diff --git a/.github/workflows/builder.yml b/.github/workflows/builder.yml
index ab6cf93..6dce797 100644
--- a/.github/workflows/builder.yml
+++ b/.github/workflows/builder.yml
@@ -89,8 +89,9 @@ jobs:
       with:
         name: openwrt_firmware_${{ env.DEVICE_NAME }}_${{ env.FILE_DATE }}
         path: |
-          ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3-gpt_both0.bin
+          ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3-ext4-gpt_both0.bin
           ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3-ext4-boot.img
           ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3-ext4-system.img
           ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3.manifest
           ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3-flash.sh
+          ${{ env.FIRMWARE }}/openwrt-msm89xx-msm8916-yiming-uz801v3-firmware.zip
diff --git a/.gitignore b/.gitignore
index bd48527..1ef408a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
 bin
-base_partitions/saved
 modem.bin
 persist.bin
\ No newline at end of file
diff --git a/base_partitions/aboot.mbn b/base_partitions/aboot.mbn
deleted file mode 100644
index 2633704..0000000
Binary files a/base_partitions/aboot.mbn and /dev/null differ
diff --git a/base_partitions/build.sh b/base_partitions/build.sh
deleted file mode 100644
index 3004dee..0000000
--- a/base_partitions/build.sh
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/bin/bash
-set -e
-
-OUTPUT_DIR="$1"
-TMPDIR=$(mktemp -d)
-
-# Cleanup on exit
-trap "rm -rf $TMPDIR" EXIT
-
-if [ -z "$OUTPUT_DIR" ]; then
-    echo "Usage: $0 <output_directory>"
-    exit 1
-fi
-
-# Create output directory
-mkdir -p "$OUTPUT_DIR"
-
-# Clone repositories
-for repo in qhypstub:qhypstub lk2nd:lk2nd qtestsign:qtestsign; do
-    name="${repo%:*}"
-    dir="${repo#*:}"
-    if [ ! -d "$TMPDIR/$dir" ]; then
-        echo "[+] Cloning $name..."
-        git clone https://github.com/msm8916-mainline/$name.git "$TMPDIR/$dir"
-    fi
-done
-
-# Check dependencies
-for cmd in aarch64-linux-gnu-gcc arm-none-eabi-gcc python3 wget unzip; do
-    command -v $cmd >/dev/null 2>&1 || { echo "Error: $cmd not found"; exit 1; }
-done
-
-# Compile qhypstub
-echo "[+] Compiling qhypstub..."
-make -C "$TMPDIR/qhypstub" clean CROSS_COMPILE=aarch64-linux-gnu- || true
-make -C "$TMPDIR/qhypstub" CROSS_COMPILE=aarch64-linux-gnu-
-
-# Patch and compile lk2nd
-echo "[+] Compiling lk2nd..."
-cd "$TMPDIR/lk2nd"
-grep -qxF 'DEFINES += USE_TARGET_HS200_CAPS=1' project/lk1st-msm8916.mk || \
-    echo 'DEFINES += USE_TARGET_HS200_CAPS=1' >> project/lk1st-msm8916.mk
-
-make clean || true
-make LK2ND_BUNDLE_DTB="msm8916-512mb-mtp.dtb" \
-     LK2ND_COMPATIBLE="yiming,uz801-v3" \
-     TOOLCHAIN_PREFIX=arm-none-eabi- \
-     lk1st-msm8916
-
-# Download Qualcomm firmware
-echo "[+] Downloading Qualcomm firmware..."
-wget -q --show-progress -P "$TMPDIR" \
-    https://github.com/Mio-sha512/openstick-stuff/raw/refs/heads/main/builder-stuff/dragonboard-410c-bootloader-emmc-linux-176.zip
-
-# Extract firmware files
-mkdir -p "$TMPDIR/files"
-unzip -o -j -d "$TMPDIR/files/" "$TMPDIR/dragonboard-410c-bootloader-emmc-linux-176.zip" \
-    dragonboard-410c-bootloader-emmc-linux-176/rpm.mbn \
-    dragonboard-410c-bootloader-emmc-linux-176/sbl1.mbn \
-    dragonboard-410c-bootloader-emmc-linux-176/tz.mbn
-
-# Sign binaries
-echo "[+] Signing binaries..."
-python3 "$TMPDIR/qtestsign/qtestsign.py" hyp \
-    "$TMPDIR/qhypstub/qhypstub.elf" -o "$TMPDIR/files/hyp.mbn"
-
-python3 "$TMPDIR/qtestsign/qtestsign.py" aboot \
-    "$TMPDIR/lk2nd/build-lk1st-msm8916/emmc_appsboot.mbn" -o "$TMPDIR/files/aboot.mbn"
-
-# Copy to output directory
-echo "[+] Copying files to output directory..."
-cp -v "$TMPDIR/files"/*.mbn "$OUTPUT_DIR/"
-
-echo "[+] Build completed successfully"
-echo "[+] Output files in: $OUTPUT_DIR"
-ls -lh "$OUTPUT_DIR"/*.mbn
diff --git a/base_partitions/flash.sh b/base_partitions/flash.sh
deleted file mode 100755
index dc9f2f2..0000000
--- a/base_partitions/flash.sh
+++ /dev/null
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-# Prerequisites: EDL mode.
-
-# Function to read file path with validation and quote cleanup
-read_path() {
-    local prompt="$1"
-    local path_var
-
-    read -e -r -p "$prompt" path_var
-    # Remove single and double quotes
-    path_var="${path_var//\"/}"
-    path_var="${path_var//\'/}"
-
-    # Validate not empty and file exists
-    if [[ -z "$path_var" ]]; then
-        echo "Error: No path provided."
-        exit 1
-    fi
-    if [[ ! -f "$path_var" ]]; then
-        echo "Error: File not found: $path_var"
-        exit 1
-    fi
-
-    echo "$path_var"
-}
-
-mkdir -p saved
-
-# Backup important partitions
-for n in fsc fsg modemst1 modemst2 modem persist sec; do
-    echo "Backing up partition $n ..."
-    edl r "$n" "saved/$n.bin" || { echo "Error backing up $n"; exit 1; }
-done
-
-# Install `aboot`
-echo "Flashing aboot..."
-edl w aboot aboot.mbn || { echo "Error flashing aboot"; exit 1; }
-
-# Reboot to fastboot
-echo "Rebooting to fastboot..."
-edl e boot || { echo "Error rebooting to fastboot"; exit 1; }
