diff --git a/esphome/components/api/__init__.py b/esphome/components/api/__init__.py
index 84589d540d3..43677ebfdce 100644
--- a/esphome/components/api/__init__.py
+++ b/esphome/components/api/__init__.py
@@ -1,5 +1,6 @@
 import base64
 import logging
+import pathlib
 
 from esphome import automation
 from esphome.automation import Condition
@@ -458,6 +459,10 @@ async def to_code(config: ConfigType) -> None:
         # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
         cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
         cg.add_build_flag("-DHAVE_INLINE_ASM=1")
+        # Compile crypto libraries with -O2 for speed instead of -Os.
+        # Crypto is CPU-bound and benefits significantly from speed optimization.
+        # GCC uses the last -O flag, so appending -O2 overrides the global -Os.
+        _write_crypto_optimize_script()
     else:
         cg.add_define("USE_API_PLAINTEXT")
 
@@ -465,6 +470,17 @@ async def to_code(config: ConfigType) -> None:
     cg.add_global(api_ns.using)
 
 
+_CRYPTO_OPTIMIZE_SCRIPT = "crypto_optimize.py"
+
+
+def _write_crypto_optimize_script() -> None:
+    from esphome.helpers import copy_file_if_changed
+
+    script_src = pathlib.Path(__file__).parent / f"{_CRYPTO_OPTIMIZE_SCRIPT}.script"
+    copy_file_if_changed(script_src, CORE.relative_build_path(_CRYPTO_OPTIMIZE_SCRIPT))
+    cg.add_platformio_option("extra_scripts", [f"post:{_CRYPTO_OPTIMIZE_SCRIPT}"])
+
+
 KEY_VALUE_SCHEMA = cv.Schema({cv.string: cv.templatable(cv.string_strict)})
 
 
diff --git a/esphome/components/api/crypto_optimize.py.script b/esphome/components/api/crypto_optimize.py.script
new file mode 100644
index 00000000000..1093a09bf6a
--- /dev/null
+++ b/esphome/components/api/crypto_optimize.py.script
@@ -0,0 +1,9 @@
+# Compile libsodium with -O2 for speed instead of the default -Os.
+# libsodium provides the crypto primitives (Curve25519, ChaCha20, Poly1305)
+# used by the Noise protocol and benefits significantly from speed optimization.
+# GCC uses the last -O flag, so appending -O2 overrides the global -Os.
+Import("env")
+
+for lb in env.GetLibBuilders():
+    if lb.name == "libsodium":
+        lb.env.Append(CCFLAGS=["-O2"])
diff --git a/script/cpp_benchmark.py b/script/cpp_benchmark.py
index 92faa05819a..5080a9fec74 100755
--- a/script/cpp_benchmark.py
+++ b/script/cpp_benchmark.py
@@ -26,12 +26,11 @@ CORE_BENCHMARKS_DIR: Path = Path(root_path) / "tests" / "benchmarks" / "core"
 STUBS_DIR: Path = Path(root_path) / "tests" / "benchmarks" / "stubs"
 
 PLATFORMIO_OPTIONS = {
-    "build_unflags": [
-        "-Os",  # remove default size-opt
-    ],
     "build_flags": [
-        "-O2",  # optimize for speed (CodSpeed recommends RelWithDebInfo)
+        "-Os",  # match firmware optimization level (detects inlining regressions)
         "-g",  # debug symbols for profiling
+        "-ffunction-sections",  # required for dead-code stripping with -Os
+        "-fdata-sections",  # required for dead-code stripping with -Os
         "-DUSE_BENCHMARK",  # disable WarnIfComponentBlockingGuard in finish()
         f"-I{STUBS_DIR}",  # stub headers for ESP32-only components
     ],