linuxboot · tlaurion · Nov 10, 2025 · Oct 18, 2025 · Oct 18, 2025 · Oct 18, 2025
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -195,7 +195,7 @@ jobs:
             - build/ppc64/musl-cross-make-fd6be58297ee21fcba89216ccd0d4aca1e3f1c5c
             - build/x86/coreboot-4.11
             - build/x86/coreboot-24.02.01
-            - build/x86/coreboot-24.12
+            - build/x86/coreboot-25.09
             - build/x86/coreboot-dasharo
             - build/x86/coreboot-purism
             - build/x86/musl-cross-make-fd6be58297ee21fcba89216ccd0d4aca1e3f1c5c
@@ -253,7 +253,7 @@ workflows:
           requires:
             - novacustom-nv4x_adl
 
-      # t480 is based on 24.12 coreboot release, not sharing any buildstack from now, depend on muscl-cross cache
+      # t480 is based on 25.09 coreboot release, not sharing any buildstack from now, depend on muscl-cross cache
       - build_and_persist:
           name: EOL_t480-hotp-maximized
           target: EOL_t480-hotp-maximized
@@ -286,7 +286,7 @@ workflows:
             - EOL_t480-hotp-maximized
 
       # Those onboarding new boards should add their entries below.
-      # coreboot 24.12 boards
+      # coreboot 25.09 boards
       - build:
           name: EOL_x220-hotp-maximized
           target: EOL_x220-hotp-maximized
@@ -435,15 +435,15 @@ workflows:
             - EOL_t480-hotp-maximized
 
       - build:
-          name: EOL_UNTESTED_w541-maximized
-          target: EOL_UNTESTED_w541-maximized
+          name: EOL_w541-maximized
+          target: EOL_w541-maximized
           subcommand: ""
           requires:
             - EOL_t480-hotp-maximized
 
       - build:
-          name: EOL_UNTESTED_w541-hotp-maximized
-          target: EOL_UNTESTED_w541-hotp-maximized
+          name: EOL_w541-hotp-maximized
+          target: EOL_w541-hotp-maximized
           subcommand: ""
           requires:
             - EOL_t480-hotp-maximized
@@ -456,15 +456,15 @@ workflows:
             - EOL_t480-hotp-maximized
 
       - build:
-          name: EOL_UNTESTED_z220-cmt-maximized
-          target: EOL_UNTESTED_z220-cmt-maximized
+          name: EOL_z220-cmt-maximized
+          target: EOL_z220-cmt-maximized
           subcommand: ""
           requires:
             - EOL_t480-hotp-maximized
 
       - build:
-          name: EOL_UNTESTED_z220-cmt-hotp-maximized
-          target: EOL_UNTESTED_z220-cmt-hotp-maximized
+          name: EOL_z220-cmt-hotp-maximized
+          target: EOL_z220-cmt-hotp-maximized
           subcommand: ""
           requires:
             - EOL_t480-hotp-maximized
@@ -527,7 +527,7 @@ workflows:
           requires:
             - librem_14
 
-      # t480 is based on 24.12 coreboot release, not sharing any buildstack from now, depend on muscl-cross cache
+      # t480 is based on 25.09 coreboot release, not sharing any buildstack from now, depend on muscl-cross cache
       - build:
           name: EOL_t480-maximized
           target: EOL_t480-maximized

diff --git a/blobs/xx80/README.md b/blobs/xx80/README.md
@@ -7,9 +7,10 @@ The following blobs are needed:
 * `me.bin`
 * `tb.bin` (optional but recommended flashing this blob to the separate Thunderbolt SPI chip to fix a bug in the original firmware)
 
-## me.bin: automatically extract, neuter and deguard
+## me.bin: automatically extract, deactivate, partially neuter and deguard
 
-download_clean_me.sh : Download vulnerable ME from Dell, verify checksum, extract ME, neuter ME and trim it, then apply the deguard patch and place it into me.bin
+download_clean_deguard_me_pad_tb.sh : Download vulnerable ME from Dell, verify checksum, extract ME, deactivate ME and paritally neuter it, then apply the deguard patch and place it into me.bin.
+For the technical details please read the documentation in the script itself, as removing modules is limited on the platform.
 
 The ME blob dumped in this directory comes from the following link: https://dl.dell.com/FOLDER04573471M/1/Inspiron_5468_1.3.0.exe
 
@@ -31,7 +32,7 @@ The GBE MAC address was forged to: `00:DE:AD:C0:FF:EE MAC`
 ## tb.bin
 
 This blob was extracted from https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe
-It is zero-padded to 1MB and should be flashed to the Thunderbolt SPI chip, which is not the same as the 16MB chip to which the heads rom is flashed. External flashing is recommended as the only way to reliably fix a bug in the original Thunderbolt software on the SPI chip. You can find a guide here: https://osresearch.net/T430-maximized-flashing/
+It is zero-padded to 1MB and should be flashed to the Thunderbolt SPI chip, which is not the same as the 16MB chip to which the heads rom is flashed. External flashing is recommended as the only way to reliably fix a bug in the original Thunderbolt software on the SPI chip. You can find a guide here: https://osresearch.net/T480-maximized-flashing/
 
 ## Integrity
 
@@ -50,4 +51,6 @@ See the board configs `boards/t480-[hotp-]maximized/t480-[hotp-]maximized.config
 # Documentation
 
 A guide on how to flash this board (both the Heads rom and the Thunderbolt `tb.bin` blob) can be found here:
-https://osresearch.net/T430-maximized-flashing/
+https://osresearch.net/T480-maximized-flashing/
+
+The upstream documentation is available here. It includes a list of known issues: https://doc.coreboot.org/mainboard/lenovo/t480.html
diff --git a/blobs/xx80/download_clean_deguard_me_pad_tb.sh b/blobs/xx80/download_clean_deguard_me_pad_tb.sh
@@ -71,14 +71,17 @@ function download_and_clean() {
 
 	extracted_me_filename="1 Inspiron_5468_1.3.0 -- 3 Intel Management Engine (Non-VPro) Update v${ME_version}.bin"
 
-	# Neutralize and shrink Intel ME. Note that this doesn't include
+	# Deactivate, paritally neuter and shrink Intel ME. Note that this doesn't include
 	# --soft-disable to set the "ME Disable" or "ME Disable B" (e.g.,
 	# High Assurance Program) bits, as they are defined within the Flash
 	# Descriptor.
 	# However, the HAP bit must be enabled to make the deguarded ME work. We only clean the ME in this function.
+	# For ME 11.x this means we must keep the rbe, bup, kernel and syslib modules.
+	# https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F#me-versions-from-11x-skylake-1
+	# Furthermore, deguard requires keeping the MFS, the HAP bit set, and we cannot relocate the FTPR partition.
+	# Some more general info on shrinking:
 	# https://github.com/corna/me_cleaner/wiki/External-flashing#neutralize-and-shrink-intel-me-useful-only-for-coreboot
 
-	# MFS is needed for deguard so we whitelist it here and also do not relocate the FTPR partition
 	python "$me_cleaner" --whitelist MFS -t -O "$me_output" "${me_installer_filename}_extracted/Firmware/${extracted_me_filename}"
 	rm -rf ./*
 	popd || exit

diff --git a/boards/EOL_UNTESTED_t440p-hotp-maximized/EOL_UNTESTED_t440p-hotp-maximized.config b/boards/EOL_UNTESTED_t440p-hotp-maximized/EOL_UNTESTED_t440p-hotp-maximized.config
@@ -5,7 +5,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-t440p.config
 CONFIG_LINUX_CONFIG=config/linux-t440p.config
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_CRYPTSETUP2=y

diff --git a/boards/EOL_UNTESTED_t440p-maximized/EOL_UNTESTED_t440p-maximized.config b/boards/EOL_UNTESTED_t440p-maximized/EOL_UNTESTED_t440p-maximized.config
@@ -5,7 +5,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-t440p.config
 CONFIG_LINUX_CONFIG=config/linux-t440p.config
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_CRYPTSETUP2=y

diff --git a/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config b/boards/EOL_UNTESTED_t530-hotp-maximized/EOL_UNTESTED_t530-hotp-maximized.config
@@ -9,7 +9,7 @@
 # - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 # This board is designed for a t530 without a dGPU. It will work just fine for a board with a dGPU, except you will not be able to use an external monitor via the mini-displayport or the dock's displayport, though external monitors will work via VGA ports. To initialize the dGPU please use one of the dgpu boards.
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t530-maximized.config

diff --git a/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config b/boards/EOL_UNTESTED_t530-maximized/EOL_UNTESTED_t530-maximized.config
@@ -9,7 +9,7 @@
 # - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 # This board is designed for a t530 without a dGPU. It will work just fine for a board with a dGPU, except you will not be able to use an external monitor via the mini-displayport or the dock's displayport, though external monitors will work via VGA ports. To initialize the dGPU please use one of the dgpu boards.
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t530-maximized.config

diff --git a/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config b/boards/EOL_optiplex-7010_9010-hotp-maximized/EOL_optiplex-7010_9010-hotp-maximized.config
@@ -8,7 +8,7 @@
 #
 # - Includes: Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-optiplex-7019_9010-maximized.config

