diff --git a/config/htop.conf b/config/htop.conf
new file mode 100644
index 000000000..5878b2936
--- /dev/null
+++ b/config/htop.conf
@@ -0,0 +1,2 @@
+CONFIG_PACKAGE_htop=m
+CONFIG_HTOP_LMSENSORS=y
diff --git a/config/utils.conf b/config/utils.conf
new file mode 100644
index 000000000..ef2673c38
--- /dev/null
+++ b/config/utils.conf
@@ -0,0 +1 @@
+CONFIG_PACKAGE_nano-full=m
diff --git a/docs/design/distfeed.md b/docs/design/distfeed.md
index 4a9a9a35f..559435129 100644
--- a/docs/design/distfeed.md
+++ b/docs/design/distfeed.md
@@ -118,3 +118,9 @@ https://downloads.openwrt.org/releases/${openwrt_version}/packages/${package_arc
 https://downloads.openwrt.org/releases/${openwrt_version}/packages/${package_arch}/routing/packages.adb
 EOF
 ```
+
+Packages from `customfeeds.list` are not rebuilt or QA'd by NethSecurity, so the nightly
+package-update cron and the UI's package update check/install flow never consider them: both
+run `apk` through `/usr/sbin/apk-official`, which temporarily moves `customfeeds.list` aside for
+the duration of a single `apk` call and restores it afterwards. Direct/manual `apk` invocations
+are unaffected and still see `customfeeds.list` normally.
diff --git a/packages/ns-api/files/ns.update b/packages/ns-api/files/ns.update
index 0732af949..f7326e4b7 100755
--- a/packages/ns-api/files/ns.update
+++ b/packages/ns-api/files/ns.update
@@ -53,11 +53,11 @@ def check_package_updates():
     try:
         # download metadata only if they are older than 5 minutes
         if (time.time() - last_package_check()) > 300:
-            subprocess.run(["/usr/bin/apk", "update"], check=True, capture_output=True)
+            subprocess.run(["/usr/sbin/apk-official", "update"], check=True, capture_output=True)
     except Exception as e:
         print(e, file=sys.stderr)
         return utils.generic_error("apk_update_failed")
-    p = subprocess.run(["/usr/bin/apk", "list", "--upgradable"], check=True, capture_output=True, text=True)
+    p = subprocess.run(["/usr/sbin/apk-official", "list", "--upgradable"], check=True, capture_output=True, text=True)
     for line in p.stdout.split("\n"):
         if not line:
             continue
diff --git a/packages/ns-plug/Makefile b/packages/ns-plug/Makefile
index 5442e0146..6bd1f0a0e 100644
--- a/packages/ns-plug/Makefile
+++ b/packages/ns-plug/Makefile
@@ -81,6 +81,7 @@ define Package/ns-plug/install
 	$(INSTALL_BIN) ./files/ns-plug $(1)/usr/sbin/ns-plug
 	$(INSTALL_BIN) ./files/ns-plug-alert-proxy $(1)/usr/sbin/ns-plug-alert-proxy
 	$(INSTALL_BIN) ./files/distfeed-setup $(1)/usr/sbin/distfeed-setup
+	$(INSTALL_BIN) ./files/apk-official $(1)/usr/sbin/apk-official
 	$(INSTALL_BIN) ./files/remote-backup $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/send-backup $(1)/usr/sbin
 	$(INSTALL_BIN) ./files/send-heartbeat $(1)/usr/sbin
diff --git a/packages/ns-plug/files/apk-official b/packages/ns-plug/files/apk-official
new file mode 100755
index 000000000..65c4d03ad
--- /dev/null
+++ b/packages/ns-plug/files/apk-official
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+#
+# Copyright (C) 2026 Nethesis S.r.l.
+# SPDX-License-Identifier: GPL-2.0-only
+#
+
+# Runs a single apk subcommand with the user-added customfeeds.list
+# (docs/design/distfeed.md "Upstream OpenWrt repositories") temporarily
+# excluded, so automatic update paths never install a package that bypassed
+# the NethSecurity distfeed/QA channel. Serialized via flock so overlapping
+# invocations (cron, UI, manual admin apk use) don't race on the file.
+
+LOCK=/var/run/apk-official.lock
+CUSTOMFEEDS=/etc/apk/repositories.d/customfeeds.list
+DISABLED="${CUSTOMFEEDS}.disabled"
+
+exec 9>"$LOCK"
+flock 9
+
+[ -f "$CUSTOMFEEDS" ] && mv "$CUSTOMFEEDS" "$DISABLED"
+apk "$@"
+status=$?
+[ -f "$DISABLED" ] && mv "$DISABLED" "$CUSTOMFEEDS"
+
+exit $status
diff --git a/packages/ns-plug/files/distfeed-setup b/packages/ns-plug/files/distfeed-setup
index 7e570365b..bb018a1b6 100644
--- a/packages/ns-plug/files/distfeed-setup
+++ b/packages/ns-plug/files/distfeed-setup
@@ -8,12 +8,14 @@
 # setup default variables
 . /etc/openwrt_release
 . /etc/os-release
+openwrt_version="$(cat /etc/openwrt_version)"
+openwrt_version="${openwrt_version#v}"
 cat << EOF > /etc/apk/repositories.d/99-defaults.list
 # This file is handled by nethsecurity and should not be edited manually. Changes will be overwritten.
 # Create a 98-overrides.list file to override these values if needed.
 set -default target_arch=$DISTRIB_TARGET
 set -default package_arch=$DISTRIB_ARCH
-set -default openwrt_version=$(cat /etc/openwrt_version)
+set -default openwrt_version=$openwrt_version
 set -default repo_channel=$(cat /etc/repo-channel)
 set -default version=$VERSION_ID
 EOF
diff --git a/packages/ns-plug/files/update-packages b/packages/ns-plug/files/update-packages
index 92ce77f3d..54f3bc222 100644
--- a/packages/ns-plug/files/update-packages
+++ b/packages/ns-plug/files/update-packages
@@ -15,15 +15,15 @@ error_exit() {
 }
 
 # Update metadata, make sure to output even if in case of error
-output=$(apk update 2>&1)
+output=$(apk-official update 2>&1)
 status=$?
 echo "$output" | logger -s -t update-packages
 [ $status -ne 0 ] && error_exit "Failed to update metadata"
 
 error_count=0
 # Upgrade each package individually and capture output
-apk list --upgradable 2>/dev/null | grep -o '{[^}]*}' | tr -d '{}' | sed 's|.*/||' | while read -r package; do
-    output=$(apk upgrade "$package" 2>&1)
+apk-official list --upgradable 2>/dev/null | grep -o '{[^}]*}' | tr -d '{}' | sed 's|.*/||' | while read -r package; do
+    output=$(apk-official upgrade "$package" 2>&1)
     status=$?
     [ $status -ne 0 ] && error_count=$((error_count + 1))
     echo "$output" | logger -s -t update-packages