diff --git a/chip/g/system.c b/chip/g/system.c
index 15640f46e3..b79af123ce 100644
--- a/chip/g/system.c
+++ b/chip/g/system.c
@@ -13,7 +13,6 @@
 #include "signed_header.h"
 #include "system.h"
 #include "task.h"
-#include "upgrade_fw.h"
 #include "version.h"
 
 static void check_reset_cause(void)
@@ -87,14 +86,6 @@ void system_pre_init(void)
 	system_init_board_properties();
 #endif
 }
-#ifdef BOARD_CR50
-void clear_retry_counter(void)
-{
-	GWRITE_FIELD(PMU, LONG_LIFE_SCRATCH_WR_EN, REG0, 1);
-	GREG32(PMU, LONG_LIFE_SCRATCH0) = 0;
-	GWRITE_FIELD(PMU, LONG_LIFE_SCRATCH_WR_EN, REG0, 0);
-}
-#endif
 
 void system_reset(int flags)
 {
@@ -105,15 +96,6 @@ void system_reset(int flags)
 	interrupt_disable();
 
 	if (flags & SYSTEM_RESET_HARD) {
-#if defined(BOARD_CR50) && !defined(SECTION_IS_RO)
-		/*
-		 * If the system was updated during this boot clear the retry
-		 * counter.
-		 */
-		if (fw_upgraded())
-			clear_retry_counter();
-#endif
-
 		/* Reset the full microcontroller */
 		GR_PMU_GLOBAL_RESET = GC_PMU_GLOBAL_RESET_KEY;
 	} else {
@@ -281,6 +263,14 @@ const char *system_get_version(enum system_image_copy_t copy)
 }
 
 #ifdef BOARD_CR50
+
+void system_clear_retry_counter(void)
+{
+	GWRITE_FIELD(PMU, LONG_LIFE_SCRATCH_WR_EN, REG0, 1);
+	GREG32(PMU, LONG_LIFE_SCRATCH0) = 0;
+	GWRITE_FIELD(PMU, LONG_LIFE_SCRATCH_WR_EN, REG0, 0);
+}
+
 /*
  * Check wich of the two cr50 RW images is newer, return true if the first
  * image is no older than the second one.
@@ -351,7 +341,7 @@ int system_process_retry_counter(void)
 	struct SignedHeader *me, *other;
 
 	retry_counter = GREG32(PMU, LONG_LIFE_SCRATCH0);
-	clear_retry_counter();
+	system_clear_retry_counter();
 
 	ccprintf("%s:retry counter %d\n", __func__, retry_counter);
 
diff --git a/chip/g/upgrade_fw.c b/chip/g/upgrade_fw.c
index b1da99d7a7..8cc79eaafa 100644
--- a/chip/g/upgrade_fw.c
+++ b/chip/g/upgrade_fw.c
@@ -32,8 +32,6 @@ struct {
 	uint32_t rw_top_offset;
 } valid_sections;
 
-static int upgrade_done;
-
 /* Pick sections where updates can go to based on current code addresses. */
 static void set_valid_sections(void)
 {
@@ -268,10 +266,6 @@ void fw_upgrade_command_handler(void *body,
 
 void fw_upgrade_complete(void)
 {
-	upgrade_done = 1;
+	system_clear_retry_counter();
 }
 
-int fw_upgraded(void)
-{
-	return upgrade_done;
-}
diff --git a/chip/g/upgrade_fw.h b/chip/g/upgrade_fw.h
index cbddd5bdb8..239384668f 100644
--- a/chip/g/upgrade_fw.h
+++ b/chip/g/upgrade_fw.h
@@ -115,9 +115,6 @@ void fw_upgrade_command_handler(void *body,
 				size_t cmd_size,
 				size_t *response_size);
 
-/* Returns 1 if an upgrade was done during this run 0 if there was no upgrade */
-int fw_upgraded(void);
-
 /* Used to tell fw upgrade the update ran successfully and is finished */
 void fw_upgrade_complete(void);
 
diff --git a/include/system.h b/include/system.h
index d6d2c063b7..5bca2c6321 100644
--- a/include/system.h
+++ b/include/system.h
@@ -462,6 +462,14 @@ int system_is_reboot_warm(void);
  */
 int system_process_retry_counter(void);
 
+/**
+ * On systems with protection from a failing RW update: reset retry
+ * counter, this is used after a new image upload is finished, to make
+ * sure that the new image has a chance to run.
+ */
+void system_clear_retry_counter(void);
+
+
 /* Board properties options */
 #define BOARD_SLAVE_CONFIG_SPI       (1 << 0)   /* Slave SPI interface */
 #define BOARD_SLAVE_CONFIG_I2C       (1 << 1)   /* Slave I2C interface */