diff --git a/client/src/cmdhfmfhard.c b/client/src/cmdhfmfhard.c
index 9b4cf4858..713a658e9 100644
--- a/client/src/cmdhfmfhard.c
+++ b/client/src/cmdhfmfhard.c
@@ -406,7 +406,8 @@ static void init_bitflip_bitarrays(void) {
                     exit(5);
                 }
 
-                uint32_t count = ((uint32_t *)uncompressed_data)[0];
+                uint32_t count;
+                memcpy(&count, uncompressed_data, sizeof(uint32_t));
 
                 if ((float)count / (1 << 24) < IGNORE_BITFLIP_THRESHOLD) {
                     uint32_t *bitset = (uint32_t *)malloc_bitarray(sizeof(uint32_t) * (1 << 19));
diff --git a/client/src/flash.c b/client/src/flash.c
index b1f4a28c9..aed71f805 100644
--- a/client/src/flash.c
+++ b/client/src/flash.c
@@ -350,7 +350,8 @@ int flash_load(flash_file_t *ctx, bool force) {
         }
 
         if (strcmp(((char *)shstr) + shdrs[i].sh_name, ".bootphase1") == 0) {
-            uint32_t offset = *(uint32_t *)(ctx->elf + le32(shdrs[i].sh_offset) + le32(shdrs[i].sh_size) - 4);
+            uint32_t offset;
+            memcpy(&offset, ctx->elf + le32(shdrs[i].sh_offset) + le32(shdrs[i].sh_size) - 4, sizeof(uint32_t));
             if (offset >= le32(shdrs[i].sh_addr)) {
                 offset -= le32(shdrs[i].sh_addr);
                 if (offset < le32(shdrs[i].sh_size)) {