diff --git a/platform/dev-qemu/Cargo.toml b/platform/dev-qemu/Cargo.toml
index 81724c1..bfaa6d1 100644
--- a/platform/dev-qemu/Cargo.toml
+++ b/platform/dev-qemu/Cargo.toml
@@ -10,6 +10,14 @@ bench = false
 name = "dev-qemu"
 test = false
 
+[features]
+default = []
+# sp-serial off (default): SmbusEspiMedium (the framing ec-test-cli
+# speaks). On: MctpSerialMedium / DSP0253 (the framing the SP speaks
+# over the two-QEMU link). Pure compile-time selector — both medium
+# constructors already exist in uart-service.
+sp-serial = []
+
 [profile.release]
 lto = true          # better optimizations
 codegen-units = 1
diff --git a/platform/dev-qemu/src/main.rs b/platform/dev-qemu/src/main.rs
index eb58914..6b46514 100644
--- a/platform/dev-qemu/src/main.rs
+++ b/platform/dev-qemu/src/main.rs
@@ -14,12 +14,29 @@ use platform_common::mock::MockOdpRelayHandler;
 use semihosting as _; // Panic handler
 use static_cell::StaticCell;
 
+// MCTP medium for the uart-service, selected at build time: SmbusEspi
+// by default (the framing ec-test-cli speaks), MctpSerialMedium under
+// sp-serial (the framing the SP speaks over the two-QEMU link). Both
+// constructors live in uart-service; dev-qemu holds no wire addressing.
+#[cfg(not(feature = "sp-serial"))]
+type EcUartService = uart_service::DefaultService<MockOdpRelayHandler>;
+#[cfg(feature = "sp-serial")]
+type EcUartService = uart_service::MctpSerialService<MockOdpRelayHandler>;
+
+#[cfg(not(feature = "sp-serial"))]
+fn new_uart_service(relay: MockOdpRelayHandler) -> EcUartService {
+    uart_service::DefaultService::default_smbusespi(relay).unwrap()
+}
+#[cfg(feature = "sp-serial")]
+fn new_uart_service(relay: MockOdpRelayHandler) -> EcUartService {
+    uart_service::MctpSerialService::default_mctp_serial(relay).unwrap()
+}
+
 #[embassy_executor::task]
 async fn uart_service(uart: buffered::Uart<'static, Async>, relay: MockOdpRelayHandler) {
     info!("Starting uart service");
-    static UART_SERVICE: StaticCell<uart_service::DefaultService<MockOdpRelayHandler>> = StaticCell::new();
-    let uart_service = uart_service::DefaultService::default_smbusespi(relay).unwrap();
-    let uart_service = UART_SERVICE.init(uart_service);
+    static UART_SERVICE: StaticCell<EcUartService> = StaticCell::new();
+    let uart_service = UART_SERVICE.init(new_uart_service(relay));
     let Err(e) = uart_service::task::uart_service(uart_service, uart).await;
     panic!("uart-service error: {:?}", e);
 }