diff --git a/debian/changelog b/debian/changelog
index c794ea8eca..c8982af3d4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,7 +1,13 @@
 linux (6.1.148-2) UNRELEASED; urgency=medium
 
+  [ Ben Hutchings ]
   * Revert to using RSA for module signatures (Closes: #1114773)
 
+  [ Santiago Ruano Rincón ]
+  * d/salsa-ci.yml: Merge the extract-source job into the build's job script
+  * d/salsa-ci.yml: Suppress unreleased changes and mismatching distribution
+    lintian tags.
+
  -- Ben Hutchings <benh@debian.org>  Tue, 09 Sep 2025 22:36:33 +0200
 
 linux (6.1.148-1) bookworm; urgency=medium
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
index 3ab99a4a0e..5249274f4b 100644
--- a/debian/salsa-ci.yml
+++ b/debian/salsa-ci.yml
@@ -18,7 +18,6 @@ variables:
 
 # Add stages for signed packages
 stages:
-  - provisioning
   - build
   - publish
   - test
@@ -26,26 +25,26 @@ stages:
   - build-signed
   - test-signed
 
-# The common Salsa CI pipeline relies on keeping the unpacked source
-# as an artifact, but in our case this is far too large for the
-# current limits on Salsa (salsa-ci-team/pipeline#195).  So we
-# redefine the source extraction and build steps to use packed source.
+# Our modified build jobs
 
-# Our modified extract-source and build jobs
-
-extract-source:
-  stage: provisioning
-  image: $SALSA_CI_IMAGES_BASE
+build:
+  timeout: 3 hours
   cache:
     key: "orig-${RELEASE}"
     paths:
       - orig
+    key: "build-${BUILD_ARCH}_${HOST_ARCH}"
+    paths:
+      - .ccache
   extends:
-    - .artifacts-default-expire
+    - .build-definition
   except:
     variables:
       - $CI_COMMIT_TAG != null
   script:
+    # Do the same as the common .build-definition script
+    - !reference [.build-before-script]
+    - !reference [.build-script-setup-environment]
     # Move cache to where genorig.py and orig target want it
     - mkdir -p orig
     - rm -rf ../orig
@@ -101,46 +100,24 @@ extract-source:
     - cp ../orig/linux_${upstream_version}.orig.tar.xz ${WORKING_DIR}
     - mv ../linux_${version}.dsc ../linux_${version}.debian.tar.xz ${WORKING_DIR}
 
-    # Move cache back to where GitLab wants it.  Only include
-    # tarballs, not unpacked source.
-    - mkdir orig
-    - mv ../orig/*.tar.xz orig
+    - chown -R 'salsa-ci:' ${WORKING_DIR} ${CCACHE_DIR}
 
-build:
-  stage: build
-  timeout: 3 hours
-  image: $SALSA_CI_IMAGES_BASE
-  cache:
-    key: "build-${BUILD_ARCH}_${HOST_ARCH}"
-    paths:
-      - .ccache
-  extends:
-    - .artifacts-default-expire
-  except:
-    variables:
-      - $CI_COMMIT_TAG != null
-  variables:
-    CCACHE_TMP_DIR: ${CI_PROJECT_DIR}/../.ccache
-    CCACHE_WORK_DIR: ${CI_PROJECT_DIR}/.ccache
-    DB_BUILD_PARAM: ${SALSA_CI_DPKG_BUILDPACKAGE_ARGS}
-    DB_BUILD_TYPE: full
-  artifacts:
-    exclude:
-      - ${WORKING_DIR}/${SOURCE_DIR}/**/*
-  script:
-    # Unpack the source
-    - |
-      apt-get update && eatmydata apt-get install --no-install-recommends -y \
-        dpkg-dev
-    - dpkg-source -x ${WORKING_DIR}/*.dsc ${WORKING_DIR}/${SOURCE_DIR}
+    - !reference [.build-script-setup-build-command]
 
-    # Do the same as the common .build-definition script
-    - !reference [.build-before-script]
-    - !reference [.build-script]
+    - cd ${WORKING_DIR}
+    - export BUILD_COMMAND="${BUILD_COMMAND} linux_${version}.dsc"
+
+    - !reference [.build-script-run-build-command]
+
+    # Move orig tarballs back to where GitLab wants them
+    - mkdir ${CI_PROJECT_DIR}/orig
+    - cp -v ${WORKING_DIR}/*.orig.tar.* ${CI_PROJECT_DIR}/orig
   after_script:
+    # pass the RELEASE_FROM_CHANGELOG envvar to any consecutive job
+    - echo "RELEASE_FROM_CHANGELOG=${RELEASE_FROM_CHANGELOG}" | tee ${CI_PROJECT_DIR}/salsa.env
+    - ls -l ${CI_PROJECT_DIR}/salsa.env
+    - cat ${CI_PROJECT_DIR}/salsa.env
     - !reference [.build-after-script]
-  dependencies:
-    - extract-source
 
 # The folllowing jobs are the standard tests, excluding any that
 # require building again
@@ -232,7 +209,7 @@ kconfig-static:
     - |
       if [ -s "$error_log" ]; then cat "$error_log"; false; fi
   needs:
-    - job: extract-source
+    - job: build
       artifacts: true
 
 # Sign code with the test key and certificate, build and test that
@@ -272,37 +249,28 @@ sign-code:
 
 build-signed:
   stage: build-signed
-  image: $SALSA_CI_IMAGES_BASE
   extends:
-    - .artifacts-default-expire
+    - .build-definition
   except:
     variables:
       - $CI_COMMIT_TAG != null
   variables:
     SALSA_CI_DPKG_BUILDPACKAGE_ARGS: ''
-    CCACHE_TMP_DIR: ${CI_PROJECT_DIR}/../.ccache
-    CCACHE_WORK_DIR: ${CI_PROJECT_DIR}/.ccache
-    DB_BUILD_PARAM: ${SALSA_CI_DPKG_BUILDPACKAGE_ARGS}
-    DB_BUILD_TYPE: full
+    # We need linux-image-*-unsigned_*_${BUILD_ARCH}.deb build-dependencies
+    # from build job
+    SALSA_CI_SBUILD_EXTRA_PACKAGE: '${WORKING_DIR}/'
   script:
-    # Unpack the source
-    - |
-      apt-get update && eatmydata apt-get install --no-install-recommends -y \
-        dpkg-dev
-    - |
-      dpkg-source -x ${WORKING_DIR}/linux-signed-${BUILD_ARCH}_*.dsc \
-        ${WORKING_DIR}/${SOURCE_DIR}
-
-    # Install build-dependencies produced by build job
-    - |
-      apt-get install --no-install-recommends -y \
-        ${WORKING_DIR}/linux-image-*-unsigned_*_${BUILD_ARCH}.deb \
-        ${WORKING_DIR}/linux-kbuild-*[0-9]_*_${BUILD_ARCH}.deb \
-        ${WORKING_DIR}/linux-support-*_all.deb
-
     # Do the same as the common .build-definition script
     - !reference [.build-before-script]
-    - !reference [.build-script]
+    - !reference [.build-script-setup-environment]
+
+    - chown -R 'salsa-ci:' ${WORKING_DIR} ${CCACHE_DIR}
+
+    - !reference [.build-script-setup-build-command]
+
+    - export BUILD_COMMAND="${BUILD_COMMAND} ${WORKING_DIR}/linux-signed-${BUILD_ARCH}_*.dsc"
+
+    - !reference [.build-script-run-build-command]
   after_script:
     - !reference [.build-after-script]
   artifacts: