diff --git a/.taskfiles/talos/Taskfile.yaml b/.taskfiles/talos/Taskfile.yaml
index f267b3f0b..659c68539 100644
--- a/.taskfiles/talos/Taskfile.yaml
+++ b/.taskfiles/talos/Taskfile.yaml
@@ -2,9 +2,6 @@
 # yaml-language-server: $schema=https://taskfile.dev/schema.json
 version: "3"
 
-vars:
-  KUBERNETES_DIR: "{{.ROOT_DIR}}/kubernetes"
-
 tasks:
   bootstrap:
     desc: Bootstrap Talos
@@ -38,7 +35,7 @@ tasks:
     desc: Bootstrap core integrations needed for Talos
     cmds:
       - until kubectl --context {{.cluster}} wait --for=condition=Ready=False nodes --all --timeout=600s; do sleep 10; done
-      - helmfile --kube-context {{.cluster}} --file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/helmfile.yaml apply --skip-diff-on-install --suppress-diff
+      - helmfile --kube-context {{.cluster}} --file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/helmfile.yaml apply --skip-diff-on-install --suppress-diff
       - until kubectl --context {{.cluster}} wait --for=condition=Ready nodes --all --timeout=600s; do sleep 10; done
     requires:
       vars:
@@ -47,13 +44,13 @@ tasks:
       - which helmfile
       - sh: kubectl config get-contexts {{.cluster}}
         msg: "Kubectl context {{.cluster}} not found"
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/helmfile.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/helmfile.yaml
 
   fetch-kubeconfig:
     desc: Fetch kubeconfig from Talos controllers
     cmd: |
       talosctl --context {{.cluster}} kubeconfig --nodes {{.controller}} \
-          --force --force-context-name {{.cluster}} {{.KUBERNETES_DIR}}/{{.cluster}}
+          --force --force-context-name {{.cluster}} {{.CLUSTER_DIR}}/{{.cluster}}
     requires:
       vars:
         - cluster
@@ -64,36 +61,36 @@ tasks:
     desc: Generate secrets for Talos
     prompt: This will overwrite your talos cert file. Are you sure?
     cmds:
-      - cd {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos && talhelper gensecret > talsecret.sops.yaml
+      - cd {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos && talhelper gensecret > talsecret.sops.yaml
     requires:
       vars:
         - cluster
     preconditions:
       - which talhelper
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
 
   generate-clusterconfig:
     desc: Generate clusterconfig for Talos
     cmds:
       - talhelper genconfig
-        --env-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
-        --secret-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talsecret.sops.yaml
-        --config-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
-        --out-dir {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig
+        --env-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
+        --secret-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talsecret.sops.yaml
+        --config-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+        --out-dir {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig
     requires:
       vars:
         - cluster
     preconditions:
       - which talhelper
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talsecret.sops.yaml
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talsecret.sops.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
 
   upgrade-all:
     desc: Upgrade talos version of all nodes
     vars:
       CLUSTERCONFIG_FILES:
-        sh: gfind {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig -type f -name '*.yaml' -printf '%f\n' | sort
+        sh: gfind {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig -type f -name '*.yaml' -printf '%f\n' | sort
     cmds:
       - for:
           var: CLUSTERCONFIG_FILES
@@ -108,7 +105,7 @@ tasks:
         - cluster
     preconditions:
       - talosctl config get-contexts | grep {{.cluster}}
-      - test -d {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig
+      - test -d {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig
 
   upgrade:
     desc: Upgrade Talos version for a node
@@ -117,12 +114,12 @@ tasks:
     vars:
       TALOS_VERSION:
         sh: |
-          yq -r ".talosVersion" {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+          yq -r ".talosVersion" {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
       TALOS_IMAGE:
         sh: |
           talhelper genurl installer \
-            --env-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml \
-            --config-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml \
+            --env-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml \
+            --config-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml \
           | grep {{.hostname}} \
           | awk '{split($0,u," "); print u[2]}'
     cmds:
@@ -134,8 +131,8 @@ tasks:
     preconditions:
       - which talhelper
       - talosctl config get-contexts | grep {{.cluster}}
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
       - msg: "Talos image could not be determined for {{.node}}"
         sh: 'test -n "{{.TALOS_IMAGE}}"'
 
@@ -144,7 +141,7 @@ tasks:
     vars:
       KUBERNETES_VERSION:
         sh: |
-          yq -r ".kubernetesVersion" {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+          yq -r ".kubernetesVersion" {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
       CONTROLPLANE_NODE:
         sh: |
           talosctl --context {{.cluster}} config info \
@@ -159,8 +156,8 @@ tasks:
     preconditions:
       - which talhelper
       - talosctl config get-contexts | grep {{.cluster}}
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
       - msg: "Kubernetes version could not be determined for cluster {{.cluster}}"
         sh: 'test -n "{{.KUBERNETES_VERSION}}"'
       - msg: "Control plane node could not be determined for cluster {{.cluster}}"
@@ -170,7 +167,7 @@ tasks:
     desc: Apply clusterconfig for a Talos cluster
     vars:
       CLUSTERCONFIG_FILES:
-        sh: gfind {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig -type f -name '*.yaml' -printf '%f\n'
+        sh: gfind {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig -type f -name '*.yaml' -printf '%f\n'
     cmds:
       - for:
           var: CLUSTERCONFIG_FILES
@@ -187,7 +184,7 @@ tasks:
         - cluster
     preconditions:
       - talosctl config get-contexts | grep {{.cluster}}
-      - test -d {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig
+      - test -d {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig
 
