diff --git a/resources/guest_configs/ci.config b/resources/guest_configs/ci.config
index 7bbf1fb1f56..166ab94db3f 100644
--- a/resources/guest_configs/ci.config
+++ b/resources/guest_configs/ci.config
@@ -5,3 +5,10 @@ CONFIG_SQUASHFS_ZSTD=y
 # aarch64 only TBD split into a separate file
 CONFIG_DEVMEM=y
 # CONFIG_ARM64_ERRATUM_3194386 is not set
+# Needed for CTRL+ALT+DEL support
+CONFIG_SERIO=y
+CONFIG_SERIO_I8042=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_GSCPS2=y
+CONFIG_KEYBOARD_ATKBD=y
+CONFIG_INPUT_KEYBOARD=y
\ No newline at end of file
diff --git a/resources/rebuild.sh b/resources/rebuild.sh
index 90bac7addb7..56afd1bdbac 100755
--- a/resources/rebuild.sh
+++ b/resources/rebuild.sh
@@ -120,7 +120,7 @@ EOF
 }
 
 function clone_amazon_linux_repo {
-    [ -d linux ] || git clone https://github.com/amazonlinux/linux linux
+    [ -d linux ] || git clone --no-checkout --filter=tree:0 https://github.com/amazonlinux/linux
 }
 
 # prints the git tag corresponding to the newest and best matching the provided kernel version $1
@@ -145,7 +145,8 @@ function build_al_kernel {
     local KERNEL_VERSION=$(echo $KERNEL_CFG | grep -Po "microvm-kernel-ci-$ARCH-\K(\d+\.\d+)")
 
     pushd linux
-    make distclean
+    # fails immediately after clone because nothing is checked out
+    make distclean || true
 
     git checkout $(get_tag $KERNEL_VERSION)
 
diff --git a/tests/framework/utils_cpuid.py b/tests/framework/utils_cpuid.py
index dabfb220240..979f4478c8b 100644
--- a/tests/framework/utils_cpuid.py
+++ b/tests/framework/utils_cpuid.py
@@ -28,6 +28,7 @@ class CpuModel(str, Enum):
     AMD_GENOA = "AMD_GENOA"
     ARM_NEOVERSE_N1 = "ARM_NEOVERSE_N1"
     ARM_NEOVERSE_V1 = "ARM_NEOVERSE_V1"
+    ARM_NEOVERSE_V2 = "ARM_NEOVERSE_V2"
     INTEL_SKYLAKE = "INTEL_SKYLAKE"
     INTEL_CASCADELAKE = "INTEL_CASCADELAKE"
     INTEL_ICELAKE = "INTEL_ICELAKE"
@@ -41,7 +42,11 @@ class CpuModel(str, Enum):
         "Intel(R) Xeon(R) Platinum 8375C CPU": "INTEL_ICELAKE",
     },
     CpuVendor.AMD: {"AMD EPYC 7R13": "AMD_MILAN", "AMD EPYC 9R14": "AMD_GENOA"},
-    CpuVendor.ARM: {"0xd0c": "ARM_NEOVERSE_N1", "0xd40": "ARM_NEOVERSE_V1"},
+    CpuVendor.ARM: {
+        "0xd0c": "ARM_NEOVERSE_N1",
+        "0xd40": "ARM_NEOVERSE_V1",
+        "0xd4f": "ARM_NEOVERSE_V2",
+    },
 }
 
 
diff --git a/tests/integration_tests/functional/test_cpu_features_aarch64.py b/tests/integration_tests/functional/test_cpu_features_aarch64.py
index 2068194a894..5b667d0b34d 100644
--- a/tests/integration_tests/functional/test_cpu_features_aarch64.py
+++ b/tests/integration_tests/functional/test_cpu_features_aarch64.py
@@ -24,6 +24,8 @@
 
 G3_SVE_AND_PAC = set("paca pacg sve svebf16 svei8mm".split())
 
+G4_FEATS = (G3_FEATS | set("bti flagm2 frint sb".split())) - set("sm3 sm4".split())
+
 
 def test_guest_cpu_features(uvm_any):
     """Check the CPU features for a microvm with different CPU templates"""
@@ -43,6 +45,8 @@ def test_guest_cpu_features(uvm_any):
             expected_cpu_features = G3_FEATS | G3_SVE_AND_PAC
         case CpuModel.ARM_NEOVERSE_V1, None:
             expected_cpu_features = G3_FEATS
+        case CpuModel.ARM_NEOVERSE_V2, None:
+            expected_cpu_features = G4_FEATS
 
     guest_feats = set(vm.ssh.check_output(CPU_FEATURES_CMD).stdout.split())
     assert guest_feats == expected_cpu_features
diff --git a/tests/integration_tests/functional/test_cpu_features_host_vs_guest.py b/tests/integration_tests/functional/test_cpu_features_host_vs_guest.py
index d2fd4936328..c8075faa505 100644
--- a/tests/integration_tests/functional/test_cpu_features_host_vs_guest.py
+++ b/tests/integration_tests/functional/test_cpu_features_host_vs_guest.py
@@ -257,12 +257,21 @@ def test_host_vs_guest_cpu_features(uvm_nano):
             assert host_feats - guest_feats == expected_host_minus_guest
             assert guest_feats - host_feats == expected_guest_minus_host
 
-        case CpuModel.ARM_NEOVERSE_V1:
+        case CpuModel.ARM_NEOVERSE_V1 | CpuModel.ARM_NEOVERSE_V2:
             expected_guest_minus_host = set()
             # KVM does not enable PAC or SVE features by default
             # and Firecracker does not enable them either.
             expected_host_minus_guest = {"paca", "pacg", "sve", "svebf16", "svei8mm"}
 
+            if CPU_MODEL == CpuModel.ARM_NEOVERSE_V2:
+                expected_host_minus_guest |= {
+                    "svebitperm",
+                    "svesha3",
+                    "sveaes",
+                    "sve2",
+                    "svepmull",
+                }
+
             # Upstream kernel v6.11+ hides "ssbs" from "lscpu" on Neoverse-N1 and Neoverse-V1 since
             # they have an errata whereby an MSR to the SSBS special-purpose register does not
             # affect subsequent speculative instructions, permitting speculative store bypassing for