diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index fa60f8f..304887a 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -74,24 +74,24 @@ provider "registry.terraform.io/rgl/kustomizer" {
 }
 
 provider "registry.terraform.io/siderolabs/talos" {
-  version     = "0.6.1"
-  constraints = "0.6.1"
+  version     = "0.7.0"
+  constraints = "0.7.0"
   hashes = [
-    "h1:eFw5nEpptkVQ+SNXFEaYa8o++5Q3WVznDgrxJ78ROLA=",
+    "h1:1yCF9ScXtXPZFU7dDhwFvgJuvA68yz9VLTmVLnd5HAA=",
+    "zh:010555eadc96ea5bfd60813d9b248b8da6a6cb8c90fdfb7ed59580e35db73392",
     "zh:0fa82a384b25a58b65523e0ea4768fa1212b1f5cfc0c9379d31162454fedcc9d",
-    "zh:14f377dd6c3786583e1e8e10d74c762fd7767f84ab048d02cd418920f42686e7",
-    "zh:2bff386f61360f306e0c7cd8d4e67048b7e38bfcb974dd7f70b1f385477fa08d",
-    "zh:3601a3e133867abacc5836392db329dc6dfe52116263e2931837c8dfdf5d0bde",
-    "zh:54b47cfd80a939ccfdc4ebb693796e930be98e2ca1b3676c3fe61b114ca12621",
-    "zh:5b7cde484b9534bf5238c0f50da704edd53658bc376df5ef5b27406e4c80ee92",
-    "zh:5e844e071112293b4fced2ac9dd0fa2f744e78db18732dd989fd54783408b667",
-    "zh:a5442065fdc1de0bd38f70418b843d82570fb05a66e0a47c1358d0d9dab4418f",
-    "zh:b140dae2b6d0a09c2160841bf75fc7a654d7249b5b9f59db07df980ed950ffec",
-    "zh:b3cbf898cab3ae26be1dc3ed24b43f3a91510e6a190f5442c08957aaf1b6537e",
-    "zh:ba5eca495b37a2fd8647c138f1d50090fcaeb266508b87e7b8c931f0b6bdb735",
-    "zh:c0202c98f555fd7ecdc1b75255c3438351a557534c4ee0e9b55d678c007f785f",
-    "zh:d4bf2b894ecba7437906a450ecf136f2885b85108b3d49f8e1a046611535c841",
-    "zh:d89a71c1a3e2ea9cb109e2cbea7fd202a9ede5f5f0cc263ef50cb7f70c249c8e",
-    "zh:d98a6963b680db5a91ac51ede3be175fa9621070df2f3774197b34db0fc2e964",
+    "zh:1a55506c9e7d95977993f20ddd3c2ab4f3189883bead9f16a6381472af196be9",
+    "zh:1b557541e736b717c4333b04e8562c04863b42c7505f3dfd4f6293f92e0c9189",
+    "zh:34ab5cd76713decca325283bb5e811aff13b1d8330891e8afbc341f9b7859fd5",
+    "zh:4efea58e2323c02481935acd10af78aef03eeb6f3f7509edf895d0a80728387f",
+    "zh:4f8dc087fec4c057dae46c50d4b23e01c1455e3aab02b978241bf692aa4e8ccc",
+    "zh:74c385c6ceb29e6184f780573ebbb657f07398ddfffe35b945fa7d0d47e1eb58",
+    "zh:778e3fb012ecffbffb98ad9c1cae2936477f961c4f7f0eb8e8bfe68364f71663",
+    "zh:7b27c2e8e6267f0965003e6ab7d5132a3262fd7f126e64447d3dc65db6b74f84",
+    "zh:7ea097f7814966332e4a2e1657d6c3a80413244a071754c3f0c0f435837eb93d",
+    "zh:7ecee92a6e8bbee8d9c006ba2ae27c7a55dbc6f15f0f2302173dd4c0901a5477",
+    "zh:89523e2fedc3c1c9b4fe1884ea9ba133b1f1f341a5386076bbcb306300cd7559",
+    "zh:acb917f9ce0631ed1eeae75d54b161b45956a5264593fb86e2bb53133c40da69",
+    "zh:e570bcfbe648f6c31bbc4be0edaca6159d3b10758259196e71714b2c3a288cd2",
   ]
 }
diff --git a/README.md b/README.md
index 7b22bf1..38ce84f 100644
--- a/README.md
+++ b/README.md
@@ -89,7 +89,7 @@ Install talosctl:
 ```bash
 # see https://github.com/siderolabs/talos/releases
 # renovate: datasource=github-releases depName=siderolabs/talos
-talos_version='1.8.4'
+talos_version='1.9.0'
 wget https://github.com/siderolabs/talos/releases/download/v$talos_version/talosctl-linux-amd64
 sudo install talosctl-linux-amd64 /usr/local/bin/talosctl
 rm talosctl-linux-amd64
@@ -506,7 +506,7 @@ Update the talos extensions to match the talos version:
 Talos:
 
 ```bash
-# see https://www.talos.dev/v1.8/advanced/troubleshooting-control-plane/
+# see https://www.talos.dev/v1.9/advanced/troubleshooting-control-plane/
 talosctl -n $all support && rm -rf support && 7z x -osupport support.zip && code support
 talosctl -n $c0 service ext-qemu-guest-agent status
 talosctl -n $c0 service etcd status
@@ -519,8 +519,10 @@ talosctl -n $c0 inspect dependencies | dot -Tsvg >c0.svg && xdg-open c0.svg
 talosctl -n $c0 dashboard
 talosctl -n $c0 logs controller-runtime
 talosctl -n $c0 logs kubelet
-talosctl -n $c0 disks
 talosctl -n $c0 mounts | sort
+talosctl -n $c0 get blockdevices
+talosctl -n $c0 get disks
+talosctl -n $c0 get systemdisk
 talosctl -n $c0 get resourcedefinitions
 talosctl -n $c0 get machineconfigs -o yaml
 talosctl -n $c0 get staticpods -o yaml
diff --git a/cilium.tf b/cilium.tf
index 5d4dd7c..2cf870b 100644
--- a/cilium.tf
+++ b/cilium.tf
@@ -44,7 +44,7 @@ locals {
   cilium_external_lb_manifest = join("---\n", [for d in local.cilium_external_lb_manifests : yamlencode(d)])
 }
 
-// see https://www.talos.dev/v1.8/kubernetes-guides/network/deploying-cilium/#method-4-helm-manifests-inline-install
+// see https://www.talos.dev/v1.9/kubernetes-guides/network/deploying-cilium/#method-4-helm-manifests-inline-install
 // see https://docs.cilium.io/en/stable/network/servicemesh/ingress/
 // see https://docs.cilium.io/en/stable/gettingstarted/hubble_setup/
 // see https://docs.cilium.io/en/stable/gettingstarted/hubble/
diff --git a/do b/do
index 6059940..59c48e2 100755
--- a/do
+++ b/do
@@ -11,20 +11,20 @@ talos_image_builder="$(perl -e 'print ((`uname -r` =~ /^(\d+\.\d+)/ && $1 >= 6.1
 
 # see https://github.com/siderolabs/talos/releases
 # renovate: datasource=github-releases depName=siderolabs/talos
-talos_version="1.8.4"
+talos_version="1.9.0"
 
 # see https://github.com/siderolabs/extensions/pkgs/container/qemu-guest-agent
 # see https://github.com/siderolabs/extensions/tree/main/guest-agents/qemu-guest-agent
-talos_qemu_guest_agent_extension_tag="9.1.0@sha256:423ca224cae8fba1e278996e83d40317dbd8863e0bbb0e6bcf5bb04bdc416717"
+talos_qemu_guest_agent_extension_tag="9.1.2@sha256:a849e55254f1cd8669ab742cdcfee200aada3dfe320841af3c338dc7cec956e9"
 
 # see https://github.com/siderolabs/extensions/pkgs/container/drbd
 # see https://github.com/siderolabs/extensions/tree/main/storage/drbd
 # see https://github.com/LINBIT/drbd
-talos_drbd_extension_tag="9.2.11-v1.8.4@sha256:bfb643094b7578c3eabb35224daad091179dc78ce5cb96fdde6fe08327ae0629"
+talos_drbd_extension_tag="9.2.12-v1.9.0@sha256:209feb3c3bb5ae3a1f43b5ec9dd55be77f958dccecc3ec39d361b4f35fde3f6c"
 
 # see https://github.com/siderolabs/extensions/pkgs/container/spin
 # see https://github.com/siderolabs/extensions/tree/main/container-runtime/spin
-talos_spin_extension_tag="v0.15.1@sha256:a0cee06a768e436d93ac98b2c2e1126a01df11f5c96b87686d38b1049e5bd119"
+talos_spin_extension_tag="v0.17.0@sha256:3f4cc5278d3b50b472e25e075688b1eb274e8e3f648bd25f969628bc2d69b1e1"
 
