diff --git a/runner/src/elf2tab.rs b/runner/src/elf2tab.rs
index c07d6034..2ac73c76 100644
--- a/runner/src/elf2tab.rs
+++ b/runner/src/elf2tab.rs
@@ -33,11 +33,9 @@ pub fn convert_elf(cli: &Cli, platform: &str) -> OutFiles {
     let package_name = cli.elf.file_stem().expect("ELF must be a file");
     let mut tab_path = cli.elf.clone();
     tab_path.set_extension("tab");
-    let protected_size = TBF_HEADER_SIZE.to_string();
     if cli.verbose {
         println!("Package name: {:?}", package_name);
         println!("TAB path: {}", tab_path.display());
-        println!("Protected region size: {}", protected_size);
     }
     let stack_size = read_stack_size(cli);
     let elf = cli.elf.as_os_str();
@@ -71,7 +69,6 @@ pub fn convert_elf(cli: &Cli, platform: &str) -> OutFiles {
         "--kernel-minor".as_ref(), "0".as_ref(),
         "-n".as_ref(), package_name,
         "-o".as_ref(), tab_path.as_os_str(),
-        "--protected-region-size".as_ref(), protected_size.as_ref(),
         "--stack".as_ref(), stack_size.as_ref(),
         format!("{},{}", elf.to_str().unwrap(), architecture).as_ref(),
     ]);
@@ -113,11 +110,6 @@ pub struct OutFiles {
     pub tbf_path: PathBuf,
 }
 
-// The amount of space to reserve for the TBF header. This must match the
-// TBF_HEADER_SIZE value in the layout file for the platform, which is currently
-// 0x60 for all platforms.
-const TBF_HEADER_SIZE: u32 = 0x60;
-
 // Reads the stack size, and returns it as a String for use on elf2tab's command
 // line.
 fn read_stack_size(cli: &Cli) -> String {
diff --git a/runtime/layouts/apollo3.ld b/runtime/layouts/apollo3.ld
index cfa7831c..aa1ab716 100644
--- a/runtime/layouts/apollo3.ld
+++ b/runtime/layouts/apollo3.ld
@@ -1,9 +1,11 @@
 /* Layout for the Apollo3 MCU, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00040000, LENGTH = 0x00060000
-  RAM   (W) : ORIGIN = 0x10002000, LENGTH = 0x2000
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00040000;
+FLASH_LENGTH = 0x00060000;
+
+RAM_START = 0x10002000;
+RAM_LENGTH = 0x2000;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/clue_nrf52840.ld b/runtime/layouts/clue_nrf52840.ld
index 8e327e1c..46c06610 100644
--- a/runtime/layouts/clue_nrf52840.ld
+++ b/runtime/layouts/clue_nrf52840.ld
@@ -1,9 +1,11 @@
 /* Layout for the micro:bit v2 board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00080000, LENGTH = 512K
-  RAM (W) : ORIGIN = 0x20006000, LENGTH = 216K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00080000;
+FLASH_LENGTH = 512K;
+
+RAM_START = 0x20006000;
+RAM_LENGTH = 216K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/esp32_c3_devkitm_1.ld b/runtime/layouts/esp32_c3_devkitm_1.ld
index 99fed335..a2aa5c40 100644
--- a/runtime/layouts/esp32_c3_devkitm_1.ld
+++ b/runtime/layouts/esp32_c3_devkitm_1.ld
@@ -1,12 +1,11 @@
 /* Layout for the esp32c3 DevKit M1 board, used by the examples in this repository. */
 
-MEMORY {
-  /* Note that the SRAM address may need to be changed depending on
-   * the kernel binary, check for the actual address of APP_MEMORY!
-   */
-  FLASH (X) : ORIGIN = 0x403B0000, LENGTH = 0x30000
-  RAM   (W) : ORIGIN = 0x3FCA1800, LENGTH = 0x2E800
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x403B0000;
+FLASH_LENGTH = 0x30000;
+
+RAM_START = 0x3FCA2000;
+RAM_LENGTH = 0x2E000;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/hail.ld b/runtime/layouts/hail.ld
index 6c94342f..8e8a790b 100644
--- a/runtime/layouts/hail.ld
+++ b/runtime/layouts/hail.ld
@@ -1,9 +1,11 @@
 /* Layout for the Hail board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00030000, LENGTH = 0x00040000
-  RAM   (W) : ORIGIN = 0x20008000, LENGTH = 62K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00030000;
+FLASH_LENGTH = 0x00040000;
+
+RAM_START = 0x20008000;
+RAM_LENGTH = 62K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/hifive1.ld b/runtime/layouts/hifive1.ld
index 90029c8e..de02227e 100644
--- a/runtime/layouts/hifive1.ld
+++ b/runtime/layouts/hifive1.ld
@@ -1,12 +1,11 @@
 /* Layout for the RISC-V 32 boards, used by the examples in this repository. */
 
