diff --git a/.github/workflows/artifacts-index.yaml b/.github/workflows/artifacts-index.yaml
index e58e02e5d8c..d1de82d7a1e 100644
--- a/.github/workflows/artifacts-index.yaml
+++ b/.github/workflows/artifacts-index.yaml
@@ -39,12 +39,12 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: Setup Python version ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d176b746e9a..50e10fe80cf 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -55,7 +55,7 @@ jobs:
       self_signed_cert: ${{ steps.generate_signing_key.outputs.self_signed_cert }}
     steps:
       - name: Checkout source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
@@ -147,7 +147,7 @@ jobs:
           fi
 
       - name: Create build matrix
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         id: generate_matrix
         with:
           script: |
@@ -177,15 +177,15 @@ jobs:
             }
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
             registry: ghcr.io
             username: ${{ github.repository_owner }}
             password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and Push
-        uses: docker/build-push-action@v6.18.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
         id: build_haos_builder
         with:
           context: .
@@ -207,7 +207,7 @@ jobs:
           echo "self_signed_cert=true" >> $GITHUB_OUTPUT
 
       - name: Create signing key
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: steps.generate_signing_key.outcome == 'success'
         with:
           name: signing-key
@@ -227,14 +227,14 @@ jobs:
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           submodules: true
           persist-credentials: false
 
       - name: Setup Python version ${{ env.PYTHON_VERSION }}
         if: ${{ github.event_name != 'release' }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -260,7 +260,7 @@ jobs:
 
       - name: Get self-signed certificate from the prepare job
         if: ${{ needs.prepare.outputs.self_signed_cert == 'true' }}
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: signing-key
 
@@ -281,7 +281,7 @@ jobs:
           df -h
 
       - name: "Restore cache: object files"
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: /mnt/cache/cc
           key: haos-cc-${{ matrix.board.id }}
@@ -329,7 +329,7 @@ jobs:
 
       - name: Upload release assets
         if: ${{ github.event_name == 'release' }}
-        uses: shogo82148/actions-upload-release-asset@v1
+        uses: shogo82148/actions-upload-release-asset@59cbc563d11314e48122193f8fe5cdda62ea6cf9 # v1.9.1
         with:
           upload_url: ${{ github.event.release.upload_url }}
           asset_path: output/images/haos_*
@@ -344,7 +344,7 @@ jobs:
 
       - name: "Save cache: object files"
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: /mnt/cache/cc
           key: haos-cc-${{ matrix.board.id }}-${{ github.run_id }}
@@ -378,7 +378,7 @@ jobs:
           done
 
       - name: Upload OS image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id != 'ova' }}
         with:
           name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.img.xz
@@ -386,7 +386,7 @@ jobs:
             output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.img.xz
 
       - name: Upload RAUC bundle artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' }}
         with:
           name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.raucb
@@ -394,7 +394,7 @@ jobs:
             output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.raucb
 
       - name: Upload Open Virtualization Format (OVA) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'ova' }}
         with:
           name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.ova
@@ -402,7 +402,7 @@ jobs:
             output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.ova
 
       - name: Upload QEMU disk image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         # Create artifact for ova every time - it's used by the called tests workflow
         if: ${{ matrix.board.id == 'ova' || (github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'generic-aarch64') }}
         with:
@@ -411,7 +411,7 @@ jobs:
             output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.qcow2.xz
 
       - name: Upload VMware Virtual Machine Disk (VMDK) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && (matrix.board.id == 'generic-aarch64' || matrix.board.id == 'ova') }}
         with:
           name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vmdk.zip
@@ -419,7 +419,7 @@ jobs:
             output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vmdk.zip
 
       - name: Upload VirtualBox Virtual Disk Image (VDI) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'ova' }}
         with:
           name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vdi.zip
@@ -427,7 +427,7 @@ jobs:
             output/images/haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vdi.zip
 
       - name: Upload Virtual Hard Disk v2 (VHDX) artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ github.event_name != 'release' && needs.prepare.outputs.publish_build != 'true' && matrix.board.id == 'ova' }}
         with:
           name: haos_${{ matrix.board.id }}-${{ needs.prepare.outputs.version_full }}.vhdx.zip
@@ -466,7 +466,7 @@ jobs:
 
     steps:
     - name: Checkout source
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         persist-credentials: false
 
diff --git a/.github/workflows/label-actions.yml b/.github/workflows/label-actions.yml
index cbf66f53c5c..b8e0dfc6cef 100644
--- a/.github/workflows/label-actions.yml
+++ b/.github/workflows/label-actions.yml
@@ -14,4 +14,4 @@ jobs:
   action:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/label-actions@v4.0.1
+      - uses: dessant/label-actions@102faf474a544be75fbaf4df54e73d3c515a0e65 # v4.0.1
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 9978e51551a..2f6b133717f 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -14,7 +14,7 @@ jobs:
     if: github.repository_owner == 'home-assistant'
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5.0.1
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           github-token: ${{ github.token }}
           issue-inactive-days: "30"
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index a23e4c46ff4..733c5d01bd1 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -15,17 +15,17 @@ jobs:
           python3-flake8
 
     - name: Check out code
-      uses: actions/checkout@v5
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: true
 
     - name: Check Dockerfile
-      uses: brpaz/hadolint-action@v1.5.0
+      uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
       with:
         dockerfile: Dockerfile
 
     - name: Check shell scripts
-      uses: ludeeus/action-shellcheck@2.0.0
+      uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
       with:
         ignore_paths: buildroot
 
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 8a212980c45..17e34ef9a92 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -13,6 +13,6 @@ jobs:
       pull-requests: read  # for release-drafter/release-drafter to read PR content and labels
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index ebc149c14b7..601406c1f74 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -19,7 +19,7 @@ jobs:
       # - No PRs marked as no-stale or pinned
       # - No issues marked as no-stale, help-wanted or pinned
       - name: 90 days stale issues & PRs policy
-        uses: actions/stale@v9.1.0
+        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 90
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index bd7364611e7..e49353ba996 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout source
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
@@ -42,7 +42,7 @@ jobs:
           sudo apt install -y qemu-system-x86 ovmf
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: 3.12
 
@@ -57,7 +57,7 @@ jobs:
 
       - name: Get OS image artifact
         if: ${{ inputs.use-artifact }}
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: haos_ova-${{ inputs.version }}.qcow2.xz
 
@@ -77,7 +77,7 @@ jobs:
           ./tests/run_tests.sh --durations=0 --durations-min=5.0
 
       - name: Archive logs
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: logs
@@ -85,7 +85,7 @@ jobs:
             tests/lg_logs/**
 
       - name: Archive JUnit reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: junit_reports
@@ -93,7 +93,7 @@ jobs:
             tests/junit_reports/*.xml
 
