Bump OS to release version 16.3

Remove usage of --content-trust CLI option in Supervisor tests (#4371 )
With https://github.com/home-assistant/cli/pull/604, there is no --content-trust option anymore. Remove the call and only check if Supervisor is healthy and there are no issues. This replaces #4370 which is too broad. (cherry picked from commit 1d29f6b099)
2025-11-06 01:18:33 +00:00 · 2025-11-03 12:48:01 +01:00 · 2025-11-03 12:47:32 +01:00 · 2025-10-29 14:02:19 +01:00 · 2025-10-29 14:02:10 +01:00 · 2025-10-14 14:55:12 +02:00
110 changed files with 2067 additions and 1676 deletions
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,6 +1,5 @@
-name: Bug Report Form
+name: Report an issue with Home Assistant Operating System
 description: Report an issue related to the Home Assistant Operating System.
-labels: bug
 body:
  - type: markdown
    attributes:
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -9,7 +9,7 @@ contact_links:
    about: Our developer documentation has its own issue tracker. Please report issues with the website there.

  - name: Request a feature for the Operating System
-    url: https://community.home-assistant.io/c/feature-requests
+    url: https://github.com/orgs/home-assistant/discussions
    about: Request an new feature for the Operating System.

  - name: I have a question or need support
--- a/.github/workflows/artifacts-index.yaml
+++ b/.github/workflows/artifacts-index.yaml
@@ -39,12 +39,12 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Setup Python version ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -16,6 +16,11 @@ on:
        required: true
        type: boolean
        default: true
+      run_tests:
+        description: 'Run tests after build'
+        required: true
+        type: boolean
+        default: true
      hassio_channel:
        description: 'Release channel to use (default: stable for GH releases, dev otherwise)'
        type: choice
@@ -50,7 +55,7 @@ jobs:
      self_signed_cert: ${{ steps.generate_signing_key.outputs.self_signed_cert }}
    steps:
      - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

@@ -77,7 +82,7 @@ jobs:
          PUBLISH_BUILD: ${{ steps.check_publish.outputs.publish_build }}
        run: |
          version_dev="dev$(date --utc +'%Y%m%d')"
-          if [ "${{ env.PUBLISH_BUILD }}" != "true" ]; then
+          if [ "${{ env.PUBLISH_BUILD }}" != "true" ] || [ "${{ github.ref }}" != "refs/heads/dev" ]; then
            version_dev="dev$(date +%s)"
          fi
          echo "Development version \"${version_dev}\""
@@ -142,7 +147,7 @@ jobs:
          fi

      - name: Create build matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        id: generate_matrix
        with:
          script: |
@@ -152,26 +157,35 @@ jobs:
            }

            const boardFilter = "${{ github.event.inputs.boards }}"
+            const runTests = "${{ github.event.inputs.run_tests }}" === "true"
+
            if (boardFilter == "") {
              console.log("Run full build for all boards")
              return { "board": boards }
            } else {
              console.log("Run partial build")
              const boardSet = new Set(boardFilter.split(","))
+
+              // if tests are enabled, we need to ensure the OVA board is included
+              if (runTests && !boardSet.has("ova")) {
+                console.log("Adding OVA board for integration tests")
+                boardSet.add("ova")
+              }
+
              const buildBoards = boards.filter(b => boardSet.has(b.id))
              return { "board": buildBoards }
            }

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Log in to the GitHub container registry
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
            registry: ghcr.io
            username: ${{ github.repository_owner }}
            password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and Push
-        uses: docker/build-push-action@v6.17.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        id: build_haos_builder
        with:
          context: .
@@ -193,7 +207,7 @@ jobs:
          echo "self_signed_cert=true" >> $GITHUB_OUTPUT

      - name: Create signing key
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: steps.generate_signing_key.outcome == 'success'
        with:
          name: signing-key
@@ -213,14 +227,14 @@ jobs:

    steps:
      - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          submodules: true
          persist-credentials: false

      - name: Setup Python version ${{ env.PYTHON_VERSION }}
        if: ${{ github.event_name != 'release' }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: ${{ env.PYTHON_VERSION }}

@@ -246,7 +260,7 @@ jobs:

      - name: Get self-signed certificate from the prepare job
        if: ${{ needs.prepare.outputs.self_signed_cert == 'true' }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: signing-key

@@ -267,7 +281,7 @@ jobs:
          df -h

      - name: "Restore cache: object files"
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: /mnt/cache/cc
          key: haos-cc-${{ matrix.board.id }}
@@ -315,7 +329,7 @@ jobs:

      - name: Upload release assets
        if: ${{ github.event_name == 'release' }}
-        uses: shogo82148/actions-upload-release-asset@v1
+        uses: shogo82148/actions-upload-release-asset@59cbc563d11314e48122193f8fe5cdda62ea6cf9 # v1.9.1
        with:
          upload_url: ${{ github.event.release.upload_url }}
          asset_path: output/images/haos_*
@@ -330,7 +344,7 @@ jobs:

      - name: "Save cache: object files"
        if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: /mnt/cache/cc
          key: haos-cc-${{ matrix.board.id }}-${{ github.run_id }}
@@ -338,6 +352,18 @@ jobs:
      - name: Generate build summary
        run: |
          echo "# ${{ matrix.board.id }} build summary" >> $GITHUB_STEP_SUMMARY
+          echo "## Built-in OS components" >> $GITHUB_STEP_SUMMARY
+          echo "Release channel: ${{ inputs.hassio_channel }} (${{ needs.prepare.outputs.hassio_channel_option }})" >> $GITHUB_STEP_SUMMARY
+          echo "| Container | Version |" >> $GITHUB_STEP_SUMMARY
+          echo "|:-|:-|" >> $GITHUB_STEP_SUMMARY
+          supervisor_version=$(jq -r ".supervisor" output/build/hassio-*/version.json)
+          landingpage_version=$(curl -fsSL https://api.github.com/repos/home-assistant/landingpage/releases/latest | jq -r '.tag_name')
+          echo "| supervisor | [${supervisor_version}](https://github.com/home-assistant/supervisor/releases/tag/${supervisor_version}) |" >> $GITHUB_STEP_SUMMARY
+          echo "| landingpage | [${landingpage_version}](https://github.com/home-assistant/landingpage/releases/tag/${landingpage_version}) |" >> $GITHUB_STEP_SUMMARY
+          for plugin in dns audio cli multicast observer; do
+            version=$(jq -r ".${plugin}" output/build/hassio-*/version.json)
+            echo "| plugin-${plugin} | [${version}](https://github.com/home-assistant/plugin-${plugin}/releases/tag/${version}) |" >> $GITHUB_STEP_SUMMARY
+          done
          echo "## Artifacts" >> $GITHUB_STEP_SUMMARY
          echo "| File | Size (bytes) | Size (formatted) |" >> $GITHUB_STEP_SUMMARY
          echo "|:-|:-|:-|" >> $GITHUB_STEP_SUMMARY
@@ -352,7 +378,7 @@ jobs:
          done

      - name: Upload OS image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id != 'ova' }}
        with:
          name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.img.xz
@@ -360,7 +386,7 @@ jobs:
            output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.img.xz

      - name: Upload RAUC bundle artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' }}
        with:
          name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.raucb
@@ -368,7 +394,7 @@ jobs:
            output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.raucb

      - name: Upload Open Virtualization Format (OVA) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'ova' }}
        with:
          name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.ova
@@ -376,7 +402,7 @@ jobs:
            output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.ova

      - name: Upload QEMU disk image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        # Create artifact for ova every time - it's used by the called tests workflow
        if: ${{ matrix.board.id == 'ova' || (github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'generic-aarch64') }}
        with:
@@ -385,7 +411,7 @@ jobs:
            output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.qcow2.xz

      - name: Upload VMware Virtual Machine Disk (VMDK) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && (matrix.board.id == 'generic-aarch64' || matrix.board.id == 'ova') }}
        with:
          name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vmdk.zip
@@ -393,7 +419,7 @@ jobs:
            output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vmdk.zip

      - name: Upload VirtualBox Virtual Disk Image (VDI) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'ova' }}
        with:
          name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vdi.zip
@@ -401,7 +427,7 @@ jobs:
            output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vdi.zip

      - name: Upload Virtual Hard Disk v2 (VHDX) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'ova' }}
        with:
          name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vhdx.zip
@@ -410,6 +436,7 @@ jobs:

  test:
    name: Test OS image
+    if: ${{ github.event_name == 'release' || inputs.run_tests == true }}
    needs: [ build, prepare ]
    uses: ./.github/workflows/test.yaml
    with:
@@ -432,14 +459,14 @@ jobs:

  bump_version:
    name: Bump ${{ needs.prepare.outputs.channel }} channel version
-    if: ${{ github.repository == 'home-assistant/operating-system' && needs.prepare.outputs.publish_build == 'true' }}
+    if: ${{ github.repository == 'home-assistant/operating-system' && needs.prepare.outputs.publish_build == 'true' && (needs.prepare.outputs.channel != 'dev' || github.ref == 'refs/heads/dev') }}
    environment: ${{ needs.prepare.outputs.channel }}
    needs: [ build, prepare ]
    runs-on: ubuntu-22.04

    steps:
    - name: Checkout source
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        persist-credentials: false

--- a/.github/workflows/label-actions.yml
+++ b/.github/workflows/label-actions.yml
@@ -14,4 +14,4 @@ jobs:
  action:
    runs-on: ubuntu-latest
    steps:
-      - uses: dessant/label-actions@v4.0.1
+      - uses: dessant/label-actions@102faf474a544be75fbaf4df54e73d3c515a0e65 # v4.0.1
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -14,7 +14,7 @@ jobs:
    if: github.repository_owner == 'home-assistant'
    runs-on: ubuntu-latest
    steps:
-      - uses: dessant/lock-threads@v5.0.1
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
        with:
          github-token: ${{ github.token }}
          issue-inactive-days: "30"
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -15,17 +15,17 @@ jobs:
          python3-flake8

    - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
      with:
        submodules: true

    - name: Check Dockerfile
-      uses: brpaz/hadolint-action@v1.5.0
+      uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
      with:
        dockerfile: Dockerfile

    - name: Check shell scripts
-      uses: ludeeus/action-shellcheck@2.0.0
+      uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
      with:
        ignore_paths: buildroot

--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -13,6 +13,6 @@ jobs:
      pull-requests: read  # for release-drafter/release-drafter to read PR content and labels
    runs-on: ubuntu-latest
    steps:
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -19,7 +19,7 @@ jobs:
      # - No PRs marked as no-stale or pinned
      # - No issues marked as no-stale, help-wanted or pinned
      - name: 90 days stale issues & PRs policy
-        uses: actions/stale@v9.1.0
+        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          days-before-stale: 90
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -32,7 +32,7 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout source
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

@@ -42,7 +42,7 @@ jobs:
          sudo apt install -y qemu-system-x86 ovmf

      - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: 3.12

@@ -57,7 +57,7 @@ jobs:

      - name: Get OS image artifact
        if: ${{ inputs.use-artifact }}
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
        with:
          name: haos_ova-${{ inputs.version }}.qcow2.xz

@@ -77,7 +77,7 @@ jobs:
          ./tests/run_tests.sh --durations=0 --durations-min=5.0

      - name: Archive logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: logs
@@ -85,7 +85,7 @@ jobs:
            tests/lg_logs/**

      - name: Archive JUnit reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        if: always()
        with:
          name: junit_reports
@@ -93,7 +93,7 @@ jobs:
            tests/junit_reports/*.xml

      - name: Publish test report
-        uses: mikepenz/action-junit-report@v5
+        uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
        if: always()
        with:
          report_paths: 'tests/junit_reports/*.xml'
--- a/Documentation/README.md
+++ b/Documentation/README.md
@@ -1,9 +1,9 @@
 # Documentation

-## Contents
+Documentation for the Home Assistant Operating System is available at [developers.home-assistant.io/docs/operating-system/][docs].
+If you want to contribute to this documentation, please refer to the [home-assistant/developers.home-assistant][docs-repo] repository.

