Since it's open source, which is one of the reasons I switched to Trezor, can anyone confirm the update is safe?  Was it verified?

Right now i still have 2.12.0 and it wants to update to 2.12.4

I think what you should avoid are the phishing messages or going to the wrong site for the firmware update. You are safe as long as the update is done through the official website or through the right GitHub link.

https://trezor.io/other/product-updates/trezor-firmware-changelog-all-versions-and-release-dates

It is better you update it than to be using the old version.

No one is complaining about the update since August 19, 2026 which was 4 days ago.

There's no software to fully verify and check if the latest firmware update is safe. The only way to know if it is safe is if you manually check the source code from their GitHub page, which is provided above.

You can download that firmware from GitHub and then flash the device via install custom firmware under the danger area. If you trust Github, than just clicking update from Trezor suite then review the open-source code from Github to verify if it is safe or not.

To me, even with any device I have in my house, usually I don't update the firmware for almost a week or two at least to make sure no one is reporting any issue about the firmware.
Just like Antminer units, sometimes it gets corrupted and has some issues after flashing firmware. That is why I always wait for a few weeks or until at least the current unit is having software issues; that is the time for me to update the unit.

Do this the same in your Trezor, but if your current firmware reported vulnerabilities, better update it immediately.

It is best not to perform any update unless it is necessary or to fix a security vulnerability. It is best to wait a week or 10 days before downloading to ensure that a sufficient number of downloads have been made and that there are no complaints. This way you reduce the risks to a minimum.

I think this is an opportunity for me to get a general opinion on how long is relatively ok to wait before making updates. Sometimes it takes more than a couple of days before vulnerabilities eventually get discovered. This is not just a topic for hard ware wallets but also software wallets too.

For hardware most issues seem to come from when you generate your seed on the device with a weak firmware.
I think this might just work too . You can't be overly careful for things like these.

Also if you wait 10 or 20 days to update. You could add a passphrase to the trezor while you wait.

Just be sure to not lose it.

That is true. Lucius quoted me and posted about it at the time and I know he was right. That has been the reason I did not bother to post anything again on this thread unless it is necessary. I was reading what people are posting on this thread, but I did not reply to it because I see it not necessary if the posts is right.

No, the firmware has to be digitally signed with keys that only Trezor has.
They might be able to have your computer do things but there is no way for them to put a custom firmware on your Trezor. It will fail and give a very obvious error.

-Dave

Trezor has a built-in bootloader that verifies the cryptographic signature of any incoming firmware. If the firmware has been tampered with, the device will display an error message and automatically wipe its storage, ensuring your funds remain safe.
Hackers often resort to messages claiming, Your coins are not safe; please enter your seed phrase to secure them."