diff --git a/modules b/modules
index 493378cf25a6e6c07f5fc625d1e4bb4f46f3343c..b505cfa5d818e87f63b7d512a797a0bc479b8978 100644
--- a/modules
+++ b/modules
@@ -2,14 +2,14 @@ GLUON_FEEDS='gluon packages routing'
OPENWRT_REPO=https://github.com/openwrt/openwrt.git
OPENWRT_BRANCH=openwrt-24.10
-OPENWRT_COMMIT=4cc1da1e44c28aa153956e179f28b8ee38dc3ac6
+OPENWRT_COMMIT=c06d4df9748aea84b9a4ffcbe51b2e6fff94de1e
PACKAGES_GLUON_REPO=https://github.com/freifunk-gluon/packages.git
PACKAGES_GLUON_COMMIT=3d08b0fee8dc5d96d8bcdb985fad1d5564de4022
PACKAGES_PACKAGES_REPO=https://github.com/openwrt/packages.git
PACKAGES_PACKAGES_BRANCH=openwrt-24.10
-PACKAGES_PACKAGES_COMMIT=dfeae07c2495539f85dbcb4c633eb52c6a9b2e72
+PACKAGES_PACKAGES_COMMIT=9b5ce53f512429910dba62b3b5be18934f9904ce
PACKAGES_ROUTING_REPO=https://github.com/openwrt/routing.git
PACKAGES_ROUTING_BRANCH=openwrt-24.10
diff --git a/package/gluon-core/luasrc/lib/gluon/upgrade/200-wireless b/package/gluon-core/luasrc/lib/gluon/upgrade/200-wireless
index 9550a887d3d2015450918b702915d8d87f5ad430..2bbe1a8f2e99eba8a6cc179e39ce8522762afe62 100755
--- a/package/gluon-core/luasrc/lib/gluon/upgrade/200-wireless
+++ b/package/gluon-core/luasrc/lib/gluon/upgrade/200-wireless
@@ -138,6 +138,7 @@ local function configure_mesh(config, radio, index, suffix, disabled)
mesh_id = config.id,
mesh_fwding = false,
macaddr = macaddr,
+ basic_rate = { config.mcast_rate },
mcast_rate = config.mcast_rate,
ifname = suffix and 'mesh' .. suffix,
disabled = disabled,
diff --git a/patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch b/patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch
index 5f90ad3f6531d2901d7d683bf3fdbded78e11241..2b4bd1d2f02cef52fb18ad6d40d8246489075483 100644
--- a/patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch
+++ b/patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch
@@ -174,7 +174,7 @@ index 0000000000000000000000000000000000000000..077a563b6066cd1d3aee4b1e82328e8c
+
+ int system_bridge_addif(struct device *bridge, struct device *dev)
diff --git a/target/linux/generic/config-6.6 b/target/linux/generic/config-6.6
-index 2ea1b7910388f57a7ba3e5868a323618c0838d9c..cf46bf89de743c83410ea0ebd856ce13a8d38ed4 100644
+index c8ebee70278022e6816a06cd72cc655e4a71a1e3..c9dbee54395fa023021b1fe28fd8800473abf16e 100644
--- a/target/linux/generic/config-6.6
+++ b/target/linux/generic/config-6.6
@@ -716,6 +716,7 @@ CONFIG_BRIDGE=y
diff --git a/patches/openwrt/0007-net-mac80211-override-incompatible-basic-rates-for-mesh.patch b/patches/openwrt/0007-net-mac80211-override-incompatible-basic-rates-for-mesh.patch
new file mode 100644
index 0000000000000000000000000000000000000000..cb9bfe8b6f938a84bcfa1ef63277412b4fc96bc8
--- /dev/null
+++ b/patches/openwrt/0007-net-mac80211-override-incompatible-basic-rates-for-mesh.patch
@@ -0,0 +1,58 @@
+From: David Bauer <mail@david-bauer.net>
+Date: Mon, 6 Jan 2025 08:30:35 +0100
+Subject: net: mac80211: override incompatible basic-rates for mesh
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/kernel/mac80211/patches/subsys/995-net-mac80211-override-incompatible-basic-rates-for-m.patch b/package/kernel/mac80211/patches/subsys/995-net-mac80211-override-incompatible-basic-rates-for-m.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..19ca64d5012d2974ab2a48e9363ecaa3b60aed4c
+--- /dev/null
++++ b/package/kernel/mac80211/patches/subsys/995-net-mac80211-override-incompatible-basic-rates-for-m.patch
+@@ -0,0 +1,46 @@
++From 091e1eea9e34db7cbf84379021fcbff82887e09a Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Mon, 6 Jan 2025 08:23:54 +0100
++Subject: [PATCH] net: mac80211: override incompatible basic-rates for mesh
++
++This is a dirty hack for Gluon.
