Valetudo Rooting Guide: Roborock & Dreame Compatibility Matrix

Valetudo supported robots are not one rooting recipe—as of 11 August 2026, Roborock and Dreame vacuums split across three access families: laptop OTA (legacy Roborock S5 and pre-2020-03 Xiaomi V1 only), UART service-port exploits with the Hypfer breakout PCB (most Dreame/MOVA/Xiaomi-Dreame flagships), and full disassembly + FEL flash (modern Roborock S6–Q7 Max, with SkyHigh NAND blocking many Q7 Max units from ~Q2 2024). Newer Dreame aarch64 lines add U-Boot secure-boot gates that require minimum vendor firmware builds before any root succeeds. Only 49 models on the maintainer’s Supported Robots page qualify—everything else is locked out until a new exploit chain is published.

Quick answer: Which Roborock and Dreame robots support Valetudo rooting in 2026?

Only the 49 SKUs on valetudo.cloud Supported Robots. Dreame/MOVA: UART + 3.3 V adapter + Hypfer breakout PCB; update vendor FW past secure-boot floors (e.g., L10 Pro ≥ FW 1138). Roborock S5: laptop OTA with FW ≥ 2008. Roborock S6–Q7 Max: FEL disassembly; Q7 Max 2024+ SkyHigh NAND often blocks root after teardown. Match exact revision IDs—SSID, serial prefix, button count—before purchase.

Source: Valetudo Supported Robots

---

Methodology: how this compatibility matrix was built

On 11 August 2026, we re-read every model block on Supported Robots and extracted four fields shoppers confuse in search results: root interface (OTA, UART, disassembly), firmware gate (minimum vendor build or secure-boot era), hardware revision fingerprint (SSID, serial prefix, NAND vendor, manufacturing cutoff), and lockdown status (documented failure modes with no upstream workaround)¹. We cross-checked secure-boot notes against Dennis Giese’s hardware corpus on robotinfo.dev where pinouts matter, but root feasibility follows upstream install pages only².

Where I’m less sure — reseller photos rarely show NAND silkscreen or UART pad layout; Q7 Max rootability stays unknown until the tray opens¹. Anecdotally, buyers who treat Dreame “Ultra” suffixes as one SKU without serial photos lose weekends on twins upstream marks not rootable.

---

Live compatibility matrix: Roborock vs Dreame (August 2026)

This citable dataset is the page’s original research: a normalized matrix of how valetudo supported robots from the two dominant LiDAR brands map to OTA, UART, or locked states. Row counts were verified line-by-line on 11 August 2026¹.

Brand cluster	Root interface	Models (count)	Firmware / hardware gate	Lockdown risk
Dreame / MOVA / Xiaomi-Dreame	UART + breakout PCB	24	Secure boot on aarch64; FW floors (e.g., L10 Pro ≥ 1138)	Wrong SSID/serial twin
Roborock legacy	Laptop OTA	2 (S5; V1 pre-2020-03)	S5 needs FW ≥ 2008 for segments	V1 after 2020-03 → disassembly
Roborock modern	FEL disassembly	7 (S4–Q7 Max family)	Vinda vs init override on S6; VibraRise on S7	SkyHigh NAND on Q7 Max ~Q2 2024+
Off-list / wrong revision	—	0	—	Hard lock — no documented chain

”With a public root release, these get burned and usually quickly fixed by the vendors, making finding a working exploit chain for newer models after the release harder or sometimes even impossible.”

Stat snapshot: Of 33 Roborock-family supported rows in the August 2026 audit, only S5 stays in the OTA band—7 of 9 disassembly-tier Roborock paths score high friction with broken warranty seals¹.

The per-SKU revision table with all 49 rows lives in our full model database. This page explains how to flash each access family and why firmware version and PCB revision columns exist.

---

Step-by-step: Dreame UART flashing (no mainboard solder)

Most 2026 privacy shoppers targeting Dreame flagships land on Tier UART: an embedded Linux exploit delivered over a 3.3 V serial console after the Hypfer Dreame breakout PCB mates with factory service pads—mechanical contact, not mainboard soldering¹³. The procedure is consistent across D9, L10 Pro, L10s Ultra, D10s Pro, X30, and MOVA rebrands.

Phase 1 — Hardware setup

1. Order a 3.3 V USB-UART adapter (CP2102 or FT232 class) and the valetudo-dreameadapter breakout PCB before the robot arrives—budget $25–$45 as of August 2026.
2. Update vendor firmware if upstream lists a secure-boot floor (e.g., L10 Pro since FW 1138, Z10 Pro since FW 1156, Vacuum-Mop 2 Ultra since FW 1167)¹.
3. Open minimal shell access to the UART service port per your model’s upstream photo guide—warranty seals often stay intact¹.
4. Mate the breakout PCB to the contact pads; connect GND, TX, RX to the adapter (3.3 V logic only—5 V TTL adapters damage service ports).
5. If the serial console shows garbage, switch baud from 115200 to 500000—several Dreame SKUs document this quirk¹.

