diff --git a/configs/arm_cortexm_sdk_defconfig b/configs/arm_cortexm_sdk_defconfig
index 08aacfd02b..db9f75f1ca 100644
--- a/configs/arm_cortexm_sdk_defconfig
+++ b/configs/arm_cortexm_sdk_defconfig
@@ -3,7 +3,7 @@ BR2_cortex_m7=y
 BR2_ARM_ENABLE_VFP=y
 BR2_ARM_EABI=y
 BR2_ARM_FPU_FPV4D16=y
-BR2_KERNEL_HEADERS_5_15=y
+BR2_KERNEL_HEADERS_6_12=y
 BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
 BR2_PTHREAD_DEBUG=y
 BR2_TOOLCHAIN_BUILDROOT_CXX=y
@@ -11,12 +11,13 @@ BR2_PACKAGE_HOST_GDB=y
 BR2_GDB_VERSION_11=y
 BR2_SHARED_STATIC_LIBS=y
 BR2_INIT_NONE=y
-# BR2_PACKAGE_BUSYBOX is not set
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
 BR2_PACKAGE_BZIP2=y
 BR2_PACKAGE_GDB=y
+BR2_PACKAGE_I2C_TOOLS=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_LIBUBOOTENV=y
-BR2_PACKAGE_LSHW=y
+BR2_PACKAGE_TSLIB=y
 BR2_PACKAGE_LIBARCHIVE=y
 BR2_PACKAGE_LIBSODIUM=y
 BR2_PACKAGE_OPENSSL=y
@@ -30,6 +31,8 @@ BR2_PACKAGE_BOOST=y
 BR2_PACKAGE_BOOST_JSON=y
 BR2_PACKAGE_BOOST_LOG=y
 BR2_PACKAGE_BOOST_PROGRAM_OPTIONS=y
+BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_OPENSSH_SFTP_SERVER=y
 BR2_PACKAGE_URANDOM_SCRIPTS=y
 BR2_PACKAGE_AKTUALIZR=y
 BR2_PACKAGE_LIBOSTREE=y
diff --git a/configs/arm_cortexm_sdk_lite_defconfig b/configs/arm_cortexm_sdk_lite_defconfig
new file mode 100644
index 0000000000..0bf6c83b8d
--- /dev/null
+++ b/configs/arm_cortexm_sdk_lite_defconfig
@@ -0,0 +1,20 @@
+BR2_arm=y
+BR2_cortex_m7=y
+BR2_ARM_ENABLE_VFP=y
+BR2_ARM_EABI=y
+BR2_ARM_FPU_FPV4D16=y
+BR2_KERNEL_HEADERS_6_12=y
+BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
+BR2_PTHREAD_DEBUG=y
+BR2_TOOLCHAIN_BUILDROOT_CXX=y
+BR2_PACKAGE_HOST_GDB=y
+BR2_GDB_VERSION_11=y
+BR2_SHARED_STATIC_LIBS=y
+BR2_INIT_NONE=y
+BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
+BR2_PACKAGE_GDB=y
+BR2_PACKAGE_I2C_TOOLS=y
+BR2_PACKAGE_LIBUBOOTENV=y
+BR2_PACKAGE_TSLIB=y
+BR2_PACKAGE_DROPBEAR=y
+BR2_PACKAGE_OPENSSH_SFTP_SERVER=y
diff --git a/package/Config.in b/package/Config.in
index d4765c0a51..b4a53085f6 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2362,6 +2362,7 @@ endif
 	source "package/openobex/Config.in"
 	source "package/openresolv/Config.in"
 	source "package/openssh/Config.in"
+	source "package/openssh-sftp-server/Config.in"
 	source "package/openswan/Config.in"
 	source "package/openvpn/Config.in"
 	source "package/p910nd/Config.in"
diff --git a/package/linux-headers/Config.in.host b/package/linux-headers/Config.in.host
index 19dfc6a863..696a33e87f 100644
--- a/package/linux-headers/Config.in.host
+++ b/package/linux-headers/Config.in.host
@@ -56,6 +56,10 @@ config BR2_KERNEL_HEADERS_5_15
 config BR2_KERNEL_HEADERS_5_17
 	bool "Linux 5.17.x kernel headers"
 	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_17
+
+config BR2_KERNEL_HEADERS_6_12
+	bool "Linux 6.12.x kernel headers"
+	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_6_12
 	select BR2_KERNEL_HEADERS_LATEST
 
 config BR2_KERNEL_HEADERS_VERSION
@@ -133,8 +137,12 @@ choice
 	  If your kernel headers are more recent than the latest version
 	  in the choice, then select the latest version.
 
+config BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_6_12
+	bool "6.12.x or later"
+	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_6_12
+
 config BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_17
-	bool "5.17.x or later"
+	bool "5.17.x"
 	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_17
 
