diff --git a/README.md b/README.md
index 6029f5d7..56921409 100644
--- a/README.md
+++ b/README.md
@@ -29,11 +29,12 @@ has been automated using Docker. Steps are as follows:
     ```shell
     git clone https://github.com/Coldcard/firmware.git
     cd firmware
+    git submodule update --init
     # DOWNLOAD https://coldcard.com/downloads
-    # get a copy of binary into ./releases/2026-03-05T2052-v5.5.0-mk-coldcard.dfu
-    git checkout 2026-03-05T2052-v5.5.0
+    # get a copy of binary into ./releases/2026-07-01T1729-v5.5.1-mk-coldcard.dfu
+    git checkout 2026-07-01T1730-v5.5.1
     cd stm32
-    make -f MK4-Makefile repro
+    make -f MK-Makefile repro
     ```
 
 4. At the end of the process a clear confirmation message is shown, or the differences.
diff --git a/cli/signit.py b/cli/signit.py
index 31ddff22..da449e8a 100755
--- a/cli/signit.py
+++ b/cli/signit.py
@@ -106,6 +106,18 @@ def show_version(fname):
 
     print('{built}-v{ver}'.format(built=built, ver=ver))
 
+@main.command('sha256sum')
+@click.argument('files', nargs=-1, required=True, type=click.Path(exists=True))
+def sha256sum(files):
+    "Print SHA256 checksum of file(s); portable stand-in for sha256sum(1)/shasum."
+    for fn in files:
+        h = sha256()
+        with open(fn, 'rb') as fd:
+            for chunk in iter(lambda: fd.read(1 << 20), b''):
+                h.update(chunk)
+        # match GNU sha256sum output: "<hex>  <name>" (two spaces)
+        print("%s  %s" % (h.hexdigest(), fn))
+
 def dfu_parse(fd):
     # do just a little parsing of DFU headers, to find start/length of main binary
     # - not trying to support anything but what ../stm32/Makefile will generate
diff --git a/stm32/shared.mk b/stm32/shared.mk
index 013f1812..2c8eed27 100644
--- a/stm32/shared.mk
+++ b/stm32/shared.mk
@@ -308,6 +308,7 @@ ifeq ($(PUBLISHED_BIN),)
 	@echo ""
 else
 	@echo Comparing against: $(PUBLISHED_BIN)
+	@echo SHA256: `$(SIGNIT) sha256sum $(PUBLISHED_BIN)`
 	test -n "$(PUBLISHED_BIN)" -a -f $(PUBLISHED_BIN)
 	$(RM) -f check-fw.bin check-bootrom.bin
 	$(SIGNIT) split $(PUBLISHED_BIN) check-fw.bin check-bootrom.bin