diff --git a/lib/functions/compilation/armbian-kernel.sh b/lib/functions/compilation/armbian-kernel.sh
new file mode 100644
index 0000000000..b7ed2bd232
--- /dev/null
+++ b/lib/functions/compilation/armbian-kernel.sh
@@ -0,0 +1,31 @@
+# Forced .config options for all Armbian kernels.
+
+# This is an internal/core extension.
+function armbian_kernel_config__disable_module_compression() {
+	display_alert "Disabling module compression and signing" "armbian-kernel" "debug"
+	kernel_config_set_n CONFIG_MODULE_COMPRESS_XZ # No use double-compressing modules
+	kernel_config_set_n CONFIG_MODULE_COMPRESS_ZSTD
+	kernel_config_set_n CONFIG_MODULE_COMPRESS_GZIP
+	kernel_config_set_y CONFIG_MODULE_COMPRESS_NONE
+	kernel_config_set_n CONFIG_SECURITY_LOCKDOWN_LSM
+	kernel_config_set_n CONFIG_MODULE_SIG # No use signing modules
+}
+
+# Helpers for manipulating kernel config. @TODO: hash of changes made
+function kernel_config_set_m() {
+	declare module="$1"
+	display_alert "Enabling kernel module" "${module}=m" "debug"
+	run_host_command_logged ./scripts/config --module "$module"
+}
+
+function kernel_config_set_y() {
+	declare config="$1"
+	display_alert "Enabling kernel config/built-in" "${config}=y" "debug"
+	run_host_command_logged ./scripts/config --enable "${config}"
+}
+
+function kernel_config_set_n() {
+	declare config="$1"
+	display_alert "Disabling kernel config/module" "${config}=n" "debug"
+	run_host_command_logged ./scripts/config --disable "${config}"
+}
diff --git a/lib/library-functions.sh b/lib/library-functions.sh
index 2d20b0ea84..a800e00e8e 100644
--- a/lib/library-functions.sh
+++ b/lib/library-functions.sh
@@ -199,6 +199,15 @@ set -o errexit  ## set -e : exit the script if any statement returns a non-true
 # shellcheck source=lib/functions/cli/utils-cli.sh
 source "${SRC}"/lib/functions/cli/utils-cli.sh
 
+# no errors tolerated. invoked before each sourced file to make sure.
+#set -o pipefail  # trace ERR through pipes - will be enabled "soon"
+#set -o nounset   ## set -u : exit the script if you try to use an uninitialised variable - one day will be enabled
+set -o errtrace # trace ERR through - enabled
+set -o errexit  ## set -e : exit the script if any statement returns a non-true return value - enabled
+### lib/functions/compilation/armbian-kernel.sh
+# shellcheck source=lib/functions/compilation/armbian-kernel.sh
+source "${SRC}"/lib/functions/compilation/armbian-kernel.sh
+
 # no errors tolerated. invoked before each sourced file to make sure.
 #set -o pipefail  # trace ERR through pipes - will be enabled "soon"
 #set -o nounset   ## set -u : exit the script if you try to use an uninitialised variable - one day will be enabled