diff --git a/boards/cubepilot/cubeorange/extras/cubepilot_cubeorange_bootloader.bin b/boards/cubepilot/cubeorange/extras/cubepilot_cubeorange_bootloader.bin
index a2b7b74c1cc..c27e81a3be5 100755
Binary files a/boards/cubepilot/cubeorange/extras/cubepilot_cubeorange_bootloader.bin and b/boards/cubepilot/cubeorange/extras/cubepilot_cubeorange_bootloader.bin differ
diff --git a/boards/px4/fmu-v6c/extras/px4_fmu-v6c_bootloader.bin b/boards/px4/fmu-v6c/extras/px4_fmu-v6c_bootloader.bin
index b6b75bb868c..46e41a7abcf 100755
Binary files a/boards/px4/fmu-v6c/extras/px4_fmu-v6c_bootloader.bin and b/boards/px4/fmu-v6c/extras/px4_fmu-v6c_bootloader.bin differ
diff --git a/platforms/nuttx/src/bootloader/nxp/imxrt_common/main.c b/platforms/nuttx/src/bootloader/nxp/imxrt_common/main.c
index 247890ad4b3..58c91c88d83 100644
--- a/platforms/nuttx/src/bootloader/nxp/imxrt_common/main.c
+++ b/platforms/nuttx/src/bootloader/nxp/imxrt_common/main.c
@@ -684,10 +684,21 @@ arch_do_jump(const uint32_t *app_base)
 	uint32_t stacktop = app_base[APP_VECTOR_OFFSET_WORDS];
 	uint32_t entrypoint = app_base[APP_VECTOR_OFFSET_WORDS + 1];
 
+	uint32_t scratch;
+
+	/* NuttX 12.12 runs thread mode on the PSP (arm_initialize_stack(), enabled
+	 * whenever CONFIG_ARCH_INTERRUPTSTACK > 7). The application expects to start
+	 * on the MSP, so select it again before handing over -- otherwise the app
+	 * keeps running on the bootloader's stack and faults once it is clobbered.
+	 */
 	asm volatile(
-		"msr msp, %0  \n"
-		"bx %1  \n"
-		: : "r"(stacktop), "r"(entrypoint) :);
+		"mrs %0, control  \n"
+		"bic %0, %0, #2   \n"
+		"msr control, %0  \n"
+		"isb sy           \n"
+		"msr msp, %1      \n"
+		"bx %2  \n"
+		: "=&r"(scratch) : "r"(stacktop), "r"(entrypoint) :);
 
 	// just to keep noreturn happy
 	for (;;) ;
diff --git a/platforms/nuttx/src/bootloader/stm/stm32_common/main.c b/platforms/nuttx/src/bootloader/stm/stm32_common/main.c
index 9c2d9ec2fd8..cb1ef0e8f0e 100644
--- a/platforms/nuttx/src/bootloader/stm/stm32_common/main.c
+++ b/platforms/nuttx/src/bootloader/stm/stm32_common/main.c
@@ -636,10 +636,21 @@ arch_do_jump(const uint32_t *app_base)
 	uint32_t stacktop = app_base[0];
 	uint32_t entrypoint = app_base[1];
 
+	uint32_t scratch;
+
+	/* NuttX 12.12 runs thread mode on the PSP (arm_initialize_stack(), enabled
+	 * whenever CONFIG_ARCH_INTERRUPTSTACK > 7). The application expects to start
+	 * on the MSP, so select it again before handing over -- otherwise the app
+	 * keeps running on the bootloader's stack and faults once it is clobbered.
+	 */
 	asm volatile(
-		"msr msp, %0  \n"
-		"bx %1  \n"
-		: : "r"(stacktop), "r"(entrypoint) :);
+		"mrs %0, control  \n"
+		"bic %0, %0, #2   \n"
+		"msr control, %0  \n"
+		"isb sy           \n"
+		"msr msp, %1      \n"
+		"bx %2  \n"
+		: "=&r"(scratch) : "r"(stacktop), "r"(entrypoint) :);
 
 	// just to keep noreturn happy
 	for (;;) ;