diff --git a/Makefile b/Makefile
index f80a6d962..d0afcf82c 100644
--- a/Makefile
+++ b/Makefile
@@ -75,6 +75,7 @@ TARGETS += \
 	drbd-pkg \
 	gasket-driver-pkg \
 	nvidia-open-gpu-kernel-modules-pkg \
+	thunderbolt-pkg \
 	zfs-pkg \
 
 # Temporarily disabled until mellanox builds with Linux 6.1
diff --git a/kernel/build/config-amd64 b/kernel/build/config-amd64
index 2090eccb7..e6195419c 100644
--- a/kernel/build/config-amd64
+++ b/kernel/build/config-amd64
@@ -1928,7 +1928,8 @@ CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y
 # CONFIG_EFI_BOOTLOADER_CONTROL is not set
 # CONFIG_EFI_CAPSULE_LOADER is not set
 # CONFIG_EFI_TEST is not set
-# CONFIG_APPLE_PROPERTIES is not set
+CONFIG_EFI_DEV_PATH_PARSER=y
+CONFIG_APPLE_PROPERTIES=y
 # CONFIG_RESET_ATTACK_MITIGATION is not set
 # CONFIG_EFI_RCI2_TABLE is not set
 # CONFIG_EFI_DISABLE_PCI_DMA is not set
@@ -2794,6 +2795,7 @@ CONFIG_IEEE802154_DRIVERS=y
 CONFIG_XEN_NETDEV_FRONTEND=y
 CONFIG_VMXNET3=y
 # CONFIG_FUJITSU_ES is not set
+CONFIG_USB4_NET=m
 CONFIG_HYPERV_NET=y
 # CONFIG_NETDEVSIM is not set
 CONFIG_NET_FAILOVER=y
@@ -4872,7 +4874,9 @@ CONFIG_PWM_SYSFS=y
 # end of Performance monitor support
 
 CONFIG_RAS=y
-# CONFIG_USB4 is not set
+CONFIG_USB4=m
+# CONFIG_USB4_DEBUGFS_WRITE is not set
+# CONFIG_USB4_DMA_TEST is not set
 
 #
 # Android
diff --git a/kernel/build/config-arm64 b/kernel/build/config-arm64
index 1d7b26520..07960d990 100644
--- a/kernel/build/config-arm64
+++ b/kernel/build/config-arm64
@@ -3177,6 +3177,7 @@ CONFIG_IEEE802154_DRIVERS=y
 CONFIG_XEN_NETDEV_FRONTEND=y
 CONFIG_VMXNET3=y
 # CONFIG_FUJITSU_ES is not set
+CONFIG_USB4_NET=m
 CONFIG_HYPERV_NET=y
 # CONFIG_NETDEVSIM is not set
 CONFIG_NET_FAILOVER=y
@@ -7364,7 +7365,9 @@ CONFIG_THUNDERX2_PMU=y
 # end of Performance monitor support
 
 CONFIG_RAS=y
-# CONFIG_USB4 is not set
+CONFIG_USB4=m
+# CONFIG_USB4_DEBUGFS_WRITE is not set
+# CONFIG_USB4_DMA_TEST is not set
 
 #
 # Android
diff --git a/thunderbolt/files/modules.txt b/thunderbolt/files/modules.txt
new file mode 100644
index 000000000..4ad4e5ac4
--- /dev/null
+++ b/thunderbolt/files/modules.txt
@@ -0,0 +1,5 @@
+modules.order
+modules.builtin
+modules.builtin.modinfo
+kernel/drivers/thunderbolt/thunderbolt.ko
+kernel/drivers/net/thunderbolt-net.ko
diff --git a/thunderbolt/pkg.yaml b/thunderbolt/pkg.yaml
new file mode 100644
index 000000000..b7b62e9dc
--- /dev/null
+++ b/thunderbolt/pkg.yaml
@@ -0,0 +1,23 @@
+name: thunderbolt-pkg
+variant: scratch
+shell: /toolchain/bin/bash
+dependencies:
+  - stage: base
+    runtime: true
+  - stage: kernel
+steps:
+  - env:
+      ARCH: {{ if eq .ARCH "aarch64"}}arm64{{ else if eq .ARCH "x86_64" }}x86_64{{ else }}unsupported{{ end }}
+    install:
+      - |
+        export KERNELRELEASE="{{ .linux_version }}-talos"
+
+        xargs -a /pkg/files/modules.txt -I {} install -D /lib/modules/${KERNELRELEASE}/{} /rootfs/lib/modules/${KERNELRELEASE}/{}
+        depmod -b /rootfs ${KERNELRELEASE}
+    test:
+      - |
+        # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
+        find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+finalize:
+  - from: /rootfs
+    to: /