diff --git a/cli/signit.py b/cli/signit.py
index caa259f4..4eb29b50 100755
--- a/cli/signit.py
+++ b/cli/signit.py
@@ -289,11 +289,10 @@ def doit(keydir, outfn=None, build_dir='l-port/build-COLDCARD', high_water=False
 
     body_len = align_to(len(body), 512)
 
-    if hw_compat & (MK_1_OK | MK_2_OK | MK_3_OK):
+    if (not resign_file) and (hw_compat & (MK_1_OK | MK_2_OK | MK_3_OK)):
         # bugfix: at least 128 bytes needed past last page boundary of flash during upgrade
-        if (body_len % 4096) <= 128:
+        if 4096 - (body_len % 4096) <= 128:
             body_len += 512
-        assert body_len > len(body) + 128, body_len
 
     assert body_len % 512 == 0, body_len
 
@@ -302,6 +301,10 @@ def doit(keydir, outfn=None, build_dir='l-port/build-COLDCARD', high_water=False
     body = pad_to(body, body_len)
     version = pad_to(version.encode('ascii'), 8, b'\0')
 
+    # check we will have space for trailing file header
+    if and hw_compat & (MK_1_OK | MK_2_OK | MK_3_OK):
+        assert body.endswith(b'\xff'*128), 'needs 128+ padding?'
+
     hdr = header(   magic_value=FW_HEADER_MAGIC,
                     version_string=version,
                     firmware_length=FW_HEADER_OFFSET+FW_HEADER_SIZE+body_len,