diff --git a/loader/src/secboot.rs b/loader/src/secboot.rs
index f8a206023..e1c2b7de1 100644
--- a/loader/src/secboot.rs
+++ b/loader/src/secboot.rs
@@ -353,11 +353,25 @@ pub fn validate_xous_img(xous_img_offset: *const u32) -> bool {
         if sig.version != 1 || (sig.version != protected_version) {
             gfx.msg("Check fail: mismatch on signature record version numbering.\n\r", &mut cursor);
             println!("Check fail: mismatch on signature record version numbering.\n\r");
+            println!("sig.version: {}", sig.version);
+            println!("protected_version: {}", protected_version);
+            // a little insight to help debug what went wrong.
+            for words in image[signed_len as usize - 16 .. ].chunks(4) {
+                let word = u32::from_le_bytes(words.try_into().unwrap());
+                println!("{:x}", word);
+            }
             die();
         }
         if protected_len != signed_len - 4 {
             gfx.msg("Check fail: mismatch on header length vs protected length.\n\r", &mut cursor);
             println!("Check fail: mismatch on header length vs protected length.\n\r");
+            println!("signed_len - 4: {}", signed_len - 4);
+            println!("protected_len: {}", protected_len);
+            // a little insight to help debug what went wrong.
+            for words in image[signed_len as usize - 16 .. ].chunks(4) {
+                let word = u32::from_le_bytes(words.try_into().unwrap());
+                println!("{:x}", word);
+            }
             die();
         }
 
diff --git a/services/root-keys/src/api.rs b/services/root-keys/src/api.rs
index 776755067..15603ff3f 100644
--- a/services/root-keys/src/api.rs
+++ b/services/root-keys/src/api.rs
@@ -3,6 +3,8 @@ pub(crate) const SERVER_NAME_KEYS: &str     = "_Root key server and update manag
 pub(crate) const ROOTKEY_MODAL_NAME: &'static str = "rootkeys modal";
 #[allow(dead_code)]
 pub(crate) const ROOTKEY_MENU_NAME: &'static str = "rootkeys menu";
+#[allow(dead_code)]
+pub(crate) const SIG_VERSION: u32 = 1;
 
 #[allow(dead_code)]
 #[derive(num_derive::FromPrimitive, num_derive::ToPrimitive, Debug)]
diff --git a/services/root-keys/src/implementation.rs b/services/root-keys/src/implementation.rs
index d7803d406..e97e52478 100644
--- a/services/root-keys/src/implementation.rs
+++ b/services/root-keys/src/implementation.rs
@@ -1820,6 +1820,19 @@ impl<'a> RootKeys {
         // use most of the available space for the kernel, so by the time we're done maybe only 10-20% of the space is empty.
         let kernel_len = kernel_region.len() - SIGBLOCK_SIZE as usize;
 
+        // we need to update our actual length because the initial burn doesn't set this
+        let mut len_data = [0u8; 8];
+        for (&src, dst) in SIG_VERSION.to_le_bytes().iter().zip(len_data[..4].iter_mut()) {
+            *dst = src;
+        }
+        for (&src, dst) in (kernel_len as u32 - 4).to_le_bytes().iter().zip(len_data[4..].iter_mut()) {
+            *dst = src;
+        }
+        log::info!("kernel len area before: {:x?}", &(self.kernel()[kernel_region.len()-8..]));
+        self.spinor.patch(self.kernel(), self.kernel_base(), &len_data, kernel_region.len() as u32 - 8)
+            .expect("couldn't patch length area");
+        log::info!("kernel len area after: {:x?}", &(self.kernel()[kernel_region.len()-8..]));
+
         (signing_key.sign(&kernel_region[SIGBLOCK_SIZE as usize..]), kernel_len as u32)
     }
 
@@ -1988,7 +2001,7 @@ impl<'a> RootKeys {
         // map a structure onto the signature region, so we can do something sane when writing stuff to it
         let mut signature: &mut SignatureInFlash = unsafe{(sig_region.as_mut_ptr() as *mut SignatureInFlash).as_mut().unwrap()}; // this pointer better not be null, we just created it!
 
-        signature.version = 1;
+        signature.version = SIG_VERSION;
         signature.signed_len = len;
         signature.signature = sig.to_bytes();
         log::debug!("sig: {:x?}", sig.to_bytes());