diff --git a/apparmor.d/groups/gpg/gpg b/apparmor.d/groups/gpg/gpg
index 6a01796ff..b65823520 100644
--- a/apparmor.d/groups/gpg/gpg
+++ b/apparmor.d/groups/gpg/gpg
@@ -29,6 +29,7 @@ profile gpg @{exec_path} {
   @{lib}/{,gnupg/}scdaemon rPx,
 
   /usr/share/terminfo/** r,
+  /usr/share/keyrings/** rw,  #aa:only apt
   /usr/share/pacman/keyrings/** r,  #aa:only pacman
 
   /etc/inputrc r,
diff --git a/apparmor.d/groups/grub/grub-mkconfig b/apparmor.d/groups/grub/grub-mkconfig
index c081d53c3..5b62fa30c 100644
--- a/apparmor.d/groups/grub/grub-mkconfig
+++ b/apparmor.d/groups/grub/grub-mkconfig
@@ -27,7 +27,7 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
   @{bin}/cut                  rix,
   @{bin}/date                 rix,
   @{bin}/dirname              rix,
-  @{sbin}/dmsetup             rPUx,
+  @{sbin}/dmsetup             rPx,
   @{bin}/dpkg                 rPx,
   @{bin}/find                 rix,
   @{bin}/findmnt              rPx,
diff --git a/apparmor.d/groups/grub/grub-probe b/apparmor.d/groups/grub/grub-probe
index 017083eaf..c767d2f02 100644
--- a/apparmor.d/groups/grub/grub-probe
+++ b/apparmor.d/groups/grub/grub-probe
@@ -36,6 +36,8 @@ profile grub-probe @{exec_path} {
   /dev/**/ r,
   /dev/mapper/control w,
 
+  deny mqueue (read, getattr) type=posix /,
+
   include if exists <local/grub-probe>
 }
 
diff --git a/apparmor.d/groups/network/NetworkManager b/apparmor.d/groups/network/NetworkManager
index 01de67a18..6b444093c 100644
--- a/apparmor.d/groups/network/NetworkManager
+++ b/apparmor.d/groups/network/NetworkManager
@@ -71,6 +71,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
   @{bin}/kmod                                                rPx,
   @{bin}/netconfig                                          rPUx,
   @{sbin}/resolvconf                                         rPx,
+  @{bin}/resolvectl                                          rPx,
   @{bin}/systemctl                                           rCx -> systemctl,
   @{lib}/{,NetworkManager/}nm-daemon-helper                  rPx,
   @{lib}/{,NetworkManager/}nm-dhcp-helper                    rPx,
diff --git a/apparmor.d/profiles-a-f/blkdeactivate b/apparmor.d/profiles-a-f/blkdeactivate
index 83806e753..bff816339 100644
--- a/apparmor.d/profiles-a-f/blkdeactivate
+++ b/apparmor.d/profiles-a-f/blkdeactivate
@@ -15,7 +15,7 @@ profile blkdeactivate @{exec_path} flags=(complain) {
   @{exec_path} rm,
 
   @{sh_path}             rix,
-  @{sbin}/dmsetup        rPUx,
+  @{sbin}/dmsetup        rPx,
   @{bin}/{,e}grep        rix,
   @{bin}/touch           rix,
   @{bin}/lsblk           rPx,
diff --git a/apparmor.d/profiles-m-r/initramfs-hooks b/apparmor.d/profiles-m-r/initramfs-hooks
index 14a83ffbb..a4fc278f0 100644
--- a/apparmor.d/profiles-m-r/initramfs-hooks
+++ b/apparmor.d/profiles-m-r/initramfs-hooks
@@ -16,6 +16,8 @@ profile initramfs-hooks @{exec_path} {
 
   @{sh_path}                               rix,
   @{coreutils_path}                        rix,
+  @{bin}/cpio                               ix,
+  @{bin}/dpkg                               Cx -> child-dpkg,
   @{bin}/fc-cache                           ix,
   @{bin}/ischroot                           Px,
   @{bin}/ldd                                Cx -> ldd,
@@ -25,6 +27,9 @@ profile initramfs-hooks @{exec_path} {
   @{lib}/initramfs-tools/bin/busybox        ix,
   @{lib}/klibc/bin/fstype                   ix,
   @{sbin}/blkid                             Px,
+  @{sbin}/cryptsetup                        PUx,
+  @{sbin}/dmsetup                           Px,
+  @{sbin}/iucode_tool                       ix,
   /usr/share/mdadm/mkconf                   Px,
 
   @{bin}/* mr,