diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 81d2b4ac..7308b150 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-05-09T13:22:16Z by kres 1e986af.
+# Generated on 2024-05-23T15:58:32Z by kres 2688b70.
 
 name: default
 concurrency:
@@ -41,6 +41,31 @@ jobs:
           - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
           - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
     steps:
+      - name: gather-system-info
+        id: system-info
+        uses: kenchan0130/actions-system-info@v1.3.0
+        continue-on-error: true
+      - name: print-system-info
+        run: |
+          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))
+
+          OUTPUTS=(
+            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
+            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
+            "Hostname: ${{ steps.system-info.outputs.hostname }}"
+            "NodeName: ${NODE_NAME}"
+            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
+            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
+            "Name: ${{ steps.system-info.outputs.name }}"
+            "Platform: ${{ steps.system-info.outputs.platform }}"
+            "Release: ${{ steps.system-info.outputs.release }}"
+            "Total memory: ${MEMORY_GB} GB"
+          )
+
+          for OUTPUT in "${OUTPUTS[@]}";do
+            echo "${OUTPUT}"
+          done
+        continue-on-error: true
       - name: checkout
         uses: actions/checkout@v4
       - name: Unshallow
@@ -124,6 +149,31 @@ jobs:
           - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
           - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
     steps:
+      - name: gather-system-info
+        id: system-info
+        uses: kenchan0130/actions-system-info@v1.3.0
+        continue-on-error: true
+      - name: print-system-info
+        run: |
+          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))
+
+          OUTPUTS=(
+            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
+            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
+            "Hostname: ${{ steps.system-info.outputs.hostname }}"
+            "NodeName: ${NODE_NAME}"
+            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
+            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
+            "Name: ${{ steps.system-info.outputs.name }}"
+            "Platform: ${{ steps.system-info.outputs.platform }}"
+            "Release: ${{ steps.system-info.outputs.release }}"
+            "Total memory: ${MEMORY_GB} GB"
+          )
+
+          for OUTPUT in "${OUTPUTS[@]}";do
+            echo "${OUTPUT}"
+          done
+        continue-on-error: true
       - name: checkout
         uses: actions/checkout@v4
       - name: Unshallow
diff --git a/.github/workflows/weekly.yaml b/.github/workflows/weekly.yaml
index f6525422..7388732e 100644
--- a/.github/workflows/weekly.yaml
+++ b/.github/workflows/weekly.yaml
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-05-09T13:22:16Z by kres 1e986af.
+# Generated on 2024-05-23T15:58:32Z by kres 2688b70.
 
 name: weekly
 concurrency:
@@ -24,6 +24,31 @@ jobs:
           - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
           - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
     steps:
+      - name: gather-system-info
+        id: system-info
+        uses: kenchan0130/actions-system-info@v1.3.0
+        continue-on-error: true
+      - name: print-system-info
+        run: |
+          MEMORY_GB=$((${{ steps.system-info.outputs.totalmem }}/1024/1024/1024))
+
+          OUTPUTS=(
+            "CPU Core: ${{ steps.system-info.outputs.cpu-core }}"
+            "CPU Model: ${{ steps.system-info.outputs.cpu-model }}"
+            "Hostname: ${{ steps.system-info.outputs.hostname }}"
+            "NodeName: ${NODE_NAME}"
+            "Kernel release: ${{ steps.system-info.outputs.kernel-release }}"
+            "Kernel version: ${{ steps.system-info.outputs.kernel-version }}"
+            "Name: ${{ steps.system-info.outputs.name }}"
+            "Platform: ${{ steps.system-info.outputs.platform }}"
+            "Release: ${{ steps.system-info.outputs.release }}"
+            "Total memory: ${MEMORY_GB} GB"
+          )
+
+          for OUTPUT in "${OUTPUTS[@]}";do
+            echo "${OUTPUT}"
+          done
+        continue-on-error: true
       - name: checkout
         uses: actions/checkout@v4
       - name: Unshallow
diff --git a/Makefile b/Makefile
index d1172985..97203b57 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2024-05-22T11:43:14Z by kres 04ecdaf.
+# Generated on 2024-05-23T15:58:32Z by kres 2688b70.
 
