diff --git a/CMakeLists.txt b/CMakeLists.txt
index ca7c263..2dd7ce0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -51,13 +51,18 @@ if(PROJECT_IS_TOP_LEVEL)
 	endif()
 endif()
 
-# avrdude programs Intel-HEX; the ELF is only a container (symbols, section
-# headers) and is never flashed. Every loader image therefore gets a .hex beside
-# it at link time. .eeprom is dropped — EEPROM content is its own avrdude update.
-function(add_hex_output name)
+# The ELF is only a container (symbols, section headers) and is never flashed —
+# and the host tool's load_image() dispatches on extension, so handing it one
+# would silently program the header bytes. Every loader image therefore gets
+# both flashable forms beside it at link time: .hex for avrdude, and .bin for
+# the host tool's raw path (which is what the reloc and update tests convert to
+# on the fly). .eeprom is dropped — EEPROM content is its own update.
+function(add_image_outputs name)
 	add_custom_command(TARGET ${name} POST_BUILD
 	                   COMMAND ${CMAKE_OBJCOPY} -O ihex -R .eeprom
-	                           $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.hex)
+	                           $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.hex
+	                   COMMAND ${CMAKE_OBJCOPY} -O binary -R .eeprom
+	                           $<TARGET_FILE:${name}> $<TARGET_FILE:${name}>.bin)
 endfunction()
 
 # The TinySafeBoot protocol reimplemented on libavr in three variants that trade
@@ -99,7 +104,7 @@ function(add_tsb_variant name bytes)
 	target_link_options(${name} PRIVATE -nostartfiles -Wl,--section-start=.text=${base_hex}
 	                    -Wl,--defsym=tsb_app=0 -Wl,--pmem-wrap-around=32k)
 	add_custom_command(TARGET ${name} POST_BUILD COMMAND ${CMAKE_SIZE} $<TARGET_FILE:${name}>)
-	add_hex_output(${name})
+	add_image_outputs(${name})
 	if(PROJECT_IS_TOP_LEVEL)
 		add_test(NAME ${name}.size
 		         COMMAND ${CMAKE_COMMAND} -DSIZE_TOOL=${CMAKE_SIZE} -DELF=$<TARGET_FILE:${name}>
@@ -176,7 +181,7 @@ target_compile_definitions(pureboot PRIVATE PUREBOOT_TIMEOUT=${PUREBOOT_TIMEOUT}
 target_link_options(pureboot PRIVATE -nostartfiles -Wl,--section-start=.text=${_pb_base_hex}
                     -Wl,--defsym=pureboot_app=${_pb_app} ${_pb_wrap})
 add_custom_command(TARGET pureboot POST_BUILD COMMAND ${CMAKE_SIZE} $<TARGET_FILE:pureboot>)
-add_hex_output(pureboot)
+add_image_outputs(pureboot)
 if(PROJECT_IS_TOP_LEVEL)
 	add_test(NAME pureboot.size
 	         COMMAND ${CMAKE_COMMAND} -DSIZE_TOOL=${CMAKE_SIZE} -DELF=$<TARGET_FILE:pureboot>
@@ -225,7 +230,7 @@ if(PROJECT_IS_TOP_LEVEL)
 		target_compile_definitions(pureboot9 PRIVATE PUREBOOT_TIMEOUT=9)
 		target_link_options(pureboot9 PRIVATE -nostartfiles -Wl,--section-start=.text=${_pb_base_hex}
 		                    -Wl,--defsym=pureboot_app=${_pb_app} ${_pb_wrap})
-		add_hex_output(pureboot9)
+		add_image_outputs(pureboot9)
 		add_test(NAME pureboot.update
 		         COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pbupdate.py
 		                 ${PB_DEVICE} $<TARGET_FILE:pureboot> $<TARGET_FILE:pureboot9> ${LIBAVR_MCU}