serial: T8375: add CLI option to explicitly set kernel console

Previously, VyOS hardcoded the kernel boot log console to either ttyS0 or
tty0, with no post-install CLI method to change it (manual GRUB edits
were required).

This commit adds a new CLI node:
  system console device <name> kernel

When set, the selected serial console is used as the kernel boot console.
When removed, the kernel boot console falls back to tty0.

59 files changed, 298 insertions, 60 deletions

diff --git a/interface-definitions/include/version/system-version.xml.i b/interface-definitions/include/version/system-version.xml.i
index 55764fc40..f29226c03 100644
--- a/interface-definitions/include/version/system-version.xml.i
+++ b/interface-definitions/include/version/system-version.xml.i
@@ -1,3 +1,3 @@
 <!-- include start from include/version/system-version.xml.i -->
-<syntaxVersion component='system' version='31'></syntaxVersion>
+<syntaxVersion component='system' version='32'></syntaxVersion>
 <!-- include end -->
diff --git a/interface-definitions/system_console.xml.in b/interface-definitions/system_console.xml.in
index 9f4c4d570..8ae98291e 100644
--- a/interface-definitions/system_console.xml.in
+++ b/interface-definitions/system_console.xml.in
@@ -36,6 +36,12 @@
               </constraint>
             </properties>
             <children>
+              <leafNode name="kernel">
+                <properties>
+                  <help>Use the console as an output for kernel messages</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
               <leafNode name="speed">
                 <properties>
                   <help>Console baud rate</help>
diff --git a/python/vyos/flavor.py b/python/vyos/flavor.py
index 46c1775f5..a9dccf448 100644
--- a/python/vyos/flavor.py
+++ b/python/vyos/flavor.py
@@ -21,7 +21,8 @@ convenient interface to reading it.
 
 Example of the version data dict::
   {
-   'console_type': 'ttyS0',
+   'console_type': 'ttyS',
+   'console_num': '0',
    'console_speed': '115200'
   }
 """
diff --git a/python/vyos/system/grub.py b/python/vyos/system/grub.py
index 1bae0d5fb..9435d18d2 100644
--- a/python/vyos/system/grub.py
+++ b/python/vyos/system/grub.py
@@ -390,7 +390,7 @@ def set_console_type(console_type: str, root_dir: str = '') -> None:
     """Write default console type to GRUB configuration
 
     Args:
-        console_type (str): a default console type
+        console_type (str): GRUB default console type, e.g. tty, ttyS or ttyAMA
         root_dir (str, optional): an optional path to the root directory.
         Defaults to empty.
     """
diff --git a/python/vyos/utils/kernel.py b/python/vyos/utils/kernel.py
index 48a7e88ea..726025605 100644
--- a/python/vyos/utils/kernel.py
+++ b/python/vyos/utils/kernel.py
@@ -14,12 +14,13 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
+from typing import Tuple
+from typing import Optional
 
 # A list of used Kernel constants
 # https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireguard/messages.h?h=linux-6.6.y#n45
 WIREGUARD_REKEY_AFTER_TIME = 120
 
-
 def load_module(name: str, quiet: bool = True, dry_run: bool = False) -> int:
     """Load a kernel module via modprobe.
 
@@ -39,7 +40,6 @@ def load_module(name: str, quiet: bool = True, dry_run: bool = False) -> int:
     cmd.append(name)
     return run(cmd)
 
-
 def unload_module(name: str) -> int:
     """Unload a kernel module via rmmod.
 
