diff --git a/src/platform/kevin/atf/default.nix b/src/platform/kevin/atf/default.nix
index 0d683fa..c16adb6 100644
--- a/src/platform/kevin/atf/default.nix
+++ b/src/platform/kevin/atf/default.nix
@@ -11,7 +11,20 @@
 }:
 
 let
-  version = "1.6";
+
+  # unfortunately with the full v1.6 the gru-kevin laptop reboots
+  # instead of waking up from sleep (suspend-to-ram)
+  #
+  #version = "1.6";
+  #hash = "sha256-WLFO+loCds6/Ej/8LQGdro8O16c7RhigR05P6tUZACI=";
+  #rev = "v${version}";
+
+  # So we have to roll back roughly 835 commits (about 9 months).
+  # TODO: git bisect and revert only what has to be reverted.
+  version = "pre-1.6-3cb749";
+  rev = "3cb74922d02bbf64c8dbcaae7093f7b94d72c948";
+  hash = "sha256-0r57ISPaKR3eTbuSX5XA8RsH59PNdbEyQSN3XpTlUxk=";
+
   atf_platform = "rk3399";
 in
 (buildArmTrustedFirmware {
@@ -33,8 +46,8 @@ in
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "arm-trusted-firmware";
-    rev = "v${version}";
-    hash = "sha256-WLFO+loCds6/Ej/8LQGdro8O16c7RhigR05P6tUZACI=";
+    inherit rev;
+    inherit hash;
   };
 
   # -F3 is needed in order to force the backport patches below to apply to an older atf
@@ -59,7 +72,7 @@ in
     })
 
     # this <nixpkgs/pkgs/misc/arm-trusted-firmware/remove-hdcp-blob.patch> rebased back to atf 1.6
-    ./remove-hdcp-blob-atf1.6.patch
+    ./remove-hdcp-blob-atf-3cb749.patch
   ];
 
   dontStrip = false;
diff --git a/src/platform/kevin/atf/remove-hdcp-blob-atf-3cb749.patch b/src/platform/kevin/atf/remove-hdcp-blob-atf-3cb749.patch
new file mode 100644
index 0000000..ea2baf6
--- /dev/null
+++ b/src/platform/kevin/atf/remove-hdcp-blob-atf-3cb749.patch
@@ -0,0 +1,75 @@
+commit 1f5ee6b1006d3d41d96901dca17f9d2758797836
+Author: Your Name <you@example.com>
+Date:   Sun Nov 14 22:31:39 2021 -0800
+
+    Expunge HDCP firmware binary blob; patch taken from here, minus the
+    baud-rate change:
+    
+      https://gitlab.com/vicencb/kevinboot/-/blob/master/atf.patch
+
+diff --git a/lib/stack_protector/stack_protector.mk b/lib/stack_protector/stack_protector.mk
+index 0f0d90fb8..936b0a3f7 100644
+--- a/lib/stack_protector/stack_protector.mk
++++ b/lib/stack_protector/stack_protector.mk
+@@ -12,7 +12,7 @@ STACK_PROTECTOR_ENABLED := 1
+ BL_COMMON_SOURCES	+=	lib/stack_protector/stack_protector.c			\
+ 				lib/stack_protector/${ARCH}/asm_stack_protector.S
+ 
+-TF_CFLAGS		+=	-fstack-protector-${ENABLE_STACK_PROTECTOR}
++TF_CFLAGS		+=	-fstack-protector-explicit
+ endif
+ 
+ $(eval $(call add_define,STACK_PROTECTOR_ENABLED))
+diff --git a/plat/rockchip/rk3399/drivers/dp/cdn_dp.c b/plat/rockchip/rk3399/drivers/dp/cdn_dp.c
+index f1a5e2b7a..d22ff63e8 100644
+--- a/plat/rockchip/rk3399/drivers/dp/cdn_dp.c
++++ b/plat/rockchip/rk3399/drivers/dp/cdn_dp.c
+@@ -9,17 +9,6 @@
+ #include <stdlib.h>
+ #include <string.h>
+ 
+-__asm__(
+-	".pushsection .text.hdcp_handler, \"ax\", %progbits\n"
+-	".global hdcp_handler\n"
+-	".balign 4\n"
+-	"hdcp_handler:\n"
+-	".incbin \"" __XSTRING(HDCPFW) "\"\n"
+-	".type hdcp_handler, %function\n"
+-	".size hdcp_handler, .- hdcp_handler\n"
+-	".popsection\n"
+-);
+-
+ static uint64_t *hdcp_key_pdata;
+ static struct cdn_dp_hdcp_key_1x key;
+ 
+@@ -34,7 +23,7 @@ uint64_t dp_hdcp_ctrl(uint64_t type)
+ 		return 0;
+ 	case HDCP_KEY_DATA_START_DECRYPT:
+ 		if (hdcp_key_pdata == (uint64_t *)(&key + 1))
+-			return hdcp_handler(&key);
++			return PSCI_E_DISABLED;
+ 		else
+ 			return PSCI_E_INVALID_PARAMS;
+ 	default:
+diff --git a/plat/rockchip/rk3399/platform.mk b/plat/rockchip/rk3399/platform.mk
+index 1997dfc48..69a4954f7 100644
+--- a/plat/rockchip/rk3399/platform.mk
++++ b/plat/rockchip/rk3399/platform.mk
+@@ -82,17 +82,11 @@ BUILD_M0		:=	${BUILD_PLAT}/m0
+ RK3399M0FW=${BUILD_M0}/${PLAT_M0}.bin
+ $(eval $(call add_define,RK3399M0FW))
+ 
+-HDCPFW=${RK_PLAT_SOC}/drivers/dp/hdcp.bin
+-$(eval $(call add_define,HDCPFW))
+-
+ # CCACHE_EXTRAFILES is needed because ccache doesn't handle .incbin
+ export CCACHE_EXTRAFILES
+ ${BUILD_PLAT}/bl31/pmu_fw.o: CCACHE_EXTRAFILES=$(RK3399M0FW)
+ ${RK_PLAT_SOC}/drivers/pmu/pmu_fw.c: $(RK3399M0FW)
+ 
+-${BUILD_PLAT}/bl31/cdn_dp.o: CCACHE_EXTRAFILES=$(HDCPFW)
+-${RK_PLAT_SOC}/drivers/dp/cdn_dp.c: $(HDCPFW)
+-
+ $(eval $(call MAKE_PREREQ_DIR,${BUILD_M0},${BUILD_PLAT}))
+ .PHONY: $(RK3399M0FW)
+ $(RK3399M0FW): | ${BUILD_M0}