diff --git a/build/debian/release.sh b/build/debian/release.sh
index 437f9c8..8f89e21 100755
--- a/build/debian/release.sh
+++ b/build/debian/release.sh
@@ -83,7 +83,7 @@
 	local image=$(get_image_path ${arch} ${build_id})
 
 	local tag=${tag:-${build_id}}
-	local serving_url=/android/ferrochrome/${arch}/${tag}/${image_filename}
+	local serving_url=/android/ferrochrome/${tag}/${arch}/${image_filename}
 	echo "Releasing ${image} to ${serving_url}"
 
 	local request='payload : { url_path: '"\"${serving_url}\""' source_path : '"\"${image}\""' }'
diff --git a/guest/pvmfw/src/entry.rs b/guest/pvmfw/src/entry.rs
index 2f0b391..34539d2 100644
--- a/guest/pvmfw/src/entry.rs
+++ b/guest/pvmfw/src/entry.rs
@@ -81,7 +81,9 @@
     // - can't access MMIO (except the console, already configured by vmbase)
 
     match main_wrapper(fdt_address as usize, payload_start as usize, payload_size as usize) {
-        Ok((entry, bcc)) => jump_to_payload(fdt_address, entry.try_into().unwrap(), bcc),
+        Ok((entry, bcc, keep_uart)) => {
+            jump_to_payload(fdt_address, entry.try_into().unwrap(), bcc, keep_uart)
+        }
         Err(e) => {
             const REBOOT_REASON_CONSOLE: usize = 1;
             console_writeln!(REBOOT_REASON_CONSOLE, "{}", e.as_avf_reboot_string());
@@ -100,7 +102,7 @@
     fdt: usize,
     payload: usize,
     payload_size: usize,
-) -> Result<(usize, Range<usize>), RebootReason> {
+) -> Result<(usize, Range<usize>, bool), RebootReason> {
     // Limitations in this function:
     // - only access MMIO once (and while) it has been mapped and configured
     // - only perform logging once the logger has been initialized
@@ -136,6 +138,8 @@
         config_entries.bcc,
         config_entries.debug_policy,
     )?;
+    // Keep UART MMIO_GUARD-ed for debuggable payloads, to enable earlycon.
+    let keep_uart = cfg!(debuggable_vms_improvements) && debuggable_payload;
 
     // Writable-dirty regions will be flushed when MemoryTracker is dropped.
     config_entries.bcc.zeroize();
@@ -147,21 +151,16 @@
     // Call unshare_all_memory here (instead of relying on the dtor) while UART is still mapped.
     unshare_all_memory();
 
-    if cfg!(debuggable_vms_improvements) && debuggable_payload {
-        // Keep UART MMIO_GUARD-ed for debuggable payloads, to enable earlycon.
-    } else {
-        unshare_uart().map_err(|e| {
-            error!("Failed to unshare the UART: {e}");
-            RebootReason::InternalError
-        })?;
+    Ok((slices.kernel.as_ptr() as usize, next_bcc, keep_uart))
+}
+
+fn jump_to_payload(fdt_address: u64, payload_start: u64, bcc: Range<usize>, keep_uart: bool) -> ! {
+    if !keep_uart {
+        unshare_uart().unwrap();
     }
 
     deactivate_dynamic_page_tables();
 
-    Ok((slices.kernel.as_ptr() as usize, next_bcc))
-}
-
-fn jump_to_payload(fdt_address: u64, payload_start: u64, bcc: Range<usize>) -> ! {
     const ASM_STP_ALIGN: usize = size_of::<u64>() * 2;
     const SCTLR_EL1_RES1: u64 = (0b11 << 28) | (0b101 << 20) | (0b1 << 11);
     // Stage 1 instruction access cacheability is unaffected.
diff --git a/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java b/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java
index 3116cc5..296604b 100644
--- a/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java
+++ b/tests/pvmfw/java/com/android/pvmfw/test/CustomPvmfwHostTestCaseBase.java
@@ -52,6 +52,7 @@
     public static final String VM_REFERENCE_DT_PATH = "/data/local/tmp/pvmfw/reference_dt.dtb";
 
     @NonNull public static final String MICRODROID_LOG_PATH = TEST_ROOT + "log.txt";
+    @NonNull public static final String MICRODROID_CONSOLE_PATH = TEST_ROOT + "console.txt";
     public static final int BOOT_COMPLETE_TIMEOUT_MS = 30000; // 30 seconds
     public static final int BOOT_FAILURE_WAIT_TIME_MS = 10000; // 10 seconds
     public static final int CONSOLE_OUTPUT_WAIT_MS = 5000; // 5 seconds
diff --git a/tests/pvmfw/java/com/android/pvmfw/test/DebugPolicyHostTests.java b/tests/pvmfw/java/com/android/pvmfw/test/DebugPolicyHostTests.java
index 7efbbc7..6a28d5e 100644
--- a/tests/pvmfw/java/com/android/pvmfw/test/DebugPolicyHostTests.java
+++ b/tests/pvmfw/java/com/android/pvmfw/test/DebugPolicyHostTests.java
@@ -248,6 +248,8 @@
                         "run-app",
                         "--log",
                         MICRODROID_LOG_PATH,
+                        "--console",
+                        MICRODROID_CONSOLE_PATH,
                         "--protected",
                         getPathForPackage(PACKAGE_NAME),
                         TEST_ROOT + "idsig",