diff --git a/kubernetes/talos/patches/cluster.yaml b/kubernetes/talos/patches/cluster.yaml
index 95fe88c0..70843132 100644
--- a/kubernetes/talos/patches/cluster.yaml
+++ b/kubernetes/talos/patches/cluster.yaml
@@ -26,6 +26,19 @@ machine:
     nodeIP:
       validSubnets:
         - 10.2.40.0/24
+    # Lower the image GC thresholds from the kubelet defaults (85/80)
+    # so containerd's image cache is pruned before /var crosses Ceph's
+    # mon_data_avail_warn line (mon DB warns when its hostpath has
+    # <30% free). k8s-2 and k8s-3 sit at 77-79% used because of pod
+    # density (75 pods on k8s-2 vs 42 on k8s-1) — unused image layers
+    # accumulate untouched until the 85% high watermark, which the
+    # node never hits, so GC never fires. 70/60 keeps /var safely
+    # under 30%-free without raising the VM disk again. Spegel P2P
+    # pull-through softens the re-pull cost when GC'd images are
+    # needed back.
+    extraConfig:
+      imageGCHighThresholdPercent: 70
+      imageGCLowThresholdPercent: 60
 cluster:
   controlPlane:
     endpoint: https://k8s.renner.uno:6443