diff --git a/platforms/bancha/cantrip_builtins.mk b/platforms/bancha/cantrip_builtins.mk
index f85e941..40b8afa 100644
--- a/platforms/bancha/cantrip_builtins.mk
+++ b/platforms/bancha/cantrip_builtins.mk
@@ -15,7 +15,13 @@
 # Placeholder until the top-level cantrip_builtins.mk is cleaned up.
 
 CANTRIP_APPS_RELEASE  :=
+# Builtins are loaded from SPI flash which is 16M by default
+ifneq ("$(wildcard $(ROOTDIR)/ml/ml-models)", "")
+CANTRIP_MODEL_RELEASE := $(OUT)/kelvin/sw/bazel_out/soundstream_encoder_non_streaming.elf
+else
+# TODO(sleffler): fallback to IREE version
 CANTRIP_MODEL_RELEASE :=
+endif
 
 CANTRIP_APPS_DEBUG    :=
 CANTRIP_MODEL_DEBUG   :=
diff --git a/platforms/bancha/platform.mk b/platforms/bancha/platform.mk
index 8eac493..1b98b32 100644
--- a/platforms/bancha/platform.mk
+++ b/platforms/bancha/platform.mk
@@ -61,14 +61,23 @@
 # Matcha hw config #defines generated from RTL
 
 I2S_HEADER=$(OPENTITAN_GEN_DIR)/i2s_regs.h
+FLASH_CTRL_HEADER=$(OPENTITAN_GEN_DIR)/flash_ctrl_regs.h
 ML_TOP_HEADER=$(OPENTITAN_GEN_DIR)/ml_top_regs.h
+OTP_CTRL_HEADER=$(OPENTITAN_GEN_DIR)/otp_ctrl_regs.h
+SPI_HOST_HEADER=$(OPENTITAN_GEN_DIR)/spi_host_regs.h
 TLUL_MAILBOX_HEADER=$(OPENTITAN_GEN_DIR)/tlul_mailbox_regs.h
 UART_HEADER=$(OPENTITAN_GEN_DIR)/uart_regs.h
 
 $(I2S_HEADER): $(REGTOOL) $(I2S_HJSON) | $(OPENTITAN_GEN_DIR)
 	$(REGTOOL) -D -o $@ $(I2S_HJSON)
+$(FLASH_CTRL_HEADER): $(REGTOOL) $(FLASH_CTRL_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(FLASH_CTRL_HJSON)
 $(ML_TOP_HEADER): $(REGTOOL) $(ML_TOP_HJSON) | $(OPENTITAN_GEN_DIR)
 	$(REGTOOL) -D -o $@ $(ML_TOP_HJSON)
+$(OTP_CTRL_HEADER): $(REGTOOL) $(OTP_CTRL_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(OTP_CTRL_HJSON)
+$(SPI_HOST_HEADER): $(REGTOOL) $(SPI_HOST_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(SPI_HOST_HJSON)
 $(TLUL_MAILBOX_HEADER): $(REGTOOL) $(MBOX_HJSON) | $(OPENTITAN_GEN_DIR)
 	$(REGTOOL) -D -o $@ $(MBOX_HJSON)
 $(UART_HEADER): $(REGTOOL) $(UART_HJSON) | $(OPENTITAN_GEN_DIR)
@@ -99,7 +108,10 @@
 
 CHERIOT_GEN_HEADERS=\
     $(I2S_HEADER) \
+    $(FLASH_CTRL_HEADER) \
     $(ML_TOP_HEADER) \
+    $(OTP_CTRL_HEADER) \
+    $(SPI_HOST_HEADER) \
     $(TLUL_MAILBOX_HEADER) \
     $(UART_HEADER) \
     $(TOP_MATCHA_IRQ_HEADER) \
diff --git a/platforms/bancha/setup.sh b/platforms/bancha/setup.sh
index 7845a2a..f9d2ea3 100644
--- a/platforms/bancha/setup.sh
+++ b/platforms/bancha/setup.sh
@@ -16,6 +16,11 @@
 
 source "${ROOTDIR}/build/platforms/sencha/setup.sh"
 
+# The following files are the input to regtool.py
+export FLASH_CTRL_HJSON="${ROOTDIR}/hw/opentitan-upstream/hw/ip/flash_ctrl/data/flash_ctrl.hjson"
+export OTP_CTRL_HJSON="${ROOTDIR}/hw/opentitan-upstream/hw/ip/otp_ctrl/data/otp_ctrl.hjson"
+export SPI_HOST_HJSON="${ROOTDIR}/hw/opentitan-upstream/hw/ip/spi_host/data/spi_host.hjson"
+
 # Firmware image to build & load at boot.
 # NB: the pathname to the source directory is formulated in platform.mk
 export CHERIOT_FIRMWARE="soundstream"
diff --git a/platforms/bancha/sim.mk b/platforms/bancha/sim.mk
index 5da3432..5c0dab2 100644
--- a/platforms/bancha/sim.mk
+++ b/platforms/bancha/sim.mk
@@ -65,11 +65,15 @@
 	tar -C $(TMP_DEBUG) -cvhf $@ matcha-tock-bundle.bin kernel
 ext_flash_debug: $(EXT_FLASH_DEBUG)
 
-$(EXT_FLASH_RELEASE): $(CHERIOT_FIRMWARE_RELEASE) | $(TMP_RELEASE)
+$(EXT_FLASH_RELEASE): $(CHERIOT_FIRMWARE_RELEASE) ${CANTRIP_MODEL_RELEASE} | $(TMP_RELEASE)
 	cp -f $(CHERIOT_FIRMWARE_RELEASE) $(TMP_RELEASE)/cheriot-firmware
 	${C_PREFIX}strip $(TMP_RELEASE)/cheriot-firmware
 	${C_PREFIX}objcopy -O binary -g $(TMP_RELEASE)/cheriot-firmware $(TMP_RELEASE)/cheriot-firmware.bin
 	tar -C $(TMP_RELEASE) -cvhf $@ cheriot-firmware.bin
+	if [[ -f "${CANTRIP_MODEL_RELEASE}" ]]; then \
+		${C_PREFIX}objcopy -O binary -g ${CANTRIP_MODEL_RELEASE} $(TMP_RELEASE)/kelvin.bin; \
+		tar -C $(TMP_RELEASE) -uvf $@ kelvin.bin; \
+	fi
 ext_flash_release: $(EXT_FLASH_RELEASE)
 
 # Renode commands to issue before the initial start of a simulation.