diff --git a/ci/build.yml b/ci/build.yml
index 4b898830ba..cb7847f5e7 100644
--- a/ci/build.yml
+++ b/ci/build.yml
@@ -359,6 +359,24 @@ legacy emu regular debug build:
       - legacy/firmware/trezor.elf
     expire_in: 1 week
 
+legacy emu regular debug asan build:
+  stage: build
+  <<: *gitlab_caching
+  needs: []
+  only:
+    - schedules  # nightly build
+  variables:
+    DEBUG_LINK: "1"
+    EMULATOR: "1"
+    ADDRESS_SANITIZER: "1"
+  script:
+    - nix-shell --run "poetry run legacy/script/cibuild"
+  artifacts:
+    name: "$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
+    paths:
+      - legacy/firmware/trezor.elf
+    expire_in: 1 week
+
 legacy emu regular debug build arm:
   image: vdovhanych/nixos
   stage: build
@@ -398,3 +416,23 @@ legacy emu btconly debug build:
     paths:
       - legacy/firmware/trezor-bitcoinonly.elf
     expire_in: 1 week
+
+legacy emu btconly debug asan build:
+  stage: build
+  <<: *gitlab_caching
+  needs: []
+  only:
+    - schedules  # nightly build
+  variables:
+    BITCOIN_ONLY: "1"
+    DEBUG_LINK: "1"
+    EMULATOR: "1"
+    ADDRESS_SANITIZER: "1"
+  script:
+    - nix-shell --run "poetry run legacy/script/cibuild"
+    - mv legacy/firmware/trezor.elf legacy/firmware/trezor-bitcoinonly.elf
+  artifacts:
+    name: "$CI_JOB_NAME-$CI_COMMIT_SHORT_SHA"
+    paths:
+      - legacy/firmware/trezor-bitcoinonly.elf
+    expire_in: 1 week
diff --git a/ci/test.yml b/ci/test.yml
index ce1b8475ad..d4ccb2d45c 100644
--- a/ci/test.yml
+++ b/ci/test.yml
@@ -327,6 +327,18 @@ legacy test:
     expire_in: 1 week
     when: always
 
+legacy asan test:
+  stage: test
+  <<: *gitlab_caching
+  needs:
+    - legacy emu regular debug asan build
+  only:
+    - schedules  # nightly build
+  variables:
+    EMULATOR: "1"
+  script:
+    - nix-shell --run "poetry run legacy/script/test | ts -s"
+
 legacy btconly test:
   stage: test
   <<: *gitlab_caching
@@ -347,6 +359,20 @@ legacy btconly test:
     expire_in: 1 week
     when: always
 
+legacy btconly asan test:
+  stage: test
+  <<: *gitlab_caching
+  needs:
+    - legacy emu btconly debug asan build
+  only:
+    - schedules  # nightly build
+  variables:
+    EMULATOR: "1"
+    EMULATOR_BINARY: "firmware/trezor-bitcoinonly.elf"
+    TREZOR_PYTEST_SKIP_ALTCOINS: 1
+  script:
+    - nix-shell --run "poetry run legacy/script/test | ts -s"
+
 
 legacy upgrade test:
   stage: test
diff --git a/legacy/Makefile.include b/legacy/Makefile.include
index f5237ea07c..9b1ff42df3 100644
--- a/legacy/Makefile.include
+++ b/legacy/Makefile.include
@@ -22,7 +22,7 @@ DBGFLAGS ?= -g3 -ggdb3
 CPUFLAGS ?=
 FPUFLAGS ?=
 ifeq ($(ADDRESS_SANITIZER),1)
-SANFLAGS += -fsanitize=address
+SANFLAGS += -fsanitize=address,undefined
 endif
 else
 PREFIX   ?= arm-none-eabi-