@@ -150,3 +150,25 @@ def lsmod():
     for m in list_loaded_modules():
         mods_data.append(get_module_data(m))
     return mods_data
+
+def get_kernel_serial_console() -> Tuple[Optional[str], Optional[str], Optional[str]]:
+    """
+    Extract the serial console type, number, and speed setting from the kernel
+    command line which was used during system boot.
+    """
+    import re
+    from vyos.utils.file import read_file
+
+    cmdline_console_re = re.compile(
+        r'(?:^|\s)console=(?P<console_type>tty(?:S|AMA))(?P<console_num>\d+),(?P<console_speed>\d+)(?=\s|$)'
+    )
+
+    kernel_cmdline = read_file('/proc/cmdline')
+    if m := cmdline_console_re.search(kernel_cmdline):
+        return (
+            m.group('console_type'),
+            m.group('console_num'),
+            m.group('console_speed'),
+        )
+
+    return (None, None, None)
diff --git a/smoketest/configs/assert/basic-api-service b/smoketest/configs/assert/basic-api-service
index ca10cf4e9..06ac37eb6 100644
--- a/smoketest/configs/assert/basic-api-service
+++ b/smoketest/configs/assert/basic-api-service
@@ -20,6 +20,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
diff --git a/smoketest/configs/assert/basic-haproxy b/smoketest/configs/assert/basic-haproxy
index 7755fc4ea..b7a11ff74 100644
--- a/smoketest/configs/assert/basic-haproxy
+++ b/smoketest/configs/assert/basic-haproxy
@@ -35,6 +35,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/basic-ipv6 b/smoketest/configs/assert/basic-ipv6
index 232a42a07..7bb4a8040 100644
--- a/smoketest/configs/assert/basic-ipv6
+++ b/smoketest/configs/assert/basic-ipv6
@@ -39,4 +39,5 @@ set system login user vyos authentication plaintext-password ''
 set system name-server '2001:db8::1'
 set system name-server '2001:db8::2'
 set system syslog local facility all level 'debug'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
diff --git a/smoketest/configs/assert/basic-syslog b/smoketest/configs/assert/basic-syslog
index a8acc18e9..04c1b0568 100644
--- a/smoketest/configs/assert/basic-syslog
+++ b/smoketest/configs/assert/basic-syslog
@@ -4,6 +4,7 @@ set interfaces ethernet eth1 address '172.16.33.154/24'
 set interfaces ethernet eth1 duplex 'auto'
 set interfaces ethernet eth1 speed 'auto'
 set interfaces ethernet eth1 vrf 'red'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos-ci-test.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/basic-system-ip-protocol b/smoketest/configs/assert/basic-system-ip-protocol
index 870ffa8f5..9d781bb16 100644
--- a/smoketest/configs/assert/basic-system-ip-protocol
+++ b/smoketest/configs/assert/basic-system-ip-protocol
@@ -1,3 +1,5 @@
+set system console device ttyS0 kernel
+set system console device ttyS0 speed '115200'
 set system ip protocol any route-map 'stub'
 set system ip protocol babel route-map 'stub'
 set system ip protocol bgp route-map 'stub'
diff --git a/smoketest/configs/assert/basic-vyos b/smoketest/configs/assert/basic-vyos
index 0f2cc730d..b6286c460 100644
--- a/smoketest/configs/assert/basic-vyos
+++ b/smoketest/configs/assert/basic-vyos
@@ -102,6 +102,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/basic-vyos-no-ntp b/smoketest/configs/assert/basic-vyos-no-ntp
index f00dea5d4..036f0e638 100644
--- a/smoketest/configs/assert/basic-vyos-no-ntp
+++ b/smoketest/configs/assert/basic-vyos-no-ntp
@@ -42,6 +42,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.ci.net'
 set system host-name 'no-ntp'
diff --git a/smoketest/configs/assert/bgp-azure-ipsec-gateway b/smoketest/configs/assert/bgp-azure-ipsec-gateway
index 823a2c36a..b854adcb3 100644
--- a/smoketest/configs/assert/bgp-azure-ipsec-gateway
+++ b/smoketest/configs/assert/bgp-azure-ipsec-gateway
@@ -109,6 +109,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system flow-accounting netflow interface 'eth1'
diff --git a/smoketest/configs/assert/bgp-bfd-communities b/smoketest/configs/assert/bgp-bfd-communities
index 06e412c55..2935b4bc1 100644
--- a/smoketest/configs/assert/bgp-bfd-communities
+++ b/smoketest/configs/assert/bgp-bfd-communities
@@ -192,6 +192,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
diff --git a/smoketest/configs/assert/bgp-big-as-cloud b/smoketest/configs/assert/bgp-big-as-cloud
index 072f5258a..f8e671804 100644
--- a/smoketest/configs/assert/bgp-big-as-cloud
+++ b/smoketest/configs/assert/bgp-big-as-cloud
@@ -829,6 +829,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system flow-accounting netflow interface 'eth0.4088'
 set system flow-accounting netflow interface 'eth0.4089'
diff --git a/smoketest/configs/assert/bgp-dmvpn-hub b/smoketest/configs/assert/bgp-dmvpn-hub
index f9ceba11c..396bcbb1b 100644
--- a/smoketest/configs/assert/bgp-dmvpn-hub
+++ b/smoketest/configs/assert/bgp-dmvpn-hub
@@ -43,6 +43,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'cpe-4'
 set system login user vyos authentication encrypted-password '$6$r/Yw/07NXNY$/ZB.Rjf9jxEV.BYoDyLdH.kH14rU52pOBtrX.4S34qlPt77chflCHvpTCq9a6huLzwaMR50rEICzA5GoIRZlM0'
diff --git a/smoketest/configs/assert/bgp-dmvpn-spoke b/smoketest/configs/assert/bgp-dmvpn-spoke
index a98275ba4..949432849 100644
--- a/smoketest/configs/assert/bgp-dmvpn-spoke
+++ b/smoketest/configs/assert/bgp-dmvpn-spoke
@@ -49,6 +49,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'cpe-1'
 set system login user vyos authentication encrypted-password '$6$r/Yw/07NXNY$/ZB.Rjf9jxEV.BYoDyLdH.kH14rU52pOBtrX.4S34qlPt77chflCHvpTCq9a6huLzwaMR50rEICzA5GoIRZlM0'
diff --git a/smoketest/configs/assert/bgp-evpn-l2vpn-leaf b/smoketest/configs/assert/bgp-evpn-l2vpn-leaf
index 84cf0805e..f8be362c1 100644
--- a/smoketest/configs/assert/bgp-evpn-l2vpn-leaf
+++ b/smoketest/configs/assert/bgp-evpn-l2vpn-leaf
