diff --git a/debian/README.md b/debian/README.md
index 581753c2..ceb1a48c 100644
--- a/debian/README.md
+++ b/debian/README.md
@@ -58,9 +58,9 @@ pkg-linux-qcom/
 │   ├── changelog               ← Generated by 'prepare' (gitignored)
 │   ├── rules                   ← Build logic + 'prepare' target
 │   ├── clean                   ← Lists generated files for dh_clean
-│   ├── linux-image.preinst     ← Pre-install maintainer script
-│   ├── linux-image.postinst.in ← Post-install maintainer script template (depmod, initramfs, GRUB)
-│   ├── linux-image.postrm      ← Post-remove maintainer script (GRUB update)
+│   ├── linux-image.preinst.in  ← Pre-install maintainer script template (no-op)
+│   ├── linux-image.postinst.in ← Post-install maintainer script template (depmod, kernel hooks)
+│   ├── linux-image.postrm.in   ← Post-remove maintainer script template (kernel hooks)
 │   ├── config/                 ← Always-applied config fragments (committed)
 │   │   └── squashfs.config     ← SQUASHFS options for Ubuntu compatibility
 │   ├── config-available/       ← Packaging fragments, all applied to every build
@@ -89,9 +89,9 @@ pkg-linux-qcom/
 | `debian/control.in` | ✅ Committed | Template with `@KVER@` placeholder |
 | `debian/changelog.in` | ✅ Committed | Template with `@KVER@` placeholder |
 | `debian/rules` | ✅ Committed | Build rules + `prepare` target |
-| `debian/linux-image.preinst` | ✅ Committed | Pre-install maintainer script |
+| `debian/linux-image.preinst.in` | ✅ Committed | Pre-install script template (`@KVER@` substituted at build time) |
 | `debian/linux-image.postinst.in` | ✅ Committed | Post-install script template (`@KVER@` substituted at build time) |
-| `debian/linux-image.postrm` | ✅ Committed | Post-remove maintainer script |
+| `debian/linux-image.postrm.in` | ✅ Committed | Post-remove script template (`@KVER@` substituted at build time) |
 | `debian/config/*.config` | ✅ Committed | Always-applied config fragments |
 | `debian/config-available/*.config` | ✅ Committed | Packaging fragments, all applied to every build |
 | `debian/dkms-modules` | 🔄 Generated | Produced by `make -f debian/rules prepare DKMS_MODULES=...` |
@@ -175,8 +175,8 @@ Debian's official `linux` source package and Ubuntu OEM kernels.
 
 ```
 KVER = <base-version> + LOCALVERSION
-     = 7.0.0-rc2        + -qcom-next-20260826
-     = 7.2.0-qcom-next-20260826
+     = 7.2.0-rc7        + -qcom-next-20260826
+     = 7.2.0-rc7-qcom-next-20260826
 ```
 
 `build-kernel.sh` passes `LOCALVERSION` to `prepare`, which determines KVER by:
@@ -336,9 +336,46 @@ Virtual packages provided: `linux-image`, `linux-image-arm64`
 Maintainer scripts:
 - `preinst` — no-op; coexistence of multiple kernel versions is handled by
   dpkg automatically (each version has a unique package name)
-- `postinst` — runs `depmod`, then `/etc/kernel/postinst.d/` hooks
-  (triggers `update-initramfs` and `update-grub`)
-- `postrm` — runs `/etc/kernel/postrm.d/` hooks (triggers `update-grub`)
+- `postinst` — runs `depmod`, then the kernel `postinst.d` hooks
+  (triggers `update-initramfs`, `update-grub` and, where systemd-boot is
+  installed, the loader entry and `loader.conf` generation)
+- `postrm` — runs the kernel `postrm.d` hooks (drops the removed kernel's
+  bootloader entries)
+
+Both hook directories are run: `/etc/kernel/{postinst,postrm}.d/` for hooks
+the administrator installs, and `/usr/share/kernel/{postinst,postrm}.d/` for
+hooks a package ships. The second directory is where systemd-boot installs
+`zz-systemd-boot` from forky onwards, so a package that runs only the first
+one produces an unbootable install there. Both scripts dispatch through
+`linux-run-hooks(1)`, which runs the two directories in the documented order
+and sets `DEB_MAINT_PARAMS`.
+
+The image package `Pre-Depends: linux-base (>= 4.12~)`, the release that ships
+that command, as Debian's own `linux-image` packages do — it runs from our
+postinst, so it has to be configured before we are. It is a plain field in
+`control.in`, not generated per suite: every suite in the build matrix carries
+4.12 or later (trixie has 4.12.1, forky and sid are ahead of it, resolute has
+4.15ubuntu5), so there is no suite to make an exception for. A suite whose
+`linux-base` predates 4.12 — noble, say, which the matrix does not build —
+refuses the package outright rather than installing it and silently skipping
+the hooks.
+
+There is no `run-parts` fallback, deliberately. One that ran `/etc/kernel/*.d/`
+alone would reintroduce the silent unbootable install on any system that got
+past the pre-dependency, which is the failure this arrangement exists to
+prevent; the postinst therefore calls the command unguarded, as Debian's does.
+The postrm is the exception and tests for it first: `Pre-Depends` holds while
+the package is installed, not while it is being removed, since dpkg may remove
+`linux-base` in the same run. It warns and carries on there, again as Debian's
+does — the cost of a skipped hook at removal is a stale bootloader entry, not
+an unbootable system, and a kernel must always be removable.
+
+Each script is generated at build time from its `debian/linux-image.<script>.in`
+template, with `@KVER@` substituted for the kernel release, so every script
+names its own kernel version rather than deriving it from the package name at
+run time. `override_dh_installdeb` in `debian/rules` substitutes each template
+that exists into `debian/linux-image-<KVER>.<script>`; adding a `prerm` is a
+matter of adding `debian/linux-image.prerm.in`.
 