-edl reset || { echo "Error resetting device"; exit 1; }
-
-# Flash firmware
-echo "Flashing partitions..."
-fastboot flash partition gpt_both0.bin || { echo "Error flashing partition"; exit 1; }
-fastboot flash aboot aboot.mbn || { echo "Error flashing aboot"; exit 1; }
-fastboot flash hyp hyp.mbn || { echo "Error flashing hyp"; exit 1; }
-fastboot flash rpm rpm.mbn || { echo "Error flashing rpm"; exit 1; }
-fastboot flash sbl1 sbl1.mbn || { echo "Error flashing sbl1"; exit 1; }
-fastboot flash tz tz.mbn || { echo "Error flashing tz"; exit 1; }
-
-boot_path=$(read_path "Drag the boot image: ")
-fastboot flash boot "$boot_path" || { echo "Error flashing boot"; exit 1; }
-
-system_path=$(read_path "Drag the system image: ")
-fastboot flash rootfs "$system_path" || { echo "Error flashing rootfs"; exit 1; }
-
-echo "Rebooting to EDL mode..."
-fastboot oem reboot-edl || { echo "Error rebooting to EDL"; exit 1; }
-
-# Restore original partitions
-for n in fsc fsg modemst1 modemst2 modem persist sec; do
-    echo "Restoring partition $n ..."
-    edl w "$n" "saved/$n.bin" || { echo "Error restoring $n"; exit 1; }
-done
-
-echo "Process completed successfully."
diff --git a/base_partitions/generate_gpt.sh b/base_partitions/generate_gpt.sh
deleted file mode 100644
index 5f76752..0000000
--- a/base_partitions/generate_gpt.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/bin/sh -e
-
-OUTFILE=${$1:-gpt_both0.bin}
-TMPDIR=$(mktemp -d)
-
-# create GPT
-truncate -s 179323904 ${TMPDIR}/gpt.img
-
-cat << EOF | sfdisk ${TMPDIR}/gpt.img
-label: gpt
-label-id: DB708ACF-2E04-8DE2-BAFE-30C9B26444C5
-unit: sectors
-first-lba: 34
-last-lba: 350208
-sector-size: 512
-
-gpt.img1 : start=        4096, size=           2, type=57B90A16-22C9-E33B-8F5D-0E81686A68CB, uuid=89BEF928-6B3F-432E-970E-46926F6BD579, name="fsc"
-gpt.img2 : start=        4098, size=        3072, type=638FF8E2-22C9-E33B-8F5D-0E81686A68CB, uuid=2B772340-E0F0-4A95-B652-27ADE619EF14, name="fsg"
-gpt.img3 : start=        7170, size=      131072, type=EBD0A0A2-B9E5-4433-87C0-68B6B72699C7, uuid=709AEC75-FFB4-4218-9A2E-A38C9D689D6D, name="modem"
-gpt.img4 : start=      138242, size=        3072, type=EBBEADAF-22C9-E33B-8F5D-0E81686A68CB, uuid=D747B414-92EA-4098-AA56-0ED0AAB1F6DC, name="modemst1"
-gpt.img5 : start=      141314, size=        3072, type=0A288B1F-22C9-E33B-8F5D-0E81686A68CB, uuid=057F46B4-9F89-4AA4-9A60-1735B4E2DB4B, name="modemst2"
-gpt.img6 : start=      144386, size=       65536, type=6C95E238-E343-4BA8-B489-8681ED22AD0B, uuid=ACD4F30F-6A99-42B2-9262-A3FECEB2B46B, name="persist"
-gpt.img7 : start=      209922, size=          32, type=303E6AC3-AF15-4C54-9E9B-D9A8FBECF401, uuid=DD07C606-826C-4B5E-BE75-F5FCAA91E623, name="sec"
-gpt.img8 : start=      209954, size=        1024, type=E1A6A689-0C8D-4CC6-B4E8-55A4320FBD8A, uuid=CB49D0D3-C49B-4586-986C-BDADBF545FEF, name="hyp"
-gpt.img9 : start=      210978, size=        1024, type=098DF793-D712-413D-9D4E-89D711772228, uuid=B5154BA2-C18D-4A17-A8CD-97EEDC0BEF31, name="rpm"
-gpt.img10 : start=      212002, size=        1024, type=DEA0BA2C-CBDD-4805-B4F9-F428251C3E98, uuid=B166535F-4B99-48F6-AA77-16F27669FD2F, name="sbl1"
-gpt.img11 : start=      213026, size=        2048, type=A053AA7F-40B8-4B1C-BA08-2F68AC71A4F4, uuid=A983B7C4-FC3A-4F88-823E-91D5DB06337F, name="tz"
-gpt.img12 : start=      215074, size=        2048, type=400FFDCD-22E0-47E7-9A23-F16ED9382388, uuid=22675009-60A3-401F-8D3F-44CD32ED394C, name="aboot"
-gpt.img13 : start=      217122, size=      131072, type=20117F86-E985-4357-B9EE-374BC1D8487D, uuid=80780B1D-0FE1-27D3-23E4-9244E62F8C46, name="boot"
-gpt.img14 : start=      348194, size=        2015, type=1B81E7E6-F50D-419B-A739-2AEEF8DA3335, uuid=A7AB80E8-E9D1-E8CD-F157-93F69B1D141E, name="rootfs"
-EOF
-
-# create fastboot compatible partition image
-# primary gpt
-dd if=${TMPDIR}/gpt.img of="$OUTFILE" bs=512 count=34
-# backup gpt
-dd if=${TMPDIR}/gpt.img bs=512 skip=2 count=32 >> "$OUTFILE"
-dd if=${TMPDIR}/gpt.img bs=512 skip=350241 >> "$OUTFILE"
diff --git a/base_partitions/gpt_both0.bin b/base_partitions/gpt_both0.bin
deleted file mode 100644
index bbd6a4e..0000000
Binary files a/base_partitions/gpt_both0.bin and /dev/null differ
diff --git a/base_partitions/hyp.mbn b/base_partitions/hyp.mbn
deleted file mode 100644
index f7f6b31..0000000
Binary files a/base_partitions/hyp.mbn and /dev/null differ
diff --git a/base_partitions/rpm.mbn b/base_partitions/rpm.mbn
deleted file mode 100644
index 0dfb26a..0000000
Binary files a/base_partitions/rpm.mbn and /dev/null differ
diff --git a/base_partitions/sbl1.mbn b/base_partitions/sbl1.mbn
deleted file mode 100644
index 3b821bd..0000000
Binary files a/base_partitions/sbl1.mbn and /dev/null differ
diff --git a/base_partitions/tz.mbn b/base_partitions/tz.mbn
deleted file mode 100644
index 7268158..0000000
Binary files a/base_partitions/tz.mbn and /dev/null differ
diff --git a/devenv/Dockerfile b/devenv/Dockerfile
index cb95691..f232ad2 100644
--- a/devenv/Dockerfile
+++ b/devenv/Dockerfile
@@ -23,8 +23,8 @@ ENV BRANCH=main
 RUN git clone --depth=1 -b ${BRANCH} https://git.openwrt.org/openwrt/openwrt.git openwrt
 
