diff --git a/build-docker-core.sh b/build-docker-core.sh
new file mode 100755
index 000000000..cae3566fd
--- /dev/null
+++ b/build-docker-core.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "--gcc_source" ]; then
+  TOOLCHAIN_FLAVOR=src
+  shift
+else
+  TOOLCHAIN_FLAVOR=linux
+fi
+
+IMAGE=trezor-firmware-build.$TOOLCHAIN_FLAVOR
+
+TAG=${1:-master}
+REPOSITORY=${2:-local}
+PRODUCTION=${PRODUCTION:-1}
+BITCOIN_ONLY=${BITCOIN_ONLY:-0}
+
+if [ "$REPOSITORY" = "local" ]; then
+  REPOSITORY=file:///local/
+else
+  REPOSITORY=https://github.com/$REPOSITORY/trezor-firmware.git
+fi
+
+docker build -t "$IMAGE" --build-arg TOOLCHAIN_FLAVOR=$TOOLCHAIN_FLAVOR ci/
+
+USER=$(ls -lnd . | awk '{ print $3 }')
+GROUP=$(ls -lnd . | awk '{ print $4 }')
+
+mkdir -p $(pwd)/build/core
+
+docker run -it \
+  -v $(pwd):/local \
+  -v $(pwd)/build/core:/build:z \
+  --env BITCOIN_ONLY="$BITCOIN_ONLY" \
+  --env PRODUCTION="$PRODUCTION" \
+  --user="$USER:$GROUP" \
+  "$IMAGE" \
+  /bin/sh -c "\
+    cd /tmp && \
+    git clone $REPOSITORY trezor-firmware && \
+    cd trezor-firmware/core && \
+    ln -s /build build &&
+    git checkout $TAG && \
+    git submodule update --init --recursive && \
+    pipenv install && \
+    pipenv run make clean vendor build_boardloader build_bootloader build_firmware"
diff --git a/build-docker-legacy.sh b/build-docker-legacy.sh
new file mode 100755
index 000000000..528330a18
--- /dev/null
+++ b/build-docker-legacy.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+set -e
+
+if [ "$1" = "--gcc_source" ]; then
+  TOOLCHAIN_FLAVOR=src
+  shift
+else
+  TOOLCHAIN_FLAVOR=linux
+fi
+
+IMAGE=trezor-firmware-build.$TOOLCHAIN_FLAVOR
+
+TAG=${1:-master}
+REPOSITORY=${2:-local}
+MEMORY_PROTECT=${MEMORY_PROTECT:-1}
+BITCOIN_ONLY=${BITCOIN_ONLY:-0}
+
+if [ "$REPOSITORY" = "local" ]; then
+  REPOSITORY=file:///local/
+else
+  REPOSITORY=https://github.com/$REPOSITORY/trezor-firmware.git
+fi
+
+docker build -t "$IMAGE" --build-arg TOOLCHAIN_FLAVOR=$TOOLCHAIN_FLAVOR ci/
+
+USER=$(ls -lnd . | awk '{ print $3 }')
+GROUP=$(ls -lnd . | awk '{ print $4 }')
+
+mkdir -p $(pwd)/build/legacy
+
+docker run -it \
+  -v $(pwd):/local \
+  -v $(pwd)/build/legacy:/build:z \
+  --env BITCOIN_ONLY="$BITCOIN_ONLY" \
+  --env MEMORY_PROTECT="$MEMORY_PROTECT" \
+  --user="$USER:$GROUP" \
+  "$IMAGE" \
+  /bin/sh -c "\
+    cd /tmp && \
+    git clone $REPOSITORY trezor-firmware && \
+    cd trezor-firmware/legacy && \
+    ln -s /build build &&
+    git checkout $TAG && \
+    git submodule update --init --recursive && \
+    pipenv install && \
+    pipenv run script/cibuild && \
+    mkdir -p build/bootloader build/firmware && \
+    cp bootloader/bootloader.bin build/bootloader/bootloader.bin && \
+    cp bootloader/bootloader.elf build/bootloader/bootloader.elf && \
+    cp firmware/trezor.bin build/firmware/firmware.bin && \
+    cp firmware/trezor.elf build/firmware/firmware.elf"
diff --git a/core/build-docker.sh b/core/build-docker.sh
deleted file mode 100755
index 865a3057f..000000000
--- a/core/build-docker.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/sh
-set -e
-
-cd "$(dirname $0)/.."