       - name: Publish test report
-        uses: mikepenz/action-junit-report@v5
+        uses: mikepenz/action-junit-report@3585e9575db828022551b4231f165eb59a0e74e3 # v5.6.2
         if: always()
         with:
           report_paths: 'tests/junit_reports/*.xml'
diff --git a/Documentation/kernel.md b/Documentation/kernel.md
index 3eb1950a111..0737261d241 100644
--- a/Documentation/kernel.md
+++ b/Documentation/kernel.md
@@ -3,22 +3,22 @@
 
 | Board | Version |
 |-------|---------|
-| Open Virtual Appliance | 6.12.43 |
-| Raspberry Pi | 6.12.34 |
-| Raspberry Pi 0-W | 6.12.34 |
-| Raspberry Pi 2 | 6.12.34 |
-| Raspberry Pi 3 | 6.12.34 |
-| Raspberry Pi 4 | 6.12.34 |
-| Raspberry Pi 5 | 6.12.34 |
-| Home Assistant Yellow | 6.12.34 |
-| Home Assistant Green | 6.12.43 |
-| Tinker Board | 6.12.43 |
-| ODROID-C2 | 6.12.43 |
-| ODROID-C4 | 6.12.43 |
-| ODROID-M1 | 6.12.43 |
-| ODROID-M1S | 6.12.43 |
-| ODROID-N2 | 6.12.43 |
-| ODROID-XU4 | 6.12.43 |
-| Generic aarch64 | 6.12.43 |
-| Generic x86-64 | 6.12.43 |
-| Khadas VIM3 | 6.12.43 |
+| Open Virtual Appliance | 6.12.51 |
+| Raspberry Pi | 6.12.47 |
+| Raspberry Pi 0-W | 6.12.47 |
+| Raspberry Pi 2 | 6.12.47 |
+| Raspberry Pi 3 | 6.12.47 |
+| Raspberry Pi 4 | 6.12.47 |
+| Raspberry Pi 5 | 6.12.47 |
+| Home Assistant Yellow | 6.12.47 |
+| Home Assistant Green | 6.12.51 |
+| Tinker Board | 6.12.51 |
+| ODROID-C2 | 6.12.51 |
+| ODROID-C4 | 6.12.51 |
+| ODROID-M1 | 6.12.51 |
+| ODROID-M1S | 6.12.51 |
+| ODROID-N2 | 6.12.51 |
+| ODROID-XU4 | 6.12.51 |
+| Generic aarch64 | 6.12.51 |
+| Generic x86-64 | 6.12.51 |
+| Khadas VIM3 | 6.12.51 |
diff --git a/Makefile b/Makefile
index 41f21a7ee12..6bfd842ab9e 100644
--- a/Makefile
+++ b/Makefile
@@ -16,6 +16,12 @@ endif
 
 ################################################################################
 
+SILENT := $(findstring s,$(word 1, $(MAKEFLAGS)))
+
+define print
+	$(if $(SILENT),,$(info $1))
+endef
+
 COLOR_STEP := $(shell tput smso 2>/dev/null)
 COLOR_WARN := $(shell (tput setab 3; tput setaf 0) 2>/dev/null)
 TERM_RESET := $(shell tput sgr0 2>/dev/null)
@@ -28,7 +34,7 @@ TERM_RESET := $(shell tput sgr0 2>/dev/null)
 
 # fallback target when target undefined here is given
 .DEFAULT:
-	@echo "$(COLOR_STEP)=== Falling back to Buildroot target '$@' ===$(TERM_RESET)"
+	$(call print,$(COLOR_STEP)=== Falling back to Buildroot target '$@' ===$(TERM_RESET))
 	$(MAKE) -C $(BUILDROOT) O=$(O) BR2_EXTERNAL=$(BUILDROOT_EXTERNAL) "$@"
 
 # default target when no target is given - must be first in Makefile
@@ -42,11 +48,11 @@ $(TARGETS_CONFIG): %-config:
 		echo ""; \
 		bash -c 'read -t 10 -p "Waiting 10s, press enter to continue or Ctrl-C to abort..."' || true; \
 	fi
-	@echo "$(COLOR_STEP)=== Using $*_defconfig ===$(TERM_RESET)"
+	$(call print,$(COLOR_STEP)=== Using $*_defconfig ===$(TERM_RESET))
 	$(MAKE) -C $(BUILDROOT) O=$(O) BR2_EXTERNAL=$(BUILDROOT_EXTERNAL) "$*_defconfig"
 
 $(TARGETS): %: %-config
-	@echo "$(COLOR_STEP)=== Building $@ ===$(TERM_RESET)"
+	$(call print,$(COLOR_STEP)=== Building $@ ===$(TERM_RESET))
 	$(MAKE) -C $(BUILDROOT) O=$(O) BR2_EXTERNAL=$(BUILDROOT_EXTERNAL)
 
 buildroot-help:
diff --git a/README.md b/README.md
index 11d755d5d2f..de27ab45db2 100644
--- a/README.md
+++ b/README.md
@@ -16,14 +16,10 @@ Home Assistant Operating System uses Docker as its container engine. By default
 
 ## Supported hardware
 
-- Nabu Casa
-- Raspberry Pi
-- Hardkernel ODROID
-- Asus Tinker Board
-- Generic x86-64 (e.g. Intel NUC)
-- Virtual appliances
-
-See the full list and specific models [here](./Documentation/boards/README.md)
+The list of supported hardware is defined by [ADR-0015](https://github.com/home-assistant/architecture/blob/master/adr/0015-home-assistant-os.md).
+Every new hardware addition must meet at least requirements defined in [ADR-0017](https://github.com/home-assistant/architecture/blob/master/adr/0017-hardware-screening-os.md) and pass through an architecture design proposal.
+
+For documentation explaining details of the individual supported boards, see [Board support](https://developers.home-assistant.io/docs/operating-system/boards/overview) section of the Home Assistant Developer Docs.
 
