diff --git a/backend/app/services/boot_images/manifest.json b/backend/app/services/boot_images/manifest.json
index 2c688c27..ecbad73b 100644
--- a/backend/app/services/boot_images/manifest.json
+++ b/backend/app/services/boot_images/manifest.json
@@ -8,9 +8,9 @@
         {
           "name": "kernel8.img",
           "asset_id": "kernel8-pi3",
-          "sha256": "495bf3ec05ad1de29cb884ec3d5e89bfc824740f537d40cbe6be59ee1cdc6ef9",
-          "size_bytes": 9695883,
-          "version": "2026-04-21"
+          "sha256": "2f87328ab8d36c266ac0545e59a7eed53841e146a75e0010929d3dafd0209310",
+          "size_bytes": 24367616,
+          "version": "2026-03-11+raw"
         },
         {
           "name": "bcm2710-rpi-3-b.dtb",
diff --git a/backend/app/services/qemu_manager.py b/backend/app/services/qemu_manager.py
index 04ef8df4..be805166 100644
--- a/backend/app/services/qemu_manager.py
+++ b/backend/app/services/qemu_manager.py
@@ -184,13 +184,22 @@ class QemuManager:
             # ttyAMA1 → GPIO shim protocol
             '-serial', f'tcp:127.0.0.1:{inst.gpio_port},server,nowait',
             '-append',
+            # earlycon=pl011,mmio32,0x3f201000 — without explicit address
+            # the kernel doesn't initialise the BCM2837 PL011 UART early
+            # enough for any output to reach ttyAMA0; we get a silent
+            # boot followed by a "broken simulator" report. The address
+            # matches the BCM2837 SoC peripheral mapping (Pi 3 base
+            # 0x3f000000 + PL011 offset 0x201000).
+            #
             # No `quiet`: surface kernel boot messages to ttyAMA0 so the
-            # user sees progress while the 5.4 GiB Pi OS rootfs comes up
-            # (~30-60 s wall on a QEMU-emulated Cortex-A53 quad). No
-            # `init=/bin/sh`: let systemd run normally so a real
-            # `serial-getty@ttyAMA0` lands the user at a login prompt
-            # instead of a silent non-interactive shell.
-            'console=ttyAMA0 root=/dev/mmcblk0p2 rootwait rw '
+            # user sees progress while the 5.4 GiB Pi OS rootfs comes up.
+            # No `init=/bin/sh`: let systemd run normally; the SD image
+            # ships with a serial-getty@ttyAMA0 autologin drop-in (baked
+            # by scripts/configure-pi3-autologin.sh) so the user lands
+            # at a root shell without credentials.
+            'earlycon=pl011,mmio32,0x3f201000 '
+            'console=ttyAMA0,115200 '
+            'root=/dev/mmcblk0p2 rootwait rw '
             'dwc_otg.lpm_enable=0',
         ]