-MEMORY {
-  /* Note that the SRAM address may need to be changed depending on
-   * the kernel binary, check for the actual address of APP_MEMORY!
-   */
-  FLASH (X) : ORIGIN = 0x20040000, LENGTH = 32M
-  RAM   (W) : ORIGIN = 0x80002800, LENGTH = 0x1800
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x20040000;
+FLASH_LENGTH = 32M;
+
+RAM_START = 0x80003000;
+RAM_LENGTH = 0x1000;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/imix.ld b/runtime/layouts/imix.ld
index e97fd993..2b88e8c7 100644
--- a/runtime/layouts/imix.ld
+++ b/runtime/layouts/imix.ld
@@ -1,9 +1,11 @@
 /* Layout for the Imix board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00040000, LENGTH = 0x00040000
-  RAM   (W) : ORIGIN = 0x20008000, LENGTH = 62K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00040000;
+FLASH_LENGTH = 0x00040000;
+
+RAM_START = 0x20008000;
+RAM_LENGTH = 62K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/imxrt1050.ld b/runtime/layouts/imxrt1050.ld
index 79dccd2a..e4c6bfe2 100644
--- a/runtime/layouts/imxrt1050.ld
+++ b/runtime/layouts/imxrt1050.ld
@@ -1,9 +1,11 @@
 /* Layout for the iMX.RT1050 board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x63002000, LENGTH = 0x1000000
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 112K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x63002000;
+FLASH_LENGTH = 0x1000000;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 112K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/microbit_v2.ld b/runtime/layouts/microbit_v2.ld
index 684810e2..d5a3f387 100644
--- a/runtime/layouts/microbit_v2.ld
+++ b/runtime/layouts/microbit_v2.ld
@@ -1,9 +1,11 @@
 /* Layout for the micro:bit v2 board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00040000, LENGTH = 256K
-  RAM (W) : ORIGIN = 0x20004000, LENGTH = 112K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00040000;
+FLASH_LENGTH = 256K;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 112K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/msp432.ld b/runtime/layouts/msp432.ld
index 5b6ee70e..3ffb351b 100644
--- a/runtime/layouts/msp432.ld
+++ b/runtime/layouts/msp432.ld
@@ -1,7 +1,9 @@
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00020000, LENGTH = 0x00020000
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 0x2000
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00020000;
+FLASH_LENGTH = 0x00020000;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 0x2000;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/nano_rp2040_connect.ld b/runtime/layouts/nano_rp2040_connect.ld
index 9da1b21e..2ee8b5a3 100644
--- a/runtime/layouts/nano_rp2040_connect.ld
+++ b/runtime/layouts/nano_rp2040_connect.ld
@@ -1,9 +1,11 @@
 /* Layout for the Raspberry Pi Pico board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x10020000, LENGTH = 256K
-  RAM (W) : ORIGIN = 0x20004000, LENGTH = 248K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x10020000;
+FLASH_LENGTH = 256K;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 248K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/nrf52.ld b/runtime/layouts/nrf52.ld
index 0bb3bcf3..e4accb52 100644
--- a/runtime/layouts/nrf52.ld
+++ b/runtime/layouts/nrf52.ld
@@ -1,9 +1,11 @@
 /* Layout for the nRF52-DK, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00030000, LENGTH = 0x00060000
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 62K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00030000;
+FLASH_LENGTH = 0x00060000;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 62K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/nrf52840.ld b/runtime/layouts/nrf52840.ld
index 8a0ac723..fd100c14 100644
--- a/runtime/layouts/nrf52840.ld
+++ b/runtime/layouts/nrf52840.ld
@@ -1,9 +1,11 @@
 /* Layout for the nRF52840-DK, usable by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x00030000, LENGTH = 0x000D0000
-  RAM   (W) : ORIGIN = 0x20008000, LENGTH = 46K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x00030000;
+FLASH_LENGTH = 0x000D0000;
+
+RAM_START = 0x20008000;
+RAM_LENGTH = 46K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/nucleo_f429zi.ld b/runtime/layouts/nucleo_f429zi.ld
index 2c0c14b1..2bdee3cb 100644
--- a/runtime/layouts/nucleo_f429zi.ld
+++ b/runtime/layouts/nucleo_f429zi.ld
@@ -1,9 +1,11 @@
 /* Layout for the Nucleo F429zi, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x08040000, LENGTH = 255K
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 112K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x08040000;
+FLASH_LENGTH = 255K;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 112K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/nucleo_f446re.ld b/runtime/layouts/nucleo_f446re.ld
index d2d4adca..5dea1e60 100644
--- a/runtime/layouts/nucleo_f446re.ld
+++ b/runtime/layouts/nucleo_f446re.ld
@@ -1,9 +1,11 @@
 /* Layout for the Nucleo F446re, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x08040000, LENGTH = 255K
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 176K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x08040000;
+FLASH_LENGTH = 255K;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 176K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/opentitan.ld b/runtime/layouts/opentitan.ld
index 56ec523f..725810fe 100644
--- a/runtime/layouts/opentitan.ld
+++ b/runtime/layouts/opentitan.ld
@@ -1,12 +1,11 @@
 /* Layout for the RISC-V 32 boards, used by the examples in this repository. */
 
-MEMORY {
-  /* Note that the SRAM address may need to be changed depending on
-   * the kernel binary, check for the actual address of APP_MEMORY!
-   */
-  FLASH (X) : ORIGIN = 0x20030000, LENGTH = 32M
-  RAM   (W) : ORIGIN = 0x10004000, LENGTH = 512K
-}
-
-TBF_HEADER_SIZE = 0x60;
+TBF_HEADER_SIZE = 0x80;
+
+FLASH_START = 0x20030000;
+FLASH_LENGTH = 32M;
+
+RAM_START = 0x10005000;
+RAM_LENGTH = 512K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/raspberry_pi_pico.ld b/runtime/layouts/raspberry_pi_pico.ld
index db49943d..b4d1f7b5 100644
--- a/runtime/layouts/raspberry_pi_pico.ld
+++ b/runtime/layouts/raspberry_pi_pico.ld
@@ -1,9 +1,11 @@
 /* Layout for the Raspberry Pi Pico board, used by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x10040000, LENGTH = 256K
-  RAM (W) : ORIGIN = 0x20011800, LENGTH = 194K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x10040000;
+FLASH_LENGTH = 256K;
+
+RAM_START = 0x20012000;
+RAM_LENGTH = 192K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/stm32f3discovery.ld b/runtime/layouts/stm32f3discovery.ld
index 0790331f..5e4cee1a 100644
--- a/runtime/layouts/stm32f3discovery.ld
+++ b/runtime/layouts/stm32f3discovery.ld
@@ -1,9 +1,11 @@
 /* Layout for the stm32f3discovery board, usable by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x08020000, LENGTH = 0x00020000
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 48K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x08020000;
+FLASH_LENGTH = 0x00020000;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 48K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/layouts/stm32f412gdiscovery.ld b/runtime/layouts/stm32f412gdiscovery.ld
index c1540da3..cc41a7c2 100644
--- a/runtime/layouts/stm32f412gdiscovery.ld
+++ b/runtime/layouts/stm32f412gdiscovery.ld
@@ -1,9 +1,11 @@
 /* Layout for the stm32f412gdiscovery board, usable by the examples in this repository. */
 
