diff --git a/internal/rosa/kernel.go b/internal/rosa/kernel.go
index 42fcbdc4..b221345c 100644
--- a/internal/rosa/kernel.go
+++ b/internal/rosa/kernel.go
@@ -29,8 +29,10 @@ func init() {
 }
 
 func (t Toolchain) newKernelHeaders() (pkg.Artifact, string) {
+	const checksum = "lCmBNcMeUmXifg0vecKOPy3GAaFcJSmOPnf3wit9xYTDSTsFADPt1xxUFfmTn1fD"
 	return t.NewPackage("kernel-headers", kernelVersion, kernelSource, &PackageAttr{
-		Flag: TEarly,
+		Flag:          TEarly,
+		KnownChecksum: new(mustDecode(checksum)),
 
 		Paths: []pkg.ExecPath{
 			// updated manually for API changes