diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index fefd22d..332b6c9 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -3,6 +3,15 @@ on:
     tags:
       - 'v*.*.*'
 
+env:
+  RPI_MODEL: rpi5
+  REGISTRY: ghcr.io
+  REGISTRY_USERNAME: ${{ github.repository_owner }}
+  # Extensions to bake into the installer image.
+  # Format: space-separated list of image:tag references (digests resolved at build time).
+  EXTENSION_ISCSI_IMAGE: ghcr.io/siderolabs/iscsi-tools:v0.2.0
+  EXTENSION_UTIL_LINUX_IMAGE: ghcr.io/siderolabs/util-linux-tools:2.41.2
+
 jobs:
   build:
     permissions:
@@ -27,21 +36,59 @@ jobs:
           git config --global user.name "github-actions[bot]"
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
 
+      - name: Resolve extension image digests
+        run: |
+          EXTENSIONS=""
+          while IFS= read -r line; do
+            IMAGE="${line#*=}"
+            DIGEST=$(crane digest "$IMAGE")
+            EXTENSIONS="$EXTENSIONS $IMAGE@$DIGEST"
+          done < <(env | grep '^EXTENSION_')
+          echo "EXTENSIONS=${EXTENSIONS# }" >> $GITHUB_ENV
+
       - name: Prepare (checkouts & patches)
-        run: make checkouts patches
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} checkouts patches-pi5
 
       - name: Kernel
-        run: make kernel
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} REGISTRY=${{ env.REGISTRY }} REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} kernel
+
+      - name: Kernel initramfs
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} REGISTRY=${{ env.REGISTRY }} REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} kern_initramfs
+
+      - name: Installer base
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} REGISTRY=${{ env.REGISTRY }} REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} installer-base
+
+      - name: Imager
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} REGISTRY=${{ env.REGISTRY }} REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} imager
 
       - name: Overlay
-        run: make overlay
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} REGISTRY=${{ env.REGISTRY }} REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} overlay
 
-      - name: Installer
-        run: make installer
+      - name: Build installer image (with extensions)
+        run: |
+          make RPI_MODEL=${{ env.RPI_MODEL }} \
+            REGISTRY=${{ env.REGISTRY }} \
+            REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} \
+            ASSET_TYPE=installer \
+            EXTENSIONS="${{ env.EXTENSIONS }}" \
+            installer-pi5
+          # Push the installer OCI tarball so it can be used for upgrades
+          crane push \
+            ./checkouts/talos/_out/installer-arm64.tar \
+            ${{ env.REGISTRY }}/${{ env.REGISTRY_USERNAME }}/installer:$(cd checkouts/talos && git describe --tag --always --dirty --match v[0-9]*)
 
-      - name: Release
+      - name: Build metal disk image (for fresh installs)
+        run: |
+          make RPI_MODEL=${{ env.RPI_MODEL }} \
+            REGISTRY=${{ env.REGISTRY }} \
+            REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} \
+            ASSET_TYPE=metal \
+            EXTENSIONS="${{ env.EXTENSIONS }}" \
+            installer-pi5
+
+      - name: Release (tag installer image with git tag)
         if: startsWith(github.ref, 'refs/tags/v')
-        run: make release
+        run: make RPI_MODEL=${{ env.RPI_MODEL }} REGISTRY=${{ env.REGISTRY }} REGISTRY_USERNAME=${{ env.REGISTRY_USERNAME }} release
 
       - name: Create GitHub Release
         env:
@@ -52,10 +99,15 @@ jobs:
           
           This is a patched version of Talos tailored for the Raspberry Pi 5, including NVMe, NIC and USB support.
           
+          ### Extensions included
+          
+          - \`iscsi-tools\` ${{ env.EXTENSION_ISCSI_IMAGE }}
+          - \`util-linux-tools\` ${{ env.EXTENSION_UTIL_LINUX_IMAGE }}
+          
           ### What's available
           
           - 📦 **Raw disk image** (\`metal-arm64.raw.zst\`) for fresh installs
-          - ⚙️  **Installer image** (\`ghcr.io/talos-rpi5/installer:${{ github.ref_name }}\`) for upgrades
+          - ⚙️  **Installer image** (\`${{ env.REGISTRY }}/${{ env.REGISTRY_USERNAME }}/installer:${{ github.ref_name }}\`) for upgrades
           
           ### Install
           
@@ -65,7 +117,7 @@ jobs:
           
           - **Upgrade existing node**
             \`\`\`bash
-            talosctl upgrade --nodes <NODE_IP> --image ghcr.io/talos-rpi5/installer:${{ github.ref_name }}
+            talosctl upgrade --nodes <NODE_IP> --image ${{ env.REGISTRY }}/${{ env.REGISTRY_USERNAME }}/installer:${{ github.ref_name }}
             \`\`\`
           
           EOF
diff --git a/Makefile b/Makefile
index 8955a48..9d4766a 100644
--- a/Makefile
+++ b/Makefile
@@ -2,12 +2,23 @@ PKG_VERSION = v1.11.0
 TALOS_VERSION = v1.11.5
 SBCOVERLAY_VERSION = main
 
+PUSH ?= true
 REGISTRY ?= ghcr.io
-REGISTRY_USERNAME ?= talos-rpi5
 
+ifndef RPI_MODEL
+RPI_MODEL = rpi5
+endif
+REGISTRY_USERNAME ?= talos-$(RPI_MODEL)
 TAG ?= $(shell git describe --tags --exact-match)
 
-EXTENSIONS ?= ghcr.io/siderolabs/gvisor:20250505.0@sha256:d7503b59603f030b972ceb29e5e86979e6c889be1596e87642291fee48ce380c
+SED ?= sed
+ASSET_TYPE ?= installer
+CONFIG_TXT = dtparam=i2c_arm=on
+
+EXTENSIONS ?=
+EXTENSION_ARGS = $(foreach ext,$(EXTENSIONS),--system-extension-image $(ext))
+
+SBCOVERLAY_PI4_IMAGE ?= ghcr.io/siderolabs/sbc-raspberrypi:v0.1.5
 
 PKG_REPOSITORY = https://github.com/siderolabs/pkgs.git
 TALOS_REPOSITORY = https://github.com/siderolabs/talos.git
@@ -25,15 +36,20 @@ SBCOVERLAY_TAG = $(shell cd $(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5 && git descr
 #
 .PHONY: help
 help:
-	@echo "checkouts : Clone repositories required for the build"
-	@echo "patches   : Apply all patches"
-	@echo "kernel    : Build kernel"
-	@echo "overlay   : Build Raspberry Pi 5 overlay"
-	@echo "installer : Build installer docker image and disk image"
-	@echo "release   : Use only when building the final release, this will tag relevant images with the current Git tag."
-	@echo "clean     : Clean up any remains"
-
-
+	@echo "checkouts      : Clone repositories required for the build"
+	@echo "patches-pi5    : Apply all patches for Raspberry Pi 5"
+	@echo "patches-pi4    : Apply all patches for Raspberry Pi 4"
+	@echo "kernel         : Build kernel"
+	@echo "overlay        : Build Raspberry Pi 5 overlay"
+	@echo "imager         : Build imager docker image"
+	@echo "installer-base : Build installer-base docker image"
+	@echo "kern_initramfs : Build kernel and initramfs"
+	@echo "installer-pi5  : Build installer/image for Raspberry Pi 5"
+	@echo "installer-pi4  : Build installer/image for Raspberry Pi 4"
+	@echo "pi5            : Full build pipeline for Raspberry Pi 5"
+	@echo "pi4            : Full build pipeline for Raspberry Pi 4"
+	@echo "release        : Use only when building the final release, this will tag relevant images with the current Git tag."
+	@echo "clean          : Clean up any remains"
 