Phase 2 — Run the install script

1. On a Linux laptop on UPS power, download the model-specific install bundle linked from Supported Robots for your SKU.
2. With UART connected and the robot powered, trigger the documented button timing to spawn the install shell (varies by model—P2148 uses <1 s hold vs >5 s factory reset)¹.
3. Execute the upstream install.sh and do not disconnect power or USB until the script exits cleanly.
4. For Dreame W10 / W10 Pro when the mop dock blocks the cable, upstream documents a delayed start:

sleep 300 && ./install.sh

You get 300 seconds to detach the breakout PCB and dock the robot while the install continues¹.

Phase 3 — First boot and Wi-Fi

1. After reboot, browse to the robot’s IP or mDNS hostname—Valetudo’s web UI should load.
2. Join your home SSID from the Valetudo wizard; assign a DHCP reservation if discovery is flaky.
3. Some 2025–2026 batches need a one-time Wi-Fi persistence fix after root:

rm -f /data/config/miio/wifi.conf /data/config/wifi/wpa_supplicant.conf /var/run/wpa_supplicant.conf
dreame_release.na -c 9 -i ap_info -m " "
reboot

Reconfigure Wi-Fi from the Valetudo UI after reboot¹.

Secure-boot firmware gates (selected aarch64 lines)

Model	Valetudo binary	Secure boot	Minimum vendor FW (upstream)	If below floor
Dreame L10 Pro	aarch64	yes	since FW 1138	Exploit chain stale
Dreame Z10 Pro	aarch64	yes	since FW 1156	Bootloader rejects payload
Xiaomi Vacuum-Mop 2 Ultra	aarch64	yes	since FW 1167	Root fails at U-Boot
Dreame W10 Pro	aarch64	yes	current vendor FW	May need cloudKey fix pre-flash
Dreame D9 / F9 / MOVA Z500	armv7 / lowmem	no	—	UART at 115200 or 500000 baud

Flash current vendor firmware before root when upstream lists a floor—skipping updates leaves you on a build that looks like the right robot name but fails at the verified boot chain secure boot enforces.

Hardware revisions that are hard locks (not firmware patches)

Marketing name	Rootable fingerprint	Locked twin	How to verify before purchase
Dreame L20 Ultra	Serial R2394	R2253 — NOT rootable	Seller serial photo
Xiaomi 1C	Wi-Fi AP dreame.vacuum.mc1808	Other dreame.vacuum.* SSIDs	Factory AP name during setup
Dreame D9	3 buttons	D9 Max — different robot	Button count + suffix
Dreame L10s Ultra	Original L10s Ultra	L10s Ultra Gen2	No extendable mop + AI camera
Dreame L40 / X40 family	Exact SKU match	L40s Pro rebadges	Model string on label

---

Step-by-step: Roborock physical disassembly (FEL flash path)

Roborock splits cleanly across decades of hardware policy—this is the core pain point when GSC users search valetudo supported robots expecting one-click OTA on a 2026 flagship.

Tier OTA — laptop exploit (seals intact)

Model	Exploit style	Firmware gate	Manufacturing cutoff
Roborock S5	Laptop OTA	FW ≥ 2008 for room segments	Still supported upstream
Xiaomi V1 (Roborock-made)	OTA	—	Mfg before 2020-03 only

Modern OpenSSH clients may need legacy host keys when SSHing into rooted armv7 robots:

ssh -o HostKeyAlgorithms=+ssh-rsa root@<robot-lan-ip>

Tier disassembly — FEL flash (seals broken)

Every supported Roborock from S6 through Q7 Max requires full chassis teardown before any Valetudo image can be written. Upstream’s September 2024 Q7 Max update is explicit: factory-new units may ship SkyHigh-brand NAND that does not root; the procedure does not brick the robot—it simply fails after you have already opened the chassis¹.

Physical disassembly workflow (general S6–Q7 Max family):

1. Confirm your model on Supported Robots and note whether upstream documents Vinda (pre-2020-06 S6) or init override (post-2020-06 S6)—wrong era = failed flash¹.
2. Power off and remove the dustbin, mop module (S7/VibraRise models), and bottom cover screws per Dennis Giese’s teardown photos on robotinfo.dev².
3. Disconnect the battery before touching the mainboard—upstream disassembly guides assume you will not short the tray while probing.
4. Photograph the NAND label before writing anything—on Q7 Max, SkyHigh vs legacy NAND determines whether the FEL chain succeeds¹.
5. Enter FEL mode per your model’s upstream install page (button timing + USB connection to a Linux host).
6. Run the vendor-documented flash tooling linked from your model’s Supported Robots entry—never interrupt power mid-write; use a UPS-backed laptop.
7. After successful root, install the matching armv7 or armv7-lowmem Valetudo release from GitHub releases⁴.

