diff --git a/.gitignore b/.gitignore
index 09d0ccd..57a3494 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 /shots/
 /mockups/
+/kernel/build/
diff --git a/kernel/edid/waveshare-1024x600.bin b/kernel/firmware/edid/waveshare-1024x600.bin
similarity index 100%
rename from kernel/edid/waveshare-1024x600.bin
rename to kernel/firmware/edid/waveshare-1024x600.bin
diff --git a/kernel/firmware/i915/adlp_dmc.bin b/kernel/firmware/i915/adlp_dmc.bin
new file mode 100644
index 0000000..9f8bc1b
Binary files /dev/null and b/kernel/firmware/i915/adlp_dmc.bin differ
diff --git a/kernel/firmware/i915/adlp_guc_70.bin b/kernel/firmware/i915/adlp_guc_70.bin
new file mode 100644
index 0000000..9f062ce
Binary files /dev/null and b/kernel/firmware/i915/adlp_guc_70.bin differ
diff --git a/kernel/firmware/i915/tgl_huc.bin b/kernel/firmware/i915/tgl_huc.bin
new file mode 100644
index 0000000..abe9f1d
Binary files /dev/null and b/kernel/firmware/i915/tgl_huc.bin differ
diff --git a/mkimage b/mkimage
index 0143987..3566efa 100755
--- a/mkimage
+++ b/mkimage
@@ -2,9 +2,9 @@
 set -euo pipefail
 
 repo=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-work=$(dirname "$repo")/kernel
+work=$repo/kernel/build
 src=$work/linux
-fwdir=$work/firmware
+fwdir=$repo/kernel/firmware
 initdir=$work/initramfs
 cpiolist=$work/initramfs.list
 
@@ -21,10 +21,11 @@ keys=(
 )
 
 # Nothing here can be loaded from disk at runtime, so every blob the drivers
-# ask for is linked into the image. The EDID is ours; the rest come from the
-# distro's linux-firmware.
+# ask for is linked into the image, all vendored in kernel/firmware: the EDID
+# is ours, the i915 blobs are pinned copies from linux-firmware. A kernel that
+# starts asking for a different blob fails the build at EXTRA_FIRMWARE.
 edid=edid/waveshare-1024x600.bin
-distrofw=(
+fw=(
 	i915/adlp_dmc.bin
 	i915/adlp_guc_70.bin
 	i915/tgl_huc.bin
@@ -85,20 +86,6 @@ mkdir -p "$initdir"
 go version -m "$initdir/init" | grep -E 'vcs\.(revision|modified)' ||
 	die "no VCS stamp; build from a git checkout so the image is traceable"
 
-say "firmware"
-mkdir -p "$fwdir/$(dirname "$edid")"
-cp "$repo/kernel/$edid" "$fwdir/$edid"
-for f in "${distrofw[@]}"; do
-	mkdir -p "$fwdir/$(dirname "$f")"
-	if [ -e "/lib/firmware/$f" ]; then
-		cp "/lib/firmware/$f" "$fwdir/$f"
-	elif [ -e "/lib/firmware/$f.zst" ]; then
-		zstd -qdf -o "$fwdir/$f" "/lib/firmware/$f.zst"
-	else
-		die "/lib/firmware/$f is missing; install linux-firmware"
-	fi
-done
-
 # The binary is embedded by the kernel link, so it has to exist before make.
 # /dev/console must be in the cpio: the kernel opens it for init's stdio before
 # anything has had a chance to mount devtmpfs over /dev.
@@ -119,7 +106,7 @@ cp "$repo/kernel/config" "$src/.config"
 	--enable EXPERT --disable BLOCK \
 	--enable IXGBE --disable ICE --disable I40E --disable IGC \
 	--enable DRM_LOAD_EDID_FIRMWARE \
-	--set-str EXTRA_FIRMWARE "$edid ${distrofw[*]}" \
+	--set-str EXTRA_FIRMWARE "$edid ${fw[*]}" \
 	--set-str EXTRA_FIRMWARE_DIR "$fwdir" \
 	--set-str INITRAMFS_SOURCE "$cpiolist" \
 	--disable INITRAMFS_COMPRESSION_GZIP --enable INITRAMFS_COMPRESSION_NONE \