diff --git a/api/resource/definitions/runtime/runtime.proto b/api/resource/definitions/runtime/runtime.proto
index 182356b9e..c3acace9f 100755
--- a/api/resource/definitions/runtime/runtime.proto
+++ b/api/resource/definitions/runtime/runtime.proto
@@ -42,6 +42,11 @@ message ExtensionServiceConfigStatusSpec {
   string spec_version = 1;
 }
 
+// KernelCmdlineSpec presents kernel command line (contents of /proc/cmdline).
+message KernelCmdlineSpec {
+  string cmdline = 1;
+}
+
 // KernelModuleSpecSpec describes Linux kernel module to load.
 message KernelModuleSpecSpec {
   string name = 1;
diff --git a/hack/release.toml b/hack/release.toml
index 51fa15cb4..bb62da706 100644
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -31,7 +31,7 @@ Talos is built with Go 1.24.4.
 
     [notes.macos-qemu]
         title = "Qemu provisioner on MacOS"
-                description = """\
+        description = """\
 On MacOS `talosctl cluster create` command now supports the Qemu provisioner in addition to the Docker provisioner.
 """
 
@@ -76,6 +76,12 @@ This implies that all image references should contain the tag, even if the image
         description = """\
 Talos now supports zswap, a compressed cache for swap pages.
 This feature can be enabled by using [ZswapConfig](https://www.talos.dev/v1.11/reference/configuration/block/zswapconfig/) document in the machine configuration.
+"""
+
+    [notes.cmdline]
+        title = "Kernel Command Line"
+        description = """\
+Talos now exposes the kernel command line as a KernelCmdline resource (`talosctl get cmdline`).
 """
 
 [make_deps]
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_cmdline.go b/internal/app/machined/pkg/controllers/runtime/kernel_cmdline.go
new file mode 100644
index 000000000..c11654351
--- /dev/null
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_cmdline.go
@@ -0,0 +1,75 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"go.uber.org/zap"
+
+	machineruntime "github.com/siderolabs/talos/internal/app/machined/pkg/runtime"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+)
+
+// KernelCmdlineController presents /proc/cmdline as a resource.
+type KernelCmdlineController struct {
+	V1Alpha1Mode machineruntime.Mode
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *KernelCmdlineController) Name() string {
+	return "runtime.KernelCmdlineController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *KernelCmdlineController) Inputs() []controller.Input {
+	return nil
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *KernelCmdlineController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: runtime.KernelCmdlineType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *KernelCmdlineController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	if ctrl.V1Alpha1Mode.InContainer() {
+		// no cmdline in containers
+		return nil
+	}
+
+	select {
+	case <-ctx.Done():
+		return nil
+	case <-r.EventCh():
+	}
+
+	contents, err := os.ReadFile("/proc/cmdline")
+	if err != nil {
+		return fmt.Errorf("error reading /proc/cmdline: %w", err)
+	}
+
+	if err := safe.WriterModify(ctx, r,
+		runtime.NewKernelCmdline(),
+		func(res *runtime.KernelCmdline) error {
+			res.TypedSpec().Cmdline = string(contents)
+
+			return nil
+		},
+	); err != nil {
+		return fmt.Errorf("error updating KernelCmdline resource: %w", err)
+	}
+
+	return nil
+}
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_cmdline_test.go b/internal/app/machined/pkg/controllers/runtime/kernel_cmdline_test.go
new file mode 100644
index 000000000..d973531b4
--- /dev/null
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_cmdline_test.go
@@ -0,0 +1,40 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package runtime_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/talos/internal/app/machined/pkg/controllers/ctest"
+	runtimectrl "github.com/siderolabs/talos/internal/app/machined/pkg/controllers/runtime"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+)
+
+func TestKernelCmdlineSuite(t *testing.T) {
+	t.Parallel()
+
+	suite.Run(t, &KernelCmdlineSuite{
+		DefaultSuite: ctest.DefaultSuite{
+			Timeout: 5 * time.Second,
+			AfterSetup: func(suite *ctest.DefaultSuite) {
+				suite.Require().NoError(suite.Runtime().RegisterController(&runtimectrl.KernelCmdlineController{}))
+			},
+		},
+	})
+}
+
+type KernelCmdlineSuite struct {
+	ctest.DefaultSuite
+}
+
+func (suite *KernelCmdlineSuite) TestKernelCmdline() {
+	ctest.AssertResource(suite, runtime.KernelCmdlineID, func(res *runtime.KernelCmdline, asrt *assert.Assertions) {
+		asrt.NotEmpty(res.TypedSpec().Cmdline)
+	})
+}
diff --git a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
index f17ea8cc8..2155772eb 100644
--- a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
+++ b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_controller.go
@@ -332,6 +332,9 @@ func (ctrl *Controller) Run(ctx context.Context, drainer *runtime.Drainer) error
 			ConfigPath:       constants.ExtensionServiceConfigPath,
 		},
 		&runtimecontrollers.ExtensionStatusController{},
+		&runtimecontrollers.KernelCmdlineController{
+			V1Alpha1Mode: ctrl.v1alpha1Runtime.State().Platform().Mode(),
+		},
 		&runtimecontrollers.KernelModuleConfigController{},
 		&runtimecontrollers.KernelModuleSpecController{
 			V1Alpha1Mode: ctrl.v1alpha1Runtime.State().Platform().Mode(),
diff --git a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go
index ae1bdfd00..b94f6069b 100644
--- a/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go
+++ b/internal/app/machined/pkg/runtime/v1alpha2/v1alpha2_state.go
@@ -208,6 +208,7 @@ func NewState() (*State, error) {
 		&runtime.ExtensionServiceConfig{},
 		&runtime.ExtensionServiceConfigStatus{},
 		&runtime.ExtensionStatus{},
+		&runtime.KernelCmdline{},
 		&runtime.KernelModuleSpec{},
 		&runtime.KernelParamSpec{},
 		&runtime.KernelParamDefaultSpec{},
diff --git a/internal/integration/api/kernel.go b/internal/integration/api/kernel.go
new file mode 100644
index 000000000..1100e2b8d
--- /dev/null
+++ b/internal/integration/api/kernel.go
@@ -0,0 +1,67 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+//go:build integration_api
+
+package api
+
+import (
+	"context"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/siderolabs/talos/internal/integration/base"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+)
+
+// KernelSuite ...
+type KernelSuite struct {
+	base.APISuite
+
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+}
+
+// SuiteName ...
+func (suite *KernelSuite) SuiteName() string {
+	return "api.KernelSuite"
+}
+
+// SetupTest ...
+func (suite *KernelSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 10*time.Second)
+
+	if !suite.Capabilities().RunsTalosKernel {
+		suite.T().Skip("skipping kernel test since Talos kernel is not running")
+	}
+}
+
+// TearDownTest ...
+func (suite *KernelSuite) TearDownTest() {
+	if suite.ctxCancel != nil {
+		suite.ctxCancel()
+	}
+}
+
+// TestCmdline tests the /proc/cmdline resource.
+func (suite *KernelSuite) TestCmdline() {
+	node := suite.RandomDiscoveredNodeInternalIP()
+	ctx := client.WithNode(suite.ctx, node)
+
+	suite.T().Logf("using node %s", node)
+
+	rtestutils.AssertResources(ctx, suite.T(), suite.Client.COSI, []resource.ID{runtime.KernelCmdlineID},
+		func(res *runtime.KernelCmdline, asrt *assert.Assertions) {
+			asrt.NotEmpty(res.TypedSpec().Cmdline, "kernel cmdline should not be empty")
+		},
+	)
+}
+
+func init() {
+	allSuites = append(allSuites, new(KernelSuite))
+}
diff --git a/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go b/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go
index 807f51b7d..ebc8378e5 100644
--- a/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go
+++ b/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go
@@ -320,6 +320,51 @@ func (x *ExtensionServiceConfigStatusSpec) GetSpecVersion() string {
 	return ""
 }
 
