diff --git a/contrib/fedora-default-kernel/README.md b/contrib/fedora-default-kernel/README.md
index 68dfe71bf..d4736e045 100644
--- a/contrib/fedora-default-kernel/README.md
+++ b/contrib/fedora-default-kernel/README.md
@@ -12,6 +12,8 @@ selection every time.
 ```bash
 $ sudo dnf install /usr/sbin/grubby
 $ sudo cp default-kernel.{path,service} /etc/systemd/system/
+$ sudo cp default-kernel.sh /usr/local/bin/default-kernel
+$ sudo chmod 755 /usr/local/bin/default-kernel
 $ sudo systemctl daemon-reload
 $ sudo systemctl enable --now default-kernel.path
 ```
diff --git a/contrib/fedora-default-kernel/default-kernel.service b/contrib/fedora-default-kernel/default-kernel.service
index e809019f3..e19d65b61 100644
--- a/contrib/fedora-default-kernel/default-kernel.service
+++ b/contrib/fedora-default-kernel/default-kernel.service
@@ -3,4 +3,4 @@ Description=linux-surface default kernel watchdog
 
 [Service]
 Type=oneshot
-ExecStart=/bin/sh -c "grubby --set-default /boot/vmlinuz*surface*"
+ExecStart=/usr/local/bin/default-kernel
diff --git a/contrib/fedora-default-kernel/default-kernel.sh b/contrib/fedora-default-kernel/default-kernel.sh
new file mode 100755
index 000000000..818b3479c
--- /dev/null
+++ b/contrib/fedora-default-kernel/default-kernel.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euo pipefail
+
+# get list of surface kernels with timestamp
+kernels=$(find /boot -maxdepth 1 -name "vmlinuz-*.surface.*" -printf '%T@\t%p\n')
+
+# sort by timestamp
+kernels=$(echo "${kernels}" | sort -n)
+
+# get latest kernel (last line) and extract path
+kernel=$(echo "${kernels}" | tail -n1 | cut -f2)
+
+echo $kernel
+
+# update GRUB config
+grubby --set-default "${kernel}"
+
+# update timestamp for rEFInd (ensure it's marked as latest across all kernels,
+# not just surface ones)
+touch "${kernel}"