 ### `linux-headers-<KVER>` — Kernel headers
 
@@ -368,11 +405,22 @@ script (`scripts/package/builddeb`). Debug symbols are installed under
 both can be installed simultaneously.
 
 Installed paths:
-- `/usr/lib/debug/lib/modules/<KVER>/` — per-module debug symbols extracted via `objcopy --only-keep-debug`
+- `/usr/lib/debug/lib/modules/<KVER>/kernel/…` — per-module debug symbols extracted via `objcopy --only-keep-debug`, mirroring where each in-tree module installs
+- `/usr/lib/debug/lib/modules/<KVER>/extra/…` — the same for bundled DKMS modules
+- `/usr/lib/debug/.build-id/<xx>/<rest>.debug` → symlink to the module's debug file, one per module
 - `/usr/lib/debug/lib/modules/<KVER>/vmlinux` — unstripped vmlinux (for `perf`, `crash`)
 - `/usr/lib/debug/boot/vmlinux-<KVER>` → symlink to vmlinux (for `systemtap`)
 - `/usr/lib/debug/vmlinux-<KVER>` → symlink to vmlinux (for `kdump-tools`)
 
+A module's debug file is reachable two ways, as in `builddeb`: by the path that
+mirrors the module's own install path, and by build ID. The build-id path is
+what `gdb` and `debuginfod` consult first, and it is the only one that holds
+however the module was addressed — a tool that opens it as
+`/usr/lib/modules/…` rather than `/lib/modules/…` looks under
+`/usr/lib/debug/usr/lib/modules/…`, which the mirrored path does not answer.
+A module built without a build ID is still shipped at the mirrored path; the
+build sends a warning to the log and no symlink is made.
+
 Depends on `linux-image-<KVER>` (same version).
 
 Virtual packages provided: `linux-image-dbg`
diff --git a/debian/control.in b/debian/control.in
index 6c5050bb..1a04bae4 100644
--- a/debian/control.in
+++ b/debian/control.in
@@ -2,19 +2,22 @@ Source: @SRCPKG@
 Section: kernel
 Priority: optional
 Maintainer: Bjordis Collaku <bcollaku@qti.qualcomm.com>
-Standards-Version: 4.6.2
+Standards-Version: 4.7.4
 Build-Depends: debhelper-compat (= 13),
                bc, bison, flex, libssl-dev, libelf-dev, dwarves,
                python3, kmod, cpio, rsync, pkg-config, gcc, make@DKMS_BUILD_DEPENDS@
 Homepage: https://kernel.org
+Vcs-Git: https://github.com/qualcomm-linux/pkg-linux-qcom.git
+Vcs-Browser: https://github.com/qualcomm-linux/pkg-linux-qcom
 Rules-Requires-Root: binary-targets
 