+// KernelCmdlineSpec presents kernel command line (contents of /proc/cmdline).
+type KernelCmdlineSpec struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Cmdline       string                 `protobuf:"bytes,1,opt,name=cmdline,proto3" json:"cmdline,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KernelCmdlineSpec) Reset() {
+	*x = KernelCmdlineSpec{}
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KernelCmdlineSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KernelCmdlineSpec) ProtoMessage() {}
+
+func (x *KernelCmdlineSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KernelCmdlineSpec.ProtoReflect.Descriptor instead.
+func (*KernelCmdlineSpec) Descriptor() ([]byte, []int) {
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *KernelCmdlineSpec) GetCmdline() string {
+	if x != nil {
+		return x.Cmdline
+	}
+	return ""
+}
+
 // KernelModuleSpecSpec describes Linux kernel module to load.
 type KernelModuleSpecSpec struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -331,7 +376,7 @@ type KernelModuleSpecSpec struct {
 
 func (x *KernelModuleSpecSpec) Reset() {
 	*x = KernelModuleSpecSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[6]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[7]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -343,7 +388,7 @@ func (x *KernelModuleSpecSpec) String() string {
 func (*KernelModuleSpecSpec) ProtoMessage() {}
 
 func (x *KernelModuleSpecSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[6]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[7]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -356,7 +401,7 @@ func (x *KernelModuleSpecSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KernelModuleSpecSpec.ProtoReflect.Descriptor instead.
 func (*KernelModuleSpecSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{6}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *KernelModuleSpecSpec) GetName() string {
@@ -384,7 +429,7 @@ type KernelParamSpecSpec struct {
 
 func (x *KernelParamSpecSpec) Reset() {
 	*x = KernelParamSpecSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[7]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[8]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -396,7 +441,7 @@ func (x *KernelParamSpecSpec) String() string {
 func (*KernelParamSpecSpec) ProtoMessage() {}
 
 func (x *KernelParamSpecSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[7]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[8]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -409,7 +454,7 @@ func (x *KernelParamSpecSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KernelParamSpecSpec.ProtoReflect.Descriptor instead.
 func (*KernelParamSpecSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{7}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *KernelParamSpecSpec) GetValue() string {
@@ -438,7 +483,7 @@ type KernelParamStatusSpec struct {
 
 func (x *KernelParamStatusSpec) Reset() {
 	*x = KernelParamStatusSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[8]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[9]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -450,7 +495,7 @@ func (x *KernelParamStatusSpec) String() string {
 func (*KernelParamStatusSpec) ProtoMessage() {}
 
 func (x *KernelParamStatusSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[8]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[9]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -463,7 +508,7 @@ func (x *KernelParamStatusSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KernelParamStatusSpec.ProtoReflect.Descriptor instead.
 func (*KernelParamStatusSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{8}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *KernelParamStatusSpec) GetCurrent() string {
@@ -497,7 +542,7 @@ type KmsgLogConfigSpec struct {
 
 func (x *KmsgLogConfigSpec) Reset() {
 	*x = KmsgLogConfigSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[9]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[10]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -509,7 +554,7 @@ func (x *KmsgLogConfigSpec) String() string {
 func (*KmsgLogConfigSpec) ProtoMessage() {}
 
 func (x *KmsgLogConfigSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[9]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[10]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -522,7 +567,7 @@ func (x *KmsgLogConfigSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KmsgLogConfigSpec.ProtoReflect.Descriptor instead.
 func (*KmsgLogConfigSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{9}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *KmsgLogConfigSpec) GetDestinations() []*common.URL {
@@ -543,7 +588,7 @@ type MachineStatusSpec struct {
 
 func (x *MachineStatusSpec) Reset() {
 	*x = MachineStatusSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[10]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -555,7 +600,7 @@ func (x *MachineStatusSpec) String() string {
 func (*MachineStatusSpec) ProtoMessage() {}
 
 func (x *MachineStatusSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[10]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -568,7 +613,7 @@ func (x *MachineStatusSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineStatusSpec.ProtoReflect.Descriptor instead.
 func (*MachineStatusSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{10}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *MachineStatusSpec) GetStage() enums.RuntimeMachineStage {
@@ -596,7 +641,7 @@ type MachineStatusStatus struct {
 
 func (x *MachineStatusStatus) Reset() {
 	*x = MachineStatusStatus{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[11]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -608,7 +653,7 @@ func (x *MachineStatusStatus) String() string {
 func (*MachineStatusStatus) ProtoMessage() {}
 
 func (x *MachineStatusStatus) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[11]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -621,7 +666,7 @@ func (x *MachineStatusStatus) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineStatusStatus.ProtoReflect.Descriptor instead.
 func (*MachineStatusStatus) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{11}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *MachineStatusStatus) GetReady() bool {
@@ -649,7 +694,7 @@ type MaintenanceServiceConfigSpec struct {
 
 func (x *MaintenanceServiceConfigSpec) Reset() {
 	*x = MaintenanceServiceConfigSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[12]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[13]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -661,7 +706,7 @@ func (x *MaintenanceServiceConfigSpec) String() string {
 func (*MaintenanceServiceConfigSpec) ProtoMessage() {}
 
 func (x *MaintenanceServiceConfigSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[12]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[13]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -674,7 +719,7 @@ func (x *MaintenanceServiceConfigSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MaintenanceServiceConfigSpec.ProtoReflect.Descriptor instead.
 func (*MaintenanceServiceConfigSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{12}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *MaintenanceServiceConfigSpec) GetListenAddress() string {
@@ -701,7 +746,7 @@ type MetaKeySpec struct {
 
 func (x *MetaKeySpec) Reset() {
 	*x = MetaKeySpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[13]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[14]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -713,7 +758,7 @@ func (x *MetaKeySpec) String() string {
 func (*MetaKeySpec) ProtoMessage() {}
 
 func (x *MetaKeySpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[13]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[14]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -726,7 +771,7 @@ func (x *MetaKeySpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MetaKeySpec.ProtoReflect.Descriptor instead.
 func (*MetaKeySpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{13}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *MetaKeySpec) GetValue() string {
@@ -746,7 +791,7 @@ type MetaLoadedSpec struct {
 
 func (x *MetaLoadedSpec) Reset() {
 	*x = MetaLoadedSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[14]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -758,7 +803,7 @@ func (x *MetaLoadedSpec) String() string {
 func (*MetaLoadedSpec) ProtoMessage() {}
 
 func (x *MetaLoadedSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[14]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -771,7 +816,7 @@ func (x *MetaLoadedSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MetaLoadedSpec.ProtoReflect.Descriptor instead.
 func (*MetaLoadedSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{14}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *MetaLoadedSpec) GetDone() bool {
@@ -796,7 +841,7 @@ type MountStatusSpec struct {
 
 func (x *MountStatusSpec) Reset() {
 	*x = MountStatusSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[15]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -808,7 +853,7 @@ func (x *MountStatusSpec) String() string {
 func (*MountStatusSpec) ProtoMessage() {}
 
 func (x *MountStatusSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[15]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -821,7 +866,7 @@ func (x *MountStatusSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MountStatusSpec.ProtoReflect.Descriptor instead.
 func (*MountStatusSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{15}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *MountStatusSpec) GetSource() string {
@@ -886,7 +931,7 @@ type PlatformMetadataSpec struct {
 
 func (x *PlatformMetadataSpec) Reset() {
 	*x = PlatformMetadataSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[16]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -898,7 +943,7 @@ func (x *PlatformMetadataSpec) String() string {
 func (*PlatformMetadataSpec) ProtoMessage() {}
 
