diff --git a/bootloader/rk27xx.c b/bootloader/rk27xx.c
index 4f04bebfc8..db4fd675ac 100644
--- a/bootloader/rk27xx.c
+++ b/bootloader/rk27xx.c
@@ -139,6 +139,14 @@ void main(void)
     if (DEV_INFO & (1<<20))
         boot = of;
 
+    /* The OF asks for a mode before it resets itself, e.g. at the end of
+     * a firmware update, and the cell survives the reset. Rockbox never
+     * sets it, so after a cold start it reads 0: anything else is a
+     * request from the OF, which expects to come back up.
+     */
+    if (GPIO1_BOOTMODE & 0xff)
+        boot = of;
+
     lcd_clear_display();
 
     ret = storage_init();
diff --git a/firmware/export/rk27xx.h b/firmware/export/rk27xx.h
index 4579a8914e..5ec71f3f8c 100644
--- a/firmware/export/rk27xx.h
+++ b/firmware/export/rk27xx.h
@@ -429,6 +429,8 @@
 #define GPIO_PECON             (*(volatile unsigned long *)(APB0_GPIO1 + 0x04))
 #define GPIO_PFDR              (*(volatile unsigned long *)(APB0_GPIO1 + 0x08))
 #define GPIO_PFCON             (*(volatile unsigned long *)(APB0_GPIO1 + 0x0C))
+/* undocumented, kept over a reset: the OF leaves its boot request here */
+#define GPIO1_BOOTMODE         (*(volatile unsigned long *)(APB0_GPIO1 + 0x1C))
 
 #define GPIO1_TEST             (*(volatile unsigned long *)(APB0_GPIO1 + 0x20))
 #define GPIO_IEE               (*(volatile unsigned long *)(APB0_GPIO1 + 0x24))