diff --git a/firmware/trezor.c b/firmware/trezor.c
index 97b5ddd69..c26ec0ded 100644
--- a/firmware/trezor.c
+++ b/firmware/trezor.c
@@ -89,12 +89,6 @@ void check_lock_screen(void)
 
 int main(void)
 {
-#if EMULATOR
-	memzero(HW_ENTROPY_DATA, HW_ENTROPY_LEN);
-#else
-	desig_get_unique_id((uint32_t*)HW_ENTROPY_DATA);
-#endif
-
 #ifndef APPVER
 	setup();
 	__stack_chk_guard = random32(); // this supports compiler provided unpredictable stack protection checks
@@ -106,12 +100,19 @@ int main(void)
 #endif
 
 	if (!is_mode_unprivileged()) {
-
+		desig_get_unique_id((uint32_t*)HW_ENTROPY_DATA);
 		timer_init();
-
 #ifdef APPVER
 		// enable MPU (Memory Protection Unit)
 		mpu_config();
+#endif
+	} else {
+#if EMULATOR
+		memzero(HW_ENTROPY_DATA, HW_ENTROPY_LEN);
+#else
+		// we are running in unprivileged mode
+		// use fixed HW_ENTROPY
+		memset(HW_ENTROPY_DATA, 0x3C, HW_ENTROPY_LEN);
 #endif
 	}
 
diff --git a/norcow_config.h b/norcow_config.h
index d78f0749e..ba57dfb4b 100644
--- a/norcow_config.h
+++ b/norcow_config.h
@@ -29,7 +29,7 @@
 /*
  * The length of the sector header in bytes. The header is preserved between sector erasures.
  */
-#define NORCOW_HEADER_LEN (0x000)
+#define NORCOW_HEADER_LEN (0x100)
 
 /*
  * Current storage version.