diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index baedc9d8ab..bfd27028b9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -249,6 +249,11 @@ base revision, or run the suite on Linux or WSL, before attributing them to a
 change. See [testing](docs/testing.md#developer-commands) for command scopes
 and lane selection.
 
+`git submodule update --init --recursive` fails at the pinned Unblob submodule
+on Windows and can leave later submodules unchecked out. Apply the
+[Unblob checkout workaround](docs/firmware-analysis.md#windows-submodule-checkout),
+then rerun the command.
+
 ## Documentation website
 
 The VitePress site uses the Markdown files in `docs/`. Run `npm run docs:dev`
diff --git a/docs/firmware-analysis.md b/docs/firmware-analysis.md
index 7cbbc26923..8eb0ca16fd 100644
--- a/docs/firmware-analysis.md
+++ b/docs/firmware-analysis.md
@@ -50,6 +50,27 @@ git submodule update --init third_party/binwalk third_party/unblob
 Normal REA builds and npm packages do not include or build these sources or
 engine binaries. See [upstream provenance](https://github.com/morluto/rea/blob/main/third_party/README.md).
 
+### Windows submodule checkout
+
+On Windows, the Unblob checkout stops with `error: invalid path`. Several
+upstream test fixture names under `tests/integration/` contain characters,
+trailing dots, or trailing spaces that NTFS does not allow; REA does not use
+those fixtures. Keep the clone, exclude that directory, and retry from the
+repository root in PowerShell:
+
+```powershell
+git -C third_party/unblob config core.protectNTFS false
+git -C third_party/unblob sparse-checkout set --no-cone '/*' '!/tests/integration/'
+git submodule update third_party/unblob
+```
+
+Both settings are required. While `core.protectNTFS` is enabled, Git for
+Windows also rejects index paths that the sparse pattern excludes; the pattern
+keeps the invalid names out of the worktree. The setting applies only to the
+Unblob submodule. In Git Bash, prefix the `sparse-checkout` command with
+`MSYS_NO_PATHCONV=1`; otherwise `!/tests/integration/` is rewritten as a
+Windows path.
+
 ## CLI and MCP
 
 ```sh