diff --git a/lmn-client.yml b/lmn-client.yml
index 6e89ca8..76e22c7 100644
--- a/lmn-client.yml
+++ b/lmn-client.yml
@@ -110,6 +110,25 @@
         ansible_board_vendor == "LENOVO" and
         (ansible_board_name == "312D" or ansible_board_name == "312A")
 
+## Temporarily fix boot order
+    - name: Make sure kernel package -16 is available
+      ansible.builtin.apt:
+        name: linux-image-6.1.0-16-amd64
+        state: present
+
+    - name: Set 6.1.0-16 as default kernel in grub
+      lineinfile:
+        dest: /etc/default/grub
+        regexp: '^(GRUB_DEFAULT=).*'
+        line: '\g<1>"Advanced options for Debian GNU/Linux>Debian GNU/Linux, with Linux 6.1.0-16-amd64"'
+        backrefs: yes
+      notify: Run update-grub
+
+    - name: Remove "unattended-upgrades" package
+      ansible.builtin.apt:
+        name: unattended-upgrades
+        state: absent
+
 ## Clean up stuff from obsolete/faulty tasks:
     - name: Remove virtiofs service
       file:
diff --git a/roles/lmn_kde/tasks/main.yml b/roles/lmn_kde/tasks/main.yml
index 669d442..87317c4 100644
--- a/roles/lmn_kde/tasks/main.yml
+++ b/roles/lmn_kde/tasks/main.yml
@@ -130,15 +130,16 @@
     replace: '"quiet splash"'
   notify: Run update-grub
 
-- name: Protect grub menu entries
+- name: Protect editing grub menu entries
   blockinfile:
     path: /etc/grub.d/40_custom
     block: |
       set superusers='root'
+      export superusers
       password_pbkdf2 root {{ grub_pwd }}
   notify: Run update-grub
 
-- name: Allow booting default entry
+- name: Allow booting grub menu entries
   lineinfile:
     dest: /etc/grub.d/10_linux
     line: CLASS="${CLASS} --unrestricted"
@@ -146,6 +147,25 @@
     firstmatch: true
   notify: Run update-grub
 
+## FIXME
+#- name: Grub timeout
+#  lineinfile:
+#    dest: /etc/default/grub
+#    line: 'GRUB_DISABLE_SUBMENU=true'
+#    insertafter: '^GRUB_TIMEOUT=.*'
+#  notify: Run update-grub
+#
+## then remove the task below:
+
+##  original line: echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"
+- name: Allow switch to advanced menu
+  replace:
+    path: /etc/grub.d/10_linux
+#    regexp: '^(\s+echo .+ \"Advanced options for %s\" \"\${OS}\" | grub_quote\).) (\\\$menuentry_id_option.+ {\")$'
+    regexp: '^(\s+echo \"submenu .+ \"Advanced options for %s\".+ grub_quote\).) (..menuentry_id_option.+{\")$'
+    replace: '\1 --unrestricted \2'
+  notify: Run update-grub
+
 - name: Grub timeout
   lineinfile:
     dest: /etc/default/grub