 # Apply patch inside openwrt directory
-COPY enable_wcn36xx_mac80211.patch openwrt/
-RUN cd openwrt && git apply enable_wcn36xx_mac80211.patch
+COPY enable_wcn36xx_mac80211.patch .
+RUN git apply enable_wcn36xx_mac80211.patch
 
 # Update and install feeds
 RUN cd openwrt && \
diff --git a/devenv/dependencies.sh b/devenv/dependencies.sh
index 2923ddc..655801d 100755
--- a/devenv/dependencies.sh
+++ b/devenv/dependencies.sh
@@ -13,10 +13,10 @@ apt-get update && apt-get install -y --no-install-recommends \
     g++ gcc gcc-aarch64-linux-gnu gcc-arm-none-eabi \
     gettext intltool \
     git \
-    gzip tar unzip xz-utils zstd \
+    gzip tar unzip xz-utils zstd zip \
     libelf-dev libfdt-dev libncurses5-dev libssl-dev zlib1g-dev \
     nano sudo \
     perl perl-modules \
-    python3-dev python3-setuptools \
+    python3-dev python3-setuptools python3-cryptography \
     wget \
     && rm -rf /var/lib/apt/lists/*
diff --git a/msm89xx/image/flash.sh b/msm89xx/image/flash.sh
index 6f581da..9433117 100644
--- a/msm89xx/image/flash.sh
+++ b/msm89xx/image/flash.sh
@@ -1,20 +1,22 @@
 #!/usr/bin/env bash
-# Prerequisites: EDL mode.
+# Prerequisites: EDL mode and fastboot.
 # Usage: Execute from bin/targets/XXX/YYY/ directory
+# Notes:
+# - Automatically detects "*-firmware.zip" in the current directory, extracts .mbn files to a temp dir, and uses them.
+# - Falls back to manual directory selection if the ZIP is not found.
 
