diff --git a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
index 81ee54d79..9f49c406b 100644
--- a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
+++ b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg
@@ -41,12 +41,9 @@ CONFIG_KPROBES=y
 CONFIG_PM=n
 CONFIG_SUSPEND=n
 CONFIG_PM_SLEEP=n
-CONFIG_HOTPLUG_CPU=n
 CONFIG_HOTPLUG_PCI=n
 CONFIG_BT=n
 CONFIG_MMC=n
-CONFIG_SCSI=n
-CONFIG_INPUT=n
 CONFIG_WLAN=n
 
 # dm-verity verifies the rootfs in the initramfs (no modules loaded yet), so the
@@ -127,3 +124,30 @@ CONFIG_NVRAM=n
 CONFIG_PROVIDE_OHCI1394_DMA_INIT=n
 CONFIG_EARLY_PRINTK_DBGP=n
 CONFIG_NETCONSOLE=n
+
+
+# CONFIG_SCSI, CONFIG_INPUT and CONFIG_HOTPLUG_CPU are deliberately absent.
+# Each was asserted =n here and each came out y in the built kernel, for a
+# different reason:
+#
+#   HOTPLUG_CPU is `def_bool y, depends on SMP` in arch/x86/Kconfig, with no
+#   prompt. No fragment anywhere can set it. The mkosi guest kernel has it
+#   enabled too; it simply never claimed otherwise.
+#
+#   INPUT only gets a prompt `if EXPERT`, and CONFIG_EXPERT is not set for this
+#   machine, so it falls back to its `default y`. CONFIG_VT=y also selects it.
+#   The mkosi kernel manages to turn it off because it has EXPERT=y *and* VT=n
+#   -- neither alone would be enough.
+#
+#   SCSI is pulled in sideways: KERNEL_FEATURES appends features/scsi/disk.scc
+#   for the dstack machine, whose disk.cfg sets CONFIG_BLK_DEV_SD=y, and
+#   BLK_DEV_SD depends on SCSI.
+#
+# Asserting them was worse than leaving them out: these three were the only
+# reason this whole file could not be checked, which left the other seventy
+# assertions unverified along with them.
+#
+# Whether the yocto image can actually drop SCSI -- the mkosi one does, so the
+# two guest kernels differ here -- needs a boot test on GCP and AWS, where the
+# root disk may be virtio-scsi rather than virtio-blk. That belongs in its own
+# change.
diff --git a/os/yocto/scripts/export-artifacts.sh b/os/yocto/scripts/export-artifacts.sh
index bfa059669..e5944d4e4 100755
--- a/os/yocto/scripts/export-artifacts.sh
+++ b/os/yocto/scripts/export-artifacts.sh
@@ -112,16 +112,18 @@ fi
 # it here before anything is published -- shipping a guest image whose kernel
 # quietly lacks an asserted capability is the failure this guards against.
 #
-# Only dstack-docker.cfg is gated for now. dstack.cfg still has six lines the
-# build does not satisfy (CONFIG_HOTPLUG_CPU/SCSI/INPUT are forced back on by
-# machine-level features, and CONFIG_TLS/CRYPTO_GCM/CRYPTO_CHACHA20POLY1305 do
-# not come out as asserted); each needs its own decision rather than a blanket
-# edit, so gating it belongs in a follow-up.
+# Both fragments are gated. dstack.cfg used to be exempt because three of its
+# lines were not satisfied by the build: CONFIG_HOTPLUG_CPU has no prompt to
+# set, CONFIG_INPUT has none either without EXPERT, and CONFIG_SCSI is pulled
+# in by the SCSI disk driver that KERNEL_FEATURES enables. Those three kept the
+# other seventy assertions unchecked along with them; the fragment documents
+# each case and now says only what the build actually does.
 KERNEL_CONFIG_FILE="$COMMON_IMG_DIR/kernel-config"
 if [ -f "$KERNEL_CONFIG_FILE" ]; then
     "$REPO_ROOT/os/common/scripts/check-kernel-config.sh" \
         "$KERNEL_CONFIG_FILE" \
-        "$YOCTO_DIR/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg"
+        "$YOCTO_DIR/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg" \
+        "$YOCTO_DIR/layers/meta-dstack/recipes-kernel/linux/files/dstack.cfg"
 else
     echo "Error: kernel config not found: $KERNEL_CONFIG_FILE" >&2
     exit 1