diff --git a/iso/builder/auto/config b/iso/builder/auto/config
index cc44ceb..50ba931 100755
--- a/iso/builder/auto/config
+++ b/iso/builder/auto/config
@@ -7,6 +7,15 @@ set -e
 
 . "$(dirname "$0")/../VERSIONS"
 
+# Pin the exact kernel ABI detected by build.sh so the ISO kernel matches
+# the kernel headers used to compile NVIDIA modules. Falls back to meta-package
+# when lb config is run manually without the environment variable.
+if [ -n "${BEE_KERNEL_ABI:-}" ] && [ "${BEE_KERNEL_ABI}" != "auto" ]; then
+    LB_LINUX_PACKAGES="linux-image-${BEE_KERNEL_ABI}"
+else
+    LB_LINUX_PACKAGES="linux-image"
+fi
+
 lb config noauto \
     --distribution bookworm \
     --architectures amd64 \
@@ -19,7 +28,7 @@ lb config noauto \
     --mirror-binary "https://deb.debian.org/debian" \
     --security true \
     --linux-flavours "amd64" \
-    --linux-packages "linux-image" \
+    --linux-packages "${LB_LINUX_PACKAGES}" \
     --memtest none \
     --iso-volume "EASY-BEE" \
     --iso-application "EASY-BEE" \
diff --git a/iso/builder/build.sh b/iso/builder/build.sh
index e79fbe1..211eba6 100755
--- a/iso/builder/build.sh
+++ b/iso/builder/build.sh
@@ -51,6 +51,11 @@ if [ -z "${DEBIAN_KERNEL_ABI}" ] || [ "${DEBIAN_KERNEL_ABI}" = "auto" ]; then
     echo "=== kernel ABI: ${DEBIAN_KERNEL_ABI} ==="
 fi
 
+# Export detected ABI so that auto/config can pin the exact kernel package
+# (prevents NVIDIA module/kernel mismatch if linux-image-amd64 meta-package
+# gets updated between build.sh start and lb build chroot step)
+export BEE_KERNEL_ABI="${DEBIAN_KERNEL_ABI}"
+
 KVER="${DEBIAN_KERNEL_ABI}-amd64"
 if [ ! -d "/usr/src/linux-headers-${KVER}" ]; then
     echo "=== installing linux-headers-${KVER} (kernel updated since image build) ==="