 func (x *PlatformMetadataSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[16]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -911,7 +956,7 @@ func (x *PlatformMetadataSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PlatformMetadataSpec.ProtoReflect.Descriptor instead.
 func (*PlatformMetadataSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{16}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *PlatformMetadataSpec) GetPlatform() string {
@@ -1005,7 +1050,7 @@ type SecurityStateSpec struct {
 
 func (x *SecurityStateSpec) Reset() {
 	*x = SecurityStateSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[17]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1017,7 +1062,7 @@ func (x *SecurityStateSpec) String() string {
 func (*SecurityStateSpec) ProtoMessage() {}
 
 func (x *SecurityStateSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[17]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1030,7 +1075,7 @@ func (x *SecurityStateSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SecurityStateSpec.ProtoReflect.Descriptor instead.
 func (*SecurityStateSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{17}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *SecurityStateSpec) GetSecureBoot() bool {
@@ -1078,7 +1123,7 @@ type UniqueMachineTokenSpec struct {
 
 func (x *UniqueMachineTokenSpec) Reset() {
 	*x = UniqueMachineTokenSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[18]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1090,7 +1135,7 @@ func (x *UniqueMachineTokenSpec) String() string {
 func (*UniqueMachineTokenSpec) ProtoMessage() {}
 
 func (x *UniqueMachineTokenSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[18]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1103,7 +1148,7 @@ func (x *UniqueMachineTokenSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UniqueMachineTokenSpec.ProtoReflect.Descriptor instead.
 func (*UniqueMachineTokenSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{18}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *UniqueMachineTokenSpec) GetToken() string {
@@ -1124,7 +1169,7 @@ type UnmetCondition struct {
 
 func (x *UnmetCondition) Reset() {
 	*x = UnmetCondition{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[19]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1136,7 +1181,7 @@ func (x *UnmetCondition) String() string {
 func (*UnmetCondition) ProtoMessage() {}
 
 func (x *UnmetCondition) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[19]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1149,7 +1194,7 @@ func (x *UnmetCondition) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use UnmetCondition.ProtoReflect.Descriptor instead.
 func (*UnmetCondition) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{19}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *UnmetCondition) GetName() string {
@@ -1177,7 +1222,7 @@ type WatchdogTimerConfigSpec struct {
 
 func (x *WatchdogTimerConfigSpec) Reset() {
 	*x = WatchdogTimerConfigSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[20]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1189,7 +1234,7 @@ func (x *WatchdogTimerConfigSpec) String() string {
 func (*WatchdogTimerConfigSpec) ProtoMessage() {}
 
 func (x *WatchdogTimerConfigSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[20]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1202,7 +1247,7 @@ func (x *WatchdogTimerConfigSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchdogTimerConfigSpec.ProtoReflect.Descriptor instead.
 func (*WatchdogTimerConfigSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{20}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *WatchdogTimerConfigSpec) GetDevice() string {
@@ -1231,7 +1276,7 @@ type WatchdogTimerStatusSpec struct {
 
 func (x *WatchdogTimerStatusSpec) Reset() {
 	*x = WatchdogTimerStatusSpec{}
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[21]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1243,7 +1288,7 @@ func (x *WatchdogTimerStatusSpec) String() string {
 func (*WatchdogTimerStatusSpec) ProtoMessage() {}
 
 func (x *WatchdogTimerStatusSpec) ProtoReflect() protoreflect.Message {
-	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[21]
+	mi := &file_resource_definitions_runtime_runtime_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1256,7 +1301,7 @@ func (x *WatchdogTimerStatusSpec) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WatchdogTimerStatusSpec.ProtoReflect.Descriptor instead.
 func (*WatchdogTimerStatusSpec) Descriptor() ([]byte, []int) {
-	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{21}
+	return file_resource_definitions_runtime_runtime_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *WatchdogTimerStatusSpec) GetDevice() string {
@@ -1300,7 +1345,9 @@ const file_resource_definitions_runtime_runtime_proto_rawDesc = "" +
 	"\x05files\x18\x01 \x03(\v2>.talos.resource.definitions.runtime.ExtensionServiceConfigFileR\x05files\x12 \n" +
 	"\venvironment\x18\x02 \x03(\tR\venvironment\"E\n" +
 	" ExtensionServiceConfigStatusSpec\x12!\n" +
-	"\fspec_version\x18\x01 \x01(\tR\vspecVersion\"J\n" +
+	"\fspec_version\x18\x01 \x01(\tR\vspecVersion\"-\n" +
+	"\x11KernelCmdlineSpec\x12\x18\n" +
+	"\acmdline\x18\x01 \x01(\tR\acmdline\"J\n" +
 	"\x14KernelModuleSpecSpec\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1e\n" +
 	"\n" +
@@ -1386,7 +1433,7 @@ func file_resource_definitions_runtime_runtime_proto_rawDescGZIP() []byte {
 	return file_resource_definitions_runtime_runtime_proto_rawDescData
 }
 
-var file_resource_definitions_runtime_runtime_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
+var file_resource_definitions_runtime_runtime_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_resource_definitions_runtime_runtime_proto_goTypes = []any{
 	(*DevicesStatusSpec)(nil),                // 0: talos.resource.definitions.runtime.DevicesStatusSpec
 	(*DiagnosticSpec)(nil),                   // 1: talos.resource.definitions.runtime.DiagnosticSpec
@@ -1394,41 +1441,42 @@ var file_resource_definitions_runtime_runtime_proto_goTypes = []any{
 	(*ExtensionServiceConfigFile)(nil),       // 3: talos.resource.definitions.runtime.ExtensionServiceConfigFile
 	(*ExtensionServiceConfigSpec)(nil),       // 4: talos.resource.definitions.runtime.ExtensionServiceConfigSpec
 	(*ExtensionServiceConfigStatusSpec)(nil), // 5: talos.resource.definitions.runtime.ExtensionServiceConfigStatusSpec
-	(*KernelModuleSpecSpec)(nil),             // 6: talos.resource.definitions.runtime.KernelModuleSpecSpec
-	(*KernelParamSpecSpec)(nil),              // 7: talos.resource.definitions.runtime.KernelParamSpecSpec
-	(*KernelParamStatusSpec)(nil),            // 8: talos.resource.definitions.runtime.KernelParamStatusSpec
-	(*KmsgLogConfigSpec)(nil),                // 9: talos.resource.definitions.runtime.KmsgLogConfigSpec
-	(*MachineStatusSpec)(nil),                // 10: talos.resource.definitions.runtime.MachineStatusSpec
-	(*MachineStatusStatus)(nil),              // 11: talos.resource.definitions.runtime.MachineStatusStatus
-	(*MaintenanceServiceConfigSpec)(nil),     // 12: talos.resource.definitions.runtime.MaintenanceServiceConfigSpec
-	(*MetaKeySpec)(nil),                      // 13: talos.resource.definitions.runtime.MetaKeySpec
-	(*MetaLoadedSpec)(nil),                   // 14: talos.resource.definitions.runtime.MetaLoadedSpec
-	(*MountStatusSpec)(nil),                  // 15: talos.resource.definitions.runtime.MountStatusSpec
-	(*PlatformMetadataSpec)(nil),             // 16: talos.resource.definitions.runtime.PlatformMetadataSpec
-	(*SecurityStateSpec)(nil),                // 17: talos.resource.definitions.runtime.SecurityStateSpec
-	(*UniqueMachineTokenSpec)(nil),           // 18: talos.resource.definitions.runtime.UniqueMachineTokenSpec
-	(*UnmetCondition)(nil),                   // 19: talos.resource.definitions.runtime.UnmetCondition
-	(*WatchdogTimerConfigSpec)(nil),          // 20: talos.resource.definitions.runtime.WatchdogTimerConfigSpec
-	(*WatchdogTimerStatusSpec)(nil),          // 21: talos.resource.definitions.runtime.WatchdogTimerStatusSpec
-	nil,                                      // 22: talos.resource.definitions.runtime.PlatformMetadataSpec.TagsEntry
-	(*common.URL)(nil),                       // 23: common.URL
-	(enums.RuntimeMachineStage)(0),           // 24: talos.resource.definitions.enums.RuntimeMachineStage
-	(*common.NetIP)(nil),                     // 25: common.NetIP
-	(enums.RuntimeSELinuxState)(0),           // 26: talos.resource.definitions.enums.RuntimeSELinuxState
-	(*durationpb.Duration)(nil),              // 27: google.protobuf.Duration
+	(*KernelCmdlineSpec)(nil),                // 6: talos.resource.definitions.runtime.KernelCmdlineSpec
+	(*KernelModuleSpecSpec)(nil),             // 7: talos.resource.definitions.runtime.KernelModuleSpecSpec
+	(*KernelParamSpecSpec)(nil),              // 8: talos.resource.definitions.runtime.KernelParamSpecSpec
+	(*KernelParamStatusSpec)(nil),            // 9: talos.resource.definitions.runtime.KernelParamStatusSpec
+	(*KmsgLogConfigSpec)(nil),                // 10: talos.resource.definitions.runtime.KmsgLogConfigSpec
+	(*MachineStatusSpec)(nil),                // 11: talos.resource.definitions.runtime.MachineStatusSpec
+	(*MachineStatusStatus)(nil),              // 12: talos.resource.definitions.runtime.MachineStatusStatus
+	(*MaintenanceServiceConfigSpec)(nil),     // 13: talos.resource.definitions.runtime.MaintenanceServiceConfigSpec
+	(*MetaKeySpec)(nil),                      // 14: talos.resource.definitions.runtime.MetaKeySpec
+	(*MetaLoadedSpec)(nil),                   // 15: talos.resource.definitions.runtime.MetaLoadedSpec
+	(*MountStatusSpec)(nil),                  // 16: talos.resource.definitions.runtime.MountStatusSpec
+	(*PlatformMetadataSpec)(nil),             // 17: talos.resource.definitions.runtime.PlatformMetadataSpec
+	(*SecurityStateSpec)(nil),                // 18: talos.resource.definitions.runtime.SecurityStateSpec
+	(*UniqueMachineTokenSpec)(nil),           // 19: talos.resource.definitions.runtime.UniqueMachineTokenSpec
