diff --git a/site/docs/install/t1650.md b/site/docs/install/t1650.md
index 3228d5b..91ab489 100644
--- a/site/docs/install/t1650.md
+++ b/site/docs/install/t1650.md
@@ -40,7 +40,7 @@ P*: Partially works with blobs
 
 | ***Features***                                    |    |
 |---------------------------------------------------|----|
-| **Internal flashing with original boot firmware** | ?  |
+| **Internal flashing with original boot firmware** | W*  |
 | **Display (if Intel GPU)**                        | W+ |
 | **Display (discrete CPU, SeaBIOS payload only)**  | W* |
 | **Audio**                                         | W+ |
@@ -133,6 +133,21 @@ Flash a ROM image (software)
 If you're already running Libreboot, and you don't have flash protection
 turned on, [internal flashing](../install/) is possible.
 
+Internal flashing is *also* possible from the factory BIOS, if you set the
+service mode jumper. This shorts `HDA_SDO` (Soft Descriptor Override), which
+disables the ME after early bringup and disables IFD-based flash protections.
+
+Observe, below the PCI slots:
+
+<img tabindex=1 src="https://av.libreboot.org/t1650/t1650_motherboard.jpg" /><span class="f"><img src="https://av.libreboot.org/t1650/t1650_motherboard.jpg" /></span>
+
+Here is a close-up:
+
+<img tabindex=1 src="https://av.libreboot.org/t1650/t1650_service_mode.jpg" /><span class="f"><img src="https://av.libreboot.org/t1650/t1650_service_mode.jpg" /></span>
+
+Simply short those pins, on the header, using a jumper. When you do this, all
+flash protections will be disabled.
+
 Flash a ROM image (hardware)
 -----------------