-# Function to find file by pattern in directory
+set -euo pipefail
+
+# Find a file by pattern at a given directory depth.
 find_image() {
     local dir="$1"
     local pattern="$2"
     local file
-    
-    file=$(find "$dir" -maxdepth 1 -type f -name "$pattern" 2>/dev/null | head -n 1)
-    
-    if [[ -z "$file" ]]; then
+    file=$(find "$dir" -maxdepth 1 -type f -name "$pattern" 2>/dev/null | head -n 1 || true)
+    if [[ -z "${file:-}" ]]; then
         echo "[-] Error: Image not found with pattern: $pattern" >&2
         return 1
     fi
-    
     echo "$file"
 }
 
@@ -22,12 +24,12 @@ echo "=== OpenWrt EXT4 Flash Script ==="
 echo "[*] Filesystem: EXT4 (full writable)"
 echo
 
-# OpenWrt images are in current directory
+# Use current directory for images.
 openwrt_dir="."
 echo "[*] Using current directory: $(pwd)"
 echo
 
-# Find required OpenWrt images
+# Detect required OpenWrt images.
 echo "[*] Detecting OpenWrt images..."
 gpt_path=$(find_image "$openwrt_dir" "*-gpt_both0.bin") || exit 1
 boot_path=$(find_image "$openwrt_dir" "*-ext4-boot.img") || exit 1
@@ -37,31 +39,44 @@ echo "[+] GPT: $(basename "$gpt_path")"
 echo "[+] Boot: $(basename "$boot_path")"
 echo "[+] Rootfs: $(basename "$system_path")"
 
-# Ask for firmware directory (where .mbn files are)
+# Detect firmware ZIP and extract .mbn files.
 echo
-echo "=== Qualcomm Firmware Directory ==="
-read -e -r -p "Drag the folder with .mbn files (aboot, hyp, rpm, sbl1, tz): " firmware_dir
+echo "=== Firmware bundle (.zip) ==="
+zip_path="$(find_image "$openwrt_dir" "*-firmware.zip" || true)"
 
-# Clean quotes and spaces
-firmware_dir="${firmware_dir//\"/}"
-firmware_dir="${firmware_dir//\'/}"
-firmware_dir="${firmware_dir// /}"
+firmware_tmp=""
+firmware_dir=""
 
-# Validate directory exists
-if [[ -z "$firmware_dir" ]]; then
-    echo "[-] Error: You must specify the directory with .mbn files"
+if [[ -n "${zip_path:-}" ]]; then
+    echo "[*] Found firmware ZIP: $(basename "$zip_path")"
+    firmware_tmp="$(mktemp -d)"
+    trap 'if [[ -n "$firmware_tmp" && -d "$firmware_tmp" ]]; then rm -rf "$firmware_tmp"; fi' EXIT
+    echo "[*] Extracting .mbn files..."
+    unzip -q -j -d "$firmware_tmp" "$zip_path" "*.mbn" || {
+        echo "[-] Error: Failed to extract .mbn files from ZIP"
+        exit 1
+    }
+    firmware_dir="$firmware_tmp"
+else
+    echo "[!] No firmware ZIP found in the current directory"
+    echo "=== Qualcomm Firmware Directory (fallback) ==="
+    read -e -r -p "Drag the folder with .mbn files (aboot, hyp, rpm, sbl1, tz): " firmware_dir
+    # Normalize quotes and spaces (useful for drag-and-drop from GUI).
+    firmware_dir="${firmware_dir//\"/}"
+    firmware_dir="${firmware_dir//\'/}"
+    firmware_dir="${firmware_dir// /}"
+fi
+
+# Validate firmware directory.
+if [[ -z "$firmware_dir" || ! -d "$firmware_dir" ]]; then
+    echo "[-] Error: Invalid firmware directory: $firmware_dir"
     exit 1
 fi
 
