diff --git a/os/mkosi/components/kernel/kernel.config b/os/mkosi/components/kernel/kernel.config
index bb2740cef..56999f818 100644
--- a/os/mkosi/components/kernel/kernel.config
+++ b/os/mkosi/components/kernel/kernel.config
@@ -302,3 +302,38 @@ CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 # No IP6_NF_* counterpart to dstack-docker.cfg's: this image has no legacy
 # tables at all, so there is no legacy ip6tables to complete. The nftables
 # frontend synthesises the IPv6 nat table Incus lists, with no module behind it.
+
+# Devices that cannot exist in a CVM. x86_64_defconfig builds these for bare
+# metal, but a dstack guest only ever sees virtio, plus GVE on GCP and ENA on
+# AWS, both enabled above. Leaving the rest in means a host that presents the
+# matching PCI IDs can steer the guest into driver code no deployment uses.
+# Passing a ConnectX NIC through later is an addition here -- CONFIG_MLX5_CORE
+# and the INFINIBAND stack -- not a relaxation of these.
+CONFIG_TIGON3=n
+CONFIG_E100=n
+CONFIG_E1000=n
+CONFIG_E1000E=n
+CONFIG_SKY2=n
+CONFIG_FORCEDETH=n
+CONFIG_8139TOO=n
+CONFIG_R8169=n
+CONFIG_NET_TULIP=n
+
+# Buses and platform glue with no counterpart in a virtual machine.
+CONFIG_PCCARD=n
+CONFIG_AGP=n
+CONFIG_MACINTOSH_DRIVERS=n
+CONFIG_NVRAM=n
+
+# Early-boot debug paths that exist to give an external device access to memory
+# before the kernel is up. PROVIDE_OHCI1394_DMA_INIT enables FireWire DMA
+# specifically so a machine can be debugged over the bus, which is the same
+# primitive an untrusted host would want; EARLY_PRINTK_DBGP is the USB debug
+# port equivalent. Neither is reachable from anything a tenant needs.
+CONFIG_PROVIDE_OHCI1394_DMA_INIT=n
+CONFIG_EARLY_PRINTK_DBGP=n
+
+# NETCONSOLE ships the kernel log to a UDP peer. Inside a CVM that is an
+# egress channel for whatever the log happens to contain, configurable at
+# runtime by root, and nothing in the image uses it.
+CONFIG_NETCONSOLE=n
diff --git a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
index 7d5547101..81ee54d79 100644
--- a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
+++ b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
@@ -103,3 +103,27 @@ CONFIG_FUSE_FS=y
 CONFIG_CUSE=y
 CONFIG_TCG_TPM=y
 CONFIG_TCG_VTPM_PROXY=y
+
+# Devices that cannot exist in a CVM. The linux-yocto baseline builds these for
+# bare metal, but a dstack guest only ever sees virtio, plus gVNIC on GCP and
+# ENA on AWS. Leaving them in means a host that presents the matching PCI IDs
+# can steer the guest into driver code no deployment uses. Kept in step with
+# os/mkosi/components/kernel/kernel.config so both guest kernels carry the same
+# device policy. Passing a ConnectX NIC through later is an addition here --
+# CONFIG_MLX5_CORE and the INFINIBAND stack -- not a relaxation of these.
+CONFIG_TIGON3=n
+CONFIG_E100=n
+CONFIG_E1000=n
+CONFIG_E1000E=n
+CONFIG_SKY2=n
+CONFIG_FORCEDETH=n
+CONFIG_8139TOO=n
+CONFIG_R8169=n
+CONFIG_NET_TULIP=n
+CONFIG_PCCARD=n
+CONFIG_AGP=n
+CONFIG_MACINTOSH_DRIVERS=n
+CONFIG_NVRAM=n
+CONFIG_PROVIDE_OHCI1394_DMA_INIT=n
+CONFIG_EARLY_PRINTK_DBGP=n
+CONFIG_NETCONSOLE=n