-
-if [ "$1" = "--gcc_source" ]; then
-	TOOLCHAIN_FLAVOR=src
-	shift
-else
-	TOOLCHAIN_FLAVOR=linux
-fi
-
-IMAGE=trezor-core-build.$TOOLCHAIN_FLAVOR
-TAG=${1:-master}
-REPOSITORY=${2:-trezor}
-PRODUCTION=${PRODUCTION:-0}
-BITCOIN_ONLY=${BITCOIN_ONLY:-0}
-
-if [ "$REPOSITORY" = "local" ]; then
-	REPOSITORY=file:///local/
-else
-	REPOSITORY=https://github.com/$REPOSITORY/trezor-firmware.git
-fi
-
-docker build -t $IMAGE --build-arg TOOLCHAIN_FLAVOR=$TOOLCHAIN_FLAVOR ci/
-
-USER=$(ls -lnd . | awk '{ print $3 }')
-GROUP=$(ls -lnd . | awk '{ print $4 }')
-
-mkdir -p $(pwd)/build/core
-docker run -t -v $(pwd):/local -v $(pwd)/build/core:/build:z --env BITCOIN_ONLY="$BITCOIN_ONLY" --user="$USER:$GROUP" $IMAGE /bin/sh -c "\
-	cd /tmp && \
-	git clone $REPOSITORY trezor-firmware && \
-	cd trezor-firmware/core && \
-	ln -s /build build &&
-	git checkout $TAG && \
-	git submodule update --init --recursive && \
-	pipenv install && \
-	PRODUCTION=$PRODUCTION pipenv run make clean vendor build_boardloader build_bootloader build_firmware"
diff --git a/legacy/build.sh b/legacy/build.sh
deleted file mode 100755
index 6cbbdea74..000000000
--- a/legacy/build.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-set -e
-
-cd "$(dirname $0)/.."
-
-BOOTLOADER_COMMIT=${1:-HEAD}
-FIRMWARE_COMMIT=${2:-HEAD}
-IMAGE=trezor-mcu-build
-BITCOIN_ONLY=${BITCOIN_ONLY:-0}
-
-USER=$(ls -lnd . | awk '{ print $3 }')
-GROUP=$(ls -lnd . | awk '{ print $4 }')
-
-docker build -t "$IMAGE" ci/
-docker run -it -v $(pwd):/src:z --env BITCOIN_ONLY="$BITCOIN_ONLY" --user="$USER:$GROUP" "$IMAGE" \
-    /src/legacy/script/fullbuild "$BOOTLOADER_COMMIT" "$FIRMWARE_COMMIT"
diff --git a/legacy/script/fullbuild b/legacy/script/fullbuild
deleted file mode 100755
index 4e30fdd53..000000000
--- a/legacy/script/fullbuild
+++ /dev/null
@@ -1,134 +0,0 @@
-#!/bin/bash
-
-# script/build: Build the Trezor firmware in a clean working tree.
-#
-
-# this needs to be there, otherwise python click installer vomits an error
-export LC_ALL=C.UTF-8
-export LANG=C.UTF-8
-
-set -eu
-
-cd "$(dirname "$0")/../.."
