diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 14fcefd..782b19b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -26,6 +26,21 @@ jobs:
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
+      - name: check indentation of our firmware C code
+        working-directory: hw/application_fpga
+        run: |
+          make -C fw/tk1 checkfmt
+          make -C fw/testfw checkfmt
+
+      - name: run static analysis on firmware C code
+        working-directory: hw/application_fpga
+        run: |
+          make check
+
+      - name: lint verilog using verilator
+        working-directory: hw/application_fpga
+        run: make lint
+
       - name: compile ch552 firmware
         working-directory: hw/boards/mta1-usb-v1/ch552_fw
         run: make
@@ -38,16 +53,6 @@ jobs:
         working-directory: hw/application_fpga
         run: make firmware.bin testfw.bin
 
-      - name: check fmt of our firmware C code
-        working-directory: hw/application_fpga
-        run: |
-          make -C fw/tk1 checkfmt
-          make -C fw/testfw checkfmt
-
-      - name: lint verilog using verilator
-        working-directory: hw/application_fpga
-        run: make lint
-
       # doing this last as it takes long time
       - name: make application FPGA gateware
         working-directory: hw/application_fpga
diff --git a/hw/application_fpga/Makefile b/hw/application_fpga/Makefile
index d570d33..2596039 100644
--- a/hw/application_fpga/Makefile
+++ b/hw/application_fpga/Makefile
@@ -149,6 +149,9 @@ firmware.elf: $(FIRMWARE_OBJS) $(P)/fw/tk1/firmware.lds
 .PHONY: check
 check:
 	clang-tidy -header-filter=.* -checks=cert-* $(FIRMWARE_SOURCES) -- $(CFLAGS)
+
+.PHONY: splint
+splint:
 	splint -nolib -predboolint +boolint -nullpass -unrecog -infloops -initallelements -type -unreachable -unqualifiedtrans -fullinitblock $(FIRMWARE_SOURCES)
 
 testfw.elf: $(TESTFW_OBJS) $(P)/fw/tk1/firmware.lds
@@ -165,6 +168,8 @@ testfw.hex: testfw.bin testfw_size_mismatch
 
 .PHONY: check-binary-hashes
 check-binary-hashes:
+	sha512sum firmware.bin
+	sha256sum application_fpga.bin
 	sha512sum -c firmware.bin.sha512
 	sha256sum -c application_fpga.bin.sha256
 
@@ -350,6 +355,8 @@ help:
 	@echo "Supported targets:"
 	@echo "------------------"
 	@echo "all                Build all targets."
+	@echo "check              Run static analysis on firmware."
+	@echo "splint             Run splint static analysis on firmware."
 	@echo "firmware.elf       Build firmware ELF file."
 	@echo "firmware.hex       Build firmware converted to hex, to be included in bitstream."
 	@echo "bram_fw.hex        Build a fake BRAM file that will be filled in later after place-n-route."