diff --git a/device/community/linux-postmarketos-mediatek-mt81/APKBUILD b/device/community/linux-postmarketos-mediatek-mt81/APKBUILD
index e96bf933b..5e73adc19 100644
--- a/device/community/linux-postmarketos-mediatek-mt81/APKBUILD
+++ b/device/community/linux-postmarketos-mediatek-mt81/APKBUILD
@@ -3,7 +3,7 @@
 maintainer="WeirdTreeThing <bradyn127@protonmail.com>"
 pkgname=linux-postmarketos-mediatek-mt81
 pkgver=6.18.36
-pkgrel=1
+pkgrel=2
 pkgdesc="Mainline kernel for mediatek mt8183/mt8192/mt8195/mt8186"
 arch="aarch64"
 _flavor="${pkgname#linux-}"
@@ -95,5 +95,5 @@ b2dcf3e3b9f80d185f587972ab6fc1f07e8ec7c7dbe3aa75c53ff6d3c7380ff4c3e6f39479297658
 e09b8fc578742b0efcfb7e4419b30de39feecf3303def62576110c98e3a7101c68c78d1276f885e585ee21536df1f2474df5816f0dffa8f99ea1df1c787fe2c6  mt8186-drm-bridge-it6505-Add-audio-support.patch
 b4c005f705bbae87b93dd061b4d02f982f2dbce1c59635a02b501def1eb784b057d1555c2c11e868f81a91365dcd1c0fbecf85034b6da701011cb2b68ecb3404  mt8186-ASoC-mediatek-mt8186-make-FE-nonatomic-and-no_pcm.patch
 06539b9c5cdaa41e4e0a4bfb8e300548cf95387db716a2f896062690075f07419e9e211c0cb5537caaa046cfae646e47413e12fde0a3c71c9f94868f464de208  mtk-pmdomain.patch
-4559768e073b2de23dccf45c625ace7df65966a2588dab083e5f333f71af316fd84e9b8cb58d7d46bacbdbc05fcd6135f969696d7090fed1518c50be5644c58b  config-postmarketos-mediatek-mt81.aarch64
+1b1a08e5d83493d29d9b7452fede88ca81b3756da1eedb1a2efcd937844f8d2284e6200d83ed0cb2a9f9a14c6b21bd0b1b6a7372f9c4782fdc15ceebac5692cf  config-postmarketos-mediatek-mt81.aarch64
 "
diff --git a/device/community/linux-postmarketos-mediatek-mt81/config-postmarketos-mediatek-mt81.aarch64 b/device/community/linux-postmarketos-mediatek-mt81/config-postmarketos-mediatek-mt81.aarch64
index bf5aff950..4e491a680 100644
--- a/device/community/linux-postmarketos-mediatek-mt81/config-postmarketos-mediatek-mt81.aarch64
+++ b/device/community/linux-postmarketos-mediatek-mt81/config-postmarketos-mediatek-mt81.aarch64
@@ -850,6 +850,7 @@ CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT=y
 # end of General architecture-dependent options
 
 CONFIG_RT_MUTEXES=y
+CONFIG_MODULE_SIG_FORMAT=y
 CONFIG_MODULES=y
 # CONFIG_MODULE_DEBUG is not set
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -858,7 +859,17 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-# CONFIG_MODULE_SIG is not set
+CONFIG_MODULE_SIG=y
+# CONFIG_MODULE_SIG_FORCE is not set
+CONFIG_MODULE_SIG_ALL=y
+# CONFIG_MODULE_SIG_SHA1 is not set
+# CONFIG_MODULE_SIG_SHA256 is not set
+# CONFIG_MODULE_SIG_SHA384 is not set
+CONFIG_MODULE_SIG_SHA512=y
+# CONFIG_MODULE_SIG_SHA3_256 is not set
+# CONFIG_MODULE_SIG_SHA3_384 is not set
+# CONFIG_MODULE_SIG_SHA3_512 is not set
+CONFIG_MODULE_SIG_HASH="sha512"
 CONFIG_MODULE_COMPRESS=y
 # CONFIG_MODULE_COMPRESS_GZIP is not set
 # CONFIG_MODULE_COMPRESS_XZ is not set
@@ -8304,14 +8315,14 @@ CONFIG_XFS_SUPPORT_ASCII_CI=y
 # CONFIG_XFS_DEBUG is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
-CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS=m
 CONFIG_BTRFS_FS_POSIX_ACL=y
 # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
 # CONFIG_BTRFS_DEBUG is not set
 # CONFIG_BTRFS_ASSERT is not set
 # CONFIG_BTRFS_EXPERIMENTAL is not set
 # CONFIG_NILFS2_FS is not set
-CONFIG_F2FS_FS=y
+CONFIG_F2FS_FS=m
 CONFIG_F2FS_STAT_FS=y
 CONFIG_F2FS_FS_XATTR=y
 CONFIG_F2FS_FS_POSIX_ACL=y
@@ -8619,7 +8630,11 @@ CONFIG_SECURITY_PATH=y
 # CONFIG_SECURITY_LOADPIN is not set
 CONFIG_SECURITY_YAMA=y
 # CONFIG_SECURITY_SAFESETID is not set
-# CONFIG_SECURITY_LOCKDOWN_LSM is not set
+CONFIG_SECURITY_LOCKDOWN_LSM=y
+CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
+CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y
+# CONFIG_LOCK_DOWN_KERNEL_FORCE_INTEGRITY is not set
+# CONFIG_LOCK_DOWN_KERNEL_FORCE_CONFIDENTIALITY is not set
 # CONFIG_SECURITY_LANDLOCK is not set
 # CONFIG_SECURITY_IPE is not set
 CONFIG_INTEGRITY=y
@@ -8629,7 +8644,7 @@ CONFIG_INTEGRITY_AUDIT=y
 # CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set
 # CONFIG_EVM is not set
 CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,bpf"
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,ipe,bpf"
 
 #
 # Kernel hardening options
@@ -8672,7 +8687,7 @@ CONFIG_RANDSTRUCT_NONE=y
 # end of Kernel hardening options
 # end of Security options
 
-CONFIG_XOR_BLOCKS=y
+CONFIG_XOR_BLOCKS=m
 CONFIG_ASYNC_CORE=m
 CONFIG_ASYNC_XOR=m
 CONFIG_CRYPTO=y
@@ -8705,7 +8720,7 @@ CONFIG_CRYPTO_NULL=y
 # CONFIG_CRYPTO_PCRYPT is not set
 # CONFIG_CRYPTO_CRYPTD is not set
 CONFIG_CRYPTO_AUTHENC=y
-# CONFIG_CRYPTO_KRB5ENC is not set
+CONFIG_CRYPTO_KRB5ENC=m
 # CONFIG_CRYPTO_BENCHMARK is not set
 # end of Crypto core or helper
 
@@ -8894,6 +8909,9 @@ CONFIG_PKCS7_MESSAGE_PARSER=y
 #
 # Certificates for signature checking
 #
+CONFIG_MODULE_SIG_KEY="certs/signing_key.pem"
+CONFIG_MODULE_SIG_KEY_TYPE_RSA=y
+# CONFIG_MODULE_SIG_KEY_TYPE_ECDSA is not set
 CONFIG_SYSTEM_TRUSTED_KEYRING=y
 CONFIG_SYSTEM_TRUSTED_KEYS=""
 # CONFIG_SYSTEM_EXTRA_CERTIFICATE is not set
@@ -8901,13 +8919,14 @@ CONFIG_SYSTEM_TRUSTED_KEYS=""
 # CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
 # end of Certificates for signature checking
 
-# CONFIG_CRYPTO_KRB5 is not set
+CONFIG_CRYPTO_KRB5=m
+# CONFIG_CRYPTO_KRB5_SELFTESTS is not set
 CONFIG_BINARY_PRINTF=y
 
 #
 # Library routines
 #
-CONFIG_RAID6_PQ=y
+CONFIG_RAID6_PQ=m
 CONFIG_RAID6_PQ_BENCHMARK=y
 CONFIG_LINEAR_RANGES=y
 # CONFIG_PACKING is not set