-if [[ ! -d "$firmware_dir" ]]; then
-    echo "[-] Error: Directory not found: $firmware_dir"
-    exit 1
-fi
-
-echo "[*] Searching for firmware in: $firmware_dir"
+echo "[*] Using firmware directory: $firmware_dir"
 echo
 
-# Check for firmware partitions (.mbn files)
+# Verify required .mbn files.
 echo "[*] Verifying Qualcomm firmware partitions..."
 missing_mbn=false
 for part in aboot hyp rpm sbl1 tz; do
@@ -73,14 +88,14 @@ for part in aboot hyp rpm sbl1 tz; do
     fi
 done
 
-if [ "$missing_mbn" = true ]; then
+if [[ "$missing_mbn" == true ]]; then
     echo
     echo "[-] ERROR: Missing required .mbn files for flashing."
-    echo "[!] These files must be extracted from the original Android firmware."
-    echo "[!] Place them in: $firmware_dir"
+    echo "[!] Ensure ZIP extraction succeeded or provide a correct directory."
     exit 1
 fi
 
+# Confirm before flashing.
 echo
 read -p "Continue with flashing? (y/N): " confirm
 if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
@@ -90,60 +105,71 @@ fi
 
 mkdir -p saved
 
-# Backup important partitions
+# Backup critical partitions via EDL.
 echo
-echo "=== Partition Backup ==="
+echo "=== Partition Backup (EDL) ==="
 for n in fsc fsg modemst1 modemst2 modem persist sec; do
     echo "[*] Backing up partition $n ..."
     edl r "$n" "saved/$n.bin" || { echo "[-] Error backing up $n"; exit 1; }
 done
 
-# Install aboot
+# Flash aboot via EDL to get a known-good aboot.
 echo
-echo "=== Flashing Partitions ==="
+echo "=== Flashing Partitions (EDL) ==="
 echo "[*] Flashing aboot via EDL..."
 edl w aboot "$firmware_dir/aboot.mbn" || { echo "[-] Error flashing aboot"; exit 1; }
 
-# Reboot to fastboot
+# Reboot to fastboot using EDL commands.
 echo "[*] Rebooting to fastboot..."
 edl e boot || { echo "[-] Error rebooting to fastboot"; exit 1; }
 edl reset || { echo "[-] Error resetting device"; exit 1; }
 
-# Wait for fastboot mode
-echo "[*] Waiting for fastboot mode (5 seconds)..."
-sleep 5
+# Wait for fastboot to come up.
+echo "[*] Waiting for fastboot mode (up to 10s)..."
+for i in {1..10}; do
+    if fastboot devices | grep -qE "fastboot$"; then
+        echo "[+] Fastboot device detected"
+        break
+    fi
+    sleep 1
+    if [[ $i -eq 10 ]]; then
+        echo "[-] Error: Fastboot device not detected"
+        exit 1
+    fi
+done
 
-# Flash firmware
+# Flash GPT and firmware via fastboot.
 echo
-echo "=== Flashing partitions via fastboot ==="
+echo "=== Flashing partitions (fastboot) ==="
 echo "[*] Flashing GPT..."
 fastboot flash partition "$gpt_path" || { echo "[-] Error flashing partition"; exit 1; }
 
-echo "[*] Flashing firmware..."
+echo "[*] Flashing firmware (.mbn files)..."
 fastboot flash aboot "$firmware_dir/aboot.mbn" || { echo "[-] Error flashing aboot"; exit 1; }
-fastboot flash hyp "$firmware_dir/hyp.mbn" || { echo "[-] Error flashing hyp"; exit 1; }
-fastboot flash rpm "$firmware_dir/rpm.mbn" || { echo "[-] Error flashing rpm"; exit 1; }
-fastboot flash sbl1 "$firmware_dir/sbl1.mbn" || { echo "[-] Error flashing sbl1"; exit 1; }
-fastboot flash tz "$firmware_dir/tz.mbn" || { echo "[-] Error flashing tz"; exit 1; }
+fastboot flash hyp   "$firmware_dir/hyp.mbn"   || { echo "[-] Error flashing hyp"; exit 1; }
+fastboot flash rpm   "$firmware_dir/rpm.mbn"   || { echo "[-] Error flashing rpm"; exit 1; }
+fastboot flash sbl1  "$firmware_dir/sbl1.mbn"  || { echo "[-] Error flashing sbl1"; exit 1; }
+fastboot flash tz    "$firmware_dir/tz.mbn"    || { echo "[-] Error flashing tz"; exit 1; }
 
