diff --git a/plugins/cozystack/skills/cluster-upgrade/references/post-upgrade-checks.md b/plugins/cozystack/skills/cluster-upgrade/references/post-upgrade-checks.md
index 896fe53..b5d727f 100644
--- a/plugins/cozystack/skills/cluster-upgrade/references/post-upgrade-checks.md
+++ b/plugins/cozystack/skills/cluster-upgrade/references/post-upgrade-checks.md
@@ -28,6 +28,10 @@ kubectl --context $CTX get tenantcontrolplane -A
 alias linstor='kubectl exec -n cozy-linstor deploy/linstor-controller -ti -- linstor'
 linstor node list
 linstor resource list --faulty
+
+# 6. CVE-2026-53359 mitigation survived the OS upgrade (nested virtualization still off).
+#    machine.install.extraKernelArgs is re-applied by `talm upgrade`; confirm per node:
+talm -n <node-ip> read /proc/cmdline | grep -o 'kvm_intel.nested=[01]'   # expect kvm_intel.nested=0
 ```
 
 ## Targeted checks (map from change-risk summary)
diff --git a/plugins/cozystack/skills/talos-bootstrap/SKILL.md b/plugins/cozystack/skills/talos-bootstrap/SKILL.md
index b09fe66..99880b4 100644
--- a/plugins/cozystack/skills/talos-bootstrap/SKILL.md
+++ b/plugins/cozystack/skills/talos-bootstrap/SKILL.md
@@ -296,6 +296,18 @@ for node_idx in "${!INVENTORY_NODE_NAMES[@]}"; do
   cat > "$f" <<EOF
 # talos-version: $TALOS_VERSION
 # talm-template: ../templates
+machine:
+  install:
+    # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation).
+    # kvm_intel/kvm_amd are built into the Talos kernel, so nested= is settable
+    # only from the kernel command line. On Talos >=1.12 pin grubUseUKICmdline
+    # false so the args land on the Talos-built cmdline (Talos rejects/ignores
+    # extraKernelArgs under the UKI cmdline). Applied by the installer, so it
+    # takes effect on "talm upgrade", not a plain "talm apply".
+    grubUseUKICmdline: false
+    extraKernelArgs:
+    - kvm_intel.nested=0
+    - kvm_amd.nested=0
 ---
 apiVersion: v1alpha1
 kind: HostnameConfig
@@ -402,6 +414,7 @@ If `state.cluster.vip.per_node[$node]` exists but the LinkConfig doc is missing,
 Present each `nodes/<name>.yaml` for review. Things to spot before apply:
 
 - `machine.install.image` should be `ghcr.io/cozystack/cozystack/talos:<tag>`. The cozystack preset sets this; surface if missing.
+- `machine.install.extraKernelArgs` should include `kvm_intel.nested=0` and `kvm_amd.nested=0` — the CVE-2026-53359 (Januscape) nested-virtualization guest-to-host escape mitigation. The Phase 6.5 overlay and the cozystack preset set these; surface if missing (e.g. an older preset).
 - `machine.kernel.modules` should list drbd / zfs / spl / openvswitch / vfio_pci / vfio_iommu_type1.
 - For CP nodes: `machine.type: controlplane`, optional `machine.network.interfaces[].vip` for HA.
 - `machine.install.disk` defaults to a heuristic — confirm it picks the right system disk on multi-disk nodes (operator can edit nodes/<name>.yaml before apply).
diff --git a/plugins/cozystack/skills/talos-bootstrap/references/manual-steps.md b/plugins/cozystack/skills/talos-bootstrap/references/manual-steps.md
index c77b5fc..d584158 100644
--- a/plugins/cozystack/skills/talos-bootstrap/references/manual-steps.md
+++ b/plugins/cozystack/skills/talos-bootstrap/references/manual-steps.md
@@ -131,6 +131,13 @@ machine:
   # Required: which interface to install Talos to.
   install:
     disk: /dev/sda
+    # CVE-2026-53359: disable KVM nested virtualization (guest-to-host escape mitigation).
+    # On Talos >=1.12 pin grubUseUKICmdline false so the args land on the built
+    # cmdline. Takes effect on `talm upgrade` (installer re-run), not `talm apply`.
+    grubUseUKICmdline: false
+    extraKernelArgs:
+    - kvm_intel.nested=0
+    - kvm_amd.nested=0
 ---
 apiVersion: v1alpha1
 kind: HostnameConfig