diff --git a/kvm_sys/bindgen.sh b/kvm_sys/bindgen.sh
index dd5f19498..b735315ac 100755
--- a/kvm_sys/bindgen.sh
+++ b/kvm_sys/bindgen.sh
@@ -20,6 +20,8 @@ use zerocopy::KnownLayout;
 // The original index (236) used in the ChromeOS v6.6 kernel was reused upstream for another
 // capability, so this may return incorrect information on some kernels.
 pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA_CROS: u32 = 236;
+pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
+pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 
 // TODO(qwandor): Update this once the pKVM patches are merged upstream with a stable capability ID.
 pub const KVM_CAP_ARM_PROTECTED_VM: u32 = 0xffbadab1;
diff --git a/kvm_sys/src/aarch64/bindings.rs b/kvm_sys/src/aarch64/bindings.rs
index 512d66246..0fd2c9227 100644
--- a/kvm_sys/src/aarch64/bindings.rs
+++ b/kvm_sys/src/aarch64/bindings.rs
@@ -18,6 +18,8 @@ use zerocopy::KnownLayout;
 // The original index (236) used in the ChromeOS v6.6 kernel was reused upstream for another
 // capability, so this may return incorrect information on some kernels.
 pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA_CROS: u32 = 236;
+pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
+pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 
 // TODO(qwandor): Update this once the pKVM patches are merged upstream with a stable capability ID.
 pub const KVM_CAP_ARM_PROTECTED_VM: u32 = 0xffbadab1;
@@ -418,7 +420,6 @@ pub const KVM_API_VERSION: u32 = 12;
 pub const KVM_MEM_LOG_DIRTY_PAGES: u32 = 1;
 pub const KVM_MEM_READONLY: u32 = 2;
 pub const KVM_MEM_GUEST_MEMFD: u32 = 4;
-pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 pub const KVM_PIT_SPEAKER_DUMMY: u32 = 1;
 pub const KVM_EXIT_HYPERV_SYNIC: u32 = 1;
 pub const KVM_EXIT_HYPERV_HCALL: u32 = 2;
@@ -738,10 +739,6 @@ pub const KVM_CAP_VM_TYPES: u32 = 235;
 pub const KVM_CAP_PRE_FAULT_MEMORY: u32 = 236;
 pub const KVM_CAP_X86_APIC_BUS_CYCLES_NS: u32 = 237;
 pub const KVM_CAP_X86_GUEST_MODE: u32 = 238;
-pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
-pub const KVM_CAP_GET_CUR_CPUFREQ: u32 = 512;
-pub const KVM_CAP_UTIL_HINT: u32 = 513;
-pub const KVM_CAP_GET_CPUFREQ_TBL: u32 = 514;
 pub const KVM_IRQ_ROUTING_IRQCHIP: u32 = 1;
 pub const KVM_IRQ_ROUTING_MSI: u32 = 2;
 pub const KVM_IRQ_ROUTING_S390_ADAPTER: u32 = 3;
diff --git a/kvm_sys/src/riscv64/bindings.rs b/kvm_sys/src/riscv64/bindings.rs
index f062cf45c..64ae775de 100644
--- a/kvm_sys/src/riscv64/bindings.rs
+++ b/kvm_sys/src/riscv64/bindings.rs
@@ -18,6 +18,8 @@ use zerocopy::KnownLayout;
 // The original index (236) used in the ChromeOS v6.6 kernel was reused upstream for another
 // capability, so this may return incorrect information on some kernels.
 pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA_CROS: u32 = 236;
+pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
+pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 
