diff --git a/src/pkvm_setup/build_qemu.sh b/src/pkvm_setup/build_qemu.sh
index f2ee5722..aee6323f 100644
--- a/src/pkvm_setup/build_qemu.sh
+++ b/src/pkvm_setup/build_qemu.sh
@@ -13,10 +13,12 @@ case "$target" in
     # Accept `aarch64` as an alias for the Debian name `arm64`.
     aarch64)
         target="arm64"
+        base_tgz_suffix="arm64-base"
         ;;
     # If no target is provided, use the default for this host.
     '')
         target="$(dpkg --print-architecture)"
+        base_tgz_suffix="base"
         ;;
 esac
 
@@ -28,7 +30,7 @@ sudo apt install -y pbuilder ubuntu-dev-tools dpkg-dev pristine-tar
 PBUILDFOLDER="$(pwd)/qemu_build"
 export PBUILDFOLDER
 
-if [[ -f "$PBUILDFOLDER/${dist}-base.tgz" ]]; then
+if [[ -f "$PBUILDFOLDER/${dist}-${base_tgz_suffix}.tgz" ]]; then
     echo "Using existing pbuilder base.tgz for $dist $target" 1>&2
 else
     echo "Creating pbuilder base.tgz for $dist $target" 1>&2
diff --git a/src/pkvm_setup/qemu b/src/pkvm_setup/qemu
index c06e9e5c..65c799ec 160000
--- a/src/pkvm_setup/qemu
+++ b/src/pkvm_setup/qemu
@@ -1 +1 @@
-Subproject commit c06e9e5c35531968b4e8a1f1d3f7a74cb26678b6
+Subproject commit 65c799ec70cc2636377b0140df4fbc4d63b0c35c
diff --git a/src/vm_runner/tests/mps/base_nested.toml b/src/vm_runner/tests/mps/base_nested.toml
index b2e42b17..4bcb7657 100644
--- a/src/vm_runner/tests/mps/base_nested.toml
+++ b/src/vm_runner/tests/mps/base_nested.toml
@@ -12,7 +12,7 @@ kvm = false
 ram_mb = 1536
 kernel = "../../../pkvm_setup/vms/pkvm-boot/vmlinuz"
 initrd = "../../../pkvm_setup/vms/pkvm-boot/initrd.img"
-append = 'earlycon root=/dev/vda2 systemd.run=/opt/opensut/bin/opensut_boot opensut.app_device=/dev/vdc'
+append = 'earlycon root=/dev/vda2 nokaslr kvm-arm.mode=protected systemd.run=/opt/opensut/bin/opensut_boot opensut.app_device=/dev/vdc'
 
 [process.disk.vda]
 format = "qcow2"
diff --git a/src/vm_runner/tests/mps/base_single.toml b/src/vm_runner/tests/mps/base_single.toml
index 2cc0aaca..3e2e558a 100644
--- a/src/vm_runner/tests/mps/base_single.toml
+++ b/src/vm_runner/tests/mps/base_single.toml
@@ -8,7 +8,7 @@ type = "vm"
 kvm = false
 kernel = "../../../pkvm_setup/vms/pkvm-boot/vmlinuz"
 initrd = "../../../pkvm_setup/vms/pkvm-boot/initrd.img"
-append = 'earlycon root=/dev/vda2 systemd.run=/opt/opensut/bin/opensut_boot opensut.app_device=/dev/vdb'
+append = 'earlycon root=/dev/vda2 nokaslr kvm-arm.mode=protected systemd.run=/opt/opensut/bin/opensut_boot opensut.app_device=/dev/vdb'
 
 [process.disk.vda]
 format = "qcow2"