 Package: linux-image-@KVER@
 Architecture: arm64
-Depends: ${misc:Depends}, ${shlibs:Depends}
-Recommends: initramfs-tools | dracut | linux-initramfs-tool
+Pre-Depends: linux-base (>= 4.12~)
+Depends: ${misc:Depends}, ${shlibs:Depends},
+         initramfs-tools | dracut | linux-initramfs-tool
 Suggests: linux-headers-@KVER@
-Provides: linux-image, linux-image-arm64
+Provides: linux-image, linux-image-arm64@DKMS_PROVIDES@
 Description: Qualcomm ARM64 Linux kernel image @KVER@
  Kernel image, modules, and DTBs for kernel release @KVER@ on ARM64
  Qualcomm platforms.
@@ -28,7 +31,7 @@ Description: Qualcomm ARM64 Linux kernel image @KVER@
 
 Package: @BINPKG@
 Architecture: arm64
-Depends: linux-image-@KVER@, ${misc:Depends}
+Depends: linux-image-@KVER@ (= ${binary:Version}), ${misc:Depends}
 Description: Qualcomm ARM64 Linux kernel image (meta-package)
  This meta-package always depends on the latest @BINPKG@ kernel image
  for ARM64 Qualcomm platforms. Installing this package ensures that
@@ -47,7 +50,7 @@ Description: Qualcomm ARM64 Linux kernel headers @KVER@
 
 Package: @HDRPKG@
 Architecture: arm64
-Depends: linux-headers-@KVER@, ${misc:Depends}
+Depends: linux-headers-@KVER@ (= ${binary:Version}), ${misc:Depends}
 Description: Qualcomm ARM64 Linux kernel headers (meta-package)
  This meta-package always depends on the latest @HDRPKG@ kernel headers
  for ARM64 Qualcomm platforms.
diff --git a/debian/linux-image.postinst.in b/debian/linux-image.postinst.in
index d1ed95bd..d7960031 100644
--- a/debian/linux-image.postinst.in
+++ b/debian/linux-image.postinst.in
@@ -1,18 +1,37 @@
 #!/bin/sh
+# postinst for linux-image-@KVER@
+#
+# Generated from debian/linux-image.postinst.in by debian/rules at build time;
+# @KVER@ is substituted with the kernel release (uname -r).
 set -e
 
 KVER="@KVER@"
 
-# Auto-generated code from dh_installmodules (depmod calls) will be inserted here
+# Auto-generated debhelper code (dh_installmodules' depmod call) is inserted
+# here.
 #DEBHELPER#
 
-# Run kernel postinst.d hooks (triggers initramfs generation and bootloader updates)
-if [ "$1" = "configure" ] && [ -d /etc/kernel/postinst.d ]; then
-    echo "linux-image: running /etc/kernel/postinst.d hooks for $KVER..."
+# Run the kernel postinst.d hooks: initramfs generation, bootloader entries.
+#
+# Hooks live in two directories: /etc/kernel/postinst.d for the ones the
+# administrator installs, and /usr/share/kernel/postinst.d for the ones a
+# package ships. systemd-boot's zz-systemd-boot moved to the latter in forky,
+# so running only the /etc directory there leaves the loader entry and
+# loader.conf unwritten and the kernel unbootable.
+#
+# linux-run-hooks(1) runs both directories in the right order and sets
+# DEB_MAINT_PARAMS. It ships in linux-base 4.12, which the package
+# pre-depends on, so it is here whenever this script runs: dpkg configures a
+# pre-dependency before it unpacks us. It is called unguarded for that reason,
+# as Debian's own linux-image postinst calls it. A fallback that ran the /etc
+# directory alone would be worse than none, since it would reintroduce exactly
+# the silent unbootable install described above.
+if [ "$1" = "configure" ]; then
+    echo "linux-image: running kernel postinst.d hooks for $KVER..."
     image_path="/boot/vmlinuz-$KVER"
-    DEB_MAINT_PARAMS="$*" run-parts --verbose --exit-on-error \
-          --arg="$KVER" --arg="$image_path" /etc/kernel/postinst.d
+    linux-run-hooks image postinst "$KVER" "$image_path" -- "$@"
 fi
 