 #
 # Checkouts
@@ -49,23 +65,30 @@ checkouts-clean:
 	rm -rf "$(CHECKOUTS_DIRECTORY)/talos"
 	rm -rf "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5"
 
-
-
 #
 # Patches
 #
-.PHONY: patches-pkgs patches-talos patches
+.PHONY: patches-pkgs patches-talos patches patches-pkgs-4 patches-pi4 patches-pi5
 patches-pkgs:
 	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
 		git am "$(PATCHES_DIRECTORY)/siderolabs/pkgs/0001-Patched-for-Raspberry-Pi-5.patch"
+	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
+		git apply $(PATCHES_DIRECTORY)/siderolabs/pkgs/0003-nf-bridge.patch
 
 patches-talos:
 	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
 		git am "$(PATCHES_DIRECTORY)/siderolabs/talos/0001-Patched-for-Raspberry-Pi-5.patch"
 
-patches: patches-pkgs patches-talos
+patches-pi5: patches-pkgs patches-talos
 
+patches-pkgs-4:
+	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
+		git apply "$(PATCHES_DIRECTORY)/siderolabs/pkgs/0002-Patched-for-Raspberry-Pi-4.patch"
 
+patches-pi4: patches-pkgs patches-pkgs-4 patches-talos
+
+# Backwards-compatible alias
+patches: patches-pi5
 
 #
 # Kernel
@@ -74,12 +97,10 @@ patches: patches-pkgs patches-talos
 kernel:
 	cd "$(CHECKOUTS_DIRECTORY)/pkgs" && \
 		$(MAKE) \
-			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=$(PUSH) \
 			PLATFORM=linux/arm64 \
 			kernel
 
-
-
 #
 # Overlay
 #
@@ -88,34 +109,67 @@ overlay:
 	@echo SBCOVERLAY_TAG = $(SBCOVERLAY_TAG)
 	cd "$(CHECKOUTS_DIRECTORY)/sbc-raspberrypi5" && \
 		$(MAKE) \
-			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) IMAGE_TAG=$(SBCOVERLAY_TAG) PUSH=true \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) IMAGE_TAG=$(SBCOVERLAY_TAG) PUSH=$(PUSH) \
 			PKGS_PREFIX=$(REGISTRY)/$(REGISTRY_USERNAME) PKGS=$(PKGS_TAG) \
 			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
 			sbc-raspberrypi5
 
+.PHONY: imager
+imager:
+	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
+		$(MAKE) \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=$(PUSH) \
+			PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
+			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 SED=$(SED) \
+			imager
 
+.PHONY: installer-base
+installer-base:
+	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
+		$(MAKE) \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=$(PUSH) \
+			PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
+			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 SED=$(SED) \
+			installer-base
+
+.PHONY: kern_initramfs
+kern_initramfs:
+	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
+		$(MAKE) \
+			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=$(PUSH) \
+			PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
+			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 SED=$(SED) \
+			kernel initramfs
 
 #
 # Installer/Image
 #
-.PHONY: installer
-installer:
+.PHONY: installer-pi5
+installer-pi5:
 	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
-		$(MAKE) \
-			REGISTRY=$(REGISTRY) USERNAME=$(REGISTRY_USERNAME) PUSH=true \
-			PKG_KERNEL=$(REGISTRY)/$(REGISTRY_USERNAME)/kernel:$(PKGS_TAG) \
-			INSTALLER_ARCH=arm64 PLATFORM=linux/arm64 \
-			IMAGER_ARGS="--overlay-name=rpi5 --overlay-image=$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG) --system-extension-image=$(EXTENSIONS)" \
-			kernel initramfs imager installer-base installer && \
 		docker \
 			run --rm -t -v ./_out:/out -v /dev:/dev --privileged $(REGISTRY)/$(REGISTRY_USERNAME)/imager:$(TALOS_TAG) \
-			metal --arch arm64 \
-			--base-installer-image="$(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG)" \
+			$(ASSET_TYPE) --arch arm64 \
+			--base-installer-image="$(REGISTRY)/$(REGISTRY_USERNAME)/installer-base:$(TALOS_TAG)" \
 			--overlay-name="rpi5" \
 			--overlay-image="$(REGISTRY)/$(REGISTRY_USERNAME)/sbc-raspberrypi5:$(SBCOVERLAY_TAG)" \
-			--system-extension-image="$(EXTENSIONS)"
+			$(EXTENSION_ARGS)
 
+.PHONY: installer-pi4
+installer-pi4:
+	cd "$(CHECKOUTS_DIRECTORY)/talos" && \
+		docker \
+			run --rm -t -v ./_out:/out -v /dev:/dev --privileged $(REGISTRY)/$(REGISTRY_USERNAME)/imager:$(TALOS_TAG) \
+			$(ASSET_TYPE) --arch arm64 \
+			--base-installer-image="$(REGISTRY)/$(REGISTRY_USERNAME)/installer-base:$(TALOS_TAG)" \
+			--overlay-name="rpi_generic" \
+			--overlay-image="$(SBCOVERLAY_PI4_IMAGE)" \
+			--overlay-option="configTxtAppend=$(CONFIG_TXT)" \
+			$(EXTENSION_ARGS)
 
+# Backwards-compatible alias
+.PHONY: installer
+installer: installer-pi5
 
 #
 # Release
@@ -126,7 +180,11 @@ release:
 		docker tag $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TALOS_TAG) $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TAG) && \
 		docker push $(REGISTRY)/$(REGISTRY_USERNAME)/installer:$(TAG)
 
+.PHONY: pi5
+pi5: checkouts-clean checkouts patches-pi5 kernel kern_initramfs installer-base imager overlay installer-pi5
 
+.PHONY: pi4
+pi4: checkouts-clean checkouts patches-pi4 kernel kern_initramfs installer-base imager installer-pi4
 
 #
 # Clean
diff --git a/README.md b/README.md
index 2478f56..ef7f463 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,9 @@
 # Raspberry Pi 5 Talos Builder
-This repository serves as the glue to build custom Talos images for the Raspberry Pi 5. It patches the Kernel and Talos build process to use the Linux Kernel source provided by [raspberrypi/linux](https://github.com/raspberrypi/linux). 
+
+This repository serves as the glue to build custom Talos images for the Raspberry Pi 5. It patches the Kernel and Talos build process to use the Linux Kernel source provided by [raspberrypi/linux](https://github.com/raspberrypi/linux).
 
 ## Tested on
+
 So far, this release has been verified on:
 
 | ✅ Hardware                                                |
@@ -11,30 +13,49 @@ So far, this release has been verified on:
 | Raspberry Pi 5b with [RS-P11 for RS-P22 RPi5](https://wiki.52pi.com/index.php?title=EP-0234) |
 
 ## What's not working?
+
 * Booting from USB: USB is only available once LINUX has booted up but not in U-Boot.
 
 ## How to use?
-The releases on this repository align with the corresponding Talos version. There is a raw disk image (initial setup) and an installer image (upgrades) provided. 
+
+The releases on this repository align with the corresponding Talos version. There is a raw disk image (initial setup) and an installer image (upgrades) provided.
 
 ### Examples
+
 Initial:
-```
+
+```bash
 unzstd metal-arm64-rpi.raw.zst
 dd if=metal-arm64-rpi.raw of=<disk> bs=4M status=progress
 sync
 ```
 
 Upgrade:
-```
+
+```bash
 talosctl upgrade \
   --nodes <node IP> \
   --image ghcr.io/talos-rpi5/installer:<version>
 ```
 
 ## Building
+
+### Using GitHub Actions
+
+The CI workflow builds and publishes images automatically. It can be triggered two ways:
+
+- **Push a tag** matching `v*.*.*` — this triggers the full build and creates a GitHub Release:
+  ```bash
+  git tag v1.11.5-cm5
+  git push origin v1.11.5-cm5
+  ```
+- **Manual run** — go to Actions → build → "Run workflow" to trigger a build without creating a release.
+
+### Local build
+
 If you'd like to make modifications, it is possible to create your own build. Bellow is an example of the standard build.
 
-```
+```bash
 # Clones all dependencies and applies the necessary patches
 make checkouts patches
 
@@ -48,5 +69,45 @@ make REGISTRY=ghcr.io REGISTRY_USERNAME=<username> overlay
 make REGISTRY=ghcr.io REGISTRY_USERNAME=<username> installer
 ```
 
+### Extensions support
+
+Talos [system extensions](https://www.talos.dev/latest/talos-guides/configuration/system-extensions/) can be baked into the installer image at build time.
+
+**Makefile variables:**
+
+```makefile
+EXTENSIONS ?=
+EXTENSION_ARGS = $(foreach ext,$(EXTENSIONS),--system-extension-image $(ext))
+```
+
+`EXTENSIONS` is a space-separated list of `image:tag@sha256:digest` references passed as a make variable at build time — no Makefile edits needed. Internally, the Makefile expands each entry into a `--system-extension-image` flag and passes them all to the Talos imager.
+
+**Adding extensions to the CI build:**
+
+Just add a new `EXTENSION_*` env var at the top of `.github/workflows/build.yaml` — the digest resolution step automatically loops through all vars matching that prefix:
+
+```yaml
+env:
+  EXTENSION_ISCSI_IMAGE: ghcr.io/siderolabs/iscsi-tools:v0.2.0
+  EXTENSION_UTIL_LINUX_IMAGE: ghcr.io/siderolabs/util-linux-tools:2.41.2
+  EXTENSION_MY_IMAGE: ghcr.io/siderolabs/my-extension:v1.0.0   # ← just add this
+```
+
+The workflow resolves the digest for each at build time and assembles the full `EXTENSIONS` string automatically.
+
+**Adding extensions for a local build:**
+
+```bash
+# Resolve the digest first
+DIGEST=$(crane digest ghcr.io/siderolabs/foo-extension:v1.0.0)
+
+make REGISTRY=ghcr.io REGISTRY_USERNAME=<username> \
+  EXTENSIONS="ghcr.io/siderolabs/foo-extension:v1.0.0@${DIGEST}" \
+  installer-pi5
+```
+
+Pass multiple extensions as a space-separated string inside the quotes.
+
 ## License
+
 See [LICENSE](LICENSE).
diff --git a/patches/siderolabs/pkgs/0002-Patched-for-Raspberry-Pi-4.patch b/patches/siderolabs/pkgs/0002-Patched-for-Raspberry-Pi-4.patch
new file mode 100644
index 0000000..0cb9ff6
