diff --git a/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser.pb.go b/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser.pb.go
new file mode 100644
index 0000000000000..c04959c336da5
--- /dev/null
+++ b/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser.pb.go
@@ -0,0 +1,361 @@
+// Copyright 2024 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        (unknown)
+// source: teleport/userprovisioning/v1/statichostuser.proto
+
+package userprovisioningv1
+
+import (
+	v1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
+	wrappers "github.com/gravitational/teleport/api/types/wrappers"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// StaticHostUser is a resource that represents host users that should be
+// created on matching nodes.
+type StaticHostUser struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// kind is a resource kind.
+	Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"`
+	// sub_kind is an optional resource sub kind, used in some resources.
+	SubKind string `protobuf:"bytes,2,opt,name=sub_kind,json=subKind,proto3" json:"sub_kind,omitempty"`
+	// version is the resource version. It must be specified.
+	// Supported values are: `v1`.
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	// metadata is resource metadata.
+	Metadata *v1.Metadata `protobuf:"bytes,4,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// spec is the static host user spec.
+	Spec *StaticHostUserSpec `protobuf:"bytes,5,opt,name=spec,proto3" json:"spec,omitempty"`
+}
+
+func (x *StaticHostUser) Reset() {
+	*x = StaticHostUser{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StaticHostUser) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StaticHostUser) ProtoMessage() {}
+
+func (x *StaticHostUser) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StaticHostUser.ProtoReflect.Descriptor instead.
+func (*StaticHostUser) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *StaticHostUser) GetKind() string {
+	if x != nil {
+		return x.Kind
+	}
+	return ""
+}
+
+func (x *StaticHostUser) GetSubKind() string {
+	if x != nil {
+		return x.SubKind
+	}
+	return ""
+}
+
+func (x *StaticHostUser) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *StaticHostUser) GetMetadata() *v1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *StaticHostUser) GetSpec() *StaticHostUserSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+// StaticHostUserSpec is the static host user spec.
+type StaticHostUserSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// login is the login to create on the node.
+	Login string `protobuf:"bytes,1,opt,name=login,proto3" json:"login,omitempty"`
+	// groups is a list of additional groups to add the user to.
+	Groups []string `protobuf:"bytes,2,rep,name=groups,proto3" json:"groups,omitempty"`
+	// sudoers is a list of sudoer entries to add.
+	Sudoers []string `protobuf:"bytes,3,rep,name=sudoers,proto3" json:"sudoers,omitempty"`
+	// uid is the new user's uid.
+	Uid string `protobuf:"bytes,4,opt,name=uid,proto3" json:"uid,omitempty"`
+	// gid is the new user's gid.
+	Gid string `protobuf:"bytes,5,opt,name=gid,proto3" json:"gid,omitempty"`
+	// node_labels is a map of node labels that will create a user from this
+	// resource.
+	NodeLabels *wrappers.LabelValues `protobuf:"bytes,6,opt,name=node_labels,json=nodeLabels,proto3" json:"node_labels,omitempty"`
+	// node_labels_expression is a predicate expression to create a user from
+	// this resource.
+	NodeLabelsExpression string `protobuf:"bytes,7,opt,name=node_labels_expression,json=nodeLabelsExpression,proto3" json:"node_labels_expression,omitempty"`
+}
+
+func (x *StaticHostUserSpec) Reset() {
+	*x = StaticHostUserSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StaticHostUserSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StaticHostUserSpec) ProtoMessage() {}
+
+func (x *StaticHostUserSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StaticHostUserSpec.ProtoReflect.Descriptor instead.
+func (*StaticHostUserSpec) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *StaticHostUserSpec) GetLogin() string {
+	if x != nil {
+		return x.Login
+	}
+	return ""
+}
+
+func (x *StaticHostUserSpec) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+func (x *StaticHostUserSpec) GetSudoers() []string {
+	if x != nil {
+		return x.Sudoers
+	}
+	return nil
+}
+
+func (x *StaticHostUserSpec) GetUid() string {
+	if x != nil {
+		return x.Uid
+	}
+	return ""
+}
+
+func (x *StaticHostUserSpec) GetGid() string {
+	if x != nil {
+		return x.Gid
+	}
+	return ""
+}
+
+func (x *StaticHostUserSpec) GetNodeLabels() *wrappers.LabelValues {
+	if x != nil {
+		return x.NodeLabels
+	}
+	return nil
+}
+
+func (x *StaticHostUserSpec) GetNodeLabelsExpression() string {
+	if x != nil {
+		return x.NodeLabelsExpression
+	}
+	return ""
+}
+
+var File_teleport_userprovisioning_v1_statichostuser_proto protoreflect.FileDescriptor
+
+var file_teleport_userprovisioning_v1_statichostuser_proto_rawDesc = []byte{
+	0x0a, 0x31, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x2f, 0x73,
+	0x74, 0x61, 0x74, 0x69, 0x63, 0x68, 0x6f, 0x73, 0x74, 0x75, 0x73, 0x65, 0x72, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x1c, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76,
+	0x31, 0x1a, 0x21, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x68, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2d, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x6c,
+	0x65, 0x67, 0x61, 0x63, 0x79, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x77, 0x72, 0x61, 0x70,
+	0x70, 0x65, 0x72, 0x73, 0x2f, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0xd9, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f,
+	0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x75,
+	0x62, 0x5f, 0x6b, 0x69, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x75,
+	0x62, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x38, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x44, 0x0a, 0x04, 0x73, 0x70, 0x65,
+	0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f,
+	0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73,
+	0x74, 0x55, 0x73, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22,
+	0xee, 0x01, 0x0a, 0x12, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73,
+	0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x16, 0x0a, 0x06,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x75, 0x64, 0x6f, 0x65, 0x72, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x73, 0x75, 0x64, 0x6f, 0x65, 0x72, 0x73, 0x12, 0x10,
+	0x0a, 0x03, 0x75, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64,
+	0x12, 0x10, 0x0a, 0x03, 0x67, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x67,
+	0x69, 0x64, 0x12, 0x36, 0x0a, 0x0b, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x77, 0x72, 0x61, 0x70, 0x70, 0x65,
+	0x72, 0x73, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x52, 0x0a,
+	0x6e, 0x6f, 0x64, 0x65, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x34, 0x0a, 0x16, 0x6e, 0x6f,
+	0x64, 0x65, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x5f, 0x65, 0x78, 0x70, 0x72, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x14, 0x6e, 0x6f, 0x64, 0x65,
+	0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x78, 0x70, 0x72, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x42, 0x64, 0x5a, 0x62, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67,
+	0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f,
+	0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67,
+	0x2f, 0x76, 0x31, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x69, 0x6e, 0x67, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_userprovisioning_v1_statichostuser_proto_rawDescOnce sync.Once
+	file_teleport_userprovisioning_v1_statichostuser_proto_rawDescData = file_teleport_userprovisioning_v1_statichostuser_proto_rawDesc
+)
+
+func file_teleport_userprovisioning_v1_statichostuser_proto_rawDescGZIP() []byte {
+	file_teleport_userprovisioning_v1_statichostuser_proto_rawDescOnce.Do(func() {
+		file_teleport_userprovisioning_v1_statichostuser_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_userprovisioning_v1_statichostuser_proto_rawDescData)
+	})
+	return file_teleport_userprovisioning_v1_statichostuser_proto_rawDescData
+}
+
+var file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_teleport_userprovisioning_v1_statichostuser_proto_goTypes = []any{
+	(*StaticHostUser)(nil),       // 0: teleport.userprovisioning.v1.StaticHostUser
+	(*StaticHostUserSpec)(nil),   // 1: teleport.userprovisioning.v1.StaticHostUserSpec
+	(*v1.Metadata)(nil),          // 2: teleport.header.v1.Metadata
+	(*wrappers.LabelValues)(nil), // 3: wrappers.LabelValues
+}
+var file_teleport_userprovisioning_v1_statichostuser_proto_depIdxs = []int32{
+	2, // 0: teleport.userprovisioning.v1.StaticHostUser.metadata:type_name -> teleport.header.v1.Metadata
+	1, // 1: teleport.userprovisioning.v1.StaticHostUser.spec:type_name -> teleport.userprovisioning.v1.StaticHostUserSpec
+	3, // 2: teleport.userprovisioning.v1.StaticHostUserSpec.node_labels:type_name -> wrappers.LabelValues
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_teleport_userprovisioning_v1_statichostuser_proto_init() }
+func file_teleport_userprovisioning_v1_statichostuser_proto_init() {
+	if File_teleport_userprovisioning_v1_statichostuser_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*StaticHostUser); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*StaticHostUserSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_userprovisioning_v1_statichostuser_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_teleport_userprovisioning_v1_statichostuser_proto_goTypes,
+		DependencyIndexes: file_teleport_userprovisioning_v1_statichostuser_proto_depIdxs,
+		MessageInfos:      file_teleport_userprovisioning_v1_statichostuser_proto_msgTypes,
+	}.Build()
+	File_teleport_userprovisioning_v1_statichostuser_proto = out.File
+	file_teleport_userprovisioning_v1_statichostuser_proto_rawDesc = nil
+	file_teleport_userprovisioning_v1_statichostuser_proto_goTypes = nil
+	file_teleport_userprovisioning_v1_statichostuser_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser_service.pb.go b/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser_service.pb.go
new file mode 100644
index 0000000000000..ccb801a403b20
--- /dev/null
+++ b/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser_service.pb.go
@@ -0,0 +1,673 @@
+// Copyright 2024 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        (unknown)
+// source: teleport/userprovisioning/v1/statichostuser_service.proto
+
+package userprovisioningv1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Request for GetStaticHostUser.
+type GetStaticHostUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Name of the user to retrieve, this take priority over current_user.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *GetStaticHostUserRequest) Reset() {
+	*x = GetStaticHostUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetStaticHostUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetStaticHostUserRequest) ProtoMessage() {}
+
+func (x *GetStaticHostUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetStaticHostUserRequest.ProtoReflect.Descriptor instead.
+func (*GetStaticHostUserRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetStaticHostUserRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// Request for ListStaticHostUsers.
+//
+// Follows the pagination semantics of
+// https://cloud.google.com/apis/design/standard_methods#list.
+type ListStaticHostUsersRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The maximum number of items to return.
+	// The server may impose a different page size at its discretion.
+	PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// The next_page_token value returned from a previous List request, if any.
+	PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
+}
+
+func (x *ListStaticHostUsersRequest) Reset() {
+	*x = ListStaticHostUsersRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListStaticHostUsersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListStaticHostUsersRequest) ProtoMessage() {}
+
+func (x *ListStaticHostUsersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListStaticHostUsersRequest.ProtoReflect.Descriptor instead.
+func (*ListStaticHostUsersRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ListStaticHostUsersRequest) GetPageSize() int32 {
+	if x != nil {
+		return x.PageSize
+	}
+	return 0
+}
+
+func (x *ListStaticHostUsersRequest) GetPageToken() string {
+	if x != nil {
+		return x.PageToken
+	}
+	return ""
+}
+
+// Response for ListStaticHostUsers.
+type ListStaticHostUsersResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Static host users that matched the search.
+	Users []*StaticHostUser `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
+	// Token to retrieve the next page of results, or empty if there are no
+	// more results in the list.
+	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
+}
+
+func (x *ListStaticHostUsersResponse) Reset() {
+	*x = ListStaticHostUsersResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListStaticHostUsersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListStaticHostUsersResponse) ProtoMessage() {}
+
+func (x *ListStaticHostUsersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListStaticHostUsersResponse.ProtoReflect.Descriptor instead.
+func (*ListStaticHostUsersResponse) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ListStaticHostUsersResponse) GetUsers() []*StaticHostUser {
+	if x != nil {
+		return x.Users
+	}
+	return nil
+}
+
+func (x *ListStaticHostUsersResponse) GetNextPageToken() string {
+	if x != nil {
+		return x.NextPageToken
+	}
+	return ""
+}
+
+// Request for CreateStaticHostUser.
+type CreateStaticHostUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The static host user resource to create.
+	User *StaticHostUser `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *CreateStaticHostUserRequest) Reset() {
+	*x = CreateStaticHostUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateStaticHostUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateStaticHostUserRequest) ProtoMessage() {}
+
+func (x *CreateStaticHostUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateStaticHostUserRequest.ProtoReflect.Descriptor instead.
+func (*CreateStaticHostUserRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CreateStaticHostUserRequest) GetUser() *StaticHostUser {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+// Request for UpdateStaticHostUser.
+type UpdateStaticHostUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The static host user resource to update.
+	User *StaticHostUser `protobuf:"bytes,2,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *UpdateStaticHostUserRequest) Reset() {
+	*x = UpdateStaticHostUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateStaticHostUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateStaticHostUserRequest) ProtoMessage() {}
+
+func (x *UpdateStaticHostUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateStaticHostUserRequest.ProtoReflect.Descriptor instead.
+func (*UpdateStaticHostUserRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *UpdateStaticHostUserRequest) GetUser() *StaticHostUser {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+// Request for UpsertStaticHostUser.
+type UpsertStaticHostUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The static host user resource to upsert.
+	User *StaticHostUser `protobuf:"bytes,2,opt,name=user,proto3" json:"user,omitempty"`
+}
+
+func (x *UpsertStaticHostUserRequest) Reset() {
+	*x = UpsertStaticHostUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpsertStaticHostUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpsertStaticHostUserRequest) ProtoMessage() {}
+
+func (x *UpsertStaticHostUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpsertStaticHostUserRequest.ProtoReflect.Descriptor instead.
+func (*UpsertStaticHostUserRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UpsertStaticHostUserRequest) GetUser() *StaticHostUser {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+// Request for DeleteStaticHostUser.
+type DeleteStaticHostUserRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Name of the user resource to remove.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *DeleteStaticHostUserRequest) Reset() {
+	*x = DeleteStaticHostUserRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteStaticHostUserRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteStaticHostUserRequest) ProtoMessage() {}
+
+func (x *DeleteStaticHostUserRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteStaticHostUserRequest.ProtoReflect.Descriptor instead.
