!!! warning "Back up first" Back up the SD card before you write it. Back up the FPGA config flash, twice, before you flash the bitstream. Prepare and back up gives the steps. The firmware image needs ...

SafeNet still requires the PIN in the SignTool process command line. The local .env.windows or machine-owned secrets/windows-signing.env stores the PIN in plaintext and needs restricted file access.