diff --git a/Dockerfile.openpilot_base b/Dockerfile.openpilot_base
index 51fe3727..ff947e57 100644
--- a/Dockerfile.openpilot_base
+++ b/Dockerfile.openpilot_base
@@ -14,6 +14,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     cppcheck \
     curl \
     ffmpeg \
+    gcc-arm-none-eabi \
     git \
     iputils-ping \
     libarchive-dev \
diff --git a/SConstruct b/SConstruct
index ce02f508..3dd8e986 100644
--- a/SConstruct
+++ b/SConstruct
@@ -357,6 +357,7 @@ Export('common', 'gpucommon', 'visionipc')
 # Build openpilot
 
 SConscript(['cereal/SConscript'])
+SConscript(['panda/board/SConscript'])
 SConscript(['opendbc/can/SConscript'])
 
 SConscript(['phonelibs/SConscript'])
diff --git a/panda b/panda
index d572c012..a8917adc 160000
--- a/panda
+++ b/panda
@@ -1 +1 @@
-Subproject commit d572c012cb9f3f421d1556b37a1d3f18b5366b06
+Subproject commit a8917adcdf5b122ffd04f3734de9e0339531f181
diff --git a/release/build_devel.sh b/release/build_devel.sh
index 50810b8a..262814f0 100755
--- a/release/build_devel.sh
+++ b/release/build_devel.sh
@@ -64,16 +64,6 @@ git commit -a -m "openpilot v$VERSION release"
 # Run build
 SCONS_CACHE=1 scons -j3
 
-echo "[-] testing panda build T=$SECONDS"
-pushd panda/board/
-make bin
-popd
-
-echo "[-] testing pedal build T=$SECONDS"
-pushd panda/board/pedal
-make obj/comma.bin
-popd
-
 if [ ! -z "$CI_PUSH" ]; then
   echo "[-] Pushing to $CI_PUSH T=$SECONDS"
   git remote set-url origin git@github.com:commaai/openpilot.git
diff --git a/release/build_release2.sh b/release/build_release2.sh
index add9de6e..f8555767 100755
--- a/release/build_release2.sh
+++ b/release/build_release2.sh
@@ -41,13 +41,9 @@ echo "#define COMMA_VERSION \"$VERSION-release\"" > selfdrive/common/version.h
 git commit -m "openpilot v$VERSION"
 
 # Build signed panda firmware
-pushd panda/board/
-cp -r /tmp/pandaextra /data/openpilot/
-RELEASE=1 make obj/panda.bin
-mv obj/panda.bin /tmp/panda.bin
-make clean
-mv /tmp/panda.bin obj/panda.bin.signed
-rm -rf /data/openpilot/pandaextra
+pushd panda/
+CERT=/tmp/pandaextra/certs/release RELEASE=1 scons
+mv board/obj/panda.bin.signed /tmp/panda.bin.signed
 popd
 
 # Build stuff
@@ -65,8 +61,13 @@ find . -name '*.o' -delete
 find . -name '*.os' -delete
 find . -name '*.pyc' -delete
 find . -name '__pycache__' -delete
+rm -rf panda/board panda/certs panda/crypto
 rm -rf .sconsign.dblite Jenkinsfile release/
 
+# Move back signed panda fw
+mkdir -p panda/board/obj
+mv /tmp/panda.bin.signed panda/board/obj/panda.bin.signed
+
 # Restore phonelibs
 git checkout phonelibs/
 
diff --git a/release/build_release3.sh b/release/build_release3.sh
index 3df9f8f2..4c72eff4 100755
--- a/release/build_release3.sh
+++ b/release/build_release3.sh
@@ -58,11 +58,9 @@ git status
 git commit -a -m "openpilot v$VERSION release"
 
 # Build panda firmware
-pushd panda/board/
-make obj/panda.bin
-mv obj/panda.bin /tmp/panda.bin
-make clean
-mv /tmp/panda.bin obj/panda.bin
+pushd panda/
+scons
+mv board/obj/panda.bin.signed /tmp/panda.bin.signed
 popd
 
 # Build
@@ -79,8 +77,13 @@ find . -name '*.o' -delete
 find . -name '*.os' -delete
 find . -name '*.pyc' -delete
 find . -name '__pycache__' -delete
+rm -rf panda/board panda/certs panda/crypto
 rm -rf .sconsign.dblite Jenkinsfile release/ apk/
 