 config BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_16
@@ -383,6 +391,7 @@ config BR2_DEFAULT_KERNEL_HEADERS
 	default "5.10.155"	if BR2_KERNEL_HEADERS_5_10
 	default "5.15.79"	if BR2_KERNEL_HEADERS_5_15
 	default "5.17.15"	if BR2_KERNEL_HEADERS_5_17
+	default "6.12.20"	if BR2_KERNEL_HEADERS_6_12
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION
 	default "custom"	if BR2_KERNEL_HEADERS_CUSTOM_TARBALL
 	default BR2_KERNEL_HEADERS_CUSTOM_REPO_VERSION \
diff --git a/package/openssh-sftp-server/Config.in b/package/openssh-sftp-server/Config.in
new file mode 100644
index 0000000000..7880b909d0
--- /dev/null
+++ b/package/openssh-sftp-server/Config.in
@@ -0,0 +1,12 @@
+config BR2_PACKAGE_OPENSSH_SFTP_SERVER
+	bool "openssh-sftp-server"
+	select BR2_PACKAGE_ZLIB
+	help
+	  SFTP server from OpenSSH. This is a standalone helper program
+	  that handles SFTP protocol over stdin/stdout, typically spawned
+	  by an SSH server (e.g., dropbear) on incoming SFTP connections.
+
+	  Unlike the full openssh package, sftp-server does not use
+	  fork() and works on noMMU targets.
+
+	  https://www.openssh.com/
diff --git a/package/openssh-sftp-server/openssh-sftp-server.hash b/package/openssh-sftp-server/openssh-sftp-server.hash
new file mode 100644
index 0000000000..eefb11ec15
--- /dev/null
+++ b/package/openssh-sftp-server/openssh-sftp-server.hash
@@ -0,0 +1,4 @@
+# From https://www.openssh.com/txt/release-9.1 (base64 encoded)
+sha256  19f85009c7e3e23787f0236fbb1578392ab4d4bf9f8ec5fe6bc1cd7e8bfdd288  openssh-9.1p1.tar.gz
+# Locally calculated
+sha256  05c30446ba738934b3f1efa965b454c122ca26cc4b268e5ae6843f58ccd1b16d  LICENCE
diff --git a/package/openssh-sftp-server/openssh-sftp-server.mk b/package/openssh-sftp-server/openssh-sftp-server.mk
new file mode 100644
index 0000000000..4dca91ceea
--- /dev/null
+++ b/package/openssh-sftp-server/openssh-sftp-server.mk
@@ -0,0 +1,57 @@
+################################################################################
+#
+# openssh-sftp-server
+#
+# Builds only the sftp-server binary from OpenSSH. This is safe on noMMU
+# targets because sftp-server never calls fork().
+#
+################################################################################
+
+OPENSSH_SFTP_SERVER_VERSION_MAJOR = 9.1
+OPENSSH_SFTP_SERVER_VERSION_MINOR = p1
+OPENSSH_SFTP_SERVER_VERSION = $(OPENSSH_SFTP_SERVER_VERSION_MAJOR)$(OPENSSH_SFTP_SERVER_VERSION_MINOR)
+OPENSSH_SFTP_SERVER_SOURCE = openssh-$(OPENSSH_SFTP_SERVER_VERSION).tar.gz
+OPENSSH_SFTP_SERVER_SITE = http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable
+OPENSSH_SFTP_SERVER_LICENSE = BSD-3-Clause, BSD-2-Clause, Public Domain
+OPENSSH_SFTP_SERVER_LICENSE_FILES = LICENCE
+
+OPENSSH_SFTP_SERVER_CONF_ENV = \
+	LD="$(TARGET_CC)" \
+	LDFLAGS="$(TARGET_CFLAGS)"
+
+OPENSSH_SFTP_SERVER_CONF_OPTS = \
+	--sysconfdir=/etc/ssh \
+	--without-sandbox \
+	--without-pam \
+	--without-selinux \
+	--without-audit \
+	--without-openssl \
+	--without-ssl-engine \
+	--disable-lastlog \
+	--disable-utmp \
+	--disable-utmpx \
+	--disable-wtmp \
+	--disable-wtmpx
+
+ifeq ($(BR2_TOOLCHAIN_SUPPORTS_PIE),)
+OPENSSH_SFTP_SERVER_CONF_OPTS += --without-pie
+endif
+
+OPENSSH_SFTP_SERVER_DEPENDENCIES = host-pkgconf zlib
+
+# Only build sftp-server. Use -ffunction-sections/-fdata-sections with
+# --gc-sections so the linker drops unreferenced functions from libssh.a
+# (notably misc.c:subprocess() which calls fork()). This avoids the
+# fork link error on noMMU targets without any stub or defsym hack.
+define OPENSSH_SFTP_SERVER_BUILD_CMDS
+	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
+		CFLAGS="$(TARGET_CFLAGS) -ffunction-sections -fdata-sections" \
+		LD="$(TARGET_CC) -Wl,--gc-sections" \
+		sftp-server
+endef
+
+define OPENSSH_SFTP_SERVER_INSTALL_TARGET_CMDS
+	$(INSTALL) -D -m 0755 $(@D)/sftp-server $(TARGET_DIR)/usr/libexec/sftp-server
+endef
+
+$(eval $(autotools-package))
diff --git a/toolchain/Config.in b/toolchain/Config.in
index 33c5e66e37..a86d9d363a 100644
--- a/toolchain/Config.in
+++ b/toolchain/Config.in
@@ -583,6 +583,10 @@ config BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_16
 config BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_17
 	bool
 	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_16
+
+config BR2_TOOLCHAIN_HEADERS_AT_LEAST_6_12
+	bool
+	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_17
 	select BR2_TOOLCHAIN_HEADERS_LATEST
 
 # This should be selected by the latest version, above, to indicate that
@@ -596,6 +600,7 @@ config BR2_TOOLCHAIN_HEADERS_LATEST
 # stops affecting a value on the first matching default.
 config BR2_TOOLCHAIN_HEADERS_AT_LEAST
 	string
+	default "6.12" if BR2_TOOLCHAIN_HEADERS_AT_LEAST_6_12
 	default "5.17" if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_17
 	default "5.16" if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_16
 	default "5.15" if BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_15