diff --git a/core/embed/firmware/bl_check.c b/core/embed/firmware/bl_check.c
index 205093739..c87bf25ca 100644
--- a/core/embed/firmware/bl_check.c
+++ b/core/embed/firmware/bl_check.c
@@ -217,25 +217,27 @@ void check_and_replace_bootloader(void) {
 
   do {
     uint32_t *p = decomp_out;
-    uint32_t last_whole_word_addr = (((uint32_t)decomp.dest) & ~3);
+    uint32_t last_whole_word_addr = (((uint32_t)decomp.dest) & ~0x7F);
     while ((uint32_t)p < last_whole_word_addr) {
-      ensure(flash_area_write_word(&BOOTLOADER_AREA, offset, *p++), NULL);
-      offset += sizeof(uint32_t);
+      ensure(flash_area_write_burst(&BOOTLOADER_AREA, offset, p), NULL);
+      p += FLASH_BURST_LENGTH;
+      offset += FLASH_BURST_LENGTH * sizeof(uint32_t);
     }
     if ((uint8_t *)p < decomp.dest) {
       // last few bytes in case of unaligned data
-      uint32_t d = 0;
+      uint32_t d[FLASH_BURST_LENGTH] = {0};
       memcpy(&d, p, (uint32_t)decomp.dest - (uint32_t)p);
-      ensure(flash_area_write_word(&BOOTLOADER_AREA, offset, d), NULL);
-      offset += sizeof(uint32_t);
+      ensure(flash_area_write_burst(&BOOTLOADER_AREA, offset, d), NULL);
+      offset += FLASH_BURST_LENGTH * sizeof(uint32_t);
     }
     decomp.dest = (uint8_t *)decomp_out;
   } while (uzlib_uncompress(&decomp) >= 0);
 
+  uint32_t d[FLASH_BURST_LENGTH] = {0};
   // fill the rest of the bootloader area with 0x00
   while (offset < bl_len) {
-    ensure(flash_area_write_word(&BOOTLOADER_AREA, offset, 0x00000000), NULL);
-    offset += sizeof(uint32_t);
+    ensure(flash_area_write_burst(&BOOTLOADER_AREA, offset, d), NULL);
+    offset += FLASH_BURST_LENGTH * sizeof(uint32_t);
   }
 
   ensure(flash_lock_write(), NULL);
diff --git a/core/embed/firmware/main.c b/core/embed/firmware/main.c
index df934b809..d11a9e251 100644
--- a/core/embed/firmware/main.c
+++ b/core/embed/firmware/main.c
@@ -137,6 +137,8 @@ int main(void) {
   secbool secret_ok = secret_optiga_extract(secret);
 #endif
 
+  mpu_config_firmware_initial();
+
 #if PRODUCTION || BOOTLOADER_QA
   check_and_replace_bootloader();
 #endif
diff --git a/core/embed/trezorhal/flash.h b/core/embed/trezorhal/flash.h
index 2918b11ee..c02a2fea9 100644
--- a/core/embed/trezorhal/flash.h
+++ b/core/embed/trezorhal/flash.h
@@ -28,6 +28,8 @@
 
 #include "flash_ll.h"
 
+#define FLASH_BURST_LENGTH (4 * 8)
+
 void flash_init(void);
 
 #endif  // TREZORHAL_FLASH_H
diff --git a/core/embed/trezorhal/mpu.h b/core/embed/trezorhal/mpu.h
index d9c22de61..5fd9abfea 100644
--- a/core/embed/trezorhal/mpu.h
+++ b/core/embed/trezorhal/mpu.h
@@ -23,6 +23,7 @@
 void mpu_config_off(void);
 void mpu_config_boardloader(void);
 void mpu_config_bootloader(void);
+void mpu_config_firmware_initial(void);
 void mpu_config_firmware(void);
 void mpu_config_prodtest(void);
 
diff --git a/core/embed/trezorhal/stm32f4/mpu.c b/core/embed/trezorhal/stm32f4/mpu.c
index 1a7b79abc..c93297d1f 100644
--- a/core/embed/trezorhal/stm32f4/mpu.c
+++ b/core/embed/trezorhal/stm32f4/mpu.c
@@ -104,6 +104,8 @@ void mpu_config_bootloader(void) {
   HAL_MPU_Enable(LL_MPU_CTRL_HARDFAULT_NMI);
 }
 