++
++We assume basic rate setup only affects the rate-controller on the TX
++side. As all devices we support have at least a 802.11n radio and thus
++cover 802.11b as well as 802.11g on 2.4 GHz, they are compatible with
++each other.
++
++As the basic rate was incorrectly set for mesh interfaces in the past,
++connections between mesh neighbors would fail when altering the basic
++rate.
++
++This patch ignores mismatches in the basic-rate field. By doing so, we
++avoid implementing some sort of scheduled switch between wireless
++configurations.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ net/mac80211/mesh.c | 7 +++++--
++ 1 file changed, 5 insertions(+), 2 deletions(-)
++
++diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
++index 25223184d6e5..53b5339be5d0 100644
++--- a/net/mac80211/mesh.c
+++++ b/net/mac80211/mesh.c
++@@ -92,8 +92,11 @@ bool mesh_matches_local(struct ieee80211_sub_if_data *sdata,
++ ieee80211_sta_get_rates(sdata, ie, sband->band,
++ &basic_rates);
++
++- if (sdata->vif.bss_conf.basic_rates != basic_rates)
++- return false;
+++ if (sdata->vif.bss_conf.basic_rates != basic_rates) {
+++ wiphy_warn(sdata->wdev.wiphy,
+++ "ignoring basic rate mismatch for peer (local=%x peer=%x)\n",
+++ sdata->vif.bss_conf.basic_rates, basic_rates);
+++ }
++
++ cfg80211_chandef_create(&sta_chan_def, sdata->vif.bss_conf.chandef.chan,
++ NL80211_CHAN_NO_HT);
++--
++2.45.2
++
diff --git a/patches/openwrt/0008-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-rate.patch b/patches/openwrt/0008-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-rate.patch
new file mode 100644
index 0000000000000000000000000000000000000000..274f002c3e8c54f4120ddf308f8c5d9eeeb60f14
--- /dev/null
+++ b/patches/openwrt/0008-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-rate.patch
@@ -0,0 +1,60 @@
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 7 Jan 2025 00:49:41 +0100
+Subject: net: mac80211: always pretend 1 Mbit/s as mesh basic rate
+
+In order to be backwards-compatible, pretend to have 1 Mbit/s 802.11b as
+basic rate regardless of the actual setting. This is required to keep
+compatibility with other non-patched mesh neighbors.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/kernel/mac80211/patches/subsys/996-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-r.patch b/package/kernel/mac80211/patches/subsys/996-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-r.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..becb17317abb9782d4827a38c232b58939246ae1
+--- /dev/null
++++ b/package/kernel/mac80211/patches/subsys/996-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-r.patch
+@@ -0,0 +1,44 @@
++From 70c1812fa170ee35cdc576c886bed4bfaae1d23c Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Tue, 7 Jan 2025 00:47:33 +0100
++Subject: [PATCH] net: mac80211: always pretend 1 Mbit/s as mesh basic rate
++
++In order to be backwards-compatible, pretend to have 1 Mbit/s 802.11b as
++basic rate regardless of the actual setting. This is required to keep
++compatibility with other non-patched mesh neighbors.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ net/mac80211/util.c | 4 ++--
