diff --git a/src/host_stream/base64.h b/include/host_stream/base64.h
similarity index 100%
rename from src/host_stream/base64.h
rename to include/host_stream/base64.h
diff --git a/src/host_stream/handshake.h b/include/host_stream/handshake.h
similarity index 95%
rename from src/host_stream/handshake.h
rename to include/host_stream/handshake.h
index 5061562..3e58bc3 100644
--- a/src/host_stream/handshake.h
+++ b/include/host_stream/handshake.h
@@ -15,7 +15,6 @@
 #include <stddef.h>
 
 #define HANDSHAKE_KEY_LEN     16
-#define HANDSHAKE_KN_STR      "29C310F5"//"48872dc21ede"  /* test vector; restore to "29C310F5" after verification */
 #define HANDSHAKE_R_LEN       16
 #define HANDSHAKE_TIMEOUT_SEC  5
 
diff --git a/src/host_stream/sha256.h b/include/host_stream/sha256.h
similarity index 100%
rename from src/host_stream/sha256.h
rename to include/host_stream/sha256.h
diff --git a/src/host_stream/event_recorder.c b/src/host_stream/event_recorder.c
index a3dec97..6b3a755 100644
--- a/src/host_stream/event_recorder.c
+++ b/src/host_stream/event_recorder.c
@@ -51,6 +51,7 @@ extern VMF_VSRC_HANDLE_T *g_ptVsrcHandle;
 
 /* ── External globals settable via BLE SET command ───────────────────────── */
 extern unsigned int g_dwSegOverlayEnable;  /* defined in kp_firmware.c */
+extern unsigned int g_dwDrawBoxEnable;     /* defined in kp_firmware.c */
 extern unsigned int g_verbose_log;         /* defined in kp_firmware.c */
 
 /* ── Speed control via MsgBroker ─────────────────────────────────────────── */
@@ -812,6 +813,7 @@ static void persist_ini_int(const char *ini_key, int val)
 /* Handle "SET key=value" command — works outside test mode.
  * cmd must already be uppercased (as provided by handle_test_cmd).
  * Supported keys (case-insensitive from sender):
+ *   DrawBoxEnable     — 0/1
  *   SegOverlayEnable  — 0/1
  *   speed_normal      — 1–255
  *   speed_alert       — 1–255
@@ -861,7 +863,13 @@ static void handle_set_cmd(const char *cmd)
     fflush(stdout);
     char ack[96];
 
-    if (strcmp(key, "SEGOVERLAYENABLE") == 0) {
+    if (strcmp(key, "DRAWBOXENABLE") == 0) {
+        int v = val ? 1 : 0;
+        g_dwDrawBoxEnable = (unsigned int)v;
+        persist_ini_int("DrawBoxEnable", v);
+        snprintf(ack, sizeof(ack), "SET_ACK DrawBoxEnable=%d", v);
+
+    } else if (strcmp(key, "SEGOVERLAYENABLE") == 0) {
         int v = val ? 1 : 0;
         printf("[SET] writing g_dwSegOverlayEnable=%d\n", v);
         fflush(stdout);
diff --git a/src/host_stream/handshake.c b/src/host_stream/handshake.c
index 3daf0af..9b5cc9d 100644
--- a/src/host_stream/handshake.c
+++ b/src/host_stream/handshake.c
@@ -13,6 +13,7 @@
 #include <fcntl.h>
 #include <unistd.h>
 
+#include <vmf_nnm_inference_app.h>
 #include "sha256.h"
 #include "base64.h"
 #include "handshake.h"
@@ -24,8 +25,14 @@ static time_t s_challenge_send_time = 0;
 
 void handshake_derive_key(uint8_t out_key[HANDSHAKE_KEY_LEN])
 {
+    /* Use runtime Kn chip number as key material (uppercase hex, no "0x" prefix).
+     * This ensures each board uses its own unique handshake key. */
+    char kn_str[16];
+    uint32_t kn = VMF_NNM_Get_Kn_Number();
+    snprintf(kn_str, sizeof(kn_str), "%08X", kn);
+
     uint8_t digest[32];
-    sha256((const uint8_t *)HANDSHAKE_KN_STR, strlen(HANDSHAKE_KN_STR), digest);
+    sha256((const uint8_t *)kn_str, strlen(kn_str), digest);
     for (int i = 0; i < HANDSHAKE_KEY_LEN; i++)
         out_key[i] = digest[i] ^ 0x5A;
 }
diff --git a/src/host_stream/kdp2_host_stream.c b/src/host_stream/kdp2_host_stream.c
index 5a061ba..b288318 100644
--- a/src/host_stream/kdp2_host_stream.c
+++ b/src/host_stream/kdp2_host_stream.c
@@ -855,7 +855,7 @@ void* kdp2_host_stream_draw_box(void *arg)
 
         int need_flush = 0;
 
-        if (g_dwResultCounts != 0) {
+        if (g_dwDrawBoxEnable && g_dwResultCounts != 0) {
             tYuvInfo.pcYuvBuff = tWriterSsmBuffer.buffer + vsrc_ssm_reader_info.dwOffset[0];
             tYuvInfo.dwWidth = dwWidth;
             tYuvInfo.dwHeight = dwHeight;
@@ -866,7 +866,7 @@ void* kdp2_host_stream_draw_box(void *arg)
 
         /* Paint STDC segmentation colour overlay (50% alpha blend into YM12).
          * Requires SegOverlayEnable=1 in host_stream.ini (default 0 = outline only). */
-        if (g_dwSegOverlayEnable && g_stdc_seg_w > 0) {
+        if (g_dwDrawBoxEnable && g_dwSegOverlayEnable && g_stdc_seg_w > 0) {
             stdc_paint_seg_overlay(tWriterSsmBuffer.buffer, &vsrc_ssm_reader_info,
                                    dwWidth, dwHeight);
             need_flush = 1;
diff --git a/src/host_stream/kp_firmware.c b/src/host_stream/kp_firmware.c
index 32f526b..30f7b8a 100644
--- a/src/host_stream/kp_firmware.c
+++ b/src/host_stream/kp_firmware.c
@@ -510,14 +510,6 @@ int main (int argc, char* argv[])
     VMF_NNM_Get_Version(&major, &minor, &patch, &build);
     uint32_t kn_number = VMF_NNM_Get_Kn_Number();
 
-    /* Derive and print BLE handshake key for startup verification.
-     * Expected: 58 48 c8 ff b2 eb b1 b8 69 92 b5 20 48 8d 1d 61 */
-    {
-        uint8_t hs_key[HANDSHAKE_KEY_LEN];
-        handshake_derive_key(hs_key);
-        printf("[INIT] handshake key: ");
-        handshake_print_key(hs_key);
-    }
 
     printf("\n\n**********************************************************\n");
     printf("Kneron Firmware\n");