The modem image is never built from source here. Nightly CI resolves the newest published Serial Modem release that ships the nRF91M1 bundle (*_nrf9151dk_nrf91m1.zip, including prereleases), locks that tag for the whole pipeline run, and passes it to every nRF91M1 hardware test and to the Release workflow. Tests download the archive, cache it under build/serial-modem-firmware/<tag>/, and flash the .hex from it. Release bundles copy the same archive unextracted into every 91m1_ppp zip, so what ships is what CI tested that night.
The Serial Modem uses the nRF91M1 UART pinout. The bench is wired for it. See Hardware Setup.
Set SERIAL_MODEM_RELEASE to pin a specific upstream tag when running tests or the release workflow locally. Static settings such as console_baudrate live in tests/on_target/ci/serial_modem_firmware.yml.
Full LTE and IP-level modem traces (AT#XTRACE=1) are a further step still, and they need a trace database to decode. Note that the UART trace backend shares uart1 with the log backend, and the two are mutually exclusive, so capturing traces that way costs the application log; overlay-trace-backend-cmux.conf routes traces over a dedicated CMUX channel instead and leaves AT#XLOG=1 usable.