diff --git a/AGENTS.md b/AGENTS.md
index 9c4661f916..2e866443fc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,7 +17,7 @@ for it:
 | [docs/DebuggerThreading.md](docs/DebuggerThreading.md) | `Core_RunOnCPUThread` / `g_frameMutex` / shutdown-lock rules - required reading before touching debugger code |
 | [docs/HLEModules.md](docs/HLEModules.md) | Adding an HLE module or function, and the seven build files a new source file goes in |
 | [docs/translations.md](docs/translations.md) | Translating UI strings with Tools/langtool |
-| [docs/pspautotests.md](docs/pspautotests.md) | Workflow for improving PPSSPP using pspautotests |
+| [docs/pspautotests.md](docs/pspautotests.md) | Workflow for improving PPSSPP using pspautotests, and running the tests that need the real firmware modules (`--disable-hle`, a firmware memstick) |
 | [docs/pspautotests-hardware.md](docs/pspautotests-hardware.md) | Writing a new pspautotest, and running it on a real PSP over PSPLink to record its `.expected` |
 | [docs/frametest.md](docs/frametest.md) | Framedump rendering tests, and replaying a dump on a real PSP |
 | [docs/sceGe.md](docs/sceGe.md) | How the firmware queues display lists, what SIGNAL and FINISH interrupts do and in which order, and how `ProcessDLQueue()` keeps that order |
diff --git a/docs/pspautotests.md b/docs/pspautotests.md
index 24134285fc..052652f47b 100644
--- a/docs/pspautotests.md
+++ b/docs/pspautotests.md
@@ -57,6 +57,32 @@ Instead of a single PRX, you can pass a directory (e.g. `pspautotests/tests/thre
   same idea in emulated time, and both can be set at once. `--timeout` is the old name for `--timeout-wall`.
 - `--graphics=software` — uses software GPU backend (required for headless; no real GPU available).
 
+### Tests that need the real firmware modules
+
+A pspautotest is homebrew, so headless runs every library on our HLE for it
+(`iForceEnableHLE` in `headless/Headless.cpp`), even the ones the app runs from the firmware by
+default. Some tests only mean anything against the real module: `video/mp4/avchold` and
+`video/mpeg/decodeend` test the Media Engine through Sony's `libmp4.prx`, `mp4msv.prx` and
+`mpeg.prx`, which call our `sceVideocodec` HLE. Run on our HLE, `avchold` reports
+`0 samples, 0 decodes` for every stream (our sceMp4 is stubs: the log says `UNIMPL sceMp4Create`),
+and it fails without exercising the decoder at all.
+
+To run them as the hardware does, pass both:
+
+- `--disable-hle=N`, the `DisableHLEFlags` bits (`Core/ConfigValues.h`) of the libraries to run
+  for real, in decimal or `0x` hex. sceMpeg is 0x10 and sceMp4 is 0x100, so the video tests take
+  `--disable-hle=0x110`.
+- `--memstick=` pointing at a memory stick with a firmware dump in `PSP/NAND/flash0/kd`. `test.py`
+  otherwise hands headless the empty one beside the exe. Since the flag is explicit, headless exits
+  with an error naming the missing module rather than falling back to HLE.
+
+```
+python test.py video/mp4/avchold video/mpeg/decodeend --graphics=software --memstick=<app memstick> --disable-hle=0x110
+```
+
+CI has no firmware dump, so these tests stay in `tests_next`, and a change to the video path
+needs this run done by hand.
+
 ### What you'll see
 
 **Passing test:**
diff --git a/pspautotests b/pspautotests
index 74cdeea078..51fc2c4d87 160000
--- a/pspautotests
+++ b/pspautotests
@@ -1 +1 @@
-Subproject commit 74cdeea078403a9d877b99e28c3cad85ba7f3d7f
+Subproject commit 51fc2c4d87fc09df9e87a62e1755ae4816cda13a
diff --git a/test.py b/test.py
index d8b974add4..fe430cad47 100755
--- a/test.py
+++ b/test.py
@@ -675,9 +675,9 @@ tests_next = [
   #"utility/savedata/saveemptyfilename",
   "utility/savedata/secureversion",
   "utility/savedata/sizes",
-  "video/mp4/avchold",
+  "video/mp4/avchold",  # needs Sony's mp4 and mpeg modules: --disable-hle=0x110, see docs/pspautotests.md
   "video/mpeg/basic",
-  "video/mpeg/decodeend",
+  "video/mpeg/decodeend",  # needs Sony's mpeg module, as avchold
   "video/mpeg/deletetiming",
   "video/pmf/pmf",
   "video/pmf_simple/pmf_simple",