- [Configuration](./configuration.md) - how users can configure HAOS
- [Network](./network.md) - approach to networking
- [Bluetooth](./bluetooth.md) - approach to bluetooth
- [Kernel](./kernel.md) - kernel versions
- [Boards](./boards/README.md) - board specific documentation
+For the list of Linux kernel versions used currently in this branch of Home Assistant Operating System, see [kernel.md](./kernel.md).
+
+[docs]: https://developers.home-assistant.io/docs/operating-system/
+[docs-repo]: https://github.com/home-assistant/developers.home-assistant/
--- a/Documentation/bluetooth.md
+++ b/Documentation/bluetooth.md
@@ -1,12 +0,0 @@
-# Bluetooth
-
-We support `bluetoothctl` on the host. Later we want to support Bluetooth through the UI.
-All pairs and settings are persistent over reboots and updates.
-
-If you want to setup Bluetooth on the host, use the `bluetoothctl` utility.
-
-## Scan devices
-
-```
-[bluetooth]# scan on
-```
--- a/Documentation/boards/README.md
+++ b/Documentation/boards/README.md
@@ -1,62 +0,0 @@
-# Boards
-
-## Overview
-
-The following boards/devices are supported:
-
- Nabu Casa
-  - [Home Assistant Green](https://www.home-assistant.io/green/)
-  - [Home Assistant Yellow](https://www.home-assistant.io/yellow/) (based custom carrier board and powered by a Raspberry Pi 4 Compute Module)
-  - [Home Assistant Blue](https://www.home-assistant.io/blue/) (based on ODROID-N2+)
- Raspberry Pi
-  - Pi 5 ([4 GB](https://www.raspberrypi.com/products/raspberry-pi-5/?variant=raspberry-pi-5-4gb) and [8 GB](https://www.raspberrypi.com/products/raspberry-pi-5/?variant=raspberry-pi-5-8gb) model) 64-bit
-  - Pi 4 Model B ([1 GB](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/?variant=raspberry-pi-4-model-b-1gb), [2 GB](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/?variant=raspberry-pi-4-model-b-2gb), [4 GB](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/?variant=raspberry-pi-4-model-b-4gb) and [8 GB](https://www.raspberrypi.com/products/raspberry-pi-4-model-b/?variant=raspberry-pi-4-model-b-8gb) model) 32-bit or 64-bit (recommended)
-  - [Pi 3 Model B](https://www.raspberrypi.com/products/raspberry-pi-3-model-b/) and [B+](https://www.raspberrypi.com/products/raspberry-pi-3-model-b-plus/) 32-bit or 64-bit (recommended)
-  - [Pi 2](https://www.raspberrypi.com/products/raspberry-pi-2-model-b/) (not recommended)
- Hardkernel
-  - [ODROID-C2](https://www.hardkernel.com/shop/odroid-c2/) (discontinued)
-  - [ODROID-C4](https://www.hardkernel.com/shop/odroid-c4/)
-  - [ODROID-M1](https://www.hardkernel.com/shop/odroid-m1/)
-  - ODROID-M1S [4 GB](https://www.hardkernel.com/shop/odroid-m1s-with-4gbyte-ram/) or [8 GB](https://www.hardkernel.com/shop/odroid-m1s-with-8gbyte-ram/)
-  - [ODROID-N2](https://www.hardkernel.com/shop/odroid-n2/) (discontinued)
-  - ODROID-N2+ [2 GB](https://www.hardkernel.com/shop/odroid-n2-with-2gbyte-ram-2/) or [4 GB](https://www.hardkernel.com/shop/odroid-n2-with-4gbyte-ram-2/)
-  - [ODROID-XU4](https://www.hardkernel.com/shop/odroid-xu4-special-price/)
- Asus
-  - [Tinker Board](https://tinker-board.asus.com/product/tinker-board.html)
- Generic x86-64 (UEFI, not suited for virtualization)
-  - [Intel NUC5CPYH](https://www.intel.com/content/www/us/en/products/sku/85254/intel-nuc-kit-nuc5cpyh/specifications.html)
-  - [Intel NUC6CAYH](https://www.intel.com/content/www/us/en/products/sku/95062/intel-nuc-kit-nuc6cayh/specifications.html)
-  - [Intel NUC10I3FNK2](https://www.intel.com/content/www/us/en/products/sku/195503/intel-nuc-10-performance-kit-nuc10i3fnk/specifications.html)
-  - [Gigabyte GB-BPCE-3455](https://www.gigabyte.com/Mini-PcBarebone/GB-BPCE-3455-rev-10/sp#sp)
-  - Computers supporting x86-64 architecture and UEFI boot should generally work
- Virtual appliance (x86_64/UEFI):
-  - VMDK
-  - OVA ?
-  - VHDX ?
-  - VDI ?
-  - QCOW2 ?
-
-Notes:
-  - see ? above: are these currently supported? see ova documentation which explains issues with previous OVA distribution)
-
-## Board specifics
-
-|Board|Build|Config|Docs|
-|-----|----|------|----|
-|Green         |`make green`         |[green](../../buildroot-external/configs/green_defconfig)|-|
-|Yellow        |`make yellow`        |[yellow](../../buildroot-external/configs/yellow_defconfig)|-|
-|Pi5 64-bit    |`make rpi5_64`       |[rpi5_64](../../buildroot-external/configs/rpi5_64_defconfig)|[raspberrypi](./raspberrypi/)|
-|Pi4B 64-bit   |`make rpi4_64`       |[rpi4_64](../../buildroot-external/configs/rpi4_64_defconfig)|[raspberrypi](./raspberrypi/)|
-|Pi4B 32-bit   |`make rpi4`          |[rpi4](../../buildroot-external/configs/rpi4_defconfig)|[raspberrypi](./raspberrypi/)|
-|Pi3B 64-bit   |`make rpi3_64`       |[rpi3_64](../../buildroot-external/configs/rpi3_64_defconfig)|[raspberrypi](./raspberrypi/)|
-|Pi3B 32-bit   |`make rpi3`          |[rpi3](../../buildroot-external/configs/rpi3_defconfig)|[raspberrypi](./raspberrypi/)|
-|Pi2           |`make rpi2`          |[rpi2](../../buildroot-external/configs/rpi2_defconfig)|[raspberrypi](./raspberrypi/)|
-|ODROID-C2     |`make odroid_c2`     |[odroid_c2](../../buildroot-external/configs/odroid_c2_defconfig)|[hardkernel](./hardkernel/)|
-|ODROID-C4     |`make odroid_c4`     |[odroid_c4](../../buildroot-external/configs/odroid_c4_defconfig)|[hardkernel](./hardkernel/)|
-|ODROID-M1     |`make odroid_m1`     |[odroid_m1](../../buildroot-external/configs/odroid_m1_defconfig)|[hardkernel](./hardkernel/)|
-|ODROID-M1S    |`make odroid_m1s`    |[odroid_m1s](../../buildroot-external/configs/odroid_m1s_defconfig)|[hardkernel](./hardkernel/)|
-|ODROID-N2/N2+ |`make odroid_n2`     |[odroid_n2](../../buildroot-external/configs/odroid_n2_defconfig)|[hardkernel](./hardkernel/)|
-|ODROID-XU4    |`make odroid_xu4`    |[odroid_xu4](../../buildroot-external/configs/odroid_xu4_defconfig)|[hardkernel](./hardkernel/)|
-|Tinker Board  |`make tinker`        |[tinker](../../buildroot-external/configs/tinker_defconfig)|[asus](./asus/)|
-|Generic x86-64|`make generic_x86_64`|[generic_x86_64](../../buildroot-external/configs/generic_x86_64_defconfig)|[generic-x86-64](./generic-x86-64/)|
-|OVA           |`make ova`           |[ova](../../buildroot-external/configs/ova_defconfig)|[ova](./ova/)|
--- a/Documentation/boards/asus/README.md
+++ b/Documentation/boards/asus/README.md
@@ -1,31 +0,0 @@
-# Tinker Board
-
-## Supported Hardware
-
-| Device         | Release Date  | Support | Config   |
-|----------------|---------------|---------|----------|
-| Tinker RK3288  | April 2017    | yes     | [tinker](../../../buildroot-external/configs/tinker_defconfig) |
-| Tinker S RK3288| January 2018  | yes     | [tinker](../../../buildroot-external/configs/tinker_defconfig) |
-| Tinker Edge T  | November 2019 | no?     |          |
-| Tinker Edge R  | November 2019 | no?     |          |
-
-## eMMC
-
-eMMC support is provided with the same image. Just flash the image to the eMMC by connecting your Tinker Board S to your PC via Micro-USB. Refer to the Tinkerboard documentation how-to flash using Micro-USB and UMS.
-
-The Home Assistant OS provided U-Boot does support UMS as well,
-however manual intervention is necessary:
-
- 1. Set the jumper between Micro-USB and HDMI the maskrom mode
- 2. Insert SD card and connect the board via Micro-USB to your PC
- 3. Continusly press Ctrl+C to interrupt boot
- 4. Set the jumper back to the park position
- 5. Start UMS using:
-```
-ums 0 mmc 0
-```
- 6. A mass storage device should appear. Flash Home Assistant OS to it.
-
-## Serial console
-
-To access the terminal over serial console, add `console=ttyS2,115200` to `cmdline.txt`. GPIO pins are: 34 = GND / 32 = UART TXD / 33 = UART RXD.
--- a/Documentation/boards/generic-aarch64/README.md
+++ b/Documentation/boards/generic-aarch64/README.md
@@ -1,36 +0,0 @@
-# Generic aarch64
-
-## Supported Hardware
-
-This board configuration aims to support most aarch64 systems with UEFI boot
-Hardware it has been tested with is listed below.
-
-## Tested Hardware
-
-| Device                | Release Date | Support | Config      |
-|-----------------------|--------------|---------|-------------|
-| QEMU                  | QEMU         | yes     | [generic_aarch64](../../../buildroot-external/configs/generic_aarch64_defconfig) |
-
-
-## Requirements
-
- aarch64 support
- UEFI boot
-
-## Wifi
-
-WiFi is untested.
-
-## Bluetooth
-
-Bluetooth is untested.
-
-## Installation
-
-Make sure secure boot is disabled in the UEFI BIOS settings.
-
-Currently there is no shiny installation method. Checklist:
- Boot PC to live environment using PXE or USB
- Copy or download the Home Assistant OS image into your live environment
- unxz the image and dd to the local hard disk
- Reboot
--- a/Documentation/boards/generic-x86-64/README.md
+++ b/Documentation/boards/generic-x86-64/README.md
@@ -1,62 +0,0 @@
-# Generic x86-64
-
-## Supported Hardware
-
-This board configuration aims to support most x86-64 systems with UEFI boot. The
-main aim is to support Intel NUC mini PCs and similar systems. Hardware it has
-been tested with is listed below.
-
-## Tested Hardware
-
-| Device                | Release Date | Support | Config      |
-|-----------------------|--------------|---------|-------------|
-| Intel NUC5CPYH        | Q3 2015      | yes     | [generic_x86_64](../../../buildroot-external/configs/generic_x86_64_defconfig) |
-| Intel NUC6CAYH        | Q4 2016      | yes     | [generic_x86_64](../../../buildroot-external/configs/generic_x86_64_defconfig) |
-| Intel NUC6CAYS        | Q4 2016      | yes     | [generic_x86_64](../../../buildroot-external/configs/generic_x86_64_defconfig) |
-| Intel NUC7i3DNHE	| Q3 2017      | yes     | [generic_x86_64](../../../buildroot-external/configs/generic_x86_64_defconfig) |
-| Intel NUC10i3FNK2     | Q4 2019      | yes     | [generic_x86_64](../../../buildroot-external/configs/generic_x86_64_defconfig) |
-| Gigabyte GB-BPCE-3455 | 2017         | yes*    | [generic_x86_64](../../../buildroot-external/configs/generic_x86_64_defconfig) |
-
-\* needs 'nomodeset' in cmdline.txt if you want a console
-
-
-## Requirements
-
- x86-64 support
- UEFI boot
- SATA/AHCI or eMMC storage
- Supported NIC:
-  - Intel Gigabit NIC (e1000, igb - via Linux mainline)
-  - Intel PCIe Gigabit NIC (e1000e - via out-of-tree module in *buildroot-external/package/intel-e1000e*)
-  - Realtek Gigabit NIC (r8169)
-  - Intel Wireless Wifi 802.11ac (iwlwifi, see below)
-
-## Wifi
-
-The following cards are supported:
-
- Intel Wireless 3160
- Intel Wireless 7260
- Intel Wireless 7265
- Intel Wireless-AC 3165
- Intel Wireless-AC 3168
- Intel Wireless-AC 8260
- Intel Wireless-AC 8265
- Intel Wireless-AC 9260
- Intel Wireless-AC 9461
- Intel Wireless-AC 9462
- Intel Wireless-AC 9560
-
-## Bluetooth
-
-Bluetooth integrated in Intel Wireless cards working OK, other options untested.
-
-## Installation
-
-Make sure secure boot is disabled in the UEFI BIOS settings.
-
-Currently there is no shiny installation method. Checklist:
- Boot PC to live environment using PXE or USB
- Copy or download the Home Assistant OS image into your live environment
- unxz the image and dd to the local hard disk
- Reboot
--- a/Documentation/boards/hardkernel/README.md
+++ b/Documentation/boards/hardkernel/README.md
@@ -1,28 +0,0 @@
-# ODROID
-
-## Supported Hardware
-
-| Device         | Release Date  | Support      | Config    |
-|----------------|---------------|--------------|-----------|
-| ODROID-C2      | 2016          | yes          | [odroid_c2](../../../buildroot-external/configs/odroid_c2_defconfig) |
-| ODROID-C4      | 2020          | yes          | [odroid_c4](../../../buildroot-external/configs/odroid_c4_defconfig) |
-| ODROID-M1      | 2022          | yes          | [odroid_m1](../../../buildroot-external/configs/odroid_m1_defconfig) |
-| ODROID-M1S     | 2023          | yes          | [odroid_m1s](../../../buildroot-external/configs/odroid_m1s_defconfig)|
-| ODROID-N2      | 2019          | yes          | [odroid_n2](../../../buildroot-external/configs/odroid_n2_defconfig) |
-| ODROID-XU4     | 2015          | yes          | [odroid_xu4](../../../buildroot-external/configs/odroid_xu4_defconfig)|
-
-See separate documentation for each board.
-
-## Connectivity devices
-
-### Wi-Fi
-
-The following devices have been tested on Home Assistant OS 5.8:
-
- [Bluetooth Module 2](https://www.hardkernel.com/shop/bluetooth-module-2/)
- [WiFi Module 3](https://www.hardkernel.com/shop/wifi-module-3/)
-
-The [WiFi Module 5A](https://www.hardkernel.com/shop/wifi-module-5a/) is not
-recommended as there is no upstream driver support available. The driver
-currently compatible with recent Linux kernel version seems to have issues
-connecting to 5GHz networks.
--- a/Documentation/boards/hardkernel/odroid-c2.md
+++ b/Documentation/boards/hardkernel/odroid-c2.md
@@ -1,22 +0,0 @@
-# ODROID-C2
-
-## eMMC
-
-eMMC support is provided transparently. Just flash the image to the eMMC board as you would an SD card.
-
-## Console
-
-By default, console access is granted over the serial header and over HDMI. Certain startup messages will only appear on the serial console by default. To show the messages on the HDMI console instead, swap the order of the two consoles in the `cmdline.txt` file on the boot partition. You can also delete the AML0 console if you don't plan on using the serial adapter.
-eg. `console=ttyAML0,115200n8 console=tty0`
-
-## USB
-
-A long-standing kernel bug currently results in some odd behavior. To use the USB, a device must be plugged into one of the USB ports at hard boot. If all devices are removed from the USB ports, the USB will cease to function until a reboot.
-
-### OTG
-
-The OTG USB is untested.
-
-## GPIO
-
-Refer to [the odroid wiki](https://wiki.odroid.com/odroid-c2/hardware/expansion_connectors).
--- a/Documentation/boards/hardkernel/odroid-c4.md
+++ b/Documentation/boards/hardkernel/odroid-c4.md
@@ -1,16 +0,0 @@
-# ODROID-C4
-
-## Experimental
-
-ODROID-C4 support is based heavily on the Odroid-C2 and N2 configurations. Given the similarity of the SoCs, as well as the comparable level of support in the Linux kernel, the C4 should hopefully present few surprises. However, Home Assistant support should be regarded as experimental.
-
-Please also refer to the documentation pages for the [ODROID-C2](./odroid-c2.md) and [Odroid-N2](./odroid-n2.md), as some of that information may apply to the C4 as well.
-
-Common C4 issues that have been specifically tested and appear to be working:
- boot from SD
- boot from eMMC
- MAC address obtained from eFuse
-
-## GPIO
-
-Refer to [the odroid wiki](https://wiki.odroid.com/odroid-c4/hardware/expansion_connectors).
--- a/Documentation/boards/hardkernel/odroid-m1.md
+++ b/Documentation/boards/hardkernel/odroid-m1.md
@@ -1,50 +0,0 @@
-# ODROID-M1
-
-Home Assistant OS 10 and newer support the ODROID-M1 board.
-
-## SD-card
-
-SD-card boot is supported via on-board bootloader (SPL) or recovery button.
-
-## eMMC
-
-eMMC boot via on-board bootloader requires a newer version of Petitboot
-(spiboot 20230328 or later). To install the latest version download the SPI boot image
-from [linuxfactory.or.kr][1] as follows:
-
-1. Download `spiupdate_odroidm1_20240415.img.xz`
-2. Use balenaEtcher or another tool to flash the updater onto an SD card
-3. Download `spiboot-20240109.img`
-4. Rename the `spiboot-20240109.img` file to`spiboot.img`.
-5. Paste the `spiboot.img` file onto the FAT partition of that same SD card.
-6. Plug-in that SD card to your ODROID-M1. Petitboot will update itself, you can verify the progress on the HDMI output.
-7. If you see the version 20240109 in the top left corner, the installation was successful.\
-   If you see any other version there, the installation failed.
-
-Once Petitboot is updated you can flash Home Assistant OS directly onto an eMMC.
-
-## NVMe
-
-Booting directly from NVMe is not supported. The NVMe card can be used as a data disk.
-
-## Technical notes on boot flow
-
-The Home Assistant OS image is bootable by the SoC directly. This means that no help
-from the Hardkernel provided and pre-installed bootloader Petitboot is necessary.
-However, the ODROID-M1 automatically boots from internal SPI. To boot
-directly off the SD-card or eMMC you need to press the recovery button.
-
-The SPI flashed U-Boot SPL tries searches for an U-Boot binary on the SD-card
-(and from eMMC with Petitboot 20230328 and later). This mechanism allows you to
-boot the Home Assistant OS U-Boot without pressing the recovery button.
-
-## Console
-
-By default, console access is available on the serial header (CON1) and on HDMI.
-The serial console's baudrate is 1500000 by default.
-
-The systemd startup messages will only appear on the serial console by default.
-To show the messages on the HDMI console instead, add the console manually
-to the `cmdline.txt` file on the boot partition (e.g. `console=tty0`).
-
-[1]: http://ppa.linuxfactory.or.kr/images/petitboot/odroidm1/
--- a/Documentation/boards/hardkernel/odroid-m1s.md
+++ b/Documentation/boards/hardkernel/odroid-m1s.md
@@ -1,58 +0,0 @@
-# ODROID-M1S
-
-Home Assistant OS 12 and newer support the ODROID-M1S board.
-
-## SD-card
-
-ODROID-M1S can boot HAOS directly from an SD card, as it has higher priority than the system on the eMMC. Simply flash the image to the SD card using your favorite tool and insert it to the micro SD slot on the board. This works even when the eMMC is wiped, or when it contains the factory-default U-Boot SPL loader, which is still able to load U-Boot provided in the HAOS image. In the second case, however, if the SD card fails to probe (e.g. due to a hardware failure), the system on the eMMC may be booted instead of HAOS.
-
-## eMMC
-
-HAOS can be installed directly to the eMMC using a special boot image, to do that:
-
-1. Download the _UMS Utility_ image: [`ODROID-M1S_EMMC2UMS.img`][1]. The _UMS Utility_ is a special image that switches ODROID-M1S to USB Mass Storage device.
-2. Use balenaEtcher or another tool to flash the _UMS utility_ onto an SD card.
-3. Plug-in that SD card to your ODROID-M1S and boot it. Connect your PC to the Micro USB OTG port.
-4. The eMMC will show as a drive on your PC and you can directly flash the HAOS image with balenaEther.
-
-Installing HAOS replaces the firmware and SPL on the eMMC with the mainline version provided by HAOS. As a result, it is not possible to use the SD card with the EMMC2UMS image anymore, because the mainline SPL is not compatible with U-Boot in the EMMC2UMS image at this time (February 2024). This does not pose any problem for standard use, just makes it more complicated in case you want to return to the Hardkernel-provided OS.
-
-A reliable way of reflashing the eMMC in this case is to use HAOS booted from an SD card. To do that, insert the SD card with HAOS to the micro SD slot and plug the board in. Once the device boots to the HA CLI, enter `login` to enter the root shell and use `curl` to download an image and `dd` it to the eMMC block device:
-
-```sh
-curl https://dn.odroid.com/RK3566/ODROID-M1S/Installer/ODROID-M1S_EMMC2UMS.img | dd of=/dev/mmcblk0
-```
-
-This way the device will start in the UMS mode on the next boot with the SD card removed. Alternatively you can use the [Hardkernel installer image][2] directly instead of the EMMC2UMS image.
-
-## NVMe
-
-Booting directly from NVMe is not supported. The NVMe card can be used as a data disk.
-
-## Technical notes on boot flow
-
-The Home Assistant OS image is bootable by the SoC directly. Refer to the [boot sequence documentation][3] for the details on what part of the boot is executed from the eMMC and what from the SD card. The steps documented above should however cover all scenarios that a standard user may encounter during usage.
-
-## Console
-
-By default, console access is available on the serial header (UART) and on HDMI.
-The serial console's baudrate is 1500000 by default.
-
-The systemd startup messages will only appear on the serial console by default.
-To show the messages on the HDMI console instead, add the console manually
-to the `cmdline.txt` file on the boot partition (e.g. `console=tty0`).
-
-## GPIO
-
-Odroid-M1S introduces a new 14pin expansion header. Refer to [the ODROID wiki][4].
-At this point not all functionality is supported by the upstream kernel used by Home Assistant OS.  
-Supported modules include:
- UPS
- Internal USB
- Mini IO board (partial support)
-
-
-[1]: https://dn.odroid.com/RK3566/ODROID-M1S/Installer/ODROID-M1S_EMMC2UMS.img
-[2]: https://wiki.odroid.com/odroid-m1s/getting_started/os_installation_guide#user_installer
-[3]: https://wiki.odroid.com/odroid-m1s/board_support/boot_sequence
-[4]: https://wiki.odroid.com/odroid-m1s/hardware/expansion_connectors
--- a/Documentation/boards/hardkernel/odroid-n2.md
+++ b/Documentation/boards/hardkernel/odroid-n2.md
@@ -1,18 +0,0 @@
-# ODROID-N2
-
-## eMMC
-
-eMMC support is provided transparently. Just flash the image to the eMMC board as you would an SD card.
-
-## Console
-
-By default, console access is granted over the serial header and over HDMI. Certain startup messages will only appear on the serial console by default. To show the messages on the HDMI console instead, swap the order of the two consoles in the `cmdline.txt` file on the boot partition. You can also delete the AML0 console if you don't plan on using the serial adapter.
-eg. `console=ttyAML0,115200n8 console=tty0`
-
-## GPIO
-
-Refer to [the odroid wiki](https://wiki.odroid.com/odroid-n2/hardware/expansion_connectors).
-At this point not all functionality is supported by the upstream kernel used
-by Home Assistant OS.
-
-The GPIO on pin 11 is used as a low active power button input.
--- a/Documentation/boards/hardkernel/odroid-xu4.md
+++ b/Documentation/boards/hardkernel/odroid-xu4.md
@@ -1,29 +0,0 @@
-# ODROID-XU4
-
-## eMMC
-
-The ODROID XU4 uses the eMMC boot partition to boot from. Typically eMMC readers can't write to this eMMC boot partition. There are a couple of possibilities:
-
-1. **Working** e.g. the eMMC already had a working image before flashing HassOS:
-   - It will be booting to U-Boot (but no further).
-     - If you have the serial adapter, you should be able to enter `distro_bootcmd` at the uboot prompt to continue booting.
-     - If not, flash the HassOS image to an SD card and boot off that temporarily (while the eMMC is also plugged in).
-   - Once booted, login at the prompts and then enter `dd if=/dev/mmcblk0 of=/dev/mmcblk0boot0 bs=512 skip=63 seek=62 count=1440` at the linux prompt.
-   - Reboot with eMMC (don't forget to flip the boot switch to eMMC)
-2. **Not Working** e.g. a clean/wiped/corruped eMMC boot partition:
-   - You'll need to follow [Hardkernel's instructions](https://forum.odroid.com/viewtopic.php?f=53&t=6173) to get a working boot sector. Then flash HassOS and follow instructions above.
-   - Alternatively, you can try flash HassOS to both an SD and eMMC, then boot off the SD with the eMMC also plugged in, then run `dd if=/dev/mmcblk1 of=/dev/mmcblk0boot0 bs=512 skip=1 seek=0 count=16381` at the Linux prompt. Note that this is untested, but in theory should work..
-
-If you are getting permissions issues when using the dd command, try disabling RO:
-`echo 0 > /sys/block/mmcblk0boot0/force_ro`
-to re-enable after running dd:
-`echo 1 > /sys/block/mmcblk0boot0/force_ro`
-
-## Console
-
-By default, console access is granted over the serial header and over HDMI. Certain startup messages will only appear on the serial console by default. To show the messages on the HDMI console instead, swap the order of the two consoles in the `cmdline.txt` file on the boot partition. You can also delete the SAC2 console if you don't plan on using the serial adapter.
-eg. `console=tty1 console=ttySAC2,115200`
-
-## GPIO
-
-Refer to [the odroid wiki](https://wiki.odroid.com/odroid-xu4/hardware/expansion_connectors).
--- a/Documentation/boards/ova/README.md
+++ b/Documentation/boards/ova/README.md
@@ -1,22 +0,0 @@
-# Virtual Machine
-
-## Supported Hypervisors
-
-| Hypervisor          | Vendor    | Support         | Config             |
-|---------------------|-----------|-----------------|--------------------|
-| HyperV              | Microsoft | yes, via VMDK   | [ova](../../../buildroot-external/configs/ova_defconfig)              |
-| VirtualBox          | Oracle    | yes, via VMDK   | [ova](../../../buildroot-external/configs/ova_defconfig)              |
-| VMware              | VMware    | yes, via VMDK   | [ova](../../../buildroot-external/configs/ova_defconfig)              |
-
-Currently we only publish a VMDK virtual disk due to issues with our previous OVA distribution. We are investigating our options to bring back the OVA distribution, however, the VMDK works for the hypervisors listed above.
-
-## Requirements
-
-Using this VMDK in a virtual machine requires the following:
-
- Operating system: Other 4.x or later Linux (64-bit)
- Enabled support for UEFI boot
- SATA disk controller
- Minimal of 1GB RAM
- At least 2x vCPU
- An assigned network
--- a/Documentation/boards/raspberrypi/README.md
+++ b/Documentation/boards/raspberrypi/README.md
@@ -1,50 +0,0 @@
-# Raspberry PI
-
-## Supported Hardware
-
-| Device              | Release Date  | Support         | Config             |
-|---------------------|---------------|-----------------|--------------------|
-| Raspberry Pi 2 B    |2015           | not recommended | [rpi2](../../../buildroot-external/configs/rpi2_defconfig)             |
-| Raspberry Pi 3 B/B+ |2016/2018      | yes             | [rpi3](../../../buildroot-external/configs/rpi3_defconfig) / [rpi3_64](../../../buildroot-external/configs/rpi3_64_defconfig) |
-| Raspberry Pi 4 B    |2019           | yes             | [rpi4](../../../buildroot-external/configs/rpi4_defconfig) / [rpi4_64](../../../buildroot-external/configs/rpi4_64_defconfig) |
-| Raspberry Pi 5      |2023           | yes (beta)      | [rpi5_64](../../../buildroot-external/configs/rpi5_64_defconfig) |
-
-## Serial console
-
-For access to terminal over serial console, add `console=ttyAMA0,115200` to `cmdline.txt` and `enable_uart=1`, `dtoverlay=pi3-disable-bt` into `config.txt`. GPIO pins are: 6 = GND / 8 = UART TXD / 10 = UART RXD.
-
-## I2C
-
-Add `dtparam=i2c1=on` and `dtparam=i2c_arm=on` to `config.txt`. After that we create a module file on host with [config usb stick][config] or direct into `/etc/modules-load.d`.
-
-rpi-i2c.conf:
-```
-i2c-dev
-i2c-bcm2708
-```
-
-## USB Boot
-
-USB mass storage boot is available on Raspberry Pi 4 (64-bit only), 3B, 3B+, 3A+, and 2B v1.2.
-
-For Raspberry 3B, 3A+ and 2B v1.2, to enable USB boot, add `program_usb_boot_mode=1` into `config.txt`. Note that this **permanently** alters the one-time programmable memory of the device.
-
-For Raspberry 4
-
-* Make sure to update the bootloader to a stable release supporting USB mass storage boot (see [bcm2711_bootloader_config.md](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711_bootloader_config.md#usbmassstorageboot)). 
-* If no SD card is used add `sd_poll_once=on` to `dtparam` in `config.txt` (comma separated). This gets rid of `mmc0: timeout waiting for hardware interrupt` kernel errors.
-* If install still fails, then your SSD likely needs quirks enabled to work correctly (see [Finding the VID and PID of your USB SSD](https://www.raspberrypi.org/forums/viewtopic.php?t=245931)). Once you find your adapter's ID, add the quirks parameter in `cmdline.txt`. 
-
-For more information see [RaspberryPi](https://www.raspberrypi.org/documentation/hardware/raspberrypi/bootmodes/msd.md).
-
-### Caveats
-
-* All bootable SD cards must be removed.
-* Boot time can be significantly longer with USB. This is due to the boot process first attempting to boot from SD card, failing, and resorting to USB.
-* Many USB drives simply do not work for boot. This is likely due to minimal driver support in uboot and will not be fixed. If you can't get it to boot on one drive, try a different brand/model. SanDisk Cruzer drives seem to have a higher rate of issues.
-
-## Tweaks
-
-If you don't need bluetooth, disabled it with add `dtoverlay=pi3-disable-bt` into `config.txt`.
-
-[config]: ../../configuration.md#automatic
--- a/Documentation/configuration.md
+++ b/Documentation/configuration.md
@@ -1,63 +0,0 @@
-# Configuration
-
-## Automatic
-
-You can use an USB drive with HassOS to configure network options, SSH access to the host and to install updates.
-Format a USB stick with FAT32/EXT4/NTFS and name it `CONFIG` (in all capitals). Alternative you can create a `CONFIG` folder inside the `boot` partition. Use the following directory structure within the USB drive:
-
-```text
-network/
-modules/
-modprobe/
-udev/
-authorized_keys
-timesyncd.conf
-hassos-xy.raucb
-```
-
- The `network` folder can contain any kind of NetworkManager connection files. For more information see [Network][network.md].
- The `modules` folder is for modules-load configuration files.
- The `modprobe` folder is for modules configuration files (/etc/modprobe.d)
- The `udev` folder is for udev rules files.
- The `authorized_keys` file activates debug SSH access on port `22222`. See [Debugging Home Assistant][debug-homeassistant].
- The `timesyncd.conf` file allow you to set different NTP servers. HassOS won't boot without correct working time servers!
- The `hassos-*.raucb` file is a firmware OTA update which will be installed. These can be found on on the [release][hassos-release] page.
-
-Text files that are on USB stick must have Unix (LF) end of line characters. If you create USB stick on Windows machine, be sure to use Notepad++, Visual Studio Code or any other editor, that supports different line endings. In Notepad++ LF EOL can be enabled with setting `Edit -> EOL Conversion -> Unix (LF)`.
-
-You can put this USB stick into the device and it will be read on startup and files written to the correct places. You can also trigger this process later using `ha os import` from the CLI or by calling `systemctl restart hassos-config` on the OS shell. *The USB Stick just needs to be inserted to the device during this setup process and can be removed afterwards.*
-
-## Local
-
-### Bootargs
-
-You can edit or create a `cmdline.txt` in your boot partition. That will be read from the bootloader.
-
-### Kernel-Module
-
-The kernel module folder `/etc/modules-load.d` is persistent and you can add your configuration files there. See [Systemd modules load][systemd-modules]. You can add the modules configuration files in `/etc/modprobe.d` that is also persistent.
-
-### Udev rules
-
-The udev rules folder `/etc/udev/rules.d` is persistent and you can add your configuration files there.
-
-### Network
-
-You can manual add, edit or remove connections configurations from `/etc/NetworkManager/system-connections`.
-
-### NTP
-
-You can manual edit the systemd timesync file on `/etc/systemd/timesyncd.conf`.
-
-Our default NTP configuration look like:
-
-```
-[Time]
-NTP=time.cloudflare.com
-FallbackNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org
-```
-
-[systemd-modules]: https://www.freedesktop.org/software/systemd/man/modules-load.d.html
-[network.md]: network.md
-[hassos-release]: https://github.com/home-assistant/hassos/releases/
-[debug-homeassistant]: https://developers.home-assistant.io/docs/operating-system/debugging
--- a/Documentation/kernel.md
+++ b/Documentation/kernel.md
@@ -3,22 +3,22 @@

