diff --git a/integration/autoupdate/tools/updater_tsh_test.go b/integration/autoupdate/tools/updater_tsh_test.go
index eafd687dd99..6bba808b4a1 100644
--- a/integration/autoupdate/tools/updater_tsh_test.go
+++ b/integration/autoupdate/tools/updater_tsh_test.go
@@ -372,17 +372,17 @@ func bootstrapTestServer(t *testing.T) (*service.TeleportProcess, string) {
 func setupManagedUpdates(t *testing.T, server *auth.Server, muMode string, muVersion string) {
 	t.Helper()
 	ctx := context.Background()
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatev1pb.AutoUpdateConfigSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 			Mode: muMode,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
-		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatev1pb.AutoUpdateVersionSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: muVersion,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = server.UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
diff --git a/integration/db/fixture.go b/integration/db/fixture.go
index 8b9065f7ba7..0ffce5371f9 100644
--- a/integration/db/fixture.go
+++ b/integration/db/fixture.go
@@ -349,7 +349,7 @@ func SetupDatabaseTest(t *testing.T, options ...TestOptionFunc) *DatabasePack {
 
 	// disable health checks to reduce log noise during tests
 	defaultHCC := services.VirtualDefaultHealthCheckConfigDB()
-	defaultHCC.GetSpec().GetMatch().Disabled = true
+	defaultHCC.GetSpec().GetMatch().SetDisabled(true)
 	_, err = p.Root.Cluster.Process.GetAuthServer().UpsertHealthCheckConfig(ctx, defaultHCC)
 	require.NoError(t, err)
 	_, err = p.Leaf.Cluster.Process.GetAuthServer().UpsertHealthCheckConfig(ctx, defaultHCC)
diff --git a/integration/integration_test.go b/integration/integration_test.go
index 55ffd5876f7..60d95eba765 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -311,17 +311,17 @@ func testAuthLocalNodeControlStream(t *testing.T, suite *integrationTestSuite) {
 	var nodeID string
 	// verify node control stream registers, extracting the id.
 	require.Eventually(t, func() bool {
-		status, err := clt.GetInventoryStatus(context.Background(), &proto.InventoryStatusRequest{
+		status, err := clt.GetInventoryStatus(context.Background(), proto.InventoryStatusRequest_builder{
 			Connected: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 
-		for _, hello := range status.Connected {
-			for _, s := range hello.Services {
+		for _, hello := range status.GetConnected() {
+			for _, s := range hello.GetServices() {
 				if s != string(types.RoleNode) {
 					continue
 				}
-				nodeID = hello.ServerID
+				nodeID = hello.GetServerID()
 				return true
 			}
 		}
diff --git a/integration/proxy/proxy_helpers.go b/integration/proxy/proxy_helpers.go
index 3a69995b4d2..24d0c43ddf3 100644
--- a/integration/proxy/proxy_helpers.go
+++ b/integration/proxy/proxy_helpers.go
@@ -674,15 +674,15 @@ func mustFindKubePod(t *testing.T, tc *client.TeleportClient) {
 	serviceClient, err := tc.NewKubernetesServiceClient(context.Background(), tc.SiteName)
 	require.NoError(t, err)
 
-	response, err := serviceClient.ListKubernetesResources(context.Background(), &kubeproto.ListKubernetesResourcesRequest{
+	response, err := serviceClient.ListKubernetesResources(context.Background(), kubeproto.ListKubernetesResourcesRequest_builder{
 		ResourceType:        types.KindKubePod,
 		KubernetesCluster:   kubeClusterName,
 		KubernetesNamespace: metav1.NamespaceDefault,
 		TeleportCluster:     tc.SiteName,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Len(t, response.Resources, 3)
-	require.Equal(t, types.KindKubePod, response.Resources[0].Kind)
+	require.Len(t, response.GetResources(), 3)
+	require.Equal(t, types.KindKubePod, response.GetResources()[0].Kind)
 }
 
 func mustConnectDatabaseGateway(ctx context.Context, t *testing.T, _ *daemon.Service, gw gateway.Gateway) {
diff --git a/integration/tctl_token_kube_test.go b/integration/tctl_token_kube_test.go
index 3b1635cc159..5777c81dcf2 100644
--- a/integration/tctl_token_kube_test.go
+++ b/integration/tctl_token_kube_test.go
@@ -127,18 +127,18 @@ func TestTCTLTokenConfigureKubeCommand_OIDC(t *testing.T) {
 	pong, err := clt.Ping(ctx)
 	require.NoError(t, err)
 
-	_, err = clt.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
-		Bot: &machineidv1.Bot{
+	_, err = clt.BotServiceClient().CreateBot(ctx, machineidv1.CreateBotRequest_builder{
+		Bot: machineidv1.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: testBotName,
-			},
-			Spec: &machineidv1.BotSpec{
+			}.Build(),
+			Spec: machineidv1.BotSpec_builder{
 				Roles: []string{testRoleName},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	addr, err := rc.Process.ProxyWebAddr()
@@ -244,18 +244,18 @@ func TestTCTLTokenConfigureKubeCommand_JWKS(t *testing.T) {
 	pong, err := clt.Ping(ctx)
 	require.NoError(t, err)
 
-	_, err = clt.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
-		Bot: &machineidv1.Bot{
+	_, err = clt.BotServiceClient().CreateBot(ctx, machineidv1.CreateBotRequest_builder{
+		Bot: machineidv1.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: testBotName,
-			},
-			Spec: &machineidv1.BotSpec{
+			}.Build(),
+			Spec: machineidv1.BotSpec_builder{
 				Roles: []string{testRoleName},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	addr, err := rc.Process.ProxyWebAddr()
diff --git a/integration/teleterm_test.go b/integration/teleterm_test.go
index 38c65e99191..2802422c69b 100644
--- a/integration/teleterm_test.go
+++ b/integration/teleterm_test.go
@@ -332,8 +332,8 @@ func testListRootClustersReturnsLoggedInUser(t *testing.T, pack *dbhelpers.Datab
 	response, err := handler.ListRootClusters(context.Background(), &api.ListClustersRequest{})
 	require.NoError(t, err)
 
-	require.Len(t, response.Clusters, 1)
-	require.Equal(t, pack.Root.User.GetName(), response.Clusters[0].LoggedInUser.Name)
+	require.Len(t, response.GetClusters(), 1)
+	require.Equal(t, pack.Root.User.GetName(), response.GetClusters()[0].GetLoggedInUser().GetName())
 }
 
 func testGetClusterReturnsPropertiesFromAuthServer(t *testing.T, pack *dbhelpers.DatabasePack) {
@@ -418,20 +418,20 @@ func testGetClusterReturnsPropertiesFromAuthServer(t *testing.T, pack *dbhelpers
 	require.NoError(t, err)
 	clusterURI := uri.NewClusterURI(rootClusterName)
 
-	response, err := handler.GetCluster(context.Background(), &api.GetClusterRequest{
+	response, err := handler.GetCluster(context.Background(), api.GetClusterRequest_builder{
 		ClusterUri: clusterURI.String(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
-	require.Equal(t, userName, response.LoggedInUser.Name)
-	require.ElementsMatch(t, []string{requestableRoleName}, response.LoggedInUser.RequestableRoles)
-	require.ElementsMatch(t, []string{suggestedReviewer}, response.LoggedInUser.SuggestedReviewers)
+	require.Equal(t, userName, response.GetLoggedInUser().GetName())
+	require.ElementsMatch(t, []string{requestableRoleName}, response.GetLoggedInUser().GetRequestableRoles())
+	require.ElementsMatch(t, []string{suggestedReviewer}, response.GetLoggedInUser().GetSuggestedReviewers())
 
 	// Verify that cluster ID cache gets updated.
 	clusterIDFromCache, ok := clusterIDCache.Load(clusterURI)
 	require.True(t, ok, "ID for cluster %q was not found in the cache", clusterURI)
 	require.NotEmpty(t, clusterIDFromCache)
-	require.Equal(t, response.AuthClusterId, clusterIDFromCache)
+	require.Equal(t, response.GetAuthClusterId(), clusterIDFromCache)
 }
 
 func testHeadlessWatcher(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.UserCreds) {
@@ -560,10 +560,10 @@ func testClientCache(t *testing.T, pack *dbhelpers.DatabasePack, creds *helpers.
 
 	// Reissue user certs by assuming a role with a bogus ID in DropAccessRequests.
 	// This makes the cached client stale.
-	accessRequest := &api.AssumeRoleRequest{
+	accessRequest := api.AssumeRoleRequest_builder{
 		RootClusterUri: cluster.URI.String(),
 		DropRequestIds: []string{"does-not-matter"},
-	}
+	}.Build()
 	err = cluster.AssumeRole(ctx, secondCallForClient, accessRequest)
 	require.NoError(t, err)
 
@@ -616,10 +616,10 @@ func testClearingStaleCachedClients(t *testing.T, pack *dbhelpers.DatabasePack,
 	require.NoError(t, err)
 	require.Equal(t, firstCallForClient, secondCallForClient)
 	// Reissue user certs by assuming a role with a bogus ID in DropAccessRequests.
-	accessRequest := &api.AssumeRoleRequest{
+	accessRequest := api.AssumeRoleRequest_builder{
 		RootClusterUri: cluster.URI.String(),
 		DropRequestIds: []string{"does-not-matter"},
-	}
+	}.Build()
 	err = cluster.AssumeRole(ctx, firstCallForClient, accessRequest)
 	require.NoError(t, err)
 	// The cert has changed, so after clearing stale clients,
@@ -974,23 +974,21 @@ func testCreateConnectMyComputerRole(t *testing.T, pack *dbhelpers.DatabasePack)
 			// skips the actual login flow and saves valid certs to disk. We already had a regression that
 			// was not caught by this test because the test did not trigger certain code paths because it
 			// was using mustLogin as a shortcut.
-			_, err = handler.AddCluster(ctx, &api.AddClusterRequest{Name: pack.Root.Cluster.Web})
+			_, err = handler.AddCluster(ctx, api.AddClusterRequest_builder{Name: pack.Root.Cluster.Web}.Build())
 			require.NoError(t, err)
-			_, err = handler.Login(ctx, &api.LoginRequest{
+			_, err = handler.Login(ctx, api.LoginRequest_builder{
 				ClusterUri: rootClusterURI,
-				Params: &api.LoginRequest_Local{
-					Local: &api.LoginRequest_LocalParams{User: userName, Password: userPassword},
-				},
-			})
+				Local:      api.LoginRequest_LocalParams_builder{User: userName, Password: userPassword}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
 			// Call CreateConnectMyComputerRole.
-			response, err := handler.CreateConnectMyComputerRole(ctx, &api.CreateConnectMyComputerRoleRequest{
+			response, err := handler.CreateConnectMyComputerRole(ctx, api.CreateConnectMyComputerRoleRequest_builder{
 				RootClusterUri: rootClusterURI,
-			})
+			}.Build())
 			require.NoError(t, err)
 
-			test.assertCertsReloaded(t, response.CertsReloaded, "CertsReloaded is the opposite of the expected value")
+			test.assertCertsReloaded(t, response.GetCertsReloaded(), "CertsReloaded is the opposite of the expected value")
 
 			// Verify that the role exists.
 			role, err := authServer.GetRole(ctx, roleName)
@@ -1007,11 +1005,11 @@ func testCreateConnectMyComputerRole(t *testing.T, pack *dbhelpers.DatabasePack)
 			//
 			// GetCluster reads data from the cert. If the certs were not reloaded properly, GetCluster
 			// will not return the role that's just been assigned to the user.
-			clusterDetails, err := handler.GetCluster(ctx, &api.GetClusterRequest{
+			clusterDetails, err := handler.GetCluster(ctx, api.GetClusterRequest_builder{
 				ClusterUri: rootClusterURI,
-			})
+			}.Build())
 			require.NoError(t, err)
-			require.Contains(t, clusterDetails.LoggedInUser.Roles, roleName,
+			require.Contains(t, clusterDetails.GetLoggedInUser().GetRoles(), roleName,
 				"the user certs don't include the freshly added role; the certs might have not been reloaded properly")
 		})
 	}
@@ -1095,9 +1093,9 @@ func testCreateConnectMyComputerToken(t *testing.T, pack *dbhelpers.DatabasePack
 	require.NoError(t, err)
 	rootClusterURI := uri.NewClusterURI(rootClusterName).String()
 	requestCreatedAt := fakeClock.Now()
-	createdTokenResponse, err := handler.CreateConnectMyComputerNodeToken(ctx, &api.CreateConnectMyComputerNodeTokenRequest{
+	createdTokenResponse, err := handler.CreateConnectMyComputerNodeToken(ctx, api.CreateConnectMyComputerNodeTokenRequest_builder{
 		RootClusterUri: rootClusterURI,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// Verify that token exists
@@ -1151,9 +1149,9 @@ func testWaitForConnectMyComputerNodeJoin(t *testing.T, pack *dbhelpers.Database
 	waitForNodeJoinErr := make(chan error)
 
 	go func() {
-		_, err := handler.WaitForConnectMyComputerNodeJoin(ctx, &api.WaitForConnectMyComputerNodeJoinRequest{
+		_, err := handler.WaitForConnectMyComputerNodeJoin(ctx, api.WaitForConnectMyComputerNodeJoinRequest_builder{
 			RootClusterUri: uri.NewClusterURI(profileName).String(),
-		})
+		}.Build())
 		waitForNodeJoinErr <- err
 	}()
 
@@ -1256,9 +1254,9 @@ func testDeleteConnectMyComputerNode(t *testing.T, pack *dbhelpers.DatabasePack)
 	require.NoError(t, err)
 
 	// test
-	_, err = handler.DeleteConnectMyComputerNode(ctx, &api.DeleteConnectMyComputerNodeRequest{
+	_, err = handler.DeleteConnectMyComputerNode(ctx, api.DeleteConnectMyComputerNodeRequest_builder{
 		RootClusterUri: uri.NewClusterURI(profileName).String(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// waits for the node to be deleted
@@ -1452,29 +1450,29 @@ func testListDatabaseUsersFromUnifiedResources(t *testing.T, pack *dbhelpers.Dat
 			require.NoError(t, err)
 
 			if accessRequestID != "" {
-				_, err := handler.AssumeRole(ctx, &api.AssumeRoleRequest{
+				_, err := handler.AssumeRole(ctx, api.AssumeRoleRequest_builder{
 					RootClusterUri:   test.dbURI.GetRootClusterURI().String(),
 					AccessRequestIds: []string{accessRequestID},
-				})
+				}.Build())
 				require.NoError(t, err)
 			}
 
-			res, err := handler.ListUnifiedResources(ctx, &api.ListUnifiedResourcesRequest{
+			res, err := handler.ListUnifiedResources(ctx, api.ListUnifiedResourcesRequest_builder{
 				ClusterUri: test.dbURI.GetClusterURI().String(),
 				Kinds:      []string{types.KindDatabase},
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			var matchedDatabase *api.Database
-			for _, resource := range res.Resources {
+			for _, resource := range res.GetResources() {
 				database := resource.GetDatabase()
-				if database != nil && database.Uri == test.dbURI.String() {
+				if database != nil && database.GetUri() == test.dbURI.String() {
 					matchedDatabase = database
 					break
 				}
 			}
 			require.NotNil(t, matchedDatabase, "database %q not found in unified resources response", test.dbURI.String())
-			require.Contains(t, matchedDatabase.DatabaseUsers, test.wantDBUser)
+			require.Contains(t, matchedDatabase.GetDatabaseUsers(), test.wantDBUser)
 		})
 	}
 }
diff --git a/integrations/access/accessmonitoring/access_monitoring_rules.go b/integrations/access/accessmonitoring/access_monitoring_rules.go
index fc7cd79dada..b435f054713 100644
--- a/integrations/access/accessmonitoring/access_monitoring_rules.go
+++ b/integrations/access/accessmonitoring/access_monitoring_rules.go
@@ -102,9 +102,9 @@ func (amrh *RuleHandler) InitAccessMonitoringRulesCache(ctx context.Context) err
 		if !amrh.ruleApplies(amr) {
 			continue
 		}
-		amrh.accessMonitoringRules.rules[amr.GetMetadata().Name] = amr
+		amrh.accessMonitoringRules.rules[amr.GetMetadata().GetName()] = amr
 		if amrh.onCacheUpdateCallback != nil {
-			amrh.onCacheUpdateCallback(types.OpPut, amr.GetMetadata().Name, amr)
+			amrh.onCacheUpdateCallback(types.OpPut, amr.GetMetadata().GetName(), amr)
 		}
 	}
 	return nil
@@ -131,9 +131,9 @@ func (amrh *RuleHandler) HandleAccessMonitoringRule(ctx context.Context, event t
 			delete(amrh.accessMonitoringRules.rules, event.Resource.GetName())
 			return nil
 		}
-		amrh.accessMonitoringRules.rules[req.Metadata.Name] = req
+		amrh.accessMonitoringRules.rules[req.GetMetadata().GetName()] = req
 		if amrh.onCacheUpdateCallback != nil {
-			amrh.onCacheUpdateCallback(types.OpPut, req.GetMetadata().Name, req)
+			amrh.onCacheUpdateCallback(types.OpPut, req.GetMetadata().GetName(), req)
 		}
 		return nil
 	case types.OpDelete:
@@ -202,12 +202,12 @@ func (amrh *RuleHandler) getAllAccessMonitoringRules(ctx context.Context) ([]*ac
 	var resources []*accessmonitoringrulesv1.AccessMonitoringRule
 	var nextToken string
 	for {
-		req := &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+		req := accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 			PageSize:         defaultAccessMonitoringRulePageSize,
 			PageToken:        nextToken,
 			Subjects:         []string{types.KindAccessRequest},
 			NotificationName: amrh.pluginName,
-		}
+		}.Build()
 
 		var page []*accessmonitoringrulesv1.AccessMonitoringRule
 		var err error
@@ -241,7 +241,7 @@ func (amrh *RuleHandler) ruleApplies(amr *accessmonitoringrulesv1.AccessMonitori
 	if amr.GetSpec().GetNotification().GetName() != amrh.pluginName {
 		return false
 	}
-	return slices.ContainsFunc(amr.Spec.Subjects, func(subject string) bool {
+	return slices.ContainsFunc(amr.GetSpec().GetSubjects(), func(subject string) bool {
 		return subject == types.KindAccessRequest
 	})
 }
diff --git a/integrations/access/accessmonitoring/access_monitoring_rules_test.go b/integrations/access/accessmonitoring/access_monitoring_rules_test.go
index 920a6316382..5973b2d2bc0 100644
--- a/integrations/access/accessmonitoring/access_monitoring_rules_test.go
+++ b/integrations/access/accessmonitoring/access_monitoring_rules_test.go
@@ -101,14 +101,14 @@ func TestRecipients(t *testing.T) {
 		},
 	})
 
-	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects:  []string{types.KindAccessRequest},
 		Condition: `user.traits["team"].contains("example")`,
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       pluginName,
 			Recipients: []string{recipient},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
@@ -181,14 +181,14 @@ func TestRecipientsWithResources(t *testing.T) {
 		},
 	})
 
-	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects:  []string{types.KindAccessRequest},
 		Condition: `access_request.spec.resource_labels_intersection["env"].contains("dev")`,
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       pluginName,
 			Recipients: []string{recipient},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	err = amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
@@ -238,27 +238,27 @@ func TestRecipientsWithSchedules(t *testing.T) {
 		},
 	})
 
-	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects: []string{types.KindAccessRequest},
 		Schedules: map[string]*pb.Schedule{
-			"default": {
-				Time: &pb.TimeSchedule{
+			"default": pb.Schedule_builder{
+				Time: pb.TimeSchedule_builder{
 					Shifts: []*pb.TimeSchedule_Shift{
-						{
+						pb.TimeSchedule_Shift_builder{
 							Weekday: time.Monday.String(),
 							Start:   "14:00",
 							End:     "15:00",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		Condition: `true`,
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       pluginName,
 			Recipients: []string{recipient},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	err = amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
@@ -311,14 +311,14 @@ func TestHandleAccessMonitoringRule(t *testing.T) {
 		FetchRecipientCallback: mockFetchRecipient,
 	})
 
-	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects:  []string{types.KindAccessRequest},
 		Condition: "true",
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       "fakePluginName",
 			Recipients: []string{"a", "b"},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
@@ -326,14 +326,14 @@ func TestHandleAccessMonitoringRule(t *testing.T) {
 	})
 	require.Len(t, amrh.getAccessMonitoringRules(), 1)
 
-	rule2, err := services.NewAccessMonitoringRuleWithLabels("rule2", nil, &pb.AccessMonitoringRuleSpec{
+	rule2, err := services.NewAccessMonitoringRuleWithLabels("rule2", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects:  []string{types.KindAccessRequest},
 		Condition: "true",
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       "aDifferentFakePlugin",
 			Recipients: []string{"a", "b"},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
@@ -354,14 +354,14 @@ func TestHandleAccessMonitoringRulePluginNameMisMatch(t *testing.T) {
 		FetchRecipientCallback: mockFetchRecipient,
 	})
 
-	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, &pb.AccessMonitoringRuleSpec{
+	rule1, err := services.NewAccessMonitoringRuleWithLabels("rule1", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects:  []string{types.KindAccessRequest},
 		Condition: "true",
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       "notTheFakePluginName",
 			Recipients: []string{"a", "b"},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
@@ -369,14 +369,14 @@ func TestHandleAccessMonitoringRulePluginNameMisMatch(t *testing.T) {
 	})
 	require.Empty(t, amrh.getAccessMonitoringRules())
 
-	rule2, err := services.NewAccessMonitoringRuleWithLabels("rule2", nil, &pb.AccessMonitoringRuleSpec{
+	rule2, err := services.NewAccessMonitoringRuleWithLabels("rule2", nil, pb.AccessMonitoringRuleSpec_builder{
 		Subjects:  []string{types.KindAccessRequest},
 		Condition: "true",
-		Notification: &pb.Notification{
+		Notification: pb.Notification_builder{
 			Name:       "fakePluginName",
 			Recipients: []string{"c", "d"},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	amrh.HandleAccessMonitoringRule(context.Background(), types.Event{
 		Type:     types.OpPut,
diff --git a/integrations/access/datadog/testlib/suite.go b/integrations/access/datadog/testlib/suite.go
index 9d3225954bd..e77f1a2ff23 100644
--- a/integrations/access/datadog/testlib/suite.go
+++ b/integrations/access/datadog/testlib/suite.go
@@ -257,23 +257,23 @@ func (s *DatadogSuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-datadog-amr",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "datadog",
 					Recipients: []string{
 						integration.Reviewer1UserName,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	// Test execution: create an access request
@@ -312,23 +312,23 @@ func (s *DatadogSuiteOSS) TestRecipientsFromAccessMonitoringRuleAfterUpdate() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-datadog-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "datadog",
 					Recipients: []string{
 						integration.Reviewer1UserName,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	// Test execution: we create an access request
@@ -348,23 +348,23 @@ func (s *DatadogSuiteOSS) TestRecipientsFromAccessMonitoringRuleAfterUpdate() {
 	// Update the Access Monitoring Rule so it is no longer applied
 	_, err = s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		UpdateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		UpdateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-datadog-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{"someOtherKind"},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "datadog",
 					Recipients: []string{
 						integration.Reviewer1UserName,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	// Test execution: we create an access request
diff --git a/integrations/access/discord/testlib/suite.go b/integrations/access/discord/testlib/suite.go
index 6975c5f2d01..d5bafd7f4a4 100644
--- a/integrations/access/discord/testlib/suite.go
+++ b/integrations/access/discord/testlib/suite.go
@@ -633,24 +633,24 @@ func (s *DiscordSuiteOSS) TestMessagePostingWithAMR() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-slack-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "discord",
 					Recipients: []string{
 						"1001", // recipient 1
 						"1002", // recipient 2
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	userName := integration.RequesterOSSUserName
diff --git a/integrations/access/email/testlib/suite.go b/integrations/access/email/testlib/suite.go
index 0fc37177d52..bc63b86cf57 100644
--- a/integrations/access/email/testlib/suite.go
+++ b/integrations/access/email/testlib/suite.go
@@ -243,23 +243,23 @@ func (s *EmailSuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-email-amr",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "email",
 					Recipients: []string{
 						integration.Reviewer1UserName,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	// Test execution: create an access request
@@ -293,23 +293,23 @@ func (s *EmailSuiteOSS) TestRecipientsFromAccessMonitoringRuleAfterUpdate() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-email-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "email",
 					Recipients: []string{
 						integration.Reviewer1UserName,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	// Test execution: create an access request
@@ -326,23 +326,23 @@ func (s *EmailSuiteOSS) TestRecipientsFromAccessMonitoringRuleAfterUpdate() {
 	// Update the Access Monitoring Rule so it is no longer applied
 	_, err = s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		UpdateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		UpdateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-email-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{"someOtherKind"},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "email",
 					Recipients: []string{
 						integration.Reviewer1UserName,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	// Test execution: create an access request
diff --git a/integrations/access/mattermost/testlib/suite.go b/integrations/access/mattermost/testlib/suite.go
index b7a67da243a..abcd7dabec1 100644
--- a/integrations/access/mattermost/testlib/suite.go
+++ b/integrations/access/mattermost/testlib/suite.go
@@ -729,24 +729,24 @@ func (s *MattermostSuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-mattermost-amr",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "mattermost",
 					Recipients: []string{
 						"team-llama/channel-llama",
 						s.reviewer1MattermostUser.Email,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	userName := integration.RequesterOSSUserName
diff --git a/integrations/access/msteams/testlib/suite.go b/integrations/access/msteams/testlib/suite.go
index 1969b583e5a..f4a64d324dc 100644
--- a/integrations/access/msteams/testlib/suite.go
+++ b/integrations/access/msteams/testlib/suite.go
@@ -545,24 +545,24 @@ func (s *MsTeamsSuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-msteams-amr",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "msteams",
 					Recipients: []string{
 						s.reviewer1TeamsUser.ID,
 						s.reviewer2TeamsUser.Mail,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	// Test execution: create an access request
diff --git a/integrations/access/pagerduty/testlib/suite.go b/integrations/access/pagerduty/testlib/suite.go
index 8762380ede8..d9868da20c7 100644
--- a/integrations/access/pagerduty/testlib/suite.go
+++ b/integrations/access/pagerduty/testlib/suite.go
@@ -436,23 +436,23 @@ func (s *PagerdutySuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: ruleName,
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "pagerduty",
 					Recipients: []string{
 						NotifyServiceName2,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	// Incident creation may happen before plugins Access Monitoring Rule cache
diff --git a/integrations/access/servicenow/testlib/suite.go b/integrations/access/servicenow/testlib/suite.go
index 026751d5fe8..739221aba96 100644
--- a/integrations/access/servicenow/testlib/suite.go
+++ b/integrations/access/servicenow/testlib/suite.go
@@ -151,23 +151,23 @@ func (s *ServiceNowSuiteOSS) TestMessagePostingWithAMR() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-servicenow-amr",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "servicenow",
 					Recipients: []string{
 						"someReviewer", // recipient 1
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	// Test execution: we create a new access request.
diff --git a/integrations/access/slack/testlib/suite.go b/integrations/access/slack/testlib/suite.go
index 0491daab131..dd83e46a110 100644
--- a/integrations/access/slack/testlib/suite.go
+++ b/integrations/access/slack/testlib/suite.go
@@ -261,24 +261,24 @@ func (s *SlackSuiteOSS) TestRecipientsFromAccessMonitoringRule() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-slack-amr",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "slack",
 					Recipients: []string{
 						s.reviewer1SlackUser.ID,
 						s.reviewer2SlackUser.Profile.Email,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	// Test execution: we create an access request
@@ -334,24 +334,24 @@ func (s *SlackSuiteOSS) TestRecipientsFromAccessMonitoringRuleAfterUpdate() {
 
 	_, err := s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		CreateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		CreateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-slack-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{types.KindAccessRequest},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "slack",
 					Recipients: []string{
 						s.reviewer1SlackUser.ID,
 						s.reviewer2SlackUser.Profile.Email,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	// Test execution: we create an access request
@@ -387,24 +387,24 @@ func (s *SlackSuiteOSS) TestRecipientsFromAccessMonitoringRuleAfterUpdate() {
 
 	_, err = s.ClientByName(integration.RulerUserName).
 		AccessMonitoringRulesClient().
-		UpdateAccessMonitoringRule(ctx, &accessmonitoringrulesv1.AccessMonitoringRule{
+		UpdateAccessMonitoringRule(ctx, accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: "test-slack-amr-2",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{"someOtherKind"},
 				Condition: "!is_empty(access_request.spec.roles)",
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name: "slack",
 					Recipients: []string{
 						s.reviewer1SlackUser.ID,
 						s.reviewer2SlackUser.Profile.Email,
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	assert.NoError(t, err)
 
 	messages = []slack.Message{}
diff --git a/integrations/lib/embeddedtbot/bot_test.go b/integrations/lib/embeddedtbot/bot_test.go
index eda0ab8f2bb..f0fc7ed2afe 100644
--- a/integrations/lib/embeddedtbot/bot_test.go
+++ b/integrations/lib/embeddedtbot/bot_test.go
@@ -290,70 +290,70 @@ func TestScopedBotJoinAuth(t *testing.T) {
 	)
 
 	// Role impersonated by the bot.
-	botRole := &scopedaccessv1.ScopedRole{
+	botRole := scopedaccessv1.ScopedRole_builder{
 		Kind:    scopedaccess.KindScopedRole,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: testBotRole,
-		},
+		}.Build(),
 		Scope: testRootScope,
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{testRootScope},
 			Rules: []*scopedaccessv1.ScopedRule{
 				// The role can read scoped roles. We will use this to validate its permissions later.
-				{
+				scopedaccessv1.ScopedRule_builder{
 					Resources: []string{scopedaccess.KindScopedRole},
 					Verbs:     []string{types.VerbReadNoSecrets},
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	require.NoError(t, scopedaccess.StrongValidateRole(botRole), "malformed role, this is a bug in the test fixture")
-	_, err = adminClient.ScopedAccessServiceClient().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	_, err = adminClient.ScopedAccessServiceClient().CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: botRole,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// Create the bot.
-	botResource := &machineidv1.Bot{
+	botResource := machineidv1.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: testBotName,
-		},
+		}.Build(),
 		Spec:  &machineidv1.BotSpec{},
 		Scope: testRootScope,
-	}
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
+	}.Build()
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1.CreateBotRequest_builder{
 		Bot: botResource,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// Assign role to bot
-	roleAssignment := &scopedaccessv1.ScopedRoleAssignment{
+	roleAssignment := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: testBotRole,
-		},
+		}.Build(),
 		Scope: testRootScope,
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  testBotRole,
 					Scope: testRootScope,
-				},
+				}.Build(),
 			},
 			BotName:  testBotName,
 			BotScope: testRootScope,
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = adminClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(
 		ctx,
-		&scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: roleAssignment,
-		})
+		}.Build())
 	require.NoError(t, err)
 
 	// Test setup: Wait for the role assignment to enter the auth server cache
@@ -361,14 +361,14 @@ func TestScopedBotJoinAuth(t *testing.T) {
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		resp, err := adminClient.ScopedAccessServiceClient().GetScopedRoleAssignment(
 			ctx,
-			&scopedaccessv1.GetScopedRoleAssignmentRequest{
+			scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 				Name:    testBotRole,
 				SubKind: scopedaccess.SubKindDynamic,
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 		require.NotNil(t, resp)
-		require.NotNil(t, resp.Assignment)
+		require.NotNil(t, resp.GetAssignment())
 	}, 5*time.Second, 100*time.Millisecond, "expected role assignment to enter the auth cache")
 
 	// Test setup: Create a fake Kubernetes JWKS signer that will be used by the bot to join the cluster.
@@ -389,33 +389,33 @@ func TestScopedBotJoinAuth(t *testing.T) {
 	require.NoError(t, os.WriteFile(tokenPath, []byte(jwt), 0600))
 
 	// Test setup: Create the scoped token allowing the Bot to join with a JWT emitted by the Kube signer.
-	token := &scopedjoiningv1.ScopedToken{
+	token := scopedjoiningv1.ScopedToken_builder{
 		Kind:     scopedaccess.KindScopedToken,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: testTokenName},
+		Metadata: headerv1.Metadata_builder{Name: testTokenName}.Build(),
 		Scope:    testRootScope,
-		Spec: &scopedjoiningv1.ScopedTokenSpec{
+		Spec: scopedjoiningv1.ScopedTokenSpec_builder{
 			JoinMethod: string(types.JoinMethodKubernetes),
 			UsageMode:  scopedjoining.TokenUsageModeBot,
-			Kubernetes: &scopedjoiningv1.Kubernetes{
+			Kubernetes: scopedjoiningv1.Kubernetes_builder{
 				Allow: []*scopedjoiningv1.Kubernetes_Rule{
-					{
+					scopedjoiningv1.Kubernetes_Rule_builder{
 						ServiceAccount: testNamespace + ":" + testServiceAccount,
-					},
+					}.Build(),
 				},
 				Type:       string(types.KubernetesJoinTypeStaticJWKS),
-				StaticJwks: &scopedjoiningv1.Kubernetes_StaticJWKSConfig{Jwks: jwks},
-			},
+				StaticJwks: scopedjoiningv1.Kubernetes_StaticJWKSConfig_builder{Jwks: jwks}.Build(),
+			}.Build(),
 			BotName:  testBotName,
 			BotScope: testRootScope,
 			Roles:    []string{string(types.RoleBot)},
-		},
-	}
+		}.Build(),
+	}.Build()
 	// Somehow the admin client interface doesn't expose CreateScopedToken ¯\_(ツ)_/¯
 	// We use the auth server directly to create the scoped token.
-	_, err = teleportServer.Process.GetAuthServer().CreateScopedToken(ctx, &scopedjoiningv1.CreateScopedTokenRequest{
+	_, err = teleportServer.Process.GetAuthServer().CreateScopedToken(ctx, scopedjoiningv1.CreateScopedTokenRequest_builder{
 		Token: token,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// Test setup: Configure the bot to join the auth using the scoped join token and the JWT.
@@ -452,8 +452,8 @@ func TestScopedBotJoinAuth(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, clusterName, botPong.ClusterName)
 
-	_, err = botClient.ScopedAccessServiceClient().GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	_, err = botClient.ScopedAccessServiceClient().GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: testBotRole,
-	})
+	}.Build())
 	require.NoError(t, err)
 }
diff --git a/integrations/operator/apis/resources/v1/accessmonitoringrulev1_types.go b/integrations/operator/apis/resources/v1/accessmonitoringrulev1_types.go
index e4852e9afc1..8036defd1f6 100644
--- a/integrations/operator/apis/resources/v1/accessmonitoringrulev1_types.go
+++ b/integrations/operator/apis/resources/v1/accessmonitoringrulev1_types.go
@@ -59,16 +59,16 @@ type TeleportAccessMonitoringRuleV1List struct {
 
 // ToTeleport returns an AccessMonitoringRule that can be sent to Teleport.
 func (l *TeleportAccessMonitoringRuleV1) ToTeleport() *accessmonitoringrulesv1pb.AccessMonitoringRule {
-	resource := &accessmonitoringrulesv1pb.AccessMonitoringRule{
+	resource := accessmonitoringrulesv1pb.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        l.Name,
 			Description: l.Annotations[teleportcr.DescriptionKey],
 			Labels:      l.Labels,
-		},
+		}.Build(),
 		Spec: (*accessmonitoringrulesv1pb.AccessMonitoringRuleSpec)(l.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/autoupdateconfigv1_types.go b/integrations/operator/apis/resources/v1/autoupdateconfigv1_types.go
index df0be6bfa98..7006fb28596 100644
--- a/integrations/operator/apis/resources/v1/autoupdateconfigv1_types.go
+++ b/integrations/operator/apis/resources/v1/autoupdateconfigv1_types.go
@@ -65,16 +65,16 @@ type TeleportAutoupdateConfigV1List struct {
 
 // ToTeleport returns an AutoUpdateConfig that can be sent to Teleport.
 func (l *TeleportAutoupdateConfigV1) ToTeleport() *autoupdatev1pb.AutoUpdateConfig {
-	resource := &autoupdatev1pb.AutoUpdateConfig{
+	resource := autoupdatev1pb.AutoUpdateConfig_builder{
 		Kind:    types.KindAutoUpdateConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        l.Name,
 			Description: l.Annotations[teleportcr.DescriptionKey],
 			Labels:      l.Labels,
-		},
+		}.Build(),
 		Spec: (*autoupdatev1pb.AutoUpdateConfigSpec)(l.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/autoupdateversionv1_types.go b/integrations/operator/apis/resources/v1/autoupdateversionv1_types.go
index 3f127165397..217f6cca061 100644
--- a/integrations/operator/apis/resources/v1/autoupdateversionv1_types.go
+++ b/integrations/operator/apis/resources/v1/autoupdateversionv1_types.go
@@ -65,16 +65,16 @@ type TeleportAutoupdateVersionV1List struct {
 
 // ToTeleport returns an AutoUpdateVersion that can be sent to Teleport.
 func (l *TeleportAutoupdateVersionV1) ToTeleport() *autoupdatev1pb.AutoUpdateVersion {
-	resource := &autoupdatev1pb.AutoUpdateVersion{
+	resource := autoupdatev1pb.AutoUpdateVersion_builder{
 		Kind:    types.KindAutoUpdateVersion,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        l.Name,
 			Description: l.Annotations[teleportcr.DescriptionKey],
 			Labels:      l.Labels,
-		},
+		}.Build(),
 		Spec: (*autoupdatev1pb.AutoUpdateVersionSpec)(l.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/botv1_types.go b/integrations/operator/apis/resources/v1/botv1_types.go
index dd9f524cb49..266a708e96a 100644
--- a/integrations/operator/apis/resources/v1/botv1_types.go
+++ b/integrations/operator/apis/resources/v1/botv1_types.go
@@ -62,17 +62,17 @@ type TeleportBotV1List struct {
 // [machineidv1.Bot] and implements the necessary interface methods used
 // by the TeleportResourceReconciler.
 func (l *TeleportBotV1) ToTeleport() *machineidv1.Bot {
-	resource := &machineidv1.Bot{
+	resource := machineidv1.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        l.Name,
 			Description: l.Annotations[teleportcr.DescriptionKey],
 			Labels:      l.Labels,
-		},
+		}.Build(),
 		Spec:  (*machineidv1.BotSpec)(l.Spec),
 		Scope: l.Scope,
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/inference_model_types.go b/integrations/operator/apis/resources/v1/inference_model_types.go
index f5e1423207a..f94e11b4208 100644
--- a/integrations/operator/apis/resources/v1/inference_model_types.go
+++ b/integrations/operator/apis/resources/v1/inference_model_types.go
@@ -60,16 +60,16 @@ type TeleportInferenceModelList struct {
 
 // ToTeleport returns a Teleport representation of this Kubernetes resource.
 func (m *TeleportInferenceModel) ToTeleport() *summarizerv1.InferenceModel {
-	resource := &summarizerv1.InferenceModel{
+	resource := summarizerv1.InferenceModel_builder{
 		Kind:    types.KindInferenceModel,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        m.Name,
 			Description: m.Annotations[teleportcr.DescriptionKey],
 			Labels:      m.Labels,
-		},
+		}.Build(),
 		Spec: (*summarizerv1.InferenceModelSpec)(m.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/inference_policy_types.go b/integrations/operator/apis/resources/v1/inference_policy_types.go
index 36a9b9d5c7d..d04af9ededf 100644
--- a/integrations/operator/apis/resources/v1/inference_policy_types.go
+++ b/integrations/operator/apis/resources/v1/inference_policy_types.go
@@ -60,16 +60,16 @@ type TeleportInferencePolicyList struct {
 
 // ToTeleport returns a Teleport representation of this Kubernetes resource.
 func (p *TeleportInferencePolicy) ToTeleport() *summarizerv1.InferencePolicy {
-	resource := &summarizerv1.InferencePolicy{
+	resource := summarizerv1.InferencePolicy_builder{
 		Kind:    types.KindInferencePolicy,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        p.Name,
 			Description: p.Annotations[teleportcr.DescriptionKey],
 			Labels:      p.Labels,
-		},
+		}.Build(),
 		Spec: (*summarizerv1.InferencePolicySpec)(p.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/inference_secret_types.go b/integrations/operator/apis/resources/v1/inference_secret_types.go
index 5e071cf88e3..824f9437153 100644
--- a/integrations/operator/apis/resources/v1/inference_secret_types.go
+++ b/integrations/operator/apis/resources/v1/inference_secret_types.go
@@ -60,16 +60,16 @@ type TeleportInferenceSecretList struct {
 
 // ToTeleport returns a Teleport representation of this Kubernetes resource.
 func (s *TeleportInferenceSecret) ToTeleport() *summarizerv1.InferenceSecret {
-	resource := &summarizerv1.InferenceSecret{
+	resource := summarizerv1.InferenceSecret_builder{
 		Kind:    types.KindInferenceSecret,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        s.Name,
 			Description: s.Annotations[teleportcr.DescriptionKey],
 			Labels:      s.Labels,
-		},
+		}.Build(),
 		Spec: (*summarizerv1.InferenceSecretSpec)(s.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/loginrule_types.go b/integrations/operator/apis/resources/v1/loginrule_types.go
index 4937e85f0a2..bdcb734c475 100644
--- a/integrations/operator/apis/resources/v1/loginrule_types.go
+++ b/integrations/operator/apis/resources/v1/loginrule_types.go
@@ -65,7 +65,7 @@ type TeleportLoginRuleList struct {
 // by the TeleportResourceReconciler.
 func (l TeleportLoginRule) ToTeleport() *LoginRuleResource {
 	resource := &LoginRuleResource{
-		LoginRule: &loginrulepb.LoginRule{
+		LoginRule: loginrulepb.LoginRule_builder{
 			Metadata: &types.Metadata{
 				Name:        l.Name,
 				Labels:      l.Labels,
@@ -74,13 +74,13 @@ func (l TeleportLoginRule) ToTeleport() *LoginRuleResource {
 			Version:          types.V1,
 			Priority:         l.Spec.Priority,
 			TraitsExpression: l.Spec.TraitsExpression,
-		},
+		}.Build(),
 	}
 	if len(l.Spec.TraitsMap) > 0 {
-		resource.LoginRule.TraitsMap = make(map[string]*wrappers.StringValues, len(l.Spec.TraitsMap))
+		resource.LoginRule.SetTraitsMap(make(map[string]*wrappers.StringValues, len(l.Spec.TraitsMap)))
 	}
 	for traitKey, traitExpressions := range l.Spec.TraitsMap {
-		resource.LoginRule.TraitsMap[traitKey] = &wrappers.StringValues{Values: traitExpressions}
+		resource.LoginRule.GetTraitsMap()[traitKey] = &wrappers.StringValues{Values: traitExpressions}
 	}
 	return resource
 }
@@ -100,21 +100,21 @@ type LoginRuleResource struct {
 }
 
 func (l *LoginRuleResource) GetName() string {
-	return l.LoginRule.Metadata.Name
+	return l.LoginRule.GetMetadata().Name
 }
 
 func (l *LoginRuleResource) SetOrigin(origin string) {
-	l.LoginRule.Metadata.SetOrigin(origin)
+	l.LoginRule.GetMetadata().SetOrigin(origin)
 }
 
 func (l *LoginRuleResource) Origin() string {
-	return l.LoginRule.Metadata.Origin()
+	return l.LoginRule.GetMetadata().Origin()
 }
 
 func (l *LoginRuleResource) GetRevision() string {
-	return l.LoginRule.Metadata.GetRevision()
+	return l.LoginRule.GetMetadata().GetRevision()
 }
 
 func (l *LoginRuleResource) SetRevision(rev string) {
-	l.LoginRule.Metadata.SetRevision(rev)
+	l.LoginRule.GetMetadata().SetRevision(rev)
 }
diff --git a/integrations/operator/apis/resources/v1/retrieval_model_types.go b/integrations/operator/apis/resources/v1/retrieval_model_types.go
index 9742c79458f..1fa76116759 100644
--- a/integrations/operator/apis/resources/v1/retrieval_model_types.go
+++ b/integrations/operator/apis/resources/v1/retrieval_model_types.go
@@ -62,16 +62,16 @@ type TeleportRetrievalModelV1List struct {
 // the Kubernetes CR name, because RetrievalModel is a singleton that can only
 // exist under that fixed name.
 func (l *TeleportRetrievalModelV1) ToTeleport() *summarizerv1.RetrievalModel {
-	resource := &summarizerv1.RetrievalModel{
+	resource := summarizerv1.RetrievalModel_builder{
 		Kind:    types.KindRetrievalModel,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        types.MetaNameRetrievalModel,
 			Description: l.Annotations[teleportcr.DescriptionKey],
 			Labels:      l.Labels,
-		},
+		}.Build(),
 		Spec: (*summarizerv1.RetrievalModelSpec)(l.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/scopedrole_types.go b/integrations/operator/apis/resources/v1/scopedrole_types.go
index 1c66550a16f..8b6b52fb3fb 100644
--- a/integrations/operator/apis/resources/v1/scopedrole_types.go
+++ b/integrations/operator/apis/resources/v1/scopedrole_types.go
@@ -60,17 +60,17 @@ type TeleportScopedRoleV1List struct {
 
 // ToTeleport returns a Teleport representation of this Kubernetes resource.
 func (m *TeleportScopedRoleV1) ToTeleport() *accessv1.ScopedRole {
-	resource := &accessv1.ScopedRole{
+	resource := accessv1.ScopedRole_builder{
 		Kind:    access.KindScopedRole,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        m.Name,
 			Description: m.Annotations[teleportcr.DescriptionKey],
 			Labels:      m.Labels,
-		},
+		}.Build(),
 		Scope: m.Scope,
 		Spec:  (*accessv1.ScopedRoleSpec)(m.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/scopedroleassignment_types.go b/integrations/operator/apis/resources/v1/scopedroleassignment_types.go
index 9cd3786c2a8..1df03cee853 100644
--- a/integrations/operator/apis/resources/v1/scopedroleassignment_types.go
+++ b/integrations/operator/apis/resources/v1/scopedroleassignment_types.go
@@ -60,18 +60,18 @@ type TeleportScopedRoleAssignmentV1List struct {
 
 // ToTeleport returns a Teleport representation of this Kubernetes resource.
 func (m *TeleportScopedRoleAssignmentV1) ToTeleport() *accessv1.ScopedRoleAssignment {
-	resource := &accessv1.ScopedRoleAssignment{
+	resource := accessv1.ScopedRoleAssignment_builder{
 		Kind:    access.KindScopedRoleAssignment,
 		SubKind: access.SubKindDynamic,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        m.Name,
 			Description: m.Annotations[teleportcr.DescriptionKey],
 			Labels:      m.Labels,
-		},
+		}.Build(),
 		Scope: m.Scope,
 		Spec:  (*accessv1.ScopedRoleAssignmentSpec)(m.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/scopedtoken_types.go b/integrations/operator/apis/resources/v1/scopedtoken_types.go
index 62ee5f3020c..2372730ac7b 100644
--- a/integrations/operator/apis/resources/v1/scopedtoken_types.go
+++ b/integrations/operator/apis/resources/v1/scopedtoken_types.go
@@ -59,17 +59,17 @@ type TeleportScopedTokenV1List struct {
 
 // ToTeleport returns a Teleport representation of this Kubernetes resource.
 func (m *TeleportScopedTokenV1) ToTeleport() *tokenv1.ScopedToken {
-	resource := &tokenv1.ScopedToken{
+	resource := tokenv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        m.Name,
 			Description: m.Annotations[teleportcr.DescriptionKey],
 			Labels:      m.Labels,
-		},
+		}.Build(),
 		Scope: m.Scope,
 		Spec:  (*tokenv1.ScopedTokenSpec)(m.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/apis/resources/v1/workload_identityv1_types.go b/integrations/operator/apis/resources/v1/workload_identityv1_types.go
index 9ac642f8b88..74d89794802 100644
--- a/integrations/operator/apis/resources/v1/workload_identityv1_types.go
+++ b/integrations/operator/apis/resources/v1/workload_identityv1_types.go
@@ -62,16 +62,16 @@ type TeleportWorkloadIdentityV1List struct {
 // [workloadidentityv1.WorkloadIdentity] and implements the necessary interface
 // methods used by the TeleportResourceReconciler.
 func (l *TeleportWorkloadIdentityV1) ToTeleport() *workloadidentityv1.WorkloadIdentity {
-	resource := &workloadidentityv1.WorkloadIdentity{
+	resource := workloadidentityv1.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        l.Name,
 			Description: l.Annotations[teleportcr.DescriptionKey],
 			Labels:      l.Labels,
-		},
+		}.Build(),
 		Spec: (*workloadidentityv1.WorkloadIdentitySpec)(l.Spec),
-	}
+	}.Build()
 	return resource
 }
 
diff --git a/integrations/operator/controllers/reconcilers/resource153.go b/integrations/operator/controllers/reconcilers/resource153.go
index f6466172f52..d0d615a592a 100644
--- a/integrations/operator/controllers/reconcilers/resource153.go
+++ b/integrations/operator/controllers/reconcilers/resource153.go
@@ -57,12 +57,12 @@ func (a Resource153Adapter[T]) GetResourceOrigin(res T) string {
 
 // SetResourceRevision implements the Adapter interface.
 func (a Resource153Adapter[T]) SetResourceRevision(res T, revision string) {
-	res.GetMetadata().Revision = revision
+	res.GetMetadata().SetRevision(revision)
 }
 
 // SetResourceLabels implements the Adapter interface.
 func (a Resource153Adapter[T]) SetResourceLabels(res T, labels map[string]string) {
-	res.GetMetadata().Labels = labels
+	res.GetMetadata().SetLabels(labels)
 }
 
 // NewTeleportResource153Reconciler instantiates a resourceReconciler for a
diff --git a/integrations/operator/controllers/resources/accessmonitoringrulev1_controller_test.go b/integrations/operator/controllers/resources/accessmonitoringrulev1_controller_test.go
index 7698717bbbb..f21733778eb 100644
--- a/integrations/operator/controllers/resources/accessmonitoringrulev1_controller_test.go
+++ b/integrations/operator/controllers/resources/accessmonitoringrulev1_controller_test.go
@@ -36,14 +36,14 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 )
 
-var accessMonitoringRuleSpec = &accessmonitoringrulesv1pb.AccessMonitoringRuleSpec{
+var accessMonitoringRuleSpec = accessmonitoringrulesv1pb.AccessMonitoringRuleSpec_builder{
 	Subjects:  []string{types.KindAccessRequest},
 	Condition: "access_request.spec.roles.contains(\"your_role_name\")",
-	Notification: &accessmonitoringrulesv1pb.Notification{
+	Notification: accessmonitoringrulesv1pb.Notification_builder{
 		Name:       "slack",
 		Recipients: []string{"your-slack-channel"},
-	},
-}
+	}.Build(),
+}.Build()
 
 type accessMonitoringRuleTestingPrimitives struct {
 	setup *testSetup
@@ -59,17 +59,17 @@ func (g *accessMonitoringRuleTestingPrimitives) SetupTeleportFixtures(ctx contex
 }
 
 func (g *accessMonitoringRuleTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	accessMonitoringRule := &accessmonitoringrulesv1pb.AccessMonitoringRule{
+	accessMonitoringRule := accessmonitoringrulesv1pb.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: accessMonitoringRuleSpec,
-	}
+	}.Build()
 	_, err := g.setup.TeleportClient.AccessMonitoringRulesClient().
 		CreateAccessMonitoringRule(ctx, accessMonitoringRule)
 	return trace.Wrap(err)
@@ -124,7 +124,7 @@ func (g *accessMonitoringRuleTestingPrimitives) ModifyKubernetesResource(ctx con
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	accessMonitoringRule.Spec.Notification.Recipients = []string{"your-slack-channel", "your-other-slack-channel"}
+	accessMonitoringRule.Spec.Notification.SetRecipients([]string{"your-slack-channel", "your-other-slack-channel"})
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, accessMonitoringRule))
 }
 
diff --git a/integrations/operator/controllers/resources/autoupdateconfig_controller_test.go b/integrations/operator/controllers/resources/autoupdateconfig_controller_test.go
index 680202706b2..452ff9657c5 100644
--- a/integrations/operator/controllers/resources/autoupdateconfig_controller_test.go
+++ b/integrations/operator/controllers/resources/autoupdateconfig_controller_test.go
@@ -38,35 +38,35 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 )
 
-var autoUpdateConfigSpec = &autoupdatev1pb.AutoUpdateConfigSpec{
+var autoUpdateConfigSpec = autoupdatev1pb.AutoUpdateConfigSpec_builder{
 	Tools: nil,
-	Agents: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+	Agents: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 		Mode:     autoupdate.AgentsUpdateModeEnabled,
 		Strategy: autoupdate.AgentsStrategyHaltOnError,
-		Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+		Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 			Regular: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "dev",
 					Days:      []string{"*"},
 					StartHour: 12,
 					WaitHours: 0,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "stage",
 					Days:      []string{"*"},
 					StartHour: 12,
 					WaitHours: 24,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "prod",
 					Days:      []string{"Mon", "Tue", "Wed", "Thu"},
 					StartHour: 12,
 					WaitHours: 24,
-				},
+				}.Build(),
 			},
-		},
-	},
-}
+		}.Build(),
+	}.Build(),
+}.Build()
 
 type autoUpdateConfigTestingPrimitives struct {
 	setup *testSetup
@@ -82,17 +82,17 @@ func (g *autoUpdateConfigTestingPrimitives) SetupTeleportFixtures(ctx context.Co
 }
 
 func (g *autoUpdateConfigTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	autoUpdateConfig := &autoupdatev1pb.AutoUpdateConfig{
+	autoUpdateConfig := autoupdatev1pb.AutoUpdateConfig_builder{
 		Kind:    types.KindAutoUpdateConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateConfig,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: autoUpdateConfigSpec,
-	}
+	}.Build()
 	_, err := g.setup.TeleportClient.
 		CreateAutoUpdateConfig(ctx, autoUpdateConfig)
 	return trace.Wrap(err)
@@ -147,10 +147,10 @@ func (g *autoUpdateConfigTestingPrimitives) ModifyKubernetesResource(ctx context
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	autoUpdateConfig.Spec.Agents.Mode = autoupdate.AgentsUpdateModeSuspended
-	autoUpdateConfig.Spec.Tools = &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	autoUpdateConfig.Spec.Agents.SetMode(autoupdate.AgentsUpdateModeSuspended)
+	autoUpdateConfig.Spec.Tools = autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 		Mode: autoupdate.ToolsUpdateModeEnabled,
-	}
+	}.Build()
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, autoUpdateConfig))
 }
 
diff --git a/integrations/operator/controllers/resources/autoupdateversion_controller_test.go b/integrations/operator/controllers/resources/autoupdateversion_controller_test.go
index bbd0a8de6e5..db74091d6df 100644
--- a/integrations/operator/controllers/resources/autoupdateversion_controller_test.go
+++ b/integrations/operator/controllers/resources/autoupdateversion_controller_test.go
@@ -38,15 +38,15 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 )
 
-var autoUpdateVersionSpec = &autoupdatev1pb.AutoUpdateVersionSpec{
+var autoUpdateVersionSpec = autoupdatev1pb.AutoUpdateVersionSpec_builder{
 	Tools: nil,
-	Agents: &autoupdatev1pb.AutoUpdateVersionSpecAgents{
+	Agents: autoupdatev1pb.AutoUpdateVersionSpecAgents_builder{
 		StartVersion:  "1.2.3",
 		TargetVersion: "1.2.4",
 		Schedule:      autoupdate.AgentsScheduleRegular,
 		Mode:          autoupdate.AgentsUpdateModeEnabled,
-	},
-}
+	}.Build(),
+}.Build()
 
 type autoUpdateVersionTestingPrimitives struct {
 	setup *testSetup
@@ -62,17 +62,17 @@ func (g *autoUpdateVersionTestingPrimitives) SetupTeleportFixtures(ctx context.C
 }
 
 func (g *autoUpdateVersionTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	autoUpdateVersion := &autoupdatev1pb.AutoUpdateVersion{
+	autoUpdateVersion := autoupdatev1pb.AutoUpdateVersion_builder{
 		Kind:    types.KindAutoUpdateVersion,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateVersion,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: autoUpdateVersionSpec,
-	}
+	}.Build()
 	_, err := g.setup.TeleportClient.
 		CreateAutoUpdateVersion(ctx, autoUpdateVersion)
 	return trace.Wrap(err)
@@ -127,10 +127,10 @@ func (g *autoUpdateVersionTestingPrimitives) ModifyKubernetesResource(ctx contex
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	autoUpdateVersion.Spec.Agents.Mode = autoupdate.AgentsUpdateModeSuspended
-	autoUpdateVersion.Spec.Tools = &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	autoUpdateVersion.Spec.Agents.SetMode(autoupdate.AgentsUpdateModeSuspended)
+	autoUpdateVersion.Spec.Tools = autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 		TargetVersion: "1.2.4",
-	}
+	}.Build()
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, autoUpdateVersion))
 }
 
diff --git a/integrations/operator/controllers/resources/botv1_controller.go b/integrations/operator/controllers/resources/botv1_controller.go
index c7ddffd9844..7f280e77bbf 100644
--- a/integrations/operator/controllers/resources/botv1_controller.go
+++ b/integrations/operator/controllers/resources/botv1_controller.go
@@ -40,7 +40,7 @@ type botClient struct {
 func (l botClient) Get(ctx context.Context, name string) (*machineidv1.Bot, error) {
 	resp, err := l.teleportClient.
 		BotServiceClient().
-		GetBot(ctx, &machineidv1.GetBotRequest{BotName: name})
+		GetBot(ctx, machineidv1.GetBotRequest_builder{BotName: name}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -51,7 +51,7 @@ func (l botClient) Get(ctx context.Context, name string) (*machineidv1.Bot, erro
 func (l botClient) Create(ctx context.Context, resource *machineidv1.Bot) error {
 	_, err := l.teleportClient.
 		BotServiceClient().
-		CreateBot(ctx, &machineidv1.CreateBotRequest{Bot: resource})
+		CreateBot(ctx, machineidv1.CreateBotRequest_builder{Bot: resource}.Build())
 	return trace.Wrap(err)
 }
 
@@ -59,7 +59,7 @@ func (l botClient) Create(ctx context.Context, resource *machineidv1.Bot) error
 func (l botClient) Update(ctx context.Context, resource *machineidv1.Bot) error {
 	_, err := l.teleportClient.
 		BotServiceClient().
-		UpsertBot(ctx, &machineidv1.UpsertBotRequest{Bot: resource})
+		UpsertBot(ctx, machineidv1.UpsertBotRequest_builder{Bot: resource}.Build())
 	return trace.Wrap(err)
 }
 
@@ -67,7 +67,7 @@ func (l botClient) Update(ctx context.Context, resource *machineidv1.Bot) error
 func (l botClient) Delete(ctx context.Context, name string) error {
 	_, err := l.teleportClient.
 		BotServiceClient().
-		DeleteBot(ctx, &machineidv1.DeleteBotRequest{BotName: name})
+		DeleteBot(ctx, machineidv1.DeleteBotRequest_builder{BotName: name}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/integrations/operator/controllers/resources/botv1_controller_test.go b/integrations/operator/controllers/resources/botv1_controller_test.go
index c0a8c0a726a..2673e13faae 100644
--- a/integrations/operator/controllers/resources/botv1_controller_test.go
+++ b/integrations/operator/controllers/resources/botv1_controller_test.go
@@ -40,22 +40,22 @@ import (
 	"github.com/gravitational/teleport/lib/defaults"
 )
 
-var botSpec = &machineidv1.BotSpec{
+var botSpec = machineidv1.BotSpec_builder{
 	Roles: []string{"roleA", "roleB"},
 	Traits: []*machineidv1.Trait{
-		{
+		machineidv1.Trait_builder{
 			Name:   "traitA",
 			Values: []string{"valueA", "valueB"},
-		},
-		{
+		}.Build(),
+		machineidv1.Trait_builder{
 			Name:   "traitB",
 			Values: []string{"valueC", "valueD"},
-		},
+		}.Build(),
 	},
 	// Note: The server-side resource will have the default value filled in, so
 	// we need to explicitly set it to ensure comparisons succeed.
 	MaxSessionTtl: durationpb.New(defaults.DefaultBotMaxSessionTTL),
-}
+}.Build()
 
 type botTestingPrimitives struct {
 	setup *testSetup
@@ -71,27 +71,27 @@ func (g *botTestingPrimitives) SetupTeleportFixtures(ctx context.Context) error
 }
 
 func (g *botTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	bot := &machineidv1.Bot{
+	bot := machineidv1.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: botSpec,
-	}
+	}.Build()
 	_, err := g.setup.TeleportClient.
 		BotServiceClient().
-		CreateBot(ctx, &machineidv1.CreateBotRequest{Bot: bot})
+		CreateBot(ctx, machineidv1.CreateBotRequest_builder{Bot: bot}.Build())
 	return trace.Wrap(err)
 }
 
 func (g *botTestingPrimitives) GetTeleportResource(ctx context.Context, name string) (*machineidv1.Bot, error) {
 	resp, err := g.setup.TeleportClient.
 		BotServiceClient().
-		GetBot(ctx, &machineidv1.GetBotRequest{BotName: name})
+		GetBot(ctx, machineidv1.GetBotRequest_builder{BotName: name}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -101,7 +101,7 @@ func (g *botTestingPrimitives) GetTeleportResource(ctx context.Context, name str
 func (g *botTestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
 	_, err := g.setup.TeleportClient.
 		BotServiceClient().
-		DeleteBot(ctx, &machineidv1.DeleteBotRequest{BotName: name})
+		DeleteBot(ctx, machineidv1.DeleteBotRequest_builder{BotName: name}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -156,7 +156,7 @@ func (g *botTestingPrimitives) CompareTeleportAndKubernetesResource(
 		testlib.ProtoCompareOptions(
 			protocmp.IgnoreFields(&machineidv1.Bot{}, "status"),
 			protocmp.SortRepeated(func(a, b *machineidv1.Trait) bool {
-				return strings.Compare(a.Name, b.Name) == -1
+				return strings.Compare(a.GetName(), b.GetName()) == -1
 			}),
 		)...,
 	)
diff --git a/integrations/operator/controllers/resources/inference_model_controller.go b/integrations/operator/controllers/resources/inference_model_controller.go
index 075cb852679..25c91a9a2b2 100644
--- a/integrations/operator/controllers/resources/inference_model_controller.go
+++ b/integrations/operator/controllers/resources/inference_model_controller.go
@@ -40,13 +40,13 @@ func (c inferenceModelClient) Get(
 	ctx context.Context, name string,
 ) (*summarizerv1.InferenceModel, error) {
 	resp, err := c.teleportClient.SummarizerServiceClient().GetInferenceModel(
-		ctx, &summarizerv1.GetInferenceModelRequest{Name: name},
+		ctx, summarizerv1.GetInferenceModelRequest_builder{Name: name}.Build(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return resp.Model, nil
+	return resp.GetModel(), nil
 }
 
 // Create creates an inference model in Teleport.
@@ -54,7 +54,7 @@ func (c inferenceModelClient) Create(
 	ctx context.Context, model *summarizerv1.InferenceModel,
 ) error {
 	_, err := c.teleportClient.SummarizerServiceClient().CreateInferenceModel(
-		ctx, &summarizerv1.CreateInferenceModelRequest{Model: model},
+		ctx, summarizerv1.CreateInferenceModelRequest_builder{Model: model}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -64,7 +64,7 @@ func (c inferenceModelClient) Update(
 	ctx context.Context, model *summarizerv1.InferenceModel,
 ) error {
 	_, err := c.teleportClient.SummarizerServiceClient().UpdateInferenceModel(
-		ctx, &summarizerv1.UpdateInferenceModelRequest{Model: model},
+		ctx, summarizerv1.UpdateInferenceModelRequest_builder{Model: model}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -72,7 +72,7 @@ func (c inferenceModelClient) Update(
 // Delete deletes an inference model with a given name from Teleport.
 func (c inferenceModelClient) Delete(ctx context.Context, name string) error {
 	_, err := c.teleportClient.SummarizerServiceClient().DeleteInferenceModel(
-		ctx, &summarizerv1.DeleteInferenceModelRequest{Name: name},
+		ctx, summarizerv1.DeleteInferenceModelRequest_builder{Name: name}.Build(),
 	)
 	return trace.Wrap(err)
 }
diff --git a/integrations/operator/controllers/resources/inference_policy_controller.go b/integrations/operator/controllers/resources/inference_policy_controller.go
index b22188ce6c4..8f6d4fefb52 100644
--- a/integrations/operator/controllers/resources/inference_policy_controller.go
+++ b/integrations/operator/controllers/resources/inference_policy_controller.go
@@ -40,13 +40,13 @@ func (c inferencePolicyClient) Get(
 	ctx context.Context, name string,
 ) (*summarizerv1.InferencePolicy, error) {
 	resp, err := c.teleportClient.SummarizerServiceClient().GetInferencePolicy(
-		ctx, &summarizerv1.GetInferencePolicyRequest{Name: name},
+		ctx, summarizerv1.GetInferencePolicyRequest_builder{Name: name}.Build(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return resp.Policy, nil
+	return resp.GetPolicy(), nil
 }
 
 // Create creates an inference policy in Teleport.
@@ -54,7 +54,7 @@ func (c inferencePolicyClient) Create(
 	ctx context.Context, policy *summarizerv1.InferencePolicy,
 ) error {
 	_, err := c.teleportClient.SummarizerServiceClient().CreateInferencePolicy(
-		ctx, &summarizerv1.CreateInferencePolicyRequest{Policy: policy},
+		ctx, summarizerv1.CreateInferencePolicyRequest_builder{Policy: policy}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -64,7 +64,7 @@ func (c inferencePolicyClient) Update(
 	ctx context.Context, policy *summarizerv1.InferencePolicy,
 ) error {
 	_, err := c.teleportClient.SummarizerServiceClient().UpdateInferencePolicy(
-		ctx, &summarizerv1.UpdateInferencePolicyRequest{Policy: policy},
+		ctx, summarizerv1.UpdateInferencePolicyRequest_builder{Policy: policy}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -72,7 +72,7 @@ func (c inferencePolicyClient) Update(
 // Delete deletes an inference policy with a given name from Teleport.
 func (c inferencePolicyClient) Delete(ctx context.Context, name string) error {
 	_, err := c.teleportClient.SummarizerServiceClient().DeleteInferencePolicy(
-		ctx, &summarizerv1.DeleteInferencePolicyRequest{Name: name},
+		ctx, summarizerv1.DeleteInferencePolicyRequest_builder{Name: name}.Build(),
 	)
 	return trace.Wrap(err)
 }
diff --git a/integrations/operator/controllers/resources/inference_secret_controller.go b/integrations/operator/controllers/resources/inference_secret_controller.go
index 8517320bbf1..25f5f9d3df9 100644
--- a/integrations/operator/controllers/resources/inference_secret_controller.go
+++ b/integrations/operator/controllers/resources/inference_secret_controller.go
@@ -40,19 +40,19 @@ type inferenceSecretClient struct {
 // Get gets an inference secret with a given name from Teleport.
 func (c inferenceSecretClient) Get(ctx context.Context, name string) (*summarizerv1.InferenceSecret, error) {
 	resp, err := c.teleportClient.SummarizerServiceClient().GetInferenceSecret(
-		ctx, &summarizerv1.GetInferenceSecretRequest{Name: name},
+		ctx, summarizerv1.GetInferenceSecretRequest_builder{Name: name}.Build(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return resp.Secret, nil
+	return resp.GetSecret(), nil
 }
 
 // Create creates an inference secret in Teleport.
 func (c inferenceSecretClient) Create(ctx context.Context, secret *summarizerv1.InferenceSecret) error {
 	_, err := c.teleportClient.SummarizerServiceClient().CreateInferenceSecret(
-		ctx, &summarizerv1.CreateInferenceSecretRequest{Secret: secret},
+		ctx, summarizerv1.CreateInferenceSecretRequest_builder{Secret: secret}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -60,7 +60,7 @@ func (c inferenceSecretClient) Create(ctx context.Context, secret *summarizerv1.
 // Update updates an existing inference secret in Teleport.
 func (c inferenceSecretClient) Update(ctx context.Context, secret *summarizerv1.InferenceSecret) error {
 	_, err := c.teleportClient.SummarizerServiceClient().UpdateInferenceSecret(
-		ctx, &summarizerv1.UpdateInferenceSecretRequest{Secret: secret},
+		ctx, summarizerv1.UpdateInferenceSecretRequest_builder{Secret: secret}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -68,7 +68,7 @@ func (c inferenceSecretClient) Update(ctx context.Context, secret *summarizerv1.
 // Delete deletes an inference secret with a given name from Teleport.
 func (c inferenceSecretClient) Delete(ctx context.Context, name string) error {
 	_, err := c.teleportClient.SummarizerServiceClient().DeleteInferenceSecret(
-		ctx, &summarizerv1.DeleteInferenceSecretRequest{Name: name},
+		ctx, summarizerv1.DeleteInferenceSecretRequest_builder{Name: name}.Build(),
 	)
 	return trace.Wrap(err)
 }
@@ -81,7 +81,7 @@ func (c inferenceSecretClient) Mutate(ctx context.Context, new, _ *summarizerv1.
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		new.Spec.Value = resolvedSecret
+		new.GetSpec().SetValue(resolvedSecret)
 	}
 	return nil
 }
diff --git a/integrations/operator/controllers/resources/retrieval_model_controller.go b/integrations/operator/controllers/resources/retrieval_model_controller.go
index 5f537f4d08a..4bb00df60b9 100644
--- a/integrations/operator/controllers/resources/retrieval_model_controller.go
+++ b/integrations/operator/controllers/resources/retrieval_model_controller.go
@@ -44,20 +44,20 @@ func (r retrievalModelClient) Get(ctx context.Context, _ string) (*summarizerv1.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resp.Model, nil
+	return resp.GetModel(), nil
 }
 
 // Create creates the Teleport RetrievalModel singleton.
 func (r retrievalModelClient) Create(ctx context.Context, resource *summarizerv1.RetrievalModel) error {
 	_, err := r.teleportClient.SummarizerServiceClient().
-		CreateRetrievalModel(ctx, &summarizerv1.CreateRetrievalModelRequest{Model: resource})
+		CreateRetrievalModel(ctx, summarizerv1.CreateRetrievalModelRequest_builder{Model: resource}.Build())
 	return trace.Wrap(err)
 }
 
 // Update upserts the Teleport RetrievalModel singleton.
 func (r retrievalModelClient) Update(ctx context.Context, resource *summarizerv1.RetrievalModel) error {
 	_, err := r.teleportClient.SummarizerServiceClient().
-		UpsertRetrievalModel(ctx, &summarizerv1.UpsertRetrievalModelRequest{Model: resource})
+		UpsertRetrievalModel(ctx, summarizerv1.UpsertRetrievalModelRequest_builder{Model: resource}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/integrations/operator/controllers/resources/scopedrole_controller.go b/integrations/operator/controllers/resources/scopedrole_controller.go
index 55d35fb1917..30da9425fdd 100644
--- a/integrations/operator/controllers/resources/scopedrole_controller.go
+++ b/integrations/operator/controllers/resources/scopedrole_controller.go
@@ -34,23 +34,23 @@ type scopedRoleClient struct {
 }
 
 func (s *scopedRoleClient) Create(ctx context.Context, role *accessv1.ScopedRole) error {
-	_, err := s.teleportClient.ScopedAccessServiceClient().CreateScopedRole(ctx, &accessv1.CreateScopedRoleRequest{
+	_, err := s.teleportClient.ScopedAccessServiceClient().CreateScopedRole(ctx, accessv1.CreateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (s *scopedRoleClient) Delete(ctx context.Context, name string) error {
-	_, err := s.teleportClient.ScopedAccessServiceClient().DeleteScopedRole(ctx, &accessv1.DeleteScopedRoleRequest{
+	_, err := s.teleportClient.ScopedAccessServiceClient().DeleteScopedRole(ctx, accessv1.DeleteScopedRoleRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (s *scopedRoleClient) Get(ctx context.Context, name string) (*accessv1.ScopedRole, error) {
-	resp, err := s.teleportClient.ScopedAccessServiceClient().GetScopedRole(ctx, &accessv1.GetScopedRoleRequest{
+	resp, err := s.teleportClient.ScopedAccessServiceClient().GetScopedRole(ctx, accessv1.GetScopedRoleRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -58,9 +58,9 @@ func (s *scopedRoleClient) Get(ctx context.Context, name string) (*accessv1.Scop
 }
 
 func (s *scopedRoleClient) Update(ctx context.Context, role *accessv1.ScopedRole) error {
-	_, err := s.teleportClient.ScopedAccessServiceClient().UpdateScopedRole(ctx, &accessv1.UpdateScopedRoleRequest{
+	_, err := s.teleportClient.ScopedAccessServiceClient().UpdateScopedRole(ctx, accessv1.UpdateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/integrations/operator/controllers/resources/scopedrole_controller_test.go b/integrations/operator/controllers/resources/scopedrole_controller_test.go
index 0576b822670..14a1f613d2a 100644
--- a/integrations/operator/controllers/resources/scopedrole_controller_test.go
+++ b/integrations/operator/controllers/resources/scopedrole_controller_test.go
@@ -38,15 +38,15 @@ import (
 	"github.com/gravitational/teleport/lib/scopes/access"
 )
 
-var scopedRoleSpec = &accessv1.ScopedRoleSpec{
+var scopedRoleSpec = accessv1.ScopedRoleSpec_builder{
 	AssignableScopes: []string{"/staging"},
 	Rules: []*accessv1.ScopedRule{
-		{
+		accessv1.ScopedRule_builder{
 			Resources: []string{"scoped_role"},
 			Verbs:     []string{"readnosecrets", "list"},
-		},
+		}.Build(),
 	},
-}
+}.Build()
 
 type scopedRoleTestingPrimitives struct {
 	setup *testSetup
@@ -62,28 +62,28 @@ func (g *scopedRoleTestingPrimitives) SetupTeleportFixtures(ctx context.Context)
 }
 
 func (g *scopedRoleTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	role := &accessv1.ScopedRole{
+	role := accessv1.ScopedRole_builder{
 		Kind:    access.KindScopedRole,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Scope: "/staging",
 		Spec:  scopedRoleSpec,
-	}
-	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().CreateScopedRole(ctx, &accessv1.CreateScopedRoleRequest{
+	}.Build()
+	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().CreateScopedRole(ctx, accessv1.CreateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (g *scopedRoleTestingPrimitives) GetTeleportResource(ctx context.Context, name string) (*accessv1.ScopedRole, error) {
-	resp, err := g.setup.TeleportClient.ScopedAccessServiceClient().GetScopedRole(ctx, &accessv1.GetScopedRoleRequest{
+	resp, err := g.setup.TeleportClient.ScopedAccessServiceClient().GetScopedRole(ctx, accessv1.GetScopedRoleRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -91,9 +91,9 @@ func (g *scopedRoleTestingPrimitives) GetTeleportResource(ctx context.Context, n
 }
 
 func (g *scopedRoleTestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
-	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().DeleteScopedRole(ctx, &accessv1.DeleteScopedRoleRequest{
+	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().DeleteScopedRole(ctx, accessv1.DeleteScopedRoleRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
@@ -135,9 +135,9 @@ func (g *scopedRoleTestingPrimitives) ModifyKubernetesResource(ctx context.Conte
 		return trace.Wrap(err)
 	}
 	role.Spec.AssignableScopes = []string{"/staging/aa", "/staging/bb"}
-	role.Spec.Ssh = &accessv1.ScopedRoleSSH{
+	role.Spec.Ssh = accessv1.ScopedRoleSSH_builder{
 		HostSudoers: []string{"test"},
-	}
+	}.Build()
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, role))
 }
 
diff --git a/integrations/operator/controllers/resources/scopedroleassignment_controller.go b/integrations/operator/controllers/resources/scopedroleassignment_controller.go
index f60e5712102..202c7584f09 100644
--- a/integrations/operator/controllers/resources/scopedroleassignment_controller.go
+++ b/integrations/operator/controllers/resources/scopedroleassignment_controller.go
@@ -35,25 +35,25 @@ type scopedRoleAssignmentClient struct {
 }
 
 func (s *scopedRoleAssignmentClient) Create(ctx context.Context, assignment *accessv1.ScopedRoleAssignment) error {
-	_, err := s.teleportClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &accessv1.CreateScopedRoleAssignmentRequest{
+	_, err := s.teleportClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, accessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (s *scopedRoleAssignmentClient) Delete(ctx context.Context, name string) error {
-	_, err := s.teleportClient.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, &accessv1.DeleteScopedRoleAssignmentRequest{
+	_, err := s.teleportClient.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, accessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    name,
 		SubKind: scopedaccess.SubKindDynamic,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (s *scopedRoleAssignmentClient) Get(ctx context.Context, name string) (*accessv1.ScopedRoleAssignment, error) {
-	resp, err := s.teleportClient.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, &accessv1.GetScopedRoleAssignmentRequest{
+	resp, err := s.teleportClient.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, accessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    name,
 		SubKind: scopedaccess.SubKindDynamic,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -61,9 +61,9 @@ func (s *scopedRoleAssignmentClient) Get(ctx context.Context, name string) (*acc
 }
 
 func (s *scopedRoleAssignmentClient) Update(ctx context.Context, assignment *accessv1.ScopedRoleAssignment) error {
-	_, err := s.teleportClient.ScopedAccessServiceClient().UpdateScopedRoleAssignment(ctx, &accessv1.UpdateScopedRoleAssignmentRequest{
+	_, err := s.teleportClient.ScopedAccessServiceClient().UpdateScopedRoleAssignment(ctx, accessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/integrations/operator/controllers/resources/scopedroleassignment_controller_test.go b/integrations/operator/controllers/resources/scopedroleassignment_controller_test.go
index feab443af38..e365059cda3 100644
--- a/integrations/operator/controllers/resources/scopedroleassignment_controller_test.go
+++ b/integrations/operator/controllers/resources/scopedroleassignment_controller_test.go
@@ -39,15 +39,15 @@ import (
 	"github.com/gravitational/teleport/lib/scopes/access"
 )
 
-var scopedRoleAssignmentSpec = &accessv1.ScopedRoleAssignmentSpec{
+var scopedRoleAssignmentSpec = accessv1.ScopedRoleAssignmentSpec_builder{
 	User: "test-user",
 	Assignments: []*accessv1.Assignment{
-		{
+		accessv1.Assignment_builder{
 			Role:  "test-role",
 			Scope: "/staging",
-		},
+		}.Build(),
 	},
-}
+}.Build()
 
 type scopedRoleAssignmentTestingPrimitives struct {
 	setup *testSetup
@@ -63,30 +63,30 @@ func (g *scopedRoleAssignmentTestingPrimitives) SetupTeleportFixtures(ctx contex
 }
 
 func (g *scopedRoleAssignmentTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	assignment := &accessv1.ScopedRoleAssignment{
+	assignment := accessv1.ScopedRoleAssignment_builder{
 		Kind:    access.KindScopedRoleAssignment,
 		Version: types.V1,
 		SubKind: access.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Scope: "/staging",
 		Spec:  scopedRoleAssignmentSpec,
-	}
-	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &accessv1.CreateScopedRoleAssignmentRequest{
+	}.Build()
+	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, accessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (g *scopedRoleAssignmentTestingPrimitives) GetTeleportResource(ctx context.Context, name string) (*accessv1.ScopedRoleAssignment, error) {
-	resp, err := g.setup.TeleportClient.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, &accessv1.GetScopedRoleAssignmentRequest{
+	resp, err := g.setup.TeleportClient.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, accessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    name,
 		SubKind: access.SubKindDynamic,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -94,10 +94,10 @@ func (g *scopedRoleAssignmentTestingPrimitives) GetTeleportResource(ctx context.
 }
 
 func (g *scopedRoleAssignmentTestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
-	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, &accessv1.DeleteScopedRoleAssignmentRequest{
+	_, err := g.setup.TeleportClient.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, accessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    name,
 		SubKind: access.SubKindDynamic,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
@@ -139,10 +139,10 @@ func (g *scopedRoleAssignmentTestingPrimitives) ModifyKubernetesResource(ctx con
 		return trace.Wrap(err)
 	}
 	assignment.Spec.Assignments = []*accessv1.Assignment{
-		{
+		accessv1.Assignment_builder{
 			Role:  "test-role",
 			Scope: "/staging/aa",
-		},
+		}.Build(),
 	}
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, assignment))
 }
diff --git a/integrations/operator/controllers/resources/scopedtoken_controller_test.go b/integrations/operator/controllers/resources/scopedtoken_controller_test.go
index 1b7ccf7a859..1cc92a18c51 100644
--- a/integrations/operator/controllers/resources/scopedtoken_controller_test.go
+++ b/integrations/operator/controllers/resources/scopedtoken_controller_test.go
@@ -37,17 +37,17 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 )
 
-var scopedTokenSpec = &tokenv1.ScopedTokenSpec{
+var scopedTokenSpec = tokenv1.ScopedTokenSpec_builder{
 	AssignedScope: "/staging/foo",
 	Roles:         []string{types.RoleNode.String()},
 	JoinMethod:    string(types.JoinMethodToken),
 	UsageMode:     "unlimited",
-	ImmutableLabels: &tokenv1.ImmutableLabels{
+	ImmutableLabels: tokenv1.ImmutableLabels_builder{
 		Ssh: map[string]string{
 			"env": "prod",
 		},
-	},
-}
+	}.Build(),
+}.Build()
 
 type scopedTokenTestingPrimitives struct {
 	setup *testSetup
@@ -63,18 +63,18 @@ func (g *scopedTokenTestingPrimitives) SetupTeleportFixtures(ctx context.Context
 }
 
 func (g *scopedTokenTestingPrimitives) CreateTeleportResource(ctx context.Context, name string) error {
-	token := &tokenv1.ScopedToken{
+	token := tokenv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Scope: "/staging",
 		Spec:  scopedTokenSpec,
-	}
+	}.Build()
 	_, err := g.setup.TeleportClient.CreateScopedToken(ctx, token)
 	return trace.Wrap(err)
 }
@@ -124,9 +124,9 @@ func (g *scopedTokenTestingPrimitives) ModifyKubernetesResource(ctx context.Cont
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	token.Spec.ImmutableLabels.Ssh = map[string]string{
+	token.Spec.ImmutableLabels.SetSsh(map[string]string{
 		"env": "staging",
-	}
+	})
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, token))
 }
 
diff --git a/integrations/operator/controllers/resources/testlib/inference_model_controller_tests.go b/integrations/operator/controllers/resources/testlib/inference_model_controller_tests.go
index 1fda7f7433a..ed62ce8f848 100644
--- a/integrations/operator/controllers/resources/testlib/inference_model_controller_tests.go
+++ b/integrations/operator/controllers/resources/testlib/inference_model_controller_tests.go
@@ -36,16 +36,14 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
 )
 
-var inferenceModelSpec = &summarizerv1.InferenceModelSpec{
-	Provider: &summarizerv1.InferenceModelSpec_Bedrock{
-		Bedrock: &summarizerv1.BedrockProvider{
-			Region:         "us-east-1",
-			BedrockModelId: "anthropic.claude-3-haiku-20240307-v1:0",
-			Integration:    "some-integration",
-		},
-	},
+var inferenceModelSpec = summarizerv1.InferenceModelSpec_builder{
+	Bedrock: summarizerv1.BedrockProvider_builder{
+		Region:         "us-east-1",
+		BedrockModelId: "anthropic.claude-3-haiku-20240307-v1:0",
+		Integration:    "some-integration",
+	}.Build(),
 	MaxSessionLengthBytes: 1234567,
-}
+}.Build()
 
 type inferenceModelTestingPrimitives struct {
 	setup *TestSetup
@@ -63,20 +61,20 @@ func (p *inferenceModelTestingPrimitives) SetupTeleportFixtures(ctx context.Cont
 func (p *inferenceModelTestingPrimitives) CreateTeleportResource(
 	ctx context.Context, name string,
 ) error {
-	model := &summarizerv1.InferenceModel{
+	model := summarizerv1.InferenceModel_builder{
 		Kind:    types.KindInferenceModel,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: inferenceModelSpec,
-	}
+	}.Build()
 	_, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		CreateInferenceModel(ctx, &summarizerv1.CreateInferenceModelRequest{Model: model})
+		CreateInferenceModel(ctx, summarizerv1.CreateInferenceModelRequest_builder{Model: model}.Build())
 	return trace.Wrap(err)
 }
 
@@ -85,11 +83,11 @@ func (p *inferenceModelTestingPrimitives) GetTeleportResource(
 ) (*summarizerv1.InferenceModel, error) {
 	resp, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		GetInferenceModel(ctx, &summarizerv1.GetInferenceModelRequest{Name: name})
+		GetInferenceModel(ctx, summarizerv1.GetInferenceModelRequest_builder{Name: name}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resp.Model, nil
+	return resp.GetModel(), nil
 }
 
 func (p *inferenceModelTestingPrimitives) DeleteTeleportResource(
@@ -97,7 +95,7 @@ func (p *inferenceModelTestingPrimitives) DeleteTeleportResource(
 ) error {
 	_, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		DeleteInferenceModel(ctx, &summarizerv1.DeleteInferenceModelRequest{Name: name})
+		DeleteInferenceModel(ctx, summarizerv1.DeleteInferenceModelRequest_builder{Name: name}.Build())
 	return trace.Wrap(err)
 }
 
@@ -146,8 +144,8 @@ func (p *inferenceModelTestingPrimitives) ModifyKubernetesResource(
 		return trace.Wrap(err)
 	}
 	model.Spec.MaxSessionLengthBytes = 7654321
-	(*summarizerv1.InferenceModelSpec)(model.Spec).GetBedrock().BedrockModelId =
-		"anthropic.claude-3-5-sonnet-20240620-v1:0"
+	(*summarizerv1.InferenceModelSpec)(model.Spec).GetBedrock().SetBedrockModelId(
+		"anthropic.claude-3-5-sonnet-20240620-v1:0")
 	return trace.Wrap(p.setup.K8sClient.Update(ctx, model))
 }
 
diff --git a/integrations/operator/controllers/resources/testlib/inference_policy_controller_tests.go b/integrations/operator/controllers/resources/testlib/inference_policy_controller_tests.go
index f08e758d45f..18c1a47f9cf 100644
--- a/integrations/operator/controllers/resources/testlib/inference_policy_controller_tests.go
+++ b/integrations/operator/controllers/resources/testlib/inference_policy_controller_tests.go
@@ -34,11 +34,11 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
 )
 
-var inferencePolicySpec = &summarizerv1.InferencePolicySpec{
+var inferencePolicySpec = summarizerv1.InferencePolicySpec_builder{
 	Kinds:  []string{"ssh", "k8s"},
 	Model:  "test-model",
 	Filter: "resource.metadata.labels[\"env\"] == \"production\"",
-}
+}.Build()
 
 type inferencePolicyTestingPrimitives struct {
 	setup *TestSetup
@@ -56,20 +56,20 @@ func (p *inferencePolicyTestingPrimitives) SetupTeleportFixtures(ctx context.Con
 func (p *inferencePolicyTestingPrimitives) CreateTeleportResource(
 	ctx context.Context, name string,
 ) error {
-	policy := &summarizerv1.InferencePolicy{
+	policy := summarizerv1.InferencePolicy_builder{
 		Kind:    types.KindInferencePolicy,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: inferencePolicySpec,
-	}
+	}.Build()
 	_, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		CreateInferencePolicy(ctx, &summarizerv1.CreateInferencePolicyRequest{Policy: policy})
+		CreateInferencePolicy(ctx, summarizerv1.CreateInferencePolicyRequest_builder{Policy: policy}.Build())
 	return trace.Wrap(err)
 }
 
@@ -78,11 +78,11 @@ func (p *inferencePolicyTestingPrimitives) GetTeleportResource(
 ) (*summarizerv1.InferencePolicy, error) {
 	resp, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		GetInferencePolicy(ctx, &summarizerv1.GetInferencePolicyRequest{Name: name})
+		GetInferencePolicy(ctx, summarizerv1.GetInferencePolicyRequest_builder{Name: name}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resp.Policy, nil
+	return resp.GetPolicy(), nil
 }
 
 func (p *inferencePolicyTestingPrimitives) DeleteTeleportResource(
@@ -90,7 +90,7 @@ func (p *inferencePolicyTestingPrimitives) DeleteTeleportResource(
 ) error {
 	_, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		DeleteInferencePolicy(ctx, &summarizerv1.DeleteInferencePolicyRequest{Name: name})
+		DeleteInferencePolicy(ctx, summarizerv1.DeleteInferencePolicyRequest_builder{Name: name}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/integrations/operator/controllers/resources/testlib/inference_secret_controller_tests.go b/integrations/operator/controllers/resources/testlib/inference_secret_controller_tests.go
index c3e2480b8f3..ed49ffc4ba1 100644
--- a/integrations/operator/controllers/resources/testlib/inference_secret_controller_tests.go
+++ b/integrations/operator/controllers/resources/testlib/inference_secret_controller_tests.go
@@ -36,9 +36,9 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
 )
 
-var inferenceSecretSpec = &summarizerv1.InferenceSecretSpec{
+var inferenceSecretSpec = summarizerv1.InferenceSecretSpec_builder{
 	Value: "my-secret-value-123",
-}
+}.Build()
 
 type inferenceSecretTestingPrimitives struct {
 	setup *TestSetup
@@ -56,20 +56,20 @@ func (p *inferenceSecretTestingPrimitives) SetupTeleportFixtures(ctx context.Con
 func (p *inferenceSecretTestingPrimitives) CreateTeleportResource(
 	ctx context.Context, name string,
 ) error {
-	secret := &summarizerv1.InferenceSecret{
+	secret := summarizerv1.InferenceSecret_builder{
 		Kind:    types.KindInferenceSecret,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: inferenceSecretSpec,
-	}
+	}.Build()
 	_, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		CreateInferenceSecret(ctx, &summarizerv1.CreateInferenceSecretRequest{Secret: secret})
+		CreateInferenceSecret(ctx, summarizerv1.CreateInferenceSecretRequest_builder{Secret: secret}.Build())
 	return trace.Wrap(err)
 }
 
@@ -78,11 +78,11 @@ func (p *inferenceSecretTestingPrimitives) GetTeleportResource(
 ) (*summarizerv1.InferenceSecret, error) {
 	resp, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		GetInferenceSecret(ctx, &summarizerv1.GetInferenceSecretRequest{Name: name})
+		GetInferenceSecret(ctx, summarizerv1.GetInferenceSecretRequest_builder{Name: name}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resp.Secret, nil
+	return resp.GetSecret(), nil
 }
 
 func (p *inferenceSecretTestingPrimitives) DeleteTeleportResource(
@@ -90,7 +90,7 @@ func (p *inferenceSecretTestingPrimitives) DeleteTeleportResource(
 ) error {
 	_, err := p.setup.TeleportClient.
 		SummarizerServiceClient().
-		DeleteInferenceSecret(ctx, &summarizerv1.DeleteInferenceSecretRequest{Name: name})
+		DeleteInferenceSecret(ctx, summarizerv1.DeleteInferenceSecretRequest_builder{Name: name}.Build())
 	return trace.Wrap(err)
 }
 
@@ -149,8 +149,8 @@ func (p *inferenceSecretTestingPrimitives) CompareTeleportAndKubernetesResource(
 	// InferenceSecret spec is write-only, so Teleport will return spec=nil. We
 	// therefore only compare the metadata.
 	diff := cmp.Diff(
-		tResource.Metadata,
-		kubeResource.ToTeleport().Metadata,
+		tResource.GetMetadata(),
+		kubeResource.ToTeleport().GetMetadata(),
 		ProtoCompareOptions()...,
 	)
 	return diff == "", diff
diff --git a/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go b/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go
index 990057c7190..92b05601789 100644
--- a/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go
+++ b/integrations/operator/controllers/resources/testlib/login_rule_controller_tests.go
@@ -67,26 +67,26 @@ func (l *loginRuleTestingPrimitives) CreateTeleportResource(ctx context.Context,
 			},
 		},
 	}
-	rule.Metadata.SetOrigin(types.OriginKubernetes)
-	_, err := l.setup.TeleportClient.LoginRuleClient().CreateLoginRule(ctx, &loginrulepb.CreateLoginRuleRequest{
+	rule.GetMetadata().SetOrigin(types.OriginKubernetes)
+	_, err := l.setup.TeleportClient.LoginRuleClient().CreateLoginRule(ctx, loginrulepb.CreateLoginRuleRequest_builder{
 		LoginRule: &rule,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 func (l *loginRuleTestingPrimitives) GetTeleportResource(ctx context.Context, name string) (*resourcesv1.LoginRuleResource, error) {
 	lrClient := l.setup.TeleportClient.LoginRuleClient()
-	loginRule, err := lrClient.GetLoginRule(ctx, &loginrulepb.GetLoginRuleRequest{
+	loginRule, err := lrClient.GetLoginRule(ctx, loginrulepb.GetLoginRuleRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	return &resourcesv1.LoginRuleResource{LoginRule: loginRule}, trail.FromGRPC(err)
 }
 
 func (l *loginRuleTestingPrimitives) DeleteTeleportResource(ctx context.Context, name string) error {
 	lrClient := l.setup.TeleportClient.LoginRuleClient()
-	_, err := lrClient.DeleteLoginRule(ctx, &loginrulepb.DeleteLoginRuleRequest{
+	_, err := lrClient.DeleteLoginRule(ctx, loginrulepb.DeleteLoginRuleRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/integrations/operator/controllers/resources/testlib/retrieval_model_controller_tests.go b/integrations/operator/controllers/resources/testlib/retrieval_model_controller_tests.go
index ec7198706ba..f3f3f123d31 100644
--- a/integrations/operator/controllers/resources/testlib/retrieval_model_controller_tests.go
+++ b/integrations/operator/controllers/resources/testlib/retrieval_model_controller_tests.go
@@ -42,15 +42,13 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources"
 )
 
-var retrievalModelSpec = &summarizerv1.RetrievalModelSpec{
-	EmbeddingsProvider: &summarizerv1.RetrievalModelSpec_Bedrock{
-		Bedrock: &summarizerv1.BedrockProvider{
-			Region:         "us-west-2",
-			BedrockModelId: "amazon.titan-embed-text-v2:0",
-		},
-	},
+var retrievalModelSpec = summarizerv1.RetrievalModelSpec_builder{
+	Bedrock: summarizerv1.BedrockProvider_builder{
+		Region:         "us-west-2",
+		BedrockModelId: "amazon.titan-embed-text-v2:0",
+	}.Build(),
 	InferenceModelName: "test-inference-model",
-}
+}.Build()
 
 type retrievalModelTestingPrimitives struct {
 	setup *TestSetup
@@ -62,32 +60,32 @@ func (p *retrievalModelTestingPrimitives) Init(setup *TestSetup) {
 }
 
 func (p *retrievalModelTestingPrimitives) SetupTeleportFixtures(ctx context.Context) error {
-	model := &summarizerv1.InferenceModel{
+	model := summarizerv1.InferenceModel_builder{
 		Kind:    types.KindInferenceModel,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
-			Name: retrievalModelSpec.InferenceModelName,
-		},
+		Metadata: headerv1.Metadata_builder{
+			Name: retrievalModelSpec.GetInferenceModelName(),
+		}.Build(),
 		Spec: inferenceModelSpec,
-	}
+	}.Build()
 	_, err := p.setup.TeleportClient.SummarizerClient().UpsertInferenceModel(ctx, model)
 	return trace.Wrap(err)
 }
 
 func (p *retrievalModelTestingPrimitives) CreateTeleportResource(ctx context.Context, _ string) error {
-	model := &summarizerv1.RetrievalModel{
+	model := summarizerv1.RetrievalModel_builder{
 		Kind:    types.KindRetrievalModel,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameRetrievalModel,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: retrievalModelSpec,
-	}
+	}.Build()
 	_, err := p.setup.TeleportClient.SummarizerServiceClient().
-		CreateRetrievalModel(ctx, &summarizerv1.CreateRetrievalModelRequest{Model: model})
+		CreateRetrievalModel(ctx, summarizerv1.CreateRetrievalModelRequest_builder{Model: model}.Build())
 	return trace.Wrap(err)
 }
 
@@ -99,7 +97,7 @@ func (p *retrievalModelTestingPrimitives) GetTeleportResource(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resp.Model, nil
+	return resp.GetModel(), nil
 }
 
 func (p *retrievalModelTestingPrimitives) DeleteTeleportResource(ctx context.Context, _ string) error {
@@ -147,10 +145,10 @@ func (p *retrievalModelTestingPrimitives) ModifyKubernetesResource(ctx context.C
 		return trace.Wrap(err)
 	}
 	model.Spec.EmbeddingsProvider = &summarizerv1.RetrievalModelSpec_Bedrock{
-		Bedrock: &summarizerv1.BedrockProvider{
+		Bedrock: summarizerv1.BedrockProvider_builder{
 			Region:         "us-west-1",
 			BedrockModelId: "amazon.titan-embed-text-v2:0",
-		},
+		}.Build(),
 	}
 	return trace.Wrap(p.setup.K8sClient.Update(ctx, model))
 }
diff --git a/integrations/operator/controllers/resources/workload_identityv1_controller.go b/integrations/operator/controllers/resources/workload_identityv1_controller.go
index b9d5e4e19f3..1f77e45f5df 100644
--- a/integrations/operator/controllers/resources/workload_identityv1_controller.go
+++ b/integrations/operator/controllers/resources/workload_identityv1_controller.go
@@ -44,7 +44,7 @@ func (l workloadIdentityClient) Get(
 	resp, err := l.teleportClient.
 		WorkloadIdentityResourceServiceClient().
 		GetWorkloadIdentity(
-			ctx, &workloadidentityv1.GetWorkloadIdentityRequest{Name: name},
+			ctx, workloadidentityv1.GetWorkloadIdentityRequest_builder{Name: name}.Build(),
 		)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -60,9 +60,9 @@ func (l workloadIdentityClient) Create(
 		WorkloadIdentityResourceServiceClient().
 		CreateWorkloadIdentity(
 			ctx,
-			&workloadidentityv1.CreateWorkloadIdentityRequest{
+			workloadidentityv1.CreateWorkloadIdentityRequest_builder{
 				WorkloadIdentity: resource,
-			},
+			}.Build(),
 		)
 	return trace.Wrap(err)
 }
@@ -75,9 +75,9 @@ func (l workloadIdentityClient) Update(
 		WorkloadIdentityResourceServiceClient().
 		UpsertWorkloadIdentity(
 			ctx,
-			&workloadidentityv1.UpsertWorkloadIdentityRequest{
+			workloadidentityv1.UpsertWorkloadIdentityRequest_builder{
 				WorkloadIdentity: resource,
-			},
+			}.Build(),
 		)
 	return trace.Wrap(err)
 }
@@ -87,7 +87,7 @@ func (l workloadIdentityClient) Delete(ctx context.Context, name string) error {
 	_, err := l.teleportClient.
 		WorkloadIdentityResourceServiceClient().
 		DeleteWorkloadIdentity(
-			ctx, &workloadidentityv1.DeleteWorkloadIdentityRequest{Name: name},
+			ctx, workloadidentityv1.DeleteWorkloadIdentityRequest_builder{Name: name}.Build(),
 		)
 	return trace.Wrap(err)
 }
diff --git a/integrations/operator/controllers/resources/workload_identityv1_controller_test.go b/integrations/operator/controllers/resources/workload_identityv1_controller_test.go
index 746f897df12..1fb3d049263 100644
--- a/integrations/operator/controllers/resources/workload_identityv1_controller_test.go
+++ b/integrations/operator/controllers/resources/workload_identityv1_controller_test.go
@@ -36,27 +36,25 @@ import (
 	"github.com/gravitational/teleport/integrations/operator/controllers/resources/testlib"
 )
 
-var workloadIdentitySpec = &workloadidentityv1.WorkloadIdentitySpec{
-	Rules: &workloadidentityv1.WorkloadIdentityRules{
+var workloadIdentitySpec = workloadidentityv1.WorkloadIdentitySpec_builder{
+	Rules: workloadidentityv1.WorkloadIdentityRules_builder{
 		Allow: []*workloadidentityv1.WorkloadIdentityRule{
-			{
+			workloadidentityv1.WorkloadIdentityRule_builder{
 				Conditions: []*workloadidentityv1.WorkloadIdentityCondition{
-					{
+					workloadidentityv1.WorkloadIdentityCondition_builder{
 						Attribute: "user.name",
-						Operator: &workloadidentityv1.WorkloadIdentityCondition_Eq{
-							Eq: &workloadidentityv1.WorkloadIdentityConditionEq{
-								Value: "userA",
-							},
-						},
-					},
+						Eq: workloadidentityv1.WorkloadIdentityConditionEq_builder{
+							Value: "userA",
+						}.Build(),
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
-	},
-	Spiffe: &workloadidentityv1.WorkloadIdentitySPIFFE{
+	}.Build(),
+	Spiffe: workloadidentityv1.WorkloadIdentitySPIFFE_builder{
 		Id: "/test",
-	},
-}
+	}.Build(),
+}.Build()
 
 type workloadIdentityTestingPrimitives struct {
 	setup *testSetup
@@ -76,24 +74,24 @@ func (g *workloadIdentityTestingPrimitives) SetupTeleportFixtures(
 func (g *workloadIdentityTestingPrimitives) CreateTeleportResource(
 	ctx context.Context, name string,
 ) error {
-	resource := &workloadidentityv1.WorkloadIdentity{
+	resource := workloadidentityv1.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				types.OriginLabel: types.OriginKubernetes,
 			},
-		},
+		}.Build(),
 		Spec: workloadIdentitySpec,
-	}
+	}.Build()
 	_, err := g.setup.TeleportClient.
 		WorkloadIdentityResourceServiceClient().
 		CreateWorkloadIdentity(
 			ctx,
-			&workloadidentityv1.CreateWorkloadIdentityRequest{
+			workloadidentityv1.CreateWorkloadIdentityRequest_builder{
 				WorkloadIdentity: resource,
-			},
+			}.Build(),
 		)
 	return trace.Wrap(err)
 }
@@ -104,7 +102,7 @@ func (g *workloadIdentityTestingPrimitives) GetTeleportResource(
 	resp, err := g.setup.TeleportClient.
 		WorkloadIdentityResourceServiceClient().
 		GetWorkloadIdentity(
-			ctx, &workloadidentityv1.GetWorkloadIdentityRequest{Name: name},
+			ctx, workloadidentityv1.GetWorkloadIdentityRequest_builder{Name: name}.Build(),
 		)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -118,7 +116,7 @@ func (g *workloadIdentityTestingPrimitives) DeleteTeleportResource(
 	_, err := g.setup.TeleportClient.
 		WorkloadIdentityResourceServiceClient().
 		DeleteWorkloadIdentity(
-			ctx, &workloadidentityv1.DeleteWorkloadIdentityRequest{Name: name},
+			ctx, workloadidentityv1.DeleteWorkloadIdentityRequest_builder{Name: name}.Build(),
 		)
 	if err != nil {
 		return trace.Wrap(err)
@@ -170,7 +168,7 @@ func (g *workloadIdentityTestingPrimitives) ModifyKubernetesResource(
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	resource.Spec.Spiffe.Id = "/changed"
+	resource.Spec.Spiffe.SetId("/changed")
 	return trace.Wrap(g.setup.K8sClient.Update(ctx, resource))
 }
 
diff --git a/lib/accessmonitoring/access_monitoring_rule_test.go b/lib/accessmonitoring/access_monitoring_rule_test.go
index 24ba82b1c1e..1da631e7b9a 100644
--- a/lib/accessmonitoring/access_monitoring_rule_test.go
+++ b/lib/accessmonitoring/access_monitoring_rule_test.go
@@ -92,7 +92,7 @@ func TestEvaluateRules(t *testing.T) {
 			rules := EvaluateRules(ctx, logtest.NewLogger(), test.env, test.rules)
 			require.Len(t, rules, len(test.expected))
 			for _, rule := range rules {
-				require.Contains(t, test.expected, rule.Metadata.GetName())
+				require.Contains(t, test.expected, rule.GetMetadata().GetName())
 			}
 		})
 	}
@@ -103,26 +103,26 @@ func makeRule(
 	weekday time.Weekday,
 	start, end string,
 ) *accessmonitoringrulesv1.AccessMonitoringRule {
-	return &accessmonitoringrulesv1.AccessMonitoringRule{
+	return accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:  []string{types.KindAccessRequest},
 			Condition: condition,
 			Schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
-						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
+						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 							Weekday: weekday.String(),
 							Start:   start,
 							End:     end,
-						}},
-					},
-				},
+						}.Build()},
+					}.Build(),
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/accessmonitoring/cache_test.go b/lib/accessmonitoring/cache_test.go
index eee751fde5d..2334d6c2e9d 100644
--- a/lib/accessmonitoring/cache_test.go
+++ b/lib/accessmonitoring/cache_test.go
@@ -33,8 +33,8 @@ func TestCache(t *testing.T) {
 
 	// Ensure rules are cached
 	rules := []*accessmonitoringrulesv1.AccessMonitoringRule{
-		{Metadata: &headerv1.Metadata{Name: "test-rule-1"}},
-		{Metadata: &headerv1.Metadata{Name: "test-rule-2"}},
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{Name: "test-rule-1"}.Build()}.Build(),
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{Name: "test-rule-2"}.Build()}.Build(),
 	}
 	cache.Put(rules)
 	require.Len(t, cache.Get(), 2)
@@ -42,14 +42,14 @@ func TestCache(t *testing.T) {
 
 	// Ensure rules are updated
 	updatedRules := []*accessmonitoringrulesv1.AccessMonitoringRule{
-		{Metadata: &headerv1.Metadata{
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{
 			Name:        "test-rule-1",
 			Description: "updated-rule-1",
-		}},
-		{Metadata: &headerv1.Metadata{
+		}.Build()}.Build(),
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{
 			Name:        "test-rule-2",
 			Description: "updated-rule-2",
-		}},
+		}.Build()}.Build(),
 	}
 	cache.Put(updatedRules)
 	require.Len(t, cache.Get(), 2)
@@ -66,12 +66,12 @@ func TestInitializeCache(t *testing.T) {
 	cache := NewCache()
 
 	rulesPageOne := []*accessmonitoringrulesv1.AccessMonitoringRule{
-		{Metadata: &headerv1.Metadata{Name: "test-rule-1"}},
-		{Metadata: &headerv1.Metadata{Name: "test-rule-2"}},
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{Name: "test-rule-1"}.Build()}.Build(),
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{Name: "test-rule-2"}.Build()}.Build(),
 	}
 	rulesPageTwo := []*accessmonitoringrulesv1.AccessMonitoringRule{
-		{Metadata: &headerv1.Metadata{Name: "test-rule-3"}},
-		{Metadata: &headerv1.Metadata{Name: "test-rule-4"}},
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{Name: "test-rule-3"}.Build()}.Build(),
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{Metadata: headerv1.Metadata_builder{Name: "test-rule-4"}.Build()}.Build(),
 	}
 	mockFetchPages := func(ctx context.Context, pageSize int64, pageToken string) (
 		[]*accessmonitoringrulesv1.AccessMonitoringRule,
diff --git a/lib/accessmonitoring/monitor_test.go b/lib/accessmonitoring/monitor_test.go
index d1b589162bd..bf1acc7478c 100644
--- a/lib/accessmonitoring/monitor_test.go
+++ b/lib/accessmonitoring/monitor_test.go
@@ -81,7 +81,7 @@ func TestAccessMonitoringRule(t *testing.T) {
 		"handle create access monitoring rule event")
 
 	// Test update access monitoring rule event.
-	rule.Spec.Condition = "new-condition"
+	rule.GetSpec().SetCondition("new-condition")
 	updateEvent := types.Event{
 		Type:     types.OpPut,
 		Resource: types.Resource153ToLegacy(rule),
@@ -269,22 +269,22 @@ func (w mockWatcher) Error() error {
 func newApprovalRule(name, condition string) *accessmonitoringrulesv1.AccessMonitoringRule {
 	const integrationName = "test"
 
-	return &accessmonitoringrulesv1.AccessMonitoringRule{
+	return accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:     []string{types.KindAccessRequest},
 			Condition:    condition,
 			DesiredState: types.AccessMonitoringRuleStateReviewed,
-			AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+			AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 				Integration: integrationName,
 				Decision:    types.RequestState_APPROVED.String(),
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 // mockEventHandler is a mock implementation of the EventHandler.
diff --git a/lib/accessmonitoring/review/review.go b/lib/accessmonitoring/review/review.go
index 5192caaf247..4ad3cb87c59 100644
--- a/lib/accessmonitoring/review/review.go
+++ b/lib/accessmonitoring/review/review.go
@@ -102,12 +102,12 @@ func (handler *Handler) initialize(ctx context.Context) error {
 		string,
 		error,
 	) {
-		req := &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+		req := accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 			PageSize:            pageSize,
 			PageToken:           pageToken,
 			Subjects:            []string{types.KindAccessRequest},
 			AutomaticReviewName: handler.HandlerName,
-		}
+		}.Build()
 		page, next, err := handler.Client.ListAccessMonitoringRulesWithFilter(ctx, req)
 		if err != nil {
 			return nil, "", trace.Wrap(err)
diff --git a/lib/accessmonitoring/review/review_test.go b/lib/accessmonitoring/review/review_test.go
index 3a46a082df6..1d7e3464ebe 100644
--- a/lib/accessmonitoring/review/review_test.go
+++ b/lib/accessmonitoring/review/review_test.go
@@ -57,10 +57,10 @@ func TestInitializeCache(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	mockReq := &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+	mockReq := accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 		Subjects:            []string{types.KindAccessRequest},
 		AutomaticReviewName: handler.HandlerName,
-	}
+	}.Build()
 
 	mockResp := []*accessmonitoringrulesv1.AccessMonitoringRule{
 		newApprovedRule("test-rule", "condition"),
@@ -119,7 +119,7 @@ func TestHandleAccessMonitoringRule(t *testing.T) {
 
 	// Test rule does not apply with invalid automatic approval name.
 	rule = newApprovedRule("test-rule", `condition`)
-	rule.Spec.AutomaticReview.Integration = "invalid"
+	rule.GetSpec().GetAutomaticReview().SetIntegration("invalid")
 	require.NoError(t, handler.HandleAccessMonitoringRule(ctx, types.Event{
 		Type:     types.OpPut,
 		Resource: types.Resource153ToResourceWithLabels(rule),
@@ -128,7 +128,7 @@ func TestHandleAccessMonitoringRule(t *testing.T) {
 
 	// Test rule does not apply with invalid state.
 	rule = newApprovedRule("test-rule", `condition`)
-	rule.Spec.DesiredState = "invalid"
+	rule.GetSpec().SetDesiredState("invalid")
 	require.NoError(t, handler.HandleAccessMonitoringRule(ctx, types.Event{
 		Type:     types.OpPut,
 		Resource: types.Resource153ToResourceWithLabels(rule),
@@ -137,7 +137,7 @@ func TestHandleAccessMonitoringRule(t *testing.T) {
 
 	// Test rule does not apply with invalid subject.
 	rule = newApprovedRule("test-rule", `condition`)
-	rule.Spec.Subjects = []string{"invalid"}
+	rule.GetSpec().SetSubjects([]string{"invalid"})
 	require.NoError(t, handler.HandleAccessMonitoringRule(ctx, types.Event{
 		Type:     types.OpPut,
 		Resource: types.Resource153ToResourceWithLabels(rule),
@@ -221,19 +221,19 @@ func TestScheduleRequest(t *testing.T) {
 		testRuleName,
 		`true`)
 
-	testRule.Spec.Schedules = map[string]*accessmonitoringrulesv1.Schedule{
-		"test-schedule": {
-			Time: &accessmonitoringrulesv1.TimeSchedule{
+	testRule.GetSpec().SetSchedules(map[string]*accessmonitoringrulesv1.Schedule{
+		"test-schedule": accessmonitoringrulesv1.Schedule_builder{
+			Time: accessmonitoringrulesv1.TimeSchedule_builder{
 				Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-					{
+					accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 						Weekday: time.Monday.String(),
 						Start:   "14:00",
 						End:     "15:00",
-					},
+					}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	})
 
 	cache := accessmonitoring.NewCache()
 	cache.Put([]*accessmonitoringrulesv1.AccessMonitoringRule{testRule})
@@ -604,21 +604,21 @@ func newDeniedRule(name, condition string) *accessmonitoringrulesv1.AccessMonito
 }
 
 func newReviewRule(name, condition, decision string) *accessmonitoringrulesv1.AccessMonitoringRule {
-	return &accessmonitoringrulesv1.AccessMonitoringRule{
+	return accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind: types.KindAccessMonitoringRule,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:     []string{types.KindAccessRequest},
 			Condition:    condition,
 			DesiredState: types.AccessMonitoringRuleStateReviewed,
-			AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+			AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 				Integration: handlerName,
 				Decision:    decision,
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 // mockClient is a mock implementation of the Teleport API client.
@@ -641,7 +641,7 @@ func (m *mockClient) ListAccessMonitoringRulesWithFilter(ctx context.Context, re
 	error,
 ) {
 	// Expect zero value page size for testing.
-	req.PageSize = 0
+	req.SetPageSize(0)
 
 	args := m.Called(ctx, req)
 	rules, ok := args.Get(0).([]*accessmonitoringrulesv1.AccessMonitoringRule)
diff --git a/lib/accessmonitoring/schedule.go b/lib/accessmonitoring/schedule.go
index 69510a721fa..4ddb31844df 100644
--- a/lib/accessmonitoring/schedule.go
+++ b/lib/accessmonitoring/schedule.go
@@ -56,18 +56,18 @@ func inSchedule(schedule *accessmonitoringrulesv1.Schedule, timestamp time.Time)
 	weekday := timestamp.Weekday().String()
 
 	for _, shift := range schedule.GetTime().GetShifts() {
-		if weekday != shift.Weekday {
+		if weekday != shift.GetWeekday() {
 			continue
 		}
 
-		startTime, err := ClockTime(timestamp, shift.Start)
+		startTime, err := ClockTime(timestamp, shift.GetStart())
 		if err != nil {
-			return false, trace.Wrap(err, "invalid start time: %q", shift.Start)
+			return false, trace.Wrap(err, "invalid start time: %q", shift.GetStart())
 		}
 
-		endTime, err := ClockTime(timestamp, shift.End)
+		endTime, err := ClockTime(timestamp, shift.GetEnd())
 		if err != nil {
-			return false, trace.Wrap(err, "invalid end time: %q", shift.End)
+			return false, trace.Wrap(err, "invalid end time: %q", shift.GetEnd())
 		}
 
 		if !timestamp.Before(startTime) && !timestamp.After(endTime) {
diff --git a/lib/accessmonitoring/schedule_test.go b/lib/accessmonitoring/schedule_test.go
index 08316b84fcf..5b17091bac1 100644
--- a/lib/accessmonitoring/schedule_test.go
+++ b/lib/accessmonitoring/schedule_test.go
@@ -95,17 +95,17 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "in schedule",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "14:00",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.True,
@@ -113,11 +113,11 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "schedule does not contain any shifts",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.False,
@@ -125,18 +125,18 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "invalid timezone",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "invalid",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "14:00",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: func(t require.TestingT, err error, _ ...any) {
 				require.ErrorContains(t, err, "unknown time zone")
@@ -146,18 +146,18 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "different timezone",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "America/Los_Angeles",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "14:00",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.False,
@@ -165,17 +165,17 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "different weekday",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Tuesday.String(),
 								Start:   "14:00",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.False,
@@ -183,17 +183,17 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "before schedule",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "14:31",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.False,
@@ -201,17 +201,17 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "exact start time",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "14:30",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.True,
@@ -219,28 +219,28 @@ func TestInSchedule(t *testing.T) {
 		{
 			description: "multiple schedules",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"schedule1": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"schedule1": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "14:30",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
-				"schedule2": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+					}.Build(),
+				}.Build(),
+				"schedule2": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Tuesday.String(),
 								Start:   "14:30",
 								End:     "15:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr:        require.NoError,
 			assertInSchedule: require.True,
diff --git a/lib/auth/access_request_test.go b/lib/auth/access_request_test.go
index bbdb5771961..d49abe8ce83 100644
--- a/lib/auth/access_request_test.go
+++ b/lib/auth/access_request_test.go
@@ -1054,30 +1054,30 @@ func testBotAccessRequestReview(t *testing.T, testPack *accessRequestTestPack) {
 	adminClient, err := testPack.tlsServer.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 	defer adminClient.Close()
-	bot, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "request-approver",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{
 					// Grants the ability to approve requests
 					"admins",
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Use the bot user to generate some certs using role impersonation.
 	// This mimics what the bot actually does.
-	botClient, err := testPack.tlsServer.NewClient(authtest.TestUser(bot.Status.UserName))
+	botClient, err := testPack.tlsServer.NewClient(authtest.TestUser(bot.GetStatus().GetUserName()))
 	require.NoError(t, err)
 	defer botClient.Close()
 	certRes, err := botClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
-		Username:     bot.Status.UserName,
+		Username:     bot.GetStatus().GetUserName(),
 		TLSPublicKey: testPack.tlsPubKey,
 		Expires:      time.Now().Add(time.Hour),
 
@@ -1110,7 +1110,7 @@ func testBotAccessRequestReview(t *testing.T, testPack *accessRequestTestPack) {
 	require.NoError(t, err)
 
 	// Check the final state of the request
-	require.Equal(t, bot.Status.UserName, accessRequest.GetReviews()[0].Author)
+	require.Equal(t, bot.GetStatus().GetUserName(), accessRequest.GetReviews()[0].Author)
 	require.Equal(t, types.RequestState_APPROVED, accessRequest.GetState())
 }
 
diff --git a/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service.go b/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service.go
index e3e7e566656..6b008f13e75 100644
--- a/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service.go
+++ b/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service.go
@@ -79,7 +79,7 @@ func (s *Service) CreateAccessMonitoringRule(ctx context.Context, req *accessmon
 	if err := authCtx.CheckAccessToKind(types.KindAccessMonitoringRule, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	created, err := s.backend.CreateAccessMonitoringRule(ctx, req.Rule)
+	created, err := s.backend.CreateAccessMonitoringRule(ctx, req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -96,7 +96,7 @@ func (s *Service) UpdateAccessMonitoringRule(ctx context.Context, req *accessmon
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.backend.UpdateAccessMonitoringRule(ctx, req.Rule)
+	created, err := s.backend.UpdateAccessMonitoringRule(ctx, req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -112,7 +112,7 @@ func (s *Service) GetAccessMonitoringRule(ctx context.Context, req *accessmonito
 	if err := authCtx.CheckAccessToKind(types.KindAccessMonitoringRule, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	got, err := s.backend.GetAccessMonitoringRule(ctx, req.Name)
+	got, err := s.backend.GetAccessMonitoringRule(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -128,7 +128,7 @@ func (s *Service) DeleteAccessMonitoringRule(ctx context.Context, req *accessmon
 	if err := authCtx.CheckAccessToKind(types.KindAccessMonitoringRule, types.VerbDelete); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := s.backend.DeleteAccessMonitoringRule(ctx, req.Name); err != nil {
+	if err := s.backend.DeleteAccessMonitoringRule(ctx, req.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &emptypb.Empty{}, nil
@@ -144,7 +144,7 @@ func (s *Service) UpsertAccessMonitoringRule(ctx context.Context, req *accessmon
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.backend.UpsertAccessMonitoringRule(ctx, req.Rule)
+	created, err := s.backend.UpsertAccessMonitoringRule(ctx, req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -160,14 +160,14 @@ func (s *Service) ListAccessMonitoringRules(ctx context.Context, req *accessmoni
 	if err := authCtx.CheckAccessToKind(types.KindAccessMonitoringRule, types.VerbRead, types.VerbList); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	results, nextToken, err := s.cache.ListAccessMonitoringRules(ctx, int(req.PageSize), req.PageToken)
+	results, nextToken, err := s.cache.ListAccessMonitoringRules(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &accessmonitoringrulesv1.ListAccessMonitoringRulesResponse{
+	return accessmonitoringrulesv1.ListAccessMonitoringRulesResponse_builder{
 		Rules:         results,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // ListAccessMonitoringRulesWithFilter lists current access monitoring rules.
@@ -183,8 +183,8 @@ func (s *Service) ListAccessMonitoringRulesWithFilter(ctx context.Context, req *
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterResponse{
+	return accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterResponse_builder{
 		Rules:         results,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service_test.go b/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service_test.go
index 8594f6d054c..662be02cbfe 100644
--- a/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service_test.go
+++ b/lib/auth/accessmonitoringrules/accessmonitoringrulesv1/service_test.go
@@ -49,15 +49,15 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 	ctx, localClient, resourceSvc := initSvc(t, clusterName)
 
 	sampleAccessMonitoringRuleFn := func(name string) *accessmonitoringrulev1.AccessMonitoringRule {
-		return &accessmonitoringrulev1.AccessMonitoringRule{
+		return accessmonitoringrulev1.AccessMonitoringRule_builder{
 			Kind:     types.KindAccessMonitoringRule,
 			Version:  types.V1,
-			Metadata: &v1.Metadata{Name: name},
-			Spec: &accessmonitoringrulev1.AccessMonitoringRuleSpec{
+			Metadata: v1.Metadata_builder{Name: name}.Build(),
+			Spec: accessmonitoringrulev1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{"someSubject"},
 				Condition: "someCondition",
-			},
-		}
+			}.Build(),
+		}.Build()
 	}
 
 	tt := []struct {
@@ -81,9 +81,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.GetAccessMonitoringRule(ctx, &accessmonitoringrulev1.GetAccessMonitoringRuleRequest{
+				_, err := resourceSvc.GetAccessMonitoringRule(ctx, accessmonitoringrulev1.GetAccessMonitoringRuleRequest_builder{
 					Name: amrName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -92,9 +92,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			Name: "no access to read AccessMonitoringRules",
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.GetAccessMonitoringRule(ctx, &accessmonitoringrulev1.GetAccessMonitoringRuleRequest{
+				_, err := resourceSvc.GetAccessMonitoringRule(ctx, accessmonitoringrulev1.GetAccessMonitoringRuleRequest_builder{
 					Name: amrName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -108,9 +108,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 				}}},
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.GetAccessMonitoringRule(ctx, &accessmonitoringrulev1.GetAccessMonitoringRuleRequest{
+				_, err := resourceSvc.GetAccessMonitoringRule(ctx, accessmonitoringrulev1.GetAccessMonitoringRuleRequest_builder{
 					Name: amrName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -132,10 +132,10 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 				}
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.ListAccessMonitoringRules(ctx, &accessmonitoringrulev1.ListAccessMonitoringRulesRequest{
+				_, err := resourceSvc.ListAccessMonitoringRules(ctx, accessmonitoringrulev1.ListAccessMonitoringRulesRequest_builder{
 					PageSize:  0,
 					PageToken: "",
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -149,10 +149,10 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 				}}},
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.ListAccessMonitoringRules(ctx, &accessmonitoringrulev1.ListAccessMonitoringRulesRequest{
+				_, err := resourceSvc.ListAccessMonitoringRules(ctx, accessmonitoringrulev1.ListAccessMonitoringRulesRequest_builder{
 					PageSize:  0,
 					PageToken: "",
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -164,9 +164,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
 				amr := sampleAccessMonitoringRuleFn(amrName)
-				_, err := resourceSvc.CreateAccessMonitoringRule(ctx, &accessmonitoringrulev1.CreateAccessMonitoringRuleRequest{
+				_, err := resourceSvc.CreateAccessMonitoringRule(ctx, accessmonitoringrulev1.CreateAccessMonitoringRuleRequest_builder{
 					Rule: amr,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -181,9 +181,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
 				amr := sampleAccessMonitoringRuleFn(amrName)
-				_, err := resourceSvc.CreateAccessMonitoringRule(ctx, &accessmonitoringrulev1.CreateAccessMonitoringRuleRequest{
+				_, err := resourceSvc.CreateAccessMonitoringRule(ctx, accessmonitoringrulev1.CreateAccessMonitoringRuleRequest_builder{
 					Rule: amr,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -195,9 +195,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
 				amr := sampleAccessMonitoringRuleFn(amrName)
-				_, err := resourceSvc.UpdateAccessMonitoringRule(ctx, &accessmonitoringrulev1.UpdateAccessMonitoringRuleRequest{
+				_, err := resourceSvc.UpdateAccessMonitoringRule(ctx, accessmonitoringrulev1.UpdateAccessMonitoringRuleRequest_builder{
 					Rule: amr,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -216,9 +216,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
 				amr := sampleAccessMonitoringRuleFn(amrName)
-				_, err := resourceSvc.UpdateAccessMonitoringRule(ctx, &accessmonitoringrulev1.UpdateAccessMonitoringRuleRequest{
+				_, err := resourceSvc.UpdateAccessMonitoringRule(ctx, accessmonitoringrulev1.UpdateAccessMonitoringRuleRequest_builder{
 					Rule: amr,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -235,9 +235,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
 				amr := sampleAccessMonitoringRuleFn(amrName)
-				_, err := resourceSvc.UpsertAccessMonitoringRule(ctx, &accessmonitoringrulev1.UpsertAccessMonitoringRuleRequest{
+				_, err := resourceSvc.UpsertAccessMonitoringRule(ctx, accessmonitoringrulev1.UpsertAccessMonitoringRuleRequest_builder{
 					Rule: amr,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -253,9 +253,9 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			Setup: func(t *testing.T, amrName string) {},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
 				amr := sampleAccessMonitoringRuleFn(amrName)
-				_, err := resourceSvc.UpsertAccessMonitoringRule(ctx, &accessmonitoringrulev1.UpsertAccessMonitoringRuleRequest{
+				_, err := resourceSvc.UpsertAccessMonitoringRule(ctx, accessmonitoringrulev1.UpsertAccessMonitoringRuleRequest_builder{
 					Rule: amr,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -266,7 +266,7 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 			Name: "no access to delete AccessMonitoringRule",
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.DeleteAccessMonitoringRule(ctx, &accessmonitoringrulev1.DeleteAccessMonitoringRuleRequest{Name: "x"})
+				_, err := resourceSvc.DeleteAccessMonitoringRule(ctx, accessmonitoringrulev1.DeleteAccessMonitoringRuleRequest_builder{Name: "x"}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -284,7 +284,7 @@ func TestAccessMonitoringRuleCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, amrName string) error {
-				_, err := resourceSvc.DeleteAccessMonitoringRule(ctx, &accessmonitoringrulev1.DeleteAccessMonitoringRuleRequest{Name: amrName})
+				_, err := resourceSvc.DeleteAccessMonitoringRule(ctx, accessmonitoringrulev1.DeleteAccessMonitoringRuleRequest_builder{Name: amrName}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
diff --git a/lib/auth/appauthconfig/appauthconfigv1/events.go b/lib/auth/appauthconfig/appauthconfigv1/events.go
index ee47f9f685f..5582a038451 100644
--- a/lib/auth/appauthconfig/appauthconfigv1/events.go
+++ b/lib/auth/appauthconfig/appauthconfigv1/events.go
@@ -73,12 +73,12 @@ func newVerifyJWTAuditEvent(ctx context.Context, req *appauthconfigv1.CreateAppS
 			Code: events.AppAuthConfigVerifySuccessCode,
 			Type: events.AppAuthConfigVerifySuccessEvent,
 		},
-		AppAuthConfig:   req.ConfigName,
+		AppAuthConfig:   req.GetConfigName(),
 		UserMetadata:    authz.ClientUserMetadata(ctx),
 		SessionMetadata: apievents.SessionMetadata{SessionID: sid},
 		AppMetadata: apievents.AppMetadata{
-			AppName: req.App.AppName,
-			AppURI:  req.App.Uri,
+			AppName: req.GetApp().GetAppName(),
+			AppURI:  req.GetApp().GetUri(),
 		},
 		Status: apievents.Status{
 			Success: true,
diff --git a/lib/auth/appauthconfig/appauthconfigv1/service.go b/lib/auth/appauthconfig/appauthconfigv1/service.go
index 624e6ab874e..700d4ac1f1c 100644
--- a/lib/auth/appauthconfig/appauthconfigv1/service.go
+++ b/lib/auth/appauthconfig/appauthconfigv1/service.go
@@ -130,10 +130,10 @@ func (s *Service) ListAppAuthConfigs(ctx context.Context, req *appauthconfigv1.L
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &appauthconfigv1.ListAppAuthConfigsResponse{
+	return appauthconfigv1.ListAppAuthConfigsResponse_builder{
 		Configs:       page,
 		NextPageToken: token,
-	}, nil
+	}.Build(), nil
 }
 
 // UpdateAppAuthConfig implements appauthconfigv1.AppAuthConfigServiceServer.
diff --git a/lib/auth/appauthconfig/appauthconfigv1/service_test.go b/lib/auth/appauthconfig/appauthconfigv1/service_test.go
index 6e8be234d1b..ebe953e6d80 100644
--- a/lib/auth/appauthconfig/appauthconfigv1/service_test.go
+++ b/lib/auth/appauthconfig/appauthconfigv1/service_test.go
@@ -26,6 +26,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	appauthconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/appauthconfig/v1"
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
@@ -65,9 +66,9 @@ func TestAppAuthConfigCRUD(t *testing.T) {
 		{
 			name: "CreateAppAuthConfig",
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
-				_, err := clt.ServiceUnderTest.CreateAppAuthConfig(ctx, &appauthconfigv1.CreateAppAuthConfigRequest{
+				_, err := clt.ServiceUnderTest.CreateAppAuthConfig(ctx, appauthconfigv1.CreateAppAuthConfigRequest_builder{
 					Config: newAppAuthConfigJWT(),
-				})
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{appAuthConfigRule(types.VerbCreate)},
@@ -80,9 +81,9 @@ func TestAppAuthConfigCRUD(t *testing.T) {
 				cfg1 := newAppAuthConfigJWT()
 				_, err := clt.CreateAppAuthConfig(ctx, cfg1)
 				require.NoError(t, err)
-				_, err = clt.ServiceUnderTest.GetAppAuthConfig(ctx, &appauthconfigv1.GetAppAuthConfigRequest{
-					Name: cfg1.Metadata.GetName(),
-				})
+				_, err = clt.ServiceUnderTest.GetAppAuthConfig(ctx, appauthconfigv1.GetAppAuthConfigRequest_builder{
+					Name: cfg1.GetMetadata().GetName(),
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{appAuthConfigRule(types.VerbRead)},
@@ -97,7 +98,7 @@ func TestAppAuthConfigCRUD(t *testing.T) {
 				resp, err := clt.ServiceUnderTest.ListAppAuthConfigs(ctx, &appauthconfigv1.ListAppAuthConfigsRequest{})
 				if err == nil {
 					require.NotNil(t, resp)
-					require.Len(t, resp.Configs, 2, "expected 2 inserted")
+					require.Len(t, resp.GetConfigs(), 2, "expected 2 inserted")
 				}
 				return err
 			},
@@ -109,13 +110,13 @@ func TestAppAuthConfigCRUD(t *testing.T) {
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
 				cfg, err := clt.CreateAppAuthConfig(ctx, newAppAuthConfigJWT())
 				require.NoError(t, err)
-				firstRev := cfg.Metadata.Revision
-				cfg, err = clt.ServiceUnderTest.UpdateAppAuthConfig(ctx, &appauthconfigv1.UpdateAppAuthConfigRequest{
+				firstRev := cfg.GetMetadata().GetRevision()
+				cfg, err = clt.ServiceUnderTest.UpdateAppAuthConfig(ctx, appauthconfigv1.UpdateAppAuthConfigRequest_builder{
 					Config: cfg,
-				})
+				}.Build())
 				if err == nil {
 					require.NotNil(t, cfg, "the updated resource should be returned")
-					require.NotEqual(t, firstRev, cfg.Metadata.Revision, "the resource should have been updated")
+					require.NotEqual(t, firstRev, cfg.GetMetadata().GetRevision(), "the resource should have been updated")
 				}
 				return err
 			},
@@ -126,9 +127,9 @@ func TestAppAuthConfigCRUD(t *testing.T) {
 			name: "UpsertAppAuthConfig",
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
 				cfg := newAppAuthConfigJWT()
-				_, err := clt.ServiceUnderTest.UpsertAppAuthConfig(ctx, &appauthconfigv1.UpsertAppAuthConfigRequest{
+				_, err := clt.ServiceUnderTest.UpsertAppAuthConfig(ctx, appauthconfigv1.UpsertAppAuthConfigRequest_builder{
 					Config: cfg,
-				})
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{appAuthConfigRule(types.VerbCreate, types.VerbUpdate)},
@@ -140,9 +141,9 @@ func TestAppAuthConfigCRUD(t *testing.T) {
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
 				cfg, err := clt.CreateAppAuthConfig(ctx, newAppAuthConfigJWT())
 				require.NoError(t, err)
-				_, err = clt.ServiceUnderTest.DeleteAppAuthConfig(ctx, &appauthconfigv1.DeleteAppAuthConfigRequest{
-					Name: cfg.Metadata.GetName(),
-				})
+				_, err = clt.ServiceUnderTest.DeleteAppAuthConfig(ctx, appauthconfigv1.DeleteAppAuthConfigRequest_builder{
+					Name: cfg.GetMetadata().GetName(),
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{appAuthConfigRule(types.VerbDelete)},
@@ -216,14 +217,12 @@ func (c *accessTest) run(t *testing.T) {
 func newAppAuthConfigJWT() *appauthconfigv1.AppAuthConfig {
 	return appauthconfig.NewAppAuthConfigJWT(
 		uuid.NewString(),
-		[]*labelv1.Label{{Name: "*", Values: []string{"*"}}},
-		&appauthconfigv1.AppAuthConfigJWTSpec{
+		[]*labelv1.Label{labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build()},
+		appauthconfigv1.AppAuthConfigJWTSpec_builder{
 			Issuer:   "https://issuer-url",
 			Audience: "teleport",
-			KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-				JwksUrl: "https://issuer-url/.well-known/jwks.json",
-			},
-		},
+			JwksUrl:  proto.String("https://issuer-url/.well-known/jwks.json"),
+		}.Build(),
 	)
 }
 
diff --git a/lib/auth/appauthconfig/appauthconfigv1/sessions_service.go b/lib/auth/appauthconfig/appauthconfigv1/sessions_service.go
index 32fe6b920ad..b0756cdc7d6 100644
--- a/lib/auth/appauthconfig/appauthconfigv1/sessions_service.go
+++ b/lib/auth/appauthconfig/appauthconfigv1/sessions_service.go
@@ -159,17 +159,17 @@ func (s *SessionsService) CreateAppSessionWithJWT(ctx context.Context, req *appa
 		return nil, trace.AccessDenied("this request can be only executed by a proxy")
 	}
 
-	sid := services.GenerateAppSessionIDFromJWT(req.Jwt)
+	sid := services.GenerateAppSessionIDFromJWT(req.GetJwt())
 	if err := validateCreateAppSessionWithJWTRequest(req); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	config, err := s.cache.GetAppAuthConfig(ctx, req.ConfigName)
+	config, err := s.cache.GetAppAuthConfig(ctx, req.GetConfigName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	jwtConfig := config.Spec.GetJwt()
+	jwtConfig := config.GetSpec().GetJwt()
 	if jwtConfig == nil {
 		return nil, trace.BadParameter("app auth config jwt session can only start with jwt configs")
 	}
@@ -179,7 +179,7 @@ func (s *SessionsService) CreateAppSessionWithJWT(ctx context.Context, req *appa
 		return nil, trace.Wrap(err)
 	}
 
-	username, tokenTTL, err := verifyAppAuthJWTToken(req.Jwt, jwks, sigs, jwtConfig)
+	username, tokenTTL, err := verifyAppAuthJWTToken(req.GetJwt(), jwks, sigs, jwtConfig)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -191,11 +191,11 @@ func (s *SessionsService) CreateAppSessionWithJWT(ctx context.Context, req *appa
 
 	ws, err := s.sessions.CreateAppSessionForAppAuth(ctx, &CreateAppSessionForAppAuthRequest{
 		Username:           username,
-		ClusterName:        req.App.ClusterName,
-		AppName:            req.App.AppName,
-		AppURI:             req.App.Uri,
-		AppPublicAddr:      req.App.PublicAddr,
-		LoginIP:            req.RemoteAddr,
+		ClusterName:        req.GetApp().GetClusterName(),
+		AppName:            req.GetApp().GetAppName(),
+		AppURI:             req.GetApp().GetUri(),
+		AppPublicAddr:      req.GetApp().GetPublicAddr(),
+		LoginIP:            req.GetRemoteAddr(),
 		Roles:              user.GetRoles(),
 		Traits:             user.GetTraits(),
 		TTL:                time.Until(tokenTTL),
@@ -206,16 +206,16 @@ func (s *SessionsService) CreateAppSessionWithJWT(ctx context.Context, req *appa
 		return nil, trace.Wrap(err)
 	}
 
-	return &appauthconfigv1.CreateAppSessionWithJWTResponse{Session: ws.(*types.WebSessionV2)}, nil
+	return appauthconfigv1.CreateAppSessionWithJWTResponse_builder{Session: ws.(*types.WebSessionV2)}.Build(), nil
 }
 
 // retrieveJWKSAppAuthConfig retrieves JWKS contents given a app auth JWT
 // config.
 func retrieveJWKSAppAuthConfig(jwtConfig *appauthconfigv1.AppAuthConfigJWTSpec, httpClient *http.Client) (*jose.JSONWebKeySet, []jose.SignatureAlgorithm, error) {
 	var rawJwks []byte
-	switch jwksSource := jwtConfig.KeysSource.(type) {
-	case *appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl:
-		req, err := http.NewRequest(http.MethodGet, jwksSource.JwksUrl, nil)
+	switch jwtConfig.WhichKeysSource() {
+	case appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl_case:
+		req, err := http.NewRequest(http.MethodGet, jwtConfig.GetJwksUrl(), nil)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
@@ -230,8 +230,8 @@ func retrieveJWKSAppAuthConfig(jwtConfig *appauthconfigv1.AppAuthConfigJWTSpec,
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
-	case *appauthconfigv1.AppAuthConfigJWTSpec_StaticJwks:
-		rawJwks = []byte(jwksSource.StaticJwks)
+	case appauthconfigv1.AppAuthConfigJWTSpec_StaticJwks_case:
+		rawJwks = []byte(jwtConfig.GetStaticJwks())
 	}
 
 	var jwks jose.JSONWebKeySet
@@ -268,8 +268,8 @@ func verifyAppAuthJWTToken(jwtToken string, jwks *jose.JSONWebKeySet, sigs []jos
 	}
 
 	expected := jwt.Expected{
-		Issuer:      jwtConfig.Issuer,
-		AnyAudience: jwt.Audience{jwtConfig.Audience},
+		Issuer:      jwtConfig.GetIssuer(),
+		AnyAudience: jwt.Audience{jwtConfig.GetAudience()},
 		Time:        time.Now(),
 	}
 	if err := claims.Validate(expected); err != nil {
@@ -289,7 +289,7 @@ func verifyAppAuthJWTToken(jwtToken string, jwks *jose.JSONWebKeySet, sigs []jos
 		return "", time.Time{}, trace.BadParameter("token must be issued recently to be used")
 	}
 
-	usernameClaimName := cmp.Or(jwtConfig.UsernameClaim, defaultUsernameClaim)
+	usernameClaimName := cmp.Or(jwtConfig.GetUsernameClaim(), defaultUsernameClaim)
 	usernameClaim, ok := remainingClaims[usernameClaimName]
 	if !ok {
 		return "", time.Time{}, trace.BadParameter("token must have %q claim", usernameClaimName)
@@ -305,17 +305,17 @@ func verifyAppAuthJWTToken(jwtToken string, jwks *jose.JSONWebKeySet, sigs []jos
 
 func validateCreateAppSessionWithJWTRequest(req *appauthconfigv1.CreateAppSessionWithJWTRequest) error {
 	switch {
-	case req.ConfigName == "":
+	case req.GetConfigName() == "":
 		return trace.BadParameter("create app session request requires an app auth config name")
-	case req.App == nil:
+	case !req.HasApp():
 		return trace.BadParameter("create app session request requires app information")
-	case req.App.AppName == "":
+	case req.GetApp().GetAppName() == "":
 		return trace.BadParameter("create app session request requires app name")
-	case req.App.ClusterName == "":
+	case req.GetApp().GetClusterName() == "":
 		return trace.BadParameter("create app session request requires app cluster name")
-	case req.App.PublicAddr == "":
+	case req.GetApp().GetPublicAddr() == "":
 		return trace.BadParameter("create app session request requires app public address")
-	case req.App.Uri == "":
+	case req.GetApp().GetUri() == "":
 		return trace.BadParameter("create app session request requires app uri")
 	}
 
diff --git a/lib/auth/appauthconfig/appauthconfigv1/sessions_service_test.go b/lib/auth/appauthconfig/appauthconfigv1/sessions_service_test.go
index d3a621d8d18..b57ee5fea33 100644
--- a/lib/auth/appauthconfig/appauthconfigv1/sessions_service_test.go
+++ b/lib/auth/appauthconfig/appauthconfigv1/sessions_service_test.go
@@ -32,6 +32,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	appauthconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/appauthconfig/v1"
 	labelv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/label/v1"
@@ -70,11 +71,9 @@ func TestRetrieveJWKS(t *testing.T) {
 	t.Run("static", func(t *testing.T) {
 		t.Run("valid", func(t *testing.T) {
 			jwksRes, sigsRes, err := retrieveJWKSAppAuthConfig(
-				&appauthconfigv1.AppAuthConfigJWTSpec{
-					KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_StaticJwks{
-						StaticJwks: string(encodedJwks),
-					},
-				},
+				appauthconfigv1.AppAuthConfigJWTSpec_builder{
+					StaticJwks: proto.String(string(encodedJwks)),
+				}.Build(),
 				nil, /* httpClient */
 			)
 			require.NoError(t, err)
@@ -84,11 +83,9 @@ func TestRetrieveJWKS(t *testing.T) {
 
 		t.Run("empty", func(t *testing.T) {
 			_, _, err := retrieveJWKSAppAuthConfig(
-				&appauthconfigv1.AppAuthConfigJWTSpec{
-					KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_StaticJwks{
-						StaticJwks: "{}",
-					},
-				},
+				appauthconfigv1.AppAuthConfigJWTSpec_builder{
+					StaticJwks: proto.String("{}"),
+				}.Build(),
 				nil, /* httpClient */
 			)
 			require.Error(t, err)
@@ -136,11 +133,9 @@ func TestRetrieveJWKS(t *testing.T) {
 				t.Cleanup(func() { httpSrv.Close() })
 
 				jwks, sigs, err := retrieveJWKSAppAuthConfig(
-					&appauthconfigv1.AppAuthConfigJWTSpec{
-						KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-							JwksUrl: httpSrv.URL,
-						},
-					},
+					appauthconfigv1.AppAuthConfigJWTSpec_builder{
+						JwksUrl: proto.String(httpSrv.URL),
+					}.Build(),
 					httpSrv.Client(),
 				)
 				tc.assertError(t, err)
@@ -162,11 +157,11 @@ func TestVerifyJWTToken(t *testing.T) {
 		assertUsername require.ValueAssertionFunc
 	}{
 		"valid token": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:        "https://issuer-url/",
 				Audience:      "teleport",
 				UsernameClaim: "username",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://issuer-url/",
 				Audience: []string{"teleport"},
@@ -182,10 +177,10 @@ func TestVerifyJWTToken(t *testing.T) {
 			},
 		},
 		"default username claim": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:   "https://issuer-url/",
 				Audience: "teleport",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://issuer-url/",
 				Audience: []string{"teleport"},
@@ -201,10 +196,10 @@ func TestVerifyJWTToken(t *testing.T) {
 			},
 		},
 		"wrong audience": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:   "https://issuer-url/",
 				Audience: "teleport",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://issuer-url/",
 				Audience: []string{"random-app"},
@@ -218,10 +213,10 @@ func TestVerifyJWTToken(t *testing.T) {
 			assertUsername: require.Empty,
 		},
 		"wrong issuer": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:   "https://issuer-url/",
 				Audience: "teleport",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://random-issuer/",
 				Audience: []string{"teleport"},
@@ -235,10 +230,10 @@ func TestVerifyJWTToken(t *testing.T) {
 			assertUsername: require.Empty,
 		},
 		"missing username claim": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:   "https://issuer-url/",
 				Audience: "teleport",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://issuer-url/",
 				Audience: []string{"teleport"},
@@ -250,10 +245,10 @@ func TestVerifyJWTToken(t *testing.T) {
 			assertUsername: require.Empty,
 		},
 		"missing issued at claim": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:   "https://issuer-url/",
 				Audience: "teleport",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://issuer-url/",
 				Audience: []string{"teleport"},
@@ -266,10 +261,10 @@ func TestVerifyJWTToken(t *testing.T) {
 			assertUsername: require.Empty,
 		},
 		"missing exp claim": {
-			config: &appauthconfigv1.AppAuthConfigJWTSpec{
+			config: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Issuer:   "https://issuer-url/",
 				Audience: "teleport",
-			},
+			}.Build(),
 			claims: jwt.Claims{
 				Issuer:   "https://issuer-url/",
 				Audience: []string{"teleport"},
@@ -293,14 +288,14 @@ func TestVerifyJWTToken(t *testing.T) {
 	}
 
 	t.Run("token freshness", func(t *testing.T) {
-		config := &appauthconfigv1.AppAuthConfigJWTSpec{
+		config := appauthconfigv1.AppAuthConfigJWTSpec_builder{
 			Issuer:        "https://issuer-url/",
 			Audience:      "teleport",
 			UsernameClaim: "email",
-		}
+		}.Build()
 		baseClaims := jwt.Claims{
-			Issuer:   config.Issuer,
-			Audience: []string{config.Audience},
+			Issuer:   config.GetIssuer(),
+			Audience: []string{config.GetAudience()},
 		}
 		usernameClaim := struct {
 			Email string `json:"email"`
@@ -352,14 +347,12 @@ func TestCreateAppSessionWithJWT(t *testing.T) {
 	user, err := types.NewUser("user")
 	require.NoError(t, err)
 
-	config := appauthconfig.NewAppAuthConfigJWT("test-config", []*labelv1.Label{{Name: "*", Values: []string{"*"}}}, &appauthconfigv1.AppAuthConfigJWTSpec{
+	config := appauthconfig.NewAppAuthConfigJWT("test-config", []*labelv1.Label{labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build()}, appauthconfigv1.AppAuthConfigJWTSpec_builder{
 		Issuer:        issuer,
 		Audience:      audience,
 		UsernameClaim: usernameClaim,
-		KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_StaticJwks{
-			StaticJwks: string(encodedJwks),
-		},
-	})
+		StaticJwks:    proto.String(string(encodedJwks)),
+	}.Build())
 
 	assertAuditEventFailure := func(tt require.TestingT, i1 any, i2 ...any) {
 		require.IsType(t, &apievents.AppAuthConfigVerify{}, i1, i2...)
@@ -468,16 +461,16 @@ func TestCreateAppSessionWithJWT(t *testing.T) {
 			})
 			require.NoError(t, err)
 
-			_, err = svc.CreateAppSessionWithJWT(t.Context(), &appauthconfigv1.CreateAppSessionWithJWTRequest{
+			_, err = svc.CreateAppSessionWithJWT(t.Context(), appauthconfigv1.CreateAppSessionWithJWTRequest_builder{
 				ConfigName: "app-config-example",
 				Jwt:        tc.token,
-				App: &appauthconfigv1.App{
+				App: appauthconfigv1.App_builder{
 					AppName:     "mcp-app",
 					PublicAddr:  "https://proxy/mcp-app",
 					Uri:         "mcp+https://localhost/mcp",
 					ClusterName: "example",
-				},
-			})
+				}.Build(),
+			}.Build())
 			tc.assertError(t, err)
 			tc.assertAuditEvent(t, emitter.LastEvent())
 		})
diff --git a/lib/auth/auth.go b/lib/auth/auth.go
index bda5ce2236d..c84f757dd6a 100644
--- a/lib/auth/auth.go
+++ b/lib/auth/auth.go
@@ -2370,7 +2370,7 @@ func (a *Server) doReleaseAlertSync(ctx context.Context, current vc.Target, visi
 	// server is up to date, but instances not connected to this auth need update.
 	var instanceVisitor vc.Visitor
 	a.inventory.UniqueHandles(func(handle inventory.UpstreamHandle) {
-		v := vc.Normalize(handle.Hello().Version)
+		v := vc.Normalize(handle.Hello().GetVersion())
 		instanceVisitor.Visit(vc.NewTarget(v))
 	})
 
@@ -5557,14 +5557,14 @@ func (a *Server) GenerateHostCerts(ctx context.Context, params HostCertsParams)
 
 	var agentScopePin *scopesv1.Pin
 	if useAgentPin {
-		agentScopePin = &scopesv1.Pin{
+		agentScopePin = scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 			Scope: params.AgentScope,
-			SystemRoles: &scopesv1.SystemRoles{
+			SystemRoles: scopesv1.SystemRoles_builder{
 				Primary:    req.Role.String(),
 				Additional: systemRoles,
-			},
-		}
+			}.Build(),
+		}.Build()
 	}
 
 	// Agent scope pins encode role and scope solely via ScopePin; setting the
@@ -5682,10 +5682,10 @@ func (a *Server) RegisterInventoryControlStream(ics client.UpstreamInventoryCont
 	// in order to simplify creation of in-memory streams when dealing with local auth (note: in theory we could
 	// send hellos simultaneously to slightly improve perf, but there is a potential benefit to having the
 	// downstream hello serve double-duty as an indicator of having successfully transitioned the rbac layer).
-	downstreamHello := &proto.DownstreamInventoryHello{
+	downstreamHello := proto.DownstreamInventoryHello_builder{
 		Version:  teleport.Version,
 		ServerID: a.ServerID,
-		Capabilities: &proto.DownstreamInventoryHello_SupportedCapabilities{
+		Capabilities: proto.DownstreamInventoryHello_SupportedCapabilities_builder{
 			NodeHeartbeats:                true,
 			AppHeartbeats:                 true,
 			AppCleanup:                    true,
@@ -5695,8 +5695,8 @@ func (a *Server) RegisterInventoryControlStream(ics client.UpstreamInventoryCont
 			KubernetesHeartbeats:          true,
 			KubernetesCleanup:             true,
 			RelayServerHeartbeatsCleanup:  true,
-		},
-	}
+		}.Build(),
+	}.Build()
 	if err := ics.Send(a.CloseContext(), downstreamHello); err != nil {
 		return trace.Wrap(err)
 	}
@@ -5730,35 +5730,35 @@ func (a *Server) MakeLocalInventoryControlStream(opts ...client.ICSPipeOption) c
 
 func (a *Server) GetInventoryStatus(ctx context.Context, req *proto.InventoryStatusRequest) (*proto.InventoryStatusSummary, error) {
 	rsp := new(proto.InventoryStatusSummary)
-	if req.Connected {
+	if req.GetConnected() {
 		a.inventory.UniqueHandles(func(handle inventory.UpstreamHandle) {
-			rsp.Connected = append(rsp.Connected, handle.Hello())
+			rsp.SetConnected(append(rsp.GetConnected(), handle.Hello()))
 		})
 
 		// connected instance list is a special case, don't bother aggregating heartbeats
 		return rsp, nil
 	}
 
-	rsp.VersionCounts = make(map[string]uint32)
-	rsp.UpgraderCounts = make(map[string]uint32)
-	rsp.ServiceCounts = make(map[string]uint32)
+	rsp.SetVersionCounts(make(map[string]uint32))
+	rsp.SetUpgraderCounts(make(map[string]uint32))
+	rsp.SetServiceCounts(make(map[string]uint32))
 
 	ins := a.GetInstances(ctx, types.InstanceFilter{})
 
 	for ins.Next() {
-		rsp.InstanceCount++
+		rsp.SetInstanceCount(rsp.GetInstanceCount() + 1)
 
-		rsp.VersionCounts[vc.Normalize(ins.Item().GetTeleportVersion())]++
+		rsp.GetVersionCounts()[vc.Normalize(ins.Item().GetTeleportVersion())]++
 
 		upgrader := ins.Item().GetExternalUpgrader()
 		if upgrader == "" {
 			upgrader = "none"
 		}
 
-		rsp.UpgraderCounts[upgrader]++
+		rsp.GetUpgraderCounts()[upgrader]++
 
 		for _, service := range ins.Item().GetServices() {
-			rsp.ServiceCounts[string(service)]++
+			rsp.GetServiceCounts()[string(service)]++
 		}
 	}
 
@@ -6160,31 +6160,29 @@ func (a *Server) CreateAccessRequestV2(ctx context.Context, req types.AccessRequ
 		}
 	}
 
-	_, err = a.Services.CreateGlobalNotification(ctx, &notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-				ByPermissions: &notificationsv1.ByPermissions{
-					RoleConditions: []*types.RoleConditions{
-						{
-							ReviewRequests: &types.AccessReviewConditions{
-								Roles: req.GetOriginalRoles(),
-							},
+	_, err = a.Services.CreateGlobalNotification(ctx, notificationsv1.GlobalNotification_builder{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			ByPermissions: notificationsv1.ByPermissions_builder{
+				RoleConditions: []*types.RoleConditions{
+					{
+						ReviewRequests: &types.AccessReviewConditions{
+							Roles: req.GetOriginalRoles(),
 						},
 					},
 				},
-			},
+			}.Build(),
 			// Prevent the requester from seeing the notification for their own access request.
 			ExcludeUsers: []string{req.GetUser()},
-			Notification: &notificationsv1.Notification{
+			Notification: notificationsv1.Notification_builder{
 				Spec:    &notificationsv1.NotificationSpec{},
 				SubKind: types.NotificationAccessRequestPendingSubKind,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Labels:  map[string]string{types.NotificationTitleLabel: notificationText, "request-id": req.GetName()},
 					Expires: timestamppb.New(req.Expiry()),
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		a.logger.WarnContext(ctx, "Failed to create access request notification", "error", err)
 	}
@@ -6566,12 +6564,12 @@ func generateAccessRequestReviewedNotification(req types.AccessRequest, params t
 		assumableTime = req.GetAssumeStartTime().Format("2006-01-02T15:04:05.000Z0700")
 	}
 
-	return &notificationsv1.Notification{
-		Spec: &notificationsv1.NotificationSpec{
+	return notificationsv1.Notification_builder{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: req.GetUser(),
-		},
+		}.Build(),
 		SubKind: subKind,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: notificationText,
 				"request-id":                 params.RequestID,
@@ -6579,8 +6577,8 @@ func generateAccessRequestReviewedNotification(req types.AccessRequest, params t
 				"assumable-time":             assumableTime,
 			},
 			Expires: timestamppb.New(req.Expiry()),
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func (a *Server) GetAccessCapabilities(ctx context.Context, req types.AccessCapabilitiesRequest) (*types.AccessCapabilities, error) {
@@ -7323,7 +7321,7 @@ func (a *Server) CreateAccessListReminderNotifications(ctx context.Context, opts
 		accessListIDs := set.New[string]()
 		for _, id := range identifiers {
 			// id.Spec.UniqueIdentifier is the access list ID
-			accessListIDs.Add(id.Spec.UniqueIdentifier)
+			accessListIDs.Add(id.GetSpec().GetUniqueIdentifier())
 		}
 
 		// owners is the combined list of owners for relevant access lists we are creating the notification for.
@@ -7380,54 +7378,50 @@ func (a *Server) CreateAccessListReminderNotifications(ctx context.Context, opts
 
 // createAccessListReminderNotification is a helper function to create a notification for an access list reminder.
 func (a *Server) createAccessListReminderNotification(ctx context.Context, owners []string, subkind string, title string) error {
-	_, err := a.Services.CreateGlobalNotification(ctx, &notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_ByUsers{
-				ByUsers: &notificationsv1.ByUsers{
-					Users: owners,
-				},
-			},
-			Notification: &notificationsv1.Notification{
+	_, err := a.Services.CreateGlobalNotification(ctx, notificationsv1.GlobalNotification_builder{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			ByUsers: notificationsv1.ByUsers_builder{
+				Users: owners,
+			}.Build(),
+			Notification: notificationsv1.Notification_builder{
 				Spec:    &notificationsv1.NotificationSpec{},
 				SubKind: subkind,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Labels: map[string]string{types.NotificationTitleLabel: title},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return err
 	}
 
 	// Also create a notification for users who have CRUD permissions for access lists. This is because they can also review access lists.
-	_, err = a.Services.CreateGlobalNotification(ctx, &notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-				ByPermissions: &notificationsv1.ByPermissions{
-					RoleConditions: []*types.RoleConditions{
-						{
-							Rules: []types.Rule{
-								{
-									Resources: []string{types.KindAccessList},
-									Verbs:     services.RW(),
-								},
+	_, err = a.Services.CreateGlobalNotification(ctx, notificationsv1.GlobalNotification_builder{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			ByPermissions: notificationsv1.ByPermissions_builder{
+				RoleConditions: []*types.RoleConditions{
+					{
+						Rules: []types.Rule{
+							{
+								Resources: []string{types.KindAccessList},
+								Verbs:     services.RW(),
 							},
 						},
 					},
 				},
-			},
+			}.Build(),
 			// Exclude the list of owners so that they don't get a duplicate notification, since we already created a notification for them.
 			ExcludeUsers: owners,
-			Notification: &notificationsv1.Notification{
+			Notification: notificationsv1.Notification_builder{
 				Spec:    &notificationsv1.NotificationSpec{},
 				SubKind: subkind,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Labels: map[string]string{types.NotificationTitleLabel: title},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return err
 	}
diff --git a/lib/auth/auth_login_test.go b/lib/auth/auth_login_test.go
index 2dc334924cf..80a8adbb8a0 100644
--- a/lib/auth/auth_login_test.go
+++ b/lib/auth/auth_login_test.go
@@ -975,69 +975,69 @@ func TestBasicSSHScopedLogin(t *testing.T) {
 
 	// set up some scoped roles
 	scopedRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-a",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/aa"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"login-a"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-b",
-			},
+			}.Build(),
 			Scope: "/aa/bb",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/aa/bb"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"login-b"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-c",
-			},
+			}.Build(),
 			Scope: "/aa/bb/cc",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/aa/bb/cc"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"login-c"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-x",
-			},
+			}.Build(),
 			Scope: "/xx",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/xx"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"login-x"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	// Create the roles.
 	for _, role := range scopedRoles {
-		_, err := adminClient.ScopedAccessServiceClient().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := adminClient.ScopedAccessServiceClient().CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -1045,26 +1045,26 @@ func TestBasicSSHScopedLogin(t *testing.T) {
 	for _, role := range scopedRoles {
 		assignmentID := uuid.NewString()
 		assignmentIDs = append(assignmentIDs, assignmentID)
-		_, err = adminClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+		_, err = adminClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+			Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    scopedaccess.KindScopedRoleAssignment,
 				SubKind: scopedaccess.SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: assignmentID,
-				},
+				}.Build(),
 				Scope: role.GetScope(),
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  role.GetMetadata().GetName(),
 							Scope: role.GetScope(),
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -1095,7 +1095,7 @@ func TestBasicSSHScopedLogin(t *testing.T) {
 	require.NoError(t, err)
 
 	// verify that the expected scope pin is applied to ssh and tls certificates
-	expectedPin := &scopesv1.Pin{
+	expectedPin := scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_USER,
 		Scope: "/aa/bb",
 		AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -1103,7 +1103,7 @@ func TestBasicSSHScopedLogin(t *testing.T) {
 			"/aa/bb":    {"/aa/bb": {"role-b"}},
 			"/aa/bb/cc": {"/aa/bb/cc": {"role-c"}},
 		}),
-	}
+	}.Build()
 
 	// parse and examine the ssh cert
 	sshCert, err := sshutils.ParseCertificate(authrsp.Cert)
diff --git a/lib/auth/auth_test.go b/lib/auth/auth_test.go
index 649c7ca4001..2d18055fe2d 100644
--- a/lib/auth/auth_test.go
+++ b/lib/auth/auth_test.go
@@ -46,10 +46,11 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport"
-	"github.com/gravitational/teleport/api/client/proto"
+	clientproto "github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/constants"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	devicepb "github.com/gravitational/teleport/api/gen/proto/go/teleport/devicetrust/v1"
@@ -407,20 +408,20 @@ func TestAuthenticateWebUser_deviceWebToken(t *testing.T) {
 		switch {
 		case dwt == nil:
 			return nil, errors.New("dtw parameter is nil")
-		case dwt.WebSessionId == "":
+		case dwt.GetWebSessionId() == "":
 			return nil, errors.New("dwt.WebSessionId is empty")
-		case dwt.BrowserUserAgent == "":
+		case dwt.GetBrowserUserAgent() == "":
 			return nil, errors.New("dwt.BrowserUserAgent is empty")
-		case dwt.BrowserIp != remoteIP:
+		case dwt.GetBrowserIp() != remoteIP:
 			return nil, errors.New("dwt.BrowserUserAgent is empty")
-		case dwt.User != user:
+		case dwt.GetUser() != user:
 			return nil, errors.New("dwt.User mismatch")
 		}
 
-		return &devicepb.DeviceWebToken{
+		return devicepb.DeviceWebToken_builder{
 			Id:    "this is an opaque ID",
 			Token: "this is an opaque token",
-		}, nil
+		}.Build(), nil
 	}
 
 	makeTokenError := func(context.Context, *devicepb.DeviceWebToken) (*devicepb.DeviceWebToken, error) {
@@ -438,9 +439,9 @@ func TestAuthenticateWebUser_deviceWebToken(t *testing.T) {
 		if dwt == nil {
 			return nil, errors.New("dwt required")
 		}
-		uaToSessionID.Store(dwt.BrowserUserAgent, dwt.GetWebSessionId())
+		uaToSessionID.Store(dwt.GetBrowserUserAgent(), dwt.GetWebSessionId())
 
-		if strings.HasPrefix(dwt.BrowserUserAgent, "fail") {
+		if strings.HasPrefix(dwt.GetBrowserUserAgent(), "fail") {
 			return makeTokenError(ctx, dwt)
 		}
 
@@ -983,9 +984,9 @@ func TestAuthenticateUser_mfaDeviceLocked(t *testing.T) {
 	require.NoError(t, err, "NewClient")
 
 	// OTP devices would work for this test too.
-	dev1, err := authtest.RegisterTestDevice(ctx, userClient, "dev1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	dev1, err := authtest.RegisterTestDevice(ctx, userClient, "dev1", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice")
-	dev2, err := authtest.RegisterTestDevice(ctx, userClient, "dev2", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, dev1 /* authenticator */)
+	dev2, err := authtest.RegisterTestDevice(ctx, userClient, "dev2", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, dev1 /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice")
 
 	// Users initially authenticate via Proxy, as there isn't a userClient before
@@ -994,9 +995,9 @@ func TestAuthenticateUser_mfaDeviceLocked(t *testing.T) {
 	require.NoError(t, err, "NewClient")
 
 	authenticateSSH := func(dev *authtest.Device) (*authclient.CLILoginResponse, error) {
-		chal, err := proxyClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-			Request: &proto.CreateAuthenticateChallengeRequest_UserCredentials{
-				UserCredentials: &proto.UserCredentials{
+		chal, err := proxyClient.CreateAuthenticateChallenge(ctx, &clientproto.CreateAuthenticateChallengeRequest{
+			Request: &clientproto.CreateAuthenticateChallengeRequest_UserCredentials{
+				UserCredentials: &clientproto.UserCredentials{
 					Username: user,
 					Password: []byte(pass),
 				},
@@ -1049,9 +1050,9 @@ func TestAuthenticateUser_mfaDeviceLocked(t *testing.T) {
 	})
 
 	t.Run("locked device password change", func(t *testing.T) {
-		chal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-			Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
-				ContextUser: &proto.ContextUser{},
+		chal, err := userClient.CreateAuthenticateChallenge(ctx, &clientproto.CreateAuthenticateChallengeRequest{
+			Request: &clientproto.CreateAuthenticateChallengeRequest_ContextUser{
+				ContextUser: &clientproto.ContextUser{},
 			},
 			ChallengeExtensions: &mfav1.ChallengeExtensions{
 				Scope: mfav1.ChallengeScope_CHALLENGE_SCOPE_CHANGE_PASSWORD,
@@ -1064,7 +1065,7 @@ func TestAuthenticateUser_mfaDeviceLocked(t *testing.T) {
 		require.NoError(t, err, "SolveAuthn")
 
 		assert.ErrorContains(t,
-			userClient.ChangePassword(ctx, &proto.ChangePasswordRequest{
+			userClient.ChangePassword(ctx, &clientproto.ChangePasswordRequest{
 				User:        user,
 				OldPassword: []byte(pass),
 				NewPassword: []byte("evenmoresecret!!1!ONE"),
@@ -1223,14 +1224,14 @@ func TestLocalControlStream(t *testing.T) {
 	stream := s.a.MakeLocalInventoryControlStream()
 	defer stream.Close()
 
-	err := stream.Send(ctx, &proto.UpstreamInventoryHello{
+	err := stream.Send(ctx, clientproto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	select {
 	case msg := <-stream.Recv():
-		_, ok := msg.(*proto.DownstreamInventoryHello)
+		_, ok := msg.(*clientproto.DownstreamInventoryHello)
 		require.True(t, ok)
 	case <-stream.Done():
 		t.Fatalf("stream closed unexpectedly: %v", stream.Error())
@@ -1246,13 +1247,14 @@ func TestLocalControlStream(t *testing.T) {
 	}, time.Second*5, time.Millisecond*200)
 
 	// try performing a normal operation against the control stream to double-check that it is healthy
-	go s.a.PingInventory(ctx, proto.InventoryPingRequest{
+	go s.a.PingInventory(ctx, clientproto.InventoryPingRequest{
 		ServerID: serverID,
 	})
 
 	select {
 	case msg := <-stream.Recv():
-		require.IsType(t, *new(*proto.DownstreamInventoryPing), msg)
+		var want *clientproto.DownstreamInventoryPing
+		require.IsType(t, want, msg)
 	case <-stream.Done():
 		t.Fatalf("stream closed unexpectedly: %v", stream.Error())
 	case <-time.After(time.Second * 10):
@@ -2927,11 +2929,11 @@ func TestGenerateOpenSSHCert(t *testing.T) {
 	priv, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.Ed25519)
 	require.NoError(t, err)
 
-	reply, err := p.a.GenerateOpenSSHCert(ctx, &proto.OpenSSHCertRequest{
+	reply, err := p.a.GenerateOpenSSHCert(ctx, &clientproto.OpenSSHCertRequest{
 		User:      user,
 		Roles:     []*types.RoleV6{role},
 		PublicKey: priv.MarshalSSHPublicKey(),
-		TTL:       proto.Duration(time.Hour),
+		TTL:       clientproto.Duration(time.Hour),
 		Cluster:   p.clusterName.GetClusterName(),
 	})
 	require.NoError(t, err)
@@ -2982,11 +2984,11 @@ func TestGenerateOpenSSHCert(t *testing.T) {
 		priv, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.Ed25519)
 		require.NoError(t, err)
 
-		reply, err := p.a.GenerateOpenSSHCert(ctx, &proto.OpenSSHCertRequest{
+		reply, err := p.a.GenerateOpenSSHCert(ctx, &clientproto.OpenSSHCertRequest{
 			User:      user,
 			Roles:     []*types.RoleV6{role},
 			PublicKey: priv.MarshalSSHPublicKey(),
-			TTL:       proto.Duration(time.Hour),
+			TTL:       clientproto.Duration(time.Hour),
 			Cluster:   p.clusterName.GetClusterName(),
 		})
 		require.NoError(t, err)
@@ -3023,49 +3025,49 @@ func TestGenerateOpenSSHCertScoped(t *testing.T) {
 	// Create a scoped role at /staging that grants "scoped-login".
 	scopedService := local.NewScopedAccessService(p.bk)
 
-	_, err = scopedService.CreateScopedRole(ctx, &scopedaccessv1pb.CreateScopedRoleRequest{
-		Role: &scopedaccessv1pb.ScopedRole{
+	_, err = scopedService.CreateScopedRole(ctx, scopedaccessv1pb.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1pb.ScopedRole_builder{
 			Kind: "scoped_role",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-ssh",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1pb.ScopedRoleSpec{
+			Spec: scopedaccessv1pb.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
-				Ssh: &scopedaccessv1pb.ScopedRoleSSH{
+				Ssh: scopedaccessv1pb.ScopedRoleSSH_builder{
 					Logins: []string{"scoped-login"},
 					Labels: []*labelv1.Label{
-						{Name: "*", Values: []string{"*"}},
+						labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	_, err = scopedService.CreateScopedRoleAssignment(ctx, &scopedaccessv1pb.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1pb.ScopedRoleAssignment{
+	_, err = scopedService.CreateScopedRoleAssignment(ctx, scopedaccessv1pb.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1pb.ScopedRoleAssignment_builder{
 			Kind: "scoped_role_assignment",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope:   "/staging",
 			SubKind: "dynamic",
-			Spec: &scopedaccessv1pb.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1pb.ScopedRoleAssignmentSpec_builder{
 				User: "scoped-user",
 				Assignments: []*scopedaccessv1pb.Assignment{
-					{
+					scopedaccessv1pb.Assignment_builder{
 						Role:  "staging-ssh",
 						Scope: "/staging",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	pin := &scopesv1pb.Pin{Kind: scopesv1pb.PinKind_PIN_KIND_USER, Scope: "/staging"}
+	pin := scopesv1pb.Pin_builder{Kind: scopesv1pb.PinKind_PIN_KIND_USER, Scope: "/staging"}.Build()
 
 	// Wait for scoped access cache to see the assignment.
 	require.EventuallyWithT(t, func(ct *assert.CollectT) {
@@ -3075,11 +3077,11 @@ func TestGenerateOpenSSHCertScoped(t *testing.T) {
 	}, 15*time.Second, 100*time.Millisecond)
 
 	t.Run("valid login in principals", func(t *testing.T) {
-		reply, err := p.a.GenerateOpenSSHCert(ctx, &proto.OpenSSHCertRequest{
+		reply, err := p.a.GenerateOpenSSHCert(ctx, &clientproto.OpenSSHCertRequest{
 			User:      user,
 			Roles:     []*types.RoleV6{role},
 			PublicKey: priv.MarshalSSHPublicKey(),
-			TTL:       proto.Duration(time.Hour),
+			TTL:       clientproto.Duration(time.Hour),
 			Cluster:   p.clusterName.GetClusterName(),
 			ScopePin:  pin,
 			Login:     "scoped-login",
@@ -3092,11 +3094,11 @@ func TestGenerateOpenSSHCertScoped(t *testing.T) {
 	})
 
 	t.Run("errors when login is not provided", func(t *testing.T) {
-		_, err := p.a.GenerateOpenSSHCert(ctx, &proto.OpenSSHCertRequest{
+		_, err := p.a.GenerateOpenSSHCert(ctx, &clientproto.OpenSSHCertRequest{
 			User:      user,
 			Roles:     []*types.RoleV6{role},
 			PublicKey: priv.MarshalSSHPublicKey(),
-			TTL:       proto.Duration(time.Hour),
+			TTL:       clientproto.Duration(time.Hour),
 			Cluster:   p.clusterName.GetClusterName(),
 			ScopePin:  pin,
 			Login:     "",
@@ -3639,42 +3641,42 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 	require.NoError(t, err)
 
 	// webDev1 is used as the authenticator for various checks.
-	webDev1, err := authtest.RegisterTestDevice(ctx, userClient, "web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev1, err := authtest.RegisterTestDevice(ctx, userClient, "web1", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice(web1)")
 
 	// Insert devices for deletion.
 	deviceOpts := []authtest.TestDeviceOpt{authtest.WithTestDeviceClock(testServer.Clock())}
-	registerDevice := func(t *testing.T, deviceName string, deviceType proto.DeviceType) *authtest.Device {
+	registerDevice := func(t *testing.T, deviceName string, deviceType clientproto.DeviceType) *authtest.Device {
 		t.Helper()
 		testDev, err := authtest.RegisterTestDevice(
 			ctx, userClient, deviceName, deviceType, webDev1 /* authenticator */, deviceOpts...)
 		require.NoError(t, err, "RegisterTestDevice(%v)", deviceName)
 		return testDev
 	}
-	deleteWeb1 := registerDevice(t, "delete-web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN)
-	deleteWeb2 := registerDevice(t, "delete-web2", proto.DeviceType_DEVICE_TYPE_WEBAUTHN)
-	deleteTOTP1 := registerDevice(t, "delete-totp1", proto.DeviceType_DEVICE_TYPE_TOTP)
-	deleteTOTP2 := registerDevice(t, "delete-totp2", proto.DeviceType_DEVICE_TYPE_TOTP)
+	deleteWeb1 := registerDevice(t, "delete-web1", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN)
+	deleteWeb2 := registerDevice(t, "delete-web2", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN)
+	deleteTOTP1 := registerDevice(t, "delete-totp1", clientproto.DeviceType_DEVICE_TYPE_TOTP)
+	deleteTOTP2 := registerDevice(t, "delete-totp2", clientproto.DeviceType_DEVICE_TYPE_TOTP)
 
-	deleteReqUsingToken := func(tokenReq authclient.CreateUserTokenRequest) func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
-		return func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
+	deleteReqUsingToken := func(tokenReq authclient.CreateUserTokenRequest) func(t *testing.T) *clientproto.DeleteMFADeviceSyncRequest {
+		return func(t *testing.T) *clientproto.DeleteMFADeviceSyncRequest {
 			token, err := authServer.NewUserToken(ctx, tokenReq)
 			require.NoError(t, err, "newUserToken")
 
 			_, err = authServer.CreateUserToken(ctx, token)
 			require.NoError(t, err, "CreateUserToken")
 
-			return &proto.DeleteMFADeviceSyncRequest{
+			return &clientproto.DeleteMFADeviceSyncRequest{
 				TokenID: token.GetName(),
 			}
 		}
 	}
 
-	deleteReqUsingChallenge := func(authenticator *authtest.Device) func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
-		return func(t *testing.T) *proto.DeleteMFADeviceSyncRequest {
-			authnChal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-				Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
-					ContextUser: &proto.ContextUser{},
+	deleteReqUsingChallenge := func(authenticator *authtest.Device) func(t *testing.T) *clientproto.DeleteMFADeviceSyncRequest {
+		return func(t *testing.T) *clientproto.DeleteMFADeviceSyncRequest {
+			authnChal, err := userClient.CreateAuthenticateChallenge(ctx, &clientproto.CreateAuthenticateChallengeRequest{
+				Request: &clientproto.CreateAuthenticateChallengeRequest_ContextUser{
+					ContextUser: &clientproto.ContextUser{},
 				},
 				ChallengeExtensions: &mfav1.ChallengeExtensions{
 					Scope: mfav1.ChallengeScope_CHALLENGE_SCOPE_MANAGE_DEVICES,
@@ -3685,7 +3687,7 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 			authnSolved, err := authenticator.SolveAuthn(authnChal)
 			require.NoError(t, err, "SolveAuthn")
 
-			return &proto.DeleteMFADeviceSyncRequest{
+			return &clientproto.DeleteMFADeviceSyncRequest{
 				ExistingMFAResponse: authnSolved,
 			}
 		}
@@ -3693,7 +3695,7 @@ func TestDeleteMFADeviceSync(t *testing.T) {
 
 	tests := []struct {
 		name            string
-		createDeleteReq func(t *testing.T) *proto.DeleteMFADeviceSyncRequest
+		createDeleteReq func(t *testing.T) *clientproto.DeleteMFADeviceSyncRequest
 		deviceToDelete  string
 	}{
 		{
@@ -3787,11 +3789,11 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 	// Insert a device.
 	const devName = "otp"
 	_, err = authtest.RegisterTestDevice(
-		ctx, userClient, devName, proto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, authtest.WithTestDeviceClock(clock))
+		ctx, userClient, devName, clientproto.DeviceType_DEVICE_TYPE_TOTP, nil /* authenticator */, authtest.WithTestDeviceClock(clock))
 	require.NoError(t, err)
 
-	createReq := func(name string) *proto.DeleteMFADeviceSyncRequest {
-		return &proto.DeleteMFADeviceSyncRequest{
+	createReq := func(name string) *clientproto.DeleteMFADeviceSyncRequest {
+		return &clientproto.DeleteMFADeviceSyncRequest{
 			DeviceName: name,
 		}
 	}
@@ -3799,13 +3801,13 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 	tests := []struct {
 		name         string
 		tokenRequest *authclient.CreateUserTokenRequest
-		deleteReq    *proto.DeleteMFADeviceSyncRequest
+		deleteReq    *clientproto.DeleteMFADeviceSyncRequest
 		wantErr      string
 		assertErr    func(error) bool
 	}{
 		{
 			name: "token not found",
-			deleteReq: &proto.DeleteMFADeviceSyncRequest{
+			deleteReq: &clientproto.DeleteMFADeviceSyncRequest{
 				TokenID:    "unknown-token-id",
 				DeviceName: devName,
 			},
@@ -3830,7 +3832,7 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 				TTL:  5 * time.Minute,
 				Type: authclient.UserTokenTypeRecoveryApproved,
 			},
-			deleteReq: &proto.DeleteMFADeviceSyncRequest{
+			deleteReq: &clientproto.DeleteMFADeviceSyncRequest{
 				DeviceName: "does-not-exist",
 			},
 			wantErr:   "does not exist",
@@ -3844,11 +3846,11 @@ func TestDeleteMFADeviceSync_WithErrors(t *testing.T) {
 		},
 		{
 			name: "invalid challenge",
-			deleteReq: &proto.DeleteMFADeviceSyncRequest{
+			deleteReq: &clientproto.DeleteMFADeviceSyncRequest{
 				DeviceName: devName,
-				ExistingMFAResponse: &proto.MFAAuthenticateResponse{
-					Response: &proto.MFAAuthenticateResponse_TOTP{
-						TOTP: &proto.TOTPResponse{
+				ExistingMFAResponse: &clientproto.MFAAuthenticateResponse{
+					Response: &clientproto.MFAAuthenticateResponse_TOTP{
+						TOTP: &clientproto.TOTPResponse{
 							Code: "not an OTP code",
 						},
 					},
@@ -3917,9 +3919,9 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 
 	deleteDevice := func(userClient *authclient.Client, testDev *authtest.Device) error {
 		// Issue and solve authn challenge.
-		authnChal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-			Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
-				ContextUser: &proto.ContextUser{},
+		authnChal, err := userClient.CreateAuthenticateChallenge(ctx, &clientproto.CreateAuthenticateChallengeRequest{
+			Request: &clientproto.CreateAuthenticateChallengeRequest_ContextUser{
+				ContextUser: &clientproto.ContextUser{},
 			},
 			ChallengeExtensions: &mfav1.ChallengeExtensions{
 				Scope: mfav1.ChallengeScope_CHALLENGE_SCOPE_MANAGE_DEVICES,
@@ -3933,7 +3935,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 			return err
 		}
 
-		return userClient.DeleteMFADeviceSync(ctx, &proto.DeleteMFADeviceSyncRequest{
+		return userClient.DeleteMFADeviceSync(ctx, &clientproto.DeleteMFADeviceSyncRequest{
 			DeviceName:          testDev.MFA.GetName(),
 			ExistingMFAResponse: authnSolved,
 		})
@@ -3951,7 +3953,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 				deleteDevice(userClient, deviceToDelete),
 				wantErr)
 
-			devicesResp, err := userClient.GetMFADevices(ctx, &proto.GetMFADevicesRequest{})
+			devicesResp, err := userClient.GetMFADevices(ctx, &clientproto.GetMFADevicesRequest{})
 			require.NoError(t, err, "GetMFADevices")
 			devName := deviceToDelete.MFA.GetName()
 			for _, dev := range devicesResp.Devices {
@@ -3978,7 +3980,7 @@ func TestDeleteMFADeviceSync_lastDevice(t *testing.T) {
 	t.Run("second factor on, otp device", makeTest(constants.SecondFactorOn, totpDev))
 
 	// Same as above, but now delete the last Webauthn device.
-	webDev, err = authtest.RegisterTestDevice(ctx, userClient, "web1", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev /* authenticator */)
+	webDev, err = authtest.RegisterTestDevice(ctx, userClient, "web1", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, totpDev /* authenticator */)
 	require.NoError(t, err, "RegisterTestDevice")
 	require.NoError(t,
 		deleteDevice(userClient, totpDev),
@@ -4017,14 +4019,14 @@ func TestAddMFADeviceSync(t *testing.T) {
 	solveChallengeWithToken := func(
 		t *testing.T,
 		tokenType string,
-		deviceType proto.DeviceType,
-		deviceUsage proto.DeviceUsage,
-	) (token string, testDev *authtest.Device, registerSolved *proto.MFARegisterResponse) {
+		deviceType clientproto.DeviceType,
+		deviceUsage clientproto.DeviceUsage,
+	) (token string, testDev *authtest.Device, registerSolved *clientproto.MFARegisterResponse) {
 		privilegeToken, err := auth.CreatePrivilegeToken(ctx, authServer, u.username, tokenType)
 		require.NoError(t, err, "createPrivilegeToken")
 		token = privilegeToken.GetName()
 
-		registerChal, err := authServer.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
+		registerChal, err := authServer.CreateRegisterChallenge(ctx, &clientproto.CreateRegisterChallengeRequest{
 			TokenID:     token,
 			DeviceType:  deviceType,
 			DeviceUsage: deviceUsage,
@@ -4038,13 +4040,13 @@ func TestAddMFADeviceSync(t *testing.T) {
 
 	solveChallengeWithUser := func(
 		t *testing.T,
-		deviceType proto.DeviceType,
-		deviceUsage proto.DeviceUsage,
-	) (*authtest.Device, *proto.MFARegisterResponse) {
+		deviceType clientproto.DeviceType,
+		deviceUsage clientproto.DeviceUsage,
+	) (*authtest.Device, *clientproto.MFARegisterResponse) {
 		// Create and solve a registration challenge.
-		authChal, err := userClient.CreateAuthenticateChallenge(ctx, &proto.CreateAuthenticateChallengeRequest{
-			Request: &proto.CreateAuthenticateChallengeRequest_ContextUser{
-				ContextUser: &proto.ContextUser{},
+		authChal, err := userClient.CreateAuthenticateChallenge(ctx, &clientproto.CreateAuthenticateChallengeRequest{
+			Request: &clientproto.CreateAuthenticateChallengeRequest_ContextUser{
+				ContextUser: &clientproto.ContextUser{},
 			},
 			ChallengeExtensions: &mfav1.ChallengeExtensions{
 				Scope: mfav1.ChallengeScope_CHALLENGE_SCOPE_MANAGE_DEVICES,
@@ -4055,7 +4057,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 		authSolved, err := u.webDev.SolveAuthn(authChal)
 		require.NoError(t, err, "SolveAuthn")
 
-		registerChal, err := userClient.CreateRegisterChallenge(ctx, &proto.CreateRegisterChallengeRequest{
+		registerChal, err := userClient.CreateRegisterChallenge(ctx, &clientproto.CreateRegisterChallengeRequest{
 			ExistingMFAResponse: authSolved,
 			DeviceType:          deviceType,
 			DeviceUsage:         deviceUsage,
@@ -4074,12 +4076,12 @@ func TestAddMFADeviceSync(t *testing.T) {
 		name       string
 		deviceName string
 		wantErr    bool
-		getReq     func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest
+		getReq     func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest
 	}{
 		{
 			name:    "invalid token type",
 			wantErr: true,
-			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
+			getReq: func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest {
 				// Obtain a non privilege token.
 				token, err := authServer.NewUserToken(ctx, authclient.CreateUserTokenRequest{
 					Name: u.username,
@@ -4090,7 +4092,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 				_, err = authServer.CreateUserToken(ctx, token)
 				require.NoError(t, err)
 
-				return &proto.AddMFADeviceSyncRequest{
+				return &clientproto.AddMFADeviceSyncRequest{
 					TokenID:       token.GetName(),
 					NewDeviceName: deviceName,
 				}
@@ -4099,11 +4101,11 @@ func TestAddMFADeviceSync(t *testing.T) {
 		{
 			name:       "TOTP device with privilege token",
 			deviceName: "new-totp",
-			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
+			getReq: func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest {
 				token, _, registerSolved := solveChallengeWithToken(
-					t, authclient.UserTokenTypePrivilege, proto.DeviceType_DEVICE_TYPE_TOTP, proto.DeviceUsage_DEVICE_USAGE_MFA)
+					t, authclient.UserTokenTypePrivilege, clientproto.DeviceType_DEVICE_TYPE_TOTP, clientproto.DeviceUsage_DEVICE_USAGE_MFA)
 
-				return &proto.AddMFADeviceSyncRequest{
+				return &clientproto.AddMFADeviceSyncRequest{
 					TokenID:        token,
 					NewDeviceName:  deviceName,
 					NewMFAResponse: registerSolved,
@@ -4113,11 +4115,11 @@ func TestAddMFADeviceSync(t *testing.T) {
 		{
 			name:       "Webauthn device with privilege exception token",
 			deviceName: "new-webauthn",
-			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
+			getReq: func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest {
 				token, _, registerSolved := solveChallengeWithToken(
-					t, authclient.UserTokenTypePrivilegeException, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, proto.DeviceUsage_DEVICE_USAGE_MFA)
+					t, authclient.UserTokenTypePrivilegeException, clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, clientproto.DeviceUsage_DEVICE_USAGE_MFA)
 
-				return &proto.AddMFADeviceSyncRequest{
+				return &clientproto.AddMFADeviceSyncRequest{
 					TokenID:        token,
 					NewDeviceName:  deviceName,
 					NewMFAResponse: registerSolved,
@@ -4128,11 +4130,11 @@ func TestAddMFADeviceSync(t *testing.T) {
 			name:       "invalid device name length",
 			deviceName: strings.Repeat("A", auth.MFADeviceNameMaxLen+1),
 			wantErr:    true,
-			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
+			getReq: func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest {
 				token, _, registerSolved := solveChallengeWithToken(
-					t, authclient.UserTokenTypePrivilegeException, proto.DeviceType_DEVICE_TYPE_WEBAUTHN, proto.DeviceUsage_DEVICE_USAGE_MFA)
+					t, authclient.UserTokenTypePrivilegeException, clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, clientproto.DeviceUsage_DEVICE_USAGE_MFA)
 
-				return &proto.AddMFADeviceSyncRequest{
+				return &clientproto.AddMFADeviceSyncRequest{
 					TokenID:        token,
 					NewDeviceName:  deviceName,
 					NewMFAResponse: registerSolved,
@@ -4142,34 +4144,34 @@ func TestAddMFADeviceSync(t *testing.T) {
 		{
 			name:       "WebAuthn with context user",
 			deviceName: "context-webauthn1",
-			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
+			getReq: func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest {
 				_, registerSolved := solveChallengeWithUser(
 					t,
-					proto.DeviceType_DEVICE_TYPE_WEBAUTHN,
-					proto.DeviceUsage_DEVICE_USAGE_MFA)
+					clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN,
+					clientproto.DeviceUsage_DEVICE_USAGE_MFA)
 
-				return &proto.AddMFADeviceSyncRequest{
-					ContextUser:    &proto.ContextUser{},
+				return &clientproto.AddMFADeviceSyncRequest{
+					ContextUser:    &clientproto.ContextUser{},
 					NewDeviceName:  deviceName,
 					NewMFAResponse: registerSolved,
-					DeviceUsage:    proto.DeviceUsage_DEVICE_USAGE_MFA,
+					DeviceUsage:    clientproto.DeviceUsage_DEVICE_USAGE_MFA,
 				}
 			},
 		},
 		{
 			name:       "TOTP with context user",
 			deviceName: "context-totp1",
-			getReq: func(t *testing.T, deviceName string) *proto.AddMFADeviceSyncRequest {
+			getReq: func(t *testing.T, deviceName string) *clientproto.AddMFADeviceSyncRequest {
 				_, registerSolved := solveChallengeWithUser(
 					t,
-					proto.DeviceType_DEVICE_TYPE_TOTP,
-					proto.DeviceUsage_DEVICE_USAGE_MFA)
+					clientproto.DeviceType_DEVICE_TYPE_TOTP,
+					clientproto.DeviceUsage_DEVICE_USAGE_MFA)
 
-				return &proto.AddMFADeviceSyncRequest{
-					ContextUser:    &proto.ContextUser{},
+				return &clientproto.AddMFADeviceSyncRequest{
+					ContextUser:    &clientproto.ContextUser{},
 					NewDeviceName:  deviceName,
 					NewMFAResponse: registerSolved,
-					DeviceUsage:    proto.DeviceUsage_DEVICE_USAGE_MFA,
+					DeviceUsage:    clientproto.DeviceUsage_DEVICE_USAGE_MFA,
 				}
 			},
 		},
@@ -4194,7 +4196,7 @@ func TestAddMFADeviceSync(t *testing.T) {
 				assert.Contains(t, addEvt.ConnectionMetadata.RemoteAddr, "127.0.0.1", "client remote addr must be localhost")
 
 				// Check it's been added.
-				res, err := userClient.GetMFADevices(ctx, &proto.GetMFADevicesRequest{})
+				res, err := userClient.GetMFADevices(ctx, &clientproto.GetMFADevicesRequest{})
 				require.NoError(t, err)
 
 				found := false
@@ -4232,9 +4234,9 @@ func TestGetMFADevices_WithToken(t *testing.T) {
 
 	clt, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
-	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err)
-	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "otp", proto.DeviceType_DEVICE_TYPE_TOTP, webDev, authtest.WithTestDeviceClock(srv.Clock()))
+	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "otp", clientproto.DeviceType_DEVICE_TYPE_TOTP, webDev, authtest.WithTestDeviceClock(srv.Clock()))
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -4278,7 +4280,7 @@ func TestGetMFADevices_WithToken(t *testing.T) {
 				tokenID = token.GetName()
 			}
 
-			res, err := srv.Auth().GetMFADevices(ctx, &proto.GetMFADevicesRequest{
+			res, err := srv.Auth().GetMFADevices(ctx, &clientproto.GetMFADevicesRequest{
 				TokenID: tokenID,
 			})
 
@@ -4315,12 +4317,12 @@ func TestGetMFADevices_WithAuth(t *testing.T) {
 
 	clt, err := srv.NewClient(authtest.TestUser(username))
 	require.NoError(t, err)
-	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web", proto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
+	webDev, err := authtest.RegisterTestDevice(ctx, clt, "web", clientproto.DeviceType_DEVICE_TYPE_WEBAUTHN, nil /* authenticator */)
 	require.NoError(t, err)
-	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "otp", proto.DeviceType_DEVICE_TYPE_TOTP, webDev, authtest.WithTestDeviceClock(srv.Clock()))
+	totpDev, err := authtest.RegisterTestDevice(ctx, clt, "otp", clientproto.DeviceType_DEVICE_TYPE_TOTP, webDev, authtest.WithTestDeviceClock(srv.Clock()))
 	require.NoError(t, err)
 
-	res, err := clt.GetMFADevices(ctx, &proto.GetMFADevicesRequest{})
+	res, err := clt.GetMFADevices(ctx, &clientproto.GetMFADevicesRequest{})
 	require.NoError(t, err)
 	compareDevices(t, true /* ignoreUpdateAndCounter */, res.GetDevices(), webDev.MFA, totpDev.MFA)
 }
@@ -4390,7 +4392,7 @@ type mockCache struct {
 	resourcesError error
 }
 
-func (m mockCache) ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
+func (m mockCache) ListResources(ctx context.Context, req clientproto.ListResourcesRequest) (*types.ListResourcesResponse, error) {
 	if m.resourcesError != nil {
 		return nil, m.resourcesError
 	}
@@ -4467,7 +4469,7 @@ func TestFilterResources(t *testing.T) {
 
 			srv := &auth.Server{Cache: tt.cache}
 
-			err := srv.IterateResources(ctx, proto.ListResourcesRequest{
+			err := srv.IterateResources(ctx, clientproto.ListResourcesRequest{
 				ResourceType: types.KindNode,
 				Namespace:    apidefaults.Namespace,
 				Limit:        tt.limit,
@@ -5044,28 +5046,28 @@ func TestCleanupNotifications(t *testing.T) {
 	// Create notification states for all notifications
 	for _, notif := range createdNotifications {
 		if !notif.isGlobal {
-			_, err := srv.Auth().UpsertUserNotificationState(ctx, notif.username, &notificationsv1.UserNotificationState{
-				Spec: &notificationsv1.UserNotificationStateSpec{
+			_, err := srv.Auth().UpsertUserNotificationState(ctx, notif.username, notificationsv1.UserNotificationState_builder{
+				Spec: notificationsv1.UserNotificationStateSpec_builder{
 					Username:       notif.username,
 					NotificationId: notif.id,
-				},
-				Status: &notificationsv1.UserNotificationStateStatus{
+				}.Build(),
+				Status: notificationsv1.UserNotificationStateStatus_builder{
 					NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 		} else {
 			// For global notifications, create a state for both users
 			for _, username := range users {
-				_, err := srv.Auth().UpsertUserNotificationState(ctx, username, &notificationsv1.UserNotificationState{
-					Spec: &notificationsv1.UserNotificationStateSpec{
+				_, err := srv.Auth().UpsertUserNotificationState(ctx, username, notificationsv1.UserNotificationState_builder{
+					Spec: notificationsv1.UserNotificationStateSpec_builder{
 						Username:       username,
 						NotificationId: notif.id,
-					},
-					Status: &notificationsv1.UserNotificationStateStatus{
+					}.Build(),
+					Status: notificationsv1.UserNotificationStateStatus_builder{
 						NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-					},
-				})
+					}.Build(),
+				}.Build())
 				require.NoError(t, err)
 			}
 		}
@@ -5200,7 +5202,7 @@ func testCreateAccessListReminderNotifications(t *testing.T) {
 	synctest.Wait()
 	resp, err := client.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{})
 	require.NoError(t, err)
-	assert.ElementsMatch(t, expectedSubKinds, slices.Map(resp.Notifications, reminderNotificationSubKind))
+	assert.ElementsMatch(t, expectedSubKinds, slices.Map(resp.GetNotifications(), reminderNotificationSubKind))
 
 	// Run CreateAccessListReminderNotifications() again to verify no duplicates are created
 	authServer.CreateAccessListReminderNotifications(ctx, auth.WithCreateNotificationInterval(time.Nanosecond))
@@ -5209,7 +5211,7 @@ func testCreateAccessListReminderNotifications(t *testing.T) {
 	synctest.Wait()
 	resp, err = client.ListNotifications(ctx, &notificationsv1.ListNotificationsRequest{})
 	require.NoError(t, err)
-	assert.ElementsMatch(t, expectedSubKinds, slices.Map(resp.Notifications, reminderNotificationSubKind),
+	assert.ElementsMatch(t, expectedSubKinds, slices.Map(resp.GetNotifications(), reminderNotificationSubKind),
 		"notifications should not have changed after second reconciliation")
 }
 
@@ -5218,17 +5220,17 @@ func TestPing(t *testing.T) {
 	type fixture struct {
 		name           string
 		scopesFeatures scopes.Features
-		scopesStatus   proto.ScopesStatus
+		scopesStatus   clientproto.ScopesStatus
 	}
 	fixtures := []fixture{
 		{
 			name:         "scopes disabled",
-			scopesStatus: proto.ScopesStatus_SCOPES_STATUS_DISABLED,
+			scopesStatus: clientproto.ScopesStatus_SCOPES_STATUS_DISABLED,
 		},
 		{
 			name:           "scopes enabled",
 			scopesFeatures: scopes.Features{Enabled: true},
-			scopesStatus:   proto.ScopesStatus_SCOPES_STATUS_ENABLED,
+			scopesStatus:   clientproto.ScopesStatus_SCOPES_STATUS_ENABLED,
 		},
 	}
 
@@ -5461,15 +5463,15 @@ func newUserNotificationWithExpiry(t *testing.T, username string, title string,
 
 	notification := notificationsv1.Notification{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: username,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Expires: expires,
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
+		}.Build(),
 	}
 
 	return &notification
@@ -5479,21 +5481,19 @@ func newGlobalNotificationWithExpiry(t *testing.T, title string, expires *timest
 	t.Helper()
 
 	notification := notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Expires: expires,
 					Labels: map[string]string{
 						types.NotificationTitleLabel: title,
 					},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	}
 
 	return &notification
diff --git a/lib/auth/auth_with_roles.go b/lib/auth/auth_with_roles.go
index 8b73c94c9a0..211aa0db7f2 100644
--- a/lib/auth/auth_with_roles.go
+++ b/lib/auth/auth_with_roles.go
@@ -835,16 +835,16 @@ func (a *ServerWithRoles) RegisterInventoryControlStream(ics client.UpstreamInve
 		filteredServices = append(filteredServices, service)
 	}
 
-	hello.Services = filteredServices
+	hello.SetServices(filteredServices)
 
 	// If the hello message's scope is non-empty, we can verify that it matches the authenticated
 	// scope in the identity. Otherwise, in order to support agents unaware of scopes, we fall back
 	// to the authenticated identity's scope.
 	agentScope := a.context.Identity.GetIdentity().GetAgentScope()
-	if hello.Scope != "" && hello.Scope != agentScope {
-		return nil, trace.AccessDenied("provided scope %q does not match agent identity %q", hello.Scope, agentScope)
+	if hello.GetScope() != "" && hello.GetScope() != agentScope {
+		return nil, trace.AccessDenied("provided scope %q does not match agent identity %q", hello.GetScope(), agentScope)
 	}
-	hello.Scope = agentScope
+	hello.SetScope(agentScope)
 	labelHash := a.context.Identity.GetIdentity().ImmutableLabelHash
 	if labels := hello.GetImmutableLabels(); labels != nil || labelHash != "" {
 		if !joining.VerifyImmutableLabelsHash(labels, labelHash) {
@@ -859,7 +859,7 @@ func (a *ServerWithRoles) GetInventoryStatus(ctx context.Context, req *proto.Inv
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Connected {
+	if req.GetConnected() {
 		if !a.hasBuiltinRole(types.RoleAdmin) {
 			return nil, trace.AccessDenied("requires local tctl, try using 'tctl inventory ls' instead")
 		}
@@ -1572,10 +1572,10 @@ func (a *ServerWithRoles) ListUnifiedResources(ctx context.Context, req *proto.L
 		if err != nil {
 			return nil, trace.Wrap(err, "getting user preferences")
 		}
-		if len(prefs.ClusterPreferences.PinnedResources.ResourceIds) == 0 {
+		if len(prefs.GetClusterPreferences().GetPinnedResources().GetResourceIds()) == 0 {
 			return &proto.ListUnifiedResourcesResponse{}, nil
 		}
-		unifiedResources, err = a.authServer.UnifiedResourceCache.GetUnifiedResourcesByIDs(ctx, prefs.ClusterPreferences.PinnedResources.GetResourceIds(), func(resource types.ResourceWithLabels) (bool, error) {
+		unifiedResources, err = a.authServer.UnifiedResourceCache.GetUnifiedResourcesByIDs(ctx, prefs.GetClusterPreferences().GetPinnedResources().GetResourceIds(), func(resource types.ResourceWithLabels) (bool, error) {
 			match, err := resourceLister.canList(resource, userFilter)
 			return match, trace.Wrap(err)
 		})
@@ -1780,23 +1780,23 @@ func (a *ServerWithRoles) filterICPermissionSets(r *proto.PaginatedResource, app
 	}
 
 	assignment := services.IdentityCenterAccountAssignment{
-		AccountAssignment: &identitycenterv1.AccountAssignment{
+		AccountAssignment: identitycenterv1.AccountAssignment_builder{
 			Kind:     types.KindIdentityCenterAccountAssignment,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &identitycenterv1.AccountAssignmentSpec{
+			Spec: identitycenterv1.AccountAssignmentSpec_builder{
 				AccountId:     appV3.GetName(),
 				PermissionSet: &identitycenterv1.PermissionSetInfo{},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
-	permissionSetQuery := assignment.Spec.PermissionSet
+	permissionSetQuery := assignment.Spec.GetPermissionSet()
 	checkable := types.Resource153ToResourceWithLabels(assignment)
 
 	var output []*types.IdentityCenterPermissionSet
 	for _, ps := range pss {
-		assignment.Metadata.Name = ps.AssignmentID
-		permissionSetQuery.Arn = ps.ARN
+		assignment.Metadata.SetName(ps.AssignmentID)
+		permissionSetQuery.SetArn(ps.ARN)
 
 		hasAccess, err := checker.canList(checkable, services.MatchResourceFilter{
 			ResourceKind: types.KindIdentityCenterAccountAssignment,
@@ -5144,8 +5144,8 @@ func (a *ServerWithRoles) ListRoles(ctx context.Context, req *proto.ListRolesReq
 // This does not use the resource verbs for RBAC, and all users are allowed to call this endpoint. The requestable roles returned here are only the ones that the user
 // has been granted permission to request. If a user has not been granted permission to request any roles, this will return an empty list.
 func (a *ServerWithRoles) ListRequestableRoles(ctx context.Context, req *proto.ListRequestableRolesRequest) (*proto.ListRequestableRolesResponse, error) {
-	if req.PageSize == 0 || req.PageSize > apidefaults.DefaultChunkSize {
-		req.PageSize = apidefaults.DefaultChunkSize
+	if req.GetPageSize() == 0 || req.GetPageSize() > apidefaults.DefaultChunkSize {
+		req.SetPageSize(apidefaults.DefaultChunkSize)
 	}
 
 	requestValidator, err := services.NewRequestValidator(ctx, a.authServer.clock, a.authServer, a.context.GetUserMetadata().User)
@@ -5155,14 +5155,14 @@ func (a *ServerWithRoles) ListRequestableRoles(ctx context.Context, req *proto.L
 
 	// Convert ListRequestableRolesRequest to ListRolesRequest for compatibility with `IterateRoles`
 	listReq := &proto.ListRolesRequest{
-		Limit:    req.PageSize,
-		StartKey: req.PageToken,
+		Limit:    req.GetPageSize(),
+		StartKey: req.GetPageToken(),
 	}
 
 	var roleFilter *types.RoleFilter
-	if req.Filter != nil {
+	if req.HasFilter() {
 		roleFilter = &types.RoleFilter{
-			SearchKeywords:  req.Filter.SearchKeywords,
+			SearchKeywords:  req.GetFilter().GetSearchKeywords(),
 			SkipSystemRoles: true,
 		}
 	}
@@ -5176,7 +5176,7 @@ func (a *ServerWithRoles) ListRequestableRoles(ctx context.Context, req *proto.L
 		}
 
 		// Apply any RoleFilters if defined.
-		if req.Filter != nil && !roleFilter.Match(role) {
+		if req.HasFilter() && !roleFilter.Match(role) {
 			return false, nil
 		}
 
@@ -5192,20 +5192,20 @@ func (a *ServerWithRoles) ListRequestableRoles(ctx context.Context, req *proto.L
 		return nil, trace.Wrap(err)
 	}
 
-	return &proto.ListRequestableRolesResponse{
+	return proto.ListRequestableRolesResponse_builder{
 		Roles:         convertRolesToRequestableRoles(out),
 		NextPageToken: nextKey,
-	}, nil
+	}.Build(), nil
 }
 
 // convertRolesToRequestableRoles turns a slice of Roles into RequestableRoles, stripping all data except the name and description.
 func convertRolesToRequestableRoles(roles []*types.RoleV6) []*proto.ListRequestableRolesResponse_RequestableRole {
 	items := make([]*proto.ListRequestableRolesResponse_RequestableRole, 0, len(roles))
 	for _, role := range roles {
-		item := &proto.ListRequestableRolesResponse_RequestableRole{
+		item := proto.ListRequestableRolesResponse_RequestableRole_builder{
 			Name:        role.GetName(),
 			Description: role.GetMetadata().Description,
-		}
+		}.Build()
 		items = append(items, item)
 	}
 
diff --git a/lib/auth/auth_with_roles_test.go b/lib/auth/auth_with_roles_test.go
index 4646280c8be..daceca76d26 100644
--- a/lib/auth/auth_with_roles_test.go
+++ b/lib/auth/auth_with_roles_test.go
@@ -1163,49 +1163,49 @@ func TestGenerateUserCertsForHeadlessKube(t *testing.T) {
 	}
 
 	scope := "/test"
-	roleResp, err := srv.Auth().ScopedAccess().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	roleResp, err := srv.Auth().ScopedAccess().CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: getScopeAsName(scope) + "-role",
-			},
+			}.Build(),
 			Scope: scope,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{scope},
-				Kube: &scopedaccessv1.ScopedRoleKube{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 					Users:  []string{"scoped_kube_user"},
 					Groups: []string{"scoped_kube_group"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   types.Wildcard,
 							Values: []string{types.Wildcard},
-						},
+						}.Build(),
 					},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	role := roleResp.GetRole()
-	sra, err := srv.Auth().ScopedAccess().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sra, err := srv.Auth().ScopedAccess().CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: scope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: user1.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: role.GetMetadata().GetName(), Scope: scope},
+					scopedaccessv1.Assignment_builder{Role: role.GetMetadata().GetName(), Scope: scope}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sra)
 
@@ -1272,7 +1272,7 @@ func TestGenerateUserCertsForHeadlessKube(t *testing.T) {
 			identity, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
 			require.NoError(t, err)
 			if tt.scope != "" {
-				require.Equal(t, tt.scope, identity.ScopePin.Scope)
+				require.Equal(t, tt.scope, identity.ScopePin.GetScope())
 			} else {
 				require.Nil(t, identity.ScopePin)
 			}
@@ -3390,11 +3390,11 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 	_, err = adminClient.UpsertKubernetesServer(ctx, kubeServer)
 	require.NoError(t, err)
 
-	waitingContainer, err := unscopedKubeClient.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerv1.KubernetesWaitingContainer{
-		Metadata: &headerv1.Metadata{
+	waitingContainer, err := unscopedKubeClient.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerv1.KubernetesWaitingContainer_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: "waiting-container",
-		},
-		Spec: &kubewaitingcontainerv1.KubernetesWaitingContainerSpec{
+		}.Build(),
+		Spec: kubewaitingcontainerv1.KubernetesWaitingContainerSpec_builder{
 			Username:      "user",
 			Cluster:       clusterName,
 			Namespace:     "namespace",
@@ -3402,8 +3402,8 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 			ContainerName: "waiting-container",
 			Patch:         []byte("patch"),
 			PatchType:     kubewaitingcontainer.ApplyPatchType,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	t.Run("CreateKubernetesCluster", func(t *testing.T) {
@@ -3543,11 +3543,11 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 
 	t.Run("CreateKubernetesWaitingContainer", func(t *testing.T) {
 		const wcName = "create-waiting-container"
-		wc := &kubewaitingcontainerv1.KubernetesWaitingContainer{
-			Metadata: &headerv1.Metadata{
+		wc := kubewaitingcontainerv1.KubernetesWaitingContainer_builder{
+			Metadata: headerv1.Metadata_builder{
 				Name: wcName,
-			},
-			Spec: &kubewaitingcontainerv1.KubernetesWaitingContainerSpec{
+			}.Build(),
+			Spec: kubewaitingcontainerv1.KubernetesWaitingContainerSpec_builder{
 				Username:      waitingContainer.GetSpec().GetUsername(),
 				Cluster:       waitingContainer.GetSpec().GetCluster(),
 				Namespace:     waitingContainer.GetSpec().GetNamespace(),
@@ -3555,21 +3555,21 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 				ContainerName: wcName,
 				Patch:         waitingContainer.GetSpec().GetPatch(),
 				PatchType:     waitingContainer.GetSpec().GetPatchType(),
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		// unscoped kube service clients SHOULD be able to create a kube waiting container
 		wc, err := unscopedKubeClient.CreateKubernetesWaitingContainer(ctx, wc)
 		require.NoError(t, err)
 
 		// cleanup waiting container
-		err = unscopedKubeClient.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerv1.DeleteKubernetesWaitingContainerRequest{
+		err = unscopedKubeClient.DeleteKubernetesWaitingContainer(ctx, kubewaitingcontainerv1.DeleteKubernetesWaitingContainerRequest_builder{
 			Username:      wc.GetSpec().GetUsername(),
 			Cluster:       wc.GetSpec().GetCluster(),
 			Namespace:     wc.GetSpec().GetNamespace(),
 			PodName:       wc.GetSpec().GetPodName(),
 			ContainerName: wc.GetSpec().GetContainerName(),
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		// scoped kube service clients SHOULD NOT be able to create a kube waiting container
@@ -3580,11 +3580,11 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 
 	t.Run("DeleteKubernetesWaitingContainer", func(t *testing.T) {
 		const wcName = "delete-waiting-container"
-		wc := &kubewaitingcontainerv1.KubernetesWaitingContainer{
-			Metadata: &headerv1.Metadata{
+		wc := kubewaitingcontainerv1.KubernetesWaitingContainer_builder{
+			Metadata: headerv1.Metadata_builder{
 				Name: wcName,
-			},
-			Spec: &kubewaitingcontainerv1.KubernetesWaitingContainerSpec{
+			}.Build(),
+			Spec: kubewaitingcontainerv1.KubernetesWaitingContainerSpec_builder{
 				Username:      waitingContainer.GetSpec().GetUsername(),
 				Cluster:       waitingContainer.GetSpec().GetCluster(),
 				Namespace:     waitingContainer.GetSpec().GetNamespace(),
@@ -3592,20 +3592,20 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 				ContainerName: wcName,
 				Patch:         waitingContainer.GetSpec().GetPatch(),
 				PatchType:     waitingContainer.GetSpec().GetPatchType(),
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		// unscoped kube service clients SHOULD be able to create a kube waiting container
 		wc, err := unscopedKubeClient.CreateKubernetesWaitingContainer(ctx, wc)
 		require.NoError(t, err)
 
-		deleteReq := &kubewaitingcontainerv1.DeleteKubernetesWaitingContainerRequest{
+		deleteReq := kubewaitingcontainerv1.DeleteKubernetesWaitingContainerRequest_builder{
 			Username:      wc.GetSpec().GetUsername(),
 			Cluster:       wc.GetSpec().GetCluster(),
 			Namespace:     wc.GetSpec().GetNamespace(),
 			PodName:       wc.GetSpec().GetPodName(),
 			ContainerName: wc.GetSpec().GetContainerName(),
-		}
+		}.Build()
 		// cleanup waiting container
 		err = unscopedKubeClient.DeleteKubernetesWaitingContainer(ctx, deleteReq)
 		require.NoError(t, err)
@@ -3617,13 +3617,13 @@ func TestKubeCRUDFromKubeService(t *testing.T) {
 	})
 
 	t.Run("GetKubernetesWaitingContainer", func(t *testing.T) {
-		req := &kubewaitingcontainerv1.GetKubernetesWaitingContainerRequest{
+		req := kubewaitingcontainerv1.GetKubernetesWaitingContainerRequest_builder{
 			Username:      waitingContainer.GetSpec().GetUsername(),
 			Cluster:       waitingContainer.GetSpec().GetCluster(),
 			Namespace:     waitingContainer.GetSpec().GetNamespace(),
 			PodName:       waitingContainer.GetSpec().GetPodName(),
 			ContainerName: waitingContainer.GetSpec().GetContainerName(),
-		}
+		}.Build()
 		// unscoped kube clients SHOULD be able to fetch a kube waiting containers
 		_, err := unscopedKubeClient.GetKubernetesWaitingContainer(ctx, req)
 		require.NoError(t, err)
@@ -5482,52 +5482,52 @@ func TestListResources_KindKubernetesCluster(t *testing.T) {
 	}
 	// create scoped roles, users, and assignments
 	for _, scope := range scopes {
-		roleResp, err := scopedAccess.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-			Role: &scopedaccessv1.ScopedRole{
+		roleResp, err := scopedAccess.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+			Role: scopedaccessv1.ScopedRole_builder{
 				Kind:    scopedaccess.KindScopedRole,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: getScopeAsName(scope) + "-role",
-				},
+				}.Build(),
 				Scope: scope,
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{scope},
-					Kube: &scopedaccessv1.ScopedRoleKube{
+					Kube: scopedaccessv1.ScopedRoleKube_builder{
 						Users:  []string{"kube_user"},
 						Groups: []string{"kube_group"},
 						Labels: []*labelv1.Label{
-							{
+							labelv1.Label_builder{
 								Name:   types.Wildcard,
 								Values: []string{types.Wildcard},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
-		})
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
 		user, err := authtest.CreateUser(ctx, srv.Auth(), getScopeAsName(scope)+"-reader")
 		require.NoError(t, err)
 
 		role := roleResp.GetRole()
-		sra, err := scopedAccess.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+		sra, err := scopedAccess.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+			Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    scopedaccess.KindScopedRoleAssignment,
 				SubKind: scopedaccess.SubKindDynamic,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.NewString(),
-				},
+				}.Build(),
 				Scope: scope,
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: user.GetName(),
 					Assignments: []*scopedaccessv1.Assignment{
-						{Role: role.GetMetadata().GetName(), Scope: scope},
+						scopedaccessv1.Assignment_builder{Role: role.GetMetadata().GetName(), Scope: scope}.Build(),
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
 		waitForSRACache(t, srv, sra)
@@ -5706,10 +5706,10 @@ func waitForSRACache(t *testing.T, srv *authtest.TLSServer, resps ...*scopedacce
 	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		for _, resp := range resps {
-			_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 				Name:    resp.GetAssignment().GetMetadata().GetName(),
 				SubKind: resp.GetAssignment().GetSubKind(),
-			})
+			}.Build())
 			require.NoError(t, err)
 		}
 	}, 10*time.Second, 100*time.Millisecond)
@@ -7593,19 +7593,19 @@ func TestListUnifiedResources_WithPinnedResources(t *testing.T) {
 	identity := authtest.TestUser(user.GetName())
 
 	// pin a resource
-	pinned := &userpreferencesv1.PinnedResourcesUserPreferences{
+	pinned := userpreferencesv1.PinnedResourcesUserPreferences_builder{
 		ResourceIds: []string{"tifa/tifa/node"},
-	}
-	clusterPrefs := &userpreferencesv1.ClusterUserPreferences{
+	}.Build()
+	clusterPrefs := userpreferencesv1.ClusterUserPreferences_builder{
 		PinnedResources: pinned,
-	}
+	}.Build()
 
-	req := &userpreferencesv1.UpsertUserPreferencesRequest{
-		Preferences: &userpreferencesv1.UserPreferences{
+	req := userpreferencesv1.UpsertUserPreferencesRequest_builder{
+		Preferences: userpreferencesv1.UserPreferences_builder{
 			ClusterPreferences: clusterPrefs,
-		},
-	}
-	err = srv.Auth().UpsertUserPreferences(ctx, username, req.Preferences)
+		}.Build(),
+	}.Build()
+	err = srv.Auth().UpsertUserPreferences(ctx, username, req.GetPreferences())
 	require.NoError(t, err)
 
 	clt, err := srv.NewClient(identity)
@@ -7956,21 +7956,21 @@ func TestUnifiedResources_IdentityCenter(t *testing.T) {
 	withMatchingAccountAssignment := withAccountAssignment(types.Allow,
 		validAccountID, validPermissionSetARN)
 
-	acct, err := srv.Auth().CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+	acct, err := srv.Auth().CreateIdentityCenterAccount(ctx, identitycenterv1.Account_builder{
 		Kind:    types.KindIdentityCenterAccount,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-account",
 			Labels: map[string]string{
 				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
-		},
-		Spec: &identitycenterv1.AccountSpec{
+		}.Build(),
+		Spec: identitycenterv1.AccountSpec_builder{
 			Id:   validAccountID,
 			Arn:  "some:account:arn",
 			Name: "Test Account",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		srv.Auth().DeleteIdentityCenterAccount(ctx,
@@ -8678,7 +8678,7 @@ func TestGenerateHostCert(t *testing.T) {
 			require.NoError(t, err)
 
 			// Try by calling new gRPC endpoint directly
-			_, err = client.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+			_, err = client.TrustClient().GenerateHostCert(ctx, trustpb.GenerateHostCertRequest_builder{
 				Key:         pub,
 				HostId:      "",
 				NodeName:    "",
@@ -8686,7 +8686,7 @@ func TestGenerateHostCert(t *testing.T) {
 				ClusterName: clusterName,
 				Role:        string(types.RoleNode),
 				Ttl:         durationpb.New(0),
-			})
+			}.Build())
 			require.True(t, test.expect(err))
 		})
 	}
@@ -11763,33 +11763,33 @@ func TestScopedRoleEvents(t *testing.T) {
 	require.Equal(t, types.OpInit, event.Type)
 
 	// Create a ScopedRole and verify create event is well-formed.
-	role := &scopedaccessv1.ScopedRole{
+	role := scopedaccessv1.ScopedRole_builder{
 		Kind: scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-role",
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/foo", "/bar"},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
-	crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	crsp, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
 	require.Equal(t, types.OpPut, event.Type)
 
 	resource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]).UnwrapT()
-	require.Empty(t, cmp.Diff(crsp.Role, resource, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(crsp.GetRole(), resource, protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// delete the role and verify delete event is well-formed.
-	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
-		Name: role.Metadata.Name,
-	})
+	_, err = service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
+		Name: role.GetMetadata().GetName(),
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
@@ -11798,52 +11798,52 @@ func TestScopedRoleEvents(t *testing.T) {
 	require.Empty(t, cmp.Diff(&types.ResourceHeader{
 		Kind: scopedaccess.KindScopedRole,
 		Metadata: types.Metadata{
-			Name: role.Metadata.Name,
+			Name: role.GetMetadata().GetName(),
 		},
 	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
 
 	// recreate scoped role so that we can use it for testing assignment events
-	_, err = service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	_, err = service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	_ = getNextEvent() // drain the role create event
 
-	assignment := &scopedaccessv1.ScopedRoleAssignment{
+	assignment := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "alice",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
-					Role:  role.Metadata.Name,
+				scopedaccessv1.Assignment_builder{
+					Role:  role.GetMetadata().GetName(),
 					Scope: "/foo",
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
-	acrsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	acrsp, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
 	require.Equal(t, types.OpPut, event.Type)
 	assignmentResource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]).UnwrapT()
-	require.Empty(t, cmp.Diff(acrsp.Assignment, assignmentResource, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(acrsp.GetAssignment(), assignmentResource, protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// delete the assignment and verify delete event is well-formed.
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:    assignment.Metadata.Name,
-		SubKind: assignment.SubKind,
-	})
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:    assignment.GetMetadata().GetName(),
+		SubKind: assignment.GetSubKind(),
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
@@ -11853,7 +11853,7 @@ func TestScopedRoleEvents(t *testing.T) {
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
 		Metadata: types.Metadata{
-			Name: assignment.Metadata.Name,
+			Name: assignment.GetMetadata().GetName(),
 		},
 	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
 }
@@ -12353,40 +12353,40 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 	// GIVEN an Identity Center Account with some associated Permission Set
 	// resources
 	permissionSets := []*identitycenterv1.PermissionSetInfo{
-		{
+		identitycenterv1.PermissionSetInfo_builder{
 			Name:         "PS One",
 			Arn:          permissionSetArnPrefix + "one",
 			AssignmentId: accountID + "-" + "ps_one",
-		},
-		{
+		}.Build(),
+		identitycenterv1.PermissionSetInfo_builder{
 			Name:         "PS Two",
 			Arn:          permissionSetArnPrefix + "two",
 			AssignmentId: accountID + "-" + "ps_two",
-		},
-		{
+		}.Build(),
+		identitycenterv1.PermissionSetInfo_builder{
 			Name:         "PS Three",
 			Arn:          permissionSetArnPrefix + "ps_three",
 			AssignmentId: accountID + "-" + "ps_three",
-		},
+		}.Build(),
 	}
 
-	_, err := srv.AuthServer.AuthServer.CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+	_, err := srv.AuthServer.AuthServer.CreateIdentityCenterAccount(ctx, identitycenterv1.Account_builder{
 		Kind:    types.KindIdentityCenterAccount,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: accountID,
 			Labels: map[string]string{
 				types.OriginLabel: apicommon.OriginAWSIdentityCenter,
 			},
-		},
-		Spec: &identitycenterv1.AccountSpec{
+		}.Build(),
+		Spec: identitycenterv1.AccountSpec_builder{
 			Id:                accountID,
 			Arn:               "aws:arn:test:account",
 			Name:              "Test Account",
 			Description:       "An account for testing",
 			PermissionSetInfo: permissionSets,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// GIVEN a role that allows access to all permission sets on the target
@@ -12432,8 +12432,8 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		{
 			name: "basic access",
 			roleModifiers: []authtest.CreateUserAndRoleOption{
-				withAccountAssignment(types.Allow, accountID, permissionSets[0].Arn),
-				withAccountAssignment(types.Allow, accountID, permissionSets[1].Arn),
+				withAccountAssignment(types.Allow, accountID, permissionSets[0].GetArn()),
+				withAccountAssignment(types.Allow, accountID, permissionSets[1].GetArn()),
 			},
 			expectedPSs: []*types.IdentityCenterPermissionSet{
 				paginatedAppPermissionSet(permissionSets[0]),
@@ -12444,7 +12444,7 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		{
 			name: "ignore search as roles when disabled",
 			roleModifiers: []authtest.CreateUserAndRoleOption{
-				withAccountAssignment(types.Allow, accountID, permissionSets[1].Arn),
+				withAccountAssignment(types.Allow, accountID, permissionSets[1].GetArn()),
 				withRequesterRole,
 			},
 			includeRequestable: false,
@@ -12456,7 +12456,7 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 		{
 			name: "requestable access",
 			roleModifiers: []authtest.CreateUserAndRoleOption{
-				withAccountAssignment(types.Allow, accountID, permissionSets[1].Arn),
+				withAccountAssignment(types.Allow, accountID, permissionSets[1].GetArn()),
 				withRequesterRole,
 			},
 			includeRequestable: true,
@@ -12527,9 +12527,9 @@ func TestFilterIdentityCenterPermissionSets(t *testing.T) {
 
 func paginatedAppPermissionSet(src *identitycenterv1.PermissionSetInfo) *types.IdentityCenterPermissionSet {
 	return &types.IdentityCenterPermissionSet{
-		ARN:          src.Arn,
-		Name:         src.Name,
-		AssignmentID: src.AssignmentId,
+		ARN:          src.GetArn(),
+		Name:         src.GetName(),
+		AssignmentID: src.GetAssignmentId(),
 	}
 }
 
