diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2ca8478ec..a455fc4b5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-24T16:35:58Z by kres 3675077.
+# Generated on 2026-03-25T07:26:58Z by kres 3675077.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
@@ -3844,6 +3844,16 @@ jobs:
         if: github.event_name == 'schedule'
         run: |
           make talosctl-cni-bundle
+      - name: installer-enforcing
+        if: github.event_name == 'schedule'
+        env:
+          IMAGE_REGISTRY: registry.dev.siderolabs.io
+          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
+          PLATFORM: linux/amd64,linux/arm64
+          PUSH: "true"
+          TAG_SUFFIX_OUT: -enforcing
+        run: |
+          make installer
       - name: provision-tests-prepare
         run: |
           make provision-tests-prepare
@@ -3934,6 +3944,13 @@ jobs:
           PUSH: "true"
         run: |
           make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
+      - name: iso
+        if: github.event_name == 'schedule'
+        env:
+          IMAGE_REGISTRY: registry.dev.siderolabs.io
+          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
+        run: |
+          make iso
       - name: talosctl-cni-bundle
         if: github.event_name == 'schedule'
         run: |
diff --git a/.github/workflows/integration-provision-1-cron.yaml b/.github/workflows/integration-provision-1-cron.yaml
index 1b340e0b1..8f0a7020f 100644
--- a/.github/workflows/integration-provision-1-cron.yaml
+++ b/.github/workflows/integration-provision-1-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-15T13:42:44Z by kres e68c408.
+# Generated on 2026-03-25T07:26:58Z by kres 3675077.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
@@ -77,6 +77,16 @@ jobs:
         if: github.event_name == 'schedule'
         run: |
           make talosctl-cni-bundle
+      - name: installer-enforcing
+        if: github.event_name == 'schedule'
+        env:
+          IMAGE_REGISTRY: registry.dev.siderolabs.io
+          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1
+          PLATFORM: linux/amd64,linux/arm64
+          PUSH: "true"
+          TAG_SUFFIX_OUT: -enforcing
+        run: |
+          make installer
       - name: provision-tests-prepare
         run: |
           make provision-tests-prepare
diff --git a/.github/workflows/integration-provision-2-cron.yaml b/.github/workflows/integration-provision-2-cron.yaml
index 274493cb5..ce8bd58d9 100644
--- a/.github/workflows/integration-provision-2-cron.yaml
+++ b/.github/workflows/integration-provision-2-cron.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2026-03-15T13:42:44Z by kres e68c408.
+# Generated on 2026-03-25T07:26:58Z by kres 3675077.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
@@ -73,6 +73,13 @@ jobs:
           PUSH: "true"
         run: |
           make talosctl-linux-amd64 kernel sd-boot sd-stub initramfs installer-base imager talos _out/integration-test-linux-amd64
+      - name: iso
+        if: github.event_name == 'schedule'
+        env:
+          IMAGE_REGISTRY: registry.dev.siderolabs.io
+          IMAGER_ARGS: --extra-kernel-arg=console=ttyS0
+        run: |
+          make iso
       - name: talosctl-cni-bundle
         if: github.event_name == 'schedule'
         run: |
diff --git a/.kres.yaml b/.kres.yaml
index 525ae805c..814af147c 100644
--- a/.kres.yaml
+++ b/.kres.yaml
@@ -909,6 +909,16 @@ spec:
         - name: talosctl-cni-bundle
           conditions:
             - only-on-schedule
+        - name: installer-enforcing
+          conditions:
+            - only-on-schedule
+          command: installer
+          environment:
+            PLATFORM: linux/amd64,linux/arm64
+            IMAGER_ARGS: "--extra-kernel-arg=console=ttyS0 --extra-kernel-arg=enforcing=1"
+            TAG_SUFFIX_OUT: -enforcing
+            IMAGE_REGISTRY: registry.dev.siderolabs.io
+            PUSH: true
         - name: provision-tests-prepare
         - name: provision-tests-track-1
           withSudo: true
@@ -956,6 +966,12 @@ spec:
             PLATFORM: linux/amd64,linux/arm64
             IMAGE_REGISTRY: registry.dev.siderolabs.io
             PUSH: true
+        - name: iso
+          conditions:
+            - only-on-schedule
+          environment:
+            IMAGER_ARGS: "--extra-kernel-arg=console=ttyS0"
+            IMAGE_REGISTRY: registry.dev.siderolabs.io
         - name: talosctl-cni-bundle
           conditions:
             - only-on-schedule