Raspberry Pi's $600 CM5 jig burns a key you can never rewrite

A carrier board you no longer need

Raspberry Pi announced the Compute Module 5 Programming Jig on 19 August: a bench box that programs one CM5 at a time with an OS image and a security configuration, aimed at people who have to build the next thousand units rather than the first one.

The mechanical answer is pogo pins. The product brief describes a "1 × provisioning head" with a "Pogo pin interface" and a "Mechanical clamping mechanism", and the documentation is explicit that this replaces the usual rig: the pins interface directly with the module, eliminating the need for a separate carrier (IO) board and reducing wear on the CM5's high-density connectors. In the announcement's words, "All you need to do is insert the Compute Module 5 into the module bay and press the clamp shut."

The brief, document RP-010444-MM, published August 2026, gives the rest:

Connectivity   JIG ETH  • Ethernet (10/100/1000)
               DUT ETH  • Ethernet (10/100/1000)
               USB-C
               12 V power (power supply included)
Power          12 V at 2 A (24 W) DC
Dimensions     170 mm × 181.5 mm × 153 mm
Weight         1796 g
List price     $600

Two Ethernet ports, not one. JIG ETH puts the jig on your provisioning network; DUT ETH is for the module under test — "For accelerated data transfer during provisioning, connect an Ethernet cable from the provisioning network to the jig's DUT ETH port." The USB-C port is how you write the jig's own OS with Raspberry Pi Imager. Compatibility is narrow and stated plainly: "Compatible with Raspberry Pi Compute Module 5", and the documentation warns against inserting a Compute Module 4.

What it writes, and how fast

The jig runs rpi-sb-provisioner, the automated provisioning software Raspberry Pi publishes for Pi 5, Pi 4, CM5, CM4 and Zero 2 W, wrapped around images built with rpi-image-gen. Three security styles are documented: secure-boot is "Full security: secure boot, encrypted storage, and device-unique keys"; fde-only is "Encrypted storage and device-unique keys without secure boot"; naked is "Just the operating system without encryption or secure boot."

The only throughput figure Raspberry Pi publishes is for the cheapest of the three: "Typical provisioning time is approximately 1.5 minutes for each CM5 with a 2.6 GB OS image installed using the naked provisioning style." Arithmetic on that number gives 40 modules an hour from one head — and the caveat matters, because secure-boot adds key generation, OTP programming and encrypted-container creation on top, with no published figure. An optional manufacturing database records serial number, board type and revision, Ethernet MAC, provisioning date and time, installed image and security settings, exportable as CSV.

The step you cannot take back

The interesting line in the whole documentation set is one parenthesis.

In secure-boot mode, the signing key hash is programmed into the device OTP memory (this is a permanent operation).

Raspberry Pi, Compute Module 5 Programming Jig documentation

One-time-programmable memory is one-time. Close the clamp on a CM5 in secure-boot mode and that module is bound to your signing key for the rest of its life; there is no unprovisioning step, and a mistake at that moment scraps the module rather than costing a re-flash. rpi-sb-provisioner pairs it with full-disk encryption using a key unique to each device, so storage is not portable between units.

That is the right design for production security, and it is also a $600 device whose headline feature is irreversible. The documented safety warnings read accordingly: do not touch the pogo pins, "they are sharp and can carry charge"; do not press the unmarked button, which "is a safety switch used internally by the provisioning software"; seat the module logo-up, because "Seating the module incorrectly can damage the pogo pins."

Single head, localhost only

Two constraints shape how this fits a real line. The first is in the name: one provisioning head, one module at a time. The second is access control — "The Secure Boot Provisioner (rpi-sb-provisioner) web interface is only available on localhost. This is a security measure that enforces authentication against the jig." You drive it from the jig itself or over Raspberry Pi Connect screen sharing, and the documented way to get a target image onto the box is Magic-Wormhole rather than an open upload endpoint. The machine that can burn keys into OTP does not take instructions from the network.

Primary sources: Raspberry Pi announcement, CM5 Programming Jig product brief RP-010444-MM (PDF), CM5 Programming Jig documentation, rpi-sb-provisioner, read 2026-08-21.