diff --git a/lib/functions/artifacts/artifact-kernel.sh b/lib/functions/artifacts/artifact-kernel.sh
index 80dc4ce9e35e..b686330f7ecf 100644
--- a/lib/functions/artifacts/artifact-kernel.sh
+++ b/lib/functions/artifacts/artifact-kernel.sh
@@ -125,7 +125,7 @@ function artifact_kernel_prepare_version() {
 
 	# run the extensions. they _must_ behave, and not try to modify the .config, instead just fill kernel_config_modifying_hashes
 	declare kernel_config_modifying_hashes_hash="undetermined"
-	declare -a kernel_config_modifying_hashes=()
+	declare -ga kernel_config_modifying_hashes=()
 	call_extensions_kernel_config
 	# Reduce to last assignment per key to keep hashing stable and ignore overridden options.
 	# tac reverses order so last becomes first, then sort -uk keeps first occurrence of each key.
diff --git a/lib/functions/compilation/armbian-kernel.sh b/lib/functions/compilation/armbian-kernel.sh
index 486206fda0bb..8f21009d28df 100644
--- a/lib/functions/compilation/armbian-kernel.sh
+++ b/lib/functions/compilation/armbian-kernel.sh
@@ -616,6 +616,7 @@ function kernel_config_set_m() {
 	declare module="$1"
 	display_alert "Enabling kernel module" "${module}=m" "debug"
 	run_host_command_logged ./scripts/config --module "${module}"
+	kernel_config_modifying_hashes+=("${module}=m")
 }
 
 # Sets a kernel configuration option to be built-in (=y).
@@ -627,6 +628,7 @@ function kernel_config_set_y() {
 	declare config="$1"
 	display_alert "Enabling kernel config/built-in" "${config}=y" "debug"
 	run_host_command_logged ./scripts/config --enable "${config}"
+	kernel_config_modifying_hashes+=("${config}=y")
 }
 
 # Disables a kernel configuration option (=n).
@@ -637,6 +639,7 @@ function kernel_config_set_n() {
 	declare config="$1"
 	display_alert "Disabling kernel config/module" "${config}=n" "debug"
 	run_host_command_logged ./scripts/config --disable "${config}"
+	kernel_config_modifying_hashes+=("${config}=n")
 }
 
 # Sets a kernel configuration option to a string value.
@@ -649,6 +652,7 @@ function kernel_config_set_string() {
 	declare value="${2}"
 	display_alert "Setting kernel config/module string" "${config}=${value}" "debug"
 	run_host_command_logged ./scripts/config --set-str "${config}" "${value}"
+	kernel_config_modifying_hashes+=("${config}=\"${value}\"")
 }
 
 # Sets a kernel configuration option to a numeric or hexadecimal value.
@@ -661,6 +665,7 @@ function kernel_config_set_val() {
 	declare value="${2}"
 	display_alert "Setting kernel config/module value" "${config}=${value}" "debug"
 	run_host_command_logged ./scripts/config --set-val "${config}" "${value}"
+	kernel_config_modifying_hashes+=("${config}=${value}")
 }
 
 # Applies kernel configuration options from arrays to hashes and the .config file.
diff --git a/lib/functions/compilation/kernel-config.sh b/lib/functions/compilation/kernel-config.sh
index 54a1634487ce..8efbf8b865f1 100644
--- a/lib/functions/compilation/kernel-config.sh
+++ b/lib/functions/compilation/kernel-config.sh
@@ -69,6 +69,10 @@ function kernel_config_initialize() {
 		run_host_command_logged cp -pv "${kernel_config_source_filename}" "${kernel_work_dir}/.config"
 	fi
 
+	# Ensure .config ends with a newline; ./scripts/config appends via `echo >>` and
+	# silently concatenates the first added option with the last line otherwise.
+	sed -i -e '$a\' "${kernel_work_dir}/.config"
+
 	# Call the extensions. This is _also_ done during the kernel artifact's prepare_version, for consistent caching.
 	cd "${kernel_work_dir}" || exit_with_error "kernel_work_dir does not exist before call_extensions_kernel_config: ${kernel_work_dir}"
 	call_extensions_kernel_config
@@ -93,6 +97,13 @@ function call_extensions_kernel_config() {
 	# shellcheck disable=SC2034
 	declare -a opts_y=() opts_n=() opts_m=()
 
+	# kernel_config_set_* append to this array; ensure it exists globally so their
+	# changes survive for artifact versioning even when no caller pre-declared it.
+	if ! declare -p kernel_config_modifying_hashes >/dev/null 2>&1; then
+		# shellcheck disable=SC2034
+		declare -ga kernel_config_modifying_hashes=()
+	fi
+
 	# Run the core-armbian config modifications here, built-in extensions:
 	call_extension_method "armbian_kernel_config" <<- 'ARMBIAN_KERNEL_CONFIG'
 		*Armbian-core default hook point for pre-olddefconfig Kernel config modifications*