From 4c4313fe284f8deb06b7cfb1e061390c2fed5259 Mon Sep 17 00:00:00 2001
From: sempiternal-aurora
 <78790545+sempiternal-aurora@users.noreply.github.com>
Date: Sat, 14 Mar 2026 09:58:58 +1100
Subject: [PATCH] Add separate hardened source

---
 kernel-cachyos/default.nix  | 4 ++--
 kernel-cachyos/update.py    | 2 +-
 kernel-cachyos/version.json | 5 +++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/kernel-cachyos/default.nix b/kernel-cachyos/default.nix
index 9486452..810bffa 100644
--- a/kernel-cachyos/default.nix
+++ b/kernel-cachyos/default.nix
@@ -204,13 +204,13 @@ builtins.listToAttrs (
     })
     (mkCachyKernel {
       pname = "linux-cachyos-hardened";
-      inherit (linuxSources.latest) version src;
+      inherit (linuxSources.hardened) version src;
       configVariant = "linux-cachyos-hardened";
       hardened = true;
     })
     (mkCachyKernel {
       pname = "linux-cachyos-hardened-lto";
-      inherit (linuxSources.latest) version src;
+      inherit (linuxSources.hardened) version src;
       configVariant = "linux-cachyos-hardened";
       hardened = true;
       lto = "thin";
diff --git a/kernel-cachyos/update.py b/kernel-cachyos/update.py
index 613b4aa..57f7f9d 100644
--- a/kernel-cachyos/update.py
+++ b/kernel-cachyos/update.py
@@ -67,7 +67,7 @@ def run_nix_prefetch_url(url: str) -> str:
 
 if __name__ == "__main__":
     versions = {}
-    for variant in ["latest", "lts", "rc"]:
+    for variant in ["latest", "lts", "rc", "hardened"]:
         print(f"{variant=}")
         srctag = get_srctag(variant)
         real_version = "-".join(srctag.split("-")[1:-1])
diff --git a/kernel-cachyos/version.json b/kernel-cachyos/version.json
index 9920b0c..243c498 100644
--- a/kernel-cachyos/version.json
+++ b/kernel-cachyos/version.json
@@ -13,5 +13,10 @@
     "version": "7.0-rc3",
     "url": "https://github.com/CachyOS/linux/releases/download/cachyos-7.0-rc3-1/cachyos-7.0-rc3-1.tar.gz",
     "hash": "sha256-+oWnfrNyTioD00QqvV5mbDoz/h/bjIVe0f+uWekjnFI="
+  },
+  "hardened": {
+    "version": "6.18.17",
+    "url": "https://github.com/CachyOS/linux/releases/download/cachyos-6.18.17-1/cachyos-6.18.17-1.tar.gz",
+    "hash": "sha256-qpTxo8Q+4Bn3vXl7VHOc4vS4WswrlqNDCr9TQZHdC2Y="
   }
 }
\ No newline at end of file