diff --git a/cmd/rtr7-build-kernel/build.go b/cmd/rtr7-build-kernel/build.go
index 693f857..9fefa1e 100644
--- a/cmd/rtr7-build-kernel/build.go
+++ b/cmd/rtr7-build-kernel/build.go
@@ -28,7 +28,7 @@ import (
 )
 
 // see https://www.kernel.org/releases.json
-var latest = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.10.tar.xz"
+var latest = "https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.7.tar.xz"
 
 const configAddendum = `
 CONFIG_IPV6=y
@@ -261,6 +261,10 @@ CONFIG_DEFAULT_TCP_CONG="bbr"
 # make[4]: *** [drivers/gpu/drm/i915] Error 2
 # make[3]: *** [drivers/gpu/drm] Error 2
 CONFIG_WERROR=n
+
+# Enable zstd compression to stay below 15 MB, which is the size of Extended Memory.
+# This is relevant to keep the kernel booting with the minimal MBR loader we use.
+CONFIG_KERNEL_ZSTD=y
 `
 
 func downloadKernel() error {
diff --git a/cmd/rtr7-rebuild-kernel/kernel.go b/cmd/rtr7-rebuild-kernel/kernel.go
index 2a78da4..b90566f 100644
--- a/cmd/rtr7-rebuild-kernel/kernel.go
+++ b/cmd/rtr7-rebuild-kernel/kernel.go
@@ -28,9 +28,9 @@ import (
 )
 
 const dockerFileContents = `
-FROM debian:buster
+FROM debian:bookworm
 
-RUN apt-get update && apt-get install -y crossbuild-essential-arm64 bc libssl-dev bison flex libelf-dev ncurses-dev
+RUN apt-get update && apt-get install -y build-essential bc libssl-dev bison flex libelf-dev ncurses-dev ca-certificates zstd
 
 COPY rtr7-build-kernel /usr/bin/rtr7-build-kernel
 {{- range $idx, $path := .Patches }}
diff --git a/vmlinuz b/vmlinuz
index 2a83828..e49b086 100644
Binary files a/vmlinuz and b/vmlinuz differ