diff --git a/go.mod b/go.mod
index b888f7ddec..241b68f1f3 100644
--- a/go.mod
+++ b/go.mod
@@ -142,7 +142,7 @@ require (
 	github.com/siderolabs/gen v0.7.0
 	github.com/siderolabs/go-api-signature v0.3.6
 	github.com/siderolabs/go-blockdevice v0.4.8
-	github.com/siderolabs/go-blockdevice/v2 v2.0.6
+	github.com/siderolabs/go-blockdevice/v2 v2.0.7
 	github.com/siderolabs/go-circular v0.2.1
 	github.com/siderolabs/go-cmd v0.1.3
 	github.com/siderolabs/go-copy v0.1.0
diff --git a/go.sum b/go.sum
index a461d0fc3a..366ed65b2c 100644
--- a/go.sum
+++ b/go.sum
@@ -645,8 +645,8 @@ github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr
 github.com/siderolabs/go-api-signature v0.3.6/go.mod h1:hoH13AfunHflxbXfh+NoploqV13ZTDfQ1mQJWNVSW9U=
 github.com/siderolabs/go-blockdevice v0.4.8 h1:KfdWvIx0Jft5YVuCsFIJFwjWEF1oqtzkgX9PeU9cX4c=
 github.com/siderolabs/go-blockdevice v0.4.8/go.mod h1:4PeOuk71pReJj1JQEXDE7kIIQJPVe8a+HZQa+qjxSEA=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6 h1:/NAy3MbNZhjLWo28asZyS/hmf86PEPDMc9i6wIcgbwI=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7 h1:OCxxA7W1xVqbEP3MrCttqhKpuV4t1KkBTzNeboYDTmc=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
 github.com/siderolabs/go-circular v0.2.1 h1:a++iVCn9jyhICX3POQZZX8n72p2h5JGdGU6w1ulmpcA=
 github.com/siderolabs/go-circular v0.2.1/go.mod h1:ZDItzVyXK+B/XuqTBV5MtQtSv06VI+oCmWGRnNCATo8=
 github.com/siderolabs/go-cmd v0.1.3 h1:JrgZwqhJQeoec3QRON0LK+fv+0y7d0DyY7zsfkO6ciw=
diff --git a/internal/app/machined/pkg/controllers/cri/image_cache_config.go b/internal/app/machined/pkg/controllers/cri/image_cache_config.go
index d937f369ac..367faeff41 100644
--- a/internal/app/machined/pkg/controllers/cri/image_cache_config.go
+++ b/internal/app/machined/pkg/controllers/cri/image_cache_config.go
@@ -16,6 +16,7 @@ import (
 	"github.com/cosi-project/runtime/pkg/safe"
 	"github.com/cosi-project/runtime/pkg/state"
 	"github.com/dustin/go-humanize"
+	"github.com/google/cel-go/common/ast"
 	"github.com/google/cel-go/common/operators"
 	"github.com/google/cel-go/common/types"
 	"github.com/siderolabs/gen/optional"
@@ -198,19 +199,26 @@ func (ctrl *ImageCacheConfigController) Run(ctx context.Context, r controller.Ru
 func (ctrl *ImageCacheConfigController) createVolumeConfigISO(ctx context.Context, r controller.ReaderWriter) error {
 	builder := cel.NewBuilder(celenv.VolumeLocator())
 
-	// volume.name == "iso9660" && volume.label.startsWith("TALOS_")
+	// volume.name in ["iso9660", "vfat"] && volume.label.startsWith("TALOS_")
 	expr := builder.NewCall(
 		builder.NextID(),
 		operators.LogicalAnd,
 		builder.NewCall(
 			builder.NextID(),
-			operators.Equals,
+			operators.In,
 			builder.NewSelect(
 				builder.NextID(),
 				builder.NewIdent(builder.NextID(), "volume"),
 				"name",
 			),
-			builder.NewLiteral(builder.NextID(), types.String("iso9660")),
+			builder.NewList(
+				builder.NextID(),
+				[]ast.Expr{
