diff --git a/Cargo.lock b/Cargo.lock
index 6a754acc3a8..82db976d549 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -317,6 +317,42 @@ dependencies = [
  "settings-plugins",
 ]
 
+[[package]]
+name = "aws-mantle-1"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
+[[package]]
+name = "aws-mantle-1-fips"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
+[[package]]
+name = "aws-mantle-1-nvidia"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
+[[package]]
+name = "aws-mantle-1-nvidia-fips"
+version = "0.1.0"
+dependencies = [
+ "settings-defaults",
+ "settings-migrations",
+ "settings-plugins",
+]
+
 [[package]]
 name = "metal-dev"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 1c8848cce2e..adb05a2093e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,6 +15,10 @@ members = [
     "variants/aws-ecs-3-nvidia-fips",
     "variants/aws-ecs-4",
     "variants/aws-ecs-4-nvidia",
+    "variants/aws-mantle-1",
+    "variants/aws-mantle-1-fips",
+    "variants/aws-mantle-1-nvidia",
+    "variants/aws-mantle-1-nvidia-fips",
     "variants/aws-k8s-1.31",
     "variants/aws-k8s-1.31-fips",
     "variants/aws-k8s-1.32",
diff --git a/Twoliter.lock b/Twoliter.lock
index 1eb1154e8d4..312cc17a8c1 100644
--- a/Twoliter.lock
+++ b/Twoliter.lock
@@ -17,7 +17,7 @@ digest = "hNrjl3b0anJiUNnwiKw/gPZoCpq7pduMI8thTZloJdo="
 
 [[kit]]
 name = "bottlerocket-core-kit"
-version = "16.2.0"
+version = "16.3.0"
 vendor = "bottlerocket"
-source = "public.ecr.aws/bottlerocket/bottlerocket-core-kit:v16.2.0"
-digest = "O1opp76tjBi5ZM/LYoWIG8OQWOHlTsEKdCBUV4/vlVI="
+source = "public.ecr.aws/bottlerocket/bottlerocket-core-kit:v16.3.0"
+digest = "TF+7JlJru7wzNybBtDBXpCQv32LOMm6C+2kQ3JBV0uU="
diff --git a/Twoliter.toml b/Twoliter.toml
index 4b1763190ca..3ef1837d00c 100644
--- a/Twoliter.toml
+++ b/Twoliter.toml
@@ -17,5 +17,5 @@ vendor = "bottlerocket"
 
 [[kit]]
 name = "bottlerocket-core-kit"
-version = "16.2.0"
+version = "16.3.0"
 vendor = "bottlerocket"
diff --git a/packages/settings-defaults/settings-defaults.spec b/packages/settings-defaults/settings-defaults.spec
index b18c85fae29..2b7f2b02337 100644
--- a/packages/settings-defaults/settings-defaults.spec
+++ b/packages/settings-defaults/settings-defaults.spec
@@ -107,6 +107,34 @@ Conflicts: %{_cross_os}settings-defaults(any)
 %description aws-ecs-4-nvidia
 %{summary}.
 
+%package aws-mantle-1
+Summary: Settings defaults for the aws-mantle-1 FIPS and non-FIPS variants
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1) or
+           %{_cross_os}variant(aws-mantle-1-fips)
+          %{nil}})
+Provides: %{_cross_os}settings-defaults(any)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-fips)
+Conflicts: %{_cross_os}settings-defaults(any)
+
+%description aws-mantle-1
+%{summary}.
+
+%package aws-mantle-1-nvidia
+Summary: Settings defaults for the aws-mantle-1-nvidia variant
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1-nvidia) or
+           %{_cross_os}variant(aws-mantle-1-nvidia-fips)
+           %{nil}})
+Provides: %{_cross_os}settings-defaults(any)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-nvidia)
+Provides: %{_cross_os}settings-defaults(aws-mantle-1-nvidia-fips)
+Conflicts: %{_cross_os}settings-defaults(any)
+
+%description aws-mantle-1-nvidia
+%{summary}.
