From 06b6de2a08909e4d6c3fd7ffb3677ec07e5d389f Mon Sep 17 00:00:00 2001
From: highlander <highlander@keepkey.com>
Date: Mon, 14 Sep 2026 15:02:17 -0600
Subject: [PATCH 1/2] ci: exercise Python harness against audited firmware
 candidates

---
 .github/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 15aba8b8..ecb16777 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -125,7 +125,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: BitHighlander/keepkey-firmware
-          ref: d0a494a805533f02387f58d89dbb6f1fb09a621a
+          ref: d33f1711c3b2b205f64c5dc35fdec02926a6dc63
           path: keepkey-firmware
 
       # NOT `submodules: recursive`. trezor-firmware carries a micropython
@@ -362,7 +362,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: BitHighlander/keepkey-firmware
-          ref: e6a6711e5e4164d3b3840356dc301aa873f1fbf7
+          ref: 4125e1c7409b1cb7b08ba595bc408e3128fc24ca
           path: keepkey-firmware
 
       - name: Init the submodules the emulator build needs
@@ -543,10 +543,10 @@ jobs:
       matrix:
         include:
           - release: "7.14.3"
-            firmware_ref: e6a6711e5e4164d3b3840356dc301aa873f1fbf7
+            firmware_ref: 4125e1c7409b1cb7b08ba595bc408e3128fc24ca
             min_fw: "7.14.3"
           - release: "7.15"
-            firmware_ref: d0a494a805533f02387f58d89dbb6f1fb09a621a
+            firmware_ref: d33f1711c3b2b205f64c5dc35fdec02926a6dc63
             min_fw: "7.15.0"
 
     # KK_BITCOIN_ONLY=ON is a second shipping product, not a build flavour:

From 11b976157b09f526022b235002f327f36e9fe4a4 Mon Sep 17 00:00:00 2001
From: highlander <highlander@keepkey.com>
Date: Mon, 14 Sep 2026 15:09:15 -0600
Subject: [PATCH 2/2] ci: run CircleCI against the same 7.15 audit head

---
 .circleci/config.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index b445e9d0..aea3a1a1 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -38,10 +38,10 @@ jobs:
             git remote add origin \
               https://github.com/BitHighlander/keepkey-firmware.git
             git fetch --depth 1 origin \
-              d0a494a805533f02387f58d89dbb6f1fb09a621a
+              d33f1711c3b2b205f64c5dc35fdec02926a6dc63
             git checkout --detach FETCH_HEAD
             test "$(git rev-parse HEAD)" = \
-              d0a494a805533f02387f58d89dbb6f1fb09a621a
+              d33f1711c3b2b205f64c5dc35fdec02926a6dc63
 
             # Match firmware CI's build set. A recursive init reaches optional
             # trezor-firmware vendors that do not support shallow HTTPS clones.