-echo "[*] Flashing OpenWrt..."
-fastboot flash boot "$boot_path" || { echo "[-] Error flashing boot"; exit 1; }
+echo "[*] Flashing OpenWrt images..."
+fastboot flash boot   "$boot_path"   || { echo "[-] Error flashing boot"; exit 1; }
 fastboot flash rootfs "$system_path" || { echo "[-] Error flashing rootfs"; exit 1; }
 
+# Reboot back to EDL to restore radio-cal data partitions.
 echo "[*] Rebooting to EDL mode..."
 fastboot oem reboot-edl || { echo "[-] Error rebooting to EDL"; exit 1; }
 
-# Wait for EDL mode
+# Small wait for EDL to be available.
 echo "[*] Waiting for EDL mode (3 seconds)..."
 sleep 3
 
-# Restore original partitions
+# Restore backed-up partitions via EDL.
 echo
-echo "=== Partition Restoration ==="
+echo "=== Partition Restoration (EDL) ==="
 for n in fsc fsg modemst1 modemst2 modem persist sec; do
     echo "[*] Restoring partition $n ..."
     edl w "$n" "saved/$n.bin" || { echo "[-] Error restoring $n"; exit 1; }
 done
 
 echo
-echo "[+] Process completed successfully"
\ No newline at end of file
+echo "[+] Process completed successfully"
diff --git a/msm89xx/image/generate_firmware.sh b/msm89xx/image/generate_firmware.sh
new file mode 100755
index 0000000..8526632
--- /dev/null
+++ b/msm89xx/image/generate_firmware.sh
@@ -0,0 +1,158 @@
+#!/bin/bash
+# Build firmware bundle: compiles qhypstub (AArch64 asm) and lk2nd (ARM), signs them, and packs a ZIP.
+# Works inside OpenWrt build by restoring implicit make rules only for qhypstub and using detected toolchains.
+
+set -e
+
+OUT_FILE="${1:-uz801v3-firmware.zip}"
+
+# Respect OpenWrt-provided TMPDIR if present; otherwise create a private one and clean up on exit.
+CLEANUP_DIR=""
+if [ -z "$TMPDIR" ]; then
+  TMPDIR="$(mktemp -d)"
+  CLEANUP_DIR="$TMPDIR"
+fi
+trap 'if [ -n "$CLEANUP_DIR" ]; then rm -rf "$CLEANUP_DIR"; fi' EXIT
+
+# Reusable working directories under TMPDIR (OpenWrt maps TMPDIR to openwrt/tmp/)
+BUILDDIR="$TMPDIR/msm8916-firmware-build"
+mkdir -p "$BUILDDIR"
+
+# Detect OpenWrt toolchain (preferred) and fall back to host tools if necessary.
+# Populate AARCH64_* for qhypstub and ARM_CROSS for lk2nd.
+if [ -n "$STAGING_DIR" ]; then
+  # Try to locate OpenWrt AArch64 toolchain (musl or non-musl prefix)
+  TOOLCHAIN_DIR="$(find "$STAGING_DIR/../toolchain-"* -maxdepth 0 -type d 2>/dev/null | head -1 || true)"
+  if [ -n "$TOOLCHAIN_DIR" ] && [ -d "$TOOLCHAIN_DIR/bin" ]; then
+    export PATH="$TOOLCHAIN_DIR/bin:$PATH"
+    AARCH64_PREFIX="$(ls "$TOOLCHAIN_DIR/bin/"aarch64-openwrt-linux-musl-gcc "$TOOLCHAIN_DIR/bin/"aarch64-openwrt-linux-gcc 2>/dev/null | head -1 | xargs -r basename | sed 's/-gcc$//' || true)"
+    if [ -n "$AARCH64_PREFIX" ]; then
+      AARCH64_CROSS="${AARCH64_PREFIX}-"
+      AARCH64_CC="${AARCH64_PREFIX}-gcc"
+      AARCH64_AS="${AARCH64_PREFIX}-as"
+      AARCH64_LD="${AARCH64_PREFIX}-ld"
+      AARCH64_AR="${AARCH64_PREFIX}-ar"
+      AARCH64_OBJCOPY="${AARCH64_PREFIX}-objcopy"
+    fi
+  fi
+  # Add OpenWrt host tools (may contain arm-none-eabi-* if installed there)
+  if [ -d "$STAGING_DIR/../host/bin" ]; then
+    export PATH="$STAGING_DIR/../host/bin:$PATH"
+  fi
+fi
+
+# Reasonable defaults if detection above was not conclusive.
+: "${AARCH64_CROSS:=aarch64-openwrt-linux-}"
+: "${AARCH64_CC:=aarch64-openwrt-linux-gcc}"
+: "${AARCH64_AS:=aarch64-openwrt-linux-as}"
+: "${AARCH64_LD:=aarch64-openwrt-linux-ld}"
+: "${AARCH64_AR:=aarch64-openwrt-linux-ar}"
+: "${AARCH64_OBJCOPY:=aarch64-openwrt-linux-objcopy}"
+: "${ARM_CROSS:=arm-none-eabi-}"
+
+# Sanity checks with clear logs.
+echo "[+] Checking toolchains..."
+if ! command -v "${AARCH64_CC}" >/dev/null 2>&1; then
+  echo "[!] Error: ${AARCH64_CC} not found in PATH"
+  exit 1
+fi
+if ! command -v "${AARCH64_AS}" >/dev/null 2>&1; then
