diff --git a/network/tailscale/README.md b/network/tailscale/README.md
index 167cfa62..e38aaaf9 100644
--- a/network/tailscale/README.md
+++ b/network/tailscale/README.md
@@ -10,14 +10,15 @@ See [Installing Extensions](https://github.com/siderolabs/extensions#installing-
 
 ## Usage
 
+Configure the extension via `ExtensionServiceConfig` document.
+
 ```yaml
-machine:
-  files:
-    - content: |
-        TS_AUTHKEY=<your auth key>
-      permissions: 0o644
-      path: /var/etc/tailscale/auth.env
-      op: create
+---
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: tailscale
+environment:
+  - TS_AUTHKEY=<your auth key>
 ```
 
 ```bash
@@ -52,14 +53,13 @@ Current known env vars are:
 
 A pratical example is enabling subnetrouting
 ```
-machine:
-  files:
-    - content: |
-        TS_AUTHKEY=<your auth key>
-        TS_ROUTES=10.96.0.0/12
-      permissions: 0o644
-      path: /var/etc/tailscale/auth.env
-      op: create
+---
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: tailscale
+environment:
+  - TS_AUTHKEY=<your auth key>
+  - TS_ROUTES=10.96.0.0/12
 ```
 
 10.96.0.0/12 is the service subnet talos uses by default (if you use a custom one, you will need to change it).
diff --git a/network/tailscale/tailscale.yaml b/network/tailscale/tailscale.yaml
index fbbcc96b..9aa83f94 100644
--- a/network/tailscale/tailscale.yaml
+++ b/network/tailscale/tailscale.yaml
@@ -5,9 +5,9 @@ depends:
     - addresses
     - connectivity
     - etcfiles
+  - configuration: true
 container:
   entrypoint: /usr/local/bin/containerboot
-  environmentFile: /var/etc/tailscale/auth.env
   environment:
   - PATH=/sbin:/usr/local/bin
   - TS_SOCKET=/var/run/tailscale/tailscaled.sock
diff --git a/power/nut-client/README.md b/power/nut-client/README.md
index 83bfef03..53b94403 100644
--- a/power/nut-client/README.md
+++ b/power/nut-client/README.md
@@ -6,22 +6,22 @@ See [Installing Extensions](https://github.com/siderolabs/extensions#installing-
 
 ## Usage
 
-Configure the extension via `.machine.files`.
+Configure the extension via `ExtensionServiceConfig` document.
 You must replace upsmonHost and upsmonPasswd to match configuration on your nut server.
 See [upsd.users](https://networkupstools.org/docs/man/upsd.users.html) man page for details.
 
 On Talos SHUTDOWNCMD must be `/sbin/poweroff`
 
 ```yaml
-machine:
-  files:
-    - path: /var/etc/nut/upsmon.conf
-      permissions: 0o600
-      op: create
-      content: |-
+---
+apiVersion: v1alpha1
+kind: ExtensionServiceConfig
+name: nut-client
+configFiles:
+  - content: |-
         MONITOR ${upsmonHost} 1 remote ${upsmonPasswd} slave
         SHUTDOWNCMD "/sbin/poweroff"
-
+    mountPath: /usr/local/etc/nut/upsmon.conf
 ```
 
 ## Testing
diff --git a/power/nut-client/nut-client.yaml b/power/nut-client/nut-client.yaml
index 3c8447be..d4592116 100644
--- a/power/nut-client/nut-client.yaml
+++ b/power/nut-client/nut-client.yaml
@@ -6,6 +6,7 @@ depends:
     - connectivity
     - etcfiles
   - path: /system/run/machined/machine.sock
+  - configuration: true
 container:
   entrypoint: ./upsmon
   args:
@@ -24,13 +25,6 @@ container:
       options:
         - bind
         - ro
-    # Configuration provided via `.machine.files`.
-    - source: /var/etc/nut
-      destination: /usr/local/etc/nut
-      type: bind
-      options:
-        - bind
-        - ro
     # `/sbin/init` talks to `machined`.
     - source: /system/run/machined/machine.sock
       destination: /system/run/machined/machine.sock