diff --git a/client/pkg/omni/resources/system/cert_refresh_tick.go b/client/pkg/omni/resources/system/cert_refresh_tick.go
index 19399706..184245ec 100644
--- a/client/pkg/omni/resources/system/cert_refresh_tick.go
+++ b/client/pkg/omni/resources/system/cert_refresh_tick.go
@@ -15,9 +15,9 @@ import (
 )
 
 // NewCertRefreshTick creates new CertRefreshTick state.
-func NewCertRefreshTick(ns, id string) *CertRefreshTick {
+func NewCertRefreshTick(id string) *CertRefreshTick {
 	return typed.NewResource[CertRefreshTickSpec, CertRefreshTickExtension](
-		resource.NewMetadata(ns, CertRefreshTickType, id, resource.VersionUndefined),
+		resource.NewMetadata(resources.EphemeralNamespace, CertRefreshTickType, id, resource.VersionUndefined),
 		protobuf.NewResourceSpec(&specs.CertRefreshTickSpec{}),
 	)
 }
diff --git a/client/pkg/omni/resources/system/dbversion.go b/client/pkg/omni/resources/system/dbversion.go
index 00967398..0e9e1a0f 100644
--- a/client/pkg/omni/resources/system/dbversion.go
+++ b/client/pkg/omni/resources/system/dbversion.go
@@ -15,9 +15,9 @@ import (
 )
 
 // NewDBVersion creates new DBVersion state.
-func NewDBVersion(ns, id string) *DBVersion {
+func NewDBVersion(id string) *DBVersion {
 	return typed.NewResource[DBVersionSpec, DBVersionExtension](
-		resource.NewMetadata(ns, DBVersionType, id, resource.VersionUndefined),
+		resource.NewMetadata(resources.DefaultNamespace, DBVersionType, id, resource.VersionUndefined),
 		protobuf.NewResourceSpec(&specs.DBVersionSpec{}),
 	)
 }
diff --git a/client/pkg/omni/resources/system/sysversion.go b/client/pkg/omni/resources/system/sysversion.go
index f22101f8..4d158e8b 100644
--- a/client/pkg/omni/resources/system/sysversion.go
+++ b/client/pkg/omni/resources/system/sysversion.go
@@ -15,9 +15,9 @@ import (
 )
 
 // NewSysVersion creates new SysVersion state.
-func NewSysVersion(ns, id string) *SysVersion {
+func NewSysVersion(id string) *SysVersion {
 	return typed.NewResource[SysVersionSpec, SysVersionExtension](
-		resource.NewMetadata(ns, SysVersionType, id, resource.VersionUndefined),
+		resource.NewMetadata(resources.EphemeralNamespace, SysVersionType, id, resource.VersionUndefined),
 		protobuf.NewResourceSpec(&specs.SysVersionSpec{}),
 	)
 }
diff --git a/client/pkg/omni/resources/virtual/kubernetes_usage.go b/client/pkg/omni/resources/virtual/kubernetes_usage.go
index a48b559d..a304997f 100644
--- a/client/pkg/omni/resources/virtual/kubernetes_usage.go
+++ b/client/pkg/omni/resources/virtual/kubernetes_usage.go
@@ -15,9 +15,9 @@ import (
 )
 
 // NewKubernetesUsage creates new Kubernetes usage resource.
-func NewKubernetesUsage(ns, id string) *KubernetesUsage {
+func NewKubernetesUsage(id string) *KubernetesUsage {
 	return typed.NewResource[KubernetesUsageSpec, KubernetesUsageExtension](
-		resource.NewMetadata(ns, KubernetesUsageType, id, resource.VersionUndefined),
+		resource.NewMetadata(resources.VirtualNamespace, KubernetesUsageType, id, resource.VersionUndefined),
 		protobuf.NewResourceSpec(&specs.KubernetesUsageSpec{}),
 	)
 }
diff --git a/client/pkg/omni/resources/virtual/labels_completion.go b/client/pkg/omni/resources/virtual/labels_completion.go
index 219b8354..f8d6c1e2 100644
--- a/client/pkg/omni/resources/virtual/labels_completion.go
+++ b/client/pkg/omni/resources/virtual/labels_completion.go
@@ -15,9 +15,9 @@ import (
 )
 
 // NewLabelsCompletion creates new LabelsCompletion resource.
-func NewLabelsCompletion(ns string, id resource.ID) *LabelsCompletion {
+func NewLabelsCompletion(id resource.ID) *LabelsCompletion {
 	return typed.NewResource[LabelsCompletionSpec, LabelsCompletionExtension](
-		resource.NewMetadata(ns, LabelsCompletionType, id, resource.VersionUndefined),
+		resource.NewMetadata(resources.VirtualNamespace, LabelsCompletionType, id, resource.VersionUndefined),
 		protobuf.NewResourceSpec(&specs.LabelsCompletionSpec{}),
 	)
 }
diff --git a/client/pkg/omnictl/internal/access/client.go b/client/pkg/omnictl/internal/access/client.go
index ae136067..d49580d5 100644
--- a/client/pkg/omnictl/internal/access/client.go
+++ b/client/pkg/omnictl/internal/access/client.go
@@ -159,7 +159,7 @@ If you want to enable the version validation and disable this warning, set githu
 		return nil
 	}
 
