diff --git a/os/packages/linux/available-kernels.nix b/os/packages/linux/available-kernels.nix
index 2f6f524d9..5c41748d0 100644
--- a/os/packages/linux/available-kernels.nix
+++ b/os/packages/linux/available-kernels.nix
@@ -1,9 +1,17 @@
 {
-  stableKernelVersion = "6.12.29";
+  stableKernelVersion = "6.12.33";
 
-  unstableKernelVersion = "6.12.29";
+  unstableKernelVersion = "6.12.33";
 
   kernels = {
+    "6.12.33" = {
+      rev = "0655f700a3545ee3a865824694b77c0d2928f17d";
+      sha256 = "sha256-2D8OZsXEW3BJODxDTutV8kjCNRnJG+KKk7t8YtJoLdE=";
+      zfs = {
+        rev = "6546b7270e6c44e7e90fd5fa4dcb2eaba04b0de2";
+        sha256 = "sha256-EFSCMEAN8XYVb+k1khXMJki4HsWkWbaH9VtXlwJINjU=";
+      };
+    };
     "6.12.29" = {
       rev = "e7a0b7edb22842d0188046201ed15217c7239fbf";
       sha256 = "sha256-4IIXcjoT+lipBsIBRncfqPCLDS6/JO068j3qCiZ8zFA=";
diff --git a/os/packages/linux/common-config.nix b/os/packages/linux/common-config.nix
index 324d3bf4c..d4701e838 100644
--- a/os/packages/linux/common-config.nix
+++ b/os/packages/linux/common-config.nix
@@ -511,6 +511,9 @@ let
       TRIM_UNUSED_KSYMS        = no;
       LIVEPATCH                = yes;
       X86_KERNEL_IBT           = whenAtLeast "6.10.11" no;
+      BPF_KPROBE_OVERRIDE      = yes;
+      FUNCTION_ERROR_INJECTION = yes;
+      BPF_LSM                  = yes;
     };
 
     virtualisation = {