diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 73f5481..052f41f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -220,6 +220,11 @@ jobs:
           CROSS_COMPILE: arm-linux-gnueabihf-
           WARDEN_CCACHE: 1
           CCACHE_DIR: /home/runner/.ccache
+          # Matched module set for the out-of-tree wifi/BT drivers (issue #4:
+          # a stale 5.10 .ko was all the panel had). Full `make modules` runs
+          # (zImage alone emits no Module.symvers); only these dirs' .ko files
+          # are collected/uploaded.
+          WARDEN_MODULES_COLLECT: drivers/net/wireless/aic8800
         # KERNEL_TARBALL is exported from the SHELL so $HOME expands — a literal
         # `~` in a YAML env: value is never tilde-expanded and broke every
         # dispatch until caught in review.
@@ -246,6 +251,7 @@ jobs:
           path: |
             ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
             ${{ runner.temp }}/kbuild-out/linux-6.18.46/arch/arm/boot/dts/rockchip/rv1106-warden.dtb
+            ${{ runner.temp }}/kbuild-out/modules-out/*.ko
           # Short so kernel images self-expire instead of piling into the
           # account-wide storage quota; the prune-artifacts job above is the
           # active bound, this is the backstop.
diff --git a/build/build-kernel.sh b/build/build-kernel.sh
index 73f097c..f0caccd 100755
--- a/build/build-kernel.sh
+++ b/build/build-kernel.sh
@@ -19,6 +19,12 @@
 #                    (qemu/configs/virt.fragment builds the QEMU -M virt variant);
 #                    every fragment option is verified to have taken effect
 #   WARDEN_CCACHE=1  compile through ccache (CI caches ~/.ccache)
+#   WARDEN_MODULES_COLLECT
+#                    space-separated in-tree dirs whose .ko files are wanted
+#                    (e.g. "drivers/net/wireless/aic8800"). Runs a full
+#                    `make modules` (the zImage target alone generates no
+#                    Module.symvers, so per-dir M= builds cannot link) and
+#                    collects the listed dirs' modules into $WORK/modules-out.
 #
 # Requires: `python` (not python3) on PATH — the SDK quirk; the CI runner provides
 # a project-local venv. Builds are SERIAL on the shared SDK box — never run two.
@@ -157,6 +163,28 @@ log "building zImage + rv1106-warden.dtb (-j$JOBS)"
 make -C "$SRC" ARCH=arm CROSS_COMPILE="$CROSS_COMPILE" CC="$KCC" -j"$JOBS" \
   zImage rockchip/rv1106-warden.dtb
 
+# Optional module set (issue #4: the panel loaded a stale 5.10 .ko because
+# this build never produced matched 6.18 modules). Full `make modules` is
+# required — zImage alone emits no Module.symvers, so a per-directory M=
+# build cannot resolve even core symbols. FAILS CLOSED if a listed dir
+# yields no modules.
+if [ -n "${WARDEN_MODULES_COLLECT:-}" ]; then
+  MODOUT="$WORK/modules-out"
+  rm -rf "$MODOUT"; mkdir -p "$MODOUT"
+  log "building modules (full set — needed for Module.symvers)"
+  make -C "$SRC" ARCH=arm CROSS_COMPILE="$CROSS_COMPILE" CC="$KCC" -j"$JOBS" modules
+  for d in $WARDEN_MODULES_COLLECT; do
+    [ -d "$SRC/$d" ] || { echo "FATAL: WARDEN_MODULES_COLLECT dir '$d' not in tree" >&2; exit 1; }
+    n=0
+    while IFS= read -r ko; do
+      cp "$ko" "$MODOUT/"; n=$((n + 1))
+    done < <(find "$SRC/$d" -name '*.ko')
+    [ "$n" -gt 0 ] || { echo "FATAL: no .ko produced under '$d'" >&2; exit 1; }
+    log "collected $n module(s) from $d"
+  done
+  ls -la "$MODOUT"
+fi
+
 Z="$SRC/arch/arm/boot/zImage"
 D="$SRC/arch/arm/boot/dts/rockchip/rv1106-warden.dtb"
 log "build OK"