+	(*UnmetCondition)(nil),                   // 20: talos.resource.definitions.runtime.UnmetCondition
+	(*WatchdogTimerConfigSpec)(nil),          // 21: talos.resource.definitions.runtime.WatchdogTimerConfigSpec
+	(*WatchdogTimerStatusSpec)(nil),          // 22: talos.resource.definitions.runtime.WatchdogTimerStatusSpec
+	nil,                                      // 23: talos.resource.definitions.runtime.PlatformMetadataSpec.TagsEntry
+	(*common.URL)(nil),                       // 24: common.URL
+	(enums.RuntimeMachineStage)(0),           // 25: talos.resource.definitions.enums.RuntimeMachineStage
+	(*common.NetIP)(nil),                     // 26: common.NetIP
+	(enums.RuntimeSELinuxState)(0),           // 27: talos.resource.definitions.enums.RuntimeSELinuxState
+	(*durationpb.Duration)(nil),              // 28: google.protobuf.Duration
 }
 var file_resource_definitions_runtime_runtime_proto_depIdxs = []int32{
 	3,  // 0: talos.resource.definitions.runtime.ExtensionServiceConfigSpec.files:type_name -> talos.resource.definitions.runtime.ExtensionServiceConfigFile
-	23, // 1: talos.resource.definitions.runtime.KmsgLogConfigSpec.destinations:type_name -> common.URL
-	24, // 2: talos.resource.definitions.runtime.MachineStatusSpec.stage:type_name -> talos.resource.definitions.enums.RuntimeMachineStage
-	11, // 3: talos.resource.definitions.runtime.MachineStatusSpec.status:type_name -> talos.resource.definitions.runtime.MachineStatusStatus
-	19, // 4: talos.resource.definitions.runtime.MachineStatusStatus.unmet_conditions:type_name -> talos.resource.definitions.runtime.UnmetCondition
-	25, // 5: talos.resource.definitions.runtime.MaintenanceServiceConfigSpec.reachable_addresses:type_name -> common.NetIP
-	22, // 6: talos.resource.definitions.runtime.PlatformMetadataSpec.tags:type_name -> talos.resource.definitions.runtime.PlatformMetadataSpec.TagsEntry
-	26, // 7: talos.resource.definitions.runtime.SecurityStateSpec.se_linux_state:type_name -> talos.resource.definitions.enums.RuntimeSELinuxState
-	27, // 8: talos.resource.definitions.runtime.WatchdogTimerConfigSpec.timeout:type_name -> google.protobuf.Duration
-	27, // 9: talos.resource.definitions.runtime.WatchdogTimerStatusSpec.timeout:type_name -> google.protobuf.Duration
-	27, // 10: talos.resource.definitions.runtime.WatchdogTimerStatusSpec.feed_interval:type_name -> google.protobuf.Duration
+	24, // 1: talos.resource.definitions.runtime.KmsgLogConfigSpec.destinations:type_name -> common.URL
+	25, // 2: talos.resource.definitions.runtime.MachineStatusSpec.stage:type_name -> talos.resource.definitions.enums.RuntimeMachineStage
+	12, // 3: talos.resource.definitions.runtime.MachineStatusSpec.status:type_name -> talos.resource.definitions.runtime.MachineStatusStatus
+	20, // 4: talos.resource.definitions.runtime.MachineStatusStatus.unmet_conditions:type_name -> talos.resource.definitions.runtime.UnmetCondition
+	26, // 5: talos.resource.definitions.runtime.MaintenanceServiceConfigSpec.reachable_addresses:type_name -> common.NetIP
+	23, // 6: talos.resource.definitions.runtime.PlatformMetadataSpec.tags:type_name -> talos.resource.definitions.runtime.PlatformMetadataSpec.TagsEntry
+	27, // 7: talos.resource.definitions.runtime.SecurityStateSpec.se_linux_state:type_name -> talos.resource.definitions.enums.RuntimeSELinuxState
+	28, // 8: talos.resource.definitions.runtime.WatchdogTimerConfigSpec.timeout:type_name -> google.protobuf.Duration
+	28, // 9: talos.resource.definitions.runtime.WatchdogTimerStatusSpec.timeout:type_name -> google.protobuf.Duration
+	28, // 10: talos.resource.definitions.runtime.WatchdogTimerStatusSpec.feed_interval:type_name -> google.protobuf.Duration
 	11, // [11:11] is the sub-list for method output_type
 	11, // [11:11] is the sub-list for method input_type
 	11, // [11:11] is the sub-list for extension type_name
@@ -1447,7 +1495,7 @@ func file_resource_definitions_runtime_runtime_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_resource_definitions_runtime_runtime_proto_rawDesc), len(file_resource_definitions_runtime_runtime_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   23,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go b/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go
index 4e1f6fd66..5a47c9391 100644
--- a/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go
+++ b/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go
@@ -298,6 +298,46 @@ func (m *ExtensionServiceConfigStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (
 	return len(dAtA) - i, nil
 }
 
