diff --git a/.github/workflows/core-hw.yml b/.github/workflows/core-hw.yml
new file mode 100644
index 00000000000..a2fe75b9c6d
--- /dev/null
+++ b/.github/workflows/core-hw.yml
@@ -0,0 +1,79 @@
+name: Core hardware
+
+on:
+  schedule:
+    - cron: '15 23 * * *'  # every day @ 23:15
+  workflow_dispatch:
+  pull_request:  # TODO remove
+
+jobs:
+#  core_hardware_test:
+#    name: Selfhosted runner test
+#    runs-on: runner5
+#    env:
+#      TREZOR_MODEL: T
+#      PYOPT: 0
+#      # BOOTLOADER_DEVEL: 1
+#      DISABLE_OPTIGA: 1
+#      PYTEST_TIMEOUT: 300
+#      TREZOR_PYTEST_SKIP_ALTCOINS: 1
+#      TT_UHUB_LOCATION: "1-3"
+#      TT_UHUB_PORT: "1"
+#      # NIX_PATH: "nixpkgs=channel:nixos-23.11"
+#    steps:
+#      - uses: actions/checkout@v4
+#        with:
+#          submodules: recursive
+#      - uses: ./.github/actions/environment
+#      - run: nix-shell --arg hardwareTest true --run uhubctl
+#      - run: nix-shell --run "poetry run make -C core build_firmware"
+#      - run: nix-shell --arg hardwareTest true --run "poetry run python ci/hardware_tests/bootstrap.py tt core/build/firmware/firmware.bin"
+#      - run: nix-shell --run "poetry run trezorctl list"
+#      - run: nix-shell --run "poetry run trezorctl get-features"
+#      - run: |
+#          nix-shell --arg hardwareTest true --run "ls -l /dev/tty*"
+#          # TODO explain
+#          nix-shell --arg hardwareTest true --run "sleep 8h | tio --no-autoconnect /dev/ttyTREZOR &> trezor.log" &
+#          nix-shell --run "poetry run pytest -v tests/device_tests -k 'not authenticate and not recovery'"
+#      - run: cat trezor.log
+#        if: always()
+
+  core_hardware_test:
+    name: Device tests
+    runs-on: [self-hosted, ${{ matrix.model == 'T2B1' && 'hw-t2b1' || 'runner5' }}]  # FIXME use hw-t2t1 after it's removed from runner0
+    strategy:
+      fail-fast: false
+      matrix:
+        model: [T2T1, T2B1]  # FIXME t1b1
+        coins: [universal, btconly]
+    env:
+      TREZOR_MODEL: ${{ matrix.model == 'T2T1' && 'T' || 'R' }}
+      TREZOR_PYTEST_SKIP_ALTCOINS: ${{ matrix.coins == 'btconly' && '1' || '0' }}
+      PYTEST_TIMEOUT: 1200
+      PYOPT: 0
+      DISABLE_OPTIGA: 1
+      BOOTLOADER_DEVEL: ${{ matrix.model == 'T2B1' && '1' || '0' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - uses: ./.github/actions/environment
+      - run: nix-shell --arg hardwareTest true --run uhubctl
+      - run: nix-shell --run "poetry run make -C core build_firmware"
+      - run: nix-shell --arg hardwareTest true --run "poetry run python ci/hardware_tests/bootstrap.py tt core/build/firmware/firmware.bin"
+      - run: nix-shell --run "poetry run trezorctl list"
+      - run: nix-shell --run "poetry run trezorctl get-features"
+      - run: |
+          nix-shell --arg hardwareTest true --run "ls -l /dev/tty*"
+          echo $TT_UHUB_PORT/$TT_UHUB_LOCATION
+          # log serial console to file; sleep is used because tio needs stdin that is not /dev/null
+          nix-shell --arg hardwareTest true --run "sleep 8h | tio --no-autoconnect /dev/ttyTREZOR &> trezor.log" &
+          nix-shell --run "poetry run pytest -v tests/device_tests -k 'not authenticate and not recovery'"
+      - run: tail -n50 tests/trezor.log || true
+        if: failure()
+      - uses: actions/upload-artifact@v3
+        with:
+          name: core-hardware-${{ matrix.model }}
+          path: trezor.log
+          retention-days: 7
+        if: always()
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f0e80f57c21..5616f2f0fa3 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -45,6 +45,5 @@ include:
   - ci/prebuild.yml
   - ci/build.yml
   - ci/test.yml
-  - ci/test-hw.yml
   - ci/posttest.yml
   - ci/deploy.yml
diff --git a/ci/hardware_tests/bootstrap.py b/ci/hardware_tests/bootstrap.py
index 6baa2d5648f..94a9105ff3d 100755
--- a/ci/hardware_tests/bootstrap.py
+++ b/ci/hardware_tests/bootstrap.py
@@ -1,24 +1,26 @@
 import os
 import sys
 
