diff --git a/config/crd/bases/anywhere.eks.amazonaws.com_clusters.yaml b/config/crd/bases/anywhere.eks.amazonaws.com_clusters.yaml
index 2126ac2e27db..92b773ab2c1f 100644
--- a/config/crd/bases/anywhere.eks.amazonaws.com_clusters.yaml
+++ b/config/crd/bases/anywhere.eks.amazonaws.com_clusters.yaml
@@ -248,8 +248,7 @@ spec:
                               timeout:
                                 description: Timeout for kube-apiserver to wait for
                                   KMS plugin. Default is 3s.
-                                format: int64
-                                type: integer
+                                type: string
                             required:
                             - name
                             - socketListenAddress
diff --git a/config/manifest/eksa-components.yaml b/config/manifest/eksa-components.yaml
index 717ef83e578b..b5d6c6439808 100644
--- a/config/manifest/eksa-components.yaml
+++ b/config/manifest/eksa-components.yaml
@@ -3884,8 +3884,7 @@ spec:
                               timeout:
                                 description: Timeout for kube-apiserver to wait for
                                   KMS plugin. Default is 3s.
-                                format: int64
-                                type: integer
+                                type: string
                             required:
                             - name
                             - socketListenAddress
diff --git a/pkg/api/v1alpha1/etcdencryption.go b/pkg/api/v1alpha1/etcdencryption.go
index 3fee4c7428f1..52f268e87714 100644
--- a/pkg/api/v1alpha1/etcdencryption.go
+++ b/pkg/api/v1alpha1/etcdencryption.go
@@ -5,13 +5,14 @@ import (
 	"time"
 
 	"github.com/pkg/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/aws/eks-anywhere/pkg/utils/ptr"
 )
 
 var (
 	defaultKMSCacheSize = ptr.Int32(1000)
-	defaultKMSTimeout   = time.Second * 3
+	defaultKMSTimeout   = metav1.Duration{Duration: time.Second * 3}
 )
 
 // ValidateEtcdEncryptionConfig validates the etcd encryption configuration.
diff --git a/pkg/api/v1alpha1/etcdencryption_types.go b/pkg/api/v1alpha1/etcdencryption_types.go
index c530f639275d..417121d9b663 100644
--- a/pkg/api/v1alpha1/etcdencryption_types.go
+++ b/pkg/api/v1alpha1/etcdencryption_types.go
@@ -1,8 +1,6 @@
 package v1alpha1
 
-import (
-	"time"
-)
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 // EtcdEncryption defines the configuration for ETCD encryption.
 type EtcdEncryption struct {
@@ -28,5 +26,5 @@ type KMS struct {
 	// SocketListenAddress defines a UNIX socket address that the KMS provider listens on.
 	SocketListenAddress string `json:"socketListenAddress"`
 	// Timeout for kube-apiserver to wait for KMS plugin. Default is 3s.
-	Timeout *time.Duration `json:"timeout,omitempty"`
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
 }
diff --git a/pkg/api/v1alpha1/zz_generated.deepcopy.go b/pkg/api/v1alpha1/zz_generated.deepcopy.go
index 3ef8acfd9058..66ed81d60bd3 100644
--- a/pkg/api/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/api/v1alpha1/zz_generated.deepcopy.go
@@ -26,7 +26,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/cluster-api/api/v1beta1"
 	apiv1beta1 "sigs.k8s.io/cluster-api/bootstrap/kubeadm/api/v1beta1"
-	timex "time"
 )
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
@@ -1458,7 +1457,7 @@ func (in *KMS) DeepCopyInto(out *KMS) {
 	}
 	if in.Timeout != nil {
 		in, out := &in.Timeout, &out.Timeout
-		*out = new(timex.Duration)
+		*out = new(metav1.Duration)
 		**out = **in
 	}
 }