diff --git a/main/linux-postmarketos-stable/APKBUILD b/main/linux-postmarketos-stable/APKBUILD
index c555fd174..365903ea4 100644
--- a/main/linux-postmarketos-stable/APKBUILD
+++ b/main/linux-postmarketos-stable/APKBUILD
@@ -9,7 +9,7 @@ case $pkgver in
 	*.*.*)	_kernver=${pkgver%.*};;
 	*.*) _kernver=$pkgver;;
 esac
-pkgrel=3
+pkgrel=4
 
 arch="x86_64 armhf aarch64"
 pkgdesc="Linux for pmOS supported chipsets (stable)"
@@ -193,7 +193,7 @@ dev() {
 }
 
 sha512sums="77e43a02d766c3d73b7e25c4aafb2e931d6b16e870510c22cef0cdb05c3acb7952b8908ebad12b10ef982c6efbe286364b1544586e715cf38390e483927904d8  linux-4.14.tar.xz
-7de482169eb64cca001c298091471d803421dfef5835fa9a693840bd96083bdc42bc12a5217ececb5780ac285cf23674f2bd008183e651b81a7fc2882b819f01  config-postmarketos-stable.armhf
-f7dcf05c3c3042c6105748bcbe60ff8c02fac91c7de260a51b568c983df7f2a69c2bde6ebc3ddc4b7283e4aba7e1a8b0e9e4baff6ab863553dc3767679f54f62  config-postmarketos-stable.aarch64
-d1e6ca8faee80641a2e882b3b9b0009b05a73adee8e939ace17be7879f8a87f4f2e7cb7bbbb9590e9b6c1491ed076505dbef599c0dc9e71fe71a8d451a7b635e  config-postmarketos-stable.x86_64
+7e4485a97ca37db7d071ebafa29450c2f307b51d48dac5c9f947d2f33c3194b1263f265031bbb502ac1d94039f0779d9528ef24491fa83260b9b78fcfe3c6c46  config-postmarketos-stable.armhf
+5e3c7d569b6a246ed5873afb088dbcd533cb1074f13a030292af41214a704ea08d9c5505b113429ded57849271c121bfef1b7771cb3051d2ac46808da13afa45  config-postmarketos-stable.aarch64
+9b7ae9e35731675db311aea9fe45b0e1ecc97cc40edc1ed7b179945e49d5656f26706c7fbf76a5308b0f480831adcfcff2777cb024c214c2e7a53b5ef0a15cd0  config-postmarketos-stable.x86_64
 8085944e5b8d49b07075776a1604a25ba87efe8b5a8a1a276a75dc47a87de4e487e72d9ace605166be977340b81a10a3cbc25c84b857509da8bba6d9184513fa  patch-4.14.9.xz"
diff --git a/main/linux-postmarketos-stable/config-postmarketos-stable.aarch64 b/main/linux-postmarketos-stable/config-postmarketos-stable.aarch64
index d382b7a76..5fc6af0ee 100644
--- a/main/linux-postmarketos-stable/config-postmarketos-stable.aarch64
+++ b/main/linux-postmarketos-stable/config-postmarketos-stable.aarch64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 4.14.0 Kernel Configuration
+# Linux/arm64 4.14.9 Kernel Configuration
 #
 CONFIG_ARM64=y
 CONFIG_64BIT=y
@@ -736,12 +736,12 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_IP_PNP_RARP is not set
 # CONFIG_NET_IPIP is not set
 # CONFIG_NET_IPGRE_DEMUX is not set
-CONFIG_NET_IP_TUNNEL=m
+CONFIG_NET_IP_TUNNEL=y
 # CONFIG_IP_MROUTE is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_UDP_TUNNEL is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=y
+CONFIG_NET_FOU=y
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
@@ -779,7 +779,7 @@ CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_SIT_6RD is not set
 CONFIG_IPV6_NDISC_NODETYPE=y
 # CONFIG_IPV6_TUNNEL is not set
-# CONFIG_IPV6_FOU is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_FOU_TUNNEL is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
@@ -1656,6 +1656,8 @@ CONFIG_NET_CORE=y
 CONFIG_MACVLAN=m
 CONFIG_MACVTAP=m
 # CONFIG_VXLAN is not set
+# CONFIG_GENEVE is not set
+# CONFIG_GTP is not set
 # CONFIG_MACSEC is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
@@ -3909,7 +3911,6 @@ CONFIG_HID_CHERRY=y
 CONFIG_HID_CHICONY=y
 # CONFIG_HID_PRODIKEYS is not set
 # CONFIG_HID_CMEDIA is not set
-# CONFIG_HID_CP2112 is not set
 CONFIG_HID_CYPRESS=y
 # CONFIG_HID_DRAGONRISE is not set
 # CONFIG_HID_EMS_FF is not set
diff --git a/main/linux-postmarketos-stable/config-postmarketos-stable.armhf b/main/linux-postmarketos-stable/config-postmarketos-stable.armhf
index 58fb4a8b9..1486ca924 100644
--- a/main/linux-postmarketos-stable/config-postmarketos-stable.armhf
+++ b/main/linux-postmarketos-stable/config-postmarketos-stable.armhf
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm 4.14.0 Kernel Configuration
+# Linux/arm 4.14.9 Kernel Configuration
 #
 CONFIG_ARM=y
 CONFIG_ARM_HAS_SG_CHAIN=y
@@ -221,6 +221,7 @@ CONFIG_OPROFILE=m
 CONFIG_HAVE_OPROFILE=y
 CONFIG_KPROBES=y
 # CONFIG_JUMP_LABEL is not set
+CONFIG_OPTPROBES=y
 # CONFIG_UPROBES is not set
 # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
@@ -791,13 +792,13 @@ CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IP_TUNNEL=m
+CONFIG_NET_IP_TUNNEL=y
 # CONFIG_NET_IPGRE is not set
 # CONFIG_IP_MROUTE is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_UDP_TUNNEL is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=y
+CONFIG_NET_FOU=y
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -839,7 +840,7 @@ CONFIG_IPV6_SIT=m
 CONFIG_IPV6_NDISC_NODETYPE=y
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_IPV6_GRE is not set
-# CONFIG_IPV6_FOU is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_FOU_TUNNEL is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
@@ -894,7 +895,7 @@ CONFIG_NF_NAT_SIP=m
 # CONFIG_NF_NAT_TFTP is not set
 # CONFIG_NF_NAT_REDIRECT is not set
 # CONFIG_NF_TABLES is not set
-CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XTABLES=y
 
 #
 # Xtables combined modules
@@ -1575,6 +1576,8 @@ CONFIG_NET_CORE=y
 # CONFIG_NET_TEAM is not set
 # CONFIG_MACVLAN is not set
 # CONFIG_VXLAN is not set
+# CONFIG_GENEVE is not set
+# CONFIG_GTP is not set
 # CONFIG_MACSEC is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
@@ -3434,7 +3437,6 @@ CONFIG_HID_GENERIC=m
 # CONFIG_HID_CORSAIR is not set
 # CONFIG_HID_PRODIKEYS is not set
 # CONFIG_HID_CMEDIA is not set
-# CONFIG_HID_CP2112 is not set
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_DRAGONRISE is not set
 # CONFIG_HID_EMS_FF is not set
diff --git a/main/linux-postmarketos-stable/config-postmarketos-stable.x86_64 b/main/linux-postmarketos-stable/config-postmarketos-stable.x86_64
index 80dee93dd..9c29b2f78 100644
--- a/main/linux-postmarketos-stable/config-postmarketos-stable.x86_64
+++ b/main/linux-postmarketos-stable/config-postmarketos-stable.x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86_64 4.14.0 Kernel Configuration
+# Linux/x86_64 4.14.9 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -243,6 +243,7 @@ CONFIG_HAVE_OPROFILE=y
 CONFIG_OPROFILE_NMI_TIMER=y
 CONFIG_KPROBES=y
 # CONFIG_JUMP_LABEL is not set
+CONFIG_OPTPROBES=y
 # CONFIG_UPROBES is not set
 # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
@@ -313,6 +314,7 @@ CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
 CONFIG_STRICT_KERNEL_RWX=y
 CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
 CONFIG_STRICT_MODULE_RWX=y
+CONFIG_ARCH_HAS_REFCOUNT=y
 # CONFIG_REFCOUNT_FULL is not set
 
 #
@@ -757,13 +759,13 @@ CONFIG_IP_PNP_BOOTP=y
 CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IP_TUNNEL=m
+CONFIG_NET_IP_TUNNEL=y
 # CONFIG_NET_IPGRE is not set
 # CONFIG_IP_MROUTE is not set
 # CONFIG_SYN_COOKIES is not set
 # CONFIG_NET_IPVTI is not set
-# CONFIG_NET_UDP_TUNNEL is not set
-# CONFIG_NET_FOU is not set
+CONFIG_NET_UDP_TUNNEL=y
+CONFIG_NET_FOU=y
 # CONFIG_NET_FOU_IP_TUNNELS is not set
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -805,7 +807,7 @@ CONFIG_IPV6_SIT=m
 CONFIG_IPV6_NDISC_NODETYPE=y
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_IPV6_GRE is not set
-# CONFIG_IPV6_FOU is not set
+CONFIG_IPV6_FOU=m
 # CONFIG_IPV6_FOU_TUNNEL is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_IPV6_MROUTE is not set
@@ -1689,6 +1691,8 @@ CONFIG_NET_CORE=y
 # CONFIG_NET_TEAM is not set
 # CONFIG_MACVLAN is not set
 # CONFIG_VXLAN is not set
+# CONFIG_GENEVE is not set
+# CONFIG_GTP is not set
 # CONFIG_MACSEC is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
@@ -3607,7 +3611,6 @@ CONFIG_HID_GENERIC=m
 # CONFIG_HID_CORSAIR is not set
 # CONFIG_HID_PRODIKEYS is not set
 # CONFIG_HID_CMEDIA is not set
-# CONFIG_HID_CP2112 is not set
 # CONFIG_HID_CYPRESS is not set
 # CONFIG_HID_DRAGONRISE is not set
 # CONFIG_HID_EMS_FF is not set
@@ -5054,8 +5057,7 @@ CONFIG_DEBUG_FS=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_SECTION_MISMATCH is not set
 CONFIG_SECTION_MISMATCH_WARN_ONLY=y
-CONFIG_FRAME_POINTER=y
-# CONFIG_STACK_VALIDATION is not set
+CONFIG_STACK_VALIDATION=y
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
 # CONFIG_MAGIC_SYSRQ is not set
 CONFIG_DEBUG_KERNEL=y
@@ -5226,9 +5228,9 @@ CONFIG_DEFAULT_IO_DELAY_TYPE=0
 # CONFIG_DEBUG_NMI_SELFTEST is not set
 CONFIG_X86_DEBUG_FPU=y
 # CONFIG_PUNIT_ATOM_DEBUG is not set
-CONFIG_FRAME_POINTER_UNWINDER=y
-# CONFIG_ORC_UNWINDER is not set
-# CONFIG_GUESS_UNWINDER is not set
+CONFIG_UNWINDER_ORC=y
+# CONFIG_UNWINDER_FRAME_POINTER is not set
+# CONFIG_UNWINDER_GUESS is not set
 
 #
 # Security options
diff --git a/main/wireguard-postmarketos-stable/APKBUILD b/main/wireguard-postmarketos-stable/APKBUILD
new file mode 100644
index 000000000..1815889e7
--- /dev/null
+++ b/main/wireguard-postmarketos-stable/APKBUILD
@@ -0,0 +1,46 @@
+_flavor=postmarketos-stable
+_kpkg=linux-$_flavor
+_kver=4.14.9
+
+# we must match up _toolsrel with wireguard-tools
+_ver=0.0.20180202
+_toolsrel=0
+
+_kpkgver="$_kver-r$_kpkgrel"
+_toolsver="$_ver-r$toolsrel"
+_abi_release=${_kver}
+
+pkgname=wireguard-${_flavor}
+pkgver=4.14.9
+pkgrel=0
+pkgdesc="Next generation secure network tunnel: kernel modules for $_flavor"
+arch=all
+url='https://www.wireguard.com'
+license="GPL-2.0"
+depends="linux-postmarketos-stable"
+makedepends="linux-postmarketos-stable-dev libmnl-dev libelf-dev elfutils-libelf"
+install_if="wireguard-tools=$_toolsver linux-postmarketos-stable=$_kpkgver"
+options="!check"
+source="https://git.zx2c4.com/WireGuard/snapshot/WireGuard-$_ver.tar.xz"
+builddir="$srcdir"/WireGuard-$_ver
+
+build() {
+	cd "$builddir"
+	# only building module: see wireguard-tools for userspace
+	unset LDFLAGS
+	make -C src/ \
+		KERNELDIR=/lib/modules/${_abi_release}/build \
+		module
+}
+
+package() {
+	cd "$builddir/src"
+
+	local module=
+	for module in *.ko; do
+		install -v -D -m644 ${module} \
+			"$pkgdir/lib/modules/$_abi_release/extra/${module}"
+	done
+}
+
+sha512sums="81eb66b2abe3b3013fc7fbc7f6601808d1676f1fa5e7942d0af09e2ec56e91c396ded2b23eece7c63d1b76f6c3209d93b7cdf06c9d30a59e626d08a604a6780a  WireGuard-0.0.20180202.tar.xz"