@@ -41,6 +41,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/bgp-evpn-l2vpn-spine b/smoketest/configs/assert/bgp-evpn-l2vpn-spine
index 5d0a70398..1961491f5 100644
--- a/smoketest/configs/assert/bgp-evpn-l2vpn-spine
+++ b/smoketest/configs/assert/bgp-evpn-l2vpn-spine
@@ -34,6 +34,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/bgp-evpn-l3vpn-pe-router b/smoketest/configs/assert/bgp-evpn-l3vpn-pe-router
index 88309e424..3193887fe 100644
--- a/smoketest/configs/assert/bgp-evpn-l3vpn-pe-router
+++ b/smoketest/configs/assert/bgp-evpn-l3vpn-pe-router
@@ -88,6 +88,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/bgp-medium-confederation b/smoketest/configs/assert/bgp-medium-confederation
index 71797fe93..c8abe5a32 100644
--- a/smoketest/configs/assert/bgp-medium-confederation
+++ b/smoketest/configs/assert/bgp-medium-confederation
@@ -63,6 +63,7 @@ set protocols bgp peer-group WDC07v6 remote-as '670'
 set protocols bgp peer-group WDC07v6 update-source 'dum0'
 set protocols bgp system-as '670'
 set system config-management commit-revisions '200'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/bgp-rpki b/smoketest/configs/assert/bgp-rpki
index 657d4abcc..93b48cc97 100644
--- a/smoketest/configs/assert/bgp-rpki
+++ b/smoketest/configs/assert/bgp-rpki
@@ -36,6 +36,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
diff --git a/smoketest/configs/assert/bgp-small-internet-exchange b/smoketest/configs/assert/bgp-small-internet-exchange
index 2adb3fbb5..61ee9755b 100644
--- a/smoketest/configs/assert/bgp-small-internet-exchange
+++ b/smoketest/configs/assert/bgp-small-internet-exchange
@@ -201,6 +201,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
diff --git a/smoketest/configs/assert/bgp-small-ipv4-unicast b/smoketest/configs/assert/bgp-small-ipv4-unicast
index f8820cb3c..a50a81732 100644
--- a/smoketest/configs/assert/bgp-small-ipv4-unicast
+++ b/smoketest/configs/assert/bgp-small-ipv4-unicast
@@ -23,6 +23,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/cluster-basic b/smoketest/configs/assert/cluster-basic
index 871b40bbb..039470177 100644
--- a/smoketest/configs/assert/cluster-basic
+++ b/smoketest/configs/assert/cluster-basic
@@ -12,6 +12,7 @@ set interfaces ethernet eth1 duplex 'auto'
 set interfaces ethernet eth1 speed 'auto'
 set interfaces loopback lo
 set system config-management commit-revisions '100'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/conntrack-basic b/smoketest/configs/assert/conntrack-basic
index 8c375d244..424cefb4e 100644
--- a/smoketest/configs/assert/conntrack-basic
+++ b/smoketest/configs/assert/conntrack-basic
@@ -24,6 +24,7 @@ set system conntrack modules sqlnet
 set system conntrack modules tftp
 set system conntrack table-size '262144'
 set system conntrack timeout
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/container-simple b/smoketest/configs/assert/container-simple
index fcc665100..b9a720393 100644
--- a/smoketest/configs/assert/container-simple
+++ b/smoketest/configs/assert/container-simple
@@ -12,6 +12,7 @@ set interfaces ethernet eth0 speed 'auto'
 set interfaces ethernet eth1 duplex 'auto'
 set interfaces ethernet eth1 speed 'auto'
 set system config-management commit-revisions '50'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$r/Yw/07NXNY$/ZB.Rjf9jxEV.BYoDyLdH.kH14rU52pOBtrX.4S34qlPt77chflCHvpTCq9a6huLzwaMR50rEICzA5GoIRZlM0'
diff --git a/smoketest/configs/assert/dialup-router-complex b/smoketest/configs/assert/dialup-router-complex
index 12edcfef2..b244dc866 100644
--- a/smoketest/configs/assert/dialup-router-complex
+++ b/smoketest/configs/assert/dialup-router-complex
@@ -726,6 +726,7 @@ set system conntrack modules sqlnet
 set system conntrack modules tftp
 set system conntrack table-size '262144'
 set system conntrack timeout
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/dialup-router-medium-vpn b/smoketest/configs/assert/dialup-router-medium-vpn
index 87b35b18c..226aa64be 100644
--- a/smoketest/configs/assert/dialup-router-medium-vpn
+++ b/smoketest/configs/assert/dialup-router-medium-vpn
@@ -296,6 +296,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system ip arp table-size '1024'
diff --git a/smoketest/configs/assert/dialup-router-wireguard-ipv6 b/smoketest/configs/assert/dialup-router-wireguard-ipv6
index 269e9d722..761d65cda 100644
--- a/smoketest/configs/assert/dialup-router-wireguard-ipv6
+++ b/smoketest/configs/assert/dialup-router-wireguard-ipv6
@@ -681,6 +681,7 @@ set system conntrack modules sqlnet
 set system conntrack modules tftp
 set system conntrack table-size '262144'
 set system conntrack timeout
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'r1'
diff --git a/smoketest/configs/assert/dns-dynamic b/smoketest/configs/assert/dns-dynamic
index f40563016..1448847ec 100644
--- a/smoketest/configs/assert/dns-dynamic
+++ b/smoketest/configs/assert/dns-dynamic
@@ -25,6 +25,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$YuG5oKoRYQnbnxk$P2eZNlIwXJP82JFyFrF2g4ZoOZr6zgLHK.SDJVoqWDGefKkRrJijUZODAVMLeWU.9EGM48YtG9MwfuewWoOGE.'
diff --git a/smoketest/configs/assert/egp-igp-route-maps b/smoketest/configs/assert/egp-igp-route-maps
index 222325cd7..0d12c1fb6 100644
--- a/smoketest/configs/assert/egp-igp-route-maps
+++ b/smoketest/configs/assert/egp-igp-route-maps
@@ -29,6 +29,7 @@ set protocols ospfv3 parameters router-id '1.1.1.1'
 set protocols ripng interface eth1
 set protocols static
 set system config-management commit-revisions '100'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system ip protocol bgp route-map 'zebra-bgp'
diff --git a/smoketest/configs/assert/firewall-bridged-global-options b/smoketest/configs/assert/firewall-bridged-global-options
index 1d960d6c1..59b9b4397 100644
--- a/smoketest/configs/assert/firewall-bridged-global-options
+++ b/smoketest/configs/assert/firewall-bridged-global-options
@@ -14,6 +14,7 @@ set interfaces ethernet eth0 duplex 'auto'
 set interfaces ethernet eth0 speed 'auto'
 set interfaces ethernet eth1 duplex 'auto'
 set interfaces ethernet eth1 speed 'auto'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos-ci-test.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/firewall-empty-nodes b/smoketest/configs/assert/firewall-empty-nodes
index c0fcd93be..91aeb273a 100644
--- a/smoketest/configs/assert/firewall-empty-nodes
+++ b/smoketest/configs/assert/firewall-empty-nodes
@@ -25,6 +25,7 @@ set interfaces ethernet eth0
 set interfaces ethernet eth1
 set interfaces ethernet eth2
 set interfaces loopback lo
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/igmp-pim-small b/smoketest/configs/assert/igmp-pim-small
index 06051af41..561cf4c16 100644
--- a/smoketest/configs/assert/igmp-pim-small
+++ b/smoketest/configs/assert/igmp-pim-small
@@ -27,6 +27,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.io'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/ipoe-server b/smoketest/configs/assert/ipoe-server
index c21495ab2..5c3863485 100644
--- a/smoketest/configs/assert/ipoe-server
+++ b/smoketest/configs/assert/ipoe-server
@@ -40,6 +40,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/ipv6-disable b/smoketest/configs/assert/ipv6-disable
index 5f906b5f7..77d585f2d 100644
--- a/smoketest/configs/assert/ipv6-disable
+++ b/smoketest/configs/assert/ipv6-disable
@@ -20,6 +20,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/isis-small b/smoketest/configs/assert/isis-small
index e61d0362e..cefc0ad51 100644
--- a/smoketest/configs/assert/isis-small
+++ b/smoketest/configs/assert/isis-small
@@ -31,6 +31,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.io'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/nat-basic b/smoketest/configs/assert/nat-basic
index f1cc0121d..e7e6916b0 100644
--- a/smoketest/configs/assert/nat-basic
+++ b/smoketest/configs/assert/nat-basic
@@ -77,6 +77,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'R1'
diff --git a/smoketest/configs/assert/ospf-simple b/smoketest/configs/assert/ospf-simple
index 4273e4b8f..02410a3f7 100644
--- a/smoketest/configs/assert/ospf-simple
+++ b/smoketest/configs/assert/ospf-simple
@@ -16,6 +16,7 @@ set protocols ospf interface eth0.666 passive
 set protocols ospf log-adjacency-changes detail
 set protocols static route 0.0.0.0/0 next-hop 193.201.42.170 distance '130'
 set system config-management commit-revisions '100'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'lab-vyos-r1'
 set system login user vyos authentication encrypted-password '$6$R.OnGzfXSfl6J$Iba/hl9bmjBs0VPtZ2zdW.Snh/nHuvxUwi0R6ruypgW63iKEbicJH.uUst8xZCyByURblxRtjAC1lAnYfIt.b0'
diff --git a/smoketest/configs/assert/ospf-small b/smoketest/configs/assert/ospf-small
index af69e5702..811e4af3c 100644
--- a/smoketest/configs/assert/ospf-small
+++ b/smoketest/configs/assert/ospf-small
@@ -65,6 +65,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/pppoe-server b/smoketest/configs/assert/pppoe-server
index e488fc746..dd9429fc3 100644
--- a/smoketest/configs/assert/pppoe-server
+++ b/smoketest/configs/assert/pppoe-server
@@ -39,6 +39,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/qos-basic b/smoketest/configs/assert/qos-basic
index 655a5794e..a9d044c0e 100644
--- a/smoketest/configs/assert/qos-basic
+++ b/smoketest/configs/assert/qos-basic
@@ -67,6 +67,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$r/Yw/07NXNY$/ZB.Rjf9jxEV.BYoDyLdH.kH14rU52pOBtrX.4S34qlPt77chflCHvpTCq9a6huLzwaMR50rEICzA5GoIRZlM0'
diff --git a/smoketest/configs/assert/rip-router b/smoketest/configs/assert/rip-router
index d22f424a5..5d868dcba 100644
--- a/smoketest/configs/assert/rip-router
+++ b/smoketest/configs/assert/rip-router
@@ -75,6 +75,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/rpki-only b/smoketest/configs/assert/rpki-only
index f3e2a74b9..8c49e6c01 100644
--- a/smoketest/configs/assert/rpki-only
+++ b/smoketest/configs/assert/rpki-only
@@ -34,6 +34,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$r/Yw/07NXNY$/ZB.Rjf9jxEV.BYoDyLdH.kH14rU52pOBtrX.4S34qlPt77chflCHvpTCq9a6huLzwaMR50rEICzA5GoIRZlM0'
diff --git a/smoketest/configs/assert/static-route-basic b/smoketest/configs/assert/static-route-basic
index a6135d2c4..06567531d 100644
--- a/smoketest/configs/assert/static-route-basic
+++ b/smoketest/configs/assert/static-route-basic
@@ -28,6 +28,7 @@ set service ntp server 172.16.100.10
 set service ntp server 172.16.100.20
 set service ntp server 172.16.110.30
 set system config-management commit-revisions '100'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/tunnel-broker b/smoketest/configs/assert/tunnel-broker
index 5518c303b..209160326 100644
--- a/smoketest/configs/assert/tunnel-broker
+++ b/smoketest/configs/assert/tunnel-broker
@@ -67,6 +67,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/vpn-openconnect-sstp b/smoketest/configs/assert/vpn-openconnect-sstp
index e7969f633..a897a696b 100644
--- a/smoketest/configs/assert/vpn-openconnect-sstp
+++ b/smoketest/configs/assert/vpn-openconnect-sstp
@@ -12,6 +12,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$2Ta6TWHd/U$NmrX0x9kexCimeOcYK1MfhMpITF9ELxHcaBU/znBq.X2ukQOj61fVI2UYP/xBzP4QtiTcdkgs7WOQMHWsRymO/'
diff --git a/smoketest/configs/assert/vpn-openvpn b/smoketest/configs/assert/vpn-openvpn
index f7b9857de..e8da06fd0 100644
--- a/smoketest/configs/assert/vpn-openvpn
+++ b/smoketest/configs/assert/vpn-openvpn
@@ -145,6 +145,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.io'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/vpp b/smoketest/configs/assert/vpp
index 7d8fcb7a7..32671696e 100644