@@ -12878,10 +12878,10 @@ func TestRegisterInventoryControlStreamScopes(t *testing.T) {
 				resultCh <- registerResult{hello: hello, err: err}
 			}()
 
-			err := h.downstream.Send(ctx, &proto.UpstreamInventoryHello{
+			err := h.downstream.Send(ctx, proto.UpstreamInventoryHello_builder{
 				ServerID: serverID,
 				Scope:    c.helloScope,
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			if c.expectErr != nil {
@@ -12907,12 +12907,12 @@ func TestRegisterInventoryControlStreamImmutableLabels(t *testing.T) {
 	ctx := t.Context()
 
 	const serverID = "test-server"
-	helloLabels := &joiningv1.ImmutableLabels{
+	helloLabels := joiningv1.ImmutableLabels_builder{
 		Ssh: map[string]string{
 			"test":  "label",
 			"test2": "label2",
 		},
-	}
+	}.Build()
 	helloHash := joining.HashImmutableLabels(helloLabels)
 
 	as, err := authtest.NewAuthServer(authtest.AuthServerConfig{Dir: t.TempDir()})
@@ -12969,10 +12969,10 @@ func TestRegisterInventoryControlStreamImmutableLabels(t *testing.T) {
 				resultCh <- registerResult{hello: hello, err: err}
 			}()
 
-			err := h.downstream.Send(ctx, &proto.UpstreamInventoryHello{
+			err := h.downstream.Send(ctx, proto.UpstreamInventoryHello_builder{
 				ServerID:        serverID,
 				ImmutableLabels: c.helloLabels,
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			if c.expectErr != nil {
@@ -13010,52 +13010,52 @@ func TestScopedUserCertGeneration(t *testing.T) {
 	username := "scoped-user"
 	scope := "/test"
 	scopedAccess := srv.Auth().ScopedAccess()
-	roleResp, err := scopedAccess.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	roleResp, err := scopedAccess.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: username,
-			},
+			}.Build(),
 			Scope: scope,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{scope},
-				Kube: &scopedaccessv1.ScopedRoleKube{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 					Users:  []string{"kube_user"},
 					Groups: []string{"kube_group"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   types.Wildcard,
 							Values: []string{types.Wildcard},
-						},
+						}.Build(),
 					},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	user, role, err := authtest.CreateUserAndRole(srv.Auth(), username, []string{username}, nil)
 	require.NoError(t, err)
 
 	scopedRole := roleResp.GetRole()
-	sra, err := scopedAccess.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sra, err := scopedAccess.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: scope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: user.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.GetMetadata().GetName(), Scope: scope},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetMetadata().GetName(), Scope: scope}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sra)
 
diff --git a/lib/auth/authclient/clt.go b/lib/auth/authclient/clt.go
index 1f36297130d..75cd3acddbf 100644
--- a/lib/auth/authclient/clt.go
+++ b/lib/auth/authclient/clt.go
@@ -706,50 +706,50 @@ func (c *Client) ScopedRoleReader() services.ScopedRoleReader {
 
 // UpsertUserNotificationState creates or updates a user notification state which records whether the user has clicked on or dismissed a notification.
 func (c *Client) UpsertUserNotificationState(ctx context.Context, username string, uns *notificationsv1.UserNotificationState) (*notificationsv1.UserNotificationState, error) {
-	return c.APIClient.UpsertUserNotificationState(ctx, &notificationsv1.UpsertUserNotificationStateRequest{
+	return c.APIClient.UpsertUserNotificationState(ctx, notificationsv1.UpsertUserNotificationStateRequest_builder{
 		Username:              username,
 		UserNotificationState: uns,
-	})
+	}.Build())
 }
 
 // UpsertUserLastSeenNotification creates or updates a user's last seen notification item.
 func (c *Client) UpsertUserLastSeenNotification(ctx context.Context, username string, ulsn *notificationsv1.UserLastSeenNotification) (*notificationsv1.UserLastSeenNotification, error) {
-	return c.APIClient.UpsertUserLastSeenNotification(ctx, &notificationsv1.UpsertUserLastSeenNotificationRequest{
+	return c.APIClient.UpsertUserLastSeenNotification(ctx, notificationsv1.UpsertUserLastSeenNotificationRequest_builder{
 		Username:                 username,
 		UserLastSeenNotification: ulsn,
-	})
+	}.Build())
 }
 
 // CreateGlobalNotification creates a global notification.
 func (c *Client) CreateGlobalNotification(ctx context.Context, gn *notificationsv1.GlobalNotification) (*notificationsv1.GlobalNotification, error) {
-	rsp, err := c.APIClient.CreateGlobalNotification(ctx, &notificationsv1.CreateGlobalNotificationRequest{
+	rsp, err := c.APIClient.CreateGlobalNotification(ctx, notificationsv1.CreateGlobalNotificationRequest_builder{
 		GlobalNotification: gn,
-	})
+	}.Build())
 	return rsp, trace.Wrap(err)
 }
 
 // CreateUserNotification creates a user-specific notification.
 func (c *Client) CreateUserNotification(ctx context.Context, notification *notificationsv1.Notification) (*notificationsv1.Notification, error) {
-	rsp, err := c.APIClient.CreateUserNotification(ctx, &notificationsv1.CreateUserNotificationRequest{
+	rsp, err := c.APIClient.CreateUserNotification(ctx, notificationsv1.CreateUserNotificationRequest_builder{
 		Notification: notification,
-	})
+	}.Build())
 	return rsp, trace.Wrap(err)
 }
 
 // DeleteGlobalNotification deletes a global notification.
 func (c *Client) DeleteGlobalNotification(ctx context.Context, notificationId string) error {
-	err := c.APIClient.DeleteGlobalNotification(ctx, &notificationsv1.DeleteGlobalNotificationRequest{
+	err := c.APIClient.DeleteGlobalNotification(ctx, notificationsv1.DeleteGlobalNotificationRequest_builder{
 		NotificationId: notificationId,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
 // DeleteUserNotification not implemented: can only be called locally.
 func (c *Client) DeleteUserNotification(ctx context.Context, username string, notificationId string) error {
-	err := c.APIClient.DeleteUserNotification(ctx, &notificationsv1.DeleteUserNotificationRequest{
+	err := c.APIClient.DeleteUserNotification(ctx, notificationsv1.DeleteUserNotificationRequest_builder{
 		Username:       username,
 		NotificationId: notificationId,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/lib/auth/authclient/httpfallback.go b/lib/auth/authclient/httpfallback.go
index 052c40d200f..35fddea1849 100644
--- a/lib/auth/authclient/httpfallback.go
+++ b/lib/auth/authclient/httpfallback.go
@@ -85,9 +85,9 @@ func (c *Client) UpsertTunnelConnection(ctx context.Context, conn types.TunnelCo
 	if !ok {
 		return trace.BadParameter("unsupported tunnel connection type %T", conn)
 	}
-	_, err := c.TrustClient().UpsertTunnelConnection(ctx, &trustpb.UpsertTunnelConnectionRequest{
+	_, err := c.TrustClient().UpsertTunnelConnection(ctx, trustpb.UpsertTunnelConnectionRequest_builder{
 		TunnelConnection: connV2,
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotImplemented(err) {
 			return trace.Wrap(c.HTTPClient.upsertTunnelConnection(ctx, conn))
@@ -116,10 +116,10 @@ func (c *HTTPClient) upsertTunnelConnection(ctx context.Context, conn types.Tunn
 //
 // TODO(strideynet): DELETE IN v20.0.0
 func (c *Client) DeleteTunnelConnection(ctx context.Context, clusterName, connName string) error {
-	_, err := c.TrustClient().DeleteTunnelConnection(ctx, &trustpb.DeleteTunnelConnectionRequest{
+	_, err := c.TrustClient().DeleteTunnelConnection(ctx, trustpb.DeleteTunnelConnectionRequest_builder{
 		ClusterName:    clusterName,
 		ConnectionName: connName,
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotImplemented(err) {
 			return trace.Wrap(c.HTTPClient.deleteTunnelConnection(ctx, clusterName, connName))
@@ -179,9 +179,9 @@ func (c *Client) UpsertProxyServerWithoutReturn(ctx context.Context, s types.Ser
 	if !ok {
 		return trace.BadParameter("unsupported proxy server type %T", s)
 	}
-	_, err := c.APIClient.PresenceServiceClient().UpsertProxyServer(ctx, &presencev1.UpsertProxyServerRequest{
+	_, err := c.APIClient.PresenceServiceClient().UpsertProxyServer(ctx, presencev1.UpsertProxyServerRequest_builder{
 		Server: serverV2,
-	})
+	}.Build())
 	if err == nil {
 		return nil
 	}
@@ -213,9 +213,9 @@ func (c *HTTPClient) upsertProxyServerLegacy(ctx context.Context, s types.Server
 //
 // TODO(noah): DELETE IN v20.0.0
 func (c *Client) DeleteProxyServer(ctx context.Context, name string) error {
-	_, err := c.APIClient.PresenceServiceClient().DeleteProxyServer(ctx, &presencev1.DeleteProxyServerRequest{
+	_, err := c.APIClient.PresenceServiceClient().DeleteProxyServer(ctx, presencev1.DeleteProxyServerRequest_builder{
 		Name: name,
-	})
+	}.Build())
 	if err == nil {
 		return nil
 	}
diff --git a/lib/auth/autoupdate/autoupdatev1/service.go b/lib/auth/autoupdate/autoupdatev1/service.go
index 9aaa6dc7302..f12d3ad68aa 100644
--- a/lib/auth/autoupdate/autoupdatev1/service.go
+++ b/lib/auth/autoupdate/autoupdatev1/service.go
@@ -148,11 +148,11 @@ func (s *Service) CreateAutoUpdateConfig(ctx context.Context, req *autoupdate.Cr
 		return nil, trace.Wrap(err)
 	}
 
-	if err := validateServerSideAgentConfig(req.Config, s.modules.Features()); err != nil {
+	if err := validateServerSideAgentConfig(req.GetConfig(), s.modules.Features()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	config, err := s.backend.CreateAutoUpdateConfig(ctx, req.Config)
+	config, err := s.backend.CreateAutoUpdateConfig(ctx, req.GetConfig())
 	var errMsg string
 	if err != nil {
 		errMsg = err.Error()
@@ -192,11 +192,11 @@ func (s *Service) UpdateAutoUpdateConfig(ctx context.Context, req *autoupdate.Up
 		return nil, trace.Wrap(err)
 	}
 
-	if err := validateServerSideAgentConfig(req.Config, s.modules.Features()); err != nil {
+	if err := validateServerSideAgentConfig(req.GetConfig(), s.modules.Features()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	config, err := s.backend.UpdateAutoUpdateConfig(ctx, req.Config)
+	config, err := s.backend.UpdateAutoUpdateConfig(ctx, req.GetConfig())
 	var errMsg string
 	if err != nil {
 		errMsg = err.Error()
@@ -236,11 +236,11 @@ func (s *Service) UpsertAutoUpdateConfig(ctx context.Context, req *autoupdate.Up
 		return nil, trace.Wrap(err)
 	}
 
-	if err := validateServerSideAgentConfig(req.Config, s.modules.Features()); err != nil {
+	if err := validateServerSideAgentConfig(req.GetConfig(), s.modules.Features()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	config, err := s.backend.UpsertAutoUpdateConfig(ctx, req.Config)
+	config, err := s.backend.UpsertAutoUpdateConfig(ctx, req.GetConfig())
 	var errMsg string
 	if err != nil {
 		errMsg = err.Error()
@@ -359,7 +359,7 @@ func (s *Service) CreateAutoUpdateVersion(ctx context.Context, req *autoupdate.C
 		return nil, trace.Wrap(err)
 	}
 
-	autoUpdateVersion, err := s.backend.CreateAutoUpdateVersion(ctx, req.Version)
+	autoUpdateVersion, err := s.backend.CreateAutoUpdateVersion(ctx, req.GetVersion())
 	var errMsg string
 	if err != nil {
 		errMsg = err.Error()
@@ -404,7 +404,7 @@ func (s *Service) UpdateAutoUpdateVersion(ctx context.Context, req *autoupdate.U
 		return nil, trace.Wrap(err)
 	}
 
-	autoUpdateVersion, err := s.backend.UpdateAutoUpdateVersion(ctx, req.Version)
+	autoUpdateVersion, err := s.backend.UpdateAutoUpdateVersion(ctx, req.GetVersion())
 	var errMsg string
 	if err != nil {
 		errMsg = err.Error()
@@ -449,7 +449,7 @@ func (s *Service) UpsertAutoUpdateVersion(ctx context.Context, req *autoupdate.U
 		return nil, trace.Wrap(err)
 	}
 
-	autoUpdateVersion, err := s.backend.UpsertAutoUpdateVersion(ctx, req.Version)
+	autoUpdateVersion, err := s.backend.UpsertAutoUpdateVersion(ctx, req.GetVersion())
 	var errMsg string
 	if err != nil {
 		errMsg = err.Error()
@@ -575,7 +575,7 @@ func (s *Service) CreateAutoUpdateAgentRollout(ctx context.Context, req *autoupd
 		return nil, trace.Wrap(err)
 	}
 
-	autoUpdateAgentRollout, err := s.backend.CreateAutoUpdateAgentRollout(ctx, req.Rollout)
+	autoUpdateAgentRollout, err := s.backend.CreateAutoUpdateAgentRollout(ctx, req.GetRollout())
 	return autoUpdateAgentRollout, trace.Wrap(err)
 }
 
@@ -604,7 +604,7 @@ func (s *Service) UpdateAutoUpdateAgentRollout(ctx context.Context, req *autoupd
 		return nil, trace.Wrap(err)
 	}
 
-	autoUpdateAgentRollout, err := s.backend.UpdateAutoUpdateAgentRollout(ctx, req.Rollout)
+	autoUpdateAgentRollout, err := s.backend.UpdateAutoUpdateAgentRollout(ctx, req.GetRollout())
 	return autoUpdateAgentRollout, trace.Wrap(err)
 }
 
@@ -633,7 +633,7 @@ func (s *Service) UpsertAutoUpdateAgentRollout(ctx context.Context, req *autoupd
 		return nil, trace.Wrap(err)
 	}
 
-	autoUpdateAgentRollout, err := s.backend.UpsertAutoUpdateAgentRollout(ctx, req.Rollout)
+	autoUpdateAgentRollout, err := s.backend.UpsertAutoUpdateAgentRollout(ctx, req.GetRollout())
 	return autoUpdateAgentRollout, trace.Wrap(err)
 }
 
@@ -715,7 +715,7 @@ func (s *Service) TriggerAutoUpdateAgentGroup(ctx context.Context, req *autoupda
 				Code: events.AutoUpdateAgentRolloutTriggerCode,
 			},
 			UserMetadata:       userMetadata,
-			Groups:             req.Groups,
+			Groups:             req.GetGroups(),
 			ConnectionMetadata: authz.ConnectionMetadata(ctx),
 			Status: apievents.Status{
 				Success: err == nil,
@@ -737,7 +737,7 @@ func (s *Service) TriggerAutoUpdateAgentGroup(ctx context.Context, req *autoupda
 			return nil, trace.Wrap(err, "getting reports")
 		}
 
-		err = rollout.TriggerGroups(existingRollout, reports, rollout.GroupListToGroupSet(req.Groups), req.DesiredState, time.Now())
+		err = rollout.TriggerGroups(existingRollout, reports, rollout.GroupListToGroupSet(req.GetGroups()), req.GetDesiredState(), time.Now())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -781,7 +781,7 @@ func (s *Service) ForceAutoUpdateAgentGroup(ctx context.Context, req *autoupdate
 				Code: events.AutoUpdateAgentRolloutForceDoneCode,
 			},
 			UserMetadata:       userMetadata,
-			Groups:             req.Groups,
+			Groups:             req.GetGroups(),
 			ConnectionMetadata: authz.ConnectionMetadata(ctx),
 			Status: apievents.Status{
 				Success: err == nil,
@@ -799,7 +799,7 @@ func (s *Service) ForceAutoUpdateAgentGroup(ctx context.Context, req *autoupdate
 			return nil, trace.Wrap(err)
 		}
 
-		err = rollout.ForceGroupsDone(existingRollout, rollout.GroupListToGroupSet(req.Groups), time.Now())
+		err = rollout.ForceGroupsDone(existingRollout, rollout.GroupListToGroupSet(req.GetGroups()), time.Now())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -831,7 +831,7 @@ func (s *Service) RollbackAutoUpdateAgentGroup(ctx context.Context, req *autoupd
 		return nil, trace.Wrap(err)
 	}
 
-	if len(req.Groups) == 0 && !req.AllStartedGroups {
+	if len(req.GetGroups()) == 0 && !req.GetAllStartedGroups() {
 		return nil, trace.BadParameter("at least one group must be specified or the all_started_groups flag set")
 	}
 
@@ -852,7 +852,7 @@ func (s *Service) RollbackAutoUpdateAgentGroup(ctx context.Context, req *autoupd
 				Success: err == nil,
 				Error:   errMsg,
 			},
-			Groups: req.Groups,
+			Groups: req.GetGroups(),
 		})
 	}()
 
@@ -865,8 +865,8 @@ func (s *Service) RollbackAutoUpdateAgentGroup(ctx context.Context, req *autoupd
 			return nil, trace.Wrap(err)
 		}
 
-		groups := rollout.GroupListToGroupSet(req.Groups)
-		if req.AllStartedGroups {
+		groups := rollout.GroupListToGroupSet(req.GetGroups())
+		if req.GetAllStartedGroups() {
 			startedGroups := rollout.GetStartedGroups(existingRollout)
 			for group := range startedGroups {
 				groups[group] = struct{}{}
@@ -909,10 +909,10 @@ func (s *Service) ListAutoUpdateAgentReports(ctx context.Context, req *autoupdat
 		return nil, trace.Wrap(err)
 	}
 
-	return &autoupdate.ListAutoUpdateAgentReportsResponse{
+	return autoupdate.ListAutoUpdateAgentReportsResponse_builder{
 		AutoupdateAgentReports: reports,
 		NextKey:                nextKey,
-	}, nil
+	}.Build(), nil
 
 }
 
@@ -1191,7 +1191,7 @@ func validateServerSideAgentConfig(config *autoupdate.AutoUpdateConfig, features
 	}
 
 	for i, group := range agentsSpec.GetSchedules().GetRegular() {
-		weekdays, err := types.ParseWeekdays(group.Days)
+		weekdays, err := types.ParseWeekdays(group.GetDays())
 		if err != nil {
 			return trace.Wrap(err, "parsing weekdays from group %d", i)
 		}
@@ -1214,7 +1214,7 @@ func computeMinRolloutTime(groups []*autoupdate.AgentAutoUpdateGroup) int {
 	}
 
 	// We start the rollout at the first group hour, and we wait for the group to update (1 hour).
-	hours := groups[0].StartHour + 1
+	hours := groups[0].GetStartHour() + 1
 
 	for _, group := range groups[1:] {
 		previousStartHour := (hours - 1) % 24
@@ -1222,16 +1222,16 @@ func computeMinRolloutTime(groups []*autoupdate.AgentAutoUpdateGroup) int {
 
 		// compute the difference between the current hour and the group start hour
 		// we then check if it's less than the WaitHours, in this case we wait a day
-		diff := hourDifference(previousStartHour, group.StartHour)
-		if diff < group.WaitHours%24 {
-			hours += 24 + hourDifference(previousEndHour, group.StartHour)
+		diff := hourDifference(previousStartHour, group.GetStartHour())
+		if diff < group.GetWaitHours()%24 {
+			hours += 24 + hourDifference(previousEndHour, group.GetStartHour())
 		} else {
-			hours += hourDifference(previousEndHour, group.StartHour)
+			hours += hourDifference(previousEndHour, group.GetStartHour())
 		}
 
 		// Handle the case where WaitHours is > 24
 		// This is an integer division
-		waitDays := group.WaitHours / 24
+		waitDays := group.GetWaitHours() / 24
 		// There's a special case where the difference modulo 24 is zero, the
 		// wait hours are non-null, but we already waited 23 hours.
 		// To avoid double counting we reduce the number of wait days by 1 if
@@ -1246,7 +1246,7 @@ func computeMinRolloutTime(groups []*autoupdate.AgentAutoUpdateGroup) int {
 	}
 
 	// We remove the group start hour we added initially
-	return int(hours - groups[0].StartHour)
+	return int(hours - groups[0].GetStartHour())
 }
 
 // hourDifference computed the difference between two hours.
diff --git a/lib/auth/autoupdate/autoupdatev1/service_test.go b/lib/auth/autoupdate/autoupdatev1/service_test.go
index 5afc8f2657a..32b650d253c 100644
--- a/lib/auth/autoupdate/autoupdatev1/service_test.go
+++ b/lib/auth/autoupdate/autoupdatev1/service_test.go
@@ -471,14 +471,14 @@ func TestAutoUpdateConfigEvents(t *testing.T) {
 	service := newService(t, authz.AdminActionAuthMFAVerified, checker, mockEmitter)
 	ctx := context.Background()
 
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatev1pb.AutoUpdateConfigSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 			Mode: autoupdate.ToolsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	_, err = service.CreateAutoUpdateConfig(ctx, &autoupdatev1pb.CreateAutoUpdateConfigRequest{Config: config})
+	_, err = service.CreateAutoUpdateConfig(ctx, autoupdatev1pb.CreateAutoUpdateConfigRequest_builder{Config: config}.Build())
 	require.NoError(t, err)
 	require.Len(t, mockEmitter.Events(), 1)
 	require.Equal(t, libevents.AutoUpdateConfigCreateEvent, mockEmitter.LastEvent().GetType())
@@ -486,7 +486,7 @@ func TestAutoUpdateConfigEvents(t *testing.T) {
 	require.Equal(t, types.MetaNameAutoUpdateConfig, mockEmitter.LastEvent().(*apievents.AutoUpdateConfigCreate).Name)
 	mockEmitter.Reset()
 
-	_, err = service.UpdateAutoUpdateConfig(ctx, &autoupdatev1pb.UpdateAutoUpdateConfigRequest{Config: config})
+	_, err = service.UpdateAutoUpdateConfig(ctx, autoupdatev1pb.UpdateAutoUpdateConfigRequest_builder{Config: config}.Build())
 	require.NoError(t, err)
 	require.Len(t, mockEmitter.Events(), 1)
 	require.Equal(t, libevents.AutoUpdateConfigUpdateEvent, mockEmitter.LastEvent().GetType())
@@ -494,7 +494,7 @@ func TestAutoUpdateConfigEvents(t *testing.T) {
 	require.Equal(t, types.MetaNameAutoUpdateConfig, mockEmitter.LastEvent().(*apievents.AutoUpdateConfigUpdate).Name)
 	mockEmitter.Reset()
 
-	_, err = service.UpsertAutoUpdateConfig(ctx, &autoupdatev1pb.UpsertAutoUpdateConfigRequest{Config: config})
+	_, err = service.UpsertAutoUpdateConfig(ctx, autoupdatev1pb.UpsertAutoUpdateConfigRequest_builder{Config: config}.Build())
 	require.NoError(t, err)
 	require.Len(t, mockEmitter.Events(), 1)
 	require.Equal(t, libevents.AutoUpdateConfigUpdateEvent, mockEmitter.LastEvent().GetType())
@@ -518,14 +518,14 @@ func TestAutoUpdateVersionEvents(t *testing.T) {
 	service := newService(t, authz.AdminActionAuthMFAVerified, checker, mockEmitter)
 	ctx := context.Background()
 
-	config, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
-		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	config, err := autoupdate.NewAutoUpdateVersion(autoupdatev1pb.AutoUpdateVersionSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	_, err = service.CreateAutoUpdateVersion(ctx, &autoupdatev1pb.CreateAutoUpdateVersionRequest{Version: config})
+	_, err = service.CreateAutoUpdateVersion(ctx, autoupdatev1pb.CreateAutoUpdateVersionRequest_builder{Version: config}.Build())
 	require.NoError(t, err)
 	require.Len(t, mockEmitter.Events(), 1)
 	require.Equal(t, libevents.AutoUpdateVersionCreateEvent, mockEmitter.LastEvent().GetType())
@@ -533,7 +533,7 @@ func TestAutoUpdateVersionEvents(t *testing.T) {
 	require.Equal(t, types.MetaNameAutoUpdateVersion, mockEmitter.LastEvent().(*apievents.AutoUpdateVersionCreate).Name)
 	mockEmitter.Reset()
 
-	_, err = service.UpdateAutoUpdateVersion(ctx, &autoupdatev1pb.UpdateAutoUpdateVersionRequest{Version: config})
+	_, err = service.UpdateAutoUpdateVersion(ctx, autoupdatev1pb.UpdateAutoUpdateVersionRequest_builder{Version: config}.Build())
 	require.NoError(t, err)
 	require.Len(t, mockEmitter.Events(), 1)
 	require.Equal(t, libevents.AutoUpdateVersionUpdateEvent, mockEmitter.LastEvent().GetType())
@@ -541,7 +541,7 @@ func TestAutoUpdateVersionEvents(t *testing.T) {
 	require.Equal(t, types.MetaNameAutoUpdateVersion, mockEmitter.LastEvent().(*apievents.AutoUpdateVersionUpdate).Name)
 	mockEmitter.Reset()
 
-	_, err = service.UpsertAutoUpdateVersion(ctx, &autoupdatev1pb.UpsertAutoUpdateVersionRequest{Version: config})
+	_, err = service.UpsertAutoUpdateVersion(ctx, autoupdatev1pb.UpsertAutoUpdateVersionRequest_builder{Version: config}.Build())
 	require.NoError(t, err)
 	require.Len(t, mockEmitter.Events(), 1)
 	require.Equal(t, libevents.AutoUpdateVersionUpdateEvent, mockEmitter.LastEvent().GetType())
@@ -571,51 +571,51 @@ func TestAutoUpdateAgentRolloutEvents(t *testing.T) {
 		mockEmitter)
 	ctx := context.Background()
 
-	rollout, err := autoupdate.NewAutoUpdateAgentRollout(&autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+	rollout, err := autoupdate.NewAutoUpdateAgentRollout(autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "1.2.4",
 		Schedule:       autoupdate.AgentsScheduleRegular,
 		AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 		Strategy:       autoupdate.AgentsStrategyHaltOnError,
-	})
+	}.Build())
 	require.NoError(t, err)
-	rollout.Status = &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+	rollout.SetStatus(autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 		Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-			{
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:       "blue",
 				State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 				ConfigDays: cloudGroupUpdateDays,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:       "dev",
 				State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 				ConfigDays: cloudGroupUpdateDays,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:       "stage",
 				State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 				ConfigDays: cloudGroupUpdateDays,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:       "prod",
 				State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				ConfigDays: cloudGroupUpdateDays,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:       "backup",
 				State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
 				ConfigDays: cloudGroupUpdateDays,
-			},
+			}.Build(),
 		},
-	}
+	}.Build())
 
-	_, err = service.CreateAutoUpdateAgentRollout(ctx, &autoupdatev1pb.CreateAutoUpdateAgentRolloutRequest{Rollout: rollout})
+	_, err = service.CreateAutoUpdateAgentRollout(ctx, autoupdatev1pb.CreateAutoUpdateAgentRolloutRequest_builder{Rollout: rollout}.Build())
 	require.NoError(t, err)
 
 	groups := []string{"prod"}
-	_, err = service.TriggerAutoUpdateAgentGroup(ctx, &autoupdatev1pb.TriggerAutoUpdateAgentGroupRequest{
+	_, err = service.TriggerAutoUpdateAgentGroup(ctx, autoupdatev1pb.TriggerAutoUpdateAgentGroupRequest_builder{
 		Groups: groups,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	require.Len(t, mockEmitter.Events(), 1)
@@ -624,9 +624,9 @@ func TestAutoUpdateAgentRolloutEvents(t *testing.T) {
 	require.Equal(t, groups, mockEmitter.LastEvent().(*apievents.AutoUpdateAgentRolloutTrigger).Groups)
 	mockEmitter.Reset()
 
-	_, err = service.ForceAutoUpdateAgentGroup(ctx, &autoupdatev1pb.ForceAutoUpdateAgentGroupRequest{
+	_, err = service.ForceAutoUpdateAgentGroup(ctx, autoupdatev1pb.ForceAutoUpdateAgentGroupRequest_builder{
 		Groups: []string{"prod"},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	require.Len(t, mockEmitter.Events(), 1)
@@ -635,9 +635,9 @@ func TestAutoUpdateAgentRolloutEvents(t *testing.T) {
 	require.Equal(t, groups, mockEmitter.LastEvent().(*apievents.AutoUpdateAgentRolloutForceDone).Groups)
 	mockEmitter.Reset()
 
-	_, err = service.RollbackAutoUpdateAgentGroup(ctx, &autoupdatev1pb.RollbackAutoUpdateAgentGroupRequest{
+	_, err = service.RollbackAutoUpdateAgentGroup(ctx, autoupdatev1pb.RollbackAutoUpdateAgentGroupRequest_builder{
 		Groups: []string{"prod"},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	require.Len(t, mockEmitter.Events(), 1)
@@ -740,23 +740,23 @@ func TestComputeMinRolloutTime(t *testing.T) {
 		{
 			name: "single group",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name: "g1",
-				},
+				}.Build(),
 			},
 			expectedHours: 1,
 		},
 		{
 			name: "two groups, same day, different start hour, no wait time",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 2,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 4,
-				},
+				}.Build(),
 			},
 			// g1 updates from 2:00 to 3:00, g2 updates from 4:00 to 5:00, rollout updates from 2:00 to 5:00.
 			expectedHours: 3,
@@ -764,14 +764,14 @@ func TestComputeMinRolloutTime(t *testing.T) {
 		{
 			name: "two groups, same day, same start hour, no wait time",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 2,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 2,
-				},
+				}.Build(),
 			},
 			// g1 and g2 can't update at the same time, the g1 updates from 2:00 to 3:00 days one,
 			// and g2 updates from 2:00 to 3:00 the next day. Total update spans from 2:00 day 1, to 3:00 day 2
@@ -780,15 +780,15 @@ func TestComputeMinRolloutTime(t *testing.T) {
 		{
 			name: "two groups, cannot happen on the same day because of wait_hours",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 2,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 4,
 					WaitHours: 6,
-				},
+				}.Build(),
 			},
 			// g1 updates from 2:00 to 3:00. At 4:00 g2 can't update yet, so we wait the next day.
 			// On day 2, g2 updates from 4:00 to 5:00. Rollout spans from 2:00 day on to 7:00 day 2.
@@ -797,15 +797,15 @@ func TestComputeMinRolloutTime(t *testing.T) {
 		{
 			name: "two groups, wait hours is several days",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 2,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 4,
 					WaitHours: 48,
-				},
+				}.Build(),
 			},
 			// g1 updates from 2:00 to 3:00. At 4:00 g2 can't update yet, so we wait 2 days.
 			// On day 3, g2 updates from 4:00 to 5:00. Rollout spans from 2:00 day on to 7:00 day 3.
@@ -814,83 +814,83 @@ func TestComputeMinRolloutTime(t *testing.T) {
 		{
 			name: "two groups, one wait hour",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 2,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 3,
 					WaitHours: 1,
-				},
+				}.Build(),
 			},
 			expectedHours: 2,
 		},
 		{
 			name: "two groups different days",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 23,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 1,
-				},
+				}.Build(),
 			},
 			expectedHours: 3,
 		},
 		{
 			name: "two groups different days, hour diff == wait hours == 1 day",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 12,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 12,
 					WaitHours: 24,
-				},
+				}.Build(),
 			},
 			expectedHours: 25,
 		},
 		{
 			name: "two groups different days, hour diff == wait hours",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 12,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 11,
 					WaitHours: 23,
-				},
+				}.Build(),
 			},
 			expectedHours: 24,
 		},
 		{
 			name: "everything at once",
 			groups: []*autoupdatev1pb.AgentAutoUpdateGroup{
-				{
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g1",
 					StartHour: 23,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g2",
 					StartHour: 1,
 					WaitHours: 4,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g3",
 					StartHour: 1,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AgentAutoUpdateGroup_builder{
 					Name:      "g4",
 					StartHour: 10,
 					WaitHours: 6,
-				},
+				}.Build(),
 			},
 			expectedHours: 60,
 		},
@@ -905,11 +905,11 @@ func TestComputeMinRolloutTime(t *testing.T) {
 func generateGroups(n int, days []string) []*autoupdatev1pb.AgentAutoUpdateGroup {
 	groups := make([]*autoupdatev1pb.AgentAutoUpdateGroup, n)
 	for i := range groups {
-		groups[i] = &autoupdatev1pb.AgentAutoUpdateGroup{
+		groups[i] = autoupdatev1pb.AgentAutoUpdateGroup_builder{
 			Name:      strconv.Itoa(i),
 			Days:      days,
 			StartHour: int32(i % 24),
-		}
+		}.Build()
 	}
 	return groups
 }
@@ -949,131 +949,131 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
 		{
 			name:    "over max groups time-based",
 			modules: selfHostedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:                      autoupdate.AgentsUpdateModeEnabled,
 				Strategy:                  autoupdate.AgentsStrategyTimeBased,
 				MaintenanceWindowDuration: durationpb.New(time.Hour),
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsTimeBasedStrategy+1, cloudGroupUpdateDays),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.Error,
 		},
 		{
 			name:    "over max groups halt-on-error",
 			modules: selfHostedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsHaltOnErrorStrategy+1, cloudGroupUpdateDays),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.Error,
 		},
 		{
 			name:    "over max groups halt-on-error cloud unlimited",
 			modules: cloudUnlimitedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsHaltOnErrorStrategy+1, cloudGroupUpdateDays),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.Error,
 		},
 		{
 			name:    "over max groups halt-on-error cloud",
 			modules: cloudModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsHaltOnErrorStrategyCloud+1, cloudGroupUpdateDays),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.Error,
 		},
 		{
 			name:    "cloud should reject custom weekdays",
 			modules: cloudModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsHaltOnErrorStrategyCloud, []string{"Mon"}),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.Error,
 		},
 		{
 			name:    "cloud unlimited should allow custom weekdays",
 			modules: cloudUnlimitedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsHaltOnErrorStrategyCloud, []string{"Mon"}),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.NoError,
 		},
 		{
 			name:    "self-hosted should allow custom weekdays",
 			modules: selfHostedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: generateGroups(maxGroupsHaltOnErrorStrategyCloud, []string{"Mon"}),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.NoError,
 		},
 		{
 			name:    "cloud should reject long rollouts",
 			modules: cloudModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: []*autoupdatev1pb.AgentAutoUpdateGroup{
-						{Name: "g1", Days: cloudGroupUpdateDays},
-						{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours},
+						autoupdatev1pb.AgentAutoUpdateGroup_builder{Name: "g1", Days: cloudGroupUpdateDays}.Build(),
+						autoupdatev1pb.AgentAutoUpdateGroup_builder{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.Error,
 		},
 		{
 			name:    "cloud should allow long rollouts with entitlement",
 			modules: cloudUnlimitedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: []*autoupdatev1pb.AgentAutoUpdateGroup{
-						{Name: "g1", Days: cloudGroupUpdateDays},
-						{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours},
+						autoupdatev1pb.AgentAutoUpdateGroup_builder{Name: "g1", Days: cloudGroupUpdateDays}.Build(),
+						autoupdatev1pb.AgentAutoUpdateGroup_builder{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.NoError,
 		},
 		{
 			name:    "self-hosted should allow long rollouts",
 			modules: selfHostedModules,
-			config: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+			config: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 				Mode:     autoupdate.AgentsUpdateModeEnabled,
 				Strategy: autoupdate.AgentsStrategyHaltOnError,
-				Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+				Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 					Regular: []*autoupdatev1pb.AgentAutoUpdateGroup{
-						{Name: "g1", Days: cloudGroupUpdateDays},
-						{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours},
+						autoupdatev1pb.AgentAutoUpdateGroup_builder{Name: "g1", Days: cloudGroupUpdateDays}.Build(),
+						autoupdatev1pb.AgentAutoUpdateGroup_builder{Name: "g2", Days: cloudGroupUpdateDays, WaitHours: maxRolloutDurationCloudHours}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: require.NoError,
 		},
 	}
@@ -1081,10 +1081,10 @@ func TestValidateServerSideAgentConfig(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			// Test setup: crafing a config and setting modules
 			config, err := autoupdate.NewAutoUpdateConfig(
-				&autoupdatev1pb.AutoUpdateConfigSpec{
+				autoupdatev1pb.AutoUpdateConfigSpec_builder{
 					Tools:  nil,
 					Agents: tt.config,
-				})
+				}.Build())
 			require.NoError(t, err)
 
 			// Test execution.
diff --git a/lib/auth/autoupdate_agent_version_report.go b/lib/auth/autoupdate_agent_version_report.go
index 1991ea85138..85313752511 100644
--- a/lib/auth/autoupdate_agent_version_report.go
+++ b/lib/auth/autoupdate_agent_version_report.go
@@ -112,7 +112,7 @@ func filterHandler(handle inventory.UpstreamHandle, now time.Time) autoUpdateFil
 	hello := handle.Hello()
 
 	// If the machine has no updater, we skip it
-	switch hello.ExternalUpgrader {
+	switch hello.GetExternalUpgrader() {
 	case "":
 		return autoUpdateFilterResultNoUpdater
 	case types.UpgraderKindSystemdUnit:
@@ -160,7 +160,7 @@ func (ir instanceReport) collectInstance(handle inventory.UpstreamHandle) {
 
 	// No need to check for UpdaterInfo being nil, it would have been filtered
 	// out by filterHandler().
-	updateGroup := handle.Hello().UpdaterInfo.UpdateGroup
+	updateGroup := handle.Hello().GetUpdaterInfo().UpdateGroup
 
 	if _, ok := ir.data[updateGroup]; !ok {
 		ir.data[updateGroup] = instanceGroupReport{}
@@ -174,14 +174,14 @@ type instanceGroupReport map[string]instanceGroupVersionReport
 func (ir instanceGroupReport) collectInstance(handle inventory.UpstreamHandle) {
 	hello := handle.Hello()
 
-	stats, ok := ir[hello.Version]
+	stats, ok := ir[hello.GetVersion()]
 	if !ok {
 		stats = instanceGroupVersionReport{}
 	}
 
 	stats.count += 1
 
-	ir[hello.Version] = stats
+	ir[hello.GetVersion()] = stats
 }
 
 type instanceGroupVersionReport struct {
@@ -201,11 +201,11 @@ func (a *Server) generateAgentVersionReport(ctx context.Context) (*autoupdatev1p
 	a.inventory.AllHandles(rawreport.collectInstance)
 
 	a.logger.DebugContext(ctx, "Building the agent version report")
-	spec := &autoupdatev1pb.AutoUpdateAgentReportSpec{
+	spec := autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 		Timestamp: timestamppb.New(a.clock.Now()),
 		Groups:    make(map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup, len(rawreport.data)),
 		Omitted:   make([]*autoupdatev1pb.AutoUpdateAgentReportSpecOmitted, 0, len(rawreport.omissions)),
-	}
+	}.Build()
 
 	// TODO(hugoShaka): gracefully handle too many groups or versions (sort and report only the largest ones).
 	// Currently the agent version report will just fail validation if there are too many groups.
@@ -213,20 +213,20 @@ func (a *Server) generateAgentVersionReport(ctx context.Context) (*autoupdatev1p
 	for groupName, groupData := range rawreport.data {
 		versions := make(map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion, len(groupData))
 		for versionName, groupVersionData := range groupData {
-			versions[versionName] = &autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
+			versions[versionName] = autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{
 				Count: int32(groupVersionData.count),
-			}
+			}.Build()
 		}
-		spec.Groups[groupName] = &autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
+		spec.GetGroups()[groupName] = autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 			Versions: versions,
-		}
+		}.Build()
 	}
 
 	for reason, count := range rawreport.omissions {
-		spec.Omitted = append(spec.Omitted, &autoupdatev1pb.AutoUpdateAgentReportSpecOmitted{
+		spec.SetOmitted(append(spec.GetOmitted(), autoupdatev1pb.AutoUpdateAgentReportSpecOmitted_builder{
 			Reason: reason,
 			Count:  int64(count),
-		})
+		}.Build()))
 	}
 
 	report, err := autoupdate.NewAutoUpdateAgentReport(spec, a.ServerID)
diff --git a/lib/auth/autoupdate_agent_version_report_test.go b/lib/auth/autoupdate_agent_version_report_test.go
index 5f9896c5590..0c272bd808b 100644
--- a/lib/auth/autoupdate_agent_version_report_test.go
+++ b/lib/auth/autoupdate_agent_version_report_test.go
@@ -107,9 +107,9 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 	}{
 		{
 			name: "no servers",
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
-			},
+			}.Build(),
 		},
 		{
 			name: "no group, same version",
@@ -119,16 +119,16 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
 				{version: "1.2.3", roles: agentRoles, updateGroup: "default"},
 			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
+					"default": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 4},
+							"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 4}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "control plane servers are ignored",
@@ -137,16 +137,16 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 				{version: "1.2.3", roles: types.SystemRoles{types.RoleApp, types.RoleProxy}, updateGroup: "default"},
 				{version: "1.2.3", roles: types.SystemRoles{types.RoleApp, types.RoleKube}, updateGroup: "default"},
 			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
+					"default": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
+							"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "disabled or pinned updaters are ignored",
@@ -155,38 +155,38 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 				{version: "1.2.3", roles: agentRoles, updaterStatus: types.UpdaterStatus_UPDATER_STATUS_PINNED, updateGroup: "default"},
 				{version: "1.2.3", roles: agentRoles, updaterStatus: types.UpdaterStatus_UPDATER_STATUS_DISABLED, updateGroup: "default"},
 			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
+					"default": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
+							"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
+					}.Build(),
 				},
 				Omitted: []*autoupdatev1pb.AutoUpdateAgentReportSpecOmitted{
-					{Reason: omissionReasonUpdaterPinned, Count: 1},
-					{Reason: omissionReasonUpdaterDisabled, Count: 1},
+					autoupdatev1pb.AutoUpdateAgentReportSpecOmitted_builder{Reason: omissionReasonUpdaterPinned, Count: 1}.Build(),
+					autoupdatev1pb.AutoUpdateAgentReportSpecOmitted_builder{Reason: omissionReasonUpdaterDisabled, Count: 1}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "reloaded and terminating instances are ignored",
 			fixtures: []fakeServer{
 				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: &proto.UpstreamInventoryGoodbye{SoftReload: true}},
-				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: &proto.UpstreamInventoryGoodbye{DeleteResources: true}},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: proto.UpstreamInventoryGoodbye_builder{SoftReload: true}.Build()},
+				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default", goodbye: proto.UpstreamInventoryGoodbye_builder{DeleteResources: true}.Build()},
 			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
+					"default": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
+							"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "too recent servers are ignored",
@@ -196,16 +196,16 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
 				{version: "1.2.3", roles: agentRoles, updaterStatus: updaterOK, updateGroup: "default"},
 			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
+					"default": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
+							"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "multiple versions and groups",
@@ -216,27 +216,27 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 				{version: "1.2.5", updateGroup: "prod", roles: agentRoles, updaterStatus: updaterOK},
 				{version: "1.2.5", updateGroup: "dev", roles: agentRoles, updaterStatus: updaterOK},
 			},
-			expected: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			expected: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(now),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"default": {
+					"default": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.3": {Count: 1},
-							"1.2.4": {Count: 1},
+							"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
+							"1.2.4": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					"dev": {
+					}.Build(),
+					"dev": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.5": {Count: 1},
+							"1.2.5": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					"prod": {
+					}.Build(),
+					"prod": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							"1.2.5": {Count: 2},
+							"1.2.5": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 2}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 	}
 	for _, tt := range tests {
@@ -265,13 +265,13 @@ func TestServer_generateAgentVersionReport(t *testing.T) {
 				if status == types.UpdaterStatus_UPDATER_STATUS_UNSPECIFIED {
 					status = types.UpdaterStatus_UPDATER_STATUS_OK
 				}
-				controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
+				controller.RegisterControlStream(stream, proto.UpstreamInventoryHello_builder{
 					Services:         fixture.roles.StringSlice(),
 					ServerID:         uuid.New().String(),
 					Version:          fixture.version,
 					ExternalUpgrader: types.UpgraderKindTeleportUpdate,
 					UpdaterInfo:      &types.UpdaterV2Info{UpdaterStatus: status, UpdateGroup: fixture.updateGroup},
-				})
+				}.Build())
 				if fixture.goodbye != nil {
 					// Sending the message twice is a little hack to make sure that the auth received the goodbye at
 					// least once. Else, the auth might still be in the small frame when it received the message
@@ -335,7 +335,7 @@ func TestServer_reportAgentVersions(t *testing.T) {
 
 	for range testNodeCount {
 		stream := newFakeControlStream()
-		controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
+		controller.RegisterControlStream(stream, proto.UpstreamInventoryHello_builder{
 			Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
 			Version:          "1.2.3",
 			ServerID:         uuid.NewString(),
@@ -344,18 +344,18 @@ func TestServer_reportAgentVersions(t *testing.T) {
 				UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
 				UpdateGroup:   "default",
 			},
-		})
+		}.Build())
 		t.Cleanup(stream.close)
 	}
 	ctx := context.Background()
-	rollout, err := autoupdate.NewAutoUpdateAgentRollout(&autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+	rollout, err := autoupdate.NewAutoUpdateAgentRollout(autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:              "1.2.3",
 		TargetVersion:             "1.2.4",
 		Schedule:                  autoupdate.AgentsScheduleRegular,
 		AutoupdateMode:            autoupdate.AgentsUpdateModeEnabled,
 		Strategy:                  autoupdate.AgentsStrategyHaltOnError,
 		MaintenanceWindowDuration: nil,
-	})
+	}.Build())
 	require.NoError(t, err)
 	_, err = svc.CreateAutoUpdateAgentRollout(ctx, rollout)
 	require.NoError(t, err)
diff --git a/lib/auth/autoupdate_rollout.go b/lib/auth/autoupdate_rollout.go
index c3371c80f9a..e0f9468e88f 100644
--- a/lib/auth/autoupdate_rollout.go
+++ b/lib/auth/autoupdate_rollout.go
@@ -55,7 +55,7 @@ func (a *Server) SampleAgentsFromAutoUpdateGroup(ctx context.Context, groupName
 		}
 
 		// If the agent group matches, we keep it.
-		if handle.Hello().UpdaterInfo.UpdateGroup == groupName {
+		if handle.Hello().GetUpdaterInfo().UpdateGroup == groupName {
 			// No need to check for UpdaterInfo being nil, it would have been filtered
 			// out by filterHandler().
 			return true
@@ -67,7 +67,7 @@ func (a *Server) SampleAgentsFromAutoUpdateGroup(ctx context.Context, groupName
 		}
 
 		// This is the catch-call group, it matches agents from every group not in groups.
-		_, ok := groupSet[handle.Hello().UpdaterInfo.UpdateGroup]
+		_, ok := groupSet[handle.Hello().GetUpdaterInfo().UpdateGroup]
 		// If the agent group is not in the group list, it falls into the catch-all.
 		return !ok
 	}
@@ -80,16 +80,16 @@ func (a *Server) SampleAgentsFromAutoUpdateGroup(ctx context.Context, groupName
 	canaries := make([]*autoupdatev1pb.Canary, 0, len(sampled))
 	for _, h := range sampled {
 		hello := h.Hello()
-		updaterID, err := uuid.FromBytes(hello.UpdaterInfo.UpdateUUID)
+		updaterID, err := uuid.FromBytes(hello.GetUpdaterInfo().UpdateUUID)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		canaries = append(canaries, &autoupdatev1pb.Canary{
+		canaries = append(canaries, autoupdatev1pb.Canary_builder{
 			UpdaterId: updaterID.String(),
-			HostId:    hello.ServerID,
-			Hostname:  hello.Hostname,
+			HostId:    hello.GetServerID(),
+			Hostname:  hello.GetHostname(),
 			Success:   false,
-		})
+		}.Build())
 	}
 	return canaries, nil
 }
diff --git a/lib/auth/autoupdate_rollout_test.go b/lib/auth/autoupdate_rollout_test.go
index 65fded882c8..f0752175c94 100644
--- a/lib/auth/autoupdate_rollout_test.go
+++ b/lib/auth/autoupdate_rollout_test.go
@@ -75,7 +75,7 @@ func TestSampleAgentsFromGroup(t *testing.T) {
 	for range testNodeCount {
 		updaterID := uuid.New()
 		stream := newFakeControlStream()
-		controller.RegisterControlStream(stream, &proto.UpstreamInventoryHello{
+		controller.RegisterControlStream(stream, proto.UpstreamInventoryHello_builder{
 			Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
 			Version:          "1.2.3",
 			ServerID:         uuid.NewString(),
@@ -85,7 +85,7 @@ func TestSampleAgentsFromGroup(t *testing.T) {
 				UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
 				UpdateGroup:   testGroupName,
 			},
-		})
+		}.Build())
 		t.Cleanup(stream.close)
 	}
 
@@ -101,7 +101,7 @@ func TestSampleAgentsFromGroup(t *testing.T) {
 	// Test execution: check that there were no duplicates in the samples
 	canarySet := make(map[string]*autoupdatev1pb.Canary)
 	for _, canary := range canaries {
-		canarySet[canary.UpdaterId] = canary
+		canarySet[canary.GetUpdaterId()] = canary
 	}
 	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
 
@@ -110,14 +110,14 @@ func TestSampleAgentsFromGroup(t *testing.T) {
 	require.Len(t, canaries2, sampleSize)
 	canarySet = make(map[string]*autoupdatev1pb.Canary)
 	for _, canary := range canaries2 {
-		canarySet[canary.UpdaterId] = canary
+		canarySet[canary.GetUpdaterId()] = canary
 	}
 	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
 
 	// Text execution: check that the random looks sane
 	var conflicts int
 	for i := range sampleSize {
-		if canaries[i].UpdaterId == canaries2[i].UpdaterId {
+		if canaries[i].GetUpdaterId() == canaries2[i].GetUpdaterId() {
 			conflicts++
 		}
 	}
@@ -131,7 +131,7 @@ func TestSampleAgentsFromGroup(t *testing.T) {
 	require.Len(t, canariesCatchAll, sampleSize)
 	canarySet = make(map[string]*autoupdatev1pb.Canary)
 	for _, canary := range canariesCatchAll {
-		canarySet[canary.UpdaterId] = canary
+		canarySet[canary.GetUpdaterId()] = canary
 	}
 	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
 
@@ -141,7 +141,7 @@ func TestSampleAgentsFromGroup(t *testing.T) {
 	require.Len(t, canariesCatchAll, sampleSize)
 	canarySet = make(map[string]*autoupdatev1pb.Canary)
 	for _, canary := range canariesCatchAll {
-		canarySet[canary.UpdaterId] = canary
+		canarySet[canary.GetUpdaterId()] = canary
 	}
 	require.Len(t, canarySet, sampleSize, "some canary got duplicated")
 }
@@ -181,7 +181,7 @@ func TestLookupAgentInInventory(t *testing.T) {
 		updaterID := uuid.New()
 		hellos := make([]*proto.UpstreamInventoryHello, i+1)
 		for j := range i + 1 {
-			hello := &proto.UpstreamInventoryHello{
+			hello := proto.UpstreamInventoryHello_builder{
 				Services:         types.SystemRoles{types.RoleNode}.StringSlice(),
 				Version:          fmt.Sprintf("1.2.%d", j),
 				ServerID:         hostID,
@@ -191,7 +191,7 @@ func TestLookupAgentInInventory(t *testing.T) {
 					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
 					UpdateGroup:   testGroupName,
 				},
-			}
+			}.Build()
 			hellos[j] = hello
 
 			stream := newFakeControlStream()
@@ -207,7 +207,7 @@ func TestLookupAgentInInventory(t *testing.T) {
 	// and content matches.
 
 	opts := cmp.Options{
-		cmpopts.SortSlices(func(a, b *proto.UpstreamInventoryHello) bool { return a.Version > b.Version }),
+		cmpopts.SortSlices(func(a, b *proto.UpstreamInventoryHello) bool { return a.GetVersion() > b.GetVersion() }),
 		protocmp.Transform(),
 	}
 	for hostID, handles := range hosts {
@@ -223,9 +223,9 @@ type fakeHandle struct {
 }
 
 func (f *fakeHandle) Hello() *proto.UpstreamInventoryHello {
-	return &proto.UpstreamInventoryHello{
+	return proto.UpstreamInventoryHello_builder{
 		Hostname: fmt.Sprintf("hostname-%d", f.id),
-	}
+	}.Build()
 }
 
 func TestHandlerSampler(t *testing.T) {
@@ -290,7 +290,7 @@ func TestHandlerSampler(t *testing.T) {
 				require.Len(t, reservoir, 5)
 				for i, h := range reservoir {
 					expectedHostname := fmt.Sprintf("hostname-%d", i)
-					require.Equal(t, expectedHostname, h.Hello().Hostname)
+					require.Equal(t, expectedHostname, h.Hello().GetHostname())
 				}
 			},
 		},
diff --git a/lib/auth/bot.go b/lib/auth/bot.go
index e55c22d095d..4f7b01d573c 100644
--- a/lib/auth/bot.go
+++ b/lib/auth/bot.go
@@ -337,10 +337,10 @@ func (a *Server) updateBotInstance(
 			return trace.Wrap(err)
 		} else {
 			// We have an existing instance, so fetch its generation.
-			auths := existingInstance.Status.LatestAuthentications
+			auths := existingInstance.GetStatus().GetLatestAuthentications()
 			if len(auths) > 0 {
 				latest := auths[len(auths)-1]
-				instanceGeneration = latest.Generation
+				instanceGeneration = latest.GetGeneration()
 			}
 		}
 	}
@@ -357,19 +357,19 @@ func (a *Server) updateBotInstance(
 		}
 	}
 
-	authRecord := &machineidv1pb.BotInstanceStatusAuthentication{
+	authRecord := machineidv1pb.BotInstanceStatusAuthentication_builder{
 		AuthenticatedAt: timestamppb.New(a.GetClock().Now()),
 		PublicKey:       publicKeyPEM,
 
 		// Note: This is presumed to be a token join. If not, a
 		// `templateAuthRecord` should be provided to override this value.
 		JoinMethod: string(types.JoinMethodToken),
-	}
+	}.Build()
 
 	if templateAuthRecord != nil {
-		authRecord.JoinToken = templateAuthRecord.JoinToken
-		authRecord.JoinMethod = templateAuthRecord.JoinMethod
-		authRecord.JoinAttrs = templateAuthRecord.JoinAttrs
+		authRecord.SetJoinToken(templateAuthRecord.GetJoinToken())
+		authRecord.SetJoinMethod(templateAuthRecord.GetJoinMethod())
+		authRecord.SetJoinAttrs(templateAuthRecord.GetJoinAttrs())
 	}
 
 	// An empty bot instance most likely means a bot is rejoining after an
@@ -403,11 +403,11 @@ func (a *Server) updateBotInstance(
 			}
 
 			// Copy the value from the request into the auth record.
-			authRecord.Generation = int32(req.Generation)
+			authRecord.SetGeneration(int32(req.Generation))
 		} else {
 			// Otherwise, just set it to 1.
 			req.Generation = 1
-			authRecord.Generation = 1
+			authRecord.SetGeneration(1)
 		}
 
 		a.logger.InfoContext(ctx, "bot has no valid instance ID, a new instance will be generated",
@@ -418,11 +418,11 @@ func (a *Server) updateBotInstance(
 
 		expires := a.GetClock().Now().Add(req.TTL + machineidv1.ExpiryMargin)
 
-		bi := newBotInstance(&machineidv1pb.BotInstanceSpec{
+		bi := newBotInstance(machineidv1pb.BotInstanceSpec_builder{
 			BotName:    botName,
 			InstanceId: instanceID.String(),
-		}, authRecord, expires)
-		bi.Scope = scope
+		}.Build(), authRecord, expires)
+		bi.SetScope(scope)
 
 		if _, err := a.BotInstance.CreateBotInstance(ctx, bi); err != nil {
 			return trace.Wrap(err)
@@ -447,7 +447,7 @@ func (a *Server) updateBotInstance(
 	} else if currentIdentityGeneration > 0 && currentIdentityGeneration != instanceGeneration {
 		// Generation counter enforcement depends on the type of cert and join
 		// method (if any - token renewals technically have no join method.)
-		if shouldEnforceGenerationCounter(req.Renewable, authRecord.JoinMethod) {
+		if shouldEnforceGenerationCounter(req.Renewable, authRecord.GetJoinMethod()) {
 			if err := a.tryLockBotDueToGenerationMismatch(ctx, botName, botInstanceID, req.JoinToken, req.Renewable); err != nil {
 				log.WarnContext(ctx, "Failed to lock bot when a generation mismatch was detected", "error", err)
 			}
@@ -466,7 +466,7 @@ func (a *Server) updateBotInstance(
 			log.WarnContext(ctx, msg,
 				"bot_instance_generation", instanceGeneration,
 				"bot_identity_generation", currentIdentityGeneration,
-				"bot_join_method", authRecord.JoinMethod,
+				"bot_join_method", authRecord.GetJoinMethod(),
 			)
 		}
 	}
@@ -474,7 +474,7 @@ func (a *Server) updateBotInstance(
 	// Increment the generation counter the cert and bot instance. The counter
 	// should be incremented and stored even if it is not validated above.
 	newGeneration := instanceGeneration + 1
-	authRecord.Generation = newGeneration
+	authRecord.SetGeneration(newGeneration)
 	req.Generation = uint64(newGeneration)
 
 	// Commit the generation counter to the bot user for downgrade
@@ -490,29 +490,29 @@ func (a *Server) updateBotInstance(
 	}
 
 	_, err := a.BotInstance.PatchBotInstance(ctx, botName, botInstanceID, func(bi *machineidv1pb.BotInstance) (*machineidv1pb.BotInstance, error) {
-		if bi.Status == nil {
-			bi.Status = &machineidv1pb.BotInstanceStatus{}
+		if !bi.HasStatus() {
+			bi.SetStatus(&machineidv1pb.BotInstanceStatus{})
 		}
 
 		// Update the record's expiration timestamp based on the request TTL
 		// plus an expiry margin.
-		bi.Metadata.Expires = timestamppb.New(a.GetClock().Now().Add(req.TTL + machineidv1.ExpiryMargin))
+		bi.GetMetadata().SetExpires(timestamppb.New(a.GetClock().Now().Add(req.TTL + machineidv1.ExpiryMargin)))
 
 		// If we're at or above the limit, remove enough of the front elements
 		// to make room for the new one at the end.
-		if len(bi.Status.LatestAuthentications) >= machineidv1.AuthenticationHistoryLimit {
-			toRemove := len(bi.Status.LatestAuthentications) - machineidv1.AuthenticationHistoryLimit + 1
-			bi.Status.LatestAuthentications = bi.Status.LatestAuthentications[toRemove:]
+		if len(bi.GetStatus().GetLatestAuthentications()) >= machineidv1.AuthenticationHistoryLimit {
+			toRemove := len(bi.GetStatus().GetLatestAuthentications()) - machineidv1.AuthenticationHistoryLimit + 1
+			bi.GetStatus().SetLatestAuthentications(bi.GetStatus().GetLatestAuthentications()[toRemove:])
 		}
 
 		// An initial auth record should have been added during initial join,
 		// but if not, add it now.
-		if bi.Status.InitialAuthentication == nil {
+		if !bi.GetStatus().HasInitialAuthentication() {
 			log.WarnContext(ctx, "bot instance is missing its initial authentication record, a new one will be added")
-			bi.Status.InitialAuthentication = authRecord
+			bi.GetStatus().SetInitialAuthentication(authRecord)
 		}
 
-		bi.Status.LatestAuthentications = append(bi.Status.LatestAuthentications, authRecord)
+		bi.GetStatus().SetLatestAuthentications(append(bi.GetStatus().GetLatestAuthentications(), authRecord))
 
 		return bi, nil
 	})
@@ -526,18 +526,18 @@ func newBotInstance(
 	initialAuth *machineidv1pb.BotInstanceStatusAuthentication,
 	expires time.Time,
 ) *machineidv1pb.BotInstance {
-	return &machineidv1pb.BotInstance{
+	return machineidv1pb.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Expires: timestamppb.New(expires),
-		},
+		}.Build(),
 		Spec: spec,
-		Status: &machineidv1pb.BotInstanceStatus{
+		Status: machineidv1pb.BotInstanceStatus_builder{
 			InitialAuthentication: initialAuth,
 			LatestAuthentications: []*machineidv1pb.BotInstanceStatusAuthentication{initialAuth},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // generateInitialBotCerts is used to generate bot certs and overlaps
@@ -620,7 +620,7 @@ func (a *Server) generateInitialBotCerts(
 	// token-joined bots and it's a secret value, so we don't bother setting it.
 	// (The renewable flag implies token joining.)
 	if !renewable {
-		certReq.JoinToken = initialAuth.JoinToken
+		certReq.JoinToken = initialAuth.GetJoinToken()
 	}
 
 	if existingInstanceID == "" {
@@ -630,14 +630,14 @@ func (a *Server) generateInitialBotCerts(
 			return nil, "", trace.Wrap(err)
 		}
 
-		initialAuth.Generation = 1
+		initialAuth.SetGeneration(1)
 
-		bi := newBotInstance(&machineidv1pb.BotInstanceSpec{
+		bi := newBotInstance(machineidv1pb.BotInstanceSpec_builder{
 			BotName:            botName,
 			InstanceId:         uuid.String(),
 			PreviousInstanceId: previousInstanceID,
-		}, initialAuth, expires.Add(machineidv1.ExpiryMargin))
-		bi.Scope = botScope
+		}.Build(), initialAuth, expires.Add(machineidv1.ExpiryMargin))
+		bi.SetScope(botScope)
 
 		_, err = a.BotInstance.CreateBotInstance(ctx, bi)
 		if err != nil {
diff --git a/lib/auth/bot_test.go b/lib/auth/bot_test.go
index e3d5ab01077..be3c359f839 100644
--- a/lib/auth/bot_test.go
+++ b/lib/auth/bot_test.go
@@ -138,23 +138,23 @@ func TestRegisterBotCertificateGenerationCheck(t *testing.T) {
 	// Create a new bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpec("testxyzzy", time.Time{}, types.ProvisionTokenSpecV2{
 		Roles:   types.SystemRoles{types.RoleBot},
-		BotName: bot.Metadata.Name,
+		BotName: bot.GetMetadata().GetName(),
 	})
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
@@ -188,18 +188,18 @@ func TestRegisterBotCertificateGenerationCheck(t *testing.T) {
 
 		// There should always be at least 1 entry as the initial join is
 		// duplicated in the list.
-		require.Len(t, bi.Status.LatestAuthentications, min(i+1, machineidv1.AuthenticationHistoryLimit))
+		require.Len(t, bi.GetStatus().GetLatestAuthentications(), min(i+1, machineidv1.AuthenticationHistoryLimit))
 
 		// Generation starts at 1 for initial certs.
-		latest := bi.Status.LatestAuthentications[len(bi.Status.LatestAuthentications)-1]
-		require.Equal(t, int32(i+1), latest.Generation)
+		latest := bi.GetStatus().GetLatestAuthentications()[len(bi.GetStatus().GetLatestAuthentications())-1]
+		require.Equal(t, int32(i+1), latest.GetGeneration())
 
-		lastExpires := bi.Metadata.Expires.AsTime()
+		lastExpires := bi.GetMetadata().GetExpires().AsTime()
 
 		// Advance the clock a bit.
 		fakeClock.Advance(time.Minute)
 
-		_, certs, err = renewBotCerts(ctx, srv, certs.TLS, bot.Status.UserName, result.PrivateKey)
+		_, certs, err = renewBotCerts(ctx, srv, certs.TLS, bot.GetStatus().GetUserName(), result.PrivateKey)
 		require.NoError(t, err)
 
 		// Parse the Identity
@@ -222,12 +222,12 @@ func TestRegisterBotCertificateGenerationCheck(t *testing.T) {
 		bi, err = srv.Auth().BotInstance.GetBotInstance(ctx, initialIdent.BotName, initialIdent.BotInstanceID)
 		require.NoError(t, err)
 
-		require.Len(t, bi.Status.LatestAuthentications, min(i+2, machineidv1.AuthenticationHistoryLimit))
+		require.Len(t, bi.GetStatus().GetLatestAuthentications(), min(i+2, machineidv1.AuthenticationHistoryLimit))
 
-		latest = bi.Status.LatestAuthentications[len(bi.Status.LatestAuthentications)-1]
-		require.Equal(t, int32(i+2), latest.Generation)
+		latest = bi.GetStatus().GetLatestAuthentications()[len(bi.GetStatus().GetLatestAuthentications())-1]
+		require.Equal(t, int32(i+2), latest.GetGeneration())
 
-		require.True(t, bi.Metadata.Expires.AsTime().After(lastExpires), "Metadata.Expires must be extended")
+		require.True(t, bi.GetMetadata().GetExpires().AsTime().After(lastExpires), "Metadata.Expires must be extended")
 	}
 }
 
@@ -250,18 +250,18 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	// Create a new bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	k8s, err := fakeissuer.NewKubernetesSigner(srv.Clock())
@@ -282,7 +282,7 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 		types.ProvisionTokenSpecV2{
 			Roles:      types.SystemRoles{types.RoleBot},
 			JoinMethod: types.JoinMethodKubernetes,
-			BotName:    bot.Metadata.Name,
+			BotName:    bot.GetMetadata().GetName(),
 			Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
 				Type: types.KubernetesJoinTypeStaticJWKS,
 				StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
@@ -317,22 +317,22 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	require.NoError(t, err)
 	ident, err := tlsca.FromSubject(cert.Subject, cert.NotAfter)
 	require.NoError(t, err)
-	wantAttrs := &workloadidentityv1pb.JoinAttrs{
-		Meta: &workloadidentityv1pb.JoinAttrsMeta{
+	wantAttrs := workloadidentityv1pb.JoinAttrs_builder{
+		Meta: workloadidentityv1pb.JoinAttrsMeta_builder{
 			JoinTokenName: tok.GetName(),
 			JoinMethod:    string(types.JoinMethodKubernetes),
-		},
-		Kubernetes: &workloadidentityv1pb.JoinAttrsKubernetes{
-			ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+		}.Build(),
+		Kubernetes: workloadidentityv1pb.JoinAttrsKubernetes_builder{
+			ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 				Namespace: "my-namespace",
 				Name:      "my-service-account",
-			},
-			Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+			}.Build(),
+			Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 				Name: "my-pod",
-			},
+			}.Build(),
 			Subject: "system:serviceaccount:my-namespace:my-service-account",
-		},
-	}
+		}.Build(),
+	}.Build()
 	require.Empty(t, cmp.Diff(
 		ident.JoinAttributes,
 		wantAttrs,
@@ -354,7 +354,7 @@ func TestBotJoinAttrs_Kubernetes(t *testing.T) {
 	roleCerts, err := botClient.GenerateUserCerts(ctx, proto.UserCertsRequest{
 		SSHPublicKey: ssh.MarshalAuthorizedKey(sshPub),
 		TLSPublicKey: tlsPub,
-		Username:     bot.Status.UserName,
+		Username:     bot.GetStatus().GetUserName(),
 		RoleRequests: []string{
 			role.GetName(),
 		},
@@ -390,23 +390,23 @@ func TestRegisterBotInstance(t *testing.T) {
 	// Create a new bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpec("testxyzzy", time.Time{}, types.ProvisionTokenSpecV2{
 		Roles:   types.SystemRoles{types.RoleBot},
-		BotName: bot.Metadata.Name,
+		BotName: bot.GetMetadata().GetName(),
 	})
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
@@ -433,19 +433,19 @@ func TestRegisterBotInstance(t *testing.T) {
 	botInstance, err := srv.Auth().BotInstance.GetBotInstance(ctx, ident.BotName, ident.BotInstanceID)
 	require.NoError(t, err)
 
-	require.Equal(t, ident.BotName, botInstance.GetSpec().BotName)
-	require.Equal(t, ident.BotInstanceID, botInstance.GetSpec().InstanceId)
+	require.Equal(t, ident.BotName, botInstance.GetSpec().GetBotName())
+	require.Equal(t, ident.BotInstanceID, botInstance.GetSpec().GetInstanceId())
 
 	// The initial authentication record should be sane
-	ia := botInstance.GetStatus().InitialAuthentication
+	ia := botInstance.GetStatus().GetInitialAuthentication()
 	require.NotNil(t, ia)
-	require.Equal(t, int32(1), ia.Generation)
-	require.Equal(t, string(types.JoinMethodToken), ia.JoinMethod)
-	require.Equal(t, token.GetSafeName(), ia.JoinToken)
+	require.Equal(t, int32(1), ia.GetGeneration())
+	require.Equal(t, string(types.JoinMethodToken), ia.GetJoinMethod())
+	require.Equal(t, token.GetSafeName(), ia.GetJoinToken())
 	// The latest authentications field should contain the same record (and
 	// only that record.)
-	require.Len(t, botInstance.GetStatus().LatestAuthentications, 1)
-	require.EqualExportedValues(t, ia, botInstance.GetStatus().LatestAuthentications[0])
+	require.Len(t, botInstance.GetStatus().GetLatestAuthentications(), 1)
+	require.EqualExportedValues(t, ia, botInstance.GetStatus().GetLatestAuthentications()[0])
 
 	// Validate that expected audit events were emitted...
 	auditEvents := mockEmitter.Events()
@@ -537,23 +537,23 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	// Create a new bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpec("testxyzzy", time.Time{}, types.ProvisionTokenSpecV2{
 		Roles:   types.SystemRoles{types.RoleBot},
-		BotName: bot.Metadata.Name,
+		BotName: bot.GetMetadata().GetName(),
 	})
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
@@ -568,7 +568,7 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	require.NoError(t, err)
 
 	// Renew the certs once (e.g. this is the actual bot process)
-	renewedClient, certsReal, err := renewBotCerts(ctx, srv, result.Certs.TLS, bot.Status.UserName, result.PrivateKey)
+	renewedClient, certsReal, err := renewBotCerts(ctx, srv, result.Certs.TLS, bot.GetStatus().GetUserName(), result.PrivateKey)
 	require.NoError(t, err)
 
 	// This client should be able to ping.
@@ -583,7 +583,7 @@ func TestRegisterBotCertificateGenerationStolen(t *testing.T) {
 	require.Equal(t, uint64(2), impersonatedIdent.Generation)
 
 	// Meanwhile, the initial set of certs was stolen. Let's try to renew those.
-	_, _, err = renewBotCerts(ctx, srv, result.Certs.TLS, bot.Status.UserName, result.PrivateKey)
+	_, _, err = renewBotCerts(ctx, srv, result.Certs.TLS, bot.GetStatus().GetUserName(), result.PrivateKey)
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 
@@ -613,23 +613,23 @@ func TestRegisterBotCertificateExtensions(t *testing.T) {
 	// Create a new bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpec("testxyzzy", time.Time{}, types.ProvisionTokenSpecV2{
 		Roles:   types.SystemRoles{types.RoleBot},
-		BotName: bot.Metadata.Name,
+		BotName: bot.GetMetadata().GetName(),
 	})
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, token))
@@ -644,7 +644,7 @@ func TestRegisterBotCertificateExtensions(t *testing.T) {
 	require.NoError(t, err)
 	checkCertLoginIP(t, result.Certs.TLS, "127.0.0.1")
 
-	_, certs, err := renewBotCerts(ctx, srv, result.Certs.TLS, bot.Status.UserName, result.PrivateKey)
+	_, certs, err := renewBotCerts(ctx, srv, result.Certs.TLS, bot.GetStatus().GetUserName(), result.PrivateKey)
 	require.NoError(t, err)
 
 	// Parse the Identity
@@ -677,16 +677,16 @@ func TestRegisterBot_RemoteAddr(t *testing.T) {
 	require.NoError(t, err)
 
 	botName := "botty"
-	_, err = machineidv1.UpsertBot(ctx, a, &machineidv1pb.Bot{
+	_, err = machineidv1.UpsertBot(ctx, a, machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: botName,
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: []string{roleName},
-		},
-	}, a.GetClock().Now(), "", scopes.Features{})
+		}.Build(),
+	}.Build(), a.GetClock().Now(), "", scopes.Features{})
 	require.NoError(t, err)
 
 	remoteAddr := "42.42.42.42:42"
@@ -935,16 +935,16 @@ func TestRegisterBot_BotInstanceRejoin(t *testing.T) {
 	require.NoError(t, err)
 
 	botName := "bot"
-	_, err = machineidv1.UpsertBot(ctx, a, &machineidv1pb.Bot{
+	_, err = machineidv1.UpsertBot(ctx, a, machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: botName,
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: []string{roleName},
-		},
-	}, a.GetClock().Now(), "", scopes.Features{})
+		}.Build(),
+	}.Build(), a.GetClock().Now(), "", scopes.Features{})
 	require.NoError(t, err)
 
 	// Create k8s and IAM join tokens
@@ -1091,16 +1091,16 @@ func TestRegisterBotWithInvalidInstanceID(t *testing.T) {
 	_, err = authtest.CreateRole(ctx, a, roleName, types.RoleSpecV6{})
 	require.NoError(t, err)
 
