diff --git a/launch_chffrplus.sh b/launch_chffrplus.sh
index 730b383a52..e53d320b9a 100755
--- a/launch_chffrplus.sh
+++ b/launch_chffrplus.sh
@@ -165,11 +165,6 @@ function launch {
           mv "${STAGING_ROOT}/finalized" $BASEDIR
           cd $BASEDIR
 
-          # Partial mitigation for symlink-related filesystem corruption
-          # Ensure all files match the repo versions after update
-          git reset --hard
-          git submodule foreach --recursive git reset --hard
-
           echo "Restarting launch script ${LAUNCHER_LOCATION}"
           unset REQUIRED_NEOS_VERSION
           unset AGNOS_VERSION
diff --git a/selfdrive/updated.py b/selfdrive/updated.py
index cbc2c387d6..7d58455860 100755
--- a/selfdrive/updated.py
+++ b/selfdrive/updated.py
@@ -216,6 +216,9 @@ def finalize_update() -> None:
     shutil.rmtree(FINALIZED)
   shutil.copytree(OVERLAY_MERGED, FINALIZED, symlinks=True)
 
+  run(["git", "reset", "--hard"], FINALIZED)
+  run(["git", "submodule", "foreach", "--recursive", "git", "reset"], FINALIZED)
+
   set_consistent_flag(True)
   cloudlog.info("done finalizing overlay")