diff --git a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2
index bf5d3576..80b04662 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/cilium/app/helm-values.yaml.j2
@@ -5,18 +5,16 @@ bgpControlPlane:
   enabled: true
 #% endif %#
 bpf:
-  masquerade: false
+  masquerade: false # Required for Talos `.machine.features.hostDNS.forwardKubeDNSToHost`
 cgroup:
   automount:
     enabled: false
   hostRoot: /sys/fs/cgroup
 cluster:
   id: 1
-  name: #{ bootstrap_cluster_name|default('home-kubernetes', true) }#
+  name: "#{ bootstrap_cluster_name|default('home-kubernetes', true) }#"
 cni:
   exclusive: false
-containerRuntime:
-  integration: containerd
 # NOTE: devices might need to be set if you have more than one active NIC on your hosts
 # devices: eno+ eth+
 endpointRoutes:
@@ -25,7 +23,7 @@ hubble:
   enabled: false
 ipam:
   mode: kubernetes
-ipv4NativeRoutingCIDR: #{ bootstrap_pod_network.split(',')[0] }#
+ipv4NativeRoutingCIDR: "#{ bootstrap_pod_network.split(',')[0] }#"
 #% if bootstrap_feature_gates.dual_stack_ipv4_first %#
 ipv6NativeRoutingCIDR: "#{ bootstrap_pod_network.split(',')[1] }#"
 ipv6:
diff --git a/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2 b/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2
index 613d34ea..05d3eeed 100644
--- a/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2
+++ b/bootstrap/templates/kubernetes/apps/kube-system/spegel/app/helmrelease.yaml.j2
@@ -24,5 +24,7 @@ spec:
     - kind: ConfigMap
       name: spegel-helm-values
   values:
+    grafanaDashboard:
+      enabled: true
     serviceMonitor:
       enabled: true
diff --git a/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/hostdns.yaml.j2 b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/hostdns.yaml.j2
index 36c5e94f..6033ccd2 100644
--- a/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/hostdns.yaml.j2
+++ b/bootstrap/templates/kubernetes/bootstrap/talos/patches/global/hostdns.yaml.j2
@@ -3,4 +3,4 @@ machine:
     hostDNS:
       enabled: true
       resolveMemberNames: true
-      forwardKubeDNSToHost: false
+      forwardKubeDNSToHost: true # Requires Cilium `bpf.masquerade: false`