 // TODO(qwandor): Update this once the pKVM patches are merged upstream with a stable capability ID.
 pub const KVM_CAP_ARM_PROTECTED_VM: u32 = 0xffbadab1;
@@ -148,7 +150,6 @@ pub const KVM_API_VERSION: u32 = 12;
 pub const KVM_MEM_LOG_DIRTY_PAGES: u32 = 1;
 pub const KVM_MEM_READONLY: u32 = 2;
 pub const KVM_MEM_GUEST_MEMFD: u32 = 4;
-pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 pub const KVM_PIT_SPEAKER_DUMMY: u32 = 1;
 pub const KVM_EXIT_HYPERV_SYNIC: u32 = 1;
 pub const KVM_EXIT_HYPERV_HCALL: u32 = 2;
@@ -467,10 +468,6 @@ pub const KVM_CAP_VM_TYPES: u32 = 235;
 pub const KVM_CAP_PRE_FAULT_MEMORY: u32 = 236;
 pub const KVM_CAP_X86_APIC_BUS_CYCLES_NS: u32 = 237;
 pub const KVM_CAP_X86_GUEST_MODE: u32 = 238;
-pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
-pub const KVM_CAP_GET_CUR_CPUFREQ: u32 = 512;
-pub const KVM_CAP_UTIL_HINT: u32 = 513;
-pub const KVM_CAP_GET_CPUFREQ_TBL: u32 = 514;
 pub const KVM_IRQ_ROUTING_IRQCHIP: u32 = 1;
 pub const KVM_IRQ_ROUTING_MSI: u32 = 2;
 pub const KVM_IRQ_ROUTING_S390_ADAPTER: u32 = 3;
diff --git a/kvm_sys/src/x86/bindings.rs b/kvm_sys/src/x86/bindings.rs
index d87d3391a..40f1a77cb 100644
--- a/kvm_sys/src/x86/bindings.rs
+++ b/kvm_sys/src/x86/bindings.rs
@@ -18,6 +18,8 @@ use zerocopy::KnownLayout;
 // The original index (236) used in the ChromeOS v6.6 kernel was reused upstream for another
 // capability, so this may return incorrect information on some kernels.
 pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA_CROS: u32 = 236;
+pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
+pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 
 // TODO(qwandor): Update this once the pKVM patches are merged upstream with a stable capability ID.
 pub const KVM_CAP_ARM_PROTECTED_VM: u32 = 0xffbadab1;
@@ -340,7 +342,6 @@ pub const KVM_API_VERSION: u32 = 12;
 pub const KVM_MEM_LOG_DIRTY_PAGES: u32 = 1;
 pub const KVM_MEM_READONLY: u32 = 2;
 pub const KVM_MEM_GUEST_MEMFD: u32 = 4;
-pub const KVM_MEM_NON_COHERENT_DMA: u32 = 8;
 pub const KVM_PIT_SPEAKER_DUMMY: u32 = 1;
 pub const KVM_EXIT_HYPERV_SYNIC: u32 = 1;
 pub const KVM_EXIT_HYPERV_HCALL: u32 = 2;
@@ -668,10 +669,6 @@ pub const KVM_CAP_VM_TYPES: u32 = 235;
 pub const KVM_CAP_PRE_FAULT_MEMORY: u32 = 236;
 pub const KVM_CAP_X86_APIC_BUS_CYCLES_NS: u32 = 237;
 pub const KVM_CAP_X86_GUEST_MODE: u32 = 238;
-pub const KVM_CAP_USER_CONFIGURE_NONCOHERENT_DMA: u32 = 239;
-pub const KVM_CAP_GET_CUR_CPUFREQ: u32 = 512;
-pub const KVM_CAP_UTIL_HINT: u32 = 513;
-pub const KVM_CAP_GET_CPUFREQ_TBL: u32 = 514;
 pub const KVM_IRQ_ROUTING_IRQCHIP: u32 = 1;
 pub const KVM_IRQ_ROUTING_MSI: u32 = 2;
 pub const KVM_IRQ_ROUTING_S390_ADAPTER: u32 = 3;
diff --git a/tools/impl/bindgen-common.sh b/tools/impl/bindgen-common.sh
index 78a207fd8..0cf43925d 100755
--- a/tools/impl/bindgen-common.sh
+++ b/tools/impl/bindgen-common.sh
@@ -4,7 +4,7 @@
 