 echo "linux-image: installed kernel $KVER (reboot to use it)."
+
 exit 0
diff --git a/debian/linux-image.postrm b/debian/linux-image.postrm
deleted file mode 100644
index 6bb1e05b..00000000
--- a/debian/linux-image.postrm
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/sh
-set -e
-
-# Auto-generated code from dh_installmodules (depmod calls) will be inserted here
-#DEBHELPER#
-
-# Run kernel postrm.d hooks (includes zz-update-grub)
-# This is the standard Debian way to trigger GRUB updates after kernel removal
-if [ "$1" = "remove" ] && [ -d /etc/kernel/postrm.d ]; then
-    # Extract the kernel version (uname -r) from the package name.
-    # Package name format: linux-image-<kver>-qcom
-    # Strip the "linux-image-" prefix and the trailing "-qcom" flavour suffix.
-    KVER=$(echo "$DPKG_MAINTSCRIPT_PACKAGE" | sed 's/^linux-image-//' | sed 's/-qcom$//')
-    if [ -n "$KVER" ]; then
-        echo "linux-image: running kernel postrm.d hooks for $KVER..."
-        image_path="/boot/vmlinuz-$KVER"
-        DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg="$KVER" \
-              --arg="$image_path" /etc/kernel/postrm.d || true
-    fi
-fi
-exit 0
diff --git a/debian/linux-image.postrm.in b/debian/linux-image.postrm.in
new file mode 100644
index 00000000..b6b3c9eb
--- /dev/null
+++ b/debian/linux-image.postrm.in
@@ -0,0 +1,43 @@
+#!/bin/sh
+# postrm for linux-image-@KVER@
+#
+# Generated from debian/linux-image.postrm.in by debian/rules at build time;
+# @KVER@ is substituted with the kernel release (uname -r).
+set -e
+
+KVER="@KVER@"
+
+# Auto-generated debhelper code (dh_installmodules' depmod call) is inserted
+# here.
+#DEBHELPER#
+
+# Run the kernel postrm.d hooks: zz-update-grub, and on forky zz-systemd-boot,
+# which drops the removed kernel's loader entry. This is the standard Debian
+# way to tidy the bootloader after a kernel is removed.
+#
+# The hooks live in the same two directories as the postinst.d ones and are
+# dispatched the same way, through linux-run-hooks(1). See the postinst for
+# the full reasoning.
+#
+# Unlike the postinst, this one tests for the command first. Pre-Depends
+# guarantees linux-base while the package is installed, not while it is being
+# removed: dpkg is free to remove linux-base in the same run, and on purge it
+# may already be gone. Debian's own linux-image postrm guards it for the same
+# reason and warns rather than failing, so that a kernel can always be
+# removed; the cost of a missing hook run here is a stale bootloader entry,
+# not an unbootable system.
+#
+# A failing hook must not fail the removal either -- dpkg would leave the
+# package half-removed -- so the dispatch is allowed to fail.
+if [ "$1" = "remove" ]; then
+    image_path="/boot/vmlinuz-$KVER"
+    if command -v linux-run-hooks >/dev/null 2>&1; then
+        echo "linux-image: running kernel postrm.d hooks for $KVER..."
+        linux-run-hooks image postrm "$KVER" "$image_path" -- "$@" || true
+    else
+        echo "linux-image: linux-base is gone; skipping the postrm.d hooks for $KVER." >&2
+        echo "linux-image: a bootloader entry for $KVER may be left behind." >&2
+    fi
+fi
+
+exit 0
diff --git a/debian/linux-image.preinst b/debian/linux-image.preinst
deleted file mode 100644
index 9493cfe6..00000000
--- a/debian/linux-image.preinst
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-set -e
-
-# preinst for linux-image-<kver>-qcom
-#
-# Each kernel version is a uniquely named package (the version is part of the
-# package name), so dpkg handles coexistence of multiple installed kernels
-# automatically. There is no need to remove other kernel versions here.
-#
-# Kernels should only be removed explicitly by the administrator:
-#   sudo dpkg -r linux-image-<kver>-qcom
-# or via apt autoremove when the package is no longer needed.
-#
-# No pre-installation cleanup is performed.
-exit 0
diff --git a/debian/linux-image.preinst.in b/debian/linux-image.preinst.in
new file mode 100644
index 00000000..eafaf3de
--- /dev/null
+++ b/debian/linux-image.preinst.in
@@ -0,0 +1,20 @@
+#!/bin/sh
+# preinst for linux-image-@KVER@
+#
+# Generated from debian/linux-image.preinst.in by debian/rules at build time;
+# @KVER@ is substituted with the kernel release (uname -r).
+set -e
+
+# Auto-generated debhelper code is inserted here.
+#DEBHELPER#
+
+# Nothing to do before unpacking. Each kernel version is a uniquely named
+# package (the version is part of the package name), so dpkg handles the
+# coexistence of multiple installed kernels on its own; there is no need to
+# remove other kernel versions here.
+#
+# Kernels are removed explicitly by the administrator:
+#   sudo dpkg -r linux-image-@KVER@
+# or by apt autoremove once the package is no longer needed.
+
+exit 0
diff --git a/debian/rules b/debian/rules
index 37405e8a..fdf13ef6 100755
--- a/debian/rules
+++ b/debian/rules
@@ -29,6 +29,11 @@ PARALLEL ?= $(shell nproc)
 # objcopy for debug symbol extraction (cross-compile aware).
 OBJCOPY ?= $(shell which aarch64-linux-gnu-objcopy 2>/dev/null || which objcopy 2>/dev/null || echo objcopy)
 