 | Board | Version |
 |-------|---------|
-| Open Virtual Appliance | 6.12.30 |
-| Raspberry Pi | 6.12.25 |
-| Raspberry Pi 0-W | 6.12.25 |
-| Raspberry Pi 2 | 6.12.25 |
-| Raspberry Pi 3 | 6.12.25 |
-| Raspberry Pi 4 | 6.12.25 |
-| Raspberry Pi 5 | 6.12.25 |
-| Home Assistant Yellow | 6.12.25 |
-| Home Assistant Green | 6.12.30 |
-| Tinker Board | 6.12.30 |
-| ODROID-C2 | 6.12.30 |
-| ODROID-C4 | 6.12.30 |
-| ODROID-M1 | 6.12.30 |
-| ODROID-M1S | 6.12.30 |
-| ODROID-N2 | 6.12.30 |
-| ODROID-XU4 | 6.12.30 |
-| Generic aarch64 | 6.12.30 |
-| Generic x86-64 | 6.12.30 |
-| Khadas VIM3 | 6.12.30 |
+| Open Virtual Appliance | 6.12.51 |
+| Raspberry Pi | 6.12.47 |
+| Raspberry Pi 0-W | 6.12.47 |
+| Raspberry Pi 2 | 6.12.47 |
+| Raspberry Pi 3 | 6.12.47 |
+| Raspberry Pi 4 | 6.12.47 |
+| Raspberry Pi 5 | 6.12.47 |
+| Home Assistant Yellow | 6.12.47 |
+| Home Assistant Green | 6.12.51 |
+| Tinker Board | 6.12.51 |
+| ODROID-C2 | 6.12.51 |
+| ODROID-C4 | 6.12.51 |
+| ODROID-M1 | 6.12.51 |
+| ODROID-M1S | 6.12.51 |
+| ODROID-N2 | 6.12.51 |
+| ODROID-XU4 | 6.12.51 |
+| Generic aarch64 | 6.12.51 |
+| Generic x86-64 | 6.12.51 |
+| Khadas VIM3 | 6.12.51 |
--- a/Documentation/network.md
+++ b/Documentation/network.md
@@ -1,193 +0,0 @@
-# Network
-
-Home Assistant Operating System uses NetworkManager to control the host network.
-
-## Configure network
-
-By default the device will be in DHCP state.
-
-Basic network settings can be set through the Supervisor frontend in the System
-tab. Advanced configurations such as VLAN are also available through the
-`ha network` CLI command.
-
-To restore the default configuration the `ha network` CLI command can be used as
-well:
-
-```
-ha network update default --ipv4-method auto
-```
-
-If more advanced network settings are required network connection files can be
-placed on a USB drive and imported to the host as described in
-[Configuration][configuration-usb].
-
-## Manual Network Configuration
-
-If the frontend or `ha network` CLI cannot meet your use case, it is still
-possible to configure the underlying NetworkManager manually.
-
-You can read the [NetworkManager manual][nm-manual] or find many configuration
-examples across the internet. Note that changes to `NetworkManager.conf` are
-not supported currently, only connection keyfiles are supported. Keep in mind
-that the system is read-only. If you don't want the IP address to change on
-every boot, you should modify the UUID property to a generic [UUID4][uuid].
-Inside the `\CONFIG\network\` directory on the USB drive or SD card, create a
-file called `my-network` and add the appropriate contents below:
-
-**NOTE: Please make sure to save this file with UNIX line endings (LF, and not Windows' default CRLF endings). You can do this using Notepad these days!**
-
-### Default
-
-A preinstalled connection profile for wired network is active by default:
-
-```ini
-[connection]
-id=Home Assistant OS default
-uuid=f62bf7c2-e565-49ff-bbfc-a4cf791e6add
-type=802-3-ethernet
-llmnr=2
-mdns=2
-
-[ipv4]
-method=auto
-
-[ipv6]
-addr-gen-mode=stable-privacy
-method=auto
-```
-
-### Wired connection to the LAN
-
-```ini
-[connection]
-id=my-network
-uuid=d55162b4-6152-4310-9312-8f4c54d86afa
-type=802-3-ethernet
-llmnr=2
-mdns=2
-
-[ipv4]
-method=auto
-
-[ipv6]
-addr-gen-mode=stable-privacy
-method=auto
-```
-
-### Wireless LAN WPA/PSK
-
-```ini
-[connection]
-id=my-network
-uuid=72111c67-4a5d-4d5c-925e-f8ee26efb3c3
-type=802-11-wireless
-
-[802-11-wireless]
-mode=infrastructure
-ssid=MY_SSID
-# Uncomment below if your SSID is not broadcasted
-#hidden=true
-
-[802-11-wireless-security]
-auth-alg=open
-key-mgmt=wpa-psk
-psk=MY_WLAN_SECRET_KEY
-
-[ipv4]
-method=auto
-
-[ipv6]
-addr-gen-mode=stable-privacy
-method=auto
-```
-
-### Static IP
-
-Replace the following configuration:
-
-```ini
-[ipv4]
-method=manual
-address=192.168.1.111/24;192.168.1.1
-dns=8.8.8.8;8.8.4.4;
-```
-
-For `address`, the value before the semicolon is the IP address and subnet prefix bitlength. The second value (after the semicolon) is the IP address of the local gateway.
-
-## Tips
-
-### Reset network
-
-If you want to reset the network configuration back to the default connection
-profile using DHCP, use the following commands on the host console:
-
-```bash
-# rm -r /mnt/overlay/etc/NetworkManager/system-connections
-# reboot
-```
-
-Home Assistant OS will recreate the default connection profile during boot.
-
-### Enabling Wi-Fi
-
-Wi-Fi is discouraged for reliability reasons. However, if you still prefer to use Wi-Fi, you can us the `ha network` command to set up Wi-Fi (example for a Raspberry Pi 4, check `ha network info` to check if your board supports Wi-Fi and the name of the Wi-Fi device):
-
-```bash
-ha network update wlan0 --ipv4-method auto --wifi-auth wpa-psk --wifi-mode infrastructure --wifi-ssid "MY-SSID" --wifi-psk MY_PASS
-````
-
-### Powersave
-
-If you have trouble with powersave then apply the following changes:
-
-```ini
-[wifi]
-# Values are 0 (use default), 1 (ignore/don't touch), 2 (disable) or 3 (enable).
-powersave=0
-```
-
-## Using `nmcli` to set a static IPv4 address
-
-Log into the the Home Assistant OS base system via a console:
-
-```bash
-Welcome to Home Assistant
-homeassistant login:
-```
-
- Login as `root` (no password needed). At the `ha >` prompt, type `login` (as instructed).
-
-From there you use the `nmcli` configuration tool.
-
- `# nmcli con show` will list the "Home Assistant OS default" connection in use.
- `# nmcli con show "Home Assistant OS default"` will list all the properties of the connection.
-
-To start editing the configuration setting for "Home Assistant OS default":
-
-```bash
-# nmcli con edit "Home Assistant OS default"
-```
-
-To add your static IP address (select 'yes' for manual method);
-
-```bash
-nmcli> set ipv4.addresses 192.168.100.10/24
-Do you also want to set 'ipv4.method' to 'manual'? [yes]:
-```
-
-In addition, it's recommended to set the DNS server and the local gateway. For most home routers the DNS server will have the same IP address as the router itself. If you are using Pi-Hole or a third-party DNS system then you can set the DNS server to that.
-
-```bash
-nmcli> set ipv4.dns 192.168.100.1
-nmcli> set ipv4.gateway 192.168.100.1
-```
-
-`nmcli> print ipv4` will show you the IPv4 properties of this connection. With `nmcli> save` you will save the changes afterwards.
-
-If you now view the default connection `cat /etc/NetworkManager/system-connections/default` you should see the method is manual and the address is set.
-
-Doing a `nmcli con reload` does not always work, so restart the virtual machine or the physical system.
-
-[nm-manual]: https://networkmanager.dev/docs/api/1.40/manpages.html
-[configuration-usb]: configuration.md
-[uuid]: https://www.uuidgenerator.net/version4
--- a/Documentation/usb-disk.png
+++ b/Documentation/usb-disk.png
--- a/12
+++ b/12
@@ -16,6 +16,12 @@ endif

 ################################################################################

+SILENT := $(findstring s,$(word 1, $(MAKEFLAGS)))
+
+define print
+	$(if $(SILENT),,$(info $1))
+endef
+
 COLOR_STEP := $(shell tput smso 2>/dev/null)
 COLOR_WARN := $(shell (tput setab 3; tput setaf 0) 2>/dev/null)
 TERM_RESET := $(shell tput sgr0 2>/dev/null)
@@ -28,7 +34,7 @@ TERM_RESET := $(shell tput sgr0 2>/dev/null)

 # fallback target when target undefined here is given
 .DEFAULT:
-	@echo "$(COLOR_STEP)=== Falling back to Buildroot target '$@' ===$(TERM_RESET)"
+	$(call print,$(COLOR_STEP)=== Falling back to Buildroot target '$@' ===$(TERM_RESET))
 	$(MAKE) -C $(BUILDROOT) O=$(O) BR2_EXTERNAL=$(BUILDROOT_EXTERNAL) "$@"

 # default target when no target is given - must be first in Makefile
@@ -42,11 +48,11 @@ $(TARGETS_CONFIG): %-config:
 		echo ""; \
 		bash -c 'read -t 10 -p "Waiting 10s, press enter to continue or Ctrl-C to abort..."' || true; \
 	fi
-	@echo "$(COLOR_STEP)=== Using $*_defconfig ===$(TERM_RESET)"
+	$(call print,$(COLOR_STEP)=== Using $*_defconfig ===$(TERM_RESET))
 	$(MAKE) -C $(BUILDROOT) O=$(O) BR2_EXTERNAL=$(BUILDROOT_EXTERNAL) "$*_defconfig"

 $(TARGETS): %: %-config
-	@echo "$(COLOR_STEP)=== Building $@ ===$(TERM_RESET)"
+	$(call print,$(COLOR_STEP)=== Building $@ ===$(TERM_RESET))
 	$(MAKE) -C $(BUILDROOT) O=$(O) BR2_EXTERNAL=$(BUILDROOT_EXTERNAL)

 buildroot-help:
--- a/README.md
+++ b/README.md
@@ -16,14 +16,10 @@ Home Assistant Operating System uses Docker as its container engine. By default

 ## Supported hardware

- Nabu Casa
- Raspberry Pi
- Hardkernel ODROID
- Asus Tinker Board
- Generic x86-64 (e.g. Intel NUC)
- Virtual appliances
+The list of supported hardware is defined by [ADR-0015](https://github.com/home-assistant/architecture/blob/master/adr/0015-home-assistant-os.md).
+Every new hardware addition must meet at least requirements defined in [ADR-0017](https://github.com/home-assistant/architecture/blob/master/adr/0017-hardware-screening-os.md) and pass through an architecture design proposal.

-See the full list and specific models [here](./Documentation/boards/README.md)
+For documentation explaining details of the individual supported boards, see [Board support](https://developers.home-assistant.io/docs/operating-system/boards/overview) section of the Home Assistant Developer Docs.

 ## Getting Started

--- a/2
+++ b/2
--- a/buildroot-external/board/arm-uefi/generic-aarch64/hassos-hook.sh
+++ b/buildroot-external/board/arm-uefi/generic-aarch64/hassos-hook.sh
@@ -20,9 +20,11 @@ function hassos_pre_image() {

 function hassos_post_image() {
    convert_disk_image_virtual vmdk
+    convert_disk_image_virtual vdi
    convert_disk_image_virtual qcow2

    convert_disk_image_zip vmdk
+    convert_disk_image_zip vdi
    convert_disk_image_xz qcow2

    convert_disk_image_xz
--- a/buildroot-external/board/arm-uefi/generic-aarch64/kernel.config
+++ b/buildroot-external/board/arm-uefi/generic-aarch64/kernel.config
@@ -75,3 +75,10 @@ CONFIG_I2C_CADENCE=y
 # 1-wire
 CONFIG_W1_MASTER_AMD_AXI=m
 CONFIG_W1_SLAVE_THERM=m
+
+# IIO
+CONFIG_XILINX_AMS=m
+
+# Audio drivers
+CONFIG_SND_HDA_INTEL=m
+CONFIG_SND_HDA_GENERIC=m
--- a/buildroot-external/board/arm-uefi/generic-aarch64/patches/linux/0001-r8169-add-support-for-RTL8125D.patch
+++ b/buildroot-external/board/arm-uefi/generic-aarch64/patches/linux/0001-r8169-add-support-for-RTL8125D.patch
@@ -1,154 +0,0 @@
-From f0fb974644a132ecc4bd2dc5cce9622435d0ec13 Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Thu, 24 Oct 2024 22:42:33 +0200
-Subject: [PATCH] r8169: add support for RTL8125D
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This adds support for new chip version RTL8125D, which can be found on
-boards like Gigabyte X870E AORUS ELITE WIFI7. Firmware rtl8125d-1.fw
-for this chip version is available in linux-firmware already.
-
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Link: https://patch.msgid.link/d0306912-e88e-4c25-8b5d-545ae8834c0c@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f75d1fbe7809bc5ed134204b920fd9e2fc5db1df
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
---
- drivers/net/ethernet/realtek/r8169.h          |  1 +
- drivers/net/ethernet/realtek/r8169_main.c     | 23 +++++++++++++------
- .../net/ethernet/realtek/r8169_phy_config.c   | 10 ++++++++
- 3 files changed, 27 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/net/ethernet/realtek/r8169.h b/drivers/net/ethernet/realtek/r8169.h
-index e2db944e6fa8b..be4c9622618d8 100644
--- a/drivers/net/ethernet/realtek/r8169.h
-+++ b/drivers/net/ethernet/realtek/r8169.h
-@@ -68,6 +68,7 @@ enum mac_version {
- 	/* support for RTL_GIGA_MAC_VER_60 has been removed */
- 	RTL_GIGA_MAC_VER_61,
- 	RTL_GIGA_MAC_VER_63,
-+	RTL_GIGA_MAC_VER_64,
- 	RTL_GIGA_MAC_VER_65,
- 	RTL_GIGA_MAC_VER_66,
- 	RTL_GIGA_MAC_NONE
-diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
-index 5ed2818bac257..1cbde7ebd6f30 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
-+++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -55,6 +55,7 @@
- #define FIRMWARE_8107E_2	"rtl_nic/rtl8107e-2.fw"
- #define FIRMWARE_8125A_3	"rtl_nic/rtl8125a-3.fw"
- #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
-+#define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
- #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
- #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
- 
-@@ -138,6 +139,7 @@ static const struct {
- 	[RTL_GIGA_MAC_VER_61] = {"RTL8125A",		FIRMWARE_8125A_3},
- 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
- 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
-+	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
- 	[RTL_GIGA_MAC_VER_65] = {"RTL8126A",		FIRMWARE_8126A_2},
- 	[RTL_GIGA_MAC_VER_66] = {"RTL8126A",		FIRMWARE_8126A_3},
- };
-@@ -707,6 +709,7 @@ MODULE_FIRMWARE(FIRMWARE_8168FP_3);
- MODULE_FIRMWARE(FIRMWARE_8107E_2);
- MODULE_FIRMWARE(FIRMWARE_8125A_3);
- MODULE_FIRMWARE(FIRMWARE_8125B_2);
-+MODULE_FIRMWARE(FIRMWARE_8125D_1);
- MODULE_FIRMWARE(FIRMWARE_8126A_2);
- MODULE_FIRMWARE(FIRMWARE_8126A_3);
- 
-@@ -2098,10 +2101,7 @@ static void rtl_set_eee_txidle_timer(struct rtl8169_private *tp)
- 		tp->tx_lpi_timer = timer_val;
- 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
- 		break;
-	case RTL_GIGA_MAC_VER_61:
-	case RTL_GIGA_MAC_VER_63:
-	case RTL_GIGA_MAC_VER_65:
-	case RTL_GIGA_MAC_VER_66:
-+	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
- 		tp->tx_lpi_timer = timer_val;
- 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
- 		break;
-@@ -2233,6 +2233,9 @@ static enum mac_version rtl8169_get_mac_version(u16 xid, bool gmii)
- 		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_66 },
- 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_65 },
- 
-+		/* 8125D family. */
-+		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
-+
- 		/* 8125B family. */
- 		{ 0x7cf, 0x641,	RTL_GIGA_MAC_VER_63 },
- 
-@@ -2500,9 +2503,7 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
- 	case RTL_GIGA_MAC_VER_61:
- 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
- 		break;
-	case RTL_GIGA_MAC_VER_63:
-	case RTL_GIGA_MAC_VER_65:
-	case RTL_GIGA_MAC_VER_66:
-+	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
- 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
- 			RX_PAUSE_SLOT_ON);
- 		break;
-@@ -3814,6 +3815,12 @@ static void rtl_hw_start_8125b(struct rtl8169_private *tp)
- 	rtl_hw_start_8125_common(tp);
- }
- 
-+static void rtl_hw_start_8125d(struct rtl8169_private *tp)
-+{
-+	rtl_set_def_aspm_entry_latency(tp);
-+	rtl_hw_start_8125_common(tp);
-+}
-+
- static void rtl_hw_start_8126a(struct rtl8169_private *tp)
- {
- 	rtl_set_def_aspm_entry_latency(tp);
-@@ -3862,6 +3869,7 @@ static void rtl_hw_config(struct rtl8169_private *tp)
- 		[RTL_GIGA_MAC_VER_53] = rtl_hw_start_8117,
- 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
- 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
-+		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
- 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8126a,
- 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8126a,
- 	};
-@@ -3879,6 +3887,7 @@ static void rtl_hw_start_8125(struct rtl8169_private *tp)
- 	/* disable interrupt coalescing */
- 	switch (tp->mac_version) {
- 	case RTL_GIGA_MAC_VER_61:
-+	case RTL_GIGA_MAC_VER_64:
- 		for (i = 0xa00; i < 0xb00; i += 4)
- 			RTL_W32(tp, i, 0);
- 		break;
-diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c
-index cf29b12084826..d09b2a41cd062 100644
--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
-+++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
-@@ -1104,6 +1104,15 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,
- 	rtl8125b_config_eee_phy(phydev);
- }
- 
-+static void rtl8125d_hw_phy_config(struct rtl8169_private *tp,
-+				   struct phy_device *phydev)
-+{
-+	r8169_apply_firmware(tp);
-+	rtl8125_legacy_force_mode(phydev);
-+	rtl8168g_disable_aldps(phydev);
-+	rtl8125b_config_eee_phy(phydev);
-+}
-+
- static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
- 				   struct phy_device *phydev)
- {
-@@ -1160,6 +1169,7 @@ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
- 		[RTL_GIGA_MAC_VER_53] = rtl8117_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
-+		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_65] = rtl8126a_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_66] = rtl8126a_hw_phy_config,
- 	};
--- a/buildroot-external/board/arm-uefi/generic-aarch64/patches/linux/0002-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
+++ b/buildroot-external/board/arm-uefi/generic-aarch64/patches/linux/0002-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
@@ -1,143 +0,0 @@
-From acc8d5ec4b6cdbf0a9625a9f9d3710b52555f3b2 Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Tue, 15 Oct 2024 07:47:14 +0200
-Subject: [PATCH] net: phy: realtek: merge the drivers for internal NBase-T
- PHY's
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The Realtek RTL8125/RTL8126 NBase-T MAC/PHY chips have internal PHY's
-which are register-compatible, at least for the registers we use here.
-So let's use just one PHY driver to support all of them.
-These internal PHY's exist also as external C45 PHY's, but on the
-internal PHY's no access to MMD registers is possible. This can be
-used to differentiate between the internal and external version.
-
-As a side effect the drivers for two now external-only drivers don't
-require read_mmd/write_mmd hooks any longer.
-
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Link: https://patch.msgid.link/c57081a6-811f-4571-ab35-34f4ca6de9af@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f87a17ed3b51fba4dfdd8f8b643b5423a85fc551
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
---
- drivers/net/phy/realtek.c | 53 +++++++++++++++++++++++++++++++--------
- 1 file changed, 43 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
-index 166f6a7283731..830a0d337de5d 100644
--- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -92,6 +92,7 @@
- 
- #define RTL_GENERIC_PHYID			0x001cc800
- #define RTL_8211FVD_PHYID			0x001cc878
-+#define RTL_8221B				0x001cc840
- #define RTL_8221B_VB_CG				0x001cc849
- #define RTL_8221B_VN_CG				0x001cc84a
- #define RTL_8251B				0x001cc862
-@@ -1040,6 +1041,23 @@ static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
- 	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
- }
- 
-+/* On internal PHY's MMD reads over C22 always return 0.
-+ * Check a MMD register which is known to be non-zero.
-+ */
-+static bool rtlgen_supports_mmd(struct phy_device *phydev)
-+{
-+	int val;
-+
-+	phy_lock_mdio_bus(phydev);
-+	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
-+	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
-+	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
-+	val = __phy_read(phydev, MII_MMD_DATA);
-+	phy_unlock_mdio_bus(phydev);
-+
-+	return val > 0;
-+}
-+
- static int rtlgen_match_phy_device(struct phy_device *phydev)
- {
- 	return phydev->phy_id == RTL_GENERIC_PHYID &&
-@@ -1049,7 +1067,8 @@ static int rtlgen_match_phy_device(struct phy_device *phydev)
- static int rtl8226_match_phy_device(struct phy_device *phydev)
- {
- 	return phydev->phy_id == RTL_GENERIC_PHYID &&
-	       rtlgen_supports_2_5gbps(phydev);
-+	       rtlgen_supports_2_5gbps(phydev) &&
-+	       rtlgen_supports_mmd(phydev);
- }
- 
- static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
-@@ -1061,6 +1080,11 @@ static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
- 		return !is_c45 && (id == phydev->phy_id);
- }
- 
-+static int rtl8221b_match_phy_device(struct phy_device *phydev)
-+{
-+	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
-+}
-+
- static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
- {
- 	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
-@@ -1081,9 +1105,21 @@ static int rtl8221b_vn_cg_c45_match_phy_device(struct phy_device *phydev)
- 	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
- }
- 
-static int rtl8251b_c22_match_phy_device(struct phy_device *phydev)
-+static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
- {
-	return rtlgen_is_c45_match(phydev, RTL_8251B, false);
-+	if (phydev->is_c45)
-+		return false;
-+
-+	switch (phydev->phy_id) {
-+	case RTL_GENERIC_PHYID:
-+	case RTL_8221B:
-+	case RTL_8251B:
-+		break;
-+	default:
-+		return false;
-+	}
-+
-+	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
- }
- 
- static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
-@@ -1345,10 +1381,8 @@ static struct phy_driver realtek_drvs[] = {
- 		.resume		= rtlgen_resume,
- 		.read_page	= rtl821x_read_page,
- 		.write_page	= rtl821x_write_page,
-		.read_mmd	= rtl822x_read_mmd,
-		.write_mmd	= rtl822x_write_mmd,
- 	}, {
-		PHY_ID_MATCH_EXACT(0x001cc840),
-+		.match_phy_device = rtl8221b_match_phy_device,
- 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
- 		.get_features	= rtl822x_get_features,
- 		.config_aneg	= rtl822x_config_aneg,
-@@ -1359,8 +1393,6 @@ static struct phy_driver realtek_drvs[] = {
- 		.resume		= rtlgen_resume,
- 		.read_page	= rtl821x_read_page,
- 		.write_page	= rtl821x_write_page,
-		.read_mmd	= rtl822x_read_mmd,
-		.write_mmd	= rtl822x_write_mmd,
- 	}, {
- 		PHY_ID_MATCH_EXACT(0x001cc838),
- 		.name           = "RTL8226-CG 2.5Gbps PHY",
-@@ -1438,8 +1470,9 @@ static struct phy_driver realtek_drvs[] = {
- 		.read_page      = rtl821x_read_page,
- 		.write_page     = rtl821x_write_page,
- 	}, {
-		.match_phy_device = rtl8251b_c22_match_phy_device,
-		.name           = "RTL8126A-internal 5Gbps PHY",
-+		.match_phy_device = rtl_internal_nbaset_match_phy_device,
-+		.name           = "Realtek Internal NBASE-T PHY",
-+		.flags		= PHY_IS_INTERNAL,
- 		.get_features   = rtl822x_get_features,
- 		.config_aneg    = rtl822x_config_aneg,
- 		.read_status    = rtl822x_read_status,
--- a/buildroot-external/board/arm-uefi/generic-aarch64/patches/linux/0003-net-phy-realtek-add-RTL8125D-internal-PHY.patch
+++ b/buildroot-external/board/arm-uefi/generic-aarch64/patches/linux/0003-net-phy-realtek-add-RTL8125D-internal-PHY.patch
@@ -1,36 +0,0 @@
-From 7ab842c714924784cae4b6ab229997905b096b4f Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Thu, 17 Oct 2024 18:01:13 +0200
-Subject: [PATCH] net: phy: realtek: add RTL8125D-internal PHY
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The first boards show up with Realtek's RTL8125D. This MAC/PHY chip
-comes with an integrated 2.5Gbps PHY with ID 0x001cc841. It's not
-clear yet whether there's an external version of this PHY and how
-Realtek calls it, therefore use the numeric id for now.
-
-Link: https://lore.kernel.org/netdev/2ada65e1-5dfa-456c-9334-2bc51272e9da@gmail.com/T/
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Message-ID: <7d2924de-053b-44d2-a479-870dc3878170@gmail.com>
-Reviewed-by: Andrew Lunn <andrew@lunn.ch>
-Signed-off-by: Andrew Lunn <andrew@lunn.ch>
-Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8989bad541133c43550bff2b80edbe37b8fb9659
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
---
- drivers/net/phy/realtek.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
-index 830a0d337de5d..8ce5705af69c5 100644
--- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -1114,6 +1114,7 @@ static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
- 	case RTL_GENERIC_PHYID:
- 	case RTL_8221B:
- 	case RTL_8251B:
-+	case 0x001cc841:
- 		break;
- 	default:
- 		return false;
--- a/buildroot-external/board/hardkernel/kernel-amlogic.config
+++ b/buildroot-external/board/hardkernel/kernel-amlogic.config
@@ -285,8 +285,6 @@ CONFIG_HNS3=y
 CONFIG_HNS3_HCLGE=y
 CONFIG_HNS3_ENET=y
 CONFIG_E1000E=y
-CONFIG_IGB=y
-CONFIG_IGBVF=y
 CONFIG_MVMDIO=y
 CONFIG_SKY2=y
 CONFIG_MLX4_EN=m
--- a/buildroot-external/board/khadas/kernel-vim.config
+++ b/buildroot-external/board/khadas/kernel-vim.config
@@ -209,8 +209,6 @@ CONFIG_HNS3=y
 CONFIG_HNS3_HCLGE=y
 CONFIG_HNS3_ENET=y
 CONFIG_E1000E=y
-CONFIG_IGB=y
-CONFIG_IGBVF=y
 CONFIG_MVMDIO=y
 CONFIG_SKY2=y
 CONFIG_MLX4_EN=m
--- a/buildroot-external/board/pc/generic-x86-64/kernel.config
+++ b/buildroot-external/board/pc/generic-x86-64/kernel.config
@@ -10,6 +10,7 @@ CONFIG_INTEL_IDLE=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
 CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y

 CONFIG_SCSI_LOWLEVEL=y
 CONFIG_SCSI_HPSA=y
@@ -45,6 +46,7 @@ CONFIG_MMC_SDHCI_ACPI=y
 CONFIG_MMC_SDHCI_PCI=y
 CONFIG_MMC_REALTEK_PCI=m
 CONFIG_MMC_REALTEK_USB=m
+CONFIG_X86_X2APIC=y
 CONFIG_X86_INTEL_LPSS=y

 CONFIG_MISC_RTSX_PCI=m
@@ -162,3 +164,9 @@ CONFIG_BMP280=m

 # Required for some PCIe devices such as ath12k
 CONFIG_IRQ_REMAP=y
+
+# Pin control support
+CONFIG_PINCTRL_CANNONLAKE=m
+
+# Network devices
+CONFIG_MARVELL_PHY=m
--- a/buildroot-external/board/pc/ova/kernel.config
+++ b/buildroot-external/board/pc/ova/kernel.config
@@ -97,6 +97,7 @@ CONFIG_MMC_BLOCK=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_ACPI=y
 CONFIG_MMC_SDHCI_PCI=y
+CONFIG_X86_X2APIC=y
 CONFIG_X86_INTEL_LPSS=y

 CONFIG_DRM=y
@@ -116,6 +117,7 @@ CONFIG_PCI_HYPERV=m
 CONFIG_PCI_HYPERV_INTERFACE=m
 CONFIG_FB_HYPERV=y

+CONFIG_CHELSIO_T4VF=m
 CONFIG_IGBVF=m
 CONFIG_IXGBEVF=m
 CONFIG_I40EVF=m
--- a/buildroot-external/board/pc/patches/linux/0001-r8169-add-support-for-RTL8125D.patch
+++ b/buildroot-external/board/pc/patches/linux/0001-r8169-add-support-for-RTL8125D.patch
@@ -1,154 +0,0 @@
-From f0fb974644a132ecc4bd2dc5cce9622435d0ec13 Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Thu, 24 Oct 2024 22:42:33 +0200
-Subject: [PATCH] r8169: add support for RTL8125D
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This adds support for new chip version RTL8125D, which can be found on
-boards like Gigabyte X870E AORUS ELITE WIFI7. Firmware rtl8125d-1.fw
-for this chip version is available in linux-firmware already.
-
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Link: https://patch.msgid.link/d0306912-e88e-4c25-8b5d-545ae8834c0c@gmail.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f75d1fbe7809bc5ed134204b920fd9e2fc5db1df
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
---
- drivers/net/ethernet/realtek/r8169.h          |  1 +
- drivers/net/ethernet/realtek/r8169_main.c     | 23 +++++++++++++------
- .../net/ethernet/realtek/r8169_phy_config.c   | 10 ++++++++
- 3 files changed, 27 insertions(+), 7 deletions(-)
-
-diff --git a/drivers/net/ethernet/realtek/r8169.h b/drivers/net/ethernet/realtek/r8169.h
-index e2db944e6fa8b..be4c9622618d8 100644
--- a/drivers/net/ethernet/realtek/r8169.h
-+++ b/drivers/net/ethernet/realtek/r8169.h
-@@ -68,6 +68,7 @@ enum mac_version {
- 	/* support for RTL_GIGA_MAC_VER_60 has been removed */
- 	RTL_GIGA_MAC_VER_61,
- 	RTL_GIGA_MAC_VER_63,
-+	RTL_GIGA_MAC_VER_64,
- 	RTL_GIGA_MAC_VER_65,
- 	RTL_GIGA_MAC_VER_66,
- 	RTL_GIGA_MAC_NONE
-diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
-index 5ed2818bac257..1cbde7ebd6f30 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
-+++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -55,6 +55,7 @@
- #define FIRMWARE_8107E_2	"rtl_nic/rtl8107e-2.fw"
- #define FIRMWARE_8125A_3	"rtl_nic/rtl8125a-3.fw"
- #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
-+#define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
- #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
- #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
- 
-@@ -138,6 +139,7 @@ static const struct {
- 	[RTL_GIGA_MAC_VER_61] = {"RTL8125A",		FIRMWARE_8125A_3},
- 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
- 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
-+	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
- 	[RTL_GIGA_MAC_VER_65] = {"RTL8126A",		FIRMWARE_8126A_2},
- 	[RTL_GIGA_MAC_VER_66] = {"RTL8126A",		FIRMWARE_8126A_3},
- };
-@@ -707,6 +709,7 @@ MODULE_FIRMWARE(FIRMWARE_8168FP_3);
- MODULE_FIRMWARE(FIRMWARE_8107E_2);
- MODULE_FIRMWARE(FIRMWARE_8125A_3);
- MODULE_FIRMWARE(FIRMWARE_8125B_2);
-+MODULE_FIRMWARE(FIRMWARE_8125D_1);
- MODULE_FIRMWARE(FIRMWARE_8126A_2);
- MODULE_FIRMWARE(FIRMWARE_8126A_3);
- 
-@@ -2098,10 +2101,7 @@ static void rtl_set_eee_txidle_timer(struct rtl8169_private *tp)
- 		tp->tx_lpi_timer = timer_val;
- 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
- 		break;
-	case RTL_GIGA_MAC_VER_61:
-	case RTL_GIGA_MAC_VER_63:
-	case RTL_GIGA_MAC_VER_65:
-	case RTL_GIGA_MAC_VER_66:
-+	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
- 		tp->tx_lpi_timer = timer_val;
- 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
- 		break;
-@@ -2233,6 +2233,9 @@ static enum mac_version rtl8169_get_mac_version(u16 xid, bool gmii)
- 		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_66 },
- 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_65 },
- 
-+		/* 8125D family. */
-+		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
-+
- 		/* 8125B family. */
- 		{ 0x7cf, 0x641,	RTL_GIGA_MAC_VER_63 },
- 
-@@ -2500,9 +2503,7 @@ static void rtl_init_rxcfg(struct rtl8169_private *tp)
- 	case RTL_GIGA_MAC_VER_61:
- 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
- 		break;
-	case RTL_GIGA_MAC_VER_63:
-	case RTL_GIGA_MAC_VER_65:
-	case RTL_GIGA_MAC_VER_66:
-+	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
- 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
- 			RX_PAUSE_SLOT_ON);
- 		break;
-@@ -3814,6 +3815,12 @@ static void rtl_hw_start_8125b(struct rtl8169_private *tp)
- 	rtl_hw_start_8125_common(tp);
- }
- 
-+static void rtl_hw_start_8125d(struct rtl8169_private *tp)
-+{
-+	rtl_set_def_aspm_entry_latency(tp);
-+	rtl_hw_start_8125_common(tp);
-+}
-+
- static void rtl_hw_start_8126a(struct rtl8169_private *tp)
- {
- 	rtl_set_def_aspm_entry_latency(tp);
-@@ -3862,6 +3869,7 @@ static void rtl_hw_config(struct rtl8169_private *tp)
- 		[RTL_GIGA_MAC_VER_53] = rtl_hw_start_8117,
- 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
- 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
-+		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
- 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8126a,
- 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8126a,
- 	};
-@@ -3879,6 +3887,7 @@ static void rtl_hw_start_8125(struct rtl8169_private *tp)
- 	/* disable interrupt coalescing */
- 	switch (tp->mac_version) {
- 	case RTL_GIGA_MAC_VER_61:
-+	case RTL_GIGA_MAC_VER_64:
- 		for (i = 0xa00; i < 0xb00; i += 4)
- 			RTL_W32(tp, i, 0);
- 		break;
-diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c
-index cf29b12084826..d09b2a41cd062 100644
--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
-+++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
-@@ -1104,6 +1104,15 @@ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,
- 	rtl8125b_config_eee_phy(phydev);
- }
- 
-+static void rtl8125d_hw_phy_config(struct rtl8169_private *tp,
-+				   struct phy_device *phydev)
-+{
-+	r8169_apply_firmware(tp);
-+	rtl8125_legacy_force_mode(phydev);
-+	rtl8168g_disable_aldps(phydev);
-+	rtl8125b_config_eee_phy(phydev);
-+}
-+
- static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
- 				   struct phy_device *phydev)
- {
-@@ -1160,6 +1169,7 @@ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
- 		[RTL_GIGA_MAC_VER_53] = rtl8117_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
-+		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_65] = rtl8126a_hw_phy_config,
- 		[RTL_GIGA_MAC_VER_66] = rtl8126a_hw_phy_config,
- 	};
--- a/buildroot-external/board/pc/patches/linux/0002-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
+++ b/buildroot-external/board/pc/patches/linux/0002-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
@@ -1,143 +0,0 @@
-From acc8d5ec4b6cdbf0a9625a9f9d3710b52555f3b2 Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Tue, 15 Oct 2024 07:47:14 +0200
-Subject: [PATCH] net: phy: realtek: merge the drivers for internal NBase-T
- PHY's
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The Realtek RTL8125/RTL8126 NBase-T MAC/PHY chips have internal PHY's
-which are register-compatible, at least for the registers we use here.
-So let's use just one PHY driver to support all of them.
-These internal PHY's exist also as external C45 PHY's, but on the
-internal PHY's no access to MMD registers is possible. This can be
-used to differentiate between the internal and external version.
-
-As a side effect the drivers for two now external-only drivers don't
-require read_mmd/write_mmd hooks any longer.
-
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Link: https://patch.msgid.link/c57081a6-811f-4571-ab35-34f4ca6de9af@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f87a17ed3b51fba4dfdd8f8b643b5423a85fc551
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
---
- drivers/net/phy/realtek.c | 53 +++++++++++++++++++++++++++++++--------
- 1 file changed, 43 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
-index 166f6a7283731..830a0d337de5d 100644
--- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -92,6 +92,7 @@
- 
- #define RTL_GENERIC_PHYID			0x001cc800
- #define RTL_8211FVD_PHYID			0x001cc878
-+#define RTL_8221B				0x001cc840
- #define RTL_8221B_VB_CG				0x001cc849
- #define RTL_8221B_VN_CG				0x001cc84a
- #define RTL_8251B				0x001cc862
-@@ -1040,6 +1041,23 @@ static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
- 	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
- }
- 
-+/* On internal PHY's MMD reads over C22 always return 0.
-+ * Check a MMD register which is known to be non-zero.
-+ */
-+static bool rtlgen_supports_mmd(struct phy_device *phydev)
-+{
-+	int val;
-+
-+	phy_lock_mdio_bus(phydev);
-+	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
-+	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
-+	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
-+	val = __phy_read(phydev, MII_MMD_DATA);
-+	phy_unlock_mdio_bus(phydev);
-+
-+	return val > 0;
-+}
-+
- static int rtlgen_match_phy_device(struct phy_device *phydev)
- {
- 	return phydev->phy_id == RTL_GENERIC_PHYID &&
-@@ -1049,7 +1067,8 @@ static int rtlgen_match_phy_device(struct phy_device *phydev)
- static int rtl8226_match_phy_device(struct phy_device *phydev)
- {
- 	return phydev->phy_id == RTL_GENERIC_PHYID &&
-	       rtlgen_supports_2_5gbps(phydev);
-+	       rtlgen_supports_2_5gbps(phydev) &&
-+	       rtlgen_supports_mmd(phydev);
- }
- 
- static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
-@@ -1061,6 +1080,11 @@ static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
- 		return !is_c45 && (id == phydev->phy_id);
- }
- 
-+static int rtl8221b_match_phy_device(struct phy_device *phydev)
-+{
-+	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
-+}
-+
- static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
- {
- 	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
-@@ -1081,9 +1105,21 @@ static int rtl8221b_vn_cg_c45_match_phy_device(struct phy_device *phydev)
- 	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
- }
- 
-static int rtl8251b_c22_match_phy_device(struct phy_device *phydev)
-+static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
- {
-	return rtlgen_is_c45_match(phydev, RTL_8251B, false);
-+	if (phydev->is_c45)
-+		return false;
-+
-+	switch (phydev->phy_id) {
-+	case RTL_GENERIC_PHYID:
-+	case RTL_8221B:
-+	case RTL_8251B:
-+		break;
-+	default:
-+		return false;
-+	}
-+
-+	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
- }
- 
- static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
-@@ -1345,10 +1381,8 @@ static struct phy_driver realtek_drvs[] = {
- 		.resume		= rtlgen_resume,
- 		.read_page	= rtl821x_read_page,
- 		.write_page	= rtl821x_write_page,
-		.read_mmd	= rtl822x_read_mmd,
-		.write_mmd	= rtl822x_write_mmd,
- 	}, {
-		PHY_ID_MATCH_EXACT(0x001cc840),
-+		.match_phy_device = rtl8221b_match_phy_device,
- 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
- 		.get_features	= rtl822x_get_features,
- 		.config_aneg	= rtl822x_config_aneg,
-@@ -1359,8 +1393,6 @@ static struct phy_driver realtek_drvs[] = {
- 		.resume		= rtlgen_resume,
- 		.read_page	= rtl821x_read_page,
- 		.write_page	= rtl821x_write_page,
-		.read_mmd	= rtl822x_read_mmd,
-		.write_mmd	= rtl822x_write_mmd,
- 	}, {
- 		PHY_ID_MATCH_EXACT(0x001cc838),
- 		.name           = "RTL8226-CG 2.5Gbps PHY",
-@@ -1438,8 +1470,9 @@ static struct phy_driver realtek_drvs[] = {
- 		.read_page      = rtl821x_read_page,
- 		.write_page     = rtl821x_write_page,
- 	}, {
-		.match_phy_device = rtl8251b_c22_match_phy_device,
-		.name           = "RTL8126A-internal 5Gbps PHY",
-+		.match_phy_device = rtl_internal_nbaset_match_phy_device,
-+		.name           = "Realtek Internal NBASE-T PHY",
-+		.flags		= PHY_IS_INTERNAL,
- 		.get_features   = rtl822x_get_features,
- 		.config_aneg    = rtl822x_config_aneg,
- 		.read_status    = rtl822x_read_status,
--- a/buildroot-external/board/pc/patches/linux/0003-net-phy-realtek-add-RTL8125D-internal-PHY.patch
+++ b/buildroot-external/board/pc/patches/linux/0003-net-phy-realtek-add-RTL8125D-internal-PHY.patch
@@ -1,36 +0,0 @@
-From 7ab842c714924784cae4b6ab229997905b096b4f Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Thu, 17 Oct 2024 18:01:13 +0200
-Subject: [PATCH] net: phy: realtek: add RTL8125D-internal PHY
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The first boards show up with Realtek's RTL8125D. This MAC/PHY chip
-comes with an integrated 2.5Gbps PHY with ID 0x001cc841. It's not
-clear yet whether there's an external version of this PHY and how
-Realtek calls it, therefore use the numeric id for now.
-
-Link: https://lore.kernel.org/netdev/2ada65e1-5dfa-456c-9334-2bc51272e9da@gmail.com/T/
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Message-ID: <7d2924de-053b-44d2-a479-870dc3878170@gmail.com>
-Reviewed-by: Andrew Lunn <andrew@lunn.ch>
-Signed-off-by: Andrew Lunn <andrew@lunn.ch>
-Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8989bad541133c43550bff2b80edbe37b8fb9659
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
---
- drivers/net/phy/realtek.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
-index 830a0d337de5d..8ce5705af69c5 100644
--- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -1114,6 +1114,7 @@ static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
- 	case RTL_GENERIC_PHYID:
- 	case RTL_8221B:
- 	case RTL_8251B:
-+	case 0x001cc841:
- 		break;
- 	default:
- 		return false;
--- a/buildroot-external/board/raspberrypi/cmdline.txt
+++ b/buildroot-external/board/raspberrypi/cmdline.txt
@@ -1 +1 @@
-dwc_otg.lpm_enable=0 console=tty0 usb-storage.quirks=174c:55aa:u,2109:0715:u,152d:0578:u,152d:0579:u,152d:1561:u,174c:0829:u,14b0:0206:u,174c:225c:u,7825:a2a4:u,152d:0562:u,125f:a88a:u,152d:a583:u,152d:a578:u
+dwc_otg.lpm_enable=0 console=tty0 usb-storage.quirks=174c:55aa:u,2109:0715:u,152d:0578:u,152d:0579:u,152d:1561:u,174c:0829:u,14b0:0206:u,174c:225c:u,7825:a2a4:u,152d:0562:u,125f:a88a:u,152d:a583:u,152d:a578:u,152d:0583:u
--- a/buildroot-external/board/raspberrypi/hassos-hook.sh
+++ b/buildroot-external/board/raspberrypi/hassos-hook.sh
@@ -19,7 +19,10 @@ function hassos_pre_image() {
    else
        cp "${BOARD_DIR}/../cmdline.txt" "${BOOT_DATA}/cmdline.txt"
    fi
-    cp "${BINARIES_DIR}"/*.dtbo "${BOOT_DATA}/overlays/" 2>/dev/null || true
+    if ls "${BINARIES_DIR}"/*.dtbo >/dev/null 2>&1; then
+        mkdir -p "${BOOT_DATA}/overlays"
+        cp "${BINARIES_DIR}"/*.dtbo "${BOOT_DATA}/overlays/"
+    fi

    # Enable 64bit support
    if [[ "${BOARD_ID}" =~ "64" ]]; then
--- a/buildroot-external/board/raspberrypi/kernel.config
+++ b/buildroot-external/board/raspberrypi/kernel.config
@@ -8,5 +8,17 @@ CONFIG_LEDS_TRIGGERS=y
 CONFIG_LEDS_TRIGGER_DISK=y
 CONFIG_LEDS_TRIGGER_ACTIVITY=y

+# make sure all network drivers are built-in
+# RPi 3B USB LAN drivers - 3B uses SMSC95XX, 3B+ uses LAN78XX
+CONFIG_USB_NET_DRIVERS=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_NET_SMSC95XX=y
+# RPi 4 uses bcmgenet driver and BCM54213PE PHY
+CONFIG_BCMGENET=y
+CONFIG_BROADCOM_PHY=y
+# RPi 5 uses Cadence driver and BCM54213PE PHY (above)
+CONFIG_MACB=y
+
 # do not use RPi in-tree driver, use one from BR package instead
 # CONFIG_MEDIA_PCI_HAILO is not set
--- a/buildroot-external/configs/generic_aarch64_defconfig
+++ b/buildroot-external/configs/generic_aarch64_defconfig
@@ -5,19 +5,20 @@ BR2_DL_DIR="/cache/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="/cache/cc"
 BR2_ENABLE_LTO=y
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches $(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64/patches"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches"
 BR2_SSP_REGULAR=y
 BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64 $(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -26,6 +27,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -117,6 +119,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/generic_x86_64_defconfig
+++ b/buildroot-external/configs/generic_x86_64_defconfig
@@ -5,19 +5,20 @@ BR2_DL_DIR="/cache/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="/cache/cc"
 BR2_ENABLE_LTO=y
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/patches"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches"
 BR2_SSP_REGULAR=y
 BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/pc/generic-x86-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/generic-x86-64/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_DEFCONFIG="x86_64"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/generic-x86-64/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -26,6 +27,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -119,6 +121,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/green_defconfig
+++ b/buildroot-external/configs/green_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/nabucasa/green $(BR2_EXTERNAL_HASSOS_PATH)/board/nabucasa/green/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/kernel-arm64-rockchip.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/nabucasa/green/kernel.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -96,6 +98,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/khadas_vim3_defconfig
+++ b/buildroot-external/configs/khadas_vim3_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/khadas/vim3 $(BR2_EXTERNAL_HASSOS_PATH)/board/khadas/vim3/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/khadas/kernel-vim.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/odroid_c2_defconfig
+++ b/buildroot-external/configs/odroid_c2_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/odroid_c4_defconfig
+++ b/buildroot-external/configs/odroid_c4_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c4 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c4/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_E2FSPROGS_E2IMAGE=y
@@ -89,6 +91,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/odroid_m1_defconfig
+++ b/buildroot-external/configs/odroid_m1_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/kernel-arm64-rockchip.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1/kernel.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/odroid_m1s_defconfig
+++ b/buildroot-external/configs/odroid_m1s_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1s $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1s/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/kernel-arm64-rockchip.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1s/kernel.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/odroid_n2_defconfig
+++ b/buildroot-external/configs/odroid_n2_defconfig
@@ -11,13 +11,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/kernel.config"
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/odroid_xu4_defconfig
+++ b/buildroot-external/configs/odroid_xu4_defconfig
@@ -12,13 +12,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_DEFCONFIG="exynos"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -29,6 +30,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/ova_defconfig
+++ b/buildroot-external/configs/ova_defconfig
@@ -5,19 +5,20 @@ BR2_DL_DIR="/cache/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="/cache/cc"
 BR2_ENABLE_LTO=y
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/patches"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches"
 BR2_SSP_REGULAR=y
 BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_DEFCONFIG="x86_64"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -29,6 +30,7 @@ BR2_PACKAGE_LINUX_TOOLS_HV_VSS_DAEMON=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -120,6 +122,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/rpi2_defconfig
+++ b/buildroot-external/configs/rpi2_defconfig
@@ -13,13 +13,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi2 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel-armv7.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -94,6 +96,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/rpi3_64_defconfig
+++ b/buildroot-external/configs/rpi3_64_defconfig
@@ -12,13 +12,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi3-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -29,6 +30,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -95,6 +97,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/rpi3_defconfig
+++ b/buildroot-external/configs/rpi3_defconfig
@@ -13,13 +13,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi3 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel-armv7.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -96,6 +98,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/rpi4_64_defconfig
+++ b/buildroot-external/configs/rpi4_64_defconfig
@@ -12,13 +12,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi4-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -29,6 +30,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
@@ -96,6 +98,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/rpi4_defconfig
+++ b/buildroot-external/configs/rpi4_defconfig
@@ -13,13 +13,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi4 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel-armv7.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -95,6 +97,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/rpi5_64_defconfig
+++ b/buildroot-external/configs/rpi5_64_defconfig
@@ -12,13 +12,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi5-64/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi5-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi5-64/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2712"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -31,6 +32,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
@@ -95,6 +97,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/tinker_defconfig
+++ b/buildroot-external/configs/tinker_defconfig
@@ -13,13 +13,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/asus/tinker $(BR2_EXTERNAL_HASSOS_PATH)/board/asus/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/asus/tinker/kernel.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
@@ -32,6 +33,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
 BR2_PACKAGE_DOSFSTOOLS=y
@@ -91,6 +93,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/configs/yellow_defconfig
+++ b/buildroot-external/configs/yellow_defconfig
@@ -12,13 +12,14 @@ BR2_TARGET_GENERIC_HOSTNAME="homeassistant"
 BR2_TARGET_GENERIC_ISSUE="Welcome to Home Assistant"
 BR2_INIT_SYSTEMD=y
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_TARGET_LOCALTIME=""
 BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rootfs-overlay $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/yellow/rootfs-overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/yellow $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
@@ -30,6 +31,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
 BR2_PACKAGE_V4L2LOOPBACK=y
+BR2_PACKAGE_PIGZ=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_CIFS_UTILS=y
@@ -99,6 +101,7 @@ BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HID=y
 BR2_PACKAGE_DHCP=y
 BR2_PACKAGE_DHCP_CLIENT=y
 BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
--- a/buildroot-external/kernel/v6.12.y/device-support-pci.config
+++ b/buildroot-external/kernel/v6.12.y/device-support-pci.config
@@ -2,6 +2,7 @@
 CONFIG_PCI_IOV=y

 CONFIG_IGB=y
+CONFIG_IXGBE=y
 CONFIG_I40E=m
 CONFIG_IGC=m

@@ -38,6 +39,7 @@ CONFIG_MEDIA_PCI_SUPPORT=y

 # PCI sound drivers
 CONFIG_SND_PCI=y
+CONFIG_SND_CTXFI=m
 CONFIG_SND_HDA_GENERIC=m
 CONFIG_SND_HDA_INTEL=m
 CONFIG_SND_HDA_CODEC_REALTEK=m
--- a/buildroot-external/kernel/v6.12.y/hassos.config
+++ b/buildroot-external/kernel/v6.12.y/hassos.config
@@ -12,6 +12,8 @@ CONFIG_PREEMPT=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_DEBUG_PREEMPT is not set

