diff --git a/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx23.cfg b/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx23.cfg
index c9cf4b3629463aa52c6862a8a4790f8dbbc52db8..70abfbc2e5b668690b60229fb681dc622386af83 100644
--- a/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx23.cfg
+++ b/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx23.cfg
@@ -1,6 +1,6 @@
 SECTION 0x0 BOOTABLE
  TAG LAST
- LOAD     0x0        OBJTREE/spl/u-boot-spl.bin
- CALL     0x14       0x0
- LOAD     0x40000100 OBJTREE/u-boot.bin
- CALL     0x40000100 0x0
+ LOAD     0x1000     OBJTREE/spl/u-boot-spl.bin
+ CALL     0x1000     0x0
+ LOAD     0x40002000 OBJTREE/u-boot.bin
+ CALL     0x40002000 0x0
diff --git a/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx28.cfg b/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx28.cfg
index 676f5c8f77ee7d0876d5d823f41629885b2e49c6..e98c97b63b953f3afca9ff53f7a198209d4c1f9f 100644
--- a/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx28.cfg
+++ b/arch/arm/cpu/arm926ejs/mxs/mxsimage.mx28.cfg
@@ -1,8 +1,8 @@
 SECTION 0x0 BOOTABLE
  TAG LAST
- LOAD     0x0        OBJTREE/spl/u-boot-spl.bin
- LOAD IVT 0x8000     0x14
+ LOAD     0x1000     OBJTREE/spl/u-boot-spl.bin
+ LOAD IVT 0x8000     0x1000
  CALL HAB 0x8000     0x0
- LOAD     0x40000100 OBJTREE/u-boot.bin
- LOAD IVT 0x8000     0x40000100
+ LOAD     0x40002000 OBJTREE/u-boot.bin
+ LOAD IVT 0x8000     0x40002000
  CALL HAB 0x8000     0x0
diff --git a/arch/arm/cpu/arm926ejs/mxs/spl_boot.c b/arch/arm/cpu/arm926ejs/mxs/spl_boot.c
index 68c30afc48be85f46cf8e3d4ae0ed8e3372c4212..38109c5ae9ae18664779c58b3a1eb4c14fb2be67 100644
--- a/arch/arm/cpu/arm926ejs/mxs/spl_boot.c
+++ b/arch/arm/cpu/arm926ejs/mxs/spl_boot.c
@@ -102,6 +102,18 @@ static uint8_t mxs_get_bootmode_index(void)
 	return i;
 }
 
+static void mxs_spl_fixup_vectors(void)
+{
+	/*
+	 * Copy our vector table to 0x0, since due to HAB, we cannot
+	 * be loaded to 0x0. We want to have working vectoring though,
+	 * thus this fixup. Our vectoring table is PIC, so copying is
+	 * fine.
+	 */
+	extern uint32_t _start;
+	memcpy(0x0, &_start, 0x60);
+}
+
 void mxs_common_spl_init(const uint32_t arg, const uint32_t *resptr,
 			 const iomux_cfg_t *iomux_setup,
 			 const unsigned int iomux_size)
@@ -110,7 +122,10 @@ void mxs_common_spl_init(const uint32_t arg, const uint32_t *resptr,
 		((CONFIG_SYS_TEXT_BASE - sizeof(struct mxs_spl_data)) & ~0xf);
 	uint8_t bootmode = mxs_get_bootmode_index();
 
+	mxs_spl_fixup_vectors();
+
 	mxs_iomux_setup_multiple_pads(iomux_setup, iomux_size);
+
 	mxs_power_init();
 
 	mxs_mem_init();
diff --git a/arch/arm/cpu/arm926ejs/mxs/u-boot-spl.lds b/arch/arm/cpu/arm926ejs/mxs/u-boot-spl.lds
index d0b482d61532ce13bf1857d7fd28e43739bc464f..f4bf8ac1dd4bbff9af63abbebf47d20acaf81cbd 100644
--- a/arch/arm/cpu/arm926ejs/mxs/u-boot-spl.lds
+++ b/arch/arm/cpu/arm926ejs/mxs/u-boot-spl.lds
@@ -16,7 +16,7 @@ OUTPUT_ARCH(arm)
 ENTRY(_start)
 SECTIONS
 {
-	. = 0x00000000;
+	. = CONFIG_SPL_TEXT_BASE;
 
 	. = ALIGN(4);
 	.text	:
diff --git a/include/configs/mxs.h b/include/configs/mxs.h
index 55ecef92a9ded24e1abf3dddeecc725d5463a26f..a9f4d894b8bedafa4563723a0a951a738b5e1a9e 100644
--- a/include/configs/mxs.h
+++ b/include/configs/mxs.h
@@ -80,8 +80,16 @@
  * We need to sacrifice first 4 bytes of RAM here to avoid triggering some
  * strange BUG in ROM corrupting first 4 bytes of RAM when loading U-Boot
  * binary. In case there was more of this mess, 0x100 bytes are skipped.
+ *
+ * In case of a HAB boot, we cannot for some weird reason use the first 4KiB
+ * of DRAM when loading. Moreover, we use the first 4 KiB for IVT and CST
+ * blocks, thus U-Boot starts at offset +8 KiB of DRAM start.
+ *
+ * As for the SPL, we must avoid the first 4 KiB as well, but we load the
+ * IVT and CST to 0x8000, so we don't need to waste the subsequent 4 KiB.
  */
-#define CONFIG_SYS_TEXT_BASE		0x40000100
+#define CONFIG_SYS_TEXT_BASE		0x40002000
+#define CONFIG_SPL_TEXT_BASE		0x00001000
 
 /* U-Boot general configuration */
 #define CONFIG_SYS_LONGHELP