+func (m *KernelCmdlineSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KernelCmdlineSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KernelCmdlineSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Cmdline) > 0 {
+		i -= len(m.Cmdline)
+		copy(dAtA[i:], m.Cmdline)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Cmdline)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *KernelModuleSpecSpec) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -1338,6 +1378,20 @@ func (m *ExtensionServiceConfigStatusSpec) SizeVT() (n int) {
 	return n
 }
 
+func (m *KernelCmdlineSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Cmdline)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *KernelModuleSpecSpec) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -2284,6 +2338,89 @@ func (m *ExtensionServiceConfigStatusSpec) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *KernelCmdlineSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KernelCmdlineSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KernelCmdlineSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cmdline", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Cmdline = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *KernelModuleSpecSpec) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
diff --git a/pkg/machinery/resources/runtime/deep_copy.generated.go b/pkg/machinery/resources/runtime/deep_copy.generated.go
index b204a771c..665940d8e 100644
--- a/pkg/machinery/resources/runtime/deep_copy.generated.go
+++ b/pkg/machinery/resources/runtime/deep_copy.generated.go
@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-// Code generated by "deep-copy -type DevicesStatusSpec -type DiagnosticSpec -type EventSinkConfigSpec -type ExtensionServiceConfigSpec -type ExtensionServiceConfigStatusSpec -type KernelModuleSpecSpec -type KernelParamSpecSpec -type KernelParamStatusSpec -type KmsgLogConfigSpec -type MaintenanceServiceConfigSpec -type MaintenanceServiceRequestSpec -type MachineResetSignalSpec -type MachineStatusSpec -type MetaKeySpec -type MountStatusSpec -type PlatformMetadataSpec -type SecurityStateSpec -type MetaLoadedSpec -type UniqueMachineTokenSpec -type VersionSpec -type WatchdogTimerConfigSpec -type WatchdogTimerStatusSpec -header-file ../../../../hack/boilerplate.txt -o deep_copy.generated.go ."; DO NOT EDIT.
+// Code generated by "deep-copy -type DevicesStatusSpec -type DiagnosticSpec -type EventSinkConfigSpec -type ExtensionServiceConfigSpec -type ExtensionServiceConfigStatusSpec -type KernelCmdlineSpec -type KernelModuleSpecSpec -type KernelParamSpecSpec -type KernelParamStatusSpec -type KmsgLogConfigSpec -type MaintenanceServiceConfigSpec -type MaintenanceServiceRequestSpec -type MachineResetSignalSpec -type MachineStatusSpec -type MetaKeySpec -type MountStatusSpec -type PlatformMetadataSpec -type SecurityStateSpec -type MetaLoadedSpec -type UniqueMachineTokenSpec -type VersionSpec -type WatchdogTimerConfigSpec -type WatchdogTimerStatusSpec -header-file ../../../../hack/boilerplate.txt -o deep_copy.generated.go ."; DO NOT EDIT.
 
 package runtime
 
@@ -53,6 +53,12 @@ func (o ExtensionServiceConfigStatusSpec) DeepCopy() ExtensionServiceConfigStatu
 	return cp
 }
 
+// DeepCopy generates a deep copy of KernelCmdlineSpec.
+func (o KernelCmdlineSpec) DeepCopy() KernelCmdlineSpec {
+	var cp KernelCmdlineSpec = o
+	return cp
+}
+
 // DeepCopy generates a deep copy of KernelModuleSpecSpec.
 func (o KernelModuleSpecSpec) DeepCopy() KernelModuleSpecSpec {
 	var cp KernelModuleSpecSpec = o
diff --git a/pkg/machinery/resources/runtime/kernel_cmdline.go b/pkg/machinery/resources/runtime/kernel_cmdline.go
new file mode 100644
index 000000000..59d1d986b
--- /dev/null
+++ b/pkg/machinery/resources/runtime/kernel_cmdline.go
@@ -0,0 +1,65 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package runtime
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/talos/pkg/machinery/proto"
+)
+
+// KernelCmdlineType is type of KernelCmdline resource.
+const KernelCmdlineType = resource.Type("KernelCmdlines.runtime.talos.dev")
+
+// KernelCmdline resource holds configuration for kernel message log streaming.
+type KernelCmdline = typed.Resource[KernelCmdlineSpec, KernelCmdlineExtension]
+
+// KernelCmdlineID is a resource ID for KernelCmdline.
+const KernelCmdlineID resource.ID = "cmdline"
+
+// KernelCmdlineSpec presents kernel command line (contents of /proc/cmdline).
+//
+//gotagsrewrite:gen
+type KernelCmdlineSpec struct {
+	Cmdline string `yaml:"cmdline" protobuf:"1"`
+}
+
+// NewKernelCmdline initializes a KernelCmdline resource.
+func NewKernelCmdline() *KernelCmdline {
+	return typed.NewResource[KernelCmdlineSpec, KernelCmdlineExtension](
+		resource.NewMetadata(NamespaceName, KernelCmdlineType, KernelCmdlineID, resource.VersionUndefined),
+		KernelCmdlineSpec{},
+	)
+}
+
+// KernelCmdlineExtension is auxiliary resource data for KernelCmdline.
+type KernelCmdlineExtension struct{}
+
+// ResourceDefinition implements meta.ResourceDefinitionProvider interface.
+func (KernelCmdlineExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KernelCmdlineType,
+		Aliases:          []resource.Type{"cmdline"},
+		DefaultNamespace: NamespaceName,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Cmdline",
+				JSONPath: "{.cmdline}",
+			},
+		},
+	}
+}
+
+func init() {
+	proto.RegisterDefaultTypes()
+
+	err := protobuf.RegisterDynamic[KernelCmdlineSpec](KernelCmdlineType, &KernelCmdline{})
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/pkg/machinery/resources/runtime/runtime.go b/pkg/machinery/resources/runtime/runtime.go
index 500d56fc0..907aacf07 100644
--- a/pkg/machinery/resources/runtime/runtime.go
+++ b/pkg/machinery/resources/runtime/runtime.go
@@ -10,7 +10,7 @@ import (
 	"github.com/siderolabs/talos/pkg/machinery/resources/v1alpha1"
 )
 
