diff --git a/hw/application_fpga/application_fpga.bin.sha256 b/hw/application_fpga/application_fpga.bin.sha256
index a274ed3..3b237b2 100644
--- a/hw/application_fpga/application_fpga.bin.sha256
+++ b/hw/application_fpga/application_fpga.bin.sha256
@@ -1 +1 @@
-f36d1b36ee4358cff4f828b5bbaee8aa7d5cc853f2d87c6e2924b29a6a4fdca6  application_fpga.bin
+0a928ee743d923335e6d53e3d3677b9a54b1194510718e55c6e5fbc4605c1aa6  application_fpga.bin
diff --git a/hw/application_fpga/firmware.bin.sha512 b/hw/application_fpga/firmware.bin.sha512
index fa5869f..bf75d58 100644
--- a/hw/application_fpga/firmware.bin.sha512
+++ b/hw/application_fpga/firmware.bin.sha512
@@ -1 +1 @@
-fe6d7b6db02d79e634373d1454a88b942f77cffe490ee30dc949581afab43161648e416d482b6ddd02f976e195b4d51d60030d0d27aef8497f45135d35034733  firmware.bin
+4be2767d5ddd30b5422f4b58075365cb6d988259e88ffa14d6d243560b289f54eaf0c351e9d744cff8ec3a18b1830f3925a86f36bd2096c12eccce25ed44993c  firmware.bin
diff --git a/hw/application_fpga/fw/README.md b/hw/application_fpga/fw/README.md
index a23ffe2..d05dbe1 100644
--- a/hw/application_fpga/fw/README.md
+++ b/hw/application_fpga/fw/README.md
@@ -318,18 +318,22 @@ Firmware then proceeds to:
 
 1. Read the partition table from flash and store in FW\_RAM.
 
-2. Check the special resetinfo area in FW\_RAM for reset type. Type
+2. Reset the CH552 USB controller to a known state, only allowing the
+   CDC USB endpoint and the internal command channel between the CPU
+   and the CH552.
+
+3. Check the special resetinfo area in FW\_RAM for reset type. Type
    zero means default behaviour, load from flash app slot 0, expecting
    the app there to have a specific hardcoded BLAKE2s digest.
 
-3. Load app data from flash slot 0 into RAM.
+4. Load app data from flash slot 0 into RAM.
 
-4. Compute a BLAKE2s digest of the loaded app.
+5. Compute a BLAKE2s digest of the loaded app.
 
-5. Compare the computed digest against the allowed app digest
+6. Compare the computed digest against the allowed app digest
    hardcoded in the firmware. If it's not equal, halt CPU.
 
-6. [Start the device app](#start-the-device-app).
+7. [Start the device app](#start-the-device-app).
 
 ### Start the device app
 
diff --git a/hw/application_fpga/fw/tk1/main.c b/hw/application_fpga/fw/tk1/main.c
index 07810af..8e7ebac 100644
--- a/hw/application_fpga/fw/tk1/main.c
+++ b/hw/application_fpga/fw/tk1/main.c
@@ -525,6 +525,10 @@ int main(void)
 		assert(1 == 2);
 	}
 
+	// Reset the USB controller to only enable the USB CDC
+	// endpoint and the internal command channel.
+	config_endpoints(IO_CDC | IO_CH552);
+
 	led_set(LED_WHITE);
 
 #if defined(SIMULATION)