diff --git a/wled00/ota_update.cpp b/wled00/ota_update.cpp
index a0bf31d3..904a242b 100644
--- a/wled00/ota_update.cpp
+++ b/wled00/ota_update.cpp
@@ -453,8 +453,8 @@ String getBootloaderSHA256Hex() {
   String result;
   result.reserve(65);
   for (int i = 0; i < 32; i++) {
-    char b1 = bootloaderSHA256Cache[i];
-    char b2 = b1 >> 4;
+    unsigned char b1 = bootloaderSHA256Cache[i];
+    unsigned char b2 = b1 >> 4; // bugfix: right-shift on signed char is undefined behaviour
     b1 &= 0x0F;
     b1 += '0'; b2 += '0';
     if (b1 > '9') b1 += 39;
@@ -780,4 +780,4 @@ void handleBootloaderOTAData(AsyncWebServerRequest *request, size_t index, uint8
 // -------------------------------------
 
 
-#endif
\ No newline at end of file
+#endif