diff --git a/clusters/unraid-lab/apps/external-secrets/values.yaml b/clusters/unraid-lab/apps/external-secrets/values.yaml
index f8f289e..c678e2c 100644
--- a/clusters/unraid-lab/apps/external-secrets/values.yaml
+++ b/clusters/unraid-lab/apps/external-secrets/values.yaml
@@ -3,6 +3,13 @@
 # into the secret this subchart mounts by default.
 bitwarden-sdk-server:
   enabled: true
+  tolerations: &control_plane_toleration
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+global:
+  tolerations: *control_plane_toleration
 
 serviceMonitor:
   enabled: false # no Prometheus Operator CRDs on this cluster
diff --git a/values/clusters/unraid-lab/cert-manager.yaml b/values/clusters/unraid-lab/cert-manager.yaml
new file mode 100644
index 0000000..81bc8ed
--- /dev/null
+++ b/values/clusters/unraid-lab/cert-manager.yaml
@@ -0,0 +1,14 @@
+# Keep cert-manager on the two non-Imp control-plane nodes.
+tolerations: &control_plane_toleration
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+webhook:
+  tolerations: *control_plane_toleration
+
+cainjector:
+  tolerations: *control_plane_toleration
+
+startupapicheck:
+  tolerations: *control_plane_toleration
diff --git a/values/clusters/unraid-lab/metrics-server.yaml b/values/clusters/unraid-lab/metrics-server.yaml
new file mode 100644
index 0000000..a3b93ca
--- /dev/null
+++ b/values/clusters/unraid-lab/metrics-server.yaml
@@ -0,0 +1,5 @@
+# Keep metrics-server off the Imp runner node.
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
diff --git a/values/clusters/unraid-lab/radar.yaml b/values/clusters/unraid-lab/radar.yaml
index 01df256..44b115c 100644
--- a/values/clusters/unraid-lab/radar.yaml
+++ b/values/clusters/unraid-lab/radar.yaml
@@ -9,3 +9,8 @@ ingress:
   tls:
     - hosts:
         - radar-unraid-lab.wind-bearded.ts.net
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
diff --git a/values/clusters/unraid-lab/tailscale-operator.yaml b/values/clusters/unraid-lab/tailscale-operator.yaml
index 7ea44ac..8ccac1a 100644
--- a/values/clusters/unraid-lab/tailscale-operator.yaml
+++ b/values/clusters/unraid-lab/tailscale-operator.yaml
@@ -1,3 +1,9 @@
 # Unraid Talos cluster identity.
 proxyConfig:
   defaultTags: "tag:k8s-operator"
+
+operatorConfig:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule