diff --git a/Cargo.lock b/Cargo.lock
index 1690f4cc..3a7afb7d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -387,6 +387,7 @@ dependencies = [
  "memory-regions",
  "nb 1.1.0",
  "nfc-device",
+ "nrf-usbd 0.3.0",
  "nrf52840-hal",
  "nrf52840-pac",
  "rand",
@@ -399,7 +400,8 @@ dependencies = [
  "trussed",
  "trussed-core",
  "trussed-manage",
- "usb-device",
+ "usb-device 0.2.9",
+ "usb-device 0.3.2",
  "usbd-ccid",
  "usbd-ctaphid",
  "utils",
@@ -1164,7 +1166,6 @@ dependencies = [
  "systick-monotonic",
  "trussed",
  "trussed-core",
- "usb-device",
  "utils",
 ]
 
@@ -1601,6 +1602,16 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "heapless"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bfb9eb618601c89945a70e254898da93b13be0388091d42117462b265bb3fad"
+dependencies = [
+ "hash32 0.3.1",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "heapless"
 version = "0.9.1"
@@ -2044,8 +2055,7 @@ dependencies = [
 [[package]]
 name = "lpc55-hal"
 version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41e86e4e491dd3f8e07e7ba6de4aace716459ddefebd05743b2cb67b6a566d3c"
+source = "git+https://github.com/lpc55/lpc55-hal?rev=ad0b163bba8b884409e7da012fade5edde0d0375#ad0b163bba8b884409e7da012fade5edde0d0375"
 dependencies = [
  "block-buffer",
  "cipher",
@@ -2058,7 +2068,8 @@ dependencies = [
  "lpc55-pac",
  "nb 1.1.0",
  "rand_core",
- "usb-device",
+ "usb-device 0.2.9",
+ "usb-device 0.3.2",
  "vcell",
  "void",
 ]
@@ -2179,7 +2190,7 @@ dependencies = [
  "embedded-storage",
  "fixed",
  "nb 1.1.0",
- "nrf-usbd",
+ "nrf-usbd 0.1.0",
  "nrf52840-pac",
  "rand_core",
  "void",
@@ -2192,7 +2203,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "945a178131ac5f69941dadb0d51c8e17cbe34cc09a0e2d51c099160a463751b8"
 dependencies = [
  "cortex-m",
- "usb-device",
+ "usb-device 0.2.9",
+ "vcell",
+]
+
+[[package]]
+name = "nrf-usbd"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedf862f941154442271ae9914777bd1c93f6d2e0dc9db4cafa160e55ffb9085"
+dependencies = [
+ "cortex-m",
+ "critical-section",
+ "usb-device 0.3.2",
  "vcell",
 ]
 
@@ -2306,6 +2329,26 @@ dependencies = [
  "libm",
 ]
 
+[[package]]
+name = "num_enum"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a015b430d3c108a207fd776d2e2196aaf8b1cf8cf93253e3a097ff3085076a1"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96667db765a921f7b295ffee8b60472b686a51d4f21c2ee4ffdb94c7013b65a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.106",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.3"
@@ -2509,6 +2552,12 @@ dependencies = [
  "universal-hash",
 ]
 
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
 [[package]]
 name = "postcard"
 version = "0.7.3"
@@ -3757,9 +3806,9 @@ dependencies = [
 [[package]]
 name = "trussed-usbip"
 version = "0.1.0-rc.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f180e84c51b87ea68e90ad7c13703f80b9f099e293e008c075a46ae823e227cc"
+source = "git+https://github.com/trussed-dev/pc-usbip-runner?rev=ecadf7fff837c148fbd30b9dafa8e3f512b0393d#ecadf7fff837c148fbd30b9dafa8e3f512b0393d"
 dependencies = [
+ "aes",
  "apdu-dispatch",
  "ctaphid-dispatch",
  "interchange",
@@ -3768,10 +3817,14 @@ dependencies = [
  "rand_chacha",
  "rand_core",
  "trussed",
- "usb-device",
+ "usb-device 0.2.9",
+ "usb-device 0.3.2",
  "usbd-ccid",
  "usbd-ctaphid",
- "usbip-device",
+ "usbd-storage",
+ "usbip-device 0.1.5",
+ "usbip-device 0.2.0",
+ "xts-mode",
 ]
 
 [[package]]
@@ -3880,24 +3933,33 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1f6cc3adc849b5292b4075fc0d5fdcf2f24866e88e336dd27a8943090a520508"
 
+[[package]]
+name = "usb-device"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98816b1accafbb09085168b90f27e93d790b4bfa19d883466b5e53315b5f06a6"
+dependencies = [
+ "heapless 0.8.0",
+ "portable-atomic",
+]
+
 [[package]]
 name = "usbd-ccid"
 version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8acbc8d41fe1b6dc92347f5988a44252fc9e2511f7cb312fa23e9eee186bfdd3"
+source = "git+https://github.com/trussed-dev/usbd-ccid?rev=9912b35c5d7ad0253a60219c1555084eab3844d7#9912b35c5d7ad0253a60219c1555084eab3844d7"
 dependencies = [
  "delog",
  "embedded-time",
  "heapless 0.9.1",
  "interchange",
- "usb-device",
+ "usb-device 0.2.9",
+ "usb-device 0.3.2",
 ]
 
 [[package]]
 name = "usbd-ctaphid"
 version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c527a4840bcb38299924c7a6b0c31f95a89172bdfb4577c515315ce9b097f15a"
+source = "git+https://github.com/trussed-dev/usbd-ctaphid?rev=91ecf98c88b1a61276ebf3e77e65009bba3c4e17#91ecf98c88b1a61276ebf3e77e65009bba3c4e17"
 dependencies = [
  "ctaphid-dispatch",
  "delog",
@@ -3907,7 +3969,18 @@ dependencies = [
  "ref-swap",
  "serde",
  "trussed-core",
- "usb-device",
+ "usb-device 0.2.9",
+ "usb-device 0.3.2",
+]
+
+[[package]]
+name = "usbd-storage"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9596ded13538d5407d0cef1c2879d6e5d9038d6ba601aa9e90a7d08a21ba5215"
+dependencies = [
+ "num_enum",
+ "usb-device 0.3.2",
 ]
 
 [[package]]
@@ -3918,7 +3991,17 @@ checksum = "2e7a0b57d68d666cc85d8bfe8a32fb4196e8eb89b611658a0624af6428e7a2fd"
 dependencies = [
  "bitflags 1.3.2",
  "log",
- "usb-device",
+ "usb-device 0.2.9",
+]
+
+[[package]]
+name = "usbip-device"
+version = "0.2.0"
+source = "git+https://github.com/daringer/usbip-device?rev=ad359ae257e4bd931d9424732132cf085e0fac02#ad359ae257e4bd931d9424732132cf085e0fac02"
+dependencies = [
+ "bitflags 1.3.2",
+ "log",
+ "usb-device 0.3.2",
 ]
 
 [[package]]
@@ -4388,6 +4471,16 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
 
+[[package]]
+name = "xts-mode"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cbddb7545ca0b9ffa7bdc653e8743303e1712687a6918ced25f2cdbed42520"
+dependencies = [
+ "byteorder",
+ "cipher",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.0"
diff --git a/Cargo.toml b/Cargo.toml
index b1a012da..2cb0892c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,6 +24,12 @@ memory-regions = { path = "components/memory-regions" }
 # unreleased libraries
 p256-cortex-m4  = { git = "https://github.com/ycrypto/p256-cortex-m4.git", rev = "cdb31e12594b4dc1f045b860a885fdc94d96aee2" }
 
+# These carry the unreleased `usb-device-0-3` feature.
+lpc55-hal = { git = "https://github.com/lpc55/lpc55-hal", rev = "ad0b163bba8b884409e7da012fade5edde0d0375" }
+usbd-ccid = { git = "https://github.com/trussed-dev/usbd-ccid", rev = "9912b35c5d7ad0253a60219c1555084eab3844d7" }
+usbd-ctaphid = { git = "https://github.com/trussed-dev/usbd-ctaphid", rev = "91ecf98c88b1a61276ebf3e77e65009bba3c4e17" }
+trussed-usbip = { git = "https://github.com/trussed-dev/pc-usbip-runner", rev = "ecadf7fff837c148fbd30b9dafa8e3f512b0393d" }
+
 # applications
 admin-app = { git = "https://github.com/Nitrokey/admin-app.git", tag = "v0.1.0-nitrokey.22" }
 opcard = { git = "https://github.com/Nitrokey/opcard-rs", tag = "v1.7.0" }
diff --git a/components/apps/Cargo.toml b/components/apps/Cargo.toml
index efcb60e5..e8495aa2 100644
--- a/components/apps/Cargo.toml
+++ b/components/apps/Cargo.toml
@@ -16,7 +16,7 @@ se05x = { version = "0.4", optional = true}
 serde = { version = "1.0.180", default-features = false }
 trussed = { workspace = true, features = ["crypto-client", "filesystem-client", "management-client", "serde-extensions", "ui-client"] }
 trussed-core.workspace = true
-trussed-usbip = { version = "=0.1.0-rc.1", default-features = false, features = ["ctaphid"], optional = true }
+trussed-usbip = { version = "=0.1.0-rc.1", default-features = false, features = ["ctaphid", "usb-device-0-2"], optional = true }
 usbd-ctaphid = { version = "0.4", optional = true }
 utils = { path = "../utils" }
 if_chain = "1.0.2"
@@ -68,6 +68,9 @@ opcard = ["dep:opcard", "backend-rsa", "backend-auth", "trussed/aes256-cbc", "tr
 piv-authenticator = ["dep:piv-authenticator", "backend-rsa", "backend-auth", "trussed/aes256-cbc", "trussed/chacha8-poly1305", "trussed/ed255", "trussed/p256", "trussed/shared-secret", "trussed/tdes", "trussed/x255"]
 se050 = ["dep:se05x", "trussed-se050-backend", "trussed-se050-manage", "admin-app/se050"]
 
+# Build the USB classes against usb-device 0.3 instead of the default 0.2.
+"usb-device-0-3" = ["usbd-ctaphid?/usb-device-0-3", "trussed-usbip?/usb-device-0-3"]
+
 # backends
 backend-auth = ["trussed-auth", "trussed-auth-backend"]
 backend-rsa = ["trussed-rsa-alloc"]
diff --git a/components/boards/Cargo.toml b/components/boards/Cargo.toml
index 2c997636..8f062e71 100644
--- a/components/boards/Cargo.toml
+++ b/components/boards/Cargo.toml
@@ -26,9 +26,11 @@ ref-swap = "0.1.0"
 spi-memory = "0.2.0"
 trussed.workspace = true
 trussed-core.workspace = true
-usb-device = "0.2"
-usbd-ccid = "0.4"
-usbd-ctaphid = "0.4"
+# Selects the usb-device version; see the `usb_device` alias in src/lib.rs.
+usb-device-0-2 = { package = "usb-device", version = "0.2", optional = true }
+usb-device-0-3 = { package = "usb-device", version = "0.3.2", optional = true }
+usbd-ccid = { version = "0.4", default-features = false }
+usbd-ctaphid = { version = "0.4", default-features = false }
 utils = { path = "../utils" }
 
 # soc-lpc55
@@ -38,6 +40,8 @@ systick-monotonic = { version = "1.0.0", optional = true }
 
 # soc-nrf52
 embedded-storage = { version = "0.3", optional = true }
+# nrf52840-hal 0.15 re-exports nrf-usbd 0.1 (usb-device 0.2 only).
+nrf-usbd = { version = "0.3", optional = true }
 nrf52840-hal = { version = "0.15.1", optional = true }
 nrf52840-pac = { version = "0.11", optional = true }
 
@@ -60,6 +64,22 @@ trussed-manage = "0.3.0"
 littlefs2-core = { version = "0.1", features = ["debug-error"] }
 
