diff --git a/Makefile b/Makefile
index afdc6ad..7ad4b7e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,8 @@
 GLUON_BUILD_DIR := gluon-build
 GLUON_GIT_URL := https://github.com/freifunk-gluon/gluon
-GLUON_GIT_REF := v2023.1
+GLUON_GIT_REF := 4e2bd01d5f7ee1677d522e75c3818719e513eb01
+
+PATCH_DIR := ./patches
 
 SECRET_KEY_FILE ?= ${HOME}/.gluon-secret-key
 
@@ -64,9 +66,13 @@ gluon-update: | ${GLUON_BUILD_DIR}/.git
 	cd ${GLUON_BUILD_DIR} && git clean -fd
 
 gluon-prepare: gluon-update
+	make gluon-patch
 	ln -sfT .. ${GLUON_BUILD_DIR}/site
 	${GLUON_MAKE} update
 
+gluon-patch:
+	scripts/apply_patches.sh ${GLUON_BUILD_DIR} ${PATCH_DIR}
+
 gluon-clean:
 	rm -rf ${GLUON_BUILD_DIR}
 
diff --git a/patches/targets-drop-TP-Link-RE450-and-RE355.patch b/patches/targets-drop-TP-Link-RE450-and-RE355.patch
new file mode 100644
index 0000000..563c885
--- /dev/null
+++ b/patches/targets-drop-TP-Link-RE450-and-RE355.patch
@@ -0,0 +1,41 @@
+From b5fb157e3b67b2d39f5b7c391ef39f0b19e4cf2e Mon Sep 17 00:00:00 2001
+From: Christian <github@grische.xyz>
+Date: Fri, 18 Aug 2023 17:02:22 +0200
+Subject: [PATCH] targets: drop TP-Link RE450 and RE355
+
+The flash size is not sufficient to host the minimal set of FFMuc packages
+---
+ targets/ath79-generic | 17 -----------------
+ 1 file changed, 17 deletions(-)
+
+diff --git a/targets/ath79-generic b/targets/ath79-generic
+index 7a5140c9..32a03ce3 100644
+--- a/targets/ath79-generic
++++ b/targets/ath79-generic
+@@ -474,23 +474,6 @@ device('tp-link-eap225-outdoor-v1', 'tplink_eap225-outdoor-v1', {
+ 	packages = ATH10K_PACKAGES_QCA9888,
+ })
+ 
+-device('tp-link-re355-v1', 'tplink_re355-v1', {
+-	manifest_aliases = {
+-		'tp-link-re355', -- upgrade from OpenWrt 19.07
+-	},
+-	packages = ATH10K_PACKAGES_SMALLBUFFERS_QCA9880,
+-	broken = true, -- OOM with 5GHz enabled in most environments if device is 64M RAM variant
+-	class = 'tiny', -- Only 6M of usable Firmware space
+-})
+-
+-device('tp-link-re450-v1', 'tplink_re450-v1', {
+-	packages = ATH10K_PACKAGES_QCA9880,
+-	manifest_aliases = {
+-		'tp-link-re450', -- upgrade from OpenWrt 19.07
+-	},
+-	class = 'tiny', -- Only 6M of usable Firmware space
+-})
+-
+ device('tp-link-tl-wdr3500-v1', 'tplink_tl-wdr3500-v1')
+ device('tp-link-tl-wdr3600-v1', 'tplink_tl-wdr3600-v1')
+ device('tp-link-tl-wdr4300-v1', 'tplink_tl-wdr4300-v1')
+-- 
+2.25.1
+
diff --git a/scripts/apply_patches.sh b/scripts/apply_patches.sh
new file mode 100644
index 0000000..0c4cab0
--- /dev/null
+++ b/scripts/apply_patches.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+set -eEu
+set -o pipefail
+shopt -s nullglob
+
+gluon_build_dir=${1:-gluon-build}
+gluon_patch_dir="${2:-patches}"
+
+function reset_gluon_build_dir() {
+    # Make sure we are in the correct folder
+    if [[ ! $(pwd) =~ .*${gluon_build_dir} ]]; then
+        echo "Resetting environment in the wrong folder. Aborting."
+        return 1
+    fi
+    echo "Resetting environment."
+
+    # Reset all files known to git, but keep manually commited changes.
+    git checkout .
+    # Delete all files not known to git
+    git clean -dx --force
+    echo "Environment reset."
+}
+
+# Relative patches folder does not work with git-apply below. Make sure it is an absolute path.
+if [[ ! ${gluon_patch_dir} =~ ^/ ]]; then
+    gluon_patch_dir="${PWD}/${gluon_patch_dir}"
+    echo "Setting patch directory to ${gluon_patch_dir}"
+fi
+
+pushd "${gluon_build_dir}"
+
+# Check if there are any patches at all
+if ! compgen -G "${gluon_patch_dir}/*.patch" >/dev/null; then
+    echo "No patches found in ${gluon_patch_dir}/*.patch"
+    exit 1
+fi
+
+# Reset previously applied patches
+reset_gluon_build_dir
+
+# Apply all patches
+echo "Applying Patches."
+if ! git apply --ignore-space-change --ignore-whitespace --whitespace=nowarn --verbose "${gluon_patch_dir}"/*.patch; then
+    echo "Patching failed. Inspect ${gluon_build_dir} folder for failed patches."
+    exit 1
+fi
+
+echo "Patching finished."
+popd
diff --git a/site.mk b/site.mk
index abe5549..850373f 100644
--- a/site.mk
+++ b/site.mk
@@ -170,7 +170,7 @@ ifeq ($(GLUON_TARGET),ath79-generic)
     GLUON_tp-link-tl-wr1043nd-v4_SITE_PACKAGES += $(INCLUDE_USB) $(INCLUDE_USB_NET) $(INCLUDE_USB_SERIAL) $(INCLUDE_USB_STORAGE)
     GLUON_d-link-dir825b1_SITE_PACKAGES += $(EXCLUDE_TLS)
     GLUON_tp-link-re355-v1_SITE_PACKAGES += $(EXCLUDE_TLS)
-    GLUON_tp-link-re450-v1_SITE_PACKAGES += $(EXCLUDE_TLS)
+    GLUON_tp-link-re450-v1_SITE_PACKAGES += $(EXCLUDE_USB) $(EXCLUDE_USB_NET) $(EXCLUDE_USB_SERIAL) $(EXCLUDE_USB_STORAGE)
 endif
 
