diff --git a/devtools/td-layout-config/config_memory_exec.json b/devtools/td-layout-config/config_memory_exec.json
index 90b93368..8b91d4a4 100644
--- a/devtools/td-layout-config/config_memory_exec.json
+++ b/devtools/td-layout-config/config_memory_exec.json
@@ -10,6 +10,11 @@
             "size": "0x20000",
             "type": "Memory"
         },
+        {
+            "name": "ShimPayload",
+            "size": "0xC2D000",
+            "type": "Memory"
+        },
         {
             "name": "EventLog",
             "size": "0x100000",
diff --git a/devtools/td-layout-config/src/image.rs b/devtools/td-layout-config/src/image.rs
index 7921b79b..761c2eda 100644
--- a/devtools/td-layout-config/src/image.rs
+++ b/devtools/td-layout-config/src/image.rs
@@ -2,7 +2,7 @@ use serde::Deserialize;
 
 use super::{layout::LayoutConfig, render};
 
-const FIRMWARE_ROM_BASE: usize = 0xFF00_0000;
+const FIRMWARE_ROM_TOP: usize = 0xFFFF_FFFF;
 const FIRMWARE_ROM_SIZE: usize = 0x100_0000;
 
 #[derive(Deserialize, Debug, PartialEq)]
@@ -75,16 +75,14 @@ pub fn parse_image(data: String) -> String {
 
     // Build ROM layout at memory space: 0xFF00_0000 - 0xFFFF_FFFF
     // Payload image is not loaded into ROM space.
+    let rom_size = image_size - payload_size;
     let mut rom_layout =
-        LayoutConfig::new(FIRMWARE_ROM_BASE, FIRMWARE_ROM_BASE + FIRMWARE_ROM_SIZE);
+        LayoutConfig::new(FIRMWARE_ROM_TOP - rom_size, FIRMWARE_ROM_TOP);
 
     if image_size > FIRMWARE_ROM_SIZE {
         panic!("Image size exceeds the maximum ROM space");
     }
 
-    if payload_size != 0 {
-        image_layout.reserve_low("Payload", payload_size, "Rom")
-    }
     rom_layout.reserve_low("Config", config_size, "Rom");
     rom_layout.reserve_low("Mailbox", mailbox_size, "Rom");
     rom_layout.reserve_low("TempStack", temp_stack_size, "Rom");