diff --git a/api/resource/definitions/runtime/runtime.proto b/api/resource/definitions/runtime/runtime.proto
index 43e93e8976..b5c1041e24 100755
--- a/api/resource/definitions/runtime/runtime.proto
+++ b/api/resource/definitions/runtime/runtime.proto
@@ -9,6 +9,7 @@ import "resource/definitions/enums/enums.proto";
 // KernelModuleSpecSpec describes Linux kernel module to load.
 message KernelModuleSpecSpec {
   string name = 1;
+  repeated string parameters = 2;
 }
 
 // KernelParamSpecSpec describes status of the defined sysctls.
diff --git a/hack/release.toml b/hack/release.toml
index fcfa285db5..baf0b93fa9 100644
--- a/hack/release.toml
+++ b/hack/release.toml
@@ -15,6 +15,29 @@ preface = """\
 
 [notes]
 
+    [notes.kernel_modules]
+        title = "Kernel Modules"
+        description = """\
+Talos now supports settings kernel module parameters.
+
+Eg:
+
+```yaml
+machine:
+  kernel:
+    modules:
+      - name: "br_netfilter"
+        parameters:
+          - nf_conntrack_max=131072
+```
+"""
+
+    [notes.sbc]
+        title = "Nano Pi R4S"
+        description = """\
+Talos now supports the Nano Pi R4S SBC.
+"""
+
     [notes.updates]
         title = "Component Updates"
         description="""\
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_module_config.go b/internal/app/machined/pkg/controllers/runtime/kernel_module_config.go
index e7960bab85..01359912a9 100644
--- a/internal/app/machined/pkg/controllers/runtime/kernel_module_config.go
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_module_config.go
@@ -74,6 +74,7 @@ func (ctrl *KernelModuleConfigController) Run(ctx context.Context, r controller.
 
 					if err = r.Modify(ctx, item, func(res resource.Resource) error {
 						res.(*runtime.KernelModuleSpec).TypedSpec().Name = module.Name()
+						res.(*runtime.KernelModuleSpec).TypedSpec().Parameters = module.Parameters()
 
 						return nil
 					}); err != nil {
diff --git a/internal/app/machined/pkg/controllers/runtime/kernel_module_spec.go b/internal/app/machined/pkg/controllers/runtime/kernel_module_spec.go
index da71a60d4f..12b1209ff3 100644
--- a/internal/app/machined/pkg/controllers/runtime/kernel_module_spec.go
+++ b/internal/app/machined/pkg/controllers/runtime/kernel_module_spec.go
@@ -7,6 +7,7 @@ package runtime
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/cosi-project/runtime/pkg/controller"
 	"github.com/cosi-project/runtime/pkg/resource"
@@ -68,8 +69,9 @@ func (ctrl *KernelModuleSpecController) Run(ctx context.Context, r controller.Ru
 			// note: this code doesn't support module unloading in any way for now
 			for _, res := range modules.Items {
 				module := res.(*runtime.KernelModuleSpec).TypedSpec()
+				parameters := strings.Join(module.Parameters, " ")
 
-				if err = manager.Load(module.Name, "", 0); err != nil {
+				if err = manager.Load(module.Name, parameters, 0); err != nil {
 					return fmt.Errorf("error loading module %q: %w", module.Name, err)
 				}
 			}
diff --git a/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go b/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go
index 0cc3d1a1df..27c528ef5c 100644
--- a/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go
+++ b/pkg/machinery/api/resource/definitions/runtime/runtime.pb.go
@@ -29,7 +29,8 @@ type KernelModuleSpecSpec struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Name       string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Parameters []string `protobuf:"bytes,2,rep,name=parameters,proto3" json:"parameters,omitempty"`
 }
 
 func (x *KernelModuleSpecSpec) Reset() {
@@ -71,6 +72,13 @@ func (x *KernelModuleSpecSpec) GetName() string {
 	return ""
 }
 
