diff --git a/src/Controller/DeviceImageController.php b/src/Controller/DeviceImageController.php
index 426a3ad..819b6e5 100644
--- a/src/Controller/DeviceImageController.php
+++ b/src/Controller/DeviceImageController.php
@@ -158,10 +158,17 @@ class DeviceImageController extends AbstractController
             'bytes'       => filesize($binPath),
         ]);
 
+        // SHA-256 of the .bin lets the device verify integrity end-to-end:
+        // anything that gets corrupted between Imagick's render and the
+        // ESP32 framebuffer (TCP edge cases, memory glitch, partial flush)
+        // is caught before we commit the bytes to NVS or paint the panel.
+        // The ESP32-S3 has hardware SHA so the verification is essentially
+        // free on the device side.
         $response = new BinaryFileResponse($binPath);
-        $response->headers->set('Content-Type',  'application/octet-stream');
-        $response->headers->set('X-Image-Id',    (string) $image->getId());
-        $response->headers->set('X-Interval-Ms', (string) $intervalMs);
+        $response->headers->set('Content-Type',   'application/octet-stream');
+        $response->headers->set('X-Image-Id',     (string) $image->getId());
+        $response->headers->set('X-Image-Sha256', hash_file('sha256', $binPath));
+        $response->headers->set('X-Interval-Ms',  (string) $intervalMs);
 
         return $response;
     }