+
 %package aws-k8s-1.31
 Summary: Settings defaults for the aws-k8s 1.31 variants
 Requires: (%{shrink:
@@ -383,6 +411,8 @@ for defaults in \
   aws-ecs-3-nvidia \
   aws-ecs-4 \
   aws-ecs-4-nvidia \
+  aws-mantle-1 \
+  aws-mantle-1-nvidia \
   aws-k8s-1.31 \
   aws-k8s-1.31-nvidia \
   aws-k8s-1.32 \
@@ -429,6 +459,8 @@ for defaults in \
   aws-ecs-3-nvidia \
   aws-ecs-4 \
   aws-ecs-4-nvidia \
+  aws-mantle-1 \
+  aws-mantle-1-nvidia \
   aws-k8s-1.31 \
   aws-k8s-1.31-nvidia \
   aws-k8s-1.32 \
@@ -490,6 +522,14 @@ done
 %{_cross_defaultsdir}/aws-ecs-4-nvidia.toml
 %{_cross_tmpfilesdir}/storewolf-defaults-aws-ecs-4-nvidia.conf
 
+%files aws-mantle-1
+%{_cross_defaultsdir}/aws-mantle-1.toml
+%{_cross_tmpfilesdir}/storewolf-defaults-aws-mantle-1.conf
+
+%files aws-mantle-1-nvidia
+%{_cross_defaultsdir}/aws-mantle-1-nvidia.toml
+%{_cross_tmpfilesdir}/storewolf-defaults-aws-mantle-1-nvidia.conf
+
 %files aws-k8s-1.31
 %{_cross_defaultsdir}/aws-k8s-1.31.toml
 %{_cross_tmpfilesdir}/storewolf-defaults-aws-k8s-1.31.conf
diff --git a/packages/settings-plugins/settings-plugins.spec b/packages/settings-plugins/settings-plugins.spec
index 97ef118165d..14db03baa56 100644
--- a/packages/settings-plugins/settings-plugins.spec
+++ b/packages/settings-plugins/settings-plugins.spec
@@ -80,6 +80,24 @@ Conflicts: %{_cross_os}settings-plugin(any)
 %description aws-ecs-4
 %{summary}.
 
+%package aws-mantle-1
+Summary: Settings plugin for the aws-mantle-1 variant
+Requires: (%{shrink:
+           %{_cross_os}variant(aws-mantle-1) or
+           %{_cross_os}variant(aws-mantle-1-fips) or
+           %{_cross_os}variant(aws-mantle-1-nvidia) or
+           %{_cross_os}variant(aws-mantle-1-nvidia-fips)
+           %{nil}})
+Provides: %{_cross_os}settings-plugin(any)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-nvidia)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-fips)
+Provides: %{_cross_os}settings-plugin(aws-mantle-1-nvidia-fips)
+Conflicts: %{_cross_os}settings-plugin(any)
+
+%description aws-mantle-1
+%{summary}.
+
 %package aws-k8s
 Summary: Settings plugin for the aws-k8s variants
 Requires: %{_cross_os}variant-family(aws-k8s)
@@ -175,6 +193,7 @@ Conflicts: %{_cross_os}settings-plugin(any)
   -p settings-plugin-aws-ecs-2 \
   -p settings-plugin-aws-ecs-3 \
   -p settings-plugin-aws-ecs-4 \
+  -p settings-plugin-aws-mantle-1 \
   -p settings-plugin-aws-k8s \
   -p settings-plugin-aws-k8s-nvidia \
   -p settings-plugin-metal-dev \
@@ -192,6 +211,7 @@ for plugin in \
   aws-ecs-2 \
   aws-ecs-3 \
   aws-ecs-4 \
+  aws-mantle-1 \
   aws-k8s-nvidia \
   aws-k8s \
   metal-dev \
@@ -235,6 +255,11 @@ done
 %{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-ecs-4.conf
 %{_cross_tmpfilesdir}/settings-plugin-aws-ecs-4.conf
 
+%files aws-mantle-1
+%{_cross_pluginsdir}/aws-mantle-1/libsettings.so
+%{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-mantle-1.conf
+%{_cross_tmpfilesdir}/settings-plugin-aws-mantle-1.conf
+
 %files aws-k8s
 %{_cross_pluginsdir}/aws-k8s/libsettings.so
 %{_cross_factorydir}%{_cross_sysconfdir}/ld.so.conf.d/aws-k8s.conf
diff --git a/sources/Cargo.lock b/sources/Cargo.lock
index 578573211e6..0c3f1c34f1c 100644
--- a/sources/Cargo.lock
+++ b/sources/Cargo.lock
@@ -2043,6 +2043,20 @@ dependencies = [
  "bottlerocket-defaults-helper",
 ]
 
+[[package]]
+name = "settings-defaults-aws-mantle-1"
+version = "0.1.0"
+dependencies = [
+ "bottlerocket-defaults-helper",
+]
+
+[[package]]
+name = "settings-defaults-aws-mantle-1-nvidia"
+version = "0.1.0"
+dependencies = [
+ "bottlerocket-defaults-helper",
+]
+
 [[package]]
 name = "settings-defaults-metal-dev"
 version = "0.1.0"
@@ -2498,6 +2512,17 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "settings-plugin-aws-mantle-1"
+version = "0.1.0"
+dependencies = [
+ "abi_stable",
+ "bottlerocket-settings-models",
+ "bottlerocket-settings-plugin",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "settings-plugin-metal-dev"
 version = "0.1.0"
diff --git a/sources/Cargo.toml b/sources/Cargo.toml
index f3318f335c0..04d5695a8ce 100644
--- a/sources/Cargo.toml
+++ b/sources/Cargo.toml
@@ -32,6 +32,8 @@ members = [
     "settings-defaults/aws-k8s-1.35-nvidia",
     "settings-defaults/aws-k8s-1.36",
     "settings-defaults/aws-k8s-1.36-nvidia",
+    "settings-defaults/aws-mantle-1",
+    "settings-defaults/aws-mantle-1-nvidia",
     "settings-defaults/metal-dev",
     "settings-defaults/metal-k8s-1.30",
     "settings-defaults/vmware-dev",
@@ -72,6 +74,7 @@ members = [
     "settings-plugins/aws-ecs-2",
     "settings-plugins/aws-ecs-3",
     "settings-plugins/aws-ecs-4",
+    "settings-plugins/aws-mantle-1",
     "settings-plugins/aws-k8s",
     "settings-plugins/aws-k8s-nvidia",
     "settings-plugins/metal-dev",
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml b/sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml
new file mode 100644
index 00000000000..f16d856d84d
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "settings-defaults-aws-mantle-1-nvidia"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+build = "../build-defaults.rs"
+
+[lib]
+path = "../defaults-toml.rs"
+
+[build-dependencies]
+bottlerocket-defaults-helper.workspace = true
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml
new file mode 120000
index 00000000000..a202ba61a4c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/10-defaults.toml
@@ -0,0 +1 @@
+../../../shared-defaults/defaults.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml
new file mode 120000
index 00000000000..4d404d663cd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/20-aws-host-containers.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-host-containers.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml
new file mode 120000
index 00000000000..7709ecb2ebd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/21-aws-bootstrap-container.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-bootstrap-container.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml
new file mode 120000
index 00000000000..a33d541652c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/25-cf-signal.toml
@@ -0,0 +1 @@
+../../../shared-defaults/cf-signal.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml
new file mode 120000
index 00000000000..a6a17e88f54
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/40-aws-creds.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-creds.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml
new file mode 120000
index 00000000000..ccba8a8ac90
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/51-registry-metadata.toml
@@ -0,0 +1 @@
+../../../shared-defaults/registry-metadata.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/53-containerd-pki.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/53-containerd-pki.toml
new file mode 120000
index 00000000000..21ac1df23ab
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/53-containerd-pki.toml
@@ -0,0 +1 @@
+../../../shared-defaults/containerd-pki.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml
new file mode 120000
index 00000000000..b4d93f54799
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/55-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml
new file mode 120000
index 00000000000..cced543330e
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/60-lockdown-none.toml
@@ -0,0 +1 @@
+../../../shared-defaults/lockdown-none.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml
new file mode 120000
index 00000000000..e7b73c620dd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1-nvidia/defaults.d/70-oci-hooks.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-hooks.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/Cargo.toml b/sources/settings-defaults/aws-mantle-1/Cargo.toml
new file mode 100644
index 00000000000..1c173f0ee5d
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "settings-defaults-aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+build = "../build-defaults.rs"
+
+[lib]
+path = "../defaults-toml.rs"
+
+[build-dependencies]
+bottlerocket-defaults-helper.workspace = true
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml
new file mode 120000
index 00000000000..a202ba61a4c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/10-defaults.toml
@@ -0,0 +1 @@
+../../../shared-defaults/defaults.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml
new file mode 120000
index 00000000000..4d404d663cd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/20-aws-host-containers.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-host-containers.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml
new file mode 120000
index 00000000000..7709ecb2ebd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/21-aws-bootstrap-container.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-bootstrap-container.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml
new file mode 120000
index 00000000000..a33d541652c
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/25-cf-signal.toml
@@ -0,0 +1 @@
+../../../shared-defaults/cf-signal.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/40-aws-creds.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/40-aws-creds.toml
new file mode 120000
index 00000000000..a6a17e88f54
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/40-aws-creds.toml
@@ -0,0 +1 @@
+../../../shared-defaults/aws-creds.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/51-registry-metadata.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/51-registry-metadata.toml
new file mode 120000
index 00000000000..ccba8a8ac90
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/51-registry-metadata.toml
@@ -0,0 +1 @@
+../../../shared-defaults/registry-metadata.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/53-containerd-pki.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/53-containerd-pki.toml
new file mode 120000
index 00000000000..21ac1df23ab
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/53-containerd-pki.toml
@@ -0,0 +1 @@
+../../../shared-defaults/containerd-pki.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/55-image-verification.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/55-image-verification.toml
new file mode 120000
index 00000000000..b4d93f54799
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/55-image-verification.toml
@@ -0,0 +1 @@
+../../../shared-defaults/image-verification.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/60-lockdown-integrity.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/60-lockdown-integrity.toml
new file mode 120000
index 00000000000..8b4de873a39
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/60-lockdown-integrity.toml
@@ -0,0 +1 @@
+../../../shared-defaults/lockdown-integrity.toml
\ No newline at end of file