+CONFIG_PSI=y
+
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y

@@ -156,6 +158,7 @@ CONFIG_NETFILTER_NETLINK_QUEUE=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
 CONFIG_NETFILTER_XT_MARK=m
+CONFIG_NETFILTER_XT_TARGET_NETMAP=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m

 CONFIG_IP_SET=m
@@ -202,6 +205,7 @@ CONFIG_WIREGUARD=m
 CONFIG_HID=y
 CONFIG_HIDRAW=y
 CONFIG_UHID=y
+CONFIG_HID_MULTITOUCH=m

 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="utf8"
--- a/buildroot-external/kernel/v6.12.y/kernel-arm64-rockchip.config
+++ b/buildroot-external/kernel/v6.12.y/kernel-arm64-rockchip.config
@@ -1053,14 +1053,6 @@ CONFIG_HNS3_ENET=y
 CONFIG_E100=m
 CONFIG_E1000=m
 CONFIG_E1000E=m
-CONFIG_IGB=m
-CONFIG_IGBVF=m
-CONFIG_IXGBE=m
-CONFIG_IXGBE_DCB=y
-CONFIG_IXGBEVF=m
-CONFIG_I40E=m
-CONFIG_I40EVF=m
-CONFIG_FM10K=m
 CONFIG_JME=m
 CONFIG_ADIN1110=m
 CONFIG_LITEX_LITEETH=m
--- a/buildroot-external/meta
+++ b/buildroot-external/meta
@@ -1,8 +1,8 @@
-VERSION_MAJOR="15"
+VERSION_MAJOR="16"
 VERSION_MINOR="3"
-VERSION_SUFFIX="dev0"
+VERSION_SUFFIX=""

 HASSOS_NAME="Home Assistant OS"
 HASSOS_ID="haos"

-DEPLOYMENT="development"
+DEPLOYMENT="production"
--- a/buildroot-external/ota/rauc-hook
+++ b/buildroot-external/ota/rauc-hook
@@ -2,7 +2,7 @@

 set -o errexit

-# shellcheck disable=SC2317  # Being usesd in trap which shellcheck can't follow
+# shellcheck disable=SC2317,SC2329  # Being usesd in trap which shellcheck can't follow
 cleanup_boot() {
    umount "${BOOT_NEW}"
    rm -rf "${BOOT_TMP}" "${BOOT_NEW}"
@@ -42,42 +42,6 @@ install_boot() {
        cp -f "${BOOT_TMP}"/*.txt "${BOOT_MNT}/" || true
        cp -f "${BOOT_TMP}"/grubenv "${BOOT_MNT}"/EFI/BOOT/ || true
    fi
-
-    # Add CM5 support for Yellow. Can be removed in HAOS 15.
-    if [ "$RAUC_SYSTEM_COMPATIBLE" = "haos-yellow" ]; then
-        if ! grep -q "\[cm5\]" "${BOOT_MNT}/config.txt"; then
-            echo "Adding CM5 config to config.txt"
-
-            # Remove old single device_tree config and add CM-specific ones
-            sed -i '/device_tree=bcm2711-rpi-cm4-ha-yellow.dtb/d; s/\[all\]/\[cm4\]\ndevice_tree=bcm2711-rpi-cm4-ha-yellow.dtb\n\n\[cm5\]\ndevice_tree=bcm2712-rpi-cm5-ha-yellow.dtb\n\n\[all\]/' "${BOOT_MNT}/config.txt"
-        fi
-    fi
-
-    # Fix for Pi3 not booting from some SD cards with now default initial_turbo=60
-    # see: https://github.com/home-assistant/operating-system/issues/3965
-    if [ "$RAUC_SYSTEM_COMPATIBLE" = "haos-rpi3" ] || [ "$RAUC_SYSTEM_COMPATIBLE" = "haos-rpi3-64" ]; then
-        # Don't change anything if initial_turbo is already set anywhere
-        if ! grep -q "^initial_turbo=" "${BOOT_MNT}/config.txt"; then
-            if grep -q '^\[pi3\]' "${BOOT_MNT}/config.txt"; then
-                echo "Adding initial_turbo=0 to [pi3] section of config.txt"
-                sed -i '/^\[pi3\]/a # Added to fix #3965\ninitial_turbo=0' "${BOOT_MNT}/config.txt"
-            else
-                echo "Adding [pi3] section with initial_turbo=0 to config.txt"
-                sed -i 's/^\[all\]/\[pi3\]\n# Added to fix #3965\ninitial_turbo=0\n\n\[all\]/' "${BOOT_MNT}/config.txt"
-            fi
-        fi
-    fi
-
-    # Prepare rauc.db for migration, should be removed in HAOS 16
-    # (along with raucdb-migrate.service and related raucdb-update changes)
-    if [ -f /mnt/data/rauc.db ]; then
-        # shellcheck disable=SC1091
-        . /etc/os-release
-        # Do not migrate if already running on OS 15.
-        if [ "${VERSION_ID%%.*}" != "15" ]; then
-            touch /mnt/boot/migrate-raucdb
-        fi
-    fi
 }

 install_spl() {
--- a/buildroot-external/package/hailo-pci/0001-Add-missing-lock-around-current-mm.patch
+++ b/buildroot-external/package/hailo-pci/0001-Add-missing-lock-around-current-mm.patch
@@ -0,0 +1,64 @@
+From 6c80e322d23337a8b9e5df85677be89f50561d10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
+Date: Wed, 2 Jul 2025 14:09:30 +0200
+Subject: [PATCH] Add missing lock around current->mm
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Backport patch on top of v4.21.0 to hold lock during mmap access.
+Without this patch, kernel traces are generated when e.g. Frigate uses the driver:
+
+WARNING: CPU: 3 PID: 5063 at include/linux/rwsem.h:80 find_vma+0x6c/0x80
+Modules linked in: broadcom bcm_phy_ptp wireguard libchacha20poly1305 chacha_neon poly1305_neon ip6_udp_tunnel udp_tunnel libcurve25519_generic libchacha rfcomm nf_conntrack_netlink xt_set ip_set nft_chain_nat nft_compat nf_tables xfrm_user algif_hash algif_skcipher af_alg bnep btsdio sch_fq_codel brcmfmac_wcc vc4 snd_soc_hdmi_codec drm_display_helper brcmfmac cec hci_uart btqca btrtl btbcm btintel spidev drm_dma_helper brcmutil bluetooth snd_soc_core snd_compress snd_pcm_dmaengine v3d ecdh_generic rpi_hevc_dec snd_pcm pisp_be cfg80211 aes_ce_blk aes_ce_cipher v4l2_mem2mem ghash_ce videobuf2_dma_contig videobuf2_memops snd_timer ecc gpu_sched videobuf2_v4l2 sha2_ce sha256_arm64 sha1_ce libaes sha1_generic raspberrypi_hwmon rfkill snd videobuf2_common rp1_pio spi_bcm2835 drm_shmem_helper gpio_keys raspberrypi_gpiomem hailo_pci(O) rp1_mailbox i2c_brcmstb drm_kms_helper pwm_fan rp1_adc nvmem_rmem rp1 uio_pdrv_genirq uio fuse drm drm_panel_orientation_quirks backlight nfnetlink
+CPU: 3 UID: 0 PID: 5063 Comm: frigate.detecto Tainted: G        W  O       6.12.25-haos-raspi #1
+Tainted: [W]=WARN, [O]=OOT_MODULE
+Hardware name: Raspberry Pi 5 Model B Rev 1.1 (DT)
+pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : find_vma+0x6c/0x80
+lr : hailo_vdma_buffer_map+0xe4/0x620 [hailo_pci]
+sp : ffffffc082f0bc20
+x29: ffffffc082f0bc30 x28: ffffff8194dea100 x27: 0000000000000000
+x26: 0000000000000000 x25: ffffff8109c04c80 x24: ffffffd03ff91000
+x23: 0000000000040f70 x22: 0000000000000001 x21: ffffff8101d570c8
+x20: 0000000000000000 x19: 0000007f8c087000 x18: 0000000000000000
+x17: 0000000000000000 x16: ffffffd08c730828 x15: 0000007f81bdcb48
+x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
+x11: 0000000000000000 x10: 0000007f81bdcb48 x9 : ffffffd03ff8b744
+x8 : ffffff8109c04d00 x7 : 0000000000000000 x6 : 000000000000003f
+x5 : 0000000000000040 x4 : 0000000000000080 x3 : 0000000000000000
+x2 : 0000000000000000 x1 : 0000007f8c087000 x0 : ffffff8177b56880
+Call trace:
+ find_vma+0x6c/0x80
+ hailo_vdma_buffer_map+0xe4/0x620 [hailo_pci]
+ hailo_vdma_buffer_map_ioctl+0xdc/0x348 [hailo_pci]
+ hailo_vdma_ioctl+0xcc/0x258 [hailo_pci]
+ hailo_pcie_fops_unlockedioctl+0x1e4/0x798 [hailo_pci]
+ __arm64_sys_ioctl+0xb0/0x100
+ invoke_syscall+0x50/0x120
+ el0_svc_common.constprop.0+0xc8/0xf0
+ do_el0_svc+0x24/0x38
+ el0_svc+0x30/0xd0
+ el0t_64_sync_handler+0x120/0x130
+ el0t_64_sync+0x190/0x198
+
+Upstream: https://github.com/hailo-ai/hailort-drivers/commit/8edb23bdb6130f89f9f73d6dc90f9db3d1f407c6
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+---
+ linux/vdma/memory.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/linux/vdma/memory.c b/linux/vdma/memory.c
+index 7ad4a68..7a78cc5 100644
+--- a/linux/vdma/memory.c
+++ b/linux/vdma/memory.c
+@@ -167,7 +167,9 @@ struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev,
+     }
+ 
+     if (HAILO_DMA_DMABUF_BUFFER != buffer_type) {
+        mmap_read_lock(current->mm);
+         vma = find_vma(current->mm, addr_or_fd);
+        mmap_read_unlock(current->mm);
+         if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING)) {
+             if (NULL == vma) {
+                 dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", addr_or_fd, size);
--- a/buildroot-external/package/hailo-pci/hailo-pci.hash
+++ b/buildroot-external/package/hailo-pci/hailo-pci.hash
@@ -1,3 +1,3 @@
 # Locally computed
 sha256  f9c375a1be4a41f7b70301dd83c91cb89e41567478859b77eef375a52d782505  LICENSE
-sha256  517683771d4d0c5e23a77d00167c46e633d322c4939adc39babbced97a658a5a  hailo-pci-v4.20.1.tar.gz
+sha256  624468126c1e5609475389271b3d2878cb6e7e40df9e85bad95be464a3e11be3  hailo-pci-v4.21.0.tar.gz
--- a/buildroot-external/package/hailo-pci/hailo-pci.mk
+++ b/buildroot-external/package/hailo-pci/hailo-pci.mk
@@ -1,4 +1,4 @@
-HAILO_PCI_VERSION = v4.20.1
+HAILO_PCI_VERSION = v4.21.0
 HAILO_PCI_SITE = $(call github,hailo-ai,hailort-drivers,$(HAILO_PCI_VERSION))
 HAILO_PCI_LICENSE = GPL-2.0
 HAILO_PCI_LICENSE_FILES = LICENSE
--- a/buildroot-external/package/hailo8-firmware/hailo8-firmware.hash
+++ b/buildroot-external/package/hailo8-firmware/hailo8-firmware.hash
@@ -1 +1 @@
-sha256  32e26fffa11f3909a07340ca3f4714e5f20ce734f497a893b129ef978cde2593  hailo8_fw.4.20.1.bin
+sha256  2a5c94591d9e70d884242e64bf2388b0d2d46b816a335b4c00c3f81a07832635  hailo8_fw.4.21.0.bin
--- a/buildroot-external/package/hailo8-firmware/hailo8-firmware.mk
+++ b/buildroot-external/package/hailo8-firmware/hailo8-firmware.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################

-HAILO8_FIRMWARE_VERSION = 4.20.1
+HAILO8_FIRMWARE_VERSION = 4.21.0
 HAILO8_FIRMWARE_LICENSE = PROPRIETARY
 HAILO8_FIRMWARE_SOURCE= hailo8_fw.$(HAILO8_FIRMWARE_VERSION).bin
 HAILO8_FIRMWARE_SITE="https://hailo-hailort.s3.eu-west-2.amazonaws.com/Hailo8/$(HAILO8_FIRMWARE_VERSION)/FW"
--- a/buildroot-external/package/hassio/create-data-partition.sh
+++ b/buildroot-external/package/hassio/create-data-partition.sh
@@ -4,6 +4,7 @@ set -e
 build_dir=$1
 dst_dir=$2
 channel=$3
+docker_version=$4

 data_img="${dst_dir}/data.ext4"

@@ -17,13 +18,12 @@ mkdir -p "${build_dir}/data/"
 sudo mount -o loop,discard "${data_img}" "${build_dir}/data/"

 # Use official Docker in Docker images
-# Ideally we use the same version as Buildroot is using in case the
-# overlayfs2 storage format changes
+# We use the same version as Buildroot is using to ensure best compatibility
 container=$(docker run --privileged -e DOCKER_TLS_CERTDIR="" \
 	-v "${build_dir}/data/":/data \
 	-v "${build_dir}/data/docker/":/var/lib/docker \
 	-v "${build_dir}":/build \
-	-d docker:28.0-dind --storage-driver overlay2)
+	-d "docker:${docker_version}-dind" --storage-driver overlay2)

 docker exec "${container}" sh /build/dind-import-containers.sh "${channel}"

--- a/buildroot-external/package/hassio/hassio.mk
+++ b/buildroot-external/package/hassio/hassio.mk
@@ -37,7 +37,7 @@ endef
 HASSIO_INSTALL_IMAGES = YES

 define HASSIO_INSTALL_IMAGES_CMDS
-	$(BR2_EXTERNAL_HASSOS_PATH)/package/hassio/create-data-partition.sh "$(@D)" "$(BINARIES_DIR)" "$(HASSIO_VERSION_CHANNEL)"
+	$(BR2_EXTERNAL_HASSOS_PATH)/package/hassio/create-data-partition.sh "$(@D)" "$(BINARIES_DIR)" "$(HASSIO_VERSION_CHANNEL)" "$(DOCKER_ENGINE_VERSION)"
 endef

 $(eval $(generic-package))
--- a/buildroot-external/package/pi-bluetooth/hcidisable.service
+++ b/buildroot-external/package/pi-bluetooth/hcidisable.service
@@ -1,10 +0,0 @@
-[Unit]
-Description=Remove HCI kernel driver if WiFi/Bluetooth module is not present
-ConditionPathExists=!/sys/bus/sdio/devices/mmc1:0001:1
-
-[Service]
-Type=forking
-ExecStart=/usr/sbin/modprobe -r hci_uart
-
-[Install]
-WantedBy=hassos-hardware.target
--- a/buildroot-external/package/pi-bluetooth/hciunbind.service
+++ b/buildroot-external/package/pi-bluetooth/hciunbind.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Unbind Broadcom HCI driver if WiFi/Bluetooth module is not present
+ConditionPathExists=!/sys/bus/sdio/devices/mmc1:0001:1
+ConditionPathExists=/sys/bus/serial/drivers/hci_uart_bcm/unbind
+ConditionPathExists=/proc/device-tree/chosen/rpi-boardrev-ext
+Before=bluetooth.service
+
+[Service]
+Type=oneshot
+ExecCondition=/bin/sh -c 'test $((16#$(xxd -p -g4 /proc/device-tree/chosen/rpi-boardrev-ext) & 16#40000000)) -gt 0'
+ExecStart=/bin/sh -c 'echo "serial0-0" > /sys/bus/serial/drivers/hci_uart_bcm/unbind'
+
+[Install]
+WantedBy=hassos-hardware.target
--- a/buildroot-external/package/pi-bluetooth/pi-bluetooth.mk
+++ b/buildroot-external/package/pi-bluetooth/pi-bluetooth.mk
@@ -12,7 +12,7 @@ PI_BLUETOOTH_LICENSE_FILES = debian/copyright
 define PI_BLUETOOTH_INSTALL_TARGET_CMDS
 	$(INSTALL) -d $(TARGET_DIR)/etc/systemd/system/hassos-hardware.target.wants
 	$(INSTALL) -m 0644 $(BR2_EXTERNAL_HASSOS_PATH)/package/pi-bluetooth/hciuart.service $(TARGET_DIR)/usr/lib/systemd/system/
-	$(INSTALL) -m 0644 $(BR2_EXTERNAL_HASSOS_PATH)/package/pi-bluetooth/hcidisable.service $(TARGET_DIR)/usr/lib/systemd/system/
+	$(INSTALL) -m 0644 $(BR2_EXTERNAL_HASSOS_PATH)/package/pi-bluetooth/hciunbind.service $(TARGET_DIR)/usr/lib/systemd/system/
 	$(INSTALL) -m 0644 $(BR2_EXTERNAL_HASSOS_PATH)/package/pi-bluetooth/bthelper@.service $(TARGET_DIR)/usr/lib/systemd/system/

 	$(INSTALL) -d $(TARGET_DIR)/usr/bin
--- a/buildroot-external/package/rpi-eeprom/0001-rpi-eeprom-update-adjust-bootfs-discovery-for-HAOS.patch
+++ b/buildroot-external/package/rpi-eeprom/0001-rpi-eeprom-update-adjust-bootfs-discovery-for-HAOS.patch
@@ -0,0 +1,53 @@
+From 5b3c41b3465a98025b6869c4ed14d210b68b7e24 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
+Date: Tue, 13 May 2025 17:19:59 +0200
+Subject: [PATCH] rpi-eeprom-update: adjust bootfs discovery for HAOS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When HAOS boots from SD card, we can rely on /mnt/boot being mounted and
+use it for storing the recovery image. If it's not on an SD card, we can
+only use it to store the image if flashrom is used, otherwise the
+bootloader doesn't pick it up - in that case show an error (e.g. on CM4
+booting from an NVMe).
+
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+Upstream: not applicable
+---
+ rpi-eeprom-update | 22 ++++++++--------------
+ 1 file changed, 8 insertions(+), 14 deletions(-)
+
+diff --git a/rpi-eeprom-update b/rpi-eeprom-update
+index b970142..3e9d75f 100755
+--- a/rpi-eeprom-update
+++ b/rpi-eeprom-update
+@@ -725,20 +725,14 @@ findBootFS()
+    # If ${BOOTFS} is not writable OR is not on /dev/mmcblk0 then error because the ROM
+    # can only load recovery.bin from the on-board SD-CARD slot or the EEPROM.
+ 
+-   if blkid | grep -qE "/dev/mmcblk0p1.*LABEL_FATBOOT.*RECOVERY.*TYPE.*vfat"; then
+-      TMP_BOOTFS_MNT="$(mktemp -d)"
+-      mount /dev/mmcblk0p1 "${TMP_BOOTFS_MNT}"
+-      BOOTFS="${TMP_BOOTFS_MNT}"
+-   elif [ -z "$BOOTFS" ]; then
+-      if ! BOOTFS=$(/usr/lib/raspberrypi-sys-mods/get_fw_loc 2> /dev/null); then
+-         for BOOTFS in /boot/firmware /boot; do
+-            if [ -f "${BOOTFS}/config.txt" ]; then
+-               break
+-            elif findmnt --fstab "$BOOTFS" > /dev/null; then
+-               break
+-            fi
+-         done
+-      fi
+   if blkid | grep -qE "/dev/mmcblk0p1.*LABEL_FATBOOT.*hassos-boot.*TYPE.*vfat"; then
+      # use HAOS default bootfs location if booting from SD card
+      BOOTFS="/mnt/boot"
+   elif [ -z "$BOOTFS" ] && [ "${RPI_EEPROM_USE_FLASHROM}" = "1" ]; then
+      # image for flashrom will created in bootfs
+      BOOTFS="/mnt/boot"
+   elif [ -z "$BOOTFS" ]; then
+      die "rpi-eeprom-update is only available when booting from an SD card or if flashrom can be used."
+    fi
+ 
+    # If BOOTFS is not a directory or doesn't contain any .elf files then
--- a/buildroot-external/package/rpi-eeprom/0001-rpi-eeprom-update-adjust-hassos-boot-discovery.patch
+++ b/buildroot-external/package/rpi-eeprom/0001-rpi-eeprom-update-adjust-hassos-boot-discovery.patch
@@ -1,30 +0,0 @@
-From ecc0714d0c132acdce1d7363567917e00ece26f9 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
-Date: Tue, 13 May 2025 17:19:59 +0200
-Subject: [PATCH] rpi-eeprom-update: adjust hassos-boot discovery
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Make discovery of boot partition compatible with HAOS without the need
-to set BOOTFS in /etc/default/rpi-eeprom-update.
-
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
-Upstream: not applicable
---
- rpi-eeprom-update | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/rpi-eeprom-update b/rpi-eeprom-update
-index b970142..720efb7 100755
--- a/rpi-eeprom-update
-+++ b/rpi-eeprom-update
-@@ -725,7 +725,7 @@ findBootFS()
-    # If ${BOOTFS} is not writable OR is not on /dev/mmcblk0 then error because the ROM
-    # can only load recovery.bin from the on-board SD-CARD slot or the EEPROM.
- 
-   if blkid | grep -qE "/dev/mmcblk0p1.*LABEL_FATBOOT.*RECOVERY.*TYPE.*vfat"; then
-+   if blkid | grep -qE "/dev/mmcblk0p1.*LABEL_FATBOOT.*hassos-boot.*TYPE.*vfat"; then
-       TMP_BOOTFS_MNT="$(mktemp -d)"
-       mount /dev/mmcblk0p1 "${TMP_BOOTFS_MNT}"
-       BOOTFS="${TMP_BOOTFS_MNT}"
--- a/buildroot-external/package/rpi-eeprom/rpi-eeprom.hash
+++ b/buildroot-external/package/rpi-eeprom/rpi-eeprom.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  9e64372f0480b8410fce3f9cc12c01548eaac36e36fe0fe8f979535281d41290  rpi-eeprom-cd4048df1d55be89bf84879754a4acf9c92e1f7a.tar.gz
+sha256  67e82c88f3bd3d9dd4adac48f1d6839b715931bd7700d768b21125f6d43517ca  rpi-eeprom-2349daafacfb7a7abe2cfecf30a49ae837bdf2c6.tar.gz
 sha256  594b7565fd3ccf8acd4711a2ec1b199181aafbc3426d0bacaa50ef40edbf7c4a  LICENSE
--- a/buildroot-external/package/rpi-eeprom/rpi-eeprom.mk
+++ b/buildroot-external/package/rpi-eeprom/rpi-eeprom.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################

-RPI_EEPROM_VERSION = cd4048df1d55be89bf84879754a4acf9c92e1f7a
+RPI_EEPROM_VERSION = 2349daafacfb7a7abe2cfecf30a49ae837bdf2c6
 RPI_EEPROM_SITE = $(call github,raspberrypi,rpi-eeprom,$(RPI_EEPROM_VERSION))
 RPI_EEPROM_LICENSE = BSD-3-Clause
 RPI_EEPROM_LICENSE_FILES = LICENSE
@@ -14,7 +14,7 @@ define RPI_EEPROM_INSTALL_RPI4_FILES
 	$(INSTALL) -d $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2711/default
 	$(INSTALL) -D -m 0644 $(@D)/firmware-2711/default/recovery.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2711/default/
 	$(INSTALL) -D -m 0644 $(@D)/firmware-2711/default/vl805-000138c0.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2711/default/
-	$(INSTALL) -D -m 0644 $(@D)/firmware-2711/default/pieeprom-2025-02-11.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2711/default/
+	$(INSTALL) -D -m 0644 $(@D)/firmware-2711/default/pieeprom-2025-05-08.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2711/default/
 endef
 endif

@@ -22,7 +22,7 @@ ifneq ($(BR2_PACKAGE_RPI_EEPROM_TARGET_ANY)$(BR2_PACKAGE_RPI_EEPROM_TARGET_RPI5)
 define RPI_EEPROM_INSTALL_RPI5_FILES
 	$(INSTALL) -d $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2712/default
 	$(INSTALL) -D -m 0644 $(@D)/firmware-2712/default/recovery.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2712/default/
-	$(INSTALL) -D -m 0644 $(@D)/firmware-2712/default/pieeprom-2025-03-10.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2712/default/
+	$(INSTALL) -D -m 0644 $(@D)/firmware-2712/default/pieeprom-2025-05-08.bin $(TARGET_DIR)/usr/lib/firmware/raspberrypi/bootloader-2712/default/
 endef
 endif

