diff --git a/Makefile b/Makefile
index 854aa31ea192d..074321f8b96c3 100644
--- a/Makefile
+++ b/Makefile
@@ -1388,6 +1388,7 @@ derive:
 derive-up-to-date: must-start-clean/host derive
 	@if ! git diff --quiet; then \
 		echo 'Please run make derive.'; \
+		git diff; \
 		exit 1; \
 	fi
 
@@ -1423,6 +1424,7 @@ endif
 protos-up-to-date/host: must-start-clean/host grpc/host
 	@if ! git diff --quiet; then \
 		echo 'Please run make grpc.'; \
+		git diff; \
 		exit 1; \
 	fi
 
@@ -1430,6 +1432,7 @@ protos-up-to-date/host: must-start-clean/host grpc/host
 must-start-clean/host:
 	@if ! git diff --quiet; then \
 		echo 'This must be run from a repo with no unstaged commits.'; \
+		git diff; \
 		exit 1; \
 	fi
 
@@ -1439,6 +1442,7 @@ crds-up-to-date: must-start-clean/host
 	$(MAKE) -C integrations/operator manifests
 	@if ! git diff --quiet; then \
 		echo 'Please run make -C integrations/operator manifests.'; \
+		git diff; \
 		exit 1; \
 	fi
 
diff --git a/api/gen/proto/go/assist/v1/assist_grpc.pb.go b/api/gen/proto/go/assist/v1/assist_grpc.pb.go
index f86a586be0689..c9b63831db087 100644
--- a/api/gen/proto/go/assist/v1/assist_grpc.pb.go
+++ b/api/gen/proto/go/assist/v1/assist_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/assist/v1/assist.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AssistService_CreateAssistantConversation_FullMethodName     = "/teleport.assist.v1.AssistService/CreateAssistantConversation"
@@ -47,6 +47,8 @@ const (
 // AssistServiceClient is the client API for AssistService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AssistService is a service that provides an ability to communicate with the Teleport Assist.
 type AssistServiceClient interface {
 	// CreateNewConversation creates a new conversation and returns the UUID of it.
 	CreateAssistantConversation(ctx context.Context, in *CreateAssistantConversationRequest, opts ...grpc.CallOption) (*CreateAssistantConversationResponse, error)
@@ -75,8 +77,9 @@ func NewAssistServiceClient(cc grpc.ClientConnInterface) AssistServiceClient {
 }
 
 func (c *assistServiceClient) CreateAssistantConversation(ctx context.Context, in *CreateAssistantConversationRequest, opts ...grpc.CallOption) (*CreateAssistantConversationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateAssistantConversationResponse)
-	err := c.cc.Invoke(ctx, AssistService_CreateAssistantConversation_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_CreateAssistantConversation_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +87,9 @@ func (c *assistServiceClient) CreateAssistantConversation(ctx context.Context, i
 }
 
 func (c *assistServiceClient) GetAssistantConversations(ctx context.Context, in *GetAssistantConversationsRequest, opts ...grpc.CallOption) (*GetAssistantConversationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAssistantConversationsResponse)
-	err := c.cc.Invoke(ctx, AssistService_GetAssistantConversations_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_GetAssistantConversations_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,8 +97,9 @@ func (c *assistServiceClient) GetAssistantConversations(ctx context.Context, in
 }
 
 func (c *assistServiceClient) DeleteAssistantConversation(ctx context.Context, in *DeleteAssistantConversationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AssistService_DeleteAssistantConversation_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_DeleteAssistantConversation_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +107,9 @@ func (c *assistServiceClient) DeleteAssistantConversation(ctx context.Context, i
 }
 
 func (c *assistServiceClient) GetAssistantMessages(ctx context.Context, in *GetAssistantMessagesRequest, opts ...grpc.CallOption) (*GetAssistantMessagesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAssistantMessagesResponse)
-	err := c.cc.Invoke(ctx, AssistService_GetAssistantMessages_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_GetAssistantMessages_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -111,8 +117,9 @@ func (c *assistServiceClient) GetAssistantMessages(ctx context.Context, in *GetA
 }
 
 func (c *assistServiceClient) CreateAssistantMessage(ctx context.Context, in *CreateAssistantMessageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AssistService_CreateAssistantMessage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_CreateAssistantMessage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -120,8 +127,9 @@ func (c *assistServiceClient) CreateAssistantMessage(ctx context.Context, in *Cr
 }
 
 func (c *assistServiceClient) UpdateAssistantConversationInfo(ctx context.Context, in *UpdateAssistantConversationInfoRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AssistService_UpdateAssistantConversationInfo_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_UpdateAssistantConversationInfo_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,8 +137,9 @@ func (c *assistServiceClient) UpdateAssistantConversationInfo(ctx context.Contex
 }
 
 func (c *assistServiceClient) IsAssistEnabled(ctx context.Context, in *IsAssistEnabledRequest, opts ...grpc.CallOption) (*IsAssistEnabledResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(IsAssistEnabledResponse)
-	err := c.cc.Invoke(ctx, AssistService_IsAssistEnabled_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_IsAssistEnabled_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -138,8 +147,9 @@ func (c *assistServiceClient) IsAssistEnabled(ctx context.Context, in *IsAssistE
 }
 
 func (c *assistServiceClient) SearchUnifiedResources(ctx context.Context, in *SearchUnifiedResourcesRequest, opts ...grpc.CallOption) (*SearchUnifiedResourcesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SearchUnifiedResourcesResponse)
-	err := c.cc.Invoke(ctx, AssistService_SearchUnifiedResources_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistService_SearchUnifiedResources_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -149,6 +159,8 @@ func (c *assistServiceClient) SearchUnifiedResources(ctx context.Context, in *Se
 // AssistServiceServer is the server API for AssistService service.
 // All implementations must embed UnimplementedAssistServiceServer
 // for forward compatibility
+//
+// AssistService is a service that provides an ability to communicate with the Teleport Assist.
 type AssistServiceServer interface {
 	// CreateNewConversation creates a new conversation and returns the UUID of it.
 	CreateAssistantConversation(context.Context, *CreateAssistantConversationRequest) (*CreateAssistantConversationResponse, error)
@@ -405,6 +417,8 @@ const (
 // AssistEmbeddingServiceClient is the client API for AssistEmbeddingService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AssistEmbeddingService is a service that provides an ability to communicate with the Assist Embedding service.
 type AssistEmbeddingServiceClient interface {
 	// AssistantGetEmbeddings returns the embeddings for the given query.
 	GetAssistantEmbeddings(ctx context.Context, in *GetAssistantEmbeddingsRequest, opts ...grpc.CallOption) (*GetAssistantEmbeddingsResponse, error)
@@ -419,8 +433,9 @@ func NewAssistEmbeddingServiceClient(cc grpc.ClientConnInterface) AssistEmbeddin
 }
 
 func (c *assistEmbeddingServiceClient) GetAssistantEmbeddings(ctx context.Context, in *GetAssistantEmbeddingsRequest, opts ...grpc.CallOption) (*GetAssistantEmbeddingsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAssistantEmbeddingsResponse)
-	err := c.cc.Invoke(ctx, AssistEmbeddingService_GetAssistantEmbeddings_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AssistEmbeddingService_GetAssistantEmbeddings_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -430,6 +445,8 @@ func (c *assistEmbeddingServiceClient) GetAssistantEmbeddings(ctx context.Contex
 // AssistEmbeddingServiceServer is the server API for AssistEmbeddingService service.
 // All implementations must embed UnimplementedAssistEmbeddingServiceServer
 // for forward compatibility
+//
+// AssistEmbeddingService is a service that provides an ability to communicate with the Assist Embedding service.
 type AssistEmbeddingServiceServer interface {
 	// AssistantGetEmbeddings returns the embeddings for the given query.
 	GetAssistantEmbeddings(context.Context, *GetAssistantEmbeddingsRequest) (*GetAssistantEmbeddingsResponse, error)
diff --git a/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go b/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go
index d9419c95fbc0c..13c53d238ee29 100644
--- a/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/accesslist/v1/accesslist_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/accesslist/v1/accesslist_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AccessListService_GetAccessLists_FullMethodName                          = "/teleport.accesslist.v1.AccessListService/GetAccessLists"
@@ -63,6 +63,8 @@ const (
 // AccessListServiceClient is the client API for AccessListService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AccessListService provides CRUD methods for Access List resources.
 type AccessListServiceClient interface {
 	// GetAccessLists returns a list of all access lists.
 	GetAccessLists(ctx context.Context, in *GetAccessListsRequest, opts ...grpc.CallOption) (*GetAccessListsResponse, error)
@@ -134,8 +136,9 @@ func NewAccessListServiceClient(cc grpc.ClientConnInterface) AccessListServiceCl
 }
 
 func (c *accessListServiceClient) GetAccessLists(ctx context.Context, in *GetAccessListsRequest, opts ...grpc.CallOption) (*GetAccessListsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAccessListsResponse)
-	err := c.cc.Invoke(ctx, AccessListService_GetAccessLists_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_GetAccessLists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -143,8 +146,9 @@ func (c *accessListServiceClient) GetAccessLists(ctx context.Context, in *GetAcc
 }
 
 func (c *accessListServiceClient) ListAccessLists(ctx context.Context, in *ListAccessListsRequest, opts ...grpc.CallOption) (*ListAccessListsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAccessListsResponse)
-	err := c.cc.Invoke(ctx, AccessListService_ListAccessLists_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_ListAccessLists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -152,8 +156,9 @@ func (c *accessListServiceClient) ListAccessLists(ctx context.Context, in *ListA
 }
 
 func (c *accessListServiceClient) GetAccessList(ctx context.Context, in *GetAccessListRequest, opts ...grpc.CallOption) (*AccessList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessList)
-	err := c.cc.Invoke(ctx, AccessListService_GetAccessList_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_GetAccessList_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -161,8 +166,9 @@ func (c *accessListServiceClient) GetAccessList(ctx context.Context, in *GetAcce
 }
 
 func (c *accessListServiceClient) UpsertAccessList(ctx context.Context, in *UpsertAccessListRequest, opts ...grpc.CallOption) (*AccessList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessList)
-	err := c.cc.Invoke(ctx, AccessListService_UpsertAccessList_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_UpsertAccessList_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -170,8 +176,9 @@ func (c *accessListServiceClient) UpsertAccessList(ctx context.Context, in *Upse
 }
 
 func (c *accessListServiceClient) UpdateAccessList(ctx context.Context, in *UpdateAccessListRequest, opts ...grpc.CallOption) (*AccessList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessList)
-	err := c.cc.Invoke(ctx, AccessListService_UpdateAccessList_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_UpdateAccessList_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -179,8 +186,9 @@ func (c *accessListServiceClient) UpdateAccessList(ctx context.Context, in *Upda
 }
 
 func (c *accessListServiceClient) DeleteAccessList(ctx context.Context, in *DeleteAccessListRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessListService_DeleteAccessList_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteAccessList_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -188,8 +196,9 @@ func (c *accessListServiceClient) DeleteAccessList(ctx context.Context, in *Dele
 }
 
 func (c *accessListServiceClient) DeleteAllAccessLists(ctx context.Context, in *DeleteAllAccessListsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessListService_DeleteAllAccessLists_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteAllAccessLists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -197,8 +206,9 @@ func (c *accessListServiceClient) DeleteAllAccessLists(ctx context.Context, in *
 }
 
 func (c *accessListServiceClient) GetAccessListsToReview(ctx context.Context, in *GetAccessListsToReviewRequest, opts ...grpc.CallOption) (*GetAccessListsToReviewResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAccessListsToReviewResponse)
-	err := c.cc.Invoke(ctx, AccessListService_GetAccessListsToReview_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_GetAccessListsToReview_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -206,8 +216,9 @@ func (c *accessListServiceClient) GetAccessListsToReview(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) CountAccessListMembers(ctx context.Context, in *CountAccessListMembersRequest, opts ...grpc.CallOption) (*CountAccessListMembersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CountAccessListMembersResponse)
-	err := c.cc.Invoke(ctx, AccessListService_CountAccessListMembers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_CountAccessListMembers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -215,8 +226,9 @@ func (c *accessListServiceClient) CountAccessListMembers(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) ListAccessListMembers(ctx context.Context, in *ListAccessListMembersRequest, opts ...grpc.CallOption) (*ListAccessListMembersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAccessListMembersResponse)
-	err := c.cc.Invoke(ctx, AccessListService_ListAccessListMembers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_ListAccessListMembers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -224,8 +236,9 @@ func (c *accessListServiceClient) ListAccessListMembers(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) ListAllAccessListMembers(ctx context.Context, in *ListAllAccessListMembersRequest, opts ...grpc.CallOption) (*ListAllAccessListMembersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAllAccessListMembersResponse)
-	err := c.cc.Invoke(ctx, AccessListService_ListAllAccessListMembers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_ListAllAccessListMembers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -233,8 +246,9 @@ func (c *accessListServiceClient) ListAllAccessListMembers(ctx context.Context,
 }
 
 func (c *accessListServiceClient) GetAccessListMember(ctx context.Context, in *GetAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Member)
-	err := c.cc.Invoke(ctx, AccessListService_GetAccessListMember_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_GetAccessListMember_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -242,8 +256,9 @@ func (c *accessListServiceClient) GetAccessListMember(ctx context.Context, in *G
 }
 
 func (c *accessListServiceClient) UpsertAccessListMember(ctx context.Context, in *UpsertAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Member)
-	err := c.cc.Invoke(ctx, AccessListService_UpsertAccessListMember_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_UpsertAccessListMember_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -251,8 +266,9 @@ func (c *accessListServiceClient) UpsertAccessListMember(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) UpdateAccessListMember(ctx context.Context, in *UpdateAccessListMemberRequest, opts ...grpc.CallOption) (*Member, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Member)
-	err := c.cc.Invoke(ctx, AccessListService_UpdateAccessListMember_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_UpdateAccessListMember_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -260,8 +276,9 @@ func (c *accessListServiceClient) UpdateAccessListMember(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) DeleteAccessListMember(ctx context.Context, in *DeleteAccessListMemberRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessListService_DeleteAccessListMember_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteAccessListMember_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -269,8 +286,9 @@ func (c *accessListServiceClient) DeleteAccessListMember(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) DeleteAllAccessListMembersForAccessList(ctx context.Context, in *DeleteAllAccessListMembersForAccessListRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessListService_DeleteAllAccessListMembersForAccessList_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteAllAccessListMembersForAccessList_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -278,8 +296,9 @@ func (c *accessListServiceClient) DeleteAllAccessListMembersForAccessList(ctx co
 }
 
 func (c *accessListServiceClient) DeleteAllAccessListMembers(ctx context.Context, in *DeleteAllAccessListMembersRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessListService_DeleteAllAccessListMembers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteAllAccessListMembers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -287,8 +306,9 @@ func (c *accessListServiceClient) DeleteAllAccessListMembers(ctx context.Context
 }
 
 func (c *accessListServiceClient) UpsertAccessListWithMembers(ctx context.Context, in *UpsertAccessListWithMembersRequest, opts ...grpc.CallOption) (*UpsertAccessListWithMembersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpsertAccessListWithMembersResponse)
-	err := c.cc.Invoke(ctx, AccessListService_UpsertAccessListWithMembers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_UpsertAccessListWithMembers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -296,8 +316,9 @@ func (c *accessListServiceClient) UpsertAccessListWithMembers(ctx context.Contex
 }
 
 func (c *accessListServiceClient) ListAccessListReviews(ctx context.Context, in *ListAccessListReviewsRequest, opts ...grpc.CallOption) (*ListAccessListReviewsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAccessListReviewsResponse)
-	err := c.cc.Invoke(ctx, AccessListService_ListAccessListReviews_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_ListAccessListReviews_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -305,8 +326,9 @@ func (c *accessListServiceClient) ListAccessListReviews(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) ListAllAccessListReviews(ctx context.Context, in *ListAllAccessListReviewsRequest, opts ...grpc.CallOption) (*ListAllAccessListReviewsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAllAccessListReviewsResponse)
-	err := c.cc.Invoke(ctx, AccessListService_ListAllAccessListReviews_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_ListAllAccessListReviews_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -314,8 +336,9 @@ func (c *accessListServiceClient) ListAllAccessListReviews(ctx context.Context,
 }
 
 func (c *accessListServiceClient) CreateAccessListReview(ctx context.Context, in *CreateAccessListReviewRequest, opts ...grpc.CallOption) (*CreateAccessListReviewResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateAccessListReviewResponse)
-	err := c.cc.Invoke(ctx, AccessListService_CreateAccessListReview_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_CreateAccessListReview_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -323,8 +346,9 @@ func (c *accessListServiceClient) CreateAccessListReview(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) DeleteAccessListReview(ctx context.Context, in *DeleteAccessListReviewRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessListService_DeleteAccessListReview_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_DeleteAccessListReview_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -332,8 +356,9 @@ func (c *accessListServiceClient) DeleteAccessListReview(ctx context.Context, in
 }
 
 func (c *accessListServiceClient) AccessRequestPromote(ctx context.Context, in *AccessRequestPromoteRequest, opts ...grpc.CallOption) (*AccessRequestPromoteResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessRequestPromoteResponse)
-	err := c.cc.Invoke(ctx, AccessListService_AccessRequestPromote_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_AccessRequestPromote_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -341,8 +366,9 @@ func (c *accessListServiceClient) AccessRequestPromote(ctx context.Context, in *
 }
 
 func (c *accessListServiceClient) GetSuggestedAccessLists(ctx context.Context, in *GetSuggestedAccessListsRequest, opts ...grpc.CallOption) (*GetSuggestedAccessListsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetSuggestedAccessListsResponse)
-	err := c.cc.Invoke(ctx, AccessListService_GetSuggestedAccessLists_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessListService_GetSuggestedAccessLists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -352,6 +378,8 @@ func (c *accessListServiceClient) GetSuggestedAccessLists(ctx context.Context, i
 // AccessListServiceServer is the server API for AccessListService service.
 // All implementations must embed UnimplementedAccessListServiceServer
 // for forward compatibility
+//
+// AccessListService provides CRUD methods for Access List resources.
 type AccessListServiceServer interface {
 	// GetAccessLists returns a list of all access lists.
 	GetAccessLists(context.Context, *GetAccessListsRequest) (*GetAccessListsResponse, error)
diff --git a/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service_grpc.pb.go b/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service_grpc.pb.go
index 896483a6e85b1..71c4bbcd01f27 100644
--- a/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/accessmonitoringrules/v1/access_monitoring_rules_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/accessmonitoringrules/v1/access_monitoring_rules_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AccessMonitoringRulesService_CreateAccessMonitoringRule_FullMethodName          = "/teleport.accessmonitoringrules.v1.AccessMonitoringRulesService/CreateAccessMonitoringRule"
@@ -46,6 +46,8 @@ const (
 // AccessMonitoringRulesServiceClient is the client API for AccessMonitoringRulesService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AccessMonitoringRulesService provides CRUD methods for Access Monitoring Rules resources.
 type AccessMonitoringRulesServiceClient interface {
 	// CreateAccessMonitoringRule creates the specified access monitoring rule.
 	CreateAccessMonitoringRule(ctx context.Context, in *CreateAccessMonitoringRuleRequest, opts ...grpc.CallOption) (*AccessMonitoringRule, error)
@@ -72,8 +74,9 @@ func NewAccessMonitoringRulesServiceClient(cc grpc.ClientConnInterface) AccessMo
 }
 
 func (c *accessMonitoringRulesServiceClient) CreateAccessMonitoringRule(ctx context.Context, in *CreateAccessMonitoringRuleRequest, opts ...grpc.CallOption) (*AccessMonitoringRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessMonitoringRule)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_CreateAccessMonitoringRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_CreateAccessMonitoringRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -81,8 +84,9 @@ func (c *accessMonitoringRulesServiceClient) CreateAccessMonitoringRule(ctx cont
 }
 
 func (c *accessMonitoringRulesServiceClient) UpdateAccessMonitoringRule(ctx context.Context, in *UpdateAccessMonitoringRuleRequest, opts ...grpc.CallOption) (*AccessMonitoringRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessMonitoringRule)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_UpdateAccessMonitoringRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_UpdateAccessMonitoringRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -90,8 +94,9 @@ func (c *accessMonitoringRulesServiceClient) UpdateAccessMonitoringRule(ctx cont
 }
 
 func (c *accessMonitoringRulesServiceClient) UpsertAccessMonitoringRule(ctx context.Context, in *UpsertAccessMonitoringRuleRequest, opts ...grpc.CallOption) (*AccessMonitoringRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessMonitoringRule)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_UpsertAccessMonitoringRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_UpsertAccessMonitoringRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -99,8 +104,9 @@ func (c *accessMonitoringRulesServiceClient) UpsertAccessMonitoringRule(ctx cont
 }
 
 func (c *accessMonitoringRulesServiceClient) GetAccessMonitoringRule(ctx context.Context, in *GetAccessMonitoringRuleRequest, opts ...grpc.CallOption) (*AccessMonitoringRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AccessMonitoringRule)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_GetAccessMonitoringRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_GetAccessMonitoringRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -108,8 +114,9 @@ func (c *accessMonitoringRulesServiceClient) GetAccessMonitoringRule(ctx context
 }
 
 func (c *accessMonitoringRulesServiceClient) DeleteAccessMonitoringRule(ctx context.Context, in *DeleteAccessMonitoringRuleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_DeleteAccessMonitoringRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_DeleteAccessMonitoringRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -117,8 +124,9 @@ func (c *accessMonitoringRulesServiceClient) DeleteAccessMonitoringRule(ctx cont
 }
 
 func (c *accessMonitoringRulesServiceClient) ListAccessMonitoringRules(ctx context.Context, in *ListAccessMonitoringRulesRequest, opts ...grpc.CallOption) (*ListAccessMonitoringRulesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAccessMonitoringRulesResponse)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_ListAccessMonitoringRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_ListAccessMonitoringRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -126,8 +134,9 @@ func (c *accessMonitoringRulesServiceClient) ListAccessMonitoringRules(ctx conte
 }
 
 func (c *accessMonitoringRulesServiceClient) ListAccessMonitoringRulesWithFilter(ctx context.Context, in *ListAccessMonitoringRulesWithFilterRequest, opts ...grpc.CallOption) (*ListAccessMonitoringRulesWithFilterResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAccessMonitoringRulesWithFilterResponse)
-	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_ListAccessMonitoringRulesWithFilter_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessMonitoringRulesService_ListAccessMonitoringRulesWithFilter_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -137,6 +146,8 @@ func (c *accessMonitoringRulesServiceClient) ListAccessMonitoringRulesWithFilter
 // AccessMonitoringRulesServiceServer is the server API for AccessMonitoringRulesService service.
 // All implementations must embed UnimplementedAccessMonitoringRulesServiceServer
 // for forward compatibility
+//
+// AccessMonitoringRulesService provides CRUD methods for Access Monitoring Rules resources.
 type AccessMonitoringRulesServiceServer interface {
 	// CreateAccessMonitoringRule creates the specified access monitoring rule.
 	CreateAccessMonitoringRule(context.Context, *CreateAccessMonitoringRuleRequest) (*AccessMonitoringRule, error)
diff --git a/api/gen/proto/go/teleport/auditlog/v1/auditlog_grpc.pb.go b/api/gen/proto/go/teleport/auditlog/v1/auditlog_grpc.pb.go
index d20b71d55761e..e72abf53a92c6 100644
--- a/api/gen/proto/go/teleport/auditlog/v1/auditlog_grpc.pb.go
+++ b/api/gen/proto/go/teleport/auditlog/v1/auditlog_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/auditlog/v1/auditlog.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AuditLogService_StreamUnstructuredSessionEvents_FullMethodName = "/teleport.auditlog.v1.AuditLogService/StreamUnstructuredSessionEvents"
@@ -40,6 +40,8 @@ const (
 // AuditLogServiceClient is the client API for AuditLogService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AuditLogService provides methods to access audit log.
 type AuditLogServiceClient interface {
 	// StreamUnstructuredSessionEvents streams audit events from a given session recording in an unstructured format.
 	// This endpoint is used by the event handler to retrieve the session events as JSON.
@@ -58,11 +60,12 @@ func NewAuditLogServiceClient(cc grpc.ClientConnInterface) AuditLogServiceClient
 }
 
 func (c *auditLogServiceClient) StreamUnstructuredSessionEvents(ctx context.Context, in *StreamUnstructuredSessionEventsRequest, opts ...grpc.CallOption) (AuditLogService_StreamUnstructuredSessionEventsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &AuditLogService_ServiceDesc.Streams[0], AuditLogService_StreamUnstructuredSessionEvents_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AuditLogService_ServiceDesc.Streams[0], AuditLogService_StreamUnstructuredSessionEvents_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &auditLogServiceStreamUnstructuredSessionEventsClient{stream}
+	x := &auditLogServiceStreamUnstructuredSessionEventsClient{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -90,8 +93,9 @@ func (x *auditLogServiceStreamUnstructuredSessionEventsClient) Recv() (*EventUns
 }
 
 func (c *auditLogServiceClient) GetUnstructuredEvents(ctx context.Context, in *GetUnstructuredEventsRequest, opts ...grpc.CallOption) (*EventsUnstructured, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EventsUnstructured)
-	err := c.cc.Invoke(ctx, AuditLogService_GetUnstructuredEvents_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AuditLogService_GetUnstructuredEvents_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -101,6 +105,8 @@ func (c *auditLogServiceClient) GetUnstructuredEvents(ctx context.Context, in *G
 // AuditLogServiceServer is the server API for AuditLogService service.
 // All implementations must embed UnimplementedAuditLogServiceServer
 // for forward compatibility
+//
+// AuditLogService provides methods to access audit log.
 type AuditLogServiceServer interface {
 	// StreamUnstructuredSessionEvents streams audit events from a given session recording in an unstructured format.
 	// This endpoint is used by the event handler to retrieve the session events as JSON.
@@ -139,7 +145,7 @@ func _AuditLogService_StreamUnstructuredSessionEvents_Handler(srv interface{}, s
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(AuditLogServiceServer).StreamUnstructuredSessionEvents(m, &auditLogServiceStreamUnstructuredSessionEventsServer{stream})
+	return srv.(AuditLogServiceServer).StreamUnstructuredSessionEvents(m, &auditLogServiceStreamUnstructuredSessionEventsServer{ServerStream: stream})
 }
 
 type AuditLogService_StreamUnstructuredSessionEventsServer interface {
diff --git a/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service_grpc.pb.go b/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service_grpc.pb.go
index 00dc46d7dbfca..3f23f0666be96 100644
--- a/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/clusterconfig/v1/clusterconfig_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/clusterconfig/v1/clusterconfig_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	ClusterConfigService_GetClusterNetworkingConfig_FullMethodName    = "/teleport.clusterconfig.v1.ClusterConfigService/GetClusterNetworkingConfig"
@@ -53,6 +53,8 @@ const (
 // ClusterConfigServiceClient is the client API for ClusterConfigService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ClusterConfigService provides methods to manage cluster configuration resources.
 type ClusterConfigServiceClient interface {
 	// GetClusterNetworkingConfig retrieves the active cluster networking configuration.
 	GetClusterNetworkingConfig(ctx context.Context, in *GetClusterNetworkingConfigRequest, opts ...grpc.CallOption) (*types.ClusterNetworkingConfigV2, error)
@@ -93,8 +95,9 @@ func NewClusterConfigServiceClient(cc grpc.ClientConnInterface) ClusterConfigSer
 }
 
 func (c *clusterConfigServiceClient) GetClusterNetworkingConfig(ctx context.Context, in *GetClusterNetworkingConfigRequest, opts ...grpc.CallOption) (*types.ClusterNetworkingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.ClusterNetworkingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_GetClusterNetworkingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_GetClusterNetworkingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +105,9 @@ func (c *clusterConfigServiceClient) GetClusterNetworkingConfig(ctx context.Cont
 }
 
 func (c *clusterConfigServiceClient) UpdateClusterNetworkingConfig(ctx context.Context, in *UpdateClusterNetworkingConfigRequest, opts ...grpc.CallOption) (*types.ClusterNetworkingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.ClusterNetworkingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_UpdateClusterNetworkingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_UpdateClusterNetworkingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -111,8 +115,9 @@ func (c *clusterConfigServiceClient) UpdateClusterNetworkingConfig(ctx context.C
 }
 
 func (c *clusterConfigServiceClient) UpsertClusterNetworkingConfig(ctx context.Context, in *UpsertClusterNetworkingConfigRequest, opts ...grpc.CallOption) (*types.ClusterNetworkingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.ClusterNetworkingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_UpsertClusterNetworkingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_UpsertClusterNetworkingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -120,8 +125,9 @@ func (c *clusterConfigServiceClient) UpsertClusterNetworkingConfig(ctx context.C
 }
 
 func (c *clusterConfigServiceClient) ResetClusterNetworkingConfig(ctx context.Context, in *ResetClusterNetworkingConfigRequest, opts ...grpc.CallOption) (*types.ClusterNetworkingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.ClusterNetworkingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_ResetClusterNetworkingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_ResetClusterNetworkingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,8 +135,9 @@ func (c *clusterConfigServiceClient) ResetClusterNetworkingConfig(ctx context.Co
 }
 
 func (c *clusterConfigServiceClient) GetSessionRecordingConfig(ctx context.Context, in *GetSessionRecordingConfigRequest, opts ...grpc.CallOption) (*types.SessionRecordingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.SessionRecordingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_GetSessionRecordingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_GetSessionRecordingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -138,8 +145,9 @@ func (c *clusterConfigServiceClient) GetSessionRecordingConfig(ctx context.Conte
 }
 
 func (c *clusterConfigServiceClient) UpdateSessionRecordingConfig(ctx context.Context, in *UpdateSessionRecordingConfigRequest, opts ...grpc.CallOption) (*types.SessionRecordingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.SessionRecordingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_UpdateSessionRecordingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_UpdateSessionRecordingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -147,8 +155,9 @@ func (c *clusterConfigServiceClient) UpdateSessionRecordingConfig(ctx context.Co
 }
 
 func (c *clusterConfigServiceClient) UpsertSessionRecordingConfig(ctx context.Context, in *UpsertSessionRecordingConfigRequest, opts ...grpc.CallOption) (*types.SessionRecordingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.SessionRecordingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_UpsertSessionRecordingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_UpsertSessionRecordingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -156,8 +165,9 @@ func (c *clusterConfigServiceClient) UpsertSessionRecordingConfig(ctx context.Co
 }
 
 func (c *clusterConfigServiceClient) ResetSessionRecordingConfig(ctx context.Context, in *ResetSessionRecordingConfigRequest, opts ...grpc.CallOption) (*types.SessionRecordingConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.SessionRecordingConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_ResetSessionRecordingConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_ResetSessionRecordingConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -165,8 +175,9 @@ func (c *clusterConfigServiceClient) ResetSessionRecordingConfig(ctx context.Con
 }
 
 func (c *clusterConfigServiceClient) GetAuthPreference(ctx context.Context, in *GetAuthPreferenceRequest, opts ...grpc.CallOption) (*types.AuthPreferenceV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.AuthPreferenceV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_GetAuthPreference_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_GetAuthPreference_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -174,8 +185,9 @@ func (c *clusterConfigServiceClient) GetAuthPreference(ctx context.Context, in *
 }
 
 func (c *clusterConfigServiceClient) UpdateAuthPreference(ctx context.Context, in *UpdateAuthPreferenceRequest, opts ...grpc.CallOption) (*types.AuthPreferenceV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.AuthPreferenceV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_UpdateAuthPreference_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_UpdateAuthPreference_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -183,8 +195,9 @@ func (c *clusterConfigServiceClient) UpdateAuthPreference(ctx context.Context, i
 }
 
 func (c *clusterConfigServiceClient) UpsertAuthPreference(ctx context.Context, in *UpsertAuthPreferenceRequest, opts ...grpc.CallOption) (*types.AuthPreferenceV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.AuthPreferenceV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_UpsertAuthPreference_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_UpsertAuthPreference_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -192,8 +205,9 @@ func (c *clusterConfigServiceClient) UpsertAuthPreference(ctx context.Context, i
 }
 
 func (c *clusterConfigServiceClient) ResetAuthPreference(ctx context.Context, in *ResetAuthPreferenceRequest, opts ...grpc.CallOption) (*types.AuthPreferenceV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.AuthPreferenceV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_ResetAuthPreference_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_ResetAuthPreference_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -201,8 +215,9 @@ func (c *clusterConfigServiceClient) ResetAuthPreference(ctx context.Context, in
 }
 
 func (c *clusterConfigServiceClient) GetClusterAuditConfig(ctx context.Context, in *GetClusterAuditConfigRequest, opts ...grpc.CallOption) (*types.ClusterAuditConfigV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.ClusterAuditConfigV2)
-	err := c.cc.Invoke(ctx, ClusterConfigService_GetClusterAuditConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_GetClusterAuditConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -210,8 +225,9 @@ func (c *clusterConfigServiceClient) GetClusterAuditConfig(ctx context.Context,
 }
 
 func (c *clusterConfigServiceClient) GetClusterAccessGraphConfig(ctx context.Context, in *GetClusterAccessGraphConfigRequest, opts ...grpc.CallOption) (*GetClusterAccessGraphConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetClusterAccessGraphConfigResponse)
-	err := c.cc.Invoke(ctx, ClusterConfigService_GetClusterAccessGraphConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ClusterConfigService_GetClusterAccessGraphConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -221,6 +237,8 @@ func (c *clusterConfigServiceClient) GetClusterAccessGraphConfig(ctx context.Con
 // ClusterConfigServiceServer is the server API for ClusterConfigService service.
 // All implementations must embed UnimplementedClusterConfigServiceServer
 // for forward compatibility
+//
+// ClusterConfigService provides methods to manage cluster configuration resources.
 type ClusterConfigServiceServer interface {
 	// GetClusterNetworkingConfig retrieves the active cluster networking configuration.
 	GetClusterNetworkingConfig(context.Context, *GetClusterNetworkingConfigRequest) (*types.ClusterNetworkingConfigV2, error)
diff --git a/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service_grpc.pb.go b/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service_grpc.pb.go
index 50bf14c9e9c28..5098686592a34 100644
--- a/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/crownjewel/v1/crownjewel_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/crownjewel/v1/crownjewel_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	CrownJewelService_CreateCrownJewel_FullMethodName = "/teleport.crownjewel.v1.CrownJewelService/CreateCrownJewel"
@@ -45,6 +45,8 @@ const (
 // CrownJewelServiceClient is the client API for CrownJewelService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// CrownJewelService is a service that provides methods to manage CrownJewels.
 type CrownJewelServiceClient interface {
 	// CreateCrownJewel creates a new CrownJewel.
 	CreateCrownJewel(ctx context.Context, in *CreateCrownJewelRequest, opts ...grpc.CallOption) (*CrownJewel, error)
@@ -69,8 +71,9 @@ func NewCrownJewelServiceClient(cc grpc.ClientConnInterface) CrownJewelServiceCl
 }
 
 func (c *crownJewelServiceClient) CreateCrownJewel(ctx context.Context, in *CreateCrownJewelRequest, opts ...grpc.CallOption) (*CrownJewel, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CrownJewel)
-	err := c.cc.Invoke(ctx, CrownJewelService_CreateCrownJewel_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CrownJewelService_CreateCrownJewel_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,8 +81,9 @@ func (c *crownJewelServiceClient) CreateCrownJewel(ctx context.Context, in *Crea
 }
 
 func (c *crownJewelServiceClient) GetCrownJewel(ctx context.Context, in *GetCrownJewelRequest, opts ...grpc.CallOption) (*CrownJewel, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CrownJewel)
-	err := c.cc.Invoke(ctx, CrownJewelService_GetCrownJewel_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CrownJewelService_GetCrownJewel_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -87,8 +91,9 @@ func (c *crownJewelServiceClient) GetCrownJewel(ctx context.Context, in *GetCrow
 }
 
 func (c *crownJewelServiceClient) ListCrownJewels(ctx context.Context, in *ListCrownJewelsRequest, opts ...grpc.CallOption) (*ListCrownJewelsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListCrownJewelsResponse)
-	err := c.cc.Invoke(ctx, CrownJewelService_ListCrownJewels_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CrownJewelService_ListCrownJewels_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -96,8 +101,9 @@ func (c *crownJewelServiceClient) ListCrownJewels(ctx context.Context, in *ListC
 }
 
 func (c *crownJewelServiceClient) UpdateCrownJewel(ctx context.Context, in *UpdateCrownJewelRequest, opts ...grpc.CallOption) (*CrownJewel, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CrownJewel)
-	err := c.cc.Invoke(ctx, CrownJewelService_UpdateCrownJewel_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CrownJewelService_UpdateCrownJewel_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -105,8 +111,9 @@ func (c *crownJewelServiceClient) UpdateCrownJewel(ctx context.Context, in *Upda
 }
 
 func (c *crownJewelServiceClient) UpsertCrownJewel(ctx context.Context, in *UpsertCrownJewelRequest, opts ...grpc.CallOption) (*CrownJewel, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CrownJewel)
-	err := c.cc.Invoke(ctx, CrownJewelService_UpsertCrownJewel_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CrownJewelService_UpsertCrownJewel_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -114,8 +121,9 @@ func (c *crownJewelServiceClient) UpsertCrownJewel(ctx context.Context, in *Upse
 }
 
 func (c *crownJewelServiceClient) DeleteCrownJewel(ctx context.Context, in *DeleteCrownJewelRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, CrownJewelService_DeleteCrownJewel_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, CrownJewelService_DeleteCrownJewel_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,6 +133,8 @@ func (c *crownJewelServiceClient) DeleteCrownJewel(ctx context.Context, in *Dele
 // CrownJewelServiceServer is the server API for CrownJewelService service.
 // All implementations must embed UnimplementedCrownJewelServiceServer
 // for forward compatibility
+//
+// CrownJewelService is a service that provides methods to manage CrownJewels.
 type CrownJewelServiceServer interface {
 	// CreateCrownJewel creates a new CrownJewel.
 	CreateCrownJewel(context.Context, *CreateCrownJewelRequest) (*CrownJewel, error)
diff --git a/api/gen/proto/go/teleport/dbobject/v1/dbobject_service_grpc.pb.go b/api/gen/proto/go/teleport/dbobject/v1/dbobject_service_grpc.pb.go
index f4e3249d1f8e4..9b87181d0a7e9 100644
--- a/api/gen/proto/go/teleport/dbobject/v1/dbobject_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/dbobject/v1/dbobject_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/dbobject/v1/dbobject_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	DatabaseObjectService_GetDatabaseObject_FullMethodName    = "/teleport.dbobject.v1.DatabaseObjectService/GetDatabaseObject"
@@ -45,6 +45,8 @@ const (
 // DatabaseObjectServiceClient is the client API for DatabaseObjectService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// DatabaseObjectService provides methods to manage Teleport DatabaseObjects
 type DatabaseObjectServiceClient interface {
 	// GetDatabaseObject is used to query a database object resource by its name.
 	//
@@ -80,8 +82,9 @@ func NewDatabaseObjectServiceClient(cc grpc.ClientConnInterface) DatabaseObjectS
 }
 
 func (c *databaseObjectServiceClient) GetDatabaseObject(ctx context.Context, in *GetDatabaseObjectRequest, opts ...grpc.CallOption) (*DatabaseObject, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObject)
-	err := c.cc.Invoke(ctx, DatabaseObjectService_GetDatabaseObject_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectService_GetDatabaseObject_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -89,8 +92,9 @@ func (c *databaseObjectServiceClient) GetDatabaseObject(ctx context.Context, in
 }
 
 func (c *databaseObjectServiceClient) ListDatabaseObjects(ctx context.Context, in *ListDatabaseObjectsRequest, opts ...grpc.CallOption) (*ListDatabaseObjectsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListDatabaseObjectsResponse)
-	err := c.cc.Invoke(ctx, DatabaseObjectService_ListDatabaseObjects_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectService_ListDatabaseObjects_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +102,9 @@ func (c *databaseObjectServiceClient) ListDatabaseObjects(ctx context.Context, i
 }
 
 func (c *databaseObjectServiceClient) CreateDatabaseObject(ctx context.Context, in *CreateDatabaseObjectRequest, opts ...grpc.CallOption) (*DatabaseObject, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObject)
-	err := c.cc.Invoke(ctx, DatabaseObjectService_CreateDatabaseObject_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectService_CreateDatabaseObject_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,8 +112,9 @@ func (c *databaseObjectServiceClient) CreateDatabaseObject(ctx context.Context,
 }
 
 func (c *databaseObjectServiceClient) UpdateDatabaseObject(ctx context.Context, in *UpdateDatabaseObjectRequest, opts ...grpc.CallOption) (*DatabaseObject, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObject)
-	err := c.cc.Invoke(ctx, DatabaseObjectService_UpdateDatabaseObject_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectService_UpdateDatabaseObject_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -116,8 +122,9 @@ func (c *databaseObjectServiceClient) UpdateDatabaseObject(ctx context.Context,
 }
 
 func (c *databaseObjectServiceClient) UpsertDatabaseObject(ctx context.Context, in *UpsertDatabaseObjectRequest, opts ...grpc.CallOption) (*DatabaseObject, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObject)
-	err := c.cc.Invoke(ctx, DatabaseObjectService_UpsertDatabaseObject_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectService_UpsertDatabaseObject_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,8 +132,9 @@ func (c *databaseObjectServiceClient) UpsertDatabaseObject(ctx context.Context,
 }
 
 func (c *databaseObjectServiceClient) DeleteDatabaseObject(ctx context.Context, in *DeleteDatabaseObjectRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, DatabaseObjectService_DeleteDatabaseObject_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectService_DeleteDatabaseObject_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -136,6 +144,8 @@ func (c *databaseObjectServiceClient) DeleteDatabaseObject(ctx context.Context,
 // DatabaseObjectServiceServer is the server API for DatabaseObjectService service.
 // All implementations must embed UnimplementedDatabaseObjectServiceServer
 // for forward compatibility
+//
+// DatabaseObjectService provides methods to manage Teleport DatabaseObjects
 type DatabaseObjectServiceServer interface {
 	// GetDatabaseObject is used to query a database object resource by its name.
 	//
diff --git a/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service_grpc.pb.go b/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service_grpc.pb.go
index 17c9c032eedae..f92f31efe1ff6 100644
--- a/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/dbobjectimportrule/v1/dbobjectimportrule_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/dbobjectimportrule/v1/dbobjectimportrule_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	DatabaseObjectImportRuleService_GetDatabaseObjectImportRule_FullMethodName    = "/teleport.dbobjectimportrule.v1.DatabaseObjectImportRuleService/GetDatabaseObjectImportRule"
@@ -45,6 +45,8 @@ const (
 // DatabaseObjectImportRuleServiceClient is the client API for DatabaseObjectImportRuleService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// DatabaseObjectImportRuleService provides methods to manage Teleport DatabaseObjectImportRules
 type DatabaseObjectImportRuleServiceClient interface {
 	// GetDatabaseObjectImportRule is used to query a DatabaseObjectImportRule resource by its name.
 	//
@@ -80,8 +82,9 @@ func NewDatabaseObjectImportRuleServiceClient(cc grpc.ClientConnInterface) Datab
 }
 
 func (c *databaseObjectImportRuleServiceClient) GetDatabaseObjectImportRule(ctx context.Context, in *GetDatabaseObjectImportRuleRequest, opts ...grpc.CallOption) (*DatabaseObjectImportRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObjectImportRule)
-	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_GetDatabaseObjectImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_GetDatabaseObjectImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -89,8 +92,9 @@ func (c *databaseObjectImportRuleServiceClient) GetDatabaseObjectImportRule(ctx
 }
 
 func (c *databaseObjectImportRuleServiceClient) ListDatabaseObjectImportRules(ctx context.Context, in *ListDatabaseObjectImportRulesRequest, opts ...grpc.CallOption) (*ListDatabaseObjectImportRulesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListDatabaseObjectImportRulesResponse)
-	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_ListDatabaseObjectImportRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_ListDatabaseObjectImportRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +102,9 @@ func (c *databaseObjectImportRuleServiceClient) ListDatabaseObjectImportRules(ct
 }
 
 func (c *databaseObjectImportRuleServiceClient) CreateDatabaseObjectImportRule(ctx context.Context, in *CreateDatabaseObjectImportRuleRequest, opts ...grpc.CallOption) (*DatabaseObjectImportRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObjectImportRule)
-	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_CreateDatabaseObjectImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_CreateDatabaseObjectImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,8 +112,9 @@ func (c *databaseObjectImportRuleServiceClient) CreateDatabaseObjectImportRule(c
 }
 
 func (c *databaseObjectImportRuleServiceClient) UpdateDatabaseObjectImportRule(ctx context.Context, in *UpdateDatabaseObjectImportRuleRequest, opts ...grpc.CallOption) (*DatabaseObjectImportRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObjectImportRule)
-	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_UpdateDatabaseObjectImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_UpdateDatabaseObjectImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -116,8 +122,9 @@ func (c *databaseObjectImportRuleServiceClient) UpdateDatabaseObjectImportRule(c
 }
 
 func (c *databaseObjectImportRuleServiceClient) UpsertDatabaseObjectImportRule(ctx context.Context, in *UpsertDatabaseObjectImportRuleRequest, opts ...grpc.CallOption) (*DatabaseObjectImportRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DatabaseObjectImportRule)
-	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_UpsertDatabaseObjectImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_UpsertDatabaseObjectImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,8 +132,9 @@ func (c *databaseObjectImportRuleServiceClient) UpsertDatabaseObjectImportRule(c
 }
 
 func (c *databaseObjectImportRuleServiceClient) DeleteDatabaseObjectImportRule(ctx context.Context, in *DeleteDatabaseObjectImportRuleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_DeleteDatabaseObjectImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DatabaseObjectImportRuleService_DeleteDatabaseObjectImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -136,6 +144,8 @@ func (c *databaseObjectImportRuleServiceClient) DeleteDatabaseObjectImportRule(c
 // DatabaseObjectImportRuleServiceServer is the server API for DatabaseObjectImportRuleService service.
 // All implementations must embed UnimplementedDatabaseObjectImportRuleServiceServer
 // for forward compatibility
+//
+// DatabaseObjectImportRuleService provides methods to manage Teleport DatabaseObjectImportRules
 type DatabaseObjectImportRuleServiceServer interface {
 	// GetDatabaseObjectImportRule is used to query a DatabaseObjectImportRule resource by its name.
 	//
diff --git a/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service_grpc.pb.go b/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service_grpc.pb.go
index 88870c1a06460..86be79eb248cf 100644
--- a/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/devicetrust/v1/devicetrust_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/devicetrust/v1/devicetrust_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	DeviceTrustService_CreateDevice_FullMethodName                   = "/teleport.devicetrust.v1.DeviceTrustService/CreateDevice"
@@ -53,6 +53,28 @@ const (
 // DeviceTrustServiceClient is the client API for DeviceTrustService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// DeviceTrustService provides methods to manage, enroll and authenticate
+// trusted devices.
+//
+// A trusted device is a device that is registered and enrolled with Teleport,
+// thus allowing the system to provide some guarantees about its provenance and
+// state.
+//
+// Managing devices requires the corresponding CRUD "device" permission.
+// Additionally, creating enrollment tokens requires the "create_enroll_token"
+// permission and enrolling devices requires the "enroll" permission. See
+// CreateDevice, CreateDeviceEnrollToken and EnrollDevice for reference.
+//
+// An authenticated, trusted device allows its user to perform device-aware
+// actions. Such actions include accessing an SSH node, managing sensitive
+// resources via `tctl`, etc. The enforcement mode is defined via cluster-wide
+// and/or per-role toggles. Device authentication is automatic for enrolled
+// devices communicating with Enterprise clusters. See AuthenticateDevice for
+// reference.
+//
+// Device Trust is a Teleport Enterprise feature. Open Source Teleport clusters
+// treat all Device RPCs as unimplemented (which, in fact, they are for OSS.)
 type DeviceTrustServiceClient interface {
 	// CreateDevice creates a device, effectively registering it on Teleport.
 	// Devices need to be registered before they can be enrolled.
@@ -164,8 +186,9 @@ func NewDeviceTrustServiceClient(cc grpc.ClientConnInterface) DeviceTrustService
 }
 
 func (c *deviceTrustServiceClient) CreateDevice(ctx context.Context, in *CreateDeviceRequest, opts ...grpc.CallOption) (*Device, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Device)
-	err := c.cc.Invoke(ctx, DeviceTrustService_CreateDevice_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_CreateDevice_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -173,8 +196,9 @@ func (c *deviceTrustServiceClient) CreateDevice(ctx context.Context, in *CreateD
 }
 
 func (c *deviceTrustServiceClient) UpdateDevice(ctx context.Context, in *UpdateDeviceRequest, opts ...grpc.CallOption) (*Device, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Device)
-	err := c.cc.Invoke(ctx, DeviceTrustService_UpdateDevice_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_UpdateDevice_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -182,8 +206,9 @@ func (c *deviceTrustServiceClient) UpdateDevice(ctx context.Context, in *UpdateD
 }
 
 func (c *deviceTrustServiceClient) UpsertDevice(ctx context.Context, in *UpsertDeviceRequest, opts ...grpc.CallOption) (*Device, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Device)
-	err := c.cc.Invoke(ctx, DeviceTrustService_UpsertDevice_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_UpsertDevice_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -191,8 +216,9 @@ func (c *deviceTrustServiceClient) UpsertDevice(ctx context.Context, in *UpsertD
 }
 
 func (c *deviceTrustServiceClient) DeleteDevice(ctx context.Context, in *DeleteDeviceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, DeviceTrustService_DeleteDevice_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_DeleteDevice_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -200,8 +226,9 @@ func (c *deviceTrustServiceClient) DeleteDevice(ctx context.Context, in *DeleteD
 }
 
 func (c *deviceTrustServiceClient) FindDevices(ctx context.Context, in *FindDevicesRequest, opts ...grpc.CallOption) (*FindDevicesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(FindDevicesResponse)
-	err := c.cc.Invoke(ctx, DeviceTrustService_FindDevices_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_FindDevices_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -209,8 +236,9 @@ func (c *deviceTrustServiceClient) FindDevices(ctx context.Context, in *FindDevi
 }
 
 func (c *deviceTrustServiceClient) GetDevice(ctx context.Context, in *GetDeviceRequest, opts ...grpc.CallOption) (*Device, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Device)
-	err := c.cc.Invoke(ctx, DeviceTrustService_GetDevice_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_GetDevice_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -218,8 +246,9 @@ func (c *deviceTrustServiceClient) GetDevice(ctx context.Context, in *GetDeviceR
 }
 
 func (c *deviceTrustServiceClient) ListDevices(ctx context.Context, in *ListDevicesRequest, opts ...grpc.CallOption) (*ListDevicesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListDevicesResponse)
-	err := c.cc.Invoke(ctx, DeviceTrustService_ListDevices_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_ListDevices_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -227,8 +256,9 @@ func (c *deviceTrustServiceClient) ListDevices(ctx context.Context, in *ListDevi
 }
 
 func (c *deviceTrustServiceClient) BulkCreateDevices(ctx context.Context, in *BulkCreateDevicesRequest, opts ...grpc.CallOption) (*BulkCreateDevicesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(BulkCreateDevicesResponse)
-	err := c.cc.Invoke(ctx, DeviceTrustService_BulkCreateDevices_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_BulkCreateDevices_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -236,8 +266,9 @@ func (c *deviceTrustServiceClient) BulkCreateDevices(ctx context.Context, in *Bu
 }
 
 func (c *deviceTrustServiceClient) CreateDeviceEnrollToken(ctx context.Context, in *CreateDeviceEnrollTokenRequest, opts ...grpc.CallOption) (*DeviceEnrollToken, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeviceEnrollToken)
-	err := c.cc.Invoke(ctx, DeviceTrustService_CreateDeviceEnrollToken_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_CreateDeviceEnrollToken_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -245,11 +276,12 @@ func (c *deviceTrustServiceClient) CreateDeviceEnrollToken(ctx context.Context,
 }
 
 func (c *deviceTrustServiceClient) EnrollDevice(ctx context.Context, opts ...grpc.CallOption) (DeviceTrustService_EnrollDeviceClient, error) {
-	stream, err := c.cc.NewStream(ctx, &DeviceTrustService_ServiceDesc.Streams[0], DeviceTrustService_EnrollDevice_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &DeviceTrustService_ServiceDesc.Streams[0], DeviceTrustService_EnrollDevice_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &deviceTrustServiceEnrollDeviceClient{stream}
+	x := &deviceTrustServiceEnrollDeviceClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -276,11 +308,12 @@ func (x *deviceTrustServiceEnrollDeviceClient) Recv() (*EnrollDeviceResponse, er
 }
 
 func (c *deviceTrustServiceClient) AuthenticateDevice(ctx context.Context, opts ...grpc.CallOption) (DeviceTrustService_AuthenticateDeviceClient, error) {
-	stream, err := c.cc.NewStream(ctx, &DeviceTrustService_ServiceDesc.Streams[1], DeviceTrustService_AuthenticateDevice_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &DeviceTrustService_ServiceDesc.Streams[1], DeviceTrustService_AuthenticateDevice_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &deviceTrustServiceAuthenticateDeviceClient{stream}
+	x := &deviceTrustServiceAuthenticateDeviceClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -307,8 +340,9 @@ func (x *deviceTrustServiceAuthenticateDeviceClient) Recv() (*AuthenticateDevice
 }
 
 func (c *deviceTrustServiceClient) ConfirmDeviceWebAuthentication(ctx context.Context, in *ConfirmDeviceWebAuthenticationRequest, opts ...grpc.CallOption) (*ConfirmDeviceWebAuthenticationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ConfirmDeviceWebAuthenticationResponse)
-	err := c.cc.Invoke(ctx, DeviceTrustService_ConfirmDeviceWebAuthentication_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_ConfirmDeviceWebAuthentication_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -316,11 +350,12 @@ func (c *deviceTrustServiceClient) ConfirmDeviceWebAuthentication(ctx context.Co
 }
 
 func (c *deviceTrustServiceClient) SyncInventory(ctx context.Context, opts ...grpc.CallOption) (DeviceTrustService_SyncInventoryClient, error) {
-	stream, err := c.cc.NewStream(ctx, &DeviceTrustService_ServiceDesc.Streams[2], DeviceTrustService_SyncInventory_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &DeviceTrustService_ServiceDesc.Streams[2], DeviceTrustService_SyncInventory_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &deviceTrustServiceSyncInventoryClient{stream}
+	x := &deviceTrustServiceSyncInventoryClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -348,8 +383,9 @@ func (x *deviceTrustServiceSyncInventoryClient) Recv() (*SyncInventoryResponse,
 
 // Deprecated: Do not use.
 func (c *deviceTrustServiceClient) GetDevicesUsage(ctx context.Context, in *GetDevicesUsageRequest, opts ...grpc.CallOption) (*DevicesUsage, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DevicesUsage)
-	err := c.cc.Invoke(ctx, DeviceTrustService_GetDevicesUsage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DeviceTrustService_GetDevicesUsage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -359,6 +395,28 @@ func (c *deviceTrustServiceClient) GetDevicesUsage(ctx context.Context, in *GetD
 // DeviceTrustServiceServer is the server API for DeviceTrustService service.
 // All implementations must embed UnimplementedDeviceTrustServiceServer
 // for forward compatibility
+//
+// DeviceTrustService provides methods to manage, enroll and authenticate
+// trusted devices.
+//
+// A trusted device is a device that is registered and enrolled with Teleport,
+// thus allowing the system to provide some guarantees about its provenance and
+// state.
+//
+// Managing devices requires the corresponding CRUD "device" permission.
+// Additionally, creating enrollment tokens requires the "create_enroll_token"
+// permission and enrolling devices requires the "enroll" permission. See
+// CreateDevice, CreateDeviceEnrollToken and EnrollDevice for reference.
+//
+// An authenticated, trusted device allows its user to perform device-aware
+// actions. Such actions include accessing an SSH node, managing sensitive
+// resources via `tctl`, etc. The enforcement mode is defined via cluster-wide
+// and/or per-role toggles. Device authentication is automatic for enrolled
+// devices communicating with Enterprise clusters. See AuthenticateDevice for
+// reference.
+//
+// Device Trust is a Teleport Enterprise feature. Open Source Teleport clusters
+// treat all Device RPCs as unimplemented (which, in fact, they are for OSS.)
 type DeviceTrustServiceServer interface {
 	// CreateDevice creates a device, effectively registering it on Teleport.
 	// Devices need to be registered before they can be enrolled.
@@ -684,7 +742,7 @@ func _DeviceTrustService_CreateDeviceEnrollToken_Handler(srv interface{}, ctx co
 }
 
 func _DeviceTrustService_EnrollDevice_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(DeviceTrustServiceServer).EnrollDevice(&deviceTrustServiceEnrollDeviceServer{stream})
+	return srv.(DeviceTrustServiceServer).EnrollDevice(&deviceTrustServiceEnrollDeviceServer{ServerStream: stream})
 }
 
 type DeviceTrustService_EnrollDeviceServer interface {
@@ -710,7 +768,7 @@ func (x *deviceTrustServiceEnrollDeviceServer) Recv() (*EnrollDeviceRequest, err
 }
 
 func _DeviceTrustService_AuthenticateDevice_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(DeviceTrustServiceServer).AuthenticateDevice(&deviceTrustServiceAuthenticateDeviceServer{stream})
+	return srv.(DeviceTrustServiceServer).AuthenticateDevice(&deviceTrustServiceAuthenticateDeviceServer{ServerStream: stream})
 }
 
 type DeviceTrustService_AuthenticateDeviceServer interface {
@@ -754,7 +812,7 @@ func _DeviceTrustService_ConfirmDeviceWebAuthentication_Handler(srv interface{},
 }
 
 func _DeviceTrustService_SyncInventory_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(DeviceTrustServiceServer).SyncInventory(&deviceTrustServiceSyncInventoryServer{stream})
+	return srv.(DeviceTrustServiceServer).SyncInventory(&deviceTrustServiceSyncInventoryServer{ServerStream: stream})
 }
 
 type DeviceTrustService_SyncInventoryServer interface {
diff --git a/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service_grpc.pb.go b/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service_grpc.pb.go
index 520738432b550..931e454d0d742 100644
--- a/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/discoveryconfig/v1/discoveryconfig_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/discoveryconfig/v1/discoveryconfig_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	DiscoveryConfigService_ListDiscoveryConfigs_FullMethodName        = "/teleport.discoveryconfig.v1.DiscoveryConfigService/ListDiscoveryConfigs"
@@ -47,6 +47,12 @@ const (
 // DiscoveryConfigServiceClient is the client API for DiscoveryConfigService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// DiscoveryConfigService provides methods to manage Discovery Configs.
+//
+// Each Discovery Config has a set of matchers and a DiscoveryGroup.
+// DiscoveryServices also have a DiscoveryGroup which will be used to load all the matchers from
+// all the DiscoveryConfigs that have the same Group.
 type DiscoveryConfigServiceClient interface {
 	// ListDiscoveryConfigs returns a paginated list of Discovery Config resources.
 	ListDiscoveryConfigs(ctx context.Context, in *ListDiscoveryConfigsRequest, opts ...grpc.CallOption) (*ListDiscoveryConfigsResponse, error)
@@ -75,8 +81,9 @@ func NewDiscoveryConfigServiceClient(cc grpc.ClientConnInterface) DiscoveryConfi
 }
 
 func (c *discoveryConfigServiceClient) ListDiscoveryConfigs(ctx context.Context, in *ListDiscoveryConfigsRequest, opts ...grpc.CallOption) (*ListDiscoveryConfigsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListDiscoveryConfigsResponse)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_ListDiscoveryConfigs_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_ListDiscoveryConfigs_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +91,9 @@ func (c *discoveryConfigServiceClient) ListDiscoveryConfigs(ctx context.Context,
 }
 
 func (c *discoveryConfigServiceClient) GetDiscoveryConfig(ctx context.Context, in *GetDiscoveryConfigRequest, opts ...grpc.CallOption) (*DiscoveryConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DiscoveryConfig)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_GetDiscoveryConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_GetDiscoveryConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,8 +101,9 @@ func (c *discoveryConfigServiceClient) GetDiscoveryConfig(ctx context.Context, i
 }
 
 func (c *discoveryConfigServiceClient) CreateDiscoveryConfig(ctx context.Context, in *CreateDiscoveryConfigRequest, opts ...grpc.CallOption) (*DiscoveryConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DiscoveryConfig)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_CreateDiscoveryConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_CreateDiscoveryConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +111,9 @@ func (c *discoveryConfigServiceClient) CreateDiscoveryConfig(ctx context.Context
 }
 
 func (c *discoveryConfigServiceClient) UpdateDiscoveryConfig(ctx context.Context, in *UpdateDiscoveryConfigRequest, opts ...grpc.CallOption) (*DiscoveryConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DiscoveryConfig)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_UpdateDiscoveryConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_UpdateDiscoveryConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -111,8 +121,9 @@ func (c *discoveryConfigServiceClient) UpdateDiscoveryConfig(ctx context.Context
 }
 
 func (c *discoveryConfigServiceClient) UpsertDiscoveryConfig(ctx context.Context, in *UpsertDiscoveryConfigRequest, opts ...grpc.CallOption) (*DiscoveryConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DiscoveryConfig)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_UpsertDiscoveryConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_UpsertDiscoveryConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -120,8 +131,9 @@ func (c *discoveryConfigServiceClient) UpsertDiscoveryConfig(ctx context.Context
 }
 
 func (c *discoveryConfigServiceClient) DeleteDiscoveryConfig(ctx context.Context, in *DeleteDiscoveryConfigRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_DeleteDiscoveryConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_DeleteDiscoveryConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,8 +141,9 @@ func (c *discoveryConfigServiceClient) DeleteDiscoveryConfig(ctx context.Context
 }
 
 func (c *discoveryConfigServiceClient) DeleteAllDiscoveryConfigs(ctx context.Context, in *DeleteAllDiscoveryConfigsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_DeleteAllDiscoveryConfigs_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_DeleteAllDiscoveryConfigs_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -138,8 +151,9 @@ func (c *discoveryConfigServiceClient) DeleteAllDiscoveryConfigs(ctx context.Con
 }
 
 func (c *discoveryConfigServiceClient) UpdateDiscoveryConfigStatus(ctx context.Context, in *UpdateDiscoveryConfigStatusRequest, opts ...grpc.CallOption) (*DiscoveryConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DiscoveryConfig)
-	err := c.cc.Invoke(ctx, DiscoveryConfigService_UpdateDiscoveryConfigStatus_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, DiscoveryConfigService_UpdateDiscoveryConfigStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -149,6 +163,12 @@ func (c *discoveryConfigServiceClient) UpdateDiscoveryConfigStatus(ctx context.C
 // DiscoveryConfigServiceServer is the server API for DiscoveryConfigService service.
 // All implementations must embed UnimplementedDiscoveryConfigServiceServer
 // for forward compatibility
+//
+// DiscoveryConfigService provides methods to manage Discovery Configs.
+//
+// Each Discovery Config has a set of matchers and a DiscoveryGroup.
+// DiscoveryServices also have a DiscoveryGroup which will be used to load all the matchers from
+// all the DiscoveryConfigs that have the same Group.
 type DiscoveryConfigServiceServer interface {
 	// ListDiscoveryConfigs returns a paginated list of Discovery Config resources.
 	ListDiscoveryConfigs(context.Context, *ListDiscoveryConfigsRequest) (*ListDiscoveryConfigsResponse, error)
diff --git a/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service_grpc.pb.go b/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service_grpc.pb.go
index 40f0b4eb79da3..4daf16e04b176 100644
--- a/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/externalauditstorage/v1/externalauditstorage_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/externalauditstorage/v1/externalauditstorage_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	ExternalAuditStorageService_GetDraftExternalAuditStorage_FullMethodName         = "/teleport.externalauditstorage.v1.ExternalAuditStorageService/GetDraftExternalAuditStorage"
@@ -50,6 +50,19 @@ const (
 // ExternalAuditStorageServiceClient is the client API for ExternalAuditStorageService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ExternalAuditStorageService provides methods to manage External Audit Storage.
+//
+// The service supports singleton "draft" and "cluster" configurations, allowing
+// us to store state for an in-progress configuring and to test the connection
+// before enabling the feature in the cluster.
+//
+// After creating and testing a draft configuration call
+// PromoteToClusterExternalAuditStorage, which will clone the existing draft
+// ExternalAuditStorage into a new resource and upsert it as the new cluster
+// ExternalAuditStorage.
+// The promoted cluster resource can't be mutated, it can only be deleted or
+// replaced by promoting a new draft.
 type ExternalAuditStorageServiceClient interface {
 	// GetDraftExternalAuditStorage returns the draft external audit storage configuration resource.
 	GetDraftExternalAuditStorage(ctx context.Context, in *GetDraftExternalAuditStorageRequest, opts ...grpc.CallOption) (*GetDraftExternalAuditStorageResponse, error)
@@ -90,8 +103,9 @@ func NewExternalAuditStorageServiceClient(cc grpc.ClientConnInterface) ExternalA
 }
 
 func (c *externalAuditStorageServiceClient) GetDraftExternalAuditStorage(ctx context.Context, in *GetDraftExternalAuditStorageRequest, opts ...grpc.CallOption) (*GetDraftExternalAuditStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetDraftExternalAuditStorageResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_GetDraftExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_GetDraftExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -99,8 +113,9 @@ func (c *externalAuditStorageServiceClient) GetDraftExternalAuditStorage(ctx con
 }
 
 func (c *externalAuditStorageServiceClient) CreateDraftExternalAuditStorage(ctx context.Context, in *CreateDraftExternalAuditStorageRequest, opts ...grpc.CallOption) (*CreateDraftExternalAuditStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateDraftExternalAuditStorageResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_CreateDraftExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_CreateDraftExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -108,8 +123,9 @@ func (c *externalAuditStorageServiceClient) CreateDraftExternalAuditStorage(ctx
 }
 
 func (c *externalAuditStorageServiceClient) UpsertDraftExternalAuditStorage(ctx context.Context, in *UpsertDraftExternalAuditStorageRequest, opts ...grpc.CallOption) (*UpsertDraftExternalAuditStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpsertDraftExternalAuditStorageResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_UpsertDraftExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_UpsertDraftExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -117,8 +133,9 @@ func (c *externalAuditStorageServiceClient) UpsertDraftExternalAuditStorage(ctx
 }
 
 func (c *externalAuditStorageServiceClient) DeleteDraftExternalAuditStorage(ctx context.Context, in *DeleteDraftExternalAuditStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_DeleteDraftExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_DeleteDraftExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -126,8 +143,9 @@ func (c *externalAuditStorageServiceClient) DeleteDraftExternalAuditStorage(ctx
 }
 
 func (c *externalAuditStorageServiceClient) PromoteToClusterExternalAuditStorage(ctx context.Context, in *PromoteToClusterExternalAuditStorageRequest, opts ...grpc.CallOption) (*PromoteToClusterExternalAuditStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PromoteToClusterExternalAuditStorageResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_PromoteToClusterExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_PromoteToClusterExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -135,8 +153,9 @@ func (c *externalAuditStorageServiceClient) PromoteToClusterExternalAuditStorage
 }
 
 func (c *externalAuditStorageServiceClient) GetClusterExternalAuditStorage(ctx context.Context, in *GetClusterExternalAuditStorageRequest, opts ...grpc.CallOption) (*GetClusterExternalAuditStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetClusterExternalAuditStorageResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_GetClusterExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_GetClusterExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -144,8 +163,9 @@ func (c *externalAuditStorageServiceClient) GetClusterExternalAuditStorage(ctx c
 }
 
 func (c *externalAuditStorageServiceClient) DisableClusterExternalAuditStorage(ctx context.Context, in *DisableClusterExternalAuditStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_DisableClusterExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_DisableClusterExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -153,8 +173,9 @@ func (c *externalAuditStorageServiceClient) DisableClusterExternalAuditStorage(c
 }
 
 func (c *externalAuditStorageServiceClient) GenerateDraftExternalAuditStorage(ctx context.Context, in *GenerateDraftExternalAuditStorageRequest, opts ...grpc.CallOption) (*GenerateDraftExternalAuditStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GenerateDraftExternalAuditStorageResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_GenerateDraftExternalAuditStorage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_GenerateDraftExternalAuditStorage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -162,8 +183,9 @@ func (c *externalAuditStorageServiceClient) GenerateDraftExternalAuditStorage(ct
 }
 
 func (c *externalAuditStorageServiceClient) TestDraftExternalAuditStorageBuckets(ctx context.Context, in *TestDraftExternalAuditStorageBucketsRequest, opts ...grpc.CallOption) (*TestDraftExternalAuditStorageBucketsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TestDraftExternalAuditStorageBucketsResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_TestDraftExternalAuditStorageBuckets_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_TestDraftExternalAuditStorageBuckets_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -171,8 +193,9 @@ func (c *externalAuditStorageServiceClient) TestDraftExternalAuditStorageBuckets
 }
 
 func (c *externalAuditStorageServiceClient) TestDraftExternalAuditStorageGlue(ctx context.Context, in *TestDraftExternalAuditStorageGlueRequest, opts ...grpc.CallOption) (*TestDraftExternalAuditStorageGlueResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TestDraftExternalAuditStorageGlueResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_TestDraftExternalAuditStorageGlue_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_TestDraftExternalAuditStorageGlue_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -180,8 +203,9 @@ func (c *externalAuditStorageServiceClient) TestDraftExternalAuditStorageGlue(ct
 }
 
 func (c *externalAuditStorageServiceClient) TestDraftExternalAuditStorageAthena(ctx context.Context, in *TestDraftExternalAuditStorageAthenaRequest, opts ...grpc.CallOption) (*TestDraftExternalAuditStorageAthenaResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TestDraftExternalAuditStorageAthenaResponse)
-	err := c.cc.Invoke(ctx, ExternalAuditStorageService_TestDraftExternalAuditStorageAthena_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ExternalAuditStorageService_TestDraftExternalAuditStorageAthena_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -191,6 +215,19 @@ func (c *externalAuditStorageServiceClient) TestDraftExternalAuditStorageAthena(
 // ExternalAuditStorageServiceServer is the server API for ExternalAuditStorageService service.
 // All implementations must embed UnimplementedExternalAuditStorageServiceServer
 // for forward compatibility
+//
+// ExternalAuditStorageService provides methods to manage External Audit Storage.
+//
+// The service supports singleton "draft" and "cluster" configurations, allowing
+// us to store state for an in-progress configuring and to test the connection
+// before enabling the feature in the cluster.
+//
+// After creating and testing a draft configuration call
+// PromoteToClusterExternalAuditStorage, which will clone the existing draft
+// ExternalAuditStorage into a new resource and upsert it as the new cluster
+// ExternalAuditStorage.
+// The promoted cluster resource can't be mutated, it can only be deleted or
+// replaced by promoting a new draft.
 type ExternalAuditStorageServiceServer interface {
 	// GetDraftExternalAuditStorage returns the draft external audit storage configuration resource.
 	GetDraftExternalAuditStorage(context.Context, *GetDraftExternalAuditStorageRequest) (*GetDraftExternalAuditStorageResponse, error)
diff --git a/api/gen/proto/go/teleport/integration/v1/awsoidc_service_grpc.pb.go b/api/gen/proto/go/teleport/integration/v1/awsoidc_service_grpc.pb.go
index 77a917bf9a78d..5731d134c91e4 100644
--- a/api/gen/proto/go/teleport/integration/v1/awsoidc_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/integration/v1/awsoidc_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/integration/v1/awsoidc_service.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AWSOIDCService_ListEICE_FullMethodName              = "/teleport.integration.v1.AWSOIDCService/ListEICE"
@@ -47,6 +47,8 @@ const (
 // AWSOIDCServiceClient is the client API for AWSOIDCService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AWSOIDCService provides access to AWS APIs using the AWS OIDC Integration.
 type AWSOIDCServiceClient interface {
 	// ListEICE returns a list of EC2 Instance Connect Endpoints.
 	// An optional NextToken that can be used to fetch the next page.
@@ -92,8 +94,9 @@ func NewAWSOIDCServiceClient(cc grpc.ClientConnInterface) AWSOIDCServiceClient {
 }
 