+# readelf for reading module build IDs. It parses ELF directly and is not tied
+# to a target, so the host one would do; resolved the same way as OBJCOPY above
+# to match how the kernel's own scripts/package/builddeb picks its READELF.
+READELF ?= $(shell which aarch64-linux-gnu-readelf 2>/dev/null || which readelf 2>/dev/null || echo readelf)
+
 # dkms identifies architectures in uname -m vocabulary (aarch64), unlike the
 # kbuild ARCH token above (arm64). The distinction matters for dkms.conf
 # BUILD_EXCLUSIVE_ARCH gates, which match against this value.
@@ -234,6 +239,20 @@ prepare:
 		DKMS_BUILD_DEPENDS=", dkms$$DKMS_BUILD_DEPENDS"; \
 	fi; \
 	\
+	# Provides tail on the image package, appended the same way: the module a
+	# -dkms package would build for this kernel is already in the image, in
+	# /lib/modules/<kver>/extra/, so a dependency on that -dkms package is
+	# satisfied by installing this kernel. The entries are deliberately
+	# unversioned -- the version a dkms source carries is its module version,
+	# not the version of the package that shipped it, so there is nothing
+	# truthful to put in a version clause.
+	DKMS_PROVIDES=""; \
+	if [ -n "$$DKMS_LIST" ]; then \
+		for mod in $$DKMS_LIST; do \
+			DKMS_PROVIDES="$$DKMS_PROVIDES, $$mod-dkms"; \
+		done; \
+	fi; \
+	\
 	# ── Substitute templates ──────────────────────────────────────────────────
 	sed \
 		-e "s|@SRCPKG@|$(SRCPKG)|g" \
@@ -242,6 +261,7 @@ prepare:
 		-e "s|@KVER@|$$KVER_RESOLVED|g" \
 		-e "s|@PKGVER@|$$PKG_VERSION|g" \
 		-e "s|@DKMS_BUILD_DEPENDS@|$$DKMS_BUILD_DEPENDS|g" \
+		-e "s|@DKMS_PROVIDES@|$$DKMS_PROVIDES|g" \
 		debian/control.in > debian/control; \
 	sed \
 		-e "s|@SRCPKG@|$(SRCPKG)|g" \
@@ -483,6 +503,17 @@ override_dh_auto_install:
 	cp -a "$$MODULE_LDS" "$$HDRDIR/arch/arm64/kernel/" 2>/dev/null || true; \
 	\
 	# Debug symbols for linux-image-<BASE>-dbg package.
+	#
+	# Each module's debug file is written twice over: once at the path that
+	# mirrors where the module installs (/usr/lib/debug + /lib/modules/<ver>/
+	# kernel/<path>), and once as a /usr/lib/debug/.build-id/xx/yyy.debug
+	# symlink to it. Both are what scripts/package/builddeb produces.
+	#
+	# The build-id path is the one gdb, debuginfod and gdb-add-index consult
+	# first, and the only one that does not depend on how the module was
+	# addressed: a tool that opens it as /usr/lib/modules/... rather than
+	# /lib/modules/... looks under /usr/lib/debug/usr/lib/modules/..., which
+	# the mirrored path alone does not answer.
 	echo "Installing debug symbols to $$DBG_PKG"; \
 	MODULES_ORDER="modules.order"; \
 	[ -n "$$OBJ_DIR" ] && MODULES_ORDER="$$OBJ_DIR/modules.order"; \
@@ -496,6 +527,15 @@ override_dh_auto_install:
 			mkdir -p "$${dbg%/*}"; \
 			$(OBJCOPY) --only-keep-debug "$$src_mod" "$$dbg" 2>/dev/null || \
 				cp -a "$$src_mod" "$$dbg"; \
+			BUILDID=$$($(READELF) -n "$$src_mod" 2>/dev/null | \
+			           sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p'); \
+			if [ -n "$$BUILDID" ]; then \
+				link="$$DBG_PKG/usr/lib/debug/.build-id/$$BUILDID.debug"; \
+				mkdir -p "$${link%/*}"; \
+				ln -sf --relative "$$dbg" "$$link"; \
+			else \
+				echo "Warning: no build ID in $$mod — no .build-id symlink for it"; \
+			fi; \
 		done < "$$MODULES_ORDER"; \
 	else \
 		echo "Warning: modules.order not found — skipping per-module debug symbol extraction"; \
@@ -545,20 +585,18 @@ override_dh_installmodules:
 override_dh_installdeb:
 	# Generate versioned maintainer scripts from templates using BASE (uname -r).
 	# The binary package name is linux-image-<BASE>, derived from kernel.release.
-	# dh_installmodules injects the depmod snippet at #DEBHELPER# in the postinst.
+	# Every maintainer script is a debian/linux-image.<script>.in template with
+	# @KVER@ substituted, so each one can name its own kernel release; scripts
+	# with no template are simply not shipped.
+	# dh_installmodules injects the depmod snippet at #DEBHELPER# in them.
 	@BASE=$$(cat $(KREL_FILE)); \
 	INST_PKG="linux-image-$$BASE"; \
 	\
-	# Generate debian/linux-image-<BASE>.postinst from template.
-	sed "s/@KVER@/$$BASE/g" debian/linux-image.postinst.in > debian/$$INST_PKG.postinst; \
-	chmod 755 debian/$$INST_PKG.postinst; \
-	\
-	# Copy static maintainer scripts to versioned names.
-	for script in preinst postrm prerm; do \
-		if [ -f debian/linux-image.$$script ]; then \
-			cp debian/linux-image.$$script debian/$$INST_PKG.$$script; \
-			chmod 755 debian/$$INST_PKG.$$script; \
-		fi; \
+	for script in preinst postinst prerm postrm; do \
+		template="debian/linux-image.$$script.in"; \
+		[ -f "$$template" ] || continue; \
+		sed "s/@KVER@/$$BASE/g" "$$template" > debian/$$INST_PKG.$$script; \
+		chmod 755 debian/$$INST_PKG.$$script; \
 	done; \
 	\
 	dh_installmodules; \
diff --git a/debian/scripts/bundle-dkms-modules.sh b/debian/scripts/bundle-dkms-modules.sh
index 28bad3b6..a45f6318 100755
--- a/debian/scripts/bundle-dkms-modules.sh
+++ b/debian/scripts/bundle-dkms-modules.sh
@@ -555,11 +555,40 @@ for name in $DKMS_MODULES; do
             exit 1
         fi
 