-	sysVersion, err := safe.StateGet[*system.SysVersion](ctx, state, system.NewSysVersion(resources.EphemeralNamespace, system.SysVersionID).Metadata())
+	sysVersion, err := safe.StateGet[*system.SysVersion](ctx, state, system.NewSysVersion(system.SysVersionID).Metadata())
 	if err != nil {
 		return err
 	}
diff --git a/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go
index 8cdbbe95..6d9b2a1d 100644
--- a/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go
+++ b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go
@@ -13,7 +13,6 @@ import (
 	"github.com/cosi-project/runtime/pkg/safe"
 	"go.uber.org/zap"
 
-	"github.com/siderolabs/omni/client/pkg/omni/resources"
 	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
 )
 
@@ -60,7 +59,7 @@ func (ctrl *CertRefreshTickController) Run(ctx context.Context, r controller.Run
 			// issue a "refresh" tick to notify all certificate management controllers to refresh certificates
 			if err := safe.WriterModify(
 				ctx, r,
-				system.NewCertRefreshTick(resources.EphemeralNamespace, t.String()),
+				system.NewCertRefreshTick(t.String()),
 				func(*system.CertRefreshTick) error {
 					return nil
 				},
diff --git a/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go
index 91c48384..2e69cee5 100644
--- a/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go
+++ b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go
@@ -12,7 +12,6 @@ import (
 	"github.com/cosi-project/runtime/pkg/state"
 	"github.com/stretchr/testify/suite"
 
-	"github.com/siderolabs/omni/client/pkg/omni/resources"
 	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
 	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
 )
@@ -28,7 +27,7 @@ func (suite *CertRefreshTickSuite) TestReconcile() {
 
 	watchCh := make(chan state.Event)
 
-	suite.Require().NoError(suite.state.WatchKind(suite.ctx, system.NewCertRefreshTick(resources.EphemeralNamespace, "").Metadata(), watchCh))
+	suite.Require().NoError(suite.state.WatchKind(suite.ctx, system.NewCertRefreshTick("").Metadata(), watchCh))
 
 	// wait for two ticks
 	ticks := 0
diff --git a/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go b/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go
index d3086c28..6ec4e5cb 100644
--- a/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go
+++ b/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go
@@ -72,7 +72,7 @@ func (suite *KubeconfigSuite) TestReconcile() {
 	time.Sleep(1 * time.Second)
 
 	// issue a refresh tick
-	suite.Require().NoError(suite.state.Create(suite.ctx, system.NewCertRefreshTick(resources.EphemeralNamespace, "refresh")))
+	suite.Require().NoError(suite.state.Create(suite.ctx, system.NewCertRefreshTick("refresh")))
 
 	assertResource(
 		&suite.OmniSuite,
diff --git a/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go b/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go
index 37d21218..db027152 100644
--- a/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go
+++ b/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go
@@ -78,7 +78,7 @@ func (suite *TalosConfigSuite) TestReconcile() {
 	time.Sleep(1 * time.Second)
 
 	// issue a refresh tick
-	suite.Require().NoError(suite.state.Create(suite.ctx, system.NewCertRefreshTick(resources.EphemeralNamespace, "refresh")))
+	suite.Require().NoError(suite.state.Create(suite.ctx, system.NewCertRefreshTick("refresh")))
 
 	assertResource(
 		&suite.OmniSuite,
diff --git a/internal/backend/runtime/omni/migration/manager.go b/internal/backend/runtime/omni/migration/manager.go
index 11148924..ecca95af 100644
--- a/internal/backend/runtime/omni/migration/manager.go
+++ b/internal/backend/runtime/omni/migration/manager.go
@@ -16,7 +16,6 @@ import (
 	"github.com/cosi-project/runtime/pkg/state"
 	"go.uber.org/zap"
 
-	"github.com/siderolabs/omni/client/pkg/omni/resources"
 	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
 )
 
@@ -320,7 +319,7 @@ func (m *Manager) Run(ctx context.Context, opt ...Option) (Result, error) {
 	version, err := safe.StateGet[*system.DBVersion](
 		ctx,
 		m.state,
-		system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID).Metadata(),
+		system.NewDBVersion(system.DBVersionID).Metadata(),
 	)
 	if err != nil && !state.IsNotFoundError(err) {
 		return Result{}, err
@@ -330,7 +329,7 @@ func (m *Manager) Run(ctx context.Context, opt ...Option) (Result, error) {
 
 	isFreshInstall := version == nil
 	if isFreshInstall {
-		version = system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID)
+		version = system.NewDBVersion(system.DBVersionID)
 
 		for _, mig := range m.migrations {
 			if mig.failWithRequiredMaxVersion == "" {
diff --git a/internal/backend/runtime/omni/migration/manager_test.go b/internal/backend/runtime/omni/migration/manager_test.go
index 174a9b6a..87025aaf 100644
--- a/internal/backend/runtime/omni/migration/manager_test.go
+++ b/internal/backend/runtime/omni/migration/manager_test.go
@@ -17,7 +17,6 @@ import (
 	"go.uber.org/zap"
 	"go.uber.org/zap/zaptest"
 