diff --git a/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config b/boards/EOL_optiplex-7010_9010-maximized/EOL_optiplex-7010_9010-maximized.config
@@ -8,7 +8,7 @@
 #
 # - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-optiplex-7019_9010-maximized.config

diff --git a/...OL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config b/...OL_optiplex-7010_9010_TXT-hotp-maximized/EOL_optiplex-7010_9010_TXT-hotp-maximized.config
@@ -8,7 +8,7 @@
 #
 # - Includes: Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-optiplex-7019_9010_TXT-maximized.config

diff --git a/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config b/boards/EOL_optiplex-7010_9010_TXT-maximized/EOL_optiplex-7010_9010_TXT-maximized.config
@@ -8,7 +8,7 @@
 #
 # - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-optiplex-7019_9010_TXT-maximized.config

diff --git a/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config b/boards/EOL_t420-hotp-maximized/EOL_t420-hotp-maximized.config
@@ -10,7 +10,7 @@
 # - dropbear
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t420-maximized.config

diff --git a/boards/EOL_t420-maximized/EOL_t420-maximized.config b/boards/EOL_t420-maximized/EOL_t420-maximized.config
@@ -9,7 +9,7 @@
 # Doesn't include (to fit in 7mb image)
 # - dropbear
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t420-maximized.config

diff --git a/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config b/boards/EOL_t430-hotp-maximized/EOL_t430-hotp-maximized.config
@@ -8,7 +8,7 @@
 #
 # - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t430-maximized.config

diff --git a/boards/EOL_t430-maximized/EOL_t430-maximized.config b/boards/EOL_t430-maximized/EOL_t430-maximized.config
@@ -8,7 +8,7 @@
 #
 # - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t430-maximized.config

diff --git a/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config b/boards/EOL_t480-hotp-maximized/EOL_t480-hotp-maximized.config
@@ -9,19 +9,20 @@
 # Make sure you understand the implications of the attack for your threat model before using this board.
 #
 # Includes
-# - Deactivated+neutered+deguarded ME and expanded consequent IFD BIOS regions 
+# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
+#   - More details can be found in the script under blobs/xx80/download_clean_deguard_me_pad_tb.sh
 # - Forged GBE MAC address to 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx80/extract.sh)
 #   - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
 # - Flashable Thunderbolt tb.bin blob extracted from https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe
 #   - It is zero-padded to 1MB and should be flashed to the Thunderbolt SPI chip,
 #     which is not the same as the 16MB chip to which the heads rom is flashed.
 #     External flashing is recommended as the only way to reliably fix a bug in the original Thunderbolt software on the SPI chip.
-#     You can find a guide here: https://osresearch.net/T430-maximized-flashing/
+#     You can find a guide here: https://osresearch.net/T480-maximized-flashing/
 #
 # - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t480-maximized.config
@@ -96,5 +97,4 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-hotp-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
-#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx80_me_blobs
diff --git a/boards/EOL_t480-maximized/EOL_t480-maximized.config b/boards/EOL_t480-maximized/EOL_t480-maximized.config
@@ -9,19 +9,20 @@
 # Make sure you understand the implications of the attack for your threat model before using this board.
 #
 # Includes
-# - Deactivated+neutered+deguarded ME and expanded consequent IFD BIOS regions 
+# - Deactivated+partially neutered+deguarded ME and expanded consequent IFD BIOS regions
+#   - More details can be found in the script under blobs/xx80/download_clean_deguard_me_pad_tb.sh
 # - Forged GBE MAC address to 00:DE:AD:C0:FF:EE MAC address (if not extracting gbe.bin from backup with blobs/xx80/extract.sh)
 #   - Note that this MAC address can be modified under build/coreboot-VER/util/bincfg/gbe-82579LM.set
 # - Flashable Thunderbolt tb.bin blob extracted from https://download.lenovo.com/pccbbs/mobiles/n24th13w.exe
 #   - It is zero-padded to 1MB and should be flashed to the Thunderbolt SPI chip,
 #     which is not the same as the 16MB chip to which the heads rom is flashed.
 #     External flashing is recommended as the only way to reliably fix a bug in the original Thunderbolt software on the SPI chip.
-#     You can find a guide here: https://osresearch.net/T430-maximized-flashing/
+#     You can find a guide here: https://osresearch.net/T480-maximized-flashing/
 #
 # - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-t480-maximized.config
@@ -96,5 +97,4 @@ export CONFIG_BOOT_KERNEL_REMOVE="intel_iommu=on intel_iommu=igfx_off"
 export CONFIG_BOARD_NAME="Thinkpad T480-maximized"
 export CONFIG_FLASH_OPTIONS="flashprog --progress --programmer internal"
 