--- a/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.hash
+++ b/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.hash
@@ -1,2 +1,2 @@
 sha256  b40930bbcf80744c86c46a12bc9da056641d722716c378f5659b9e555ef833e1  LICENSE
-sha256  035bb930c317a6944dbee14db60dea68d65e15fe5f51253e3080f9f016b89fd7  rpi-rf-mod-0ee62f7a87d26e990fb0e03b00befb505a7e44fd.tar.gz
+sha256  961b7e38dfe6450cd70b677d3cc8c1aabb00639f58e3ce7379c94053fdb19117  rpi-rf-mod-e1404d6b2400589a1956d7429ad16227c8db6771.tar.gz
--- a/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.mk
+++ b/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.mk
@@ -10,12 +10,12 @@
 # https://codeload.github.com/jens-maus/RaspberryMatic/tar.gz/COMMIT
 #
 # Copyright (c) 2018-2023 Jens Maus <mail@jens-maus.de>
-# https://github.com/jens-maus/RaspberryMatic/tree/master/buildroot-external/package/rpi-rf-mod
+# https://github.com/OpenCCU/OpenCCU/tree/master/buildroot-external/package/rpi-rf-mod
 #
 ################################################################################

-RPI_RF_MOD_VERSION = 0ee62f7a87d26e990fb0e03b00befb505a7e44fd
-RPI_RF_MOD_SITE = $(call github,jens-maus,RaspberryMatic,$(RPI_RF_MOD_VERSION))
+RPI_RF_MOD_VERSION = e1404d6b2400589a1956d7429ad16227c8db6771
+RPI_RF_MOD_SITE = $(call github,OpenCCU,OpenCCU,$(RPI_RF_MOD_VERSION))
 RPI_RF_MOD_LICENSE = Apache-2.0
 RPI_RF_MOD_LICENSE_FILES = LICENSE
 RPI_RF_MOD_DEPENDENCIES = host-dtc
--- a/buildroot-external/patches/docker-engine/0001-Unmap-IPv4-addresses-loaded-from-store.patch
+++ b/buildroot-external/patches/docker-engine/0001-Unmap-IPv4-addresses-loaded-from-store.patch
@@ -0,0 +1,33 @@
+From 050f3d1930d9bf4fea986ed21feaaa6474822191 Mon Sep 17 00:00:00 2001
+From: Rob Murray <rob.murray@docker.com>
+Date: Wed, 27 Aug 2025 16:37:00 +0100
+Subject: [PATCH] Unmap IPv4 addresses loaded from store
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When a endpoint's net.IPNet is loaded from store and converted
+to a netip.Addr, unmap it so that iptables rules don't contain
+IPv4-mapped IPv6 addresses.
+
+Signed-off-by: Rob Murray <rob.murray@docker.com>
+(cherry picked from commit 071e6472db32a34ed0f73f7166e0c2b405ae23a5)
+Signed-off-by: Rob Murray <rob.murray@docker.com>
+(backported for 28.3.3 from 31f405932a349e99f45388afe764ec5433b30de2)
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+---
+ libnetwork/drivers/bridge/bridge_linux.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libnetwork/drivers/bridge/bridge_linux.go b/libnetwork/drivers/bridge/bridge_linux.go
+index 19fcf43..15002f2 100644
+--- a/libnetwork/drivers/bridge/bridge_linux.go
+++ b/libnetwork/drivers/bridge/bridge_linux.go
+@@ -1218,6 +1218,7 @@ func (d *driver) CreateEndpoint(ctx context.Context, nid, eid string, ifInfo dri
+ func (ep *bridgeEndpoint) netipAddrs() (v4, v6 netip.Addr) {
+ 	if ep.addr != nil {
+ 		v4, _ = netip.AddrFromSlice(ep.addr.IP)
+		v4 = v4.Unmap()
+ 	}
+ 	if ep.addrv6 != nil {
+ 		v6, _ = netip.AddrFromSlice(ep.addrv6.IP)
--- a/buildroot-external/patches/systemd/0004-journal-gatewayd-add-boots-endpoint.patch
+++ b/buildroot-external/patches/systemd/0004-journal-gatewayd-add-boots-endpoint.patch
@@ -0,0 +1,225 @@
+From ddfb78d5e8fd91e34ec6c9889d651f75e25a68b6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
+Date: Thu, 22 May 2025 19:30:31 +0200
+Subject: [PATCH] journal-gatewayd: add /boots endpoint
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add endpoint for listing boots. Output format mimics `journalctl
+--list-boots -ojson`, so it's a plain array containing index, boot ID
+and timestamps of the first and last entry. Initial implementation
+returns boots ordered starting with the current one and doesn't allow
+any filtering (i.e. equivalent of --lines argument).
+---
+(Backported for v256.x)
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+Upstream: https://github.com/systemd/systemd/pull/37574
+---
+ src/journal-remote/journal-gatewayd.c         | 129 ++++++++++++++++++
+ src/shared/logs-show.c                        |   2 +-
+ src/shared/logs-show.h                        |   6 +
+ .../units/TEST-04-JOURNAL.journal-gatewayd.sh |   6 +
+ 4 files changed, 142 insertions(+), 1 deletion(-)
+
+diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
+index dd91f22923..0999234f42 100644
+--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
+@@ -63,6 +63,9 @@ typedef struct RequestMeta {
+         uint64_t n_entries;
+         bool n_entries_set, since_set, until_set;
+ 
+        sd_id128_t previous_boot_id;
+        int32_t boot_index;
+
+         FILE *tmp;
+         uint64_t delta, size;
+ 
+@@ -885,6 +888,129 @@ static int request_handler_machine(
+         return MHD_queue_response(connection, MHD_HTTP_OK, response);
+ }
+ 
+static int output_boot(FILE *f, BootId boot, int boot_display_index) {
+        _cleanup_(json_variant_unrefp) JsonVariant *json = NULL;
+        int r;
+
+        r = json_build(
+                        &json,
+                        JSON_BUILD_OBJECT(
+                                        JSON_BUILD_PAIR_INTEGER("index", boot_display_index),
+                                        JSON_BUILD_PAIR_ID128("boot_id", boot.id),
+                                        JSON_BUILD_PAIR_UNSIGNED("first_entry", boot.first_usec),
+                                        JSON_BUILD_PAIR_UNSIGNED("last_entry", boot.last_usec)));
+        if (r < 0)
+                return r;
+
+        return json_variant_dump(json, JSON_FORMAT_SEQ, f, /* prefix= */ NULL);
+}
+
+static ssize_t request_reader_boots(
+                void *cls,
+                uint64_t pos,
+                char *buf,
+                size_t max) {
+
+        RequestMeta *m = ASSERT_PTR(cls);
+        int r;
+
+        assert(buf);
+        assert(max > 0);
+        assert(pos >= m->delta);
+
+        pos -= m->delta;
+
+        while (pos >= m->size) {
+                BootId boot;
+                off_t sz;
+
+                /* We're seeking from tail (newest boot) so advance to older. */
+                r = discover_next_boot(
+                                m->journal,
+                                m->previous_boot_id,
+                                /* advance_older = */ true,
+                                &boot);
+                if (r < 0) {
+                        log_error_errno(r, "Failed to advance boot index: %m");
+                        return MHD_CONTENT_READER_END_WITH_ERROR;
+                }
+                if (r == 0)
+                        return MHD_CONTENT_READER_END_OF_STREAM;
+
+                pos -= m->size;
+                m->delta += m->size;
+
+                r = request_meta_ensure_tmp(m);
+                if (r < 0) {
+                        log_error_errno(r, "Failed to create temporary file: %m");
+                        return MHD_CONTENT_READER_END_WITH_ERROR;
+                }
+
+                r = output_boot(m->tmp, boot, m->boot_index);
+                if (r < 0) {
+                        log_error_errno(r, "Failed to serialize boot: %m");
+                        return MHD_CONTENT_READER_END_WITH_ERROR;
+                }
+
+                sz = ftello(m->tmp);
+                if (sz < 0) {
+                        log_error_errno(errno, "Failed to retrieve file position: %m");
+                        return MHD_CONTENT_READER_END_WITH_ERROR;
+                }
+
+                m->size = (uint64_t) sz;
+
+                m->previous_boot_id = boot.id;
+                m->boot_index -= 1;
+        }
+
+        if (fseeko(m->tmp, pos, SEEK_SET) < 0) {
+                log_error_errno(errno, "Failed to seek to position: %m");
+                return MHD_CONTENT_READER_END_WITH_ERROR;
+        }
+
+        size_t n = MIN(m->size - pos, max);
+
+        errno = 0;
+        size_t k = fread(buf, 1, n, m->tmp);
+        if (k != n) {
+                log_error("Failed to read from file: %s", STRERROR_OR_EOF(errno));
+                return MHD_CONTENT_READER_END_WITH_ERROR;
+        }
+
+        return (ssize_t) k;
+}
+
+static int request_handler_boots(
+                struct MHD_Connection *connection,
+                void *connection_cls) {
+
+        _cleanup_(MHD_destroy_responsep) struct MHD_Response *response = NULL;
+        RequestMeta *m = ASSERT_PTR(connection_cls);
+        int r;
+
+        assert(connection);
+
+        r = open_journal(m);
+        if (r < 0)
+                return mhd_respondf(connection, r, MHD_HTTP_INTERNAL_SERVER_ERROR, "Failed to open journal: %m");
+
+        m->previous_boot_id = SD_ID128_NULL;
+        m->boot_index = 0;
+        r = sd_journal_seek_tail(m->journal); /* seek to newest */
+        if (r < 0)
+                return mhd_respondf(connection, r, MHD_HTTP_INTERNAL_SERVER_ERROR, "Failed to seek in journal: %m");
+
+        response = MHD_create_response_from_callback(MHD_SIZE_UNKNOWN, 4*1024, request_reader_boots, m, NULL);
+        if (!response)
+                return respond_oom(connection);
+
+        if (MHD_add_response_header(response, "Content-Type", "application/json-seq") == MHD_NO)
+                return respond_oom(connection);
+
+        return MHD_queue_response(connection, MHD_HTTP_OK, response);
+}
+
+ static mhd_result request_handler(
+                 void *cls,
+                 struct MHD_Connection *connection,
+@@ -931,6 +1057,9 @@ static mhd_result request_handler(
+         if (streq(url, "/machine"))
+                 return request_handler_machine(connection, *connection_cls);
+ 
+        if (streq(url, "/boots"))
+                return request_handler_boots(connection, *connection_cls);
+
+         return mhd_respond(connection, MHD_HTTP_NOT_FOUND, "Not found.");
+ }
+ 
+diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
+index 153a4110ce..014c8b690a 100644
+--- a/src/shared/logs-show.c
+++ b/src/shared/logs-show.c
+@@ -1765,7 +1765,7 @@ int show_journal_by_unit(
+         return show_journal(f, j, mode, n_columns, not_before, how_many, flags, ellipsized);
+ }
+ 
+-static int discover_next_boot(
+int discover_next_boot(
+                 sd_journal *j,
+                 sd_id128_t previous_boot_id,
+                 bool advance_older,
+diff --git a/src/shared/logs-show.h b/src/shared/logs-show.h
+index 7e7b2af901..e6162caf55 100644
+--- a/src/shared/logs-show.h
+++ b/src/shared/logs-show.h
+@@ -70,6 +70,12 @@ void json_escape(
+                 size_t l,
+                 OutputFlags flags);
+ 
+int discover_next_boot(
+                sd_journal *j,
+                sd_id128_t previous_boot_id,
+                bool advance_older,
+                BootId *ret);
+
+ int journal_find_boot(sd_journal *j, sd_id128_t boot_id, int offset, sd_id128_t *ret);
+ int journal_get_boots(
+                 sd_journal *j,
+diff --git a/test/units/TEST-04-JOURNAL.journal-gatewayd.sh b/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+index 9c7a3d05bb..35ac91ba40 100755
+--- a/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+++ b/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+@@ -139,6 +139,12 @@ curl -LSfs http://localhost:19531/fields/_TRANSPORT
+ (! curl -LSfs http://localhost:19531/fields)
+ (! curl -LSfs http://localhost:19531/fields/foo-bar-baz)
+ 
+# /boots
+curl -LSfs http://localhost:19531/boots >"$LOG_FILE"
+jq --seq -s . "$LOG_FILE"
+LAST_BOOT_ID=$(journalctl --list-boots -ojson -n1 | jq -r '.[0].boot_id')
+jq --seq -se ".[0] | select(.boot_id == \"$LAST_BOOT_ID\")" "$LOG_FILE"
+
+ systemctl stop systemd-journal-gatewayd.{socket,service}
+ 
+ if ! command -v openssl >/dev/null; then
--- a/buildroot-external/patches/systemd/0005-journal-gatewayd-make-num_entries-in-Range-header-op.patch
+++ b/buildroot-external/patches/systemd/0005-journal-gatewayd-make-num_entries-in-Range-header-op.patch
@@ -0,0 +1,147 @@
+From a7a18e1be478c0114a7f8e285ce238aacd4c2ba7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
+Date: Wed, 18 Jun 2025 17:32:49 +0200
+Subject: [PATCH] journal-gatewayd: make num_entries in Range header optional
+ again
+
+Since 435c372ce5059082212d37ac7039844f14f34a80 added in v256,
+num_entries part of the Range header is mandatory and error is returned
+when it's not filled in. This makes using the "follow" argument clumsy,
+because for an indefinite following of the logs, arbitrary high number
+must be specified. This change makes it possible to omit it again and
+documents this behavior in the man page.
+
+Moreover, as the cursor part of the header was never mandatory, enclose
+it in square brackets in the documentation as well and elaborate how
+indexing works.
+
+Following are some concrete examples of the Range header which are now
+accepted:
+
+ entries= (or entries=:)
+  - everything starting from the first event
+
+ entries=cursor
+  - everything starting from `cursor`
+
+ entries=:-9:10
+  - last 10 events and close the connection
+
+If the follow flag is set:
+
+ entries=:-4:10
+  - last 5 events, wait for 5 new and close connection
+
+ entries=:-9:
+  - last 10 events and keep streaming
+
+Note that only the very last one is changing current behavior, but
+reintroduces pre-v256 compatibility.
+
+Fixes #37172
+---
+(Backported for v256.x)
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+Upstream: https://github.com/systemd/systemd/pull/37883
+---
+ man/systemd-journal-gatewayd.service.xml       | 13 ++++++++-----
+ src/journal-remote/journal-gatewayd.c          | 14 ++++++++------
+ test/units/TEST-04-JOURNAL.journal-gatewayd.sh | 15 +++++++++++++++
+ 3 files changed, 31 insertions(+), 11 deletions(-)
+
+diff --git a/man/systemd-journal-gatewayd.service.xml b/man/systemd-journal-gatewayd.service.xml
+index 38adfe6b4e..5dbdace78e 100644
+--- a/man/systemd-journal-gatewayd.service.xml
+++ b/man/systemd-journal-gatewayd.service.xml
+@@ -275,20 +275,23 @@
+     <title>Range header</title>
+ 
+     <para>
+-      <option>Range: entries=<replaceable>cursor</replaceable>[[:<replaceable>num_skip</replaceable>]:<replaceable>num_entries</replaceable>]</option>
+      <option>Range: entries=[<replaceable>cursor</replaceable>][[:<replaceable>num_skip</replaceable>]:[<replaceable>num_entries</replaceable>]]</option>
+     </para>
+     <para>
+       <option>Range: realtime=[<replaceable>since</replaceable>]:[<replaceable>until</replaceable>][[:<replaceable>num_skip</replaceable>]:<replaceable>num_entries</replaceable>]</option>
+     </para>
+ 
+     <para>where
+-      <replaceable>cursor</replaceable> is a cursor string,
+      <replaceable>cursor</replaceable> is a cursor string, defaults to the first entry,
+       <replaceable>since</replaceable> and <replaceable>until</replaceable> are timestamps (seconds since 1970-01-01 00:00:00 UTC),
+       <replaceable>num_skip</replaceable> is an integer,
+       <replaceable>num_entries</replaceable> is an unsigned integer.
+     </para>
+ 
+     <para>Range defaults to all available events.</para>
+
+    <para>If <replaceable>num_skip</replaceable> is negative and no <replaceable>cursor</replaceable> is
+    given, the last entry will be the reference point.</para>
+   </refsect1>
+ 
+   <refsect1>
+@@ -300,9 +303,9 @@
+       <varlistentry>
+         <term><uri>follow</uri></term>
+ 
+-        <listitem><para>wait for new events
+-        (like <command>journalctl --follow</command>, except that
+-        the number of events returned is not limited).</para>
+        <listitem><para>wait for new events (like <command>journalctl --follow</command>, the number of
+        events returned is not limited, unless <replaceable>num_entries</replaceable> is specified in the
+        <replaceable>Range</replaceable> header).</para>
+ 
+         <xi:include href="version-info.xml" xpointer="v197"/>
+         </listitem>
+diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
+index 0999234f42..0661ecb1cf 100644
+--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
+@@ -332,14 +332,16 @@ static int request_parse_range_skip_and_n_entries(
+         }
+ 
+         p = (colon2 ?: colon) + 1;
+-        r = safe_atou64(p, &m->n_entries);
+-        if (r < 0)
+-                return r;
+        if (!isempty(p)) {
+                r = safe_atou64(p, &m->n_entries);
+                if (r < 0)
+                        return r;
+ 
+-        if (m->n_entries <= 0)
+-                return -EINVAL;
+                if (m->n_entries <= 0)
+                        return -EINVAL;
+ 
+-        m->n_entries_set = true;
+                m->n_entries_set = true;
+        }
+ 
+         return 0;
+ }
+diff --git a/test/units/TEST-04-JOURNAL.journal-gatewayd.sh b/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+index 35ac91ba40..ef85dc17c6 100755
+--- a/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+++ b/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+@@ -67,6 +67,21 @@ curl -LSfs \
+      --header "Range: entries=$BOOT_CURSOR:5:10" \
+      http://localhost:19531/entries >"$LOG_FILE"
+ jq -se "length == 10" "$LOG_FILE"
+# Check that follow with no num_entries follows "indefinitely"
+(
+    set +e; \
+    timeout 5 curl -LSfs \
+         --header "Accept: application/json" \
+         --header "Range: entries=:-1:" \
+         http://localhost:19531/entries?follow >"$LOG_FILE" ; \
+    test $? -eq 124 # timeout should kill the curl process waiting for new entries
+)
+# Check that follow with num_entries returns the specified number of entries and exits
+timeout 5 curl -LSfs \
+     --header "Accept: application/json" \
+     --header "Range: entries=:-20:10" \
+     http://localhost:19531/entries?follow >"$LOG_FILE"
+jq -se "length == 10" "$LOG_FILE"
+ # Check if the specified cursor refers to an existing entry and return just that entry
+ curl -LSfs \
+      --header "Accept: application/json" \
--- a/buildroot-external/patches/systemd/0006-journal-gatewayd-fix-handling-of-num_skip-pointing-b.patch
+++ b/buildroot-external/patches/systemd/0006-journal-gatewayd-fix-handling-of-num_skip-pointing-b.patch
@@ -0,0 +1,73 @@
+From 56e744bc45713ef7575032cfdb20073013ec0a8d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
+Date: Tue, 24 Jun 2025 18:54:44 +0200
+Subject: [PATCH] journal-gatewayd: fix handling of num_skip pointing beyond
+ the last entry
+
+When `num_skip` is supplied to the `Range` header, journal-gatewayd
+always returns the very last record even though it should have been
+skipped. This is because the `sd_journal_next_skip` always returns
+non-zero value on the first call, leading to one iteration of the
+`request_reader_entries` returning the last record.
+
+To avoid this unexpected behavior, check that the number of lines we
+have skipped by is not lower than the requested skip value. If it is,
+then it means there are lines which should not be returned now -
+decrement the n_skip counter then and return from the function, closing
+the stream if follow flag is not set.
+
+Fixes #37954
+---
+(Backported for v256.x)
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+Upstream: https://github.com/systemd/systemd/pull/37955
+---
+src/journal-remote/journal-gatewayd.c          | 16 ++++++++++++++--
+ test/units/TEST-04-JOURNAL.journal-gatewayd.sh |  6 ++++++
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
+index 0661ecb1cf..5bce48d485 100644
+--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
+@@ -181,9 +181,21 @@ static ssize_t request_reader_entries(
+ 
+                 if (m->n_skip < 0)
+                         r = sd_journal_previous_skip(m->journal, (uint64_t) -m->n_skip + 1);
+-                else if (m->n_skip > 0)
+                else if (m->n_skip > 0) {
+                         r = sd_journal_next_skip(m->journal, (uint64_t) m->n_skip + 1);
+-                else
+                        if (r < 0) {
+                                log_error_errno(r, "Failed to skip journal entries: %m");
+                                return MHD_CONTENT_READER_END_WITH_ERROR;
+                        }
+                        /* We skipped beyond the end, make sure entries between the cursor and n_skip offset
+                         * from it are not returned. */
+                        if (r < m->n_skip + 1) {
+                                m->n_skip -= r;
+                                if (m->follow)
+                                        return 0;
+                                return MHD_CONTENT_READER_END_OF_STREAM;
+                        }
+                } else
+                         r = sd_journal_next(m->journal);
+ 
+                 if (r < 0) {
+diff --git a/test/units/TEST-04-JOURNAL.journal-gatewayd.sh b/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+index ef85dc17c6..b6dc860b63 100755
+--- a/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+++ b/test/units/TEST-04-JOURNAL.journal-gatewayd.sh
+@@ -82,6 +82,12 @@ timeout 5 curl -LSfs \
+      --header "Range: entries=:-20:10" \
+      http://localhost:19531/entries?follow >"$LOG_FILE"
+ jq -se "length == 10" "$LOG_FILE"
+# Test positive skip beyond the last entry
+curl -LSfs \
+     --header "Accept: application/json" \
+     --header "Range: entries=$TEST_CURSOR:1:1" \
+     http://localhost:19531/entries?SYSLOG_IDENTIFIER="$TEST_TAG" >"$LOG_FILE"
+jq -se "length == 0" "$LOG_FILE"
+ # Check if the specified cursor refers to an existing entry and return just that entry
+ curl -LSfs \
+      --header "Accept: application/json" \
--- a/buildroot-external/patches/systemd/0007-journal-gatewayd-fix-busy-loop-when-following-way-be.patch
+++ b/buildroot-external/patches/systemd/0007-journal-gatewayd-fix-busy-loop-when-following-way-be.patch
@@ -0,0 +1,88 @@
+From d93da906a2148429f21c201aeb20e8738c22f4a4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
+Date: Wed, 30 Jul 2025 19:18:13 +0200
+Subject: [PATCH] journal-gatewayd: fix busy loop when following way beyond
+ journal end
+
+Fix regression introduced in a7bfb9f76b96888d60b4f287f29dcbf758ba34c0,
+where busy loop can be started with a request for following logs with a
+range header set with num_skip value pointing beyond the end of the
+journal. In that case the reader callback returns 0 and is called
+immediately again, usually causing an endless loop that is not recovered
+even when new journal events are added.
+
+The bug does not occur if num_skip is not set - in that case if no
+journal entries matching the filters are added, the tight loop is
+avoided by the sd_journal_wait().
+
+To fix the issue, when no matching journal events are available, set a
+flag and reuse the backoff mechanism using the sd_journal_wait().
+
+Link: https://github.com/home-assistant/operating-system/issues/4190
+---
+(Backported for v256.x)
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+Upstream: https://github.com/systemd/systemd/pull/38422
+---
+ src/journal-remote/journal-gatewayd.c | 31 +++++++++++++++------------
+ 1 file changed, 17 insertions(+), 14 deletions(-)
+
+diff --git a/src/journal-remote/journal-gatewayd.c b/src/journal-remote/journal-gatewayd.c
+index 5bce48d485..f7ecc352cc 100644
+--- a/src/journal-remote/journal-gatewayd.c
+++ b/src/journal-remote/journal-gatewayd.c
+@@ -171,6 +171,7 @@ static ssize_t request_reader_entries(
+ 
+         while (pos >= m->size) {
+                 off_t sz;
+                bool wait_for_events = false;
+ 
+                 /* End of this entry, so let's serialize the next
+                  * one */
+@@ -191,9 +192,10 @@ static ssize_t request_reader_entries(
+                          * from it are not returned. */
+                         if (r < m->n_skip + 1) {
+                                 m->n_skip -= r;
+-                                if (m->follow)
+-                                        return 0;
+-                                return MHD_CONTENT_READER_END_OF_STREAM;
+
+                                if (!m->follow)
+                                        return MHD_CONTENT_READER_END_OF_STREAM;
+                                wait_for_events = true;
+                         }
+                 } else
+                         r = sd_journal_next(m->journal);
+@@ -202,20 +204,21 @@ static ssize_t request_reader_entries(
+                         log_error_errno(r, "Failed to advance journal pointer: %m");
+                         return MHD_CONTENT_READER_END_WITH_ERROR;
+                 } else if (r == 0) {
+                        if (!m->follow)
+                                return MHD_CONTENT_READER_END_OF_STREAM;
+                        wait_for_events = true;
+                }
+ 
+-                        if (m->follow) {
+-                                r = sd_journal_wait(m->journal, (uint64_t) JOURNAL_WAIT_TIMEOUT);
+-                                if (r < 0) {
+-                                        log_error_errno(r, "Couldn't wait for journal event: %m");
+-                                        return MHD_CONTENT_READER_END_WITH_ERROR;
+-                                }
+-                                if (r == SD_JOURNAL_NOP)
+-                                        break;
+-
+-                                continue;
+                if (wait_for_events) {
+                        r = sd_journal_wait(m->journal, (uint64_t) JOURNAL_WAIT_TIMEOUT);
+                        if (r < 0) {
+                                log_error_errno(r, "Couldn't wait for journal event: %m");
+                                return MHD_CONTENT_READER_END_WITH_ERROR;
+                         }
+                        if (r == SD_JOURNAL_NOP)
+                                break;
+ 
+-                        return MHD_CONTENT_READER_END_OF_STREAM;
+                        continue;
+                 }
+ 
+                 if (m->discrete) {
--- a/buildroot-external/patches/systemd/0008-Use-paths-specified-from-environment-variables-for-e.patch
+++ b/buildroot-external/patches/systemd/0008-Use-paths-specified-from-environment-variables-for-e.patch
@@ -0,0 +1,918 @@
+From 2ae8aa6b338f98974581ef239c55fc34f6873b6e Mon Sep 17 00:00:00 2001
+From: Valentin David <valentin.david@canonical.com>
+Date: Mon, 10 Mar 2025 10:53:41 +0100
+Subject: [PATCH] Use paths specified from environment variables for /etc
+ configuration files
+
+Some configuration files that need updates are directly under in /etc. To
+update them atomically, we need write access to /etc. For Ubuntu Core this is
+an issue as /etc is not writable. Only a selection of subdirectories can be
+writable. The general solution is symlinks or bind mounts to writable places.
+But for atomic writes in /etc, that does not work. So Ubuntu has had a patch
+for that that did not age well.
+
+Instead we would like to introduce some environment variables for alternate
+paths.
+
+ * SYSTEMD_ETC_HOSTNAME: /etc/hostname
+ * SYSTEMD_ETC_MACHINE_INFO: /etc/machine-info
+ * SYSTEMD_ETC_LOCALTIME: /etc/localtime
+ * SYSTEMD_ETC_LOCALE_CONF: /etc/locale.conf
+ * SYSTEMD_ETC_VCONSOLE_CONF: /etc/vconsole.conf
+ * SYSTEMD_ETC_ADJTIME: /etc/adjtime
+
+While it is for now expected that there is a symlink from the standard, we
+still try to read them from that alternate path. This is important for
+`/etc/localtime`, which is a symlink, so we cannot have an indirect symlink or
+bind mount for it.
+
+Since machine-id is typically written only once and not updated. This commit
+does not cover it. An initrd can properly create it and bind mount it.
+---
+(Backported for v256.x)
+Upstream: https://github.com/systemd/systemd/pull/36656
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+---
+ docs/ENVIRONMENT.md                       | 25 ++++++++++++
+ src/basic/hostname-util.c                 | 20 +++++++++-
+ src/basic/hostname-util.h                 |  3 ++
+ src/basic/time-util.c                     | 11 +++++-
+ src/basic/time-util.h                     |  1 +
+ src/core/manager.c                        | 14 +++++--
+ src/firstboot/firstboot.c                 | 32 ++++++++-------
+ src/hostname/hostnamed.c                  | 20 +++++-----
+ src/locale/localed-util.c                 | 10 ++---
+ src/shared/env-file-label.c               |  7 ++--
+ src/shared/hostname-setup.c               |  2 +-
+ src/shared/locale-setup.c                 | 28 +++++++++++---
+ src/shared/locale-setup.h                 |  3 ++
+ src/timedate/timedated.c                  | 24 ++++++++----
+ test/units/TEST-30-ONCLOCKCHANGE.sh       | 28 ++++++++++++++
+ test/units/TEST-45-TIMEDATE.sh            | 44 +++++++++++++++++++++
+ test/units/TEST-71-HOSTNAME.sh            | 39 +++++++++++++++++++
+ test/units/TEST-73-LOCALE.sh              | 47 +++++++++++++++++++++++
+ test/units/TEST-74-AUX-UTILS.firstboot.sh | 37 ++++++++++++++++++
+ 19 files changed, 344 insertions(+), 51 deletions(-)
+
+diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
+index 6081351580..c7b62e0348 100644
+--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
+@@ -295,6 +295,9 @@ All tools:
+   first existing unit listed in the environment variable, and
+   `timedatectl set-ntp off` disables and stops all listed units.
+ 
+* `$SYSTEMD_ETC_ADJTIME` - override the path to the hardware clock settings
+  file. The default is `/etc/adjtime`.
+
+ `systemd-sulogin-shell`:
+ 
+ * `$SYSTEMD_SULOGIN_FORCE=1` — This skips asking for the root password if the
+@@ -721,3 +724,25 @@ Tools using the Varlink protocol (such as `varlinkctl`) or sd-bus (such as
+ * `$SYSTEMD_ADJUST_TERMINAL_TITLE` – Takes a boolean. When false the terminal
+   window title will not be updated for interactive invocation of the mentioned
+   tools.
+
+`systemd-timedated`, `systemd-firstboot`, `systemd`:
+
+* `$SYSTEMD_ETC_LOCALTIME` - override the path to the timezone symlink. The
+  default is `/etc/localtime`. The directory of the path should exist and not
+  be removed.
+
+`systemd-hostnamed`, `systemd-firstboot`:
+
+* `$SYSTEMD_ETC_HOSTNAME` - override the path to local system name
+  configuration file. The default is `/etc/hostname`.
+
+* `$SYSTEMD_ETC_MACHINE_INFO` - override the path to the machine metadata file. The
+  default is `/etc/machine-info`.
+
+`systemd-localed`, `systemd-firstboot`:
+
+* `$SYSTEMD_ETC_LOCALE_CONF` - override the path to the system-wide locale
+  configuration file. The default is `/etc/locale.conf`.
+
+* `$SYSTEMD_ETC_VCONSOLE_CONF` - override the path to the virtual console
+  configuration file. The default is `/etc/vconsole.conf`.
+diff --git a/src/basic/hostname-util.c b/src/basic/hostname-util.c
+index e743033b1e..d31897914f 100644
+--- a/src/basic/hostname-util.c
+++ b/src/basic/hostname-util.c
+@@ -191,13 +191,31 @@ bool is_localhost(const char *hostname) {
+                 endswith_no_case(hostname, ".localhost.localdomain.");
+ }
+ 
+const char* etc_hostname(void) {
+        static const char *cached = NULL;
+
+        if (!cached)
+                cached = secure_getenv("SYSTEMD_ETC_HOSTNAME") ?: "/etc/hostname";
+
+        return cached;
+}
+
+const char* etc_machine_info(void) {
+        static const char *cached = NULL;
+
+        if (!cached)
+                cached = secure_getenv("SYSTEMD_ETC_MACHINE_INFO") ?: "/etc/machine-info";
+
+        return cached;
+}
+
+ int get_pretty_hostname(char **ret) {
+         _cleanup_free_ char *n = NULL;
+         int r;
+ 
+         assert(ret);
+ 
+-        r = parse_env_file(NULL, "/etc/machine-info", "PRETTY_HOSTNAME", &n);
