diff --git a/Dockerfile b/Dockerfile
index a551758301..924dc49171 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -127,6 +127,7 @@ ARG CGO_ENABLED
 ENV CGO_ENABLED ${CGO_ENABLED}
 ENV GOCACHE /.cache/go-build
 ENV GOMODCACHE /.cache/mod
+ENV PROTOTOOL_CACHE_PATH /.cache/prototool
 ARG SOURCE_DATE_EPOCH
 ENV SOURCE_DATE_EPOCH ${SOURCE_DATE_EPOCH}
 WORKDIR /src
@@ -144,7 +145,18 @@ RUN --mount=type=cache,target=/.cache go mod verify
 
 # The generate target generates code from protobuf service definitions and machinery config.
 
+# format protobuf service definitions
+FROM build AS proto-format-build
+WORKDIR /src/api
+COPY api .
+RUN --mount=type=cache,target=/.cache prototool format --overwrite --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
+
+FROM --platform=${BUILDPLATFORM} scratch AS fmt-protobuf
+COPY --from=proto-format-build /src/api/ /api/
+
+# compile protobuf service definitions
 FROM build AS generate-build
+COPY --from=proto-format-build /src/api /api/
 # Common needs to be at or near the top to satisfy the subsequent imports
 COPY ./api/vendor/ /api/vendor/
 COPY ./api/common/common.proto /api/common/common.proto
@@ -179,6 +191,7 @@ RUN --mount=type=cache,target=/.cache go generate ./...
 RUN gofumports -w -local github.com/talos-systems/talos ./
 
 FROM --platform=${BUILDPLATFORM} scratch AS generate
+COPY --from=proto-format-build /src/api /api/
 COPY --from=generate-build /api/common/*.pb.go /pkg/machinery/api/common/
 COPY --from=generate-build /api/security/*.pb.go /pkg/machinery/api/security/
 COPY --from=generate-build /api/machine/*.pb.go /pkg/machinery/api/machine/
@@ -627,7 +640,6 @@ RUN --mount=type=cache,target=/.cache FILES="$(gofumports -l -local github.com/t
 FROM base AS lint-protobuf
 WORKDIR /src/api
 COPY api .
-COPY prototool.yaml .
 RUN prototool lint --protoc-bin-path=/toolchain/bin/protoc --protoc-wkt-path=/toolchain/include
 
 # The markdownlint target performs linting on Markdown files.
diff --git a/Makefile b/Makefile
index d629a18528..6e3b01a173 100644
--- a/Makefile
+++ b/Makefile
@@ -262,10 +262,15 @@ cloud-images: ## Uploads cloud images (AMIs, etc.) to the cloud registry.
 
 # Code Quality
 
-.PHONY: fmt
-fmt: ## Formats the source code.
+fmt-go: ## Formats the source code.
 	@docker run --rm -it -v $(PWD):/src -w /src golang:$(GO_VERSION) bash -c "go install mvdan.cc/gofumpt/gofumports@$(GOFUMPT_VERSION) && gofumports -w -local github.com/talos-systems/talos ."
 
+fmt-protobuf: ## Formats protobuf files.
+	@$(MAKE) local-fmt-protobuf DEST=./ PLATFORM=linux/amd64
+
+fmt: ## Formats the source code and protobuf files.
+	@$(MAKE) fmt-go fmt-protobuf
+
 lint-%: ## Runs the specified linter. Valid options are go, protobuf, and markdown (e.g. lint-go).
 	@$(MAKE) target-lint-$* PLATFORM=linux/amd64
 
diff --git a/api/cluster/cluster.proto b/api/cluster/cluster.proto
index ad14debc51..84980aae43 100644
--- a/api/cluster/cluster.proto
+++ b/api/cluster/cluster.proto
@@ -4,8 +4,8 @@ package cluster;
 
 option go_package = "github.com/talos-systems/talos/pkg/machinery/api/cluster";
 
-import "google/protobuf/duration.proto";
 import "common/common.proto";
+import "google/protobuf/duration.proto";
 
 // The cluster service definition.
 service ClusterService {
@@ -13,12 +13,12 @@ service ClusterService {
 }
 
 message HealthCheckRequest {
-    google.protobuf.Duration wait_timeout = 1;
-    ClusterInfo cluster_info = 2;
+  google.protobuf.Duration wait_timeout = 1;
+  ClusterInfo cluster_info = 2;
 }
 
 message ClusterInfo {
-  repeated string control_plane_nodes  = 1;
+  repeated string control_plane_nodes = 1;
   repeated string worker_nodes = 2;
   string force_endpoint = 3;
 }
diff --git a/api/common/common.proto b/api/common/common.proto
index e129a63c97..1b958ef732 100644
--- a/api/common/common.proto
+++ b/api/common/common.proto
@@ -34,11 +34,17 @@ message Data {
   bytes bytes = 2;
 }
 
-message DataResponse { repeated Data messages = 1; }
+message DataResponse {
+  repeated Data messages = 1;
+}
 
-message Empty { Metadata metadata = 1; }
+message Empty {
+  Metadata metadata = 1;
+}
 
-message EmptyResponse { repeated Empty messages = 1; }
+message EmptyResponse {
+  repeated Empty messages = 1;
+}
 
 enum ContainerDriver {
   CONTAINERD = 0;
diff --git a/api/inspect/inspect.proto b/api/inspect/inspect.proto
index c2b9b45b7a..e712b8b1ff 100644
--- a/api/inspect/inspect.proto
+++ b/api/inspect/inspect.proto
@@ -4,8 +4,8 @@ package inspect;
 
 option go_package = "github.com/talos-systems/talos/pkg/machinery/api/inspect";
 
-import "google/protobuf/empty.proto";
 import "common/common.proto";
+import "google/protobuf/empty.proto";
 
 // The inspect service definition.
 //
@@ -16,26 +16,26 @@ service InspectService {
 
 // The ControllerRuntimeDependency message contains the graph of controller-resource dependencies.
 message ControllerRuntimeDependency {
-    common.Metadata metadata = 1;
-    repeated ControllerDependencyEdge edges = 2;
+  common.Metadata metadata = 1;
+  repeated ControllerDependencyEdge edges = 2;
 }
 
