diff --git a/local/scripts/test-iommu-qemu.sh b/local/scripts/test-iommu-qemu.sh
index cc663f944f..aea5e6a464 100755
--- a/local/scripts/test-iommu-qemu.sh
+++ b/local/scripts/test-iommu-qemu.sh
@@ -79,12 +79,18 @@ firmware="$(find_uefi_firmware)" || {
 }
 
 arch="${ARCH:-$(uname -m)}"
+iso="build/$arch/$config.iso"
 image="build/$arch/$config/harddrive.img"
 extra="build/$arch/$config/extra.img"
 extra_qemu_args="${filtered_args[*]:-}"
 
-if [[ ! -f "$image" ]]; then
-    echo "ERROR: missing image $image" >&2
+boot_media=""
+if [[ -f "$iso" ]]; then
+    boot_media="iso"
+elif [[ -f "$image" ]]; then
+    boot_media="harddrive"
+else
+    echo "ERROR: no bootable image found ($iso or $image)" >&2
     echo "Build it first with: ./local/scripts/build-redbear.sh $config" >&2
     exit 1
 fi
@@ -93,14 +99,20 @@ if [[ ! -f "$extra" ]]; then
     truncate -s 1g "$extra"
 fi
 
-pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
+if [[ "$boot_media" == "iso" ]]; then
+    boot_args=(-cdrom "$iso")
+else
+    boot_args=(-drive file="$image",format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL)
+fi
+
+pkill -f "qemu-system-x86_64.*$config" 2>/dev/null || true
 sleep 1
 
 if [[ "$check_mode" -eq 1 ]]; then
     expect <<EOF
 log_user 1
 set timeout 240
-spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci -device amd-iommu -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none -drive file=$image,format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -enable-kvm -cpu host $extra_qemu_args
+spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci -device amd-iommu -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none ${boot_args[*]} -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -enable-kvm -cpu host $extra_qemu_args
 expect -re {PCI .*1022:1419}
 expect "login:"
 send "root\r"
diff --git a/local/scripts/test-msix-qemu.sh b/local/scripts/test-msix-qemu.sh
index a93663351d..ab91a24875 100755
--- a/local/scripts/test-msix-qemu.sh
+++ b/local/scripts/test-msix-qemu.sh
@@ -46,6 +46,7 @@ if [[ "$config" == "redbear-mini" ]]; then
   config="redbear-mini"
 fi
 arch="${ARCH:-$(uname -m)}"
+iso="build/$arch/$config.iso"
 image="build/$arch/$config/harddrive.img"
 extra="build/$arch/$config/extra.img"
 log_file="build/$arch/$config/msix-check.log"
@@ -54,8 +55,13 @@ firmware="$(find_uefi_firmware)" || {
     exit 1
 }
 
-if [[ ! -f "$image" ]]; then
-    echo "ERROR: missing image $image" >&2
+boot_media=""
+if [[ -f "$iso" ]]; then
+    boot_media="iso"
+elif [[ -f "$image" ]]; then
+    boot_media="harddrive"
+else
+    echo "ERROR: no bootable image found ($iso or $image)" >&2
     echo "Build it first with: ./local/scripts/build-redbear.sh $config" >&2
     exit 1
 fi
@@ -64,7 +70,13 @@ if [[ ! -f "$extra" ]]; then
     truncate -s 1g "$extra"
 fi
 
-pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
+if [[ "$boot_media" == "iso" ]]; then
+    boot_args=(-cdrom "$iso")
+else
+    boot_args=(-drive file="$image",format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL)
+fi
+
+pkill -f "qemu-system-x86_64.*$config" 2>/dev/null || true
 sleep 1
 
 rm -f "$log_file"
@@ -84,8 +96,7 @@ timeout 90s qemu-system-x86_64 \
   -netdev user,id=net0 \
   -object filter-dump,id=f1,netdev=net0,file="build/$arch/$config/network.pcap" \
   -nographic -vga none \
-  -drive file="$image",format=raw,if=none,id=drv0,snapshot=on \
-  -device nvme,drive=drv0,serial=NVME_SERIAL \
+  "${boot_args[@]}" \
   -drive file="$extra",format=raw,if=none,id=drv1,snapshot=on \
   -device nvme,drive=drv1,serial=NVME_EXTRA \
   -enable-kvm -cpu host \
diff --git a/local/scripts/test-ps2-qemu.sh b/local/scripts/test-ps2-qemu.sh
index 2ed18a89fd..10910008ab 100755
--- a/local/scripts/test-ps2-qemu.sh
+++ b/local/scripts/test-ps2-qemu.sh
@@ -63,12 +63,18 @@ firmware="$(find_uefi_firmware)" || {
 }
 
 arch="${ARCH:-$(uname -m)}"
+iso="build/$arch/$config.iso"
 image="build/$arch/$config/harddrive.img"
 extra="build/$arch/$config/extra.img"
 extra_qemu_args="${filtered_args[*]:-}"
 