 # common variables
 
diff --git a/Pkgfile b/Pkgfile
index 62f12578..8a991780 100644
--- a/Pkgfile
+++ b/Pkgfile
@@ -1,4 +1,4 @@
-# syntax = ghcr.io/siderolabs/bldr:v0.3.0
+# syntax = ghcr.io/siderolabs/bldr:v0.3.1
 
 format: v1alpha2
 
diff --git a/container-runtime/ecr-credential-provider/pkg.yaml b/container-runtime/ecr-credential-provider/pkg.yaml
index fd8683b5..34531f68 100644
--- a/container-runtime/ecr-credential-provider/pkg.yaml
+++ b/container-runtime/ecr-credential-provider/pkg.yaml
@@ -33,6 +33,12 @@ steps:
       - install -D -m 0755
         ${GOPATH}/src/k8s.io/cloud-provider-aws/dist/ecr-credential-provider
         /rootfs/usr/local/lib/kubelet/credentialproviders/ecr-credential-provider
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/container-runtime/gvisor-debug/pkg.yaml b/container-runtime/gvisor-debug/pkg.yaml
index a2b8d35e..42160f6a 100644
--- a/container-runtime/gvisor-debug/pkg.yaml
+++ b/container-runtime/gvisor-debug/pkg.yaml
@@ -7,10 +7,17 @@ steps:
   - prepare:
       - |
         sed -i 's#$VERSION#{{ .VERSION }}#' /pkg/manifest.yaml
+    install:
+      - |
+        mkdir -p /rootfs/etc/cri/conf.d
+        cp /pkg/gvisor-debug.part /rootfs/etc/cri/conf.d/gvisor-debug.part
+        cp /pkg/runsc.toml /rootfs/etc/cri/conf.d/runsc.toml
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /pkg/manifest.yaml
     to: /
-  - from: /pkg/gvisor-debug.part
-    to: /rootfs/etc/cri/conf.d/gvisor-debug.part
-  - from: /pkg/runsc.toml
-    to: /rootfs/etc/cri/conf.d/runsc.toml
diff --git a/container-runtime/gvisor/pkg.yaml b/container-runtime/gvisor/pkg.yaml
index 0b5b0aa7..00f91bfc 100644
--- a/container-runtime/gvisor/pkg.yaml
+++ b/container-runtime/gvisor/pkg.yaml
@@ -41,6 +41,12 @@ steps:
 
         cp ./bin/containerd-shim-runsc-v1 /rootfs/usr/local/bin/containerd-shim-runsc-v1
         chmod +x /rootfs/usr/local/bin/containerd-shim-runsc-v1
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/container-runtime/kata-containers/pkg.yaml b/container-runtime/kata-containers/pkg.yaml
index dd3dc8cd..05a5a029 100644
--- a/container-runtime/kata-containers/pkg.yaml
+++ b/container-runtime/kata-containers/pkg.yaml
@@ -56,6 +56,12 @@ steps:
       - |
         cd ${GOPATH}/src/github.com/kata-containers/src/runtime
         cp containerd-shim-kata-v2 /rootfs/usr/local/bin/containerd-shim-kata-v2
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/container-runtime/spin/pkg.yaml b/container-runtime/spin/pkg.yaml
index c814c1c0..6c6d0541 100644
--- a/container-runtime/spin/pkg.yaml
+++ b/container-runtime/spin/pkg.yaml
@@ -24,6 +24,12 @@ steps:
         mkdir -p /rootfs/usr/local/bin
 
         tar xf containerd-shim-spin.tar.gz -C /rootfs/usr/local/bin
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/container-runtime/stargz-snapshotter/pkg.yaml b/container-runtime/stargz-snapshotter/pkg.yaml
index 38d8256b..5f14916d 100644
--- a/container-runtime/stargz-snapshotter/pkg.yaml
+++ b/container-runtime/stargz-snapshotter/pkg.yaml
@@ -38,6 +38,12 @@ steps:
 
         cp ./out/ctr-remote /rootfs/usr/local/lib/containers/stargz-snapshotter/ctr-remote
         chmod +x /rootfs/usr/local/lib/containers/stargz-snapshotter/ctr-remote
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/container-runtime/wasmedge/pkg.yaml b/container-runtime/wasmedge/pkg.yaml
index 3401bdd6..bbfa014a 100644
--- a/container-runtime/wasmedge/pkg.yaml
+++ b/container-runtime/wasmedge/pkg.yaml
@@ -22,12 +22,19 @@ steps:
     install:
       - |
         mkdir -p /rootfs/usr/local/bin
+        mkdir -p /rootfs/etc/cri/conf.d
+
+        cp /pkg/wasm.part /rootfs/etc/cri/conf.d/wasm.part
 
         tar xf containerd-shim-wasmedge.tar.gz -C /rootfs/usr/local/bin
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
   - from: /pkg/manifest.yaml
     to: /
-  - from: /pkg/wasm.part
-    to: /rootfs/etc/cri/conf.d/wasm.part
diff --git a/drivers/chelsio/pkg.yaml b/drivers/chelsio/pkg.yaml
index 981ccfd4..abddd472 100644
--- a/drivers/chelsio/pkg.yaml
+++ b/drivers/chelsio/pkg.yaml
@@ -22,6 +22,11 @@ steps:
       - |
         # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
         find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/drivers/gasket/pkg.yaml b/drivers/gasket/pkg.yaml
index 0c7bae47..012c8b4b 100644
--- a/drivers/gasket/pkg.yaml
+++ b/drivers/gasket/pkg.yaml
@@ -15,6 +15,12 @@ steps:
         mkdir -p /rootfs/lib/modules
 
         cp -R /lib/modules/* /rootfs/lib/modules
+  - test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/drivers/mellanox-ofed/pkg.yaml b/drivers/mellanox-ofed/pkg.yaml
index cfe0069b..bf4294fe 100644
--- a/drivers/mellanox-ofed/pkg.yaml
+++ b/drivers/mellanox-ofed/pkg.yaml
@@ -15,6 +15,12 @@ steps:
         mkdir -p /rootfs/lib/modules
 
         cp -R /lib/modules/* /rootfs/lib/modules
+  - test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/drivers/thunderbolt/pkg.yaml b/drivers/thunderbolt/pkg.yaml
index 0a01fac1..9bb45bf7 100644
--- a/drivers/thunderbolt/pkg.yaml
+++ b/drivers/thunderbolt/pkg.yaml
@@ -22,6 +22,11 @@ steps:
       - |
         # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
         find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/drivers/usb-modem/pkg.yaml b/drivers/usb-modem/pkg.yaml
index 7089ae31..5d4109a9 100644
--- a/drivers/usb-modem/pkg.yaml
+++ b/drivers/usb-modem/pkg.yaml
@@ -22,6 +22,11 @@ steps:
       - |
         # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
         find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/drivers/v4l-uvc/pkg.yaml b/drivers/v4l-uvc/pkg.yaml
index 089d8c97..74d77572 100644
--- a/drivers/v4l-uvc/pkg.yaml
+++ b/drivers/v4l-uvc/pkg.yaml
@@ -22,6 +22,11 @@ steps:
       - |
         # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
         find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/examples/hello-world-service/pkg.yaml b/examples/hello-world-service/pkg.yaml
index 0a445b2f..20c5759d 100644
--- a/examples/hello-world-service/pkg.yaml
+++ b/examples/hello-world-service/pkg.yaml
@@ -21,6 +21,12 @@ steps:
         mkdir -p /rootfs/usr/local/lib/containers/hello-world
 
         cp -p /pkg/src/hello-world /rootfs/usr/local/lib/containers/hello-world/
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/amd-ucode/pkg.yaml b/firmware/amd-ucode/pkg.yaml
index 26d1c9c7..6a543e48 100644
--- a/firmware/amd-ucode/pkg.yaml
+++ b/firmware/amd-ucode/pkg.yaml
@@ -12,6 +12,12 @@ steps:
       - |
         mkdir -p /rootfs/lib/firmware
         cp -R -p /lib/firmware/amd-ucode /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/amdgpu-firmware/pkg.yaml b/firmware/amdgpu-firmware/pkg.yaml
index 5be9d33d..67d52798 100644
--- a/firmware/amdgpu-firmware/pkg.yaml
+++ b/firmware/amdgpu-firmware/pkg.yaml
@@ -12,6 +12,12 @@ steps:
       - |
         mkdir -p /rootfs/lib/firmware
         cp -R -p /lib/firmware/amdgpu /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/bnx2-bnx2x/pkg.yaml b/firmware/bnx2-bnx2x/pkg.yaml
index c300435a..6aaac682 100644
--- a/firmware/bnx2-bnx2x/pkg.yaml
+++ b/firmware/bnx2-bnx2x/pkg.yaml
@@ -13,6 +13,12 @@ steps:
         mkdir -p /rootfs/lib/firmware
         cp -R -p /lib/firmware/bnx2 /rootfs/lib/firmware
         cp -R -p /lib/firmware/bnx2x /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/chelsio/pkg.yaml b/firmware/chelsio/pkg.yaml
index f17caa2b..0c715b45 100644
--- a/firmware/chelsio/pkg.yaml
+++ b/firmware/chelsio/pkg.yaml
@@ -13,6 +13,12 @@ steps:
         mkdir -p /rootfs/lib/firmware
         cp -R -p /lib/firmware/cxgb3 /rootfs/lib/firmware
         cp -R -p /lib/firmware/cxgb4 /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/i915-ucode/pkg.yaml b/firmware/i915-ucode/pkg.yaml
index b97feca9..3dd76d3e 100644
--- a/firmware/i915-ucode/pkg.yaml
+++ b/firmware/i915-ucode/pkg.yaml
@@ -12,6 +12,12 @@ steps:
       - |
         mkdir -p /rootfs/lib/firmware
         cp -R -p /lib/firmware/i915 /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/intel-ice-firmware/pkg.yaml b/firmware/intel-ice-firmware/pkg.yaml
index c7c9dd58..c48dcfb5 100644
--- a/firmware/intel-ice-firmware/pkg.yaml
+++ b/firmware/intel-ice-firmware/pkg.yaml
@@ -12,6 +12,12 @@ steps:
       - |
         mkdir -p /rootfs/lib/firmware/intel/ice/ddp
         cp /lib/firmware/intel/ice/ddp/ice-*.pkg /rootfs/lib/firmware/intel/ice/ddp/ice.pkg
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/intel-ucode/pkg.yaml b/firmware/intel-ucode/pkg.yaml
index bff837c9..d47bf030 100644
--- a/firmware/intel-ucode/pkg.yaml
+++ b/firmware/intel-ucode/pkg.yaml
@@ -18,6 +18,12 @@ steps:
       - |
         mkdir -p /rootfs/lib/firmware
         cp -R -p intel-ucode /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/qlogic-firmware/pkg.yaml b/firmware/qlogic-firmware/pkg.yaml
index f558793f..8cc0c9e3 100644
--- a/firmware/qlogic-firmware/pkg.yaml
+++ b/firmware/qlogic-firmware/pkg.yaml
@@ -12,6 +12,12 @@ steps:
       - |
         mkdir -p /rootfs/lib/firmware
         cp -R -p /lib/firmware/qed /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/firmware/realtek-firmware/pkg.yaml b/firmware/realtek-firmware/pkg.yaml
index f83618ec..69a90293 100644
--- a/firmware/realtek-firmware/pkg.yaml
+++ b/firmware/realtek-firmware/pkg.yaml
@@ -15,6 +15,12 @@ steps:
         cp -R -p /lib/firmware/rtl_nic /rootfs/lib/firmware
         cp -R -p /lib/firmware/rtlwifi /rootfs/lib/firmware
         cp -R -p /lib/firmware/rtw88 /rootfs/lib/firmware
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/guest-agents/qemu-guest-agent/pkg.yaml b/guest-agents/qemu-guest-agent/pkg.yaml
index acdc72cd..ee7ea3d0 100644
--- a/guest-agents/qemu-guest-agent/pkg.yaml
+++ b/guest-agents/qemu-guest-agent/pkg.yaml
@@ -63,6 +63,12 @@ steps:
         rmdir /rootfs/usr/local/share
         rmdir /rootfs/var/run
         rmdir /rootfs/var
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/guest-agents/talos-vmtoolsd/README.md b/guest-agents/talos-vmtoolsd/README.md
index 60f4bdcf..391b0502 100644
--- a/guest-agents/talos-vmtoolsd/README.md
+++ b/guest-agents/talos-vmtoolsd/README.md
@@ -1,11 +1,11 @@
-# talos-vmtoolsd
-
-Adds talos-vmtoolsd as a system extension.
-
-## Installation
-
-See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
-
-## Configuration
-
-This extension requires no configuration.
+# talos-vmtoolsd
+
+Adds talos-vmtoolsd as a system extension.
+
+## Installation
+
+See [Installing Extensions](https://github.com/siderolabs/extensions#installing-extensions).
+
+## Configuration
+
+This extension requires no configuration.
diff --git a/guest-agents/talos-vmtoolsd/pkg.yaml b/guest-agents/talos-vmtoolsd/pkg.yaml
index 0f7b09d2..ea7df5df 100644
--- a/guest-agents/talos-vmtoolsd/pkg.yaml
+++ b/guest-agents/talos-vmtoolsd/pkg.yaml
@@ -1,9 +1,14 @@
-name: vmtoolsd-guest-agent
-variant: scratch
-dependencies:
-  - image: {{ .BUILD_ARG_PKGS_PREFIX }}/talos-vmtoolsd:{{ .TALOS_VMTOOLSD_VERSION }}
-    from: /
-    to: /rootfs
-finalize:
-  - from: /rootfs
-    to: /
+name: vmtoolsd-guest-agent
+variant: scratch
+dependencies:
+  - stage: base
+  - image: {{ .BUILD_ARG_PKGS_PREFIX }}/talos-vmtoolsd:{{ .TALOS_VMTOOLSD_VERSION }}
+    from: /
+    to: /rootfs
+steps:
+  - test:
+      - |
+        /extensions-validator validate --rootfs=/rootfs --pkg-name="${PKG_NAME}"
+finalize:
+  - from: /rootfs
+    to: /
diff --git a/guest-agents/talos-vmtoolsd/vars.yaml b/guest-agents/talos-vmtoolsd/vars.yaml
index c7c711e9..a6c8ffb6 100644
--- a/guest-agents/talos-vmtoolsd/vars.yaml
+++ b/guest-agents/talos-vmtoolsd/vars.yaml
@@ -1 +1 @@
-VERSION: "{{ .TALOS_VMTOOLSD_VERSION }}"
+VERSION: "{{ .TALOS_VMTOOLSD_VERSION }}"
diff --git a/guest-agents/vars.yaml b/guest-agents/vars.yaml
index 6cc83f38..4fe416cf 100644
--- a/guest-agents/vars.yaml
+++ b/guest-agents/vars.yaml
@@ -7,4 +7,4 @@ PCRE2_VERSION: 10.42
 # renovate: datasource=git-tags depName=https://gitlab.com/xen-project/xen-guest-agent.git
 XEN_GUEST_AGENT_VERSION: 0.4.0
 # renovate: datasource=github-releases depName=siderolabs/talos-vmtoolsd
-TALOS_VMTOOLSD_VERSION: 0.5.0
+TALOS_VMTOOLSD_VERSION: v0.5.1
diff --git a/guest-agents/xen-guest-agent/pkg.yaml b/guest-agents/xen-guest-agent/pkg.yaml
index 032f0c5e..d12497f3 100644
--- a/guest-agents/xen-guest-agent/pkg.yaml
+++ b/guest-agents/xen-guest-agent/pkg.yaml
@@ -1,6 +1,10 @@
 name: xen-guest-agent
 variant: alpine
 shell: /bin/sh
+dependencies:
+  - stage: base
+    from: /
+    to: /base-rootfs
 install:
   - cargo
   - xen-dev
@@ -28,6 +32,12 @@ steps:
         containerRoot=/rootfs/usr/local/lib/containers/xen-guest-agent
         mkdir -p "$containerRoot"
         mv target/{{ .ARCH }}-alpine-linux-musl/release/xen-guest-agent "$containerRoot/xen-guest-agent"
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /base-rootfs/extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/internal/base/pkg.yaml b/internal/base/pkg.yaml
index 33960617..8c421e7c 100644
--- a/internal/base/pkg.yaml
+++ b/internal/base/pkg.yaml
@@ -4,6 +4,7 @@ shell: /toolchain/bin/bash
 dependencies:
   - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/base:{{ .BUILD_ARG_PKGS }}"
   - image: "{{ .BUILD_ARG_PKGS_PREFIX }}/ca-certificates:{{ .BUILD_ARG_PKGS }}"
+  - image: ghcr.io/siderolabs/extensions-validator:2c7bb38
 finalize:
   - from: /
     to: /
diff --git a/misc/binfmt-misc/pkg.yaml b/misc/binfmt-misc/pkg.yaml
index 101d24e7..6805f26c 100644
--- a/misc/binfmt-misc/pkg.yaml
+++ b/misc/binfmt-misc/pkg.yaml
@@ -22,6 +22,11 @@ steps:
       - |
         # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
         find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/network/tailscale/pkg.yaml b/network/tailscale/pkg.yaml
index b0e0e97e..b8ca3c8f 100644
--- a/network/tailscale/pkg.yaml
+++ b/network/tailscale/pkg.yaml
@@ -34,7 +34,12 @@ steps:
         cp -pr dist/tailscale /rootfs/usr/local/lib/containers/tailscale/usr/local/bin
         cp -pr dist/tailscaled /rootfs/usr/local/lib/containers/tailscale/usr/local/bin
         cp -pr dist/containerboot /rootfs/usr/local/lib/containers/tailscale/usr/local/bin
-
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/nvidia-gpu/nonfree/kmod-nvidia/pkg.yaml b/nvidia-gpu/nonfree/kmod-nvidia/pkg.yaml
index c0df214c..a23a186e 100644
--- a/nvidia-gpu/nonfree/kmod-nvidia/pkg.yaml
+++ b/nvidia-gpu/nonfree/kmod-nvidia/pkg.yaml
@@ -18,6 +18,12 @@ steps:
         cp /pkg/files/nvidia.conf /rootfs/usr/local/lib/modprobe.d/nvidia.conf
 
         cp -R /lib/modules/* /rootfs/lib/modules
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/nvidia-gpu/nvidia-container-toolkit/pkg.yaml b/nvidia-gpu/nvidia-container-toolkit/pkg.yaml
index 6300f941..2b01677d 100644
--- a/nvidia-gpu/nvidia-container-toolkit/pkg.yaml
+++ b/nvidia-gpu/nvidia-container-toolkit/pkg.yaml
@@ -19,6 +19,12 @@ steps:
     install:
       - |
         mkdir -p /rootfs
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/nvidia-gpu/nvidia-fabricmanager/pkg.yaml b/nvidia-gpu/nvidia-fabricmanager/pkg.yaml
index 71e13952..e8335091 100644
--- a/nvidia-gpu/nvidia-fabricmanager/pkg.yaml
+++ b/nvidia-gpu/nvidia-fabricmanager/pkg.yaml
@@ -44,6 +44,12 @@ steps:
         sed -i 's/STATE_FILE_NAME=.*/STATE_FILE_NAME=\/var\/run\/nvidia-fabricmanager\/fabricmanager.state/g' /rootfs/usr/local/share/nvidia/nvswitch/fabricmanager.cfg
         sed -i 's/TOPOLOGY_FILE_PATH=.*/TOPOLOGY_FILE_PATH=\/usr\/local\/share\/nvidia\/nvswitch/g' /rootfs/usr/local/share/nvidia/nvswitch/fabricmanager.cfg
         sed -i 's/DATABASE_PATH=.*/DATABASE_PATH=\/usr\/local\/share\/nvidia\/nvswitch/g' /rootfs/usr/local/share/nvidia/nvswitch/fabricmanager.cfg
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/nvidia-gpu/nvidia-modules/pkg.yaml b/nvidia-gpu/nvidia-modules/pkg.yaml
index a7043af7..0af3f7d6 100644
--- a/nvidia-gpu/nvidia-modules/pkg.yaml
+++ b/nvidia-gpu/nvidia-modules/pkg.yaml
@@ -18,6 +18,12 @@ steps:
         cp /pkg/files/nvidia.conf /rootfs/usr/local/lib/modprobe.d/nvidia.conf
 
         cp -R /lib/modules/* /rootfs/lib/modules
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/power/nut-client/pkg.yaml b/power/nut-client/pkg.yaml
index da3f8371..cdb775c5 100644
--- a/power/nut-client/pkg.yaml
+++ b/power/nut-client/pkg.yaml
@@ -82,7 +82,12 @@ steps:
         rm -rf /rootfs/usr/local/etc
         rm -rf /rootfs/usr/local/lib/nut
         rm -rf /rootfs/usr/local/sbin
-
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/storage/btrfs/pkg.yaml b/storage/btrfs/pkg.yaml
index 5382a2c4..202b6fa9 100644
--- a/storage/btrfs/pkg.yaml
+++ b/storage/btrfs/pkg.yaml
@@ -22,6 +22,11 @@ steps:
       - |
         # https://www.kernel.org/doc/html/v4.15/admin-guide/module-signing.html#signed-modules-and-stripping
         find /rootfs/lib/modules -name '*.ko' -exec grep -FL '~Module signature appended~' {} \+
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/storage/drbd/pkg.yaml b/storage/drbd/pkg.yaml
index 894facb9..bd3153a8 100644
--- a/storage/drbd/pkg.yaml
+++ b/storage/drbd/pkg.yaml
@@ -15,6 +15,12 @@ steps:
         mkdir -p /rootfs/lib/modules
 
         cp -R /lib/modules/* /rootfs/lib/modules
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/storage/fuse3/pkg.yaml b/storage/fuse3/pkg.yaml
index fc555a6d..47ddaacc 100644
--- a/storage/fuse3/pkg.yaml
+++ b/storage/fuse3/pkg.yaml
@@ -35,6 +35,12 @@ steps:
       - |
 
         DESTDIR=/rootfs ninja -C _build install
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/storage/iscsi-tools/pkg.yaml b/storage/iscsi-tools/pkg.yaml
index 9a6d179d..4376bf8a 100644
--- a/storage/iscsi-tools/pkg.yaml
+++ b/storage/iscsi-tools/pkg.yaml
@@ -19,6 +19,12 @@ steps:
       # cleanup
       rm -rf /rootfs/usr/local/include
       rm -rf /rootfs/usr/share
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /pkg/iscsid.yaml
     to: /rootfs/usr/local/etc/containers/iscsid.yaml
diff --git a/storage/mdadm/pkg.yaml b/storage/mdadm/pkg.yaml
index 8527a3b1..f448aa90 100644
--- a/storage/mdadm/pkg.yaml
+++ b/storage/mdadm/pkg.yaml
@@ -35,6 +35,12 @@ steps:
         cp mdmon /rootfs/usr/local/sbin/mdmon
         cp /pkg/files/udev-md-raid-arrays.rules   /rootfs/usr/etc/udev/rules.d/63-md-raid-arrays.rules
         cp /pkg/files/udev-md-raid-assembly.rules /rootfs/usr/etc/udev/rules.d/64-md-raid-assembly.rules
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/storage/zfs/pkg.yaml b/storage/zfs/pkg.yaml
index 1d5e1f96..40b4e648 100644
--- a/storage/zfs/pkg.yaml
+++ b/storage/zfs/pkg.yaml
@@ -18,6 +18,12 @@ steps:
         mkdir -p /rootfs/lib/modules /rootfs/usr/local/lib/containers/zpool-importer
 
         cp -R /lib/modules/* /rootfs/lib/modules
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs
diff --git a/tools/util-linux/pkg.yaml b/tools/util-linux/pkg.yaml
index 1d5750ea..fc73528f 100644
--- a/tools/util-linux/pkg.yaml
+++ b/tools/util-linux/pkg.yaml
@@ -40,6 +40,12 @@ steps:
         mkdir /rootfs
         make install DESTDIR=/rootfs
         rm -rf /rootfs/usr/local/{include,lib,share}
+    test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
 finalize:
   - from: /rootfs
     to: /rootfs