-	"github.com/siderolabs/omni/client/pkg/omni/resources"
 	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
 	"github.com/siderolabs/omni/internal/backend/runtime/omni/migration"
 )
@@ -54,7 +53,7 @@ func TestFailOnTooOldDBVersion(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			st := state.WrapCore(namespaced.NewState(inmem.Build))
 
-			dbVersion := system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID)
+			dbVersion := system.NewDBVersion(system.DBVersionID)
 			dbVersion.TypedSpec().Value.Version = tt.currentVersion
 
 			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
diff --git a/internal/backend/runtime/omni/state.go b/internal/backend/runtime/omni/state.go
index 6a0cd0eb..64b62072 100644
--- a/internal/backend/runtime/omni/state.go
+++ b/internal/backend/runtime/omni/state.go
@@ -284,7 +284,7 @@ func initResources(ctx context.Context, resourceState state.State, logger *zap.L
 		}
 	}
 
-	sysVersion := system.NewSysVersion(resources.EphemeralNamespace, system.SysVersionID)
+	sysVersion := system.NewSysVersion(system.SysVersionID)
 	sysVersion.TypedSpec().Value.BackendVersion = version.Tag
 	sysVersion.TypedSpec().Value.InstanceName = config.Config.Account.Name
 	sysVersion.TypedSpec().Value.BackendApiVersion = version.API
diff --git a/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go b/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go
index 7532a41c..1852cdef 100644
--- a/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go
+++ b/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go
@@ -131,7 +131,7 @@ func (ku *KubernetesUsage) Start() error {
 			return
 		}
 
-		usage := virtual.NewKubernetesUsage(ku.ptr.Namespace(), ku.ptr.ID())
+		usage := virtual.NewKubernetesUsage(ku.ptr.ID())
 
 		calculateUsage(pods, nodes, usage)
 
diff --git a/internal/backend/runtime/omni/virtual/state.go b/internal/backend/runtime/omni/virtual/state.go
index 19a4dd36..eb0b5e0d 100644
--- a/internal/backend/runtime/omni/virtual/state.go
+++ b/internal/backend/runtime/omni/virtual/state.go
@@ -344,7 +344,7 @@ func (v *State) labelsCompletion(ctx context.Context, ptr resource.Pointer) (*vi
 		}
 	}
 
-	completion := virtual.NewLabelsCompletion(resources.VirtualNamespace, ptr.ID())
+	completion := virtual.NewLabelsCompletion(ptr.ID())
 	completion.TypedSpec().Value.Items = labels
 
 	return completion, nil
diff --git a/internal/integration/auth_test.go b/internal/integration/auth_test.go
index 4d5459b1..c2466be8 100644
--- a/internal/integration/auth_test.go
+++ b/internal/integration/auth_test.go
@@ -913,7 +913,7 @@ func AssertResourceAuthz(rootCtx context.Context, rootCli *client.Client, client
 				allowedVerbSet: readOnlyVerbSet,
 			},
 			{
-				resource:       virtual.NewKubernetesUsage(resources.MetricsNamespace, uuid.New().String()),
+				resource:       virtual.NewKubernetesUsage(uuid.New().String()),
 				allowedVerbSet: readOnlyVerbSet,
 			},
 			{
@@ -929,7 +929,7 @@ func AssertResourceAuthz(rootCtx context.Context, rootCli *client.Client, client
 				allowedVerbSet: readOnlyVerbSet,
 			},
 			{
-				resource:       virtual.NewLabelsCompletion(resources.MetricsNamespace, uuid.New().String()),
+				resource:       virtual.NewLabelsCompletion(uuid.New().String()),
 				allowedVerbSet: readOnlyVerbSet,
 			},
 			{
@@ -1017,7 +1017,7 @@ func AssertResourceAuthz(rootCtx context.Context, rootCli *client.Client, client
 				allowedVerbSet: readOnlyVerbSet,
 			},
 			{
-				resource:              system.NewSysVersion(resources.DefaultNamespace, uuid.New().String()),
+				resource:              system.NewSysVersion(uuid.New().String()),
 				allowedVerbSet:        readOnlyVerbSet,
 				isSignatureSufficient: true,
 			},
@@ -1142,10 +1142,10 @@ func AssertResourceAuthz(rootCtx context.Context, rootCli *client.Client, client
 				resource: oidc.NewJWTPublicKey(resources.DefaultNamespace, uuid.New().String()),
 			},
 			{
-				resource: system.NewDBVersion(resources.DefaultNamespace, uuid.New().String()),
+				resource: system.NewDBVersion(uuid.New().String()),
 			},
 			{
-				resource: system.NewCertRefreshTick(resources.DefaultNamespace, uuid.New().String()),
+				resource: system.NewCertRefreshTick(uuid.New().String()),
 			},
 			{
 				resource: authres.NewPublicKey(resources.DefaultNamespace, uuid.New().String()),