 ## Getting Started
 
diff --git a/buildroot b/buildroot
index 49cc2691438..02f1553a34c 160000
--- a/buildroot
+++ b/buildroot
@@ -1 +1 @@
-Subproject commit 49cc2691438304dff75ef5fadffba9303b2c443f
+Subproject commit 02f1553a34c2b8f6e432fe4300bfe529897d5f3c
diff --git a/buildroot-external/board/asus/tinker/patches/linux/0009-Revert-can-ti_hecc-fix-Woverflow-compiler-warning.patch b/buildroot-external/board/asus/tinker/patches/linux/0009-Revert-can-ti_hecc-fix-Woverflow-compiler-warning.patch
deleted file mode 100644
index bbdf846e724..00000000000
--- a/buildroot-external/board/asus/tinker/patches/linux/0009-Revert-can-ti_hecc-fix-Woverflow-compiler-warning.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 1ce3a9bcf0b0b69e62411879113d83452c1b859e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Jan=20=C4=8Cerm=C3=A1k?= <sairon@sairon.cz>
-Date: Thu, 28 Aug 2025 10:34:56 +0200
-Subject: [PATCH] Revert "can: ti_hecc: fix -Woverflow compiler warning"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This reverts commit 1da38b70d90f8529c060dd380d0c18e6d9595463.
-
-There is no BIT_U32 in 6.12.y, the patch was incorrectly applied to 6.12
-series.
-
-Link: https://lore.kernel.org/stable/63e25fdb-095a-40eb-b341-75781e71ea95@roeck-us.net/
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
----
- drivers/net/can/ti_hecc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
-index e6d6661a908ab..644e8b8eb91e7 100644
---- a/drivers/net/can/ti_hecc.c
-+++ b/drivers/net/can/ti_hecc.c
-@@ -383,7 +383,7 @@ static void ti_hecc_start(struct net_device *ndev)
- 	 * overflows instead of the hardware silently dropping the
- 	 * messages.
- 	 */
--	mbx_mask = ~BIT_U32(HECC_RX_LAST_MBOX);
-+	mbx_mask = ~BIT(HECC_RX_LAST_MBOX);
- 	hecc_write(priv, HECC_CANOPC, mbx_mask);
- 
- 	/* Enable interrupts */
diff --git a/buildroot-external/board/pc/generic-x86-64/kernel.config b/buildroot-external/board/pc/generic-x86-64/kernel.config
index 4d2340c7f6b..6b0a5b86820 100644
--- a/buildroot-external/board/pc/generic-x86-64/kernel.config
+++ b/buildroot-external/board/pc/generic-x86-64/kernel.config
@@ -10,6 +10,7 @@ CONFIG_INTEL_IDLE=y
 # CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set
 # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
 CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 
 CONFIG_SCSI_LOWLEVEL=y
 CONFIG_SCSI_HPSA=y
@@ -45,6 +46,7 @@ CONFIG_MMC_SDHCI_ACPI=y
 CONFIG_MMC_SDHCI_PCI=y
 CONFIG_MMC_REALTEK_PCI=m
 CONFIG_MMC_REALTEK_USB=m
+CONFIG_X86_X2APIC=y
 CONFIG_X86_INTEL_LPSS=y
 
 CONFIG_MISC_RTSX_PCI=m
diff --git a/buildroot-external/board/pc/ova/kernel.config b/buildroot-external/board/pc/ova/kernel.config
index 4fe4be70a52..0e2d3e5d73f 100644
--- a/buildroot-external/board/pc/ova/kernel.config
+++ b/buildroot-external/board/pc/ova/kernel.config
@@ -97,6 +97,7 @@ CONFIG_MMC_BLOCK=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_ACPI=y
 CONFIG_MMC_SDHCI_PCI=y
+CONFIG_X86_X2APIC=y
 CONFIG_X86_INTEL_LPSS=y
 