-if [[ ! -f "$image" ]]; then
-    echo "ERROR: missing image $image" >&2
+boot_media=""
+if [[ -f "$iso" ]]; then
+    boot_media="iso"
+elif [[ -f "$image" ]]; then
+    boot_media="harddrive"
+else
+    echo "ERROR: no bootable image found ($iso or $image)" >&2
     echo "Build it first with: ./local/scripts/build-redbear.sh $config" >&2
     exit 1
 fi
@@ -77,14 +83,20 @@ if [[ ! -f "$extra" ]]; then
     truncate -s 1g "$extra"
 fi
 
-pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
+if [[ "$boot_media" == "iso" ]]; then
+    boot_args=(-cdrom "$iso")
+else
+    boot_args=(-drive file="$image",format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL)
+fi
+
+pkill -f "qemu-system-x86_64.*$config" 2>/dev/null || true
 sleep 1
 
 if [[ "$check_mode" -eq 1 ]]; then
     expect <<EOF
 log_user 1
 set timeout 240
-spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none -drive file=$image,format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -enable-kvm -cpu host $extra_qemu_args
+spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none ${boot_args[*]} -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -enable-kvm -cpu host $extra_qemu_args
 expect "login:"
 send "root\r"
 expect "assword:"
diff --git a/local/scripts/test-timer-qemu.sh b/local/scripts/test-timer-qemu.sh
index 422d94cedf..3b5cf2725d 100755
--- a/local/scripts/test-timer-qemu.sh
+++ b/local/scripts/test-timer-qemu.sh
@@ -63,12 +63,18 @@ firmware="$(find_uefi_firmware)" || {
 }
 
 arch="${ARCH:-$(uname -m)}"
+iso="build/$arch/$config.iso"
 image="build/$arch/$config/harddrive.img"
 extra="build/$arch/$config/extra.img"
 extra_qemu_args="${filtered_args[*]:-}"
 
-if [[ ! -f "$image" ]]; then
-    echo "ERROR: missing image $image" >&2
+boot_media=""
+if [[ -f "$iso" ]]; then
+    boot_media="iso"
+elif [[ -f "$image" ]]; then
+    boot_media="harddrive"
+else
+    echo "ERROR: no bootable image found ($iso or $image)" >&2
     echo "Build it first with: ./local/scripts/build-redbear.sh $config" >&2
     exit 1
 fi
@@ -77,14 +83,20 @@ if [[ ! -f "$extra" ]]; then
     truncate -s 1g "$extra"
 fi
 
-pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
+if [[ "$boot_media" == "iso" ]]; then
+    boot_args=(-cdrom "$iso")
+else
+    boot_args=(-drive file="$image",format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL)
+fi
+
+pkill -f "qemu-system-x86_64.*$config" 2>/dev/null || true
 sleep 1
 
 if [[ "$check_mode" -eq 1 ]]; then
     expect <<EOF
 log_user 1
 set timeout 240
-spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none -drive file=$image,format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -enable-kvm -cpu host $extra_qemu_args
+spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none ${boot_args[*]} -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -enable-kvm -cpu host $extra_qemu_args
 expect "login:"
 send "root\r"
 expect "assword:"
diff --git a/local/scripts/test-usb-storage-qemu.sh b/local/scripts/test-usb-storage-qemu.sh
index ac6206fa1f..4d4c0d8f8c 100755
--- a/local/scripts/test-usb-storage-qemu.sh
+++ b/local/scripts/test-usb-storage-qemu.sh
@@ -62,6 +62,11 @@ done
 
 config="${1:-redbear-full}"
 arch="${ARCH:-$(uname -m)}"
+# Boot media: prefer the live ISO (canonical build-redbear.sh artifact).
+# harddrive.img is only produced by older make-all flows and goes stale —
+# booting it tests the wrong tree (this happened in practice with a stale
+# bootloader build). extra.img and usb-storage.img stay as data drives.
+iso="build/$arch/$config.iso"
 image="build/$arch/$config/harddrive.img"
 extra="build/$arch/$config/extra.img"
 usb_img="build/$arch/$config/usb-storage.img"
@@ -71,8 +76,13 @@ firmware="$(find_uefi_firmware)" || {
     exit 1
 }
 
-if [[ ! -f "$image" ]]; then
-    echo "ERROR: missing image $image" >&2
+boot_media=""
+if [[ -f "$iso" ]]; then
+    boot_media="iso"
+elif [[ -f "$image" ]]; then
+    boot_media="harddrive"
+else
+    echo "ERROR: no bootable image found ($iso or $image)" >&2
     echo "Build it first with: ./local/scripts/build-redbear.sh $config" >&2
     exit 1
 fi
@@ -85,9 +95,17 @@ if [[ ! -f "$usb_img" ]]; then
     truncate -s 64M "$usb_img"
 fi
 