-
-EMULATOR=${EMULATOR:-0}
-
-readonly MCU_ROOT=legacy
-
-readonly ARTIFACT_EXTENSIONS=(bin elf)
-readonly BUILD_DIR="$(readlink -f build)"
-
-readonly BOOTLOADER_DIR="$BUILD_DIR/legacy/bootloader"
-readonly BOOTLOADER_FILENAME="$MCU_ROOT/bootloader/bootloader.bin"
-readonly BOOTLOADER_PATH="$BOOTLOADER_DIR/$BOOTLOADER_FILENAME"
-
-readonly FIRMWARE_DIR="$BUILD_DIR/legacy/firmware"
-readonly FIRMWARE_FILENAME="$MCU_ROOT/firmware/trezor.bin"
-readonly FIRMWARE_PATH="$FIRMWARE_DIR/$FIRMWARE_FILENAME"
-
-readonly EMULATOR_DIR="$FIRMWARE_DIR"
-readonly EMULATOR_FILENAME="$MCU_ROOT/firmware/trezor-emulator.elf"
-readonly EMULATOR_PATH="$EMULATOR_DIR/$MCU_ROOT/firmware/trezor.elf"
-
-worktree_setup() {
-    local path="$1"
-    local commit="$2"
-
-    rm -rf "$path"
-    git clone -n --reference=. . "$path" --recurse-submodules
-
-    # Use `git rev-parse` so that we can use any reference from the working repository.
-    git -C "$path" checkout "$(git rev-parse "$commit")"
-
-    ( cd "$path/$MCU_ROOT" && script/setup )
-}
-
-worktree_build() {
-    local path="$1"
-
-    if [ ! -e "$path/Pipfile" ]; then
-        echo "Can't handle pre-monorepo tags properly. You will have to check out manually"
-        exit 1
-    fi
-
-    pushd $path
-    export HOME=/tmp
-    pipenv install
-    pipenv run $MCU_ROOT/script/cibuild
-    popd
-}
-
-worktree_copy() {
-    local path="$1"
-    local filename="$2"
-    local pattern="$3"
-
-    local describe="$(git -C "$path" describe --tags --match "legacy/$pattern")"
-    describe="${describe##legacy/}"
-
-    local src="$path/$filename"
-
-    local basename="$(basename "$filename")"
-    local dest="$BUILD_DIR/${basename%.*}-$describe.${basename##*.}"
-
-    if [ "$EMULATOR" = 1 ]; then
-        install -Dm0644 "${src%.*}.elf" "${dest%.*}.elf"
-    else
-        for extension in "${ARTIFACT_EXTENSIONS[@]}"; do
-            install -Dm0644 \
-                "${src%.*}.$extension" \
-                "${dest%.*}.$extension"
-        done
-    fi
-
-    printf "%s" "$dest"
-}
-
-main() {
-    local bootloader_commit="$1"
-    local firmware_commit="$2"
-
-    worktree_setup "$FIRMWARE_DIR" "$firmware_commit"
-
-    if [ "$EMULATOR" != 1 ]; then
-        worktree_setup "$BOOTLOADER_DIR" "$bootloader_commit"
-        worktree_build "$BOOTLOADER_DIR"
-
-        cp "$BOOTLOADER_PATH" "$FIRMWARE_DIR/$BOOTLOADER_FILENAME"
-    fi
-
-    worktree_build "$FIRMWARE_DIR"
-
-    if [ "$EMULATOR" = 1 ]; then
-        cp "$EMULATOR_PATH" "$EMULATOR_DIR/$EMULATOR_FILENAME"
-        local firmware_path="$(worktree_copy \
-            "$EMULATOR_DIR" \
-            "$EMULATOR_FILENAME" \
-            "v*")"
-        chmod +x "$firmware_path"
-
-    else
-
-        local firmware_path="$(worktree_copy \
-            "$FIRMWARE_DIR" \
-            "$FIRMWARE_FILENAME" \
-            "v*")"
-
-        local bootloader_path="$(worktree_copy \
-            "$BOOTLOADER_DIR" \
-            "$BOOTLOADER_FILENAME" \
-            "bl*")"
-
-        printf "\n\n"; $PYTHON $MCU_ROOT/script/fingerprint \
-            "$bootloader_path" \
-            --max-size 32768 \
-            --double
-    fi
-
-    printf "\n\n"; $PYTHON $MCU_ROOT/script/fingerprint \
-        "$firmware_path" \
-        --offset 256 \
-        --max-size 983296  # 256 + 64*1024 + 3*128*1024 + 4*128*1024
-}
-
-main "$@"