diff --git a/op-node/cmd/genesis/systemconfig.go b/op-node/cmd/genesis/systemconfig.go
index c98c39934bf0..55069322b4e8 100644
--- a/op-node/cmd/genesis/systemconfig.go
+++ b/op-node/cmd/genesis/systemconfig.go
@@ -28,7 +28,7 @@ func NewSystemConfigContract(caller *batching.MultiCaller, addr common.Address)
 }
 
 func (c *SystemConfigContract) StartBlock(ctx context.Context) (*big.Int, error) {
-	result, err := c.caller.SingleCall(ctx, rpcblock.Latest, c.contract.Call(methodStartBlock))
+	result, err := c.caller.SingleCall(ctx, rpcblock.Finalized, c.contract.Call(methodStartBlock))
 	if err != nil {
 		return nil, fmt.Errorf("failed to call startBlock: %w", err)
 	}
diff --git a/op-node/rollup/confdepth/conf_depth.go b/op-node/rollup/confdepth/conf_depth.go
index 66b9534a7c25..114763661d0f 100644
--- a/op-node/rollup/confdepth/conf_depth.go
+++ b/op-node/rollup/confdepth/conf_depth.go
@@ -16,18 +16,24 @@ import (
 type confDepth struct {
 	// everything fetched by hash is trusted already, so we implement those by embedding the fetcher
 	derive.L1Fetcher
-	l1Head func() eth.L1BlockRef
-	depth  uint64
+	l1Head      func() eth.L1BlockRef
+	depth       uint64
+	l1Finalized func() eth.L1BlockRef
 }
 
-func NewConfDepth(depth uint64, l1Head func() eth.L1BlockRef, fetcher derive.L1Fetcher) *confDepth {
-	return &confDepth{L1Fetcher: fetcher, l1Head: l1Head, depth: depth}
+func NewConfDepth(depth uint64, l1Head func() eth.L1BlockRef, l1Finalized func() eth.L1BlockRef, fetcher derive.L1Fetcher) *confDepth {
+	return &confDepth{L1Fetcher: fetcher, l1Head: l1Head, l1Finalized: l1Finalized, depth: depth}
 }
 
 // L1BlockRefByNumber is used for L1 traversal and for finding a safe common point between the L2 engine and L1 chain.
 // Any block numbers that are within confirmation depth of the L1 head are mocked to be "not found",
 // effectively hiding the uncertain part of the L1 chain.
 func (c *confDepth) L1BlockRefByNumber(ctx context.Context, num uint64) (eth.L1BlockRef, error) {
+	// Need num <= l1 finalized block number
+	l1Finalized := c.l1Finalized()
+	if num > l1Finalized.Number {
+		return eth.L1BlockRef{}, ethereum.NotFound
+	}
 	// Don't apply the conf depth if l1Head is empty (as it is during the startup case before the l1State is initialized).
 	l1Head := c.l1Head()
 	if l1Head == (eth.L1BlockRef{}) {
diff --git a/op-node/rollup/driver/driver.go b/op-node/rollup/driver/driver.go
index 3a3272387821..b18837285121 100644
--- a/op-node/rollup/driver/driver.go
+++ b/op-node/rollup/driver/driver.go
@@ -188,7 +188,7 @@ func NewDriver(
 	sys.Register("l1-blocks", l1Tracker, opts)
 
 	l1 = NewMeteredL1Fetcher(l1Tracker, metrics)
-	verifConfDepth := confdepth.NewConfDepth(driverCfg.VerifierConfDepth, statusTracker.L1Head, l1)
+	verifConfDepth := confdepth.NewConfDepth(driverCfg.VerifierConfDepth, statusTracker.L1Head, statusTracker.L1Finalized, l1)
 
 	ec := engine.NewEngineController(l2, log, metrics, cfg, syncCfg,
 		sys.Register("engine-controller", nil, opts))
@@ -239,7 +239,7 @@ func NewDriver(
 	if driverCfg.SequencerEnabled {
 		asyncGossiper := async.NewAsyncGossiper(driverCtx, network, log, metrics)
 		attrBuilder := derive.NewFetchingAttributesBuilder(cfg, l1, l2)
-		sequencerConfDepth := confdepth.NewConfDepth(driverCfg.SequencerConfDepth, statusTracker.L1Head, l1)
+		sequencerConfDepth := confdepth.NewConfDepth(driverCfg.SequencerConfDepth, statusTracker.L1Head, statusTracker.L1Finalized, l1)
 		findL1Origin := sequencing.NewL1OriginSelector(log, cfg, sequencerConfDepth)
 		sequencer = sequencing.NewSequencer(driverCtx, log, cfg, attrBuilder, findL1Origin,
 			sequencerStateListener, sequencerConductor, asyncGossiper, metrics)
diff --git a/op-node/rollup/status/status.go b/op-node/rollup/status/status.go
index b14f93843f72..05886d425bfd 100644
--- a/op-node/rollup/status/status.go
+++ b/op-node/rollup/status/status.go
@@ -133,3 +133,8 @@ func (st *StatusTracker) SyncStatus() *eth.SyncStatus {
 func (st *StatusTracker) L1Head() eth.L1BlockRef {
 	return st.SyncStatus().HeadL1
 }
+
+// L1Finalized is a helper function
+func (st *StatusTracker) L1Finalized() eth.L1BlockRef {
+	return st.SyncStatus().FinalizedL1
+}