diff --git a/build/meta-bsp/recipes-bsp/linux/bsp-linux_1.0.bb b/build/meta-bsp/recipes-bsp/linux/bsp-linux_1.0.bb
index 5482bbe95..81d69d705 100644
--- a/build/meta-bsp/recipes-bsp/linux/bsp-linux_1.0.bb
+++ b/build/meta-bsp/recipes-bsp/linux/bsp-linux_1.0.bb
@@ -189,10 +189,50 @@ addtask do_deploy
 do_deploy_boot[nostamp] = "1"
 do_deploy_boot[depends] = "filesystem:do_fs_check"
 
+# Refuse the repack when a file the ITS pulls in is missing — typically a
+# kernel never built for this platform, or a tree cleaned since. mkimage
+# itself only prints its usage page after a dtc "Couldn't open".
+def __check_itb_inputs(d):
+    import os
+    import re
+
+    itb_path = d.getVar('IB_ITB_PATH')
+    target_its = d.getVar('IB_TARGET_ITS')
+    names = [target_its]
+    if target_its.endswith('_avz'):
+        names.append(target_its[:-len('_avz')] + d.getVar('IB_GUEST_SUFFIX'))
+
+    missing = []
+    for name in names:
+        its = os.path.join(itb_path, name + '.its')
+        if not os.path.exists(its):
+            continue
+        with open(its) as f:
+            for path in re.findall(r'/incbin/\("([^"]+)"\)', f.read()):
+                if not os.path.exists(path):
+                    missing.append(os.path.normpath(path))
+
+    if missing:
+        bb.fatal("Cannot repack the ITB, missing:\n    %s\n"
+                 "Build first (build.sh linux, or build.sh bsp-linux on a fresh "
+                 "tree or after a platform switch)." % "\n    ".join(missing))
+
+# do_deploy_boot is what `deploy.sh linux` runs (linux:do_deploy): it puts a
+# freshly built kernel on p1 without the full deploy. The kernel only reaches
+# the target inside the ITB, so the ITB is repacked here first. Not through
+# `addtask do_itb before do_deploy_boot` as bsp-so3 and bsp-zephyr do: that
+# would pull do_prepare_initrd, hence rootfs-linux:do_build and, with the
+# rootfs.cpio ramfs, usr-linux:do_deploy — a rebuild of the whole user side
+# for a kernel change. exec_func runs the two tasks' bodies without their
+# dependencies; the ITB takes the initrd.cpio.gz the last `build.sh` left.
 python do_deploy_boot() {
 
     bb.plain("Deploy Linux boot (u-boot, itb)")
 
+    bb.build.exec_func('do_render_its', d)
+    __check_itb_inputs(d)
+    bb.build.exec_func('do_itb', d)
+
     __do_deploy_boot(d)
 }
 addtask do_deploy_boot
diff --git a/build/meta-linux/recipes-linux/linux/linux-deploy.inc b/build/meta-linux/recipes-linux/linux/linux-deploy.inc
new file mode 100644
index 000000000..57306c34c
--- /dev/null
+++ b/build/meta-linux/recipes-linux/linux/linux-deploy.inc
@@ -0,0 +1,17 @@
+# Copyright (c) 2026 EDGEMTech SA
+
+# `deploy.sh linux`: put the kernel from the last `build.sh linux` on the
+# target. A kernel is never copied on its own — it travels in the ITB, which
+# bsp-linux packs and writes onto p1 (bsp-linux:do_deploy_boot). No
+# dependency on do_build: deploy writes what the build produced, it does not
+# compile.
+#
+# Not in linux.bbclass: bsp-linux inherits that class and has its own
+# do_deploy.
+
+do_deploy[nostamp] = "1"
+do_deploy[depends] = "bsp-linux:do_deploy_boot"
+python do_deploy () {
+    bb.plain("Linux kernel deployed (ITB on p1)")
+}
+addtask do_deploy
diff --git a/build/meta-linux/recipes-linux/linux/linux_6.12-rpi4.bb b/build/meta-linux/recipes-linux/linux/linux_6.12-rpi4.bb
index bd7b93b9f..ec09418e7 100644
--- a/build/meta-linux/recipes-linux/linux/linux_6.12-rpi4.bb
+++ b/build/meta-linux/recipes-linux/linux/linux_6.12-rpi4.bb
@@ -22,6 +22,7 @@ SRCREV = "8f77e03530f65209a377d25023e912b288e039cd"
 FILESPATH:prepend = "${THISDIR}/files/0001-${PF}:"
  
 require files/0001-${PF}-patches.inc
+require linux-deploy.inc
 
 # Where the working directory will be placed in infrabase root dir
 IB_TARGET = "${IB_LINUX_PATH}"
diff --git a/build/meta-linux/recipes-linux/linux/linux_6.12.bb b/build/meta-linux/recipes-linux/linux/linux_6.12.bb
index dd95d0fe4..9291ced10 100644
--- a/build/meta-linux/recipes-linux/linux/linux_6.12.bb
+++ b/build/meta-linux/recipes-linux/linux/linux_6.12.bb
@@ -22,6 +22,7 @@ SRC_URI[sha256sum] = "1376ce98485a0c8de4635d0bfb88760924e4a818c0439d830738bb1c69
 FILESPATH:prepend = "${THISDIR}/files/0001-${PF}:"
  
 require files/0001-${PF}-patches.inc
+require linux-deploy.inc
 
 # Where the working directory will be placed in infrabase root dir
 IB_TARGET = "${IB_LINUX_PATH}"
diff --git a/build/meta-so3/recipes-so3/so3/so3_6.3.1.bb b/build/meta-so3/recipes-so3/so3/so3_6.3.1.bb
index 0b93ee21f..a0cec58ce 100644
--- a/build/meta-so3/recipes-so3/so3/so3_6.3.1.bb
+++ b/build/meta-so3/recipes-so3/so3/so3_6.3.1.bb
@@ -51,6 +51,16 @@ do_build () {
 	make
 }
 
+# `deploy.sh so3`: the kernel travels in the ITB, which bsp-so3 repacks and
+# writes onto p1 (bsp-so3:do_deploy_boot). No dependency on do_build —
+# deploy writes what the last `build.sh so3` produced, it does not compile.
+do_deploy[nostamp] = "1"
+do_deploy[depends] = "bsp-so3:do_deploy_boot"
+python do_deploy () {
+    bb.plain("SO3 kernel deployed (ITB on p1)")
+}
+addtask do_deploy
+
 do_clean[nostamp] = "1"
 do_clean () {
 	rm -f ${TMPDIR}/stamps/so3*