diff --git a/build.sh b/build.sh
index feaa812..6dddb87 100755
--- a/build.sh
+++ b/build.sh
@@ -89,14 +89,16 @@ gpgcheck=0
 EOF
 }
 
-# Drop packages listed in a blocklist from the cloned upstream package
-# manifests. rpm-ostree refuses (fatally) to exclude a package that an included
-# manifest declares, so remove those lines at the source instead.
+# Drop packages listed in a blocklist from the cloned upstream manifests.
+# rpm-ostree refuses (fatally) to exclude a package that an included manifest
+# declares, so remove those lines at the source instead. Packages are declared
+# both in packages/*.yaml and in the top-level variant manifests (e.g. the base
+# kernel list lives in common.yaml), so scan both.
 trim_upstream_packages() {
   local root="$1"
   local blocklist="$2"
   local f
-  for f in "${root}"/packages/*.yaml; do
+  for f in "${root}"/*.yaml "${root}"/packages/*.yaml; do
     [[ -f "${f}" ]] || continue
     awk '
       NR == FNR {
@@ -111,8 +113,9 @@ trim_upstream_packages() {
         print
       }
     ' "${blocklist}" "${f}" > "${f}.tmp"
-    # Drop top-level keys that were left with no list items (e.g. if every
-    # entry under packages-x86_64: was removed).
+    # Drop top-level keys left with no list items or nested keys (e.g. if every
+    # entry under packages-x86_64: was removed). Comments and blank lines do not
+    # count as content, so a key followed only by comments is still dropped.
     awk '
       { lines[NR] = $0 }
       END {
@@ -120,8 +123,9 @@ trim_upstream_packages() {
           if (lines[i] ~ /^[A-Za-z0-9_.-]+:$/) {
             keep = 0
             for (j = i + 1; j <= NR; j++) {
-              if (lines[j] ~ /^[[:space:]]+-[[:space:]]/) { keep = 1; break }
               if (lines[j] ~ /^[A-Za-z0-9_.-]+:/) break
+              if (lines[j] ~ /^[[:space:]]+-[[:space:]]/) { keep = 1; break }
+              if (lines[j] ~ /^[[:space:]]+[A-Za-z0-9_.-]+:/) { keep = 1; break }
             }
             if (!keep) continue
           }