diff --git a/vhdbuilder/packer/pre-install-dependencies.sh b/vhdbuilder/packer/pre-install-dependencies.sh
index 7557baa1442..bb3badce708 100644
--- a/vhdbuilder/packer/pre-install-dependencies.sh
+++ b/vhdbuilder/packer/pre-install-dependencies.sh
@@ -185,6 +185,18 @@ if [[ ${UBUNTU_RELEASE//./} -ge 2204 && "${ENABLE_FIPS,,}" != "true" ]]; then
       "linux-headers-azure-lts-${UBUNTU_RELEASE}"
     )
     echo "Installing fde LTS kernel for CVM Ubuntu ${UBUNTU_RELEASE}"
+  elif [ "${UBUNTU_RELEASE}" = "24.04" ]; then
+    # Pin to 6.8.0-1062-azure to avoid regression in 6.8.0-1063-azure
+    # (LP #2070072 conntrack-on-promisc revert + LP #2144730 ITS mitigation).
+    KERNEL_IMAGE="linux-image-6.8.0-1062-azure"
+    KERNEL_PACKAGES=(
+      "linux-image-6.8.0-1062-azure"
+      "linux-tools-6.8.0-1062-azure"
+      "linux-cloud-tools-6.8.0-1062-azure"
+      "linux-headers-6.8.0-1062-azure"
+      "linux-modules-extra-6.8.0-1062-azure"
+    )
+    echo "Installing pinned LTS kernel 6.8.0-1062-azure for Ubuntu 24.04 (regression in 1063)"
   else
     # Use LTS kernel for other versions
     KERNEL_IMAGE="linux-image-azure-lts-${UBUNTU_RELEASE}"
@@ -197,9 +209,13 @@ if [[ ${UBUNTU_RELEASE//./} -ge 2204 && "${ENABLE_FIPS,,}" != "true" ]]; then
     echo "Installing LTS kernel for Ubuntu ${UBUNTU_RELEASE}"
   fi
 
-  # Add modules-extra only when the package exists in the current apt repo
+  # Add modules-extra only when the package exists in the current apt repo.
+  # Skip for the pinned 24.04 case: the exact-version modules-extra is already in
+  # KERNEL_PACKAGES, and the LTS metapackage would pull the newer (pinned-out) kernel.
   MODULES_EXTRA_PKG="linux-modules-extra-azure-lts-${UBUNTU_RELEASE}"
-  if apt-cache show "${MODULES_EXTRA_PKG}" &>/dev/null; then
+  if [ "$KERNEL_IMAGE" = "linux-image-6.8.0-1062-azure" ]; then
+    echo "Pinned kernel selected - using exact-version modules-extra, skipping ${MODULES_EXTRA_PKG}"
+  elif apt-cache show "${MODULES_EXTRA_PKG}" &>/dev/null; then
     KERNEL_PACKAGES+=("${MODULES_EXTRA_PKG}")
   else
     echo "Package ${MODULES_EXTRA_PKG} not available - skipping"
diff --git a/vhdbuilder/packer/test/linux-vhd-content-test.sh b/vhdbuilder/packer/test/linux-vhd-content-test.sh
index f662230adb7..a5ce9a595a0 100644
--- a/vhdbuilder/packer/test/linux-vhd-content-test.sh
+++ b/vhdbuilder/packer/test/linux-vhd-content-test.sh
@@ -794,20 +794,37 @@ testLtsKernel() {
   # shellcheck disable=SC3010
   if [[ "$os_sku" == "Ubuntu" && ${enable_fips,,} != "true" ]] ; then
     echo "OS is Ubuntu, FIPS is not enabled, check LTS kernel version"
+    # CVM builds use linux-image-azure-fde-lts-* (different flavor), skip exact pin check
+    local is_cvm=false
+    if grep -q "cvm" <<< "$FEATURE_FLAGS"; then
+      is_cvm=true
+    fi
+
     # Check the Ubuntu version and set the expected kernel version
-    if [ "$os_version" = "22.04" ]; then
+    if [ "$os_version" = "24.04" ] && [ "$is_cvm" = "false" ]; then
+      # Pinned to exact version to avoid regression in 6.8.0-1063-azure
+      expected_kernel="6.8.0-1062-azure"
+    elif [ "$os_version" = "22.04" ]; then
       expected_kernel="5.15"
     elif [ "$os_version" = "24.04" ]; then
       expected_kernel="6.8"
     else
       # TODO(2604): update once 26.04 LTS kernel metapackage is available
-      echo "LTS kernel not installed for: $os_version"
+      echo "LTS kernel not installed for: $os_version, skipping check"
+      echo "$test:Finish"
+      return
     fi
 
     kernel=$(uname -r)
     echo "Current kernel version: $kernel"
     # shellcheck disable=SC3010
-    if [[ "$kernel" == *"$expected_kernel"* ]]; then
+    if [ "$os_version" = "24.04" ] && [ "$is_cvm" = "false" ]; then
+      if [[ "$kernel" == "$expected_kernel" ]]; then
+        echo "Kernel version matches pinned version ($expected_kernel)."
+      else
+        err $test "Kernel version does not match pinned version. Expected exactly $expected_kernel, found $kernel."
+      fi
+    elif [[ "$kernel" == *"$expected_kernel"* ]]; then
       echo "Kernel version is as expected ($expected_kernel)."
     else
       err $test "Kernel version is not as expected. Expected $expected_kernel, found $kernel."