diff --git a/sources/settings-defaults/aws-mantle-1/defaults.d/70-oci-hooks.toml b/sources/settings-defaults/aws-mantle-1/defaults.d/70-oci-hooks.toml
new file mode 120000
index 00000000000..e7b73c620dd
--- /dev/null
+++ b/sources/settings-defaults/aws-mantle-1/defaults.d/70-oci-hooks.toml
@@ -0,0 +1 @@
+../../../shared-defaults/oci-hooks.toml
\ No newline at end of file
diff --git a/sources/settings-plugins/aws-mantle-1/Cargo.toml b/sources/settings-plugins/aws-mantle-1/Cargo.toml
new file mode 100644
index 00000000000..14bd451e6c1
--- /dev/null
+++ b/sources/settings-plugins/aws-mantle-1/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "settings-plugin-aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0 OR MIT"
+publish = false
+
+[lib]
+crate-type = ["cdylib"]
+name = "settings_aws_mantle_1"
+
+[dependencies]
+abi_stable.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+
+# settings plugins
+bottlerocket-settings-models.workspace = true
+bottlerocket-settings-plugin.workspace = true
diff --git a/sources/settings-plugins/aws-mantle-1/src/lib.rs b/sources/settings-plugins/aws-mantle-1/src/lib.rs
new file mode 100644
index 00000000000..94deacd8143
--- /dev/null
+++ b/sources/settings-plugins/aws-mantle-1/src/lib.rs
@@ -0,0 +1,21 @@
+use bottlerocket_settings_models::model_derive::model;
+use bottlerocket_settings_plugin::SettingsPlugin;
+
+#[derive(SettingsPlugin)]
+#[model(rename = "settings", impl_default = true)]
+struct AwsMantle1Settings {
+    motd: bottlerocket_settings_models::MotdV1,
+    host_containers: bottlerocket_settings_models::HostContainersSettingsV1,
+    bootstrap_commands: bottlerocket_settings_models::BootstrapCommandsSettingsV1,
+    bootstrap_containers: bottlerocket_settings_models::BootstrapContainersSettingsV1,
+    ntp: bottlerocket_settings_models::NtpSettingsV1,
+    network: bottlerocket_settings_models::NetworkSettingsV1,
+    kernel: bottlerocket_settings_models::KernelSettingsV1,
+    aws: bottlerocket_settings_models::AwsSettingsV1,
+    pki: bottlerocket_settings_models::PkiSettingsV1,
+    container_registry: bottlerocket_settings_models::RegistrySettingsV1,
+    oci_hooks: bottlerocket_settings_models::OciHooksSettingsV1,
+    cloudformation: bottlerocket_settings_models::CloudFormationSettingsV1,
+    dns: bottlerocket_settings_models::DnsSettingsV1,
+    image_verifier_plugins: bottlerocket_settings_models::ImageVerifierPluginsSettingsV1,
+}
diff --git a/sources/shared-defaults/containerd-pki.toml b/sources/shared-defaults/containerd-pki.toml
new file mode 100644
index 00000000000..72e17d229f6
--- /dev/null
+++ b/sources/shared-defaults/containerd-pki.toml
@@ -0,0 +1,2 @@
+[metadata.settings.pki]
+affected-services = ["pki", "containerd"]
diff --git a/sources/shared-defaults/registry-metadata.toml b/sources/shared-defaults/registry-metadata.toml
new file mode 100644
index 00000000000..ba06ac8fc3c
--- /dev/null
+++ b/sources/shared-defaults/registry-metadata.toml
@@ -0,0 +1,14 @@
+# Network
+[metadata.settings.network]
+affected-services = ["containerd", "host-containerd", "host-containers"]
+
+[metadata.settings.container-registry]
+affected-services = ["containerd", "host-containers", "bootstrap-containers", "thar-be-registries"]
+
+# Image registry mirrors
+[metadata.settings.container-registry.mirrors]
+affected-services = ["containerd", "host-containers", "bootstrap-containers", "thar-be-registries"]
+
+# Image registry credentials
+[metadata.settings.container-registry.credentials]
+affected-services = ["containerd", "host-containers", "bootstrap-containers", "thar-be-registries"]
diff --git a/variants/README.md b/variants/README.md
index 900ae1f6791..ced525666a8 100644
--- a/variants/README.md
+++ b/variants/README.md
@@ -190,6 +190,34 @@ The [aws-ecs-3-nvidia-fips](aws-ecs-3-nvidia-fips/Cargo.toml) variant includes t
 container instance in AWS.
 It also includes the required packages to configure containers to leverage NVIDIA GPUs and is FIPS-enabled.
 
+### aws-mantle-1: limited support
+
+The [aws-mantle-1](aws-mantle-1/Cargo.toml) variant is a minimal Bottlerocket build. Unlike other AWS variants, it does not run a container orchestrator agent.
+
+This variant is intended for use by AWS Bedrock's Mantle API and may make breaking changes without warning. If you need a fully supported variant, use one of the Kubernetes or Amazon ECS variants instead.
