diff --git a/esphome/net_retry.py b/esphome/net_retry.py
index c56d45e217..f7e6e601ea 100644
--- a/esphome/net_retry.py
+++ b/esphome/net_retry.py
@@ -73,6 +73,8 @@ def is_transient_download_error(e: Exception) -> bool:
         e
     ):
         return False
+    # SSLError (a ConnectionError subclass) stays transient on purpose: it
+    # also covers mid-handshake connection drops, not just bad certificates.
     return isinstance(
         e,
         (