diff --git a/kubernetes/infrastructure/multus/multus-daemonset.yaml b/kubernetes/infrastructure/multus/multus-daemonset.yaml
index 4601d5d1..cffb217b 100644
--- a/kubernetes/infrastructure/multus/multus-daemonset.yaml
+++ b/kubernetes/infrastructure/multus/multus-daemonset.yaml
@@ -1,5 +1,5 @@
-# Vendored from k8snetworkplumbingwg/multus-cni v4.2.4 thick daemonset:
-#   https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.2.4/deployments/multus-daemonset-thick.yml
+# Vendored from k8snetworkplumbingwg/multus-cni v4.3.1 thick daemonset:
+#   https://raw.githubusercontent.com/k8snetworkplumbingwg/multus-cni/v4.3.1/deployments/multus-daemonset-thick.yml
 #
 # Why vendored, not Helm: there is no published Helm repository for this
 # project — the upstream k8snetworkplumbingwg/helm-charts repo only ships
@@ -7,10 +7,11 @@
 # https://k8snetworkplumbingwg.github.io/helm-charts/ 404s.
 #
 # Why thick (not thin): the only version-pinned image tag published for
-# v4.2.4 is `v4.2.4-thick` — there is no `v4.2.4-thin` or unsuffixed
+# v4.2.4 was `v4.2.4-thick` — there was no `v4.2.4-thin` or unsuffixed
 # `v4.2.4` tag (verified against ghcr.io/k8snetworkplumbingwg/multus-cni
-# package versions). The thin variant only ships under moving tags
-# (snapshot, latest), which we don't want for reproducibility.
+# package versions). The thin variant only shipped under moving tags
+# (snapshot, latest), which we don't want for reproducibility. v4.3.1 also
+# publishes an unsuffixed tag; we keep `-thick` so image and manifest match.
 #
 # Talos compatibility: the daemon chroots into /hostroot to exec CNI
 # plugin binaries from /opt/cni/bin on the host. Talos's rootfs is
@@ -30,6 +31,7 @@ spec:
     kind: NetworkAttachmentDefinition
     shortNames:
       - net-attach-def
+      - nad
   versions:
     - name: v1
       served: true
@@ -82,6 +84,15 @@ rules:
       - list
       - update
       - watch
+  - apiGroups:
+      - "resource.k8s.io"
+    resources:
+      - resourceclaims
+      - resourceclaims/status
+      - resourceslices
+    verbs:
+      - get
+      - list
   - apiGroups:
       - ""
       - events.k8s.io
@@ -286,7 +297,7 @@ spec:
             - name: cnibin
               mountPath: /host/opt/cni/bin
               mountPropagation: Bidirectional
-      terminationGracePeriodSeconds: 10
+      terminationGracePeriodSeconds: 30
       volumes:
         - name: cni
           hostPath: