diff --git a/calamares/modules/initcpio.conf b/calamares/modules/initcpio.conf
index 16fb25e..717a511 100644
--- a/calamares/modules/initcpio.conf
+++ b/calamares/modules/initcpio.conf
@@ -1,2 +1,25 @@
+# SPDX-FileCopyrightText: no
+# SPDX-License-Identifier: CC0-1.0
+#
+# Run mkinitcpio(8) with the given preset value
 ---
-kernel: linux510
+# This key defines the kernel to be loaded.
+# It can have the following values:
+#  - empty or unset, interpreted as "all"
+#  - the literal string "$uname" (without quotes, with dollar),
+#    which will use the output of `uname -r` to determine the
+#    running kernel, and use that.
+#  - any other string.
+#
+# Whatever is set, that string is passed as *preset* argument to the
+# `-p` option of *mkinitcpio*. Take care that both "$uname" operates
+# in the host system, and might not be correct if the target system is
+# updated (to a newer kernel) as part of the installation.
+#
+# Note that "all" is probably not a good preset to use either.
+kernel: linux312
+
+# Set this to true to turn off mitigations for lax file
+# permissions on initramfs (which, in turn, can compromise
+# your LUKS encryption keys, CVS-2019-13179).
+be_unsafe: false