diff --git a/config/boards/orangepi5-plus.conf b/config/boards/orangepi5-plus.conf
index f2aa79cb14..a756ba14e6 100644
--- a/config/boards/orangepi5-plus.conf
+++ b/config/boards/orangepi5-plus.conf
@@ -13,7 +13,6 @@ BOOT_SCENARIO="spl-blobs"
 BOOT_SUPPORT_SPI="yes"
 BOOT_SPI_RKSPI_LOADER="yes"
 IMAGE_PARTITION_TABLE="gpt"
-KERNEL_UPGRADE_FREEZE="vendor-rk35xx@24.8.1"
 declare -g UEFI_EDK2_BOARD_ID="orangepi-5plus" # This _only_ used for uefi-edk2-rk3588 extension
 
 function post_family_tweaks__orangepi5plus_naming_audios() {
@@ -28,38 +27,17 @@ function post_family_tweaks__orangepi5plus_naming_audios() {
 
 	return 0
 }
-# Mainline U-Boot for edge kernel
-function post_family_config_branch_edge__orangepi5plus_use_mainline_uboot() {
+
+function post_family_config__orangepi5plus_use_mainline_uboot() {
+	[[ "${BRANCH}" == "vendor" ]] && return 0 # skip for vendor branch
+
 	display_alert "$BOARD" "Mainline U-Boot overrides for $BOARD - $BRANCH" "info"
 
 	declare -g BOOTCONFIG="orangepi-5-plus-rk3588_defconfig"     # override the default for the board/family
 	declare -g BOOTDELAY=1                                       # Wait for UART interrupt to enter UMS/RockUSB mode etc
 	declare -g BOOTSOURCE="https://github.com/u-boot/u-boot.git" # We ❤️ mainline U-Boot
-	declare -g BOOTBRANCH="tag:v2024.10-rc3"
-	declare -g BOOTPATCHDIR="v2024.10"
-	declare -g BOOTDIR="u-boot-${BOARD}" # do not share u-boot directory
-	declare -g UBOOT_TARGET_MAP="BL31=${RKBIN_DIR}/${BL31_BLOB} ROCKCHIP_TPL=${RKBIN_DIR}/${DDR_BLOB};;u-boot-rockchip.bin u-boot-rockchip-spi.bin"
-	unset uboot_custom_postprocess write_uboot_platform write_uboot_platform_mtd # disable stuff from rockchip64_common; we're using binman here which does all the work already
-
-	# Just use the binman-provided u-boot-rockchip.bin, which is ready-to-go
-	function write_uboot_platform() {
-		dd "if=$1/u-boot-rockchip.bin" "of=$2" bs=32k seek=1 conv=notrunc status=none
-	}
-
-	function write_uboot_platform_mtd() {
-		flashcp -v -p "$1/u-boot-rockchip-spi.bin" /dev/mtd0
-	}
-}
-
-# Mainline U-Boot for current kernel
-function post_family_config_branch_current__orangepi5plus_use_mainline_uboot() {
-	display_alert "$BOARD" "Mainline U-Boot overrides for $BOARD - $BRANCH" "info"
-
-	declare -g BOOTCONFIG="orangepi-5-plus-rk3588_defconfig"     # override the default for the board/family
-	declare -g BOOTDELAY=1                                       # Wait for UART interrupt to enter UMS/RockUSB mode etc
-	declare -g BOOTSOURCE="https://github.com/u-boot/u-boot.git" # We ❤️ mainline U-Boot
-	declare -g BOOTBRANCH="tag:v2024.10-rc3"
-	declare -g BOOTPATCHDIR="v2024.10"
+	declare -g BOOTBRANCH="tag:v2025.10"
+	declare -g BOOTPATCHDIR="v2025.10"
 	declare -g BOOTDIR="u-boot-${BOARD}" # do not share u-boot directory
 	declare -g UBOOT_TARGET_MAP="BL31=${RKBIN_DIR}/${BL31_BLOB} ROCKCHIP_TPL=${RKBIN_DIR}/${DDR_BLOB};;u-boot-rockchip.bin u-boot-rockchip-spi.bin"
 	unset uboot_custom_postprocess write_uboot_platform write_uboot_platform_mtd # disable stuff from rockchip64_common; we're using binman here which does all the work already
@@ -75,11 +53,11 @@ function post_family_config_branch_current__orangepi5plus_use_mainline_uboot() {
 }
 
 function post_config_uboot_target__extra_configs_for_rock5b_mainline_environment_in_spi() {
-	[[ "${BRANCH}" != "edge" && "${BRANCH}" != "current" ]] && return 0
+	[[ "${BRANCH}" == "vendor" ]] && return 0
 
 	display_alert "$BOARD" "u-boot configs for ${BOOTBRANCH} u-boot config BRANCH=${BRANCH}" "info"
 	run_host_command_logged scripts/config --set-val CONFIG_BOARD_RNG_SEED "y"
-	run_host_command_logged scripts/config --set-val ARMV8_CRYPTO "n"    #broken as per 2024.10-rc3
-	run_host_command_logged scripts/config --set-val ARMV8_CE_SHA1 "n"   #broken as per 2024.10-rc3
-	run_host_command_logged scripts/config --set-val ARMV8_CE_SHA256 "n" #broken as per 2024.10-rc3
+	run_host_command_logged scripts/config --set-val ARMV8_CRYPTO "y"
+	run_host_command_logged scripts/config --set-val ARMV8_CE_SHA1 "y"
+	run_host_command_logged scripts/config --set-val ARMV8_CE_SHA256 "y"
 }