-	_, err = machineidv1.UpsertBot(ctx, a, &machineidv1pb.Bot{
+	_, err = machineidv1.UpsertBot(ctx, a, machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: botName,
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: []string{roleName},
-		},
-	}, a.GetClock().Now(), "", scopes.Features{})
+		}.Build(),
+	}.Build(), a.GetClock().Now(), "", scopes.Features{})
 	require.NoError(t, err)
 
 	client, err := srv.NewClient(authtest.TestAdmin())
@@ -1169,30 +1169,30 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 	// Initial setup, create a bot and join token.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenA, err := types.NewProvisionTokenFromSpec("a", time.Time{}, types.ProvisionTokenSpecV2{
 		Roles:   types.SystemRoles{types.RoleBot},
-		BotName: bot.Metadata.Name,
+		BotName: bot.GetMetadata().GetName(),
 	})
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, tokenA))
 
 	tokenB, err := types.NewProvisionTokenFromSpec("b", time.Time{}, types.ProvisionTokenSpecV2{
 		Roles:   types.SystemRoles{types.RoleBot},
-		BotName: bot.Metadata.Name,
+		BotName: bot.GetMetadata().GetName(),
 	})
 	require.NoError(t, err)
 	require.NoError(t, client.CreateToken(ctx, tokenB))
@@ -1226,7 +1226,7 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 	require.NotEqual(t, initialInstanceA, initialInstanceB)
 
 	for i := range 6 {
-		_, certsA, err = renewBotCerts(ctx, srv, certsA.TLS, bot.Status.UserName, resultA.PrivateKey)
+		_, certsA, err = renewBotCerts(ctx, srv, certsA.TLS, bot.GetStatus().GetUserName(), resultA.PrivateKey)
 		require.NoError(t, err)
 
 		instanceA, generationA := instanceIDFromCerts(t, certsA)
@@ -1235,7 +1235,7 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 
 		// Only renew bot B 3x.
 		if i < 3 {
-			_, certsB, err = renewBotCerts(ctx, srv, certsB.TLS, bot.Status.UserName, resultB.PrivateKey)
+			_, certsB, err = renewBotCerts(ctx, srv, certsB.TLS, bot.GetStatus().GetUserName(), resultB.PrivateKey)
 			require.NoError(t, err)
 
 			instanceB, generationB := instanceIDFromCerts(t, certsB)
@@ -1247,14 +1247,14 @@ func TestRegisterBotMultipleTokens(t *testing.T) {
 	// Renew B again. This will be the final renewal, but the legacy generation
 	// counter on the user will be greater as it should have been incremented by
 	// bot A.
-	_, certsB, err = renewBotCerts(ctx, srv, certsB.TLS, bot.Status.UserName, resultB.PrivateKey)
+	_, certsB, err = renewBotCerts(ctx, srv, certsB.TLS, bot.GetStatus().GetUserName(), resultB.PrivateKey)
 	require.NoError(t, err)
 
 	instanceB, generationB := instanceIDFromCerts(t, certsB)
 	require.Equal(t, initialInstanceB, instanceB)
 	require.Equal(t, uint64(5), generationB)
 
-	botUser, err := client.GetUser(ctx, bot.Status.UserName, false)
+	botUser, err := client.GetUser(ctx, bot.GetStatus().GetUserName(), false)
 	require.NoError(t, err)
 	genStr := botUser.BotGenerationLabel()
 	require.Equal(t, "7", genStr)
@@ -1266,62 +1266,62 @@ func createScopedBot(t *testing.T, srv *authtest.TLSServer, adminClient *authcli
 
 	// Create a scoped role for the bot.
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err := scopedSvc.CreateScopedRole(t.Context(), &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err := scopedSvc.CreateScopedRole(t.Context(), scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-example",
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/test"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create the scoped bot.
-	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
 			Scope:   "/test",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-scoped",
-			},
+			}.Build(),
 			Spec: &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create a scoped role assignment for the bot.
-	resp, err := srv.Auth().ScopedAccess().CreateScopedRoleAssignment(t.Context(), &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	resp, err := srv.Auth().ScopedAccess().CreateScopedRoleAssignment(t.Context(), scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/test",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "test-scoped",
 				BotScope: "/test",
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "scoped-example", Scope: "/test"},
+					scopedaccessv1.Assignment_builder{Role: "scoped-example", Scope: "/test"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    resp.GetAssignment().GetMetadata().GetName(),
 			SubKind: resp.GetAssignment().GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 	}, time.Second*10, 100*time.Millisecond)
 }
@@ -1351,32 +1351,32 @@ func TestRegisterBotWithScopedKubernetesToken(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	scopedToken := &joiningv1.ScopedToken{
+	scopedToken := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
 		Scope:   "/test",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "example-token",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			JoinMethod: string(types.JoinMethodKubernetes),
 			Roles:      []string{string(types.RoleBot)},
 			UsageMode:  joining.TokenUsageModeBot,
 			BotName:    "test-scoped",
 			BotScope:   "/test",
-			Kubernetes: &joiningv1.Kubernetes{
+			Kubernetes: joiningv1.Kubernetes_builder{
 				Type: string(types.KubernetesJoinTypeStaticJWKS),
-				StaticJwks: &joiningv1.Kubernetes_StaticJWKSConfig{
+				StaticJwks: joiningv1.Kubernetes_StaticJWKSConfig_builder{
 					Jwks: jwks,
-				},
+				}.Build(),
 				Allow: []*joiningv1.Kubernetes_Rule{
-					{
+					joiningv1.Kubernetes_Rule_builder{
 						ServiceAccount: "my-namespace:my-service-account",
-					},
+					}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	_, err = client.CreateScopedToken(ctx, scopedToken)
 	require.NoError(t, err)
diff --git a/lib/auth/clusterconfig/clusterconfigv1/service.go b/lib/auth/clusterconfig/clusterconfigv1/service.go
index 97c7c4b549b..bb14e71f612 100644
--- a/lib/auth/clusterconfig/clusterconfigv1/service.go
+++ b/lib/auth/clusterconfig/clusterconfigv1/service.go
@@ -214,26 +214,26 @@ func (s *Service) UpdateAuthPreference(ctx context.Context, req *clusterconfigpb
 	}
 
 	// check that the given RequireMFAType is supported in this build.
-	if req.AuthPreference.GetPrivateKeyPolicy().IsHardwareKeyPolicy() && s.modules.BuildType() != modules.BuildEnterprise {
+	if req.GetAuthPreference().GetPrivateKeyPolicy().IsHardwareKeyPolicy() && s.modules.BuildType() != modules.BuildEnterprise {
 		return nil, trace.AccessDenied("Hardware Key support is only available with an enterprise license")
 	}
 
-	if err := dtconfig.ValidateConfigAgainstModules(req.AuthPreference.GetDeviceTrust(), s.modules); err != nil {
+	if err := dtconfig.ValidateConfigAgainstModules(req.GetAuthPreference().GetDeviceTrust(), s.modules); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := req.AuthPreference.CheckSignatureAlgorithmSuite(s.signatureAlgorithmSuiteParams); err != nil {
+	if err := req.GetAuthPreference().CheckSignatureAlgorithmSuite(s.signatureAlgorithmSuiteParams); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	req.AuthPreference.SetOrigin(types.OriginDynamic)
+	req.GetAuthPreference().SetOrigin(types.OriginDynamic)
 
 	original, err := s.cache.GetAuthPreference(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	updated, err := s.backend.UpdateAuthPreference(ctx, req.AuthPreference)
+	updated, err := s.backend.UpdateAuthPreference(ctx, req.GetAuthPreference())
 
 	if auditErr := s.emitter.EmitAuditEvent(ctx, &apievents.AuthPreferenceUpdate{
 		Metadata: apievents.Metadata{
@@ -243,7 +243,7 @@ func (s *Service) UpdateAuthPreference(ctx context.Context, req *clusterconfigpb
 		UserMetadata:       authzCtx.GetUserMetadata(),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		Status:             eventStatus(err),
-		AdminActionsMFA:    GetAdminActionsMFAStatus(original, req.AuthPreference),
+		AdminActionsMFA:    GetAdminActionsMFAStatus(original, req.GetAuthPreference()),
 	}); auditErr != nil {
 		slog.WarnContext(ctx, "Failed to emit auth preference update event.", "error", auditErr)
 	}
@@ -282,26 +282,26 @@ func (s *Service) UpsertAuthPreference(ctx context.Context, req *clusterconfigpb
 	}
 
 	// check that the given RequireMFAType is supported in this build.
-	if req.AuthPreference.GetPrivateKeyPolicy().IsHardwareKeyPolicy() && s.modules.BuildType() != modules.BuildEnterprise {
+	if req.GetAuthPreference().GetPrivateKeyPolicy().IsHardwareKeyPolicy() && s.modules.BuildType() != modules.BuildEnterprise {
 		return nil, trace.AccessDenied("Hardware Key support is only available with an enterprise license")
 	}
 
-	if err := dtconfig.ValidateConfigAgainstModules(req.AuthPreference.GetDeviceTrust(), s.modules); err != nil {
+	if err := dtconfig.ValidateConfigAgainstModules(req.GetAuthPreference().GetDeviceTrust(), s.modules); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := req.AuthPreference.CheckSignatureAlgorithmSuite(s.signatureAlgorithmSuiteParams); err != nil {
+	if err := req.GetAuthPreference().CheckSignatureAlgorithmSuite(s.signatureAlgorithmSuiteParams); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	req.AuthPreference.SetOrigin(types.OriginDynamic)
+	req.GetAuthPreference().SetOrigin(types.OriginDynamic)
 
 	original, err := s.cache.GetAuthPreference(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	updated, err := s.backend.UpsertAuthPreference(ctx, req.AuthPreference)
+	updated, err := s.backend.UpsertAuthPreference(ctx, req.GetAuthPreference())
 
 	if auditErr := s.emitter.EmitAuditEvent(ctx, &apievents.AuthPreferenceUpdate{
 		Metadata: apievents.Metadata{
@@ -311,7 +311,7 @@ func (s *Service) UpsertAuthPreference(ctx context.Context, req *clusterconfigpb
 		UserMetadata:       authzCtx.GetUserMetadata(),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		Status:             eventStatus(err),
-		AdminActionsMFA:    GetAdminActionsMFAStatus(original, req.AuthPreference),
+		AdminActionsMFA:    GetAdminActionsMFAStatus(original, req.GetAuthPreference()),
 	}); auditErr != nil {
 		slog.WarnContext(ctx, "Failed to emit auth preference update event.", "error", auditErr)
 	}
@@ -485,7 +485,7 @@ func (s *Service) UpdateClusterNetworkingConfig(ctx context.Context, req *cluste
 		return nil, trace.Wrap(err)
 	}
 
-	tst, err := req.ClusterNetworkConfig.GetTunnelStrategyType()
+	tst, err := req.GetClusterNetworkConfig().GetTunnelStrategyType()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -493,7 +493,7 @@ func (s *Service) UpdateClusterNetworkingConfig(ctx context.Context, req *cluste
 		return nil, trace.AccessDenied("proxy peering is an enterprise-only feature")
 	}
 
-	req.ClusterNetworkConfig.SetOrigin(types.OriginDynamic)
+	req.GetClusterNetworkConfig().SetOrigin(types.OriginDynamic)
 
 	oldCfg, err := s.cache.GetClusterNetworkingConfig(ctx)
 	if err != nil {
@@ -506,7 +506,7 @@ func (s *Service) UpdateClusterNetworkingConfig(ctx context.Context, req *cluste
 		return nil, trace.Wrap(err)
 	}
 
-	updated, err := s.backend.UpdateClusterNetworkingConfig(ctx, req.ClusterNetworkConfig)
+	updated, err := s.backend.UpdateClusterNetworkingConfig(ctx, req.GetClusterNetworkConfig())
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.ClusterNetworkingConfigUpdate{
 		Metadata: apievents.Metadata{
@@ -550,7 +550,7 @@ func (s *Service) UpsertClusterNetworkingConfig(ctx context.Context, req *cluste
 		return nil, trace.Wrap(err)
 	}
 
-	tst, err := req.ClusterNetworkConfig.GetTunnelStrategyType()
+	tst, err := req.GetClusterNetworkConfig().GetTunnelStrategyType()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -558,7 +558,7 @@ func (s *Service) UpsertClusterNetworkingConfig(ctx context.Context, req *cluste
 		return nil, trace.AccessDenied("proxy peering is an enterprise-only feature")
 	}
 
-	req.ClusterNetworkConfig.SetOrigin(types.OriginDynamic)
+	req.GetClusterNetworkConfig().SetOrigin(types.OriginDynamic)
 
 	oldCfg, err := s.cache.GetClusterNetworkingConfig(ctx)
 	if err != nil {
@@ -787,13 +787,13 @@ func (s *Service) UpdateSessionRecordingConfig(ctx context.Context, req *cluster
 		return nil, trace.Wrap(err)
 	}
 
-	req.SessionRecordingConfig.SetOrigin(types.OriginDynamic)
+	req.GetSessionRecordingConfig().SetOrigin(types.OriginDynamic)
 
-	if err := services.ValidateSessionRecordingConfig(req.SessionRecordingConfig, s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
+	if err := services.ValidateSessionRecordingConfig(req.GetSessionRecordingConfig(), s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	updated, err := s.backend.UpdateSessionRecordingConfig(ctx, req.SessionRecordingConfig)
+	updated, err := s.backend.UpdateSessionRecordingConfig(ctx, req.GetSessionRecordingConfig())
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.SessionRecordingConfigUpdate{
 		Metadata: apievents.Metadata{
@@ -837,13 +837,13 @@ func (s *Service) UpsertSessionRecordingConfig(ctx context.Context, req *cluster
 		return nil, trace.Wrap(err)
 	}
 
-	req.SessionRecordingConfig.SetOrigin(types.OriginDynamic)
+	req.GetSessionRecordingConfig().SetOrigin(types.OriginDynamic)
 
-	if err := services.ValidateSessionRecordingConfig(req.SessionRecordingConfig, s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
+	if err := services.ValidateSessionRecordingConfig(req.GetSessionRecordingConfig(), s.signatureAlgorithmSuiteParams.FIPS, s.signatureAlgorithmSuiteParams.Cloud); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	upserted, err := s.backend.UpsertSessionRecordingConfig(ctx, req.SessionRecordingConfig)
+	upserted, err := s.backend.UpsertSessionRecordingConfig(ctx, req.GetSessionRecordingConfig())
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.SessionRecordingConfigUpdate{
 		Metadata: apievents.Metadata{
@@ -945,11 +945,11 @@ func (s *Service) GetClusterAccessGraphConfig(ctx context.Context, _ *clustercon
 
 	// If the policy feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
 	if !s.modules.Features().GetEntitlement(entitlements.Policy).Enabled && !s.modules.Features().AccessGraph && !s.modules.Features().Cloud {
-		return &clusterconfigpb.GetClusterAccessGraphConfigResponse{
-			AccessGraph: &clusterconfigpb.AccessGraphConfig{
+		return clusterconfigpb.GetClusterAccessGraphConfigResponse_builder{
+			AccessGraph: clusterconfigpb.AccessGraphConfig_builder{
 				Enabled: false,
-			},
-		}, nil
+			}.Build(),
+		}.Build(), nil
 	}
 
 	var sshScanEnabled bool
@@ -960,17 +960,17 @@ func (s *Service) GetClusterAccessGraphConfig(ctx context.Context, _ *clustercon
 		sshScanEnabled = obj.SecretsScanConfig() == clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED
 	}
 
-	return &clusterconfigpb.GetClusterAccessGraphConfigResponse{
-		AccessGraph: &clusterconfigpb.AccessGraphConfig{
+	return clusterconfigpb.GetClusterAccessGraphConfigResponse_builder{
+		AccessGraph: clusterconfigpb.AccessGraphConfig_builder{
 			Enabled:  s.accessGraph.Enabled,
 			Address:  s.accessGraph.Address,
 			Ca:       s.accessGraph.CA,
 			Insecure: s.accessGraph.Insecure,
-			SecretsScanConfig: &clusterconfigpb.AccessGraphSecretsScanConfiguration{
+			SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfiguration_builder{
 				SshScanEnabled: sshScanEnabled,
-			},
-		},
-	}, nil
+			}.Build(),
+		}.Build(),
+	}.Build(), nil
 }
 
 func (s *Service) GetAccessGraphSettings(ctx context.Context, _ *clusterconfigpb.GetAccessGraphSettingsRequest) (*clusterconfigpb.AccessGraphSettings, error) {
@@ -1137,9 +1137,9 @@ func (s *Service) ResetAccessGraphSettings(ctx context.Context, _ *clusterconfig
 		return nil, trace.AccessDenied("access graph is feature isn't enabled")
 	}
 
-	obj, err := clusterconfig.NewAccessGraphSettings(&clusterconfigpb.AccessGraphSettingsSpec{
+	obj, err := clusterconfig.NewAccessGraphSettings(clusterconfigpb.AccessGraphSettingsSpec_builder{
 		SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/clusterconfig/clusterconfigv1/service_test.go b/lib/auth/clusterconfig/clusterconfigv1/service_test.go
index 3e1a092487f..17df57ea708 100644
--- a/lib/auth/clusterconfig/clusterconfigv1/service_test.go
+++ b/lib/auth/clusterconfig/clusterconfigv1/service_test.go
@@ -195,7 +195,7 @@ func TestUpdateAuthPreference(t *testing.T) {
 				test.preference(pref)
 			}
 
-			updated, err := env.UpdateAuthPreference(context.Background(), &clusterconfigpb.UpdateAuthPreferenceRequest{AuthPreference: pref.(*types.AuthPreferenceV2)})
+			updated, err := env.UpdateAuthPreference(context.Background(), clusterconfigpb.UpdateAuthPreferenceRequest_builder{AuthPreference: pref.(*types.AuthPreferenceV2)}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -318,7 +318,7 @@ func TestUpsertAuthPreference(t *testing.T) {
 				test.preference(pref)
 			}
 
-			updated, err := env.UpsertAuthPreference(context.Background(), &clusterconfigpb.UpsertAuthPreferenceRequest{AuthPreference: pref.(*types.AuthPreferenceV2)})
+			updated, err := env.UpsertAuthPreference(context.Background(), clusterconfigpb.UpsertAuthPreferenceRequest_builder{AuthPreference: pref.(*types.AuthPreferenceV2)}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -757,7 +757,7 @@ func TestUpdateClusterNetworkingConfig(t *testing.T) {
 				test.config(cfg)
 			}
 
-			updated, err := env.UpdateClusterNetworkingConfig(context.Background(), &clusterconfigpb.UpdateClusterNetworkingConfigRequest{ClusterNetworkConfig: cfg.(*types.ClusterNetworkingConfigV2)})
+			updated, err := env.UpdateClusterNetworkingConfig(context.Background(), clusterconfigpb.UpdateClusterNetworkingConfigRequest_builder{ClusterNetworkConfig: cfg.(*types.ClusterNetworkingConfigV2)}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -867,7 +867,7 @@ func TestUpsertClusterNetworkingConfig(t *testing.T) {
 				test.config(cfg)
 			}
 
-			updated, err := env.UpsertClusterNetworkingConfig(context.Background(), &clusterconfigpb.UpsertClusterNetworkingConfigRequest{ClusterNetworkConfig: cfg.(*types.ClusterNetworkingConfigV2)})
+			updated, err := env.UpsertClusterNetworkingConfig(context.Background(), clusterconfigpb.UpsertClusterNetworkingConfigRequest_builder{ClusterNetworkConfig: cfg.(*types.ClusterNetworkingConfigV2)}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -1134,7 +1134,7 @@ func TestUpdateSessionRecordingConfig(t *testing.T) {
 				test.config(cfg)
 			}
 
-			updated, err := env.UpdateSessionRecordingConfig(context.Background(), &clusterconfigpb.UpdateSessionRecordingConfigRequest{SessionRecordingConfig: cfg.(*types.SessionRecordingConfigV2)})
+			updated, err := env.UpdateSessionRecordingConfig(context.Background(), clusterconfigpb.UpdateSessionRecordingConfigRequest_builder{SessionRecordingConfig: cfg.(*types.SessionRecordingConfigV2)}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -1223,7 +1223,7 @@ func TestUpsertSessionRecordingConfig(t *testing.T) {
 				test.config(cfg)
 			}
 
-			updated, err := env.UpsertSessionRecordingConfig(context.Background(), &clusterconfigpb.UpsertSessionRecordingConfigRequest{SessionRecordingConfig: cfg.(*types.SessionRecordingConfigV2)})
+			updated, err := env.UpsertSessionRecordingConfig(context.Background(), clusterconfigpb.UpsertSessionRecordingConfigRequest_builder{SessionRecordingConfig: cfg.(*types.SessionRecordingConfigV2)}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -1419,13 +1419,13 @@ func TestAuditEventsEmitted(t *testing.T) {
 
 			p.SetLockingMode(constants.LockingModeStrict)
 
-			p, err = env.UpdateAuthPreference(ctx, &clusterconfigpb.UpdateAuthPreferenceRequest{AuthPreference: p})
+			p, err = env.UpdateAuthPreference(ctx, clusterconfigpb.UpdateAuthPreferenceRequest_builder{AuthPreference: p}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
 			require.Empty(t, cmp.Diff(&mfaUnchangedEvent, evt))
 
-			_, err = env.UpsertAuthPreference(ctx, &clusterconfigpb.UpsertAuthPreferenceRequest{AuthPreference: p})
+			_, err = env.UpsertAuthPreference(ctx, clusterconfigpb.UpsertAuthPreferenceRequest_builder{AuthPreference: p}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
@@ -1436,7 +1436,7 @@ func TestAuditEventsEmitted(t *testing.T) {
 				RPID: "example.com",
 			}
 
-			p, err = env.UpdateAuthPreference(ctx, &clusterconfigpb.UpdateAuthPreferenceRequest{AuthPreference: p})
+			p, err = env.UpdateAuthPreference(ctx, clusterconfigpb.UpdateAuthPreferenceRequest_builder{AuthPreference: p}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
@@ -1447,7 +1447,7 @@ func TestAuditEventsEmitted(t *testing.T) {
 			// from the previous authPref setup
 			p.Spec.AllowCLIAuthViaBrowser = nil
 
-			_, err = env.UpsertAuthPreference(ctx, &clusterconfigpb.UpsertAuthPreferenceRequest{AuthPreference: p})
+			_, err = env.UpsertAuthPreference(ctx, clusterconfigpb.UpsertAuthPreferenceRequest_builder{AuthPreference: p}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
@@ -1477,13 +1477,13 @@ func TestAuditEventsEmitted(t *testing.T) {
 
 			cfg.SetRoutingStrategy(types.RoutingStrategy_MOST_RECENT)
 
-			cfg, err = env.UpdateClusterNetworkingConfig(ctx, &clusterconfigpb.UpdateClusterNetworkingConfigRequest{ClusterNetworkConfig: cfg})
+			cfg, err = env.UpdateClusterNetworkingConfig(ctx, clusterconfigpb.UpdateClusterNetworkingConfigRequest_builder{ClusterNetworkConfig: cfg}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpsertClusterNetworkingConfig(ctx, &clusterconfigpb.UpsertClusterNetworkingConfigRequest{ClusterNetworkConfig: cfg})
+			_, err = env.UpsertClusterNetworkingConfig(ctx, clusterconfigpb.UpsertClusterNetworkingConfigRequest_builder{ClusterNetworkConfig: cfg}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
@@ -1513,13 +1513,13 @@ func TestAuditEventsEmitted(t *testing.T) {
 
 			cfg.SetMode(types.RecordAtProxy)
 
-			cfg, err = env.UpdateSessionRecordingConfig(ctx, &clusterconfigpb.UpdateSessionRecordingConfigRequest{SessionRecordingConfig: cfg})
+			cfg, err = env.UpdateSessionRecordingConfig(ctx, clusterconfigpb.UpdateSessionRecordingConfigRequest_builder{SessionRecordingConfig: cfg}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpsertSessionRecordingConfig(ctx, &clusterconfigpb.UpsertSessionRecordingConfigRequest{SessionRecordingConfig: cfg})
+			_, err = env.UpsertSessionRecordingConfig(ctx, clusterconfigpb.UpsertSessionRecordingConfigRequest_builder{SessionRecordingConfig: cfg}.Build())
 			require.NoError(t, err)
 
 			evt = <-env.emitter.C()
@@ -1573,13 +1573,13 @@ func TestAuditEventsEmitted(t *testing.T) {
 			evt := <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpdateAuthPreference(ctx, &clusterconfigpb.UpdateAuthPreferenceRequest{AuthPreference: types.DefaultAuthPreference().(*types.AuthPreferenceV2)})
+			_, err = env.UpdateAuthPreference(ctx, clusterconfigpb.UpdateAuthPreferenceRequest_builder{AuthPreference: types.DefaultAuthPreference().(*types.AuthPreferenceV2)}.Build())
 			require.Error(t, err)
 
 			evt = <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpsertAuthPreference(ctx, &clusterconfigpb.UpsertAuthPreferenceRequest{AuthPreference: types.DefaultAuthPreference().(*types.AuthPreferenceV2)})
+			_, err = env.UpsertAuthPreference(ctx, clusterconfigpb.UpsertAuthPreferenceRequest_builder{AuthPreference: types.DefaultAuthPreference().(*types.AuthPreferenceV2)}.Build())
 			require.Error(t, err)
 
 			evt = <-env.emitter.C()
@@ -1609,13 +1609,13 @@ func TestAuditEventsEmitted(t *testing.T) {
 			evt := <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpdateClusterNetworkingConfig(ctx, &clusterconfigpb.UpdateClusterNetworkingConfigRequest{ClusterNetworkConfig: types.DefaultClusterNetworkingConfig().(*types.ClusterNetworkingConfigV2)})
+			_, err = env.UpdateClusterNetworkingConfig(ctx, clusterconfigpb.UpdateClusterNetworkingConfigRequest_builder{ClusterNetworkConfig: types.DefaultClusterNetworkingConfig().(*types.ClusterNetworkingConfigV2)}.Build())
 			require.Error(t, err)
 
 			evt = <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpsertClusterNetworkingConfig(ctx, &clusterconfigpb.UpsertClusterNetworkingConfigRequest{ClusterNetworkConfig: types.DefaultClusterNetworkingConfig().(*types.ClusterNetworkingConfigV2)})
+			_, err = env.UpsertClusterNetworkingConfig(ctx, clusterconfigpb.UpsertClusterNetworkingConfigRequest_builder{ClusterNetworkConfig: types.DefaultClusterNetworkingConfig().(*types.ClusterNetworkingConfigV2)}.Build())
 			require.Error(t, err)
 
 			evt = <-env.emitter.C()
@@ -1645,13 +1645,13 @@ func TestAuditEventsEmitted(t *testing.T) {
 			evt := <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpdateSessionRecordingConfig(ctx, &clusterconfigpb.UpdateSessionRecordingConfigRequest{SessionRecordingConfig: types.DefaultSessionRecordingConfig().(*types.SessionRecordingConfigV2)})
+			_, err = env.UpdateSessionRecordingConfig(ctx, clusterconfigpb.UpdateSessionRecordingConfigRequest_builder{SessionRecordingConfig: types.DefaultSessionRecordingConfig().(*types.SessionRecordingConfigV2)}.Build())
 			require.Error(t, err)
 
 			evt = <-env.emitter.C()
 			require.Empty(t, cmp.Diff(expectedEvent, evt))
 
-			_, err = env.UpsertSessionRecordingConfig(ctx, &clusterconfigpb.UpsertSessionRecordingConfigRequest{SessionRecordingConfig: types.DefaultSessionRecordingConfig().(*types.SessionRecordingConfigV2)})
+			_, err = env.UpsertSessionRecordingConfig(ctx, clusterconfigpb.UpsertSessionRecordingConfigRequest_builder{SessionRecordingConfig: types.DefaultSessionRecordingConfig().(*types.SessionRecordingConfigV2)}.Build())
 			require.Error(t, err)
 
 			evt = <-env.emitter.C()
@@ -1870,9 +1870,9 @@ func newTestEnv(opts ...serviceOpt) (*env, error) {
 func TestGetAccessGraphConfig(t *testing.T) {
 
 	settings, err := clusterconfig.NewAccessGraphSettings(
-		&clusterconfigpb.AccessGraphSettingsSpec{
+		clusterconfigpb.AccessGraphSettingsSpec_builder{
 			SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED,
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -1896,11 +1896,11 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			role:              types.RoleProxy,
 			accessGraphConfig: cfgEnabled,
 			errorAssertion:    require.NoError,
-			responseAssertion: &clusterconfigpb.GetClusterAccessGraphConfigResponse{
-				AccessGraph: &clusterconfigpb.AccessGraphConfig{
+			responseAssertion: clusterconfigpb.GetClusterAccessGraphConfigResponse_builder{
+				AccessGraph: clusterconfigpb.AccessGraphConfig_builder{
 					Enabled: false,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "authorized proxy with non empty access graph config; Policy module is enabled",
@@ -1914,15 +1914,15 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			},
 			accessGraphConfig: cfgEnabled,
 			errorAssertion:    require.NoError,
-			responseAssertion: &clusterconfigpb.GetClusterAccessGraphConfigResponse{
-				AccessGraph: &clusterconfigpb.AccessGraphConfig{
+			responseAssertion: clusterconfigpb.GetClusterAccessGraphConfigResponse_builder{
+				AccessGraph: clusterconfigpb.AccessGraphConfig_builder{
 					Enabled:           true,
 					Insecure:          true,
 					Address:           "address",
 					Ca:                []byte("ca"),
 					SecretsScanConfig: &clusterconfigpb.AccessGraphSecretsScanConfiguration{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "authorized discovery with non empty access graph config; Policy module is enabled",
@@ -1936,15 +1936,15 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			},
 			accessGraphConfig: cfgEnabled,
 			errorAssertion:    require.NoError,
-			responseAssertion: &clusterconfigpb.GetClusterAccessGraphConfigResponse{
-				AccessGraph: &clusterconfigpb.AccessGraphConfig{
+			responseAssertion: clusterconfigpb.GetClusterAccessGraphConfigResponse_builder{
+				AccessGraph: clusterconfigpb.AccessGraphConfig_builder{
 					Enabled:           true,
 					Insecure:          true,
 					Address:           "address",
 					Ca:                []byte("ca"),
 					SecretsScanConfig: &clusterconfigpb.AccessGraphSecretsScanConfiguration{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "Policy module is enabled with secrets scan option",
@@ -1959,17 +1959,17 @@ func TestGetAccessGraphConfig(t *testing.T) {
 			accessGraphConfig:   cfgEnabled,
 			accessGraphSettings: settings,
 			errorAssertion:      require.NoError,
-			responseAssertion: &clusterconfigpb.GetClusterAccessGraphConfigResponse{
-				AccessGraph: &clusterconfigpb.AccessGraphConfig{
+			responseAssertion: clusterconfigpb.GetClusterAccessGraphConfigResponse_builder{
+				AccessGraph: clusterconfigpb.AccessGraphConfig_builder{
 					Enabled:  true,
 					Insecure: true,
 					Address:  "address",
 					Ca:       []byte("ca"),
-					SecretsScanConfig: &clusterconfigpb.AccessGraphSecretsScanConfiguration{
+					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfiguration_builder{
 						SshScanEnabled: true,
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 	}
 
@@ -2034,9 +2034,9 @@ func TestGetAccessGraphSettings(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			settings, err := clusterconfig.NewAccessGraphSettings(
-				&clusterconfigpb.AccessGraphSettingsSpec{
+				clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-				},
+				}.Build(),
 			)
 			require.NoError(t, err)
 			env, err := newTestEnv(withAuthorizer(test.authorizer), withAccessGraphSettings(settings))
@@ -2099,7 +2099,7 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
 				}, nil
 			}),
 			mutator: func(p *clusterconfigpb.AccessGraphSettings) {
-				p.Spec.SecretsScanConfig = clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED
+				p.GetSpec().SetSecretsScanConfig(clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED)
 			},
 			assertion: func(t *testing.T, updated *clusterconfigpb.AccessGraphSettings, err error) {
 				require.Error(t, err)
@@ -2127,7 +2127,7 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
 				}, nil
 			}),
 			mutator: func(p *clusterconfigpb.AccessGraphSettings) {
-				p.Spec.SecretsScanConfig = clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED
+				p.GetSpec().SetSecretsScanConfig(clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED)
 			},
 			assertion: func(t *testing.T, updated *clusterconfigpb.AccessGraphSettings, err error) {
 				require.NoError(t, err)
@@ -2139,9 +2139,9 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			settings, err := clusterconfig.NewAccessGraphSettings(
-				&clusterconfigpb.AccessGraphSettingsSpec{
+				clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED,
-				},
+				}.Build(),
 			)
 			require.NoError(t, err)
 			env, err := newTestEnv(
@@ -2157,7 +2157,7 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
 				test.mutator(pref)
 			}
 
-			updated, err := env.UpdateAccessGraphSettings(context.Background(), &clusterconfigpb.UpdateAccessGraphSettingsRequest{AccessGraphSettings: pref})
+			updated, err := env.UpdateAccessGraphSettings(context.Background(), clusterconfigpb.UpdateAccessGraphSettingsRequest_builder{AccessGraphSettings: pref}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -2250,11 +2250,11 @@ func TestUpsertAccessGraphSettings(t *testing.T) {
 				}, nil
 			}),
 			mutator: func(p *clusterconfigpb.AccessGraphSettings) {
-				p.Spec.SecretsScanConfig = clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED
+				p.GetSpec().SetSecretsScanConfig(clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED)
 			},
 			assertion: func(t *testing.T, updated *clusterconfigpb.AccessGraphSettings, err error) {
 				require.NoError(t, err)
-				require.Equal(t, clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED, updated.Spec.SecretsScanConfig)
+				require.Equal(t, clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED, updated.GetSpec().GetSecretsScanConfig())
 			},
 		},
 	}
@@ -2262,9 +2262,9 @@ func TestUpsertAccessGraphSettings(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			settings, err := clusterconfig.NewAccessGraphSettings(
-				&clusterconfigpb.AccessGraphSettingsSpec{
+				clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-				})
+				}.Build())
 
 			require.NoError(t, err)
 
@@ -2281,7 +2281,7 @@ func TestUpsertAccessGraphSettings(t *testing.T) {
 				test.mutator(pref)
 			}
 
-			updated, err := env.UpsertAccessGraphSettings(context.Background(), &clusterconfigpb.UpsertAccessGraphSettingsRequest{AccessGraphSettings: pref})
+			updated, err := env.UpsertAccessGraphSettings(context.Background(), clusterconfigpb.UpsertAccessGraphSettingsRequest_builder{AccessGraphSettings: pref}.Build())
 			test.assertion(t, updated, err)
 		})
 	}
@@ -2351,9 +2351,9 @@ func TestResetAccessGraphSettings(t *testing.T) {
 	for _, test := range cases {
 		t.Run(test.name, func(t *testing.T) {
 			settings, err := clusterconfig.NewAccessGraphSettings(
-				&clusterconfigpb.AccessGraphSettingsSpec{
+				clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-				})
+				}.Build())
 
 			require.NoError(t, err)
 
diff --git a/lib/auth/crownjewel/crownjewelv1/service.go b/lib/auth/crownjewel/crownjewelv1/service.go
index 109fad79708..c3c462f4f40 100644
--- a/lib/auth/crownjewel/crownjewelv1/service.go
+++ b/lib/auth/crownjewel/crownjewelv1/service.go
@@ -115,11 +115,11 @@ func (s *Service) CreateCrownJewel(ctx context.Context, req *crownjewelv1.Create
 		return nil, trace.Wrap(err)
 	}
 
-	if err := crownjewel.ValidateCrownJewel(req.CrownJewel); err != nil {
+	if err := crownjewel.ValidateCrownJewel(req.GetCrownJewel()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	rsp, err := s.backend.CreateCrownJewel(ctx, req.CrownJewel)
+	rsp, err := s.backend.CreateCrownJewel(ctx, req.GetCrownJewel())
 
 	s.emitCreateAuditEvent(ctx, rsp, authCtx, err)
 
@@ -157,15 +157,15 @@ func (s *Service) ListCrownJewels(ctx context.Context, req *crownjewelv1.ListCro
 		return nil, trace.Wrap(err)
 	}
 
-	rsp, nextToken, err := s.reader.ListCrownJewels(ctx, req.PageSize, req.PageToken)
+	rsp, nextToken, err := s.reader.ListCrownJewels(ctx, req.GetPageSize(), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &crownjewelv1.ListCrownJewelsResponse{
+	return crownjewelv1.ListCrownJewelsResponse_builder{
 		CrownJewels:   rsp,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // GetCrownJewel returns crown jewel resource.
@@ -202,7 +202,7 @@ func (s *Service) UpdateCrownJewel(ctx context.Context, req *crownjewelv1.Update
 		return nil, trace.Wrap(err)
 	}
 
-	if err := crownjewel.ValidateCrownJewel(req.CrownJewel); err != nil {
+	if err := crownjewel.ValidateCrownJewel(req.GetCrownJewel()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -211,7 +211,7 @@ func (s *Service) UpdateCrownJewel(ctx context.Context, req *crownjewelv1.Update
 		return nil, trace.Wrap(err)
 	}
 
-	rsp, err := s.backend.UpdateCrownJewel(ctx, req.CrownJewel)
+	rsp, err := s.backend.UpdateCrownJewel(ctx, req.GetCrownJewel())
 
 	s.emitUpdateAuditEvent(ctx, oldCrownJewel, req.GetCrownJewel(), authCtx, err)
 
@@ -254,7 +254,7 @@ func (s *Service) UpsertCrownJewel(ctx context.Context, req *crownjewelv1.Upsert
 		return nil, trace.Wrap(err)
 	}
 
-	if err := crownjewel.ValidateCrownJewel(req.CrownJewel); err != nil {
+	if err := crownjewel.ValidateCrownJewel(req.GetCrownJewel()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -263,7 +263,7 @@ func (s *Service) UpsertCrownJewel(ctx context.Context, req *crownjewelv1.Upsert
 		return nil, trace.Wrap(err)
 	}
 
-	rsp, err := s.backend.UpsertCrownJewel(ctx, req.CrownJewel)
+	rsp, err := s.backend.UpsertCrownJewel(ctx, req.GetCrownJewel())
 
 	s.emitUpsertAuditEvent(ctx, oldCrownJewel, req.GetCrownJewel(), authCtx, err)
 
diff --git a/lib/auth/crownjewel/object.go b/lib/auth/crownjewel/object.go
index 2d7b4f5d553..8a53264a820 100644
--- a/lib/auth/crownjewel/object.go
+++ b/lib/auth/crownjewel/object.go
@@ -29,14 +29,14 @@ import (
 // NewCrownJewel creates a new CrownJewel object.
 // It validates the object before returning it.
 func NewCrownJewel(name string, spec *crownjewelv1.CrownJewelSpec) (*crownjewelv1.CrownJewel, error) {
-	cj := &crownjewelv1.CrownJewel{
+	cj := crownjewelv1.CrownJewel_builder{
 		Kind:    types.KindCrownJewel,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 
 	if err := ValidateCrownJewel(cj); err != nil {
 		return nil, trace.Wrap(err)
@@ -54,18 +54,18 @@ func ValidateCrownJewel(jewel *crownjewelv1.CrownJewel) error {
 	switch {
 	case jewel == nil:
 		return trace.BadParameter("crown jewel is nil")
-	case jewel.Metadata == nil:
+	case !jewel.HasMetadata():
 		return trace.BadParameter("crown jewel metadata is nil")
-	case jewel.Metadata.Name == "":
+	case jewel.GetMetadata().GetName() == "":
 		return trace.BadParameter("crown jewel name is empty")
-	case jewel.Spec == nil:
+	case !jewel.HasSpec():
 		return trace.BadParameter("crown jewel spec is nil")
-	case len(jewel.Spec.TeleportMatchers) == 0 && len(jewel.Spec.AwsMatchers) == 0 && jewel.Spec.Query == "":
+	case len(jewel.GetSpec().GetTeleportMatchers()) == 0 && len(jewel.GetSpec().GetAwsMatchers()) == 0 && jewel.GetSpec().GetQuery() == "":
 		return trace.BadParameter("crown jewel must have at least one matcher")
 	}
 
-	if len(jewel.Spec.TeleportMatchers) > 0 {
-		for _, matcher := range jewel.Spec.TeleportMatchers {
+	if len(jewel.GetSpec().GetTeleportMatchers()) > 0 {
+		for _, matcher := range jewel.GetSpec().GetTeleportMatchers() {
 			if len(matcher.GetKinds()) == 0 {
 				return trace.BadParameter("teleport matcher kinds must be set")
 			}
@@ -74,20 +74,20 @@ func ValidateCrownJewel(jewel *crownjewelv1.CrownJewel) error {
 				return trace.Wrap(err)
 			}
 
-			if len(matcher.Names) == 0 && len(matcher.GetLabels()) == 0 {
+			if len(matcher.GetNames()) == 0 && len(matcher.GetLabels()) == 0 {
 				return trace.BadParameter("teleport matcher names or labels must be set")
 			}
 
 			for _, label := range matcher.GetLabels() {
-				if label.Name == "" || len(label.Values) == 0 {
+				if label.GetName() == "" || len(label.GetValues()) == 0 {
 					return trace.BadParameter("teleport matcher label name or value is empty")
 				}
 			}
 		}
 	}
 
-	if len(jewel.Spec.AwsMatchers) > 0 {
-		for _, matcher := range jewel.Spec.AwsMatchers {
+	if len(jewel.GetSpec().GetAwsMatchers()) > 0 {
+		for _, matcher := range jewel.GetSpec().GetAwsMatchers() {
 			if len(matcher.GetTypes()) == 0 {
 				return trace.BadParameter("aws matcher type must be set")
 			}
@@ -97,7 +97,7 @@ func ValidateCrownJewel(jewel *crownjewelv1.CrownJewel) error {
 			}
 
 			for _, label := range matcher.GetTags() {
-				if label.Key == "" || len(label.Values) == 0 {
+				if label.GetKey() == "" || len(label.GetValues()) == 0 {
 					return trace.BadParameter("aws matcher tag key or value is empty")
 				}
 			}
diff --git a/lib/auth/crownjewel/object_test.go b/lib/auth/crownjewel/object_test.go
index db1c23bbb26..8f8c894d904 100644
--- a/lib/auth/crownjewel/object_test.go
+++ b/lib/auth/crownjewel/object_test.go
@@ -45,184 +45,184 @@ func TestValidateCrownJewel(t *testing.T) {
 		},
 		{
 			name: "ValidCrownJewel",
-			jewel: &crownjewelv1.CrownJewel{
-				Metadata: &headerv1.Metadata{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &crownjewelv1.CrownJewelSpec{
+				}.Build(),
+				Spec: crownjewelv1.CrownJewelSpec_builder{
 					TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-						{
+						crownjewelv1.TeleportMatcher_builder{
 							Kinds: []string{"db"},
 							Names: []string{"name1"},
 							Labels: []*labelv1.Label{
-								{
+								labelv1.Label_builder{
 									Name:   "label1",
 									Values: []string{"value1"},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 					AwsMatchers: []*crownjewelv1.AWSMatcher{
-						{
+						crownjewelv1.AWSMatcher_builder{
 							Types: []string{"type1"},
 							Arns:  []string{"arn1"},
 							Tags: []*crownjewelv1.AWSTag{
-								{
+								crownjewelv1.AWSTag_builder{
 									Key:    "key1",
 									Values: []*wrapperspb.StringValue{wrapperspb.String("value1")},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: require.NoError,
 		},
 		{
 			name: "ValidCrownJewelWithQuery",
-			jewel: &crownjewelv1.CrownJewel{
-				Metadata: &headerv1.Metadata{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &crownjewelv1.CrownJewelSpec{
+				}.Build(),
+				Spec: crownjewelv1.CrownJewelSpec_builder{
 					Query: "SELECT * FROM nodes",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: require.NoError,
 		},
 		{
 			name: "MissingMatchers",
-			jewel: &crownjewelv1.CrownJewel{
-				Metadata: &headerv1.Metadata{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Spec: &crownjewelv1.CrownJewelSpec{},
-			},
+			}.Build(),
 			wantErr: require.Error,
 		},
 		{
 			name: "MissingMetadata",
-			jewel: &crownjewelv1.CrownJewel{
-				Spec: &crownjewelv1.CrownJewelSpec{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Spec: crownjewelv1.CrownJewelSpec_builder{
 					TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-						{
+						crownjewelv1.TeleportMatcher_builder{
 							Kinds: []string{"kind1"},
 							Names: []string{"name1"},
 							Labels: []*labelv1.Label{
-								{
+								labelv1.Label_builder{
 									Name:   "label1",
 									Values: []string{"value1"},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: require.Error,
 		},
 		{
 			name: "EmptyName",
-			jewel: &crownjewelv1.CrownJewel{
-				Metadata: &headerv1.Metadata{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "",
-				},
-				Spec: &crownjewelv1.CrownJewelSpec{
+				}.Build(),
+				Spec: crownjewelv1.CrownJewelSpec_builder{
 					TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-						{
+						crownjewelv1.TeleportMatcher_builder{
 							Kinds: []string{"kind1"},
 							Names: []string{"name1"},
 							Labels: []*labelv1.Label{
-								{
+								labelv1.Label_builder{
 									Name:   "label1",
 									Values: []string{"value1"},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 					AwsMatchers: []*crownjewelv1.AWSMatcher{
-						{
+						crownjewelv1.AWSMatcher_builder{
 							Types: []string{"type1"},
 							Arns:  []string{"arn1"},
 							Tags: []*crownjewelv1.AWSTag{
-								{
+								crownjewelv1.AWSTag_builder{
 									Key:    "key1",
 									Values: []*wrapperspb.StringValue{wrapperspb.String("value1")},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: require.Error,
 		},
 		{
 			name: "EmptyTeleportMatcherKinds",
-			jewel: &crownjewelv1.CrownJewel{
-				Metadata: &headerv1.Metadata{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &crownjewelv1.CrownJewelSpec{
+				}.Build(),
+				Spec: crownjewelv1.CrownJewelSpec_builder{
 					TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-						{
+						crownjewelv1.TeleportMatcher_builder{
 							Kinds: []string{},
 							Names: []string{"name1"},
 							Labels: []*labelv1.Label{
-								{
+								labelv1.Label_builder{
 									Name:   "label1",
 									Values: []string{"value1"},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 					AwsMatchers: []*crownjewelv1.AWSMatcher{
-						{
+						crownjewelv1.AWSMatcher_builder{
 							Types: []string{"type1"},
 							Arns:  []string{"arn1"},
 							Tags: []*crownjewelv1.AWSTag{
-								{
+								crownjewelv1.AWSTag_builder{
 									Key:    "key1",
 									Values: []*wrapperspb.StringValue{wrapperspb.String("value1")},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: require.Error,
 		},
 		{
 			name: "EmptyAWSMatcherKinds",
-			jewel: &crownjewelv1.CrownJewel{
-				Metadata: &headerv1.Metadata{
+			jewel: crownjewelv1.CrownJewel_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &crownjewelv1.CrownJewelSpec{
+				}.Build(),
+				Spec: crownjewelv1.CrownJewelSpec_builder{
 					TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-						{
+						crownjewelv1.TeleportMatcher_builder{
 							Kinds: []string{"type2"},
 							Names: []string{"name1"},
 							Labels: []*labelv1.Label{
-								{
+								labelv1.Label_builder{
 									Name:   "label1",
 									Values: []string{"value1"},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 					AwsMatchers: []*crownjewelv1.AWSMatcher{
-						{
+						crownjewelv1.AWSMatcher_builder{
 							Types: []string{},
 							Arns:  []string{"arn1"},
 							Tags: []*crownjewelv1.AWSTag{
-								{
+								crownjewelv1.AWSTag_builder{
 									Key:    "key1",
 									Values: []*wrapperspb.StringValue{wrapperspb.String("value1")},
-								},
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: require.Error,
 		},
 	}
diff --git a/lib/auth/db_test.go b/lib/auth/db_test.go
index 75e1bd1565a..bda00fa0990 100644
--- a/lib/auth/db_test.go
+++ b/lib/auth/db_test.go
@@ -202,32 +202,32 @@ func TestDBCertSigning(t *testing.T) {
 		oldCert, err := tlsutils.ParseCertificatePEM(oldCertPEM)
 		require.NoError(t, err)
 
-		dbClientCAOverride = &subcav1.CertAuthorityOverride{
+		dbClientCAOverride = subcav1.CertAuthorityOverride_builder{
 			Kind:    types.KindCertAuthorityOverride,
 			SubKind: string(types.DatabaseClientCA),
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: clusterName,
-			},
-			Spec: &subcav1.CertAuthorityOverrideSpec{
+			}.Build(),
+			Spec: subcav1.CertAuthorityOverrideSpec_builder{
 				CertificateOverrides: []*subcav1.CertificateOverride{
 					subCAEnv.NewDisabledCertificateOverride(t, parsedActiveDBClientCert, nil),
 					subCAEnv.NewDisabledCertificateOverride(t, parsedNewDBClientCert, nil),
 					subCAEnv.NewDisabledCertificateOverride(t, oldCert, nil),
 				},
-			},
-		}
+			}.Build(),
+		}.Build()
 		// Include external root in the first override's chain.
-		dbClientCAOverride.Spec.CertificateOverrides[0].Chain = []string{string(externalRoot.CertPEM)}
+		dbClientCAOverride.GetSpec().GetCertificateOverrides()[0].SetChain([]string{string(externalRoot.CertPEM)})
 		// Active the old override.
-		dbClientCAOverride.Spec.CertificateOverrides[2].Disabled = false
+		dbClientCAOverride.GetSpec().GetCertificateOverrides()[2].SetDisabled(false)
 	}
 
 	// Map self-signed certificates to their overrides.
 	// Certificates absent from the map don't need to change.
 	caOverrideCertificateMap := map[string]*subcav1.CertificateOverride{
-		string(activeDBClientCACert): dbClientCAOverride.Spec.CertificateOverrides[0],
-		string(newDBClientCACert):    dbClientCAOverride.Spec.CertificateOverrides[1],
+		string(activeDBClientCACert): dbClientCAOverride.GetSpec().GetCertificateOverrides()[0],
+		string(newDBClientCACert):    dbClientCAOverride.GetSpec().GetCertificateOverrides()[1],
 	}
 	getOverrideAwareCertificates := func(
 		selfSignedCert []byte,
@@ -239,21 +239,21 @@ func TestDBCertSigning(t *testing.T) {
 		}
 
 		if includeChain {
-			chain = make([][]byte, 0, len(co.Chain)+1)
-			chain = append(chain, []byte(co.Certificate))
-			for _, pem := range co.Chain {
+			chain = make([][]byte, 0, len(co.GetChain())+1)
+			chain = append(chain, []byte(co.GetCertificate()))
+			for _, pem := range co.GetChain() {
 				chain = append(chain, []byte(pem))
 			}
 		}
 
-		return []byte(co.Certificate), co.PublicKey, chain
+		return []byte(co.GetCertificate()), co.GetPublicKey(), chain
 	}
 
 	mustDeleteCAOverrides := func(t *testing.T) {
 		t.Helper()
 		err := authServer.DeleteCertAuthorityOverride(t.Context(), types.CertAuthorityOverrideID{
-			ClusterName: dbClientCAOverride.Metadata.Name,
-			CAType:      dbClientCAOverride.SubKind,
+			ClusterName: dbClientCAOverride.GetMetadata().GetName(),
+			CAType:      dbClientCAOverride.GetSubKind(),
 		})
 		require.NoError(t, err, "DeleteCertAuthorityOverride errored")
 	}
@@ -360,8 +360,8 @@ func TestDBCertSigning(t *testing.T) {
 			t.Run("active_ca_overrides", func(t *testing.T) {
 				// Take a copy, then enable all overrides.
 				caOverride := proto.Clone(dbClientCAOverride).(*subcav1.CertAuthorityOverride)
-				for _, co := range caOverride.Spec.CertificateOverrides {
-					co.Disabled = false
+				for _, co := range caOverride.GetSpec().GetCertificateOverrides() {
+					co.SetDisabled(false)
 				}
 				_, err := authServer.CreateCertAuthorityOverride(t.Context(), caOverride)
 				require.NoError(t, err, "CreateCertAuthorityOverride errored")
diff --git a/lib/auth/dbobject/dbobjectv1/service.go b/lib/auth/dbobject/dbobjectv1/service.go
index 43ecd7a6a8d..c657f5c3553 100644
--- a/lib/auth/dbobject/dbobjectv1/service.go
+++ b/lib/auth/dbobject/dbobjectv1/service.go
@@ -103,11 +103,11 @@ func (rs *DatabaseObjectService) GetDatabaseObject(ctx context.Context, req *pb.
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	out, err := rs.backend.GetDatabaseObject(ctx, req.Name)
+	out, err := rs.backend.GetDatabaseObject(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -123,14 +123,14 @@ func (rs *DatabaseObjectService) ListDatabaseObjects(
 		return nil, trace.Wrap(err)
 	}
 
-	out, next, err := rs.backend.ListDatabaseObjects(ctx, int(req.PageSize), req.PageToken)
+	out, next, err := rs.backend.ListDatabaseObjects(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &pb.ListDatabaseObjectsResponse{
+	return pb.ListDatabaseObjectsResponse_builder{
 		Objects:       out,
 		NextPageToken: next,
-	}, nil
+	}.Build(), nil
 }
 
 // CreateDatabaseObject creates a new DatabaseObject. It will return an error if the DatabaseObject already
@@ -143,12 +143,12 @@ func (rs *DatabaseObjectService) CreateDatabaseObject(
 		return nil, trace.Wrap(err)
 	}
 
-	err = databaseobject.ValidateDatabaseObject(req.Object)
+	err = databaseobject.ValidateDatabaseObject(req.GetObject())
 	if err != nil {
 		return nil, trace.Wrap(err, "validating object")
 	}
 
-	out, err := rs.backend.CreateDatabaseObject(ctx, req.Object)
+	out, err := rs.backend.CreateDatabaseObject(ctx, req.GetObject())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -180,12 +180,12 @@ func (rs *DatabaseObjectService) UpdateDatabaseObject(
 		return nil, trace.Wrap(err)
 	}
 
-	err = databaseobject.ValidateDatabaseObject(req.Object)
+	err = databaseobject.ValidateDatabaseObject(req.GetObject())
 	if err != nil {
 		return nil, trace.Wrap(err, "validating object")
 	}
 
-	object, err := rs.backend.UpdateDatabaseObject(ctx, req.Object)
+	object, err := rs.backend.UpdateDatabaseObject(ctx, req.GetObject())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -215,7 +215,7 @@ func (rs *DatabaseObjectService) DeleteDatabaseObject(
 		return nil, trace.Wrap(err)
 	}
 
-	err = rs.backend.DeleteDatabaseObject(ctx, req.Name)
+	err = rs.backend.DeleteDatabaseObject(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/dbobjectimportrule/dbobjectimportrulev1/service.go b/lib/auth/dbobjectimportrule/dbobjectimportrulev1/service.go
index a10b1fc7a55..fd1fb64323d 100644
--- a/lib/auth/dbobjectimportrule/dbobjectimportrulev1/service.go
+++ b/lib/auth/dbobjectimportrule/dbobjectimportrulev1/service.go
@@ -103,11 +103,11 @@ func (rs *DatabaseObjectImportRuleService) GetDatabaseObjectImportRule(ctx conte
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	out, err := rs.backend.GetDatabaseObjectImportRule(ctx, req.Name)
+	out, err := rs.backend.GetDatabaseObjectImportRule(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -123,14 +123,14 @@ func (rs *DatabaseObjectImportRuleService) ListDatabaseObjectImportRules(
 		return nil, trace.Wrap(err)
 	}
 
-	out, next, err := rs.backend.ListDatabaseObjectImportRules(ctx, int(req.PageSize), req.PageToken)
+	out, next, err := rs.backend.ListDatabaseObjectImportRules(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &pb.ListDatabaseObjectImportRulesResponse{
+	return pb.ListDatabaseObjectImportRulesResponse_builder{
 		Rules:         out,
 		NextPageToken: next,
-	}, nil
+	}.Build(), nil
 }
 
 // CreateDatabaseObjectImportRule creates a new DatabaseObjectImportRule. It will return an error if the DatabaseObjectImportRule already
@@ -143,12 +143,12 @@ func (rs *DatabaseObjectImportRuleService) CreateDatabaseObjectImportRule(
 		return nil, trace.Wrap(err)
 	}
 
-	err = databaseobjectimportrule.ValidateDatabaseObjectImportRule(req.Rule)
+	err = databaseobjectimportrule.ValidateDatabaseObjectImportRule(req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err, "validating rule")
 	}
 
-	out, err := rs.backend.CreateDatabaseObjectImportRule(ctx, req.Rule)
+	out, err := rs.backend.CreateDatabaseObjectImportRule(ctx, req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -180,12 +180,12 @@ func (rs *DatabaseObjectImportRuleService) UpdateDatabaseObjectImportRule(
 		return nil, trace.Wrap(err)
 	}
 
-	err = databaseobjectimportrule.ValidateDatabaseObjectImportRule(req.Rule)
+	err = databaseobjectimportrule.ValidateDatabaseObjectImportRule(req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err, "validating rule")
 	}
 
-	rule, err := rs.backend.UpdateDatabaseObjectImportRule(ctx, req.Rule)
+	rule, err := rs.backend.UpdateDatabaseObjectImportRule(ctx, req.GetRule())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -215,7 +215,7 @@ func (rs *DatabaseObjectImportRuleService) DeleteDatabaseObjectImportRule(
 		return nil, trace.Wrap(err)
 	}
 
-	err = rs.backend.DeleteDatabaseObjectImportRule(ctx, req.Name)
+	err = rs.backend.DeleteDatabaseObjectImportRule(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/delegation/delegationv1/create_delegation_session.go b/lib/auth/delegation/delegationv1/create_delegation_session.go
index cae089aedf5..de3c6feb7c2 100644
--- a/lib/auth/delegation/delegationv1/create_delegation_session.go
+++ b/lib/auth/delegation/delegationv1/create_delegation_session.go
@@ -77,15 +77,15 @@ func (s *SessionService) CreateDelegationSession(
 		return nil, trace.BadParameter("ttl: cannot be more than %d hours", sessionMaxTTL/time.Hour)
 	}
 
-	session := &delegationv1.DelegationSession{
+	session := delegationv1.DelegationSession_builder{
 		Kind:    types.KindDelegationSession,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    uuid.NewString(),
 			Expires: timestamppb.New(time.Now().Add(ttl)),
-		},
+		}.Build(),
 		Spec: req.GetSpec(),
-	}
+	}.Build()
 	spec := session.GetSpec()
 	resources := spec.GetResources()
 
diff --git a/lib/auth/delegation/delegationv1/create_delegation_session_test.go b/lib/auth/delegation/delegationv1/create_delegation_session_test.go
index 5bc5ad00b23..2eaa59c4500 100644
--- a/lib/auth/delegation/delegationv1/create_delegation_session_test.go
+++ b/lib/auth/delegation/delegationv1/create_delegation_session_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/durationpb"
 
@@ -58,10 +59,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			expectedExpires := time.Now().Add(5 * time.Minute)
 			expectedSpec := newDelegationSessionSpec("bob")
 
-			session, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+			session, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 				Spec: expectedSpec,
 				Ttl:  durationpb.New(5 * time.Minute),
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			assert.Equal(t, types.KindDelegationSession, session.GetKind())
@@ -91,16 +92,16 @@ func TestSessionService_CreateSession(t *testing.T) {
 			types.RoleSpecV6{},
 		)
 
-		session, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		session, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec(
 				"bob",
-				&delegationv1pb.DelegationResourceSpec{
+				delegationv1pb.DelegationResourceSpec_builder{
 					Kind: types.Wildcard,
 					Name: types.Wildcard,
-				},
+				}.Build(),
 			),
 			Ttl: durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.NoError(t, err)
 		assert.Equal(t, types.Wildcard, session.GetSpec().GetResources()[0].GetKind())
 		assert.Equal(t, types.Wildcard, session.GetSpec().GetResources()[0].GetName())
@@ -115,10 +116,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			types.RoleSpecV6{},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("bob"),
 			Ttl:  durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsAccessDenied(err))
 		require.ErrorContains(t, err, "user does not have permission to delegate access to all of the required resources")
@@ -139,16 +140,16 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec(
 				"bob",
-				&delegationv1pb.DelegationResourceSpec{
+				delegationv1pb.DelegationResourceSpec_builder{
 					Kind: types.KindApp,
 					Name: "unknown-app",
-				},
+				}.Build(),
 			),
 			Ttl: durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsAccessDenied(err))
 		require.ErrorContains(t, err, "missing resources: [app/unknown-app]")
@@ -169,10 +170,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("alice"),
 			Ttl:  durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsAccessDenied(err))
 		require.ErrorContains(t, err, "cannot create a delegation session for a different user")
@@ -193,10 +194,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("bob"),
 			Ttl:  durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.ErrorIs(t, err, &mfa.ErrAdminActionMFARequired)
 	})
@@ -218,10 +219,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("bob"),
 			Ttl:  durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsAccessDenied(err))
 		require.ErrorContains(t, err, "cannot create a delegation session from within a delegation session")
@@ -243,10 +244,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("bob"),
 			Ttl:  durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsAccessDenied(err))
 		require.ErrorContains(t, err, "cannot create a delegation session because certificate reissuance is prohibited")
@@ -267,9 +268,9 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("bob"),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsBadParameter(err))
 		require.ErrorContains(t, err, "ttl: is required")
@@ -290,10 +291,10 @@ func TestSessionService_CreateSession(t *testing.T) {
 			},
 		)
 
-		_, err := service.CreateDelegationSession(t.Context(), &delegationv1pb.CreateDelegationSessionRequest{
+		_, err := service.CreateDelegationSession(t.Context(), delegationv1pb.CreateDelegationSessionRequest_builder{
 			Spec: newDelegationSessionSpec("bob"),
 			Ttl:  durationpb.New(14 * 24 * time.Hour),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsBadParameter(err))
 		require.ErrorContains(t, err, "ttl: cannot be more than 168 hours")
@@ -306,23 +307,21 @@ func newDelegationSessionSpec(
 ) *delegationv1pb.DelegationSessionSpec {
 	if len(resources) == 0 {
 		resources = []*delegationv1pb.DelegationResourceSpec{
-			{
+			delegationv1pb.DelegationResourceSpec_builder{
 				Kind: types.KindApp,
 				Name: "hr-system",
-			},
+			}.Build(),
 		}
 	}
 
-	return &delegationv1pb.DelegationSessionSpec{
+	return delegationv1pb.DelegationSessionSpec_builder{
 		User:      user,
 		Resources: resources,
 		AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-			{
-				Kind: types.KindBot,
-				Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-					BotName: "payroll-agent",
-				},
-			},
+			delegationv1pb.DelegationUserSpec_builder{
+				Kind:    types.KindBot,
+				BotName: proto.String("payroll-agent"),
+			}.Build(),
 		},
-	}
+	}.Build()
 }
diff --git a/lib/auth/delegation/delegationv1/generate_certs.go b/lib/auth/delegation/delegationv1/generate_certs.go
index dd8e55c9f5a..c7f9b2f1196 100644
--- a/lib/auth/delegation/delegationv1/generate_certs.go
+++ b/lib/auth/delegation/delegationv1/generate_certs.go
@@ -251,11 +251,11 @@ func (s *SessionService) generateCertificates(
 	}
 
 	// Add the protocol-specific routing hints to the certificate.
-	switch routing := req.Routing.(type) {
-	case *delegationv1.GenerateCertsRequest_RouteToKubernetes:
-		certReq.KubernetesCluster = routing.RouteToKubernetes.GetClusterName()
-	case *delegationv1.GenerateCertsRequest_RouteToApp:
-		route := routing.RouteToApp
+	switch req.WhichRouting() {
+	case delegationv1.GenerateCertsRequest_RouteToKubernetes_case:
+		certReq.KubernetesCluster = req.GetRouteToKubernetes().GetClusterName()
+	case delegationv1.GenerateCertsRequest_RouteToApp_case:
+		route := req.GetRouteToApp()
 
 		certReq.AppPublicAddr = route.GetPublicAddr()
 		certReq.AppClusterName = route.GetClusterName()
@@ -296,8 +296,8 @@ func (s *SessionService) generateCertificates(
 			return nil, trace.Wrap(err)
 		}
 		certReq.AppSessionID = appSession.GetName()
-	case *delegationv1.GenerateCertsRequest_RouteToDatabase:
-		route := routing.RouteToDatabase
+	case delegationv1.GenerateCertsRequest_RouteToDatabase_case:
+		route := req.GetRouteToDatabase()
 
 		certReq.DBService = route.GetServiceName()
 		certReq.DBProtocol = route.GetProtocol()
@@ -310,10 +310,10 @@ func (s *SessionService) generateCertificates(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &delegationv1.GenerateCertsResponse{
+	return delegationv1.GenerateCertsResponse_builder{
 		Ssh: certs.SSH,
 		Tls: certs.TLS,
-	}, nil
+	}.Build(), nil
 }
 
 func (s *SessionService) getRoleSet(ctx context.Context, user services.UserState) (services.RoleSet, error) {
diff --git a/lib/auth/delegation/delegationv1/generate_certs_test.go b/lib/auth/delegation/delegationv1/generate_certs_test.go
index ec46eef54d0..c5d6ebd5045 100644
--- a/lib/auth/delegation/delegationv1/generate_certs_test.go
+++ b/lib/auth/delegation/delegationv1/generate_certs_test.go
@@ -27,9 +27,10 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/durationpb"
 
-	"github.com/gravitational/teleport/api/client/proto"
+	clientproto "github.com/gravitational/teleport/api/client/proto"
 	delegationv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/delegation/v1"
 	"github.com/gravitational/teleport/api/types"
 	"github.com/gravitational/teleport/lib/auth/delegation/delegationv1"
@@ -59,23 +60,21 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 				},
 			})
 
-			session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+			session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 				User: "bob",
 				Resources: []*delegationv1pb.DelegationResourceSpec{
-					{
+					delegationv1pb.DelegationResourceSpec_builder{
 						Kind: types.KindApp,
 						Name: "hr-system",
-					},
+					}.Build(),
 				},
 				AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-					{
-						Kind: types.KindBot,
-						Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-							BotName: "payroll-agent",
-						},
-					},
+					delegationv1pb.DelegationUserSpec_builder{
+						Kind:    types.KindBot,
+						BotName: proto.String("payroll-agent"),
+					}.Build(),
 				},
-			})
+			}.Build())
 
 			appSession, err := types.NewWebSession(
 				uuid.NewString(),
@@ -104,7 +103,7 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 				return appSession, nil
 			}
 
-			pack.onGenerateCert = func(_ context.Context, req cert.Request) (*proto.Certs, error) {
+			pack.onGenerateCert = func(_ context.Context, req cert.Request) (*clientproto.Certs, error) {
 				require.Equal(t, "bob", req.User.GetName())
 				require.Equal(t, sshPublicKey, req.SSHPublicKey)
 				require.Equal(t, tlsPublicKey, req.TLSPublicKey)
@@ -132,34 +131,32 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 				require.Equal(t, appSession.GetName(), req.AppSessionID)
 				require.Equal(t, "payroll-agent", req.BotName)
 
-				return &proto.Certs{
+				return &clientproto.Certs{
 					TLS: tlsCertificate,
 					SSH: sshCertificate,
 				}, nil
 			}
 			pack.authenticateBot("payroll-agent")
 
-			rsp, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+			rsp, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 				DelegationSessionId: session.GetMetadata().GetName(),
 				SshPublicKey:        sshPublicKey,
 				TlsPublicKey:        tlsPublicKey,
 				Ttl:                 durationpb.New(5 * time.Minute),
-				Routing: &delegationv1pb.GenerateCertsRequest_RouteToApp{
-					RouteToApp: &delegationv1pb.RouteToApp{
-						Name:        "hr-system",
-						PublicAddr:  "hr-system.test.teleport.sh",
-						ClusterName: "test.teleport.sh",
-						Uri:         "http://localhost:9000",
-						TargetPort:  9000,
-					},
-				},
-			})
+				RouteToApp: delegationv1pb.RouteToApp_builder{
+					Name:        "hr-system",
+					PublicAddr:  "hr-system.test.teleport.sh",
+					ClusterName: "test.teleport.sh",
+					Uri:         "http://localhost:9000",
+					TargetPort:  9000,
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 			require.Equal(t,
-				&delegationv1pb.GenerateCertsResponse{
+				delegationv1pb.GenerateCertsResponse_builder{
 					Ssh: sshCertificate,
 					Tls: tlsCertificate,
-				},
+				}.Build(),
 				rsp,
 			)
 		})
@@ -176,20 +173,18 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 				},
 			})
 
-			session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+			session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 				User: "bob",
 				Resources: []*delegationv1pb.DelegationResourceSpec{
-					{Kind: types.Wildcard, Name: types.Wildcard},
+					delegationv1pb.DelegationResourceSpec_builder{Kind: types.Wildcard, Name: types.Wildcard}.Build(),
 				},
 				AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-					{
-						Kind: types.KindBot,
-						Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-							BotName: "payroll-agent",
-						},
-					},
+					delegationv1pb.DelegationUserSpec_builder{
+						Kind:    types.KindBot,
+						BotName: proto.String("payroll-agent"),
+					}.Build(),
 				},
-			})
+			}.Build())
 
 			appSession, err := types.NewWebSession(
 				uuid.NewString(),
@@ -206,39 +201,37 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 				return appSession, nil
 			}
 
-			pack.onGenerateCert = func(_ context.Context, req cert.Request) (*proto.Certs, error) {
+			pack.onGenerateCert = func(_ context.Context, req cert.Request) (*clientproto.Certs, error) {
 				params := req.CheckerContext.CertParams().UnscopedCertParams()
 				require.NotNil(t, params)
 				require.Empty(t, params.GetAllowedResourceAccessIDs())
 
-				return &proto.Certs{
+				return &clientproto.Certs{
 					TLS: tlsCertificate,
 					SSH: sshCertificate,
 				}, nil
 			}
 			pack.authenticateBot("payroll-agent")
 
-			rsp, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+			rsp, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 				DelegationSessionId: session.GetMetadata().GetName(),
 				SshPublicKey:        sshPublicKey,
 				TlsPublicKey:        tlsPublicKey,
 				Ttl:                 durationpb.New(5 * time.Minute),
-				Routing: &delegationv1pb.GenerateCertsRequest_RouteToApp{
-					RouteToApp: &delegationv1pb.RouteToApp{
-						Name:        "hr-system",
-						PublicAddr:  "hr-system.test.teleport.sh",
-						ClusterName: "test.teleport.sh",
-						Uri:         "http://localhost:9000",
-						TargetPort:  9000,
-					},
-				},
-			})
+				RouteToApp: delegationv1pb.RouteToApp_builder{
+					Name:        "hr-system",
+					PublicAddr:  "hr-system.test.teleport.sh",
+					ClusterName: "test.teleport.sh",
+					Uri:         "http://localhost:9000",
+					TargetPort:  9000,
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 			require.Equal(t,
-				&delegationv1pb.GenerateCertsResponse{
+				delegationv1pb.GenerateCertsResponse_builder{
 					Ssh: sshCertificate,
 					Tls: tlsCertificate,
-				},
+				}.Build(),
 				rsp,
 			)
 		})
@@ -248,12 +241,12 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 		service, pack := sessionServiceTestPack(t)
 		pack.authenticateBot("payroll-agent")
 
-		_, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+		_, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 			DelegationSessionId: uuid.NewString(),
 			SshPublicKey:        sshPublicKey,
 			TlsPublicKey:        tlsPublicKey,
 			Ttl:                 durationpb.New(1 * time.Hour),
-		})
+		}.Build())
 		require.ErrorIs(t, err, delegationv1.ErrDelegationUnauthorized)
 	})
 
@@ -268,30 +261,28 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 		})
 		pack.authenticateBot("evil-bot")
 
-		session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+		session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 			User: "bob",
 			Resources: []*delegationv1pb.DelegationResourceSpec{
-				{
+				delegationv1pb.DelegationResourceSpec_builder{
 					Kind: types.KindApp,
 					Name: "hr-system",
-				},
+				}.Build(),
 			},
 			AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-				{
-					Kind: types.KindBot,
-					Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-						BotName: "payroll-agent",
-					},
-				},
+				delegationv1pb.DelegationUserSpec_builder{
+					Kind:    types.KindBot,
+					BotName: proto.String("payroll-agent"),
+				}.Build(),
 			},
-		})
+		}.Build())
 
-		_, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+		_, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 			DelegationSessionId: session.GetMetadata().GetName(),
 			SshPublicKey:        sshPublicKey,
 			TlsPublicKey:        tlsPublicKey,
 			Ttl:                 durationpb.New(1 * time.Hour),
-		})
+		}.Build())
 		require.ErrorIs(t, err, delegationv1.ErrDelegationUnauthorized)
 	})
 
@@ -306,30 +297,28 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 		})
 		pack.authenticateBotInDelegationSession("payroll-agent", "source-delegation-session")
 
-		session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+		session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 			User: "bob",
 			Resources: []*delegationv1pb.DelegationResourceSpec{
-				{
+				delegationv1pb.DelegationResourceSpec_builder{
 					Kind: types.KindApp,
 					Name: "hr-system",
-				},
+				}.Build(),
 			},
 			AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-				{
-					Kind: types.KindBot,
-					Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-						BotName: "payroll-agent",
-					},
-				},
+				delegationv1pb.DelegationUserSpec_builder{
+					Kind:    types.KindBot,
+					BotName: proto.String("payroll-agent"),
+				}.Build(),
 			},
-		})
+		}.Build())
 
-		_, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+		_, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 			DelegationSessionId: session.GetMetadata().GetName(),
 			SshPublicKey:        sshPublicKey,
 			TlsPublicKey:        tlsPublicKey,
 			Ttl:                 durationpb.New(1 * time.Hour),
-		})
+		}.Build())
 		require.ErrorIs(t, err, delegationv1.ErrDelegationUnauthorized)
 	})
 
@@ -345,33 +334,31 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 			})
 			pack.authenticateBot("payroll-agent")
 
-			session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+			session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 				User: "bob",
 				Resources: []*delegationv1pb.DelegationResourceSpec{
-					{
+					delegationv1pb.DelegationResourceSpec_builder{
 						Kind: types.KindApp,
 						Name: "hr-system",
-					},
+					}.Build(),
 				},
 				AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-					{
-						Kind: types.KindBot,
-						Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-							BotName: "payroll-agent",
-						},
-					},
+					delegationv1pb.DelegationUserSpec_builder{
+						Kind:    types.KindBot,
+						BotName: proto.String("payroll-agent"),
+					}.Build(),
 				},
-			})
+			}.Build())
 
 			// This won't actually sleep, thanks to synctest!
 			time.Sleep(time.Until(session.GetMetadata().GetExpires().AsTime().Add(delegationv1.ClockSkewAllowance)))
 
-			_, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+			_, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 				DelegationSessionId: session.GetMetadata().GetName(),
 				SshPublicKey:        sshPublicKey,
 				TlsPublicKey:        tlsPublicKey,
 				Ttl:                 durationpb.New(1 * time.Hour),
-			})
+			}.Build())
 			require.ErrorIs(t, err, delegationv1.ErrDelegationUnauthorized)
 		})
 	})
@@ -381,30 +368,28 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 		pack.createUser(t, "bob", types.RoleSpecV6{})
 		pack.authenticateBot("payroll-agent")
 
-		session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+		session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 			User: "bob",
 			Resources: []*delegationv1pb.DelegationResourceSpec{
-				{
+				delegationv1pb.DelegationResourceSpec_builder{
 					Kind: types.KindApp,
 					Name: "hr-system",
-				},
+				}.Build(),
 			},
 			AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-				{
-					Kind: types.KindBot,
-					Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-						BotName: "payroll-agent",
-					},
-				},
+				delegationv1pb.DelegationUserSpec_builder{
+					Kind:    types.KindBot,
+					BotName: proto.String("payroll-agent"),
+				}.Build(),
 			},
-		})
+		}.Build())
 
-		_, err := service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+		_, err := service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 			DelegationSessionId: session.GetMetadata().GetName(),
 			SshPublicKey:        sshPublicKey,
 			TlsPublicKey:        tlsPublicKey,
 			Ttl:                 durationpb.New(1 * time.Hour),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsAccessDenied(err))
 		require.ErrorContains(t, err, "user does not have permission to delegate access to all of the required resources")
@@ -434,49 +419,45 @@ func TestSessionService_GenerateCerts(t *testing.T) {
 				return appSession, nil
 			}
 
-			pack.onGenerateCert = func(_ context.Context, req cert.Request) (*proto.Certs, error) {
+			pack.onGenerateCert = func(_ context.Context, req cert.Request) (*clientproto.Certs, error) {
 				require.Equal(t, 1*time.Hour, req.TTL) // This is the session expiry, not the requested TTL.
 
-				return &proto.Certs{
+				return &clientproto.Certs{
 					TLS: tlsCertificate,
 					SSH: sshCertificate,
 				}, nil
 			}
 			pack.authenticateBot("payroll-agent")
 
-			session := pack.createSession(t, &delegationv1pb.DelegationSessionSpec{
+			session := pack.createSession(t, delegationv1pb.DelegationSessionSpec_builder{
 				User: "bob",
 				Resources: []*delegationv1pb.DelegationResourceSpec{
-					{
+					delegationv1pb.DelegationResourceSpec_builder{
 						Kind: types.KindApp,
 						Name: "hr-system",
-					},
+					}.Build(),
 				},
 				AuthorizedUsers: []*delegationv1pb.DelegationUserSpec{
-					{
-						Kind: types.KindBot,
-						Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-							BotName: "payroll-agent",
-						},
-					},
+					delegationv1pb.DelegationUserSpec_builder{
+						Kind:    types.KindBot,
+						BotName: proto.String("payroll-agent"),
+					}.Build(),
 				},
-			})
+			}.Build())
 
-			_, err = service.GenerateCerts(t.Context(), &delegationv1pb.GenerateCertsRequest{
+			_, err = service.GenerateCerts(t.Context(), delegationv1pb.GenerateCertsRequest_builder{
 				DelegationSessionId: session.GetMetadata().GetName(),
 				SshPublicKey:        sshPublicKey,
 				TlsPublicKey:        tlsPublicKey,
 				Ttl:                 durationpb.New(365 * 24 * 1 * time.Hour),
-				Routing: &delegationv1pb.GenerateCertsRequest_RouteToApp{
-					RouteToApp: &delegationv1pb.RouteToApp{
-						Name:        "hr-system",
-						PublicAddr:  "hr-system.test.teleport.sh",
-						ClusterName: "test.teleport.sh",
-						Uri:         "http://localhost:9000",
-						TargetPort:  9000,
-					},
-				},
-			})
+				RouteToApp: delegationv1pb.RouteToApp_builder{
+					Name:        "hr-system",
+					PublicAddr:  "hr-system.test.teleport.sh",
+					ClusterName: "test.teleport.sh",
+					Uri:         "http://localhost:9000",
+					TargetPort:  9000,
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 		})
 	})
diff --git a/lib/auth/delegation/delegationv1/session_service_test.go b/lib/auth/delegation/delegationv1/session_service_test.go
index 4c33eb89177..7b2a8d5a87f 100644
--- a/lib/auth/delegation/delegationv1/session_service_test.go
+++ b/lib/auth/delegation/delegationv1/session_service_test.go
@@ -250,15 +250,15 @@ func (p *sessionTestPack) authenticateBotInDelegationSession(botName, delegation
 func (p *sessionTestPack) createSession(t *testing.T, spec *delegationv1pb.DelegationSessionSpec) *delegationv1pb.DelegationSession {
 	t.Helper()
 
-	session, err := p.sessions.CreateDelegationSession(t.Context(), &delegationv1pb.DelegationSession{
+	session, err := p.sessions.CreateDelegationSession(t.Context(), delegationv1pb.DelegationSession_builder{
 		Kind:    types.KindDelegationSession,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    uuid.NewString(),
 			Expires: timestamppb.New(time.Now().Add(time.Hour)),
-		},
+		}.Build(),
 		Spec: spec,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	return session
diff --git a/lib/auth/desktop_test.go b/lib/auth/desktop_test.go
index 872d4b590ac..d2e827a749c 100644
--- a/lib/auth/desktop_test.go
+++ b/lib/auth/desktop_test.go
@@ -117,16 +117,16 @@ func TestDesktopAccessCAOverrides(t *testing.T) {
 		ExternalRoot: externalCA,
 	}
 	caOverride := env.NewOverrideForCA(t, ca, nil)
-	override := caOverride.Spec.CertificateOverrides[0]
-	override.Disabled = false // enable
+	override := caOverride.GetSpec().GetCertificateOverrides()[0]
+	override.SetDisabled(false) // enable
 	_, err = authServer.CreateCertAuthorityOverride(t.Context(), caOverride)
 	require.NoError(t, err, "CreateCertAuthorityOverride errored")
-	overrideCert, err := tlsutils.ParseCertificatePEM([]byte(override.Certificate))
+	overrideCert, err := tlsutils.ParseCertificatePEM([]byte(override.GetCertificate()))
 	require.NoError(t, err)
 
 	t.Run("generate with override", func(t *testing.T) {
 		runTest(t, overrideCert, &proto.CAOverrideCertificateDetails{
-			PublicKeyHash: override.PublicKey,
+			PublicKeyHash: override.GetPublicKey(),
 		})
 	})
 }
diff --git a/lib/auth/discoveryconfig/discoveryconfigv1/service.go b/lib/auth/discoveryconfig/discoveryconfigv1/service.go
index 2265e77cc73..e7e944a3af9 100644
--- a/lib/auth/discoveryconfig/discoveryconfigv1/service.go
+++ b/lib/auth/discoveryconfig/discoveryconfigv1/service.go
@@ -149,10 +149,10 @@ func (s *Service) ListDiscoveryConfigs(ctx context.Context, req *discoveryconfig
 		dcs[i] = conv.ToProto(downgraded)
 	}
 
-	return &discoveryconfigv1.ListDiscoveryConfigsResponse{
+	return discoveryconfigv1.ListDiscoveryConfigsResponse_builder{
 		DiscoveryConfigs: dcs,
 		NextKey:          nextKey,
-	}, nil
+	}.Build(), nil
 }
 
 // GetDiscoveryConfig returns the specified DiscoveryConfig resource.
@@ -166,7 +166,7 @@ func (s *Service) GetDiscoveryConfig(ctx context.Context, req *discoveryconfigv1
 		return nil, trace.Wrap(err)
 	}
 
-	dc, err := s.backend.GetDiscoveryConfig(ctx, req.Name)
+	dc, err := s.backend.GetDiscoveryConfig(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -347,7 +347,7 @@ func (s *Service) DeleteDiscoveryConfig(ctx context.Context, req *discoveryconfi
 		},
 		UserMetadata: authCtx.GetUserMetadata(),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Name,
+			Name: req.GetName(),
 		},
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 	}); err != nil {
diff --git a/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go b/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go
index ec739a265a9..b979c8586b7 100644
--- a/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go
+++ b/lib/auth/discoveryconfig/discoveryconfigv1/service_test.go
@@ -87,9 +87,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.GetDiscoveryConfig(ctx, &discoveryconfigpb.GetDiscoveryConfigRequest{
+				_, err := resourceSvc.GetDiscoveryConfig(ctx, discoveryconfigpb.GetDiscoveryConfigRequest_builder{
 					Name: dcName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -98,9 +98,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			Name: "no access to read discovery configs",
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.GetDiscoveryConfig(ctx, &discoveryconfigpb.GetDiscoveryConfigRequest{
+				_, err := resourceSvc.GetDiscoveryConfig(ctx, discoveryconfigpb.GetDiscoveryConfigRequest_builder{
 					Name: dcName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -114,9 +114,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 				}}},
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.GetDiscoveryConfig(ctx, &discoveryconfigpb.GetDiscoveryConfigRequest{
+				_, err := resourceSvc.GetDiscoveryConfig(ctx, discoveryconfigpb.GetDiscoveryConfigRequest_builder{
 					Name: dcName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -138,10 +138,10 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 				}
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.ListDiscoveryConfigs(ctx, &discoveryconfigpb.ListDiscoveryConfigsRequest{
+				_, err := resourceSvc.ListDiscoveryConfigs(ctx, discoveryconfigpb.ListDiscoveryConfigsRequest_builder{
 					PageSize:  0,
 					NextToken: "",
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -155,10 +155,10 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 				}}},
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.ListDiscoveryConfigs(ctx, &discoveryconfigpb.ListDiscoveryConfigsRequest{
+				_, err := resourceSvc.ListDiscoveryConfigs(ctx, discoveryconfigpb.ListDiscoveryConfigsRequest_builder{
 					PageSize:  0,
 					NextToken: "",
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -170,9 +170,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
 				dc := sampleDiscoveryConfigFn(t, dcName)
-				_, err := resourceSvc.CreateDiscoveryConfig(ctx, &discoveryconfigpb.CreateDiscoveryConfigRequest{
+				_, err := resourceSvc.CreateDiscoveryConfig(ctx, discoveryconfigpb.CreateDiscoveryConfigRequest_builder{
 					DiscoveryConfig: convert.ToProto(dc),
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -187,9 +187,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
 				dc := sampleDiscoveryConfigFn(t, dcName)
-				_, err := resourceSvc.CreateDiscoveryConfig(ctx, &discoveryconfigpb.CreateDiscoveryConfigRequest{
+				_, err := resourceSvc.CreateDiscoveryConfig(ctx, discoveryconfigpb.CreateDiscoveryConfigRequest_builder{
 					DiscoveryConfig: convert.ToProto(dc),
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -201,9 +201,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
 				dc := sampleDiscoveryConfigFn(t, dcName)
-				_, err := resourceSvc.UpdateDiscoveryConfig(ctx, &discoveryconfigpb.UpdateDiscoveryConfigRequest{
+				_, err := resourceSvc.UpdateDiscoveryConfig(ctx, discoveryconfigpb.UpdateDiscoveryConfigRequest_builder{
 					DiscoveryConfig: convert.ToProto(dc),
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -222,9 +222,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
 				dc := sampleDiscoveryConfigFn(t, dcName)
-				_, err := resourceSvc.UpdateDiscoveryConfig(ctx, &discoveryconfigpb.UpdateDiscoveryConfigRequest{
+				_, err := resourceSvc.UpdateDiscoveryConfig(ctx, discoveryconfigpb.UpdateDiscoveryConfigRequest_builder{
 					DiscoveryConfig: convert.ToProto(dc),
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -241,9 +241,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
 				dc := sampleDiscoveryConfigFn(t, dcName)
-				_, err := resourceSvc.UpsertDiscoveryConfig(ctx, &discoveryconfigpb.UpsertDiscoveryConfigRequest{
+				_, err := resourceSvc.UpsertDiscoveryConfig(ctx, discoveryconfigpb.UpsertDiscoveryConfigRequest_builder{
 					DiscoveryConfig: convert.ToProto(dc),
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -259,9 +259,9 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			Setup: func(t *testing.T, dcName string) {},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
 				dc := sampleDiscoveryConfigFn(t, dcName)
-				_, err := resourceSvc.UpsertDiscoveryConfig(ctx, &discoveryconfigpb.UpsertDiscoveryConfigRequest{
+				_, err := resourceSvc.UpsertDiscoveryConfig(ctx, discoveryconfigpb.UpsertDiscoveryConfigRequest_builder{
 					DiscoveryConfig: convert.ToProto(dc),
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -272,7 +272,7 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 			Name: "no access to delete discovery config",
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.DeleteDiscoveryConfig(ctx, &discoveryconfigpb.DeleteDiscoveryConfigRequest{Name: "x"})
+				_, err := resourceSvc.DeleteDiscoveryConfig(ctx, discoveryconfigpb.DeleteDiscoveryConfigRequest_builder{Name: "x"}.Build())
 				return err
 			},
 			ErrAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -290,7 +290,7 @@ func TestDiscoveryConfigCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.DeleteDiscoveryConfig(ctx, &discoveryconfigpb.DeleteDiscoveryConfigRequest{Name: dcName})
+				_, err := resourceSvc.DeleteDiscoveryConfig(ctx, discoveryconfigpb.DeleteDiscoveryConfigRequest_builder{Name: dcName}.Build())
 				return err
 			},
 			ErrAssertion: require.NoError,
@@ -376,9 +376,9 @@ func TestUpdateDiscoveryConfigStatus(t *testing.T) {
 			name:       "no access to update discovery config status",
 			systemRole: types.RoleNode,
 			test: func(t *testing.T, ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.UpdateDiscoveryConfigStatus(ctx, &discoveryconfigpb.UpdateDiscoveryConfigStatusRequest{
+				_, err := resourceSvc.UpdateDiscoveryConfigStatus(ctx, discoveryconfigpb.UpdateDiscoveryConfigStatusRequest_builder{
 					Name: dcName,
-				})
+				}.Build())
 				return err
 			},
 			errAssertion: requireTraceErrorFn(trace.IsAccessDenied),
@@ -387,9 +387,9 @@ func TestUpdateDiscoveryConfigStatus(t *testing.T) {
 			name:       "discovery config doesn't exist",
 			systemRole: types.RoleDiscovery,
 			test: func(t *testing.T, ctx context.Context, resourceSvc *Service, dcName string) error {
-				_, err := resourceSvc.UpdateDiscoveryConfigStatus(ctx, &discoveryconfigpb.UpdateDiscoveryConfigStatusRequest{
+				_, err := resourceSvc.UpdateDiscoveryConfigStatus(ctx, discoveryconfigpb.UpdateDiscoveryConfigStatusRequest_builder{
 					Name: dcName,
-				})
+				}.Build())
 				return err
 			},
 			errAssertion: requireTraceErrorFn(trace.IsNotFound),
@@ -404,17 +404,17 @@ func TestUpdateDiscoveryConfigStatus(t *testing.T) {
 			test: func(t *testing.T, ctx context.Context, resourceSvc *Service, dcName string) error {
 				now := time.Now()
 				msg := "error message"
-				status := &discoveryconfigpb.DiscoveryConfigStatus{
+				status := discoveryconfigpb.DiscoveryConfigStatus_builder{
 					State:               discoveryconfigpb.DiscoveryConfigState_DISCOVERY_CONFIG_STATE_RUNNING,
 					ErrorMessage:        &msg,
 					DiscoveredResources: 42,
 					LastSyncTime:        timestamppb.New(now),
-				}
+				}.Build()
 
-				out, err := resourceSvc.UpdateDiscoveryConfigStatus(ctx, &discoveryconfigpb.UpdateDiscoveryConfigStatusRequest{
+				out, err := resourceSvc.UpdateDiscoveryConfigStatus(ctx, discoveryconfigpb.UpdateDiscoveryConfigStatusRequest_builder{
 					Name:   dcName,
 					Status: status,
-				})
+				}.Build())
 				require.NoError(t, err)
 				dc := sampleDiscoveryConfigFn(t, dcName)
 				dc.Status = convert.StatusFromProto(status)
diff --git a/lib/auth/dynamicwindows/dynamicwindowsv1/service.go b/lib/auth/dynamicwindows/dynamicwindowsv1/service.go
index dac5b72ca33..ee46ab83be1 100644
--- a/lib/auth/dynamicwindows/dynamicwindowsv1/service.go
+++ b/lib/auth/dynamicwindows/dynamicwindowsv1/service.go
@@ -131,14 +131,14 @@ func (s *Service) ListDynamicWindowsDesktops(ctx context.Context, request *dynam
 		return nil, trace.Wrap(err)
 	}
 
-	desktops, next, err := s.cache.ListDynamicWindowsDesktops(ctx, int(request.PageSize), request.PageToken)
+	desktops, next, err := s.cache.ListDynamicWindowsDesktops(ctx, int(request.GetPageSize()), request.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	response := &dynamicwindowspb.ListDynamicWindowsDesktopsResponse{
+	response := dynamicwindowspb.ListDynamicWindowsDesktopsResponse_builder{
 		NextPageToken: next,
-	}
+	}.Build()
 	for _, d := range desktops {
 		if err := checkAccess(auth, d); err != nil {
 			continue
@@ -147,7 +147,7 @@ func (s *Service) ListDynamicWindowsDesktops(ctx context.Context, request *dynam
 		if !ok {
 			return nil, trace.BadParameter("unexpected type %T", d)
 		}
-		response.Desktops = append(response.Desktops, desktop)
+		response.SetDesktops(append(response.GetDesktops(), desktop))
 	}
 
 	return response, nil
@@ -168,7 +168,7 @@ func (s *Service) CreateDynamicWindowsDesktop(ctx context.Context, req *dynamicw
 	if err := checkAccess(auth, req.GetDesktop()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	d, err := s.backend.CreateDynamicWindowsDesktop(ctx, types.DynamicWindowsDesktop(req.Desktop))
+	d, err := s.backend.CreateDynamicWindowsDesktop(ctx, types.DynamicWindowsDesktop(req.GetDesktop()))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -207,7 +207,7 @@ func (s *Service) UpdateDynamicWindowsDesktop(ctx context.Context, req *dynamicw
 	if err := checkAccess(auth, req.GetDesktop()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	d, err = s.backend.UpdateDynamicWindowsDesktop(ctx, req.Desktop)
+	d, err = s.backend.UpdateDynamicWindowsDesktop(ctx, req.GetDesktop())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -244,7 +244,7 @@ func (s *Service) UpsertDynamicWindowsDesktop(ctx context.Context, req *dynamicw
 	if err := checkAccess(auth, req.GetDesktop()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	d, err = s.backend.UpsertDynamicWindowsDesktop(ctx, req.Desktop)
+	d, err = s.backend.UpsertDynamicWindowsDesktop(ctx, req.GetDesktop())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/dynamicwindows/dynamicwindowsv1/service_test.go b/lib/auth/dynamicwindows/dynamicwindowsv1/service_test.go
index efc0f9a1fb1..15f308319dd 100644
--- a/lib/auth/dynamicwindows/dynamicwindowsv1/service_test.go
+++ b/lib/auth/dynamicwindows/dynamicwindowsv1/service_test.go
@@ -70,7 +70,7 @@ func TestFailedAccessCheck(t *testing.T) {
 		}
 		resp, err := s.ListDynamicWindowsDesktops(context.Background(), &req)
 		require.NoError(t, err)
-		require.Empty(t, resp.Desktops)
+		require.Empty(t, resp.GetDesktops())
 	})
 }
 
@@ -211,7 +211,7 @@ func callMethod(service *Service, method string) error {
 			_, err := desc.Handler(service, context.Background(), func(arg any) error {
 				switch arg := arg.(type) {
 				case *dynamicwindowsv1.GetDynamicWindowsDesktopRequest:
-					arg.Name = "test2"
+					arg.SetName("test2")
 
 				case *dynamicwindowsv1.CreateDynamicWindowsDesktopRequest:
 					arg.Desktop, _ = types.NewDynamicWindowsDesktopV1("test", nil, types.DynamicWindowsDesktopSpecV1{
diff --git a/lib/auth/gitserver/gitserverv1/github.go b/lib/auth/gitserver/gitserverv1/github.go
index 66463b764da..a0c5b8aec17 100644
--- a/lib/auth/gitserver/gitserverv1/github.go
+++ b/lib/auth/gitserver/gitserverv1/github.go
@@ -33,20 +33,20 @@ import (
 )
 
 func (s *Service) CreateGitHubAuthRequest(ctx context.Context, in *pb.CreateGitHubAuthRequestRequest) (*types.GithubAuthRequest, error) {
-	if in.Request == nil {
+	if !in.HasRequest() {
 		return nil, trace.BadParameter("missing github auth request")
 	}
-	if err := types.ValidateGitHubOrganizationName(in.Organization); err != nil {
+	if err := types.ValidateGitHubOrganizationName(in.GetOrganization()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if in.Request.SSOTestFlow {
+	if in.GetRequest().SSOTestFlow {
 		return nil, trace.BadParameter("sso test flow is not supported when creating GitHub auth request for authenticated user")
 	}
-	if in.Request.CreateWebSession {
+	if in.GetRequest().CreateWebSession {
 		return nil, trace.BadParameter("CreateWebSession is not supported when creating GitHub auth request for authenticated user")
 	}
 
-	authCtx, gitServer, err := s.authAndFindServerByOrg(ctx, in.Organization)
+	authCtx, gitServer, err := s.authAndFindServerByOrg(ctx, in.GetOrganization())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -64,15 +64,15 @@ func (s *Service) CreateGitHubAuthRequest(ctx context.Context, in *pb.CreateGitH
 		return nil, trace.Wrap(err)
 	}
 
-	in.Request.ConnectorID = uuid
-	in.Request.ConnectorSpec = spec
-	in.Request.AuthenticatedUser = authCtx.User.GetName()
-	in.Request.CertTTL = authCtx.Identity.GetIdentity().Expires.Sub(s.cfg.clock.Now())
-	in.Request.ClientLoginIP = authCtx.Identity.GetIdentity().LoginIP
+	in.GetRequest().ConnectorID = uuid
+	in.GetRequest().ConnectorSpec = spec
+	in.GetRequest().AuthenticatedUser = authCtx.User.GetName()
+	in.GetRequest().CertTTL = authCtx.Identity.GetIdentity().Expires.Sub(s.cfg.clock.Now())
+	in.GetRequest().ClientLoginIP = authCtx.Identity.GetIdentity().LoginIP
 
 	// More params of in.Request will get updated and checked by
 	// s.cfg.GitHubAuthRequestCreator.
-	request, err := s.cfg.GitHubAuthRequestCreator(ctx, *in.Request)
+	request, err := s.cfg.GitHubAuthRequestCreator(ctx, *in.GetRequest())
 	return request, trace.Wrap(err)
 }
 
diff --git a/lib/auth/gitserver/gitserverv1/github_test.go b/lib/auth/gitserver/gitserverv1/github_test.go
index c3d80455c38..aa9c86d24b5 100644
--- a/lib/auth/gitserver/gitserverv1/github_test.go
+++ b/lib/auth/gitserver/gitserverv1/github_test.go
@@ -44,10 +44,10 @@ func TestCreateGitHubAuthRequest(t *testing.T) {
 	}
 
 	service := newService(t, checker, org1)
-	createdRequest, err := service.CreateGitHubAuthRequest(ctx, &pb.CreateGitHubAuthRequestRequest{
+	createdRequest, err := service.CreateGitHubAuthRequest(ctx, pb.CreateGitHubAuthRequestRequest_builder{
 		Request:      &types.GithubAuthRequest{},
 		Organization: org1.GetGitHub().Organization,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.NotNil(t, createdRequest)
 
diff --git a/lib/auth/gitserver/gitserverv1/service.go b/lib/auth/gitserver/gitserverv1/service.go
index 795841dcb23..d99af40b92b 100644
--- a/lib/auth/gitserver/gitserverv1/service.go
+++ b/lib/auth/gitserver/gitserverv1/service.go
@@ -109,7 +109,7 @@ func (s *Service) CreateGitServer(ctx context.Context, req *pb.CreateGitServerRe
 	if _, err := s.authorize(ctx, types.VerbCreate); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	server, err := s.cfg.Backend.CreateGitServer(ctx, req.Server)
+	server, err := s.cfg.Backend.CreateGitServer(ctx, req.GetServer())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -121,13 +121,13 @@ func (s *Service) GetGitServer(ctx context.Context, req *pb.GetGitServerRequest)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	server, err := s.cfg.Backend.GetGitServer(ctx, req.Name)
+	server, err := s.cfg.Backend.GetGitServer(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	if err := s.checkAccess(authCtx, server); err != nil {
 		if trace.IsAccessDenied(err) {
-			return nil, trace.NotFound("git server %q not found", req.Name)
+			return nil, trace.NotFound("git server %q not found", req.GetName())
 		}
 		return nil, trace.Wrap(err)
 	}
@@ -139,14 +139,14 @@ func (s *Service) ListGitServers(ctx context.Context, req *pb.ListGitServersRequ
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	servers, next, err := s.cfg.Backend.ListGitServers(ctx, int(req.PageSize), req.PageToken)
+	servers, next, err := s.cfg.Backend.ListGitServers(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp := &pb.ListGitServersResponse{
+	resp := pb.ListGitServersResponse_builder{
 		NextPageToken: next,
-	}
+	}.Build()
 	for _, server := range servers {
 		err := s.checkAccess(authCtx, server)
 		if trace.IsAccessDenied(err) {
@@ -158,7 +158,7 @@ func (s *Service) ListGitServers(ctx context.Context, req *pb.ListGitServersRequ
 		if serverV2, err := toServerV2(server); err != nil {
 			return nil, trace.Wrap(err)
 		} else {
-			resp.Servers = append(resp.Servers, serverV2)
+			resp.SetServers(append(resp.GetServers(), serverV2))
 		}
 	}
 	return resp, nil
@@ -168,7 +168,7 @@ func (s *Service) UpdateGitServer(ctx context.Context, req *pb.UpdateGitServerRe
 	if _, err := s.authorize(ctx, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	server, err := s.cfg.Backend.UpdateGitServer(ctx, req.Server)
+	server, err := s.cfg.Backend.UpdateGitServer(ctx, req.GetServer())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -179,7 +179,7 @@ func (s *Service) UpsertGitServer(ctx context.Context, req *pb.UpsertGitServerRe
 	if _, err := s.authorize(ctx, types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	server, err := s.cfg.Backend.UpsertGitServer(ctx, req.Server)
+	server, err := s.cfg.Backend.UpsertGitServer(ctx, req.GetServer())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/gitserver/gitserverv1/service_test.go b/lib/auth/gitserver/gitserverv1/service_test.go
index e0ba093ecbb..8fcdefd4484 100644
--- a/lib/auth/gitserver/gitserverv1/service_test.go
+++ b/lib/auth/gitserver/gitserverv1/service_test.go
@@ -66,7 +66,7 @@ func TestServiceAccess(t *testing.T) {
 			name:    "create verb not allowed",
 			checker: &fakeAccessChecker{ /*nothing allowed*/ },
 			run: func(t *testing.T, service *Service) {
-				_, err := service.CreateGitServer(ctx, &pb.CreateGitServerRequest{Server: org3})
+				_, err := service.CreateGitServer(ctx, pb.CreateGitServerRequest_builder{Server: org3}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			},
 		},
@@ -76,7 +76,7 @@ func TestServiceAccess(t *testing.T) {
 				allowVerbs: []string{types.VerbCreate},
 			},
 			run: func(t *testing.T, service *Service) {
-				_, err := service.CreateGitServer(ctx, &pb.CreateGitServerRequest{Server: org3})
+				_, err := service.CreateGitServer(ctx, pb.CreateGitServerRequest_builder{Server: org3}.Build())
 				require.NoError(t, err)
 			},
 		},
@@ -84,7 +84,7 @@ func TestServiceAccess(t *testing.T) {
 			name:    "get verb not allowed",
 			checker: &fakeAccessChecker{ /*nothing allowed*/ },
 			run: func(t *testing.T, service *Service) {
-				_, err := service.GetGitServer(ctx, &pb.GetGitServerRequest{Name: org1.GetName()})
+				_, err := service.GetGitServer(ctx, pb.GetGitServerRequest_builder{Name: org1.GetName()}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			},
 		},
@@ -94,7 +94,7 @@ func TestServiceAccess(t *testing.T) {
 				allowVerbs: []string{types.VerbRead},
 			},
 			run: func(t *testing.T, service *Service) {
-				_, err := service.GetGitServer(ctx, &pb.GetGitServerRequest{Name: org1.GetName()})
+				_, err := service.GetGitServer(ctx, pb.GetGitServerRequest_builder{Name: org1.GetName()}.Build())
 				require.True(t, trace.IsNotFound(err))
 			},
 		},
@@ -105,7 +105,7 @@ func TestServiceAccess(t *testing.T) {
 				allowResource: true,
 			},
 			run: func(t *testing.T, service *Service) {
-				server, err := service.GetGitServer(ctx, &pb.GetGitServerRequest{Name: org1.GetName()})
+				server, err := service.GetGitServer(ctx, pb.GetGitServerRequest_builder{Name: org1.GetName()}.Build())
 				require.NoError(t, err)
 				require.Equal(t, "org1", server.GetGitHub().Organization)
 			},
@@ -129,7 +129,7 @@ func TestServiceAccess(t *testing.T) {
 			run: func(t *testing.T, service *Service) {
 				resp, err := service.ListGitServers(ctx, &pb.ListGitServersRequest{})
 				require.NoError(t, err)
-				require.Empty(t, resp.Servers)
+				require.Empty(t, resp.GetServers())
 			},
 		},
 		{
@@ -141,14 +141,14 @@ func TestServiceAccess(t *testing.T) {
 			run: func(t *testing.T, service *Service) {
 				resp, err := service.ListGitServers(ctx, &pb.ListGitServersRequest{})
 				require.NoError(t, err)
-				require.Len(t, resp.Servers, 2)
+				require.Len(t, resp.GetServers(), 2)
 			},
 		},
 		{
 			name:    "update verb not allowed",
 			checker: &fakeAccessChecker{ /*nothing allowed*/ },
 			run: func(t *testing.T, service *Service) {
-				_, err := service.UpdateGitServer(ctx, &pb.UpdateGitServerRequest{Server: org1})
+				_, err := service.UpdateGitServer(ctx, pb.UpdateGitServerRequest_builder{Server: org1}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			},
 		},
@@ -160,7 +160,7 @@ func TestServiceAccess(t *testing.T) {
 			run: func(t *testing.T, service *Service) {
 				org1WithRevision, err := service.cfg.Backend.GetGitServer(ctx, org1.GetName())
 				require.NoError(t, err)
-				_, err = service.UpdateGitServer(ctx, &pb.UpdateGitServerRequest{Server: org1WithRevision.(*types.ServerV2)})
+				_, err = service.UpdateGitServer(ctx, pb.UpdateGitServerRequest_builder{Server: org1WithRevision.(*types.ServerV2)}.Build())
 				require.NoError(t, err)
 			},
 		},
@@ -168,7 +168,7 @@ func TestServiceAccess(t *testing.T) {
 			name:    "upsert verb not allowed",
 			checker: &fakeAccessChecker{ /*nothing allowed*/ },
 			run: func(t *testing.T, service *Service) {
-				_, err := service.UpsertGitServer(ctx, &pb.UpsertGitServerRequest{Server: org3})
+				_, err := service.UpsertGitServer(ctx, pb.UpsertGitServerRequest_builder{Server: org3}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			},
 		},
@@ -178,7 +178,7 @@ func TestServiceAccess(t *testing.T) {
 				allowVerbs: []string{types.VerbCreate, types.VerbUpdate},
 			},
 			run: func(t *testing.T, service *Service) {
-				_, err := service.UpsertGitServer(ctx, &pb.UpsertGitServerRequest{Server: org3})
+				_, err := service.UpsertGitServer(ctx, pb.UpsertGitServerRequest_builder{Server: org3}.Build())
 				require.NoError(t, err)
 			},
 		},
@@ -186,7 +186,7 @@ func TestServiceAccess(t *testing.T) {
 			name:    "delete verb not allowed",
 			checker: &fakeAccessChecker{ /*nothing allowed*/ },
 			run: func(t *testing.T, service *Service) {
-				_, err := service.DeleteGitServer(ctx, &pb.DeleteGitServerRequest{Name: org1.GetName()})
+				_, err := service.DeleteGitServer(ctx, pb.DeleteGitServerRequest_builder{Name: org1.GetName()}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			},
 		},
@@ -196,7 +196,7 @@ func TestServiceAccess(t *testing.T) {
 				allowVerbs: []string{types.VerbDelete},
 			},
 			run: func(t *testing.T, service *Service) {
-				_, err := service.DeleteGitServer(ctx, &pb.DeleteGitServerRequest{Name: org1.GetName()})
+				_, err := service.DeleteGitServer(ctx, pb.DeleteGitServerRequest_builder{Name: org1.GetName()}.Build())
 				require.NoError(t, err)
 			},
 		},
@@ -207,10 +207,10 @@ func TestServiceAccess(t *testing.T) {
 				allowResource: true,
 			},
 			run: func(t *testing.T, service *Service) {
-				_, err := service.CreateGitHubAuthRequest(ctx, &pb.CreateGitHubAuthRequestRequest{
+				_, err := service.CreateGitHubAuthRequest(ctx, pb.CreateGitHubAuthRequestRequest_builder{
 					Request:      &types.GithubAuthRequest{},
 					Organization: org1.GetGitHub().Organization,
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 		},
@@ -220,10 +220,10 @@ func TestServiceAccess(t *testing.T) {
 				allowVerbs: []string{types.VerbRead, types.VerbList},
 			},
 			run: func(t *testing.T, service *Service) {
-				_, err := service.CreateGitHubAuthRequest(ctx, &pb.CreateGitHubAuthRequestRequest{
+				_, err := service.CreateGitHubAuthRequest(ctx, pb.CreateGitHubAuthRequestRequest_builder{
 					Request:      &types.GithubAuthRequest{},
 					Organization: org1.GetGitHub().Organization,
-				})
+				}.Build())
 				// Getting NotFound instead of AccessDenied.
 				require.True(t, trace.IsNotFound(err))
 			},
diff --git a/lib/auth/grpcclientconfig/grpcclientconfigv1/service.go b/lib/auth/grpcclientconfig/grpcclientconfigv1/service.go
index 3444e293b16..1408c3d5173 100644
--- a/lib/auth/grpcclientconfig/grpcclientconfigv1/service.go
+++ b/lib/auth/grpcclientconfig/grpcclientconfigv1/service.go
@@ -61,7 +61,7 @@ type Service struct {
 // GetServiceConfig handles requests for fetching the service config configured
 // on this server.
 func (s *Service) GetServiceConfig(ctx context.Context, req *grpcv1.GetServiceConfigRequest) (*grpcv1.GetServiceConfigResponse, error) {
-	return &grpcv1.GetServiceConfigResponse{
+	return grpcv1.GetServiceConfigResponse_builder{
 		Config: s.config,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/auth/grpcclientconfig/grpcclientconfigv1/service_test.go b/lib/auth/grpcclientconfig/grpcclientconfigv1/service_test.go
index dd715b26842..e1b593357b3 100644
--- a/lib/auth/grpcclientconfig/grpcclientconfigv1/service_test.go
+++ b/lib/auth/grpcclientconfig/grpcclientconfigv1/service_test.go
@@ -45,18 +45,16 @@ func TestGetServiceConfigEnvVar(t *testing.T) {
 		{
 			name: "custom service config envvar",
 			env:  ptr(`{"loadBalancingConfig": [{"teleport_pick_healthy": {"mode": "MODE_RECONNECT"}}], "healthCheckConfig":{"serviceName": "test"}}`),
-			expected: &grpcv1.ServiceConfig{
-				LoadBalancingConfig: []*grpcv1.LoadBalancerConfig{{
-					Config: &grpcv1.LoadBalancerConfig_TeleportPickHealthy{
-						TeleportPickHealthy: &grpcv1.TeleportPickHealthyConfig{
-							Mode: grpcv1.Mode_MODE_RECONNECT,
-						},
-					},
-				}},
-				HealthCheckConfig: &grpcv1.HealthCheckConfig{
+			expected: grpcv1.ServiceConfig_builder{
+				LoadBalancingConfig: []*grpcv1.LoadBalancerConfig{grpcv1.LoadBalancerConfig_builder{
+					TeleportPickHealthy: grpcv1.TeleportPickHealthyConfig_builder{
+						Mode: grpcv1.Mode_MODE_RECONNECT,
+					}.Build(),
+				}.Build()},
+				HealthCheckConfig: grpcv1.HealthCheckConfig_builder{
 					ServiceName: ptr("test"),
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/lib/auth/grpcserver.go b/lib/auth/grpcserver.go
index 83cf07a5a08..9e2c18414d4 100644
--- a/lib/auth/grpcserver.go
+++ b/lib/auth/grpcserver.go
@@ -922,7 +922,7 @@ func (g *GRPCServer) InventoryControlStream(stream authpb.AuthService_InventoryC
 	// services that currently use ics for heartbeats are registered in the icsServiceToMetricName
 	// mapping for translation.
 	var metricServices []string
-	for _, service := range hello.Services {
+	for _, service := range hello.GetServices() {
 		if name, ok := icsServiceToMetricName[types.SystemRole(service)]; ok {
 			metricServices = append(metricServices, name)
 		}
@@ -3814,7 +3814,7 @@ func (g *GRPCServer) ListAuthServers(ctx context.Context, req *presencev1pb.List
 		return nil, trace.Wrap(err)
 	}
 
-	servers, next, err := auth.ListAuthServers(ctx, int(req.PageSize), req.PageToken)
+	servers, next, err := auth.ListAuthServers(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3828,10 +3828,10 @@ func (g *GRPCServer) ListAuthServers(ctx context.Context, req *presencev1pb.List
 		serverV2s = append(serverV2s, srv)
 	}
 
-	return &presencev1pb.ListAuthServersResponse{
+	return presencev1pb.ListAuthServersResponse_builder{
 		Servers:       serverV2s,
 		NextPageToken: next,
-	}, nil
+	}.Build(), nil
 }
 
 // ListProxyServers returns a paginated list of proxy servers.
@@ -3841,7 +3841,7 @@ func (g *GRPCServer) ListProxyServers(ctx context.Context, req *presencev1pb.Lis
 		return nil, trace.Wrap(err)
 	}
 
-	servers, next, err := auth.ListProxyServers(ctx, int(req.PageSize), req.PageToken)
+	servers, next, err := auth.ListProxyServers(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -3855,10 +3855,10 @@ func (g *GRPCServer) ListProxyServers(ctx context.Context, req *presencev1pb.Lis
 		serverV2s = append(serverV2s, srv)
 	}
 
-	return &presencev1pb.ListProxyServersResponse{
+	return presencev1pb.ListProxyServersResponse_builder{
 		Servers:       serverV2s,
 		NextPageToken: next,
-	}, nil
+	}.Build(), nil
 }
 
 // GetNode retrieves a node by name and namespace.
@@ -6874,22 +6874,22 @@ func (g *GRPCServer) GetUnstructuredEvents(ctx context.Context, req *auditlogpb.
 	rawEvents, lastkey, err := auth.ServerWithRoles.SearchUnstructuredEvents(
 		ctx,
 		events.SearchEventsRequest{
-			From:       req.StartDate.AsTime(),
-			To:         req.EndDate.AsTime(),
-			EventTypes: req.EventTypes,
-			Limit:      int(req.Limit),
-			Order:      types.EventOrder(req.Order),
-			StartKey:   req.StartKey,
+			From:       req.GetStartDate().AsTime(),
+			To:         req.GetEndDate().AsTime(),
+			EventTypes: req.GetEventTypes(),
+			Limit:      int(req.GetLimit()),
+			Order:      types.EventOrder(req.GetOrder()),
+			StartKey:   req.GetStartKey(),
 		},
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &auditlogpb.EventsUnstructured{
+	return auditlogpb.EventsUnstructured_builder{
 		Items:   rawEvents,
 		LastKey: lastkey,
-	}, nil
+	}.Build(), nil
 }
 
 // ExportUnstructuredEvents exports events from a given event chunk returned by GetEventExportChunks. This API prioritizes
@@ -6939,7 +6939,7 @@ func (g *GRPCServer) StreamUnstructuredSessionEvents(req *auditlogpb.StreamUnstr
 		return trace.Wrap(err)
 	}
 
-	c, e := auth.ServerWithRoles.StreamSessionEvents(stream.Context(), session.ID(req.SessionId), int64(req.StartIndex))
+	c, e := auth.ServerWithRoles.StreamSessionEvents(stream.Context(), session.ID(req.GetSessionId()), int64(req.GetStartIndex()))
 
 	for {
 		select {
diff --git a/lib/auth/grpcserver_test.go b/lib/auth/grpcserver_test.go
index 88846434ea1..923131e1fa8 100644
--- a/lib/auth/grpcserver_test.go
+++ b/lib/auth/grpcserver_test.go
@@ -3260,11 +3260,11 @@ func TestInstanceCertAndControlStream(t *testing.T) {
 	require.NoError(t, err)
 	defer stream.Close()
 
-	err = stream.Send(ctx, &proto.UpstreamInventoryHello{
+	err = stream.Send(ctx, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles(roles).StringSlice(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	select {
@@ -3298,9 +3298,9 @@ func TestInstanceCertAndControlStream(t *testing.T) {
 	case msg := <-stream.Recv():
 		ping, ok := msg.(*proto.DownstreamInventoryPing)
 		require.True(t, ok)
-		err = stream.Send(ctx, &proto.UpstreamInventoryPong{
-			ID: ping.ID,
-		})
+		err = stream.Send(ctx, proto.UpstreamInventoryPong_builder{
+			ID: ping.GetID(),
+		}.Build())
 		require.NoError(t, err)
 	case <-time.After(time.Second * 5):
 		t.Fatalf("timeout waiting for downstream ping")
@@ -5417,14 +5417,14 @@ func TestGRPCServer_GetInstallers(t *testing.T) {
 
 			if tc.hasAgentRollout {
 				rollout, err := autoupdate.NewAutoUpdateAgentRollout(
-					&autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+					autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 						StartVersion:              "1.2.3",
 						TargetVersion:             "1.2.4",
 						Schedule:                  autoupdate.AgentsScheduleImmediate,
 						AutoupdateMode:            autoupdate.AgentsUpdateModeEnabled,
 						Strategy:                  autoupdate.AgentsStrategyTimeBased,
 						MaintenanceWindowDuration: durationpb.New(1 * time.Hour),
-					})
+					}.Build())
 				require.NoError(t, err)
 				_, err = grpc.AuthServer.CreateAutoUpdateAgentRollout(ctx, rollout)
 				require.NoError(t, err)
@@ -5949,12 +5949,12 @@ func TestGetAccessGraphConfig(t *testing.T) {
 	)
 	user, _, err := authtest.CreateUserAndRole(server.Auth(), "test", []string{"role"}, nil)
 	require.NoError(t, err)
-	positiveResponse := &clusterconfigpb.AccessGraphConfig{
+	positiveResponse := clusterconfigpb.AccessGraphConfig_builder{
 		Enabled:           true,
 		Ca:                []byte("ca"),
 		Address:           "addr",
 		SecretsScanConfig: &clusterconfigpb.AccessGraphSecretsScanConfiguration{},
-	}
+	}.Build()
 
 	tests := []struct {
 		desc      string
@@ -6009,10 +6009,10 @@ func TestGetVnetConfig(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create newConfig.
-	newConfig, err := vnet.NewVnetConfig(&vnetv1pb.VnetConfigSpec{
+	newConfig, err := vnet.NewVnetConfig(vnetv1pb.VnetConfigSpec_builder{
 		Ipv4CidrRange:  vnet.DefaultIPv4CIDRRange,
-		CustomDnsZones: []*vnetv1pb.CustomDNSZone{{Suffix: "example.com"}},
-	})
+		CustomDnsZones: []*vnetv1pb.CustomDNSZone{vnetv1pb.CustomDNSZone_builder{Suffix: "example.com"}.Build()},
+	}.Build())
 	require.NoError(t, err)
 	createdConfig, err := server.Auth().CreateVnetConfig(t.Context(), newConfig)
 	require.NoError(t, err)
@@ -7074,55 +7074,55 @@ func TestGenerateUserCertsScopedBot(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			ctx := t.Context()
-			bot, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
-				Bot: &machineidv1.Bot{
+			bot, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1.CreateBotRequest_builder{
+				Bot: machineidv1.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: c.botName,
-					},
+					}.Build(),
 					Scope: c.scope,
 					Spec:  &machineidv1.BotSpec{},
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
 			ident := authtest.TestBot(c.botName, c.internal)
 			if c.scope != "" {
 				scopedSvc := adminClient.ScopedAccessServiceClient()
-				roleResp, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-					Role: &scopedaccessv1.ScopedRole{
+				roleResp, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+					Role: scopedaccessv1.ScopedRole_builder{
 						Kind:    scopedaccess.KindScopedRole,
 						Version: types.V1,
-						Metadata: &headerv1.Metadata{
+						Metadata: headerv1.Metadata_builder{
 							Name: c.botName + "-role",
-						},
+						}.Build(),
 						Scope: c.scope,
-						Spec: &scopedaccessv1.ScopedRoleSpec{
+						Spec: scopedaccessv1.ScopedRoleSpec_builder{
 							AssignableScopes: []string{c.scope},
-						},
-					},
-				})
+						}.Build(),
+					}.Build(),
+				}.Build())
 				require.NoError(t, err)
 
-				sra, err := testServer.Auth().ScopedAccess().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-					Assignment: &scopedaccessv1.ScopedRoleAssignment{
+				sra, err := testServer.Auth().ScopedAccess().CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+					Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 						Kind:    scopedaccess.KindScopedRoleAssignment,
 						SubKind: scopedaccess.SubKindDynamic,
 						Version: types.V1,
-						Metadata: &headerv1.Metadata{
+						Metadata: headerv1.Metadata_builder{
 							Name: uuid.NewString(),
-						},
+						}.Build(),
 						Scope: c.scope,
-						Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+						Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 							BotName:  bot.GetMetadata().GetName(),
 							BotScope: c.scope,
 							Assignments: []*scopedaccessv1.Assignment{
-								{Role: roleResp.GetRole().GetMetadata().GetName(), Scope: c.scope},
+								scopedaccessv1.Assignment_builder{Role: roleResp.GetRole().GetMetadata().GetName(), Scope: c.scope}.Build(),
 							},
-						},
-					},
-				})
+						}.Build(),
+					}.Build(),
+				}.Build())
 				require.NoError(t, err)
 
 				waitForSRACache(t, testServer, sra)
diff --git a/lib/auth/healthcheckconfig/healthcheckconfigv1/service.go b/lib/auth/healthcheckconfig/healthcheckconfigv1/service.go
index be6bd5485bb..b15bc88a9da 100644
--- a/lib/auth/healthcheckconfig/healthcheckconfigv1/service.go
+++ b/lib/auth/healthcheckconfig/healthcheckconfigv1/service.go
@@ -117,10 +117,10 @@ func (s *Service) ListHealthCheckConfigs(ctx context.Context, req *healthcheckco
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &healthcheckconfigv1.ListHealthCheckConfigsResponse{
+	return healthcheckconfigv1.ListHealthCheckConfigsResponse_builder{
 		Configs:       page,
 		NextPageToken: token,
-	}, nil
+	}.Build(), nil
 }
 
 // UpdateHealthCheckConfig updates an existing HealthCheckConfig.
diff --git a/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go b/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go
index 381da2a9fa0..69f9c379744 100644
--- a/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go
+++ b/lib/auth/healthcheckconfig/healthcheckconfigv1/service_test.go
@@ -67,9 +67,9 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 		{
 			name: "CreateHealthCheckConfig",
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
-				_, err := clt.ServiceUnderTest.CreateHealthCheckConfig(ctx, &healthcheckconfigv1.CreateHealthCheckConfigRequest{
+				_, err := clt.ServiceUnderTest.CreateHealthCheckConfig(ctx, healthcheckconfigv1.CreateHealthCheckConfigRequest_builder{
 					Config: newResource(t),
-				})
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{healthCheckConfigRule(types.VerbCreate)},
@@ -82,9 +82,9 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 				cfg1 := newResource(t)
 				_, err := clt.CreateHealthCheckConfig(ctx, cfg1)
 				require.NoError(t, err)
-				_, err = clt.ServiceUnderTest.GetHealthCheckConfig(ctx, &healthcheckconfigv1.GetHealthCheckConfigRequest{
-					Name: cfg1.Metadata.GetName(),
-				})
+				_, err = clt.ServiceUnderTest.GetHealthCheckConfig(ctx, healthcheckconfigv1.GetHealthCheckConfigRequest_builder{
+					Name: cfg1.GetMetadata().GetName(),
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{healthCheckConfigRule(types.VerbRead)},
@@ -99,7 +99,7 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 				resp, err := clt.ServiceUnderTest.ListHealthCheckConfigs(ctx, &healthcheckconfigv1.ListHealthCheckConfigsRequest{})
 				if err == nil {
 					require.NotNil(t, resp)
-					require.Len(t, resp.Configs, 2+teleport.VirtualDefaultHealthCheckConfigCount,
+					require.Len(t, resp.GetConfigs(), 2+teleport.VirtualDefaultHealthCheckConfigCount,
 						"expected 2 inserted and virtual defaults")
 				}
 				return err
@@ -112,13 +112,13 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
 				cfg, err := clt.CreateHealthCheckConfig(ctx, newResource(t))
 				require.NoError(t, err)
-				cfg.Spec.HealthyThreshold = 3
-				cfg, err = clt.ServiceUnderTest.UpdateHealthCheckConfig(ctx, &healthcheckconfigv1.UpdateHealthCheckConfigRequest{
+				cfg.GetSpec().SetHealthyThreshold(3)
+				cfg, err = clt.ServiceUnderTest.UpdateHealthCheckConfig(ctx, healthcheckconfigv1.UpdateHealthCheckConfigRequest_builder{
 					Config: cfg,
-				})
+				}.Build())
 				if err == nil {
 					require.NotNil(t, cfg, "the updated resource should be returned")
-					require.Equal(t, 3, int(cfg.Spec.HealthyThreshold), "the resource should have been updated")
+					require.Equal(t, 3, int(cfg.GetSpec().GetHealthyThreshold()), "the resource should have been updated")
 				}
 				return err
 			},
@@ -129,9 +129,9 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 			name: "UpsertHealthCheckConfig",
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
 				cfg := newResource(t)
-				_, err := clt.ServiceUnderTest.UpsertHealthCheckConfig(ctx, &healthcheckconfigv1.UpsertHealthCheckConfigRequest{
+				_, err := clt.ServiceUnderTest.UpsertHealthCheckConfig(ctx, healthcheckconfigv1.UpsertHealthCheckConfigRequest_builder{
 					Config: cfg,
-				})
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{healthCheckConfigRule(types.VerbCreate, types.VerbUpdate)},
@@ -143,9 +143,9 @@ func TestHealthCheckConfigCRUD(t *testing.T) {
 			actionFn: func(t *testing.T, ctx context.Context, clt testClient) error {
 				cfg, err := clt.CreateHealthCheckConfig(ctx, newResource(t))
 				require.NoError(t, err)
-				_, err = clt.ServiceUnderTest.DeleteHealthCheckConfig(ctx, &healthcheckconfigv1.DeleteHealthCheckConfigRequest{
-					Name: cfg.Metadata.GetName(),
-				})
+				_, err = clt.ServiceUnderTest.DeleteHealthCheckConfig(ctx, healthcheckconfigv1.DeleteHealthCheckConfigRequest_builder{
+					Name: cfg.GetMetadata().GetName(),
+				}.Build())
 				return err
 			},
 			requiredAccessRules: []types.Rule{healthCheckConfigRule(types.VerbDelete)},
@@ -219,14 +219,14 @@ func (c *accessTest) run(t *testing.T) {
 func newResource(t *testing.T) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	r, err := healthcheckconfig.NewHealthCheckConfig(uuid.NewString(),
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
-				DbLabels: []*labelv1.Label{{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   "*",
 					Values: []string{"*"},
-				}},
-			},
-		},
+				}.Build()},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	return r
diff --git a/lib/auth/init.go b/lib/auth/init.go
index 12ebcacd62d..92f7a5a31a5 100644
--- a/lib/auth/init.go
+++ b/lib/auth/init.go
@@ -1313,9 +1313,9 @@ func initializeAccessGraphSettings(ctx context.Context, asrv *Server) error {
 		return nil
 	}
 
-	stored, err = clusterconfig.NewAccessGraphSettings(&clusterconfigpb.AccessGraphSettingsSpec{
+	stored, err = clusterconfig.NewAccessGraphSettings(clusterconfigpb.AccessGraphSettingsSpec_builder{
 		SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/auth/init_test.go b/lib/auth/init_test.go
index 1579be3c130..62a2f7861d6 100644
--- a/lib/auth/init_test.go
+++ b/lib/auth/init_test.go
@@ -1758,7 +1758,7 @@ func TestInit_bootstrap(t *testing.T) {
 				cfg.BootstrapResources = append(
 					cfg.BootstrapResources,
 					newHealthCheckConfig(t, func(hcc *healthcheckconfigv1.HealthCheckConfig) {
-						hcc.Spec.HealthyThreshold = 9000
+						hcc.GetSpec().SetHealthyThreshold(9000)
 					}),
 				)
 			},
@@ -2478,9 +2478,9 @@ func TestTeleportProcessAuthVersionUpgradeCheck(t *testing.T) {
 			if test.initialVersion != "" {
 				ver, err := semver.NewVersion(test.initialVersion)
 				require.NoError(t, err)
-				backendInfo, err := backendinfo.NewBackendInfo(&backendinfov1.BackendInfoSpec{
+				backendInfo, err := backendinfo.NewBackendInfo(backendinfov1.BackendInfoSpec_builder{
 					TeleportVersion: ver.String(),
-				})
+				}.Build())
 				require.NoError(t, err)
 				_, err = service.CreateBackendInfo(ctx, backendInfo)
 				require.NoError(t, err)
@@ -2533,21 +2533,21 @@ func Test_createPresetDatabaseObjectImportRule(t *testing.T) {
 	presetRule := databaseobjectimportrule.NewPresetImportAllObjectsRule()
 	require.NotNil(t, presetRule)
 
-	customRule, err := databaseobjectimportrule.NewDatabaseObjectImportRule("dev_rule", &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+	customRule, err := databaseobjectimportrule.NewDatabaseObjectImportRule("dev_rule", dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 		Priority:       100,
 		DatabaseLabels: label.FromMap(map[string][]string{"env": {"dev"}}),
-		Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{{
-			Match: &dbobjectimportrulev1.DatabaseObjectImportMatch{
+		Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{dbobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+			Match: dbobjectimportrulev1.DatabaseObjectImportMatch_builder{
 				TableNames: []string{"*"},
-			},
+			}.Build(),
 			AddLabels: map[string]string{
 				"env": "dev",
 			},
-			Scope: &dbobjectimportrulev1.DatabaseObjectImportScope{
+			Scope: dbobjectimportrulev1.DatabaseObjectImportScope_builder{
 				SchemaNames: []string{"public"},
-			},
-		}},
-	})
+			}.Build(),
+		}.Build()},
+	}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
diff --git a/lib/auth/integration/integrationv1/awsoidc.go b/lib/auth/integration/integrationv1/awsoidc.go
index 09a1b4ebf33..648fad6adbd 100644
--- a/lib/auth/integration/integrationv1/awsoidc.go
+++ b/lib/auth/integration/integrationv1/awsoidc.go
@@ -49,7 +49,7 @@ func (s *Service) GenerateAWSOIDCToken(ctx context.Context, req *integrationpb.G
 
 	for _, allowedRole := range []types.SystemRole{types.RoleDiscovery, types.RoleAuth, types.RoleProxy} {
 		if authz.HasBuiltinRole(*authCtx, string(allowedRole)) {
-			return s.generateAWSOIDCTokenWithoutAuthZ(ctx, req.Integration)
+			return s.generateAWSOIDCTokenWithoutAuthZ(ctx, req.GetIntegration())
 		}
 	}
 
@@ -74,9 +74,9 @@ func (s *Service) generateAWSOIDCTokenWithoutAuthZ(ctx context.Context, integrat
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.GenerateAWSOIDCTokenResponse{
+	return integrationpb.GenerateAWSOIDCTokenResponse_builder{
 		Token: token,
-	}, nil
+	}.Build(), nil
 }
 
 // AWSOIDCServiceConfig holds configuration options for the AWSOIDC Integration gRPC service.
@@ -272,9 +272,9 @@ func NewAWSOIDCService(cfg *AWSOIDCServiceConfig) (*AWSOIDCService, error) {
 var _ integrationpb.AWSOIDCServiceServer = (*AWSOIDCService)(nil)
 
 func (s *AWSOIDCService) roleARNForIntegration(ctx context.Context, integrationName string) (string, error) {
-	integration, err := s.integrationService.GetIntegration(ctx, &integrationpb.GetIntegrationRequest{
+	integration, err := s.integrationService.GetIntegration(ctx, integrationpb.GetIntegrationRequest_builder{
 		Name: integrationName,
-	})
+	}.Build())
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
@@ -297,7 +297,7 @@ func (s *AWSOIDCService) awsClientReqWithARN(ctx context.Context, integrationNam
 	}
 
 	return &awsoidc.AWSClientRequest{
-		Token:   token.Token,
+		Token:   token.GetToken(),
 		RoleARN: arn,
 		Region:  region,
 	}, nil
@@ -326,7 +326,7 @@ func (s *AWSOIDCService) ListEICE(ctx context.Context, req *integrationpb.ListEI
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -337,9 +337,9 @@ func (s *AWSOIDCService) ListEICE(ctx context.Context, req *integrationpb.ListEI
 	}
 
 	listResp, err := awsoidc.ListEC2ICE(ctx, listClient, awsoidc.ListEC2ICERequest{
-		Region:    req.Region,
-		VPCIDs:    req.VpcIds,
-		NextToken: req.NextToken,
+		Region:    req.GetRegion(),
+		VPCIDs:    req.GetVpcIds(),
+		NextToken: req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -347,21 +347,21 @@ func (s *AWSOIDCService) ListEICE(ctx context.Context, req *integrationpb.ListEI
 
 	eiceList := make([]*integrationpb.EC2InstanceConnectEndpoint, 0, len(listResp.EC2ICEs))
 	for _, e := range listResp.EC2ICEs {
-		eiceList = append(eiceList, &integrationpb.EC2InstanceConnectEndpoint{
+		eiceList = append(eiceList, integrationpb.EC2InstanceConnectEndpoint_builder{
 			Name:          e.Name,
 			State:         e.State,
 			StateMessage:  e.StateMessage,
 			DashboardLink: e.DashboardLink,
 			SubnetId:      e.SubnetID,
 			VpcId:         e.VPCID,
-		})
+		}.Build())
 	}
 
-	return &integrationpb.ListEICEResponse{
+	return integrationpb.ListEICEResponse_builder{
 		NextToken:     listResp.NextToken,
 		Ec2Ices:       eiceList,
 		DashboardLink: listResp.DashboardLink,
-	}, nil
+	}.Build(), nil
 }
 
 // CreateEICE creates multiple EC2 Instance Connect Endpoint using the provided Subnets and Security Group IDs.
@@ -377,7 +377,7 @@ func (s *AWSOIDCService) CreateEICE(ctx context.Context, req *integrationpb.Crea
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -392,18 +392,18 @@ func (s *AWSOIDCService) CreateEICE(ctx context.Context, req *integrationpb.Crea
 		return nil, trace.Wrap(err)
 	}
 
-	endpoints := make([]awsoidc.EC2ICEEndpoint, 0, len(req.Endpoints))
-	for _, endpoint := range req.Endpoints {
+	endpoints := make([]awsoidc.EC2ICEEndpoint, 0, len(req.GetEndpoints()))
+	for _, endpoint := range req.GetEndpoints() {
 		endpoints = append(endpoints, awsoidc.EC2ICEEndpoint{
-			Name:             endpoint.Name,
-			SubnetID:         endpoint.SubnetId,
-			SecurityGroupIDs: endpoint.SecurityGroupIds,
+			Name:             endpoint.GetName(),
+			SubnetID:         endpoint.GetSubnetId(),
+			SecurityGroupIDs: endpoint.GetSecurityGroupIds(),
 		})
 	}
 
 	createResp, err := awsoidc.CreateEC2ICE(ctx, createClient, awsoidc.CreateEC2ICERequest{
 		Cluster:         clusterName.GetClusterName(),
-		IntegrationName: req.Integration,
+		IntegrationName: req.GetIntegration(),
 		Endpoints:       endpoints,
 	})
 	if err != nil {
@@ -412,17 +412,17 @@ func (s *AWSOIDCService) CreateEICE(ctx context.Context, req *integrationpb.Crea
 
 	eiceList := make([]*integrationpb.EC2ICEndpoint, 0, len(createResp.CreatedEndpoints))
 	for _, e := range createResp.CreatedEndpoints {
-		eiceList = append(eiceList, &integrationpb.EC2ICEndpoint{
+		eiceList = append(eiceList, integrationpb.EC2ICEndpoint_builder{
 			Name:             e.Name,
 			SubnetId:         e.SubnetID,
 			SecurityGroupIds: e.SecurityGroupIDs,
-		})
+		}.Build())
 	}
 
-	return &integrationpb.CreateEICEResponse{
+	return integrationpb.CreateEICEResponse_builder{
 		Name:             createResp.Name,
 		CreatedEndpoints: eiceList,
-	}, nil
+	}.Build(), nil
 }
 
 // ListDatabases returns a paginated list of Databases.
@@ -436,7 +436,7 @@ func (s *AWSOIDCService) ListDatabases(ctx context.Context, req *integrationpb.L
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -447,11 +447,11 @@ func (s *AWSOIDCService) ListDatabases(ctx context.Context, req *integrationpb.L
 	}
 
 	listDBsResp, err := awsoidc.ListDatabases(ctx, listDBsClient, s.logger, awsoidc.ListDatabasesRequest{
-		Region:    req.Region,
-		RDSType:   req.RdsType,
-		Engines:   req.Engines,
-		NextToken: req.NextToken,
-		VpcId:     req.VpcId,
+		Region:    req.GetRegion(),
+		RDSType:   req.GetRdsType(),
+		Engines:   req.GetEngines(),
+		NextToken: req.GetNextToken(),
+		VpcId:     req.GetVpcId(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -471,10 +471,10 @@ func (s *AWSOIDCService) ListDatabases(ctx context.Context, req *integrationpb.L
 		dbList = append(dbList, dbV3)
 	}
 
-	return &integrationpb.ListDatabasesResponse{
+	return integrationpb.ListDatabasesResponse_builder{
 		Databases: dbList,
 		NextToken: listDBsResp.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // ListSecurityGroups returns a paginated list of SecurityGroups.
@@ -488,7 +488,7 @@ func (s *AWSOIDCService) ListSecurityGroups(ctx context.Context, req *integratio
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -499,8 +499,8 @@ func (s *AWSOIDCService) ListSecurityGroups(ctx context.Context, req *integratio
 	}
 
 	listSGsResp, err := awsoidc.ListSecurityGroups(ctx, listSGsClient, awsoidc.ListSecurityGroupsRequest{
-		VPCID:     req.VpcId,
-		NextToken: req.NextToken,
+		VPCID:     req.GetVpcId(),
+		NextToken: req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -508,19 +508,19 @@ func (s *AWSOIDCService) ListSecurityGroups(ctx context.Context, req *integratio
 
 	sgList := make([]*integrationpb.SecurityGroup, 0, len(listSGsResp.SecurityGroups))
 	for _, sg := range listSGsResp.SecurityGroups {
-		sgList = append(sgList, &integrationpb.SecurityGroup{
+		sgList = append(sgList, integrationpb.SecurityGroup_builder{
 			Name:          sg.Name,
 			Id:            sg.ID,
 			Description:   sg.Description,
 			InboundRules:  convertSecurityGroupRulesToProto(sg.InboundRules),
 			OutboundRules: convertSecurityGroupRulesToProto(sg.OutboundRules),
-		})
+		}.Build())
 	}
 
-	return &integrationpb.ListSecurityGroupsResponse{
+	return integrationpb.ListSecurityGroupsResponse_builder{
 		SecurityGroups: sgList,
 		NextToken:      listSGsResp.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 func convertSecurityGroupRulesToProto(inRules []awsoidc.SecurityGroupRule) []*integrationpb.SecurityGroupRule {
@@ -531,10 +531,10 @@ func convertSecurityGroupRulesToProto(inRules []awsoidc.SecurityGroupRule) []*in
 			cidrs = make([]*integrationpb.SecurityGroupRuleCIDR, 0, len(r.CIDRs))
 		}
 		for _, cidr := range r.CIDRs {
-			cidrs = append(cidrs, &integrationpb.SecurityGroupRuleCIDR{
+			cidrs = append(cidrs, integrationpb.SecurityGroupRuleCIDR_builder{
 				Cidr:        cidr.CIDR,
 				Description: cidr.Description,
-			})
+			}.Build())
 		}
 
 		var groupIDs []*integrationpb.SecurityGroupRuleGroupID
@@ -542,18 +542,18 @@ func convertSecurityGroupRulesToProto(inRules []awsoidc.SecurityGroupRule) []*in
 			groupIDs = make([]*integrationpb.SecurityGroupRuleGroupID, 0, len(r.Groups))
 		}
 		for _, group := range r.Groups {
-			groupIDs = append(groupIDs, &integrationpb.SecurityGroupRuleGroupID{
+			groupIDs = append(groupIDs, integrationpb.SecurityGroupRuleGroupID_builder{
 				GroupId:     group.GroupId,
 				Description: group.Description,
-			})
+			}.Build())
 		}
-		out = append(out, &integrationpb.SecurityGroupRule{
+		out = append(out, integrationpb.SecurityGroupRule_builder{
 			IpProtocol: r.IPProtocol,
 			FromPort:   int32(r.FromPort),
 			ToPort:     int32(r.ToPort),
 			Cidrs:      cidrs,
 			GroupIds:   groupIDs,
-		})
+		}.Build())
 	}
 	return out
 }
@@ -574,7 +574,7 @@ func (s *AWSOIDCService) DeployDatabaseService(ctx context.Context, req *integra
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -584,34 +584,34 @@ func (s *AWSOIDCService) DeployDatabaseService(ctx context.Context, req *integra
 		return nil, trace.Wrap(err)
 	}
 
-	deployments := make([]awsoidc.DeployDatabaseServiceRequestDeployment, 0, len(req.Deployments))
-	for _, d := range req.Deployments {
+	deployments := make([]awsoidc.DeployDatabaseServiceRequestDeployment, 0, len(req.GetDeployments()))
+	for _, d := range req.GetDeployments() {
 		deployments = append(deployments, awsoidc.DeployDatabaseServiceRequestDeployment{
-			VPCID:               d.VpcId,
-			SubnetIDs:           d.SubnetIds,
-			SecurityGroupIDs:    d.SecurityGroups,
-			DeployServiceConfig: d.TeleportConfigString,
+			VPCID:               d.GetVpcId(),
+			SubnetIDs:           d.GetSubnetIds(),
+			SecurityGroupIDs:    d.GetSecurityGroups(),
+			DeployServiceConfig: d.GetTeleportConfigString(),
 		})
 	}
 
 	deployDBResp, err := awsoidc.DeployDatabaseService(ctx, deployServiceClient, awsoidc.DeployDatabaseServiceRequest{
-		Region:                  req.Region,
-		TaskRoleARN:             req.TaskRoleArn,
-		TeleportVersionTag:      req.TeleportVersion,
-		DeploymentJoinTokenName: req.DeploymentJoinTokenName,
+		Region:                  req.GetRegion(),
+		TaskRoleARN:             req.GetTaskRoleArn(),
+		TeleportVersionTag:      req.GetTeleportVersion(),
+		DeploymentJoinTokenName: req.GetDeploymentJoinTokenName(),
 		Deployments:             deployments,
 		TeleportClusterName:     clusterName.GetClusterName(),
-		IntegrationName:         req.Integration,
+		IntegrationName:         req.GetIntegration(),
 		TeleportBuildType:       s.modules.BuildType(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.DeployDatabaseServiceResponse{
+	return integrationpb.DeployDatabaseServiceResponse_builder{
 		ClusterArn:          deployDBResp.ClusterARN,
 		ClusterDashboardUrl: deployDBResp.ClusterDashboardURL,
-	}, nil
+	}.Build(), nil
 }
 
 // ListDeployedDatabaseServices lists Database Services deployed into Amazon ECS.
@@ -630,7 +630,7 @@ func (s *AWSOIDCService) ListDeployedDatabaseServices(ctx context.Context, req *
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -641,10 +641,10 @@ func (s *AWSOIDCService) ListDeployedDatabaseServices(ctx context.Context, req *
 	}
 
 	listDatabaseServicesResponse, err := awsoidc.ListDeployedDatabaseServices(ctx, listDatabaseServicesClient, awsoidc.ListDeployedDatabaseServicesRequest{
-		Integration:         req.Integration,
+		Integration:         req.GetIntegration(),
 		TeleportClusterName: clusterName.GetClusterName(),
-		Region:              req.Region,
-		NextToken:           req.NextToken,
+		Region:              req.GetRegion(),
+		NextToken:           req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -652,18 +652,18 @@ func (s *AWSOIDCService) ListDeployedDatabaseServices(ctx context.Context, req *
 
 	deployedDatabaseServices := make([]*integrationpb.DeployedDatabaseService, 0, len(listDatabaseServicesResponse.DeployedDatabaseServices))
 	for _, deployedService := range listDatabaseServicesResponse.DeployedDatabaseServices {
-		deployedDatabaseServices = append(deployedDatabaseServices, &integrationpb.DeployedDatabaseService{
+		deployedDatabaseServices = append(deployedDatabaseServices, integrationpb.DeployedDatabaseService_builder{
 			Name:                deployedService.Name,
 			ServiceDashboardUrl: deployedService.ServiceDashboardURL,
 			ContainerEntryPoint: deployedService.ContainerEntryPoint,
 			ContainerCommand:    deployedService.ContainerCommand,
-		})
+		}.Build())
 	}
 
-	return &integrationpb.ListDeployedDatabaseServicesResponse{
+	return integrationpb.ListDeployedDatabaseServicesResponse_builder{
 		DeployedDatabaseServices: deployedDatabaseServices,
 		NextToken:                listDatabaseServicesResponse.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // EnrollEKSClusters enrolls EKS clusters into Teleport by installing teleport-kube-agent chart on the clusters.
@@ -682,7 +682,7 @@ func (s *AWSOIDCService) EnrollEKSClusters(ctx context.Context, req *integration
 		return nil, trace.BadParameter("could not get public proxy address.")
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -699,15 +699,15 @@ func (s *AWSOIDCService) EnrollEKSClusters(ctx context.Context, req *integration
 
 	features := s.modules.Features()
 	enrollmentResponse, err := awsoidc.EnrollEKSClusters(ctx, s.logger, s.clock, publicProxyAddr, enrollEKSClient, awsoidc.EnrollEKSClustersRequest{
-		Region:              req.Region,
+		Region:              req.GetRegion(),
 		ClusterNames:        req.GetEksClusterNames(),
-		EnableAppDiscovery:  req.EnableAppDiscovery,
+		EnableAppDiscovery:  req.GetEnableAppDiscovery(),
 		EnableAutoUpgrades:  features.AutomaticUpgrades,
 		IsCloud:             features.Cloud,
-		AgentVersion:        req.AgentVersion,
+		AgentVersion:        req.GetAgentVersion(),
 		TeleportClusterName: clusterName.GetClusterName(),
-		IntegrationName:     req.Integration,
-		ExtraLabels:         req.ExtraLabels,
+		IntegrationName:     req.GetIntegration(),
+		ExtraLabels:         req.GetExtraLabels(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -715,17 +715,17 @@ func (s *AWSOIDCService) EnrollEKSClusters(ctx context.Context, req *integration
 
 	results := make([]*integrationpb.EnrollEKSClusterResult, 0, len(enrollmentResponse.Results))
 	for _, r := range enrollmentResponse.Results {
-		results = append(results, &integrationpb.EnrollEKSClusterResult{
+		results = append(results, integrationpb.EnrollEKSClusterResult_builder{
 			EksClusterName: r.ClusterName,
 			ResourceId:     r.ResourceId,
 			Error:          trace.UserMessage(r.Error),
 			IssueType:      r.IssueType,
-		})
+		}.Build())
 	}
 
-	return &integrationpb.EnrollEKSClustersResponse{
+	return integrationpb.EnrollEKSClustersResponse_builder{
 		Results: results,
-	}, nil
+	}.Build(), nil
 }
 
 // DeployService deploys Services into Amazon ECS.
@@ -744,7 +744,7 @@ func (s *AWSOIDCService) DeployService(ctx context.Context, req *integrationpb.D
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -755,28 +755,28 @@ func (s *AWSOIDCService) DeployService(ctx context.Context, req *integrationpb.D
 	}
 
 	deployServiceResp, err := awsoidc.DeployService(ctx, deployServiceClient, awsoidc.DeployServiceRequest{
-		DeploymentJoinTokenName: req.DeploymentJoinTokenName,
-		DeploymentMode:          req.DeploymentMode,
-		TeleportConfigString:    req.TeleportConfigString,
-		IntegrationName:         req.Integration,
-		Region:                  req.Region,
-		SecurityGroups:          req.SecurityGroups,
-		SubnetIDs:               req.SubnetIds,
-		TaskRoleARN:             req.TaskRoleArn,
+		DeploymentJoinTokenName: req.GetDeploymentJoinTokenName(),
+		DeploymentMode:          req.GetDeploymentMode(),
+		TeleportConfigString:    req.GetTeleportConfigString(),
+		IntegrationName:         req.GetIntegration(),
+		Region:                  req.GetRegion(),
+		SecurityGroups:          req.GetSecurityGroups(),
+		SubnetIDs:               req.GetSubnetIds(),
+		TaskRoleARN:             req.GetTaskRoleArn(),
 		TeleportClusterName:     clusterName.GetClusterName(),
-		TeleportVersionTag:      req.TeleportVersion,
+		TeleportVersionTag:      req.GetTeleportVersion(),
 		TeleportBuildType:       s.modules.BuildType(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.DeployServiceResponse{
+	return integrationpb.DeployServiceResponse_builder{
 		ClusterArn:          deployServiceResp.ClusterARN,
 		ServiceArn:          deployServiceResp.ServiceARN,
 		TaskDefinitionArn:   deployServiceResp.TaskDefinitionARN,
 		ServiceDashboardUrl: deployServiceResp.ServiceDashboardURL,
-	}, nil
+	}.Build(), nil
 }
 
