diff --git a/.circleci/config.yml b/.circleci/config.yml
index 4f3f8256b..b64561d01 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -48,8 +48,8 @@ commands:
 jobs:
   prep_env:
     docker:
-      # Docker image: tlaurion/heads-dev-env:v0.2.7
-      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
+      # Docker image: tlaurion/heads-dev-env:v0.2.9
+      - image: tlaurion/heads-dev-env@sha256:96f8f91c6464305c4a990d59f9ef93910c16c7fd0501a46b43b34a4600a368de
     resource_class: large
     working_directory: ~/heads
     steps:
@@ -124,8 +124,8 @@ jobs:
 
   build_and_persist:
     docker:
-      # Docker image: tlaurion/heads-dev-env:v0.2.7
-      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
+      # Docker image: tlaurion/heads-dev-env:v0.2.9
+      - image: tlaurion/heads-dev-env@sha256:96f8f91c6464305c4a990d59f9ef93910c16c7fd0501a46b43b34a4600a368de
     resource_class: large
     working_directory: ~/heads
     parameters:
@@ -153,8 +153,8 @@ jobs:
 
   build:
     docker:
-      # Docker image: tlaurion/heads-dev-env:v0.2.7
-      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
+      # Docker image: tlaurion/heads-dev-env:v0.2.9
+      - image: tlaurion/heads-dev-env@sha256:96f8f91c6464305c4a990d59f9ef93910c16c7fd0501a46b43b34a4600a368de
     resource_class: large
     working_directory: ~/heads
     parameters:
@@ -175,8 +175,8 @@ jobs:
 
   save_cache:
     docker:
-      # Docker image: tlaurion/heads-dev-env:v0.2.7
-      - image: tlaurion/heads-dev-env@sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
+      # Docker image: tlaurion/heads-dev-env:v0.2.9
+      - image: tlaurion/heads-dev-env@sha256:96f8f91c6464305c4a990d59f9ef93910c16c7fd0501a46b43b34a4600a368de
     resource_class: large
     working_directory: ~/heads
     steps:
diff --git a/boards/novacustom-v540tu/novacustom-v540tu.config b/boards/novacustom-v540tu/novacustom-v540tu.config
index 7f1d023f6..6b6d757a2 100644
--- a/boards/novacustom-v540tu/novacustom-v540tu.config
+++ b/boards/novacustom-v540tu/novacustom-v540tu.config
@@ -15,6 +15,7 @@
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=dasharo
+export CONFIG_DASHARO_EC=y
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-novacustom-v540tu.config
diff --git a/boards/novacustom-v560tu/novacustom-v560tu.config b/boards/novacustom-v560tu/novacustom-v560tu.config
index cf6e7a095..f9899c705 100644
--- a/boards/novacustom-v560tu/novacustom-v560tu.config
+++ b/boards/novacustom-v560tu/novacustom-v560tu.config
@@ -15,6 +15,7 @@
 
 export CONFIG_COREBOOT=y
 export CONFIG_COREBOOT_VERSION=dasharo
+export CONFIG_DASHARO_EC=y
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-novacustom-v560tu.config
diff --git a/config/coreboot-novacustom-v540tu.config b/config/coreboot-novacustom-v540tu.config
index 4f947d78c..44da03805 100644
--- a/config/coreboot-novacustom-v540tu.config
+++ b/config/coreboot-novacustom-v540tu.config
@@ -543,8 +543,9 @@ CONFIG_RCBA_LENGTH=0x4000
 # Embedded Controllers
 #
 CONFIG_EC_ACPI=y
-CONFIG_EC_SYSTEM76_EC=y
-# CONFIG_EC_SYSTEM76_EC_UPDATE is not set
+CONFIG_EC_DASHARO_EC=y
+CONFIG_EC_DASHARO_EC_UPDATE=y
+CONFIG_EC_DASHARO_EC_UPDATE_FILE="ec.rom"
 