+					builder.NewLiteral(builder.NextID(), types.String("iso9660")),
+					builder.NewLiteral(builder.NextID(), types.String("vfat")),
+				},
+				nil,
+			),
 		),
 		builder.NewMemberCall(
 			builder.NextID(),
diff --git a/internal/app/machined/pkg/controllers/cri/image_cache_config_test.go b/internal/app/machined/pkg/controllers/cri/image_cache_config_test.go
index 7935ad216d..1c39f7fa5a 100644
--- a/internal/app/machined/pkg/controllers/cri/image_cache_config_test.go
+++ b/internal/app/machined/pkg/controllers/cri/image_cache_config_test.go
@@ -63,7 +63,7 @@ func (suite *ImageCacheConfigSuite) TestReconcileFeatureEnabled() {
 	suite.Require().NoError(suite.State().Create(suite.Ctx(), cfg))
 
 	ctest.AssertResource(suite, crictrl.VolumeImageCacheISO, func(r *block.VolumeConfig, asrt *assert.Assertions) {
-		asrt.Equal(`volume.name == "iso9660" && volume.label.startsWith("TALOS_")`, r.TypedSpec().Locator.Match.String())
+		asrt.Equal(`volume.name in ["iso9660", "vfat"] && volume.label.startsWith("TALOS_")`, r.TypedSpec().Locator.Match.String())
 	})
 	ctest.AssertResource(suite, crictrl.VolumeImageCacheDISK, func(r *block.VolumeConfig, asrt *assert.Assertions) {
 		asrt.Equal(`volume.partition_label == "IMAGECACHE"`, r.TypedSpec().Locator.Match.String())
diff --git a/pkg/machinery/go.mod b/pkg/machinery/go.mod
index 5aca98c88f..46c9a992f0 100644
--- a/pkg/machinery/go.mod
+++ b/pkg/machinery/go.mod
@@ -27,7 +27,7 @@ require (
 	github.com/siderolabs/crypto v0.5.0
 	github.com/siderolabs/gen v0.7.0
 	github.com/siderolabs/go-api-signature v0.3.6
-	github.com/siderolabs/go-blockdevice/v2 v2.0.6
+	github.com/siderolabs/go-blockdevice/v2 v2.0.7
 	github.com/siderolabs/go-pointer v1.0.0
 	github.com/siderolabs/net v0.4.0
 	github.com/siderolabs/protoenc v0.2.1
diff --git a/pkg/machinery/go.sum b/pkg/machinery/go.sum
index b62017b461..5a859548fa 100644
--- a/pkg/machinery/go.sum
+++ b/pkg/machinery/go.sum
@@ -110,8 +110,8 @@ github.com/siderolabs/gen v0.7.0 h1:uHAt3WD0dof28NHFuguWBbDokaXQraR/HyVxCLw2QCU=
 github.com/siderolabs/gen v0.7.0/go.mod h1:an3a2Y53O7kUjnnK8Bfu3gewtvnIOu5RTU6HalFtXQQ=
 github.com/siderolabs/go-api-signature v0.3.6 h1:wDIsXbpl7Oa/FXvxB6uz4VL9INA9fmr3EbmjEZYFJrU=
 github.com/siderolabs/go-api-signature v0.3.6/go.mod h1:hoH13AfunHflxbXfh+NoploqV13ZTDfQ1mQJWNVSW9U=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6 h1:/NAy3MbNZhjLWo28asZyS/hmf86PEPDMc9i6wIcgbwI=
-github.com/siderolabs/go-blockdevice/v2 v2.0.6/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7 h1:OCxxA7W1xVqbEP3MrCttqhKpuV4t1KkBTzNeboYDTmc=
+github.com/siderolabs/go-blockdevice/v2 v2.0.7/go.mod h1:74htzCV913UzaLZ4H+NBXkwWlYnBJIq5m/379ZEcu8w=
 github.com/siderolabs/go-pointer v1.0.0 h1:6TshPKep2doDQJAAtHUuHWXbca8ZfyRySjSBT/4GsMU=
 github.com/siderolabs/go-pointer v1.0.0/go.mod h1:HTRFUNYa3R+k0FFKNv11zgkaCLzEkWVzoYZ433P3kHc=
 github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg=