diff --git a/config/boards/README.md b/config/boards/README.md
index 870b7117b40c..4e21e13cfb2f 100644
--- a/config/boards/README.md
+++ b/config/boards/README.md
@@ -75,6 +75,7 @@ If you are unsure about the documentation then invoke `$ grep -r -A5 -B5 "BUILD_
 		- [branch]: Use specified [branch] kernel
 		- [none]: Exits with error
 - **KERNEL_TEST_TARGET** ( comma-separated list of kernel releases or branches ): if test targets are different for testings. Also applies to build list generation. (internal switch)
+- **KERNEL_UPGRADE_FREEZE** ( comma-separated list of kernels with versions obove which they stop updating, example: KERNEL_UPGRADE_FREEZE="vendor-rk35xx@24.8.1,current-rockchip-rk3588@24.8.2" )
 - **FULL_DESKTOP** ( boolean ): defines whether to install desktop stack of applications such as office, thunderbird, etc..
 	- Values:
 		- yes: install desktop stack
diff --git a/config/boards/khadas-edge2.conf b/config/boards/khadas-edge2.conf
index 0458ff41a856..bb9fccfd63fe 100644
--- a/config/boards/khadas-edge2.conf
+++ b/config/boards/khadas-edge2.conf
@@ -6,6 +6,7 @@ declare -g BOOT_SOC="rk3588" # Just to avoid errors in rockchip64_commmon
 declare -g KERNEL_TARGET="edge,current,vendor"
 declare -g KERNEL_TEST_TARGET="vendor,current"
 declare -g IMAGE_PARTITION_TABLE="gpt"
+declare -g KERNEL_UPGRADE_FREEZE="vendor-rk35xx@24.8.1"
 declare -g BOOT_FDT_FILE="rockchip/rk3588s-khadas-edge2.dtb" # Specific to this board
 
 declare -g BLUETOOTH_HCIATTACH_PARAMS="-s 115200 /dev/ttyS9 bcm43xx 1500000" # For the bluetooth-hciattach extension
diff --git a/config/boards/orangepi5-plus.conf b/config/boards/orangepi5-plus.conf
index c85ddc4d517e..802916cc6247 100644
--- a/config/boards/orangepi5-plus.conf
+++ b/config/boards/orangepi5-plus.conf
@@ -13,6 +13,7 @@ BOOT_SCENARIO="spl-blobs"
 BOOT_SUPPORT_SPI="yes"
 BOOT_SPI_RKSPI_LOADER="yes"
 IMAGE_PARTITION_TABLE="gpt"
+KERNEL_UPGRADE_FREEZE="vendor-rk35xx@24.8.1"
 declare -g UEFI_EDK2_BOARD_ID="orangepi-5plus" # This _only_ used for uefi-edk2-rk3588 extension
 
 function post_family_tweaks__orangepi5plus_naming_audios() {
diff --git a/config/boards/orangepi5.conf b/config/boards/orangepi5.conf
index 42569fa11113..c96c41cb1086 100644
--- a/config/boards/orangepi5.conf
+++ b/config/boards/orangepi5.conf
@@ -14,7 +14,7 @@ BOOT_SCENARIO="spl-blobs"
 BOOT_SUPPORT_SPI="yes"
 BOOT_SPI_RKSPI_LOADER="yes"
 IMAGE_PARTITION_TABLE="gpt"
-KERNEL_UPGRADE_FREEZE="24.8.1"
+KERNEL_UPGRADE_FREEZE="vendor-rk35xx@24.8.1"
 declare -g UEFI_EDK2_BOARD_ID="orangepi-5" # This _only_ used for uefi-edk2-rk3588 extension
 
 # @TODO: consider removing those, as the defaults in rockchip64_common have been bumped up
diff --git a/config/boards/orangepi5pro.wip b/config/boards/orangepi5pro.wip
index 2e1530dc42b4..13d5d6a84955 100644
--- a/config/boards/orangepi5pro.wip
+++ b/config/boards/orangepi5pro.wip
@@ -13,6 +13,7 @@ BOOT_SCENARIO="spl-blobs"
 BOOT_SUPPORT_SPI="yes"
 BOOT_SPI_RKSPI_LOADER="yes"
 IMAGE_PARTITION_TABLE="gpt"
+KERNEL_UPGRADE_FREEZE="vendor-rk35xx@24.8.1"
 
 function post_family_tweaks__orangepi5pro_naming_audios() {
 	display_alert "$BOARD" "Renaming orangepi5pro audios" "info"
diff --git a/lib/functions/bsp/armbian-bsp-cli-deb.sh b/lib/functions/bsp/armbian-bsp-cli-deb.sh
index 010cb5eef753..eef3db9ed36a 100644
--- a/lib/functions/bsp/armbian-bsp-cli-deb.sh
+++ b/lib/functions/bsp/armbian-bsp-cli-deb.sh
@@ -210,12 +210,17 @@ function compile_armbian-bsp-cli() {
 
 	### preventing upgrading stable kernels beyond version if defined
 	# if freeze variable is removed, upgrade becomes possible again
-	if [[ "${BETA}" != "yes" && -n "${KERNEL_UPGRADE_FREEZE}" ]]; then
-		cat <<- EOF >> "${destination}"/etc/apt/preferences.d/frozen-armbian
-		Package: linux-*-${BRANCH}-${LINUXFAMILY}
-		Pin: version ${KERNEL_UPGRADE_FREEZE}
-		Pin-Priority: 999
-		EOF
+	if [[ "${BETA}" != "yes" ]]; then
+		for pin_variants in $(echo $KERNEL_UPGRADE_FREEZE | sed "s/,/ /g"); do
+		extracted_pins=(${pin_variants//@/ })
+			if [[ "${BRANCH}-${LINUXFAMILY}" == "${extracted_pins[0]}" ]]; then
+				cat <<- EOF >> "${destination}"/etc/apt/preferences.d/frozen-armbian
+				Package: linux-*-${extracted_pins[0]}
+				Pin: version ${extracted_pins[1]}
+				Pin-Priority: 999
+				EOF
+			fi
+		done
 	else
 		touch "${destination}"/etc/apt/preferences.d/frozen-armbian
 	fi