 func (c *aWSOIDCServiceClient) ListEICE(ctx context.Context, in *ListEICERequest, opts ...grpc.CallOption) (*ListEICEResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListEICEResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_ListEICE_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_ListEICE_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -101,8 +104,9 @@ func (c *aWSOIDCServiceClient) ListEICE(ctx context.Context, in *ListEICERequest
 }
 
 func (c *aWSOIDCServiceClient) CreateEICE(ctx context.Context, in *CreateEICERequest, opts ...grpc.CallOption) (*CreateEICEResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateEICEResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_CreateEICE_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_CreateEICE_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,8 +114,9 @@ func (c *aWSOIDCServiceClient) CreateEICE(ctx context.Context, in *CreateEICEReq
 }
 
 func (c *aWSOIDCServiceClient) ListDatabases(ctx context.Context, in *ListDatabasesRequest, opts ...grpc.CallOption) (*ListDatabasesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListDatabasesResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_ListDatabases_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_ListDatabases_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -119,8 +124,9 @@ func (c *aWSOIDCServiceClient) ListDatabases(ctx context.Context, in *ListDataba
 }
 
 func (c *aWSOIDCServiceClient) ListSecurityGroups(ctx context.Context, in *ListSecurityGroupsRequest, opts ...grpc.CallOption) (*ListSecurityGroupsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListSecurityGroupsResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_ListSecurityGroups_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_ListSecurityGroups_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,8 +134,9 @@ func (c *aWSOIDCServiceClient) ListSecurityGroups(ctx context.Context, in *ListS
 }
 
 func (c *aWSOIDCServiceClient) DeployDatabaseService(ctx context.Context, in *DeployDatabaseServiceRequest, opts ...grpc.CallOption) (*DeployDatabaseServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeployDatabaseServiceResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_DeployDatabaseService_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_DeployDatabaseService_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -137,8 +144,9 @@ func (c *aWSOIDCServiceClient) DeployDatabaseService(ctx context.Context, in *De
 }
 
 func (c *aWSOIDCServiceClient) DeployService(ctx context.Context, in *DeployServiceRequest, opts ...grpc.CallOption) (*DeployServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeployServiceResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_DeployService_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_DeployService_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -146,8 +154,9 @@ func (c *aWSOIDCServiceClient) DeployService(ctx context.Context, in *DeployServ
 }
 
 func (c *aWSOIDCServiceClient) EnrollEKSClusters(ctx context.Context, in *EnrollEKSClustersRequest, opts ...grpc.CallOption) (*EnrollEKSClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EnrollEKSClustersResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_EnrollEKSClusters_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_EnrollEKSClusters_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -155,8 +164,9 @@ func (c *aWSOIDCServiceClient) EnrollEKSClusters(ctx context.Context, in *Enroll
 }
 
 func (c *aWSOIDCServiceClient) ListEC2(ctx context.Context, in *ListEC2Request, opts ...grpc.CallOption) (*ListEC2Response, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListEC2Response)
-	err := c.cc.Invoke(ctx, AWSOIDCService_ListEC2_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_ListEC2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -164,8 +174,9 @@ func (c *aWSOIDCServiceClient) ListEC2(ctx context.Context, in *ListEC2Request,
 }
 
 func (c *aWSOIDCServiceClient) ListEKSClusters(ctx context.Context, in *ListEKSClustersRequest, opts ...grpc.CallOption) (*ListEKSClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListEKSClustersResponse)
-	err := c.cc.Invoke(ctx, AWSOIDCService_ListEKSClusters_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AWSOIDCService_ListEKSClusters_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -175,6 +186,8 @@ func (c *aWSOIDCServiceClient) ListEKSClusters(ctx context.Context, in *ListEKSC
 // AWSOIDCServiceServer is the server API for AWSOIDCService service.
 // All implementations must embed UnimplementedAWSOIDCServiceServer
 // for forward compatibility
+//
+// AWSOIDCService provides access to AWS APIs using the AWS OIDC Integration.
 type AWSOIDCServiceServer interface {
 	// ListEICE returns a list of EC2 Instance Connect Endpoints.
 	// An optional NextToken that can be used to fetch the next page.
diff --git a/api/gen/proto/go/teleport/integration/v1/integration_service_grpc.pb.go b/api/gen/proto/go/teleport/integration/v1/integration_service_grpc.pb.go
index 95be8603fcc6b..dac1038e618ab 100644
--- a/api/gen/proto/go/teleport/integration/v1/integration_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/integration/v1/integration_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/integration/v1/integration_service.proto
 
@@ -31,8 +31,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	IntegrationService_ListIntegrations_FullMethodName      = "/teleport.integration.v1.IntegrationService/ListIntegrations"
@@ -47,6 +47,8 @@ const (
 // IntegrationServiceClient is the client API for IntegrationService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// IntegrationService provides methods to manage Integrations with 3rd party APIs.
 type IntegrationServiceClient interface {
 	// ListIntegrations returns a paginated list of Integration resources.
 	ListIntegrations(ctx context.Context, in *ListIntegrationsRequest, opts ...grpc.CallOption) (*ListIntegrationsResponse, error)
@@ -74,8 +76,9 @@ func NewIntegrationServiceClient(cc grpc.ClientConnInterface) IntegrationService
 }
 
 func (c *integrationServiceClient) ListIntegrations(ctx context.Context, in *ListIntegrationsRequest, opts ...grpc.CallOption) (*ListIntegrationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListIntegrationsResponse)
-	err := c.cc.Invoke(ctx, IntegrationService_ListIntegrations_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_ListIntegrations_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -83,8 +86,9 @@ func (c *integrationServiceClient) ListIntegrations(ctx context.Context, in *Lis
 }
 
 func (c *integrationServiceClient) GetIntegration(ctx context.Context, in *GetIntegrationRequest, opts ...grpc.CallOption) (*types.IntegrationV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.IntegrationV1)
-	err := c.cc.Invoke(ctx, IntegrationService_GetIntegration_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_GetIntegration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -92,8 +96,9 @@ func (c *integrationServiceClient) GetIntegration(ctx context.Context, in *GetIn
 }
 
 func (c *integrationServiceClient) CreateIntegration(ctx context.Context, in *CreateIntegrationRequest, opts ...grpc.CallOption) (*types.IntegrationV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.IntegrationV1)
-	err := c.cc.Invoke(ctx, IntegrationService_CreateIntegration_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_CreateIntegration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -101,8 +106,9 @@ func (c *integrationServiceClient) CreateIntegration(ctx context.Context, in *Cr
 }
 
 func (c *integrationServiceClient) UpdateIntegration(ctx context.Context, in *UpdateIntegrationRequest, opts ...grpc.CallOption) (*types.IntegrationV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.IntegrationV1)
-	err := c.cc.Invoke(ctx, IntegrationService_UpdateIntegration_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_UpdateIntegration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,8 +116,9 @@ func (c *integrationServiceClient) UpdateIntegration(ctx context.Context, in *Up
 }
 
 func (c *integrationServiceClient) DeleteIntegration(ctx context.Context, in *DeleteIntegrationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, IntegrationService_DeleteIntegration_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_DeleteIntegration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -119,8 +126,9 @@ func (c *integrationServiceClient) DeleteIntegration(ctx context.Context, in *De
 }
 
 func (c *integrationServiceClient) DeleteAllIntegrations(ctx context.Context, in *DeleteAllIntegrationsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, IntegrationService_DeleteAllIntegrations_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_DeleteAllIntegrations_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,8 +136,9 @@ func (c *integrationServiceClient) DeleteAllIntegrations(ctx context.Context, in
 }
 
 func (c *integrationServiceClient) GenerateAWSOIDCToken(ctx context.Context, in *GenerateAWSOIDCTokenRequest, opts ...grpc.CallOption) (*GenerateAWSOIDCTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GenerateAWSOIDCTokenResponse)
-	err := c.cc.Invoke(ctx, IntegrationService_GenerateAWSOIDCToken_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, IntegrationService_GenerateAWSOIDCToken_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -139,6 +148,8 @@ func (c *integrationServiceClient) GenerateAWSOIDCToken(ctx context.Context, in
 // IntegrationServiceServer is the server API for IntegrationService service.
 // All implementations must embed UnimplementedIntegrationServiceServer
 // for forward compatibility
+//
+// IntegrationService provides methods to manage Integrations with 3rd party APIs.
 type IntegrationServiceServer interface {
 	// ListIntegrations returns a paginated list of Integration resources.
 	ListIntegrations(context.Context, *ListIntegrationsRequest) (*ListIntegrationsResponse, error)
diff --git a/api/gen/proto/go/teleport/kube/v1/kube_service_grpc.pb.go b/api/gen/proto/go/teleport/kube/v1/kube_service_grpc.pb.go
index 2280ba473cac0..2be5ac46ee7d6 100644
--- a/api/gen/proto/go/teleport/kube/v1/kube_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/kube/v1/kube_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/kube/v1/kube_service.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	KubeService_ListKubernetesResources_FullMethodName = "/teleport.kube.v1.KubeService/ListKubernetesResources"
@@ -39,6 +39,9 @@ const (
 // KubeServiceClient is the client API for KubeService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// KubeService provides methods to list Kubernetes resources when users are not allowed
+// to access the underlying cluster or resources but their `search_as_roles` allow.
 type KubeServiceClient interface {
 	// ListKubernetesResources lists the Kubernetes resources without leaking details.
 	ListKubernetesResources(ctx context.Context, in *ListKubernetesResourcesRequest, opts ...grpc.CallOption) (*ListKubernetesResourcesResponse, error)
@@ -53,8 +56,9 @@ func NewKubeServiceClient(cc grpc.ClientConnInterface) KubeServiceClient {
 }
 
 func (c *kubeServiceClient) ListKubernetesResources(ctx context.Context, in *ListKubernetesResourcesRequest, opts ...grpc.CallOption) (*ListKubernetesResourcesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListKubernetesResourcesResponse)
-	err := c.cc.Invoke(ctx, KubeService_ListKubernetesResources_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, KubeService_ListKubernetesResources_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -64,6 +68,9 @@ func (c *kubeServiceClient) ListKubernetesResources(ctx context.Context, in *Lis
 // KubeServiceServer is the server API for KubeService service.
 // All implementations must embed UnimplementedKubeServiceServer
 // for forward compatibility
+//
+// KubeService provides methods to list Kubernetes resources when users are not allowed
+// to access the underlying cluster or resources but their `search_as_roles` allow.
 type KubeServiceServer interface {
 	// ListKubernetesResources lists the Kubernetes resources without leaking details.
 	ListKubernetesResources(context.Context, *ListKubernetesResourcesRequest) (*ListKubernetesResourcesResponse, error)
diff --git a/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service_grpc.pb.go b/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service_grpc.pb.go
index 97bf310158364..5d7ce460c5e50 100644
--- a/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/kubewaitingcontainer/v1/kubewaitingcontainer_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	KubeWaitingContainersService_ListKubernetesWaitingContainers_FullMethodName  = "/teleport.kubewaitingcontainer.v1.KubeWaitingContainersService/ListKubernetesWaitingContainers"
@@ -43,6 +43,10 @@ const (
 // KubeWaitingContainersServiceClient is the client API for KubeWaitingContainersService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// KubeWaitingContainersService manages Kubernetes ephemeral
+// containers that are waiting to be created until moderated
+// session conditions are met.
 type KubeWaitingContainersServiceClient interface {
 	// ListKubernetesWaitingContainers returns a Kubernetes ephemeral
 	// container that is waiting to be created.
@@ -67,8 +71,9 @@ func NewKubeWaitingContainersServiceClient(cc grpc.ClientConnInterface) KubeWait
 }
 
 func (c *kubeWaitingContainersServiceClient) ListKubernetesWaitingContainers(ctx context.Context, in *ListKubernetesWaitingContainersRequest, opts ...grpc.CallOption) (*ListKubernetesWaitingContainersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListKubernetesWaitingContainersResponse)
-	err := c.cc.Invoke(ctx, KubeWaitingContainersService_ListKubernetesWaitingContainers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, KubeWaitingContainersService_ListKubernetesWaitingContainers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -76,8 +81,9 @@ func (c *kubeWaitingContainersServiceClient) ListKubernetesWaitingContainers(ctx
 }
 
 func (c *kubeWaitingContainersServiceClient) GetKubernetesWaitingContainer(ctx context.Context, in *GetKubernetesWaitingContainerRequest, opts ...grpc.CallOption) (*KubernetesWaitingContainer, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(KubernetesWaitingContainer)
-	err := c.cc.Invoke(ctx, KubeWaitingContainersService_GetKubernetesWaitingContainer_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, KubeWaitingContainersService_GetKubernetesWaitingContainer_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -85,8 +91,9 @@ func (c *kubeWaitingContainersServiceClient) GetKubernetesWaitingContainer(ctx c
 }
 
 func (c *kubeWaitingContainersServiceClient) CreateKubernetesWaitingContainer(ctx context.Context, in *CreateKubernetesWaitingContainerRequest, opts ...grpc.CallOption) (*KubernetesWaitingContainer, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(KubernetesWaitingContainer)
-	err := c.cc.Invoke(ctx, KubeWaitingContainersService_CreateKubernetesWaitingContainer_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, KubeWaitingContainersService_CreateKubernetesWaitingContainer_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -94,8 +101,9 @@ func (c *kubeWaitingContainersServiceClient) CreateKubernetesWaitingContainer(ct
 }
 
 func (c *kubeWaitingContainersServiceClient) DeleteKubernetesWaitingContainer(ctx context.Context, in *DeleteKubernetesWaitingContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, KubeWaitingContainersService_DeleteKubernetesWaitingContainer_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, KubeWaitingContainersService_DeleteKubernetesWaitingContainer_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -105,6 +113,10 @@ func (c *kubeWaitingContainersServiceClient) DeleteKubernetesWaitingContainer(ct
 // KubeWaitingContainersServiceServer is the server API for KubeWaitingContainersService service.
 // All implementations must embed UnimplementedKubeWaitingContainersServiceServer
 // for forward compatibility
+//
+// KubeWaitingContainersService manages Kubernetes ephemeral
+// containers that are waiting to be created until moderated
+// session conditions are met.
 type KubeWaitingContainersServiceServer interface {
 	// ListKubernetesWaitingContainers returns a Kubernetes ephemeral
 	// container that is waiting to be created.
diff --git a/api/gen/proto/go/teleport/loginrule/v1/loginrule_service_grpc.pb.go b/api/gen/proto/go/teleport/loginrule/v1/loginrule_service_grpc.pb.go
index a8d4dc7aa99a0..fd138656fadf4 100644
--- a/api/gen/proto/go/teleport/loginrule/v1/loginrule_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/loginrule/v1/loginrule_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/loginrule/v1/loginrule_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	LoginRuleService_CreateLoginRule_FullMethodName = "/teleport.loginrule.v1.LoginRuleService/CreateLoginRule"
@@ -45,6 +45,8 @@ const (
 // LoginRuleServiceClient is the client API for LoginRuleService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// LoginRuleService provides CRUD methods for the LoginRule resource.
 type LoginRuleServiceClient interface {
 	// CreateLoginRule creates a login rule if one with the same name does not
 	// already exist, else it returns an error.
@@ -73,8 +75,9 @@ func NewLoginRuleServiceClient(cc grpc.ClientConnInterface) LoginRuleServiceClie
 }
 
 func (c *loginRuleServiceClient) CreateLoginRule(ctx context.Context, in *CreateLoginRuleRequest, opts ...grpc.CallOption) (*LoginRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LoginRule)
-	err := c.cc.Invoke(ctx, LoginRuleService_CreateLoginRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, LoginRuleService_CreateLoginRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -82,8 +85,9 @@ func (c *loginRuleServiceClient) CreateLoginRule(ctx context.Context, in *Create
 }
 
 func (c *loginRuleServiceClient) UpsertLoginRule(ctx context.Context, in *UpsertLoginRuleRequest, opts ...grpc.CallOption) (*LoginRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LoginRule)
-	err := c.cc.Invoke(ctx, LoginRuleService_UpsertLoginRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, LoginRuleService_UpsertLoginRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -91,8 +95,9 @@ func (c *loginRuleServiceClient) UpsertLoginRule(ctx context.Context, in *Upsert
 }
 
 func (c *loginRuleServiceClient) GetLoginRule(ctx context.Context, in *GetLoginRuleRequest, opts ...grpc.CallOption) (*LoginRule, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LoginRule)
-	err := c.cc.Invoke(ctx, LoginRuleService_GetLoginRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, LoginRuleService_GetLoginRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -100,8 +105,9 @@ func (c *loginRuleServiceClient) GetLoginRule(ctx context.Context, in *GetLoginR
 }
 
 func (c *loginRuleServiceClient) ListLoginRules(ctx context.Context, in *ListLoginRulesRequest, opts ...grpc.CallOption) (*ListLoginRulesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListLoginRulesResponse)
-	err := c.cc.Invoke(ctx, LoginRuleService_ListLoginRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, LoginRuleService_ListLoginRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -109,8 +115,9 @@ func (c *loginRuleServiceClient) ListLoginRules(ctx context.Context, in *ListLog
 }
 
 func (c *loginRuleServiceClient) DeleteLoginRule(ctx context.Context, in *DeleteLoginRuleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, LoginRuleService_DeleteLoginRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, LoginRuleService_DeleteLoginRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -118,8 +125,9 @@ func (c *loginRuleServiceClient) DeleteLoginRule(ctx context.Context, in *Delete
 }
 
 func (c *loginRuleServiceClient) TestLoginRule(ctx context.Context, in *TestLoginRuleRequest, opts ...grpc.CallOption) (*TestLoginRuleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TestLoginRuleResponse)
-	err := c.cc.Invoke(ctx, LoginRuleService_TestLoginRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, LoginRuleService_TestLoginRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,6 +137,8 @@ func (c *loginRuleServiceClient) TestLoginRule(ctx context.Context, in *TestLogi
 // LoginRuleServiceServer is the server API for LoginRuleService service.
 // All implementations must embed UnimplementedLoginRuleServiceServer
 // for forward compatibility
+//
+// LoginRuleService provides CRUD methods for the LoginRule resource.
 type LoginRuleServiceServer interface {
 	// CreateLoginRule creates a login rule if one with the same name does not
 	// already exist, else it returns an error.
diff --git a/api/gen/proto/go/teleport/machineid/v1/bot_service_grpc.pb.go b/api/gen/proto/go/teleport/machineid/v1/bot_service_grpc.pb.go
index c8830ad91e6eb..cad254d963677 100644
--- a/api/gen/proto/go/teleport/machineid/v1/bot_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/bot_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/machineid/v1/bot_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	BotService_GetBot_FullMethodName    = "/teleport.machineid.v1.BotService/GetBot"
@@ -45,6 +45,8 @@ const (
 // BotServiceClient is the client API for BotService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// BotService provides methods to manage Teleport Bots
 type BotServiceClient interface {
 	// GetBot is used to query a Bot resource by its name.
 	//
@@ -80,8 +82,9 @@ func NewBotServiceClient(cc grpc.ClientConnInterface) BotServiceClient {
 }
 
 func (c *botServiceClient) GetBot(ctx context.Context, in *GetBotRequest, opts ...grpc.CallOption) (*Bot, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Bot)
-	err := c.cc.Invoke(ctx, BotService_GetBot_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, BotService_GetBot_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -89,8 +92,9 @@ func (c *botServiceClient) GetBot(ctx context.Context, in *GetBotRequest, opts .
 }
 
 func (c *botServiceClient) ListBots(ctx context.Context, in *ListBotsRequest, opts ...grpc.CallOption) (*ListBotsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListBotsResponse)
-	err := c.cc.Invoke(ctx, BotService_ListBots_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, BotService_ListBots_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +102,9 @@ func (c *botServiceClient) ListBots(ctx context.Context, in *ListBotsRequest, op
 }
 
 func (c *botServiceClient) CreateBot(ctx context.Context, in *CreateBotRequest, opts ...grpc.CallOption) (*Bot, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Bot)
-	err := c.cc.Invoke(ctx, BotService_CreateBot_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, BotService_CreateBot_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,8 +112,9 @@ func (c *botServiceClient) CreateBot(ctx context.Context, in *CreateBotRequest,
 }
 
 func (c *botServiceClient) UpdateBot(ctx context.Context, in *UpdateBotRequest, opts ...grpc.CallOption) (*Bot, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Bot)
-	err := c.cc.Invoke(ctx, BotService_UpdateBot_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, BotService_UpdateBot_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -116,8 +122,9 @@ func (c *botServiceClient) UpdateBot(ctx context.Context, in *UpdateBotRequest,
 }
 
 func (c *botServiceClient) UpsertBot(ctx context.Context, in *UpsertBotRequest, opts ...grpc.CallOption) (*Bot, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Bot)
-	err := c.cc.Invoke(ctx, BotService_UpsertBot_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, BotService_UpsertBot_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,8 +132,9 @@ func (c *botServiceClient) UpsertBot(ctx context.Context, in *UpsertBotRequest,
 }
 
 func (c *botServiceClient) DeleteBot(ctx context.Context, in *DeleteBotRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, BotService_DeleteBot_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, BotService_DeleteBot_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -136,6 +144,8 @@ func (c *botServiceClient) DeleteBot(ctx context.Context, in *DeleteBotRequest,
 // BotServiceServer is the server API for BotService service.
 // All implementations must embed UnimplementedBotServiceServer
 // for forward compatibility
+//
+// BotService provides methods to manage Teleport Bots
 type BotServiceServer interface {
 	// GetBot is used to query a Bot resource by its name.
 	//
diff --git a/api/gen/proto/go/teleport/machineid/v1/workload_identity_service_grpc.pb.go b/api/gen/proto/go/teleport/machineid/v1/workload_identity_service_grpc.pb.go
index c804b3bd1c1be..5d600458af5c8 100644
--- a/api/gen/proto/go/teleport/machineid/v1/workload_identity_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/machineid/v1/workload_identity_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/machineid/v1/workload_identity_service.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	WorkloadIdentityService_SignX509SVIDs_FullMethodName = "/teleport.machineid.v1.WorkloadIdentityService/SignX509SVIDs"
@@ -39,6 +39,9 @@ const (
 // WorkloadIdentityServiceClient is the client API for WorkloadIdentityService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// WorkloadIdentityService provides the signing of workload identity documents.
+// It currently only supports signing SPIFFE x509 SVIDs.
 type WorkloadIdentityServiceClient interface {
 	// SignX509SVIDs generates signed x509 SVIDs based on the SVIDs provided in
 	// the request.
@@ -54,8 +57,9 @@ func NewWorkloadIdentityServiceClient(cc grpc.ClientConnInterface) WorkloadIdent
 }
 
 func (c *workloadIdentityServiceClient) SignX509SVIDs(ctx context.Context, in *SignX509SVIDsRequest, opts ...grpc.CallOption) (*SignX509SVIDsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SignX509SVIDsResponse)
-	err := c.cc.Invoke(ctx, WorkloadIdentityService_SignX509SVIDs_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, WorkloadIdentityService_SignX509SVIDs_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -65,6 +69,9 @@ func (c *workloadIdentityServiceClient) SignX509SVIDs(ctx context.Context, in *S
 // WorkloadIdentityServiceServer is the server API for WorkloadIdentityService service.
 // All implementations must embed UnimplementedWorkloadIdentityServiceServer
 // for forward compatibility
+//
+// WorkloadIdentityService provides the signing of workload identity documents.
+// It currently only supports signing SPIFFE x509 SVIDs.
 type WorkloadIdentityServiceServer interface {
 	// SignX509SVIDs generates signed x509 SVIDs based on the SVIDs provided in
 	// the request.
diff --git a/api/gen/proto/go/teleport/notifications/v1/notifications_service_grpc.pb.go b/api/gen/proto/go/teleport/notifications/v1/notifications_service_grpc.pb.go
index a00e1de288d50..1774ed66652fe 100644
--- a/api/gen/proto/go/teleport/notifications/v1/notifications_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/notifications/v1/notifications_service_grpc.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/notifications/v1/notifications_service.proto
 
@@ -33,8 +33,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	NotificationService_CreateUserNotification_FullMethodName         = "/teleport.notifications.v1.NotificationService/CreateUserNotification"
@@ -49,6 +49,8 @@ const (
 // NotificationServiceClient is the client API for NotificationService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// NotificationService provides CRUD operations for notifications resources.
 type NotificationServiceClient interface {
 	// CreateUserNotification creates a user-specific notification.
 	CreateUserNotification(ctx context.Context, in *CreateUserNotificationRequest, opts ...grpc.CallOption) (*Notification, error)
@@ -75,8 +77,9 @@ func NewNotificationServiceClient(cc grpc.ClientConnInterface) NotificationServi
 }
 
 func (c *notificationServiceClient) CreateUserNotification(ctx context.Context, in *CreateUserNotificationRequest, opts ...grpc.CallOption) (*Notification, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Notification)
-	err := c.cc.Invoke(ctx, NotificationService_CreateUserNotification_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_CreateUserNotification_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +87,9 @@ func (c *notificationServiceClient) CreateUserNotification(ctx context.Context,
 }
 
 func (c *notificationServiceClient) DeleteUserNotification(ctx context.Context, in *DeleteUserNotificationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, NotificationService_DeleteUserNotification_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_DeleteUserNotification_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,8 +97,9 @@ func (c *notificationServiceClient) DeleteUserNotification(ctx context.Context,
 }
 
 func (c *notificationServiceClient) CreateGlobalNotification(ctx context.Context, in *CreateGlobalNotificationRequest, opts ...grpc.CallOption) (*GlobalNotification, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GlobalNotification)
-	err := c.cc.Invoke(ctx, NotificationService_CreateGlobalNotification_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_CreateGlobalNotification_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +107,9 @@ func (c *notificationServiceClient) CreateGlobalNotification(ctx context.Context
 }
 
 func (c *notificationServiceClient) DeleteGlobalNotification(ctx context.Context, in *DeleteGlobalNotificationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, NotificationService_DeleteGlobalNotification_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_DeleteGlobalNotification_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -111,8 +117,9 @@ func (c *notificationServiceClient) DeleteGlobalNotification(ctx context.Context
 }
 
 func (c *notificationServiceClient) ListNotifications(ctx context.Context, in *ListNotificationsRequest, opts ...grpc.CallOption) (*ListNotificationsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListNotificationsResponse)
-	err := c.cc.Invoke(ctx, NotificationService_ListNotifications_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_ListNotifications_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -120,8 +127,9 @@ func (c *notificationServiceClient) ListNotifications(ctx context.Context, in *L
 }
 
 func (c *notificationServiceClient) UpsertUserNotificationState(ctx context.Context, in *UpsertUserNotificationStateRequest, opts ...grpc.CallOption) (*UserNotificationState, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UserNotificationState)
-	err := c.cc.Invoke(ctx, NotificationService_UpsertUserNotificationState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_UpsertUserNotificationState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,8 +137,9 @@ func (c *notificationServiceClient) UpsertUserNotificationState(ctx context.Cont
 }
 
 func (c *notificationServiceClient) UpsertUserLastSeenNotification(ctx context.Context, in *UpsertUserLastSeenNotificationRequest, opts ...grpc.CallOption) (*UserLastSeenNotification, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UserLastSeenNotification)
-	err := c.cc.Invoke(ctx, NotificationService_UpsertUserLastSeenNotification_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, NotificationService_UpsertUserLastSeenNotification_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -140,6 +149,8 @@ func (c *notificationServiceClient) UpsertUserLastSeenNotification(ctx context.C
 // NotificationServiceServer is the server API for NotificationService service.
 // All implementations must embed UnimplementedNotificationServiceServer
 // for forward compatibility
+//
+// NotificationService provides CRUD operations for notifications resources.
 type NotificationServiceServer interface {
 	// CreateUserNotification creates a user-specific notification.
 	CreateUserNotification(context.Context, *CreateUserNotificationRequest) (*Notification, error)
diff --git a/api/gen/proto/go/teleport/okta/v1/okta_service_grpc.pb.go b/api/gen/proto/go/teleport/okta/v1/okta_service_grpc.pb.go
index 084a4646a3f05..4a3ea01a1f53e 100644
--- a/api/gen/proto/go/teleport/okta/v1/okta_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/okta/v1/okta_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/okta/v1/okta_service.proto
 
@@ -31,8 +31,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	OktaService_ListOktaImportRules_FullMethodName        = "/teleport.okta.v1.OktaService/ListOktaImportRules"
@@ -53,6 +53,8 @@ const (
 // OktaServiceClient is the client API for OktaService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// OktaService provides CRUD methods for Okta resources.
 type OktaServiceClient interface {
 	// ListOktaImportRules returns a paginated list of all Okta import rule resources.
 	ListOktaImportRules(ctx context.Context, in *ListOktaImportRulesRequest, opts ...grpc.CallOption) (*ListOktaImportRulesResponse, error)
@@ -91,8 +93,9 @@ func NewOktaServiceClient(cc grpc.ClientConnInterface) OktaServiceClient {
 }
 
 func (c *oktaServiceClient) ListOktaImportRules(ctx context.Context, in *ListOktaImportRulesRequest, opts ...grpc.CallOption) (*ListOktaImportRulesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListOktaImportRulesResponse)
-	err := c.cc.Invoke(ctx, OktaService_ListOktaImportRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_ListOktaImportRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -100,8 +103,9 @@ func (c *oktaServiceClient) ListOktaImportRules(ctx context.Context, in *ListOkt
 }
 
 func (c *oktaServiceClient) GetOktaImportRule(ctx context.Context, in *GetOktaImportRuleRequest, opts ...grpc.CallOption) (*types.OktaImportRuleV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OktaImportRuleV1)
-	err := c.cc.Invoke(ctx, OktaService_GetOktaImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_GetOktaImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -109,8 +113,9 @@ func (c *oktaServiceClient) GetOktaImportRule(ctx context.Context, in *GetOktaIm
 }
 
 func (c *oktaServiceClient) CreateOktaImportRule(ctx context.Context, in *CreateOktaImportRuleRequest, opts ...grpc.CallOption) (*types.OktaImportRuleV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OktaImportRuleV1)
-	err := c.cc.Invoke(ctx, OktaService_CreateOktaImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_CreateOktaImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -118,8 +123,9 @@ func (c *oktaServiceClient) CreateOktaImportRule(ctx context.Context, in *Create
 }
 
 func (c *oktaServiceClient) UpdateOktaImportRule(ctx context.Context, in *UpdateOktaImportRuleRequest, opts ...grpc.CallOption) (*types.OktaImportRuleV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OktaImportRuleV1)
-	err := c.cc.Invoke(ctx, OktaService_UpdateOktaImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_UpdateOktaImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -127,8 +133,9 @@ func (c *oktaServiceClient) UpdateOktaImportRule(ctx context.Context, in *Update
 }
 
 func (c *oktaServiceClient) DeleteOktaImportRule(ctx context.Context, in *DeleteOktaImportRuleRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, OktaService_DeleteOktaImportRule_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_DeleteOktaImportRule_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -136,8 +143,9 @@ func (c *oktaServiceClient) DeleteOktaImportRule(ctx context.Context, in *Delete
 }
 
 func (c *oktaServiceClient) DeleteAllOktaImportRules(ctx context.Context, in *DeleteAllOktaImportRulesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, OktaService_DeleteAllOktaImportRules_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_DeleteAllOktaImportRules_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -145,8 +153,9 @@ func (c *oktaServiceClient) DeleteAllOktaImportRules(ctx context.Context, in *De
 }
 
 func (c *oktaServiceClient) ListOktaAssignments(ctx context.Context, in *ListOktaAssignmentsRequest, opts ...grpc.CallOption) (*ListOktaAssignmentsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListOktaAssignmentsResponse)
-	err := c.cc.Invoke(ctx, OktaService_ListOktaAssignments_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_ListOktaAssignments_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -154,8 +163,9 @@ func (c *oktaServiceClient) ListOktaAssignments(ctx context.Context, in *ListOkt
 }
 
 func (c *oktaServiceClient) GetOktaAssignment(ctx context.Context, in *GetOktaAssignmentRequest, opts ...grpc.CallOption) (*types.OktaAssignmentV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OktaAssignmentV1)
-	err := c.cc.Invoke(ctx, OktaService_GetOktaAssignment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_GetOktaAssignment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -163,8 +173,9 @@ func (c *oktaServiceClient) GetOktaAssignment(ctx context.Context, in *GetOktaAs
 }
 
 func (c *oktaServiceClient) CreateOktaAssignment(ctx context.Context, in *CreateOktaAssignmentRequest, opts ...grpc.CallOption) (*types.OktaAssignmentV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OktaAssignmentV1)
-	err := c.cc.Invoke(ctx, OktaService_CreateOktaAssignment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_CreateOktaAssignment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -172,8 +183,9 @@ func (c *oktaServiceClient) CreateOktaAssignment(ctx context.Context, in *Create
 }
 
 func (c *oktaServiceClient) UpdateOktaAssignment(ctx context.Context, in *UpdateOktaAssignmentRequest, opts ...grpc.CallOption) (*types.OktaAssignmentV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.OktaAssignmentV1)
-	err := c.cc.Invoke(ctx, OktaService_UpdateOktaAssignment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_UpdateOktaAssignment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -181,8 +193,9 @@ func (c *oktaServiceClient) UpdateOktaAssignment(ctx context.Context, in *Update
 }
 
 func (c *oktaServiceClient) UpdateOktaAssignmentStatus(ctx context.Context, in *UpdateOktaAssignmentStatusRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, OktaService_UpdateOktaAssignmentStatus_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_UpdateOktaAssignmentStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -190,8 +203,9 @@ func (c *oktaServiceClient) UpdateOktaAssignmentStatus(ctx context.Context, in *
 }
 
 func (c *oktaServiceClient) DeleteOktaAssignment(ctx context.Context, in *DeleteOktaAssignmentRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, OktaService_DeleteOktaAssignment_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_DeleteOktaAssignment_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -199,8 +213,9 @@ func (c *oktaServiceClient) DeleteOktaAssignment(ctx context.Context, in *Delete
 }
 
 func (c *oktaServiceClient) DeleteAllOktaAssignments(ctx context.Context, in *DeleteAllOktaAssignmentsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, OktaService_DeleteAllOktaAssignments_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, OktaService_DeleteAllOktaAssignments_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -210,6 +225,8 @@ func (c *oktaServiceClient) DeleteAllOktaAssignments(ctx context.Context, in *De
 // OktaServiceServer is the server API for OktaService service.
 // All implementations must embed UnimplementedOktaServiceServer
 // for forward compatibility
+//
+// OktaService provides CRUD methods for Okta resources.
 type OktaServiceServer interface {
 	// ListOktaImportRules returns a paginated list of all Okta import rule resources.
 	ListOktaImportRules(context.Context, *ListOktaImportRulesRequest) (*ListOktaImportRulesResponse, error)
diff --git a/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go b/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go
index bccd115651e0b..1ea0bb21d8d4c 100644
--- a/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/plugins/v1/plugin_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/plugins/v1/plugin_service.proto
 
@@ -31,8 +31,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	PluginService_CreatePlugin_FullMethodName                  = "/teleport.plugins.v1.PluginService/CreatePlugin"
@@ -51,6 +51,8 @@ const (
 // PluginServiceClient is the client API for PluginService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// PluginService provides CRUD operations for Plugin resources.
 type PluginServiceClient interface {
 	// CreatePlugin creates a new plugin instance.
 	CreatePlugin(ctx context.Context, in *CreatePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -89,8 +91,9 @@ func NewPluginServiceClient(cc grpc.ClientConnInterface) PluginServiceClient {
 }
 
 func (c *pluginServiceClient) CreatePlugin(ctx context.Context, in *CreatePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, PluginService_CreatePlugin_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_CreatePlugin_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -98,8 +101,9 @@ func (c *pluginServiceClient) CreatePlugin(ctx context.Context, in *CreatePlugin
 }
 
 func (c *pluginServiceClient) GetPlugin(ctx context.Context, in *GetPluginRequest, opts ...grpc.CallOption) (*types.PluginV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.PluginV1)
-	err := c.cc.Invoke(ctx, PluginService_GetPlugin_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_GetPlugin_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -107,8 +111,9 @@ func (c *pluginServiceClient) GetPlugin(ctx context.Context, in *GetPluginReques
 }
 
 func (c *pluginServiceClient) UpdatePlugin(ctx context.Context, in *UpdatePluginRequest, opts ...grpc.CallOption) (*types.PluginV1, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.PluginV1)
-	err := c.cc.Invoke(ctx, PluginService_UpdatePlugin_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_UpdatePlugin_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -116,8 +121,9 @@ func (c *pluginServiceClient) UpdatePlugin(ctx context.Context, in *UpdatePlugin
 }
 
 func (c *pluginServiceClient) DeletePlugin(ctx context.Context, in *DeletePluginRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, PluginService_DeletePlugin_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_DeletePlugin_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,8 +131,9 @@ func (c *pluginServiceClient) DeletePlugin(ctx context.Context, in *DeletePlugin
 }
 
 func (c *pluginServiceClient) ListPlugins(ctx context.Context, in *ListPluginsRequest, opts ...grpc.CallOption) (*ListPluginsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListPluginsResponse)
-	err := c.cc.Invoke(ctx, PluginService_ListPlugins_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_ListPlugins_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -134,8 +141,9 @@ func (c *pluginServiceClient) ListPlugins(ctx context.Context, in *ListPluginsRe
 }
 
 func (c *pluginServiceClient) SetPluginCredentials(ctx context.Context, in *SetPluginCredentialsRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, PluginService_SetPluginCredentials_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_SetPluginCredentials_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -143,8 +151,9 @@ func (c *pluginServiceClient) SetPluginCredentials(ctx context.Context, in *SetP
 }
 
 func (c *pluginServiceClient) SetPluginStatus(ctx context.Context, in *SetPluginStatusRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, PluginService_SetPluginStatus_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_SetPluginStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -152,8 +161,9 @@ func (c *pluginServiceClient) SetPluginStatus(ctx context.Context, in *SetPlugin
 }
 
 func (c *pluginServiceClient) GetAvailablePluginTypes(ctx context.Context, in *GetAvailablePluginTypesRequest, opts ...grpc.CallOption) (*GetAvailablePluginTypesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAvailablePluginTypesResponse)
-	err := c.cc.Invoke(ctx, PluginService_GetAvailablePluginTypes_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_GetAvailablePluginTypes_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -161,8 +171,9 @@ func (c *pluginServiceClient) GetAvailablePluginTypes(ctx context.Context, in *G
 }
 
 func (c *pluginServiceClient) SearchPluginStaticCredentials(ctx context.Context, in *SearchPluginStaticCredentialsRequest, opts ...grpc.CallOption) (*SearchPluginStaticCredentialsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SearchPluginStaticCredentialsResponse)
-	err := c.cc.Invoke(ctx, PluginService_SearchPluginStaticCredentials_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_SearchPluginStaticCredentials_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -170,8 +181,9 @@ func (c *pluginServiceClient) SearchPluginStaticCredentials(ctx context.Context,
 }
 
 func (c *pluginServiceClient) NeedsCleanup(ctx context.Context, in *NeedsCleanupRequest, opts ...grpc.CallOption) (*NeedsCleanupResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(NeedsCleanupResponse)
-	err := c.cc.Invoke(ctx, PluginService_NeedsCleanup_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_NeedsCleanup_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -179,8 +191,9 @@ func (c *pluginServiceClient) NeedsCleanup(ctx context.Context, in *NeedsCleanup
 }
 
 func (c *pluginServiceClient) Cleanup(ctx context.Context, in *CleanupRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, PluginService_Cleanup_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginService_Cleanup_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -190,6 +203,8 @@ func (c *pluginServiceClient) Cleanup(ctx context.Context, in *CleanupRequest, o
 // PluginServiceServer is the server API for PluginService service.
 // All implementations must embed UnimplementedPluginServiceServer
 // for forward compatibility
+//
+// PluginService provides CRUD operations for Plugin resources.
 type PluginServiceServer interface {
 	// CreatePlugin creates a new plugin instance.
 	CreatePlugin(context.Context, *CreatePluginRequest) (*emptypb.Empty, error)
diff --git a/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go b/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go
index 0d2ed5d027f5d..973054bb808c7 100644
--- a/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/presence/v1/service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/presence/v1/service.proto
 
@@ -31,8 +31,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	PresenceService_GetRemoteCluster_FullMethodName    = "/teleport.presence.v1.PresenceService/GetRemoteCluster"
@@ -44,6 +44,8 @@ const (
 // PresenceServiceClient is the client API for PresenceService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// PresenceService provides methods to manage presence of RemoteClusters
 type PresenceServiceClient interface {
 	// GetRemoteCluster retrieves a RemoteCluster by name.
 	GetRemoteCluster(ctx context.Context, in *GetRemoteClusterRequest, opts ...grpc.CallOption) (*types.RemoteClusterV3, error)
@@ -64,8 +66,9 @@ func NewPresenceServiceClient(cc grpc.ClientConnInterface) PresenceServiceClient
 }
 
 func (c *presenceServiceClient) GetRemoteCluster(ctx context.Context, in *GetRemoteClusterRequest, opts ...grpc.CallOption) (*types.RemoteClusterV3, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.RemoteClusterV3)
-	err := c.cc.Invoke(ctx, PresenceService_GetRemoteCluster_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PresenceService_GetRemoteCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -73,8 +76,9 @@ func (c *presenceServiceClient) GetRemoteCluster(ctx context.Context, in *GetRem
 }
 
 func (c *presenceServiceClient) ListRemoteClusters(ctx context.Context, in *ListRemoteClustersRequest, opts ...grpc.CallOption) (*ListRemoteClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListRemoteClustersResponse)
-	err := c.cc.Invoke(ctx, PresenceService_ListRemoteClusters_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PresenceService_ListRemoteClusters_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -82,8 +86,9 @@ func (c *presenceServiceClient) ListRemoteClusters(ctx context.Context, in *List
 }
 
 func (c *presenceServiceClient) UpdateRemoteCluster(ctx context.Context, in *UpdateRemoteClusterRequest, opts ...grpc.CallOption) (*types.RemoteClusterV3, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.RemoteClusterV3)
-	err := c.cc.Invoke(ctx, PresenceService_UpdateRemoteCluster_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PresenceService_UpdateRemoteCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -91,8 +96,9 @@ func (c *presenceServiceClient) UpdateRemoteCluster(ctx context.Context, in *Upd
 }
 
 func (c *presenceServiceClient) DeleteRemoteCluster(ctx context.Context, in *DeleteRemoteClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, PresenceService_DeleteRemoteCluster_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, PresenceService_DeleteRemoteCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,6 +108,8 @@ func (c *presenceServiceClient) DeleteRemoteCluster(ctx context.Context, in *Del
 // PresenceServiceServer is the server API for PresenceService service.
 // All implementations must embed UnimplementedPresenceServiceServer
 // for forward compatibility
+//
+// PresenceService provides methods to manage presence of RemoteClusters
 type PresenceServiceServer interface {
 	// GetRemoteCluster retrieves a RemoteCluster by name.
 	GetRemoteCluster(context.Context, *GetRemoteClusterRequest) (*types.RemoteClusterV3, error)
diff --git a/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service_grpc.pb.go b/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service_grpc.pb.go
index 2295ea96e1f96..c82b4821e7e16 100644
--- a/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/resourceusage/v1/resourceusage_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/resourceusage/v1/resourceusage_service.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	ResourceUsageService_GetUsage_FullMethodName = "/teleport.resourceusage.v1.ResourceUsageService/GetUsage"
@@ -39,6 +39,8 @@ const (
 // ResourceUsageServiceClient is the client API for ResourceUsageService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ResourceUsageService is a service to fetch information about the usage of limited resources on usage-billed plans.
 type ResourceUsageServiceClient interface {
 	// GetUsage returns usage information for all limited resources.
 	GetUsage(ctx context.Context, in *GetUsageRequest, opts ...grpc.CallOption) (*GetUsageResponse, error)
@@ -53,8 +55,9 @@ func NewResourceUsageServiceClient(cc grpc.ClientConnInterface) ResourceUsageSer
 }
 
 func (c *resourceUsageServiceClient) GetUsage(ctx context.Context, in *GetUsageRequest, opts ...grpc.CallOption) (*GetUsageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetUsageResponse)
-	err := c.cc.Invoke(ctx, ResourceUsageService_GetUsage_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, ResourceUsageService_GetUsage_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -64,6 +67,8 @@ func (c *resourceUsageServiceClient) GetUsage(ctx context.Context, in *GetUsageR
 // ResourceUsageServiceServer is the server API for ResourceUsageService service.
 // All implementations must embed UnimplementedResourceUsageServiceServer
 // for forward compatibility
+//
+// ResourceUsageService is a service to fetch information about the usage of limited resources on usage-billed plans.
 type ResourceUsageServiceServer interface {
 	// GetUsage returns usage information for all limited resources.
 	GetUsage(context.Context, *GetUsageRequest) (*GetUsageResponse, error)
diff --git a/api/gen/proto/go/teleport/samlidp/v1/samlidp_grpc.pb.go b/api/gen/proto/go/teleport/samlidp/v1/samlidp_grpc.pb.go
index 136f54383c858..41f6c31477cac 100644
--- a/api/gen/proto/go/teleport/samlidp/v1/samlidp_grpc.pb.go
+++ b/api/gen/proto/go/teleport/samlidp/v1/samlidp_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/samlidp/v1/samlidp.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	SAMLIdPService_ProcessSAMLIdPRequest_FullMethodName       = "/teleport.samlidp.v1.SAMLIdPService/ProcessSAMLIdPRequest"
@@ -40,6 +40,8 @@ const (
 // SAMLIdPServiceClient is the client API for SAMLIdPService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// SAMLIdPService provides utility methods for the SAML identity provider.
 type SAMLIdPServiceClient interface {
 	// ProcessSAMLIdPRequest processes the SAML auth request.
 	ProcessSAMLIdPRequest(ctx context.Context, in *ProcessSAMLIdPRequestRequest, opts ...grpc.CallOption) (*ProcessSAMLIdPRequestResponse, error)
@@ -56,8 +58,9 @@ func NewSAMLIdPServiceClient(cc grpc.ClientConnInterface) SAMLIdPServiceClient {
 }
 
 func (c *sAMLIdPServiceClient) ProcessSAMLIdPRequest(ctx context.Context, in *ProcessSAMLIdPRequestRequest, opts ...grpc.CallOption) (*ProcessSAMLIdPRequestResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ProcessSAMLIdPRequestResponse)
-	err := c.cc.Invoke(ctx, SAMLIdPService_ProcessSAMLIdPRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SAMLIdPService_ProcessSAMLIdPRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -65,8 +68,9 @@ func (c *sAMLIdPServiceClient) ProcessSAMLIdPRequest(ctx context.Context, in *Pr
 }
 