 [features]
+# The bus and both class drivers must resolve to the same usb-device version.
+default = ["usb-device-0-2"]
+"usb-device-0-2" = [
+    "dep:usb-device-0-2",
+    "usbd-ccid/usb-device-0-2",
+    "usbd-ctaphid/usb-device-0-2",
+    "lpc55-hal?/usb-device-0-2",
+]
+"usb-device-0-3" = [
+    "dep:usb-device-0-3",
+    "usbd-ccid/usb-device-0-3",
+    "usbd-ctaphid/usb-device-0-3",
+    "lpc55-hal?/usb-device-0-3",
+    "dep:nrf-usbd",
+]
+
 board-nk3am = ["soc-nrf52", "lfs-backup", "se05x/embedded-hal-v0.2.7"]
 board-nk3xn = ["soc-lpc55", "fm11nc08", "utils/storage", "se05x/embedded-hal-v0.2.7"]
 board-nkpk = ["board-nk3am", "utils/storage"]
diff --git a/components/boards/src/init.rs b/components/boards/src/init.rs
index dc550c1d..4369306e 100644
--- a/components/boards/src/init.rs
+++ b/components/boards/src/init.rs
@@ -6,6 +6,10 @@ use apdu_dispatch::{
 use apps::AUTH_LOCATION;
 use apps::{AdminData, ClientBuilder, Data, Dispatch, Endpoints, FidoData, InitStatus};
 
+use crate::usb_device::{
+    bus::UsbBusAllocator,
+    device::{UsbDevice, UsbDeviceBuilder, UsbVidPid},
+};
 use ctaphid_dispatch::Channel as CtapChannel;
 #[cfg(not(feature = "no-delog"))]
 use delog::delog;
@@ -16,10 +20,6 @@ use rand_chacha::ChaCha8Rng;
 use ref_swap::OptionRefSwap;
 use trussed::store::Store as _;
 use trussed_core::InterruptFlag;
-use usb_device::{
-    bus::UsbBusAllocator,
-    device::{UsbDevice, UsbDeviceBuilder, UsbVidPid},
-};
 use usbd_ccid::Ccid;
 use usbd_ctaphid::CtapHid;
 use utils::Version;
@@ -131,6 +131,46 @@ const CARD_ISSUER: &[u8; 13] = b"Nitrokey\0\0\0\0\0";
 const USB_MANUFACTURER: &str = "Nitrokey";
 const USB_VENDOR_ID: u16 = 0x20A0;
 
+#[cfg(not(feature = "usb-device-0-3"))]
+fn build_usb_device<'a, B: crate::usb_device::bus::UsbBus>(
+    usb_bus: &'a UsbBusAllocator<B>,
+    usb_product: &'a str,
+    usb_product_id: u16,
+    version: Version,
+) -> UsbDevice<'a, B> {
+    UsbDeviceBuilder::new(usb_bus, UsbVidPid(USB_VENDOR_ID, usb_product_id))
+        .product(usb_product)
+        .manufacturer(USB_MANUFACTURER)
+        .device_release(version.usb_release())
+        .max_packet_size_0(64)
+        .composite_with_iads()
+        .build()
+}
+
+/// usb-device 0.3 replaced the string setters with `strings()` and returns `Result`.
+#[cfg(feature = "usb-device-0-3")]
+fn build_usb_device<'a, B: crate::usb_device::bus::UsbBus>(
+    usb_bus: &'a UsbBusAllocator<B>,
+    usb_product: &'a str,
+    usb_product_id: u16,
+    version: Version,
+) -> UsbDevice<'a, B> {
+    use crate::usb_device::prelude::{LangID, StringDescriptors};
+
+    let strings = StringDescriptors::new(LangID::EN)
+        .manufacturer(USB_MANUFACTURER)
+        .product(usb_product);
+
+    UsbDeviceBuilder::new(usb_bus, UsbVidPid(USB_VENDOR_ID, usb_product_id))
+        .strings(&[strings])
+        .expect("failed to set USB string descriptors")
+        .device_release(version.usb_release())
+        .max_packet_size_0(64)
+        .expect("invalid max packet size for EP0")
+        .composite_with_iads()
+        .build()
+}
+
 pub fn init_usb_nfc<B: Board>(
     resources: &'static mut UsbResources<B>,
     usb_bus: Option<UsbBusAllocator<<B::Soc as Soc>::UsbBus>>,
@@ -165,14 +205,7 @@ pub fn init_usb_nfc<B: Board>(
             .implements_ctap2()
             .implements_wink();
 
-        let vidpid = UsbVidPid(USB_VENDOR_ID, usb_product_id);
-        let usbd = UsbDeviceBuilder::new(usb_bus, vidpid)
-            .product(usb_product)
-            .manufacturer(USB_MANUFACTURER)
-            .device_release(version.usb_release())
-            .max_packet_size_0(64)
-            .composite_with_iads()
-            .build();
+        let usbd = build_usb_device(usb_bus, usb_product, usb_product_id, version);
 
         UsbClasses {
             usbd,
diff --git a/components/boards/src/lib.rs b/components/boards/src/lib.rs
index 5a6e6758..18adffeb 100644
--- a/components/boards/src/lib.rs
+++ b/components/boards/src/lib.rs
@@ -3,6 +3,15 @@
 
 delog::generate_macros!();
 
+// The selected `usb-device` version; 0.3 wins if both features are enabled.
+#[cfg(all(feature = "usb-device-0-2", not(feature = "usb-device-0-3")))]
+pub use usb_device_0_2 as usb_device;
+#[cfg(feature = "usb-device-0-3")]
+pub use usb_device_0_3 as usb_device;
+
+#[cfg(not(any(feature = "usb-device-0-2", feature = "usb-device-0-3")))]
+compile_error!("No usb-device version chosen! Enable `usb-device-0-2` or `usb-device-0-3`.");
+
 use cortex_m_rt::ExceptionFrame;
 
 pub mod flash;
diff --git a/components/boards/src/soc.rs b/components/boards/src/soc.rs
index 35c2442e..d6a37529 100644
--- a/components/boards/src/soc.rs
+++ b/components/boards/src/soc.rs
@@ -1,6 +1,6 @@
+use crate::usb_device::bus::UsbBus;
 use cortex_m::interrupt::InterruptNumber;
 use embedded_time::duration::Milliseconds;
-use usb_device::bus::UsbBus;
 
 use apps::{Reboot, Variant};
 
diff --git a/components/boards/src/soc/nrf52.rs b/components/boards/src/soc/nrf52.rs
index dcfe1bc3..efa6d4d8 100644
--- a/components/boards/src/soc/nrf52.rs
+++ b/components/boards/src/soc/nrf52.rs
@@ -1,7 +1,8 @@
 use apps::Variant;
+#[cfg(not(feature = "usb-device-0-3"))]
+use nrf52840_hal::usbd::{UsbPeripheral, Usbd};
 use nrf52840_hal::{
     clocks::Clocks,
-    usbd::{UsbPeripheral, Usbd},
     wdt::{self, count::One, handles::Hdl0, Watchdog, WatchdogHandle},
 };
 use nrf52840_pac::{power::RESETREAS, Interrupt, SCB, WDT};
@@ -13,12 +14,26 @@ use rtic_monotonic::{RtcDuration, RtcMonotonic};
 pub mod flash;
 pub mod rtic_monotonic;
 
+/// nrf-usbd 0.3's `UsbPeripheral` is a trait, not a struct owning the peripheral.
+#[cfg(feature = "usb-device-0-3")]
+pub struct Peripheral;
+
+// SAFETY: only constructed in `build_usb_bus`, which takes the one USBD token,
+// so nothing else can be driving this register block.
+#[cfg(feature = "usb-device-0-3")]
+unsafe impl nrf_usbd::UsbPeripheral for Peripheral {
+    const REGISTERS: *const () = nrf52840_pac::USBD::ptr() as *const ();
+}
+
 pub struct Nrf52 {
     uuid: Uuid,
 }
 
 impl Soc for Nrf52 {
+    #[cfg(not(feature = "usb-device-0-3"))]
     type UsbBus = Usbd<UsbPeripheral<'static>>;
+    #[cfg(feature = "usb-device-0-3")]
+    type UsbBus = nrf_usbd::Usbd<Peripheral>;
     type Clock = RtcMonotonic;
 