+  echo "[!] Error: ${AARCH64_AS} not found in PATH"
+  exit 1
+fi
+if ! command -v "${ARM_CROSS}gcc" >/dev/null 2>&1; then
+  echo "[!] Error: ${ARM_CROSS}gcc not found in PATH"
+  exit 1
+fi
+echo "[+] Found aarch64 toolchain: $(command -v ${AARCH64_CC})"
+echo "[+] Found aarch64 assembler: $(command -v ${AARCH64_AS})"
+echo "[+] Found arm toolchain: $(command -v ${ARM_CROSS}gcc)"
+
+# Clone sources (idempotent; reuse if already present to speed up rebuilds).
+for repo in qhypstub:qhypstub lk2nd:lk2nd qtestsign:qtestsign; do
+  name="${repo%:*}"
+  dir="${repo#*:}"
+  if [ ! -d "$BUILDDIR/$dir/.git" ]; then
+    echo "[+] Cloning $name..."
+    git clone "https://github.com/msm8916-mainline/$name.git" "$BUILDDIR/$dir"
+  else
+    echo "[+] Reusing existing $name..."
+  fi
+done
+
+# Build qhypstub (pure AArch64 assembly).
+# OpenWrt disables GNU make implicit rules by default (-rR), so clear MAKEFLAGS only for this sub-make.
+echo "[+] Compiling qhypstub..."
+if [ ! -f "$BUILDDIR/qhypstub/qhypstub.elf" ]; then
+  env -u MAKEFLAGS MAKEFLAGS= \
+  make -C "$BUILDDIR/qhypstub" clean \
+    CROSS_COMPILE="$AARCH64_CROSS" \
+    CC="$AARCH64_CC" AS="$AARCH64_AS" LD="$AARCH64_LD" AR="$AARCH64_AR" OBJCOPY="$AARCH64_OBJCOPY" || true
+
+  env -u MAKEFLAGS MAKEFLAGS= \
+  make -C "$BUILDDIR/qhypstub" \
+    CROSS_COMPILE="$AARCH64_CROSS" \
+    CC="$AARCH64_CC" AS="$AARCH64_AS" LD="$AARCH64_LD" AR="$AARCH64_AR" OBJCOPY="$AARCH64_OBJCOPY"
+else
+  echo "[+] qhypstub already compiled"
+fi
+
+# Patch (idempotent) and build lk2nd using ARM EABI toolchain.
+echo "[+] Compiling lk2nd..."
+if [ ! -f "$BUILDDIR/lk2nd/build-lk1st-msm8916/emmc_appsboot.mbn" ]; then
+  (
+    cd "$BUILDDIR/lk2nd"
+    grep -qxF 'DEFINES += USE_TARGET_HS200_CAPS=1' project/lk1st-msm8916.mk || \
+      echo 'DEFINES += USE_TARGET_HS200_CAPS=1' >> project/lk1st-msm8916.mk
+    make clean || true
+    make \
+      LK2ND_BUNDLE_DTB="msm8916-512mb-mtp.dtb" \
+      LK2ND_COMPATIBLE="yiming,uz801-v3" \
+      TOOLCHAIN_PREFIX="$ARM_CROSS" \
+      lk1st-msm8916
+  )
+else
+  echo "[+] lk2nd already compiled"
+fi
+
+# Prepare output area.
+OUTDIR="$BUILDDIR/output"
+mkdir -p "$OUTDIR"
+
+# Download base Qualcomm bootloader bundle if missing (rpm/sbl1/tz).
+echo "[+] Downloading Qualcomm firmware..."
+FWZIP="$BUILDDIR/dragonboard-410c-bootloader-emmc-linux-176.zip"
+if [ ! -f "$FWZIP" ]; then
+  wget -q --show-progress -O "$FWZIP" \
+    "https://github.com/Mio-sha512/openstick-stuff/raw/refs/heads/main/builder-stuff/dragonboard-410c-bootloader-emmc-linux-176.zip"
+fi
+
+# Extract required files only.
+unzip -o -j -d "$OUTDIR" "$FWZIP" \
+  dragonboard-410c-bootloader-emmc-linux-176/rpm.mbn \
+  dragonboard-410c-bootloader-emmc-linux-176/sbl1.mbn \
+  dragonboard-410c-bootloader-emmc-linux-176/tz.mbn
+
+# Sign hyp (qhypstub) and aboot (lk2nd) using qtestsign.
+echo "[+] Signing binaries..."
+python3 "$BUILDDIR/qtestsign/qtestsign.py" hyp \
+  "$BUILDDIR/qhypstub/qhypstub.elf" -o "$OUTDIR/hyp.mbn"
+
+python3 "$BUILDDIR/qtestsign/qtestsign.py" aboot \
+  "$BUILDDIR/lk2nd/build-lk1st-msm8916/emmc_appsboot.mbn" -o "$OUTDIR/aboot.mbn"
+
+# Pack final ZIP with all MBN parts.
+echo "[+] Creating firmware package..."
+(
+  cd "$OUTDIR"
+  zip -9 "$(basename "$OUT_FILE")" *.mbn
+)
+
+# Place result in the requested path (create directory if needed).
+DEST_DIR="$(dirname "$OUT_FILE")"
+mkdir -p "$DEST_DIR"
+mv -f "$OUTDIR/$(basename "$OUT_FILE")" "$OUT_FILE"
+
+echo "[+] Build completed successfully"
+echo "[+] Output file: $OUT_FILE"
+ls -lh "$OUT_FILE"
diff --git a/msm89xx/image/msm8916.mk b/msm89xx/image/msm8916.mk
index ea886fa..af0ca4d 100644
--- a/msm89xx/image/msm8916.mk
+++ b/msm89xx/image/msm8916.mk
@@ -12,6 +12,11 @@ define Build/install-flasher
     chmod +x $@
 endef
 
