diff --git a/helpers/DATA/hw-detect/patch_changes/001-disable_firmware_lookup_or_load_request.patch b/helpers/DATA/hw-detect/patch_changes/001-disable_firmware_lookup_or_load_request.patch
new file mode 100644
index 0000000..bb006b5
--- /dev/null
+++ b/helpers/DATA/hw-detect/patch_changes/001-disable_firmware_lookup_or_load_request.patch
@@ -0,0 +1,59 @@
+diff --git a/check-missing-firmware.sh b/check-missing-firmware.sh
+index c6a5a845..3bb4d6a4 100755
+--- a/check-missing-firmware.sh
++++ b/check-missing-firmware.sh
+@@ -361,8 +361,6 @@ check_for_firmware() {
+ # For those who don't want to load any firmware, even if available on
+ # installation images (#1029848). The loop is still entered so that
+ # logs are generated.
+-db_get hw-detect/firmware-lookup
+-firmware_lookup="$RET"
+ 
+ # NOTE: The ask_load_firmware function returns true the first time around,
+ # without asking any questions. For consistency, skip mountmedia calls during
+@@ -373,10 +371,11 @@ while check_missing && ask_load_firmware; do
+ 	loop=$((loop+1))
+ 	log "mainloop iteration #$loop"
+ 
+-	if [ "$firmware_lookup" = "never" ]; then
+-		log "firmware lookup disabled (=$firmware_lookup), exiting"
+-		exit 0
+-	fi
++	# Trisquel: hardcode disable firmware loading
++	# to prevent installation of nonfree blobs. This script
++	# is kept to preserve compatibility with hw-detect.
++	log "firmware lookup disabled (hardcoded), exiting"
++	exit 0
+ 
+ 	# first, check if needed firmware debs are available on the
+ 	# PXE initrd or the installation CD.
+diff --git a/hw-detect.post-base-installer.d/50install-firmware b/hw-detect.post-base-installer.d/50install-firmware
+old mode 100755
+new mode 100644
+index f6e069f3..f69ed994
+--- a/hw-detect.post-base-installer.d/50install-firmware
++++ b/hw-detect.post-base-installer.d/50install-firmware
+@@ -8,12 +8,12 @@ log () {
+ 
+ # For those who don't want to load any firmware, even if available on
+ # installation images (#1029848):
+-db_get hw-detect/firmware-lookup
+-firmware_lookup="$RET"
+-if [ "$firmware_lookup" = "never" ]; then
+-	log "firmware lookup disabled (=$firmware_lookup), exiting"
+-	exit 0
+-fi
++
++# Trisquel: hardcode disable firmware loading
++# to prevent installation of nonfree blobs. This script
++# is kept to preserve compatibility with hw-detect.
++log "firmware lookup disabled (hardcoded), exiting"
++exit 0
+ 
+ # copy any loose firmware files to /target (incl. subdirs)
+ if [ -d /lib/firmware ]; then@@ -56,5 +56,3 @@ done
+ printf "GenuineIntel intel-microcode\nAuthenticAMD amd64-microcode\n" | while read vendor pkg; do
+ 	if grep -qs "^vendor_id.*$vendor$" /proc/cpuinfo; then
+ 		log "queuing $pkg installation ($vendor)"
+-		echo $pkg >> /tmp/microcode.list
+-		mkdir -p /var/cache/firmware
diff --git a/helpers/DATA/hw-detect/patch_changes/002-remove_firmware_lookup_from_template.patch b/helpers/DATA/hw-detect/patch_changes/002-remove_firmware_lookup_from_template.patch
new file mode 100644
index 0000000..337d4f4
--- /dev/null
+++ b/helpers/DATA/hw-detect/patch_changes/002-remove_firmware_lookup_from_template.patch
@@ -0,0 +1,17 @@
+diff --git a/debian/hw-detect.templates b/debian/hw-detect.templates
+index 790afdbf..db5e2934 100644
+--- a/debian/hw-detect.templates
++++ b/debian/hw-detect.templates
+@@ +79,12 -79,3 @@ Template: hw-detect/load-ide
+ Type: boolean
+ Default: false
+ Description: for internal use; can be preseeded
+-
+-# This is an initial implementation, which might evolve over time (#1029848):
+-Template: hw-detect/firmware-lookup
+-Type: text
+-Default:
+-Description: for expert use; can be preseeded
+- Setting this to "never" makes check-missing-firmware and install-firmware
+- hooks not try to find and install firmware packages (even if available on
+- the installation image).
diff --git a/helpers/make-hw-detect b/helpers/make-hw-detect
index 579b3a5..40815af 100644
--- a/helpers/make-hw-detect
+++ b/helpers/make-hw-detect
@@ -17,8 +17,8 @@
 #    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
 #
 
-VERSION=1
-EXTERNAL='deb-src http://ftp.debian.org/debian bullseye main'
+VERSION=2
+EXTERNAL='deb-src http://ftp.debian.org/debian trixie main'
 REPOKEY=0E98404D386FA1D9
 NETINST=true
 . ./config
@@ -35,5 +35,7 @@ sed ${START},${END}d debian/hw-detect.templates -i
 
 sed -i '/non-free/,/^fi$/ d'  hw-detect.post-base-installer.d/50install-firmware
 
+apply_patch_changes
+
 changelog "Rebranded and adapted for Trisquel"
 package