+func (*DeleteStaticHostUserRequest) Descriptor() ([]byte, []int) {
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *DeleteStaticHostUserRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+var File_teleport_userprovisioning_v1_statichostuser_service_proto protoreflect.FileDescriptor
+
+var file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDesc = []byte{
+	0x0a, 0x39, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x2f, 0x73,
+	0x74, 0x61, 0x74, 0x69, 0x63, 0x68, 0x6f, 0x73, 0x74, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1c, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x31, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2f, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e,
+	0x67, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x68, 0x6f, 0x73, 0x74, 0x75,
+	0x73, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x2e, 0x0a, 0x18, 0x47, 0x65, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x58, 0x0a, 0x1a, 0x4c, 0x69, 0x73,
+	0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x61, 0x67, 0x65, 0x5f,
+	0x73, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x70, 0x61, 0x67, 0x65,
+	0x53, 0x69, 0x7a, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x61, 0x67, 0x65, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x22, 0x89, 0x01, 0x0a, 0x1b, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74,
+	0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x42, 0x0a, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72,
+	0x52, 0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x6e, 0x65, 0x78, 0x74, 0x5f,
+	0x70, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0d, 0x6e, 0x65, 0x78, 0x74, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22,
+	0x5f, 0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48,
+	0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x40,
+	0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74,
+	0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72,
+	0x22, 0x5f, 0x0a, 0x1b, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63,
+	0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x40, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65,
+	0x72, 0x22, 0x5f, 0x0a, 0x1b, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69,
+	0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x40, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c,
+	0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73,
+	0x65, 0x72, 0x22, 0x31, 0x0a, 0x1b, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x32, 0x8e, 0x06, 0x0a, 0x16, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63,
+	0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x12, 0x79, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73,
+	0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x36, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74,
+	0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e,
+	0x67, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f,
+	0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x8a, 0x01, 0x0a, 0x13,
+	0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73,
+	0x65, 0x72, 0x73, 0x12, 0x38, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75,
+	0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e,
+	0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73,
+	0x74, 0x55, 0x73, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x39, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x69, 0x73,
+	0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7f, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72,
+	0x12, 0x39, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72,
+	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x74, 0x65,
+	0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x69,
+	0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x7f, 0x0a, 0x14, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65,
+	0x72, 0x12, 0x39, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65,
+	0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73,
+	0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x74,
+	0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74,
+	0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x7f, 0x0a, 0x14, 0x55, 0x70,
+	0x73, 0x65, 0x72, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73,
+	0x65, 0x72, 0x12, 0x39, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73,
+	0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76,
+	0x31, 0x2e, 0x55, 0x70, 0x73, 0x65, 0x72, 0x74, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f,
+	0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e,
+	0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x69, 0x0a, 0x14, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48, 0x6f, 0x73, 0x74, 0x55,
+	0x73, 0x65, 0x72, 0x12, 0x39, 0x2e, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2e, 0x75,
+	0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2e,
+	0x76, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x48,
+	0x6f, 0x73, 0x74, 0x55, 0x73, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x42, 0x64, 0x5a, 0x62, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x76, 0x69, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x61, 0x6c, 0x2f, 0x74, 0x65, 0x6c, 0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x74, 0x65, 0x6c,
+	0x65, 0x70, 0x6f, 0x72, 0x74, 0x2f, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x2f, 0x76, 0x31, 0x3b, 0x75, 0x73, 0x65, 0x72, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x69, 0x6e, 0x67, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescOnce sync.Once
+	file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescData = file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDesc
+)
+
+func file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescGZIP() []byte {
+	file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescOnce.Do(func() {
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescData = protoimpl.X.CompressGZIP(file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescData)
+	})
+	return file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDescData
+}
+
+var file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_teleport_userprovisioning_v1_statichostuser_service_proto_goTypes = []any{
+	(*GetStaticHostUserRequest)(nil),    // 0: teleport.userprovisioning.v1.GetStaticHostUserRequest
+	(*ListStaticHostUsersRequest)(nil),  // 1: teleport.userprovisioning.v1.ListStaticHostUsersRequest
+	(*ListStaticHostUsersResponse)(nil), // 2: teleport.userprovisioning.v1.ListStaticHostUsersResponse