-//go:generate deep-copy -type DevicesStatusSpec -type DiagnosticSpec -type EventSinkConfigSpec -type ExtensionServiceConfigSpec -type ExtensionServiceConfigStatusSpec -type KernelModuleSpecSpec -type KernelParamSpecSpec -type KernelParamStatusSpec -type KmsgLogConfigSpec -type MaintenanceServiceConfigSpec -type MaintenanceServiceRequestSpec -type MachineResetSignalSpec -type MachineStatusSpec -type MetaKeySpec -type MountStatusSpec -type PlatformMetadataSpec -type SecurityStateSpec -type MetaLoadedSpec -type UniqueMachineTokenSpec -type VersionSpec -type WatchdogTimerConfigSpec -type WatchdogTimerStatusSpec -header-file ../../../../hack/boilerplate.txt -o deep_copy.generated.go .
+//go:generate deep-copy -type DevicesStatusSpec -type DiagnosticSpec -type EventSinkConfigSpec -type ExtensionServiceConfigSpec -type ExtensionServiceConfigStatusSpec -type KernelCmdlineSpec -type KernelModuleSpecSpec -type KernelParamSpecSpec -type KernelParamStatusSpec -type KmsgLogConfigSpec -type MaintenanceServiceConfigSpec -type MaintenanceServiceRequestSpec -type MachineResetSignalSpec -type MachineStatusSpec -type MetaKeySpec -type MountStatusSpec -type PlatformMetadataSpec -type SecurityStateSpec -type MetaLoadedSpec -type UniqueMachineTokenSpec -type VersionSpec -type WatchdogTimerConfigSpec -type WatchdogTimerStatusSpec -header-file ../../../../hack/boilerplate.txt -o deep_copy.generated.go .
 
 // NamespaceName contains configuration resources.
 const NamespaceName resource.Namespace = v1alpha1.NamespaceName
diff --git a/pkg/machinery/resources/runtime/runtime_test.go b/pkg/machinery/resources/runtime/runtime_test.go
index fd6103c86..9438a6883 100644
--- a/pkg/machinery/resources/runtime/runtime_test.go
+++ b/pkg/machinery/resources/runtime/runtime_test.go
@@ -28,6 +28,7 @@ func TestRegisterResource(t *testing.T) {
 		&runtime.Diagnostic{},
 		&runtime.EventSinkConfig{},
 		&runtime.ExtensionStatus{},
+		&runtime.KernelCmdline{},
 		&runtime.KernelModuleSpec{},
 		&runtime.KernelParamSpec{},
 		&runtime.KernelParamStatus{},
diff --git a/website/content/v1.11/reference/api.md b/website/content/v1.11/reference/api.md
index 2c7c18dae..ad901d589 100644
--- a/website/content/v1.11/reference/api.md
+++ b/website/content/v1.11/reference/api.md
@@ -276,6 +276,7 @@ description: Talos gRPC API reference.
     - [ExtensionServiceConfigFile](#talos.resource.definitions.runtime.ExtensionServiceConfigFile)
     - [ExtensionServiceConfigSpec](#talos.resource.definitions.runtime.ExtensionServiceConfigSpec)
     - [ExtensionServiceConfigStatusSpec](#talos.resource.definitions.runtime.ExtensionServiceConfigStatusSpec)
+    - [KernelCmdlineSpec](#talos.resource.definitions.runtime.KernelCmdlineSpec)
     - [KernelModuleSpecSpec](#talos.resource.definitions.runtime.KernelModuleSpecSpec)
     - [KernelParamSpecSpec](#talos.resource.definitions.runtime.KernelParamSpecSpec)
     - [KernelParamStatusSpec](#talos.resource.definitions.runtime.KernelParamStatusSpec)
@@ -5113,6 +5114,21 @@ ExtensionServiceConfigStatusSpec describes status of rendered extensions service
 
 
 
+<a name="talos.resource.definitions.runtime.KernelCmdlineSpec"></a>
+
+### KernelCmdlineSpec
+KernelCmdlineSpec presents kernel command line (contents of /proc/cmdline).
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| cmdline | [string](#string) |  |  |
+
+
+
+
+
+
 <a name="talos.resource.definitions.runtime.KernelModuleSpecSpec"></a>
 
 ### KernelModuleSpecSpec