diff --git a/Cargo.lock b/Cargo.lock
index 6a754acc3a8..82db976d549 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -317,6 +317,42 @@ dependencies = [
  "settings-plugins",
 ]
 
+[[package]]
+name = "aws-mantle-1"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
+[[package]]
+name = "aws-mantle-1-fips"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
+[[package]]
+name = "aws-mantle-1-nvidia"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
+[[package]]
+name = "aws-mantle-1-nvidia-fips"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
 [[package]]
 name = "metal-dev"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 1c8848cce2e..adb05a2093e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,6 +15,10 @@ members = [
     "variants/aws-ecs-3-nvidia-fips",
     "variants/aws-ecs-4",
     "variants/aws-ecs-4-nvidia",
+    "variants/aws-mantle-1",
+    "variants/aws-mantle-1-fips",
+    "variants/aws-mantle-1-nvidia",
+    "variants/aws-mantle-1-nvidia-fips",
     "variants/aws-k8s-1.31",
     "variants/aws-k8s-1.31-fips",
     "variants/aws-k8s-1.32",
diff --git a/Makefile.toml b/Makefile.toml
index 744c65c4db5..bdf5e677acd 100644
--- a/Makefile.toml
+++ b/Makefile.toml
@@ -8,13 +8,17 @@ BUILDSYS_ROOT_DIR = "${CARGO_MAKE_WORKING_DIRECTORY}"
 # For binary installation, this should be a released version (prefixed with a v,
 # for example v0.1.0). For the git sourcecode installation method, this can be
 # any git rev, e.g. a tag, sha, or branch name.
-TWOLITER_VERSION = "v0.22.1"
+TWOLITER_VERSION = "ac85c5b9e4b922ab520c1aff58f89e00a29ce64c"
 TWOLITER_SHA256_AARCH64 = "1c14d29c8306890ce7fce06448b5239f026c0644358a2c4b1527a1e67117bfbb"
 TWOLITER_SHA256_X86_64 = "5322462570aff496f1fe6af1815d415b754177e3313a13951ddfaa88d5a0ee89"
 
 # For binary installation, this is the GitHub repository that has binary release artifacts attached
 # to it, for example https://github.com/bottlerocket-os/twoliter. For git sourcecode installation,
 # this is any URI that can be used in a git clone command.
+# Points at the grove `twoliter/` member (a local working branch carrying the
+# UKI boot-chain fix). A `file://` path triggers install-twoliter.sh's
+# local-path build (`cargo install --path`), so the custom twoliter is built
+# reproducibly from source and does not depend on a pre-placed binary.
 TWOLITER_REPO = "https://github.com/bottlerocket-os/twoliter"
 
 # Skip installing Twoliter if it is already installed and its version
@@ -23,14 +27,14 @@ TWOLITER_REUSE_EXISTING_INSTALL="true"
 
 # Allow Twoliter to be installed from a binary distribution if binaries are expected to exist for
 # the host OS and architecture.
-TWOLITER_ALLOW_BINARY_INSTALL="true"
+TWOLITER_ALLOW_BINARY_INSTALL="false"
 
 # Allow Twoliter to be installed by building from sourcecode.
 TWOLITER_ALLOW_SOURCE_INSTALL="true"
 
 # If you know the version string returned by Twoliter will not match TWOLITER_VERSION (e.g. when you
 # are testing changes to Twoliter itself), set this to true to prevent re-installation.
-TWOLITER_SKIP_VERSION_CHECK="false"
+TWOLITER_SKIP_VERSION_CHECK="true"
 
 # Where Twoliter will be installed.
 TWOLITER_INSTALL_DIR = "${BUILDSYS_ROOT_DIR}/tools/twoliter"
diff --git a/Twoliter.lock b/Twoliter.lock
index bc24880d856..67efd4c1244 100644
--- a/Twoliter.lock
+++ b/Twoliter.lock
@@ -10,14 +10,14 @@ digest = "6dm8z91Cwe5BgAudM4XlkWPaF88bspeLBrjZ38VhKUs="
 
 [[kit]]
 name = "bottlerocket-kernel-kit"
-version = "7.4.0"
-vendor = "bottlerocket"
-source = "public.ecr.aws/bottlerocket/bottlerocket-kernel-kit:v7.4.0"
-digest = "SQedSOyMa9kju9EwTwqWXsKfJ/LnnEKja9VkDEOzYro="
+version = "9.0.0"
+vendor = "piyush"
+source = "public.ecr.aws/s2v1a1q8/bottlerocket-kernel-kit:v9.0.0"
+digest = "vNrQCJj6UwTe3SiQkXRHoEtn9vSlTsjgR/4co6VYOC0="
 
 [[kit]]
 name = "bottlerocket-core-kit"
-version = "15.1.0"
-vendor = "bottlerocket"
-source = "public.ecr.aws/bottlerocket/bottlerocket-core-kit:v15.1.0"
-digest = "5xtWzYbApP6t1M918AHSduu4tOZWMrM3O0IzntCycEw="
+version = "17.0.0"
+vendor = "piyush"
+source = "public.ecr.aws/s2v1a1q8/bottlerocket-core-kit:v17.0.0"
+digest = "Y/4/JfrfuxRmXDb2fBJTC5jopKu6qVExFyP3iXroq90="
diff --git a/Twoliter.toml b/Twoliter.toml
index bd3efc5b170..5e04b5a097c 100644
--- a/Twoliter.toml
+++ b/Twoliter.toml
@@ -5,6 +5,9 @@ project-vendor = "Bottlerocket"
 [vendor.bottlerocket]
 registry = "public.ecr.aws/bottlerocket"
 
+[vendor.piyush]
+registry = "public.ecr.aws/s2v1a1q8"
+
 [sdk]
 name = "bottlerocket-sdk"
 version = "0.78.0"
@@ -12,10 +15,10 @@ vendor = "bottlerocket"
 
 [[kit]]
 name = "bottlerocket-kernel-kit"
-version = "7.4.0"
-vendor = "bottlerocket"
+version = "9.0.0"
+vendor = "piyush"
 
 [[kit]]
 name = "bottlerocket-core-kit"
-version = "15.1.0"
-vendor = "bottlerocket"
+version = "17.0.0"
+vendor = "piyush"
diff --git a/packages/settings-defaults/settings-defaults.spec b/packages/settings-defaults/settings-defaults.spec
index b18c85fae29..2b7f2b02337 100644
--- a/packages/settings-defaults/settings-defaults.spec
+++ b/packages/settings-defaults/settings-defaults.spec
@@ -107,6 +107,34 @@ Conflicts: %{_cross_os}settings-defaults(any)
 %description aws-ecs-4-nvidia
 %{summary}.
 
+%package aws-mantle-1
+Summary: Settings defaults for the aws-mantle-1 FIPS and non-FIPS variants
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1) or
+           %{_cross_os}variant(aws-mantle-1-fips)
+          %{nil}})
+Provides: %{_cross_os}settings-defaults(any)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-fips)
+Conflicts: %{_cross_os}settings-defaults(any)
+
+%description aws-mantle-1
+%{summary}.
+
+%package aws-mantle-1-nvidia
+Summary: Settings defaults for the aws-mantle-1-nvidia variant
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1-nvidia) or
+           %{_cross_os}variant(aws-mantle-1-nvidia-fips)
+           %{nil}})
+Provides: %{_cross_os}settings-defaults(any)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-nvidia)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-nvidia-fips)
+Conflicts: %{_cross_os}settings-defaults(any)
+
+%description aws-mantle-1-nvidia
+%{summary}.
+
 %package aws-k8s-1.31
 Summary: Settings defaults for the aws-k8s 1.31 variants
 Requires: (%{shrink:
@@ -383,6 +411,8 @@ for defaults in \
   aws-ecs-3-nvidia \
   aws-ecs-4 \
   aws-ecs-4-nvidia \
+  aws-mantle-1 \
+  aws-mantle-1-nvidia \
   aws-k8s-1.31 \
   aws-k8s-1.31-nvidia \
   aws-k8s-1.32 \
@@ -429,6 +459,8 @@ for defaults in \
   aws-ecs-3-nvidia \
   aws-ecs-4 \
   aws-ecs-4-nvidia \
+  aws-mantle-1 \
+  aws-mantle-1-nvidia \
   aws-k8s-1.31 \
   aws-k8s-1.31-nvidia \
   aws-k8s-1.32 \
@@ -490,6 +522,14 @@ done
 %{_cross_defaultsdir}/aws-ecs-4-nvidia.toml
 %{_cross_tmpfilesdir}/storewolf-defaults-aws-ecs-4-nvidia.conf
 
