diff --git a/debian.master/config/annotations b/debian.master/config/annotations
index 34cf2ff8e0df..9422a0698bcc 100644
--- a/debian.master/config/annotations
+++ b/debian.master/config/annotations
@@ -4450,8 +4450,6 @@ CONFIG_MEMORY                                   policy<{'amd64': 'y', 'arm64': '
 CONFIG_ARM_PL172_MPMC                           policy<{'arm64': 'm', 'armhf': 'm'}>
 CONFIG_BRCMSTB_DPFE                             policy<{'arm64': 'y'}>
 CONFIG_TI_EMIF                                  policy<{'armhf': 'm'}>
-CONFIG_OMAP_GPMC                                policy<{'armhf': 'y', 'arm64': 'y'}>
-CONFIG_OMAP_GPMC_DEBUG                          policy<{'armhf': 'n', 'arm64': 'n'}>
 CONFIG_TI_EMIF_SRAM                             policy<{'armhf-generic': 'm'}>
 CONFIG_FPGA_DFL_EMIF                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
 CONFIG_MVEBU_DEVBUS                             policy<{'armhf': 'y'}>
@@ -4562,8 +4560,6 @@ CONFIG_MTD_ONENAND_OTP                          flag<REVIEW>
 CONFIG_MTD_RAW_NAND                             policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'y', 'ppc64el': 'm', 's390x': '-'}>
 CONFIG_MTD_NAND_DENALI_PCI                      policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
 CONFIG_MTD_NAND_DENALI_DT                       policy<{'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
-CONFIG_MTD_NAND_OMAP2                           policy<{'armhf': 'y', 'arm64': 'm'}>
-CONFIG_MTD_NAND_OMAP_BCH                        policy<{'armhf': 'y', 'arm64': 'y'}>
 CONFIG_MTD_NAND_CAFE                            policy<{'amd64': 'm', 'arm64': 'm', 'armhf': 'm', 'ppc64el': 'm'}>
 CONFIG_MTD_NAND_ORION                           policy<{'armhf': 'm'}>
 CONFIG_MTD_NAND_MARVELL                         policy<{'arm64': 'm', 'armhf': 'm'}>
@@ -4595,8 +4591,6 @@ CONFIG_MTD_NAND_DISKONCHIP_PROBE_ADDRESS        policy<{'amd64': '0', 'arm64': '
 CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE             policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n'}>
 #
 CONFIG_MTD_RAW_NAND                             note<boot essential on arm>
-CONFIG_MTD_NAND_OMAP2                           note<boot essential on arm>
-CONFIG_MTD_NAND_OMAP_BCH                        note<boot essential on arm>
 CONFIG_MTD_NAND_DISKONCHIP_BBTWRITE             note<can be enabled at runtime>
 
 # Menu: Device Drivers >> Memory Technology Device (MTD) support >> NAND >> Raw/Parallel NAND Device Support >> JZ4780 NAND controller
@@ -13870,6 +13864,8 @@ CONFIG_PAGE_TABLE_ISOLATION                     policy<{'amd64': 'y'}>
 CONFIG_INTEL_TXT                                policy<{'amd64': 'y'}>
 CONFIG_HARDENED_USERCOPY                        policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_HARDENED_USERCOPY_PAGESPAN               policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
+CONFIG_HARDEN_BRANCH_HISTORY                    policy<{'armhf': 'y'}>
+CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY          policy<{'arm64': 'y'}>
 CONFIG_FORTIFY_SOURCE                           policy<{'amd64': 'y', 'arm64': 'y', 'armhf': 'y', 'ppc64el': 'y', 's390x': 'y'}>
 CONFIG_STATIC_USERMODEHELPER                    policy<{'amd64': 'n', 'arm64': 'n', 'armhf': 'n', 'ppc64el': 'n', 's390x': 'n'}>
 CONFIG_LSM                                      policy<{'amd64': '"landlock,lockdown,yama,integrity,apparmor"', 'arm64': '"landlock,lockdown,yama,integrity,apparmor"', 'armhf': '"landlock,lockdown,yama,integrity,apparmor"', 'ppc64el': '"landlock,lockdown,yama,integrity,apparmor"', 's390x': '"landlock,lockdown,yama,integrity,apparmor"'}>
diff --git a/debian.master/config/arm64/config.common.arm64 b/debian.master/config/arm64/config.common.arm64
index 8b3741b8bab2..f0cd2a65580c 100644
--- a/debian.master/config/arm64/config.common.arm64
+++ b/debian.master/config/arm64/config.common.arm64
@@ -390,8 +390,6 @@ CONFIG_MTD_BLKDEVS=m
 CONFIG_MTD_BLOCK=m
 CONFIG_MTD_CMDLINE_PARTS=m
 CONFIG_MTD_NAND_CORE=m
-CONFIG_MTD_NAND_OMAP2=m
-CONFIG_MTD_NAND_OMAP_BCH_BUILD=m
 CONFIG_MTD_OF_PARTS=m
 CONFIG_MTD_PHYSMAP_GEMINI=y
 CONFIG_MTD_PHYSMAP_VERSATILE=y
diff --git a/debian.master/config/armhf/config.common.armhf b/debian.master/config/armhf/config.common.armhf
index 91bc47eb1c3f..089c5b797714 100644
--- a/debian.master/config/armhf/config.common.armhf
+++ b/debian.master/config/armhf/config.common.armhf
@@ -378,8 +378,6 @@ CONFIG_MTD_BLKDEVS=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_NAND_CORE=y
-CONFIG_MTD_NAND_OMAP2=y
-CONFIG_MTD_NAND_OMAP_BCH_BUILD=y
 CONFIG_MTD_OF_PARTS=y
 CONFIG_MTD_PHYSMAP_GEMINI=y
 CONFIG_MTD_PHYSMAP_VERSATILE=y
diff --git a/debian.master/config/config.common.ubuntu b/debian.master/config/config.common.ubuntu
index aa5e0218541b..3bc53d3f041e 100644
--- a/debian.master/config/config.common.ubuntu
+++ b/debian.master/config/config.common.ubuntu
@@ -4162,6 +4162,7 @@ CONFIG_HANGCHECK_TIMER=m
 CONFIG_HAPPYMEAL=m
 CONFIG_HARDENED_USERCOPY=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
+CONFIG_HARDEN_BRANCH_HISTORY=y
 CONFIG_HARDEN_BRANCH_PREDICTOR=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
@@ -6313,6 +6314,7 @@ CONFIG_MISDN_L1OIP=m
 CONFIG_MISDN_NETJET=m
 CONFIG_MISDN_SPEEDFAX=m
 CONFIG_MISDN_W6692=m
+CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=y
 # CONFIG_MK8 is not set
 CONFIG_MKISS=m
 CONFIG_MLX4_CORE=m
@@ -6673,7 +6675,9 @@ CONFIG_MTD_NAND_MTK=m
 CONFIG_MTD_NAND_MXC=m
 CONFIG_MTD_NAND_MXIC=m
 CONFIG_MTD_NAND_NANDSIM=m
+CONFIG_MTD_NAND_OMAP2=y
 CONFIG_MTD_NAND_OMAP_BCH=y
+CONFIG_MTD_NAND_OMAP_BCH_BUILD=y
 CONFIG_MTD_NAND_ORION=m
 CONFIG_MTD_NAND_PL35X=m
 CONFIG_MTD_NAND_PLATFORM=m