diff --git a/src/coreboot/default.nix b/src/coreboot/default.nix
index b202038..f1b519e 100644
--- a/src/coreboot/default.nix
+++ b/src/coreboot/default.nix
@@ -37,6 +37,8 @@ stdenv.mkDerivation {
 
   inherit src;
   patches = let inherit (nixpkgsOnBuildForBuild) fetchpatch; in [
+
+    # backport upstream commits newer than ${version}
     (fetchpatch {
       # Makefile.inc: Use `define` for cbfs-files-processor-defconfig
       url = "https://github.com/coreboot/coreboot/commit/1c08a9a9c4986f2b3c47322f041e289121536dc0.patch";
@@ -57,29 +59,6 @@ stdenv.mkDerivation {
       url = "https://github.com/coreboot/coreboot/commit/2db6e6806b0966d5e921752aa3f91af0310b3181.patch";
       hash = "sha256-Bvtz4joH+v5RSzDPAa8w0in/UKXdPvGO2tijamHPAfs=";
     })
-    ./patches/0006-remove-submodules.patch
-    ./patches/0008-payloads-external-linux-allow-CONFIG_LINUX_COMMAND_L.patch
-    ./patches/0009-payloads-Kconfig-add-CONFIG_UNCOMPRESSED_PAYLOAD.patch
-    ./patches/0010-rk3399-mainboard-google-gru-add-define-for-GPIO_PEN_.patch
-    ./patches/0011-rk3399-src-Kconfig-increase-HEAP_SIZE-to-0x40000-byt.patch
-    ./patches/0012-rk3399-include-soc-memlayout.ld-enlarge-RAMSTAGE-and.patch
-    ./patches/0013-kgpe-d16-src-arch-x86-use-CONFIG_CBFS_PREFIX-instead.patch
-    ./patches/0014-kgpe-d16-ignore-nvram-for-power_state-always_on-iomm.patch
-    ./patches/0015-kgpe-d16-factor-out-is_recovery_jumper_set-print-val.patch
-    ./patches/0016-kgpe-d16-src-drivers-pc80-factor-rewrite_cmos-out-of.patch
-    ./patches/0017-use_fallback-platform-independent-part.patch
-    ./patches/0018-use_fallback-rk3399-gru-kevin-use-fallback-if-watchd.patch
-    ./patches/0019-use_fallback-rk3399-gru-kevin-update-for-coreboot-4..patch
-    ./patches/0020-use_fallback-kgpe-d16-implement-using-nvram-with-cmo.patch
-    ./patches/0021-am1i-omit-amdfw.rom-completely-it-has-broken-address.patch
-    ./patches/0022-kgpe-d16-disable-sanitize_cmos-it-causes-too-many-pr.patch
-    ./patches/0023-kgpe-d16-disable-TPM.patch
-    ./patches/0024-amd-sb700-early_setup.c-select-console-properly.patch
-    ./patches/0025-southbridge-amd-sb700-lpc.c-set-SPI-flash-aperture-t.patch
-    ./patches/0001-mainboard-asus-kgpe-d16-romstage.c-support-console-o.patch
-    ./patches/0002-southbridge-amd-sb700-lpc.c-leave-LPC-timeout-mechan.patch
-    ./patches/0003-treewide-reduce-many-messages-to-BIOS_SPEW.patch
-
     # the next two patches are required in order for the third patch to apply properly
     (fetchpatch {
       # AUTHORS, util/: Drop individual copyright notices
@@ -100,10 +79,43 @@ stdenv.mkDerivation {
       includes = [ "util/rockchip/make_idb.py" ];
     })
 
+    # remove submodules for hermeticity (not needed anyways)
+    ./patches/0006-remove-submodules.patch
+
+    # additional Kconfig options
+    ./patches/0008-payloads-external-linux-allow-CONFIG_LINUX_COMMAND_L.patch
+    ./patches/0009-payloads-Kconfig-add-CONFIG_UNCOMPRESSED_PAYLOAD.patch
+
+    # rk3399 patches
+    ./patches/0010-rk3399-mainboard-google-gru-add-define-for-GPIO_PEN_.patch
+    ./patches/0011-rk3399-src-Kconfig-increase-HEAP_SIZE-to-0x40000-byt.patch
+    ./patches/0012-rk3399-include-soc-memlayout.ld-enlarge-RAMSTAGE-and.patch
+
+    # kgpe-d16 patches
+    ./patches/0013-kgpe-d16-src-arch-x86-use-CONFIG_CBFS_PREFIX-instead.patch
+    ./patches/0014-kgpe-d16-ignore-nvram-for-power_state-always_on-iomm.patch
+    ./patches/0015-kgpe-d16-factor-out-is_recovery_jumper_set-print-val.patch
+    ./patches/0016-kgpe-d16-src-drivers-pc80-factor-rewrite_cmos-out-of.patch
+    ./patches/0022-kgpe-d16-disable-sanitize_cmos-it-causes-too-many-pr.patch
+    ./patches/0023-kgpe-d16-disable-TPM.patch
+    ./patches/0024-amd-sb700-early_setup.c-select-console-properly.patch
+    ./patches/0025-southbridge-amd-sb700-lpc.c-set-SPI-flash-aperture-t.patch
+    ./patches/0001-mainboard-asus-kgpe-d16-romstage.c-support-console-o.patch
+    ./patches/0002-southbridge-amd-sb700-lpc.c-leave-LPC-timeout-mechan.patch
+    ./patches/0003-treewide-reduce-many-messages-to-BIOS_SPEW.patch
     ./patches/0001-mc146818rtc.c-mute-erroneous-warning.patch
     ./patches/0002-mc146818rtc_boot.c-always-report-cmos_chksum_valid-i.patch
     ./patches/0003-kgpe-d16-bootblock.c-use-RTC_BOOT_BYTE-even-when-CON.patch
     ./patches/0004-superio-winbond-w83667hg-a-superio.c-do-not-use-get_.patch
+
+    # am1i patches
+    ./patches/0021-am1i-omit-amdfw.rom-completely-it-has-broken-address.patch
+
+    # normal/fallback functionality (ownerboot-specific)
+    ./patches/0017-use_fallback-platform-independent-part.patch
+    ./patches/0018-use_fallback-rk3399-gru-kevin-use-fallback-if-watchd.patch
+    ./patches/0019-use_fallback-rk3399-gru-kevin-update-for-coreboot-4..patch
+    ./patches/0020-use_fallback-kgpe-d16-implement-using-nvram-with-cmo.patch
   ];
 
   postPatch = ''