diff --git a/.github/workflows/firmware-ci.yml b/.github/workflows/firmware-ci.yml
index 21ec9cfc..29407ee7 100644
--- a/.github/workflows/firmware-ci.yml
+++ b/.github/workflows/firmware-ci.yml
@@ -15,7 +15,7 @@ jobs:
     name: Build ESP32-S3 Firmware
     runs-on: ubuntu-latest
     container:
-      image: espressif/idf:v5.2
+      image: espressif/idf:v5.4
 
     steps:
       - uses: actions/checkout@v4
@@ -54,9 +54,10 @@ jobs:
           fi
 
           # Check partition table magic (0xAA50 at offset 0).
+          # Use od instead of xxd (xxd not available in espressif/idf container).
           PT=build/partition_table/partition-table.bin
           if [ -f "$PT" ]; then
-            MAGIC=$(xxd -l2 -p "$PT")
+            MAGIC=$(od -A n -t x1 -N 2 "$PT" | tr -d ' ')
             if [ "$MAGIC" != "aa50" ]; then
               echo "::warning::Partition table magic mismatch: $MAGIC (expected aa50)"
               ERRORS=$((ERRORS + 1))
@@ -71,7 +72,7 @@ jobs:
           fi
 
           # Verify non-zero data in binary (not all 0xFF padding).
-          NONZERO=$(xxd -l 1024 -p "$BIN" | tr -d 'f' | wc -c)
+          NONZERO=$(od -A n -t x1 -N 1024 "$BIN" | tr -d ' f\n' | wc -c)
           if [ "$NONZERO" -lt 100 ]; then
             echo "::error::Binary appears to be mostly padding (non-zero chars: $NONZERO)"
             ERRORS=$((ERRORS + 1))
@@ -97,4 +98,5 @@ jobs:
             firmware/esp32-csi-node/build/esp32-csi-node.bin
             firmware/esp32-csi-node/build/bootloader/bootloader.bin
             firmware/esp32-csi-node/build/partition_table/partition-table.bin
-          retention-days: 30
+            firmware/esp32-csi-node/build/ota_data_initial.bin
+          retention-days: 90