 CONFIG_DRM=y
@@ -116,6 +117,7 @@ CONFIG_PCI_HYPERV=m
 CONFIG_PCI_HYPERV_INTERFACE=m
 CONFIG_FB_HYPERV=y
 
+CONFIG_CHELSIO_T4VF=m
 CONFIG_IGBVF=m
 CONFIG_IXGBEVF=m
 CONFIG_I40EVF=m
diff --git a/buildroot-external/board/raspberrypi/cmdline.txt b/buildroot-external/board/raspberrypi/cmdline.txt
index 211e1eec449..0efd2034285 100644
--- a/buildroot-external/board/raspberrypi/cmdline.txt
+++ b/buildroot-external/board/raspberrypi/cmdline.txt
@@ -1 +1 @@
-dwc_otg.lpm_enable=0 console=tty0 usb-storage.quirks=174c:55aa:u,2109:0715:u,152d:0578:u,152d:0579:u,152d:1561:u,174c:0829:u,14b0:0206:u,174c:225c:u,7825:a2a4:u,152d:0562:u,125f:a88a:u,152d:a583:u,152d:a578:u
+dwc_otg.lpm_enable=0 console=tty0 usb-storage.quirks=174c:55aa:u,2109:0715:u,152d:0578:u,152d:0579:u,152d:1561:u,174c:0829:u,14b0:0206:u,174c:225c:u,7825:a2a4:u,152d:0562:u,125f:a88a:u,152d:a583:u,152d:a578:u,152d:0583:u
diff --git a/buildroot-external/board/raspberrypi/patches/linux/0004-usb-dwc2-masquerade-split-interrupt-transfers.patch b/buildroot-external/board/raspberrypi/patches/linux/0004-usb-dwc2-masquerade-split-interrupt-transfers.patch
deleted file mode 100644
index 44eddc8dfec..00000000000
--- a/buildroot-external/board/raspberrypi/patches/linux/0004-usb-dwc2-masquerade-split-interrupt-transfers.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From c5191902ddf76f99a21b2c36c19a82bb04966e1f Mon Sep 17 00:00:00 2001
-From: Jonathan Bell <jonathan@raspberrypi.com>
-Date: Tue, 24 Jun 2025 13:41:32 +0100
-Subject: [PATCH] usb: dwc2: masquerade split-interrupt transfers
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Masquerading Interrupt split transfers as Control puts the transfer into
-the non-periodic handler in the hub. This stops the hub dropping
-complete-split data in the microframe after a CSPLIT should have
-arrived, improving resilience to host IRQ latency. Devices are none
-the wiser - the handshake tokens are the same.
-
-Originally devised by Hans Petter Selasky @ FreeBSD.
-
-(v2: dwc2 needs an un-masquerade prior to channel interrupt handling)
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-(cherry picked from commit 5329a41ef5655b559fb5274123ce13a0287db878)
-Upstream: https://github.com/raspberrypi/linux/pull/6936
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
----
- drivers/usb/dwc2/hcd.c      | 12 ++++++++++++
- drivers/usb/dwc2/hcd_intr.c |  3 +++
- 2 files changed, 15 insertions(+)
-
-diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
-index 04cebb7b3cedd..23b1dde7a07dd 100644
---- a/drivers/usb/dwc2/hcd.c
-+++ b/drivers/usb/dwc2/hcd.c
-@@ -676,6 +676,18 @@ static void dwc2_hc_init(struct dwc2_hsotg *hsotg, struct dwc2_host_chan *chan)
- 		hcchar |= HCCHAR_EPDIR;
- 	if (chan->speed == USB_SPEED_LOW)
- 		hcchar |= HCCHAR_LSPDDEV;
-+
-+	/*
-+	 * Masquerading Interrupt split transfers as Control puts the transfer
-+	 * into the non-periodic handler in the hub. This stops the hub
-+	 * dropping complete-split data in the microframe after a CSPLIT
-+	 * should have arrived, improving resilience to host IRQ latency.
-+	 * Devices are none the wiser - the handshake tokens are the same.
-+	 * The fakery is undone in dwc2_hc_n_intr().
-+	 */
-+	if (chan->do_split && chan->ep_type == USB_ENDPOINT_XFER_INT)
-+		chan->ep_type = USB_ENDPOINT_XFER_CONTROL;
-+
- 	hcchar |= chan->ep_type << HCCHAR_EPTYPE_SHIFT & HCCHAR_EPTYPE_MASK;
- 	hcchar |= chan->max_packet << HCCHAR_MPS_SHIFT & HCCHAR_MPS_MASK;
- 	dwc2_writel(hsotg, hcchar, HCCHAR(hc_num));
-diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c
-index 5c7538d498dd1..60622ef76b6be 100644
---- a/drivers/usb/dwc2/hcd_intr.c
-+++ b/drivers/usb/dwc2/hcd_intr.c
-@@ -2048,6 +2048,9 @@ static void dwc2_hc_n_intr(struct dwc2_hsotg *hsotg, int chnum)
- 
- 	chan->hcint = hcintraw;
- 
-+	/* Un-masquerade the transfer type */
-+	if (chan->do_split)
-+		chan->ep_type = chan->qh->ep_type;
- 	/*
- 	 * If the channel was halted due to a dequeue, the qtd list might
- 	 * be empty or at least the first entry will not be the active qtd.
diff --git a/buildroot-external/board/raspberrypi/patches/linux/0005-Fixup-usb-dwc2-limit-maximum-packet-size-for-split-I.patch b/buildroot-external/board/raspberrypi/patches/linux/0005-Fixup-usb-dwc2-limit-maximum-packet-size-for-split-I.patch
deleted file mode 100644
index a112ba314af..00000000000
--- a/buildroot-external/board/raspberrypi/patches/linux/0005-Fixup-usb-dwc2-limit-maximum-packet-size-for-split-I.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 31aede5422f40ed2f42b7238016c140f7dc1a3fe Mon Sep 17 00:00:00 2001
-From: Jonathan Bell <jonathan@raspberrypi.com>
-Date: Fri, 4 Jul 2025 14:15:19 +0100
-Subject: [PATCH] Fixup! usb: dwc2: limit "maximum packet size" for split-IN
- transfers
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Control Setup phase transfers needs an 8 byte maxpacket override, or
-drivers doing a GET with a small buffer as a split transaction would
-cause broken transfers.
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-(cherry picked from commit 3829e1b98f3d2750b8b38abfdb4a142a0d8e4590)
-Upstream: https://github.com/raspberrypi/linux/pull/6936
-Signed-off-by: Jan Čermák <sairon@sairon.cz>
----
- drivers/usb/dwc2/hcd.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
-index 23b1dde7a07dd..12242649f5650 100644
---- a/drivers/usb/dwc2/hcd.c
-+++ b/drivers/usb/dwc2/hcd.c
-@@ -2350,6 +2350,7 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg,
- 			else
- 				chan->xfer_buf = urb->setup_packet;
- 			chan->xfer_len = 8;
-+			chan->max_packet = 8;
- 			break;
- 
- 		case DWC2_CONTROL_DATA:
diff --git a/buildroot-external/configs/generic_aarch64_defconfig b/buildroot-external/configs/generic_aarch64_defconfig
index 4660ecca5a3..c5bf930ad73 100644
--- a/buildroot-external/configs/generic_aarch64_defconfig
+++ b/buildroot-external/configs/generic_aarch64_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64 $(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/board/arm-uefi/generic-aarch64/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/generic_x86_64_defconfig b/buildroot-external/configs/generic_x86_64_defconfig
index c7eee36b762..9e6c3832049 100644
--- a/buildroot-external/configs/generic_x86_64_defconfig
+++ b/buildroot-external/configs/generic_x86_64_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/pc/generic-x86-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/generic-x86-64/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_DEFCONFIG="x86_64"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/generic-x86-64/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/green_defconfig b/buildroot-external/configs/green_defconfig
index 75123ac2642..ee3d4243405 100644
--- a/buildroot-external/configs/green_defconfig
+++ b/buildroot-external/configs/green_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/nabucasa/green $(BR2_EXTERNAL_HASSOS_PATH)/board/nabucasa/green/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/kernel-arm64-rockchip.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/nabucasa/green/kernel.config"
diff --git a/buildroot-external/configs/khadas_vim3_defconfig b/buildroot-external/configs/khadas_vim3_defconfig
index a7678269e2d..26ea7c6e929 100644
--- a/buildroot-external/configs/khadas_vim3_defconfig
+++ b/buildroot-external/configs/khadas_vim3_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/khadas/vim3 $(BR2_EXTERNAL_HASSOS_PATH)/board/khadas/vim3/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/khadas/kernel-vim.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
diff --git a/buildroot-external/configs/odroid_c2_defconfig b/buildroot-external/configs/odroid_c2_defconfig
index 106734b149d..c510b9f0c94 100644
--- a/buildroot-external/configs/odroid_c2_defconfig
+++ b/buildroot-external/configs/odroid_c2_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c2/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
diff --git a/buildroot-external/configs/odroid_c4_defconfig b/buildroot-external/configs/odroid_c4_defconfig
index 22238348145..ab10d0e8113 100644
--- a/buildroot-external/configs/odroid_c4_defconfig
+++ b/buildroot-external/configs/odroid_c4_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c4 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-c4/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
diff --git a/buildroot-external/configs/odroid_m1_defconfig b/buildroot-external/configs/odroid_m1_defconfig
index 83dcfb040d1..750dc55bf66 100644
--- a/buildroot-external/configs/odroid_m1_defconfig
+++ b/buildroot-external/configs/odroid_m1_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/kernel-arm64-rockchip.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1/kernel.config"
diff --git a/buildroot-external/configs/odroid_m1s_defconfig b/buildroot-external/configs/odroid_m1s_defconfig
index da592e273d4..a7c656ad124 100644
--- a/buildroot-external/configs/odroid_m1s_defconfig
+++ b/buildroot-external/configs/odroid_m1s_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1s $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1s/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/kernel-arm64-rockchip.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-m1s/kernel.config"
diff --git a/buildroot-external/configs/odroid_n2_defconfig b/buildroot-external/configs/odroid_n2_defconfig
index 6ffbc40158c..8acd353f74a 100644
--- a/buildroot-external/configs/odroid_n2_defconfig
+++ b/buildroot-external/configs/odroid_n2_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/kernel-amlogic.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-n2/kernel.config"
diff --git a/buildroot-external/configs/odroid_xu4_defconfig b/buildroot-external/configs/odroid_xu4_defconfig
index 68660140c61..18199230ef4 100644
--- a/buildroot-external/configs/odroid_xu4_defconfig
+++ b/buildroot-external/configs/odroid_xu4_defconfig
@@ -19,7 +19,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4 $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_DEFCONFIG="exynos"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/hardkernel/odroid-xu4/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/ova_defconfig b/buildroot-external/configs/ova_defconfig
index 19f89953d1b..44f43ba8c71 100644
--- a/buildroot-external/configs/ova_defconfig
+++ b/buildroot-external/configs/ova_defconfig
@@ -18,7 +18,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_DEFCONFIG="x86_64"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/board/pc/ova/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/rpi2_defconfig b/buildroot-external/configs/rpi2_defconfig
index fdb6a5a05cf..7cebeb253d2 100644
--- a/buildroot-external/configs/rpi2_defconfig
+++ b/buildroot-external/configs/rpi2_defconfig
@@ -20,7 +20,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi2 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel-armv7.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/rpi3_64_defconfig b/buildroot-external/configs/rpi3_64_defconfig
index cc308ef05e9..8e6ec466418 100644
--- a/buildroot-external/configs/rpi3_64_defconfig
+++ b/buildroot-external/configs/rpi3_64_defconfig
@@ -19,7 +19,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi3-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/rpi3_defconfig b/buildroot-external/configs/rpi3_defconfig
index c4e111f24cd..a8c055bfd34 100644
--- a/buildroot-external/configs/rpi3_defconfig
+++ b/buildroot-external/configs/rpi3_defconfig
@@ -20,7 +20,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi3 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel-armv7.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/rpi4_64_defconfig b/buildroot-external/configs/rpi4_64_defconfig
index 3443fcf6995..ee25b85f393 100644
--- a/buildroot-external/configs/rpi4_64_defconfig
+++ b/buildroot-external/configs/rpi4_64_defconfig
@@ -19,7 +19,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi4-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/rpi4_defconfig b/buildroot-external/configs/rpi4_defconfig
index b731e45dcb6..53ac49e62dd 100644
--- a/buildroot-external/configs/rpi4_defconfig
+++ b/buildroot-external/configs/rpi4_defconfig
@@ -20,7 +20,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi4 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel-armv7.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/rpi5_64_defconfig b/buildroot-external/configs/rpi5_64_defconfig
index f37f8d35782..50c773ce1e1 100644
--- a/buildroot-external/configs/rpi5_64_defconfig
+++ b/buildroot-external/configs/rpi5_64_defconfig
@@ -19,7 +19,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi5-64 $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/rpi5-64/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2712"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/configs/tinker_defconfig b/buildroot-external/configs/tinker_defconfig
index b07433e5d32..bbb5dcf13a9 100644
--- a/buildroot-external/configs/tinker_defconfig
+++ b/buildroot-external/configs/tinker_defconfig
@@ -20,7 +20,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/asus/tinker $(BR2_EXTERNAL_HASSOS_PATH)/board/asus/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.43"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.51"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/asus/tinker/kernel.config"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config"
diff --git a/buildroot-external/configs/yellow_defconfig b/buildroot-external/configs/yellow_defconfig
index eef22de8a7e..cd5c272da83 100644
--- a/buildroot-external/configs/yellow_defconfig
+++ b/buildroot-external/configs/yellow_defconfig
@@ -19,7 +19,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-image.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/yellow $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/hassos-hook.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250702.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/stable_20250916.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/hassos.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/docker.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-pci.config $(BR2_EXTERNAL_HASSOS_PATH)/kernel/v6.12.y/device-support-wireless.config $(BR2_EXTERNAL_HASSOS_PATH)/board/raspberrypi/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
diff --git a/buildroot-external/kernel/v6.12.y/device-support-pci.config b/buildroot-external/kernel/v6.12.y/device-support-pci.config
index 8569bc9c704..92d5a64bedc 100644
--- a/buildroot-external/kernel/v6.12.y/device-support-pci.config
+++ b/buildroot-external/kernel/v6.12.y/device-support-pci.config
@@ -39,6 +39,7 @@ CONFIG_MEDIA_PCI_SUPPORT=y
 