-MEMORY {
-  FLASH (X) : ORIGIN = 0x08030000, LENGTH = 256K
-  RAM   (W) : ORIGIN = 0x20004000, LENGTH = 112K
-}
-
 TBF_HEADER_SIZE = 0x60;
+
+FLASH_START = 0x08030000;
+FLASH_LENGTH = 256K;
+
+RAM_START = 0x20004000;
+RAM_LENGTH = 112K;
+
 INCLUDE libtock_layout.ld
diff --git a/runtime/libtock_layout.ld b/runtime/libtock_layout.ld
index e68a5cef..39eb5ef8 100644
--- a/runtime/libtock_layout.ld
+++ b/runtime/libtock_layout.ld
@@ -6,18 +6,22 @@
  * This layout should be included by a script that defines the FLASH and RAM
  * regions for the board as well as TBF_HEADER_SIZE. Here is a an example
  * process binary linker script to get started:
- *     MEMORY {
- *         FLASH (X) : ORIGIN = 0x10000, LENGTH = 0x10000
- *         RAM   (W) : ORIGIN = 0x20000, LENGTH = 0x10000
- *     }
+ *
  *     TBF_HEADER_SIZE = 0x60;
+ *
+ *     FLASH_START = 0x10000;
+ *     FLASH_LENGTH = 0x10000;
+ *
+ *     RAM_START = 0x20000;
+ *     RAM_LENGTH = 0x10000;
+ *
  *     INCLUDE ../libtock-rs/layout.ld
  *
- * FLASH refers to the area the process binary occupies in flash, including TBF
- * headers. RAM refers to the area the process will have access to in memory.
- * STACK_SIZE is the size of the process' stack (this layout file may round the
- * stack size up for alignment purposes). TBF_HEADER_SIZE must correspond to the
- * --protected-region-size flag passed to elf2tab.
+ * FLASH refers to the area the process binary occupies in flash (including the
+ * TBF headers, so FLASH_START refers to the TBF load address). RAM refers to
+ * the area the process will have access to in memory. STACK_SIZE is the size of
+ * the process' stack (this layout file may round the stack size up for
+ * alignment purposes).
  *
  * This places the flash sections in the following order:
  *     1. .rt_header -- Constants used by runtime initialization.
@@ -32,6 +36,11 @@
  *     3. .bss   -- Zero-initialized read-write global data.
  *     4. Heap   -- The heap (optional) comes after .bss and grows upwards to
  *                  the process break.
+ *
+ * TBF_HEADER_SIZE is further used internally in the included `layout.ld` file
+ * to set the `tbf_protected_region_size` symbol. elf2tab will thus prepend TBF
+ * headers and an optional padding such that the final binary matches the
+ * intended app load address (0x10000 in the above example).
  */
 
 /* TODO: Should TBF_HEADER_SIZE be configured via a similar mechanism to the
@@ -49,31 +58,38 @@
  * to warn users that the linker may be misbehaved under these conditions.
  */
 PROVIDE(LIBTOCKRS_OVERRIDE_RAM_ORIGIN_CHECK = 0);
-ASSERT(LIBTOCKRS_OVERRIDE_RAM_ORIGIN_CHECK == 1 || ORIGIN(RAM) % 0x1000 == 0, "
+ASSERT(LIBTOCKRS_OVERRIDE_RAM_ORIGIN_CHECK == 1 || RAM_START % 0x1000 == 0, "
 Start of RAM region must be well-aligned to a 4kB boundary for LLVM's lld to
 work. Refer to https://github.com/tock/libtock-rs/pull/477 for more
 information. Set LIBTOCKRS_OVERRIDE_RAM_ORIGIN_CHECK = 1 to override this check
 (e.g., when using a different linker).");
 
+MEMORY {
+  FLASH (X) : ORIGIN = FLASH_START + TBF_HEADER_SIZE, LENGTH = FLASH_LENGTH - TBF_HEADER_SIZE
+  RAM   (W) : ORIGIN = RAM_START                    , LENGTH = RAM_LENGTH
+}
+
 /* GNU LD looks for `start` as an entry point by default, while LLVM's LLD looks
  * for `_start`. To be compatible with both, we manually specify an entry point.
  */
 ENTRY(start)
 
 SECTIONS {
-    /* Sections located in FLASH at runtime.
+    /* The FLASH memory section is placed at a TBF_HEADER_SIZE offset, to give
+     * elf2tab room to prepend the TBF headers. Communicate this reservation to
+     * elf2tab, such that it fills up the space after the TBF headers (if any)
+     * as part of the protected region trailer:
      */
+    tbf_protected_region_size = TBF_HEADER_SIZE;
 
-    /* Add a section where elf2tab will place the TBF headers, so that the rest
-     * of the FLASH sections are in the right locations. */
-    .tbf_header (NOLOAD) : {
-        . = . + TBF_HEADER_SIZE;
-    } > FLASH
+    /* Sections located in FLASH at runtime.
+     */
 
     /* Runtime header. Contains values the linker knows that the runtime needs
      * to look up.
      */
-    .start ALIGN(4) : {
+    . = ALIGN(4);
+    .start : {
         /* We combine rt_header and _start into a single section. If we don't,
          * elf2tab does not parse the ELF file correctly for unknown reasons.
          */