 # see https://github.com/piraeusdatastore/piraeus-operator/releases
 # renovate: datasource=github-releases depName=piraeusdatastore/piraeus-operator
@@ -67,9 +67,9 @@ function update-talos-extensions {
 }
 
 function build_talos_image__imager {
-  # see https://www.talos.dev/v1.8/talos-guides/install/boot-assets/
-  # see https://www.talos.dev/v1.8/advanced/metal-network-configuration/
-  # see Profile type at https://github.com/siderolabs/talos/blob/v1.8.3/pkg/imager/profile/profile.go#L24-L47
+  # see https://www.talos.dev/v1.9/talos-guides/install/boot-assets/
+  # see https://www.talos.dev/v1.9/advanced/metal-network-configuration/
+  # see Profile type at https://github.com/siderolabs/talos/blob/v1.9.0/pkg/imager/profile/profile.go#L24-L47
   local talos_version_tag="v$talos_version"
   rm -rf tmp/talos
   mkdir -p tmp/talos
@@ -110,7 +110,7 @@ EOF
 }
 
 function build_talos_image__image_factory {
-  # see https://www.talos.dev/v1.8/learn-more/image-factory/
+  # see https://www.talos.dev/v1.9/learn-more/image-factory/
   # see https://github.com/siderolabs/image-factory?tab=readme-ov-file#http-frontend-api
   local talos_version_tag="v$talos_version"
   rm -rf tmp/talos
@@ -222,7 +222,7 @@ function piraeus-install {
   # see https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#ch-kubernetes
   # see 5.7.1. Available Parameters in a Storage Class at https://linbit.com/drbd-user-guide/linstor-guide-1_0-en/#s-kubernetes-sc-parameters
   # see https://linbit.com/drbd-user-guide/drbd-guide-9_0-en/
-  # see https://www.talos.dev/v1.8/kubernetes-guides/configuration/storage/#piraeus--linstor
+  # see https://www.talos.dev/v1.9/kubernetes-guides/configuration/storage/#piraeus--linstor
   step 'piraeus install'
   kubectl apply --server-side -k "https://github.com/piraeusdatastore/piraeus-operator//config/default?ref=v$piraeus_operator_version"
   step 'piraeus wait'
diff --git a/providers.tf b/providers.tf
index 54723d3..c4bfe92 100644
--- a/providers.tf
+++ b/providers.tf
@@ -18,7 +18,7 @@ terraform {
     # see https://github.com/siderolabs/terraform-provider-talos
     talos = {
       source  = "siderolabs/talos"
-      version = "0.6.1"
+      version = "0.7.0"
     }
     # see https://registry.terraform.io/providers/hashicorp/helm
     # see https://github.com/hashicorp/terraform-provider-helm
diff --git a/talos.tf b/talos.tf
index a9b3a07..1347f67 100644
--- a/talos.tf
+++ b/talos.tf
@@ -18,7 +18,7 @@ locals {
       #    talos image, which is created in the installed state.
       #install = {}
       features = {
-        # see https://www.talos.dev/v1.8/kubernetes-guides/configuration/kubeprism/
+        # see https://www.talos.dev/v1.9/kubernetes-guides/configuration/kubeprism/
         # see talosctl -n $c0 read /etc/kubernetes/kubeconfig-kubelet | yq .clusters[].cluster.server
         # NB if you use a non-default CNI, you must configure it to use the
         #    https://localhost:7445 kube-apiserver endpoint.
@@ -26,7 +26,7 @@ locals {
           enabled = true
           port    = 7445
         }
-        # see https://www.talos.dev/v1.8/talos-guides/network/host-dns/
+        # see https://www.talos.dev/v1.9/talos-guides/network/host-dns/
         hostDNS = {
           enabled              = true
           forwardKubeDNSToHost = true
@@ -70,13 +70,14 @@ locals {
             endpoints = [
               local.zot_cluster_url,
             ]
+            skipFallback = false
           }
         }
       }
     }
     cluster = {
-      # see https://www.talos.dev/v1.8/talos-guides/discovery/
-      # see https://www.talos.dev/v1.8/reference/configuration/#clusterdiscoveryconfig
+      # see https://www.talos.dev/v1.9/talos-guides/discovery/
+      # see https://www.talos.dev/v1.9/reference/configuration/#clusterdiscoveryconfig
       discovery = {
         enabled = true
         registries = {
@@ -100,12 +101,12 @@ locals {
   }
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/resources/machine_secrets
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/resources/machine_secrets
 resource "talos_machine_secrets" "talos" {
   talos_version = "v${var.talos_version}"
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/data-sources/machine_configuration
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/data-sources/machine_configuration
 data "talos_machine_configuration" "controller" {
   cluster_name       = var.cluster_name
   cluster_endpoint   = var.cluster_endpoint
@@ -121,7 +122,7 @@ data "talos_machine_configuration" "controller" {
       machine = {
         network = {
           interfaces = [
-            # see https://www.talos.dev/v1.8/talos-guides/network/vip/
+            # see https://www.talos.dev/v1.9/talos-guides/network/vip/
             {
               interface = "eth0"
               dhcp      = true
@@ -203,7 +204,7 @@ data "talos_machine_configuration" "controller" {
   ]
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/data-sources/machine_configuration
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/data-sources/machine_configuration
 data "talos_machine_configuration" "worker" {
   cluster_name       = var.cluster_name
   cluster_endpoint   = var.cluster_endpoint
@@ -218,14 +219,14 @@ data "talos_machine_configuration" "worker" {
   ]
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/data-sources/client_configuration
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/data-sources/client_configuration
 data "talos_client_configuration" "talos" {
   cluster_name         = var.cluster_name
   client_configuration = talos_machine_secrets.talos.client_configuration
   endpoints            = [for node in local.controller_nodes : node.address]
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/resources/cluster_kubeconfig
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/resources/cluster_kubeconfig
 resource "talos_cluster_kubeconfig" "talos" {
   client_configuration = talos_machine_secrets.talos.client_configuration
   endpoint             = local.controller_nodes[0].address
@@ -235,7 +236,7 @@ resource "talos_cluster_kubeconfig" "talos" {
   ]
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/resources/machine_configuration_apply
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/resources/machine_configuration_apply
 resource "talos_machine_configuration_apply" "controller" {
   count                       = var.controller_count
   client_configuration        = talos_machine_secrets.talos.client_configuration
@@ -256,7 +257,7 @@ resource "talos_machine_configuration_apply" "controller" {
   ]
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/resources/machine_configuration_apply
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/resources/machine_configuration_apply
 resource "talos_machine_configuration_apply" "worker" {
   count                       = var.worker_count
   client_configuration        = talos_machine_secrets.talos.client_configuration
@@ -277,7 +278,7 @@ resource "talos_machine_configuration_apply" "worker" {
   ]
 }
 
