diff --git a/coreboot-t440p/config.sh b/coreboot-t440p/config.sh
index 235d81f..7a0ae1a 100755
--- a/coreboot-t440p/config.sh
+++ b/coreboot-t440p/config.sh
@@ -5,8 +5,12 @@
 WORK_DIR="${WORK_DIR:-$HOME/t440p-coreboot}"
 COREBOOT_DIR="$WORK_DIR/coreboot"
 
-# The coreboot commit known to work with this guide
-COREBOOT_COMMIT="e1e762716cf925c621d58163133ed1c3e006a903"
+# Pinned coreboot release tag.
+# Pinning a tag (not a SHA) keeps the guide reproducible AND lets us
+# ride toolchain fixes that land in new releases. Bumped from the old
+# 2024-era commit e1e762716c after GCC 15 started failing -Werror on
+# unterminated char[] initializers in src/commonlib/include/.../loglevel.h.
+COREBOOT_COMMIT="26.03"
 
 # Blob paths (populated after extraction)
 BLOB_IFD="$WORK_DIR/ifd.bin"
diff --git a/coreboot-t440p/main.sh b/coreboot-t440p/main.sh
index 36d8154..25a103d 100755
--- a/coreboot-t440p/main.sh
+++ b/coreboot-t440p/main.sh
@@ -61,8 +61,20 @@ run_step() {
 
 # --- Main flow ---
 
+# Validate a step number (1-12). Coerces invalid input to 1.
+_sanitize_step() {
+  case "$1" in
+    ''|*[!0-9]*) echo 1; return ;;
+  esac
+  if [ "$1" -lt 1 ] || [ "$1" -gt 12 ]; then
+    echo 1
+  else
+    echo "$1"
+  fi
+}
+
 run_full_install() {
-  _start="${1:-1}"
+  _start=$(_sanitize_step "${1:-1}")
 
   [ "$_start" -le 1 ]  && run_step 1  "Install Dependencies"          install_dependencies
   [ "$_start" -le 2 ]  && run_step 2  "Connect CH341A Programmer"     step_attach_ch341a
@@ -85,9 +97,69 @@ run_full_install() {
   printf "${NC}\n"
 }
 
+# --- CLI ---
+
+print_usage() {
+  cat <<USAGE
+Usage: $(basename "$0") [OPTIONS]
+
+Options:
+  -s, --start N        Skip interactive menu; run full install from step N.
+                       Useful when BIOS is already extracted / blobs ready.
+  -u, --update         Skip menu; internal-flash coreboot (already running it).
+  -r, --revert         Skip menu; restore original BIOS.
+  -w, --work-dir PATH  Override WORK_DIR (default: \$HOME/t440p-coreboot).
+  -h, --help           Show this help.
+
+Steps (for --start):
+   1. Install dependencies       7. Build ifdtool & extract blobs
+   2. Connect CH341A programmer  8. Build cbfstool
+   3. Extract original BIOS      9. Obtain mrc.bin
+   4. Verify BIOS backups       10. Configure coreboot
+   5. Combine BIOS images       11. Build coreboot
+   6. Clone coreboot repo       12. Flash coreboot
+
+Example — skip hardware steps when backups already extracted:
+  $(basename "$0") --start 5
+USAGE
+}
+
+# Parse CLI flags. Populates CLI_MODE and CLI_START.
+CLI_MODE=""
+CLI_START=""
+_parse_cli() {
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      -s|--start)
+        [ -z "$2" ] && { error "--start needs a step number"; exit 2; }
+        CLI_MODE="start"
+        CLI_START=$(_sanitize_step "$2")
+        shift 2
+        ;;
+      -u|--update) CLI_MODE="update"; shift ;;
+      -r|--revert) CLI_MODE="revert"; shift ;;
+      -w|--work-dir)
+        [ -z "$2" ] && { error "--work-dir needs a path"; exit 2; }
+        WORK_DIR="$2"
+        COREBOOT_DIR="$WORK_DIR/coreboot"
+        BLOB_IFD="$WORK_DIR/ifd.bin"
+        BLOB_ME="$WORK_DIR/me.bin"
+        BLOB_GBE="$WORK_DIR/gbe.bin"
+        BLOB_MRC="$WORK_DIR/mrc.bin"
+        ORIGINAL_ROM="$WORK_DIR/t440p-original.rom"
+        shift 2
+        ;;
+      -h|--help) print_usage; exit 0 ;;
+      *) error "Unknown flag: $1"; print_usage; exit 2 ;;
+    esac
+  done
+}
+
 # --- Entry point ---
 
 main() {
+  _parse_cli "$@"
+
   show_banner
   detect_distro
 
@@ -97,6 +169,13 @@ main() {
   info "Working directory: $WORK_DIR"
   echo ""
 
+  # Non-interactive modes (from CLI flags) — skip the menu entirely.
+  case "$CLI_MODE" in
+    start)  run_full_install "$CLI_START"; return ;;
+    update) step_update_bios; return ;;
+    revert) step_revert_bios; return ;;
+  esac
+
   echo "  What would you like to do?"
   echo ""
   echo "  1) Full install        - Run all steps from the beginning"
@@ -105,6 +184,8 @@ main() {
   echo "  4) Revert to original  - Restore original BIOS"
   echo "  5) Quit"
   echo ""
+  info "Tip: pass --start N / --update / --revert to skip this menu."
+  echo ""
 
   printf "${CYAN}Choice [1-5]:${NC} "
   read -r _choice
@@ -117,7 +198,7 @@ main() {
       echo ""
       echo "  Steps:"
       echo "   1. Install dependencies       7. Build ifdtool & extract blobs"
-      echo "   2. Verify CH341A programmer   8. Build cbfstool"
+      echo "   2. Connect CH341A programmer  8. Build cbfstool"
       echo "   3. Extract original BIOS      9. Obtain mrc.bin"
       echo "   4. Verify BIOS backups       10. Configure coreboot"
       echo "   5. Combine BIOS images       11. Build coreboot"
diff --git a/coreboot-t440p/steps/clone_coreboot.sh b/coreboot-t440p/steps/clone_coreboot.sh
index cd1df0d..49c2d87 100755
--- a/coreboot-t440p/steps/clone_coreboot.sh
+++ b/coreboot-t440p/steps/clone_coreboot.sh
@@ -12,18 +12,23 @@ step_clone_coreboot() {
       info "Using existing coreboot directory."
       cd "$COREBOOT_DIR" || return 1
 
-      _current=$(git rev-parse HEAD 2>/dev/null)
-      if [ "$_current" = "$COREBOOT_COMMIT" ]; then
-        success "Already on correct commit."
-        return 0
-      else
-        warn "Current commit ($_current) differs from expected ($COREBOOT_COMMIT)."
-        if prompt_yes_no "Checkout the correct commit?"; then
-          run_cmd "git checkout $COREBOOT_COMMIT" || return 1
-          run_cmd "git submodule update --init --checkout" || return 1
-        fi
+      # Resolve the target ref (may be a tag or a SHA) to a SHA for comparison.
+      run_cmd "git fetch --tags origin" || return 1
+      _target_sha=$(git rev-parse --verify "$COREBOOT_COMMIT^{commit}" 2>/dev/null)
+      _current_sha=$(git rev-parse HEAD 2>/dev/null)
+
+      if [ -n "$_target_sha" ] && [ "$_current_sha" = "$_target_sha" ]; then
+        success "Already on $COREBOOT_COMMIT."
         return 0
       fi
+
+      warn "Current HEAD ($_current_sha) differs from target ($COREBOOT_COMMIT)."
+      if prompt_yes_no "Checkout $COREBOOT_COMMIT?"; then
+        run_cmd "git checkout $COREBOOT_COMMIT" || return 1
+        run_cmd "git submodule update --init --checkout" || return 1
+        success "Checked out $COREBOOT_COMMIT."
+      fi
+      return 0
     fi
   fi
 
@@ -32,11 +37,14 @@ step_clone_coreboot() {
 
   cd "$COREBOOT_DIR" || return 1
 
-  info "Checking out commit: $COREBOOT_COMMIT"
+  info "Fetching tags..."
+  run_cmd "git fetch --tags origin" || return 1
+
+  info "Checking out: $COREBOOT_COMMIT"
   run_cmd "git checkout $COREBOOT_COMMIT" || return 1
 
   info "Initializing submodules..."
   run_cmd "git submodule update --init --checkout" || return 1
 
-  success "Coreboot repository ready."
+  success "Coreboot repository ready on $COREBOOT_COMMIT."
 }
diff --git a/coreboot-t440p/steps/combine_bios.sh b/coreboot-t440p/steps/combine_bios.sh
index 0951354..6f39652 100755
--- a/coreboot-t440p/steps/combine_bios.sh
+++ b/coreboot-t440p/steps/combine_bios.sh
@@ -6,6 +6,18 @@ step_combine_bios() {
 
   cd "$WORK_DIR" || return 1
 
+  # Short-circuit if the combined ROM already exists at the right size.
+  if [ -f t440p-original.rom ]; then
+    _existing=$(wc -c < t440p-original.rom)
+    if [ "$_existing" -eq "$SIZE_12MB" ]; then
+      info "Existing 12MB ROM found: $WORK_DIR/t440p-original.rom"
+      if prompt_yes_default "Use the existing combined ROM?"; then
+        success "Using existing t440p-original.rom."
+        return 0
+      fi
+    fi
+  fi
+
   info "Combining 8MB (bottom) + 4MB (top) into a single 12MB ROM..."
   run_cmd "cat 8mb_backup1.bin 4mb_backup1.bin > t440p-original.rom" || return 1
 
diff --git a/coreboot-t440p/steps/extract_bios.sh b/coreboot-t440p/steps/extract_bios.sh
index a287f67..20026fb 100755
--- a/coreboot-t440p/steps/extract_bios.sh
+++ b/coreboot-t440p/steps/extract_bios.sh
@@ -134,6 +134,25 @@ _read_with_retry() {
 step_extract_bios() {
   section "Extract Original BIOS"
 
+  cd "$WORK_DIR" || return 1
+
+  # Short-circuit: if all four backups already exist and are the right size,
+  # assume the user already pulled them off the board and offer to skip.
+  if [ -f 4mb_backup1.bin ] && [ -f 4mb_backup2.bin ] \
+     && [ -f 8mb_backup1.bin ] && [ -f 8mb_backup2.bin ]; then
+    _s1=$(wc -c < 4mb_backup1.bin)
+    _s2=$(wc -c < 8mb_backup1.bin)
+    if [ "$_s1" -eq "$SIZE_4MB" ] && [ "$_s2" -eq "$SIZE_8MB" ]; then
+      info "Existing backups found in $WORK_DIR:"
+      echo "    4mb_backup1.bin, 4mb_backup2.bin, 8mb_backup1.bin, 8mb_backup2.bin"
+      echo ""
+      if prompt_yes_default "Skip re-reading the chips and use the existing backups?"; then
+        success "Using existing backups. Skipping extraction."
+        return 0
+      fi
+    fi
+  fi
+
   info "The T440p has two EEPROM chips beside the SODIMM slots:"
   echo "  - 4MB (top)    — smaller SOIC-8, farther from CPU"
   echo "  - 8MB (bottom) — larger SOIC-8, closer to CPU (holds ME firmware)"
@@ -141,8 +160,6 @@ step_extract_bios() {
   info "Each chip is read twice so we can diff the results and catch flaky reads."
   echo ""
 
-  cd "$WORK_DIR" || return 1
-
   # --- 4MB chip (do first: smaller = faster iteration on setup) ---
   echo ""
   show_image "eeprom_chip_4mb.webp" "Reference: 4MB (top) chip location on T440p"
diff --git a/coreboot-t440p/utils.sh b/coreboot-t440p/utils.sh
index 590fa03..527bb20 100755
--- a/coreboot-t440p/utils.sh
+++ b/coreboot-t440p/utils.sh
@@ -52,9 +52,11 @@ prompt_yes_default() {
   esac
 }
 
-# Prompt for a value with a default
+# Prompt for a value with a default.
+# The prompt goes to stderr so callers can capture ONLY the chosen value
+# via command substitution: VAL=$(prompt_value "Label" "default").
 prompt_value() {
-  printf "${CYAN}%s [%s]:${NC} " "$1" "$2"
+  printf "${CYAN}%s [%s]:${NC} " "$1" "$2" >&2
   read -r _response
   if [ -z "$_response" ]; then
     echo "$2"