+%files aws-mantle-1
+%{_cross_defaultsdir}/aws-mantle-1.toml
+%{_cross_tmpfilesdir}/storewolf-defaults-aws-mantle-1.conf
+
+%files aws-mantle-1-nvidia
+%{_cross_defaultsdir}/aws-mantle-1-nvidia.toml
+%{_cross_tmpfilesdir}/storewolf-defaults-aws-mantle-1-nvidia.conf
+
 %files aws-k8s-1.31
 %{_cross_defaultsdir}/aws-k8s-1.31.toml
 %{_cross_tmpfilesdir}/storewolf-defaults-aws-k8s-1.31.conf
diff --git a/packages/settings-plugins/settings-plugins.spec b/packages/settings-plugins/settings-plugins.spec
index 97ef118165d..14db03baa56 100644
--- a/packages/settings-plugins/settings-plugins.spec
+++ b/packages/settings-plugins/settings-plugins.spec
@@ -80,6 +80,24 @@ Conflicts: %{_cross_os}settings-plugin(any)
 %description aws-ecs-4
 %{summary}.
 
+%package aws-mantle-1
+Summary: Settings plugin for the aws-mantle-1 variant
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1) or
+           %{_cross_os}variant(aws-mantle-1-fips) or
+           %{_cross_os}variant(aws-mantle-1-nvidia) or
+           %{_cross_os}variant(aws-mantle-1-nvidia-fips)
+           %{nil}})
+Provides: %{_cross_os}settings-plugin(any)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-nvidia)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-fips)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-nvidia-fips)
+Conflicts: %{_cross_os}settings-plugin(any)
+
+%description aws-mantle-1
+%{summary}.
+
 %package aws-k8s
 Summary: Settings plugin for the aws-k8s variants
 Requires: %{_cross_os}variant-family(aws-k8s)
@@ -175,6 +193,7 @@ Conflicts: %{_cross_os}settings-plugin(any)
   -p settings-plugin-aws-ecs-2 \
   -p settings-plugin-aws-ecs-3 \
   -p settings-plugin-aws-ecs-4 \
+  -p settings-plugin-aws-mantle-1 \
   -p settings-plugin-aws-k8s \
   -p settings-plugin-aws-k8s-nvidia \
   -p settings-plugin-metal-dev \
@@ -192,6 +211,7 @@ for plugin in \
   aws-ecs-2 \
   aws-ecs-3 \
   aws-ecs-4 \
+  aws-mantle-1 \
   aws-k8s-nvidia \
   aws-k8s \
   metal-dev \
@@ -235,6 +255,11 @@ done
 %{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-ecs-4.conf
 %{_cross_tmpfilesdir}/settings-plugin-aws-ecs-4.conf
 
+%files aws-mantle-1
+%{_cross_pluginsdir}/aws-mantle-1/libsettings.so
+%{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-mantle-1.conf
+%{_cross_tmpfilesdir}/settings-plugin-aws-mantle-1.conf
+
 %files aws-k8s
 %{_cross_pluginsdir}/aws-k8s/libsettings.so
 %{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-k8s.conf
diff --git a/sources/Cargo.lock b/sources/Cargo.lock
index 578573211e6..0c3f1c34f1c 100644
--- a/sources/Cargo.lock
+++ b/sources/Cargo.lock
@@ -2043,6 +2043,20 @@ dependencies = [
  "bottlerocket-defaults-helper",
 ]
 
+[[package]]
+name = "settings-defaults-aws-mantle-1"
+version = "0.1.0"
+dependencies = [
+ "bottlerocket-defaults-helper",
+]
+
+[[package]]
+name = "settings-defaults-aws-mantle-1-nvidia"
+version = "0.1.0"
+dependencies = [
+ "bottlerocket-defaults-helper",
+]
+
 [[package]]
 name = "settings-defaults-metal-dev"
 version = "0.1.0"
@@ -2498,6 +2512,17 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "settings-plugin-aws-mantle-1"
+version = "0.1.0"
+dependencies = [
+ "abi_stable",
+ "bottlerocket-settings-models",
+ "bottlerocket-settings-plugin",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "settings-plugin-metal-dev"
 version = "0.1.0"
diff --git a/sources/Cargo.toml b/sources/Cargo.toml
index f3318f335c0..5a92500b590 100644
--- a/sources/Cargo.toml
+++ b/sources/Cargo.toml
@@ -20,6 +20,8 @@ members = [
     "settings-defaults/aws-ecs-3-nvidia",
     "settings-defaults/aws-ecs-4",
     "settings-defaults/aws-ecs-4-nvidia",
+    "settings-defaults/aws-mantle-1",
+    "settings-defaults/aws-mantle-1-nvidia",
     "settings-defaults/aws-k8s-1.31",
     "settings-defaults/aws-k8s-1.31-nvidia",
     "settings-defaults/aws-k8s-1.32",
@@ -72,6 +74,7 @@ members = [
     "settings-plugins/aws-ecs-2",
     "settings-plugins/aws-ecs-3",
     "settings-plugins/aws-ecs-4",
+    "settings-plugins/aws-mantle-1",
     "settings-plugins/aws-k8s",
     "settings-plugins/aws-k8s-nvidia",
     "settings-plugins/metal-dev",
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml b/sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml
new file mode 100644
index 00000000000..f16d856d84d
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "settings-defaults-aws-mantle-1-nvidia"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+build = "../build-defaults.rs"
+
+[lib]
+path = "../defaults-toml.rs"
+
+[build-dependencies]
+bottlerocket-defaults-helper.workspace = true
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml
new file mode 120000
index 00000000000..a202ba61a4c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml
@@ -0,0 +1 @@
+../../../shared-defaults/defaults.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/11-network.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/11-network.toml
new file mode 120000
index 00000000000..fb68e80140f
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/11-network.toml
@@ -0,0 +1 @@
+../../../shared-defaults/network.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml
new file mode 120000
index 00000000000..4d404d663cd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-host-containers.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml
new file mode 120000
index 00000000000..7709ecb2ebd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-bootstrap-container.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml
new file mode 120000
index 00000000000..a33d541652c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml
@@ -0,0 +1 @@
+../../../shared-defaults/cf-signal.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml
new file mode 120000
index 00000000000..a6a17e88f54
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-creds.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml
new file mode 120000
index 00000000000..ccba8a8ac90
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml
@@ -0,0 +1 @@
+../../../shared-defaults/registry-metadata.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/52-new-variant.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/52-new-variant.toml
new file mode 120000
index 00000000000..f404c521255
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/52-new-variant.toml
@@ -0,0 +1 @@
+../../../shared-defaults/new-variant.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/54-pki.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/54-pki.toml
new file mode 120000
index 00000000000..e33a1437046
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/54-pki.toml
@@ -0,0 +1 @@
+../../../shared-defaults/pki.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml
new file mode 120000
index 00000000000..b4d93f54799
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml
new file mode 120000
index 00000000000..cced543330e
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml
@@ -0,0 +1 @@
+../../../shared-defaults/lockdown-none.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml
new file mode 120000
index 00000000000..e7b73c620dd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-hooks.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/76-oci-defaults-capabilities.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/76-oci-defaults-capabilities.toml
new file mode 120000
index 00000000000..100c2874090
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/76-oci-defaults-capabilities.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-defaults-capabilities.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/77-oci-defaults-docker-resource-limits.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/77-oci-defaults-docker-resource-limits.toml
new file mode 120000
index 00000000000..24b077b8362
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/77-oci-defaults-docker-resource-limits.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-defaults-docker-resource-limits.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/Cargo.toml b/sources/settings-defaults/aws-mantle-1/Cargo.toml
new file mode 100644
index 00000000000..1c173f0ee5d
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "settings-defaults-aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+build = "../build-defaults.rs"
+
+[lib]
+path = "../defaults-toml.rs"
+
+[build-dependencies]
+bottlerocket-defaults-helper.workspace = true
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml
new file mode 120000
index 00000000000..a202ba61a4c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml
@@ -0,0 +1 @@
+../../../shared-defaults/defaults.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/11-network.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/11-network.toml
new file mode 120000
index 00000000000..fb68e80140f
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/11-network.toml
@@ -0,0 +1 @@
+../../../shared-defaults/network.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml
new file mode 120000
index 00000000000..4d404d663cd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-host-containers.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml
new file mode 120000
index 00000000000..7709ecb2ebd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-bootstrap-container.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml
new file mode 120000
index 00000000000..a33d541652c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml
@@ -0,0 +1 @@
+../../../shared-defaults/cf-signal.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/40-aws-creds.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/40-aws-creds.toml
new file mode 120000
index 00000000000..a6a17e88f54
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/40-aws-creds.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-creds.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/51-registry-metadata.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/51-registry-metadata.toml
new file mode 120000
index 00000000000..ccba8a8ac90
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/51-registry-metadata.toml
@@ -0,0 +1 @@
+../../../shared-defaults/registry-metadata.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/52-new-variant.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/52-new-variant.toml
new file mode 120000
index 00000000000..f404c521255
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/52-new-variant.toml
@@ -0,0 +1 @@
+../../../shared-defaults/new-variant.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/53-pki.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/53-pki.toml
new file mode 120000
index 00000000000..e33a1437046
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/53-pki.toml
@@ -0,0 +1 @@
+../../../shared-defaults/pki.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/55-image-verification.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/55-image-verification.toml
new file mode 120000
index 00000000000..b4d93f54799
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/55-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/60-lockdown-integrity.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/60-lockdown-integrity.toml
new file mode 120000
index 00000000000..8b4de873a39
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/60-lockdown-integrity.toml
@@ -0,0 +1 @@
+../../../shared-defaults/lockdown-integrity.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/70-oci-hooks.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/70-oci-hooks.toml
new file mode 120000
index 00000000000..e7b73c620dd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/70-oci-hooks.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-hooks.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/76-oci-defaults-capabilities.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/76-oci-defaults-capabilities.toml
