diff --git a/home/hosts/andromache/default.nix b/home/hosts/andromache/default.nix
index b4892b8..8c5a6eb 100644
--- a/home/hosts/andromache/default.nix
+++ b/home/hosts/andromache/default.nix
@@ -40,7 +40,10 @@
     gitea.enable = true;
     github.enable = true;
   };
+  k8s.enable = true;
   k8s.k9s.enable = true;
+  k8s.talos.enable = true;
+  keyboard.vortexCore.enable = true;
   keepassxc.enable = true;
   music.enable = true;
   newsboat.enable = true;
diff --git a/home/modules/k8s/default.nix b/home/modules/k8s/default.nix
index 04838e0..e964b27 100644
--- a/home/modules/k8s/default.nix
+++ b/home/modules/k8s/default.nix
@@ -24,12 +24,19 @@ in
         type = lib.types.bool;
       };
     };
+    talos = {
+      enable = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+      };
+    };
   };
 
   imports = [
     ./crossplane.nix
     ./helm.nix
     ./k9s.nix
+    ./talos.nix
   ];
 
   config = lib.mkIf cfg.enable {
diff --git a/home/modules/k8s/talos.nix b/home/modules/k8s/talos.nix
new file mode 100644
index 0000000..bb4f2d1
--- /dev/null
+++ b/home/modules/k8s/talos.nix
@@ -0,0 +1,12 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  config = lib.mkIf config.k8s.talos.enable {
+    home.packages = [ pkgs.talosctl ];
+  };
+}
diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index ad6ac57..6ac1a5f 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -55,6 +55,7 @@ in
   };
   desktop.ly.enable = true;
   docker.enable = true;
+  k8s.enable = true;
   hcloud.enable = true;
   networking = {
     enable = true;
diff --git a/modules/k8s/default.nix b/modules/k8s/default.nix
index 98e8c57..4a48b6d 100644
--- a/modules/k8s/default.nix
+++ b/modules/k8s/default.nix
@@ -1,3 +1,17 @@
+{ config, lib, ... }:
+
 {
-  imports = [ ./crossplane.nix ];
+  imports = [
+    ./crossplane.nix
+    ./talos.nix
+  ];
+
+  options.k8s.enable = lib.mkOption {
+    default = false;
+    type = lib.types.bool;
+  };
+
+  config = lib.mkIf config.k8s.enable {
+    k8s.talos.enable = lib.mkDefault true;
+  };
 }
diff --git a/modules/k8s/talos.nix b/modules/k8s/talos.nix
new file mode 100644
index 0000000..52fa8ca
--- /dev/null
+++ b/modules/k8s/talos.nix
@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (config.host) username;
+in
+{
+  options.k8s.talos = {
+    enable = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+    };
+    platform = lib.mkOption {
+      default = "qemu";
+      type = lib.types.enum [
+        "docker"
+        "qemu"
+      ];
+    };
+  };
+
+  config = lib.mkIf config.k8s.talos.enable (
+    lib.mkMerge [
+      (lib.mkIf (config.k8s.talos.platform == "docker") {
+        docker.enable = true;
+        assertions = [
+          {
+            assertion = !config.docker.rootless;
+            message = "talos in docker needs 'docker.rootless = false;'";
+          }
+        ];
+      })
+      (lib.mkIf (config.k8s.talos.platform == "qemu") {
+        users.users.${username}.extraGroups = [ "kvm" ];
+        environment.systemPackages = [ pkgs.qemu ];
+      })
+    ]
+  );
+}