diff --git a/Makefile b/Makefile
index 56fad7e8..385f4785 100644
--- a/Makefile
+++ b/Makefile
@@ -131,6 +131,7 @@ TARGETS += tailscale
 TARGETS += tenstorrent
 TARGETS += thunderbolt
 TARGETS += trident-iscsi-tools
+TARGETS += trident-nfs-tools
 TARGETS += uhid
 TARGETS += uinput
 TARGETS += usb-modem-drivers
diff --git a/storage/trident-nfs-tools/README.md b/storage/trident-nfs-tools/README.md
new file mode 100644
index 00000000..ab7dad92
--- /dev/null
+++ b/storage/trident-nfs-tools/README.md
@@ -0,0 +1,42 @@
+# trident-nfs-tools
+
+This extension provides `mkdir` on the host for **NetApp Trident CSI** NFS volume support on Talos Linux.
+
+## Problem
+
+Trident's `chwrap` mechanism shells out to `mkdir` to create NFS mountpoint directories.
+Talos Linux does not ship `mkdir` or any coreutils, causing NFS mounts to fail with:
+
+```
+Mkdir failed: exit status 2
+error mounting NFS volume ... exit status 32
+```
+
+Note: The iSCSI code path in Trident uses Go's native `os.MkdirAll()` and does not
+have this problem. Only the NFS code path shells out to the `mkdir` binary.
+
+## What's Included
+
+* **mkdir** — busybox multi-call binary (only depends on musl libc)
+
+## Use Case
+
+To run [trident-operator](https://github.com/NetApp/trident) with NFS, you need this extension
+in addition to `nfs-utils` (for NFSv3 locking support):
+
+```yaml
+systemExtensions:
+  - siderolabs/nfs-utils
+  - siderolabs/trident-nfs-tools
+```
+
+## Upstream Fix
+
+PR [#1152](https://github.com/NetApp/trident/pull/1152) replaces the `mkdir` shell-out
+with Go's native `os.MkdirAll()`. Once merged and released, this extension will no longer
+be needed.
+
+## References
+
+- [Trident issue #806](https://github.com/NetApp/trident/issues/806)
+- [Trident PR #1152](https://github.com/NetApp/trident/pull/1152)
diff --git a/storage/trident-nfs-tools/manifest.yaml.tmpl b/storage/trident-nfs-tools/manifest.yaml.tmpl
new file mode 100644
index 00000000..a03f8bbd
--- /dev/null
+++ b/storage/trident-nfs-tools/manifest.yaml.tmpl
@@ -0,0 +1,17 @@
+version: v1alpha1
+metadata:
+  name: trident-nfs-tools
+  version: "{{ .VERSION }}"
+  author: Oliver Hauer
+  description: |
+    [{{ .TIER }}] This system extension provides mkdir on the host for NetApp Trident CSI
+    NFS volume support on Talos Linux.
+
+    Trident's chwrap mechanism requires mkdir to be present on the host filesystem.
+    Without it, NFS mounts fail with "exit status 32".
+
+    See: https://github.com/NetApp/trident/issues/806
+    See: https://github.com/NetApp/trident/pull/1152
+  compatibility:
+    talos:
+      version: ">= v1.13.0"
diff --git a/storage/trident-nfs-tools/pkg.yaml b/storage/trident-nfs-tools/pkg.yaml
new file mode 100644
index 00000000..a4f9e9b2
--- /dev/null
+++ b/storage/trident-nfs-tools/pkg.yaml
@@ -0,0 +1,27 @@
+name: trident-nfs-tools
+variant: scratch
+shell: /bin/bash
+dependencies:
+  - stage: base
+steps:
+  - install:
+      - |
+        mkdir -p /rootfs/usr/local/sbin
+
+        # Use busybox mkdir from the build tools image.
+        # busybox is a multi-call binary; when invoked as "mkdir" (argv[0])
+        # it acts as mkdir. Only depends on musl libc which is on Talos.
+        cp /usr/bin/busybox /rootfs/usr/local/sbin/mkdir
+      - |
+        sed -i "s#\$VERSION#{{ .VERSION }}#" /pkg/manifest.yaml
+  - test:
+      - |
+        mkdir -p /extensions-validator-rootfs
+        cp -r /rootfs/ /extensions-validator-rootfs/rootfs
+        cp /pkg/manifest.yaml /extensions-validator-rootfs/manifest.yaml
+        /extensions-validator validate --rootfs=/extensions-validator-rootfs --pkg-name="${PKG_NAME}"
+finalize:
+  - from: /rootfs
+    to: /rootfs
+  - from: /pkg/manifest.yaml
+    to: /
diff --git a/storage/trident-nfs-tools/vars.yaml b/storage/trident-nfs-tools/vars.yaml
new file mode 100644
index 00000000..8daac951
--- /dev/null
+++ b/storage/trident-nfs-tools/vars.yaml
@@ -0,0 +1,3 @@
+VERSION: v0.1.0
+
+TIER: "contrib"