diff --git a/.github/workflows/build-kernel-deb.yml b/.github/workflows/build-kernel-deb.yml
index 873d60a..e205a0d 100644
--- a/.github/workflows/build-kernel-deb.yml
+++ b/.github/workflows/build-kernel-deb.yml
@@ -43,9 +43,9 @@ on:
         required: false
         default: 'linux-image-qcom-next'
       kernel-config:
-        description: 'Advanced: comma-separated config fragments from debian/config-available/'
+        description: 'Advanced: extra config fragments applied on top of all of debian/config-available/ (e.g. intree:arch/arm64/configs/qcom_debug.config)'
         required: false
-        default: 'squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can'
+        default: ''
       debian-version-stub:
         description: 'Advanced: Debian version stub; the selected suite''s mapped suffix and a Daily-style trailing ~ are applied automatically'
         required: false
@@ -118,9 +118,9 @@ on:
         type: string
         default: 'linux-image-qcom-next'
       kernel-config:
-        description: 'Comma-separated config fragments to activate from debian/config-available/'
+        description: 'Extra config fragments applied on top of all of debian/config-available/ (e.g. intree:arch/arm64/configs/qcom_debug.config)'
         type: string
-        default: 'squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can'
+        default: ''
       debian-revision:
         description: 'Debian revision component of the package version'
         type: string
@@ -423,7 +423,7 @@ jobs:
           SRCPKG_INPUT: ${{ inputs.srcpkg || 'linux-qcom-next' }}
           BINPKG_INPUT: ${{ inputs.binpkg || 'linux-image-qcom-next' }}
           KVER_EXTRA_INPUT: ${{ inputs.kver-extra }}
-          KERNEL_CONFIG_INPUT: ${{ inputs.kernel-config || 'squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can' }}
+          KERNEL_CONFIG_INPUT: ${{ inputs.kernel-config }}
           DEBUG_BUILD_INPUT: ${{ inputs.debug-build }}
         run: |
           # No -x here: keep xtrace off for this step as it assembles the
diff --git a/README.md b/README.md
index 98ef52c..9f1e56c 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ isolated `kernel_variant + suite` build leg.
 | Variant | Source package | Image metapackage | Daily suites | Release suites | Notes |
 |---------|----------------|-------------------|--------------|----------------|-------|
 | `qcom-next` | `linux-qcom-next` | `linux-image-qcom-next` | trixie, forky, resolute | trixie, forky | Standard kernel |
-| `qcom-next-debug` | `linux-qcom-next-debug` | `linux-image-qcom-next-debug` | trixie, forky | trixie, forky | Adds `arch/arm64/configs/qcom_debug.config` from the kernel source via `intree:qcom_debug` |
+| `qcom-next-debug` | `linux-qcom-next-debug` | `linux-image-qcom-next-debug` | trixie, forky | trixie, forky | Adds `arch/arm64/configs/qcom_debug.config` and `kernel/configs/debug.config` from the kernel source, via `intree:` entries |
 
 Both build the same kernel ref. `derive-localversion.sh` folds the variant name
 into LOCALVERSION, so each produces a distinct kernel release
@@ -60,7 +60,7 @@ The final Production matrix is conceptually:
       "tag_pattern": "qcom-next-*",
       "srcpkg": "linux-qcom-next",
       "binpkg": "linux-image-qcom-next",
-      "kernel_config": "squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can",
+      "kernel_config": [],
       "debian_version_stub": "0qli",
       "debian_version_suffix": "~",
       "pkg_linux_qcom_ref": "qcom/debian/latest"
@@ -74,7 +74,7 @@ The final Production matrix is conceptually:
       "ref_strategy": "pinned_ref",
       "srcpkg": "linux-qcom-next",
       "binpkg": "linux-image-qcom-next",
-      "kernel_config": "squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can",
+      "kernel_config": [],
       "debian_version_stub": "0qli",
       "debian_version_suffix": "",
       "pkg_linux_qcom_ref": "qcom/debian/latest",
@@ -183,7 +183,7 @@ its own values for:
 | `tag_pattern` | Required only for `latest_tag`; matching tags must end in `-YYYYMMDD`, which determines newest-first ordering. |
 | `srcpkg` | Debian source package name. |
 | `binpkg` | Kernel image metapackage name. |
-| `kernel_config` | Comma-separated fragments activated from `debian/config-available/`. |
+| `kernel_config` | Extra fragments applied on top of `debian/config-available/`, all of which is applied to every build, one per array element. A bare name selects `debian/config-available/<name>.config`; an `intree:` entry names a fragment shipped by the kernel source, as a path relative to the kernel source root (e.g. `intree:arch/arm64/configs/qcom_debug.config`), so it stays versioned with the kernel it targets. Empty for variants that need nothing beyond `config-available/`; today it carries only `intree:` fragments. `resolve-matrix.sh` joins it into the comma-separated `kernel-config` workflow input. |
 | `debian_version_stub` | Base Debian revision, shared by a variant's Daily and Release rows. Must not end in `~`; the suite suffix is derived, not stored here. |
 | `debian_version_suffix` | `~` for Daily rows, empty for Release rows. Documents the delivery-type half of the revision formula on the row itself; `resolve-matrix.sh` rejects a row where this disagrees with `type`, but derivation always computes this suffix from `type`, never reads this field. |
 | `localversion`, `kver_extra` | Optional version overrides forwarded to packaging. |
@@ -302,7 +302,7 @@ flowchart LR
     K["Matrix-selected kernel repository\nDaily: latest tag or branch tip\nRelease: pinned ref"] --> PS
     M["pkg-linux-qcom\nMatrix-selected packaging ref\nFinal: qcom/debian/latest"] --> PS
 
-    PS["prepare-source.sh\n\nInject debian/\nActivate selected config fragments\nGenerate control, changelog, localversion, pkgversion"] --> TAR
+    PS["prepare-source.sh\n\nInject debian/\nApply all config-available fragments plus any extras\nGenerate control, changelog, localversion, pkgversion"] --> TAR
     TAR["tar czf kernel-srcpkg-variant-suite.tar.gz\nPreserves execute permissions"] --> ART
     ART["GitHub Actions artifact\nOne prepared source tree per variant + suite"]
 ```
@@ -361,7 +361,7 @@ flowchart LR
 ```
 
 `--skip-prepare` is safe because `prepare-source.sh` has already generated the
-packaging metadata and activated the selected fragments before the artifact is
+packaging metadata and applied the config fragments before the artifact is
 created.
 
 ## Packages
@@ -424,7 +424,7 @@ The available inputs are:
 | `kernel-url` | `qualcomm-linux/kernel` | Advanced alternate kernel repository. |
 | `srcpkg` | `linux-qcom-next` | Advanced source package identity override. |
 | `binpkg` | `linux-image-qcom-next` | Advanced image metapackage identity override. |
-| `kernel-config` | `squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can` | Advanced packaging fragments to activate. |
+| `kernel-config` | Empty | Advanced extra fragments applied on top of all of `debian/config-available/`, e.g. `intree:arch/arm64/configs/qcom_debug.config`. |
 | `debian-version-stub` | `0qli` | Advanced Debian version stub. The selected suite's mapped suffix and a Daily-style trailing `~` are applied automatically; direct builds always use Daily semantics since they are build-only and non-promoting. |
 | `localversion` | Auto-derived | Advanced explicit `LOCALVERSION` override. |
 | `kver-extra` | Empty | Advanced kernel-release suffix. |
diff --git a/ci/build-matrix.json b/ci/build-matrix.json
index bc91514..cbb8390 100644
--- a/ci/build-matrix.json
+++ b/ci/build-matrix.json
@@ -19,7 +19,7 @@
       "tag_pattern": "qcom-next-*",
       "srcpkg": "linux-qcom-next",
       "binpkg": "linux-image-qcom-next",
-      "kernel_config": "squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can",
+      "kernel_config": [],
       "debian_version_stub": "0qli",
       "debian_version_suffix": "~",
       "pkg_linux_qcom_ref": "qcom/debian/latest"
@@ -37,7 +37,7 @@
       "ref_strategy": "pinned_ref",
       "srcpkg": "linux-qcom-next",
       "binpkg": "linux-image-qcom-next",
-      "kernel_config": "squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can",
+      "kernel_config": [],
       "debian_version_stub": "0qli",
       "debian_version_suffix": "",
       "pkg_linux_qcom_ref": "qcom/debian/latest"
@@ -55,7 +55,10 @@
       "tag_pattern": "qcom-next-*",
       "srcpkg": "linux-qcom-next-debug",
       "binpkg": "linux-image-qcom-next-debug",
-      "kernel_config": "squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can,intree:qcom_debug",
+      "kernel_config": [
+        "intree:arch/arm64/configs/qcom_debug.config",
+        "intree:kernel/configs/debug.config"
+      ],
       "debian_version_stub": "0qli",
       "debian_version_suffix": "~",
       "pkg_linux_qcom_ref": "qcom/debian/latest"
@@ -73,7 +76,10 @@
       "ref_strategy": "pinned_ref",
       "srcpkg": "linux-qcom-next-debug",
       "binpkg": "linux-image-qcom-next-debug",
-      "kernel_config": "squashfs,systemd-boot,qcom-imsdk,docker,qemu-boot,usb-can,intree:qcom_debug",
+      "kernel_config": [
+        "intree:arch/arm64/configs/qcom_debug.config",
+        "intree:kernel/configs/debug.config"
+      ],
       "debian_version_stub": "0qli",
       "debian_version_suffix": "",
       "pkg_linux_qcom_ref": "qcom/debian/latest"
diff --git a/ci/scripts/resolve-matrix.sh b/ci/scripts/resolve-matrix.sh
index 776f1df..c2f63be 100755
--- a/ci/scripts/resolve-matrix.sh
+++ b/ci/scripts/resolve-matrix.sh
@@ -10,8 +10,12 @@ set -euo pipefail
 #     kernel variant and delivery type (e.g. "trixie": "~bpo13+1").
 #   - "deliveries": the matrix rows. Each kernel_variant owns exactly one
 #     Daily row and one Release row. A row declares every input needed by
-#     that delivery, including a debian_version_stub; suites are the only
-#     list-valued field and are expanded into isolated legs.
+#     that delivery, including a debian_version_stub. Two fields are
+#     list-valued: suites, which is expanded into isolated legs, and
+#     kernel_config, which is one config fragment per element. A fragment is
+#     either a bare name from debian/config-available/ or an "intree:" entry
+#     naming a path relative to the kernel source root
+#     (e.g. intree:arch/arm64/configs/qcom_debug.config).
 #
 # Each flattened leg's final debian_revision is derived from
 # debian_version_stub, suite_suffix_mapping[suite], and the delivery type via
@@ -42,7 +46,9 @@ set -euo pipefail
 #   Compact JSON array to stdout. Every entry has a single suite, the
 #   kernel_variant that scopes its artifacts, Debusine workspace, and logs,
 #   and a suite-specific debian_revision (debian_version_stub and
-#   debian_version_suffix are consumed and removed).
+#   debian_version_suffix are consumed and removed). kernel_config is joined
+#   into the comma-separated string that build-kernel-deb.yml's kernel-config
+#   input and prepare-source.sh's --kernel-config expect.
 #
 # Exit codes:
 #   0  Success, at least one entry emitted.
@@ -100,6 +106,38 @@ validation_errors=$(jq -r '
     else "kernel_variant must use lowercase letters, digits, and internal hyphens"
     end;
 
+  # An "intree:" entry names a fragment shipped by the kernel source, as a
+  # path relative to the kernel source root (e.g.
+  # intree:arch/arm64/configs/qcom_debug.config). Reject absolute paths,
+  # ".." traversal, and anything not ending in .config so a typo fails here
+  # rather than deep inside prepare-source.sh.
+  def intree_path_valid:
+    .[7:] as $path |
+    ($path | test("^([A-Za-z0-9_.-]+/)*[A-Za-z0-9_.-]+\\.config$"))
+    and (($path | test("(^|/)\\.\\.(/|$)")) | not);
+
+  # Every fragment lands in debian/config/ under its basename, so two entries
+  # sharing one basename (e.g. arch/arm64/configs/hardening.config and
+  # kernel/configs/hardening.config) collide there.
+  def fragment_basename:
+    sub("^intree:"; "") | sub("^.*/"; "") | sub("\\.config$"; "");
+
+  def kernel_config_valid:
+    if (.kernel_config | type) != "array"
+    then "kernel_config must be an array"
+    elif any(.kernel_config[]; type != "string" or length == 0)
+    then "kernel_config must contain only non-empty strings"
+    elif any(.kernel_config[]; test(","))
+    then "kernel_config entries must not contain commas; use one array element per fragment"
+    elif ([.kernel_config[]] | unique | length) != (.kernel_config | length)
+    then "kernel_config must not contain duplicates"
+    elif any(.kernel_config[]; startswith("intree:") and (intree_path_valid | not))
+    then "intree: entries must be a kernel-source-relative path ending in .config (e.g. intree:arch/arm64/configs/qcom_debug.config)"
+    elif ([.kernel_config[] | fragment_basename] | unique | length) != (.kernel_config | length)
+    then "kernel_config entries must not resolve to the same fragment filename"
+    else empty
+    end;
+
   def suites_valid:
     if (.suites | type) != "array" or (.suites | length) == 0
     then "suites must be a non-empty array"
@@ -125,7 +163,6 @@ validation_errors=$(jq -r '
       required_string("ref_strategy"),
       required_string("srcpkg"),
       required_string("binpkg"),
-      required_string("kernel_config"),
       required_string("debian_version_stub"),
       optional_string("pkg_linux_qcom_ref"),
       optional_string("debusine_parent_workspace"),
@@ -133,6 +170,7 @@ validation_errors=$(jq -r '
       optional_string("kver_extra"),
       variant_name_valid,
       suites_valid,
+      kernel_config_valid,
       if (.debian_version_stub | type) == "string" and (.debian_version_stub | test("~$"))
       then "debian_version_stub must not end in ~"
       else empty end,
@@ -291,7 +329,9 @@ result=$(jq -c \
             else []
             end
           )[] as $suite
-        | $row | del(.suites) | . + {"suite": $suite}
+        | $row
+        | del(.suites)
+        | . + {"suite": $suite, "kernel_config": ($row.kernel_config | join(","))}
       ]
       | if length == 0
         then error(