+	(*CreateStaticHostUserRequest)(nil), // 3: teleport.userprovisioning.v1.CreateStaticHostUserRequest
+	(*UpdateStaticHostUserRequest)(nil), // 4: teleport.userprovisioning.v1.UpdateStaticHostUserRequest
+	(*UpsertStaticHostUserRequest)(nil), // 5: teleport.userprovisioning.v1.UpsertStaticHostUserRequest
+	(*DeleteStaticHostUserRequest)(nil), // 6: teleport.userprovisioning.v1.DeleteStaticHostUserRequest
+	(*StaticHostUser)(nil),              // 7: teleport.userprovisioning.v1.StaticHostUser
+	(*emptypb.Empty)(nil),               // 8: google.protobuf.Empty
+}
+var file_teleport_userprovisioning_v1_statichostuser_service_proto_depIdxs = []int32{
+	7,  // 0: teleport.userprovisioning.v1.ListStaticHostUsersResponse.users:type_name -> teleport.userprovisioning.v1.StaticHostUser
+	7,  // 1: teleport.userprovisioning.v1.CreateStaticHostUserRequest.user:type_name -> teleport.userprovisioning.v1.StaticHostUser
+	7,  // 2: teleport.userprovisioning.v1.UpdateStaticHostUserRequest.user:type_name -> teleport.userprovisioning.v1.StaticHostUser
+	7,  // 3: teleport.userprovisioning.v1.UpsertStaticHostUserRequest.user:type_name -> teleport.userprovisioning.v1.StaticHostUser
+	0,  // 4: teleport.userprovisioning.v1.StaticHostUsersService.GetStaticHostUser:input_type -> teleport.userprovisioning.v1.GetStaticHostUserRequest
+	1,  // 5: teleport.userprovisioning.v1.StaticHostUsersService.ListStaticHostUsers:input_type -> teleport.userprovisioning.v1.ListStaticHostUsersRequest
+	3,  // 6: teleport.userprovisioning.v1.StaticHostUsersService.CreateStaticHostUser:input_type -> teleport.userprovisioning.v1.CreateStaticHostUserRequest
+	4,  // 7: teleport.userprovisioning.v1.StaticHostUsersService.UpdateStaticHostUser:input_type -> teleport.userprovisioning.v1.UpdateStaticHostUserRequest
+	5,  // 8: teleport.userprovisioning.v1.StaticHostUsersService.UpsertStaticHostUser:input_type -> teleport.userprovisioning.v1.UpsertStaticHostUserRequest
+	6,  // 9: teleport.userprovisioning.v1.StaticHostUsersService.DeleteStaticHostUser:input_type -> teleport.userprovisioning.v1.DeleteStaticHostUserRequest
+	7,  // 10: teleport.userprovisioning.v1.StaticHostUsersService.GetStaticHostUser:output_type -> teleport.userprovisioning.v1.StaticHostUser
+	2,  // 11: teleport.userprovisioning.v1.StaticHostUsersService.ListStaticHostUsers:output_type -> teleport.userprovisioning.v1.ListStaticHostUsersResponse
+	7,  // 12: teleport.userprovisioning.v1.StaticHostUsersService.CreateStaticHostUser:output_type -> teleport.userprovisioning.v1.StaticHostUser
+	7,  // 13: teleport.userprovisioning.v1.StaticHostUsersService.UpdateStaticHostUser:output_type -> teleport.userprovisioning.v1.StaticHostUser
+	7,  // 14: teleport.userprovisioning.v1.StaticHostUsersService.UpsertStaticHostUser:output_type -> teleport.userprovisioning.v1.StaticHostUser
+	8,  // 15: teleport.userprovisioning.v1.StaticHostUsersService.DeleteStaticHostUser:output_type -> google.protobuf.Empty
+	10, // [10:16] is the sub-list for method output_type
+	4,  // [4:10] is the sub-list for method input_type
+	4,  // [4:4] is the sub-list for extension type_name
+	4,  // [4:4] is the sub-list for extension extendee
+	0,  // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_teleport_userprovisioning_v1_statichostuser_service_proto_init() }
+func file_teleport_userprovisioning_v1_statichostuser_service_proto_init() {
+	if File_teleport_userprovisioning_v1_statichostuser_service_proto != nil {
+		return
+	}
+	file_teleport_userprovisioning_v1_statichostuser_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*GetStaticHostUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*ListStaticHostUsersRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*ListStaticHostUsersResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*CreateStaticHostUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[4].Exporter = func(v any, i int) any {
+			switch v := v.(*UpdateStaticHostUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[5].Exporter = func(v any, i int) any {
+			switch v := v.(*UpsertStaticHostUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes[6].Exporter = func(v any, i int) any {
+			switch v := v.(*DeleteStaticHostUserRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   7,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_teleport_userprovisioning_v1_statichostuser_service_proto_goTypes,
+		DependencyIndexes: file_teleport_userprovisioning_v1_statichostuser_service_proto_depIdxs,
+		MessageInfos:      file_teleport_userprovisioning_v1_statichostuser_service_proto_msgTypes,
+	}.Build()
+	File_teleport_userprovisioning_v1_statichostuser_service_proto = out.File
+	file_teleport_userprovisioning_v1_statichostuser_service_proto_rawDesc = nil
+	file_teleport_userprovisioning_v1_statichostuser_service_proto_goTypes = nil
+	file_teleport_userprovisioning_v1_statichostuser_service_proto_depIdxs = nil
+}
diff --git a/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser_service_grpc.pb.go b/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser_service_grpc.pb.go
new file mode 100644
index 0000000000000..6a50cce054096
--- /dev/null
+++ b/api/gen/proto/go/teleport/userprovisioning/v1/statichostuser_service_grpc.pb.go
@@ -0,0 +1,332 @@
+// Copyright 2024 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.4.0
+// - protoc             (unknown)
+// source: teleport/userprovisioning/v1/statichostuser_service.proto
+
+package userprovisioningv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
+
+const (
+	StaticHostUsersService_GetStaticHostUser_FullMethodName    = "/teleport.userprovisioning.v1.StaticHostUsersService/GetStaticHostUser"
+	StaticHostUsersService_ListStaticHostUsers_FullMethodName  = "/teleport.userprovisioning.v1.StaticHostUsersService/ListStaticHostUsers"
+	StaticHostUsersService_CreateStaticHostUser_FullMethodName = "/teleport.userprovisioning.v1.StaticHostUsersService/CreateStaticHostUser"
+	StaticHostUsersService_UpdateStaticHostUser_FullMethodName = "/teleport.userprovisioning.v1.StaticHostUsersService/UpdateStaticHostUser"
+	StaticHostUsersService_UpsertStaticHostUser_FullMethodName = "/teleport.userprovisioning.v1.StaticHostUsersService/UpsertStaticHostUser"
+	StaticHostUsersService_DeleteStaticHostUser_FullMethodName = "/teleport.userprovisioning.v1.StaticHostUsersService/DeleteStaticHostUser"
+)
+
+// StaticHostUsersServiceClient is the client API for StaticHostUsersService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// StaticHostUsersService provides methods to manage static host users.
