diff --git a/images/flashbox-l1.conf b/images/flashbox-l1.conf
index a5d07dfd..4ec0b2ce 100644
--- a/images/flashbox-l1.conf
+++ b/images/flashbox-l1.conf
@@ -8,4 +8,4 @@ Include=modules/flashbox/observability/mkosi.conf
 Profiles=azure,gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260728T082537Z
diff --git a/images/flashbox-l2.conf b/images/flashbox-l2.conf
index 96076496..ab04e461 100644
--- a/images/flashbox-l2.conf
+++ b/images/flashbox-l2.conf
@@ -7,4 +7,4 @@ Include=modules/flashbox/flashbox-l2/mkosi.conf
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260728T082537Z
diff --git a/images/l2-op-rbuilder-bproxy.conf b/images/l2-op-rbuilder-bproxy.conf
index d798e665..10dde9bf 100644
--- a/images/l2-op-rbuilder-bproxy.conf
+++ b/images/l2-op-rbuilder-bproxy.conf
@@ -2,7 +2,7 @@
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260728T082537Z
 
 [Include]
 Include=shared/mkosi.conf
diff --git a/images/l2-op-rbuilder.conf b/images/l2-op-rbuilder.conf
index 211cb630..940889b9 100644
--- a/images/l2-op-rbuilder.conf
+++ b/images/l2-op-rbuilder.conf
@@ -2,7 +2,7 @@
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260728T082537Z
 
 [Include]
 Include=shared/mkosi.conf
diff --git a/images/l2-simulator.conf b/images/l2-simulator.conf
index f7c2d54a..519aee19 100644
--- a/images/l2-simulator.conf
+++ b/images/l2-simulator.conf
@@ -2,7 +2,7 @@
 Profiles=gcp
 
 [Distribution]
-Snapshot=20260430T025253Z
+Snapshot=20260728T082537Z
 
 [Include]
 Include=shared/mkosi.conf
diff --git a/shared/mkosi.apt.conf b/shared/mkosi.apt.conf
new file mode 100644
index 00000000..c7e283ac
--- /dev/null
+++ b/shared/mkosi.apt.conf
@@ -0,0 +1,5 @@
+# Trim apt download volume and tolerate transient failures — index fetches
+# go through lima's user-mode network and are written to mkosi.cache over
+# the reverse-sshfs mount, so every megabyte counts.
+Acquire::Languages "none";
+Acquire::Retries "3";
diff --git a/shared/mkosi.build.d/10-kernel.sh b/shared/mkosi.build.d/10-kernel.sh
index 2d930928..a2f23ad6 100755
--- a/shared/mkosi.build.d/10-kernel.sh
+++ b/shared/mkosi.build.d/10-kernel.sh
@@ -3,18 +3,23 @@ set -euxo pipefail
 shopt -s inherit_errexit  # propagate errexit to $() subshells
 shopt -s nullglob         # non-matching globs expand to nothing
 
-# KERNEL_VERSION must be set (Debian major.minor, e.g. "6.16").
+# KERNEL_VERSION must be set (Debian major.minor, e.g. "7.1").
 # Must match a linux-source package available in the pinned snapshot mirror.
+# KERNEL_APT_SUITE selects the suite the package is installed from
+# (default: <release>-backports; set to "sid" when the wanted point release
+# has not been built for backports yet).
 if [[ -z "${KERNEL_VERSION:-}" ]]; then
-    echo "ERROR: KERNEL_VERSION is not set. Set it in mkosi.conf Environment= (e.g. KERNEL_VERSION=6.16)" >&2
+    echo "ERROR: KERNEL_VERSION is not set. Set it in mkosi.conf Environment= (e.g. KERNEL_VERSION=7.1)" >&2
     exit 1
 fi
 
 # Read distribution info from mkosi config JSON
 snapshot=$(jq -r '.Snapshot' "$MKOSI_CONFIG")
 release=$(jq -re '.Release' "$MKOSI_CONFIG")
+kernel_suite="${KERNEL_APT_SUITE:-${release}-backports}"
 echo "Snapshot: $snapshot"
 echo "Release: $release"
+echo "Kernel apt suite: $kernel_suite"
 
 # Auto-discover config fragments from registered directories
 # KERNEL_CONFIG_SNIPPETS is processed first, then KERNEL_CONFIG_SNIPPETS_* in alphabetical order
@@ -45,6 +50,7 @@ cache_hash=$(
     { echo "KERNEL_VERSION=${KERNEL_VERSION}"; \
       echo "LOCALVERSION=${LOCALVERSION}"; \
       echo "SNAPSHOT=${snapshot}"; \
+      echo "SUITE=${kernel_suite}"; \
       cat -- "${config_paths[@]}" "${patch_paths[@]}"; } \
     | sha256sum | cut -d' ' -f1 | cut -c1-12
 )
@@ -73,7 +79,7 @@ else
     kernel_src_dir="${BUILDROOT}${chroot_kernel_src_dir}"
     kconfig_dir="${BUILDROOT}${chroot_kconfig_dir}"
 
-    apt-get -y install "linux-source-${KERNEL_VERSION}/${release}-backports" --install-recommends
+    apt-get -y install "linux-source-${KERNEL_VERSION}/${kernel_suite}" --install-recommends
 
     source_tarball="${BUILDROOT}/usr/src/linux-source-${KERNEL_VERSION}.tar.xz"
     if [[ ! -f "${source_tarball}" ]]; then
diff --git a/shared/mkosi.conf b/shared/mkosi.conf
index 1d594ed2..0131b254 100644
--- a/shared/mkosi.conf
+++ b/shared/mkosi.conf
@@ -6,7 +6,10 @@ Release=trixie
 [Build]
 PackageCacheDirectory=mkosi.cache
 SandboxTrees=mkosi.builddir/mkosi.sources:/etc/apt/sources.list.d/mkosi.sources
-Environment=KERNEL_VERSION=6.19
+             shared/mkosi.pref:/etc/apt/preferences.d/mkosi.pref
+             shared/mkosi.apt.conf:/etc/apt/apt.conf.d/99mkosi.conf
+Environment=KERNEL_VERSION=7.1
+            KERNEL_APT_SUITE=sid
             KERNEL_CONFIG_SNIPPETS=shared/kernel/config.d
             KERNEL_PATCHES=shared/kernel/patches
 WithNetwork=true
diff --git a/shared/mkosi.pref b/shared/mkosi.pref
new file mode 100644
index 00000000..33b97a85
--- /dev/null
+++ b/shared/mkosi.pref
@@ -0,0 +1,6 @@
+# Pin sid below the release suites so it is never used for dependency
+# resolution unless a package is explicitly requested from it
+# (e.g. linux-source via KERNEL_APT_SUITE=sid in 10-kernel.sh).
+Package: *
+Pin: release n=sid
+Pin-Priority: 100
diff --git a/shared/mkosi.sync.d/10-setup-apt.sh b/shared/mkosi.sync.d/10-setup-apt.sh
index b3f5cbb3..8509b250 100755
--- a/shared/mkosi.sync.d/10-setup-apt.sh
+++ b/shared/mkosi.sync.d/10-setup-apt.sh
@@ -14,4 +14,12 @@ URIs: $MIRROR
 Suites: ${RELEASE} ${RELEASE}-backports
 Components: main
 Trusted: yes
+
+# deb only (no deb-src): sid is used solely to fetch the linux-source
+# binary package, and its Sources index alone is ~12 MB per apt update.
+Types: deb
+URIs: $MIRROR
+Suites: sid
+Components: main
+Trusted: yes
 EOF