diff --git a/clustertool/embed/generic/patches/all.yaml b/clustertool/embed/generic/patches/all.yaml
index 2dbb75d1cef..c8347c75730 100644
--- a/clustertool/embed/generic/patches/all.yaml
+++ b/clustertool/embed/generic/patches/all.yaml
@@ -1,49 +1,39 @@
-- op: replace
-  path: /machine/time
-  value:
-    "disabled": false
-    "servers":
-      - "time.cloudflare.com"
-- op: replace
-  path: /cluster/proxy
-  value:
-    "disabled": true
-- op: add
-  path: /machine/kubelet/extraArgs
-  value:
-    "rotate-server-certificates": true
-- op: add
-  path: /machine/kubelet/extraConfig
-  value:
-    "maxPods": 250
-    "shutdownGracePeriod": "15s"
-    "shutdownGracePeriodCriticalPods": "10s"
-- op: add
-  path: /machine/kubelet/extraMounts
-  value:
-    - "destination": "/var/openebs/local"
-      "type": "bind"
-      "source": "/var/openebs/local"
-      "options":
-        - "bind"
-        - "rshared"
-        - "rw"
-    - destination: /var/lib/longhorn
-      type: bind
-      source: /var/lib/longhorn
-      options:
-        - bind
-        - rshared
-        - rw
-- op: replace
-  path: /machine/features/hostDNS
-  value:
-    enabled: true
-    resolveMemberNames: true
-    forwardKubeDNSToHost: true
-- op: add
-  path: /machine/sysctls
-  value:
+cluster:
+  proxy:
+    disabled: true
+machine:
+  time:
+    disabled: false
+    servers:
+      - time.cloudflare.com
+  kubelet:
+    extraArgs:
+      rotate-server-certificates: "true"
+    extraConfig:
+      maxPods: 250
+      shutdownGracePeriod: 15s
+      shutdownGracePeriodCriticalPods: 10s
+    extraMounts:
+      - destination: /var/openebs/local
+        type: bind
+        source: /var/openebs/local
+        options:
+          - bind
+          - rshared
+          - rw
+      - destination: /var/lib/longhorn
+        type: bind
+        source: /var/lib/longhorn
+        options:
+          - bind
+          - rshared
+          - rw
+  features:
+    hostDNS:
+      enabled: true
+      forwardKubeDNSToHost: true
+      resolveMemberNames: true
+  sysctls:
     fs.inotify.max_queued_events: "65536"
     fs.inotify.max_user_instances: "8192"
     fs.inotify.max_user_watches: "524288"
@@ -58,47 +48,45 @@
     net.ipv4.tcp_wmem: 4096 65536 33554432 # 10Gb/s
     net.ipv4.tcp_window_scaling: 1         # 10Gb/s
     vm.nr_hugepages: 1024                  # PostgreSQL
-
-- op: add
-  path: /machine/registries/mirrors
-  value:
-    cgr.dev:
-      endpoints:
-        - https://cgr.dev
-    docker.io:
-      endpoints:
-        - https://mirror.gcr.io
-        - https://registry-1.docker.io
-        - https://docker.io
-    registry-1.docker.io:
-      endpoints:
-        - https://mirror.gcr.io
-        - https://registry-1.docker.io
-    ghcr.io:
-      endpoints:
-        - https://ghcr.io
-    quay.io:
-      endpoints:
-        - https://quay.io
-    mcr.microsoft.com:
-      endpoints:
-        - https://mcr.microsoft.com
-    public.ecr.aws:
-      endpoints:
-        - https://public.ecr.aws
-    gcr.io:
-      endpoints:
-        - https://gcr.io
-    registry.k8s.io:
-      endpoints:
-        - https://registry.k8s.io
-    k8s.gcr.io:
-      endpoints:
-        - https://k8s.gcr.io
-    tccr.io:
-      endpoints:
-        - https://quay.io
-        - https://tccr.io
-    factory.talos.dev:
-      endpoints:
-        - https://factory.talos.dev
+  registries:
+    mirrors:
+      cgr.dev:
+        endpoints:
+          - https://cgr.dev
+      docker.io:
+        endpoints:
+          - https://mirror.gcr.io
+          - https://registry-1.docker.io
+          - https://docker.io
+      factory.talos.dev:
+        endpoints:
+          - https://factory.talos.dev
+      gcr.io:
+        endpoints:
+          - https://gcr.io
+      ghcr.io:
+        endpoints:
+          - https://ghcr.io
+      k8s.gcr.io:
+        endpoints:
+          - https://k8s.gcr.io
+      mcr.microsoft.com:
+        endpoints:
+          - https://mcr.microsoft.com
+      public.ecr.aws:
+        endpoints:
+          - https://public.ecr.aws
+      quay.io:
+        endpoints:
+          - https://quay.io
+      registry-1.docker.io:
+        endpoints:
+          - https://mirror.gcr.io
+          - https://registry-1.docker.io
+      registry.k8s.io:
+        endpoints:
+          - https://registry.k8s.io
+      tccr.io:
+        endpoints:
+          - https://quay.io
+          - https://tccr.io
diff --git a/clustertool/embed/generic/patches/controlplane.yaml b/clustertool/embed/generic/patches/controlplane.yaml
index c91e87f2356..6201d17a031 100644
--- a/clustertool/embed/generic/patches/controlplane.yaml
+++ b/clustertool/embed/generic/patches/controlplane.yaml
@@ -1,40 +1,28 @@
-- op: add
-  path: /cluster/proxy/extraArgs
-  value:
-    "metrics-bind-address": "0.0.0.0:10249"
-- op: add
-  path: /cluster/controllerManager/extraArgs
-  value:
-    "bind-address": "0.0.0.0"
-
-- op: add
-  path: /cluster/scheduler/extraArgs
-  value:
-    "bind-address": "0.0.0.0"
-
-- op: add
-  path: /cluster/apiServer/extraArgs
-  value:
-    enable-aggregator-routing: true
-    runtime-config: admissionregistration.k8s.io/v1alpha1=true
-    feature-gates: MutatingAdmissionPolicy=true
-
-- op: replace
-  path: /cluster/apiServer/admissionControl
-  value:
+machine:
+  features:
+    kubernetesTalosAPIAccess:
+      enabled: true
+      allowedRoles:
+        - os:admin
+      allowedKubernetesNamespaces:
+        - system-upgrade
+cluster:
+  controllerManager:
+    extraArgs:
+      bind-address: 0.0.0.0
+  proxy:
+    extraArgs:
+      metrics-bind-address: 0.0.0.0:10249
+  apiServer:
+    extraArgs:
+      enable-aggregator-routing: "true"
+      feature-gates: MutatingAdmissionPolicy=true
+      runtime-config: admissionregistration.k8s.io/v1alpha1=true
+    admissionControl:
       - name: PodSecurity
         configuration:
-          apiVersion: pod-security.admission.config.k8s.io/v1alpha1
-          defaults:
-            audit: restricted
-            audit-version: latest
-            enforce: baseline
-            enforce-version: latest
-            warn: restricted
-            warn-version: latest
           exemptions:
             namespaces:
-              - kube-system
               - metallb
               - metallb-config
               - topolvm-system
@@ -45,34 +33,23 @@
               - snapshot-controller
               - volsync
               - flux-system
-            runtimeClasses: []
-            usernames: []
-          kind: PodSecurityConfiguration
-- op: add
-  path: /machine/features/kubernetesTalosAPIAccess
-  value:
-    enabled: true
-    allowedRoles:
-      - os:admin
-    allowedKubernetesNamespaces:
-      - system-upgrade
-- op: add
-  path: /cluster/scheduler
-  value:
+  scheduler:
+    extraArgs:
+      bind-address: 0.0.0.0
     config:
       apiVersion: kubescheduler.config.k8s.io/v1
       kind: KubeSchedulerConfiguration
       profiles:
-        - schedulerName: default-scheduler
-          plugins:
-            score:
-              disabled:
-                - name: ImageLocality
-          pluginConfig:
-            - name: PodTopologySpread
-              args:
-                defaultingType: List
+        - pluginConfig:
+            - args:
                 defaultConstraints:
                   - maxSkew: 1
                     topologyKey: kubernetes.io/hostname
                     whenUnsatisfiable: ScheduleAnyway
+                defaultingType: List
+              name: PodTopologySpread
+          plugins:
+            score:
+              disabled:
+                - name: ImageLocality
+          schedulerName: default-scheduler
diff --git a/clustertool/embed/generic/patches/nvidia.yaml b/clustertool/embed/generic/patches/nvidia.yaml
new file mode 100644
index 00000000000..e274bbceb09
--- /dev/null
+++ b/clustertool/embed/generic/patches/nvidia.yaml
@@ -0,0 +1,9 @@
+machine:
+  kernel:
+    modules:
+      - name: nvidia
+      - name: nvidia_uvm
+      - name: nvidia_drm
+      - name: nvidia_modeset
+  sysctls:
+    net.core.bpf_jit_harden: 1
diff --git a/clustertool/embed/generic/patches/worker.yaml b/clustertool/embed/generic/patches/worker.yaml
index c027c6b625a..1ddb3dbe258 100644
--- a/clustertool/embed/generic/patches/worker.yaml
+++ b/clustertool/embed/generic/patches/worker.yaml
@@ -1,6 +1,5 @@
-- op: replace
-  path: /machine/time
-  value:
-    "disabled": false
-    "servers":
-      - "time.cloudflare.com"
+machine:
+  time:
+    disabled: false
+    servers:
+      - time.cloudflare.com