diff --git a/.github/scripts/test_sysupgrade.sh b/.github/scripts/test_sysupgrade.sh
index 39fbf5db4..147f31f52 100755
--- a/.github/scripts/test_sysupgrade.sh
+++ b/.github/scripts/test_sysupgrade.sh
@@ -2194,8 +2194,9 @@ reset_env; ubi_setup ubifs-kvol
 STUB_PIVOT_RC=0
 run -z --kernel="$UFIT" --rootfs="$UFS"
 if [ "$RC" -ne 0 ] && printf '%s' "$OUT" | grep -q "retired NAND layout with a separate kernel volume" &&
+    printf '%s' "$OUT" | grep -q "ipctool nand-migrate" &&
     nothing_ubi && ! handed_off && ! rebooted; then
-    ok "ubifs-kvol: refused before anything is touched, reinstall link given"
+    ok "ubifs-kvol: refused before anything is touched, nand-migrate and reinstall link given"
 else
     bad "ubifs-kvol must be refused, rc=$RC log='$(cat "$SB/tmp/flash.log")' out='$OUT'"
 fi
@@ -2728,7 +2729,9 @@ default_url_is "$F/openipc.ssc338q-nor-ultimate.tgz" ubi_setup ubiblock
 reset_env; UBLOCK_SOC=gk7205v500 ubi_setup ubiblock
 STUB_PIVOT_RC=0
 run -z --kernel="$UK" --rootfs="$US"
+# nand-migrate needs a FIT U-Boot, which a ubiblock camera does not have
 if [ "$RC" -ne 0 ] && printf '%s' "$OUT" | grep -q "retired NAND layout with a separate kernel volume" &&
+    ! printf '%s' "$OUT" | grep -q "nand-migrate" &&
     nothing_ubi && ! handed_off && ! rebooted; then
     ok "ubiblock on gk7205v500: refused before anything is touched, reinstall link given"
 else
diff --git a/general/overlay/usr/sbin/sysupgrade b/general/overlay/usr/sbin/sysupgrade
index 1b9912222..995fd9161 100755
--- a/general/overlay/usr/sbin/sysupgrade
+++ b/general/overlay/usr/sbin/sysupgrade
@@ -1,6 +1,6 @@
 #!/bin/sh
 # OpenIPC.org | 2025
-scr_version=1.0.71
+scr_version=1.0.72
 
 args="$@"
 LOCK_FILE=/tmp/sysupgrade.lock
@@ -2958,8 +2958,17 @@ fi
 # that moved to the kernel-in-rootfs one: current images for them carry the
 # kernel inside the UBIFS rootfs and size the volumes to it. ubiblock stays
 # for the rest (nand_layout_moved).
+#
+# The first FIT layout (ubifs-kvol) can move over in place: its U-Boot is a
+# FIT NAND build, which loads a kernel from UBIFS, so `ipctool nand-migrate`
+# rewrites the rootfs, switches bootcmd and drops the kernel volume, with no
+# serial console (OpenIPC/ipctool#243). A ubiblock camera's U-Boot predates
+# FIT; that one is reinstalled from U-Boot.
+if { [ "1" = "$update_kernel" ] || [ "1" = "$update_rootfs" ]; } && [ "$ubi_layout" = "ubifs-kvol" ]; then
+	die "This camera uses the retired NAND layout with a separate kernel volume; current images carry the kernel inside the rootfs. Move it over without a serial console: copy rootfs.ubifs.* from its -nand- package to /tmp and run 'ipctool nand-migrate /tmp/rootfs.ubifs.<soc>' (it keeps U-Boot and the settings, and reboots), or reinstall it from U-Boot: https://openipc.org/cameras/vendors/$vendor/socs/$model -- nothing was written."
+fi
 if { [ "1" = "$update_kernel" ] || [ "1" = "$update_rootfs" ]; } &&
-	{ [ "$ubi_layout" = "ubifs-kvol" ] || { [ "$ubi_layout" = "ubiblock" ] && nand_layout_moved; }; }; then
+	[ "$ubi_layout" = "ubiblock" ] && nand_layout_moved; then
 	die "This camera uses the retired NAND layout with a separate kernel volume; current images carry the kernel inside the rootfs. Reinstall it from U-Boot with the current NAND instructions: https://openipc.org/cameras/vendors/$vendor/socs/$model -- nothing was written."
 fi
 # On the ubifs layout the kernel is a file in the rootfs: there is no kernel