--- /dev/null
+++ b/patches/siderolabs/pkgs/0002-Patched-for-Raspberry-Pi-4.patch
@@ -0,0 +1,47 @@
+diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64
+index 9b215b0..6cc483e 100644
+--- a/kernel/build/config-arm64
++++ b/kernel/build/config-arm64
+@@ -432,13 +432,13 @@ CONFIG_ROCKCHIP_ERRATUM_3588001=y
+ CONFIG_SOCIONEXT_SYNQUACER_PREITS=y
+ # end of ARM errata workarounds via the alternatives framework
+ 
+-# CONFIG_ARM64_4K_PAGES is not set
+-CONFIG_ARM64_16K_PAGES=y
++CONFIG_ARM64_4K_PAGES=y
++# CONFIG_ARM64_16K_PAGES is not set
+ # CONFIG_ARM64_64K_PAGES is not set
+-# CONFIG_ARM64_VA_BITS_39 is not set
+-CONFIG_ARM64_VA_BITS_48=y
++CONFIG_ARM64_VA_BITS_39=y
++# CONFIG_ARM64_VA_BITS_48 is not et
+ # CONFIG_ARM64_VA_BITS_52 is not set
+-CONFIG_ARM64_VA_BITS=48
++CONFIG_ARM64_VA_BITS=39
+ CONFIG_ARM64_PA_BITS_48=y
+ CONFIG_ARM64_PA_BITS=48
+ # CONFIG_CPU_BIG_ENDIAN is not set
+@@ -834,10 +834,10 @@ CONFIG_ARCH_WANTS_EXECMEM_LATE=y
+ CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y
+ CONFIG_SOFTIRQ_ON_OWN_STACK=y
+ CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
+-CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
+-CONFIG_ARCH_MMAP_RND_BITS=18
+-CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y
+-CONFIG_ARCH_MMAP_RND_COMPAT_BITS=11
++# CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
++# CONFIG_ARCH_MMAP_RND_BITS is not set
++# CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y
++# CONFIG_ARCH_MMAP_RND_COMPAT_BITS is not set
+ CONFIG_HAVE_PAGE_SIZE_4KB=y
+ CONFIG_PAGE_SIZE_4KB=y
+ CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+@@ -3735,7 +3735,7 @@ CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
+ CONFIG_SERIAL_MVEBU_UART=y
+ CONFIG_SERIAL_MVEBU_CONSOLE=y
+ # CONFIG_SERIAL_OWL is not set
+-# CONFIG_SERIAL_RPI_FW is not set
++CONFIG_SERIAL_RPI_FW=m
+ # end of Serial drivers
+ 
+ CONFIG_SERIAL_MCTRL_GPIO=y
diff --git a/patches/siderolabs/pkgs/0003-nf-bridge.patch b/patches/siderolabs/pkgs/0003-nf-bridge.patch
new file mode 100644
index 0000000..eddb8d2
--- /dev/null
+++ b/patches/siderolabs/pkgs/0003-nf-bridge.patch
@@ -0,0 +1,13 @@
+diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64
+index 9b215b0..6518d59 100644
+--- a/kernel/build/config-arm64
++++ b/kernel/build/config-arm64
+@@ -1633,7 +1633,7 @@ CONFIG_IP6_NF_NAT=y
+ # end of IPv6: Netfilter Configuration
+ 
+ CONFIG_NF_DEFRAG_IPV6=y
+-# CONFIG_NF_TABLES_BRIDGE is not set
++CONFIG_NF_TABLES_BRIDGE=y
+ # CONFIG_NF_CONNTRACK_BRIDGE is not set
+ CONFIG_BRIDGE_NF_EBTABLES_LEGACY=y
+ CONFIG_BRIDGE_NF_EBTABLES=y
diff --git a/patches/siderolabs/talos/0002-Makefile.patch b/patches/siderolabs/talos/0002-Makefile.patch
new file mode 100644
index 0000000..d97d1b4
--- /dev/null
+++ b/patches/siderolabs/talos/0002-Makefile.patch
@@ -0,0 +1,54 @@
+diff --git a/Makefile b/Makefile
+index e5e5be5d2..72fd7cd02 100644
+--- a/Makefile
++++ b/Makefile
+@@ -17,10 +17,12 @@ NAME = Talos
+ CLOUD_IMAGES_EXTRA_ARGS ?= ""
+ ZSTD_COMPRESSION_LEVEL ?= 18
+ 
+-CI_RELEASE_TAG := $(shell git log --oneline --format=%B -n 1 HEAD^2 -- 2>/dev/null | head -n 1 | sed -r "/^release\(.*\)/ s/^release\((.*)\):.*$/\1/; t; Q")
++CI_RELEASE_TAG := $(shell git log --oneline --format=%B -n 1 HEAD^2 -- 2>/dev/null | head -n 1 | $(SED) -r "/^release\(.*\)/ s/^release\((.*)\):.*$/\1/; t; Q")
+ 
+ ARTIFACTS := _out
+ 
++SED ?= sed
++
+ DEBUG_TOOLS_SOURCE := scratch
+ EMBED_TARGET ?= embed
+ 
+@@ -122,7 +124,7 @@ TEXTLINT_RULE_ONE_SENTENCE_PER_LINE_VERSION ?= 2.0.0
+ # renovate: datasource=docker depName=hugomods/hugo
+ HUGO_VERSION ?= dart-sass-0.145.0
+ OPERATING_SYSTEM := $(shell uname -s | tr "[:upper:]" "[:lower:]")
+-ARCH := $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
++ARCH := $(shell uname -m | $(SED) 's/x86_64/amd64/' | $(SED) 's/aarch64/arm64/')
+ TALOSCTL_DEFAULT_TARGET := talosctl-$(OPERATING_SYSTEM)
+ TALOSCTL_EXECUTABLE := $(PWD)/$(ARTIFACTS)/$(TALOSCTL_DEFAULT_TARGET)-$(ARCH)
+ INTEGRATION_TEST := integration-test
+@@ -371,7 +373,7 @@ docker-%: ## Builds the specified target defined in the Dockerfile using the doc
+ 	@$(MAKE) target-$* TARGET_ARGS="--output type=docker,dest=$(DEST)/$*.tar,name=$(REGISTRY_AND_USERNAME)/$*:$(IMAGE_TAG_OUT) $(TARGET_ARGS)"
+ 
+ registry-%: ## Builds the specified target defined in the Dockerfile using the image/registry output type. The build result will be pushed to the registry if PUSH=true.
+-	@$(MAKE) target-$* TARGET_ARGS="--output type=image,name=$(REGISTRY_AND_USERNAME)/$*:$(IMAGE_TAG_OUT),rewrite-timestamp=true $(TARGET_ARGS)"
++	@$(MAKE) target-$* TARGET_ARGS="--output type=image,name=$(REGISTRY_AND_USERNAME)/$*:$(IMAGE_TAG_OUT),rewrite-timestamp=false $(TARGET_ARGS)"
+ 
+ hack-test-%: ## Runs the specified script in ./hack/test with well known environment variables.
+ 	@./hack/test/$*.sh
+@@ -739,7 +741,7 @@ reproducibility-test-docker-%: $(ARTIFACTS)
+ 	@mkdir -p _out1/ _out2/
+ 	@$(MAKE) docker-$* DEST=_out1/
+ 	@$(MAKE) docker-$* DEST=_out2/ TARGET_ARGS="--no-cache"
+-	@find _out1/ -type f | xargs -IFILE diffoscope FILE `echo FILE | sed 's/_out1/_out2/'`
++	@find _out1/ -type f | xargs -IFILE diffoscope FILE `echo FILE | $(SED) 's/_out1/_out2/'`
+ 	@rm -rf _out1/ _out2/
+ 
+ reproducibility-test-local-%: $(ARTIFACTS)
+@@ -747,7 +749,7 @@ reproducibility-test-local-%: $(ARTIFACTS)
+ 	@mkdir -p _out1/ _out2/
+ 	@$(MAKE) local-$* DEST=_out1/
+ 	@$(MAKE) local-$* DEST=_out2/ TARGET_ARGS="--no-cache"
+-	@find _out1/ -type f | xargs -IFILE diffoscope FILE `echo FILE | sed 's/_out1/_out2/'`
++	@find _out1/ -type f | xargs -IFILE diffoscope FILE `echo FILE | $(SED) 's/_out1/_out2/'`
+ 	@rm -rf _out1/ _out2/
+ 
+ reproducibility-test-iso: $(ARTIFACTS)