 // ListEC2 returns a paginated list of AWS EC2 instances.
@@ -792,7 +792,7 @@ func (s *AWSOIDCService) ListEC2(ctx context.Context, req *integrationpb.ListEC2
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -803,9 +803,9 @@ func (s *AWSOIDCService) ListEC2(ctx context.Context, req *integrationpb.ListEC2
 	}
 
 	listEC2Resp, err := awsoidc.ListEC2(ctx, listEC2Client, awsoidc.ListEC2Request{
-		Region:      req.Region,
-		Integration: req.Integration,
-		NextToken:   req.NextToken,
+		Region:      req.GetRegion(),
+		Integration: req.GetIntegration(),
+		NextToken:   req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -825,10 +825,10 @@ func (s *AWSOIDCService) ListEC2(ctx context.Context, req *integrationpb.ListEC2
 		serverList = append(serverList, serverV2)
 	}
 
-	return &integrationpb.ListEC2Response{
+	return integrationpb.ListEC2Response_builder{
 		Servers:   serverList,
 		NextToken: listEC2Resp.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // ListEKSCluster returns a paginated list of AWS EKS Clusters.
@@ -842,7 +842,7 @@ func (s *AWSOIDCService) ListEKSClusters(ctx context.Context, req *integrationpb
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -853,8 +853,8 @@ func (s *AWSOIDCService) ListEKSClusters(ctx context.Context, req *integrationpb
 	}
 
 	listEKSClustersResp, err := awsoidc.ListEKSClusters(ctx, listEKSClustersClient, awsoidc.ListEKSClustersRequest{
-		Region:    req.Region,
-		NextToken: req.NextToken,
+		Region:    req.GetRegion(),
+		NextToken: req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -865,14 +865,14 @@ func (s *AWSOIDCService) ListEKSClusters(ctx context.Context, req *integrationpb
 		clustersList = append(clustersList, convertEKSCluster(cluster))
 	}
 
-	return &integrationpb.ListEKSClustersResponse{
+	return integrationpb.ListEKSClustersResponse_builder{
 		Clusters:  clustersList,
 		NextToken: listEKSClustersResp.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 func convertEKSCluster(clusterService awsoidc.EKSCluster) *integrationpb.EKSCluster {
-	return &integrationpb.EKSCluster{
+	return integrationpb.EKSCluster_builder{
 		Name:                 clusterService.Name,
 		Region:               clusterService.Region,
 		Arn:                  clusterService.Arn,
@@ -881,7 +881,7 @@ func convertEKSCluster(clusterService awsoidc.EKSCluster) *integrationpb.EKSClus
 		Status:               clusterService.Status,
 		EndpointPublicAccess: clusterService.EndpointPublicAccess,
 		AuthenticationMode:   clusterService.AuthenticationMode,
-	}
+	}.Build()
 }
 
 // ListSubnets returns a list of AWS VPC subnets.
@@ -895,7 +895,7 @@ func (s *AWSOIDCService) ListSubnets(ctx context.Context, req *integrationpb.Lis
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -906,8 +906,8 @@ func (s *AWSOIDCService) ListSubnets(ctx context.Context, req *integrationpb.Lis
 	}
 
 	resp, err := awsoidc.ListSubnets(ctx, awsClient, awsoidc.ListSubnetsRequest{
-		VPCID:     req.VpcId,
-		NextToken: req.NextToken,
+		VPCID:     req.GetVpcId(),
+		NextToken: req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -915,17 +915,17 @@ func (s *AWSOIDCService) ListSubnets(ctx context.Context, req *integrationpb.Lis
 
 	subnets := make([]*integrationpb.Subnet, 0, len(resp.Subnets))
 	for _, s := range resp.Subnets {
-		subnets = append(subnets, &integrationpb.Subnet{
+		subnets = append(subnets, integrationpb.Subnet_builder{
 			Name:             s.Name,
 			Id:               s.ID,
 			AvailabilityZone: s.AvailabilityZone,
-		})
+		}.Build())
 	}
 
-	return &integrationpb.ListSubnetsResponse{
+	return integrationpb.ListSubnetsResponse_builder{
 		Subnets:   subnets,
 		NextToken: resp.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // ListVPCs returns a list of AWS VPCs.
@@ -939,7 +939,7 @@ func (s *AWSOIDCService) ListVPCs(ctx context.Context, req *integrationpb.ListVP
 		return nil, trace.Wrap(err)
 	}
 
-	awsClientReq, err := s.awsClientReq(ctx, req.Integration, req.Region)
+	awsClientReq, err := s.awsClientReq(ctx, req.GetIntegration(), req.GetRegion())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -950,7 +950,7 @@ func (s *AWSOIDCService) ListVPCs(ctx context.Context, req *integrationpb.ListVP
 	}
 
 	resp, err := awsoidc.ListVPCs(ctx, awsClient, awsoidc.ListVPCsRequest{
-		NextToken: req.NextToken,
+		NextToken: req.GetNextToken(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -958,16 +958,16 @@ func (s *AWSOIDCService) ListVPCs(ctx context.Context, req *integrationpb.ListVP
 
 	vpcs := make([]*integrationpb.VPC, 0, len(resp.VPCs))
 	for _, s := range resp.VPCs {
-		vpcs = append(vpcs, &integrationpb.VPC{
+		vpcs = append(vpcs, integrationpb.VPC_builder{
 			Name: s.Name,
 			Id:   s.ID,
-		})
+		}.Build())
 	}
 
-	return &integrationpb.ListVPCsResponse{
+	return integrationpb.ListVPCsResponse_builder{
 		Vpcs:      vpcs,
 		NextToken: resp.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // Ping does a health check for an integration.
@@ -984,7 +984,7 @@ func (s *AWSOIDCService) Ping(ctx context.Context, req *integrationpb.PingReques
 	var awsClientReq *awsoidc.AWSClientRequest
 	switch {
 	case req.GetRoleArn() != "":
-		awsClientReq, err = s.awsClientReqWithARN(ctx, req.Integration, awsutils.AWSGlobalRegion, req.GetRoleArn())
+		awsClientReq, err = s.awsClientReqWithARN(ctx, req.GetIntegration(), awsutils.AWSGlobalRegion, req.GetRoleArn())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1007,9 +1007,9 @@ func (s *AWSOIDCService) Ping(ctx context.Context, req *integrationpb.PingReques
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.PingResponse{
+	return integrationpb.PingResponse_builder{
 		AccountId: resp.AccountID,
 		Arn:       resp.ARN,
 		UserId:    resp.UserID,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/auth/integration/integrationv1/awsoidc_test.go b/lib/auth/integration/integrationv1/awsoidc_test.go
index 2ead25f9f94..403ad145233 100644
--- a/lib/auth/integration/integrationv1/awsoidc_test.go
+++ b/lib/auth/integration/integrationv1/awsoidc_test.go
@@ -82,7 +82,7 @@ func TestGenerateAWSOIDCToken(t *testing.T) {
 			}},
 		}, localClient)
 
-		_, err := resourceSvc.GenerateAWSOIDCToken(ctx, &integrationv1.GenerateAWSOIDCTokenRequest{Integration: integrationNameWithoutIssuer})
+		_, err := resourceSvc.GenerateAWSOIDCToken(ctx, integrationv1.GenerateAWSOIDCTokenRequest_builder{Integration: integrationNameWithoutIssuer}.Build())
 		require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %T", err)
 	})
 
@@ -97,7 +97,7 @@ func TestGenerateAWSOIDCToken(t *testing.T) {
 				},
 			})
 
-			_, err := resourceSvc.GenerateAWSOIDCToken(ctx, &integrationv1.GenerateAWSOIDCTokenRequest{Integration: integrationNameWithoutIssuer})
+			_, err := resourceSvc.GenerateAWSOIDCToken(ctx, integrationv1.GenerateAWSOIDCTokenRequest_builder{Integration: integrationNameWithoutIssuer}.Build())
 			require.NoError(t, err)
 		}
 	})
@@ -127,9 +127,9 @@ func TestGenerateAWSOIDCToken(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("with integration in rpc call but no issuer defined", func(t *testing.T) {
-		resp, err := resourceSvc.GenerateAWSOIDCToken(ctx, &integrationv1.GenerateAWSOIDCTokenRequest{
+		resp, err := resourceSvc.GenerateAWSOIDCToken(ctx, integrationv1.GenerateAWSOIDCTokenRequest_builder{
 			Integration: integrationNameWithoutIssuer,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		_, err = key.VerifyAWSOIDC(jwt.AWSOIDCVerifyParams{
@@ -145,9 +145,9 @@ func TestGenerateAWSOIDCToken(t *testing.T) {
 		require.Error(t, err)
 	})
 	t.Run("with integration in rpc call and issuer defined", func(t *testing.T) {
-		resp, err := resourceSvc.GenerateAWSOIDCToken(ctx, &integrationv1.GenerateAWSOIDCTokenRequest{
+		resp, err := resourceSvc.GenerateAWSOIDCToken(ctx, integrationv1.GenerateAWSOIDCTokenRequest_builder{
 			Integration: integrationNameWithIssuer,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		_, err = key.VerifyAWSOIDC(jwt.AWSOIDCVerifyParams{
@@ -181,15 +181,15 @@ func TestConvertSecurityGroupRulesToProto(t *testing.T) {
 					Description: "cidr x",
 				}},
 			}},
-			expected: []*integrationv1.SecurityGroupRule{{
+			expected: []*integrationv1.SecurityGroupRule{integrationv1.SecurityGroupRule_builder{
 				IpProtocol: "tcp",
 				FromPort:   8080,
 				ToPort:     8081,
-				Cidrs: []*integrationv1.SecurityGroupRuleCIDR{{
+				Cidrs: []*integrationv1.SecurityGroupRuleCIDR{integrationv1.SecurityGroupRuleCIDR_builder{
 					Cidr:        "10.10.10.0/24",
 					Description: "cidr x",
-				}},
-			}},
+				}.Build()},
+			}.Build()},
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
@@ -248,76 +248,76 @@ func TestRBAC(t *testing.T) {
 			{
 				name: "ListDatabases",
 				fn: func() error {
-					_, err := awsoidService.ListDatabases(userCtx, &integrationv1.ListDatabasesRequest{
+					_, err := awsoidService.ListDatabases(userCtx, integrationv1.ListDatabasesRequest_builder{
 						Integration: integrationName,
 						Region:      "",
 						RdsType:     "",
 						Engines:     []string{},
 						NextToken:   "",
 						VpcId:       "vpc-123",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "EnrollEKSClusters",
 				fn: func() error {
-					_, err := awsoidService.EnrollEKSClusters(userCtx, &integrationv1.EnrollEKSClustersRequest{
+					_, err := awsoidService.EnrollEKSClusters(userCtx, integrationv1.EnrollEKSClustersRequest_builder{
 						Integration:     integrationName,
 						Region:          "my-region",
 						EksClusterNames: []string{"EKS1"},
 						AgentVersion:    "10.0.0",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "DeployService",
 				fn: func() error {
-					_, err = awsoidService.DeployService(userCtx, &integrationv1.DeployServiceRequest{
+					_, err = awsoidService.DeployService(userCtx, integrationv1.DeployServiceRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "ListSubnets",
 				fn: func() error {
-					_, err := awsoidService.ListSubnets(userCtx, &integrationv1.ListSubnetsRequest{
+					_, err := awsoidService.ListSubnets(userCtx, integrationv1.ListSubnetsRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
 						VpcId:       "vpc-1",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "ListVPCs",
 				fn: func() error {
-					_, err := awsoidService.ListVPCs(userCtx, &integrationv1.ListVPCsRequest{
+					_, err := awsoidService.ListVPCs(userCtx, integrationv1.ListVPCsRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "Ping",
 				fn: func() error {
-					_, err := awsoidService.Ping(userCtx, &integrationv1.PingRequest{
+					_, err := awsoidService.Ping(userCtx, integrationv1.PingRequest_builder{
 						Integration: integrationName,
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "Ping with arn",
 				fn: func() error {
-					_, err := awsoidService.Ping(userCtx, &integrationv1.PingRequest{
+					_, err := awsoidService.Ping(userCtx, integrationv1.PingRequest_builder{
 						Integration: integrationName,
 						RoleArn:     "some-arn",
-					})
+					}.Build())
 					return err
 				},
 			},
@@ -343,57 +343,57 @@ func TestRBAC(t *testing.T) {
 			{
 				name: "ListDatabases",
 				fn: func() error {
-					_, err := awsoidService.ListDatabases(userCtx, &integrationv1.ListDatabasesRequest{
+					_, err := awsoidService.ListDatabases(userCtx, integrationv1.ListDatabasesRequest_builder{
 						Integration: integrationName,
 						Region:      "",
 						RdsType:     "",
 						Engines:     []string{},
 						NextToken:   "",
 						VpcId:       "vpc-123",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "EnrollEKSClusters",
 				fn: func() error {
-					_, err := awsoidService.EnrollEKSClusters(userCtx, &integrationv1.EnrollEKSClustersRequest{
+					_, err := awsoidService.EnrollEKSClusters(userCtx, integrationv1.EnrollEKSClustersRequest_builder{
 						Integration:     integrationName,
 						Region:          "my-region",
 						EksClusterNames: []string{"EKS1"},
 						AgentVersion:    "10.0.0",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "DeployService",
 				fn: func() error {
-					_, err = awsoidService.DeployService(userCtx, &integrationv1.DeployServiceRequest{
+					_, err = awsoidService.DeployService(userCtx, integrationv1.DeployServiceRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "ListSubnets",
 				fn: func() error {
-					_, err := awsoidService.ListSubnets(userCtx, &integrationv1.ListSubnetsRequest{
+					_, err := awsoidService.ListSubnets(userCtx, integrationv1.ListSubnetsRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
 						VpcId:       "vpc-1",
-					})
+					}.Build())
 					return err
 				},
 			},
 			{
 				name: "ListVPCs",
 				fn: func() error {
-					_, err := awsoidService.ListVPCs(userCtx, &integrationv1.ListVPCsRequest{
+					_, err := awsoidService.ListVPCs(userCtx, integrationv1.ListVPCsRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
-					})
+					}.Build())
 					return err
 				},
 			},
@@ -407,10 +407,10 @@ func TestRBAC(t *testing.T) {
 			{
 				name: "ListDeployedDatabaseServices",
 				fn: func() error {
-					_, err := awsoidService.ListDeployedDatabaseServices(userCtx, &integrationv1.ListDeployedDatabaseServicesRequest{
+					_, err := awsoidService.ListDeployedDatabaseServices(userCtx, integrationv1.ListDeployedDatabaseServicesRequest_builder{
 						Integration: integrationName,
 						Region:      "my-region",
-					})
+					}.Build())
 					return err
 				},
 			},
@@ -441,7 +441,7 @@ func TestConvertEKSCluster(t *testing.T) {
 				AuthenticationMode:   "API",
 				EndpointPublicAccess: true,
 			},
-			expected: &integrationv1.EKSCluster{
+			expected: integrationv1.EKSCluster_builder{
 				Name:                 "my-cluster",
 				Region:               "us-east-1",
 				Arn:                  "my-arn",
@@ -450,7 +450,7 @@ func TestConvertEKSCluster(t *testing.T) {
 				Status:               "ACTIVE",
 				AuthenticationMode:   "API",
 				EndpointPublicAccess: true,
-			},
+			}.Build(),
 		},
 	} {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/lib/auth/integration/integrationv1/awsra.go b/lib/auth/integration/integrationv1/awsra.go
index ff12884ea66..bf15a63a836 100644
--- a/lib/auth/integration/integrationv1/awsra.go
+++ b/lib/auth/integration/integrationv1/awsra.go
@@ -85,12 +85,12 @@ func (s *Service) generateAWSRACredentialsWithoutAuthZ(ctx context.Context, req
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.GenerateAWSRACredentialsResponse{
+	return integrationpb.GenerateAWSRACredentialsResponse_builder{
 		AccessKeyId:     awsCredentials.AccessKeyID,
 		SecretAccessKey: awsCredentials.SecretAccessKey,
 		SessionToken:    awsCredentials.SessionToken,
 		Expiration:      timestamppb.New(awsCredentials.Expiration),
-	}, nil
+	}.Build(), nil
 }
 
 func (s *Service) getAWSRolesAnywhereIntegrationSpec(ctx context.Context, integrationName string) (*types.AWSRAIntegrationSpecV1, error) {
@@ -199,12 +199,12 @@ func (s *AWSRolesAnywhereService) ListRolesAnywhereProfiles(ctx context.Context,
 	}
 	trustAnchor := spec.TrustAnchorARN
 
-	credentials, err := s.integrationService.generateAWSRACredentialsWithoutAuthZ(ctx, &integrationpb.GenerateAWSRACredentialsRequest{
+	credentials, err := s.integrationService.generateAWSRACredentialsWithoutAuthZ(ctx, integrationpb.GenerateAWSRACredentialsRequest_builder{
 		ProfileArn:                    spec.ProfileSyncConfig.ProfileARN,
 		RoleArn:                       spec.ProfileSyncConfig.RoleARN,
 		ProfileAcceptsRoleSessionName: spec.ProfileSyncConfig.ProfileAcceptsRoleSessionName,
 		SubjectName:                   authCtx.Identity.GetIdentity().Username,
-	}, trustAnchor)
+	}.Build(), trustAnchor)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -217,10 +217,10 @@ func (s *AWSRolesAnywhereService) ListRolesAnywhereProfiles(ctx context.Context,
 
 	listRolesAnywhereClient, err := awsra.NewListRolesAnywhereProfilesClient(ctx, &awsra.AWSClientConfig{
 		Credentials: awsra.Credentials{
-			AccessKeyID:     credentials.AccessKeyId,
-			SecretAccessKey: credentials.SecretAccessKey,
-			SessionToken:    credentials.SessionToken,
-			Expiration:      credentials.Expiration.AsTime(),
+			AccessKeyID:     credentials.GetAccessKeyId(),
+			SecretAccessKey: credentials.GetSecretAccessKey(),
+			SessionToken:    credentials.GetSessionToken(),
+			Expiration:      credentials.GetExpiration().AsTime(),
 			Version:         1,
 		},
 		Region: trustAnchorRegion,
@@ -239,10 +239,10 @@ func (s *AWSRolesAnywhereService) ListRolesAnywhereProfiles(ctx context.Context,
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.ListRolesAnywhereProfilesResponse{
+	return integrationpb.ListRolesAnywhereProfilesResponse_builder{
 		Profiles:      profileList.Profiles,
 		NextPageToken: profileList.NextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // AWSRolesAnywherePing performs a health check for the AWS Roles Anywhere integration.
@@ -264,8 +264,8 @@ func (s *AWSRolesAnywhereService) AWSRolesAnywherePing(ctx context.Context, req
 
 	var trustAnchorARN, profileARN, roleARN string
 
-	switch req.Mode.(type) {
-	case *integrationpb.AWSRolesAnywherePingRequest_Integration:
+	switch req.WhichMode() {
+	case integrationpb.AWSRolesAnywherePingRequest_Integration_case:
 		spec, err := s.integrationService.getAWSRolesAnywhereIntegrationSpec(ctx, req.GetIntegration())
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -275,7 +275,7 @@ func (s *AWSRolesAnywhereService) AWSRolesAnywherePing(ctx context.Context, req
 		profileARN = spec.ProfileSyncConfig.ProfileARN
 		roleARN = spec.ProfileSyncConfig.RoleARN
 
-	case *integrationpb.AWSRolesAnywherePingRequest_Custom:
+	case integrationpb.AWSRolesAnywherePingRequest_Custom_case:
 		trustAnchorARN = req.GetCustom().GetTrustAnchorArn()
 		profileARN = req.GetCustom().GetProfileArn()
 		roleARN = req.GetCustom().GetRoleArn()
@@ -291,11 +291,11 @@ func (s *AWSRolesAnywhereService) AWSRolesAnywherePing(ctx context.Context, req
 		"role_arn", roleARN,
 	)
 
-	credentialsRequest := &integrationpb.GenerateAWSRACredentialsRequest{
+	credentialsRequest := integrationpb.GenerateAWSRACredentialsRequest_builder{
 		ProfileArn:  profileARN,
 		RoleArn:     roleARN,
 		SubjectName: authCtx.Identity.GetIdentity().Username,
-	}
+	}.Build()
 
 	trustAnchorARNParsed, err := arn.Parse(trustAnchorARN)
 	if err != nil {
@@ -310,10 +310,10 @@ func (s *AWSRolesAnywhereService) AWSRolesAnywherePing(ctx context.Context, req
 
 	pingClient, err := s.newPingClient(ctx, &awsra.AWSClientConfig{
 		Credentials: awsra.Credentials{
-			AccessKeyID:     credentials.AccessKeyId,
-			SecretAccessKey: credentials.SecretAccessKey,
-			SessionToken:    credentials.SessionToken,
-			Expiration:      credentials.Expiration.AsTime(),
+			AccessKeyID:     credentials.GetAccessKeyId(),
+			SecretAccessKey: credentials.GetSecretAccessKey(),
+			SessionToken:    credentials.GetSessionToken(),
+			Expiration:      credentials.GetExpiration().AsTime(),
 			Version:         1,
 		},
 		Region: trustAnchorRegion,
@@ -329,10 +329,10 @@ func (s *AWSRolesAnywhereService) AWSRolesAnywherePing(ctx context.Context, req
 		return nil, trace.Wrap(err)
 	}
 
-	return &integrationpb.AWSRolesAnywherePingResponse{
+	return integrationpb.AWSRolesAnywherePingResponse_builder{
 		ProfileCount: int32(pingResp.EnabledProfileCounter),
 		AccountId:    pingResp.AccountID,
 		Arn:          pingResp.ARN,
 		UserId:       pingResp.UserID,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/auth/integration/integrationv1/awsra_test.go b/lib/auth/integration/integrationv1/awsra_test.go
index f244f0d0e31..63830eb7651 100644
--- a/lib/auth/integration/integrationv1/awsra_test.go
+++ b/lib/auth/integration/integrationv1/awsra_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/sts"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	integrationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/integration/v1"
 	"github.com/gravitational/teleport/api/types"
@@ -68,12 +69,12 @@ func TestGenerateAWSRACredentials(t *testing.T) {
 			}},
 		}, localClient)
 
-		_, err := resourceSvc.GenerateAWSRACredentials(ctx, &integrationv1.GenerateAWSRACredentialsRequest{
+		_, err := resourceSvc.GenerateAWSRACredentials(ctx, integrationv1.GenerateAWSRACredentialsRequest_builder{
 			Integration: integrationName,
 			RoleArn:     "arn:aws:iam::123456789012:role/OpsTeam",
 			ProfileArn:  "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
 			SubjectName: "test",
-		})
+		}.Build())
 		require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %T", err)
 	})
 
@@ -88,13 +89,13 @@ func TestGenerateAWSRACredentials(t *testing.T) {
 				},
 			})
 
-			_, err := resourceSvc.GenerateAWSRACredentials(ctx, &integrationv1.GenerateAWSRACredentialsRequest{
+			_, err := resourceSvc.GenerateAWSRACredentials(ctx, integrationv1.GenerateAWSRACredentialsRequest_builder{
 				Integration:                   integrationName,
 				RoleArn:                       "arn:aws:iam::123456789012:role/OpsTeam",
 				ProfileArn:                    "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
 				ProfileAcceptsRoleSessionName: true,
 				SubjectName:                   "test",
-			})
+			}.Build())
 			require.NoError(t, err)
 		}
 	})
@@ -133,33 +134,33 @@ func TestAWSRolesAnywhereProfileSyncFilters(t *testing.T) {
 
 	t.Run("valid without filters", func(t *testing.T) {
 		ig := integrationWithFilters(t, "integration1", []string{})
-		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+		_, err := resourceSvc.CreateIntegration(ctx, integrationv1.CreateIntegrationRequest_builder{
 			Integration: ig,
-		})
+		}.Build())
 		require.NoError(t, err)
 	})
 
 	t.Run("valid with glob filter", func(t *testing.T) {
 		ig := integrationWithFilters(t, "integration2", []string{"MyTeam-*"})
-		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+		_, err := resourceSvc.CreateIntegration(ctx, integrationv1.CreateIntegrationRequest_builder{
 			Integration: ig,
-		})
+		}.Build())
 		require.NoError(t, err)
 	})
 
 	t.Run("valid with regex filter", func(t *testing.T) {
 		ig := integrationWithFilters(t, "integration3", []string{"^MyTeam-.*$"})
-		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+		_, err := resourceSvc.CreateIntegration(ctx, integrationv1.CreateIntegrationRequest_builder{
 			Integration: ig,
-		})
+		}.Build())
 		require.NoError(t, err)
 	})
 
 	t.Run("invalid with invalid regex", func(t *testing.T) {
 		ig := integrationWithFilters(t, "integration5", []string{`^[invalid-regex{$`})
-		_, err := resourceSvc.CreateIntegration(ctx, &integrationv1.CreateIntegrationRequest{
+		_, err := resourceSvc.CreateIntegration(ctx, integrationv1.CreateIntegrationRequest_builder{
 			Integration: ig,
-		})
+		}.Build())
 		require.Error(t, err)
 	})
 }
@@ -222,31 +223,27 @@ func TestAWSRolesAnywherePing(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("test connection using an integration", func(t *testing.T) {
-		pingResp, err := awsRolesAnywhereService.AWSRolesAnywherePing(ctx, &integrationv1.AWSRolesAnywherePingRequest{
-			Mode: &integrationv1.AWSRolesAnywherePingRequest_Integration{
-				Integration: integrationName,
-			},
-		})
+		pingResp, err := awsRolesAnywhereService.AWSRolesAnywherePing(ctx, integrationv1.AWSRolesAnywherePingRequest_builder{
+			Integration: proto.String(integrationName),
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, pingResp)
-		require.Equal(t, "123456789012", pingResp.AccountId)
-		require.Equal(t, int32(1), pingResp.ProfileCount)
+		require.Equal(t, "123456789012", pingResp.GetAccountId())
+		require.Equal(t, int32(1), pingResp.GetProfileCount())
 	})
 
 	t.Run("test connection using provided trust anchor", func(t *testing.T) {
-		pingResp, err := awsRolesAnywhereService.AWSRolesAnywherePing(ctx, &integrationv1.AWSRolesAnywherePingRequest{
-			Mode: &integrationv1.AWSRolesAnywherePingRequest_Custom{
-				Custom: &integrationv1.AWSRolesAnywherePingRequestWithoutIntegration{
-					TrustAnchorArn: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
-					RoleArn:        "arn:aws:iam::123456789012:role/SyncRole",
-					ProfileArn:     "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
-				},
-			},
-		})
+		pingResp, err := awsRolesAnywhereService.AWSRolesAnywherePing(ctx, integrationv1.AWSRolesAnywherePingRequest_builder{
+			Custom: integrationv1.AWSRolesAnywherePingRequestWithoutIntegration_builder{
+				TrustAnchorArn: "arn:aws:rolesanywhere:eu-west-2:123456789012:trust-anchor/12345678-1234-1234-1234-123456789012",
+				RoleArn:        "arn:aws:iam::123456789012:role/SyncRole",
+				ProfileArn:     "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/12345678-1234-1234-1234-123456789012",
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, pingResp)
-		require.Equal(t, "123456789012", pingResp.AccountId)
-		require.Equal(t, int32(1), pingResp.ProfileCount)
+		require.Equal(t, "123456789012", pingResp.GetAccountId())
+		require.Equal(t, int32(1), pingResp.GetProfileCount())
 	})
 }
 
diff --git a/lib/auth/integration/integrationv1/azureoidc.go b/lib/auth/integration/integrationv1/azureoidc.go
index 0db1fd50e59..fd56fd512d6 100644
--- a/lib/auth/integration/integrationv1/azureoidc.go
+++ b/lib/auth/integration/integrationv1/azureoidc.go
@@ -35,7 +35,7 @@ func (s *Service) GenerateAzureOIDCToken(ctx context.Context, req *integrationpb
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	_, err = s.cache.GetIntegration(ctx, req.Integration)
+	_, err = s.cache.GetIntegration(ctx, req.GetIntegration())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -45,7 +45,7 @@ func (s *Service) GenerateAzureOIDCToken(ctx context.Context, req *integrationpb
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			return &integrationpb.GenerateAzureOIDCTokenResponse{Token: token}, nil
+			return integrationpb.GenerateAzureOIDCTokenResponse_builder{Token: token}.Build(), nil
 		}
 	}
 	return nil, trace.AccessDenied("token generation is only available to auth, proxy or discovery services")
diff --git a/lib/auth/integration/integrationv1/azureoidc_test.go b/lib/auth/integration/integrationv1/azureoidc_test.go
index f235d51538d..e6dab71e142 100644
--- a/lib/auth/integration/integrationv1/azureoidc_test.go
+++ b/lib/auth/integration/integrationv1/azureoidc_test.go
@@ -61,7 +61,7 @@ func TestGenerateAzureOIDCToken(t *testing.T) {
 				{Resources: []string{types.KindIntegration}, Verbs: []string{types.VerbUse}},
 			}},
 		}, localClient)
-		_, err = resourceSvc.GenerateAzureOIDCToken(ctx, &integrationv1.GenerateAzureOIDCTokenRequest{Integration: integrationName})
+		_, err = resourceSvc.GenerateAzureOIDCToken(ctx, integrationv1.GenerateAzureOIDCTokenRequest_builder{Integration: integrationName}.Build())
 		require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %T", err)
 
 		// Auth, Discovery, and Proxy roles should be able to generate Azure OIDC tokens
@@ -75,7 +75,7 @@ func TestGenerateAzureOIDCToken(t *testing.T) {
 				},
 			})
 
-			_, err := resourceSvc.GenerateAzureOIDCToken(ctx, &integrationv1.GenerateAzureOIDCTokenRequest{Integration: integrationName})
+			_, err := resourceSvc.GenerateAzureOIDCToken(ctx, integrationv1.GenerateAzureOIDCTokenRequest_builder{Integration: integrationName}.Build())
 			require.NoError(t, err)
 		}
 	})
@@ -89,9 +89,9 @@ func TestGenerateAzureOIDCToken(t *testing.T) {
 				Username: string(types.RoleDiscovery),
 			},
 		})
-		resp, err := resourceSvc.GenerateAzureOIDCToken(ctx, &integrationv1.GenerateAzureOIDCTokenRequest{
+		resp, err := resourceSvc.GenerateAzureOIDCToken(ctx, integrationv1.GenerateAzureOIDCTokenRequest_builder{
 			Integration: integrationName,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		// Validate JWT against public key
@@ -107,7 +107,7 @@ func TestGenerateAzureOIDCToken(t *testing.T) {
 		require.NoError(t, err)
 
 		// Verify the Azure token using the JWT
-		_, err = key.VerifyAzureToken(resp.Token)
+		_, err = key.VerifyAzureToken(resp.GetToken())
 		require.NoError(t, err)
 	})
 }
diff --git a/lib/auth/integration/integrationv1/credentials.go b/lib/auth/integration/integrationv1/credentials.go
index 9d63b7b7dce..f611b2f18cd 100644
--- a/lib/auth/integration/integrationv1/credentials.go
+++ b/lib/auth/integration/integrationv1/credentials.go
@@ -39,7 +39,7 @@ func (s *Service) ExportIntegrationCertAuthorities(ctx context.Context, in *inte
 	if err := authCtx.CheckAccessToKind(types.KindIntegration, types.VerbRead); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	ig, err := s.cache.GetIntegration(ctx, in.Integration)
+	ig, err := s.cache.GetIntegration(ctx, in.GetIntegration())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -51,9 +51,9 @@ func (s *Service) ExportIntegrationCertAuthorities(ctx context.Context, in *inte
 
 	// Currently only public keys are exported.
 	caKeySetWithoutSecrets := caKeySet.WithoutSecrets()
-	return &integrationpb.ExportIntegrationCertAuthoritiesResponse{
+	return integrationpb.ExportIntegrationCertAuthoritiesResponse_builder{
 		CertAuthorities: &caKeySetWithoutSecrets,
-	}, nil
+	}.Build(), nil
 }
 
 func buildGitHubOAuthCredentials(idSecret *types.PluginIdSecretCredential) (*types.PluginStaticCredentialsV1, error) {
diff --git a/lib/auth/integration/integrationv1/credentials_test.go b/lib/auth/integration/integrationv1/credentials_test.go
index bab9e544311..4e59e272ac6 100644
--- a/lib/auth/integration/integrationv1/credentials_test.go
+++ b/lib/auth/integration/integrationv1/credentials_test.go
@@ -52,9 +52,9 @@ func TestExportIntegrationCertAuthorities(t *testing.T) {
 		Username: string(types.RoleAdmin),
 	})
 
-	_, err = resourceSvc.CreateIntegration(adminCtx, &integrationpb.CreateIntegrationRequest{Integration: githubIntegration})
+	_, err = resourceSvc.CreateIntegration(adminCtx, integrationpb.CreateIntegrationRequest_builder{Integration: githubIntegration}.Build())
 	require.NoError(t, err)
-	_, err = resourceSvc.CreateIntegration(adminCtx, &integrationpb.CreateIntegrationRequest{Integration: oidcIntegration})
+	_, err = resourceSvc.CreateIntegration(adminCtx, integrationpb.CreateIntegrationRequest_builder{Integration: oidcIntegration}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -71,11 +71,11 @@ func TestExportIntegrationCertAuthorities(t *testing.T) {
 				t.Helper()
 				require.NoError(t, err)
 				require.NotNil(t, resp)
-				require.NotNil(t, resp.CertAuthorities)
-				require.Len(t, resp.CertAuthorities.SSH, 1)
-				require.NotNil(t, resp.CertAuthorities.SSH[0])
-				assert.NotEmpty(t, resp.CertAuthorities.SSH[0].PublicKey)
-				assert.Empty(t, resp.CertAuthorities.SSH[0].PrivateKey)
+				require.NotNil(t, resp.GetCertAuthorities())
+				require.Len(t, resp.GetCertAuthorities().SSH, 1)
+				require.NotNil(t, resp.GetCertAuthorities().SSH[0])
+				assert.NotEmpty(t, resp.GetCertAuthorities().SSH[0].PublicKey)
+				assert.Empty(t, resp.GetCertAuthorities().SSH[0].PrivateKey)
 			},
 		},
 		{
@@ -115,9 +115,9 @@ func TestExportIntegrationCertAuthorities(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			resp, err := resourceSvc.ExportIntegrationCertAuthorities(test.identity, &integrationpb.ExportIntegrationCertAuthoritiesRequest{
+			resp, err := resourceSvc.ExportIntegrationCertAuthorities(test.identity, integrationpb.ExportIntegrationCertAuthoritiesRequest_builder{
 				Integration: test.integration,
-			})
+			}.Build())
 			test.check(t, resp, err)
 		})
 	}
diff --git a/lib/auth/integration/integrationv1/github.go b/lib/auth/integration/integrationv1/github.go
index e9fcbd1b3b0..a1757e4fb06 100644
--- a/lib/auth/integration/integrationv1/github.go
+++ b/lib/auth/integration/integrationv1/github.go
@@ -46,26 +46,26 @@ func (s *Service) GenerateGitHubUserCert(ctx context.Context, in *integrationpb.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	caSigner, err := s.getGitHubSigner(ctx, in.Integration)
+	caSigner, err := s.getGitHubSigner(ctx, in.GetIntegration())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	if err := cert.SignCert(rand.Reader, caSigner); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &integrationpb.GenerateGitHubUserCertResponse{
+	return integrationpb.GenerateGitHubUserCertResponse_builder{
 		AuthorizedKey: ssh.MarshalAuthorizedKey(cert),
-	}, nil
+	}.Build(), nil
 }
 
 func (s *Service) prepareGitHubCert(in *integrationpb.GenerateGitHubUserCertRequest) (*ssh.Certificate, error) {
-	if in.UserId == "" {
+	if in.GetUserId() == "" {
 		return nil, trace.BadParameter("missing UserId for GenerateGitHubUserCert")
 	}
-	if in.KeyId == "" {
+	if in.GetKeyId() == "" {
 		return nil, trace.BadParameter("missing KeyId for GenerateGitHubUserCert")
 	}
-	key, _, _, _, err := ssh.ParseAuthorizedKey(in.PublicKey)
+	key, _, _, _, err := ssh.ParseAuthorizedKey(in.GetPublicKey())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -75,12 +75,12 @@ func (s *Service) prepareGitHubCert(in *integrationpb.GenerateGitHubUserCertRequ
 	cert := &ssh.Certificate{
 		Key:         key,
 		CertType:    ssh.UserCert,
-		KeyId:       in.KeyId,
+		KeyId:       in.GetKeyId(),
 		ValidAfter:  uint64(now.Add(-time.Minute).Unix()),
-		ValidBefore: uint64(now.Add(in.Ttl.AsDuration()).Unix()),
+		ValidBefore: uint64(now.Add(in.GetTtl().AsDuration()).Unix()),
 		Permissions: ssh.Permissions{
 			Extensions: map[string]string{
-				"id@github.com": in.UserId,
+				"id@github.com": in.GetUserId(),
 			},
 		},
 	}
diff --git a/lib/auth/integration/integrationv1/github_test.go b/lib/auth/integration/integrationv1/github_test.go
index bc576e1e8f6..d10b01d337e 100644
--- a/lib/auth/integration/integrationv1/github_test.go
+++ b/lib/auth/integration/integrationv1/github_test.go
@@ -46,19 +46,19 @@ func TestGenerateGitHubUserCert(t *testing.T) {
 		Role:     types.RoleAdmin,
 		Username: string(types.RoleAdmin),
 	})
-	_, err = resourceSvc.CreateIntegration(adminCtx, &integrationpb.CreateIntegrationRequest{Integration: githubIntegration})
+	_, err = resourceSvc.CreateIntegration(adminCtx, integrationpb.CreateIntegrationRequest_builder{Integration: githubIntegration}.Build())
 	require.NoError(t, err)
 
 	key, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.Ed25519)
 	require.NoError(t, err)
 
-	req := &integrationpb.GenerateGitHubUserCertRequest{
+	req := integrationpb.GenerateGitHubUserCertRequest_builder{
 		Integration: "github-my-org",
 		PublicKey:   key.MarshalSSHPublicKey(),
 		UserId:      "1122334455",
 		KeyId:       "alice",
 		Ttl:         durationpb.New(time.Minute),
-	}
+	}.Build()
 
 	// Admin users cannot generate certs.
 	_, err = resourceSvc.GenerateGitHubUserCert(adminCtx, req)
@@ -71,7 +71,7 @@ func TestGenerateGitHubUserCert(t *testing.T) {
 	})
 	resp, err := resourceSvc.GenerateGitHubUserCert(proxyCtx, req)
 	require.NoError(t, err)
-	authorizedKey, _, _, _, err := ssh.ParseAuthorizedKey(resp.AuthorizedKey)
+	authorizedKey, _, _, _, err := ssh.ParseAuthorizedKey(resp.GetAuthorizedKey())
 	require.NoError(t, err)
 	sshCert, ok := authorizedKey.(*ssh.Certificate)
 	require.True(t, ok)
diff --git a/lib/auth/integration/integrationv1/service.go b/lib/auth/integration/integrationv1/service.go
index 009a45aff53..db563dbf95b 100644
--- a/lib/auth/integration/integrationv1/service.go
+++ b/lib/auth/integration/integrationv1/service.go
@@ -218,10 +218,10 @@ func (s *Service) ListIntegrations(ctx context.Context, req *integrationpb.ListI
 		igs[i] = v1
 	}
 
-	return &integrationpb.ListIntegrationsResponse{
+	return integrationpb.ListIntegrationsResponse_builder{
 		Integrations: igs,
 		NextKey:      nextKey,
-	}, nil
+	}.Build(), nil
 }
 
 // GetIntegration returns the specified Integration resource.
@@ -260,25 +260,25 @@ func (s *Service) CreateIntegration(ctx context.Context, req *integrationpb.Crea
 		return nil, trace.Wrap(err)
 	}
 
-	switch req.Integration.GetSubKind() {
+	switch req.GetIntegration().GetSubKind() {
 	case types.IntegrationSubKindGitHub:
 		if s.modules.BuildType() != modules.BuildEnterprise {
 			return nil, trace.AccessDenied("GitHub integration requires a Teleport Enterprise license")
 		}
-		if err := s.createGitHubCredentials(ctx, req.Integration); err != nil {
+		if err := s.createGitHubCredentials(ctx, req.GetIntegration()); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	case types.IntegrationSubKindAWSOIDC, types.IntegrationSubKindAWSRolesAnywhere:
-		if err := awscommon.ValidIntegrationName(req.Integration.GetName()); err != nil {
+		if err := awscommon.ValidIntegrationName(req.GetIntegration().GetName()); err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		if err := validateAWSRolesAnywhereProfileFilters(req.Integration); err != nil {
+		if err := validateAWSRolesAnywhereProfileFilters(req.GetIntegration()); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
 
-	ig, err := s.backend.CreateIntegration(ctx, req.Integration)
+	ig, err := s.backend.CreateIntegration(ctx, req.GetIntegration())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -324,15 +324,15 @@ func (s *Service) UpdateIntegration(ctx context.Context, req *integrationpb.Upda
 		return nil, trace.Wrap(err)
 	}
 
-	if err := validateAWSRolesAnywhereProfileFilters(req.Integration); err != nil {
+	if err := validateAWSRolesAnywhereProfileFilters(req.GetIntegration()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.maybeUpdateStaticCredentials(ctx, req.Integration); err != nil {
+	if err := s.maybeUpdateStaticCredentials(ctx, req.GetIntegration()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	ig, err := s.backend.UpdateIntegration(ctx, req.Integration)
+	ig, err := s.backend.UpdateIntegration(ctx, req.GetIntegration())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -411,7 +411,7 @@ func (s *Service) DeleteIntegration(ctx context.Context, req *integrationpb.Dele
 		return nil, trace.Wrap(err)
 	}
 
-	if req.DeleteAssociatedResources {
+	if req.GetDeleteAssociatedResources() {
 		if err := s.deleteAssociatedResources(ctx, authCtx, ig); err != nil {
 			return nil, trace.Wrap(err)
 		}
diff --git a/lib/auth/integration/integrationv1/service_test.go b/lib/auth/integration/integrationv1/service_test.go
index 25ac381f42e..f9c72f13c90 100644
--- a/lib/auth/integration/integrationv1/service_test.go
+++ b/lib/auth/integration/integrationv1/service_test.go
@@ -104,9 +104,9 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.GetIntegration(ctx, &integrationpb.GetIntegrationRequest{
+				_, err := resourceSvc.GetIntegration(ctx, integrationpb.GetIntegrationRequest_builder{
 					Name: igName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: noError,
@@ -115,9 +115,9 @@ func TestIntegrationCRUD(t *testing.T) {
 			Name: "no access to read integrations",
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.GetIntegration(ctx, &integrationpb.GetIntegrationRequest{
+				_, err := resourceSvc.GetIntegration(ctx, integrationpb.GetIntegrationRequest_builder{
 					Name: igName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -131,9 +131,9 @@ func TestIntegrationCRUD(t *testing.T) {
 				}}},
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.GetIntegration(ctx, &integrationpb.GetIntegrationRequest{
+				_, err := resourceSvc.GetIntegration(ctx, integrationpb.GetIntegrationRequest_builder{
 					Name: igName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -155,10 +155,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				}
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.ListIntegrations(ctx, &integrationpb.ListIntegrationsRequest{
+				_, err := resourceSvc.ListIntegrations(ctx, integrationpb.ListIntegrationsRequest_builder{
 					Limit:   0,
 					NextKey: "",
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: noError,
@@ -172,10 +172,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				}}},
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.ListIntegrations(ctx, &integrationpb.ListIntegrationsRequest{
+				_, err := resourceSvc.ListIntegrations(ctx, integrationpb.ListIntegrationsRequest_builder{
 					Limit:   0,
 					NextKey: "",
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -187,7 +187,7 @@ func TestIntegrationCRUD(t *testing.T) {
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
 				ig := sampleIntegrationFn(t, igName)
-				_, err := resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: ig.(*types.IntegrationV1)})
+				_, err := resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: ig.(*types.IntegrationV1)}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -203,7 +203,7 @@ func TestIntegrationCRUD(t *testing.T) {
 			IntegrationName: "integration-allow-create-access",
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
 				ig := sampleIntegrationFn(t, igName)
-				_, err := resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: ig.(*types.IntegrationV1)})
+				_, err := resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: ig.(*types.IntegrationV1)}.Build())
 				return err
 			},
 			ErrAssertion: noError,
@@ -219,7 +219,7 @@ func TestIntegrationCRUD(t *testing.T) {
 			IntegrationName: "integration-awsoidc-invalid.name",
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
 				ig := sampleIntegrationFn(t, igName)
-				_, err := resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: ig.(*types.IntegrationV1)})
+				_, err := resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: ig.(*types.IntegrationV1)}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsBadParameter,
@@ -238,7 +238,7 @@ func TestIntegrationCRUD(t *testing.T) {
 					return trace.Wrap(err)
 				}
 
-				_, err = resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: ig})
+				_, err = resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: ig}.Build())
 				return trace.Wrap(err)
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -253,7 +253,7 @@ func TestIntegrationCRUD(t *testing.T) {
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
 				ig := sampleIntegrationFn(t, igName)
-				_, err := resourceSvc.UpdateIntegration(ctx, &integrationpb.UpdateIntegrationRequest{Integration: ig.(*types.IntegrationV1)})
+				_, err := resourceSvc.UpdateIntegration(ctx, integrationpb.UpdateIntegrationRequest_builder{Integration: ig.(*types.IntegrationV1)}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -272,7 +272,7 @@ func TestIntegrationCRUD(t *testing.T) {
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
 				ig := sampleIntegrationFn(t, igName)
-				_, err := resourceSvc.UpdateIntegration(ctx, &integrationpb.UpdateIntegrationRequest{Integration: ig.(*types.IntegrationV1)})
+				_, err := resourceSvc.UpdateIntegration(ctx, integrationpb.UpdateIntegrationRequest_builder{Integration: ig.(*types.IntegrationV1)}.Build())
 				return err
 			},
 			ErrAssertion: noError,
@@ -290,7 +290,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: oldIg})
+				_, err = resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: oldIg}.Build())
 				if err != nil {
 					return trace.Wrap(err)
 				}
@@ -299,7 +299,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.UpdateIntegration(ctx, &integrationpb.UpdateIntegrationRequest{Integration: newIg})
+				_, err = resourceSvc.UpdateIntegration(ctx, integrationpb.UpdateIntegrationRequest_builder{Integration: newIg}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -320,7 +320,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: oldIg})
+				_, err = resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: oldIg}.Build())
 				if err != nil {
 					return trace.Wrap(err)
 				}
@@ -329,7 +329,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.UpdateIntegration(ctx, &integrationpb.UpdateIntegrationRequest{Integration: newIg})
+				_, err = resourceSvc.UpdateIntegration(ctx, integrationpb.UpdateIntegrationRequest_builder{Integration: newIg}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -350,7 +350,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: oldIg})
+				_, err = resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: oldIg}.Build())
 				if err != nil {
 					return trace.Wrap(err)
 				}
@@ -359,7 +359,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.UpdateIntegration(ctx, &integrationpb.UpdateIntegrationRequest{Integration: newIg})
+				_, err = resourceSvc.UpdateIntegration(ctx, integrationpb.UpdateIntegrationRequest_builder{Integration: newIg}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -380,7 +380,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.CreateIntegration(ctx, &integrationpb.CreateIntegrationRequest{Integration: oldIg})
+				_, err = resourceSvc.CreateIntegration(ctx, integrationpb.CreateIntegrationRequest_builder{Integration: oldIg}.Build())
 				if err != nil {
 					return trace.Wrap(err)
 				}
@@ -389,7 +389,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				_, err = resourceSvc.UpdateIntegration(ctx, &integrationpb.UpdateIntegrationRequest{Integration: newIg})
+				_, err = resourceSvc.UpdateIntegration(ctx, integrationpb.UpdateIntegrationRequest_builder{Integration: newIg}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsBadParameter,
@@ -400,7 +400,7 @@ func TestIntegrationCRUD(t *testing.T) {
 			Name: "no access to delete integration",
 			Role: types.RoleSpecV6{},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: "x"})
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: "x"}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -420,7 +420,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: igName}.Build())
 				return err
 
 			},
@@ -447,7 +447,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: igName}.Build())
 				return err
 			},
 			Cleanup: func(t *testing.T, igName string) {
@@ -474,10 +474,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, localClient.CreatePlugin(ctx, NewIdentityCenterPlugin(igName, igName)))
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: "another-plugin"})
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: "another-plugin"}.Build())
 				require.NoError(t, err)
 				require.NoError(t, localClient.DeletePlugin(ctx, types.PluginTypeMattermost))
-				_, err = resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
+				_, err = resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: igName}.Build())
 				return err
 			},
 			Cleanup: func(t *testing.T, igName string) {
@@ -498,7 +498,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: igName}.Build())
 				return err
 			},
 			ErrAssertion: noError,
@@ -554,7 +554,7 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NotNil(t, staticCreds)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{Name: igName})
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{Name: igName}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -584,9 +584,9 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{
 					Name: igName,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsBadParameter,
@@ -610,10 +610,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{
 					Name:                      igName,
 					DeleteAssociatedResources: true,
-				})
+				}.Build())
 				return err
 			},
 			ErrAssertion: trace.IsAccessDenied,
@@ -650,10 +650,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{
 					Name:                      igName,
 					DeleteAssociatedResources: true,
-				})
+				}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -690,10 +690,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{
 					Name:                      igName,
 					DeleteAssociatedResources: true,
-				})
+				}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
@@ -737,10 +737,10 @@ func TestIntegrationCRUD(t *testing.T) {
 				require.NoError(t, err)
 			},
 			Test: func(ctx context.Context, resourceSvc *Service, igName string) error {
-				_, err := resourceSvc.DeleteIntegration(ctx, &integrationpb.DeleteIntegrationRequest{
+				_, err := resourceSvc.DeleteIntegration(ctx, integrationpb.DeleteIntegrationRequest_builder{
 					Name:                      igName,
 					DeleteAssociatedResources: true,
-				})
+				}.Build())
 				return err
 			},
 			Validate: func(t *testing.T, igName string) {
diff --git a/lib/auth/issuance/v1/service.go b/lib/auth/issuance/v1/service.go
index 50bef9ff522..b233755fe27 100644
--- a/lib/auth/issuance/v1/service.go
+++ b/lib/auth/issuance/v1/service.go
@@ -122,12 +122,12 @@ func (s *Service) IssueScopedBotCerts(
 		)
 	}
 	// Ensure at least one key is provided
-	if len(req.TlsPublicKey) == 0 && len(req.SshPublicKey) == 0 {
+	if len(req.GetTlsPublicKey()) == 0 && len(req.GetSshPublicKey()) == 0 {
 		return nil, trace.BadParameter("at least one of ssh_public_key or tls_public_key is required")
 	}
 
-	switch req.GetUsage().(type) {
-	case *issuancev1pb.IssueScopedBotCertsRequest_Identity:
+	switch req.WhichUsage() {
+	case issuancev1pb.IssueScopedBotCertsRequest_Identity_case:
 	// no special handling.
 	default:
 		return nil, trace.BadParameter(
@@ -149,7 +149,7 @@ func (s *Service) IssueScopedBotCerts(
 		)
 	case currentIdentity.DisallowReissue:
 		return nil, trace.AccessDenied("reissuance is prohibited")
-	case currentIdentity.ScopePin == nil || currentIdentity.ScopePin.Scope == "":
+	case currentIdentity.ScopePin == nil || currentIdentity.ScopePin.GetScope() == "":
 		return nil, trace.AccessDenied(
 			"scope pin missing, rpc can only be invoked by scoped identities",
 		)
@@ -178,7 +178,7 @@ func (s *Service) IssueScopedBotCerts(
 	// resource itself. In the future, we will allow "sub-pinning" where the
 	// resulting certs may be a descendant scope of the current scope and
 	// bot scope.
-	requestedScope := currentIdentity.ScopePin.Scope
+	requestedScope := currentIdentity.ScopePin.GetScope()
 	// Sanity check that the requested scope is still descendant or equiv to
 	// botScope - in case bot scope has changed.
 	if !scopes.ScopeOfOrigin(botScope).IsAssignableToScopeOfEffect(requestedScope) {
@@ -199,8 +199,8 @@ func (s *Service) IssueScopedBotCerts(
 		User:           user,
 		CheckerContext: checker,
 		TTL:            ttl,
-		SSHPublicKey:   req.SshPublicKey,
-		TLSPublicKey:   req.TlsPublicKey,
+		SSHPublicKey:   req.GetSshPublicKey(),
+		TLSPublicKey:   req.GetTlsPublicKey(),
 
 		// Explicitly set BotInternal to false as these certs are intended for
 		// outputs/services and not use by the bot internally. This prevents
@@ -233,10 +233,10 @@ func (s *Service) IssueScopedBotCerts(
 	// We do not return any CAs. The Bot already has an internal identity and
 	// the ability to fetch/watch CAs. Returning CAs here would create confusion
 	// around where to correctly source CAs.
-	return &issuancev1pb.IssueScopedBotCertsResponse{
-		Certs: &issuancev1pb.Certs{
+	return issuancev1pb.IssueScopedBotCertsResponse_builder{
+		Certs: issuancev1pb.Certs_builder{
 			Tls: certs.TLS,
 			Ssh: certs.SSH,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
diff --git a/lib/auth/issuance/v1/service_test.go b/lib/auth/issuance/v1/service_test.go
index d3c06e5a4f8..6c3ab28eb3d 100644
--- a/lib/auth/issuance/v1/service_test.go
+++ b/lib/auth/issuance/v1/service_test.go
@@ -94,60 +94,60 @@ func TestIssueScopedBotCerts(t *testing.T) {
 
 	// Create a scoped role.
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "bot-role",
-			},
+			}.Build(),
 			Scope: botScope,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{botScope},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create a scoped bot.
-	bot, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-bot",
-			},
+			}.Build(),
 			Scope: botScope,
 			Spec:  &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create a scoped role assignment for the bot.
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: botScope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
-				BotName:  bot.Metadata.Name,
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
+				BotName:  bot.GetMetadata().GetName(),
 				BotScope: botScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "bot-role", Scope: botScope},
+					scopedaccessv1.Assignment_builder{Role: "bot-role", Scope: botScope}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
 	// Create a client with a scoped bot internal identity.
 	botClient, err := srv.NewClient(
-		authtest.TestScopedBot(bot.Metadata.Name, botScope, true),
+		authtest.TestScopedBot(bot.GetMetadata().GetName(), botScope, true),
 	)
 	require.NoError(t, err)
 	t.Cleanup(func() { _ = botClient.Close() })
@@ -173,12 +173,12 @@ func TestIssueScopedBotCerts(t *testing.T) {
 			Usage:        &issuancev1pb.IssueScopedBotCertsRequest_Identity{},
 		})
 		require.NoError(t, err)
-		require.NotNil(t, resp.Certs)
-		require.NotEmpty(t, resp.Certs.Ssh)
-		require.NotEmpty(t, resp.Certs.Tls)
+		require.NotNil(t, resp.GetCerts())
+		require.NotEmpty(t, resp.GetCerts().GetSsh())
+		require.NotEmpty(t, resp.GetCerts().GetTls())
 
 		// Parse the returned TLS cert and verify identity properties.
-		tlsCert, err := tlsca.ParseCertificatePEM(resp.Certs.Tls)
+		tlsCert, err := tlsca.ParseCertificatePEM(resp.GetCerts().GetTls())
 		require.NoError(t, err)
 		identity, err := tlsca.FromSubject(tlsCert.Subject, tlsCert.NotAfter)
 		require.NoError(t, err)
@@ -191,7 +191,7 @@ func TestIssueScopedBotCerts(t *testing.T) {
 		require.WithinDuration(t, now.Add(requestedTTL), tlsCert.NotAfter, time.Minute)
 
 		// Verify the SSH cert is valid.
-		sshParsedKey, _, _, _, err := ssh.ParseAuthorizedKey(resp.Certs.Ssh)
+		sshParsedKey, _, _, _, err := ssh.ParseAuthorizedKey(resp.GetCerts().GetSsh())
 		require.NoError(t, err)
 		sshCert, ok := sshParsedKey.(*ssh.Certificate)
 		require.True(t, ok, "parsed SSH key should be a certificate")
@@ -213,11 +213,11 @@ func TestIssueScopedBotCerts(t *testing.T) {
 	})
 
 	t.Run("missing usage rejected", func(t *testing.T) {
-		_, err := issuanceClient.IssueScopedBotCerts(ctx, &issuancev1pb.IssueScopedBotCertsRequest{
+		_, err := issuanceClient.IssueScopedBotCerts(ctx, issuancev1pb.IssueScopedBotCertsRequest_builder{
 			SshPublicKey: sshPubKeyBytes,
 			TlsPublicKey: tlsPubKeyPEM,
 			Ttl:          durationpb.New(time.Hour),
-		})
+		}.Build())
 		require.ErrorContains(t, err, "unsupported or unspecified usage variant")
 	})
 
@@ -228,9 +228,9 @@ func TestIssueScopedBotCerts(t *testing.T) {
 			Usage:        &issuancev1pb.IssueScopedBotCertsRequest_Identity{},
 		})
 		require.NoError(t, err)
-		require.NotNil(t, resp.Certs)
-		require.NotEmpty(t, resp.Certs.Ssh)
-		require.Empty(t, resp.Certs.Tls)
+		require.NotNil(t, resp.GetCerts())
+		require.NotEmpty(t, resp.GetCerts().GetSsh())
+		require.Empty(t, resp.GetCerts().GetTls())
 	})
 
 	t.Run("tls only", func(t *testing.T) {
@@ -240,9 +240,9 @@ func TestIssueScopedBotCerts(t *testing.T) {
 			Usage:        &issuancev1pb.IssueScopedBotCertsRequest_Identity{},
 		})
 		require.NoError(t, err)
-		require.NotNil(t, resp.Certs)
-		require.Empty(t, resp.Certs.Ssh)
-		require.NotEmpty(t, resp.Certs.Tls)
+		require.NotNil(t, resp.GetCerts())
+		require.Empty(t, resp.GetCerts().GetSsh())
+		require.NotEmpty(t, resp.GetCerts().GetTls())
 	})
 
 	t.Run("missing keys rejected", func(t *testing.T) {
@@ -318,19 +318,19 @@ func TestIssueScopedBotCerts_Unauthorized(t *testing.T) {
 
 	// Create a scoped role (needed for scoped identity generation).
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-role",
-			},
+			}.Build(),
 			Scope: testScope,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{testScope},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Generate a key pair shared across subtests.
@@ -342,37 +342,37 @@ func TestIssueScopedBotCerts_Unauthorized(t *testing.T) {
 	require.NoError(t, err)
 	sshPubKeyBytes := ssh.MarshalAuthorizedKey(sshPubKey)
 
-	scopedBot, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	scopedBot, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot",
-			},
+			}.Build(),
 			Scope: testScope,
 			Spec:  &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: testScope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
-				BotName:  scopedBot.Metadata.Name,
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
+				BotName:  scopedBot.GetMetadata().GetName(),
 				BotScope: testScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "test-role", Scope: testScope},
+					scopedaccessv1.Assignment_builder{Role: "test-role", Scope: testScope}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
@@ -397,23 +397,23 @@ func TestIssueScopedBotCerts_Unauthorized(t *testing.T) {
 		user, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 		require.NoError(t, err)
 
-		userSRAResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+		userSRAResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+			Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    scopedaccess.KindScopedRoleAssignment,
 				Version: types.V1,
 				SubKind: scopedaccess.SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.NewString(),
-				},
+				}.Build(),
 				Scope: testScope,
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: user.GetName(),
 					Assignments: []*scopedaccessv1.Assignment{
-						{Role: "test-role", Scope: testScope},
+						scopedaccessv1.Assignment_builder{Role: "test-role", Scope: testScope}.Build(),
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 		waitForSRACache(t, srv, userSRAResp)
 
@@ -433,20 +433,20 @@ func TestIssueScopedBotCerts_Unauthorized(t *testing.T) {
 
 	t.Run("unscoped bot", func(t *testing.T) {
 		// Create an unscoped bot.
-		unscopedBot, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		unscopedBot, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "unscoped-bot",
-				},
+				}.Build(),
 				Spec: &machineidv1pb.BotSpec{},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
 		botClient, err := srv.NewClient(
-			authtest.TestBot(unscopedBot.Metadata.Name, true),
+			authtest.TestBot(unscopedBot.GetMetadata().GetName(), true),
 		)
 		require.NoError(t, err)
 		t.Cleanup(func() { _ = botClient.Close() })
@@ -461,7 +461,7 @@ func TestIssueScopedBotCerts_Unauthorized(t *testing.T) {
 
 	t.Run("scoped bot without BotInternal", func(t *testing.T) {
 		botClient, err := srv.NewClient(
-			authtest.TestScopedBot(scopedBot.Metadata.Name, testScope, false),
+			authtest.TestScopedBot(scopedBot.GetMetadata().GetName(), testScope, false),
 		)
 		require.NoError(t, err)
 		t.Cleanup(func() { _ = botClient.Close() })
@@ -475,7 +475,7 @@ func TestIssueScopedBotCerts_Unauthorized(t *testing.T) {
 	})
 
 	t.Run("scoped bot with DisallowReissue", func(t *testing.T) {
-		ident := authtest.TestScopedBot(scopedBot.Metadata.Name, testScope, true)
+		ident := authtest.TestScopedBot(scopedBot.GetMetadata().GetName(), testScope, true)
 		lu := ident.I.(authz.LocalUser)
 		lu.Identity.DisallowReissue = true
 		ident.I = lu
@@ -498,10 +498,10 @@ func waitForSRACache(t *testing.T, srv *authtest.TLSServer, resps ...*scopedacce
 	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		for _, resp := range resps {
-			_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 				Name:    resp.GetAssignment().GetMetadata().GetName(),
 				SubKind: resp.GetAssignment().GetSubKind(),
-			})
+			}.Build())
 			require.NoError(t, err)
 		}
 	}, 10*time.Second, 100*time.Millisecond)
diff --git a/lib/auth/join.go b/lib/auth/join.go
index 893e98f4984..d10320882cf 100644
--- a/lib/auth/join.go
+++ b/lib/auth/join.go
@@ -229,7 +229,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkGitHubJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Github = claims.JoinAttrs()
+			attrs.SetGithub(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -238,7 +238,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkGitLabJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Gitlab = claims.JoinAttrs()
+			attrs.SetGitlab(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -247,7 +247,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkCircleCIJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Circleci = claims.JoinAttrs()
+			attrs.SetCircleci(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -256,7 +256,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkKubernetesJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Kubernetes = claims.JoinAttrs()
+			attrs.SetKubernetes(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -265,7 +265,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkGCPJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Gcp = claims.JoinAttrs()
+			attrs.SetGcp(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -274,7 +274,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkSpaceliftJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Spacelift = claims.JoinAttrs()
+			attrs.SetSpacelift(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -283,7 +283,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkTerraformCloudJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.TerraformCloud = claims.JoinAttrs()
+			attrs.SetTerraformCloud(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -292,7 +292,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkBitbucketJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims
-			attrs.Bitbucket = claims.JoinAttrs()
+			attrs.SetBitbucket(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -301,7 +301,7 @@ func (a *Server) RegisterUsingToken(ctx context.Context, req *types.RegisterUsin
 		claims, err := a.checkAzureDevopsJoinRequest(ctx, req, provisionToken)
 		if claims != nil {
 			rawClaims = claims.ForAudit()
-			attrs.AzureDevops = claims.JoinAttrs()
+			attrs.SetAzureDevops(claims.JoinAttrs())
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -420,14 +420,14 @@ func (a *Server) GenerateBotCertsForJoin(
 	if params.Attrs == nil {
 		params.Attrs = &workloadidentityv1pb.JoinAttrs{}
 	}
-	params.Attrs.Meta = &workloadidentityv1pb.JoinAttrsMeta{
+	params.Attrs.SetMeta(workloadidentityv1pb.JoinAttrsMeta_builder{
 		JoinMethod: string(joinMethod),
-	}
+	}.Build())
 	if joinMethod != types.JoinMethodToken {
-		params.Attrs.Meta.JoinTokenName = token.GetName()
+		params.Attrs.GetMeta().SetJoinTokenName(token.GetName())
 	}
 
-	auth := &machineidv1pb.BotInstanceStatusAuthentication{
+	auth := machineidv1pb.BotInstanceStatusAuthentication_builder{
 		AuthenticatedAt: timestamppb.New(a.GetClock().Now()),
 		// TODO: GetSafeName may not return an appropriate value for later
 		// comparison / locking purposes, and this also shouldn't contain
@@ -436,7 +436,7 @@ func (a *Server) GenerateBotCertsForJoin(
 		JoinMethod: string(token.GetJoinMethod()),
 		PublicKey:  params.PublicTLSKey,
 		JoinAttrs:  params.Attrs,
-	}
+	}.Build()
 
 	// TODO(noah): In v19, we can drop writing to the deprecated Metadata field.
 	auth.Metadata, err = rawJoinAttrsToGoogleStruct(params.RawJoinClaims)
diff --git a/lib/auth/join/join_test.go b/lib/auth/join/join_test.go
index 709c8dbdcb2..12124c3f190 100644
--- a/lib/auth/join/join_test.go
+++ b/lib/auth/join/join_test.go
@@ -163,25 +163,25 @@ func TestRegister_Bot(t *testing.T) {
 
 	srv := newTestTLSServer(t)
 
-	bot, err := machineidv1.UpsertBot(ctx, srv.Auth(), &machineidv1pb.Bot{
+	bot, err := machineidv1.UpsertBot(ctx, srv.Auth(), machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test",
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: []string{},
-		},
-	}, srv.Clock().Now(), "", scopes.Features{})
+		}.Build(),
+	}.Build(), srv.Clock().Now(), "", scopes.Features{})
 	require.NoError(t, err)
 
 	later := srv.Clock().Now().Add(4 * time.Hour)
 
-	goodToken := newBotToken(t, "good-token", bot.Metadata.Name, types.RoleBot, later)
-	expiredToken := newBotToken(t, "expired", bot.Metadata.Name, types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
+	goodToken := newBotToken(t, "good-token", bot.GetMetadata().GetName(), types.RoleBot, later)
+	expiredToken := newBotToken(t, "expired", bot.GetMetadata().GetName(), types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
 	wrongKind := newBotToken(t, "wrong-kind", "", types.RoleNode, later)
 	wrongUser := newBotToken(t, "wrong-user", "llama", types.RoleBot, later)
-	invalidToken := newBotToken(t, "this-token-does-not-exist", bot.Metadata.Name, types.RoleBot, later)
+	invalidToken := newBotToken(t, "this-token-does-not-exist", bot.GetMetadata().GetName(), types.RoleBot, later)
 
 	err = srv.Auth().UpsertToken(ctx, goodToken)
 	require.NoError(t, err)
@@ -307,17 +307,17 @@ func TestRegister_Bot_Expiry(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			botName := uuid.NewString()
-			_, err := machineidv1.UpsertBot(ctx, srv.Auth(), &machineidv1pb.Bot{
+			_, err := machineidv1.UpsertBot(ctx, srv.Auth(), machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: botName,
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles:  []string{},
 					Traits: []*machineidv1pb.Trait{},
-				},
-			}, srv.Clock().Now(), "", scopes.Features{})
+				}.Build(),
+			}.Build(), srv.Clock().Now(), "", scopes.Features{})
 			require.NoError(t, err)
 			tok := newBotToken(t, uuid.NewString(), botName, types.RoleBot, srv.Clock().Now().Add(time.Hour))
 			require.NoError(t, srv.Auth().UpsertToken(ctx, tok))
diff --git a/lib/auth/join_azure_legacy.go b/lib/auth/join_azure_legacy.go
index 9032f084e6a..90dccd46b7e 100644
--- a/lib/auth/join_azure_legacy.go
+++ b/lib/auth/join_azure_legacy.go
@@ -97,9 +97,9 @@ func (a *Server) RegisterUsingAzureMethod(
 	}
 
 	if req.RegisterUsingTokenRequest.Role == types.RoleBot {
-		params := makeBotCertsParams(req.RegisterUsingTokenRequest, nil /*rawClaims*/, &workloadidentityv1pb.JoinAttrs{
+		params := makeBotCertsParams(req.RegisterUsingTokenRequest, nil /*rawClaims*/, workloadidentityv1pb.JoinAttrs_builder{
 			Azure: joinAttrs,
-		})
+		}.Build())
 		certs, _, err := a.GenerateBotCertsForJoin(ctx, provisionToken, params)
 		return certs, trace.Wrap(err)
 	}
diff --git a/lib/auth/join_bound_keypair_test.go b/lib/auth/join_bound_keypair_test.go
index 4d0358a568c..9309e85e8eb 100644
--- a/lib/auth/join_bound_keypair_test.go
+++ b/lib/auth/join_bound_keypair_test.go
@@ -129,18 +129,18 @@ func TestServer_RegisterUsingBoundKeypairMethod(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	sshPrivateKey, sshPublicKey, err := testauthority.GenerateKeyPair()
@@ -979,18 +979,18 @@ func TestServer_RegisterUsingBoundKeypairMethod_GenerationCounter(t *testing.T)
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpecAndStatus(
@@ -1188,18 +1188,18 @@ func TestServer_RegisterUsingBoundKeypairMethod_JoinStateFailure(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpecAndStatus(
@@ -1346,18 +1346,18 @@ func TestServer_RegisterUsingBoundKeypairMethod_JoinStateFailureDuringRenewal(t
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpecAndStatus(
diff --git a/lib/auth/join_iam.go b/lib/auth/join_iam.go
index 6249e6903c0..987ffbf188b 100644
--- a/lib/auth/join_iam.go
+++ b/lib/auth/join_iam.go
@@ -117,9 +117,9 @@ func (a *Server) RegisterUsingIAMMethod(
 	}
 
 	if req.RegisterUsingTokenRequest.Role == types.RoleBot {
-		params := makeBotCertsParams(req.RegisterUsingTokenRequest, verifiedIdentity, &workloadidentityv1pb.JoinAttrs{
+		params := makeBotCertsParams(req.RegisterUsingTokenRequest, verifiedIdentity, workloadidentityv1pb.JoinAttrs_builder{
 			Iam: verifiedIdentity.JoinAttrs(),
-		})
+		}.Build())
 		certs, _, err := a.GenerateBotCertsForJoin(ctx, provisionToken, params)
 		return certs, trace.Wrap(err, "generating bot certs")
 	}
diff --git a/lib/auth/join_oracle.go b/lib/auth/join_oracle.go
index a37bd912e3e..ac43a22e8bd 100644
--- a/lib/auth/join_oracle.go
+++ b/lib/auth/join_oracle.go
@@ -92,9 +92,9 @@ func (a *Server) registerUsingOracleMethod(
 	}
 
 	if tokenReq.Role == types.RoleBot {
-		params := makeBotCertsParams(tokenReq, claims, &workloadidentityv1pb.JoinAttrs{
+		params := makeBotCertsParams(tokenReq, claims, workloadidentityv1pb.JoinAttrs_builder{
 			Oracle: claims.JoinAttrs(),
-		})
+		}.Build())
 		certs, _, err := a.GenerateBotCertsForJoin(ctx, provisionToken, params)
 		return certs, trace.Wrap(err, "generating bot certs")
 	}
diff --git a/lib/auth/join_test.go b/lib/auth/join_test.go
index 2bfab455638..125ff5bd686 100644
--- a/lib/auth/join_test.go
+++ b/lib/auth/join_test.go
@@ -308,25 +308,25 @@ func TestJoin_Bot(t *testing.T) {
 
 	srv := newTestTLSServer(t)
 
-	bot, err := machineidv1.UpsertBot(ctx, srv.Auth(), &machineidv1pb.Bot{
+	bot, err := machineidv1.UpsertBot(ctx, srv.Auth(), machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test",
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: []string{},
-		},
-	}, srv.Clock().Now(), "", scopes.Features{})
+		}.Build(),
+	}.Build(), srv.Clock().Now(), "", scopes.Features{})
 	require.NoError(t, err)
 
 	later := srv.Clock().Now().Add(4 * time.Hour)
 
