Build your own firmware¶

Instead of step 2 (the install page), you can compile the firmware yourself, with your own changes. The other steps of the guide stay the same: the Home Assistant files, then steps 4 to 7.

Note

Over the air, the tablet only accepts a firmware signed with the same key as the one it runs. A tablet installed from the install page runs the project key: to switch to your own builds (your own key), flash it once over USB.

Prerequisites¶

ESPHome 2026.9.0 or newer: the ESPHome add-on, or the command line (pip install esphome). It is enforced by min_version: in tab5-ha-hmi.yaml, so an older ESPHome refuses to compile. 2026.7.0 brought the official st7123 touchscreen platform (no more external_components), zero-copy audio, VAD and PSRAM-over-SDIO; the floor was raised to 2026.8.1 on 2026-08-26 for the API, voice-assistant and crash-handler fixes this project exercises daily, then to 2026.9.0 on 2026-09-16; the pairing window, the key given by Home Assistant and signed firmware (3.0) are checked on it (reasoning in the comment above min_version:).
Home Assistant 2026.8 or newer (it gives the tablet its encryption key, see step 4).
A M5Stack Tab5 and the name of its display chip (hardware revisions).

1. Clone and locate the entry point¶

git clone https://github.com/Axellum/M5-Tab5-ESPHome-LVGL.git
cd M5-Tab5-ESPHome-LVGL

The main file is tab5-ha-hmi.yaml at the repository root. All other YAML files in Tab5/ are included as packages by this entry point.

2. Create your build settings file¶

Copy the example file:

cp Tab5/user_entities.example.yaml Tab5/user_entities.yaml

Tab5/user_entities.yaml is gitignored (never committed). For a standard install there is nothing to replace in it: every line is optional.

Screen language: French by default; add tab5_langue: English (or Deutsch, Nederlands, Español, Italiano, Türkçe) for another language on the first boot. It can then be changed from Home Assistant (select « Langue »), see translations.

Time zone: nothing to set since 3.0. The tablet takes Home Assistant's time zone and keeps the last one it received, so the alarm clock stays right when HA is down after a power cut. An old tab5_fuseau line is ignored.

Tab5 revision: if the display chip on your sticker is not the ST7123, add tab5_ecran: st7121 or tab5_ecran: ili9881c to this file (see hardware revisions). Leave it out for the ST7123.

Several screens: keep the default name (tab5-ha-hmi) for the first one and give each other screen its own, tab5_nom: salon-7b (lower case, digits and dashes; tab5_nom_affiche for the name shown in Home Assistant), or -s tab5_nom salon-7b on the command line. Home Assistant pushes the same display to every connected screen, nothing to set there (ADR-0063). Do not rename a tablet already installed.

Your devices (lights, climate, plants, TV…) are not set here any more (since 3.0): you pick them in Home Assistant with the mouse, see step 6 and adapt to your home; old entity_light_… keys in an existing file are simply ignored. The entry point tab5-ha-hmi.yaml includes this file via substitutions: !include Tab5/user_entities.yaml. No entity key is left: Home Assistant finds the tablet's own entities (voice satellite, media player, pipeline select) and those of the « MAJ Écran » button by itself (ADR-0025); old entity_tab5_…, entity_primary_active and entity_push_automation lines are ignored.

3. Create your firmware signing key¶

Since 3.0 the firmware holds no secret: no Wi-Fi password, no API key (ADR-0020). What protects the tablet is a signature: over the network, it only accepts a firmware signed with the same key as the one it runs. Create this private key once, at the repository root:

python -m espsecure generate-signing-key --version 2 --scheme rsa3072 tab5_signature.pem

espsecure comes with ESPHome. The file is gitignored; to keep it elsewhere, set its path in Tab5/user_entities.yaml (tab5_cle_signature: …). Keep a copy outside your computer: without it, the tablet can only be updated over USB.

No secrets.yaml any more: one left from 2.x is simply not read (see upgrading from 2.x).

4. First flash (USB) and Wi-Fi¶

Connect the Tab5 to your computer via USB-C. Then:

esphome run tab5-ha-hmi.yaml

The tablet has no Wi-Fi network yet. Give it yours, either way: - over USB, right after the flash: the project's install page (Chrome or Edge), Connect and install, then its Wi-Fi button, or ESPHome Web, Connect, then Configure Wi-Fi. Both use Improv and work with a firmware you built yourself. Closing that window restarts the tablet once: that is normal; - without a cable: join the open « Tab5 Fallback AP » network with a phone; a page opens (otherwise go to http://192.168.4.1) to pick your network.

The network is kept across updates. Then add the tablet to Home Assistant, within 30 minutes of its start.

Updates over Wi-Fi¶

Once the tablet is on your network, later builds go over Wi-Fi:

esphome run tab5-ha-hmi.yaml --device 192.168.x.x

The transfer is not encrypted any more (there is no key in the YAML); the tablet checks the signature and refuses a firmware signed by another key. Your builds are signed by your key at compile time, nothing else to do.

Logs: esphome logs looks for the key in the YAML and no longer finds one. Use python tools/tab5_logs.py --host 192.168.x.x --config-ha \\<ha-ip>\config: it reads the key Home Assistant keeps (.storage/core.config_entries, or the TAB5_CLE_API variable) and never prints it. More in debugging.