
 
-# TLS trust store (Spike 6 — Wi-Fi + TLS, the gate for Spike 7 gitoxide push).
+# PSRAM (Spike 7 — the git working set needs it; the docs memory plan budgets
+# ~1.5 MB PSRAM for pack/delta work, and the rope buffer lives there too). This
+# board is an ESP32-S3-WROOM-1-N16R8 → 8 MB *octal* PSRAM, so OCT mode is
+# required (quad would fail to init). USE_MALLOC adds PSRAM to the heap
+# allocator, so large allocations (Box, Rope, libgit2 buffers) land there
+# instead of the ~339 KB internal DRAM Spike 6 measured. Octal PSRAM occupies
+# GPIO 33–37; the EPD/SD pins (4–13) deliberately avoid that range, so no wiring
+# conflict. Speed left at the 40 MHz default (safe first-enable; 80 MHz needs
+# matching flash-freq config and is a later tuning step).
+CONFIG_SPIRAM=y
+CONFIG_SPIRAM_MODE_OCT=y
+CONFIG_SPIRAM_USE_MALLOC=y
+
+# TLS trust store (Spike 6 — Wi-Fi + TLS, the gate for Spike 7 git push).
 # The certificate bundle backs esp_crt_bundle_attach so an HTTPS GET to
 # api.github.com validates against real roots. FULL rather than the common
 # subset so a less common CA in the chain can't surprise us on the bench.