diff --git a/firmware-2712/latest/pieeprom-2026-01-21.bin b/firmware-2712/latest/pieeprom-2026-01-21.bin
new file mode 100644
index 00000000..9841c1f8
Binary files /dev/null and b/firmware-2712/latest/pieeprom-2026-01-21.bin differ
diff --git a/firmware-2712/latest/recovery.bin b/firmware-2712/latest/recovery.bin
index e12a3fff..a1c11aa9 100644
Binary files a/firmware-2712/latest/recovery.bin and b/firmware-2712/latest/recovery.bin differ
diff --git a/firmware-2712/release-notes.md b/firmware-2712/release-notes.md
index 399e99ab..0d6208ed 100644
--- a/firmware-2712/release-notes.md
+++ b/firmware-2712/release-notes.md
@@ -1,5 +1,11 @@
 # Raspberry Pi5 bootloader EEPROM release notes
 
+## 2026-01-21: rpi-fw-crypto: Fix bad hmac arguments lock-up (latest)
+
+* rpi-fw-crypto: Fix bad hmac arguments lock-up
+  Improve argument validation so that a bad key-id or invalid private key
+  can no longer cause a lock-up during HMAC operations.
+
 ## 2026-01-16: Assume eMMC for CM4/CM5 non-lite (latest)
 
 * Assume eMMC for CM4/CM5 non-lite