 # PCI sound drivers
 CONFIG_SND_PCI=y
+CONFIG_SND_CTXFI=m
 CONFIG_SND_HDA_GENERIC=m
 CONFIG_SND_HDA_INTEL=m
 CONFIG_SND_HDA_CODEC_REALTEK=m
diff --git a/buildroot-external/kernel/v6.12.y/hassos.config b/buildroot-external/kernel/v6.12.y/hassos.config
index 213c008d6a0..75c6adf743c 100644
--- a/buildroot-external/kernel/v6.12.y/hassos.config
+++ b/buildroot-external/kernel/v6.12.y/hassos.config
@@ -12,6 +12,8 @@ CONFIG_PREEMPT=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_DEBUG_PREEMPT is not set
 
+CONFIG_PSI=y
+
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 
@@ -203,6 +205,7 @@ CONFIG_WIREGUARD=m
 CONFIG_HID=y
 CONFIG_HIDRAW=y
 CONFIG_UHID=y
+CONFIG_HID_MULTITOUCH=m
 
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="utf8"
diff --git a/buildroot-external/meta b/buildroot-external/meta
index 9266c0cc0a1..b9d0b37a614 100644
--- a/buildroot-external/meta
+++ b/buildroot-external/meta
@@ -1,5 +1,5 @@
 VERSION_MAJOR="16"
-VERSION_MINOR="2"
+VERSION_MINOR="3"
 VERSION_SUFFIX=""
 
 HASSOS_NAME="Home Assistant OS"
diff --git a/buildroot-external/package/hassio/create-data-partition.sh b/buildroot-external/package/hassio/create-data-partition.sh
index 64179728736..e24ef9cf244 100755
--- a/buildroot-external/package/hassio/create-data-partition.sh
+++ b/buildroot-external/package/hassio/create-data-partition.sh
@@ -4,6 +4,7 @@ set -e
 build_dir=$1
 dst_dir=$2
 channel=$3
+docker_version=$4
 
 data_img="${dst_dir}/data.ext4"
 
@@ -17,13 +18,12 @@ mkdir -p "${build_dir}/data/"
 sudo mount -o loop,discard "${data_img}" "${build_dir}/data/"
 