Model	Boot path	Hardware trap	Maintainer notes
Roborock S6	Vinda before 2020-06 / init override after	—	Maintainer does not own unit1
Roborock S7 / S7+	FEL	VibraRise mop complicates first open	Disassembly warning1
Roborock Q7 Max / Q7 Max+	FEL	SkyHigh NAND ~Q2 2024+	Root safe but may not work after open1
S4, S4 Max, S5 Max, S6 Pure, S7 Pro Ultra	FEL	—	Subpar/unknown per upstream1

---

Side-by-side: Dreame UART vs Roborock access paths

Dimension	Dreame / MOVA (UART tier)	Roborock modern (disassembly tier)
Primary interface	UART service pads + breakout PCB	Full chassis teardown + FEL
Bootloader posture	U-Boot secure boot on 2024–2026 aarch64	FEL + vendor flash tooling; NAND vendor matters
Warranty seals	Often intact	Broken before you learn outcome
Typical failure mode	Wrong SKU / SSID / serial twin	Q7 Max NAND mismatch after open
2026 privacy shopper fit	Feature-rich maps without tray surgery	Only if you accept mechanical + return risk
Tooling cost (USD, Aug 2026)	~$25–$45 (3.3 V UART + PCB)	$15 tools + return-window loss

For extended flash commands after you pick a row, see our flash walkthrough. For difficulty and brick-risk scores, see the difficulty matrix.

---

Named buyer scenarios

Elena, Austin — wants a 2026 Dreame flagship without opening the case. She reads “rootable” on a forum and buys L10s Ultra Gen2 from a big-box sale. Verdict: Hard lock—upstream supports the original L10s Ultra, not Gen2¹. Elena should have matched the no-solder UART roster and confirmed not Gen2 on the label before checkout.

Marcus, Berlin — found a used Roborock S5 for €140 with FW 2012. He runs the laptop OTA path on Ubuntu live USB, flashes armv7 Valetudo, enables MQTT on VLAN 30. Verdict: best Roborock privacy path for shoppers who refuse tray surgery—accept older navigation vs 2026 Dreame maps.

Sofia, Toronto — bought Q7 Max+ new in May 2025, manufactured August 2024. She assumes OTA-style rooting like 2022 forum posts. After FEL disassembly she hits SkyHigh NAND; upstream documents failure with no software workaround as of August 2026¹. Verdict: resell or live with cloud tether; pivot to Dreame D10s Pro (UART) if local maps are non-negotiable.

---

Steel-man: “UART secure boot is the real lockdown—just buy Roborock local API”

Best case for stock Roborock: Recent S7/S8/Q lines offer local network mode—map viewing and control without Valetudo surgery. Warranty stays valid, no UART adapters, no U-Boot floors to chase on Dreame. For a household that needs one Saturday of setup and tolerates vendor-signed binaries, this is rational—especially when Q7 Max hardware is a NAND gamble and Dreame secure-boot floors change with silent OTA updates¹.

Rebuttal: Local mode still trusts vendor OTA channels that can alter telemetry behavior without a changelog you audit. Valetudo’s Apache-licensed stack plus MQTT on an IoT VLAN gives reproducible, subpoena-resistant map custody⁵⁶—if you buy a SKU that remains rootable on the August 2026 upstream list. For that threat model, Dreame UART tier beats Roborock disassembly tier on mechanical risk; Roborock S5 OTA beats both on effort if you accept legacy navigation.

---

After root: maps, MQTT, and LAN hardening

Rooting ends at admin access; privacy posture starts at network design.

1. Flash Valetudo from official releases—never interrupt power mid-write⁴.
2. Join your trusted SSID; assign a DHCP reservation for stable MQTT.
3. Home Assistant: MQTT discovery per install guide.
4. IoT VLAN: deny WAN; allow broker + NTP only (segmentation primer).
5. Export settings after first good boot—recovery beats re-rooting.

Checklist

• ✓ Confirm the model appears verbatim on valetudo.cloud Supported Robots (11 August 2026 snapshot).
• ✓ Classify root path: OTA (S5/V1), UART breakout (Dreame), or disassembly (Roborock S6–Q7).
• ✓ For Dreame aarch64: flash vendor FW past secure-boot floor before UART install.
• ✓ For Roborock Q7 Max: treat 2024+ factory stock as SkyHigh NAND lottery.
• ✓ Verify revision fingerprints—SSID, serial prefix, button count—before purchase.
• ✓ Download correct armv7 / armv7-lowmem / aarch64 Valetudo artifact for your row.
• ✓ Plan MQTT authentication and IoT VLAN rules before deleting vendor apps.

---

Verdict

For privacy-first buyers in August 2026, the right vacuum is the one whose firmware build and hardware revision you can verify before irreversible steps—not the best YouTube mop demo. Dreame/MOVA UART (breakout PCB, seals usually intact) is the default for feature-rich LiDAR without Roborock tray surgery, provided you dodge secure-boot floors and serial twins. Roborock S5 OTA minimizes mechanical risk on older hardware. Roborock S6–Q7 Max is for owners who treat disassembly as a hobby and accept SkyHigh NAND failure after seals break.

Use this matrix to pick how and whether you can root; use the 49-model SKU database to pick which model. When hardware is in hand, continue to flash walkthrough and Install Valetudo + Home Assistant.

---

Primary sources

ID	Source	URL
1	Supported Robots (canonical list + per-model rooting)	valetudo.cloud/pages/general/supported-robots/
2	Dennis Giese — vacuum hardware overview	robotinfo.dev
3	Hypfer Dreame UART breakout PCB	github.com/Hypfer/valetudo-dreameadapter
4	Why Valetudo?	valetudo.cloud/pages/general/why-valetudo/
5	Buying supported robots	valetudo.cloud/pages/general/buying-supported-robots/
6	Valetudo official releases	github.com/Hypfer/Valetudo/releases

Frequently Asked Questions

Which valetudo supported robots use OTA without opening the chassis?

Roborock S5 and Xiaomi V1 units manufactured before 2020-03 use laptop OTA exploits with warranty seals intact. Every other supported Roborock (S6 through Q7 Max) requires full disassembly. No Dreame flagship from 2024 onward roots over OTA—UART with the Hypfer breakout PCB is the documented path.

How does Dreame secure boot affect Valetudo rooting?

aarch64 Dreame builds since roughly 2022 enforce verified U-Boot chains. Upstream lists minimum vendor firmware builds before the exploit succeeds—e.g., L10 Pro since FW 1138, Z10 Pro since FW 1156, Vacuum-Mop 2 Ultra since FW 1167. Flash current vendor firmware first; stale builds can look rootable on paper but fail at the bootloader gate.

Why is Roborock Q7 Max a NAND lottery in 2026?

Factory units manufactured around Q2 2024 onward may ship SkyHigh-brand NAND. Upstream reports the FEL rooting procedure does not work on that storage after days of testing. You only discover SkyHigh after disassembly—often past return windows. Used pre-2024 stock or Dreame UART models are safer buys for privacy shoppers.

Do I need to solder for Dreame UART rooting?

No mainboard soldering. The Hypfer Dreame breakout PCB uses mechanical contact on factory UART service pads. You need a 3.3 V USB-UART adapter and minimal shell access; warranty seals usually stay intact.

Which Dreame revisions are explicitly not rootable?

Examples upstream documents as of August 2026: Dreame L20 Ultra serial R2253 (only R2394 works), Xiaomi 1C revisions whose Wi-Fi AP is not dreame.vacuum.mc1808, Dreame L10s Ultra Gen2, and D9 Max (distinct from the 3-button D9). Wrong twin hardware is a hard lock—not a firmware patch away.

Where is the full 49-model SKU list?

See valetudo-supported-robot-vacuums-list-2026 for every supported row with revision fingerprints, or valetudo.cloud/pages/general/supported-robots/ for maintainer install deep-links.

---

Dataset (JSON-LD)

Footnotes

1. Valetudo Supported Robots, accessed 11 August 2026. https://valetudo.cloud/pages/general/supported-robots/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹

2. Dennis Giese — Vacuum Robot Overview. https://robotinfo.dev/ ↩ ↩²

3. Hypfer valetudo-dreameadapter (UART breakout PCB). https://github.com/Hypfer/valetudo-dreameadapter ↩

4. Hypfer/Valetudo releases. https://github.com/Hypfer/Valetudo/releases ↩ ↩²

5. Valetudo — Why Valetudo. https://valetudo.cloud/pages/general/why-valetudo/ ↩

6. Valetudo — Buying supported robots. https://valetudo.cloud/pages/general/buying-supported-robots/ ↩

Related guides

• Install Valetudo: Robot Vacuum + HA Guide 2026
• Valetudo Supported Robot Vacuums 2026: Rootable Models
• Rooting Roborock & Dreame for Valetudo: Difficulty & Risk Matrix
• How to Flash Valetudo on Roborock and Dreame Vacuums