diff --git a/agent/README.md b/agent/README.md
index b359781..1914e41 100644
--- a/agent/README.md
+++ b/agent/README.md
@@ -85,9 +85,10 @@ Requires `arm-none-eabi-gcc` (Arch: `pacman -S arm-none-eabi-gcc arm-none-eabi-n
 | hi3536dv100 | 0x12080000 | 0x14000000 | 0x80000000 | 0x81000000 |
 
 gk7205v500 also serves gk7205v510/v530. The V500 bootrom has no SPL stage:
-`defib agent upload` puts the agent in the boot-code slot of an OpenIPC
-u-boot-xmedia image (downloaded, or `-f` for your own), whose DDR-init code
-runs first; the bootrom then executes the slot in place at `0x41007000`.
+`defib agent upload` puts the agent in the boot-code slot of OpenIPC's
+`u-boot-<chip>-nor.bin` (downloaded from the OpenIPC/firmware `latest`
+release, or `-f` for your own), whose DDR-init code runs first; the bootrom
+then executes the slot in place at `0x41007000`.
 
 hi3536dv100 also covers the "Hi3536E" that Xiongmai puts in its NVRs, a
 variant of the same die. Its UART runs off a fixed 24 MHz clock, so
diff --git a/src/defib/cli/app.py b/src/defib/cli/app.py
index dc2acec..0d31037 100644
--- a/src/defib/cli/app.py
+++ b/src/defib/cli/app.py
@@ -1087,7 +1087,7 @@ def agent_upload(
     chip: str = typer.Option(..., "-c", "--chip", help="Chip model name"),
     port: str = typer.Option("/dev/ttyUSB0", "-p", "--port", help="Serial device (/dev/ttyUSB0), tcp://host:port, rfc2217://host:port, or socket:///path"),
     output: str = typer.Option("human", "--output", help="Output mode: human, json"),
-    file: str | None = typer.Option(None, "-f", "--file", help="CV6xx: composite boot file (GSL+DDR+U-Boot), required. V500: U-Boot image whose header and DDR-init code carry the agent (default: OpenIPC u-boot-xmedia download). Ignored for other protocols"),
+    file: str | None = typer.Option(None, "-f", "--file", help="CV6xx: composite boot file (GSL+DDR+U-Boot), required. V500: U-Boot image whose header and DDR-init code carry the agent (default: OpenIPC u-boot-<chip>-nor.bin download). Ignored for other protocols"),
     power_cycle: bool = typer.Option(False, "--power-cycle", help="Auto power-cycle via configured controller (DEFIB_POWER_TYPE)"),
     poe_port_override: str = typer.Option("", "--poe-port", help="Explicit MikroTik ether port (e.g. ether3) — overrides comment-based auto-discovery. Requires --power-cycle."),
 ) -> None:
diff --git a/src/defib/firmware.py b/src/defib/firmware.py
index 2f89717..e127d79 100644
--- a/src/defib/firmware.py
+++ b/src/defib/firmware.py
@@ -482,13 +482,13 @@ def _download(
         raise ConnectionError(f"Failed to download firmware: {e}") from e
 
 
-# V500-family (gk7205v500/v510/v530) U-Boot is built in OpenIPC/u-boot-xmedia,
-# not OpenIPC/firmware. defib only needs its boot-image header and DDR-init
-# (aux) code to carry the flash agent, and those do not depend on the flash
-# type, so the smaller NOR build is the donor.
-XMEDIA_UBOOT_BASE_URL = (
-    "https://github.com/OpenIPC/u-boot-xmedia/releases/download/latest"
-)
+# V500-family (gk7205v500/v510/v530) U-Boot is OpenIPC/u-boot's NOR build on
+# the OpenIPC/firmware release, as for every other per-flash-type SoC (the
+# retired OpenIPC/u-boot-xmedia published it before). defib only needs its
+# boot-image header and DDR-init (aux) code to carry the flash agent, and
+# those do not depend on the flash type, so the smaller NOR build is the donor.
+# Both builds carry the same key area and aux area byte for byte, so the agent
+# boot image does not change with the source.
 
 
 def download_v500_donor(chip: str) -> Path:
@@ -502,4 +502,4 @@ def download_v500_donor(chip: str) -> Path:
     if dest.exists():
         logger.info("Using cached V500 donor: %s", dest)
         return dest
-    return _download(f"{XMEDIA_UBOOT_BASE_URL}/{name}", dest)
+    return _download(f"{OPENIPC_BASE_URL}/{name}", dest)
diff --git a/src/defib/protocol/hisilicon_v500.py b/src/defib/protocol/hisilicon_v500.py
index 936cdab..e64d18e 100644
--- a/src/defib/protocol/hisilicon_v500.py
+++ b/src/defib/protocol/hisilicon_v500.py
@@ -81,7 +81,7 @@ def v500_member(chip: str) -> str | None:
 def wrap_v500_payload(donor: bytes, payload: bytes, load_addr: int) -> bytes:
     """Put ``payload`` in the boot-code area of a V500 boot image.
 
-    ``donor`` is a complete V500 U-Boot image (e.g. OpenIPC u-boot-xmedia's
+    ``donor`` is a complete V500 U-Boot image (e.g. OpenIPC's
     ``u-boot-gk7205v500-nor.bin``). Its key area, params and aux (DDR init)
     area are kept verbatim; its boot code is replaced by ``payload`` and the
     two length fields are patched to match. The bootrom runs the boot code
diff --git a/tests/test_firmware.py b/tests/test_firmware.py
index 0732140..f2b2cf4 100644
--- a/tests/test_firmware.py
+++ b/tests/test_firmware.py
@@ -258,8 +258,10 @@ def fake_urlopen(req, timeout=None):
         first = firmware.download_v500_donor("gk7205v510")
         again = firmware.download_v500_donor("gk7205v510")
         assert first == again == get_cache_dir() / "u-boot-gk7205v510-nor.bin"
+        # OpenIPC/u-boot's build on the firmware release; the retired
+        # u-boot-xmedia release carries the same key and DDR-init areas.
         assert urls == [
-            "https://github.com/OpenIPC/u-boot-xmedia/releases/download/latest/"
+            "https://github.com/OpenIPC/firmware/releases/download/latest/"
             "u-boot-gk7205v510-nor.bin"
         ]
 
@@ -377,9 +379,8 @@ def offline(url, dest, on_progress=None):
             download_firmware(soc)
 
     def test_gk7205v5xx_shares_the_v500_donor_cache_entry(self, tmp_path, monkeypatch):
-        # download_v500_donor() caches u-boot-xmedia's NOR build under the
-        # same name the OpenIPC/firmware release uses, so either source
-        # satisfies the other.
+        # download_v500_donor() caches the NOR build under the same name the
+        # install path uses, so either one satisfies the other.
         monkeypatch.setenv("XDG_CACHE_HOME", str(tmp_path))
         monkeypatch.setattr("sys.platform", "linux")
         donor = get_cache_dir() / "u-boot-gk7205v510-nor.bin"