diff --git a/firmware/Makefile b/firmware/Makefile
index a80ac819a..b65c470a9 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -23,12 +23,15 @@ PATH_BOOTSTRAP=bootstrap
 PATH_APPLICATION=application
 PATH_BASEBAND=baseband
 
+# TODO: Pass these (as #defines?) to Makefiles, use values in code.
 PAD_BOOTSTRAP=0x10000
-PAD_BASEBAND=0x10000
+PAD_HACKRF_FIRMWARE=0x10000
+PAD_BASEBAND=0x20000
 
 TARGET=portapack-h1-firmware
 
 TARGET_BOOTSTRAP=$(PATH_BOOTSTRAP)/bootstrap
+TARGET_HACKRF_FIRMWARE=hackrf_one_usb_rom_to_ram
 TARGET_APPLICATION=$(PATH_APPLICATION)/build/application
 TARGET_BASEBAND=$(PATH_BASEBAND)/build/baseband
 
@@ -53,12 +56,16 @@ program: $(TARGET).bin
 	sleep 1s
 	hackrf_spiflash -w $(TARGET).bin
 
-$(TARGET).bin: $(TARGET_BOOTSTRAP)_pad.bin $(TARGET_BASEBAND)_pad.bin $(TARGET_APPLICATION).bin
-	cat $(TARGET_BOOTSTRAP)_pad.bin $(TARGET_BASEBAND)_pad.bin $(TARGET_APPLICATION).bin >$(TARGET).bin
+$(TARGET).bin: $(TARGET_BOOTSTRAP)_pad.bin $(TARGET_HACKRF_FIRMWARE)_pad.bin $(TARGET_BASEBAND)_pad.bin $(TARGET_APPLICATION).bin
+	cat $(TARGET_BOOTSTRAP)_pad.bin $(TARGET_HACKRF_FIRMWARE)_pad.bin $(TARGET_BASEBAND)_pad.bin $(TARGET_APPLICATION).bin >$(TARGET).bin
 
 $(TARGET_BOOTSTRAP)_pad.bin: $(TARGET_BOOTSTRAP).elf
 	$(CP) -O binary --pad-to $(PAD_BOOTSTRAP) $(TARGET_BOOTSTRAP).elf $(TARGET_BOOTSTRAP)_pad.bin
 
+$(TARGET_HACKRF_FIRMWARE)_pad.bin: $(TARGET_HACKRF_FIRMWARE).bin
+	# TODO: Not confident this is reliable. It certainly won't work on Windows.
+	dd if=/dev/null of=$(TARGET_HACKRF_FIRMWARE)_pad.bin bs=1 count=1 seek=$(PAD_HACKRF_FIRMWARE)
+
 $(TARGET_BASEBAND)_pad.bin: $(TARGET_BASEBAND).elf
 	$(CP) -O binary --pad-to $(PAD_BASEBAND) $(TARGET_BASEBAND).elf $(TARGET_BASEBAND)_pad.bin
 
diff --git a/firmware/application/m4_startup.cpp b/firmware/application/m4_startup.cpp
index 100983e34..b2ba689ed 100644
--- a/firmware/application/m4_startup.cpp
+++ b/firmware/application/m4_startup.cpp
@@ -27,7 +27,7 @@
 #include <cstddef>
 #include <cstring>
 
-static constexpr uint32_t m4_text_flash_image_offset = 0x10000;
+static constexpr uint32_t m4_text_flash_image_offset = 0x20000;
 static constexpr size_t m4_text_size = 0x8000;
 static constexpr uint32_t m4_text_flash_base = LPC_SPIFI_DATA_CACHED_BASE + m4_text_flash_image_offset;
 static constexpr uint32_t m4_text_ram_base = 0x10080000;
diff --git a/firmware/bootstrap/bootstrap.c b/firmware/bootstrap/bootstrap.c
index 87f9d8eff..862b861f4 100644
--- a/firmware/bootstrap/bootstrap.c
+++ b/firmware/bootstrap/bootstrap.c
@@ -99,7 +99,7 @@ int main(void) {
 	/* NOTE: MEMMAP registers are ORed with the shadow address to create the
 	 * actual address.
 	 */
-	LPC_CREG->M0APPMEMMAP = LPC_SPIFI_DATA_CACHED_BASE + 0x20000;
+	LPC_CREG->M0APPMEMMAP = LPC_SPIFI_DATA_CACHED_BASE + 0x40000;
 
 	/* Change M0APP_RST to 0 */
 	LPC_RGU->RESET_CTRL[1] = 0;