+        r = parse_env_file(NULL, etc_machine_info(), "PRETTY_HOSTNAME", &n);
+         if (r < 0)
+                 return r;
+ 
+diff --git a/src/basic/hostname-util.h b/src/basic/hostname-util.h
+index bcac3d9fb0..d592de376d 100644
+--- a/src/basic/hostname-util.h
+++ b/src/basic/hostname-util.h
+@@ -68,4 +68,7 @@ static inline bool is_dns_proxy_stub_hostname(const char *hostname) {
+         return STRCASE_IN_SET(hostname, "_localdnsproxy", "_localdnsproxy.");
+ }
+ 
+const char* etc_hostname(void);
+const char* etc_machine_info(void);
+
+ int get_pretty_hostname(char **ret);
+diff --git a/src/basic/time-util.c b/src/basic/time-util.c
+index b94f37c31c..35153db563 100644
+--- a/src/basic/time-util.c
+++ b/src/basic/time-util.c
+@@ -1610,7 +1610,7 @@ int get_timezone(char **ret) {
+ 
+         assert(ret);
+ 
+-        r = readlink_malloc("/etc/localtime", &t);
+        r = readlink_malloc(etc_localtime(), &t);
+         if (r == -ENOENT)
+                 /* If the symlink does not exist, assume "UTC", like glibc does */
+                 return strdup_to(ret, "UTC");
+@@ -1626,6 +1626,15 @@ int get_timezone(char **ret) {
+         return strdup_to(ret, e);
+ }
+ 
+const char* etc_localtime(void) {
+        static const char *cached = NULL;
+
+        if (!cached)
+                cached = secure_getenv("SYSTEMD_ETC_LOCALTIME") ?: "/etc/localtime";
+
+        return cached;
+}
+
+ time_t mktime_or_timegm(struct tm *tm, bool utc) {
+         assert(tm);
+ 
+diff --git a/src/basic/time-util.h b/src/basic/time-util.h
+index f273770233..e6fe563603 100644
+--- a/src/basic/time-util.h
+++ b/src/basic/time-util.h
+@@ -176,6 +176,7 @@ bool clock_supported(clockid_t clock);
+ usec_t usec_shift_clock(usec_t, clockid_t from, clockid_t to);
+ 
+ int get_timezone(char **ret);
+const char* etc_localtime(void);
+ 
+ time_t mktime_or_timegm(struct tm *tm, bool utc);
+ struct tm *localtime_or_gmtime_r(const time_t *t, struct tm *tm, bool utc);
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 8313a9edab..6b59dd1f33 100644
+--- a/src/core/manager.c
+++ b/src/core/manager.c
+@@ -416,7 +416,7 @@ static int manager_read_timezone_stat(Manager *m) {
+         assert(m);
+ 
+         /* Read the current stat() data of /etc/localtime so that we detect changes */
+-        if (lstat("/etc/localtime", &st) < 0) {
+        if (lstat(etc_localtime(), &st) < 0) {
+                 log_debug_errno(errno, "Failed to stat /etc/localtime, ignoring: %m");
+                 changed = m->etc_localtime_accessible;
+                 m->etc_localtime_accessible = false;
+@@ -453,14 +453,20 @@ static int manager_setup_timezone_change(Manager *m) {
+          * Note that we create the new event source first here, before releasing the old one. This should optimize
+          * behaviour as this way sd-event can reuse the old watch in case the inode didn't change. */
+ 
+-        r = sd_event_add_inotify(m->event, &new_event, "/etc/localtime",
+        r = sd_event_add_inotify(m->event, &new_event, etc_localtime(),
+                                  IN_ATTRIB|IN_MOVE_SELF|IN_CLOSE_WRITE|IN_DONT_FOLLOW, manager_dispatch_timezone_change, m);
+         if (r == -ENOENT) {
+                 /* If the file doesn't exist yet, subscribe to /etc instead, and wait until it is created either by
+                  * O_CREATE or by rename() */
+                _cleanup_free_ char *localtime_dir = NULL;
+ 
+-                log_debug_errno(r, "/etc/localtime doesn't exist yet, watching /etc instead.");
+-                r = sd_event_add_inotify(m->event, &new_event, "/etc",
+                int dir_r = path_extract_directory(etc_localtime(), &localtime_dir);
+                if (dir_r < 0)
+                        return log_error_errno(dir_r, "Failed to extract directory from path '%s': %m", etc_localtime());
+
+                log_debug_errno(r, "%s doesn't exist yet, watching %s instead.", etc_localtime(), localtime_dir);
+
+                r = sd_event_add_inotify(m->event, &new_event, localtime_dir,
+                                          IN_CREATE|IN_MOVED_TO|IN_ONLYDIR, manager_dispatch_timezone_change, m);
+         }
+         if (r < 0)
+diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
+index 0dbdfc6638..80a7a74825 100644
+--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
+@@ -28,6 +28,7 @@
+ #include "hostname-util.h"
+ #include "kbd-util.h"
+ #include "libcrypt-util.h"
+#include "locale-setup.h"
+ #include "locale-util.h"
+ #include "lock-util.h"
+ #include "main-func.h"
+@@ -409,7 +410,7 @@ static int process_locale(int rfd) {
+ 
+         assert(rfd >= 0);
+ 
+-        pfd = chase_and_open_parent_at(rfd, "/etc/locale.conf",
+        pfd = chase_and_open_parent_at(rfd, etc_locale_conf(),
+                                        CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
+                                        &f);
+         if (pfd < 0)
+@@ -426,7 +427,7 @@ static int process_locale(int rfd) {
+                 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
+ 
+         if (arg_copy_locale && r == 0) {
+-                r = copy_file_atomic_at(AT_FDCWD, "/etc/locale.conf", pfd, f, 0644, COPY_REFLINK);
+                r = copy_file_atomic_at(AT_FDCWD, etc_locale_conf(), pfd, f, 0644, COPY_REFLINK);
+                 if (r != -ENOENT) {
+                         if (r < 0)
+                                 return log_error_errno(r, "Failed to copy host's /etc/locale.conf: %m");
+@@ -514,7 +515,7 @@ static int process_keymap(int rfd) {
+ 
+         assert(rfd >= 0);
+ 
+-        pfd = chase_and_open_parent_at(rfd, "/etc/vconsole.conf",
+        pfd = chase_and_open_parent_at(rfd, etc_vconsole_conf(),
+                                        CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
+                                        &f);
+         if (pfd < 0)
+@@ -531,7 +532,7 @@ static int process_keymap(int rfd) {
+                 return log_error_errno(r, "Failed to check if directory file descriptor is root: %m");
+ 
+         if (arg_copy_keymap && r == 0) {
+-                r = copy_file_atomic_at(AT_FDCWD, "/etc/vconsole.conf", pfd, f, 0644, COPY_REFLINK);
+                r = copy_file_atomic_at(AT_FDCWD, etc_vconsole_conf(), pfd, f, 0644, COPY_REFLINK);
+                 if (r != -ENOENT) {
+                         if (r < 0)
+                                 return log_error_errno(r, "Failed to copy host's /etc/vconsole.conf: %m");
+@@ -602,13 +603,13 @@ static int prompt_timezone(int rfd) {
+ 
+ static int process_timezone(int rfd) {
+         _cleanup_close_ int pfd = -EBADF;
+-        _cleanup_free_ char *f = NULL;
+        _cleanup_free_ char *f = NULL, *relpath = NULL;
+         const char *e;
+         int r;
+ 
+         assert(rfd >= 0);
+ 
+-        pfd = chase_and_open_parent_at(rfd, "/etc/localtime",
+        pfd = chase_and_open_parent_at(rfd, etc_localtime(),
+                                        CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN|CHASE_NOFOLLOW,
+                                        &f);
+         if (pfd < 0)
+@@ -627,7 +628,7 @@ static int process_timezone(int rfd) {
+         if (arg_copy_timezone && r == 0) {
+                 _cleanup_free_ char *s = NULL;
+ 
+-                r = readlink_malloc("/etc/localtime", &s);
+                r = readlink_malloc(etc_localtime(), &s);
+                 if (r != -ENOENT) {
+                         if (r < 0)
+                                 return log_error_errno(r, "Failed to read host's /etc/localtime: %m");
+@@ -648,9 +649,12 @@ static int process_timezone(int rfd) {
+         if (isempty(arg_timezone))
+                 return 0;
+ 
+-        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
+        e = strjoina("/usr/share/zoneinfo/", arg_timezone);
+        r = path_make_relative_parent(etc_localtime(), e, &relpath);
+        if (r < 0)
+                return r;
+ 
+-        r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+        r = symlinkat_atomic_full(relpath, pfd, f, /* make_relative= */ false);
+         if (r < 0)
+                 return log_error_errno(r, "Failed to create /etc/localtime symlink: %m");
+ 
+@@ -707,7 +711,7 @@ static int process_hostname(int rfd) {
+ 
+         assert(rfd >= 0);
+ 
+-        pfd = chase_and_open_parent_at(rfd, "/etc/hostname",
+        pfd = chase_and_open_parent_at(rfd, etc_hostname(),
+                                        CHASE_AT_RESOLVE_IN_ROOT|CHASE_MKDIR_0755|CHASE_WARN,
+                                        &f);
+         if (pfd < 0)
+@@ -1235,12 +1239,12 @@ static int process_reset(int rfd) {
+                 return 0;
+ 
+         FOREACH_STRING(p,
+-                       "/etc/locale.conf",
+-                       "/etc/vconsole.conf",
+-                       "/etc/hostname",
+                       etc_locale_conf(),
+                       etc_vconsole_conf(),
+                       etc_hostname(),
+                        "/etc/machine-id",
+                        "/etc/kernel/cmdline",
+-                       "/etc/localtime") {
+                       etc_localtime()) {
+                 r = reset_one(rfd, p);
+                 if (r < 0)
+                         return r;
+diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
+index af66b48a3d..f13af53f6f 100644
+--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
+@@ -112,7 +112,7 @@ static void context_read_etc_hostname(Context *c) {
+ 
+         assert(c);
+ 
+-        if (stat("/etc/hostname", &current_stat) >= 0 &&
+        if (stat(etc_hostname(), &current_stat) >= 0 &&
+             stat_inode_unmodified(&c->etc_hostname_stat, &current_stat))
+                 return;
+ 
+@@ -131,7 +131,7 @@ static void context_read_machine_info(Context *c) {
+ 
+         assert(c);
+ 
+-        if (stat("/etc/machine-info", &current_stat) >= 0 &&
+        if (stat(etc_machine_info(), &current_stat) >= 0 &&
+             stat_inode_unmodified(&c->etc_machine_info_stat, &current_stat))
+                 return;
+ 
+@@ -144,7 +144,7 @@ static void context_read_machine_info(Context *c) {
+                       (UINT64_C(1) << PROP_HARDWARE_VENDOR) |
+                       (UINT64_C(1) << PROP_HARDWARE_MODEL));
+ 
+-        r = parse_env_file(NULL, "/etc/machine-info",
+        r = parse_env_file(NULL, etc_machine_info(),
+                            "PRETTY_HOSTNAME", &c->data[PROP_PRETTY_HOSTNAME],
+                            "ICON_NAME", &c->data[PROP_ICON_NAME],
+                            "CHASSIS", &c->data[PROP_CHASSIS],
+@@ -615,20 +615,20 @@ static int context_write_data_static_hostname(Context *c) {
+         s = &c->etc_hostname_stat;
+ 
+         if (isempty(c->data[PROP_STATIC_HOSTNAME])) {
+-                if (unlink("/etc/hostname") < 0 && errno != ENOENT)
+                if (unlink(etc_hostname()) < 0 && errno != ENOENT)
+                         return -errno;
+ 
+                 TAKE_PTR(s);
+                 return 0;
+         }
+ 
+-        r = write_string_file("/etc/hostname", c->data[PROP_STATIC_HOSTNAME],
+        r = write_string_file(etc_hostname(), c->data[PROP_STATIC_HOSTNAME],
+                               WRITE_STRING_FILE_CREATE | WRITE_STRING_FILE_TRUNCATE);
+         if (r < 0)
+                 return r;
+ 
+         /* Cannot use WRITE_STRING_FILE_SYNC as it tries to sync parent dir */
+-        fd = open("/etc/hostname", O_RDONLY|O_CLOEXEC);
+        fd = open(etc_hostname(), O_RDONLY|O_CLOEXEC);
+         if (fsync(fd) < 0)
+                 return -errno;
+ 
+@@ -654,7 +654,7 @@ static int context_write_data_machine_info(Context *c) {
+          * already, even if we can't make it hit the disk. */
+         s = &c->etc_machine_info_stat;
+ 
+-        r = load_env_file(NULL, "/etc/machine-info", &l);
+        r = load_env_file(NULL, etc_machine_info(), &l);
+         if (r < 0 && r != -ENOENT)
+                 return r;
+ 
+@@ -667,14 +667,14 @@ static int context_write_data_machine_info(Context *c) {
+         }
+ 
+         if (strv_isempty(l)) {
+-                if (unlink("/etc/machine-info") < 0 && errno != ENOENT)
+                if (unlink(etc_machine_info()) < 0 && errno != ENOENT)
+                         return -errno;
+ 
+                 TAKE_PTR(s);
+                 return 0;
+         }
+ 
+-        r = write_env_file_label(AT_FDCWD, "/etc/machine-info", NULL, l);
+        r = write_env_file_label(AT_FDCWD, etc_machine_info(), NULL, l);
+         if (r < 0)
+                 return r;
+ 
+@@ -1420,7 +1420,7 @@ static int build_describe_response(Context *c, bool privileged, JsonVariant **re
+         (void) vsock_get_local_cid(&local_cid);
+ 
+         (void) load_os_release_pairs(/* root= */ NULL, &os_release_pairs);
+-        (void) load_env_file_pairs(/* f=*/ NULL, "/etc/machine-info", &machine_info_pairs);
+        (void) load_env_file_pairs(/* f=*/ NULL, etc_machine_info(), &machine_info_pairs);
+ 
+         r = json_build(&v, JSON_BUILD_OBJECT(
+                                        JSON_BUILD_PAIR("Hostname", JSON_BUILD_STRING(hn)),
+diff --git a/src/locale/localed-util.c b/src/locale/localed-util.c
+index 56996596fe..6e2a43aa56 100644
+--- a/src/locale/localed-util.c
+++ b/src/locale/localed-util.c
+@@ -350,7 +350,7 @@ int vconsole_read_data(Context *c, sd_bus_message *m) {
+                 c->vc_cache = sd_bus_message_ref(m);
+         }
+ 
+-        fd = RET_NERRNO(open("/etc/vconsole.conf", O_CLOEXEC | O_PATH));
+        fd = RET_NERRNO(open(etc_vconsole_conf(), O_CLOEXEC | O_PATH));
+         if (fd == -ENOENT) {
+                 c->vc_stat = (struct stat) {};
+                 vc_context_clear(&c->vc);
+@@ -372,7 +372,7 @@ int vconsole_read_data(Context *c, sd_bus_message *m) {
+         x11_context_clear(&c->x11_from_vc);
+ 
+         r = parse_env_file_fd(
+-                        fd, "/etc/vconsole.conf",
+                        fd, etc_vconsole_conf(),
+                         "KEYMAP",        &c->vc.keymap,
+                         "KEYMAP_TOGGLE", &c->vc.toggle,
+                         "XKBLAYOUT",     &c->x11_from_vc.layout,
+@@ -496,7 +496,7 @@ int vconsole_write_data(Context *c) {
+ 
+         xc = context_get_x11_context(c);
+ 
+-        r = load_env_file(NULL, "/etc/vconsole.conf", &l);
+        r = load_env_file(NULL, etc_vconsole_conf(), &l);
+         if (r < 0 && r != -ENOENT)
+                 return r;
+ 
+@@ -525,7 +525,7 @@ int vconsole_write_data(Context *c) {
+                 return r;
+ 
+         if (strv_isempty(l)) {
+-                if (unlink("/etc/vconsole.conf") < 0)
+                if (unlink(etc_vconsole_conf()) < 0)
+                         return errno == ENOENT ? 0 : -errno;
+ 
+                 c->vc_stat = (struct stat) {};
+@@ -536,7 +536,7 @@ int vconsole_write_data(Context *c) {
+         if (r < 0)
+                 return r;
+ 
+-        if (stat("/etc/vconsole.conf", &c->vc_stat) < 0)
+        if (stat(etc_vconsole_conf(), &c->vc_stat) < 0)
+                 return -errno;
+ 
+         return 0;
+diff --git a/src/shared/env-file-label.c b/src/shared/env-file-label.c
+index 5917b6377f..c0c9668e9f 100644
+--- a/src/shared/env-file-label.c
+++ b/src/shared/env-file-label.c
+@@ -2,8 +2,9 @@
+ 
+ #include <sys/stat.h>
+ 
+-#include "env-file-label.h"
+ #include "env-file.h"
+#include "env-file-label.h"
+#include "locale-setup.h"
+ #include "selinux-util.h"
+ 
+ int write_env_file_label(int dir_fd, const char *fname, char **headers, char **l) {
+@@ -23,11 +24,11 @@ int write_env_file_label(int dir_fd, const char *fname, char **headers, char **l
+ int write_vconsole_conf_label(char **l) {
+         int r;
+ 
+-        r = mac_selinux_create_file_prepare("/etc/vconsole.conf", S_IFREG);
+        r = mac_selinux_create_file_prepare(etc_vconsole_conf(), S_IFREG);
+         if (r < 0)
+                 return r;
+ 
+-        r = write_vconsole_conf(AT_FDCWD, "/etc/vconsole.conf", l);
+        r = write_vconsole_conf(AT_FDCWD, etc_vconsole_conf(), l);
+ 
+         mac_selinux_create_file_clear();
+ 
+diff --git a/src/shared/hostname-setup.c b/src/shared/hostname-setup.c
+index 6cfd4b54bf..88455f5c1e 100644
+--- a/src/shared/hostname-setup.c
+++ b/src/shared/hostname-setup.c
+@@ -130,7 +130,7 @@ int read_etc_hostname(const char *path, char **ret) {
+         assert(ret);
+ 
+         if (!path)
+-                path = "/etc/hostname";
+                path = etc_hostname();
+ 
+         f = fopen(path, "re");
+         if (!f)
+diff --git a/src/shared/locale-setup.c b/src/shared/locale-setup.c
+index 4e7f486a23..a4351003a9 100644
+--- a/src/shared/locale-setup.c
+++ b/src/shared/locale-setup.c
+@@ -64,7 +64,7 @@ static int locale_context_load_conf(LocaleContext *c, LocaleLoadFlag flag) {
+         if (!FLAGS_SET(flag, LOCALE_LOAD_LOCALE_CONF))
+                 return 0;
+ 
+-        fd = RET_NERRNO(open("/etc/locale.conf", O_CLOEXEC | O_PATH));
+        fd = RET_NERRNO(open(etc_locale_conf(), O_CLOEXEC | O_PATH));
+         if (fd == -ENOENT)
+                 return 0;
+         if (fd < 0)
+@@ -80,7 +80,7 @@ static int locale_context_load_conf(LocaleContext *c, LocaleLoadFlag flag) {
+         c->st = st;
+         locale_context_clear(c);
+ 
+-        r = parse_env_file_fd(fd, "/etc/locale.conf",
+        r = parse_env_file_fd(fd, etc_locale_conf(),
+                               "LANG",              &c->locale[VARIABLE_LANG],
+                               "LANGUAGE",          &c->locale[VARIABLE_LANGUAGE],
+                               "LC_CTYPE",          &c->locale[VARIABLE_LC_CTYPE],
+@@ -196,7 +196,7 @@ int locale_context_save(LocaleContext *c, char ***ret_set, char ***ret_unset) {
+                 return r;
+ 
+         if (strv_isempty(set)) {
+-                if (unlink("/etc/locale.conf") < 0)
+                if (unlink(etc_locale_conf()) < 0)
+                         return errno == ENOENT ? 0 : -errno;
+ 
+                 c->st = (struct stat) {};
+@@ -208,11 +208,11 @@ int locale_context_save(LocaleContext *c, char ***ret_set, char ***ret_unset) {
+                 return 0;
+         }
+ 
+-        r = write_env_file_label(AT_FDCWD, "/etc/locale.conf", NULL, set);
+        r = write_env_file_label(AT_FDCWD, etc_locale_conf(), NULL, set);
+         if (r < 0)
+                 return r;
+ 
+-        if (stat("/etc/locale.conf", &c->st) < 0)
+        if (stat(etc_locale_conf(), &c->st) < 0)
+                 return -errno;
+ 
+         if (ret_set)
+@@ -292,3 +292,21 @@ int locale_setup(char ***environment) {
+ 
+         return 0;
+ }
+
+const char* etc_locale_conf(void) {
+        static const char *cached = NULL;
+
+        if (!cached)
+                cached = secure_getenv("SYSTEMD_ETC_LOCALE_CONF") ?: "/etc/locale.conf";
+
+        return cached;
+}
+
+const char* etc_vconsole_conf(void) {
+        static const char *cached = NULL;
+
+        if (!cached)
+                cached = secure_getenv("SYSTEMD_ETC_VCONSOLE_CONF") ?: "/etc/vconsole.conf";
+
+        return cached;
+}
+diff --git a/src/shared/locale-setup.h b/src/shared/locale-setup.h
+index 537acc72df..3f1cd6b88c 100644
+--- a/src/shared/locale-setup.h
+++ b/src/shared/locale-setup.h
+@@ -27,3 +27,6 @@ void locale_context_take(LocaleContext *c, char *l[_VARIABLE_LC_MAX]);
+ bool locale_context_equal(const LocaleContext *c, char *l[_VARIABLE_LC_MAX]);
+ 
+ int locale_setup(char ***environment);
+
+const char* etc_locale_conf(void);
+const char* etc_vconsole_conf(void);
+diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
+index e3b4367ec0..e0d38d3ad2 100644
+--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
+@@ -306,22 +306,32 @@ static int context_write_data_timezone(Context *c) {
+ 
+                 if (access("/usr/share/zoneinfo/UTC", F_OK) < 0) {
+ 
+-                        if (unlink("/etc/localtime") < 0 && errno != ENOENT)
+                        if (unlink(etc_localtime()) < 0 && errno != ENOENT)
+                                 return -errno;
+ 
+                         return 0;
+                 }
+ 
+-                source = "../usr/share/zoneinfo/UTC";
+                source = "/usr/share/zoneinfo/UTC";
+         } else {
+-                p = path_join("../usr/share/zoneinfo", c->zone);
+                p = path_join("/usr/share/zoneinfo", c->zone);
+                 if (!p)
+                         return -ENOMEM;
+ 
+                 source = p;
+         }
+ 
+-        return symlink_atomic(source, "/etc/localtime");
+        return symlinkat_atomic_full(source, AT_FDCWD, etc_localtime(),
+                                     !secure_getenv("SYSTEMD_ETC_LOCALTIME"));
+}
+
+static const char* etc_adjtime(void) {
+        static const char *cached = NULL;
+
+        if (!cached)
+                cached = secure_getenv("SYSTEMD_ETC_ADJTIME") ?: "/etc/adjtime";
+
+        return cached;
+ }
+ 
+ static int context_write_data_local_rtc(Context *c) {
+@@ -330,7 +340,7 @@ static int context_write_data_local_rtc(Context *c) {
+ 
+         assert(c);
+ 
+-        r = read_full_file("/etc/adjtime", &s, NULL);
+        r = read_full_file(etc_adjtime(), &s, NULL);
+         if (r < 0) {
+                 if (r != -ENOENT)
+                         return r;
+@@ -382,7 +392,7 @@ static int context_write_data_local_rtc(Context *c) {
+                 *(char*) mempcpy(stpcpy(stpcpy(mempcpy(w, s, a), prepend), c->local_rtc ? "LOCAL" : "UTC"), e, b) = 0;
+ 
+                 if (streq(w, NULL_ADJTIME_UTC)) {
+-                        if (unlink("/etc/adjtime") < 0)
+                        if (unlink(etc_adjtime()) < 0)
+                                 if (errno != ENOENT)
+                                         return -errno;
+ 
+@@ -394,7 +404,7 @@ static int context_write_data_local_rtc(Context *c) {
+         if (r < 0)
+                 return r;
+ 
+-        return write_string_file_atomic_label("/etc/adjtime", w);
+        return write_string_file_atomic_label(etc_adjtime(), w);
+ }
+ 
+ static int context_update_ntp_status(Context *c, sd_bus *bus, sd_bus_message *m) {
+diff --git a/test/units/TEST-30-ONCLOCKCHANGE.sh b/test/units/TEST-30-ONCLOCKCHANGE.sh
+index 83698b8da6..11f30b75d3 100755
+--- a/test/units/TEST-30-ONCLOCKCHANGE.sh
+++ b/test/units/TEST-30-ONCLOCKCHANGE.sh
+@@ -24,6 +24,34 @@ timedatectl set-time 2018-1-1
+ 
+ while test ! -f /tmp/clock-changed ; do sleep .5 ; done
+ 
+mkdir -p /etc/alternate-path
+rm -f /etc/alternate-path/localtime
+
+cat <<EOF >/run/systemd/system.conf
+[Manager]
+ManagerEnvironment=SYSTEMD_ETC_LOCALTIME=/etc/alternate-path/localtime
+EOF
+mkdir -p /run/systemd/system/systemd-timedated.service.d
+cat >/run/systemd/system/systemd-timedated.service.d/override.conf <<EOF
+[Service]
+Environment=SYSTEMD_ETC_LOCALTIME=/run/alternate-path/mylocaltime
+Environment=SYSTEMD_ETC_ADJTIME=/run/alternate-path/myadjtime
+EOF
+systemctl daemon-reload
+
+systemd-run --on-timezone-change touch /tmp/timezone-changed-alternate-path-1
+timedatectl set-timezone Europe/Berlin
+
+while test ! -f /tmp/timezone-changed-alternate-path-1 ; do sleep .5 ; done
+
+systemd-run --on-timezone-change touch /tmp/timezone-changed-alternate-path-2
+timedatectl set-timezone Europe/Kyiv
+
+while test ! -f /tmp/timezone-changed-alternate-path-2 ; do sleep .5 ; done
+
+rm /run/systemd/system.conf /run/systemd/system/systemd-timedated.service.d/override.conf
+systemctl daemon-reload
+
+ systemd-analyze log-level info
+ 
+ touch /testok
+diff --git a/test/units/TEST-45-TIMEDATE.sh b/test/units/TEST-45-TIMEDATE.sh
+index 420ebefd01..c1fa30e206 100755
+--- a/test/units/TEST-45-TIMEDATE.sh
+++ b/test/units/TEST-45-TIMEDATE.sh
+@@ -403,6 +403,50 @@ EOF
+     rm -f /run/systemd/network/ntp99.*
+ }
+ 
+teardown_timedated_alternate_paths() {
+    set +eu
+
+    rm -rf /run/systemd/system/systemd-timedated.service.d
+    systemctl daemon-reload
+    systemctl restart systemd-timedated
+}
+
+testcase_timedated_alternate_paths() {
+    trap teardown_timedated_alternate_paths RETURN
+
+    mkdir -p /run/alternate-path
+    mkdir -p /run/systemd/system/systemd-timedated.service.d
+    cat >/run/systemd/system/systemd-timedated.service.d/override.conf <<EOF
+[Service]
+Environment=SYSTEMD_ETC_LOCALTIME=/run/alternate-path/mylocaltime
+Environment=SYSTEMD_ETC_ADJTIME=/run/alternate-path/myadjtime
+EOF
+    systemctl daemon-reload
+    systemctl restart systemd-timedated
+
+    assert_in "Local time:" "$(timedatectl --no-pager)"
+
+    assert_eq "$(timedatectl --no-pager set-timezone Europe/Kyiv 2>&1)" ""
+    assert_eq "$(readlink /run/alternate-path/mylocaltime | sed 's#^.*zoneinfo/##')" "Europe/Kyiv"
+    assert_in "Time zone: Europe/Kyiv \(EES*T, \+0[0-9]00\)" "$(timedatectl)"
+
+    # Restart to force using get_timezine
+    systemctl restart systemd-timedated
+    assert_in "Time zone: Europe/Kyiv \(EES*T, \+0[0-9]00\)" "$(timedatectl)"
+
+    assert_in "RTC in local TZ: no" "$(timedatectl --no-pager)"
+    assert_rc 0 timedatectl set-local-rtc 1
+    assert_in "RTC in local TZ: yes" "$(timedatectl --no-pager)"
+    assert_eq "$(cat /run/alternate-path/myadjtime)" "0.0 0 0
+0
+LOCAL"
+    assert_rc 0 timedatectl set-local-rtc 0
+    if [[ -e /run/alternate-path/myadjtime ]]; then
+        echo "/run/alternate-path/myadjtime still exists" >&2
+        exit 1
+    fi
+}
+
+ run_testcases
+ 
+ touch /testok
+diff --git a/test/units/TEST-71-HOSTNAME.sh b/test/units/TEST-71-HOSTNAME.sh
+index dc3f587ea3..add24c6804 100755
+--- a/test/units/TEST-71-HOSTNAME.sh
+++ b/test/units/TEST-71-HOSTNAME.sh
+@@ -237,6 +237,45 @@ test_varlink() {
+     cmp "$A" "$B"
+ }
+ 
+teardown_hostnamed_alternate_paths() {
+    set +eu
+
+    rm -rf /run/systemd/system/systemd-hostnamed.service.d
+    systemctl daemon-reload
+    systemctl restart systemd-hostnamed
+    if [[ -f /etc/hostname ]]; then
+        orig=$(cat /etc/hostname)
+        if [[ -n "${orig}" ]]; then
+            hostnamectl hostname "${orig}"
+        fi
+    fi
+}
+
+testcase_hostnamed_alternate_paths() {
+    trap teardown_hostnamed_alternate_paths RETURN
+
+    mkdir -p /run/alternate-path
+
+    mkdir -p /run/systemd/system/systemd-hostnamed.service.d
+    cat >/run/systemd/system/systemd-hostnamed.service.d/override.conf <<EOF
+[Service]
+Environment=SYSTEMD_ETC_HOSTNAME=/run/alternate-path/myhostname
+Environment=SYSTEMD_ETC_MACHINE_INFO=/run/alternate-path/mymachine-info
+EOF
+    systemctl daemon-reload
+    systemctl restart systemd-hostnamed
+
+    assert_rc 0 hostnamectl set-hostname heisenberg
+    assert_rc 0 hostnamectl chassis watch
+
+    output=$(hostnamectl)
+    assert_in "Static hostname: heisenberg" "$output"
+    assert_in "Chassis: watch" "$output"
+    assert_in "heisenberg" "$(cat /run/alternate-path/myhostname)"
+    assert_in "CHASSIS=watch" "$(cat /run/alternate-path/mymachine-info)"
+}
+
+
+ run_testcases
+ 
+ touch /testok
+diff --git a/test/units/TEST-73-LOCALE.sh b/test/units/TEST-73-LOCALE.sh
+index 0617bd0d51..fbc6f7dad4 100755
+--- a/test/units/TEST-73-LOCALE.sh
+++ b/test/units/TEST-73-LOCALE.sh
+@@ -652,6 +652,53 @@ testcase_locale_gen_leading_space() {
+     localectl set-locale en_US.UTF-8
+ }
+ 
+teardown_localed_alternate_paths() {
+    set +eu
+
+    rm -rf /run/systemd/system/systemd-localed.service.d
+    systemctl daemon-reload
+    systemctl restart systemd-localed
+}
+
+testcase_localed_alternate_paths() {
+    trap teardown_localed_alternate_paths RETURN
+
+    mkdir -p /run/alternate-path
+
+    mkdir -p /run/systemd/system/systemd-localed.service.d
+    cat >/run/systemd/system/systemd-localed.service.d/override.conf <<EOF
+[Service]
+Environment=SYSTEMD_ETC_LOCALE_CONF=/run/alternate-path/mylocale.conf
+Environment=SYSTEMD_ETC_VCONSOLE_CONF=/run/alternate-path/myvconsole.conf
+EOF
+    systemctl daemon-reload
+    systemctl restart systemd-localed
+
+    if localectl list-locales | grep "^de_DE.UTF-8$"; then
+        assert_rc 0 localectl set-locale "LANG=de_DE.UTF-8" "LC_CTYPE=C"
+    else
+        skip_locale=1
+    fi
+
+    if localectl list-keymaps | grep -F "^no$"; then
+        assert_rc 0 localectl set-keymap "no"
+    else
+        skip_keymap=1
+    fi
+
+    output=$(localectl)
+
+    if [[ -z "${skip_locale-}" ]]; then
+        assert_in "System Locale: LANG=de_DE.UTF-8" "$output"
+        assert_in "LANG=de_DE.UTF-8" "$(cat /run/alternate-path/mylocale.conf)"
+    fi
+
+    if [[ -z "${skip_keymap-}" ]]; then
+        assert_in "VC Keymap: no" "$output"
+        assert_in "KEYMAP=no" "$(cat /run/alternate-path/myvconsole.conf)"
+    fi
+}
+
+ # Make sure the content of kbd-model-map is the one that the tests expect
+ # regardless of the version installed on the distro where the testsuite is
+ # running on.
+diff --git a/test/units/TEST-74-AUX-UTILS.firstboot.sh b/test/units/TEST-74-AUX-UTILS.firstboot.sh
+index d9e5f59426..bb15e52896 100755
+--- a/test/units/TEST-74-AUX-UTILS.firstboot.sh
+++ b/test/units/TEST-74-AUX-UTILS.firstboot.sh
+@@ -18,6 +18,10 @@ at_exit() {
+         rm -fr "$ROOT"
+     fi
+ 
+    if [[ -d /etc/otherpath ]]; then
+        rm -rf /etc/otherpath
+    fi
+
+     restore_locale
+ }
+ 
+@@ -282,3 +286,36 @@ rm -fv "$ROOT/etc/passwd" "$ROOT/etc/shadow"
+ (! systemd-firstboot --root="$ROOT" --root-shell=/bin/nonexistentshell)
+ (! systemd-firstboot --root="$ROOT" --machine-id=invalidmachineid)
+ (! systemd-firstboot --root="$ROOT" --timezone=Foo/Bar)
+
+mkdir -p "${ROOT}/etc/otherpath"
+mkdir -p /etc/otherpath
+echo "KEYMAP=us" >/etc/otherpath/vconsole.conf
+echo "LANG=en_US.UTF-8" >/etc/otherpath/locale.conf
+ln -s "../$(readlink /etc/localtime)" /etc/otherpath/localtime
+
+SYSTEMD_ETC_LOCALE_CONF=/etc/otherpath/locale.conf \
+SYSTEMD_ETC_VCONSOLE_CONF=/etc/otherpath/vconsole.conf \
+SYSTEMD_ETC_LOCALTIME=/etc/otherpath/localtime \
+SYSTEMD_ETC_HOSTNAME=/etc/otherpath/hostname \
+systemd-firstboot --root="$ROOT" --copy-locale --copy-keymap --copy-timezone --hostname="weirdpaths"
+
+diff "${ROOT}/etc/otherpath/locale.conf" "/etc/otherpath/locale.conf"
+diff "${ROOT}/etc/otherpath/vconsole.conf" "/etc/otherpath/vconsole.conf"
+grep -q "weirdpaths" "${ROOT}/etc/otherpath/hostname"
+
+[[ "$(readlink /etc/otherpath/localtime)" = "$(readlink "${ROOT}/etc/otherpath/localtime")" ]]
+
+SYSTEMD_ETC_LOCALE_CONF=/etc/otherpath/locale.conf \
+SYSTEMD_ETC_VCONSOLE_CONF=/etc/otherpath/vconsole.conf \
+SYSTEMD_ETC_LOCALTIME=/etc/otherpath/localtime \
+SYSTEMD_ETC_HOSTNAME=/etc/otherpath/hostname \
+systemd-firstboot --root="$ROOT" --force \
+                  --hostname="weirdpaths2" \
+                  --locale=no_NO.UTF-8 \
+                  --keymap=no \
+                  --timezone=Europe/Oslo
+
+grep -q "LANG=no_NO.UTF-8" "${ROOT}/etc/otherpath/locale.conf"
+grep -q "KEYMAP=no" "${ROOT}/etc/otherpath/vconsole.conf"
+grep -q "weirdpaths2" "${ROOT}/etc/otherpath/hostname"
+[[ "$(readlink "${ROOT}/etc/otherpath/localtime")" = "../../usr/share/zoneinfo/Europe/Oslo" ]]
--- a/buildroot-external/rootfs-overlay/etc/bluetooth/main.conf
+++ b/buildroot-external/rootfs-overlay/etc/bluetooth/main.conf
@@ -1,5 +1,9 @@
 [General]
 Experimental=true
+# Increase temporary device timeout from 30s to 195s to prevent device
+# removal during connection retries and to align with Home Assistant's
+# Bluetooth stack expectations
+TemporaryTimeout=195