 # Use official Docker in Docker images
-# Ideally we use the same version as Buildroot is using in case the
-# overlayfs2 storage format changes
+# We use the same version as Buildroot is using to ensure best compatibility
 container=$(docker run --privileged -e DOCKER_TLS_CERTDIR="" \
 	-v "${build_dir}/data/":/data \
 	-v "${build_dir}/data/docker/":/var/lib/docker \
 	-v "${build_dir}":/build \
-	-d docker:28.0-dind --storage-driver overlay2)
+	-d "docker:${docker_version}-dind" --storage-driver overlay2)
 
 docker exec "${container}" sh /build/dind-import-containers.sh "${channel}"
 
diff --git a/buildroot-external/package/hassio/hassio.mk b/buildroot-external/package/hassio/hassio.mk
index 423be2d17d7..fa1e51e6991 100644
--- a/buildroot-external/package/hassio/hassio.mk
+++ b/buildroot-external/package/hassio/hassio.mk
@@ -37,7 +37,7 @@ endef
 HASSIO_INSTALL_IMAGES = YES
 
 define HASSIO_INSTALL_IMAGES_CMDS
-	$(BR2_EXTERNAL_HASSOS_PATH)/package/hassio/create-data-partition.sh "$(@D)" "$(BINARIES_DIR)" "$(HASSIO_VERSION_CHANNEL)"
+	$(BR2_EXTERNAL_HASSOS_PATH)/package/hassio/create-data-partition.sh "$(@D)" "$(BINARIES_DIR)" "$(HASSIO_VERSION_CHANNEL)" "$(DOCKER_ENGINE_VERSION)"
 endef
 
 $(eval $(generic-package))
diff --git a/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.hash b/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.hash
index 49db947a008..fd5cfd05f79 100644
--- a/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.hash
+++ b/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.hash
@@ -1,2 +1,2 @@
 sha256  b40930bbcf80744c86c46a12bc9da056641d722716c378f5659b9e555ef833e1  LICENSE
-sha256  035bb930c317a6944dbee14db60dea68d65e15fe5f51253e3080f9f016b89fd7  rpi-rf-mod-0ee62f7a87d26e990fb0e03b00befb505a7e44fd.tar.gz
+sha256  961b7e38dfe6450cd70b677d3cc8c1aabb00639f58e3ce7379c94053fdb19117  rpi-rf-mod-e1404d6b2400589a1956d7429ad16227c8db6771.tar.gz
diff --git a/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.mk b/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.mk
index b4e34ee035b..bee517fff2b 100644
--- a/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.mk
+++ b/buildroot-external/package/rpi-rf-mod/rpi-rf-mod.mk
@@ -10,12 +10,12 @@
 # https://codeload.github.com/jens-maus/RaspberryMatic/tar.gz/COMMIT
 #
 # Copyright (c) 2018-2023 Jens Maus <mail@jens-maus.de>
-# https://github.com/jens-maus/RaspberryMatic/tree/master/buildroot-external/package/rpi-rf-mod
+# https://github.com/OpenCCU/OpenCCU/tree/master/buildroot-external/package/rpi-rf-mod
 #
 ################################################################################
 