+void mpu_config_firmware_initial(void) {}
+
 void mpu_config_firmware(void) {
   // Disable MPU
   HAL_MPU_Disable();
diff --git a/core/embed/trezorhal/stm32u5/mpu.c b/core/embed/trezorhal/stm32u5/mpu.c
index 91ed0b0c9..37ddd9918 100644
--- a/core/embed/trezorhal/stm32u5/mpu.c
+++ b/core/embed/trezorhal/stm32u5/mpu.c
@@ -107,8 +107,6 @@ static void mpu_set_attributes() {
   MPU->MAIR0 |= 0x44 << 24;
 }
 
-#define GFXMMU_BUFFERS_S GFXMMU_VIRTUAL_BUFFERS_BASE_S
-
 #define SECRET_START FLASH_BASE_S
 #define SECRET_SIZE SIZE_16K
 #define BOARDLOADER_SIZE SIZE_48K
@@ -139,11 +137,13 @@ static void mpu_set_attributes() {
   (FLASH_SIZE - (FIRMWARE_SIZE + BOOTLOADER_SIZE + BOARDLOADER_SIZE + \
                  SECRET_SIZE + STORAGE_SIZE))
 
+#define L3_PREV_SIZE_BLD (STORAGE_SIZE + BOOTLOADER_SIZE)
+
 #ifdef STM32U585xx
 #define GRAPHICS_START FMC_BANK1
 #define GRAPHICS_SIZE SIZE_16M
 #else
-#define GRAPHICS_START GFXMMU_BUFFERS
+#define GRAPHICS_START GFXMMU_VIRTUAL_BUFFERS_BASE
 #define GRAPHICS_SIZE SIZE_16M
 #endif
 
@@ -181,6 +181,23 @@ void mpu_config_bootloader() {
   HAL_MPU_Enable(LL_MPU_CTRL_HARDFAULT_NMI);
 }
 
+void mpu_config_firmware_initial() {
+  HAL_MPU_Disable();
+  mpu_set_attributes();
+  // clang-format off
+  //   REGION    ADDRESS                   SIZE                TYPE       WRITE   UNPRIV
+  SET_REGION( 0, BOOTLOADER_START,         L3_PREV_SIZE_BLD,   FLASH_DATA,  YES,   YES ); // Bootloader + Storage
+  SET_REGION( 1, FIRMWARE_START,           FIRMWARE_SIZE,      FLASH_CODE,   NO,   YES ); // Firmware
+  SET_REGION( 2, ASSETS_START,             ASSETS_SIZE,        FLASH_DATA,  YES,   YES ); // Assets
+  SET_REGION( 3, SRAM1_BASE,               SRAM_SIZE,          SRAM,        YES,   YES ); // SRAM1/2/3/5
+  SET_REGION( 4, GRAPHICS_START,           GRAPHICS_SIZE,      SRAM,        YES,   YES ); // Frame buffer or display interface
+  SET_REGION( 5, PERIPH_BASE_NS,           SIZE_512M,          PERIPHERAL,  YES,   YES ); // Peripherals
+  SET_REGION( 6, FLASH_OTP_BASE,           SIZE_2K,            FLASH_DATA,  YES,   YES ); // OTP
+  DIS_REGION( 7 );
+  // clang-format on
+  HAL_MPU_Enable(LL_MPU_CTRL_HARDFAULT_NMI);
+}
+
 void mpu_config_firmware() {
   HAL_MPU_Disable();
   mpu_set_attributes();