+        # Stage 2c: link the debug file into /usr/lib/debug/.build-id/, the way
+        # debian/rules does for in-tree modules. gdb and debuginfod look a
+        # debug file up by build ID before they try the path-mirrored copy, and
+        # the build-id path is the only one that does not depend on how the
+        # module was addressed. Read the ID from the module rather than the
+        # extracted file, and before Stage 3 strips it -- --strip-debug keeps
+        # the note, but there is no reason to depend on that.
+        #
+        # readelf parses ELF directly and is not tied to a target, so the host
+        # one reads an arm64 module fine; the assertion above already relies on
+        # that.
+        if ! dbg_notes="$(readelf -n "$dest" 2>&1)"; then
+            log_error "readelf failed reading the build ID of $b"
+            log_error "  module: $dest"
+            printf '%s\n' "$dbg_notes" | sed 's/^/  | /' >&2
+            exit 1
+        fi
+        buildid="$(sed -n 's@^.*Build ID: \(..\)\(.*\)@\1/\2@p' <<< "$dbg_notes")"
+        if [[ -n "$buildid" ]]; then
+            link="$DBG_PKG_DIR/usr/lib/debug/.build-id/$buildid.debug"
+            mkdir -p "${link%/*}"
+            ln -sf --relative "$dbg" "$link"
+        else
+            log_warn "No build ID in $b; skipping its .build-id symlink"
+        fi
+
         # Stage 3: strip the shipped copy in place
         strip --strip-debug "$dest"
 
         log_info "  Installed: $dest (stripped)"
         log_info "  Debug:     $dbg"
+        if [[ -n "$buildid" ]]; then
+            log_info "  Build ID:  ${buildid/\//}"
+        fi
 
     done < <(printf '%s\n' "$kos")