--- a/smoketest/configs/assert/vpp
+++ b/smoketest/configs/assert/vpp
@@ -11,6 +11,7 @@ set interfaces ethernet eth3
 set interfaces ethernet eth4 description 'Bonding'
 set interfaces loopback lo
 set system config-management commit-revisions '100'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'r16'
 set system login user vyos authentication encrypted-password '$6$rounds=656000$FZBlGpWsmSrV2Rvq$YPNAPtk4k6u99FAMxR6cw4DUPCgOomwCgRZRSO5rAoJK8RlMSCkVAFVF3ozL/3mZMfxcuCnwvd5HX6f9V5KzO.'
diff --git a/smoketest/configs/assert/vrf-basic b/smoketest/configs/assert/vrf-basic
index 0c4e49c52..775f84e8f 100644
--- a/smoketest/configs/assert/vrf-basic
+++ b/smoketest/configs/assert/vrf-basic
@@ -31,6 +31,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/vrf-bgp-pppoe-underlay b/smoketest/configs/assert/vrf-bgp-pppoe-underlay
index e3c765a9a..f15e7c109 100644
--- a/smoketest/configs/assert/vrf-bgp-pppoe-underlay
+++ b/smoketest/configs/assert/vrf-bgp-pppoe-underlay
@@ -137,6 +137,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'vyos.net'
 set system host-name 'vyos'
diff --git a/smoketest/configs/assert/vrf-ospf b/smoketest/configs/assert/vrf-ospf
index 53207d565..c57e7cd2e 100644
--- a/smoketest/configs/assert/vrf-ospf
+++ b/smoketest/configs/assert/vrf-ospf
@@ -24,6 +24,7 @@ set system conntrack modules pptp
 set system conntrack modules sip
 set system conntrack modules sqlnet
 set system conntrack modules tftp
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system host-name 'vyos'
 set system login user vyos authentication encrypted-password '$6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0'
diff --git a/smoketest/configs/assert/wireless-basic b/smoketest/configs/assert/wireless-basic
index e424b2b0f..03ad767cb 100644
--- a/smoketest/configs/assert/wireless-basic
+++ b/smoketest/configs/assert/wireless-basic
@@ -16,6 +16,7 @@ set interfaces wireless wlan1 mode 'n'
 set interfaces wireless wlan1 ssid 'VyOS-PUBLIC'
 set interfaces wireless wlan1 type 'access-point'
 set system config-management commit-revisions '200'
+set system console device ttyS0 kernel
 set system console device ttyS0 speed '115200'
 set system domain-name 'dev.vyos.net'
 set system host-name 'WR1'
diff --git a/smoketest/scripts/cli/test_system_console.py b/smoketest/scripts/cli/test_system_console.py
new file mode 100755
index 000000000..388e9236f
--- /dev/null
+++ b/smoketest/scripts/cli/test_system_console.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import unittest
+
+from base_vyostest_shim import VyOSUnitTestSHIM
+
+from vyos.configsession import ConfigSessionError
+from vyos.system import disk
+from vyos.system.grub import CFG_VYOS_VARS
+from vyos.system.grub import vars_read
+from vyos.xml_ref import default_value
+
+base_path = ['system', 'console']
+serial_console = 'ttyS0'
+default_speed = default_value(base_path + ['device', serial_console, 'speed'])
+
+def get_grub_vars() -> dict:
+    root_dir = disk.find_persistence()
+    vars_file: str = f'{root_dir}/{CFG_VYOS_VARS}'
+    vars_current: dict[str, str] = vars_read(vars_file)
+    return vars_current
+
+class TestSystemConsole(VyOSUnitTestSHIM.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        super(TestSystemConsole, cls).setUpClass()
+
+        # ensure we can also run this test on a live system - so lets clean
+        # out the current configuration :)
+        cls.cli_delete(cls, base_path)
+        cls.cli_commit(cls)
+
+    def tearDown(self):
+        self.cli_delete(base_path)
+        self.cli_commit()
+        # always forward to base class
+        super().tearDown()
+
+    def test_multiple_kernel_consoles(self):
+        self.cli_set(base_path + ['device', 'ttyS1', 'kernel'])
+        self.cli_set(base_path + ['device', 'ttyS2', 'kernel'])
+
+        # Only one console can have 'kernel'
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+    def test_fbcon_and_serial_con_switch(self):
+        if not os.path.exists('/tmp/vyos.smoketests.hint'):
+            self.skipTest('Not running under VyOS CI/CD QEMU environment!')
+
+        grub_vars = get_grub_vars()
+        # we have deleted the CLI config in tearDown() so the default is now
+        # the framebuffer console at tty0
+        self.assertEqual(grub_vars['console_type'], 'tty')
+
+        self.cli_set(base_path + ['device', serial_console, 'kernel'])
+        self.cli_commit()
+
+        grub_vars = get_grub_vars()
+        # We moved the Kernel boot console to ttyS0
+        self.assertEqual(grub_vars['console_type'], serial_console[:-1])
+        self.assertEqual(grub_vars['console_num'], serial_console[-1])
+        self.assertEqual(grub_vars['console_speed'], default_speed)
+
+        self.cli_delete(base_path)
+        self.cli_commit()
+
+        # We moved back to tty as Kernel boot console
+        grub_vars = get_grub_vars()
+        self.assertEqual(grub_vars['console_type'], 'tty')
+
+if __name__ == '__main__':
+    unittest.main(verbosity=2, failfast=VyOSUnitTestSHIM.TestCase.debug_on())
diff --git a/src/activation-scripts/05-serial_console.py b/src/activation-scripts/05-serial_console.py
index 93e381d17..ccda2ac4e 100755
--- a/src/activation-scripts/05-serial_console.py
+++ b/src/activation-scripts/05-serial_console.py
@@ -13,45 +13,31 @@
 # You should have received a copy of the GNU Lesser General Public License
 # along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
-import re
-
-from typing import Optional
-from typing import Tuple
-
 from vyos.configtree import ConfigTree
-from vyos.utils.file import read_file
 from vyos.system.image import is_live_boot
+from vyos.utils.kernel import get_kernel_serial_console
+from vyos.utils.serial import is_tty
 