-from device.t1 import TrezorOne
-from device.tt import TrezorT
+from device.legacy import TrezorOne
+from device.core import TrezorCore
 
 
 def main(model: str, file: str = None):
     t1 = TrezorOne(
-        os.environ["T1_UHUB_LOCATION"],
-        os.environ["T1_ARDUINO_SERIAL"],
-        os.environ["T1_UHUB_PORT"],
+        os.getenv("T1_UHUB_LOCATION"),
+        os.getenv("T1_ARDUINO_SERIAL"),
+        os.getenv("T1_UHUB_PORT"),
     )
-    tt = TrezorT(os.environ["TT_UHUB_LOCATION"], os.environ["TT_UHUB_PORT"])
+    tt = TrezorCore(os.getenv("TT_UHUB_LOCATION"), os.getenv("TT_UHUB_PORT"))
 
     if model == "t1":
-        tt.power_off()
+        # tt.power_off()
         path = t1.update_firmware(file)
     elif model == "tt":
-        t1.power_off()
-        path = tt.update_firmware(file)
+        # t1.power_off()
+        path = tt.update_firmware(file, "Trezor T")
+    elif model == "t2b1":
+        path = tt.update_firmware(file, "Safe 3")
     else:
         raise ValueError("Unknown Trezor model.")
 
diff --git a/ci/hardware_tests/device/tt.py b/ci/hardware_tests/device/core.py
similarity index 77%
rename from ci/hardware_tests/device/tt.py
rename to ci/hardware_tests/device/core.py
index 3cf66618ab5..5afd948a328 100644
--- a/ci/hardware_tests/device/tt.py
+++ b/ci/hardware_tests/device/core.py
@@ -1,8 +1,8 @@
 from .device import Device
 
 
-class TrezorT(Device):
-    def update_firmware(self, file=None):
+class TrezorCore(Device):
+    def update_firmware(self, file=None, model_name="Trezor T"):
         if not file:
             raise ValueError(
                 "Uploading production firmware will replace the bootloader, it is not allowed!"
@@ -10,10 +10,11 @@ def update_firmware(self, file=None):
 
         # reset to enter bootloader again
         self.power_off()
+        self.wait(5)
         self.power_on()
 
         self.wait(5)
-        self.check_model("Trezor T bootloader")
+        self.check_model("bootloader")
 
         self.run_trezorctl("device wipe --bootloader || true")
         self.wait(5)
@@ -26,4 +27,4 @@ def update_firmware(self, file=None):
 
         # after firmware-update finishes wait for reboot
         self.wait(15)
-        return self.check_model("Trezor T")
+        return self.check_model(model_name)
diff --git a/ci/hardware_tests/device/t1.py b/ci/hardware_tests/device/legacy.py
similarity index 100%
rename from ci/hardware_tests/device/t1.py
rename to ci/hardware_tests/device/legacy.py
diff --git a/ci/shell.nix b/ci/shell.nix
index 5e438b381cb..3fa21dbb3a5 100644
--- a/ci/shell.nix
+++ b/ci/shell.nix
@@ -136,6 +136,7 @@ stdenvNoCC.mkDerivation ({
     libiconv
   ] ++ lib.optionals hardwareTest [
     uhubctl
+    tio
     ffmpeg
     dejavu_fonts
   ] ++ lib.optionals devTools [