+# Move back signed panda fw
+mkdir -p panda/board/obj
+mv /tmp/panda.bin.signed panda/board/obj/panda.bin.signed
+
 # Restore phonelibs
 git checkout phonelibs/
 
diff --git a/release/files_common b/release/files_common
index 9afacded..d4f3e0cb 100644
--- a/release/files_common
+++ b/release/files_common
@@ -513,7 +513,6 @@ panda/__init__.py
 panda/VERSION
 panda/board/**
 panda/certs/**
-panda/common/**
 panda/crypto/**
 panda/python/**
 
diff --git a/selfdrive/manager/test/test_manager.py b/selfdrive/manager/test/test_manager.py
index 71154277..e19311f0 100644
--- a/selfdrive/manager/test/test_manager.py
+++ b/selfdrive/manager/test/test_manager.py
@@ -13,7 +13,7 @@ os.environ['FAKEUPLOAD'] = "1"
 
 # TODO: make eon fast
 MAX_STARTUP_TIME = 30 if EON else 15
-ALL_PROCESSES = [p.name for p in managed_processes.values() if type(p) is not DaemonProcess]
+ALL_PROCESSES = [p.name for p in managed_processes.values() if (type(p) is not DaemonProcess) and (p.name not in ['updated', 'pandad'])]
 
 
 class TestManager(unittest.TestCase):
@@ -42,7 +42,7 @@ class TestManager(unittest.TestCase):
     for p in ALL_PROCESSES:
       managed_processes[p].start()
 
-    time.sleep(10)
+    time.sleep(30)
 
     for p in reversed(ALL_PROCESSES):
       exit_code = managed_processes[p].stop(retry=False)
diff --git a/selfdrive/pandad.py b/selfdrive/pandad.py
index b0d2cf73..d4cc9847 100755
--- a/selfdrive/pandad.py
+++ b/selfdrive/pandad.py
@@ -3,13 +3,16 @@
 import os
 import time
 
-from panda import BASEDIR as PANDA_BASEDIR, Panda, PandaDFU, build_st
+from panda import BASEDIR as PANDA_BASEDIR, Panda, PandaDFU
 from common.basedir import BASEDIR
 from common.gpio import gpio_init, gpio_set
 from selfdrive.hardware import TICI
 from selfdrive.hardware.tici.pins import GPIO_HUB_RST_N, GPIO_STM_BOOT0, GPIO_STM_RST_N
 from selfdrive.swaglog import cloudlog
 
+PANDA_FW_FN = os.path.join(PANDA_BASEDIR, "board", "obj", "panda.bin.signed")
+
+
 def set_panda_power(power=True):
   if not TICI:
     return
@@ -25,24 +28,9 @@ def set_panda_power(power=True):
   gpio_set(GPIO_STM_RST_N, not power)
 
 
-def get_firmware_fn():
-  signed_fn = os.path.join(PANDA_BASEDIR, "board", "obj", "panda.bin.signed")
-  if os.path.exists(signed_fn):
-    cloudlog.info("Using prebuilt signed firmware")
-    return signed_fn
-  else:
-    cloudlog.info("Building panda firmware")
-    fn = "obj/panda.bin"
-    build_st(fn, clean=False)
-    return os.path.join(PANDA_BASEDIR, "board", fn)
-
-
-def get_expected_signature(fw_fn=None):
-  if fw_fn is None:
-    fw_fn = get_firmware_fn()
-
+def get_expected_signature():
   try:
-    return Panda.get_signature_from_firmware(fw_fn)
+    return Panda.get_signature_from_firmware(PANDA_FW_FN)
   except Exception:
     cloudlog.exception("Error computing expected signature")
     return b""
@@ -71,8 +59,7 @@ def update_panda():
 
     time.sleep(1)
 
-  fw_fn = get_firmware_fn()
-  fw_signature = get_expected_signature(fw_fn)
+  fw_signature = get_expected_signature()
 
   try:
     serial = panda.get_serial()[0].decode("utf-8")
@@ -90,7 +77,7 @@ def update_panda():
 
   if panda.bootstub or panda_signature != fw_signature:
     cloudlog.info("Panda firmware out of date, update required")
-    panda.flash(fw_fn)
+    panda.flash()
     cloudlog.info("Done flashing")
 
   if panda.bootstub:
@@ -111,6 +98,7 @@ def update_panda():
   cloudlog.info("Resetting panda")
   panda.reset()
 
+
 def main():
   set_panda_power()
   update_panda()
diff --git a/tools/mac_setup.sh b/tools/mac_setup.sh
index fe6988dd..99ac11e8 100755
--- a/tools/mac_setup.sh
+++ b/tools/mac_setup.sh
@@ -20,6 +20,7 @@ brew "openssl"
 brew "pyenv"
 brew "qt@5"
 brew "zeromq"
+cask "gcc-arm-embedded"
 EOS
 
 if [[ $SHELL == "/bin/zsh" ]]; then