new file mode 120000
index 00000000000..100c2874090
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/76-oci-defaults-capabilities.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-defaults-capabilities.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/77-oci-defaults-docker-resource-limits.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/77-oci-defaults-docker-resource-limits.toml
new file mode 120000
index 00000000000..24b077b8362
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/77-oci-defaults-docker-resource-limits.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-defaults-docker-resource-limits.toml
\ No newline at end of file
diff --git a/sources/settings-plugins/aws-mantle-1/Cargo.toml b/sources/settings-plugins/aws-mantle-1/Cargo.toml
new file mode 100644
index 00000000000..14bd451e6c1
--- /dev/null
+++ b/sources/settings-plugins/aws-mantle-1/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "settings-plugin-aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+name = "settings_aws_mantle_1"
+
+[dependencies]
+abi_stable.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+
+# settings plugins
+bottlerocket-settings-models.workspace = true
+bottlerocket-settings-plugin.workspace = true
diff --git a/sources/settings-plugins/aws-mantle-1/src/lib.rs b/sources/settings-plugins/aws-mantle-1/src/lib.rs
new file mode 100644
index 00000000000..5bf60bc9b80
--- /dev/null
+++ b/sources/settings-plugins/aws-mantle-1/src/lib.rs
@@ -0,0 +1,22 @@
+use bottlerocket_settings_models::model_derive::model;
+use bottlerocket_settings_plugin::SettingsPlugin;
+
+#[derive(SettingsPlugin)]
+#[model(rename = "settings", impl_default = true)]
+struct AwsMantle1Settings {
+    motd: bottlerocket_settings_models::MotdV1,
+    host_containers: bottlerocket_settings_models::HostContainersSettingsV1,
+    bootstrap_commands: bottlerocket_settings_models::BootstrapCommandsSettingsV1,
+    bootstrap_containers: bottlerocket_settings_models::BootstrapContainersSettingsV1,
+    ntp: bottlerocket_settings_models::NtpSettingsV1,
+    network: bottlerocket_settings_models::NetworkSettingsV1,
+    kernel: bottlerocket_settings_models::KernelSettingsV1,
+    aws: bottlerocket_settings_models::AwsSettingsV1,
+    pki: bottlerocket_settings_models::PkiSettingsV1,
+    container_registry: bottlerocket_settings_models::RegistrySettingsV1,
+    oci_defaults: bottlerocket_settings_models::OciDefaultsV1,
+    oci_hooks: bottlerocket_settings_models::OciHooksSettingsV1,
+    cloudformation: bottlerocket_settings_models::CloudFormationSettingsV1,
+    dns: bottlerocket_settings_models::DnsSettingsV1,
+    image_verifier_plugins: bottlerocket_settings_models::ImageVerifierPluginsSettingsV1,
+}
diff --git a/sources/shared-defaults/network.toml b/sources/shared-defaults/network.toml
new file mode 100644
index 00000000000..ed0bed18650
--- /dev/null
+++ b/sources/shared-defaults/network.toml
@@ -0,0 +1,2 @@
+[metadata.settings.network]
+affected-services = ["containerd", "host-containerd", "host-containers"]
diff --git a/sources/shared-defaults/new-variant.toml b/sources/shared-defaults/new-variant.toml
new file mode 100644
index 00000000000..f0bf2f2dd2d
--- /dev/null
+++ b/sources/shared-defaults/new-variant.toml
@@ -0,0 +1,7 @@
+# Network
+[metadata.settings.network]
+affected-services = ["containerd", "host-containerd", "host-containers", "updog"]
+
+# Image registry credentials
+[metadata.settings.container-registry.credentials]
+affected-services = ["host-containers", "bootstrap-containers", "thar-be-registries"]
diff --git a/sources/shared-defaults/pki.toml b/sources/shared-defaults/pki.toml
new file mode 100644
index 00000000000..7e7def4e5fc
--- /dev/null
+++ b/sources/shared-defaults/pki.toml
@@ -0,0 +1,2 @@
+[metadata.settings.pki]
+affected-services = ["pki"]
diff --git a/sources/shared-defaults/registry-metadata.toml b/sources/shared-defaults/registry-metadata.toml
new file mode 100644
index 00000000000..3cef5ddc400
--- /dev/null
+++ b/sources/shared-defaults/registry-metadata.toml
@@ -0,0 +1,12 @@
+# Image registries. Retained for backwards compatibility, but superseded by the
+# more specific metadata for mirrors and credentials.
+[metadata.settings.container-registry]
+affected-services = ["host-containers", "bootstrap-containers", "thar-be-registries"]
+
+# Image registry mirrors