     type Duration = RtcDuration;
@@ -107,7 +122,7 @@ pub type UsbClockType = Clocks<
     nrf52840_hal::clocks::Internal,
     nrf52840_hal::clocks::LfOscStarted,
 >;
-type UsbBusType = usb_device::bus::UsbBusAllocator<<Nrf52 as Soc>::UsbBus>;
+type UsbBusType = crate::usb_device::bus::UsbBusAllocator<<Nrf52 as Soc>::UsbBus>;
 
 pub fn setup_usb_bus(
     static_usb_clock: &'static mut Option<UsbClockType>,
@@ -129,9 +144,22 @@ pub fn setup_usb_bus(
             .set_bit()
     });
 
+    build_usb_bus(usb_pac, usb_clock)
+}
+
+#[cfg(not(feature = "usb-device-0-3"))]
+fn build_usb_bus(usb_pac: nrf52840_pac::USBD, usb_clock: &'static UsbClockType) -> UsbBusType {
     Usbd::new(UsbPeripheral::new(usb_pac, usb_clock))
 }
 
+/// nrf-usbd 0.3 addresses the registers statically; the token only proves ownership.
+#[cfg(feature = "usb-device-0-3")]
+fn build_usb_bus(usb_pac: nrf52840_pac::USBD, _usb_clock: &'static UsbClockType) -> UsbBusType {
+    drop(usb_pac);
+    // nrf-usbd 0.1 returned a ready-made allocator; 0.3 returns the bus itself.
+    crate::usb_device::bus::UsbBusAllocator::new(nrf_usbd::Usbd::new(Peripheral))
+}
+
 #[derive(Debug)]
 pub struct ResetReason {
     pub resetpin: bool,
diff --git a/components/boards/src/store.rs b/components/boards/src/store.rs
index faab9163..f2183f8d 100644
--- a/components/boards/src/store.rs
+++ b/components/boards/src/store.rs
@@ -282,6 +282,7 @@ fn init_vfs(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::usb_device::bus::UsbBus;
     use crate::{
         soc::Soc,
         ui::{buttons::UserPresence, rgb_led::RgbLed, Clock},
@@ -291,7 +292,6 @@ mod tests {
     use embedded_time::duration::Milliseconds;
     use littlefs2::{path, path::PathBuf};
     use nfc_device::traits::nfc::{Device as NfcDevice, Error as NfcError, State as NfcState};
-    use usb_device::bus::UsbBus;
 
     struct TestBoard<EfsStorage> {
         __: PhantomData<EfsStorage>,
@@ -352,12 +352,12 @@ mod tests {
     impl UsbBus for DummyUsbBus {
         fn alloc_ep(
             &mut self,
-            _ep_dir: usb_device::UsbDirection,
-            _ep_addr: Option<usb_device::endpoint::EndpointAddress>,
-            _ep_type: usb_device::endpoint::EndpointType,
+            _ep_dir: crate::usb_device::UsbDirection,
+            _ep_addr: Option<crate::usb_device::endpoint::EndpointAddress>,
+            _ep_type: crate::usb_device::endpoint::EndpointType,
             _max_packet_size: u16,
             _interval: u8,
-        ) -> usb_device::Result<usb_device::endpoint::EndpointAddress> {
+        ) -> crate::usb_device::Result<crate::usb_device::endpoint::EndpointAddress> {
             unimplemented!()
         }
         fn enable(&mut self) {
@@ -374,25 +374,29 @@ mod tests {
 
         fn write(
             &self,
-            _ep_addr: usb_device::endpoint::EndpointAddress,
+            _ep_addr: crate::usb_device::endpoint::EndpointAddress,
             _buf: &[u8],
-        ) -> usb_device::Result<usize> {
+        ) -> crate::usb_device::Result<usize> {
             unimplemented!()
         }
 
         fn read(
             &self,
-            _ep_addr: usb_device::endpoint::EndpointAddress,
+            _ep_addr: crate::usb_device::endpoint::EndpointAddress,
             _buf: &mut [u8],
-        ) -> usb_device::Result<usize> {
+        ) -> crate::usb_device::Result<usize> {
             unimplemented!()
         }
 
