diff --git a/esphome/components/api/api_frame_helper.h b/esphome/components/api/api_frame_helper.h
index 03f3814bb9..2b4e9ea3cd 100644
--- a/esphome/components/api/api_frame_helper.h
+++ b/esphome/components/api/api_frame_helper.h
@@ -29,6 +29,10 @@ static constexpr uint16_t MAX_MESSAGE_SIZE = 8192;  // 8 KiB for ESP8266
 static constexpr uint16_t MAX_MESSAGE_SIZE = 32768;  // 32 KiB for ESP32 and other platforms
 #endif
 
+// Extra byte reserved in rx_buf_ beyond the message size so protobuf
+// StringRef fields can be null-terminated in-place after decode.
+static constexpr uint16_t RX_BUF_NULL_TERMINATOR = 1;
+
 // Maximum number of messages to batch in a single write operation
 // Must be >= MAX_INITIAL_PER_BATCH in api_connection.h (enforced by static_assert there)
 static constexpr size_t MAX_MESSAGES_PER_BATCH = 34;
diff --git a/esphome/components/api/api_frame_helper_noise.cpp b/esphome/components/api/api_frame_helper_noise.cpp
index 882a9e86f4..3fc5040e95 100644
--- a/esphome/components/api/api_frame_helper_noise.cpp
+++ b/esphome/components/api/api_frame_helper_noise.cpp
@@ -201,11 +201,11 @@ APIError APINoiseFrameHelper::try_read_frame_() {
     return (state_ == State::DATA) ? APIError::BAD_DATA_PACKET : APIError::BAD_HANDSHAKE_PACKET_LEN;
   }
 
-  // Reserve space for body (+1 for null terminator in DATA state so protobuf
+  // Reserve space for body (+ null terminator in DATA state so protobuf
   // StringRef fields can be safely null-terminated in-place after decode.
   // During handshake, rx_buf_.size() is used in prologue construction, so
   // the buffer must be exactly msg_size to avoid prologue mismatch.)
-  uint16_t alloc_size = msg_size + (state_ == State::DATA ? 1 : 0);
+  uint16_t alloc_size = msg_size + (state_ == State::DATA ? RX_BUF_NULL_TERMINATOR : 0);
   if (this->rx_buf_.size() != alloc_size) {
     this->rx_buf_.resize(alloc_size);
   }
@@ -411,7 +411,10 @@ APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
 
   NoiseBuffer mbuf;
   noise_buffer_init(mbuf);
-  noise_buffer_set_inout(mbuf, this->rx_buf_.data(), this->rx_buf_.size(), this->rx_buf_.size());
+  // rx_buf_ has RX_BUF_NULL_TERMINATOR extra byte for null termination,
+  // but only the actual message bytes contain encrypted data
+  size_t msg_size = this->rx_buf_.size() - RX_BUF_NULL_TERMINATOR;
+  noise_buffer_set_inout(mbuf, this->rx_buf_.data(), msg_size, msg_size);
   int err = noise_cipherstate_decrypt(this->recv_cipher_, &mbuf);
   APIError decrypt_err =
       handle_noise_error_(err, LOG_STR("noise_cipherstate_decrypt"), APIError::CIPHERSTATE_DECRYPT_FAILED);
diff --git a/esphome/components/api/api_frame_helper_plaintext.cpp b/esphome/components/api/api_frame_helper_plaintext.cpp
index b721843d07..e2bb56e0ac 100644
--- a/esphome/components/api/api_frame_helper_plaintext.cpp
+++ b/esphome/components/api/api_frame_helper_plaintext.cpp
@@ -163,10 +163,10 @@ APIError APIPlaintextFrameHelper::try_read_frame_() {
   }
   // header reading done
 
-  // Reserve space for body (+1 for null terminator so protobuf StringRef fields
+  // Reserve space for body (+ null terminator so protobuf StringRef fields
   // can be safely null-terminated in-place after decode)
-  if (this->rx_buf_.size() != this->rx_header_parsed_len_ + 1) {
-    this->rx_buf_.resize(this->rx_header_parsed_len_ + 1);
+  if (this->rx_buf_.size() != this->rx_header_parsed_len_ + RX_BUF_NULL_TERMINATOR) {
+    this->rx_buf_.resize(this->rx_header_parsed_len_ + RX_BUF_NULL_TERMINATOR);
   }
 
   if (rx_buf_len_ < rx_header_parsed_len_) {