+type StaticHostUsersServiceClient interface {
+	// GetStaticHostUser retrieves a static host user resource by name.
+	GetStaticHostUser(ctx context.Context, in *GetStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error)
+	// ListStaticHostUsers gets all existing static host users.
+	ListStaticHostUsers(ctx context.Context, in *ListStaticHostUsersRequest, opts ...grpc.CallOption) (*ListStaticHostUsersResponse, error)
+	// CreateStaticHostUser creates a static host user if one does not already exist.
+	CreateStaticHostUser(ctx context.Context, in *CreateStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error)
+	// UpdateStaticHostUser updates an existing static host user.
+	UpdateStaticHostUser(ctx context.Context, in *UpdateStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error)
+	// UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user.
+	UpsertStaticHostUser(ctx context.Context, in *UpsertStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error)
+	// DeleteStaticHostUser removes an existing static host user resource by name.
+	DeleteStaticHostUser(ctx context.Context, in *DeleteStaticHostUserRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type staticHostUsersServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewStaticHostUsersServiceClient(cc grpc.ClientConnInterface) StaticHostUsersServiceClient {
+	return &staticHostUsersServiceClient{cc}
+}
+
+func (c *staticHostUsersServiceClient) GetStaticHostUser(ctx context.Context, in *GetStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StaticHostUser)
+	err := c.cc.Invoke(ctx, StaticHostUsersService_GetStaticHostUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *staticHostUsersServiceClient) ListStaticHostUsers(ctx context.Context, in *ListStaticHostUsersRequest, opts ...grpc.CallOption) (*ListStaticHostUsersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListStaticHostUsersResponse)
+	err := c.cc.Invoke(ctx, StaticHostUsersService_ListStaticHostUsers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *staticHostUsersServiceClient) CreateStaticHostUser(ctx context.Context, in *CreateStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StaticHostUser)
+	err := c.cc.Invoke(ctx, StaticHostUsersService_CreateStaticHostUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *staticHostUsersServiceClient) UpdateStaticHostUser(ctx context.Context, in *UpdateStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StaticHostUser)
+	err := c.cc.Invoke(ctx, StaticHostUsersService_UpdateStaticHostUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *staticHostUsersServiceClient) UpsertStaticHostUser(ctx context.Context, in *UpsertStaticHostUserRequest, opts ...grpc.CallOption) (*StaticHostUser, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StaticHostUser)
+	err := c.cc.Invoke(ctx, StaticHostUsersService_UpsertStaticHostUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *staticHostUsersServiceClient) DeleteStaticHostUser(ctx context.Context, in *DeleteStaticHostUserRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, StaticHostUsersService_DeleteStaticHostUser_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// StaticHostUsersServiceServer is the server API for StaticHostUsersService service.
+// All implementations must embed UnimplementedStaticHostUsersServiceServer
+// for forward compatibility
+//
+// StaticHostUsersService provides methods to manage static host users.
+type StaticHostUsersServiceServer interface {
+	// GetStaticHostUser retrieves a static host user resource by name.
+	GetStaticHostUser(context.Context, *GetStaticHostUserRequest) (*StaticHostUser, error)
+	// ListStaticHostUsers gets all existing static host users.
+	ListStaticHostUsers(context.Context, *ListStaticHostUsersRequest) (*ListStaticHostUsersResponse, error)
+	// CreateStaticHostUser creates a static host user if one does not already exist.
+	CreateStaticHostUser(context.Context, *CreateStaticHostUserRequest) (*StaticHostUser, error)
+	// UpdateStaticHostUser updates an existing static host user.
+	UpdateStaticHostUser(context.Context, *UpdateStaticHostUserRequest) (*StaticHostUser, error)
+	// UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user.
+	UpsertStaticHostUser(context.Context, *UpsertStaticHostUserRequest) (*StaticHostUser, error)
+	// DeleteStaticHostUser removes an existing static host user resource by name.
+	DeleteStaticHostUser(context.Context, *DeleteStaticHostUserRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedStaticHostUsersServiceServer()
+}
+
+// UnimplementedStaticHostUsersServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedStaticHostUsersServiceServer struct {
+}
+
+func (UnimplementedStaticHostUsersServiceServer) GetStaticHostUser(context.Context, *GetStaticHostUserRequest) (*StaticHostUser, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetStaticHostUser not implemented")
+}
+func (UnimplementedStaticHostUsersServiceServer) ListStaticHostUsers(context.Context, *ListStaticHostUsersRequest) (*ListStaticHostUsersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListStaticHostUsers not implemented")
+}
+func (UnimplementedStaticHostUsersServiceServer) CreateStaticHostUser(context.Context, *CreateStaticHostUserRequest) (*StaticHostUser, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateStaticHostUser not implemented")
+}
+func (UnimplementedStaticHostUsersServiceServer) UpdateStaticHostUser(context.Context, *UpdateStaticHostUserRequest) (*StaticHostUser, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateStaticHostUser not implemented")
+}
+func (UnimplementedStaticHostUsersServiceServer) UpsertStaticHostUser(context.Context, *UpsertStaticHostUserRequest) (*StaticHostUser, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpsertStaticHostUser not implemented")
+}
+func (UnimplementedStaticHostUsersServiceServer) DeleteStaticHostUser(context.Context, *DeleteStaticHostUserRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteStaticHostUser not implemented")
+}
+func (UnimplementedStaticHostUsersServiceServer) mustEmbedUnimplementedStaticHostUsersServiceServer() {
+}
+
+// UnsafeStaticHostUsersServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to StaticHostUsersServiceServer will
+// result in compilation errors.