+func (x *KernelModuleSpecSpec) GetParameters() []string {
+	if x != nil {
+		return x.Parameters
+	}
+	return nil
+}
+
 // KernelParamSpecSpec describes status of the defined sysctls.
 type KernelParamSpecSpec struct {
 	state         protoimpl.MessageState
@@ -441,10 +449,12 @@ var file_resource_definitions_runtime_runtime_proto_rawDesc = []byte{
 	0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
 	0x1a, 0x26, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x64, 0x65, 0x66, 0x69, 0x6e,
 	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x65, 0x6e, 0x75, 0x6d, 0x73, 0x2f, 0x65, 0x6e, 0x75,
-	0x6d, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x2a, 0x0a, 0x14, 0x4b, 0x65, 0x72, 0x6e,
+	0x6d, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x4a, 0x0a, 0x14, 0x4b, 0x65, 0x72, 0x6e,
 	0x65, 0x6c, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x53, 0x70, 0x65, 0x63, 0x53, 0x70, 0x65, 0x63,
 	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x22, 0x50, 0x0a, 0x13, 0x4b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x50, 0x61,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65,
+	0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65,
+	0x74, 0x65, 0x72, 0x73, 0x22, 0x50, 0x0a, 0x13, 0x4b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x50, 0x61,
 	0x72, 0x61, 0x6d, 0x53, 0x70, 0x65, 0x63, 0x53, 0x70, 0x65, 0x63, 0x12, 0x14, 0x0a, 0x05, 0x76,
 	0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
 	0x65, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x5f, 0x65, 0x72, 0x72, 0x6f,
diff --git a/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go b/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go
index 17967f8e4e..766ff5f0e8 100644
--- a/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go
+++ b/pkg/machinery/api/resource/definitions/runtime/runtime_vtproto.pb.go
@@ -51,6 +51,15 @@ func (m *KernelModuleSpecSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error)
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if len(m.Parameters) > 0 {
+		for iNdEx := len(m.Parameters) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Parameters[iNdEx])
+			copy(dAtA[i:], m.Parameters[iNdEx])
+			i = encodeVarint(dAtA, i, uint64(len(m.Parameters[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
 	if len(m.Name) > 0 {
 		i -= len(m.Name)
 		copy(dAtA[i:], m.Name)
@@ -402,6 +411,12 @@ func (m *KernelModuleSpecSpec) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + sov(uint64(l))
 	}
+	if len(m.Parameters) > 0 {
+		for _, s := range m.Parameters {
+			l = len(s)
+			n += 1 + l + sov(uint64(l))
+		}
+	}
 	if m.unknownFields != nil {
 		n += len(m.unknownFields)
 	}
@@ -607,6 +622,38 @@ func (m *KernelModuleSpecSpec) UnmarshalVT(dAtA []byte) error {
 			}
 			m.Name = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Parameters", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Parameters = append(m.Parameters, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skip(dAtA[iNdEx:])
diff --git a/pkg/machinery/config/provider.go b/pkg/machinery/config/provider.go
index 04ad52c34f..967608405b 100644
--- a/pkg/machinery/config/provider.go
+++ b/pkg/machinery/config/provider.go
@@ -599,4 +599,5 @@ type Kernel interface {
 // KernelModule describes Linux module to load.
 type KernelModule interface {
 	Name() string
+	Parameters() []string
 }
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_kernel.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_kernel.go
index 22ed4ae3cf..e5c63c0cec 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_kernel.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_kernel.go
@@ -18,3 +18,8 @@ func (kc *KernelConfig) Modules() []config.KernelModule {
 func (kmc *KernelModuleConfig) Name() string {
 	return kmc.ModuleName
 }
+
+// Parameters implements config.KernelModule interface.
+func (kmc *KernelModuleConfig) Parameters() []string {
+	return kmc.ModuleParameters
+}
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go
index 04f49eab34..eefc9f972a 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_types.go
@@ -2549,4 +2549,7 @@ type KernelModuleConfig struct {
 	// description: |
 	//   Module name.
 	ModuleName string `yaml:"name"`
+	// description: |
+	//   Module parameters, changes applied after reboot.
+	ModuleParameters []string `yaml:"parameters,omitempty"`
 }
diff --git a/pkg/machinery/config/types/v1alpha1/v1alpha1_types_doc.go b/pkg/machinery/config/types/v1alpha1/v1alpha1_types_doc.go
index 66877e40fa..d944bdf9ba 100644
--- a/pkg/machinery/config/types/v1alpha1/v1alpha1_types_doc.go
+++ b/pkg/machinery/config/types/v1alpha1/v1alpha1_types_doc.go
@@ -2661,12 +2661,17 @@ func init() {
 			FieldName: "modules",
 		},
 	}
-	KernelModuleConfigDoc.Fields = make([]encoder.Doc, 1)
+	KernelModuleConfigDoc.Fields = make([]encoder.Doc, 2)
 	KernelModuleConfigDoc.Fields[0].Name = "name"
 	KernelModuleConfigDoc.Fields[0].Type = "string"
 	KernelModuleConfigDoc.Fields[0].Note = ""
 	KernelModuleConfigDoc.Fields[0].Description = "Module name."
 	KernelModuleConfigDoc.Fields[0].Comments[encoder.LineComment] = "Module name."
+	KernelModuleConfigDoc.Fields[1].Name = "parameters"
+	KernelModuleConfigDoc.Fields[1].Type = "[]string"
+	KernelModuleConfigDoc.Fields[1].Note = ""
+	KernelModuleConfigDoc.Fields[1].Description = "Module parameters, changes applied after reboot."
+	KernelModuleConfigDoc.Fields[1].Comments[encoder.LineComment] = "Module parameters, changes applied after reboot."
 }
 