-#Include bits related to ivybridge ME blob download/neutering down to BUP+ROMP
 BOARD_TARGETS := xx80_me_blobs
diff --git a/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config b/boards/EOL_w530-hotp-maximized/EOL_w530-hotp-maximized.config
@@ -9,7 +9,7 @@
 # - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 # This board ignores the in-built dGPU that comes with all w530's. In doing so the dGPU will not be initialized. This has some benefits in terms of reduced complexity in working with OS's with poor support for NVIDIA, better battery life and lower heat (making use of the thicker heatsink from a dGPU). Conversely, if you do not initialize the dGPU you will be unable to use an external monitor. To initialize the dGPU please use the dGPU boards that corresponds with the model of dGPU included with your device.
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-w530-maximized.config

diff --git a/boards/EOL_w530-maximized/EOL_w530-maximized.config b/boards/EOL_w530-maximized/EOL_w530-maximized.config
@@ -9,7 +9,7 @@
 # - Includes Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 # This board ignores the in-built dGPU that comes with all w530's. In doing so the dGPU will not be initialized. This has some benefits in terms of reduced complexity in working with OS's with poor support for NVIDIA, better battery life and lower heat (making use of the thicker heatsink from a dGPU). Conversely, if you do not initialize the dGPU you will be unable to use an external monitor. To initialize the dGPU please use the dGPU boards that corresponds with the model of dGPU included with your device.
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-w530-maximized.config

diff --git a/...d/EOL_UNTESTED_w541-hotp-maximized.config → ...-maximized/EOL_w541-hotp-maximized.config b/...d/EOL_UNTESTED_w541-hotp-maximized.config → ...-maximized/EOL_w541-hotp-maximized.config
@@ -5,7 +5,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-w541.config
 CONFIG_LINUX_CONFIG=config/linux-w541.config
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_CRYPTSETUP2=y

diff --git a/...imized/EOL_UNTESTED_w541-maximized.config → ..._w541-maximized/EOL_w541-maximized.config b/...imized/EOL_UNTESTED_w541-maximized.config → ..._w541-maximized/EOL_w541-maximized.config
@@ -5,7 +5,7 @@ CONFIG_COREBOOT_CONFIG=config/coreboot-w541.config
 CONFIG_LINUX_CONFIG=config/linux-w541.config
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_CRYPTSETUP2=y

diff --git a/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config b/boards/EOL_x220-hotp-maximized/EOL_x220-hotp-maximized.config
@@ -10,7 +10,7 @@
 # - dropbear
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x220-maximized.config

diff --git a/boards/EOL_x220-maximized/EOL_x220-maximized.config b/boards/EOL_x220-maximized/EOL_x220-maximized.config
@@ -10,7 +10,7 @@
 # - dropbear
 
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x220-maximized.config

diff --git a/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config b/boards/EOL_x230-hotp-maximized-fhd_edp/EOL_x230-hotp-maximized-fhd_edp.config
@@ -20,7 +20,7 @@
 #
 # - Includes: Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230-maximized-fhd_edp.config

diff --git a/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config b/boards/EOL_x230-hotp-maximized/EOL_x230-hotp-maximized.config
@@ -8,7 +8,7 @@
 #
 # - Includes: Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230-maximized.config

diff --git a/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config b/boards/EOL_x230-hotp-maximized_usb-kb/EOL_x230-hotp-maximized_usb-kb.config
@@ -10,7 +10,7 @@
 # 	Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 # 	USB Keyboard support
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230-maximized.config

diff --git a/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config b/boards/EOL_x230-maximized-fhd_edp/EOL_x230-maximized-fhd_edp.config
@@ -20,7 +20,7 @@
 #
 # - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230-maximized-fhd_edp.config

diff --git a/boards/EOL_x230-maximized/EOL_x230-maximized.config b/boards/EOL_x230-maximized/EOL_x230-maximized.config
@@ -8,7 +8,7 @@
 #
 # - DOES NOT INCLUDE Nitrokey/Librem Key HOTP Security dongle remote attestation (in addition to TOTP remote attestation through Qr Code)
 export CONFIG_COREBOOT=y
-export CONFIG_COREBOOT_VERSION=24.12
+export CONFIG_COREBOOT_VERSION=25.09
 export CONFIG_LINUX_VERSION=6.1.8
 
 CONFIG_COREBOOT_CONFIG=config/coreboot-x230-maximized.config