diff --git a/client/src/cmdhw.c b/client/src/cmdhw.c
index 062cbd815..f996c5fe5 100644
--- a/client/src/cmdhw.c
+++ b/client/src/cmdhw.c
@@ -2534,6 +2534,7 @@ static int CmdBWMUpgrade(const char *Cmd) {
     // BWM ESP is an ESP32-C2; a wrong/other-chip image would brick it.
     //   [0x00]       == 0xE9   -> ESP image magic
     //   [0x0C..0x0D] == 0x000C -> chip_id ESP32-C2 (LE uint16)
+    //   [0xABCD5432..0x20] == 0x000C -> app descriptor (LE uint32)
     if (fwlen < 16) {
         PrintAndLogEx(FAILED, "file is too small to be an ESP firmware image (%zu bytes)", fwlen);
         free(fw);
@@ -2550,6 +2551,13 @@ static int CmdBWMUpgrade(const char *Cmd) {
         free(fw);
         return PM3_EFILE;
     }
+
+    uint32_t app_sign = (uint32_t)(fw[0x20] | (fw[0x21] << 8) | (fw[0x22] << 16) | ((uint32_t)fw[0x23] << 24));
+        if (app_sign != 0xABCD5432) {
+        PrintAndLogEx(FAILED, "refusing to flash: image app_sign " _YELLOW_("0x%08X") " is invalid (expected 0xABCD5432)", app_sign);
+        free(fw);
+        return PM3_EFILE;
+    }
     
     // Record the running version first, so we can confirm the update actually took
     // even when the finalize ack is lost (the case that used to discard a completed