diff --git a/packages/chrony/chrony-conf b/packages/chrony/chrony-conf
index 0cb106256..91032c0a9 100644
--- a/packages/chrony/chrony-conf
+++ b/packages/chrony/chrony-conf
@@ -4,6 +4,26 @@ ntp = "v1"
 {{#each settings.ntp.time-servers}}
 pool {{this}}{{#each ../settings.ntp.options}} {{this}}{{/each}}
 {{/each}}
+{{#if settings.ntp.refclocks}}
+{{#each settings.ntp.refclocks}}
+refclock {{this.driver}} {{this.parameter}}{{#if this.options}}{{#each this.options}} {{this}}{{/each}}{{/if}}
+{{/each}}
+{{/if}}
+{{#if settings.ntp.allow}}
+{{#each settings.ntp.allow}}
+allow {{this}}
+{{/each}}
+{{/if}}
+{{#if settings.ntp.cmdallow}}
+{{#each settings.ntp.cmdallow}}
+cmdallow {{this}}
+{{/each}}
+{{/if}}
+{{#if settings.ntp.bindcmdaddress}}
+{{#each settings.ntp.bindcmdaddress}}
+bindcmdaddress {{this}}
+{{/each}}
+{{/if}}
 driftfile /var/lib/chrony/drift
 makestep 1.0 3
 dumponexit
diff --git a/packages/os/ena-ptp.rules b/packages/os/ena-ptp.rules
new file mode 100644
index 000000000..7aee8bcf8
--- /dev/null
+++ b/packages/os/ena-ptp.rules
@@ -0,0 +1,11 @@
+# Amazon EC2 exposes the Amazon Time Sync Service PTP Hardware Clock (PHC) through
+# the ENA driver when the instance is booted with the `ena.phc_enable=1` kernel
+# parameter. The kernel names PTP character devices /dev/ptpN in probe order, which
+# is not stable, so create a predictable /dev/ptp_ena symlink -- matching the name
+# used by Amazon Linux and the EC2 documentation -- for chrony to reference via
+# `settings.ntp.refclocks` (e.g. `refclock PHC /dev/ptp_ena`).
+ACTION=="remove", GOTO="ena_ptp_end"
+SUBSYSTEM!="ptp", GOTO="ena_ptp_end"
+ATTR{clock_name}=="ena-ptp-*", SYMLINK+="ptp_ena"
+
+LABEL="ena_ptp_end"
diff --git a/packages/os/os.spec b/packages/os/os.spec
index b748ece8a..4bea2a11f 100644
--- a/packages/os/os.spec
+++ b/packages/os/os.spec
@@ -85,6 +85,7 @@ Source300: ephemeral-storage.rules
 Source301: ebs-volumes.rules
 Source302: ephemeral-ebs-storage.rules
 Source303: supplemental-storage.rules
+Source304: ena-ptp.rules
 
 # 4xx sources: Bottlerocket licenses
 Source400: COPYRIGHT
@@ -793,6 +794,7 @@ install -p -m 0644 %{S:300} %{buildroot}%{_cross_udevrulesdir}/80-ephemeral-stor
 install -p -m 0644 %{S:301} %{buildroot}%{_cross_udevrulesdir}/81-ebs-volumes.rules
 install -p -m 0644 %{S:302} %{buildroot}%{_cross_udevrulesdir}/82-ephemeral-ebs-storage.rules
 install -p -m 0644 %{S:303} %{buildroot}%{_cross_udevrulesdir}/83-supplemental-storage.rules
+install -p -m 0644 %{S:304} %{buildroot}%{_cross_udevrulesdir}/84-ena-ptp.rules
 
 install -d %{buildroot}%{_cross_datadir}/whippet/
 install -p -m 0644 %{S:22} %{buildroot}%{_cross_datadir}/whippet/system.toml
@@ -813,6 +815,7 @@ install -p -m 0644 %{S:400} %{S:401} %{S:402} %{buildroot}%{_cross_licensedir}
 %{_cross_licensedir}/COPYRIGHT
 %{_cross_licensedir}/LICENSE-MIT
 %{_cross_licensedir}/LICENSE-APACHE
+%{_cross_udevrulesdir}/84-ena-ptp.rules
 
 %files -n %{_cross_os}apiserver
 %{_cross_bindir}/apiserver