 #
 # Intel Firmware
diff --git a/docker/DOCKER_REPRO_DIGEST b/docker/DOCKER_REPRO_DIGEST
index 7e1624946..95c2adc21 100644
--- a/docker/DOCKER_REPRO_DIGEST
+++ b/docker/DOCKER_REPRO_DIGEST
@@ -9,5 +9,5 @@
 # sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 
 # Place the digest on the first non-comment line below (remove the leading '#')
-# Version: v0.2.7
-sha256:5f890f3d1b6b57f9e567191695df003a2ee880f084f5dfe7a5633e3e8f937479
+# Version: v0.2.9
+sha256:96f8f91c6464305c4a990d59f9ef93910c16c7fd0501a46b43b34a4600a368de
diff --git a/flake.lock b/flake.lock
index f1f0771ca..3f671b431 100644
--- a/flake.lock
+++ b/flake.lock
@@ -34,10 +34,27 @@
         "type": "github"
       }
     },
+    "nixpkgs-sdcc": {
+      "locked": {
+        "lastModified": 1706220439,
+        "narHash": "sha256-JMPlh3WoVVOSFSGdetBDKKkKkLNwnTqewFn+g1v2n/A=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "7a339d87931bba829f68e94621536cad9132971a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "7a339d87931bba829f68e94621536cad9132971a",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-sdcc": "nixpkgs-sdcc"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index 0b985424a..bd0c226bf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,6 +4,10 @@
   # Inputs define external dependencies and their sources.
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; # Using the unstable channel for the latest packages, while flake.lock fixates the commit reused until changed.
+    # No flake for 3.8.0
+    # Pinned nixpkgs for sdcc 4.2.0 - matches: https://github.com/Dasharo/ec-sdk/pull/2
+    # sdcc 4.5.0 has optimizer bug: https://github.com/Dasharo/dasharo-issues/issues/1785
+    nixpkgs-sdcc.url = "github:nixos/nixpkgs/7a339d87931bba829f68e94621536cad9132971a";
     flake-utils.url = "github:numtide/flake-utils"; # Utilities for flake functionality.
   };
   # Outputs are the result of the flake, including the development environment and Docker image.
@@ -11,10 +15,12 @@
     self,
     flake-utils,
     nixpkgs,
+    nixpkgs-sdcc,
     ...
   }:
     flake-utils.lib.eachDefaultSystem (system: let
       pkgs = nixpkgs.legacyPackages.${system}; # Accessing the legacy package set.
+      pkgs-sdcc = nixpkgs-sdcc.legacyPackages.${system}; # Pinned for sdcc 4.2.0
       lib = pkgs.lib; # The standard Nix packages library.
 
       # Dependencies are the packages required for the Heads project.
@@ -63,11 +69,13 @@
         psmisc #process tools like killall, pstree, etc
         python3 # me_cleaner, coreboot
         rsync # coreboot
+        pkgs-sdcc.sdcc  # Dasharo EC build — pinned to 4.2.0 (matches Debian oldstable, 4.5 has optimizer bug)
         sharutils
         texinfo
         unzip
         wget
         which
+        xxd # Dasharo EC build
         xz
         zip
         zlib
diff --git a/modules/dasharo-ec b/modules/dasharo-ec
new file mode 100644
index 000000000..1675ea363
--- /dev/null
+++ b/modules/dasharo-ec
@@ -0,0 +1,53 @@
+ifeq "$(CONFIG_DASHARO_EC)" "y"
+
+modules-y += dasharo-ec
+
+dasharo-ec_repo := https://github.com/Dasharo/ec
+dasharo-ec_commit_hash := d198b641195e60e13afc17be9464e4f402d1c2fa
+
+# Map BOARD to the EC board model
+ifeq "$(BOARD)" "novacustom-v540tu"
+DASHARO_EC_BOARD_MODEL := v540tu
+else ifeq "$(BOARD)" "novacustom-v560tu"
+DASHARO_EC_BOARD_MODEL := v560tu
+else
+$(error "$(BOARD): no Dasharo EC board model mapping defined")
+endif
+
+dasharo-ec_version := $(dasharo-ec_commit_hash)
+dasharo-ec_base_dir := dasharo-ec-$(dasharo-ec_version)-$(BOARD)
+dasharo-ec_dir := dasharo-ec-$(dasharo-ec_version)-$(BOARD)
+
+# ec.rom is copied to a stable path by the explicit rule below
+dasharo-ec_output := ec.rom
+
+# No-op configure: submodules are handled by the EC Makefile's canary rule
+# for git repos
+dasharo-ec_configure :=
+
+# Build the EC firmware: only pass make arguments; post-build steps are
+# handled by the explicit rule below.
+dasharo-ec_target := BOARD=novacustom/$(DASHARO_EC_BOARD_MODEL)
+
+# Copy ec.rom from the dynamic build path to a stable location and pad to
+# 128KB as required by coreboot. Runs after the module make completes.
+$(build)/$(dasharo-ec_dir)/ec.rom: $(build)/$(dasharo-ec_dir)/.build
+	sh -c 'cp $(build)/$(dasharo-ec_dir)/build/novacustom/$(DASHARO_EC_BOARD_MODEL)/*/ec.rom $@'
+	dd if=/dev/zero of=$@ bs=1 seek=128k count=0
+
+# Copy ec.rom into the coreboot source tree before coreboot builds.
+# coreboot_base_dir (coreboot-dasharo) is shared between v540tu and v560tu, so
+# a plain timestamp-based rule is racy: whichever board built last wins the mtime
+# race and the other board silently keeps the wrong binary.  Adding FORCE makes the
+# recipe always run so we can do a content check; the actual cp (and the mtime
+# update that triggers downstream rebuilds) only happens when the content differs.
+$(build)/$(coreboot_base_dir)/ec.rom: $(build)/$(dasharo-ec_dir)/ec.rom FORCE
+	@if ! cmp -s "$(build)/$(dasharo-ec_dir)/ec.rom" "$@" 2>/dev/null; then \
+		echo "$(DATE) COPY $(DASHARO_EC_BOARD_MODEL) ec.rom -> coreboot"; \
+		cp "$(build)/$(dasharo-ec_dir)/ec.rom" "$@"; \
+	fi
+
+# Ensure coreboot's configure step depends on ec.rom being present
+$(build)/$(coreboot_dir)/.configured: $(build)/$(coreboot_base_dir)/ec.rom
+
+endif