+define Build/generate-firmware
+    chmod +x $(TOPDIR)/target/linux/$(BOARD)/image/generate_firmware.sh
+    $(TOPDIR)/target/linux/$(BOARD)/image/generate_firmware.sh $@
+endef
+
 define Device/msm8916
   SOC := msm8916
   CMDLINE := "earlycon console=tty0 console=ttyMSM0,115200 root=/dev/mmcblk0p14 rootwait"
@@ -25,9 +30,10 @@ define Device/yiming-uz801v3
   DEVICE_MODEL := uz801v3
   DEVICE_PACKAGES := uz801-tweaks wpad-basic-wolfssl msm-firmware-dumper rmtfs rootfs-resizer msm8916-usb-gadget
   IMAGE/system.img := append-rootfs | append-metadata | sparse-img
-  ARTIFACTS := gpt_both0.bin flash.sh
-  ARTIFACT/gpt_both0.bin := generate-gpt
+  ARTIFACTS := ext4-gpt_both0.bin flash.sh firmware.zip
+  ARTIFACT/ext4-gpt_both0.bin := generate-gpt
   ARTIFACT/flash.sh := install-flasher
+  ARTIFACT/firmware.zip := generate-firmware
 endef
 TARGET_DEVICES += yiming-uz801v3
 
diff --git a/readme.md b/readme.md
index 1b84a7b..fd2b008 100644
--- a/readme.md
+++ b/readme.md
@@ -25,6 +25,7 @@ Modern version of OpenWrt working on UZ801v3:
 - Firmware is dumped on first boot from modem/persist partition:
   - Uses the binaries/firmware from the own device.
     - __This might imply that a port for other devices would be easier... but I have not tested it as I only have this device.___
+- Leaves the `luci-app-tailscale` package in `/root` ready to be installed with: `apk install --allow-untrusted luci-app-tailscale*.apk`
 
 ### How to build OpenWrt
 Docker is required!
@@ -42,7 +43,7 @@ The base partitions are in a folder called `base_partitions` on this repo:
 - Install `edl`: https://github.com/bkerler/edl
 - Put the device in `edl` mode: https://wiki.postmarketos.org/wiki/Zhihe_series_LTE_dongles_(generic-zhihe)#How_to_enter_flash_mode
 - Do a full backup: `edl rf backup.bin`
-- Run `./openwrt-msm89xx-msm8916-yiming-uz801v3-flash.sh`: It will prompt for the partitions folder (`base_partitions`). The script will backup the important partitions specific for your device, will flash everything and will restore de previously saved partitions.
+- Run `./openwrt-msm89xx-msm8916-yiming-uz801v3-flash.sh`: The script will backup the important partitions specific for your device, will flash everything and will restore de previously saved partitions.
 
 After the succesful flash if you:
 - Want to enter `fastboot`, just insert the device with the button pressed.
@@ -80,7 +81,6 @@ Once you have selected your region, you'll find folders typically representing T
   - Also test Shell
 - Custom package server for msm89xx/msm8916
   - Any target specific module not present might require to be built from sources. This repo can be used to do that, run `make menuconfig` before `make -j$(nproc)` and select it from the menu.
-- Generate all `base_partitions` with openwrt builder.
 - Investigate `lpac` and eSIM.
 
 ## Credits