diff --git a/kernel/configs/7.3/aarch64.config b/kernel/configs/7.3/aarch64.config
index 640ab44..0e3976a 100644
--- a/kernel/configs/7.3/aarch64.config
+++ b/kernel/configs/7.3/aarch64.config
@@ -1026,7 +1026,7 @@ CONFIG_ARCH_HAS_PMD_SOFTLEAVES=y
 CONFIG_CONTIG_ALLOC=y
 CONFIG_PCP_BATCH_SCALE_MAX=5
 CONFIG_PHYS_ADDR_T_64BIT=y
-CONFIG_KSM=y
+# CONFIG_KSM is not set
 CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
 # CONFIG_MEMORY_FAILURE is not set
@@ -1034,8 +1034,8 @@ CONFIG_ARCH_WANTS_THP_SWAP=y
 # CONFIG_PERSISTENT_HUGE_ZERO_FOLIO is not set
 CONFIG_MM_ID=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
-CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
-# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
+# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set
+CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
 # CONFIG_TRANSPARENT_HUGEPAGE_NEVER is not set
 CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_NEVER=y
 # CONFIG_TRANSPARENT_HUGEPAGE_SHMEM_HUGE_ALWAYS is not set
@@ -3224,13 +3224,11 @@ CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_AKCIPHER2=y
 CONFIG_CRYPTO_AKCIPHER=y
-CONFIG_CRYPTO_KPP2=y
 CONFIG_CRYPTO_ACOMP2=y
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_USER is not set
-CONFIG_CRYPTO_SELFTESTS=y
-# CONFIG_CRYPTO_SELFTESTS_FULL is not set
+# CONFIG_CRYPTO_SELFTESTS is not set
 CONFIG_CRYPTO_NULL=y
 # CONFIG_CRYPTO_PCRYPT is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/kernel/configs/c2vm.fragment b/kernel/configs/c2vm.fragment
index 383ecff..cc1fabf 100644
--- a/kernel/configs/c2vm.fragment
+++ b/kernel/configs/c2vm.fragment
@@ -32,3 +32,14 @@ CONFIG_LOCALVERSION="-c2vm"
 
 # Firecracker's config had Amazon's, which goes in the build ID.
 CONFIG_BUILD_SALT=""
+
+# The VMs are small (512 MiB by default) and short-lived: memory and boot
+# time matter more than what these buy a single-tenant guest.
+# Huge pages only where a program asks for them: "always" raises
+# min_free_kbytes and holds memory a small VM needs.
+# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set
+CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y
+# No page merging, and no ksmd thread: one guest has little to merge.
+# CONFIG_KSM is not set
+# The crypto self-tests run at each boot.
+# CONFIG_CRYPTO_SELFTESTS is not set