diff --git a/k8s/infra/monitoring/kube-prometheus-stack/values.yaml b/k8s/infra/monitoring/kube-prometheus-stack/values.yaml
index 673f463..4087f5a 100644
--- a/k8s/infra/monitoring/kube-prometheus-stack/values.yaml
+++ b/k8s/infra/monitoring/kube-prometheus-stack/values.yaml
@@ -23,12 +23,65 @@ prometheus:
             matchLabels:
               app: prometheus
 
+# https://github.com/siderolabs/talos/discussions/7214
+kubeControllerManager:
+  enabled: true
+  serviceMonitor:
+    relabelings:
+      - sourceLabels: [ __meta_kubernetes_pod_node_name ]
+        separator: ;
+        regex: ^(.*)$
+        targetLabel: nodename
+        replacement: $1
+        action: replace
+    metricRelabelings:
+      - action: labeldrop
+        regex: pod
+
+kubeEtcd:
+  enabled: true
+  service:
+    selector:
+      # etcd doesn't run as a container,
+      # but most probably runs on the same nodes that host a controller
+      k8s-app: kube-controller-manager
+  serviceMonitor:
+    relabelings:
+      - sourceLabels: [ __meta_kubernetes_pod_node_name ]
+        separator: ;
+        regex: ^(.*)$
+        targetLabel: nodename
+        replacement: $1
+        action: replace
+    metricRelabelings:
+      - action: labeldrop
+        regex: pod
+
+kubeProxy:
+  # Cilium replaces Kube Proxy
+  enabled: false
+
+
+kubeScheduler:
+  enabled: true
+  serviceMonitor:
+    relabelings:
+      - sourceLabels: [ __meta_kubernetes_pod_node_name ]
+        separator: ;
+        regex: ^(.*)$
+        targetLabel: nodename
+        replacement: $1
+        action: replace
+    metricRelabelings:
+      - action: labeldrop
+        regex: pod
+
 nodeExporter:
   enabled: true
 
 grafana:
   enabled: true
-  envFromSecrets: [ {name: grafana-oidc-credentials } ]
+  envFromSecrets: [ { name: grafana-oidc-credentials } ]
   grafana.ini:
     security:
       disable_initial_admin_creation: false
diff --git a/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl b/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl
index 08c8693..69c9dd5 100644
--- a/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl
+++ b/tofu/kubernetes/talos/machine-config/control-plane.yaml.tftpl
@@ -1,3 +1,4 @@
+# https://www.talos.dev/v1.10/reference/configuration/v1alpha1/config/
 machine:
   network:
     interfaces:
@@ -18,6 +19,15 @@ cluster:
   allowSchedulingOnControlPlanes: true
   apiServer:
     ${indent(4, api_server)}
+  controllerManager:
+    extraArgs:
+      bind-address: 0.0.0.0
+  etcd:
+    extraArgs:
+      listen-metrics-urls: http://0.0.0.0:2381
+  scheduler:
+    extraArgs:
+      bind-address: 0.0.0.0
   network:
     cni:
       name: none