-// see https://registry.terraform.io/providers/siderolabs/talos/0.6.1/docs/resources/machine_bootstrap
+// see https://registry.terraform.io/providers/siderolabs/talos/0.7.0/docs/resources/machine_bootstrap
 resource "talos_machine_bootstrap" "talos" {
   client_configuration = talos_machine_secrets.talos.client_configuration
   endpoint             = local.controller_nodes[0].address
diff --git a/variables.tf b/variables.tf
index 03c9c85..0ff0dd0 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1,9 +1,9 @@
 # see https://github.com/siderolabs/talos/releases
-# see https://www.talos.dev/v1.8/introduction/support-matrix/
+# see https://www.talos.dev/v1.9/introduction/support-matrix/
 variable "talos_version" {
   type = string
   # renovate: datasource=github-releases depName=siderolabs/talos
-  default = "1.8.4"
+  default = "1.9.0"
   validation {
     condition     = can(regex("^\\d+(\\.\\d+)+", var.talos_version))
     error_message = "Must be a version number."
@@ -11,7 +11,7 @@ variable "talos_version" {
 }
 
 # see https://github.com/siderolabs/kubelet/pkgs/container/kubelet
-# see https://www.talos.dev/v1.8/introduction/support-matrix/
+# see https://www.talos.dev/v1.9/introduction/support-matrix/
 variable "kubernetes_version" {
   type = string
   # renovate: datasource=github-releases depName=siderolabs/kubelet
@@ -102,7 +102,7 @@ variable "worker_count" {
 
 variable "talos_libvirt_base_volume_name" {
   type    = string
-  default = "talos-1.8.4.qcow2"
+  default = "talos-1.9.0.qcow2"
   validation {
     condition     = can(regex(".+\\.qcow2+$", var.talos_libvirt_base_volume_name))
     error_message = "Must be a name with a .qcow2 extension."