+
+### aws-mantle-1-fips: limited support
+
+The [aws-mantle-1-fips](aws-mantle-1-fips/Cargo.toml) variant is a minimal Bottlerocket build. Unlike other AWS variants, it does not run a container orchestrator agent. It is FIPS enabled.
+
+This variant is intended for use by AWS Bedrock's Mantle API and may make breaking changes without warning. If you need a fully supported variant, use one of the Kubernetes or Amazon ECS variants instead.
+
+### aws-mantle-1-nvidia: limited support
+
+The [aws-mantle-1-nvidia](aws-mantle-1-nvidia/Cargo.toml) variant is a minimal Bottlerocket build. Unlike other AWS variants, it does not run a container orchestrator agent.
+
+This variant is intended for use by AWS Bedrock's Mantle API and may make breaking changes without warning. If you need a fully supported variant, use one of the Kubernetes or Amazon ECS variants instead.
+
+It also includes the required packages to configure containers to leverage NVIDIA GPUs.
+
+### aws-mantle-1-nvidia-fips: limited support
+
+The [aws-mantle-1-nvidia-fips](aws-mantle-1-nvidia-fips/Cargo.toml) variant is a minimal Bottlerocket build. Unlike other AWS variants, it does not run a container orchestrator agent.
+
+This variant is intended for use by AWS Bedrock's Mantle API and may make breaking changes without warning. If you need a fully supported variant, use one of the Kubernetes or Amazon ECS variants instead.
+
+It also includes the required packages to configure containers to leverage NVIDIA GPUs and is FIPS-enabled.
+
 ### aws-dev: AWS development build
 
 The [aws-dev](aws-dev/Cargo.toml) variant has useful packages for local development of the OS.
diff --git a/variants/aws-mantle-1-fips/Cargo.toml b/variants/aws-mantle-1-fips/Cargo.toml
new file mode 100644
index 00000000000..01df9be79cc
--- /dev/null
+++ b/variants/aws-mantle-1-fips/Cargo.toml
@@ -0,0 +1,54 @@
+[package]
+name = "aws-mantle-1-fips"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+in-place-updates = false
+ephemeral-encryption-keys = true
+fips = true
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+]
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "fips=1",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1-fips/amispec.toml b/variants/aws-mantle-1-fips/amispec.toml
new file mode 100644
index 00000000000..0df1d42bf41
--- /dev/null
+++ b/variants/aws-mantle-1-fips/amispec.toml
@@ -0,0 +1,11 @@
+description = "The aws-mantle-1 variant is a minimal Bottlerocket build for AWS Bedrock's Mantle API. It carries several experimental features like ephemeral-encryption-keys, runs no container orchestrator agent and may make breaking changes without warning."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"
diff --git a/variants/aws-mantle-1-nvidia-fips/Cargo.toml b/variants/aws-mantle-1-nvidia-fips/Cargo.toml
new file mode 100644
index 00000000000..0e89fd71514
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia-fips/Cargo.toml
@@ -0,0 +1,61 @@
+[package]
+name = "aws-mantle-1-nvidia-fips"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+ephemeral-encryption-keys = true
+fips = true
+in-place-updates = false
+
+[package.metadata.build-variant.image-layout]
+os-image-size-gib = 4
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+# NVIDIA support
+    "nvidia-container-toolkit-ecs",
+    "kmod-6.18-nvidia-r580-tesla",
+    "kmod-6.18-nvidia-r580-gdrcopy",
+    "kmod-6.18-nvidia-r580-imex-config",
+]
+
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "fips=1",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1-nvidia-fips/amispec.toml b/variants/aws-mantle-1-nvidia-fips/amispec.toml
new file mode 100644
index 00000000000..0df1d42bf41
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia-fips/amispec.toml
@@ -0,0 +1,11 @@