++ 1 file changed, 2 insertions(+), 2 deletions(-)
++
++--- a/net/mac80211/mesh.c
+++++ b/net/mac80211/mesh.c
++@@ -1093,7 +1093,7 @@ ieee80211_mesh_build_beacon(struct ieee8
++ rcu_read_unlock();
++
++ if (ieee80211_put_srates_elem(skb, sband,
++- sdata->vif.bss_conf.basic_rates,
+++ BIT(0),
++ rate_flags, 0, WLAN_EID_SUPP_RATES) ||
++ mesh_add_ds_params_ie(sdata, skb))
++ goto out_free;
++@@ -1106,7 +1106,7 @@ ieee80211_mesh_build_beacon(struct ieee8
++ bcn->tail = bcn->head + bcn->head_len;
++
++ if (ieee80211_put_srates_elem(skb, sband,
++- sdata->vif.bss_conf.basic_rates,
+++ BIT(0),
++ rate_flags, 0, WLAN_EID_EXT_SUPP_RATES) ||
++ mesh_add_rsn_ie(sdata, skb) ||
++ mesh_add_ht_cap_ie(sdata, skb) ||
++--- a/net/mac80211/mesh_plink.c
+++++ b/net/mac80211/mesh_plink.c
++@@ -283,6 +283,7 @@ static int mesh_plink_frame_tx(struct ie
++ rate_flags =
++ ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chanreq.oper);
++ basic_rates = sdata->vif.bss_conf.basic_rates;
+++ basic_rates = BIT(0); /* mandatory rate */
++
++ if (ieee80211_put_srates_elem(skb, sband, basic_rates,
++ rate_flags, 0,
diff --git a/patches/openwrt/0009-wifi-scripts-allow-per-IF-mesh-basic-rate-selection.patch b/patches/openwrt/0009-wifi-scripts-allow-per-IF-mesh-basic-rate-selection.patch
new file mode 100644
index 0000000000000000000000000000000000000000..9b6b2d98af68ca3e616e3a078b5b97a5252c2b30
--- /dev/null
+++ b/patches/openwrt/0009-wifi-scripts-allow-per-IF-mesh-basic-rate-selection.patch
@@ -0,0 +1,35 @@
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 7 Jan 2025 11:43:36 +0100
+Subject: wifi-scripts: allow per-IF mesh basic rate selection
+
+Bringing up a mesh interface using wpa_supplicant already supports a
+per-VIF basic rate selection. Add the same ability when creating a mesh
+VIF without wpa_supplicant.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
+index 368885246a73b14153ffe3c7d83627f873111742..5b5a7fabda896c978b685b89163a36bae33fcdb6 100755
+--- a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
++++ b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
+@@ -841,13 +841,19 @@ mac80211_setup_adhoc() {
+
+ mac80211_setup_mesh() {
+ json_get_vars ssid mesh_id mcast_rate
++ json_get_values iface_basic_rate_list basic_rate
+
+ mcval=
+ [ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
+ [ -n "$mesh_id" ] && ssid="$mesh_id"
+
++ brlist="$basic_rate_list"
++ if [ -n "$iface_basic_rate_list" ]; then
++ brlist="$iface_basic_rate_list"
++ fi
++
+ brstr=
+- for br in $basic_rate_list; do
++ for br in $brlist; do
+ wpa_supplicant_add_rate brstr "$br"
+ done
+
diff --git a/targets/generic b/targets/generic
index 6db126515dc5a3cb9c92410696cf1cf2a376fb7e..7de3660a330327fc40a051287eddedf942e436e0 100644
--- a/targets/generic
+++ b/targets/generic
@@ -70,7 +70,7 @@ config('KERNEL_IP_MROUTE', false)
config('KERNEL_IPV6_MROUTE', false)
config('KERNEL_IPV6_SEG6_LWTUNNEL', false)
config('KERNEL_SWAP', false)
-config('SECCOMP', false)
+config('USE_SECCOMP', false)
config('KERNEL_SECCOMP', false)
-- kmod-mt7915e pulls in CONFIG_KERNEL_RELAY
-- use try_config, so enabling the package is still possible