diff --git a/.github/workflows/build-kernel-release.yml b/.github/workflows/build-kernel-release.yml
index c89f0cc..8cf4d53 100644
--- a/.github/workflows/build-kernel-release.yml
+++ b/.github/workflows/build-kernel-release.yml
@@ -131,6 +131,7 @@ jobs:
       ksu_resolved_hash:    ${{ steps.set-matrix.outputs.ksu_resolved_hash }}
       ksu_options_normalized: ${{ steps.set-matrix.outputs.ksu_options_normalized }}
       susfs_resolved_hash:  ${{ steps.set-matrix.outputs.susfs_resolved_hash }}
+      susfs_base_version: ${{ steps.set-matrix.outputs.susfs_base_version }}
     steps:
       - name: 📥 Checkout Code (to access configs/)
         uses: actions/checkout@v6
@@ -267,8 +268,7 @@ jobs:
           merged_matrix=$(echo "$merged_matrix" | jq --arg resolved_sha "$resolved_sha" 'map(.ksu_resolved_hash = $resolved_sha)')
           
           # SUSFS hash fetch
-          SUSFS_REPO="https://gitlab.com/simonpunk/susfs4ksu.git"
-          PROJECT_ID="simonpunk%2fsusfs4ksu"
+          GITLAB_PROJECT_PATH="simonpunk/susfs4ksu"
           android_ver=$(echo "$merged_matrix" | jq -r '.[0].android_version')
           kernel_ver=$(echo "$merged_matrix"  | jq -r '.[0].kernel_version')
           susfs_key="${android_ver}-${kernel_ver}"
@@ -288,41 +288,55 @@ jobs:
           susfs_enabled=$(echo "$merged_matrix" | jq -r '.[0].susfs')
           
           if [ "$susfs_enabled" = "true" ]; then
-            echo "🔍 Resolving SUSFS hash for: $susfs_key (ref: $susfs_ref)"
+            echo "🔍 Resolving SUSFS hash and version for: $susfs_key (ref: $susfs_ref)"
             
+            # Single GraphQL query: fetch commit SHA + susfs.h blob in one call
+            GL_QUERY="{ project(fullPath: \"${GITLAB_PROJECT_PATH}\") { repository { ch: commit(ref: \"${susfs_ref}\") { sha } blobs(paths: [\"kernel_patches/include/linux/susfs.h\"], ref: \"${susfs_ref}\") { nodes { rawBlob } } } } }"
+
             MAX_RETRIES=3
             RETRY_COUNT=0
             RETRY_DELAY=5
             susfs_resolved=""
+            susfs_base_version="unknown"
             
             until [ $RETRY_COUNT -ge $MAX_RETRIES ]; do
-              # We query the commit endpoint which accepts Branch, Tag, or SHA
-              RESULT=$(curl -s --fail \
-                "https://gitlab.com/api/v4/projects/${PROJECT_ID}/repository/commits/${susfs_ref}")
+              RESPONSE=$(curl -s --fail -G "https://gitlab.com/api/graphql" --data-urlencode "query=$GL_QUERY")
               EXIT_CODE=$?
               
-              if [ $EXIT_CODE -eq 0 ] && [ -n "$RESULT" ]; then
-                susfs_resolved=$(echo "$RESULT" | jq -r '.id')
-                echo "  ✅ Resolved: $susfs_key → $susfs_resolved"
-                break
+              if [ $EXIT_CODE -eq 0 ] && [ -n "$RESPONSE" ]; then
+                susfs_resolved=$(echo "$RESPONSE" | jq -r '.data.project.repository.ch.sha // empty')
+                if [ -n "$susfs_resolved" ] && [ "$susfs_resolved" != "null" ]; then
+                  echo "  ✅ Resolved: $susfs_key → $susfs_resolved"
+                  extracted=$(echo "$RESPONSE" | jq -r '.data.project.repository.blobs.nodes[0].rawBlob // empty' | grep '#define SUSFS_VERSION' | awk -F'"' '{print $2}')
+                  susfs_base_version="${extracted:-unknown}"
+                  echo "  ✅ SUSFS_VERSION = $susfs_base_version"
+                  break
+                fi
               fi
               
               RETRY_COUNT=$((RETRY_COUNT + 1))
-              echo "::warning::GitLab API failed (Attempt $RETRY_COUNT/$MAX_RETRIES). Retrying..."
+              echo "::warning::GitLab GraphQL API failed (Attempt $RETRY_COUNT/$MAX_RETRIES). Retrying..."
               sleep $RETRY_DELAY
             done
             
-            # Final Validation
+            # Final Validation — SUSFS hash
             if [ -z "$susfs_resolved" ] || [ "$susfs_resolved" = "null" ]; then
               echo "::error::Could not resolve SUSFS ref '$susfs_ref' for $susfs_key on GitLab."
               exit 1
             fi
+            
+            # Final Validation — SUSFS version
+            if [ "$susfs_base_version" = "unknown" ]; then
+              echo "::warning::Could not extract SUSFS_VERSION from susfs.h after $MAX_RETRIES attempts."
+            fi
           else
             susfs_resolved="unknown"
+            susfs_base_version="unknown"
             echo "ℹ️  SUSFS disabled for this device, skipping resolution"
           fi
           
           echo "susfs_resolved_hash=$susfs_resolved" >> "$GITHUB_OUTPUT"
+          echo "susfs_base_version=$susfs_base_version" >> "$GITHUB_OUTPUT"
           
           # Inject susfs_resolved_hash into matrix
           merged_matrix=$(echo "$merged_matrix" | jq \