diff --git a/.github/workflows/notecard-binary-tests.yml b/.github/workflows/notecard-binary-tests.yml
index b1032fc0..cc434e28 100644
--- a/.github/workflows/notecard-binary-tests.yml
+++ b/.github/workflows/notecard-binary-tests.yml
@@ -92,7 +92,11 @@ jobs:
 
       - name: Generate MD5 Server Token
         run: |
-          [ -n "$MD5SRV_TOKEN" ] || echo "MD5SRV_TOKEN=`uuidgen`" >> $GITHUB_ENV
+          [ -n "$MD5SRV_TOKEN" ] || MD5SRV_TOKEN=`uuidgen`
+          # Mask the token before it goes into GITHUB_ENV. Otherwise, GitHub
+          # prints it in plain text in the env block of every later step.
+          echo "::add-mask::$MD5SRV_TOKEN"
+          echo "MD5SRV_TOKEN=$MD5SRV_TOKEN" >> $GITHUB_ENV
 
       # gdb-multiarch: We used gdb to remotely flash the test firmware onto the
       # Swan attached to the Notestation. Apparently "regular" gdb (i.e.
@@ -148,13 +152,15 @@ jobs:
       - name: Create Notehub accesss token
         if: env.CREATE_NOTEHUB_ROUTES!='false'
         run: |
+          # Mask the token before it goes into GITHUB_ENV. Otherwise, GitHub
+          # prints it in plain text in the env block of every later step.
           curl -f -X POST \
             -L 'https://${{ env.NOTEHUB }}/oauth2/token' \
             -H 'content-type: application/x-www-form-urlencoded' \
             -d grant_type=client_credentials \
             -d client_id=${{ secrets.NOTEHUB_HIL_CLIENT_ID }} \
             -d client_secret=${{ secrets.NOTEHUB_HIL_CLIENT_SECRET }} | \
-            { token=$(jq -r .access_token); echo "NOTEHUB_ACCESS_TOKEN=$token" >> $GITHUB_ENV; }
+            { token=$(jq -r .access_token); echo "::add-mask::$token"; echo "NOTEHUB_ACCESS_TOKEN=$token" >> $GITHUB_ENV; }
 
       - name: Create Notehub HTTP route
         if: env.CREATE_NOTEHUB_ROUTES!='false'
diff --git a/test/hitl/card.binary/lib/notecard_binary/NotecardComms.cpp b/test/hitl/card.binary/lib/notecard_binary/NotecardComms.cpp
index 475d68bf..ad6b08bf 100644
--- a/test/hitl/card.binary/lib/notecard_binary/NotecardComms.cpp
+++ b/test/hitl/card.binary/lib/notecard_binary/NotecardComms.cpp
@@ -150,7 +150,6 @@ size_t readDataUntilTimeout(Stream& serial, size_t timeout, uint8_t* buf, size_t
 }
 
 
-HardwareSerial Serial2(A0,A3);
-HardwareSerial Serial3(A5,A4); // A5 is RX, A4 is TX
+UartSerial notecardSerial(A5,A4); // A5 is RX, A4 is TX
 
 
diff --git a/test/hitl/card.binary/lib/notecard_binary/NotecardComms.h b/test/hitl/card.binary/lib/notecard_binary/NotecardComms.h
index d05052a0..5f29d5bc 100644
--- a/test/hitl/card.binary/lib/notecard_binary/NotecardComms.h
+++ b/test/hitl/card.binary/lib/notecard_binary/NotecardComms.h
@@ -10,7 +10,7 @@ enum NotecardInterface {
 };
 
 #ifndef NOTECARD_IF_SERIAL_PORT
-#define NOTECARD_IF_SERIAL_PORT Serial3
+#define NOTECARD_IF_SERIAL_PORT notecardSerial
 #endif
 
 #ifndef NOTECARD_IF_SERIAL_BAUDRATE
@@ -36,6 +36,18 @@ HardwareSerial stlinkSerial(PIN_VCP_RX, PIN_VCP_TX);
 #define dbgSerial Serial
 #endif
 
+// In STM32 Arduino core 3.x, HardwareSerial is an abstract base class and Uart
+// is the concrete UART class. Core 2.x has no Uart class.
+#if STM32_CORE_VERSION_MAJOR >= 3
+typedef Uart UartSerial;
+#else
+typedef HardwareSerial UartSerial;
+#endif
+
+// Don't name this Serial2 or Serial3. Core 3.x declares those itself, and a
+// second declaration with a different type won't compile.
+extern UartSerial notecardSerial;
+
 bool initialize_notecard_interface(NotecardInterface iface);
 size_t readDataUntilTimeout(Stream& serial, size_t timeout, uint8_t* buf, size_t bufLen, size_t dataLen, size_t& duration);
 
diff --git a/test/hitl/card.binary/platformio.ini b/test/hitl/card.binary/platformio.ini
index 3615d58e..a15a9884 100644
--- a/test/hitl/card.binary/platformio.ini
+++ b/test/hitl/card.binary/platformio.ini
@@ -41,5 +41,8 @@ extra_scripts = post:after_upload.py
 build_type = debug
 debug_test = *
 upload_protocol = custom
-upload_command = ${sysenv.GDB_CMD} -ex "set confirm off" -ex "set pagination off" -ex "file .pio/build/debug/firmware.elf" -ex "target extended-remote ${sysenv.MCU_GDB_SERVER_IP}:${sysenv.MCU_GDB_SERVER_PORT}" -ex "monitor reset halt" -ex "load" -ex "monitor reset" -ex "quit"
+; -batch and upload.gdb make GDB exit non-zero when the connect, reset, or
+; load fails. See upload.gdb. "pio test" hides the upload command's stdout, so
+; 1>&2 sends GDB's output to stderr, where it shows in the CI log.
+upload_command = ${sysenv.GDB_CMD} -batch -ex "set confirm off" -ex "set pagination off" -ex "file .pio/build/debug/firmware.elf" -ex "target extended-remote ${sysenv.MCU_GDB_SERVER_IP}:${sysenv.MCU_GDB_SERVER_PORT}" -x upload.gdb 1>&2
 test_port = ${sysenv.TEST_PORT}
diff --git a/test/hitl/card.binary/test/test_card_binary.cpp b/test/hitl/card.binary/test/test_card_binary.cpp
index 7d97fc6e..528cf6ac 100644
--- a/test/hitl/card.binary/test/test_card_binary.cpp
+++ b/test/hitl/card.binary/test/test_card_binary.cpp
@@ -428,6 +428,14 @@ TEST(test_max_length_aux_serial)
 
 void waitForNotecardConnected()
 {
+    // Set the product and mode before waiting. The Notestation is shared, so
+    // the previous user can leave a different product UID on the Notecard. If
+    // that product has no Notehub project, the Notecard delays its connect
+    // attempts ("connect delayed", the penalty box) for several minutes. A
+    // hub.set that changes the product also clears that delay.
+    assert_initialize_notecard(NOTECARD_IF_I2C);
+    TEST_ASSERT_TRUE_MESSAGE(cardBinary.notecardConnectionMode(), "Unable to set Notecard connection mode");
+
     // TODO: waitForNotecardConnected takes timeout in milliseconds, so 5*60 seems wrong?
     TEST_ASSERT_TRUE_MESSAGE(NotecardBinary::waitForNotecardConnected(NOT_CONNECTED_TIMEOUT), "Notecard not connected");
 }
diff --git a/test/hitl/card.binary/upload.gdb b/test/hitl/card.binary/upload.gdb
new file mode 100644
index 00000000..049b9b70
--- /dev/null
+++ b/test/hitl/card.binary/upload.gdb
@@ -0,0 +1,21 @@
+# Flash commands for the custom upload_command in platformio.ini.
+#
+# These commands live in a sourced file, not in -ex options, so that a failure
+# stops the upload. GDB aborts a sourced file at the first command that fails,
+# and with -batch it then exits non-zero. With -ex options, GDB runs the later
+# commands anyway and exits 0 (or, with -batch, reports only the last command),
+# so a failed connect or load looked like a successful upload.
+#
+# If the "target extended-remote" -ex before this file fails, the first
+# "monitor" command here fails too, so that case also exits non-zero.
+#
+# GDB prints load progress only for interactive commands, so the echo lines
+# and compare-sections show in the CI log what was flashed. compare-sections
+# reports a mismatch as a warning, not an error.
+monitor reset halt
+echo Loading firmware...\n
+load
+echo Comparing flash with the ELF...\n
+compare-sections
+monitor reset
+echo Upload done.\n