diff --git a/os/mkosi/components/kernel/kernel.config b/os/mkosi/components/kernel/kernel.config
index 767d34f45..6384ceac0 100644
--- a/os/mkosi/components/kernel/kernel.config
+++ b/os/mkosi/components/kernel/kernel.config
@@ -207,7 +207,16 @@ CONFIG_NFT_LIMIT=m
 CONFIG_NFT_REJECT=m
 CONFIG_NFT_REJECT_INET=m
 CONFIG_NFT_HASH=m
+# SELinux, matching dstack-docker.cfg symbol for symbol. CONFIG_SECURITY comes
+# from x86_64_defconfig here, but the rest of the chain is asserted because two
+# separate steps fail silently: SELINUX needs SECURITY_NETWORK && AUDIT, and an
+# LSM only registers if CONFIG_LSM names it, which depends on which
+# DEFAULT_SECURITY_* is chosen.
+CONFIG_SECURITY_NETWORK=y
+CONFIG_AUDIT=y
 CONFIG_SECURITY_SELINUX=y
+CONFIG_DEFAULT_SECURITY_SELINUX=y
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_XFRM=y
 CONFIG_XFRM_USER=y
diff --git a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg
index df656498c..1a23f7ecf 100644
--- a/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg
+++ b/os/yocto/layers/meta-dstack/recipes-kernel/linux/files/dstack-docker.cfg
@@ -20,7 +20,28 @@ CONFIG_BPF_SYSCALL=y
 CONFIG_IP_VS=m
 CONFIG_SECCOMP=y
 CONFIG_SECCOMP_FILTER=y
+# SELinux. This line alone never took effect: the kernel is built from the
+# linux-yocto "tiny" type, which leaves CONFIG_SECURITY off, and SELINUX is
+# "depends on SECURITY_NETWORK && AUDIT && NET && INET" with SECURITY_NETWORK in
+# turn depending on SECURITY. So every image this fragment produced ran without
+# SELinux while claiming otherwise, and os/mkosi -- which starts from
+# x86_64_defconfig -- had it.
+CONFIG_SECURITY=y
+CONFIG_SECURITY_NETWORK=y
+CONFIG_AUDIT=y
 CONFIG_SECURITY_SELINUX=y
+# Compiling it in is still not enough, and the second failure is silent too: an
+# LSM only registers if CONFIG_LSM names it, and that string's default is picked
+# by DEFAULT_SECURITY_*. Enabling SECURITY without naming a default lands on
+# DEFAULT_SECURITY_DAC, whose list is
+# "landlock,lockdown,yama,loadpin,safesetid,ipe,bpf" -- no selinux -- so the
+# hooks would build and never initialize.
+CONFIG_DEFAULT_SECURITY_SELINUX=y
+# The resulting order is asserted rather than left to a default, in both
+# backends, so neither a defconfig change nor a new DEFAULT_SECURITY_* branch
+# can drop selinux without failing the build. Entries for LSMs that are not
+# compiled in are ignored by the kernel.
+CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,selinux,smack,tomoyo,apparmor,ipe,bpf"
 CONFIG_VLAN_8021Q=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_XFRM=y