-message ControllerRuntimeDependenciesResponse { repeated ControllerRuntimeDependency messages = 1; }
+message ControllerRuntimeDependenciesResponse {
+  repeated ControllerRuntimeDependency messages = 1;
+}
 
 enum DependencyEdgeType {
-    OUTPUT_EXCLUSIVE = 0;
-    OUTPUT_SHARED = 3;
-    INPUT_STRONG = 1;
-    INPUT_WEAK = 2;
-    INPUT_DESTROY_READY = 4;
+  OUTPUT_EXCLUSIVE = 0;
+  OUTPUT_SHARED = 3;
+  INPUT_STRONG = 1;
+  INPUT_WEAK = 2;
+  INPUT_DESTROY_READY = 4;
 }
 
 message ControllerDependencyEdge {
-    string controller_name = 1;
-
-    DependencyEdgeType edge_type = 2;
-
-    string resource_namespace = 3;
-    string resource_type = 4;
-    string resource_id = 5;
+  string controller_name = 1;
+  DependencyEdgeType edge_type = 2;
+  string resource_namespace = 3;
+  string resource_type = 4;
+  string resource_id = 5;
 }
diff --git a/api/machine/machine.proto b/api/machine/machine.proto
index 199ae6e9a1..a4e876837e 100644
--- a/api/machine/machine.proto
+++ b/api/machine/machine.proto
@@ -4,26 +4,22 @@ package machine;
 
 option go_package = "github.com/talos-systems/talos/pkg/machinery/api/machine";
 
+import "common/common.proto";
 import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
 import "google/protobuf/empty.proto";
 import "google/protobuf/timestamp.proto";
-import "google/protobuf/duration.proto";
-import "common/common.proto";
 
 // The machine service definition.
 service MachineService {
-  rpc ApplyConfiguration(ApplyConfigurationRequest)
-      returns (ApplyConfigurationResponse);
-
+  rpc ApplyConfiguration(ApplyConfigurationRequest) returns (ApplyConfigurationResponse);
   // Bootstrap method makes control plane node enter etcd bootstrap mode.
   //
   // Node aborts etcd join sequence and creates single-node etcd cluster.
   //
   // If recover_etcd argument is specified, etcd is recovered from a snapshot
   // uploaded with EtcdRecover.
-
   rpc Bootstrap(BootstrapRequest) returns (BootstrapResponse);
-
   rpc Containers(ContainersRequest) returns (ContainersResponse);
   rpc Copy(CopyRequest) returns (stream common.Data);
   rpc CPUInfo(google.protobuf.Empty) returns (CPUInfoResponse);
@@ -31,27 +27,20 @@ service MachineService {
   rpc Dmesg(DmesgRequest) returns (stream common.Data);
   rpc Events(EventsRequest) returns (stream Event);
   rpc EtcdMemberList(EtcdMemberListRequest) returns (EtcdMemberListResponse);
-  rpc EtcdRemoveMember(EtcdRemoveMemberRequest)
-      returns (EtcdRemoveMemberResponse);
-  rpc EtcdLeaveCluster(EtcdLeaveClusterRequest)
-      returns (EtcdLeaveClusterResponse);
-  rpc EtcdForfeitLeadership(EtcdForfeitLeadershipRequest)
-      returns (EtcdForfeitLeadershipResponse);
-
+  rpc EtcdRemoveMember(EtcdRemoveMemberRequest) returns (EtcdRemoveMemberResponse);
+  rpc EtcdLeaveCluster(EtcdLeaveClusterRequest) returns (EtcdLeaveClusterResponse);
+  rpc EtcdForfeitLeadership(EtcdForfeitLeadershipRequest) returns (EtcdForfeitLeadershipResponse);
   // EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot
   // to the node.
   //
   // Snapshot can be later used to recover the cluster via Bootstrap method.
   rpc EtcdRecover(stream common.Data) returns (EtcdRecoverResponse);
-
   // EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance
   // and streams it back to the client.
   //
   // This method is available only on control plane nodes (which run etcd).
   rpc EtcdSnapshot(EtcdSnapshotRequest) returns (stream common.Data);
-
-  rpc GenerateConfiguration(GenerateConfigurationRequest)
-      returns (GenerateConfigurationResponse);
+  rpc GenerateConfiguration(GenerateConfigurationRequest) returns (GenerateConfigurationResponse);
   rpc Hostname(google.protobuf.Empty) returns (HostnameResponse);
   rpc Kubeconfig(google.protobuf.Empty) returns (stream common.Data);
   rpc List(ListRequest) returns (stream FileInfo);
@@ -60,8 +49,7 @@ service MachineService {
   rpc Logs(LogsRequest) returns (stream common.Data);
   rpc Memory(google.protobuf.Empty) returns (MemoryResponse);
   rpc Mounts(google.protobuf.Empty) returns (MountsResponse);
-  rpc NetworkDeviceStats(google.protobuf.Empty)
-      returns (NetworkDeviceStatsResponse);
+  rpc NetworkDeviceStats(google.protobuf.Empty) returns (NetworkDeviceStatsResponse);
   rpc Processes(google.protobuf.Empty) returns (ProcessesResponse);
   rpc Read(ReadRequest) returns (stream common.Data);
   rpc Reboot(google.protobuf.Empty) returns (RebootResponse);
@@ -77,7 +65,6 @@ service MachineService {
   rpc SystemStat(google.protobuf.Empty) returns (SystemStatResponse);
   rpc Upgrade(UpgradeRequest) returns (UpgradeResponse);
   rpc Version(google.protobuf.Empty) returns (VersionResponse);
-
   // GenerateClientConfiguration generates talosctl client configuration (talosconfig).
   rpc GenerateClientConfiguration(GenerateClientConfigurationRequest) returns (GenerateClientConfigurationResponse);
 }
@@ -97,12 +84,20 @@ message ApplyConfiguration {
   // Configuration validation warnings.
   repeated string warnings = 2;
 }
-message ApplyConfigurationResponse { repeated ApplyConfiguration messages = 1; }
+
+message ApplyConfigurationResponse {
+  repeated ApplyConfiguration messages = 1;
+}
 
 // rpc reboot
 // The reboot message containing the reboot status.
-message Reboot { common.Metadata metadata = 1; }
-message RebootResponse { repeated Reboot messages = 1; }
+message Reboot {
+  common.Metadata metadata = 1;
+}
+
+message RebootResponse {
+  repeated Reboot messages = 1;
+}
 
 // rpc Bootstrap
 message BootstrapRequest {
@@ -117,8 +112,13 @@ message BootstrapRequest {
 }
 
 // The bootstrap message containing the bootstrap status.
-message Bootstrap { common.Metadata metadata = 1; }
-message BootstrapResponse { repeated Bootstrap messages = 1; }
+message Bootstrap {
+  common.Metadata metadata = 1;
+}
+
+message BootstrapResponse {
+  repeated Bootstrap messages = 1;
+}
 
 // rpc events
 message SequenceEvent {
@@ -161,26 +161,25 @@ message ServiceStateEvent {
     FINISHED = 5;
     FAILED = 6;
     SKIPPED = 7;
-  };
+  }
   Action action = 2;
   string message = 3;
   ServiceHealth health = 4;
-};
+}
 
 message RestartEvent {
   int64 cmd = 1;
-};
+}
 
 // ConfigLoadErrorEvent is reported when the config loading has failed.
 message ConfigLoadErrorEvent {
   string error = 1;
-};
-
+}
 
 // ConfigValidationErrorEvent is reported when config validation has failed.
 message ConfigValidationErrorEvent {
   string error = 1;
-};
+}
 
 // AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname.
 message AddressEvent {
@@ -218,13 +217,23 @@ message ResetRequest {
 }
 
 // The reset message containing the restart status.
-message Reset { common.Metadata metadata = 1; }
-message ResetResponse { repeated Reset messages = 1; }
+message Reset {
+  common.Metadata metadata = 1;
+}
+
+message ResetResponse {
+  repeated Reset messages = 1;
+}
 
 // rpc shutdown
 // The messages message containing the shutdown status.
-message Shutdown { common.Metadata metadata = 1; }
-message ShutdownResponse { repeated Shutdown messages = 1; }
+message Shutdown {
+  common.Metadata metadata = 1;
+}
+
+message ShutdownResponse {
+  repeated Shutdown messages = 1;
+}
 
 // rpc upgrade
 message UpgradeRequest {
@@ -238,14 +247,20 @@ message Upgrade {
   common.Metadata metadata = 1;
   string ack = 2;
 }
-message UpgradeResponse { repeated Upgrade messages = 1; }
+
+message UpgradeResponse {
+  repeated Upgrade messages = 1;
+}
 
 // rpc servicelist
 message ServiceList {
   common.Metadata metadata = 1;
   repeated ServiceInfo services = 2;
 }
-message ServiceListResponse { repeated ServiceList messages = 1; }
+
+message ServiceListResponse {
+  repeated ServiceList messages = 1;
+}
 
 message ServiceInfo {
   string id = 1;
@@ -254,7 +269,9 @@ message ServiceInfo {
   ServiceHealth health = 4;
 }
 
-message ServiceEvents { repeated ServiceEvent events = 1; }
+message ServiceEvents {
+  repeated ServiceEvent events = 1;
+}
 
 message ServiceEvent {
   string msg = 1;
@@ -270,29 +287,44 @@ message ServiceHealth {
 }
 
 // rpc servicestart
-message ServiceStartRequest { string id = 1; }
+message ServiceStartRequest {
+  string id = 1;
+}
 
 message ServiceStart {
   common.Metadata metadata = 1;
   string resp = 2;
 }
-message ServiceStartResponse { repeated ServiceStart messages = 1; }
 
-message ServiceStopRequest { string id = 1; }
+message ServiceStartResponse {
+  repeated ServiceStart messages = 1;
+}
+
+message ServiceStopRequest {
+  string id = 1;
+}
 
 message ServiceStop {
   common.Metadata metadata = 1;
   string resp = 2;
 }
-message ServiceStopResponse { repeated ServiceStop messages = 1; }
 
-message ServiceRestartRequest { string id = 1; }
+message ServiceStopResponse {
+  repeated ServiceStop messages = 1;
+}
+
+message ServiceRestartRequest {
+  string id = 1;
+}
 
 message ServiceRestart {
   common.Metadata metadata = 1;
   string resp = 2;
 }
-message ServiceRestartResponse { repeated ServiceRestart messages = 1; }
+
+message ServiceRestartResponse {
+  repeated ServiceRestart messages = 1;
+}
 
 message StartRequest {
   option deprecated = true;
@@ -370,7 +402,7 @@ message FileInfo {
   // Mode is the bitmap of UNIX mode/permission flags of the file
   uint32 mode = 4;
   // Modified indicates the UNIX timestamp at which the file was last modified
-  int64 modified = 5; // TODO: unix timestamp or include proto's Date type
+  int64 modified = 5;
   // IsDir indicates that the file is a directory
   bool is_dir = 6;
   // Error describes any error encountered while trying to read the file
@@ -405,7 +437,10 @@ message Mounts {
   common.Metadata metadata = 1;
   repeated MountStat stats = 2;
 }
-message MountsResponse { repeated Mounts messages = 1; }
+
+message MountsResponse {
+  repeated Mounts messages = 1;
+}
 
 // The messages message containing the requested processes.
 message MountStat {
@@ -423,7 +458,9 @@ message Version {
   FeaturesInfo features = 4;
 }
 
-message VersionResponse { repeated Version messages = 1; }
+message VersionResponse {
+  repeated Version messages = 1;
+}
 
 message VersionInfo {
   string tag = 1;
@@ -456,13 +493,20 @@ message LogsRequest {
   int32 tail_lines = 5;
 }
 
-message ReadRequest { string path = 1; }
+message ReadRequest {
+  string path = 1;
+}
 
 // rpc rollback
 message RollbackRequest {}
 
-message Rollback { common.Metadata metadata = 1; }
-message RollbackResponse { repeated Rollback messages = 1; }
+message Rollback {
+  common.Metadata metadata = 1;
+}
+
+message RollbackResponse {
+  repeated Rollback messages = 1;
+}
 
 // rpc Containers
 
@@ -489,7 +533,9 @@ message Container {
   repeated ContainerInfo containers = 2;
 }
 
-message ContainersResponse { repeated Container messages = 1; }
+message ContainersResponse {
+  repeated Container messages = 1;
+}
 
 // dmesg
 message DmesgRequest {
@@ -498,7 +544,9 @@ message DmesgRequest {
 }
 
 // rpc processes
-message ProcessesResponse { repeated Process messages = 1; }
+message ProcessesResponse {
+  repeated Process messages = 1;
+}
 
 message Process {
   common.Metadata metadata = 1;
@@ -527,10 +575,14 @@ message RestartRequest {
   common.ContainerDriver driver = 3;
 }
 
-message Restart { common.Metadata metadata = 1; }
+message Restart {
+  common.Metadata metadata = 1;
+}
 
 // The messages message containing the restart status.
-message RestartResponse { repeated Restart messages = 1; }
+message RestartResponse {
+  repeated Restart messages = 1;
+}
 
 // rpc stats
 
@@ -547,7 +599,9 @@ message Stats {
   repeated Stat stats = 2;
 }
 
-message StatsResponse { repeated Stats messages = 1; }
+message StatsResponse {
+  repeated Stats messages = 1;
+}
 
 // The messages message containing the requested stat.
 message Stat {
@@ -564,7 +618,9 @@ message Memory {
   MemInfo meminfo = 2;
 }
 
-message MemoryResponse { repeated Memory messages = 1; }
+message MemoryResponse {
+  repeated Memory messages = 1;
+}
 
 message MemInfo {
   uint64 memtotal = 1;
@@ -619,7 +675,9 @@ message MemInfo {
 
 // rpc Hostname
 
-message HostnameResponse { repeated Hostname messages = 1; }
+message HostnameResponse {
+  repeated Hostname messages = 1;
+}
 
 message Hostname {
   common.Metadata metadata = 1;
@@ -628,7 +686,9 @@ message Hostname {
 
 // rpc LoadAvg
 
-message LoadAvgResponse { repeated LoadAvg messages = 1; }
+message LoadAvgResponse {
+  repeated LoadAvg messages = 1;
+}
 
 message LoadAvg {
   common.Metadata metadata = 1;
@@ -639,7 +699,9 @@ message LoadAvg {
 
 // rpc SystemStat
 
-message SystemStatResponse { repeated SystemStat messages = 1; }
+message SystemStatResponse {
+  repeated SystemStat messages = 1;
+}
 
 message SystemStat {
   common.Metadata metadata = 1;
@@ -684,7 +746,9 @@ message SoftIRQStat {
 
 // rpc CPUInfo
 
-message CPUInfoResponse { repeated CPUsInfo messages = 1; }
+message CPUInfoResponse {
+  repeated CPUsInfo messages = 1;
+}
 
 message CPUsInfo {
   common.Metadata metadata = 1;
@@ -722,7 +786,9 @@ message CPUInfo {
 
 // rpc NetworkDeviceStats
 
-message NetworkDeviceStatsResponse { repeated NetworkDeviceStats messages = 1; }
+message NetworkDeviceStatsResponse {
+  repeated NetworkDeviceStats messages = 1;
+}
 
 message NetworkDeviceStats {
   common.Metadata metadata = 1;
@@ -752,7 +818,9 @@ message NetDev {
 
 // rpc DiskStats
 
-message DiskStatsResponse { repeated DiskStats messages = 1; }
+message DiskStatsResponse {
+  repeated DiskStats messages = 1;
+}
 
 message DiskStats {
   common.Metadata metadata = 1;
@@ -780,20 +848,34 @@ message DiskStat {
 }
 
 message EtcdLeaveClusterRequest {}
-message EtcdLeaveCluster { common.Metadata metadata = 1; }
-message EtcdLeaveClusterResponse { repeated EtcdLeaveCluster messages = 1; }
+
+message EtcdLeaveCluster {
+  common.Metadata metadata = 1;
+}
+
+message EtcdLeaveClusterResponse {
+  repeated EtcdLeaveCluster messages = 1;
+}
 
 message EtcdRemoveMemberRequest {
   string member = 1;
 }
-message EtcdRemoveMember { common.Metadata metadata = 1; }
-message EtcdRemoveMemberResponse { repeated EtcdRemoveMember messages = 1; }
+
+message EtcdRemoveMember {
+  common.Metadata metadata = 1;
+}
+
+message EtcdRemoveMemberResponse {
+  repeated EtcdRemoveMember messages = 1;
+}
 
 message EtcdForfeitLeadershipRequest {}
+
 message EtcdForfeitLeadership {
   common.Metadata metadata = 1;
   string member = 2;
 }
+
 message EtcdForfeitLeadershipResponse {
   repeated EtcdForfeitLeadership messages = 1;
 }
@@ -824,14 +906,20 @@ message EtcdMembers {
   // the list of etcd members registered on the node.
   repeated EtcdMember members = 3;
 }
-message EtcdMemberListResponse { repeated EtcdMembers messages = 1; }
+
+message EtcdMemberListResponse {
+  repeated EtcdMembers messages = 1;
+}
 
 message EtcdSnapshotRequest {}
 
 message EtcdRecover {
   common.Metadata metadata = 1;
 }
-message EtcdRecoverResponse { repeated EtcdRecover messages = 1; }
+
+message EtcdRecoverResponse {
+  repeated EtcdRecover messages = 1;
+}
 
 // rpc generateConfiguration
 
@@ -874,7 +962,7 @@ message MachineConfig {
     TYPE_WORKER = 3;
     // Alias for TYPE_WORKER.
     TYPE_JOIN = 3 [deprecated = true];
-  };
+  }
   MachineType type = 1;
   InstallConfig install_config = 2;
   NetworkConfig network_config = 3;
diff --git a/prototool.yaml b/api/prototool.yaml
similarity index 62%
rename from prototool.yaml
rename to api/prototool.yaml
index 174c673e49..9c8ed83d97 100644
--- a/prototool.yaml
+++ b/api/prototool.yaml
@@ -1,55 +1,10 @@
-# Paths to exclude when searching for Protobuf files.
-# These can either be file or directory names.
-# If there is a directory name, that directory and all sub-directories will be excluded.
-#excludes:
-#  - path/to/a
-#  - path/to/b/file.proto
-
-# Protoc directives.
 protoc:
-  # The Protobuf version to use from https://github.com/protocolbuffers/protobuf/releases.
-  # By default use 3.11.0.
-  # You probably want to set this to make your builds completely reproducible.
-  version: 3.15.6
-
-  # Additional paths to include with -I to protoc.
-  # By default, the directory of the config file is included,
-  # or the current directory if there is no config file.
+  version: 3.19.1
   includes:
     - vendor/
 
-  # If not set, compile will fail if there are unused imports.
-  # Setting this will ignore unused imports.
-  #allow_unused_imports: true
-
-# Create directives.
-#create:
-# List of mappings from relative directory to base package.
-# This affects how packages are generated with create.
-#packages:
-# This means that a file created "foo.proto" in the current directory will have package "bar".
-# A file created "a/b/foo.proto" will have package "bar.a.b".
-#- directory: .
-#  name: bar
-# This means that a file created "idl/code.uber/a/b/c.proto" will have package "uber.a.b".
-#- directory: idl/code.uber
-#  name: uber
-
-# Lint directives.
 lint:
-  # The lint group to use.
-  # Available groups: "uber1", "uber2", "google", "empty".
-  # The default group is the "uber1" lint group for backwards compatibility reasons,
-  # however we recommend using the "uber2" lint group.
-  # The special group "empty" has no linters, allowing you to manually specify all
-  # lint rules in lint.rules.add.
-  # Run prototool lint --list-all-lint-groups to see all available lint groups.
-  # Run prototool lint --list-lint-group GROUP to list the linters in the given lint group.
   group: empty
-
-  # Linter files to ignore.
-  # These can either be file or directory names.
-  # If there is a directory name, that directory and all sub-directories will be ignored.
   ignores:
     - id: FILE_OPTIONS_GO_PACKAGE_NOT_LONG_FORM
       files:
@@ -58,17 +13,14 @@ lint:
       files:
         - common/common.proto
 
-  # Linter rules.
-  # Run prototool lint --list-all-linters to see all available linters.
-  # Run prototool lint --list-linters to see the currently configured linters.
   rules:
-
     # The specific linters to add.
     # TODO Enable more: https://github.com/talos-systems/talos/issues/2722.
     add:
       # All rules except language-specific (C#, Java, Obj-C, PHP, Ruby, but not Go).
+      # prototool lint --list-all-linters | grep -vE '(CSHARP|JAVA|OBJC|PHP|RUBY)'
       - COMMENTS_NO_C_STYLE                                            # Verifies that there are no /* c-style */ comments.
-      # - COMMENTS_NO_INLINE                                             # Verifies that there are no inline comments.
+      - COMMENTS_NO_INLINE                                             # Verifies that there are no inline comments.
       # - ENUMS_HAVE_COMMENTS                                            # Verifies that all enums have a comment of the form "// EnumName ...".
       # - ENUMS_HAVE_SENTENCE_COMMENTS                                   # Verifies that all enums have a comment that contains at least one complete sentence.
       # - ENUMS_NO_ALLOW_ALIAS                                           # Verifies that no enums use the option "allow_alias".
@@ -143,121 +95,8 @@ lint:
       # - WKT_DURATION_SUFFIX                                            # Verifies that all google.protobuf.Duration field names are "duration" or end in "_duration".
       # - WKT_TIMESTAMP_SUFFIX                                           # Verifies that all google.protobuf.Timestamp field names are "time" or end in "_time".
 
-# The specific linters to remove.
-#    remove:
-#      - ENUM_NAMES_CAMEL_CASE
-
-# The path to the file header or the file header content for all Protobuf files.
-# If either path or content is set and the FILE_HEADER linter is turned on,
-# files will be checked to begin with the given header, and format --fix
-# will place this header before the syntax declaration. Note that
-# format --fix will delete anything before the syntax declaration
-# if this is set.
-#
-# Set path to use a file's contents for the header. Path must be relative.
-# Set content to directly specify the header.
-# **Both path and content cannot be set at the same time. They are only done
-# so here for example purposes.**
-#
-# If is_commented is set, this file is assumed to already have comments
-# and will be added directly. If is_commented is not set, "// " will be
-# added before every line.
-#  file_header:
-#    path: path/to/protobuf_file_header.txt
-#    content: |
-#      //
-#      // Acme, Inc. (c) 2019
-#      //
-#    is_commented: true
-# Override the default java_package file option prefix of "com".
-# If this is set, this will affect lint, create, and format --fix to use.
-# this prefix instead of "com".
-#  java_package_prefix: au.com
-
-# Breaking change detector directives.
-#break:
-# Include beta packages in breaking change detection.
-# Beta packages have the form "foo.bar.vMAJORbetaBETA" where MAJOR > 0 and BETA > 0.
-# By default, beta packages are ignored.
-#include_beta: true
-# Allow stable packages to depend on beta packages.
-# By default, the breaking change detector will error if a stable package
-# depends on a breaking package.
-# If include_beta is true, this is implicitly set.
-#allow_beta_deps: true
-
-# Code generation directives.
-#generate:
-# Options that will apply to all plugins of type go and gogo.
-#  go_options:
-# The base import path. This should be the go path of the prototool.yaml file.
-# This is required if you have any go plugins.
-#    import_path: uber/foo/bar.git/idl/uber
-
-# Extra modifiers to include with Mfile=package.
-#    extra_modifiers:
-#      google/api/annotations.proto: google.golang.org/genproto/googleapis/api/annotations
-#      google/api/http.proto: google.golang.org/genproto/googleapis/api/annotations
-
-# The list of plugins.
-#  plugins:
-# The plugin name. This will go to protoc with --name_out, so it either needs
-# to be a built-in name (like java), or a plugin name with a binary
-# protoc-gen-name.
-#    - name: gogo
-
-# The type, if any. Valid types are go, gogo.
-# Use go if your plugin is a standard Golang plugin
-# that uses github.com/golang/protobuf imports, use gogo
-# if it uses github.com/gogo/protobuf imports. For protoc-gen-go
-# use go, For protoc-gen-gogo, protoc-gen-gogoslick, etc, use gogo.
-#      type: gogo
-
-# Extra flags to specify.
-# The only flag you will generally set is plugins=grpc for Golang.
-# The Mfile=package flags are automatically set.
-# ** Otherwise, generally do not set this unless you know what you are doing. **
-#      flags: plugins=grpc
-
-# The path to output generated files to.
-# If the directory does not exist, it will be created when running generation.
-# This needs to be a relative path.
-#      output: ../../.gen/proto/go
-
-# Optional override for the plugin path. For example, if you set set path to
-# /usr/local/bin/gogo_plugin", prototool will add the
-# "--plugin=protoc-gen-gogo=/usr/local/bin/gogo_plugin" flag to protoc calls.
-# If set to "gogo_plugin", prototool will search your path for "gogo_plugin",.
-# and fail if "gogo_plugin" cannot be found.
-#      path: gogo_plugin
-
-#    - name: yarpc-go
-#      type: gogo
-#      output: ../../.gen/proto/go
-
-#    - name: grpc-gateway
-#      type: go
-#      output: ../../.gen/proto/go
-
-#    - name: java
-#      output: ../../.gen/proto/java
-
-# Optional file suffix for plugins that output a single file as opposed
-# to writing a set of files to a directory. This is only valid in two
-# known cases:
-# - For the java plugin, set this to "jar" to produce jars
-#   https://developers.google.com/protocol-buffers/docs/reference/java-generated#invocation
-# - For the descriptor_set plugin, this is required as using descriptor_set
-#   requires a file to be given instead of a directory.
-#      file_suffix: jar
+break:
+  include_beta: false
+  allow_beta_deps: false
 
-# descriptor_set is special, and uses the --descriptor_set_out flag on protoc.
-# file_suffix is required, and the options include_imports and include_source_info
-# can be optionally set to add the flags --include_imports and --include_source-info.
-# The include_imports and include_source_info options are not valid for any
-# other plugin name.
-#    - name: descriptor_set
-#      output: ../../.gen/proto/descriptor
-#      file_suffix: bin
-#      include_imports: true
-#      include_source_info: true
+# We don't use prototool for code generation, so there are no settings for that.
diff --git a/api/resource/resource.proto b/api/resource/resource.proto
index 25cd56c866..bffafc3e27 100644
--- a/api/resource/resource.proto
+++ b/api/resource/resource.proto
@@ -19,73 +19,75 @@ service ResourceService {
 // common resource definition
 
 message Resource {
-    Metadata metadata = 1;
-    Spec spec = 2;
+  Metadata metadata = 1;
+  Spec spec = 2;
 }
 
 message Metadata {
-    string namespace = 1;
-    string type = 2;
-    string id = 3;
-    string version = 4;
-    string owner = 7;
-    string phase = 5;
-    google.protobuf.Timestamp created = 8;
-    google.protobuf.Timestamp updated = 9;
-    repeated string finalizers = 6;
+  string namespace = 1;
+  string type = 2;
+  string id = 3;
+  string version = 4;
+  string owner = 7;
+  string phase = 5;
+  google.protobuf.Timestamp created = 8;
+  google.protobuf.Timestamp updated = 9;
+  repeated string finalizers = 6;
 }
 
 message Spec {
-    bytes yaml = 1;
+  bytes yaml = 1;
 }
 
 // rpc Get
 message GetRequest {
-    string namespace = 1;
-    string type = 2;
-    string id = 3;
+  string namespace = 1;
+  string type = 2;
+  string id = 3;
 }
 
 // The GetResponse message contains the Resource returned.
 message Get {
-    common.Metadata metadata = 1;
-    Resource definition = 2;
-    Resource resource = 3;
+  common.Metadata metadata = 1;
+  Resource definition = 2;
+  Resource resource = 3;
 }
 
-message GetResponse { repeated Get messages = 1; }
+message GetResponse {
+  repeated Get messages = 1;
+}
 
 // rpc List
 // The ListResponse message contains the Resource returned.
 message ListRequest {
-    string namespace = 1;
-    string type = 2;
+  string namespace = 1;
+  string type = 2;
 }
 
 message ListResponse {
-    common.Metadata metadata = 1;
-    Resource definition = 2;
-    Resource resource = 3;
+  common.Metadata metadata = 1;
+  Resource definition = 2;
+  Resource resource = 3;
 }
 
 // rpc Watch
 // The WatchResponse message contains the Resource returned.
 message WatchRequest {
-    string namespace = 1;
-    string type = 2;
-    string id = 3;
-    uint32 tail_events = 4;
+  string namespace = 1;
+  string type = 2;
+  string id = 3;
+  uint32 tail_events = 4;
 }
 
 enum EventType {
-    CREATED = 0;
-    UPDATED = 1;
-    DESTROYED = 2;
+  CREATED = 0;
+  UPDATED = 1;
+  DESTROYED = 2;
 }
 
 message WatchResponse {
-    common.Metadata metadata = 1;
-    EventType event_type = 2;
-    Resource definition = 3;
-    Resource resource = 4;
+  common.Metadata metadata = 1;
+  EventType event_type = 2;
+  Resource definition = 3;
+  Resource resource = 4;
 }
diff --git a/api/resource/secrets/secrets.proto b/api/resource/secrets/secrets.proto
index b2c84a60e8..7500298678 100644
--- a/api/resource/secrets/secrets.proto
+++ b/api/resource/secrets/secrets.proto
@@ -5,13 +5,13 @@ package resource.secrets;
 option go_package = "github.com/talos-systems/talos/pkg/machinery/api/resource/secrets";
 
 message CertAndKeyPEM {
-    bytes cert = 1;
-    bytes key = 2;
+  bytes cert = 1;
+  bytes key = 2;
 }
 
 // APISpec describes secrets.API.
 message APISpec {
-    bytes ca_pem = 1;
-    CertAndKeyPEM server = 2;
-    CertAndKeyPEM client = 3;
+  bytes ca_pem = 1;
+  CertAndKeyPEM server = 2;
+  CertAndKeyPEM client = 3;
 }
diff --git a/api/storage/storage.proto b/api/storage/storage.proto
index 012b2a5437..68fdb39334 100644
--- a/api/storage/storage.proto
+++ b/api/storage/storage.proto
@@ -4,8 +4,8 @@ package storage;
 
 option go_package = "github.com/talos-systems/talos/pkg/machinery/api/storage";
 
-import "google/protobuf/empty.proto";
 import "common/common.proto";
+import "google/protobuf/empty.proto";
 
 // StorageService represents the storage service.
 service StorageService {
@@ -46,4 +46,7 @@ message Disks {
   common.Metadata metadata = 1;
   repeated Disk disks = 2;
 }
-message DisksResponse { repeated Disks messages = 1; }
+
+message DisksResponse {
+  repeated Disks messages = 1;
+}
diff --git a/api/time/time.proto b/api/time/time.proto
index a32b0863d8..58cf2f9e42 100644
--- a/api/time/time.proto
+++ b/api/time/time.proto
@@ -4,9 +4,9 @@ package time;
 
 option go_package = "github.com/talos-systems/talos/pkg/machinery/api/time";
 
+import "common/common.proto";
 import "google/protobuf/empty.proto";
 import "google/protobuf/timestamp.proto";
-import "common/common.proto";
 
 // The time service definition.
 service TimeService {
@@ -15,7 +15,9 @@ service TimeService {
 }
 
 // The response message containing the ntp server
-message TimeRequest { string server = 1; }
+message TimeRequest {
+  string server = 1;
+}
 
 message Time {
   common.Metadata metadata = 1;
@@ -25,4 +27,6 @@ message Time {
 }
 
 // The response message containing the ntp server, time, and offset
-message TimeResponse { repeated Time messages = 1; }
+message TimeResponse {
+  repeated Time messages = 1;
+}
diff --git a/api/vendor/google/rpc/status.proto b/api/vendor/google/rpc/status.proto
index 3b1f7a932f..3f8acfe429 100644
--- a/api/vendor/google/rpc/status.proto
+++ b/api/vendor/google/rpc/status.proto
@@ -16,8 +16,6 @@ syntax = "proto3";
 
 package google.rpc;
 
-import "google/protobuf/any.proto";
-
 option cc_enable_arenas = true;
 option go_package = "google.golang.org/genproto/googleapis/rpc/status;status";
 option java_multiple_files = true;
@@ -25,6 +23,8 @@ option java_outer_classname = "StatusProto";
 option java_package = "com.google.rpc";
 option objc_class_prefix = "RPC";
 
+import "google/protobuf/any.proto";
+
 // The `Status` type defines a logical error model that is suitable for
 // different programming environments, including REST APIs and RPC APIs. It is
 // used by [gRPC](https://github.com/grpc). Each `Status` message contains
@@ -35,12 +35,10 @@ option objc_class_prefix = "RPC";
 message Status {
   // The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].
   int32 code = 1;
-
   // A developer-facing error message, which should be in English. Any
   // user-facing error message should be localized and sent in the
   // [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.
   string message = 2;
-
   // A list of messages that carry the error details.  There is a common set of
   // message types for APIs to use.
   repeated google.protobuf.Any details = 3;
diff --git a/pkg/machinery/api/cluster/cluster.pb.go b/pkg/machinery/api/cluster/cluster.pb.go
index ec902d44e4..aa5eb79a19 100644
--- a/pkg/machinery/api/cluster/cluster.pb.go
+++ b/pkg/machinery/api/cluster/cluster.pb.go
@@ -202,9 +202,9 @@ var File_cluster_cluster_proto protoreflect.FileDescriptor
 var file_cluster_cluster_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
 	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
-	0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
 	0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x8b, 0x01, 0x0a, 0x12, 0x48, 0x65, 0x61, 0x6c, 0x74, 0x68,
 	0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3c, 0x0a, 0x0c,
 	0x77, 0x61, 0x69, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01,
diff --git a/pkg/machinery/api/inspect/inspect.pb.go b/pkg/machinery/api/inspect/inspect.pb.go
index a130e13ecc..fc87d268b7 100644
--- a/pkg/machinery/api/inspect/inspect.pb.go
+++ b/pkg/machinery/api/inspect/inspect.pb.go
@@ -266,9 +266,9 @@ var File_inspect_inspect_proto protoreflect.FileDescriptor
 var file_inspect_inspect_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x2f, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63,
 	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x69, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74,
-	0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f,
+	0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x22, 0x84, 0x01, 0x0a, 0x1b, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
 	0x72, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x44, 0x65, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x6e,
 	0x63, 0x79, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01,
diff --git a/pkg/machinery/api/machine/machine.pb.go b/pkg/machinery/api/machine/machine.pb.go
index 753b821ccf..77bb0aa43a 100644
--- a/pkg/machinery/api/machine/machine.pb.go
+++ b/pkg/machinery/api/machine/machine.pb.go
@@ -3042,7 +3042,7 @@ type FileInfo struct {
 	// Mode is the bitmap of UNIX mode/permission flags of the file
 	Mode uint32 `protobuf:"varint,4,opt,name=mode,proto3" json:"mode,omitempty"`
 	// Modified indicates the UNIX timestamp at which the file was last modified
-	Modified int64 `protobuf:"varint,5,opt,name=modified,proto3" json:"modified,omitempty"` // TODO: unix timestamp or include proto's Date type
+	Modified int64 `protobuf:"varint,5,opt,name=modified,proto3" json:"modified,omitempty"`
 	// IsDir indicates that the file is a directory
 	IsDir bool `protobuf:"varint,6,opt,name=is_dir,json=isDir,proto3" json:"is_dir,omitempty"`
 	// Error describes any error encountered while trying to read the file
@@ -8797,15 +8797,15 @@ var File_machine_machine_proto protoreflect.FileDescriptor
 var file_machine_machine_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70,
-	0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
-	0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
-	0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6a,
+	0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6a,
 	0x0a, 0x19, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
 	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x64,
 	0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12,
diff --git a/pkg/machinery/api/machine/machine_grpc.pb.go b/pkg/machinery/api/machine/machine_grpc.pb.go
index 8128a1b534..ed582dd778 100644
--- a/pkg/machinery/api/machine/machine_grpc.pb.go
+++ b/pkg/machinery/api/machine/machine_grpc.pb.go
@@ -27,6 +27,12 @@ const _ = grpc.SupportPackageIsVersion7
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type MachineServiceClient interface {
 	ApplyConfiguration(ctx context.Context, in *ApplyConfigurationRequest, opts ...grpc.CallOption) (*ApplyConfigurationResponse, error)
+	// Bootstrap method makes control plane node enter etcd bootstrap mode.
+	//
+	// Node aborts etcd join sequence and creates single-node etcd cluster.
+	//
+	// If recover_etcd argument is specified, etcd is recovered from a snapshot
+	// uploaded with EtcdRecover.
 	Bootstrap(ctx context.Context, in *BootstrapRequest, opts ...grpc.CallOption) (*BootstrapResponse, error)
 	Containers(ctx context.Context, in *ContainersRequest, opts ...grpc.CallOption) (*ContainersResponse, error)
 	Copy(ctx context.Context, in *CopyRequest, opts ...grpc.CallOption) (MachineService_CopyClient, error)
@@ -682,6 +688,12 @@ func (c *machineServiceClient) GenerateClientConfiguration(ctx context.Context,
 // for forward compatibility
 type MachineServiceServer interface {
 	ApplyConfiguration(context.Context, *ApplyConfigurationRequest) (*ApplyConfigurationResponse, error)
+	// Bootstrap method makes control plane node enter etcd bootstrap mode.
+	//
+	// Node aborts etcd join sequence and creates single-node etcd cluster.
+	//
+	// If recover_etcd argument is specified, etcd is recovered from a snapshot
+	// uploaded with EtcdRecover.
 	Bootstrap(context.Context, *BootstrapRequest) (*BootstrapResponse, error)
 	Containers(context.Context, *ContainersRequest) (*ContainersResponse, error)
 	Copy(*CopyRequest, MachineService_CopyServer) error
diff --git a/pkg/machinery/api/storage/storage.pb.go b/pkg/machinery/api/storage/storage.pb.go
index 03bccc7f9e..c9be0508c7 100644
--- a/pkg/machinery/api/storage/storage.pb.go
+++ b/pkg/machinery/api/storage/storage.pb.go
@@ -308,9 +308,9 @@ var File_storage_storage_proto protoreflect.FileDescriptor
 var file_storage_storage_proto_rawDesc = []byte{
 	0x0a, 0x15, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
-	0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f,
+	0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x22, 0xaa, 0x02, 0x0a, 0x04, 0x44, 0x69, 0x73, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x73,
 	0x69, 0x7a, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12,
 	0x14, 0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
diff --git a/pkg/machinery/api/time/time.pb.go b/pkg/machinery/api/time/time.pb.go
index 032c9581bc..0cf2b83f27 100644
--- a/pkg/machinery/api/time/time.pb.go
+++ b/pkg/machinery/api/time/time.pb.go
@@ -196,12 +196,12 @@ var File_time_time_proto protoreflect.FileDescriptor
 
 var file_time_time_proto_rawDesc = []byte{
 	0x0a, 0x0f, 0x74, 0x69, 0x6d, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x12, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f,
-	0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x25, 0x0a, 0x0b, 0x54, 0x69,
+	0x6f, 0x12, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x1a, 0x13, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d,
+	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x25, 0x0a, 0x0b, 0x54, 0x69,
 	0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72,
 	0x76, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65,
 	0x72, 0x22, 0xc2, 0x01, 0x0a, 0x04, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x08, 0x6d, 0x65,
diff --git a/website/content/docs/v0.14/Reference/api.md b/website/content/docs/v0.14/Reference/api.md
index 008b3053b1..2037a994ca 100644
--- a/website/content/docs/v0.14/Reference/api.md
+++ b/website/content/docs/v0.14/Reference/api.md
@@ -1258,9 +1258,7 @@ FileInfo describes a file or directory's information
 | name | [string](#string) |  | Name is the name (including prefixed path) of the file or directory |
 | size | [int64](#int64) |  | Size indicates the number of bytes contained within the file |
 | mode | [uint32](#uint32) |  | Mode is the bitmap of UNIX mode/permission flags of the file |
-| modified | [int64](#int64) |  | Modified indicates the UNIX timestamp at which the file was last modified
-
-TODO: unix timestamp or include proto's Date type |
+| modified | [int64](#int64) |  | Modified indicates the UNIX timestamp at which the file was last modified |
 | is_dir | [bool](#bool) |  | IsDir indicates that the file is a directory |
 | error | [string](#string) |  | Error describes any error encountered while trying to read the file information. |
 | link | [string](#string) |  | Link is filled with symlink target |
@@ -2778,7 +2776,11 @@ The machine service definition.
 | Method Name | Request Type | Response Type | Description |
 | ----------- | ------------ | ------------- | ------------|
 | ApplyConfiguration | [ApplyConfigurationRequest](#machine.ApplyConfigurationRequest) | [ApplyConfigurationResponse](#machine.ApplyConfigurationResponse) |  |
-| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) |  |
+| Bootstrap | [BootstrapRequest](#machine.BootstrapRequest) | [BootstrapResponse](#machine.BootstrapResponse) | Bootstrap method makes control plane node enter etcd bootstrap mode.
+
+Node aborts etcd join sequence and creates single-node etcd cluster.
+
+If recover_etcd argument is specified, etcd is recovered from a snapshot uploaded with EtcdRecover. |
 | Containers | [ContainersRequest](#machine.ContainersRequest) | [ContainersResponse](#machine.ContainersResponse) |  |
 | Copy | [CopyRequest](#machine.CopyRequest) | [.common.Data](#common.Data) stream |  |
 | CPUInfo | [.google.protobuf.Empty](#google.protobuf.Empty) | [CPUInfoResponse](#machine.CPUInfoResponse) |  |