 # Helper functions for bindgen scripts sourced by tools/bindgen-all-the-things.
 
-BINDGEN_LINUX="${PWD}/../../third_party/kernel/v6.12"
+LINUX_VERSION="6.12.18"
 
 export BINDGEN_OPTS=(
     '--disable-header-comment'
@@ -48,6 +48,7 @@ bindgen_generate() {
 }
 
 bindgen_cleanup() {
+    rm -rf "${BINDGEN_TEMP}"
     rm -rf "${BINDGEN_LINUX_X86_HEADERS}" "${BINDGEN_LINUX_ARM64_HEADERS}" "${BINDGEN_LINUX_RISCV_HEADERS}"
 }
 
@@ -64,14 +65,18 @@ if [[ -z "${BINDGEN_LINUX_X86_HEADERS+x}" || ! -d "${BINDGEN_LINUX_X86_HEADERS}"
 
     echo -n "Installing Linux headers for x86, arm64, and riscv..."
     (
-        cd "${BINDGEN_LINUX}"
+        BINDGEN_LINUX_TARBALL="https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-${LINUX_VERSION}.tar.xz"
+        export BINDGEN_TEMP=$(mktemp -d)
+        cd "${BINDGEN_TEMP}"
+
+        # TODO: consider caching the downloaded file
+        curl "${BINDGEN_LINUX_TARBALL}" | tar xfJ -
+        cd "linux-${LINUX_VERSION}"
+
         nproc=$(nproc)
         make -s headers_install ARCH=x86 INSTALL_HDR_PATH="${BINDGEN_LINUX_X86_HEADERS}" -j "${nproc}"
         make -s headers_install ARCH=arm64 INSTALL_HDR_PATH="${BINDGEN_LINUX_ARM64_HEADERS}" -j "${nproc}"
         make -s headers_install ARCH=riscv INSTALL_HDR_PATH="${BINDGEN_LINUX_RISCV_HEADERS}" -j "${nproc}"
-        make -s mrproper ARCH=x86
-        make -s mrproper ARCH=arm64
-        make -s mrproper ARCH=riscv
     )
     echo " done."
 fi
diff --git a/virtio_sys/bindgen.sh b/virtio_sys/bindgen.sh
index 37d88f91f..fb8ecdee4 100755
--- a/virtio_sys/bindgen.sh
+++ b/virtio_sys/bindgen.sh
@@ -57,6 +57,8 @@ VIRTIO_IDS_EXTRAS="
 //! from 63) are nonstandard and not defined by the virtio specification.
 
 // Added by virtio_sys/bindgen.sh - do not edit the generated file.
+pub const VIRTIO_ID_WL: u32 = 63;
+pub const VIRTIO_ID_TPM: u32 = 62;
 // TODO(b/236144983): Fix this id when an official virtio-id is assigned to this device.
 pub const VIRTIO_ID_PVCLOCK: u32 = 61;
 // TODO: Remove this once the ID is included in the Linux headers.
diff --git a/virtio_sys/src/virtio_ids.rs b/virtio_sys/src/virtio_ids.rs
index f77fea955..d47cd32c1 100644
--- a/virtio_sys/src/virtio_ids.rs
+++ b/virtio_sys/src/virtio_ids.rs
@@ -12,6 +12,8 @@
 //! from 63) are nonstandard and not defined by the virtio specification.
 
 // Added by virtio_sys/bindgen.sh - do not edit the generated file.
+pub const VIRTIO_ID_WL: u32 = 63;
+pub const VIRTIO_ID_TPM: u32 = 62;
 // TODO(b/236144983): Fix this id when an official virtio-id is assigned to this device.
 pub const VIRTIO_ID_PVCLOCK: u32 = 61;
 // TODO: Remove this once the ID is included in the Linux headers.
@@ -56,5 +58,3 @@ pub const VIRTIO_ID_PARAM_SERV: u32 = 38;
 pub const VIRTIO_ID_AUDIO_POLICY: u32 = 39;
 pub const VIRTIO_ID_BT: u32 = 40;
 pub const VIRTIO_ID_GPIO: u32 = 41;
-pub const VIRTIO_ID_WL: u32 = 63;
-pub const VIRTIO_ID_TPM: u32 = 62;