 base = ['system', 'console', 'device']
 
-def get_kernel_serial_console() -> Tuple[Optional[str], Optional[str]]:
-    """
-    Extract the serial console device and speed setting from the kernel
-    command line.
-    """
-    device = speed = None
-    CMDLINE_CONSOLE_RE = re.compile(
-        r'(?:^|\s)console=(?P<device>tty(?:S|AMA)\d+),(?P<speed>\d+)(?=\s|$)'
-    )
-    kernel_cmdline = read_file('/proc/cmdline')
-    if m := CMDLINE_CONSOLE_RE.search(kernel_cmdline):
-        device = m.group("device") # "ttyS0"
-        speed = m.group("speed")   # Baud rate/speed, e.g. "115200"
-
-    return (device, speed)
-
 def activate(config: ConfigTree):
-    # Configure the kernel serial console only once during live boot.
-    # During installation, the user can define the console. If this is not
-    # limited to live boot, the serial interface will always be re-added during
-    # system boot, even if it was removed from config.boot.
+    # Configure the kernel serial console only once during live boot. During
+    # installation, the user can define the console type (VT TTY or serial
+    # TTY). If this is not limited to live boot, the serial interface will
+    # always be re-added during system boot, even if it was removed from
+    # config.boot.
     if not is_live_boot():
         return
 
-    (device, speed) = get_kernel_serial_console()
-    if device and speed:
-        # The kernel was booted with a configured serial console, but no
-        # console is configured in the CLI; align/fix the CLI configuration.
-        if not config.exists(base + [device]):
-            config.set(base + [device, 'speed'], value=speed)
-            config.set_tag(base)
+    # Parse current kernel cmdline and continue only for valid serial console
+    # data. Prevent writing incomplete/invalid console settings to config.boot.
+    console_type, console_num, console_speed = get_kernel_serial_console()
+    device = f'{console_type}{console_num}'
+    if not is_tty(device) or not console_speed:
+        return
+
+    # The kernel was booted with a configured serial console, but no console
+    # is configured via CLI; align/fix the CLI configuration.
+    if not config.exists(base + [device]):
+        config.set(base + [device, 'speed'], value=console_speed)
+        config.set_tag(base)
diff --git a/src/conf_mode/system_console.py b/src/conf_mode/system_console.py
index 5d89eeba7..50e5e607b 100755
--- a/src/conf_mode/system_console.py
+++ b/src/conf_mode/system_console.py
@@ -30,6 +30,8 @@ airbag.enable()
 
 by_bus_dir = '/dev/serial/by-bus'
 
+default_tty_console = ('tty', '0', '')
+
 def get_config(config=None):
     if config:
         conf = config
@@ -57,7 +59,8 @@ def verify(console):
     if not console or 'device' not in console:
         return None
 
-    for device in console['device']:
+    kernel_consoles: list = []
+    for device, device_config in console['device'].items():
         if device.startswith('usb'):
             # It is much easiert to work with the native ttyUSBn name when using
             # getty, but that name may change across reboots - depending on the
@@ -70,6 +73,11 @@ def verify(console):
                 raise ConfigError(f'Device {device} does not support being used as tty')
         if not is_tty(device, warning=True):
             Warning(f'Device "{device}" used for console is not a TTY!')
+        if 'kernel' in device_config:
+            kernel_consoles.append(device)
+
+    if len(kernel_consoles) > 1:
+        raise ConfigError('Only one device can be used as Kernel output console!')
 
     return None
 
@@ -82,7 +90,7 @@ def generate(console):
                 os.unlink(os.path.join(root, basename))
 
     if not console or 'device' not in console:
-        grub_util.update_serial_console('', '', '')
+        grub_util.update_serial_console(*default_tty_console)
         return None
 
     # replace keys in the config for ttyUSB items to use them in `apply()` later
@@ -102,6 +110,7 @@ def generate(console):
             else:
                 raise ConfigError(f'Device {device} does not support being used as tty')
 
+    use_serial_console = False
     for device, device_config in console['device'].items():
         # Do not render getty configuration if specified device is not a TTY.
         if not is_tty(device):
@@ -113,17 +122,15 @@ def generate(console):
         render(config_file, 'getty/serial-getty.service.j2', device_config)
         os.symlink(config_file, getty_wants_symlink)
 
-    # GRUB - use first defined serial console to populate Kernel console= parameter
-    device = None
-    if 'device' in console and len(console['device']) > 0:
-        # We use the first device for the Kernel console
-        console_device = next(iter(console['device']))
-        console_speed = console['device'][console_device]['speed']
-
-        # get console type ("ttyS" or "ttyAMA") from console_device (e.g. "ttyS0")
-        console_type = console_device.translate(str.maketrans('', '', '0123456789'))
-        console_num = ''.join(ch for ch in console_device if ch.isdigit())
-        grub_util.update_serial_console(console_type, console_num, console_speed)
+        if 'kernel' in device_config:
+            # get console type ("ttyS" or "ttyAMA") from device (e.g. "ttyS0")
+            console_type = device.rstrip('0123456789')
+            console_num = device[len(console_type):]
+            grub_util.update_serial_console(console_type, console_num, device_config['speed'])
+            use_serial_console = True
+
+        if not use_serial_console:
+            grub_util.update_serial_console(*default_tty_console)
 
