diff --git a/images/flashbox-l1.conf b/images/flashbox-l1.conf
index 42f61ce8..5b8e40be 100644
--- a/images/flashbox-l1.conf
+++ b/images/flashbox-l1.conf
@@ -7,4 +7,4 @@ Include=modules/flashbox/flashbox-l1/mkosi.conf
 Profiles=azure,gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260519T000413Z
diff --git a/images/flashbox-l2.conf b/images/flashbox-l2.conf
index 96076496..d8628646 100644
--- a/images/flashbox-l2.conf
+++ b/images/flashbox-l2.conf
@@ -7,4 +7,4 @@ Include=modules/flashbox/flashbox-l2/mkosi.conf
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260519T000413Z
diff --git a/images/l2-op-rbuilder-bproxy.conf b/images/l2-op-rbuilder-bproxy.conf
index d798e665..6d8c6119 100644
--- a/images/l2-op-rbuilder-bproxy.conf
+++ b/images/l2-op-rbuilder-bproxy.conf
@@ -2,7 +2,7 @@
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260519T000413Z
 
 [Include]
 Include=shared/mkosi.conf
diff --git a/images/l2-op-rbuilder.conf b/images/l2-op-rbuilder.conf
index 211cb630..11ac2374 100644
--- a/images/l2-op-rbuilder.conf
+++ b/images/l2-op-rbuilder.conf
@@ -2,7 +2,7 @@
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260519T000413Z
 
 [Include]
 Include=shared/mkosi.conf
diff --git a/images/l2-simulator.conf b/images/l2-simulator.conf
index f7c2d54a..1c592de8 100644
--- a/images/l2-simulator.conf
+++ b/images/l2-simulator.conf
@@ -2,7 +2,7 @@
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260519T000413Z
 
 [Include]
 Include=shared/mkosi.conf
diff --git a/shared/mkosi.build.d/10-kernel.sh b/shared/mkosi.build.d/10-kernel.sh
index 2d930928..72c1bfe9 100755
--- a/shared/mkosi.build.d/10-kernel.sh
+++ b/shared/mkosi.build.d/10-kernel.sh
@@ -73,7 +73,7 @@ else
     kernel_src_dir="${BUILDROOT}${chroot_kernel_src_dir}"
     kconfig_dir="${BUILDROOT}${chroot_kconfig_dir}"
 
-    apt-get -y install "linux-source-${KERNEL_VERSION}/${release}-backports" --install-recommends
+    apt-get -y install "linux-source-${KERNEL_VERSION}" --install-recommends
 
     source_tarball="${BUILDROOT}/usr/src/linux-source-${KERNEL_VERSION}.tar.xz"
     if [[ ! -f "${source_tarball}" ]]; then
diff --git a/shared/mkosi.conf b/shared/mkosi.conf
index 1d594ed2..5544676c 100644
--- a/shared/mkosi.conf
+++ b/shared/mkosi.conf
@@ -6,7 +6,7 @@ Release=trixie
 [Build]
 PackageCacheDirectory=mkosi.cache
 SandboxTrees=mkosi.builddir/mkosi.sources:/etc/apt/sources.list.d/mkosi.sources
-Environment=KERNEL_VERSION=6.19
+Environment=KERNEL_VERSION=6.12
             KERNEL_CONFIG_SNIPPETS=shared/kernel/config.d
             KERNEL_PATCHES=shared/kernel/patches
 WithNetwork=true
diff --git a/shared/mkosi.sync.d/10-setup-apt.sh b/shared/mkosi.sync.d/10-setup-apt.sh
index b3f5cbb3..9f4d3604 100755
--- a/shared/mkosi.sync.d/10-setup-apt.sh
+++ b/shared/mkosi.sync.d/10-setup-apt.sh
@@ -4,8 +4,10 @@
 SNAPSHOT=$(jq -r .Snapshot /work/config.json)
 if [ "$SNAPSHOT" = "null" ]; then
     MIRROR="http://deb.debian.org/debian"
+    MIRROR_SECURITY="http://security.debian.org/debian-security"
 else
     MIRROR="http://snapshot.debian.org/archive/debian/${SNAPSHOT}"
+    MIRROR_SECURITY="http://snapshot.debian.org/archive/debian-security/${SNAPSHOT}"
 fi
 
 cat > "$SRCDIR/mkosi.builddir/mkosi.sources" <<EOF
@@ -14,4 +16,10 @@ URIs: $MIRROR
 Suites: ${RELEASE} ${RELEASE}-backports
 Components: main
 Trusted: yes
+
+Types: deb deb-src
+URIs: $MIRROR_SECURITY
+Suites: ${RELEASE}-security
+Components: main
+Trusted: yes
 EOF