 func (_ Config) Doc() *encoder.Doc {
diff --git a/pkg/machinery/config/types/v1alpha1/zz_generated.deepcopy.go b/pkg/machinery/config/types/v1alpha1/zz_generated.deepcopy.go
index 8143d0e18d..64dd35f6e8 100644
--- a/pkg/machinery/config/types/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/machinery/config/types/v1alpha1/zz_generated.deepcopy.go
@@ -1086,7 +1086,7 @@ func (in *KernelConfig) DeepCopyInto(out *KernelConfig) {
 			if (*in)[i] != nil {
 				in, out := &(*in)[i], &(*out)[i]
 				*out = new(KernelModuleConfig)
-				**out = **in
+				(*in).DeepCopyInto(*out)
 			}
 		}
 	}
@@ -1106,6 +1106,11 @@ func (in *KernelConfig) DeepCopy() *KernelConfig {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *KernelModuleConfig) DeepCopyInto(out *KernelModuleConfig) {
 	*out = *in
+	if in.ModuleParameters != nil {
+		in, out := &in.ModuleParameters, &out.ModuleParameters
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 	return
 }
 
diff --git a/pkg/machinery/resources/runtime/deep_copy.generated.go b/pkg/machinery/resources/runtime/deep_copy.generated.go
index 670b80c079..e46fe10fac 100644
--- a/pkg/machinery/resources/runtime/deep_copy.generated.go
+++ b/pkg/machinery/resources/runtime/deep_copy.generated.go
@@ -9,6 +9,10 @@ package runtime
 // DeepCopy generates a deep copy of KernelModuleSpecSpec.
 func (o KernelModuleSpecSpec) DeepCopy() KernelModuleSpecSpec {
 	var cp KernelModuleSpecSpec = o
+	if o.Parameters != nil {
+		cp.Parameters = make([]string, len(o.Parameters))
+		copy(cp.Parameters, o.Parameters)
+	}
 	return cp
 }
 
diff --git a/pkg/machinery/resources/runtime/kernel_module_spec.go b/pkg/machinery/resources/runtime/kernel_module_spec.go
index 7aaa70a142..c0abd72f2f 100644
--- a/pkg/machinery/resources/runtime/kernel_module_spec.go
+++ b/pkg/machinery/resources/runtime/kernel_module_spec.go
@@ -23,8 +23,9 @@ type KernelModuleSpec = typed.Resource[KernelModuleSpecSpec, KernelModuleSpecRD]
 //
 //gotagsrewrite:gen
 type KernelModuleSpecSpec struct {
-	Name string `yaml:"string" protobuf:"1"`
-	// more options in the future: args, aliases, etc.
+	Name       string   `yaml:"string" protobuf:"1"`
+	Parameters []string `yaml:"parameters" protobuf:"2"`
+	// more options in the future: aliases, etc.
 }
 
 // NewKernelModuleSpec initializes a KernelModuleSpec resource.
diff --git a/website/content/v1.3/reference/api.md b/website/content/v1.3/reference/api.md
index 0c95afae0e..2b00d239ea 100644
--- a/website/content/v1.3/reference/api.md
+++ b/website/content/v1.3/reference/api.md
@@ -3002,6 +3002,7 @@ KernelModuleSpecSpec describes Linux kernel module to load.
 | Field | Type | Label | Description |
 | ----- | ---- | ----- | ----------- |
 | name | [string](#string) |  |  |
+| parameters | [string](#string) | repeated |  |
 
 
 
diff --git a/website/content/v1.3/reference/configuration.md b/website/content/v1.3/reference/configuration.md
index 473507e78f..158386bd45 100644
--- a/website/content/v1.3/reference/configuration.md
+++ b/website/content/v1.3/reference/configuration.md
@@ -2920,5 +2920,6 @@ Appears in:
 | Field | Type | Description | Value(s) |
 |-------|------|-------------|----------|
 |`name` |string |Module name.  | |
+|`parameters` |[]string |Module parameters, changes applied after reboot.  | |