     return None
 
diff --git a/src/migration-scripts/system/31-to-32 b/src/migration-scripts/system/31-to-32
new file mode 100644
index 000000000..1688b44ed
--- /dev/null
+++ b/src/migration-scripts/system/31-to-32
@@ -0,0 +1,38 @@
+# Copyright (C) VyOS Inc.
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Serial
+
+from vyos.configtree import ConfigTree
+from vyos.system import disk
+from vyos.system.grub import CFG_VYOS_VARS
+from vyos.system.grub import vars_read
+
+serial_console = 'ttyS0'
+base = ['system', 'console']
+
+def migrate(config: ConfigTree) -> None:
+    if not base:
+        return
+
+    root_dir = disk.find_persistence()
+    vars_file: str = f'{root_dir}/{CFG_VYOS_VARS}'
+    vars_current: dict[str, str] = vars_read(vars_file)
+    # Check if VyOS installation uses serial boot console
+    if vars_current['console_type'] == 'ttyS':
+        # In the past we only supported ttyS0 as boot console, that's why we
+        # can hardcode it ...
+        if config.exists(base + ['device', serial_console]):
+            config.set(base + ['device', serial_console, 'kernel'])
diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py
index fb3cdda9e..27d8214c3 100755
--- a/src/op_mode/image_installer.py
+++ b/src/op_mode/image_installer.py
@@ -17,7 +17,8 @@
 # You should have received a copy of the GNU General Public License along with
 # VyOS. If not, see <https://www.gnu.org/licenses/>.
 
-from argparse import ArgumentParser, Namespace
+from argparse import ArgumentParser
+from argparse import Namespace
 from pathlib import Path
 from shutil import copy
 from shutil import chown
@@ -616,6 +617,49 @@ def configure_authentication(config_file: str, password: str) -> None:
     with open(config_file, 'w') as f:
         f.write(config.to_string())
 
+def configure_serial_console(config_file: str, console_type: str) -> None:
+    """Apply serial console settings to config.boot from kernel cmdline.
+
+    This overlaps with 05-serial_console.py activation logic, but that script
+    only runs during live boot. During installation, the user may pick a
+    different source config, so serial console settings must be written to
+    the final target config explicitly.
+
+    Behavior:
+    - Reads the kernel serial console device/speed from the current boot cmdline.
+    - If the detected device is a valid tty, writes:
+        system console device <TTY> speed <rate>
+    - If "console_type == 'S'", also writes:
+        system console device <TTY> kernel
+
+    Args:
+        config_file (str): path of target config file
+        console_type (str): 'K' (KVM/tty) or 'S' (serial)
+    """
+    from vyos.utils.serial import is_tty
+    from vyos.utils.kernel import get_kernel_serial_console
+
+    # Parse current kernel cmdline and continue only for valid serial console
+    # data. Prevent writing incomplete/invalid console settings to config.boot.
+    k_console_type, k_console_num, k_console_speed = get_kernel_serial_console()
+    device = f'{k_console_type}{k_console_num}'
+    if not is_tty(device) or not k_console_speed:
+        return
+
+    base = ['system', 'console', 'device']
+    config_string = read_file(config_file)
+    config = ConfigTree(config_string)
+    config.set(base + [device, 'speed'], value=k_console_speed)
+    config.set_tag(base)
+
+    # Only mark this device as kernel boot console when console_type 'S' for
+    # serial was defined by user.
+    if console_type == 'S':
+        config.set(base + [device, 'kernel'])
+
+    with open(config_file, 'w') as f:
+        f.write(config.to_string())
+
 def validate_signature(file_path: str, sign_type: str) -> None:
     """Validate a file by signature and delete a signature file
 
@@ -769,10 +813,8 @@ def console_hint() -> str:
         path = '/dev/tty'
 
     name = Path(path).name
-    if name in ['ttyS0']:
+    if name.startswith(('ttyS', 'ttyAMA')):
         return 'S'
-    elif name in ['ttyAMA0']:
-        return 'A'
     else:
         return 'K'
 
@@ -924,11 +966,7 @@ def install_image() -> None:
         print(MSG_WARN_PASSWORD_CONFIRM)
 
     # ask for default console
-    console_dict: dict[str, str] = {'K': 'tty'}
-    if flavor_sercon_type:
-        tmp: str = flavor_sercon_type[-1] # get "S" from "ttyS" and "A" from "ttyAMA"
-        console_dict.update({tmp: flavor_sercon_type})
-
+    console_dict: dict[str, str] = {'K': 'tty', 'S': flavor_sercon_type}
     console_type: str = ask_input(MSG_INPUT_CONSOLE_TYPE,
                                   default=console_hint(),
                                   valid_responses=console_dict.keys())
@@ -977,6 +1015,8 @@ def install_image() -> None:
         copy(default_config, f'{target_config_dir}/config.boot')
         configure_authentication(f'{target_config_dir}/config.boot',
                                  user_password)
+        configure_serial_console(f'{target_config_dir}/config.boot',
+                                 console_type)
         Path(f'{target_config_dir}/.vyatta_config').touch()
 
         # create a persistence.conf