diff --git a/kubernetes/bootstrap.sh b/kubernetes/bootstrap.sh
index eebc378a..ae281351 100755
--- a/kubernetes/bootstrap.sh
+++ b/kubernetes/bootstrap.sh
@@ -442,7 +442,7 @@ hcloud_volumes_for_node() {
         gib=${size%GiB}
         [[ "$gib" =~ ^[0-9]+$ ]] || fail "$patch: cannot read volume size '$size' — state it as <n>GiB"
         echo $(( (gib * 1074 + 999) / 1000 ))
-    done < <(yq -r 'select(.kind == "RawVolumeConfig") | .provisioning.minSize' "$patch")
+    done < <(yq -r 'select(.kind == "RawVolumeConfig" and .provisioning.diskSelector.match != "system_disk") | .provisioning.minSize' "$patch")
 }
 
 # Deletes everything this phase created, and NOTHING else.
@@ -795,13 +795,16 @@ if [[ "$PHASE" == "hcloudtest" ]]; then
             hcloud volume delete "$n-osd" >/dev/null \
                 || fail "could not delete the previous OSD volume for $n"
         fi
+        # A raw volume on the system disk needs no Hetzner volume.
         vol_size=$(hcloud_volumes_for_node "$n")
-        [[ -n "$vol_size" ]] || fail "$n declares no RawVolumeConfig — a node with no OSD device is not this cluster's shape"
-        hcloud volume create --name "$n-osd" --size "$vol_size" --server "$n" \
-            --label "$HCLOUD_LABEL" >/dev/null \
-            || fail "could not create the OSD volume for $n"
-
-        echo "  $n at $addr, with a ${vol_size}GB OSD volume"
+        if [[ -n "$vol_size" ]]; then
+            hcloud volume create --name "$n-osd" --size "$vol_size" --server "$n" \
+                --label "$HCLOUD_LABEL" >/dev/null \
+                || fail "could not create the OSD volume for $n"
+            echo "  $n at $addr, with a ${vol_size}GB OSD volume"
+        else
+            echo "  $n at $addr, OSD on the system disk"
+        fi
         NODE_ADDRS+=("$addr")
     done
     ok
diff --git a/kubernetes/talos/patches/hcloud-1.yaml b/kubernetes/talos/patches/hcloud-1.yaml
index 94636069..6ee5512d 100644
--- a/kubernetes/talos/patches/hcloud-1.yaml
+++ b/kubernetes/talos/patches/hcloud-1.yaml
@@ -3,7 +3,8 @@
 # underlay network instead of VLANs, because Hetzner networks are layer 3.
 # Private keys and peers are generated per run by bootstrap.sh hcloudtest.
 #
-# enp1s0 is the public NIC, enp7s0 the underlay.
+# enp1s0 is the public NIC, enp7s0 the underlay. The OSD takes a partition
+# on the local system disk; EPHEMERAL is capped to leave it room.
 machine:
   install:
     disk: /dev/sda
@@ -101,10 +102,17 @@ addresses:
   - address: fd02:47::11/64
 ---
 apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+provisioning:
+  maxSize: 100GiB
+  grow: false
+---
+apiVersion: v1alpha1
 kind: RawVolumeConfig
 name: osd-data
 provisioning:
   diskSelector:
-    match: '!system_disk'
+    match: system_disk
   minSize: 400GiB
   grow: true
diff --git a/kubernetes/talos/patches/hcloud-2.yaml b/kubernetes/talos/patches/hcloud-2.yaml
index 7d637d21..04d2ad51 100644
--- a/kubernetes/talos/patches/hcloud-2.yaml
+++ b/kubernetes/talos/patches/hcloud-2.yaml
@@ -3,7 +3,8 @@
 # underlay network instead of VLANs, because Hetzner networks are layer 3.
 # Private keys and peers are generated per run by bootstrap.sh hcloudtest.
 #
-# enp1s0 is the public NIC, enp7s0 the underlay.
+# enp1s0 is the public NIC, enp7s0 the underlay. The OSD takes a partition
+# on the local system disk; EPHEMERAL is capped to leave it room.
 machine:
   install:
     disk: /dev/sda
@@ -101,10 +102,17 @@ addresses:
   - address: fd02:47::12/64
 ---
 apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+provisioning:
+  maxSize: 100GiB
+  grow: false
+---
+apiVersion: v1alpha1
 kind: RawVolumeConfig
 name: osd-data
 provisioning:
   diskSelector:
-    match: '!system_disk'
+    match: system_disk
   minSize: 400GiB
   grow: true
diff --git a/kubernetes/talos/patches/hcloud-3.yaml b/kubernetes/talos/patches/hcloud-3.yaml
index 67561290..bded6d0a 100644
--- a/kubernetes/talos/patches/hcloud-3.yaml
+++ b/kubernetes/talos/patches/hcloud-3.yaml
@@ -3,7 +3,8 @@
 # underlay network instead of VLANs, because Hetzner networks are layer 3.
 # Private keys and peers are generated per run by bootstrap.sh hcloudtest.
 #
-# enp1s0 is the public NIC, enp7s0 the underlay.
+# enp1s0 is the public NIC, enp7s0 the underlay. The OSD takes a partition
+# on the local system disk; EPHEMERAL is capped to leave it room.
 machine:
   install:
     disk: /dev/sda
@@ -101,10 +102,17 @@ addresses:
   - address: fd02:47::13/64
 ---
 apiVersion: v1alpha1
+kind: VolumeConfig
+name: EPHEMERAL
+provisioning:
+  maxSize: 100GiB
+  grow: false
+---
+apiVersion: v1alpha1
 kind: RawVolumeConfig
 name: osd-data
 provisioning:
   diskSelector:
-    match: '!system_disk'
+    match: system_disk
   minSize: 400GiB
   grow: true