-RPI_RF_MOD_VERSION = 0ee62f7a87d26e990fb0e03b00befb505a7e44fd
-RPI_RF_MOD_SITE = $(call github,jens-maus,RaspberryMatic,$(RPI_RF_MOD_VERSION))
+RPI_RF_MOD_VERSION = e1404d6b2400589a1956d7429ad16227c8db6771
+RPI_RF_MOD_SITE = $(call github,OpenCCU,OpenCCU,$(RPI_RF_MOD_VERSION))
 RPI_RF_MOD_LICENSE = Apache-2.0
 RPI_RF_MOD_LICENSE_FILES = LICENSE
 RPI_RF_MOD_DEPENDENCIES = host-dtc
diff --git a/buildroot-external/patches/docker-engine/0001-Unmap-IPv4-addresses-loaded-from-store.patch b/buildroot-external/patches/docker-engine/0001-Unmap-IPv4-addresses-loaded-from-store.patch
new file mode 100644
index 00000000000..7daff643880
--- /dev/null
+++ b/buildroot-external/patches/docker-engine/0001-Unmap-IPv4-addresses-loaded-from-store.patch
@@ -0,0 +1,33 @@
+From 050f3d1930d9bf4fea986ed21feaaa6474822191 Mon Sep 17 00:00:00 2001
+From: Rob Murray <rob.murray@docker.com>
+Date: Wed, 27 Aug 2025 16:37:00 +0100
+Subject: [PATCH] Unmap IPv4 addresses loaded from store
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When a endpoint's net.IPNet is loaded from store and converted
+to a netip.Addr, unmap it so that iptables rules don't contain
+IPv4-mapped IPv6 addresses.
+
+Signed-off-by: Rob Murray <rob.murray@docker.com>
+(cherry picked from commit 071e6472db32a34ed0f73f7166e0c2b405ae23a5)
+Signed-off-by: Rob Murray <rob.murray@docker.com>
+(backported for 28.3.3 from 31f405932a349e99f45388afe764ec5433b30de2)
+Signed-off-by: Jan Čermák <sairon@sairon.cz>
+---
+ libnetwork/drivers/bridge/bridge_linux.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libnetwork/drivers/bridge/bridge_linux.go b/libnetwork/drivers/bridge/bridge_linux.go
+index 19fcf43..15002f2 100644
+--- a/libnetwork/drivers/bridge/bridge_linux.go
++++ b/libnetwork/drivers/bridge/bridge_linux.go
+@@ -1218,6 +1218,7 @@ func (d *driver) CreateEndpoint(ctx context.Context, nid, eid string, ifInfo dri
+ func (ep *bridgeEndpoint) netipAddrs() (v4, v6 netip.Addr) {
+ 	if ep.addr != nil {
+ 		v4, _ = netip.AddrFromSlice(ep.addr.IP)
++		v4 = v4.Unmap()
+ 	}
+ 	if ep.addrv6 != nil {
+ 		v6, _ = netip.AddrFromSlice(ep.addrv6.IP)
diff --git a/buildroot-external/patches/linux/6.12.43/0001-ipv6-add-option-to-explicitly-enable-reachability-te.patch b/buildroot-external/patches/linux/6.12.43/0001-ipv6-add-option-to-explicitly-enable-reachability-te.patch
deleted file mode 100644
index 651027f9d6b..00000000000
--- a/buildroot-external/patches/linux/6.12.43/0001-ipv6-add-option-to-explicitly-enable-reachability-te.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 3a369be3f99ff577e09f8fc02703c7c9e4e74f3d Mon Sep 17 00:00:00 2001
-From: Stefan Agner <stefan@agner.ch>
-Date: Tue, 28 Mar 2023 12:02:10 +0200
-Subject: [PATCH] ipv6: add option to explicitly enable reachability test
-
-Systems which act as host as well as router might prefer the host
-behavior. Currently the kernel does not allow to use IPv6 forwarding
-globally and at the same time use route reachability probing.
-
-Add a compile time flag to enable route reachability probe in any
-case.
-
-Signed-off-by: Stefan Agner <stefan@agner.ch>
----
- net/ipv6/Kconfig | 9 +++++++++
- net/ipv6/route.c | 3 ++-
- 2 files changed, 11 insertions(+), 1 deletion(-)
-
-diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
-index 1c9c686d9522f..ee4d9ca9d2e24 100644
---- a/net/ipv6/Kconfig
-+++ b/net/ipv6/Kconfig
-@@ -48,6 +48,15 @@ config IPV6_OPTIMISTIC_DAD
- 
- 	  If unsure, say N.
- 
-+config IPV6_REACHABILITY_PROBE
-+	bool "IPv6: Always use reachability probing (RFC 4191)"
-+	help
-+	  By default reachability probing is disabled on router devices (when
-+	  IPv6 forwarding is enabled). This option explicitly enables
-+	  reachability probing always.
-+
-+	  If unsure, say N.
-+
- config INET6_AH
- 	tristate "IPv6: AH transformation"
- 	select XFRM_AH
-diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 8ebfed5d63232..f1a61af0f5199 100644
---- a/net/ipv6/route.c
-+++ b/net/ipv6/route.c
-@@ -2223,7 +2223,8 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
- 
- 	strict |= flags & RT6_LOOKUP_F_IFACE;
- 	strict |= flags & RT6_LOOKUP_F_IGNORE_LINKSTATE;
--	if (READ_ONCE(net->ipv6.devconf_all->forwarding) == 0)
-+	if (READ_ONCE(net->ipv6.devconf_all->forwarding) == 0 ||
-+	    IS_ENABLED(CONFIG_IPV6_REACHABILITY_PROBE))
- 		strict |= RT6_LOOKUP_F_REACHABLE;
- 
- 	rcu_read_lock();
diff --git a/buildroot-external/patches/linux/6.12.43/0002-net-ipv4-fix-regression-in-local-broadcast-routes.patch b/buildroot-external/patches/linux/6.12.43/0002-net-ipv4-fix-regression-in-local-broadcast-routes.patch
deleted file mode 100644
index f1c9bf6a43a..00000000000
--- a/buildroot-external/patches/linux/6.12.43/0002-net-ipv4-fix-regression-in-local-broadcast-routes.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From f356e2a2604bfc26be8bc51bf83f6a023f06316f Mon Sep 17 00:00:00 2001
-From: Oscar Maes <oscmaes92@gmail.com>
-Date: Wed, 27 Aug 2025 08:23:21 +0200
-Subject: [PATCH] net: ipv4: fix regression in local-broadcast routes
-
-[ Upstream commit 5189446ba995556eaa3755a6e875bc06675b88bd ]
-
-Commit 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes")
-introduced a regression where local-broadcast packets would have their
-gateway set in __mkroute_output, which was caused by fi = NULL being
-removed.
-
-Fix this by resetting the fib_info for local-broadcast packets. This
-preserves the intended changes for directed-broadcast packets.
-
-Cc: stable@vger.kernel.org
-Fixes: 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes")
-Reported-by: Brett A C Sheffield <bacs@librecast.net>
-Closes: https://lore.kernel.org/regressions/20250822165231.4353-4-bacs@librecast.net
-Signed-off-by: Oscar Maes <oscmaes92@gmail.com>
-Reviewed-by: David Ahern <dsahern@kernel.org>
-Link: https://patch.msgid.link/20250827062322.4807-1-oscmaes92@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
----
- net/ipv4/route.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 9a5c9497b3931..261ddb6542a40 100644
---- a/net/ipv4/route.c
-+++ b/net/ipv4/route.c
-@@ -2532,12 +2532,16 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
- 		    !netif_is_l3_master(dev_out))
- 			return ERR_PTR(-EINVAL);
- 
--	if (ipv4_is_lbcast(fl4->daddr))
-+	if (ipv4_is_lbcast(fl4->daddr)) {
- 		type = RTN_BROADCAST;
--	else if (ipv4_is_multicast(fl4->daddr))
-+
-+		/* reset fi to prevent gateway resolution */
-+		fi = NULL;
-+	} else if (ipv4_is_multicast(fl4->daddr)) {
- 		type = RTN_MULTICAST;
--	else if (ipv4_is_zeronet(fl4->daddr))
-+	} else if (ipv4_is_zeronet(fl4->daddr)) {
- 		return ERR_PTR(-EINVAL);
-+	}
- 
- 	if (dev_out->flags & IFF_LOOPBACK)
- 		flags |= RTCF_LOCAL;
diff --git a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/ha-cli@.service b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/ha-cli@.service
index e62f68bae83..829567bd90e 100644
--- a/buildroot-external/rootfs-overlay/usr/lib/systemd/system/ha-cli@.service
+++ b/buildroot-external/rootfs-overlay/usr/lib/systemd/system/ha-cli@.service
@@ -15,6 +15,9 @@ Before=getty.target
 Conflicts=rescue.service
 Before=rescue.service
 
+# Same value as RestartMaxDelaySec to avoid marking the service as failed
+StartLimitIntervalSec=3s
+
 [Service]
 # the VT is cleared by TTYVTDisallocate
 # The '-o' option value tells agetty to replace 'login' arguments with an
@@ -23,7 +26,9 @@ Before=rescue.service
 ExecStart=/usr/sbin/hassos-cli
 Type=idle
 Restart=always
-RestartSec=0
+RestartSec=100ms
+RestartMaxDelaySec=3s
+RestartSteps=3
 UtmpIdentifier=%I
 TTYPath=/dev/%I
 TTYReset=yes
diff --git a/buildroot-external/rootfs-overlay/usr/sbin/hassos-cli b/buildroot-external/rootfs-overlay/usr/sbin/hassos-cli
index 5aaca7f30d8..52fabec0d58 100755
--- a/buildroot-external/rootfs-overlay/usr/sbin/hassos-cli
+++ b/buildroot-external/rootfs-overlay/usr/sbin/hassos-cli
@@ -3,15 +3,40 @@
 # Run logging cli
 # ==============================================================================
 
-echo "Waiting for the Home Assistant CLI to be ready..."
+run_shell() { exec /bin/ash -l; }
+interrupt() { echo " cancelled"; systemctl reset-failed "ha-cli@*"; run_shell; }
+emergency_shell() {
+    printf "\n\n[WARNING] Home Assistant CLI is not starting or was interrupted.\n"
+    echo ""
+    echo "This happens when start of all services takes longer than expected, or because"
+    echo "of slow internet connection. Emergency console has been started, you can use"
+    echo "for example the following commands for troubleshooting:"
+    echo ""
+    echo " * 'docker ps -a' - e.g. to check if 'hassio_supervisor' container is running"
+    echo " * 'journalctl -e' - to investigate latest system logs"
+    echo " * 'exit' or Ctrl+D - to exit the emergency console and retry HA CLI startup"
+    echo ""
+    run_shell
+}
+
+trap interrupt INT
+
+printf "Waiting for the Home Assistant CLI to be ready..."
 
 i=0
 while [ ! "$(docker ps -q -f name=hassio_cli)" ]; do
     sleep 1
+
+    if [ $((i % 4)) = 0 ]; then
+        printf "\010\010\010   \010\010\010"
+    else
+        printf "."
+    fi
+
     i=$((i+1))
-    if [ $i = 60 ]; then
-        echo "[WARN] Home Assistant CLI not starting! Jumping into emergency console..."
-        exec /bin/ash -l
+
+    if [ $i = 180 ]; then
+        emergency_shell
     fi
 done
 
@@ -22,16 +47,20 @@ docker container exec \
 case $? in
   10)
     # Jump to root login shell (login command)
-    exec /bin/ash -l
+    run_shell
+    ;;
+  130)
+    # 130 is CLI termination with Ctrl+C (SIGINT)
+    printf "\nHome Assistant CLI has been interrupted.\n"
+    systemctl reset-failed "ha-cli@*"
     ;;
   143)
     # 143 graceful termination (SIGTERM). Most likely a proper shutdown.
     # Just sleep for a while until actual systemd shutdown gets invoked.
-    echo ""
-    echo "Home Assistant CLI has been terminated."
+    printf "\nHome Assistant CLI has been terminated.\n"
     sleep 30
     ;;
   *)
-    echo "HA CLI failed with error code: $?"
+    printf "\nHA CLI failed with error code: %s\n" "$?"
     ;;
 esac
diff --git a/buildroot-external/rootfs-overlay/usr/sbin/hassos-supervisor b/buildroot-external/rootfs-overlay/usr/sbin/hassos-supervisor
index 8da3308e3d5..20b777bd209 100755
--- a/buildroot-external/rootfs-overlay/usr/sbin/hassos-supervisor
+++ b/buildroot-external/rootfs-overlay/usr/sbin/hassos-supervisor
@@ -11,6 +11,7 @@ set -e
 # Init supervisor
 SUPERVISOR_DATA=/mnt/data/supervisor
 SUPERVISOR_STARTUP_MARKER="/run/supervisor/startup-marker"
+SUPERVISOR_CIDFILE="${SUPERVISOR_DATA}/hassio_supervisor.cid"
 SUPERVISOR_STARTSCRIPT_VERSION="/mnt/data/.hassos-supervisor-version"
 SUPERVISOR_IMAGE="ghcr.io/home-assistant/${SUPERVISOR_ARCH}-hassio-supervisor"
 
@@ -58,8 +59,8 @@ if [ -z "${SUPERVISOR_IMAGE_ID}" ]; then
         docker tag "${SUPERVISOR_IMAGE}:${SUPERVISOR_VERSION}" "${SUPERVISOR_IMAGE}:latest"
     else
         # Pull failed, updater info might be corrupted or the release might have
-	# been removed from the container registry, delete the updater info
-	# to start from scratch on next try.
+        # been removed from the container registry, delete the updater info
+        # to start from scratch on next try.
         echo "[ERROR] Supervisor download failed."
         rm -f "${SUPERVISOR_DATA}/updater.json"
         exit 1
@@ -87,12 +88,18 @@ fi
 
 # If Supervisor container is missing, create it
 if [ -z "${SUPERVISOR_CONTAINER_ID}" ]; then
+    # We need to remove the CID file here, Docker will refuse to start if the
+    # file is present. Single instance is ensured by other code paths.
+    [ -f "${SUPERVISOR_CIDFILE}" ] && rm -f "${SUPERVISOR_CIDFILE}"
+
     echo "[INFO] Creating a new Supervisor container..."
     # shellcheck disable=SC2086
     docker container create \
         --name hassio_supervisor \
         --privileged --security-opt apparmor="hassio-supervisor" \
         --oom-score-adj=-300 \
+        --cidfile "${SUPERVISOR_CIDFILE}" \
+        --mount type=bind,src="${SUPERVISOR_CIDFILE}",dst=/run/cid,readonly \
         -v /run/docker.sock:/run/docker.sock:rw \
         -v /run/containerd/containerd.sock:/run/containerd/containerd.sock:rw \
         -v /run/systemd/journal/socket:/run/systemd/journal/socket:rw \
diff --git a/buildroot-external/scripts/post-build.sh b/buildroot-external/scripts/post-build.sh
index 0ff0207127e..8346b527228 100755
--- a/buildroot-external/scripts/post-build.sh
+++ b/buildroot-external/scripts/post-build.sh
@@ -27,7 +27,7 @@ setup_localtime
     echo "VERSION_ID=$(hassos_version)"
     echo "PRETTY_NAME=\"${HASSOS_NAME} $(hassos_version)\""
     echo "CPE_NAME=cpe:2.3:o:home-assistant:${HASSOS_ID}:$(hassos_version):*:${DEPLOYMENT}:*:*:*:${BOARD_ID}:*"
-    echo "HOME_URL=https://hass.io/"
+    echo "HOME_URL=https://www.home-assistant.io/"
     echo "VARIANT=\"${HASSOS_NAME} ${BOARD_NAME}\""
     echo "VARIANT_ID=${BOARD_ID}"
     echo "SUPERVISOR_MACHINE=${SUPERVISOR_MACHINE}"
diff --git a/tests/supervisor_test/test_supervisor.py b/tests/supervisor_test/test_supervisor.py
index 2b8bc1b2a47..ec9266d73c8 100644
--- a/tests/supervisor_test/test_supervisor.py
+++ b/tests/supervisor_test/test_supervisor.py
@@ -117,11 +117,7 @@ def test_addon_install(shell_json):
 
 
 @pytest.mark.dependency(depends=["test_supervisor_is_updated"])
-def test_code_sign(shell_json):
-    # enable Content-Trust
-    assert (
-        shell_json("ha security options --content-trust=true --no-progress --raw-json").get("result") == "ok"
-    ), "Content-Trust enable failed"
+def test_supervisor_errors(shell_json):
     # run Supervisor health check
     health_check = shell_json("ha resolution healthcheck --no-progress --raw-json")
     assert health_check.get("result") == "ok", "Supervisor health check failed"