+type UnsafeStaticHostUsersServiceServer interface {
+	mustEmbedUnimplementedStaticHostUsersServiceServer()
+}
+
+func RegisterStaticHostUsersServiceServer(s grpc.ServiceRegistrar, srv StaticHostUsersServiceServer) {
+	s.RegisterService(&StaticHostUsersService_ServiceDesc, srv)
+}
+
+func _StaticHostUsersService_GetStaticHostUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetStaticHostUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(StaticHostUsersServiceServer).GetStaticHostUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: StaticHostUsersService_GetStaticHostUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(StaticHostUsersServiceServer).GetStaticHostUser(ctx, req.(*GetStaticHostUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _StaticHostUsersService_ListStaticHostUsers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListStaticHostUsersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(StaticHostUsersServiceServer).ListStaticHostUsers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: StaticHostUsersService_ListStaticHostUsers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(StaticHostUsersServiceServer).ListStaticHostUsers(ctx, req.(*ListStaticHostUsersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _StaticHostUsersService_CreateStaticHostUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateStaticHostUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(StaticHostUsersServiceServer).CreateStaticHostUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: StaticHostUsersService_CreateStaticHostUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(StaticHostUsersServiceServer).CreateStaticHostUser(ctx, req.(*CreateStaticHostUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _StaticHostUsersService_UpdateStaticHostUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateStaticHostUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(StaticHostUsersServiceServer).UpdateStaticHostUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: StaticHostUsersService_UpdateStaticHostUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(StaticHostUsersServiceServer).UpdateStaticHostUser(ctx, req.(*UpdateStaticHostUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _StaticHostUsersService_UpsertStaticHostUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpsertStaticHostUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(StaticHostUsersServiceServer).UpsertStaticHostUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: StaticHostUsersService_UpsertStaticHostUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(StaticHostUsersServiceServer).UpsertStaticHostUser(ctx, req.(*UpsertStaticHostUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _StaticHostUsersService_DeleteStaticHostUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteStaticHostUserRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(StaticHostUsersServiceServer).DeleteStaticHostUser(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: StaticHostUsersService_DeleteStaticHostUser_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(StaticHostUsersServiceServer).DeleteStaticHostUser(ctx, req.(*DeleteStaticHostUserRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// StaticHostUsersService_ServiceDesc is the grpc.ServiceDesc for StaticHostUsersService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var StaticHostUsersService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "teleport.userprovisioning.v1.StaticHostUsersService",
+	HandlerType: (*StaticHostUsersServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetStaticHostUser",
+			Handler:    _StaticHostUsersService_GetStaticHostUser_Handler,
+		},
+		{
+			MethodName: "ListStaticHostUsers",
+			Handler:    _StaticHostUsersService_ListStaticHostUsers_Handler,
+		},
+		{
+			MethodName: "CreateStaticHostUser",
+			Handler:    _StaticHostUsersService_CreateStaticHostUser_Handler,
+		},
+		{
+			MethodName: "UpdateStaticHostUser",
+			Handler:    _StaticHostUsersService_UpdateStaticHostUser_Handler,
+		},
+		{
+			MethodName: "UpsertStaticHostUser",
+			Handler:    _StaticHostUsersService_UpsertStaticHostUser_Handler,
+		},
+		{
+			MethodName: "DeleteStaticHostUser",
+			Handler:    _StaticHostUsersService_DeleteStaticHostUser_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "teleport/userprovisioning/v1/statichostuser_service.proto",
+}
diff --git a/api/proto/teleport/userprovisioning/v1/statichostuser.proto b/api/proto/teleport/userprovisioning/v1/statichostuser.proto
new file mode 100644
index 0000000000000..24309445c89bc
--- /dev/null
+++ b/api/proto/teleport/userprovisioning/v1/statichostuser.proto
@@ -0,0 +1,58 @@
+// Copyright 2024 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.userprovisioning.v1;
+
+import "teleport/header/v1/metadata.proto";
+import "teleport/legacy/types/wrappers/wrappers.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v1;userprovisioningv1";
+
+// StaticHostUser is a resource that represents host users that should be
+// created on matching nodes.
+message StaticHostUser {
+  // kind is a resource kind.
+  string kind = 1;
+  // sub_kind is an optional resource sub kind, used in some resources.
+  string sub_kind = 2;
+  // version is the resource version. It must be specified.
+  // Supported values are: `v1`.
+  string version = 3;
+  // metadata is resource metadata.
+  teleport.header.v1.Metadata metadata = 4;
+  // spec is the static host user spec.
+  StaticHostUserSpec spec = 5;
+}
+
+// StaticHostUserSpec is the static host user spec.
+message StaticHostUserSpec {
+  // login is the login to create on the node.
+  string login = 1;
+  // groups is a list of additional groups to add the user to.
+  repeated string groups = 2;
+  // sudoers is a list of sudoer entries to add.
+  repeated string sudoers = 3;
+  // uid is the new user's uid.
+  string uid = 4;
+  // gid is the new user's gid.
+  string gid = 5;
+  // node_labels is a map of node labels that will create a user from this
+  // resource.
+  wrappers.LabelValues node_labels = 6;
+  // node_labels_expression is a predicate expression to create a user from
+  // this resource.
+  string node_labels_expression = 7;
+}
diff --git a/api/proto/teleport/userprovisioning/v1/statichostuser_service.proto b/api/proto/teleport/userprovisioning/v1/statichostuser_service.proto
new file mode 100644
index 0000000000000..35ff5b890bacd
--- /dev/null
+++ b/api/proto/teleport/userprovisioning/v1/statichostuser_service.proto
@@ -0,0 +1,91 @@
+// Copyright 2024 Gravitational, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package teleport.userprovisioning.v1;
+
+import "google/protobuf/empty.proto";
+import "teleport/userprovisioning/v1/statichostuser.proto";
+
+option go_package = "github.com/gravitational/teleport/api/gen/proto/go/teleport/userprovisioning/v1;userprovisioningv1";
+
+// StaticHostUsersService provides methods to manage static host users.
+service StaticHostUsersService {
+  // GetStaticHostUser retrieves a static host user resource by name.
+  rpc GetStaticHostUser(GetStaticHostUserRequest) returns (StaticHostUser);
+  // ListStaticHostUsers gets all existing static host users.
+  rpc ListStaticHostUsers(ListStaticHostUsersRequest) returns (ListStaticHostUsersResponse);
+  // CreateStaticHostUser creates a static host user if one does not already exist.
+  rpc CreateStaticHostUser(CreateStaticHostUserRequest) returns (StaticHostUser);
+  // UpdateStaticHostUser updates an existing static host user.
+  rpc UpdateStaticHostUser(UpdateStaticHostUserRequest) returns (StaticHostUser);
+  // UpsertStaticHostUser creates a new static host user or forcefully updates an existing static host user.
+  rpc UpsertStaticHostUser(UpsertStaticHostUserRequest) returns (StaticHostUser);
+  // DeleteStaticHostUser removes an existing static host user resource by name.
+  rpc DeleteStaticHostUser(DeleteStaticHostUserRequest) returns (google.protobuf.Empty);
+}
+
+// Request for GetStaticHostUser.
+message GetStaticHostUserRequest {
+  // Name of the user to retrieve, this take priority over current_user.
+  string name = 1;
+}
+
+// Request for ListStaticHostUsers.
+//
+// Follows the pagination semantics of
+// https://cloud.google.com/apis/design/standard_methods#list.
+message ListStaticHostUsersRequest {
+  // The maximum number of items to return.
+  // The server may impose a different page size at its discretion.
+  int32 page_size = 1;
+
+  // The next_page_token value returned from a previous List request, if any.
+  string page_token = 2;
+}
+
+// Response for ListStaticHostUsers.
+message ListStaticHostUsersResponse {
+  // Static host users that matched the search.
+  repeated StaticHostUser users = 1;
+
+  // Token to retrieve the next page of results, or empty if there are no
+  // more results in the list.
+  string next_page_token = 2;
+}
+
+// Request for CreateStaticHostUser.
+message CreateStaticHostUserRequest {
+  // The static host user resource to create.
+  StaticHostUser user = 1;
+}
+
+// Request for UpdateStaticHostUser.
+message UpdateStaticHostUserRequest {
+  // The static host user resource to update.
+  StaticHostUser user = 2;
+}
+
+// Request for UpsertStaticHostUser.
+message UpsertStaticHostUserRequest {
+  // The static host user resource to upsert.
+  StaticHostUser user = 2;
+}
+
+// Request for DeleteStaticHostUser.
+message DeleteStaticHostUserRequest {
+  // Name of the user resource to remove.
+  string name = 1;
+}
diff --git a/api/types/constants.go b/api/types/constants.go
index f598dcf32e760..c0125fcd19fd6 100644
--- a/api/types/constants.go
+++ b/api/types/constants.go
@@ -535,6 +535,9 @@ const (
 	// KindAccessGraphSettings is a resource which holds cluster-wide configuration for dynamic access graph settings.
 	KindAccessGraphSettings = "access_graph_settings"
 
+	// KindStaticHostUser is a host user to be created on matching SSH nodes.
+	KindStaticHostUser = "static_host_user"
+
 	// MetaNameAccessGraphSettings is the exact name of the singleton resource holding
 	// access graph settings.
 	MetaNameAccessGraphSettings = "access-graph-settings"