+# Boot-disk args: ISO via -cdrom, or legacy harddrive via nvme. Data drives
+# (extra, usb-storage) are always attached the same way.
+if [[ "$boot_media" == "iso" ]]; then
+    boot_args=(-cdrom "$iso")
+else
+    boot_args=(-drive file="$image",format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL)
+fi
+
 expected_sector_b64="$(seed_usb_image "$usb_img")"
 
-pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
+pkill -f "qemu-system-x86_64.*$config" 2>/dev/null || true
 sleep 1
 
 rm -f "$log_file"
@@ -95,7 +113,7 @@ expect <<EOF
 log_user 1
 log_file -noappend $log_file
 set timeout 300
-spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci,id=xhci -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none -drive file=$image,format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -drive file=$usb_img,format=raw,if=none,id=usbdisk,snapshot=on -device usb-storage,bus=xhci.0,drive=usbdisk -enable-kvm -cpu host
+spawn qemu-system-x86_64 -name {Red Bear OS x86_64} -device qemu-xhci,id=xhci -smp 4 -m 2048 -bios $firmware -chardev stdio,id=debug,signal=off,mux=on -serial chardev:debug -mon chardev=debug -machine q35 -device ich9-intel-hda -device hda-output -device virtio-net,netdev=net0 -netdev user,id=net0 -object filter-dump,id=f1,netdev=net0,file=build/$arch/$config/network.pcap -nographic -vga none ${boot_args[*]} -drive file=$extra,format=raw,if=none,id=drv1,snapshot=on -device nvme,drive=drv1,serial=NVME_EXTRA -drive file=$usb_img,format=raw,if=none,id=usbdisk,snapshot=on -device usb-storage,bus=xhci.0,drive=usbdisk -enable-kvm -cpu host
 expect "USB SCSI driver spawned"
 expect "DISK CONTENT: $expected_sector_b64"
 expect "login:"
diff --git a/local/scripts/test-xhci-irq-qemu.sh b/local/scripts/test-xhci-irq-qemu.sh
index 6976974f8d..c7f70824ef 100755
--- a/local/scripts/test-xhci-irq-qemu.sh
+++ b/local/scripts/test-xhci-irq-qemu.sh
@@ -59,11 +59,20 @@ firmware="$(find_uefi_firmware)" || {
 }
 
 arch="${ARCH:-$(uname -m)}"
+# Prefer the live ISO (canonical build-redbear.sh artifact); harddrive.img is
+# only produced by older make-all flows and goes stale, which would test the
+# wrong tree. extra.img stays as a data drive in both modes.
+iso="build/$arch/$config.iso"
 image="build/$arch/$config/harddrive.img"
 extra="build/$arch/$config/extra.img"
 
-if [[ ! -f "$image" ]]; then
-    echo "ERROR: missing image $image" >&2
+boot_media=""
+if [[ -f "$iso" ]]; then
+    boot_media="iso"
+elif [[ -f "$image" ]]; then
+    boot_media="harddrive"
+else
+    echo "ERROR: no bootable image found ($iso or $image)" >&2
     echo "Build it first with: ./local/scripts/build-redbear.sh $config" >&2
     exit 1
 fi
@@ -72,7 +81,13 @@ if [[ ! -f "$extra" ]]; then
     truncate -s 1g "$extra"
 fi
 
-pkill -f "qemu-system-x86_64.*$image" 2>/dev/null || true
+if [[ "$boot_media" == "iso" ]]; then
+    boot_args=(-cdrom "$iso")
+else
+    boot_args=(-drive file="$image",format=raw,if=none,id=drv0,snapshot=on -device nvme,drive=drv0,serial=NVME_SERIAL)
+fi
+
+pkill -f "qemu-system-x86_64.*$config" 2>/dev/null || true
 sleep 1
 
 if [[ "$check_mode" -eq 1 ]]; then
@@ -96,8 +111,7 @@ if [[ "$check_mode" -eq 1 ]]; then
       -netdev user,id=net0 \
       -object filter-dump,id=f1,netdev=net0,file="build/$arch/$config/network.pcap" \
       -nographic -vga none \
-      -drive file="$image",format=raw,if=none,id=drv0,snapshot=on \
-      -device nvme,drive=drv0,serial=NVME_SERIAL \
+      "${boot_args[@]}" \
       -drive file="$extra",format=raw,if=none,id=drv1,snapshot=on \
       -device nvme,drive=drv1,serial=NVME_EXTRA \
       -enable-kvm -cpu host \
@@ -175,8 +189,7 @@ exec qemu-system-x86_64 \
   -netdev user,id=net0 \
   -object filter-dump,id=f1,netdev=net0,file="build/$arch/$config/network.pcap" \
   -vga std \
-  -drive file="$image",format=raw,if=none,id=drv0,snapshot=on \
-  -device nvme,drive=drv0,serial=NVME_SERIAL \
+  "${boot_args[@]}" \
   -drive file="$extra",format=raw,if=none,id=drv1,snapshot=on \
   -device nvme,drive=drv1,serial=NVME_EXTRA \
   -enable-kvm -cpu host