 [Policy]
 AutoEnable=true
--- a/buildroot-external/rootfs-overlay/etc/docker/daemon.json
+++ b/buildroot-external/rootfs-overlay/etc/docker/daemon.json
@@ -1,8 +1,6 @@
 {
    "storage-driver": "overlay2",
    "log-driver": "journald",
-    "experimental": true,
-    "ip6tables": true,
    "log-opts": {
        "tag": "{{.Name}}"
    },
--- a/buildroot-external/rootfs-overlay/usr/lib/sysctl.d/20-network.conf
+++ b/buildroot-external/rootfs-overlay/usr/lib/sysctl.d/20-network.conf
@@ -5,3 +5,12 @@ net.ipv4.igmp_max_memberships = 1024
 # Increase maximum receive and send buffer size
 net.core.rmem_max = 4194304
 net.core.wmem_max = 4194304
+
+# Disable TCP slow start after idle to keep cwnd across idle
+net.ipv4.tcp_slow_start_after_idle = 0
+
+# Enable linear RTO backoff for "thin" TCP streams.
+# "Thin" per kernel: tp->packets_out < 4 and not in initial slow start.
+# Ref: tcp_stream_is_thin(tp) in include/net/tcp.h
+# Rationale: reduce tail latency for API-style connections after sporadic loss.
+net.ipv4.tcp_thin_linear_timeouts = 1
--- a/buildroot-external/rootfs-overlay/usr/lib/systemd/system.conf.d/localtime.conf
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system.conf.d/localtime.conf
@@ -0,0 +1,2 @@
+[Manager]
+ManagerEnvironment=SYSTEMD_ETC_LOCALTIME=/mnt/overlay/etc/localtime
--- a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/ha-cli@.service
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/ha-cli@.service
@@ -15,6 +15,9 @@ Before=getty.target
 Conflicts=rescue.service
 Before=rescue.service

+# Same value as RestartMaxDelaySec to avoid marking the service as failed
+StartLimitIntervalSec=3s
+
 [Service]
 # the VT is cleared by TTYVTDisallocate
 # The '-o' option value tells agetty to replace 'login' arguments with an
@@ -23,7 +26,9 @@ Before=rescue.service
 ExecStart=/usr/sbin/hassos-cli
 Type=idle
 Restart=always
-RestartSec=0
+RestartSec=100ms
+RestartMaxDelaySec=3s
+RestartSteps=3
 UtmpIdentifier=%I
 TTYPath=/dev/%I
 TTYReset=yes
--- a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/raucdb-migrate.service
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/raucdb-migrate.service
@@ -1,13 +0,0 @@
-[Unit]
-Description=Migrate rauc.db to boot partition
-Before=rauc.service
-RequiresMountsFor=/mnt/boot /mnt/data
-ConditionPathExists=/mnt/boot/migrate-raucdb
-
-[Service]
-Type=oneshot
-ExecStart=/bin/cp /mnt/data/rauc.db /mnt/boot/
-ExecStartPost=/bin/rm /mnt/boot/migrate-raucdb
-
-[Install]
-WantedBy=multi-user.target
--- a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/systemd-timedated.service.d/localtime.conf
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/systemd-timedated.service.d/localtime.conf
@@ -0,0 +1,3 @@
+[Service]
+Environment=SYSTEMD_ETC_LOCALTIME=/mnt/overlay/etc/localtime
+ReadWritePaths=/etc /mnt/overlay/etc
--- a/Show More
+++ b/Show More