Consider a Hardcoded
Kernel Cmdline

CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE_OVERRIDE=y
CONFIG_CMDLINE="root=/dev/sda1"

The bootloader typically sets the kernel command line. But it’s also possible to hard code the command line in the kernel configuration. That’s what we often do, because it helps to mitigate attacks where the bootloader configuration might be modified. Caveat: Depending on how your update concept works, it may need to alter the kernel command line in the bootloader.