diff --git a/local/scripts/upgrade-forks.sh b/local/scripts/upgrade-forks.sh
index f63ea151bc..08c2b28a94 100755
--- a/local/scripts/upgrade-forks.sh
+++ b/local/scripts/upgrade-forks.sh
@@ -245,15 +245,8 @@ for fork in "${TARGET_FORKS[@]}"; do
     echo "  Merge base: $merge_base_short"
     echo "  RB commits: $ahead"
 
-    # Collect RB commit list (oldest first for cherry-pick)
-    mapfile -t rb_commits < <(cd "$fork_dir" && git log --reverse --format='%H' "${upstream_ref}..HEAD" 2>/dev/null)
-
     if [[ "$DRY_RUN" -eq 1 ]]; then
-        echo -e "  ${YELLOW}PLAN: reset to $upstream_sha, cherry-pick $ahead commits${NC}"
-        for c in "${rb_commits[@]}"; do
-            short=$(cd "$fork_dir" && git log -1 --format='%h %s' "$c")
-            echo "    + $short"
-        done
+        echo -e "  ${YELLOW}PLAN: reset to $upstream_sha, apply net RB diff${NC}"
         echo ""
         continue
     fi
@@ -263,36 +256,63 @@ for fork in "${TARGET_FORKS[@]}"; do
     (cd "$fork_dir" && git branch "$backup_branch" HEAD 2>/dev/null)
     echo "  Backup:     $backup_branch"
 
+    # Save old HEAD for diff generation
+    old_head=$(cd "$fork_dir" && git rev-parse HEAD)
+
     # Reset to upstream
     (cd "$fork_dir" && git reset --hard "$upstream_ref" 2>/dev/null)
     echo "  Reset to:   $upstream_sha"
 
-    # Cherry-pick RB commits
-    pick_fail=0
-    for c in "${rb_commits[@]}"; do
-        short=$(cd "$fork_dir" && git log -1 --format='%h %s' "$c")
-        if (cd "$fork_dir" && git cherry-pick "$c" 2>/dev/null); then
-            echo "    ✓ $short"
-        else
-            echo -e "    ${RED}✗ CONFLICT: $short${NC}"
-            (cd "$fork_dir" && git cherry-pick --abort 2>/dev/null) || true
-            pick_fail=1
-            break
-        fi
-    done
+    # Generate net diff of all RB changes as a single patch
+    rb_patch="/tmp/rb-upgrade-${fork}-$$.patch"
+    (cd "$fork_dir" && git diff "$upstream_ref" "$old_head" -- . ':!Cargo.lock' > "$rb_patch" 2>/dev/null)
 
-    if [[ "$pick_fail" -ne 0 ]]; then
-        echo -e "  ${RED}FAIL: cherry-pick conflict, restored from backup${NC}"
-        echo -e "  ${YELLOW}Manual rebase needed: cd $fork_dir && git rebase $upstream_ref $backup_branch${NC}"
-        (cd "$fork_dir" && git reset --hard "$backup_branch" 2>/dev/null)
-        FAIL_COUNT=$((FAIL_COUNT + 1))
-        FAILED_FORKS+=("$fork")
-        echo ""
-        continue
+    # Apply net RB diff
+    if (cd "$fork_dir" && git apply --reject "$rb_patch" 2>/dev/null); then
+        echo "  Net diff:   applied ($(wc -l < "$rb_patch") lines)"
+    else
+        # Net diff failed — try individual cherry-picks as fallback
+        echo -e "  ${YELLOW}Net diff had conflicts, falling back to cherry-pick...${NC}"
+        (cd "$fork_dir" && git reset --hard "$upstream_ref" 2>/dev/null)
+        mapfile -t rb_commits < <(cd "$fork_dir" && git log --reverse --format='%H' "${upstream_ref}..${old_head}" 2>/dev/null)
+        pick_fail=0
+        for c in "${rb_commits[@]}"; do
+            short=$(cd "$fork_dir" && git log -1 --format='%h %s' "$c")
+            if (cd "$fork_dir" && git cherry-pick "$c" 2>/dev/null); then
+                echo "    ✓ $short"
+            else
+                echo -e "    ${RED}✗ CONFLICT: $short${NC}"
+                (cd "$fork_dir" && git cherry-pick --abort 2>/dev/null) || true
+                pick_fail=1
+                break
+            fi
+        done
+        if [[ "$pick_fail" -ne 0 ]]; then
+            echo -e "  ${RED}FAIL: both net-diff and cherry-pick failed, restored from backup${NC}"
+            (cd "$fork_dir" && git reset --hard "$backup_branch" 2>/dev/null)
+            rm -f "$rb_patch"
+            FAIL_COUNT=$((FAIL_COUNT + 1))
+            FAILED_FORKS+=("$fork")
+            echo ""
+            continue
+        fi
     fi
 
+    # Regenerate Cargo.lock (avoids cherry-pick conflicts on generated file)
+    if (cd "$fork_dir" && [ -f Cargo.toml ] && cargo generate-lockfile 2>/dev/null); then
+        echo "  Lockfile:   regenerated"
+    fi
+
+    # Stage all changes and commit as a single RB reapply
+    (cd "$fork_dir" && git add -A 2>/dev/null)
+    if ! (cd "$fork_dir" && git diff --cached --quiet 2>/dev/null); then
+        (cd "$fork_dir" && git commit -m "rb: reapply Red Bear patches on upstream $upstream_sha" 2>/dev/null)
+        echo "  Committed:  RB patches reapplied"
+    fi
+
+    rm -f "$rb_patch"
     new_sha=$(cd "$fork_dir" && git rev-parse --short HEAD)
-    echo -e "  ${GREEN}DONE: $old_sha → $new_sha ($ahead patches reapplied)${NC}"
+    echo -e "  ${GREEN}DONE: $old_sha → $new_sha ($ahead RB changes reapplied)${NC}"
     echo -e "  ${YELLOW}Backup at $backup_branch${NC}"
 
     # Post-upgrade verification: check no upstream functions were dropped
diff --git a/local/sources/base b/local/sources/base
index ab0da30613..5e5657e4dd 160000
--- a/local/sources/base
+++ b/local/sources/base
@@ -1 +1 @@
-Subproject commit ab0da30613f23214de34222d23134310db9e60f9
+Subproject commit 5e5657e4dd4626d642b2e6267de02f9dc46334ea
diff --git a/local/sources/installer b/local/sources/installer
index 7f79277929..1e9dcdee98 160000
--- a/local/sources/installer
+++ b/local/sources/installer
@@ -1 +1 @@
-Subproject commit 7f792779291a82ced4b27deaa0205a381d11f2ba
+Subproject commit 1e9dcdee9809bba3338ec8f66f1a21d788838340
diff --git a/local/sources/kernel b/local/sources/kernel
index b2a9228783..2086faecb0 160000
--- a/local/sources/kernel
+++ b/local/sources/kernel
@@ -1 +1 @@
-Subproject commit b2a9228783c9870068cfd4741073793e3c97ed4c
+Subproject commit 2086faecb0e83af9b7f085e0d67ba9305df15915