diff --git a/BUILDING.md b/BUILDING.md
index 2c948e2b..755046bd 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -48,8 +48,8 @@ If you use [direnv](https://direnv.net/), the environment loads automatically wh
 BlueSCSI uses a forked Pico SDK with Ultra hardware support. Clone it with submodules:
 
 ```bash
-git clone --recurse-submodules https://github.com/bluescsi/pico-sdk-internal.git -b v2.2.0-UltraSupport-rel2
-git clone --recurse-submodules https://github.com/raspberrypi/pico-extras.git -b sdk-2.2.0
+git clone --recurse-submodules https://github.com/bluescsi/pico-sdk-internal.git -b v2.3.0-bluescsi
+git clone --recurse-submodules https://github.com/raspberrypi/pico-extras.git -b sdk-2.3.0
 ```
 
 Set the environment variables:
diff --git a/flake.lock b/flake.lock
index 25b0fc53..fb043dc3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777578337,
-        "narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
+        "lastModified": 1784007870,
+        "narHash": "sha256-djcLt/JJphyNt4eDY9XTly+/WbCK5lqWq9lSgCmJkkQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
+        "rev": "18b9261cb3294b6d2a06d03f96872827b8fe2698",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index e80f67bf..a6d41216 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,23 +17,43 @@
           pico-sdk = pkgs.fetchFromGitHub {
             owner = "bluescsi";
             repo = "pico-sdk-internal";
-            rev = "v2.2.0-UltraSupport-rel2";
+            rev = "4458968e999258eb527a883ffbc4f184a90a8261"; # v2.3.0-bluescsi
             fetchSubmodules = true;
-            hash = "sha256-Rx+MyFQSHJuIAjClaNXGXt+vhcl0aPP5XGZkzMxLkro=";
+            hash = "sha256-SexHT0NOhnMSaKPDgudOxl1UciGQPLni+dDJpgRVJcg=";
           };
 
           pico-extras = pkgs.fetchFromGitHub {
             owner = "raspberrypi";
             repo = "pico-extras";
-            rev = "sdk-2.2.0";
+            rev = "sdk-2.3.0";
             fetchSubmodules = true;
-            hash = "sha256-AfMycI+CMl76OERyRN8xQer7erh0wxpJnD4fu/Sl18c=";
+            hash = "sha256-CkxLqfe8uqzz8H8mlY5UQbXJczydGpEyuUyRN/UhoUU=";
           };
+
+          # tmp till merge in nixpkgs
+          picotool = pkgs.picotool.overrideAttrs (old: {
+            version = "2.3.0";
+            src = pkgs.fetchFromGitHub {
+              owner = "raspberrypi";
+              repo = "picotool";
+              rev = "2.3.0";
+              hash = "sha256-w9kVCdwevEjc12NNZWztehp6SSgsd9ehSaxqc9sg4O4=";
+            };
+            # Our SDK fetch includes the mbedtls submodule, so nixpkgs'
+            # mbedtls source substitution is unnecessary.
+            postPatch = "";
+            cmakeFlags = [ "-DPICO_SDK_PATH=${pico-sdk}" ];
+          });
+
+          pioasm = pkgs.pioasm.overrideAttrs (old: {
+            version = "2.3.0";
+            src = pico-sdk;
+          });
         in
         {
           default = pkgs.mkShell {
             packages = with pkgs; [
-              gcc-arm-embedded-14
+              gcc-arm-embedded-15
               cmake
               python3
               picotool