Beware that the introduction of the nsec system call can cause trouble if replica updates commands before you're running the new kernel.