+description = "The aws-mantle-1 variant is a minimal Bottlerocket build for AWS Bedrock's Mantle API. It carries several experimental features like ephemeral-encryption-keys, runs no container orchestrator agent and may make breaking changes without warning."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"
diff --git a/variants/aws-mantle-1-nvidia/Cargo.toml b/variants/aws-mantle-1-nvidia/Cargo.toml
new file mode 100644
index 00000000000..5f7217268e2
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia/Cargo.toml
@@ -0,0 +1,59 @@
+[package]
+name = "aws-mantle-1-nvidia"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+ephemeral-encryption-keys = true
+in-place-updates = false
+
+[package.metadata.build-variant.image-layout]
+os-image-size-gib = 4
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+# NVIDIA support
+    "nvidia-container-toolkit-ecs",
+    "kmod-6.18-nvidia-r580-tesla",
+    "kmod-6.18-nvidia-r580-gdrcopy",
+    "kmod-6.18-nvidia-r580-imex-config",
+]
+
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1-nvidia/amispec.toml b/variants/aws-mantle-1-nvidia/amispec.toml
new file mode 100644
index 00000000000..0df1d42bf41
--- /dev/null
+++ b/variants/aws-mantle-1-nvidia/amispec.toml
@@ -0,0 +1,11 @@
+description = "The aws-mantle-1 variant is a minimal Bottlerocket build for AWS Bedrock's Mantle API. It carries several experimental features like ephemeral-encryption-keys, runs no container orchestrator agent and may make breaking changes without warning."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"
diff --git a/variants/aws-mantle-1/Cargo.toml b/variants/aws-mantle-1/Cargo.toml
new file mode 100644
index 00000000000..c7b29470689
--- /dev/null
+++ b/variants/aws-mantle-1/Cargo.toml
@@ -0,0 +1,52 @@
+[package]
+name = "aws-mantle-1"
+version = "0.1.0"
+edition = "2021"
+publish = false
+build = "../build.rs"
+# Don't rebuild crate just because of changes to README.
+exclude = ["README.md"]
+
+[package.metadata.build-variant.image-features]
+grub-set-private-var = true
+uefi-secure-boot = true
+xfs-data-partition = true
+systemd-networkd = true
+erofs-root-partition = true
+external-kmod-development = false
+encrypted-storage = true
+in-place-updates = false
+ephemeral-encryption-keys = true
+
+[package.metadata.build-variant]
+image-format = "uki"
+included-packages = [
+# core
+    "release",
+    "kernel-6.18",
+    "containerd-2.2",
+    "systemd-257",
+    "systemd-257-bootloader",
+    "nftables",
+    "whippet",
+    "aws-signer-notation-plugin",
+    "digestion-image-verifier",
+    "notation-image-verifier",
+    "thar-be-image-verifiers",
+]
+kernel-parameters = [
+    "console=tty0",
+    "console=ttyS0,115200n8",
+    "net.ifnames=0",
+    "netdog.default-interface=eth0:dhcp4,dhcp6?",
+    "quiet",
+    "module_blacklist=i8042",
+]
+
+[lib]
+path = "../variants.rs"
+
+[build-dependencies]
+settings-defaults = { path = "../../packages/settings-defaults" }
+settings-plugins = { path = "../../packages/settings-plugins" }
+settings-migrations = { path = "../../packages/settings-migrations" }
diff --git a/variants/aws-mantle-1/amispec.toml b/variants/aws-mantle-1/amispec.toml
new file mode 100644
index 00000000000..0df1d42bf41
--- /dev/null
+++ b/variants/aws-mantle-1/amispec.toml
@@ -0,0 +1,11 @@
+description = "The aws-mantle-1 variant is a minimal Bottlerocket build for AWS Bedrock's Mantle API. It carries several experimental features like ephemeral-encryption-keys, runs no container orchestrator agent and may make breaking changes without warning."
+
+# https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-options.html
+imds-support = "v2.0"
+
+# Override the pubsys "gp2" default
+[block-device-mappings."/dev/xvda".ebs]
+volume-type = "gp3"
+
+[block-device-mappings."/dev/xvdb".ebs]
+volume-type = "gp3"