-        fn set_stalled(&self, _ep_addr: usb_device::endpoint::EndpointAddress, _stalled: bool) {
+        fn set_stalled(
+            &self,
+            _ep_addr: crate::usb_device::endpoint::EndpointAddress,
+            _stalled: bool,
+        ) {
             unimplemented!()
         }
 
-        fn is_stalled(&self, _ep_addr: usb_device::endpoint::EndpointAddress) -> bool {
+        fn is_stalled(&self, _ep_addr: crate::usb_device::endpoint::EndpointAddress) -> bool {
             unimplemented!()
         }
 
@@ -404,7 +408,7 @@ mod tests {
             unimplemented!()
         }
 
-        fn poll(&self) -> usb_device::bus::PollResult {
+        fn poll(&self) -> crate::usb_device::bus::PollResult {
             unimplemented!()
         }
     }
diff --git a/runners/embedded/Cargo.toml b/runners/embedded/Cargo.toml
index cbb44c0d..09e9c105 100644
--- a/runners/embedded/Cargo.toml
+++ b/runners/embedded/Cargo.toml
@@ -11,7 +11,7 @@ license = "MIT"
 [dependencies]
 ### base dependencies
 apps = { path = "../../components/apps", features = ["nk3"] }
-boards = { path = "../../components/boards", features = ["trussed-auth"] }
+boards = { path = "../../components/boards", default-features = false, features = ["trussed-auth"] }
 delog = "0.1"
 cortex-m = { version = "0.7", features = ["critical-section-single-core"]}
 cortex-m-rt = "0.7.5"
@@ -30,8 +30,7 @@ trussed.workspace = true
 trussed-core.workspace = true
 interchange = "0.3"
 
-### usb machinery
-usb-device = "0.2"
+### usb machinery comes via `boards::usb_device`, to keep the versions in sync.
 
 ### NRF52 specific dependencies
 nrf52840-hal = { version = "0.15.1", optional = true }
@@ -55,7 +54,11 @@ serde = { version = "1", features = ["derive"] }
 utils = { path = "../../components/utils", features = ["build"] }
 
 [features]
-default = ["alloc"]
+default = ["alloc", "usb-device-0-2"]
+
+# `boards` is taken without defaults so asking for 0.3 does not drag in 0.2.
+"usb-device-0-2" = ["boards/usb-device-0-2"]
+"usb-device-0-3" = ["boards/usb-device-0-3", "apps/usb-device-0-3"]
 
 test = ["apps/nk3-test", "utils/test"]
 develop = ["no-encrypted-storage", "apps/no-reset-time-window", "log-traceP"]
diff --git a/runners/embedded/src/lib.rs b/runners/embedded/src/lib.rs
index 39ddc832..928483c6 100644
--- a/runners/embedded/src/lib.rs
+++ b/runners/embedded/src/lib.rs
@@ -2,13 +2,13 @@
 #![warn(trivial_casts, unused, unused_qualifications)]
 
 use apdu_dispatch::interchanges::Responder as CcidResponder;
+use boards::usb_device::bus::UsbBusAllocator;
 use boards::{
     init::{UsbNfc, UsbResources},
     soc::Soc,
     Board,
 };
 use nfc_device::Iso14443;
-use usb_device::bus::UsbBusAllocator;
 use utils::Version;
 
 delog::generate_macros!();
diff --git a/runners/embedded/src/nk3xn/init.rs b/runners/embedded/src/nk3xn/init.rs
index 11696c21..f207eee5 100644
--- a/runners/embedded/src/nk3xn/init.rs
+++ b/runners/embedded/src/nk3xn/init.rs
@@ -69,7 +69,7 @@ use {boards::nk3xn::TimerDelay, se05x::embedded_hal::Hal027};
 
 use crate::{VERSION, VERSION_STRING};
 
-type UsbBusType = usb_device::bus::UsbBusAllocator<<Lpc55 as Soc>::UsbBus>;
+type UsbBusType = boards::usb_device::bus::UsbBusAllocator<<Lpc55 as Soc>::UsbBus>;
 
 pub type WwdtEnabled = wwdt::Active;
 pub type WwdtResetting = wwdt::Active;
diff --git a/runners/nkpk/Cargo.toml b/runners/nkpk/Cargo.toml
index 770dca2a..70d24623 100644
--- a/runners/nkpk/Cargo.toml
+++ b/runners/nkpk/Cargo.toml
@@ -8,7 +8,7 @@ authors = ["Nitrokey GmbH <info@nitrokey.com>"]
 [dependencies]
 apdu-dispatch = "0.4"
 apps = { path = "../../components/apps", features = ["nkpk"] }
-boards = { path = "../../components/boards", features = ["board-nkpk"] }
+boards = { path = "../../components/boards", default-features = false, features = ["board-nkpk"] }
 cortex-m = { version = "0.7", features = ["critical-section-single-core"]}
 cortex-m-rtic = "1.0"
 ctaphid-dispatch = "0.4"
@@ -24,6 +24,12 @@ memory-regions = "1"
 utils = { path = "../../components/utils", features = ["build"] }
 
 [features]
+default = ["usb-device-0-2"]
+
+# `boards` is taken without defaults so asking for 0.3 does not drag in 0.2.
+"usb-device-0-2" = ["boards/usb-device-0-2"]
+"usb-device-0-3" = ["boards/usb-device-0-3", "apps/usb-device-0-3"]
+
 log-all = ["boards/log-all"]
 log-trace = []
 log-debug = []
diff --git a/runners/usbip/Cargo.toml b/runners/usbip/Cargo.toml
index 68280a3c..2c63a5b9 100644
--- a/runners/usbip/Cargo.toml
+++ b/runners/usbip/Cargo.toml
@@ -19,7 +19,7 @@ rand_core = { version = "0.6.4", features = ["getrandom"] }
 signal-hook = { version = "0.3.17", default-features = false }
 trussed.workspace = true
 trussed-core.workspace = true
-trussed-usbip = { version = "=0.1.0-rc.1", default-features = false, features = ["ctaphid"] }
+trussed-usbip = { version = "=0.1.0-rc.1", default-features = false, features = ["ctaphid", "usb-device-0-2"] }
 utils = { path = "../../components/utils", features = ["log-all"] }
 
 [build-dependencies]
@@ -29,3 +29,9 @@ utils = { path = "../../components/utils", features = ["build"] }
 test = ["apps/nk3-test"]
 provisioner = ["apps/nk3-provisioner"]
 ccid = ["apps/trussed-usbip-ccid", "trussed-usbip/ccid"]
+
+# Build against usb-device 0.3.
+usb-device-0-3 = ["trussed-usbip/usb-device-0-3", "apps/usb-device-0-3"]
+
+# SCSI block device over USB/IP
+usb-storage = ["trussed-usbip/storage", "usb-device-0-3"]
diff --git a/runners/usbip/src/main.rs b/runners/usbip/src/main.rs
index 760c431f..315bb370 100644
--- a/runners/usbip/src/main.rs
+++ b/runners/usbip/src/main.rs
@@ -42,6 +42,11 @@ struct Args {
     #[clap(short, long)]
     efs: Option<PathBuf>,
 
+    /// Path for persistant block-device-in-file, `None` means in RAM
+    #[cfg(feature = "usb-storage")]
+    #[clap(short, long)]
+    block_device: Option<PathBuf>,
+
     /// User presence check mechanism.
     ///
     /// The interactive option shows a prompt on stderr requesting consent from the user.  Note
@@ -142,6 +147,10 @@ fn main() {
         serial_number: None,
         vid: VID,
         pid: PID,
+        #[cfg(feature = "usb-storage")]
+        block_device: args.block_device,
+        #[cfg(feature = "usb-storage")]
+        block_device_key: Some(*b"12_123456789_123456789_123456789"),
     };
 
     let store = store::init(args.ifs, args.efs);
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index b36240c6..2cc840a6 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.88.0"
+channel = "1.96.0"
 components = ["rustfmt", "llvm-tools-preview", "clippy"]
 targets = ["thumbv7em-none-eabihf", "thumbv8m.main-none-eabi"]