+[metadata.settings.container-registry.mirrors]
+affected-services = ["host-containers", "bootstrap-containers", "thar-be-registries"]
+
+# Image registry credentials
+[metadata.settings.container-registry.credentials]
+affected-services = ["host-containers", "bootstrap-containers", "thar-be-registries"]
diff --git a/variants/aws-mantle-1-fips/Cargo.toml b/variants/aws-mantle-1-fips/Cargo.toml
new file mode 100644
index 00000000000..01df9be79cc
--- /dev/null
+++ b/variants/aws-mantle-1-fips/Cargo.toml
@@ -0,0 +1,54 @@
+[package]
+name = "aws-mantle-1-fips"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+in-place-updates = false
+ephemeral-encryption-keys = true
+fips = true
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+]
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "fips=1",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1-fips/amispec.toml b/variants/aws-mantle-1-fips/amispec.toml
new file mode 100644
index 00000000000..023761c93e5
--- /dev/null
+++ b/variants/aws-mantle-1-fips/amispec.toml
@@ -0,0 +1,11 @@
+description = "This variant is in preview. It contains the newly released Docker v29.0.0 along with features related to image verification and encrypted storage."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"
diff --git a/variants/aws-mantle-1-nvidia-fips/Cargo.toml b/variants/aws-mantle-1-nvidia-fips/Cargo.toml
new file mode 100644
index 00000000000..0e89fd71514
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia-fips/Cargo.toml
@@ -0,0 +1,61 @@
+[package]
+name = "aws-mantle-1-nvidia-fips"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+ephemeral-encryption-keys = true
+fips = true
+in-place-updates = false
+
+[package.metadata.build-variant.image-layout]
+os-image-size-gib = 4
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+# NVIDIA support
+    "nvidia-container-toolkit-ecs",
+    "kmod-6.18-nvidia-r580-tesla",
+    "kmod-6.18-nvidia-r580-gdrcopy",
+    "kmod-6.18-nvidia-r580-imex-config",
+]
+
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "fips=1",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1-nvidia-fips/amispec.toml b/variants/aws-mantle-1-nvidia-fips/amispec.toml
new file mode 100644
index 00000000000..023761c93e5
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia-fips/amispec.toml
@@ -0,0 +1,11 @@
+description = "This variant is in preview. It contains the newly released Docker v29.0.0 along with features related to image verification and encrypted storage."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"
diff --git a/variants/aws-mantle-1-nvidia/Cargo.toml b/variants/aws-mantle-1-nvidia/Cargo.toml
new file mode 100644
index 00000000000..5f7217268e2
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia/Cargo.toml
@@ -0,0 +1,59 @@
+[package]
+name = "aws-mantle-1-nvidia"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+ephemeral-encryption-keys = true
+in-place-updates = false
+
+[package.metadata.build-variant.image-layout]
+os-image-size-gib = 4
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+# NVIDIA support
+    "nvidia-container-toolkit-ecs",
+    "kmod-6.18-nvidia-r580-tesla",
+    "kmod-6.18-nvidia-r580-gdrcopy",
+    "kmod-6.18-nvidia-r580-imex-config",
+]
+
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1-nvidia/amispec.toml b/variants/aws-mantle-1-nvidia/amispec.toml
new file mode 100644
index 00000000000..023761c93e5
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia/amispec.toml
@@ -0,0 +1,11 @@
+description = "This variant is in preview. It contains the newly released Docker v29.0.0 along with features related to image verification and encrypted storage."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"
diff --git a/variants/aws-mantle-1/Cargo.toml b/variants/aws-mantle-1/Cargo.toml
new file mode 100644
index 00000000000..c7b29470689
--- /dev/null
+++ b/variants/aws-mantle-1/Cargo.toml
@@ -0,0 +1,52 @@
+[package]
+name = "aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+in-place-updates = false
+ephemeral-encryption-keys = true
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+]
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1/amispec.toml b/variants/aws-mantle-1/amispec.toml
new file mode 100644
index 00000000000..023761c93e5
--- /dev/null
+++ b/variants/aws-mantle-1/amispec.toml
@@ -0,0 +1,11 @@
+description = "This variant is in preview. It contains the newly released Docker v29.0.0 along with features related to image verification and encrypted storage."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"