diff --git a/stage1/jump_app.c b/stage1/jump_app.c
index 8fa87e8..fe8b3e2 100644
--- a/stage1/jump_app.c
+++ b/stage1/jump_app.c
@@ -31,6 +31,16 @@ int eboot_jump_to_app(eos_bootctl_t *bctl, eos_slot_t slot)
     if (rc != EOS_OK)
         return rc;
 
+    /* Defense-in-depth: ensure the image fits within the actual slot
+     * before any integrity verification can stream payload bytes. */
+    uint32_t slot_size = eos_hal_slot_size(slot);
+    if (slot_size == 0 ||
+        hdr.hdr_size > slot_size ||
+        hdr.image_size > slot_size - hdr.hdr_size) {
+        eos_boot_log_append(EOS_LOG_IMAGE_INVALID, slot, EOS_ERR_INVALID);
+        return EOS_ERR_INVALID;
+    }
+
     /* Verify image integrity before jumping */
     /* eos_image_verify_integrity() adds hdr_size internally — pass base addr only */
     rc = eos_image_verify_integrity(&hdr, addr);