 # no pkglists for target ath79-mikrotik
@@ -178,10 +178,127 @@ endif
 
 ifeq ($(GLUON_TARGET),ath79-nand)
     GLUON_SITE_PACKAGES += $(INCLUDE_TLS) $(INCLUDE_USB) $(INCLUDE_USB_NET) $(INCLUDE_USB_SERIAL) $(INCLUDE_USB_STORAGE)
-
 endif
 
 ifeq ($(GLUON_TARGET),bcm27xx-bcm2708)
     GLUON_SITE_PACKAGES += $(INCLUDE_TLS) $(INCLUDE_USB) $(INCLUDE_USB_HID) $(INCLUDE_USB_NET) $(INCLUDE_USB_SERIAL) $(INCLUDE_USB_STORAGE)
-
+endif
+
+# some extra sauce to make offloader/kvm images extra spicy
+
+USB_PACKAGES_BASIC := \
+	kmod-usb-core \
+	kmod-usb2
+
+USB_PACKAGES_STORAGE := \
+	block-mount \
+	blkid \
+	kmod-fs-ext4 \
+	kmod-fs-vfat \
+	kmod-usb-storage \
+	kmod-usb-storage-extras \
+	kmod-nls-cp1250 \
+	kmod-nls-cp1251 \
+	kmod-nls-cp437 \
+	kmod-nls-cp775 \
+	kmod-nls-cp850 \
+	kmod-nls-cp852 \
+	kmod-nls-cp866 \
+	kmod-nls-iso8859-1 \
+	kmod-nls-iso8859-13 \
+	kmod-nls-iso8859-15 \
+	kmod-nls-iso8859-2 \
+	kmod-nls-koi8r \
+	kmod-nls-utf8 \
+	swap-utils
+
+# network support for USB devices
+USB_PACKAGES_NET := \
+	kmod-mii \
+	kmod-nls-base \
+	kmod-usb-net \
+	kmod-usb-net-asix \
+	kmod-usb-net-asix-ax88179 \
+	kmod-usb-net-cdc-eem \
+	kmod-usb-net-cdc-ether \
+	kmod-usb-net-cdc-mbim \
+	kmod-usb-net-cdc-ncm \
+	kmod-usb-net-cdc-subset \
+	kmod-usb-net-dm9601-ether \
+	kmod-usb-net-hso \
+	kmod-usb-net-huawei-cdc-ncm \
+	kmod-usb-net-ipheth \
+	kmod-usb-net-kalmia \
+	kmod-usb-net-kaweth \
+	kmod-usb-net-mcs7830 \
+	kmod-usb-net-pegasus \
+	kmod-usb-net-qmi-wwan \
+	kmod-usb-net-rndis \
+	kmod-usb-net-rtl8152 \
+	kmod-usb-net-sierrawireless \
+	kmod-usb-net-smsc95xx
+
+USB_PACKAGES_NET_ADD := \
+	kmod-rtl8192cu \
+	kmod-rtl8187 \
+	kmod-ath9k-htc  \
+	kmod-ath9k-common \
+	kmod-ath \
+	kmod-rt73-usb \
+	kmod-carl9170 \
+	kmod-brcmfmac
+
+PCI_PACKAGES_NET := \
+	kmod-3c59x \
+	kmod-e100 \
+	kmod-e1000 \
+	kmod-e1000e \
+	kmod-forcedeth \
+	kmod-natsemi \
+	kmod-ne2k-pci \
+	kmod-pcnet32 \
+	kmod-r8169 \
+	kmod-sis900 \
+	kmod-sky2 \
+	kmod-tg3 \
+	kmod-tulip \
+	kmod-via-rhine
+
+TOOLS_PACKAGES := \
+	iperf \
+	socat \
+	tcpdump \
+	usbutils \
+	vnstat
+
+# x86-generic
+ifeq ($(GLUON_TARGET),x86-generic)
+# support the usb stack on x86 devices
+# and add a few common USB and PCI NICs
+GLUON_SITE_PACKAGES += \
+	kmod-usb-hid \
+	kmod-hid-generic \
+	kmod-button-hotplug \
+	$(USB_PACKAGES_BASIC) \
+	$(USB_PACKAGES_STORAGE) \
+	$(USB_PACKAGES_NET) \
+	$(PCI_PACKAGES_NET) \
+	$(TOOLS_PACKAGES) \
+	$(USB_PACKAGES_NET_ADD)
+endif
+
+# x86-64
+ifeq ($(GLUON_TARGET),x86-64)
+# support the usb stack on x86-64 devices
+# and add a few common USB and PCI NICs
+GLUON_SITE_PACKAGES += \
+	kmod-usb-hid \
+	kmod-hid-generic \
+	kmod-button-hotplug \
+	$(USB_PACKAGES_BASIC) \
+	$(USB_PACKAGES_STORAGE) \
+	$(USB_PACKAGES_NET) \
+	$(PCI_PACKAGES_NET) \
+	$(TOOLS_PACKAGES) \
+	$(USB_PACKAGES_NET_ADD)
 endif