Secure Firmware Over-The-Air (FOTA) updates are essential for Critical Infrastructure IoT (CI-IoT) devices, but impose severe energy costs on battery-powered nodes operating over Low Power Wide Area Networks such as NB-IoT. This paper presents HASAC (Hardware-Aware Segmented Authenticated Compression), a FOTA framework for resource-constrained IoT devices that minimises update energy by dynamically adapting cryptographic and compression strategies to device hardware capabilities and radio conditions. We implement HASAC on a Cortex-M33 platform and show that radio transmission and interconnect overhead account for more than 90% of the total update energy, while cryptographic computation contributes only a small fraction. We further demonstrate that on devices equipped with hardware security modules, AES-128-CCM achieves more than an order-of-magnitude improvement in throughput and energy efficiency compared to software implementations, even for small firmware segments. Building on these insights, HASAC dynamically selects between hardware-accelerated AES and software-optimised ChaCha20-Poly1305, and applies link-aware LZ4 compression only when it yields a positive energy return. Model-based evaluation demonstrates that, in deep coverage scenarios, HASAC reduces the total energy cost of secure firmware updates by up to 30% compared to conventional uncompressed baselines, reconciling strong security guarantees with long-term battery longevity.