 func (c *sAMLIdPServiceClient) TestSAMLIdPAttributeMapping(ctx context.Context, in *TestSAMLIdPAttributeMappingRequest, opts ...grpc.CallOption) (*TestSAMLIdPAttributeMappingResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(TestSAMLIdPAttributeMappingResponse)
-	err := c.cc.Invoke(ctx, SAMLIdPService_TestSAMLIdPAttributeMapping_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SAMLIdPService_TestSAMLIdPAttributeMapping_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -76,6 +80,8 @@ func (c *sAMLIdPServiceClient) TestSAMLIdPAttributeMapping(ctx context.Context,
 // SAMLIdPServiceServer is the server API for SAMLIdPService service.
 // All implementations must embed UnimplementedSAMLIdPServiceServer
 // for forward compatibility
+//
+// SAMLIdPService provides utility methods for the SAML identity provider.
 type SAMLIdPServiceServer interface {
 	// ProcessSAMLIdPRequest processes the SAML auth request.
 	ProcessSAMLIdPRequest(context.Context, *ProcessSAMLIdPRequestRequest) (*ProcessSAMLIdPRequestResponse, error)
diff --git a/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go b/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go
index 0d80105b0ae8e..3f0a50f31614f 100644
--- a/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/scim/v1/scim_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/scim/v1/scim_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	SCIMService_ListSCIMResources_FullMethodName  = "/teleport.scim.v1.SCIMService/ListSCIMResources"
@@ -44,6 +44,8 @@ const (
 // SCIMServiceClient is the client API for SCIMService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// SCIMService implements a SCIM gateway for external IDPs for user provisioning
 type SCIMServiceClient interface {
 	// List fetches all (or a subset of all) resources resources of a given type
 	ListSCIMResources(ctx context.Context, in *ListSCIMResourcesRequest, opts ...grpc.CallOption) (*ResourceList, error)
@@ -68,8 +70,9 @@ func NewSCIMServiceClient(cc grpc.ClientConnInterface) SCIMServiceClient {
 }
 
 func (c *sCIMServiceClient) ListSCIMResources(ctx context.Context, in *ListSCIMResourcesRequest, opts ...grpc.CallOption) (*ResourceList, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ResourceList)
-	err := c.cc.Invoke(ctx, SCIMService_ListSCIMResources_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SCIMService_ListSCIMResources_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -77,8 +80,9 @@ func (c *sCIMServiceClient) ListSCIMResources(ctx context.Context, in *ListSCIMR
 }
 
 func (c *sCIMServiceClient) GetSCIMResource(ctx context.Context, in *GetSCIMResourceRequest, opts ...grpc.CallOption) (*Resource, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Resource)
-	err := c.cc.Invoke(ctx, SCIMService_GetSCIMResource_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SCIMService_GetSCIMResource_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -86,8 +90,9 @@ func (c *sCIMServiceClient) GetSCIMResource(ctx context.Context, in *GetSCIMReso
 }
 
 func (c *sCIMServiceClient) CreateSCIMResource(ctx context.Context, in *CreateSCIMResourceRequest, opts ...grpc.CallOption) (*Resource, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Resource)
-	err := c.cc.Invoke(ctx, SCIMService_CreateSCIMResource_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SCIMService_CreateSCIMResource_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -95,8 +100,9 @@ func (c *sCIMServiceClient) CreateSCIMResource(ctx context.Context, in *CreateSC
 }
 
 func (c *sCIMServiceClient) UpdateSCIMResource(ctx context.Context, in *UpdateSCIMResourceRequest, opts ...grpc.CallOption) (*Resource, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Resource)
-	err := c.cc.Invoke(ctx, SCIMService_UpdateSCIMResource_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SCIMService_UpdateSCIMResource_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -104,8 +110,9 @@ func (c *sCIMServiceClient) UpdateSCIMResource(ctx context.Context, in *UpdateSC
 }
 
 func (c *sCIMServiceClient) DeleteSCIMResource(ctx context.Context, in *DeleteSCIMResourceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, SCIMService_DeleteSCIMResource_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SCIMService_DeleteSCIMResource_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -115,6 +122,8 @@ func (c *sCIMServiceClient) DeleteSCIMResource(ctx context.Context, in *DeleteSC
 // SCIMServiceServer is the server API for SCIMService service.
 // All implementations must embed UnimplementedSCIMServiceServer
 // for forward compatibility
+//
+// SCIMService implements a SCIM gateway for external IDPs for user provisioning
 type SCIMServiceServer interface {
 	// List fetches all (or a subset of all) resources resources of a given type
 	ListSCIMResources(context.Context, *ListSCIMResourcesRequest) (*ResourceList, error)
diff --git a/api/gen/proto/go/teleport/secreports/v1/secreports_service_grpc.pb.go b/api/gen/proto/go/teleport/secreports/v1/secreports_service_grpc.pb.go
index 79a438a08ced6..bc25d091ee6f6 100644
--- a/api/gen/proto/go/teleport/secreports/v1/secreports_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/secreports/v1/secreports_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/secreports/v1/secreports_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	SecReportsService_UpsertAuditQuery_FullMethodName    = "/teleport.secreports.v1.SecReportsService/UpsertAuditQuery"
@@ -53,6 +53,8 @@ const (
 // SecReportsServiceClient is the client API for SecReportsService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// SecReportsService is a service that manages security reports.
 type SecReportsServiceClient interface {
 	// UpsertAuditQuery upsets an audit query.
 	UpsertAuditQuery(ctx context.Context, in *UpsertAuditQueryRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -93,8 +95,9 @@ func NewSecReportsServiceClient(cc grpc.ClientConnInterface) SecReportsServiceCl
 }
 
 func (c *secReportsServiceClient) UpsertAuditQuery(ctx context.Context, in *UpsertAuditQueryRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, SecReportsService_UpsertAuditQuery_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_UpsertAuditQuery_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +105,9 @@ func (c *secReportsServiceClient) UpsertAuditQuery(ctx context.Context, in *Upse
 }
 
 func (c *secReportsServiceClient) GetAuditQuery(ctx context.Context, in *GetAuditQueryRequest, opts ...grpc.CallOption) (*AuditQuery, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AuditQuery)
-	err := c.cc.Invoke(ctx, SecReportsService_GetAuditQuery_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_GetAuditQuery_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -111,8 +115,9 @@ func (c *secReportsServiceClient) GetAuditQuery(ctx context.Context, in *GetAudi
 }
 
 func (c *secReportsServiceClient) ListAuditQueries(ctx context.Context, in *ListAuditQueriesRequest, opts ...grpc.CallOption) (*ListAuditQueriesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListAuditQueriesResponse)
-	err := c.cc.Invoke(ctx, SecReportsService_ListAuditQueries_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_ListAuditQueries_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -120,8 +125,9 @@ func (c *secReportsServiceClient) ListAuditQueries(ctx context.Context, in *List
 }
 
 func (c *secReportsServiceClient) DeleteAuditQuery(ctx context.Context, in *DeleteAuditQueryRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, SecReportsService_DeleteAuditQuery_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_DeleteAuditQuery_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,8 +135,9 @@ func (c *secReportsServiceClient) DeleteAuditQuery(ctx context.Context, in *Dele
 }
 
 func (c *secReportsServiceClient) UpsertReport(ctx context.Context, in *UpsertReportRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, SecReportsService_UpsertReport_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_UpsertReport_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -138,8 +145,9 @@ func (c *secReportsServiceClient) UpsertReport(ctx context.Context, in *UpsertRe
 }
 
 func (c *secReportsServiceClient) GetReport(ctx context.Context, in *GetReportRequest, opts ...grpc.CallOption) (*Report, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Report)
-	err := c.cc.Invoke(ctx, SecReportsService_GetReport_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_GetReport_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -147,8 +155,9 @@ func (c *secReportsServiceClient) GetReport(ctx context.Context, in *GetReportRe
 }
 
 func (c *secReportsServiceClient) ListReports(ctx context.Context, in *ListReportsRequest, opts ...grpc.CallOption) (*ListReportsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListReportsResponse)
-	err := c.cc.Invoke(ctx, SecReportsService_ListReports_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_ListReports_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -156,8 +165,9 @@ func (c *secReportsServiceClient) ListReports(ctx context.Context, in *ListRepor
 }
 
 func (c *secReportsServiceClient) DeleteReport(ctx context.Context, in *DeleteReportRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, SecReportsService_DeleteReport_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_DeleteReport_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -165,8 +175,9 @@ func (c *secReportsServiceClient) DeleteReport(ctx context.Context, in *DeleteRe
 }
 
 func (c *secReportsServiceClient) RunAuditQuery(ctx context.Context, in *RunAuditQueryRequest, opts ...grpc.CallOption) (*RunAuditQueryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RunAuditQueryResponse)
-	err := c.cc.Invoke(ctx, SecReportsService_RunAuditQuery_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_RunAuditQuery_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -174,8 +185,9 @@ func (c *secReportsServiceClient) RunAuditQuery(ctx context.Context, in *RunAudi
 }
 
 func (c *secReportsServiceClient) GetAuditQueryResult(ctx context.Context, in *GetAuditQueryResultRequest, opts ...grpc.CallOption) (*GetAuditQueryResultResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAuditQueryResultResponse)
-	err := c.cc.Invoke(ctx, SecReportsService_GetAuditQueryResult_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_GetAuditQueryResult_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -183,8 +195,9 @@ func (c *secReportsServiceClient) GetAuditQueryResult(ctx context.Context, in *G
 }
 
 func (c *secReportsServiceClient) RunReport(ctx context.Context, in *RunReportRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, SecReportsService_RunReport_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_RunReport_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -192,8 +205,9 @@ func (c *secReportsServiceClient) RunReport(ctx context.Context, in *RunReportRe
 }
 
 func (c *secReportsServiceClient) GetReportResult(ctx context.Context, in *GetReportResultRequest, opts ...grpc.CallOption) (*GetReportResultResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetReportResultResponse)
-	err := c.cc.Invoke(ctx, SecReportsService_GetReportResult_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_GetReportResult_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -201,8 +215,9 @@ func (c *secReportsServiceClient) GetReportResult(ctx context.Context, in *GetRe
 }
 
 func (c *secReportsServiceClient) GetReportState(ctx context.Context, in *GetReportStateRequest, opts ...grpc.CallOption) (*ReportState, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ReportState)
-	err := c.cc.Invoke(ctx, SecReportsService_GetReportState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_GetReportState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -210,8 +225,9 @@ func (c *secReportsServiceClient) GetReportState(ctx context.Context, in *GetRep
 }
 
 func (c *secReportsServiceClient) GetSchema(ctx context.Context, in *GetSchemaRequest, opts ...grpc.CallOption) (*GetSchemaResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetSchemaResponse)
-	err := c.cc.Invoke(ctx, SecReportsService_GetSchema_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, SecReportsService_GetSchema_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -221,6 +237,8 @@ func (c *secReportsServiceClient) GetSchema(ctx context.Context, in *GetSchemaRe
 // SecReportsServiceServer is the server API for SecReportsService service.
 // All implementations must embed UnimplementedSecReportsServiceServer
 // for forward compatibility
+//
+// SecReportsService is a service that manages security reports.
 type SecReportsServiceServer interface {
 	// UpsertAuditQuery upsets an audit query.
 	UpsertAuditQuery(context.Context, *UpsertAuditQueryRequest) (*emptypb.Empty, error)
diff --git a/api/gen/proto/go/teleport/transport/v1/transport_service_grpc.pb.go b/api/gen/proto/go/teleport/transport/v1/transport_service_grpc.pb.go
index 3112cd8d28657..5f4dae9862ac8 100644
--- a/api/gen/proto/go/teleport/transport/v1/transport_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/transport/v1/transport_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/transport/v1/transport_service.proto
 
@@ -29,8 +29,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	TransportService_GetClusterDetails_FullMethodName = "/teleport.transport.v1.TransportService/GetClusterDetails"
@@ -41,6 +41,13 @@ const (
 // TransportServiceClient is the client API for TransportService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// TransportService provides methods to proxy connections to various Teleport instances.
+//
+// All connections are operate on top of a bidirectional stream which transports
+// raw payloads from higher level protocols (i.e. SSH). Clients must send an initial
+// message on the stream to set up the connections accordingly. After the initial
+// request either side may freely send data in any order until the stream is terminated.
 type TransportServiceClient interface {
 	// GetClusterDetails provides cluster information that may affect how transport
 	// should occur.
@@ -68,8 +75,9 @@ func NewTransportServiceClient(cc grpc.ClientConnInterface) TransportServiceClie
 }
 
 func (c *transportServiceClient) GetClusterDetails(ctx context.Context, in *GetClusterDetailsRequest, opts ...grpc.CallOption) (*GetClusterDetailsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetClusterDetailsResponse)
-	err := c.cc.Invoke(ctx, TransportService_GetClusterDetails_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TransportService_GetClusterDetails_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -77,11 +85,12 @@ func (c *transportServiceClient) GetClusterDetails(ctx context.Context, in *GetC
 }
 
 func (c *transportServiceClient) ProxySSH(ctx context.Context, opts ...grpc.CallOption) (TransportService_ProxySSHClient, error) {
-	stream, err := c.cc.NewStream(ctx, &TransportService_ServiceDesc.Streams[0], TransportService_ProxySSH_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &TransportService_ServiceDesc.Streams[0], TransportService_ProxySSH_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &transportServiceProxySSHClient{stream}
+	x := &transportServiceProxySSHClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -108,11 +117,12 @@ func (x *transportServiceProxySSHClient) Recv() (*ProxySSHResponse, error) {
 }
 
 func (c *transportServiceClient) ProxyCluster(ctx context.Context, opts ...grpc.CallOption) (TransportService_ProxyClusterClient, error) {
-	stream, err := c.cc.NewStream(ctx, &TransportService_ServiceDesc.Streams[1], TransportService_ProxyCluster_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &TransportService_ServiceDesc.Streams[1], TransportService_ProxyCluster_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &transportServiceProxyClusterClient{stream}
+	x := &transportServiceProxyClusterClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -141,6 +151,13 @@ func (x *transportServiceProxyClusterClient) Recv() (*ProxyClusterResponse, erro
 // TransportServiceServer is the server API for TransportService service.
 // All implementations must embed UnimplementedTransportServiceServer
 // for forward compatibility
+//
+// TransportService provides methods to proxy connections to various Teleport instances.
+//
+// All connections are operate on top of a bidirectional stream which transports
+// raw payloads from higher level protocols (i.e. SSH). Clients must send an initial
+// message on the stream to set up the connections accordingly. After the initial
+// request either side may freely send data in any order until the stream is terminated.
 type TransportServiceServer interface {
 	// GetClusterDetails provides cluster information that may affect how transport
 	// should occur.
@@ -205,7 +222,7 @@ func _TransportService_GetClusterDetails_Handler(srv interface{}, ctx context.Co
 }
 
 func _TransportService_ProxySSH_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(TransportServiceServer).ProxySSH(&transportServiceProxySSHServer{stream})
+	return srv.(TransportServiceServer).ProxySSH(&transportServiceProxySSHServer{ServerStream: stream})
 }
 
 type TransportService_ProxySSHServer interface {
@@ -231,7 +248,7 @@ func (x *transportServiceProxySSHServer) Recv() (*ProxySSHRequest, error) {
 }
 
 func _TransportService_ProxyCluster_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(TransportServiceServer).ProxyCluster(&transportServiceProxyClusterServer{stream})
+	return srv.(TransportServiceServer).ProxyCluster(&transportServiceProxyClusterServer{ServerStream: stream})
 }
 
 type TransportService_ProxyClusterServer interface {
diff --git a/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go b/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go
index 1c30771b89e6f..3915be697442e 100644
--- a/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/trust/v1/trust_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/trust/v1/trust_service.proto
 
@@ -31,8 +31,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	TrustService_GetCertAuthority_FullMethodName            = "/teleport.trust.v1.TrustService/GetCertAuthority"
@@ -47,6 +47,8 @@ const (
 // TrustServiceClient is the client API for TrustService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// TrustService provides methods to manage certificate authorities.
 type TrustServiceClient interface {
 	// GetCertAuthority returns a cert authority by type and domain.
 	GetCertAuthority(ctx context.Context, in *GetCertAuthorityRequest, opts ...grpc.CallOption) (*types.CertAuthorityV2, error)
@@ -74,8 +76,9 @@ func NewTrustServiceClient(cc grpc.ClientConnInterface) TrustServiceClient {
 }
 
 func (c *trustServiceClient) GetCertAuthority(ctx context.Context, in *GetCertAuthorityRequest, opts ...grpc.CallOption) (*types.CertAuthorityV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.CertAuthorityV2)
-	err := c.cc.Invoke(ctx, TrustService_GetCertAuthority_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_GetCertAuthority_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -83,8 +86,9 @@ func (c *trustServiceClient) GetCertAuthority(ctx context.Context, in *GetCertAu
 }
 
 func (c *trustServiceClient) GetCertAuthorities(ctx context.Context, in *GetCertAuthoritiesRequest, opts ...grpc.CallOption) (*GetCertAuthoritiesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetCertAuthoritiesResponse)
-	err := c.cc.Invoke(ctx, TrustService_GetCertAuthorities_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_GetCertAuthorities_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -92,8 +96,9 @@ func (c *trustServiceClient) GetCertAuthorities(ctx context.Context, in *GetCert
 }
 
 func (c *trustServiceClient) DeleteCertAuthority(ctx context.Context, in *DeleteCertAuthorityRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, TrustService_DeleteCertAuthority_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_DeleteCertAuthority_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -101,8 +106,9 @@ func (c *trustServiceClient) DeleteCertAuthority(ctx context.Context, in *Delete
 }
 
 func (c *trustServiceClient) UpsertCertAuthority(ctx context.Context, in *UpsertCertAuthorityRequest, opts ...grpc.CallOption) (*types.CertAuthorityV2, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(types.CertAuthorityV2)
-	err := c.cc.Invoke(ctx, TrustService_UpsertCertAuthority_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_UpsertCertAuthority_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,8 +116,9 @@ func (c *trustServiceClient) UpsertCertAuthority(ctx context.Context, in *Upsert
 }
 
 func (c *trustServiceClient) RotateCertAuthority(ctx context.Context, in *RotateCertAuthorityRequest, opts ...grpc.CallOption) (*RotateCertAuthorityResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RotateCertAuthorityResponse)
-	err := c.cc.Invoke(ctx, TrustService_RotateCertAuthority_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_RotateCertAuthority_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -119,8 +126,9 @@ func (c *trustServiceClient) RotateCertAuthority(ctx context.Context, in *Rotate
 }
 
 func (c *trustServiceClient) RotateExternalCertAuthority(ctx context.Context, in *RotateExternalCertAuthorityRequest, opts ...grpc.CallOption) (*RotateExternalCertAuthorityResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RotateExternalCertAuthorityResponse)
-	err := c.cc.Invoke(ctx, TrustService_RotateExternalCertAuthority_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_RotateExternalCertAuthority_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,8 +136,9 @@ func (c *trustServiceClient) RotateExternalCertAuthority(ctx context.Context, in
 }
 
 func (c *trustServiceClient) GenerateHostCert(ctx context.Context, in *GenerateHostCertRequest, opts ...grpc.CallOption) (*GenerateHostCertResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GenerateHostCertResponse)
-	err := c.cc.Invoke(ctx, TrustService_GenerateHostCert_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TrustService_GenerateHostCert_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -139,6 +148,8 @@ func (c *trustServiceClient) GenerateHostCert(ctx context.Context, in *GenerateH
 // TrustServiceServer is the server API for TrustService service.
 // All implementations must embed UnimplementedTrustServiceServer
 // for forward compatibility
+//
+// TrustService provides methods to manage certificate authorities.
 type TrustServiceServer interface {
 	// GetCertAuthority returns a cert authority by type and domain.
 	GetCertAuthority(context.Context, *GetCertAuthorityRequest) (*types.CertAuthorityV2, error)
diff --git a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go
index 1560d46e51646..521a09fdfc699 100644
--- a/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/userloginstate/v1/userloginstate_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/userloginstate/v1/userloginstate_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	UserLoginStateService_GetUserLoginStates_FullMethodName       = "/teleport.userloginstate.v1.UserLoginStateService/GetUserLoginStates"
@@ -44,6 +44,8 @@ const (
 // UserLoginStateServiceClient is the client API for UserLoginStateService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// UserLoginStateService provides CRUD methods for user login state resources.
 type UserLoginStateServiceClient interface {
 	// GetUserLoginStates returns a list of all user login states.
 	GetUserLoginStates(ctx context.Context, in *GetUserLoginStatesRequest, opts ...grpc.CallOption) (*GetUserLoginStatesResponse, error)
@@ -66,8 +68,9 @@ func NewUserLoginStateServiceClient(cc grpc.ClientConnInterface) UserLoginStateS
 }
 
 func (c *userLoginStateServiceClient) GetUserLoginStates(ctx context.Context, in *GetUserLoginStatesRequest, opts ...grpc.CallOption) (*GetUserLoginStatesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetUserLoginStatesResponse)
-	err := c.cc.Invoke(ctx, UserLoginStateService_GetUserLoginStates_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserLoginStateService_GetUserLoginStates_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -75,8 +78,9 @@ func (c *userLoginStateServiceClient) GetUserLoginStates(ctx context.Context, in
 }
 
 func (c *userLoginStateServiceClient) GetUserLoginState(ctx context.Context, in *GetUserLoginStateRequest, opts ...grpc.CallOption) (*UserLoginState, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UserLoginState)
-	err := c.cc.Invoke(ctx, UserLoginStateService_GetUserLoginState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserLoginStateService_GetUserLoginState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +88,9 @@ func (c *userLoginStateServiceClient) GetUserLoginState(ctx context.Context, in
 }
 
 func (c *userLoginStateServiceClient) UpsertUserLoginState(ctx context.Context, in *UpsertUserLoginStateRequest, opts ...grpc.CallOption) (*UserLoginState, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UserLoginState)
-	err := c.cc.Invoke(ctx, UserLoginStateService_UpsertUserLoginState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserLoginStateService_UpsertUserLoginState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,8 +98,9 @@ func (c *userLoginStateServiceClient) UpsertUserLoginState(ctx context.Context,
 }
 
 func (c *userLoginStateServiceClient) DeleteUserLoginState(ctx context.Context, in *DeleteUserLoginStateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, UserLoginStateService_DeleteUserLoginState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserLoginStateService_DeleteUserLoginState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +108,9 @@ func (c *userLoginStateServiceClient) DeleteUserLoginState(ctx context.Context,
 }
 
 func (c *userLoginStateServiceClient) DeleteAllUserLoginStates(ctx context.Context, in *DeleteAllUserLoginStatesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, UserLoginStateService_DeleteAllUserLoginStates_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserLoginStateService_DeleteAllUserLoginStates_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -113,6 +120,8 @@ func (c *userLoginStateServiceClient) DeleteAllUserLoginStates(ctx context.Conte
 // UserLoginStateServiceServer is the server API for UserLoginStateService service.
 // All implementations must embed UnimplementedUserLoginStateServiceServer
 // for forward compatibility
+//
+// UserLoginStateService provides CRUD methods for user login state resources.
 type UserLoginStateServiceServer interface {
 	// GetUserLoginStates returns a list of all user login states.
 	GetUserLoginStates(context.Context, *GetUserLoginStatesRequest) (*GetUserLoginStatesResponse, error)
diff --git a/api/gen/proto/go/teleport/users/v1/users_service_grpc.pb.go b/api/gen/proto/go/teleport/users/v1/users_service_grpc.pb.go
index 320821e2151b6..271665bfecaa4 100644
--- a/api/gen/proto/go/teleport/users/v1/users_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/users/v1/users_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/users/v1/users_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	UsersService_GetUser_FullMethodName    = "/teleport.users.v1.UsersService/GetUser"
@@ -45,6 +45,8 @@ const (
 // UsersServiceClient is the client API for UsersService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// UsersService provides methods to manage Teleport users.
 type UsersServiceClient interface {
 	// GetUser retrieves a user by name or looks up the current user if requested.
 	GetUser(ctx context.Context, in *GetUserRequest, opts ...grpc.CallOption) (*GetUserResponse, error)
@@ -69,8 +71,9 @@ func NewUsersServiceClient(cc grpc.ClientConnInterface) UsersServiceClient {
 }
 
