diff --git a/ql-bootloader/updater/tool/config b/ql-bootloader/updater/tool/config
index dd6a34e..1b138b5 100644
--- a/ql-bootloader/updater/tool/config
+++ b/ql-bootloader/updater/tool/config
@@ -3,7 +3,7 @@ Number_of_Images = 1
 1_Image_Enable = 1
 1_Image_Image_ID = 0x30
 1_Image_Path = customer_app.bin
-1_Image_Flash_Entry_Address = 0x0000322000
+1_Image_Flash_Entry_Address = 0x00002E5000
 1_Image_ID_Name = 1
 
 
diff --git a/tools/verify_ota_ready_baseline.py b/tools/verify_ota_ready_baseline.py
index 208bf32..401000e 100644
--- a/tools/verify_ota_ready_baseline.py
+++ b/tools/verify_ota_ready_baseline.py
@@ -24,6 +24,7 @@ GNSS_BOOT_IMAGE = ROOT / "ql-config/config/EG800AKCN_11LG/gnss_boot.pkg"
 GNSS_FIRM_IMAGE = ROOT / "ql-config/config/EG800AKCN_11LG/gnss_firm.pkg"
 KERNEL_FLAGS = ROOT / "ql-kernel/threadx/config/common/default_dflags_1602.mk"
 FOTA_HEADER = ROOT / "ql-application/threadx/common/include/ql_fota.h"
+FBF_CONFIG = ROOT / "ql-bootloader/updater/tool/config"
 BASELINE_HEADER = ROOT / "ql-application/threadx/interface/custom_app/inc/ota_baseline.h"
 BUILD_MACRO = ROOT / "ql-application/threadx/interface/custom_app/lib/hal/build_macro.h"
 APP_MAKEFILE = ROOT / "ql-application/threadx/interface/custom_app/Makefile"
@@ -166,6 +167,22 @@ def verify_fota_contract() -> None:
     ):
         if symbol not in api:
             fail(f"SDK FULLOTA2 API {symbol} is missing")
+
+    fbf_config = FBF_CONFIG.read_text(encoding="utf-8", errors="replace")
+    fbf_image_path = re.search(r"(?m)^1_Image_Path\s*=\s*(\S+)\s*$", fbf_config)
+    fbf_entry = re.search(
+        r"(?m)^1_Image_Flash_Entry_Address\s*=\s*(0x[0-9A-Fa-f]+)\s*$",
+        fbf_config,
+    )
+    if not fbf_image_path or fbf_image_path.group(1) != "customer_app.bin":
+        fail("FBF config does not package customer_app.bin")
+    if not fbf_entry or int(fbf_entry.group(1), 16) != EXPECTED["app_start"]:
+        actual = fbf_entry.group(1) if fbf_entry else "missing"
+        fail(
+            f"FBF target address is {actual}; expected "
+            f"0x{EXPECTED['app_start']:08X}"
+        )
+
     identity = BASELINE_HEADER.read_text(encoding="utf-8")
     if "eg800akcn_11lg-hxgnss-fs576-app2e5000" not in identity:
         fail("application layout identity is missing")