diff --git a/components/bootloader_support/include_bootloader/bootloader_utility.h b/components/bootloader_support/include_bootloader/bootloader_utility.h
index e1abc04f44..e072d7d76a 100644
--- a/components/bootloader_support/include_bootloader/bootloader_utility.h
+++ b/components/bootloader_support/include_bootloader/bootloader_utility.h
@@ -96,9 +96,10 @@ void bootloader_atexit(void);
 esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_hex, size_t len);
 
 /**
- * @brief Debug log contents of a buffer as hexadecimal
+ * @brief Debug log contents of a buffer as hexadecimal.
  *
- * @note Only works if component log level is DEBUG or higher.
+ * @note - Only works if component log level is DEBUG or higher.
+ *       - It will print at most 128 bytes from @c buffer.
  *
  * @param buffer Buffer to log
  * @param length Length of buffer in bytes. Maximum length 128 bytes.
diff --git a/components/bootloader_support/src/bootloader_utility.c b/components/bootloader_support/src/bootloader_utility.c
index 65d8f65262..1d35b6badb 100644
--- a/components/bootloader_support/src/bootloader_utility.c
+++ b/components/bootloader_support/src/bootloader_utility.c
@@ -856,22 +856,19 @@ esp_err_t bootloader_sha256_hex_to_str(char *out_str, const uint8_t *in_array_he
 
 void bootloader_debug_buffer(const void *buffer, size_t length, const char *label)
 {
-#if BOOT_LOG_LEVEL >= LOG_LEVEL_DEBUG
-    assert(length <= 128); // Avoid unbounded VLA size
+#if CONFIG_BOOTLOADER_LOG_LEVEL >= 4
     const uint8_t *bytes = (const uint8_t *)buffer;
-    char hexbuf[length * 2 + 1];
-    hexbuf[length * 2] = 0;
-    for (size_t i = 0; i < length; i++) {
-        for (int shift = 0; shift < 2; shift++) {
-            uint8_t nibble = (bytes[i] >> (shift ? 0 : 4)) & 0x0F;
-            if (nibble < 10) {
-                hexbuf[i * 2 + shift] = '0' + nibble;
-            } else {
-                hexbuf[i * 2 + shift] = 'a' + nibble - 10;
-            }
-        }
-    }
+    const size_t output_len = MIN(length, 128);
+    char hexbuf[128 * 2 + 1];
+
+    bootloader_sha256_hex_to_str(hexbuf, bytes, output_len);
+
+    hexbuf[output_len * 2] = '\0';
     ESP_LOGD(TAG, "%s: %s", label, hexbuf);
+#else
+    (void) buffer;
+    (void) length;
+    (void) label;
 #endif
 }