 func (c *usersServiceClient) GetUser(ctx context.Context, in *GetUserRequest, opts ...grpc.CallOption) (*GetUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetUserResponse)
-	err := c.cc.Invoke(ctx, UsersService_GetUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UsersService_GetUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,8 +81,9 @@ func (c *usersServiceClient) GetUser(ctx context.Context, in *GetUserRequest, op
 }
 
 func (c *usersServiceClient) ListUsers(ctx context.Context, in *ListUsersRequest, opts ...grpc.CallOption) (*ListUsersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListUsersResponse)
-	err := c.cc.Invoke(ctx, UsersService_ListUsers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UsersService_ListUsers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -87,8 +91,9 @@ func (c *usersServiceClient) ListUsers(ctx context.Context, in *ListUsersRequest
 }
 
 func (c *usersServiceClient) CreateUser(ctx context.Context, in *CreateUserRequest, opts ...grpc.CallOption) (*CreateUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateUserResponse)
-	err := c.cc.Invoke(ctx, UsersService_CreateUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UsersService_CreateUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -96,8 +101,9 @@ func (c *usersServiceClient) CreateUser(ctx context.Context, in *CreateUserReque
 }
 
 func (c *usersServiceClient) UpdateUser(ctx context.Context, in *UpdateUserRequest, opts ...grpc.CallOption) (*UpdateUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateUserResponse)
-	err := c.cc.Invoke(ctx, UsersService_UpdateUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UsersService_UpdateUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -105,8 +111,9 @@ func (c *usersServiceClient) UpdateUser(ctx context.Context, in *UpdateUserReque
 }
 
 func (c *usersServiceClient) UpsertUser(ctx context.Context, in *UpsertUserRequest, opts ...grpc.CallOption) (*UpsertUserResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpsertUserResponse)
-	err := c.cc.Invoke(ctx, UsersService_UpsertUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UsersService_UpsertUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -114,8 +121,9 @@ func (c *usersServiceClient) UpsertUser(ctx context.Context, in *UpsertUserReque
 }
 
 func (c *usersServiceClient) DeleteUser(ctx context.Context, in *DeleteUserRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, UsersService_DeleteUser_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UsersService_DeleteUser_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -125,6 +133,8 @@ func (c *usersServiceClient) DeleteUser(ctx context.Context, in *DeleteUserReque
 // UsersServiceServer is the server API for UsersService service.
 // All implementations must embed UnimplementedUsersServiceServer
 // for forward compatibility
+//
+// UsersService provides methods to manage Teleport users.
 type UsersServiceServer interface {
 	// GetUser retrieves a user by name or looks up the current user if requested.
 	GetUser(context.Context, *GetUserRequest) (*GetUserResponse, error)
diff --git a/api/gen/proto/go/teleport/vnet/v1/vnet_config_service_grpc.pb.go b/api/gen/proto/go/teleport/vnet/v1/vnet_config_service_grpc.pb.go
index f5e768ac7eb90..e17d0a3d1d21f 100644
--- a/api/gen/proto/go/teleport/vnet/v1/vnet_config_service_grpc.pb.go
+++ b/api/gen/proto/go/teleport/vnet/v1/vnet_config_service_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/vnet/v1/vnet_config_service.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	VnetConfigService_GetVnetConfig_FullMethodName    = "/teleport.vnet.v1.VnetConfigService/GetVnetConfig"
@@ -44,6 +44,8 @@ const (
 // VnetConfigServiceClient is the client API for VnetConfigService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// VnetConfigService provides an API to manage the singleton VnetConfig.
 type VnetConfigServiceClient interface {
 	// GetVnetConfig returns the specified VnetConfig.
 	GetVnetConfig(ctx context.Context, in *GetVnetConfigRequest, opts ...grpc.CallOption) (*VnetConfig, error)
@@ -66,8 +68,9 @@ func NewVnetConfigServiceClient(cc grpc.ClientConnInterface) VnetConfigServiceCl
 }
 
 func (c *vnetConfigServiceClient) GetVnetConfig(ctx context.Context, in *GetVnetConfigRequest, opts ...grpc.CallOption) (*VnetConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VnetConfig)
-	err := c.cc.Invoke(ctx, VnetConfigService_GetVnetConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetConfigService_GetVnetConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -75,8 +78,9 @@ func (c *vnetConfigServiceClient) GetVnetConfig(ctx context.Context, in *GetVnet
 }
 
 func (c *vnetConfigServiceClient) CreateVnetConfig(ctx context.Context, in *CreateVnetConfigRequest, opts ...grpc.CallOption) (*VnetConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VnetConfig)
-	err := c.cc.Invoke(ctx, VnetConfigService_CreateVnetConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetConfigService_CreateVnetConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +88,9 @@ func (c *vnetConfigServiceClient) CreateVnetConfig(ctx context.Context, in *Crea
 }
 
 func (c *vnetConfigServiceClient) UpdateVnetConfig(ctx context.Context, in *UpdateVnetConfigRequest, opts ...grpc.CallOption) (*VnetConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VnetConfig)
-	err := c.cc.Invoke(ctx, VnetConfigService_UpdateVnetConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetConfigService_UpdateVnetConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,8 +98,9 @@ func (c *vnetConfigServiceClient) UpdateVnetConfig(ctx context.Context, in *Upda
 }
 
 func (c *vnetConfigServiceClient) UpsertVnetConfig(ctx context.Context, in *UpsertVnetConfigRequest, opts ...grpc.CallOption) (*VnetConfig, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VnetConfig)
-	err := c.cc.Invoke(ctx, VnetConfigService_UpsertVnetConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetConfigService_UpsertVnetConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +108,9 @@ func (c *vnetConfigServiceClient) UpsertVnetConfig(ctx context.Context, in *Upse
 }
 
 func (c *vnetConfigServiceClient) DeleteVnetConfig(ctx context.Context, in *DeleteVnetConfigRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, VnetConfigService_DeleteVnetConfig_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetConfigService_DeleteVnetConfig_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -113,6 +120,8 @@ func (c *vnetConfigServiceClient) DeleteVnetConfig(ctx context.Context, in *Dele
 // VnetConfigServiceServer is the server API for VnetConfigService service.
 // All implementations must embed UnimplementedVnetConfigServiceServer
 // for forward compatibility
+//
+// VnetConfigService provides an API to manage the singleton VnetConfig.
 type VnetConfigServiceServer interface {
 	// GetVnetConfig returns the specified VnetConfig.
 	GetVnetConfig(context.Context, *GetVnetConfigRequest) (*VnetConfig, error)
diff --git a/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go b/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go
index 47fd6c6475447..c7163c0936509 100644
--- a/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go
+++ b/api/gen/proto/go/userpreferences/v1/userpreferences_grpc.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/userpreferences/v1/userpreferences.proto
 
@@ -30,8 +30,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	UserPreferencesService_GetUserPreferences_FullMethodName    = "/teleport.userpreferences.v1.UserPreferencesService/GetUserPreferences"
@@ -41,6 +41,8 @@ const (
 // UserPreferencesServiceClient is the client API for UserPreferencesService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// UserPreferencesService is a service that stores user settings.
 type UserPreferencesServiceClient interface {
 	// GetUserPreferences returns the user preferences for a given user.
 	GetUserPreferences(ctx context.Context, in *GetUserPreferencesRequest, opts ...grpc.CallOption) (*GetUserPreferencesResponse, error)
@@ -57,8 +59,9 @@ func NewUserPreferencesServiceClient(cc grpc.ClientConnInterface) UserPreference
 }
 
 func (c *userPreferencesServiceClient) GetUserPreferences(ctx context.Context, in *GetUserPreferencesRequest, opts ...grpc.CallOption) (*GetUserPreferencesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetUserPreferencesResponse)
-	err := c.cc.Invoke(ctx, UserPreferencesService_GetUserPreferences_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserPreferencesService_GetUserPreferences_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -66,8 +69,9 @@ func (c *userPreferencesServiceClient) GetUserPreferences(ctx context.Context, i
 }
 
 func (c *userPreferencesServiceClient) UpsertUserPreferences(ctx context.Context, in *UpsertUserPreferencesRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, UserPreferencesService_UpsertUserPreferences_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, UserPreferencesService_UpsertUserPreferences_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -77,6 +81,8 @@ func (c *userPreferencesServiceClient) UpsertUserPreferences(ctx context.Context
 // UserPreferencesServiceServer is the server API for UserPreferencesService service.
 // All implementations must embed UnimplementedUserPreferencesServiceServer
 // for forward compatibility
+//
+// UserPreferencesService is a service that stores user settings.
 type UserPreferencesServiceServer interface {
 	// GetUserPreferences returns the user preferences for a given user.
 	GetUserPreferences(context.Context, *GetUserPreferencesRequest) (*GetUserPreferencesResponse, error)
diff --git a/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go b/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go
index bd6d9c9a86de4..7f0812c5f881f 100644
--- a/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go
+++ b/gen/proto/go/accessgraph/v1alpha/access_graph_service_grpc.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: accessgraph/v1alpha/access_graph_service.proto
 
@@ -32,8 +32,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	AccessGraphService_Query_FullMethodName              = "/accessgraph.v1alpha.AccessGraphService/Query"
@@ -50,6 +50,8 @@ const (
 // AccessGraphServiceClient is the client API for AccessGraphService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// AccessGraphService is a service for interacting the access graph service.
 type AccessGraphServiceClient interface {
 	// Query queries the access graph.
 	// Currently only used by WebUI.
@@ -101,8 +103,9 @@ func NewAccessGraphServiceClient(cc grpc.ClientConnInterface) AccessGraphService
 }
 
 func (c *accessGraphServiceClient) Query(ctx context.Context, in *QueryRequest, opts ...grpc.CallOption) (*QueryResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(QueryResponse)
-	err := c.cc.Invoke(ctx, AccessGraphService_Query_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessGraphService_Query_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,8 +113,9 @@ func (c *accessGraphServiceClient) Query(ctx context.Context, in *QueryRequest,
 }
 
 func (c *accessGraphServiceClient) GetFile(ctx context.Context, in *GetFileRequest, opts ...grpc.CallOption) (*GetFileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetFileResponse)
-	err := c.cc.Invoke(ctx, AccessGraphService_GetFile_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessGraphService_GetFile_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -119,11 +123,12 @@ func (c *accessGraphServiceClient) GetFile(ctx context.Context, in *GetFileReque
 }
 
 func (c *accessGraphServiceClient) EventsStream(ctx context.Context, opts ...grpc.CallOption) (AccessGraphService_EventsStreamClient, error) {
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[0], AccessGraphService_EventsStream_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[0], AccessGraphService_EventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &accessGraphServiceEventsStreamClient{stream}
+	x := &accessGraphServiceEventsStreamClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -153,11 +158,12 @@ func (x *accessGraphServiceEventsStreamClient) CloseAndRecv() (*EventsStreamResp
 }
 
 func (c *accessGraphServiceClient) EventsStreamV2(ctx context.Context, opts ...grpc.CallOption) (AccessGraphService_EventsStreamV2Client, error) {
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[1], AccessGraphService_EventsStreamV2_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[1], AccessGraphService_EventsStreamV2_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &accessGraphServiceEventsStreamV2Client{stream}
+	x := &accessGraphServiceEventsStreamV2Client{ClientStream: stream}
 	return x, nil
 }
 
@@ -184,8 +190,9 @@ func (x *accessGraphServiceEventsStreamV2Client) Recv() (*EventsStreamV2Response
 }
 
 func (c *accessGraphServiceClient) Register(ctx context.Context, in *RegisterRequest, opts ...grpc.CallOption) (*RegisterResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RegisterResponse)
-	err := c.cc.Invoke(ctx, AccessGraphService_Register_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessGraphService_Register_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -193,8 +200,9 @@ func (c *accessGraphServiceClient) Register(ctx context.Context, in *RegisterReq
 }
 
 func (c *accessGraphServiceClient) ReplaceCAs(ctx context.Context, in *ReplaceCAsRequest, opts ...grpc.CallOption) (*ReplaceCAsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ReplaceCAsResponse)
-	err := c.cc.Invoke(ctx, AccessGraphService_ReplaceCAs_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, AccessGraphService_ReplaceCAs_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -202,11 +210,12 @@ func (c *accessGraphServiceClient) ReplaceCAs(ctx context.Context, in *ReplaceCA
 }
 
 func (c *accessGraphServiceClient) AWSEventsStream(ctx context.Context, opts ...grpc.CallOption) (AccessGraphService_AWSEventsStreamClient, error) {
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[2], AccessGraphService_AWSEventsStream_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[2], AccessGraphService_AWSEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &accessGraphServiceAWSEventsStreamClient{stream}
+	x := &accessGraphServiceAWSEventsStreamClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -236,11 +245,12 @@ func (x *accessGraphServiceAWSEventsStreamClient) CloseAndRecv() (*AWSEventsStre
 }
 
 func (c *accessGraphServiceClient) GitlabEventsStream(ctx context.Context, opts ...grpc.CallOption) (AccessGraphService_GitlabEventsStreamClient, error) {
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[3], AccessGraphService_GitlabEventsStream_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[3], AccessGraphService_GitlabEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &accessGraphServiceGitlabEventsStreamClient{stream}
+	x := &accessGraphServiceGitlabEventsStreamClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -267,11 +277,12 @@ func (x *accessGraphServiceGitlabEventsStreamClient) Recv() (*GitlabEventsStream
 }
 
 func (c *accessGraphServiceClient) EntraEventsStream(ctx context.Context, opts ...grpc.CallOption) (AccessGraphService_EntraEventsStreamClient, error) {
-	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[4], AccessGraphService_EntraEventsStream_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &AccessGraphService_ServiceDesc.Streams[4], AccessGraphService_EntraEventsStream_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &accessGraphServiceEntraEventsStreamClient{stream}
+	x := &accessGraphServiceEntraEventsStreamClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -300,6 +311,8 @@ func (x *accessGraphServiceEntraEventsStreamClient) Recv() (*EntraEventsStreamRe
 // AccessGraphServiceServer is the server API for AccessGraphService service.
 // All implementations must embed UnimplementedAccessGraphServiceServer
 // for forward compatibility
+//
+// AccessGraphService is a service for interacting the access graph service.
 type AccessGraphServiceServer interface {
 	// Query queries the access graph.
 	// Currently only used by WebUI.
@@ -424,7 +437,7 @@ func _AccessGraphService_GetFile_Handler(srv interface{}, ctx context.Context, d
 }
 
 func _AccessGraphService_EventsStream_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(AccessGraphServiceServer).EventsStream(&accessGraphServiceEventsStreamServer{stream})
+	return srv.(AccessGraphServiceServer).EventsStream(&accessGraphServiceEventsStreamServer{ServerStream: stream})
 }
 
 type AccessGraphService_EventsStreamServer interface {
@@ -450,7 +463,7 @@ func (x *accessGraphServiceEventsStreamServer) Recv() (*EventsStreamRequest, err
 }
 
 func _AccessGraphService_EventsStreamV2_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(AccessGraphServiceServer).EventsStreamV2(&accessGraphServiceEventsStreamV2Server{stream})
+	return srv.(AccessGraphServiceServer).EventsStreamV2(&accessGraphServiceEventsStreamV2Server{ServerStream: stream})
 }
 
 type AccessGraphService_EventsStreamV2Server interface {
@@ -512,7 +525,7 @@ func _AccessGraphService_ReplaceCAs_Handler(srv interface{}, ctx context.Context
 }
 
 func _AccessGraphService_AWSEventsStream_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(AccessGraphServiceServer).AWSEventsStream(&accessGraphServiceAWSEventsStreamServer{stream})
+	return srv.(AccessGraphServiceServer).AWSEventsStream(&accessGraphServiceAWSEventsStreamServer{ServerStream: stream})
 }
 
 type AccessGraphService_AWSEventsStreamServer interface {
@@ -538,7 +551,7 @@ func (x *accessGraphServiceAWSEventsStreamServer) Recv() (*AWSEventsStreamReques
 }
 
 func _AccessGraphService_GitlabEventsStream_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(AccessGraphServiceServer).GitlabEventsStream(&accessGraphServiceGitlabEventsStreamServer{stream})
+	return srv.(AccessGraphServiceServer).GitlabEventsStream(&accessGraphServiceGitlabEventsStreamServer{ServerStream: stream})
 }
 
 type AccessGraphService_GitlabEventsStreamServer interface {
@@ -564,7 +577,7 @@ func (x *accessGraphServiceGitlabEventsStreamServer) Recv() (*GitlabEventsStream
 }
 
 func _AccessGraphService_EntraEventsStream_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(AccessGraphServiceServer).EntraEventsStream(&accessGraphServiceEntraEventsStreamServer{stream})
+	return srv.(AccessGraphServiceServer).EntraEventsStream(&accessGraphServiceEntraEventsStreamServer{ServerStream: stream})
 }
 
 type AccessGraphService_EntraEventsStreamServer interface {
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go
index 2a0e67550d748..f389a1704c7e7 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/service_grpc.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/lib/teleterm/v1/service.proto
 
@@ -32,8 +32,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	TerminalService_UpdateTshdEventsServerAddress_FullMethodName     = "/teleport.lib.teleterm.v1.TerminalService/UpdateTshdEventsServerAddress"
@@ -82,6 +82,13 @@ const (
 // TerminalServiceClient is the client API for TerminalService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// TerminalService is used by the Electron app to communicate with the tsh daemon.
+//
+// While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
+// proto practices used within the company, this service is not guaranteed to be stable across
+// versions. The packaging process of Teleport Connect ensures that the server and the client use
+// the same version of the service.
 type TerminalServiceClient interface {
 	// UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
 	// supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
@@ -215,8 +222,9 @@ func NewTerminalServiceClient(cc grpc.ClientConnInterface) TerminalServiceClient
 }
 
 func (c *terminalServiceClient) UpdateTshdEventsServerAddress(ctx context.Context, in *UpdateTshdEventsServerAddressRequest, opts ...grpc.CallOption) (*UpdateTshdEventsServerAddressResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateTshdEventsServerAddressResponse)
-	err := c.cc.Invoke(ctx, TerminalService_UpdateTshdEventsServerAddress_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_UpdateTshdEventsServerAddress_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -224,8 +232,9 @@ func (c *terminalServiceClient) UpdateTshdEventsServerAddress(ctx context.Contex
 }
 
 func (c *terminalServiceClient) ListRootClusters(ctx context.Context, in *ListClustersRequest, opts ...grpc.CallOption) (*ListClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListClustersResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ListRootClusters_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ListRootClusters_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -233,8 +242,9 @@ func (c *terminalServiceClient) ListRootClusters(ctx context.Context, in *ListCl
 }
 
 func (c *terminalServiceClient) ListLeafClusters(ctx context.Context, in *ListLeafClustersRequest, opts ...grpc.CallOption) (*ListClustersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListClustersResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ListLeafClusters_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ListLeafClusters_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -242,8 +252,9 @@ func (c *terminalServiceClient) ListLeafClusters(ctx context.Context, in *ListLe
 }
 
 func (c *terminalServiceClient) GetDatabases(ctx context.Context, in *GetDatabasesRequest, opts ...grpc.CallOption) (*GetDatabasesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetDatabasesResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetDatabases_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetDatabases_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -251,8 +262,9 @@ func (c *terminalServiceClient) GetDatabases(ctx context.Context, in *GetDatabas
 }
 
 func (c *terminalServiceClient) ListDatabaseUsers(ctx context.Context, in *ListDatabaseUsersRequest, opts ...grpc.CallOption) (*ListDatabaseUsersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListDatabaseUsersResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ListDatabaseUsers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ListDatabaseUsers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -260,8 +272,9 @@ func (c *terminalServiceClient) ListDatabaseUsers(ctx context.Context, in *ListD
 }
 
 func (c *terminalServiceClient) GetServers(ctx context.Context, in *GetServersRequest, opts ...grpc.CallOption) (*GetServersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetServersResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetServers_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetServers_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -269,8 +282,9 @@ func (c *terminalServiceClient) GetServers(ctx context.Context, in *GetServersRe
 }
 
 func (c *terminalServiceClient) GetAccessRequests(ctx context.Context, in *GetAccessRequestsRequest, opts ...grpc.CallOption) (*GetAccessRequestsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAccessRequestsResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetAccessRequests_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetAccessRequests_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -278,8 +292,9 @@ func (c *terminalServiceClient) GetAccessRequests(ctx context.Context, in *GetAc
 }
 
 func (c *terminalServiceClient) GetAccessRequest(ctx context.Context, in *GetAccessRequestRequest, opts ...grpc.CallOption) (*GetAccessRequestResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAccessRequestResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetAccessRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetAccessRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -287,8 +302,9 @@ func (c *terminalServiceClient) GetAccessRequest(ctx context.Context, in *GetAcc
 }
 
 func (c *terminalServiceClient) DeleteAccessRequest(ctx context.Context, in *DeleteAccessRequestRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_DeleteAccessRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_DeleteAccessRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -296,8 +312,9 @@ func (c *terminalServiceClient) DeleteAccessRequest(ctx context.Context, in *Del
 }
 
 func (c *terminalServiceClient) CreateAccessRequest(ctx context.Context, in *CreateAccessRequestRequest, opts ...grpc.CallOption) (*CreateAccessRequestResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateAccessRequestResponse)
-	err := c.cc.Invoke(ctx, TerminalService_CreateAccessRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_CreateAccessRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -305,8 +322,9 @@ func (c *terminalServiceClient) CreateAccessRequest(ctx context.Context, in *Cre
 }
 
 func (c *terminalServiceClient) ReviewAccessRequest(ctx context.Context, in *ReviewAccessRequestRequest, opts ...grpc.CallOption) (*ReviewAccessRequestResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ReviewAccessRequestResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ReviewAccessRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ReviewAccessRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -314,8 +332,9 @@ func (c *terminalServiceClient) ReviewAccessRequest(ctx context.Context, in *Rev
 }
 
 func (c *terminalServiceClient) GetRequestableRoles(ctx context.Context, in *GetRequestableRolesRequest, opts ...grpc.CallOption) (*GetRequestableRolesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetRequestableRolesResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetRequestableRoles_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetRequestableRoles_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -323,8 +342,9 @@ func (c *terminalServiceClient) GetRequestableRoles(ctx context.Context, in *Get
 }
 
 func (c *terminalServiceClient) AssumeRole(ctx context.Context, in *AssumeRoleRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_AssumeRole_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_AssumeRole_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -332,8 +352,9 @@ func (c *terminalServiceClient) AssumeRole(ctx context.Context, in *AssumeRoleRe
 }
 
 func (c *terminalServiceClient) PromoteAccessRequest(ctx context.Context, in *PromoteAccessRequestRequest, opts ...grpc.CallOption) (*PromoteAccessRequestResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PromoteAccessRequestResponse)
-	err := c.cc.Invoke(ctx, TerminalService_PromoteAccessRequest_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_PromoteAccessRequest_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -341,8 +362,9 @@ func (c *terminalServiceClient) PromoteAccessRequest(ctx context.Context, in *Pr
 }
 
 func (c *terminalServiceClient) GetSuggestedAccessLists(ctx context.Context, in *GetSuggestedAccessListsRequest, opts ...grpc.CallOption) (*GetSuggestedAccessListsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetSuggestedAccessListsResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetSuggestedAccessLists_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetSuggestedAccessLists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -350,8 +372,9 @@ func (c *terminalServiceClient) GetSuggestedAccessLists(ctx context.Context, in
 }
 
 func (c *terminalServiceClient) GetKubes(ctx context.Context, in *GetKubesRequest, opts ...grpc.CallOption) (*GetKubesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetKubesResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetKubes_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetKubes_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -359,8 +382,9 @@ func (c *terminalServiceClient) GetKubes(ctx context.Context, in *GetKubesReques
 }
 
 func (c *terminalServiceClient) GetApps(ctx context.Context, in *GetAppsRequest, opts ...grpc.CallOption) (*GetAppsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetAppsResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetApps_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetApps_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -368,8 +392,9 @@ func (c *terminalServiceClient) GetApps(ctx context.Context, in *GetAppsRequest,
 }
 
 func (c *terminalServiceClient) AddCluster(ctx context.Context, in *AddClusterRequest, opts ...grpc.CallOption) (*Cluster, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Cluster)
-	err := c.cc.Invoke(ctx, TerminalService_AddCluster_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_AddCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -377,8 +402,9 @@ func (c *terminalServiceClient) AddCluster(ctx context.Context, in *AddClusterRe
 }
 
 func (c *terminalServiceClient) RemoveCluster(ctx context.Context, in *RemoveClusterRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_RemoveCluster_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_RemoveCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -386,8 +412,9 @@ func (c *terminalServiceClient) RemoveCluster(ctx context.Context, in *RemoveClu
 }
 
 func (c *terminalServiceClient) ListGateways(ctx context.Context, in *ListGatewaysRequest, opts ...grpc.CallOption) (*ListGatewaysResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListGatewaysResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ListGateways_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ListGateways_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -395,8 +422,9 @@ func (c *terminalServiceClient) ListGateways(ctx context.Context, in *ListGatewa
 }
 
 func (c *terminalServiceClient) CreateGateway(ctx context.Context, in *CreateGatewayRequest, opts ...grpc.CallOption) (*Gateway, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Gateway)
-	err := c.cc.Invoke(ctx, TerminalService_CreateGateway_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_CreateGateway_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -404,8 +432,9 @@ func (c *terminalServiceClient) CreateGateway(ctx context.Context, in *CreateGat
 }
 
 func (c *terminalServiceClient) RemoveGateway(ctx context.Context, in *RemoveGatewayRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_RemoveGateway_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_RemoveGateway_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -413,8 +442,9 @@ func (c *terminalServiceClient) RemoveGateway(ctx context.Context, in *RemoveGat
 }
 
 func (c *terminalServiceClient) SetGatewayTargetSubresourceName(ctx context.Context, in *SetGatewayTargetSubresourceNameRequest, opts ...grpc.CallOption) (*Gateway, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Gateway)
-	err := c.cc.Invoke(ctx, TerminalService_SetGatewayTargetSubresourceName_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_SetGatewayTargetSubresourceName_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -422,8 +452,9 @@ func (c *terminalServiceClient) SetGatewayTargetSubresourceName(ctx context.Cont
 }
 
 func (c *terminalServiceClient) SetGatewayLocalPort(ctx context.Context, in *SetGatewayLocalPortRequest, opts ...grpc.CallOption) (*Gateway, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Gateway)
-	err := c.cc.Invoke(ctx, TerminalService_SetGatewayLocalPort_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_SetGatewayLocalPort_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -431,8 +462,9 @@ func (c *terminalServiceClient) SetGatewayLocalPort(ctx context.Context, in *Set
 }
 
 func (c *terminalServiceClient) GetAuthSettings(ctx context.Context, in *GetAuthSettingsRequest, opts ...grpc.CallOption) (*AuthSettings, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AuthSettings)
-	err := c.cc.Invoke(ctx, TerminalService_GetAuthSettings_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetAuthSettings_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -440,8 +472,9 @@ func (c *terminalServiceClient) GetAuthSettings(ctx context.Context, in *GetAuth
 }
 
 func (c *terminalServiceClient) GetCluster(ctx context.Context, in *GetClusterRequest, opts ...grpc.CallOption) (*Cluster, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Cluster)
-	err := c.cc.Invoke(ctx, TerminalService_GetCluster_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetCluster_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -449,8 +482,9 @@ func (c *terminalServiceClient) GetCluster(ctx context.Context, in *GetClusterRe
 }
 
 func (c *terminalServiceClient) Login(ctx context.Context, in *LoginRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_Login_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_Login_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -458,11 +492,12 @@ func (c *terminalServiceClient) Login(ctx context.Context, in *LoginRequest, opt
 }
 
 func (c *terminalServiceClient) LoginPasswordless(ctx context.Context, opts ...grpc.CallOption) (TerminalService_LoginPasswordlessClient, error) {
-	stream, err := c.cc.NewStream(ctx, &TerminalService_ServiceDesc.Streams[0], TerminalService_LoginPasswordless_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &TerminalService_ServiceDesc.Streams[0], TerminalService_LoginPasswordless_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &terminalServiceLoginPasswordlessClient{stream}
+	x := &terminalServiceLoginPasswordlessClient{ClientStream: stream}
 	return x, nil
 }
 
@@ -489,8 +524,9 @@ func (x *terminalServiceLoginPasswordlessClient) Recv() (*LoginPasswordlessRespo
 }
 
 func (c *terminalServiceClient) Logout(ctx context.Context, in *LogoutRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_Logout_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_Logout_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -498,11 +534,12 @@ func (c *terminalServiceClient) Logout(ctx context.Context, in *LogoutRequest, o
 }
 
 func (c *terminalServiceClient) TransferFile(ctx context.Context, in *FileTransferRequest, opts ...grpc.CallOption) (TerminalService_TransferFileClient, error) {
-	stream, err := c.cc.NewStream(ctx, &TerminalService_ServiceDesc.Streams[1], TerminalService_TransferFile_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &TerminalService_ServiceDesc.Streams[1], TerminalService_TransferFile_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &terminalServiceTransferFileClient{stream}
+	x := &terminalServiceTransferFileClient{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -530,8 +567,9 @@ func (x *terminalServiceTransferFileClient) Recv() (*FileTransferProgress, error
 }
 
 func (c *terminalServiceClient) ReportUsageEvent(ctx context.Context, in *ReportUsageEventRequest, opts ...grpc.CallOption) (*EmptyResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(EmptyResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ReportUsageEvent_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ReportUsageEvent_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -539,8 +577,9 @@ func (c *terminalServiceClient) ReportUsageEvent(ctx context.Context, in *Report
 }
 
 func (c *terminalServiceClient) UpdateHeadlessAuthenticationState(ctx context.Context, in *UpdateHeadlessAuthenticationStateRequest, opts ...grpc.CallOption) (*UpdateHeadlessAuthenticationStateResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateHeadlessAuthenticationStateResponse)
-	err := c.cc.Invoke(ctx, TerminalService_UpdateHeadlessAuthenticationState_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_UpdateHeadlessAuthenticationState_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -548,8 +587,9 @@ func (c *terminalServiceClient) UpdateHeadlessAuthenticationState(ctx context.Co
 }
 
 func (c *terminalServiceClient) CreateConnectMyComputerRole(ctx context.Context, in *CreateConnectMyComputerRoleRequest, opts ...grpc.CallOption) (*CreateConnectMyComputerRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateConnectMyComputerRoleResponse)
-	err := c.cc.Invoke(ctx, TerminalService_CreateConnectMyComputerRole_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_CreateConnectMyComputerRole_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -557,8 +597,9 @@ func (c *terminalServiceClient) CreateConnectMyComputerRole(ctx context.Context,
 }
 
 func (c *terminalServiceClient) CreateConnectMyComputerNodeToken(ctx context.Context, in *CreateConnectMyComputerNodeTokenRequest, opts ...grpc.CallOption) (*CreateConnectMyComputerNodeTokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateConnectMyComputerNodeTokenResponse)
-	err := c.cc.Invoke(ctx, TerminalService_CreateConnectMyComputerNodeToken_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_CreateConnectMyComputerNodeToken_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -566,8 +607,9 @@ func (c *terminalServiceClient) CreateConnectMyComputerNodeToken(ctx context.Con
 }
 
 func (c *terminalServiceClient) WaitForConnectMyComputerNodeJoin(ctx context.Context, in *WaitForConnectMyComputerNodeJoinRequest, opts ...grpc.CallOption) (*WaitForConnectMyComputerNodeJoinResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(WaitForConnectMyComputerNodeJoinResponse)
-	err := c.cc.Invoke(ctx, TerminalService_WaitForConnectMyComputerNodeJoin_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_WaitForConnectMyComputerNodeJoin_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -575,8 +617,9 @@ func (c *terminalServiceClient) WaitForConnectMyComputerNodeJoin(ctx context.Con
 }
 
 func (c *terminalServiceClient) DeleteConnectMyComputerNode(ctx context.Context, in *DeleteConnectMyComputerNodeRequest, opts ...grpc.CallOption) (*DeleteConnectMyComputerNodeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(DeleteConnectMyComputerNodeResponse)
-	err := c.cc.Invoke(ctx, TerminalService_DeleteConnectMyComputerNode_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_DeleteConnectMyComputerNode_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -584,8 +627,9 @@ func (c *terminalServiceClient) DeleteConnectMyComputerNode(ctx context.Context,
 }
 
 func (c *terminalServiceClient) GetConnectMyComputerNodeName(ctx context.Context, in *GetConnectMyComputerNodeNameRequest, opts ...grpc.CallOption) (*GetConnectMyComputerNodeNameResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetConnectMyComputerNodeNameResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetConnectMyComputerNodeName_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetConnectMyComputerNodeName_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -593,8 +637,9 @@ func (c *terminalServiceClient) GetConnectMyComputerNodeName(ctx context.Context
 }
 
 func (c *terminalServiceClient) ListUnifiedResources(ctx context.Context, in *ListUnifiedResourcesRequest, opts ...grpc.CallOption) (*ListUnifiedResourcesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListUnifiedResourcesResponse)
-	err := c.cc.Invoke(ctx, TerminalService_ListUnifiedResources_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_ListUnifiedResources_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -602,8 +647,9 @@ func (c *terminalServiceClient) ListUnifiedResources(ctx context.Context, in *Li
 }
 
 func (c *terminalServiceClient) GetUserPreferences(ctx context.Context, in *GetUserPreferencesRequest, opts ...grpc.CallOption) (*GetUserPreferencesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetUserPreferencesResponse)
-	err := c.cc.Invoke(ctx, TerminalService_GetUserPreferences_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_GetUserPreferences_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -611,8 +657,9 @@ func (c *terminalServiceClient) GetUserPreferences(ctx context.Context, in *GetU
 }
 
 func (c *terminalServiceClient) UpdateUserPreferences(ctx context.Context, in *UpdateUserPreferencesRequest, opts ...grpc.CallOption) (*UpdateUserPreferencesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(UpdateUserPreferencesResponse)
-	err := c.cc.Invoke(ctx, TerminalService_UpdateUserPreferences_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_UpdateUserPreferences_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -620,8 +667,9 @@ func (c *terminalServiceClient) UpdateUserPreferences(ctx context.Context, in *U
 }
 
 func (c *terminalServiceClient) AuthenticateWebDevice(ctx context.Context, in *AuthenticateWebDeviceRequest, opts ...grpc.CallOption) (*AuthenticateWebDeviceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(AuthenticateWebDeviceResponse)
-	err := c.cc.Invoke(ctx, TerminalService_AuthenticateWebDevice_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TerminalService_AuthenticateWebDevice_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -631,6 +679,13 @@ func (c *terminalServiceClient) AuthenticateWebDevice(ctx context.Context, in *A
 // TerminalServiceServer is the server API for TerminalService service.
 // All implementations must embed UnimplementedTerminalServiceServer
 // for forward compatibility
+//
+// TerminalService is used by the Electron app to communicate with the tsh daemon.
+//
+// While we aim to preserve backwards compatibility in order to satisfy CI checks and follow the
+// proto practices used within the company, this service is not guaranteed to be stable across
+// versions. The packaging process of Teleport Connect ensures that the server and the client use
+// the same version of the service.
 type TerminalServiceServer interface {
 	// UpdateTshdEventsServerAddress lets the Electron app update the address the tsh daemon is
 	// supposed to use when connecting to the tshd events gRPC service. This RPC needs to be made
@@ -1383,7 +1438,7 @@ func _TerminalService_Login_Handler(srv interface{}, ctx context.Context, dec fu
 }
 
 func _TerminalService_LoginPasswordless_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(TerminalServiceServer).LoginPasswordless(&terminalServiceLoginPasswordlessServer{stream})
+	return srv.(TerminalServiceServer).LoginPasswordless(&terminalServiceLoginPasswordlessServer{ServerStream: stream})
 }
 
 type TerminalService_LoginPasswordlessServer interface {
@@ -1431,7 +1486,7 @@ func _TerminalService_TransferFile_Handler(srv interface{}, stream grpc.ServerSt
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(TerminalServiceServer).TransferFile(m, &terminalServiceTransferFileServer{stream})
+	return srv.(TerminalServiceServer).TransferFile(m, &terminalServiceTransferFileServer{ServerStream: stream})
 }
 
 type TerminalService_TransferFileServer interface {
diff --git a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go
index c4fb9657f6d10..bd558541e9342 100644
--- a/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/v1/tshd_events_service_grpc.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/lib/teleterm/v1/tshd_events_service.proto
 
@@ -32,8 +32,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	TshdEventsService_Relogin_FullMethodName                           = "/teleport.lib.teleterm.v1.TshdEventsService/Relogin"
@@ -47,6 +47,9 @@ const (
 // TshdEventsServiceClient is the client API for TshdEventsService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// TshdEventsService is served by the Electron app. The tsh daemon calls this service to notify the
+// app about actions that happen outside of the app itself.
 type TshdEventsServiceClient interface {
 	// Relogin makes the Electron app display a login modal for the specific root cluster. The request
 	// returns a response after the relogin procedure has been successfully finished.
@@ -83,8 +86,9 @@ func NewTshdEventsServiceClient(cc grpc.ClientConnInterface) TshdEventsServiceCl
 }
 
 func (c *tshdEventsServiceClient) Relogin(ctx context.Context, in *ReloginRequest, opts ...grpc.CallOption) (*ReloginResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ReloginResponse)
-	err := c.cc.Invoke(ctx, TshdEventsService_Relogin_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TshdEventsService_Relogin_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -92,8 +96,9 @@ func (c *tshdEventsServiceClient) Relogin(ctx context.Context, in *ReloginReques
 }
 
 func (c *tshdEventsServiceClient) SendNotification(ctx context.Context, in *SendNotificationRequest, opts ...grpc.CallOption) (*SendNotificationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SendNotificationResponse)
-	err := c.cc.Invoke(ctx, TshdEventsService_SendNotification_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TshdEventsService_SendNotification_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -101,8 +106,9 @@ func (c *tshdEventsServiceClient) SendNotification(ctx context.Context, in *Send
 }
 
 func (c *tshdEventsServiceClient) SendPendingHeadlessAuthentication(ctx context.Context, in *SendPendingHeadlessAuthenticationRequest, opts ...grpc.CallOption) (*SendPendingHeadlessAuthenticationResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SendPendingHeadlessAuthenticationResponse)
-	err := c.cc.Invoke(ctx, TshdEventsService_SendPendingHeadlessAuthentication_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TshdEventsService_SendPendingHeadlessAuthentication_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,8 +116,9 @@ func (c *tshdEventsServiceClient) SendPendingHeadlessAuthentication(ctx context.
 }
 
 func (c *tshdEventsServiceClient) PromptMFA(ctx context.Context, in *PromptMFARequest, opts ...grpc.CallOption) (*PromptMFAResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(PromptMFAResponse)
-	err := c.cc.Invoke(ctx, TshdEventsService_PromptMFA_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TshdEventsService_PromptMFA_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -119,8 +126,9 @@ func (c *tshdEventsServiceClient) PromptMFA(ctx context.Context, in *PromptMFARe
 }
 
 func (c *tshdEventsServiceClient) GetUsageReportingSettings(ctx context.Context, in *GetUsageReportingSettingsRequest, opts ...grpc.CallOption) (*GetUsageReportingSettingsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(GetUsageReportingSettingsResponse)
-	err := c.cc.Invoke(ctx, TshdEventsService_GetUsageReportingSettings_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TshdEventsService_GetUsageReportingSettings_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,8 +136,9 @@ func (c *tshdEventsServiceClient) GetUsageReportingSettings(ctx context.Context,
 }
 
 func (c *tshdEventsServiceClient) ReportUnexpectedVnetShutdown(ctx context.Context, in *ReportUnexpectedVnetShutdownRequest, opts ...grpc.CallOption) (*ReportUnexpectedVnetShutdownResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ReportUnexpectedVnetShutdownResponse)
-	err := c.cc.Invoke(ctx, TshdEventsService_ReportUnexpectedVnetShutdown_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, TshdEventsService_ReportUnexpectedVnetShutdown_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -139,6 +148,9 @@ func (c *tshdEventsServiceClient) ReportUnexpectedVnetShutdown(ctx context.Conte
 // TshdEventsServiceServer is the server API for TshdEventsService service.
 // All implementations must embed UnimplementedTshdEventsServiceServer
 // for forward compatibility
+//
+// TshdEventsService is served by the Electron app. The tsh daemon calls this service to notify the
+// app about actions that happen outside of the app itself.
 type TshdEventsServiceServer interface {
 	// Relogin makes the Electron app display a login modal for the specific root cluster. The request
 	// returns a response after the relogin procedure has been successfully finished.
diff --git a/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go b/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go
index 258c3f567900d..8bbf28768a63a 100644
--- a/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go
+++ b/gen/proto/go/teleport/lib/teleterm/vnet/v1/vnet_service_grpc.pb.go
@@ -16,7 +16,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/lib/teleterm/vnet/v1/vnet_service.proto
 
@@ -31,8 +31,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	VnetService_Start_FullMethodName = "/teleport.lib.teleterm.vnet.v1.VnetService/Start"
@@ -42,6 +42,8 @@ const (
 // VnetServiceClient is the client API for VnetService service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// VnetService provides methods to manage a VNet instance.
 type VnetServiceClient interface {
 	// Start starts VNet.
 	Start(ctx context.Context, in *StartRequest, opts ...grpc.CallOption) (*StartResponse, error)
@@ -58,8 +60,9 @@ func NewVnetServiceClient(cc grpc.ClientConnInterface) VnetServiceClient {
 }
 
 func (c *vnetServiceClient) Start(ctx context.Context, in *StartRequest, opts ...grpc.CallOption) (*StartResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StartResponse)
-	err := c.cc.Invoke(ctx, VnetService_Start_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetService_Start_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -67,8 +70,9 @@ func (c *vnetServiceClient) Start(ctx context.Context, in *StartRequest, opts ..
 }
 
 func (c *vnetServiceClient) Stop(ctx context.Context, in *StopRequest, opts ...grpc.CallOption) (*StopResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(StopResponse)
-	err := c.cc.Invoke(ctx, VnetService_Stop_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, VnetService_Stop_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,6 +82,8 @@ func (c *vnetServiceClient) Stop(ctx context.Context, in *StopRequest, opts ...g
 // VnetServiceServer is the server API for VnetService service.
 // All implementations must embed UnimplementedVnetServiceServer
 // for forward compatibility
+//
+// VnetService provides methods to manage a VNet instance.
 type VnetServiceServer interface {
 	// Start starts VNet.
 	Start(context.Context, *StartRequest) (*StartResponse, error)
diff --git a/go.mod b/go.mod
index 217fe26308e81..7ae09d7c16cb8 100644
--- a/go.mod
+++ b/go.mod
@@ -211,7 +211,7 @@ require (
 	google.golang.org/api v0.180.0
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5
 	google.golang.org/grpc v1.64.0
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0
 	google.golang.org/protobuf v1.34.1
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
 	gopkg.in/dnaeon/go-vcr.v3 v3.2.0
diff --git a/go.sum b/go.sum
index c70e9ddcb829a..16aa0b6858697 100644
--- a/go.sum
+++ b/go.sum
@@ -3138,8 +3138,8 @@ google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpX
 google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
 google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0 h1:9SxA29VM43MF5Z9dQu694wmY5t8E/Gxr7s+RSxiIDmc=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0/go.mod h1:yZOK5zhQMiALmuweVdIVoQPa6eIJyXn2B9g5dJDhqX4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/integrations/event-handler/go.mod b/integrations/event-handler/go.mod
index 2dad56b45dab6..4937dd2611eca 100644
--- a/integrations/event-handler/go.mod
+++ b/integrations/event-handler/go.mod
@@ -301,7 +301,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/grpc v1.64.0 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22 // indirect
diff --git a/integrations/event-handler/go.sum b/integrations/event-handler/go.sum
index 7c8ce9ca80e25..127d0865b8f60 100644
--- a/integrations/event-handler/go.sum
+++ b/integrations/event-handler/go.sum
@@ -2357,8 +2357,8 @@ google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpX
 google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
 google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0 h1:9SxA29VM43MF5Z9dQu694wmY5t8E/Gxr7s+RSxiIDmc=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0/go.mod h1:yZOK5zhQMiALmuweVdIVoQPa6eIJyXn2B9g5dJDhqX4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/integrations/terraform/go.mod b/integrations/terraform/go.mod
index 301d36d08f447..6e65fea1e29d6 100644
--- a/integrations/terraform/go.mod
+++ b/integrations/terraform/go.mod
@@ -420,7 +420,7 @@ require (
 	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240520151616-dc85e6b867a5 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240520151616-dc85e6b867a5 // indirect
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 // indirect
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
diff --git a/integrations/terraform/go.sum b/integrations/terraform/go.sum
index c958715f0e3c6..e09253bd4a552 100644
--- a/integrations/terraform/go.sum
+++ b/integrations/terraform/go.sum
@@ -2914,8 +2914,8 @@ google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpX
 google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
 google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0 h1:rNBFJjBCOgVr9pWD7rs/knKL4FRTKgpZmsRfV214zcA=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0/go.mod h1:Dk1tviKTvMCz5tvh7t+fh94dhmQVHuCt2OzJB3CTW9Y=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0 h1:9SxA29VM43MF5Z9dQu694wmY5t8E/Gxr7s+RSxiIDmc=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.4.0/go.mod h1:yZOK5zhQMiALmuweVdIVoQPa6eIJyXn2B9g5dJDhqX4=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
diff --git a/lib/multiplexer/test/ping_grpc.pb.go b/lib/multiplexer/test/ping_grpc.pb.go
index 488b8f6ebde55..4c882f1a4aae8 100644
--- a/lib/multiplexer/test/ping_grpc.pb.go
+++ b/lib/multiplexer/test/ping_grpc.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.3.0
+// - protoc-gen-go-grpc v1.4.0
 // - protoc             (unknown)
 // source: teleport/lib/multiplexer/test/ping.proto
 
@@ -32,8 +32,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	Pinger_Ping_FullMethodName = "/teleport.lib.multiplexer.test.Pinger/Ping"
@@ -42,6 +42,8 @@ const (
 // PingerClient is the client API for Pinger service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Pinger is a service used in tests
 type PingerClient interface {
 	Ping(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error)
 }
@@ -55,8 +57,9 @@ func NewPingerClient(cc grpc.ClientConnInterface) PingerClient {
 }
 
 func (c *pingerClient) Ping(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Response, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Response)
-	err := c.cc.Invoke(ctx, Pinger_Ping_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Pinger_Ping_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -66,6 +69,8 @@ func (c *pingerClient) Ping(ctx context.Context, in *Request, opts ...grpc.CallO
 // PingerServer is the server API for Pinger service.
 // All implementations must embed UnimplementedPingerServer
 // for forward compatibility
+//
+// Pinger is a service used in tests
 type PingerServer interface {
 	Ping(context.Context, *Request) (*Response, error)
 	mustEmbedUnimplementedPingerServer()