   _apply-machineconfig:
     internal: true
@@ -196,7 +193,7 @@ tasks:
       - talosctl --context {{.cluster}} apply-config
         {{ if eq "true" .insecure }} --insecure {{ end }}
         --nodes "{{.hostname}}"
-        --file "{{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig/{{.filename}}"
+        --file "{{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig/{{.filename}}"
         {{ if eq "true" .dry_run }}--dry-run{{ end }}
     requires:
       vars:
@@ -206,7 +203,7 @@ tasks:
         - insecure
     preconditions:
       - talosctl config get-contexts | grep {{.cluster}}
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig/{{.filename}}
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/clusterconfig/{{.filename}}
 
   _upgrade:
     desc: Upgrade Talos version for a node
@@ -216,12 +213,12 @@ tasks:
     vars:
       TALOS_VERSION:
         sh: |
-          yq -r ".talosVersion" {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+          yq -r ".talosVersion" {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
       TALOS_IMAGE:
         sh: |
           talhelper genurl installer \
-            --env-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml \
-            --config-file {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml \
+            --env-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml \
+            --config-file {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml \
           | grep {{.hostname}} \
           | awk '{split($0,u," "); print u[2]}'
     cmds:
@@ -235,8 +232,8 @@ tasks:
     preconditions:
       - which talhelper
       - talosctl config get-contexts | grep {{.cluster}}
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
-      - test -f {{.KUBERNETES_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talenv.sops.yaml
+      - test -f {{.CLUSTER_DIR}}/{{.cluster}}/bootstrap/talos/talconfig.yaml
       - msg: "Talos image could not be determined for {{.node}}"
         sh: 'test -n "{{.TALOS_IMAGE}}"'
 
diff --git a/Taskfile.yml b/Taskfile.yml
index 0607ffac0..1295763e9 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -2,11 +2,14 @@
 # yaml-language-server: $schema=https://taskfile.dev/schema.json
 version: "3"
 
+set: [pipefail]
+shopt: [globstar]
+
 vars:
-  CLUSTER_DIR: '{{.ROOT_DIR}}/kubernetes/talos'
+  CLUSTER_DIR: '{{.ROOT_DIR}}/kubernetes'
   BOOTSTRAP_DIR: '{{.CLUSTER_DIR}}/bootstrap'
+  TALOS_DIR: "{{.BOOTSTRAP_DIR}}/talos"
   ANSIBLE_DIR: "{{.ROOT_DIR}}/infrastructure/ansible"
-  TALOS_DIR: "{{.ROOT_DIR}}/kubernetes/talos/bootstrap/talos"
   TERRAFORM_DIR: "{{.ROOT_DIR}}/infrastructure/terraform"
 
 dotenv: [".config.env"]
diff --git a/kubernetes/bootstrap/apps/helmfile.yaml b/kubernetes/bootstrap/apps/helmfile.yaml
index fbddc26b0..50853f76b 100644
--- a/kubernetes/bootstrap/apps/helmfile.yaml
+++ b/kubernetes/bootstrap/apps/helmfile.yaml
@@ -22,14 +22,14 @@ releases:
     namespace: kube-system
     chart: cilium/cilium
     version: 1.16.6
-    values: ["../apps/kube-system/cilium/app/values.yaml"]
+    values: ["../../apps/kube-system/cilium/app/values.yaml"]
     needs: ["monitoring/prometheus-operator-crds"]
 
   - name: kubelet-csr-approver
     namespace: kube-system
     chart: postfinance/kubelet-csr-approver
     version: 1.2.2
-    values: ["../apps/kube-system/kubelet-csr-approver/app/values.yaml"]
+    values: ["../../apps/kube-system/kubelet-csr-approver/app/values.yaml"]
     needs:
       - kube-system/cilium
       - monitoring/prometheus-operator-crds
@@ -38,13 +38,13 @@ releases:
     namespace: flux-system
     chart: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator
     version: 0.13.0
-    values: ["../apps/flux-system/flux-operator/app/values.yaml"]
+    values: ["../../apps/flux-system/flux-operator/app/values.yaml"]
 
   - name: flux-instance
     namespace: flux-system
     chart: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance
     version: 0.13.0
     wait: false
-    values: ["../apps/flux-system/flux-operator/instance/values.yaml"]
+    values: ["../../apps/flux-system/flux-operator/instance/values.yaml"]
     needs:
       - flux-system/flux-operator