diff --git a/qemu/saimaa.c b/qemu/saimaa.c
index 00db593..364c76f 100644
--- a/qemu/saimaa.c
+++ b/qemu/saimaa.c
@@ -753,15 +753,17 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x08006B8D;
                 cpu_physical_memory_write(0x080528D0, &v, 4);
             }
-            /* PBL dispatcher-table fabrication (b33): retarget literal
-             * [0x80164F0] (image: hash blob!) to scratch struct at
-             * 0x08600200 with [0x18]=2 (ready -> dispatch). */
+            /* PBL dispatcher-table fabrication (b33, moved b37): retarget
+             * literal [0x80164F0] (image: hash blob!) to scratch struct
+             * at 0x08024000 (OCIMEM, out of stack-march paths!) with
+             * [0x18]=2 (ready -> dispatch). Was IMEM 0x08600200
+             * (self-executed when sp marched there!). */
             {
-                uint32_t v = 0x08600200;
-                cpu_physical_memory_write(0x08600200, &v, 4);
+                uint32_t v = 0x08024000;
+                cpu_physical_memory_write(0x08024000, &v, 4);
                 v = 0x00000002;
-                cpu_physical_memory_write(0x08600214, &v, 4);
-                v = 0x08600200;
+                cpu_physical_memory_write(0x08024014, &v, 4);
+                v = 0x08024000;
                 cpu_physical_memory_write(0x080164F0, &v, 4);
             }
             /* HW-ready bits (b25/b26): [0x073A100] bits 0,1,2 (SBL
diff --git a/tools/sbl_uni.py b/tools/sbl_uni.py
index 46f2b0d..1ae691c 100644
--- a/tools/sbl_uni.py
+++ b/tools/sbl_uni.py
@@ -442,11 +442,11 @@ def main():
     W32(0x080528D0, STUBV)
     # PBL dispatcher-table fabrication (b33): [0x80164F0] (literal pool,
     # image default points at hash blob!) retargeted to scratch struct
-    # at 0x08600200 with [0x18]=2 (ready-flag -> world-switch dispatch;
-    # TZ deferred via OCIMEM stub). IMEM scratch (below SBL IMEM stack).
-    W32(0x08600200, 0x08600200)
-    W32(0x08600214, 0x00000002)
-    W32(0x080164F0, 0x08600200)
+    # at 0x08024000 (OCIMEM, out of stack-march paths!) with [0x18]=2
+    # (ready-flag -> world-switch dispatch; TZ deferred via OCIMEM stub).
+    W32(0x08024000, 0x08024000)
+    W32(0x08024014, 0x00000002)
+    W32(0x080164F0, 0x08024000)
     # HW-ready bit fabrication (b25): [0x073A100] bits 0,1,2 = peripheral
     # status done-bits (poll#1 checks bit2 (lsls#29), poll#2 bit1 (lsls#30),
     # post-poll gate bit0 (lsls#31)). SBL only reads it, never writes.