-	goodToken := newBotToken(t, "good-token", bot.Metadata.Name, types.RoleBot, later)
-	expiredToken := newBotToken(t, "expired", bot.Metadata.Name, types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
+	goodToken := newBotToken(t, "good-token", bot.GetMetadata().GetName(), types.RoleBot, later)
+	expiredToken := newBotToken(t, "expired", bot.GetMetadata().GetName(), types.RoleBot, srv.Clock().Now().Add(-1*time.Hour))
 	wrongKind := newBotToken(t, "wrong-kind", "", types.RoleNode, later)
 	wrongUser := newBotToken(t, "wrong-user", "llama", types.RoleBot, later)
-	invalidToken := newBotToken(t, "this-token-does-not-exist", bot.Metadata.Name, types.RoleBot, later)
+	invalidToken := newBotToken(t, "this-token-does-not-exist", bot.GetMetadata().GetName(), types.RoleBot, later)
 
 	err = srv.Auth().UpsertToken(ctx, goodToken)
 	require.NoError(t, err)
@@ -451,17 +451,17 @@ func TestJoin_Bot_Expiry(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			botName := uuid.NewString()
-			_, err := machineidv1.UpsertBot(ctx, srv.Auth(), &machineidv1pb.Bot{
+			_, err := machineidv1.UpsertBot(ctx, srv.Auth(), machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: botName,
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles:  []string{},
 					Traits: []*machineidv1pb.Trait{},
-				},
-			}, srv.Clock().Now(), "", scopes.Features{})
+				}.Build(),
+			}.Build(), srv.Clock().Now(), "", scopes.Features{})
 			require.NoError(t, err)
 			tok := newBotToken(t, uuid.NewString(), botName, types.RoleBot, srv.Clock().Now().Add(time.Hour))
 			require.NoError(t, srv.Auth().UpsertToken(ctx, tok))
diff --git a/lib/auth/join_tpm.go b/lib/auth/join_tpm.go
index 365d0fb4a15..49076435511 100644
--- a/lib/auth/join_tpm.go
+++ b/lib/auth/join_tpm.go
@@ -93,9 +93,9 @@ func (a *Server) RegisterUsingTPMMethod(
 	}
 
 	if initReq.JoinRequest.Role == types.RoleBot {
-		params := makeBotCertsParams(initReq.JoinRequest, validatedEK, &workloadidentityv1pb.JoinAttrs{
+		params := makeBotCertsParams(initReq.JoinRequest, validatedEK, workloadidentityv1pb.JoinAttrs_builder{
 			Tpm: validatedEK.JoinAttrs(),
-		})
+		}.Build())
 		certs, _, err := a.GenerateBotCertsForJoin(ctx, ptv2, params)
 		return certs, trace.Wrap(err, "generating certs for bot")
 	}
diff --git a/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service.go b/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service.go
index 4c20e89ef53..4a81e71d535 100644
--- a/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service.go
+++ b/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service.go
@@ -92,34 +92,34 @@ func (s *Service) ListKubernetesWaitingContainers(ctx context.Context, req *kube
 		return nil, trace.AccessDenied("unauthorized to list Kubernetes waiting container resources")
 	}
 
-	conts, nextToken, err := s.cache.ListKubernetesWaitingContainers(ctx, int(req.PageSize), req.PageToken)
+	conts, nextToken, err := s.cache.ListKubernetesWaitingContainers(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &kubewaitingcontainerpb.ListKubernetesWaitingContainersResponse{
+	return kubewaitingcontainerpb.ListKubernetesWaitingContainersResponse_builder{
 		WaitingContainers: conts,
 		NextPageToken:     nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // GetKubernetesWaitingContainer returns a Kubernetes ephemeral
 // container that are waiting to be created until moderated
 // session conditions are met.
 func (s *Service) GetKubernetesWaitingContainer(ctx context.Context, req *kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
-	if req.Username == "" {
+	if req.GetUsername() == "" {
 		return nil, trace.BadParameter("missing username")
 	}
-	if req.Cluster == "" {
+	if req.GetCluster() == "" {
 		return nil, trace.BadParameter("missing cluster")
 	}
-	if req.Namespace == "" {
+	if req.GetNamespace() == "" {
 		return nil, trace.BadParameter("missing namespace")
 	}
-	if req.PodName == "" {
+	if req.GetPodName() == "" {
 		return nil, trace.BadParameter("missing pod name")
 	}
-	if req.ContainerName == "" {
+	if req.GetContainerName() == "" {
 		return nil, trace.BadParameter("missing container name")
 	}
 
@@ -134,13 +134,13 @@ func (s *Service) GetKubernetesWaitingContainer(ctx context.Context, req *kubewa
 		return nil, trace.AccessDenied("unauthorized to read Kubernetes waiting container resources")
 	}
 
-	out, err := s.cache.GetKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
-		Username:      req.Username,
-		Cluster:       req.Cluster,
-		Namespace:     req.Namespace,
-		PodName:       req.PodName,
-		ContainerName: req.ContainerName,
-	})
+	out, err := s.cache.GetKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest_builder{
+		Username:      req.GetUsername(),
+		Cluster:       req.GetCluster(),
+		Namespace:     req.GetNamespace(),
+		PodName:       req.GetPodName(),
+		ContainerName: req.GetContainerName(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -163,7 +163,7 @@ func (s *Service) CreateKubernetesWaitingContainer(ctx context.Context, req *kub
 		return nil, trace.AccessDenied("unauthorized to create Kubernetes waiting container resources")
 	}
 
-	out, err := s.backend.CreateKubernetesWaitingContainer(ctx, req.WaitingContainer)
+	out, err := s.backend.CreateKubernetesWaitingContainer(ctx, req.GetWaitingContainer())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -175,19 +175,19 @@ func (s *Service) CreateKubernetesWaitingContainer(ctx context.Context, req *kub
 // container that are waiting to be created until moderated
 // session conditions are met.
 func (s *Service) DeleteKubernetesWaitingContainer(ctx context.Context, req *kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest) (*emptypb.Empty, error) {
-	if req.Username == "" {
+	if req.GetUsername() == "" {
 		return nil, trace.BadParameter("missing username")
 	}
-	if req.Cluster == "" {
+	if req.GetCluster() == "" {
 		return nil, trace.BadParameter("missing cluster")
 	}
-	if req.Namespace == "" {
+	if req.GetNamespace() == "" {
 		return nil, trace.BadParameter("missing namespace")
 	}
-	if req.PodName == "" {
+	if req.GetPodName() == "" {
 		return nil, trace.BadParameter("missing pod name")
 	}
-	if req.ContainerName == "" {
+	if req.GetContainerName() == "" {
 		return nil, trace.BadParameter("missing container name")
 	}
 
@@ -202,13 +202,13 @@ func (s *Service) DeleteKubernetesWaitingContainer(ctx context.Context, req *kub
 		return nil, trace.AccessDenied("unauthorized to delete Kubernetes waiting container resources")
 	}
 
-	return &emptypb.Empty{}, trace.Wrap(s.backend.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
-		Username:      req.Username,
-		Cluster:       req.Cluster,
-		Namespace:     req.Namespace,
-		PodName:       req.PodName,
-		ContainerName: req.ContainerName,
-	}))
+	return &emptypb.Empty{}, trace.Wrap(s.backend.DeleteKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest_builder{
+		Username:      req.GetUsername(),
+		Cluster:       req.GetCluster(),
+		Namespace:     req.GetNamespace(),
+		PodName:       req.GetPodName(),
+		ContainerName: req.GetContainerName(),
+	}.Build()))
 }
 
 // isKubeSvcOrProxy returns true if the given context has the builtin role
diff --git a/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service_test.go b/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service_test.go
index abdf600ee1a..bcc0109bfb9 100644
--- a/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service_test.go
+++ b/lib/auth/kubewaitingcontainer/kubewaitingcontainerv1/service_test.go
@@ -47,7 +47,7 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 	sampleKubeWaitingContFn := func(t *testing.T, name string) *kubewaitingcontainerpb.KubernetesWaitingContainer {
 		wc, err := kubewaitingcontainer.NewKubeWaitingContainer(
 			name,
-			&kubewaitingcontainerpb.KubernetesWaitingContainerSpec{
+			kubewaitingcontainerpb.KubernetesWaitingContainerSpec_builder{
 				Username:      username,
 				Cluster:       cluster,
 				Namespace:     namespace,
@@ -55,7 +55,7 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				ContainerName: name,
 				Patch:         []byte("patch"),
 				PatchType:     patchType,
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 		return wc
@@ -84,9 +84,9 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 			},
 			Setup: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
 				for range 10 {
-					_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+					_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 						WaitingContainer: sampleKubeWaitingContFn(t, uuid.NewString()),
-					})
+					}.Build())
 					require.NoError(t, err)
 				}
 			},
@@ -116,27 +116,27 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				return kubeAuthFn
 			},
 			Setup: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 					WaitingContainer: sampleKubeWaitingContFn(t, wcName),
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				out, err := resourceSvc.GetKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
+				out, err := resourceSvc.GetKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest_builder{
 					Username:      username,
 					Cluster:       cluster,
 					Namespace:     namespace,
 					PodName:       podName,
 					ContainerName: wcName,
-				})
+				}.Build())
 				require.NoError(t, err)
-				require.Equal(t, wcName, out.Metadata.Name)
-				require.Equal(t, username, out.Spec.Username)
-				require.Equal(t, cluster, out.Spec.Cluster)
-				require.Equal(t, namespace, out.Spec.Namespace)
-				require.Equal(t, podName, out.Spec.PodName)
-				require.Equal(t, wcName, out.Spec.ContainerName)
-				require.Equal(t, patchType, out.Spec.PatchType)
+				require.Equal(t, wcName, out.GetMetadata().GetName())
+				require.Equal(t, username, out.GetSpec().GetUsername())
+				require.Equal(t, cluster, out.GetSpec().GetCluster())
+				require.Equal(t, namespace, out.GetSpec().GetNamespace())
+				require.Equal(t, podName, out.GetSpec().GetPodName())
+				require.Equal(t, wcName, out.GetSpec().GetContainerName())
+				require.Equal(t, patchType, out.GetSpec().GetPatchType())
 			},
 		},
 		{
@@ -147,13 +147,13 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				})
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.GetKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.GetKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest_builder{
 					Username:      username,
 					Cluster:       cluster,
 					Namespace:     namespace,
 					PodName:       podName,
 					ContainerName: wcName,
-				})
+				}.Build())
 				require.Error(t, err)
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -164,13 +164,13 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				return kubeAuthFn
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.GetKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.GetKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest_builder{
 					Username:      username,
 					Cluster:       cluster,
 					Namespace:     namespace,
 					PodName:       podName,
 					ContainerName: wcName,
-				})
+				}.Build())
 				require.Error(t, err)
 				require.True(t, trace.IsNotFound(err))
 			},
@@ -183,17 +183,17 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				return kubeAuthFn
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				out, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+				out, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 					WaitingContainer: sampleKubeWaitingContFn(t, wcName),
-				})
+				}.Build())
 				require.NoError(t, err)
-				require.Equal(t, wcName, out.Metadata.Name)
-				require.Equal(t, username, out.Spec.Username)
-				require.Equal(t, cluster, out.Spec.Cluster)
-				require.Equal(t, namespace, out.Spec.Namespace)
-				require.Equal(t, podName, out.Spec.PodName)
-				require.Equal(t, wcName, out.Spec.ContainerName)
-				require.Equal(t, patchType, out.Spec.PatchType)
+				require.Equal(t, wcName, out.GetMetadata().GetName())
+				require.Equal(t, username, out.GetSpec().GetUsername())
+				require.Equal(t, cluster, out.GetSpec().GetCluster())
+				require.Equal(t, namespace, out.GetSpec().GetNamespace())
+				require.Equal(t, podName, out.GetSpec().GetPodName())
+				require.Equal(t, wcName, out.GetSpec().GetContainerName())
+				require.Equal(t, patchType, out.GetSpec().GetPatchType())
 			},
 		},
 		{
@@ -204,9 +204,9 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				})
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 					WaitingContainer: sampleKubeWaitingContFn(t, wcName),
-				})
+				}.Build())
 				require.Error(t, err)
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -217,15 +217,15 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				return kubeAuthFn
 			},
 			Setup: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 					WaitingContainer: sampleKubeWaitingContFn(t, wcName),
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 					WaitingContainer: sampleKubeWaitingContFn(t, wcName),
-				})
+				}.Build())
 				require.Error(t, err)
 				require.True(t, trace.IsAlreadyExists(err))
 			},
@@ -238,19 +238,19 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				return kubeAuthFn
 			},
 			Setup: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.CreateKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.CreateKubernetesWaitingContainerRequest_builder{
 					WaitingContainer: sampleKubeWaitingContFn(t, wcName),
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.DeleteKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest_builder{
 					Username:      username,
 					Cluster:       cluster,
 					Namespace:     namespace,
 					PodName:       podName,
 					ContainerName: wcName,
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 		},
@@ -262,13 +262,13 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				})
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.DeleteKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest_builder{
 					Username:      username,
 					Cluster:       cluster,
 					Namespace:     namespace,
 					PodName:       podName,
 					ContainerName: wcName,
-				})
+				}.Build())
 				require.Error(t, err)
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -279,13 +279,13 @@ func TestKubeWaitingContainerServiceCRUD(t *testing.T) {
 				return kubeAuthFn
 			},
 			Test: func(t *testing.T, ctx context.Context, resourceSvc *Service, wcName string) {
-				_, err := resourceSvc.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
+				_, err := resourceSvc.DeleteKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest_builder{
 					Username:      username,
 					Cluster:       cluster,
 					Namespace:     namespace,
 					PodName:       podName,
 					ContainerName: wcName,
-				})
+				}.Build())
 				require.Error(t, err)
 				require.True(t, trace.IsNotFound(err))
 			},
diff --git a/lib/auth/linuxdesktop/linuxdesktopv1/desktop.go b/lib/auth/linuxdesktop/linuxdesktopv1/desktop.go
index cbb990eb9c6..766f9ee82b4 100644
--- a/lib/auth/linuxdesktop/linuxdesktopv1/desktop.go
+++ b/lib/auth/linuxdesktop/linuxdesktopv1/desktop.go
@@ -25,15 +25,15 @@ import (
 )
 
 func NewLinuxDesktop(name string, spec *linuxdesktopv1pb.LinuxDesktopSpec) (*linuxdesktopv1pb.LinuxDesktop, error) {
-	return &linuxdesktopv1pb.LinuxDesktop{
+	return linuxdesktopv1pb.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
+		}.Build(),
 		Spec: spec,
-	}, nil
+	}.Build(), nil
 }
 
 func ValidateLinuxDesktop(desktop *linuxdesktopv1pb.LinuxDesktop) error {
diff --git a/lib/auth/linuxdesktop/linuxdesktopv1/desktop_test.go b/lib/auth/linuxdesktop/linuxdesktopv1/desktop_test.go
index 80913c5ca38..9c8229e454c 100644
--- a/lib/auth/linuxdesktop/linuxdesktopv1/desktop_test.go
+++ b/lib/auth/linuxdesktop/linuxdesktopv1/desktop_test.go
@@ -32,10 +32,10 @@ import (
 func TestNewLinuxDesktop(t *testing.T) {
 	t.Parallel()
 
-	spec := &linuxdesktopv1pb.LinuxDesktopSpec{
+	spec := linuxdesktopv1pb.LinuxDesktopSpec_builder{
 		Addr:     "127.0.0.1:22",
 		Hostname: "desktop-1",
-	}
+	}.Build()
 	desktop, err := NewLinuxDesktop("desktop-1", spec)
 	require.NoError(t, err)
 	require.Equal(t, types.KindLinuxDesktop, desktop.GetKind())
@@ -47,17 +47,17 @@ func TestNewLinuxDesktop(t *testing.T) {
 func TestValidateLinuxDesktop(t *testing.T) {
 	t.Parallel()
 
-	valid := &linuxdesktopv1pb.LinuxDesktop{
+	valid := linuxdesktopv1pb.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "desktop-1",
-		},
-		Spec: &linuxdesktopv1pb.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1pb.LinuxDesktopSpec_builder{
 			Addr:     "127.0.0.1:22",
 			Hostname: "host",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	tests := []struct {
 		name    string
@@ -75,44 +75,44 @@ func TestValidateLinuxDesktop(t *testing.T) {
 		},
 		{
 			name: "missing metadata",
-			desktop: &linuxdesktopv1pb.LinuxDesktop{
-				Spec: valid.Spec,
-			},
+			desktop: linuxdesktopv1pb.LinuxDesktop_builder{
+				Spec: valid.GetSpec(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "missing name",
-			desktop: &linuxdesktopv1pb.LinuxDesktop{
+			desktop: linuxdesktopv1pb.LinuxDesktop_builder{
 				Metadata: &headerv1.Metadata{},
-				Spec:     valid.Spec,
-			},
+				Spec:     valid.GetSpec(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "missing spec",
-			desktop: &linuxdesktopv1pb.LinuxDesktop{
-				Metadata: valid.Metadata,
-			},
+			desktop: linuxdesktopv1pb.LinuxDesktop_builder{
+				Metadata: valid.GetMetadata(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "missing addr",
-			desktop: &linuxdesktopv1pb.LinuxDesktop{
-				Metadata: valid.Metadata,
-				Spec: &linuxdesktopv1pb.LinuxDesktopSpec{
+			desktop: linuxdesktopv1pb.LinuxDesktop_builder{
+				Metadata: valid.GetMetadata(),
+				Spec: linuxdesktopv1pb.LinuxDesktopSpec_builder{
 					Hostname: "host",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "missing hostname",
-			desktop: &linuxdesktopv1pb.LinuxDesktop{
-				Metadata: valid.Metadata,
-				Spec: &linuxdesktopv1pb.LinuxDesktopSpec{
+			desktop: linuxdesktopv1pb.LinuxDesktop_builder{
+				Metadata: valid.GetMetadata(),
+				Spec: linuxdesktopv1pb.LinuxDesktopSpec_builder{
 					Addr: "127.0.0.1:22",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 	}
diff --git a/lib/auth/linuxdesktop/linuxdesktopv1/service.go b/lib/auth/linuxdesktop/linuxdesktopv1/service.go
index 9e683ee69b8..4954f2e0e30 100644
--- a/lib/auth/linuxdesktop/linuxdesktopv1/service.go
+++ b/lib/auth/linuxdesktop/linuxdesktopv1/service.go
@@ -136,7 +136,7 @@ func (s *Service) ListLinuxDesktops(ctx context.Context, req *linuxdesktopv1.Lis
 
 			return nil, false
 		}),
-		int(req.PageSize),
+		int(req.GetPageSize()),
 		func(t *linuxdesktopv1.LinuxDesktop) string {
 			return t.GetMetadata().GetName()
 		})
@@ -145,10 +145,10 @@ func (s *Service) ListLinuxDesktops(ctx context.Context, req *linuxdesktopv1.Lis
 		return nil, trace.Wrap(err)
 	}
 
-	return &linuxdesktopv1.ListLinuxDesktopsResponse{
+	return linuxdesktopv1.ListLinuxDesktopsResponse_builder{
 		LinuxDesktops: rsp,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // GetLinuxDesktop returns Linux desktop resource.
diff --git a/lib/auth/linuxdesktop/linuxdesktopv1/service_test.go b/lib/auth/linuxdesktop/linuxdesktopv1/service_test.go
index 7cc32bf2b16..c8e188e9e9c 100644
--- a/lib/auth/linuxdesktop/linuxdesktopv1/service_test.go
+++ b/lib/auth/linuxdesktop/linuxdesktopv1/service_test.go
@@ -186,10 +186,10 @@ func allowChecks(checks ...check) map[check]bool {
 func newTestDesktop(t *testing.T, name string) *linuxdesktopv1pb.LinuxDesktop {
 	t.Helper()
 
-	desktop, err := NewLinuxDesktop(name, &linuxdesktopv1pb.LinuxDesktopSpec{
+	desktop, err := NewLinuxDesktop(name, linuxdesktopv1pb.LinuxDesktopSpec_builder{
 		Addr:     "127.0.0.1:22",
 		Hostname: "desktop-host",
-	})
+	}.Build())
 	require.NoError(t, err)
 	return desktop
 }
@@ -213,10 +213,10 @@ func TestServiceListLinuxDesktops(t *testing.T) {
 	}
 	service := newTestService(t, checker, authz.AdminActionAuthNotRequired, backend, reader)
 
-	resp, err := service.ListLinuxDesktops(ctx, &linuxdesktopv1pb.ListLinuxDesktopsRequest{
+	resp, err := service.ListLinuxDesktops(ctx, linuxdesktopv1pb.ListLinuxDesktopsRequest_builder{
 		PageSize:  10,
 		PageToken: "next-token",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, []*linuxdesktopv1pb.LinuxDesktop{desktop}, resp.GetLinuxDesktops())
 	require.Empty(t, resp.GetNextPageToken())
@@ -246,9 +246,9 @@ func TestServiceGetLinuxDesktop(t *testing.T) {
 	}
 	service := newTestService(t, checker, authz.AdminActionAuthNotRequired, backend, reader)
 
-	resp, err := service.GetLinuxDesktop(ctx, &linuxdesktopv1pb.GetLinuxDesktopRequest{
+	resp, err := service.GetLinuxDesktop(ctx, linuxdesktopv1pb.GetLinuxDesktopRequest_builder{
 		Name: "desktop-1",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, desktop, resp)
 	require.True(t, reader.getCalled)
@@ -273,9 +273,9 @@ func TestServiceCreateLinuxDesktop(t *testing.T) {
 	}
 	service := newTestService(t, checker, authz.AdminActionAuthNotRequired, backend, reader)
 
-	resp, err := service.CreateLinuxDesktop(ctx, &linuxdesktopv1pb.CreateLinuxDesktopRequest{
+	resp, err := service.CreateLinuxDesktop(ctx, linuxdesktopv1pb.CreateLinuxDesktopRequest_builder{
 		LinuxDesktop: desktop,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, desktop, resp)
 	require.True(t, backend.createCalled)
@@ -319,9 +319,9 @@ func TestServiceUpdateLinuxDesktop(t *testing.T) {
 	}
 	service := newTestService(t, checker, authz.AdminActionAuthNotRequired, backend, reader)
 
-	resp, err := service.UpdateLinuxDesktop(ctx, &linuxdesktopv1pb.UpdateLinuxDesktopRequest{
+	resp, err := service.UpdateLinuxDesktop(ctx, linuxdesktopv1pb.UpdateLinuxDesktopRequest_builder{
 		LinuxDesktop: desktop,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, desktop, resp)
 	require.True(t, backend.updateCalled)
@@ -366,9 +366,9 @@ func TestServiceUpsertLinuxDesktop(t *testing.T) {
 	}
 	service := newTestService(t, checker, authz.AdminActionAuthNotRequired, backend, reader)
 
-	resp, err := service.UpsertLinuxDesktop(ctx, &linuxdesktopv1pb.UpsertLinuxDesktopRequest{
+	resp, err := service.UpsertLinuxDesktop(ctx, linuxdesktopv1pb.UpsertLinuxDesktopRequest_builder{
 		LinuxDesktop: desktop,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, desktop, resp)
 	require.True(t, backend.upsertCalled)
@@ -413,9 +413,9 @@ func TestServiceDeleteLinuxDesktop(t *testing.T) {
 	}
 	service := newTestService(t, checker, authz.AdminActionAuthNotRequired, backend, reader)
 
-	_, err := service.DeleteLinuxDesktop(ctx, &linuxdesktopv1pb.DeleteLinuxDesktopRequest{
+	_, err := service.DeleteLinuxDesktop(ctx, linuxdesktopv1pb.DeleteLinuxDesktopRequest_builder{
 		Name: "desktop-1",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.True(t, backend.deleteCalled)
 	require.Equal(t, "desktop-1", backend.deleteName)
@@ -439,9 +439,9 @@ func TestServiceAdminActionRequired(t *testing.T) {
 		{
 			name: "create",
 			call: func(ctx context.Context, svc *Service) error {
-				_, err := svc.CreateLinuxDesktop(ctx, &linuxdesktopv1pb.CreateLinuxDesktopRequest{
+				_, err := svc.CreateLinuxDesktop(ctx, linuxdesktopv1pb.CreateLinuxDesktopRequest_builder{
 					LinuxDesktop: desktop,
-				})
+				}.Build())
 				return err
 			},
 			backendCheck: func(t *testing.T, backend *fakeBackend) {
@@ -452,9 +452,9 @@ func TestServiceAdminActionRequired(t *testing.T) {
 		{
 			name: "update",
 			call: func(ctx context.Context, svc *Service) error {
-				_, err := svc.UpdateLinuxDesktop(ctx, &linuxdesktopv1pb.UpdateLinuxDesktopRequest{
+				_, err := svc.UpdateLinuxDesktop(ctx, linuxdesktopv1pb.UpdateLinuxDesktopRequest_builder{
 					LinuxDesktop: desktop,
-				})
+				}.Build())
 				return err
 			},
 			backendCheck: func(t *testing.T, backend *fakeBackend) {
@@ -465,9 +465,9 @@ func TestServiceAdminActionRequired(t *testing.T) {
 		{
 			name: "upsert",
 			call: func(ctx context.Context, svc *Service) error {
-				_, err := svc.UpsertLinuxDesktop(ctx, &linuxdesktopv1pb.UpsertLinuxDesktopRequest{
+				_, err := svc.UpsertLinuxDesktop(ctx, linuxdesktopv1pb.UpsertLinuxDesktopRequest_builder{
 					LinuxDesktop: desktop,
-				})
+				}.Build())
 				return err
 			},
 			backendCheck: func(t *testing.T, backend *fakeBackend) {
@@ -481,9 +481,9 @@ func TestServiceAdminActionRequired(t *testing.T) {
 		{
 			name: "delete",
 			call: func(ctx context.Context, svc *Service) error {
-				_, err := svc.DeleteLinuxDesktop(ctx, &linuxdesktopv1pb.DeleteLinuxDesktopRequest{
+				_, err := svc.DeleteLinuxDesktop(ctx, linuxdesktopv1pb.DeleteLinuxDesktopRequest_builder{
 					Name: "desktop-1",
-				})
+				}.Build())
 				return err
 			},
 			backendCheck: func(t *testing.T, backend *fakeBackend) {
diff --git a/lib/auth/machineid/machineidv1/auto_update_version_reporter.go b/lib/auth/machineid/machineidv1/auto_update_version_reporter.go
index 756620b3494..6bf77ab48dc 100644
--- a/lib/auth/machineid/machineidv1/auto_update_version_reporter.go
+++ b/lib/auth/machineid/machineidv1/auto_update_version_reporter.go
@@ -267,24 +267,24 @@ func (r *AutoUpdateVersionReporter) generateReport(ctx context.Context) error {
 			// If the bot did not send an ExternalUpdater, it does not properly
 			// support managed updates - so we put it in the no-group ("") group.
 			var groupName string
-			if ui := latest.GetUpdaterInfo(); latest.ExternalUpdater != "" && ui != nil {
+			if ui := latest.GetUpdaterInfo(); latest.GetExternalUpdater() != "" && ui != nil {
 				groupName = ui.UpdateGroup
 			}
 
 			group, ok := groups[groupName]
 			if !ok {
-				group = &autoupdate.AutoUpdateBotInstanceReportSpecGroup{
+				group = autoupdate.AutoUpdateBotInstanceReportSpecGroup_builder{
 					Versions: make(map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion),
-				}
+				}.Build()
 				groups[groupName] = group
 			}
 
-			version, ok := group.Versions[latest.GetVersion()]
+			version, ok := group.GetVersions()[latest.GetVersion()]
 			if !ok {
 				version = &autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{}
-				group.Versions[latest.GetVersion()] = version
+				group.GetVersions()[latest.GetVersion()] = version
 			}
-			version.Count++
+			version.SetCount(version.GetCount() + 1)
 		}
 
 		if nextToken == "" || len(instances) == 0 {
@@ -292,10 +292,10 @@ func (r *AutoUpdateVersionReporter) generateReport(ctx context.Context) error {
 		}
 	}
 
-	report, err := update.NewAutoUpdateBotInstanceReport(&autoupdate.AutoUpdateBotInstanceReportSpec{
+	report, err := update.NewAutoUpdateBotInstanceReport(autoupdate.AutoUpdateBotInstanceReportSpec_builder{
 		Timestamp: timestamppb.New(r.clock.Now()),
 		Groups:    groups,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "creating report")
 	}
@@ -338,13 +338,13 @@ func EmitInstancesMetric(report *autoupdate.AutoUpdateBotInstanceReport, gauge *
 				gauge.With(prometheus.Labels{
 					teleport.TagVersion:          version,
 					teleport.TagAutomaticUpdates: "false",
-				}).Set(float64(versionMetrics.Count))
+				}).Set(float64(versionMetrics.GetCount()))
 			}
 			continue
 		}
 
 		for version, metrics := range groupMetrics.GetVersions() {
-			byVersion[version] += metrics.Count
+			byVersion[version] += metrics.GetCount()
 		}
 	}
 
diff --git a/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go b/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go
index c87314315c4..da38fb76582 100644
--- a/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go
+++ b/lib/auth/machineid/machineidv1/auto_update_version_reporter_test.go
@@ -69,25 +69,25 @@ func TestAutoUpdateVersionReporter(t *testing.T) {
 	createBotInstance := func(t *testing.T, group string, versions []string) {
 		t.Helper()
 
-		_, err = botInstanceService.CreateBotInstance(ctx, &machineidv1pb.BotInstance{
-			Metadata: &headerv1.Metadata{
+		_, err = botInstanceService.CreateBotInstance(ctx, machineidv1pb.BotInstance_builder{
+			Metadata: headerv1.Metadata_builder{
 				Expires: timestamppb.New(clock.Now().Add(1 * time.Hour)),
-			},
-			Spec: &machineidv1pb.BotInstanceSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotInstanceSpec_builder{
 				InstanceId: uuid.NewString(),
 				BotName:    "bot-1234",
-			},
-			Status: &machineidv1pb.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1pb.BotInstanceStatus_builder{
 				LatestHeartbeats: slices.Map(versions, func(v string) *machineidv1pb.BotInstanceStatusHeartbeat {
-					heartbeat := &machineidv1pb.BotInstanceStatusHeartbeat{Version: v}
+					heartbeat := machineidv1pb.BotInstanceStatusHeartbeat_builder{Version: v}.Build()
 					if group != "" {
-						heartbeat.ExternalUpdater = "kube"
-						heartbeat.UpdaterInfo = &types.UpdaterV2Info{UpdateGroup: group}
+						heartbeat.SetExternalUpdater("kube")
+						heartbeat.SetUpdaterInfo(&types.UpdaterV2Info{UpdateGroup: group})
 					}
 					return heartbeat
 				}),
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 	createBotInstance(t, "", []string{"17.0.0", "18.0.0"})
@@ -124,29 +124,29 @@ func TestAutoUpdateVersionReporter(t *testing.T) {
 	require.NoError(t, err)
 
 	diff := cmp.Diff(
-		&autoupdatev1pb.AutoUpdateBotInstanceReportSpec{
+		autoupdatev1pb.AutoUpdateBotInstanceReportSpec_builder{
 			Timestamp: timestamppb.New(clock.Now()),
 			Groups: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup{
-				"prod": {
+				"prod": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup_builder{
 					Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
-						"18.1.0": {Count: 1},
+						"18.1.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
 					},
-				},
-				"stage": {
+				}.Build(),
+				"stage": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup_builder{
 					Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
-						"19.0.0-dev": {Count: 1},
+						"19.0.0-dev": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
 					},
-				},
+				}.Build(),
 
 				// Unmanaged (no-group) group.
-				"": {
+				"": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup_builder{
 					Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
-						"18.0.0": {Count: 1},
-						"18.1.0": {Count: 2},
+						"18.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
+						"18.1.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 2}.Build(),
 					},
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		report.GetSpec(),
 		protocmp.Transform(),
 	)
@@ -171,30 +171,30 @@ func TestEmitInstancesMetric(t *testing.T) {
 	)
 
 	machineidv1.EmitInstancesMetric(
-		&autoupdatev1pb.AutoUpdateBotInstanceReport{
-			Spec: &autoupdatev1pb.AutoUpdateBotInstanceReportSpec{
+		autoupdatev1pb.AutoUpdateBotInstanceReport_builder{
+			Spec: autoupdatev1pb.AutoUpdateBotInstanceReportSpec_builder{
 				Groups: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup{
-					"prod": {
+					"prod": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
-							"18.0.0": {Count: 1},
-							"19.0.0": {Count: 1},
+							"18.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
+							"19.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					"stage": {
+					}.Build(),
+					"stage": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
-							"18.0.0": {Count: 1},
-							"19.0.0": {Count: 1},
+							"18.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
+							"19.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					"": {
+					}.Build(),
+					"": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion{
-							"19.0.0": {Count: 123},
-							"20.0.0": {Count: 321},
+							"19.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 123}.Build(),
+							"20.0.0": autoupdatev1pb.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 321}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 		gauge,
 	)
 
diff --git a/lib/auth/machineid/machineidv1/bot_instance_service.go b/lib/auth/machineid/machineidv1/bot_instance_service.go
index 7bbfe3b2ea1..585d696f2d7 100644
--- a/lib/auth/machineid/machineidv1/bot_instance_service.go
+++ b/lib/auth/machineid/machineidv1/bot_instance_service.go
@@ -129,7 +129,7 @@ func (b *BotInstanceService) DeleteBotInstance(ctx context.Context, req *pb.Dele
 		return nil, trace.Wrap(err)
 	}
 
-	instance, err := b.backend.GetBotInstance(ctx, req.BotName, req.InstanceId)
+	instance, err := b.backend.GetBotInstance(ctx, req.GetBotName(), req.GetInstanceId())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -137,7 +137,7 @@ func (b *BotInstanceService) DeleteBotInstance(ctx context.Context, req *pb.Dele
 	ruleCtx.Resource153 = instance
 	if err := authCtx.CheckerContext.Decision(
 		ctx,
-		instance.Scope,
+		instance.GetScope(),
 		func(checker *services.ScopedAccessChecker) error {
 			return checker.CheckAccessToRules(
 				&ruleCtx,
@@ -158,7 +158,7 @@ func (b *BotInstanceService) DeleteBotInstance(ctx context.Context, req *pb.Dele
 	}
 
 	if err := b.backend.DeleteBotInstance(
-		ctx, instance.Spec.BotName, instance.Spec.InstanceId,
+		ctx, instance.GetSpec().GetBotName(), instance.GetSpec().GetInstanceId(),
 	); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -182,7 +182,7 @@ func (b *BotInstanceService) GetBotInstance(ctx context.Context, req *pb.GetBotI
 		return nil, trace.Wrap(err)
 	}
 
-	res, err := b.cache.GetBotInstance(ctx, req.BotName, req.InstanceId)
+	res, err := b.cache.GetBotInstance(ctx, req.GetBotName(), req.GetInstanceId())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -190,7 +190,7 @@ func (b *BotInstanceService) GetBotInstance(ctx context.Context, req *pb.GetBotI
 	ruleCtx.Resource153 = res
 	if err := authCtx.CheckerContext.Decision(
 		ctx,
-		res.Scope,
+		res.GetScope(),
 		func(checker *services.ScopedAccessChecker) error {
 			return checker.CheckAccessToRules(
 				&ruleCtx,
@@ -213,16 +213,16 @@ func (b *BotInstanceService) ListBotInstances(ctx context.Context, req *pb.ListB
 		sortField = req.GetSort().Field
 		sortDesc = req.GetSort().IsDesc
 	}
-	return b.ListBotInstancesV2(ctx, &pb.ListBotInstancesV2Request{
+	return b.ListBotInstancesV2(ctx, pb.ListBotInstancesV2Request_builder{
 		PageSize:  req.GetPageSize(),
 		PageToken: req.GetPageToken(),
 		SortField: sortField,
 		SortDesc:  sortDesc,
-		Filter: &pb.ListBotInstancesV2Request_Filters{
+		Filter: pb.ListBotInstancesV2Request_Filters_builder{
 			BotName:    req.GetFilterBotName(),
 			SearchTerm: req.GetFilterSearchTerm(),
-		},
-	})
+		}.Build(),
+	}.Build())
 }
 
 // ListBotInstancesV2 returns a list of bot instances matching the criteria in the request
@@ -243,8 +243,8 @@ func (b *BotInstanceService) ListBotInstancesV2(ctx context.Context, req *pb.Lis
 
 	botInstances, nextToken, err := b.cache.ListBotInstances(
 		ctx,
-		int(req.PageSize),
-		req.PageToken,
+		int(req.GetPageSize()),
+		req.GetPageToken(),
 		&services.ListBotInstancesRequestOptions{
 			SortField:        req.GetSortField(),
 			SortDesc:         req.GetSortDesc(),
@@ -256,7 +256,7 @@ func (b *BotInstanceService) ListBotInstancesV2(ctx context.Context, req *pb.Lis
 				ruleCtx.Resource153 = botInstance
 				err := authCtx.CheckerContext.Decision(
 					ctx,
-					botInstance.Scope,
+					botInstance.GetScope(),
 					func(checker *services.ScopedAccessChecker) error {
 						return checker.CheckAccessToRules(
 							&ruleCtx,
@@ -274,10 +274,10 @@ func (b *BotInstanceService) ListBotInstancesV2(ctx context.Context, req *pb.Lis
 		return nil, trace.Wrap(err)
 	}
 
-	return &pb.ListBotInstancesResponse{
+	return pb.ListBotInstancesResponse_builder{
 		BotInstances:  botInstances,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // SubmitHeartbeat records heartbeat information for a bot
@@ -286,7 +286,7 @@ func (b *BotInstanceService) SubmitHeartbeat(ctx context.Context, req *pb.Submit
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if req.Heartbeat == nil {
+	if !req.HasHeartbeat() {
 		return nil, trace.BadParameter("heartbeat: must be non-nil")
 	}
 
@@ -316,7 +316,7 @@ func (b *BotInstanceService) SubmitHeartbeat(ctx context.Context, req *pb.Submit
 	// flag set - however - once sufficient time has passed and we're sure all
 	// existing bots will have the BotInternal flag set in their certs, we can
 	// make this check always applied.
-	if ident.ScopePin != nil && ident.ScopePin.Scope != "" {
+	if ident.ScopePin != nil && ident.ScopePin.GetScope() != "" {
 		if !ident.BotInternal {
 			return nil, trace.AccessDenied("identity not marked BotInternal")
 		}
@@ -327,28 +327,28 @@ func (b *BotInstanceService) SubmitHeartbeat(ctx context.Context, req *pb.Submit
 		"Received bot instance heartbeat",
 		"bot_name", botName,
 		"bot_instance", botInstanceID,
-		"heartbeat", logutils.StringerAttr(req.Heartbeat),
+		"heartbeat", logutils.StringerAttr(req.GetHeartbeat()),
 	)
 	_, err = b.backend.PatchBotInstance(ctx, botName, botInstanceID, func(instance *pb.BotInstance) (*pb.BotInstance, error) {
-		if instance.Status == nil {
-			instance.Status = &pb.BotInstanceStatus{}
+		if !instance.HasStatus() {
+			instance.SetStatus(&pb.BotInstanceStatus{})
 		}
 		// Set initial heartbeat if not set.
-		if instance.Status.InitialHeartbeat == nil {
-			instance.Status.InitialHeartbeat = req.Heartbeat
+		if !instance.GetStatus().HasInitialHeartbeat() {
+			instance.GetStatus().SetInitialHeartbeat(req.GetHeartbeat())
 		}
 		// If we're at or above the limit, remove enough of the front
 		// elements to make room for the new one at the end.
-		if len(instance.Status.LatestHeartbeats) >= heartbeatHistoryLimit {
-			toRemove := len(instance.Status.LatestHeartbeats) - heartbeatHistoryLimit + 1
-			instance.Status.LatestHeartbeats = instance.Status.LatestHeartbeats[toRemove:]
+		if len(instance.GetStatus().GetLatestHeartbeats()) >= heartbeatHistoryLimit {
+			toRemove := len(instance.GetStatus().GetLatestHeartbeats()) - heartbeatHistoryLimit + 1
+			instance.GetStatus().SetLatestHeartbeats(instance.GetStatus().GetLatestHeartbeats()[toRemove:])
 		}
 		// Append the new heartbeat to the end.
-		instance.Status.LatestHeartbeats = append(instance.Status.LatestHeartbeats, req.Heartbeat)
+		instance.GetStatus().SetLatestHeartbeats(append(instance.GetStatus().GetLatestHeartbeats(), req.GetHeartbeat()))
 
 		if storeHeartbeatExtras() {
 			// Overwrite the service health.
-			instance.Status.ServiceHealth = req.ServiceHealth
+			instance.GetStatus().SetServiceHealth(req.GetServiceHealth())
 		}
 
 		return instance, nil
diff --git a/lib/auth/machineid/machineidv1/bot_instance_service_test.go b/lib/auth/machineid/machineidv1/bot_instance_service_test.go
index c6e13c41236..61b5da56529 100644
--- a/lib/auth/machineid/machineidv1/bot_instance_service_test.go
+++ b/lib/auth/machineid/machineidv1/bot_instance_service_test.go
@@ -53,7 +53,7 @@ const (
 func insertTestBotInstance(t *testing.T, backend *local.BotInstanceService) {
 	t.Helper()
 	bi := newBotInstance(testBotName)
-	bi.Spec.InstanceId = testInstanceID
+	bi.GetSpec().SetInstanceId(testInstanceID)
 	_, err := backend.CreateBotInstance(t.Context(), bi)
 	require.NoError(t, err)
 }
@@ -195,61 +195,61 @@ func TestBotInstanceServiceReadDelete(t *testing.T) {
 
 	// Make sure we can get all foo instances
 	for id := range idsFoo {
-		ins, err := service.GetBotInstance(ctx, &machineidv1.GetBotInstanceRequest{
+		ins, err := service.GetBotInstance(ctx, machineidv1.GetBotInstanceRequest_builder{
 			BotName:    "foo",
 			InstanceId: id,
-		})
+		}.Build())
 		require.NoError(t, err)
 
-		require.Equal(t, "foo", ins.Spec.BotName)
-		require.Equal(t, id, ins.Spec.InstanceId)
+		require.Equal(t, "foo", ins.GetSpec().GetBotName())
+		require.Equal(t, id, ins.GetSpec().GetInstanceId())
 	}
 
 	// Make sure we can get all bar instances
 	for id := range idsBar {
-		ins, err := service.GetBotInstance(ctx, &machineidv1.GetBotInstanceRequest{
+		ins, err := service.GetBotInstance(ctx, machineidv1.GetBotInstanceRequest_builder{
 			BotName:    "bar",
 			InstanceId: id,
-		})
+		}.Build())
 		require.NoError(t, err)
 
-		require.Equal(t, "bar", ins.Spec.BotName)
-		require.Equal(t, id, ins.Spec.InstanceId)
+		require.Equal(t, "bar", ins.GetSpec().GetBotName())
+		require.Equal(t, id, ins.GetSpec().GetInstanceId())
 	}
 
 	// List should work
 	fooInstances := listInstances(t, ctx, service, "foo")
 	require.Len(t, fooInstances, 3)
 	for _, bi := range fooInstances {
-		require.Contains(t, idsFoo, bi.Spec.InstanceId)
+		require.Contains(t, idsFoo, bi.GetSpec().GetInstanceId())
 	}
 
 	barInstances := listInstances(t, ctx, service, "bar")
 	require.Len(t, barInstances, 3)
 	for _, bi := range barInstances {
-		require.Contains(t, idsBar, bi.Spec.InstanceId)
+		require.Contains(t, idsBar, bi.GetSpec().GetInstanceId())
 	}
 
 	allInstances := listInstances(t, ctx, service, "")
 	require.Len(t, allInstances, 6)
 	for _, bi := range allInstances {
-		require.Contains(t, idsAll, bi.Spec.InstanceId)
+		require.Contains(t, idsAll, bi.GetSpec().GetInstanceId())
 	}
 
 	// Attempt to delete everything
 	for id := range idsFoo {
-		_, err := service.DeleteBotInstance(ctx, &machineidv1.DeleteBotInstanceRequest{
+		_, err := service.DeleteBotInstance(ctx, machineidv1.DeleteBotInstanceRequest_builder{
 			BotName:    "foo",
 			InstanceId: id,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
 	for id := range idsBar {
-		_, err := service.DeleteBotInstance(ctx, &machineidv1.DeleteBotInstanceRequest{
+		_, err := service.DeleteBotInstance(ctx, machineidv1.DeleteBotInstanceRequest_builder{
 			BotName:    "bar",
 			InstanceId: id,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -287,43 +287,43 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "success",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					Hostname: "llama",
-				},
+				}.Build(),
 				ServiceHealth: []*machineidv1.BotInstanceServiceHealth{
-					{
-						Service: &machineidv1.BotInstanceServiceIdentifier{
+					machineidv1.BotInstanceServiceHealth_builder{
+						Service: machineidv1.BotInstanceServiceIdentifier_builder{
 							Type: "application-tunnel",
 							Name: "my-application-tunnel",
-						},
+						}.Build(),
 						Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
 						Reason: ptr("application is broken"),
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			identity:      goodIdentity,
 			assertErr:     assert.NoError,
 			wantHeartbeat: true,
 			wantServiceHealth: []*machineidv1.BotInstanceServiceHealth{
-				{
-					Service: &machineidv1.BotInstanceServiceIdentifier{
+				machineidv1.BotInstanceServiceHealth_builder{
+					Service: machineidv1.BotInstanceServiceIdentifier_builder{
 						Type: "application-tunnel",
 						Name: "my-application-tunnel",
-					},
+					}.Build(),
 					Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
 					Reason: ptr("application is broken"),
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:              "missing bot name",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					Hostname: "llama",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			identity: tlsca.Identity{
 				BotInstanceID: botInstanceID,
 			},
@@ -335,11 +335,11 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "missing instance id",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					Hostname: "llama",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			identity: tlsca.Identity{
 				BotName: botName,
 			},
@@ -351,11 +351,11 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "bot instance does not exist",
 			createBotInstance: false,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					Hostname: "llama",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			identity: goodIdentity,
 			assertErr: func(t assert.TestingT, err error, i ...any) bool {
 				return assert.True(t, trace.IsNotFound(err))
@@ -364,9 +364,9 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "missing heartbeat",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
 				Heartbeat: nil,
-			},
+			}.Build(),
 			identity: goodIdentity,
 			assertErr: func(t assert.TestingT, err error, i ...any) bool {
 				return assert.True(t, trace.IsBadParameter(err)) && assert.Contains(t, err.Error(), "heartbeat: must be non-nil")
@@ -376,21 +376,21 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "service name too long",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					Hostname: "llama",
-				},
+				}.Build(),
 				ServiceHealth: []*machineidv1.BotInstanceServiceHealth{
-					{
-						Service: &machineidv1.BotInstanceServiceIdentifier{
+					machineidv1.BotInstanceServiceHealth_builder{
+						Service: machineidv1.BotInstanceServiceIdentifier_builder{
 							Type: "application-tunnel",
 							Name: strings.Repeat("a", 100),
-						},
+						}.Build(),
 						Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
 						Reason: ptr("application is broken"),
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			identity: goodIdentity,
 			assertErr: func(t assert.TestingT, err error, i ...any) bool {
 				return assert.True(t, trace.IsBadParameter(err)) && assert.Contains(t, err.Error(), "is longer than 64 bytes")
@@ -400,21 +400,21 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "status reason too long",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					Hostname: "llama",
-				},
+				}.Build(),
 				ServiceHealth: []*machineidv1.BotInstanceServiceHealth{
-					{
-						Service: &machineidv1.BotInstanceServiceIdentifier{
+					machineidv1.BotInstanceServiceHealth_builder{
+						Service: machineidv1.BotInstanceServiceIdentifier_builder{
 							Type: "application-tunnel",
 							Name: "my-application-tunnel",
-						},
+						}.Build(),
 						Status: machineidv1.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
 						Reason: ptr(strings.Repeat("a", 300)),
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			identity: goodIdentity,
 			assertErr: func(t assert.TestingT, err error, i ...any) bool {
 				return assert.True(t, trace.IsBadParameter(err)) && assert.Contains(t, err.Error(), "status reason longer than 256 bytes")
@@ -424,13 +424,13 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "scoped identity without BotInternal",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{Hostname: "llama"},
-			},
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{Hostname: "llama"}.Build(),
+			}.Build(),
 			identity: tlsca.Identity{
 				BotName:       botName,
 				BotInstanceID: botInstanceID,
-				ScopePin:      &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/scopes/test"},
+				ScopePin:      scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/scopes/test"}.Build(),
 				BotInternal:   false,
 			},
 			assertErr: func(t assert.TestingT, err error, i ...any) bool {
@@ -442,13 +442,13 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 		{
 			name:              "scoped identity with BotInternal",
 			createBotInstance: true,
-			req: &machineidv1.SubmitHeartbeatRequest{
-				Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{Hostname: "llama"},
-			},
+			req: machineidv1.SubmitHeartbeatRequest_builder{
+				Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{Hostname: "llama"}.Build(),
+			}.Build(),
 			identity: tlsca.Identity{
 				BotName:       botName,
 				BotInstanceID: botInstanceID,
-				ScopePin:      &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/scopes/test"},
+				ScopePin:      scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/scopes/test"}.Build(),
 				BotInternal:   true,
 			},
 			assertErr:     assert.NoError,
@@ -475,7 +475,7 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 
 			if tt.createBotInstance {
 				bi := newBotInstance(botName)
-				bi.Spec.InstanceId = botInstanceID
+				bi.GetSpec().SetInstanceId(botInstanceID)
 				_, err := backend.CreateBotInstance(ctx, bi)
 				require.NoError(t, err)
 			}
@@ -489,25 +489,25 @@ func TestBotInstanceServiceSubmitHeartbeat(t *testing.T) {
 					assert.Empty(
 						t,
 						cmp.Diff(
-							bi.Status.InitialHeartbeat,
-							tt.req.Heartbeat,
+							bi.GetStatus().GetInitialHeartbeat(),
+							tt.req.GetHeartbeat(),
 							protocmp.Transform()),
 					)
-					assert.Len(t, bi.Status.LatestHeartbeats, 1)
+					assert.Len(t, bi.GetStatus().GetLatestHeartbeats(), 1)
 					assert.Empty(
 						t,
 						cmp.Diff(
-							bi.Status.LatestHeartbeats[0],
-							tt.req.Heartbeat,
+							bi.GetStatus().GetLatestHeartbeats()[0],
+							tt.req.GetHeartbeat(),
 							protocmp.Transform()),
 					)
 				} else {
-					assert.Nil(t, bi.Status.InitialHeartbeat)
-					assert.Empty(t, bi.Status.LatestHeartbeats)
+					assert.Nil(t, bi.GetStatus().GetInitialHeartbeat())
+					assert.Empty(t, bi.GetStatus().GetLatestHeartbeats())
 				}
 				assert.Empty(t,
 					cmp.Diff(
-						bi.Status.ServiceHealth,
+						bi.GetStatus().GetServiceHealth(),
 						tt.wantServiceHealth,
 						protocmp.Transform(),
 					),
@@ -543,28 +543,28 @@ func TestBotInstanceServiceSubmitHeartbeat_HeartbeatLimit(t *testing.T) {
 	require.NoError(t, err)
 
 	bi := newBotInstance(botName)
-	bi.Spec.InstanceId = botInstanceID
+	bi.GetSpec().SetInstanceId(botInstanceID)
 	_, err = backend.CreateBotInstance(ctx, bi)
 	require.NoError(t, err)
 
 	extraHeartbeats := 5
 	for i := range heartbeatHistoryLimit + extraHeartbeats {
-		_, err = service.SubmitHeartbeat(ctx, &machineidv1.SubmitHeartbeatRequest{
-			Heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+		_, err = service.SubmitHeartbeat(ctx, machineidv1.SubmitHeartbeatRequest_builder{
+			Heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				Hostname: strconv.Itoa(i),
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
 	bi, err = backend.GetBotInstance(ctx, botName, botInstanceID)
 	require.NoError(t, err)
-	assert.Len(t, bi.Status.LatestHeartbeats, heartbeatHistoryLimit)
-	assert.Equal(t, "0", bi.Status.InitialHeartbeat.Hostname)
+	assert.Len(t, bi.GetStatus().GetLatestHeartbeats(), heartbeatHistoryLimit)
+	assert.Equal(t, "0", bi.GetStatus().GetInitialHeartbeat().GetHostname())
 	// Ensure we have the last 10 heartbeats
 	for i := range heartbeatHistoryLimit {
 		wantHostname := strconv.Itoa(i + extraHeartbeats)
-		assert.Equal(t, wantHostname, bi.Status.LatestHeartbeats[i].Hostname)
+		assert.Equal(t, wantHostname, bi.GetStatus().GetLatestHeartbeats()[i].GetHostname())
 	}
 }
 
@@ -635,11 +635,11 @@ func callMethod(t *testing.T, service *BotInstanceService, method string) error
 			_, err := desc.Handler(service, context.Background(), func(req any) error {
 				switch r := req.(type) {
 				case *machineidv1.GetBotInstanceRequest:
-					r.BotName = testBotName
-					r.InstanceId = testInstanceID
+					r.SetBotName(testBotName)
+					r.SetInstanceId(testInstanceID)
 				case *machineidv1.DeleteBotInstanceRequest:
-					r.BotName = testBotName
-					r.InstanceId = testInstanceID
+					r.SetBotName(testBotName)
+					r.SetInstanceId(testInstanceID)
 				}
 				return nil
 			}, nil)
@@ -654,15 +654,15 @@ func callMethod(t *testing.T, service *BotInstanceService, method string) error
 func newBotInstance(botName string) *machineidv1.BotInstance {
 	id := uuid.New()
 
-	bi := &machineidv1.BotInstance{
+	bi := machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    botName,
 			InstanceId: id.String(),
-		},
+		}.Build(),
 		Status: &machineidv1.BotInstanceStatus{},
-	}
+	}.Build()
 
 	return bi
 }
@@ -678,7 +678,7 @@ func createInstances(t *testing.T, ctx context.Context, backend *local.BotInstan
 		_, err := backend.CreateBotInstance(ctx, bi)
 		require.NoError(t, err)
 
-		ids[bi.Spec.InstanceId] = struct{}{}
+		ids[bi.GetSpec().GetInstanceId()] = struct{}{}
 	}
 
 	return ids
@@ -692,16 +692,16 @@ func listInstances(t *testing.T, ctx context.Context, service *BotInstanceServic
 	var nextKey string
 
 	for {
-		res, err := service.ListBotInstances(ctx, &machineidv1.ListBotInstancesRequest{
+		res, err := service.ListBotInstances(ctx, machineidv1.ListBotInstancesRequest_builder{
 			FilterBotName: botName,
 			PageSize:      0,
 			PageToken:     nextKey,
-		})
+		}.Build())
 		require.NoError(t, err)
 
-		resources = append(resources, res.BotInstances...)
+		resources = append(resources, res.GetBotInstances()...)
 
-		nextKey = res.NextPageToken
+		nextKey = res.GetNextPageToken()
 		if nextKey == "" {
 			break
 		}
diff --git a/lib/auth/machineid/machineidv1/bot_service.go b/lib/auth/machineid/machineidv1/bot_service.go
index aa2cab4a03c..fff480da6ae 100644
--- a/lib/auth/machineid/machineidv1/bot_service.go
+++ b/lib/auth/machineid/machineidv1/bot_service.go
@@ -189,24 +189,24 @@ func (bs *BotService) GetBot(ctx context.Context, req *pb.GetBotRequest) (*pb.Bo
 		return nil, trace.Wrap(err)
 	}
 
-	if req.BotName == "" {
+	if req.GetBotName() == "" {
 		return nil, trace.BadParameter("bot_name: must be non-empty")
 	}
 
-	bot, err := bs.getBot(ctx, req.BotName)
+	bot, err := bs.getBot(ctx, req.GetBotName())
 	if err != nil {
 		return nil, trace.Wrap(err, "fetching bot")
 	}
 
 	ruleCtx.Resource153 = bot
 	if err := authCtx.CheckerContext.Decision(
-		ctx, bot.Scope, func(checker *services.ScopedAccessChecker) error {
+		ctx, bot.GetScope(), func(checker *services.ScopedAccessChecker) error {
 			return checker.CheckAccessToRules(&ruleCtx, types.KindBot, types.VerbReadNoSecrets)
 		},
 	); err != nil {
 		// Return NotFound rather than Forbidden to avoid leaking existence of
 		// bot.
-		return nil, trace.NotFound("bot %q not found", req.BotName)
+		return nil, trace.NotFound("bot %q not found", req.GetBotName())
 	}
 
 	return bot, nil
@@ -262,14 +262,14 @@ func (bs *BotService) ListBots(
 	// needing to iterate over all users here. This is currently a fairly
 	// expensive implementation.
 	bots := []*pb.Bot{}
-	rsp, err := bs.cache.ListUsers(ctx, &userspb.ListUsersRequest{
-		PageSize:  req.PageSize,
-		PageToken: req.PageToken,
-	})
+	rsp, err := bs.cache.ListUsers(ctx, userspb.ListUsersRequest_builder{
+		PageSize:  req.GetPageSize(),
+		PageToken: req.GetPageToken(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "listing users")
 	}
-	for _, u := range rsp.Users {
+	for _, u := range rsp.GetUsers() {
 		botName, isBot := u.GetLabel(types.BotLabel)
 		if !isBot {
 			continue
@@ -316,7 +316,7 @@ func (bs *BotService) ListBots(
 		// Check if user can access this specific Bot.
 		ruleCtx := authCtx.RuleContext()
 		ruleCtx.Resource153 = bot
-		if err := authCtx.CheckerContext.Decision(ctx, bot.Scope, func(checker *services.ScopedAccessChecker) error {
+		if err := authCtx.CheckerContext.Decision(ctx, bot.GetScope(), func(checker *services.ScopedAccessChecker) error {
 			return checker.CheckAccessToRules(&ruleCtx, types.KindBot, types.VerbList)
 		}); err != nil {
 			// Ignore resources the user cannot access.
@@ -326,10 +326,10 @@ func (bs *BotService) ListBots(
 		bots = append(bots, bot)
 	}
 
-	return &pb.ListBotsResponse{
+	return pb.ListBotsResponse_builder{
 		Bots:          bots,
-		NextPageToken: rsp.NextPageToken,
-	}, nil
+		NextPageToken: rsp.GetNextPageToken(),
+	}.Build(), nil
 }
 
 // CreateBot creates a new bot. It will throw an error if the bot already
@@ -337,7 +337,7 @@ func (bs *BotService) ListBots(
 func (bs *BotService) CreateBot(
 	ctx context.Context, req *pb.CreateBotRequest,
 ) (*pb.Bot, error) {
-	if err := setKindAndVersion(req.Bot); err != nil {
+	if err := setKindAndVersion(req.GetBot()); err != nil {
 		return nil, trace.Wrap(err, "setting kind and version")
 	}
 	authCtx, err := bs.scopedAuthorizer.AuthorizeScoped(ctx)
@@ -345,15 +345,15 @@ func (bs *BotService) CreateBot(
 		return nil, trace.Wrap(err)
 	}
 
-	if err := StrongValidateBot(req.Bot); err != nil {
+	if err := StrongValidateBot(req.GetBot()); err != nil {
 		return nil, trace.Wrap(err, "validating bot")
 	}
 	// Validation comes before authz checks so we know that scope etc is
 	// well-formed.
 
 	ruleCtx := authCtx.RuleContext()
-	ruleCtx.Resource153 = req.Bot
-	if err := authCtx.CheckerContext.Decision(ctx, req.Bot.Scope, func(checker *services.ScopedAccessChecker) error {
+	ruleCtx.Resource153 = req.GetBot()
+	if err := authCtx.CheckerContext.Decision(ctx, req.GetBot().GetScope(), func(checker *services.ScopedAccessChecker) error {
 		return checker.CheckAccessToRules(&ruleCtx, types.KindBot, types.VerbCreate)
 	}); err != nil {
 		return nil, trace.Wrap(err)
@@ -367,13 +367,13 @@ func (bs *BotService) CreateBot(
 	}
 
 	var bot *pb.Bot
-	if req.Bot.Scope != "" {
-		bot, err = bs.createScopedBot(ctx, authCtx, req.Bot)
+	if req.GetBot().GetScope() != "" {
+		bot, err = bs.createScopedBot(ctx, authCtx, req.GetBot())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 	} else {
-		bot, err = bs.createUnscopedBot(ctx, authCtx, req.Bot)
+		bot, err = bs.createUnscopedBot(ctx, authCtx, req.GetBot())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -381,10 +381,10 @@ func (bs *BotService) CreateBot(
 
 	bs.reporter.AnonymizeAndSubmit(&usagereporter.BotCreateEvent{
 		UserName:    authz.ClientUsername(ctx),
-		BotUserName: BotResourceName(bot.Metadata.Name),
-		RoleName:    BotResourceName(bot.Metadata.Name),
-		BotName:     bot.Metadata.Name,
-		RoleCount:   int64(len(bot.Spec.Roles)),
+		BotUserName: BotResourceName(bot.GetMetadata().GetName()),
+		RoleName:    BotResourceName(bot.GetMetadata().GetName()),
+		BotName:     bot.GetMetadata().GetName(),
+		RoleCount:   int64(len(bot.GetSpec().GetRoles())),
 	})
 	if err := bs.emitter.EmitAuditEvent(ctx, &apievents.BotCreate{
 		Metadata: apievents.Metadata{
@@ -393,7 +393,7 @@ func (bs *BotService) CreateBot(
 		},
 		UserMetadata: authz.ClientUserMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: bot.Metadata.Name,
+			Name: bot.GetMetadata().GetName(),
 		},
 	}); err != nil {
 		bs.logger.WarnContext(
@@ -475,7 +475,7 @@ func UpsertBot(
 	createdBy string,
 	scopesFeatures scopes.Features,
 ) (*pb.Bot, error) {
-	if bot.Scope != "" {
+	if bot.GetScope() != "" {
 		if err := scopesFeatures.AssertEnabled(); err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -487,7 +487,7 @@ func UpsertBot(
 	// Fetch pre-existing user, we'll use this to preserve generation and
 	// check for scope transitions.
 	existingUser, err := backend.GetUser(
-		ctx, BotResourceName(bot.Metadata.Name), false,
+		ctx, BotResourceName(bot.GetMetadata().GetName()), false,
 	)
 	if err != nil && !trace.IsNotFound(err) {
 		// We'll happily ignore a not-found error, in this case, we have an
@@ -502,7 +502,7 @@ func UpsertBot(
 		// This restriction may be loosened in future if we evaluate pre-upsert
 		// and post-upsert scope authz.
 		existingScope, _ := existingUser.GetLabel(types.BotScopeLabel)
-		if existingScope != bot.Scope {
+		if existingScope != bot.GetScope() {
 			return nil, trace.BadParameter(
 				"upserts cannot cause the scope of a bot to change, delete and recreate the bot to change its scope",
 			)
@@ -512,7 +512,7 @@ func UpsertBot(
 	// Create User (and maybe Role if unscoped) from the Bot.
 	var user types.User
 	var role types.Role
-	if bot.Scope != "" {
+	if bot.GetScope() != "" {
 		user, err = scopedBotToUser(bot, now, createdBy)
 		if err != nil {
 			return nil, trace.Wrap(err, "converting scoped bot to user resource")
@@ -563,7 +563,7 @@ func UpsertBot(
 
 // UpsertBot creates a new bot or forcefully updates an existing bot.
 func (bs *BotService) UpsertBot(ctx context.Context, req *pb.UpsertBotRequest) (*pb.Bot, error) {
-	if err := setKindAndVersion(req.Bot); err != nil {
+	if err := setKindAndVersion(req.GetBot()); err != nil {
 		return nil, trace.Wrap(err, "setting kind and version")
 	}
 
@@ -572,17 +572,17 @@ func (bs *BotService) UpsertBot(ctx context.Context, req *pb.UpsertBotRequest) (
 		return nil, trace.Wrap(err)
 	}
 
-	if err := StrongValidateBot(req.Bot); err != nil {
+	if err := StrongValidateBot(req.GetBot()); err != nil {
 		return nil, trace.Wrap(err, "validating bot")
 	}
 	// Validation comes before authz checks so that we know scope (if present)
 	// is well-formed.
 
 	ruleCtx := authCtx.RuleContext()
-	ruleCtx.Resource153 = req.Bot
+	ruleCtx.Resource153 = req.GetBot()
 	if err := authCtx.CheckerContext.Decision(
 		ctx,
-		req.Bot.Scope,
+		req.GetBot().GetScope(),
 		func(checker *services.ScopedAccessChecker) error {
 			return checker.CheckAccessToRules(
 				&ruleCtx, types.KindBot, types.VerbCreate, types.VerbUpdate,
@@ -601,7 +601,7 @@ func (bs *BotService) UpsertBot(ctx context.Context, req *pb.UpsertBotRequest) (
 	}
 
 	bot, err := UpsertBot(
-		ctx, bs.backend, req.Bot, bs.clock.Now(), authCtx.User.GetName(), bs.scopesFeatures,
+		ctx, bs.backend, req.GetBot(), bs.clock.Now(), authCtx.User.GetName(), bs.scopesFeatures,
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -609,10 +609,10 @@ func (bs *BotService) UpsertBot(ctx context.Context, req *pb.UpsertBotRequest) (
 
 	bs.reporter.AnonymizeAndSubmit(&usagereporter.BotCreateEvent{
 		UserName:    authz.ClientUsername(ctx),
-		BotUserName: BotResourceName(bot.Metadata.Name),
-		RoleName:    BotResourceName(bot.Metadata.Name),
-		BotName:     bot.Metadata.Name,
-		RoleCount:   int64(len(bot.Spec.Roles)),
+		BotUserName: BotResourceName(bot.GetMetadata().GetName()),
+		RoleName:    BotResourceName(bot.GetMetadata().GetName()),
+		BotName:     bot.GetMetadata().GetName(),
+		RoleCount:   int64(len(bot.GetSpec().GetRoles())),
 	})
 	if err := bs.emitter.EmitAuditEvent(ctx, &apievents.BotCreate{
 		Metadata: apievents.Metadata{
@@ -621,7 +621,7 @@ func (bs *BotService) UpsertBot(ctx context.Context, req *pb.UpsertBotRequest) (
 		},
 		UserMetadata: authz.ClientUserMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: bot.Metadata.Name,
+			Name: bot.GetMetadata().GetName(),
 		},
 	}); err != nil {
 		bs.logger.WarnContext(
@@ -638,7 +638,7 @@ func (bs *BotService) UpsertBot(ctx context.Context, req *pb.UpsertBotRequest) (
 func (bs *BotService) UpdateBot(
 	ctx context.Context, req *pb.UpdateBotRequest,
 ) (*pb.Bot, error) {
-	if err := setKindAndVersion(req.Bot); err != nil {
+	if err := setKindAndVersion(req.GetBot()); err != nil {
 		return nil, trace.Wrap(err, "setting kind and version")
 	}
 
@@ -656,7 +656,7 @@ func (bs *BotService) UpdateBot(
 	}
 
 	if err := authCtx.CheckAccessToResource153(
-		req.Bot,
+		req.GetBot(),
 		types.VerbUpdate,
 	); err != nil {
 		return nil, trace.Wrap(err)
@@ -666,62 +666,62 @@ func (bs *BotService) UpdateBot(
 	}
 
 	switch {
-	case req.Bot == nil:
+	case !req.HasBot():
 		return nil, trace.BadParameter("bot: must be non-nil")
-	case req.Bot.Metadata == nil:
+	case !req.GetBot().HasMetadata():
 		return nil, trace.BadParameter("bot.metadata: must be non-nil")
-	case req.Bot.Metadata.Name == "":
+	case req.GetBot().GetMetadata().GetName() == "":
 		return nil, trace.BadParameter("bot.metadata.name: must be non-empty")
-	case req.Bot.Spec == nil:
+	case !req.GetBot().HasSpec():
 		return nil, trace.BadParameter("bot.spec: must be non-nil")
-	case req.UpdateMask == nil:
+	case !req.HasUpdateMask():
 		return nil, trace.BadParameter("update_mask: must be non-nil")
-	case len(req.UpdateMask.Paths) == 0:
+	case len(req.GetUpdateMask().Paths) == 0:
 		return nil, trace.BadParameter("update_mask.paths: must be non-empty")
 	}
 
-	user, err := bs.backend.GetUser(ctx, BotResourceName(req.Bot.Metadata.Name), false)
+	user, err := bs.backend.GetUser(ctx, BotResourceName(req.GetBot().GetMetadata().GetName()), false)
 	if err != nil {
 		return nil, trace.Wrap(err, "getting bot user")
 	}
 	if scope := user.GetMetadata().Labels[types.BotScopeLabel]; scope != "" {
 		return nil, trace.BadParameter("cannot update scoped bot")
 	}
-	role, err := bs.backend.GetRole(ctx, BotResourceName(req.Bot.Metadata.Name))
+	role, err := bs.backend.GetRole(ctx, BotResourceName(req.GetBot().GetMetadata().GetName()))
 	if err != nil {
 		return nil, trace.Wrap(err, "getting bot role")
 	}
 
-	for _, path := range req.UpdateMask.Paths {
+	for _, path := range req.GetUpdateMask().Paths {
 		switch path {
 		case "spec.roles":
-			if slices.Contains(req.Bot.Spec.Roles, "") {
+			if slices.Contains(req.GetBot().GetSpec().GetRoles(), "") {
 				return nil, trace.BadParameter(
 					"spec.roles: must not contain empty strings",
 				)
 			}
 			role.SetImpersonateConditions(types.Allow, types.ImpersonateConditions{
-				Roles: req.Bot.Spec.Roles,
+				Roles: req.GetBot().GetSpec().GetRoles(),
 			})
 		case "spec.traits":
 			traits := map[string][]string{}
-			for _, t := range req.Bot.Spec.Traits {
-				if len(t.Values) == 0 {
+			for _, t := range req.GetBot().GetSpec().GetTraits() {
+				if len(t.GetValues()) == 0 {
 					continue
 				}
-				if traits[t.Name] == nil {
-					traits[t.Name] = []string{}
+				if traits[t.GetName()] == nil {
+					traits[t.GetName()] = []string{}
 				}
-				traits[t.Name] = append(traits[t.Name], t.Values...)
+				traits[t.GetName()] = append(traits[t.GetName()], t.GetValues()...)
 			}
 			user.SetTraits(traits)
 		case "spec.max_session_ttl":
 			opts := role.GetOptions()
-			opts.MaxSessionTTL = types.Duration(req.Bot.Spec.MaxSessionTtl.AsDuration())
+			opts.MaxSessionTTL = types.Duration(req.GetBot().GetSpec().GetMaxSessionTtl().AsDuration())
 			role.SetOptions(opts)
 		case "metadata.description":
 			meta := user.GetMetadata()
-			meta.Description = req.Bot.Metadata.Description
+			meta.Description = req.GetBot().GetMetadata().GetDescription()
 			user.SetMetadata(meta)
 		default:
 			return nil, trace.BadParameter("update_mask: unsupported path %q", path)
@@ -744,7 +744,7 @@ func (bs *BotService) UpdateBot(
 		},
 		UserMetadata: authz.ClientUserMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Bot.Metadata.Name,
+			Name: req.GetBot().GetMetadata().GetName(),
 		},
 	}); err != nil {
 		bs.logger.WarnContext(
@@ -789,13 +789,13 @@ func (bs *BotService) deleteBotRole(ctx context.Context, botName string) error {
 // dummyBotWithName returns a dummy bot with the given name. This is used
 // for evaluating RBAC for the Delete RPC
 func dummyBotWithName(name string) *pb.Bot {
-	return &pb.Bot{
+	return pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // DeleteBot deletes an existing bot. It will throw an error if the bot does
@@ -812,7 +812,7 @@ func (bs *BotService) DeleteBot(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if req.BotName == "" {
+	if req.GetBotName() == "" {
 		return nil, trace.BadParameter("bot_name: must be non-empty")
 	}
 
@@ -826,14 +826,14 @@ func (bs *BotService) DeleteBot(
 
 	// Fetch user to determine if bot is scoped or unscoped.
 	user, err := bs.backend.GetUser(
-		ctx, BotResourceName(req.BotName), false,
+		ctx, BotResourceName(req.GetBotName()), false,
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	scope := user.GetMetadata().Labels[types.BotScopeLabel]
 
-	ruleCtx.Resource153 = dummyBotWithName(req.BotName)
+	ruleCtx.Resource153 = dummyBotWithName(req.GetBotName())
 	if err := authCtx.CheckerContext.Decision(ctx, scope, func(checker *services.ScopedAccessChecker) error {
 		return checker.CheckAccessToRules(&ruleCtx, types.KindBot, types.VerbDelete)
 	}); err != nil {
@@ -847,11 +847,11 @@ func (bs *BotService) DeleteBot(
 		}
 	}
 
-	userErr := bs.deleteBotUser(ctx, req.BotName, user)
+	userErr := bs.deleteBotUser(ctx, req.GetBotName(), user)
 	var roleErr error
 	if scope == "" {
 		// Only unscoped bots have a Bot role for us to delete.
-		roleErr = bs.deleteBotRole(ctx, req.BotName)
+		roleErr = bs.deleteBotRole(ctx, req.GetBotName())
 	}
 	err = trace.NewAggregate(
 		trace.Wrap(userErr, "deleting bot user"),
@@ -868,7 +868,7 @@ func (bs *BotService) DeleteBot(
 		},
 		UserMetadata: authz.ClientUserMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.BotName,
+			Name: req.GetBotName(),
 		},
 	}); err != nil {
 		bs.logger.WarnContext(
@@ -892,11 +892,11 @@ func setKindAndVersion(b *pb.Bot) error {
 	if b == nil {
 		return trace.BadParameter("bot: must be non-nil")
 	}
-	if b.Kind == "" {
-		b.Kind = types.KindBot
+	if b.GetKind() == "" {
+		b.SetKind(types.KindBot)
 	}
-	if b.Version == "" {
-		b.Version = types.V1
+	if b.GetVersion() == "" {
+		b.SetVersion(types.V1)
 	}
 	return nil
 }
@@ -908,34 +908,34 @@ func StrongValidateBot(b *pb.Bot) error {
 	if b == nil {
 		return trace.BadParameter("must be non-nil")
 	}
-	if b.Metadata == nil {
+	if !b.HasMetadata() {
 		return trace.BadParameter("metadata: must be non-nil")
 	}
-	if b.Metadata.Name == "" {
+	if b.GetMetadata().GetName() == "" {
 		return trace.BadParameter("metadata.name: must be non-empty")
 	}
-	if b.Spec == nil {
+	if !b.HasSpec() {
 		return trace.BadParameter("spec: must be non-nil")
 	}
-	if slices.Contains(b.Spec.Roles, "") {
+	if slices.Contains(b.GetSpec().GetRoles(), "") {
 		return trace.BadParameter("spec.roles: must not contain empty strings")
 	}
 
 	// Scoped bot only validation
-	if b.Scope != "" {
+	if b.GetScope() != "" {
 		// Validate scope-specific fields
-		if err := scopes.StrongValidate(b.Scope); err != nil {
+		if err := scopes.StrongValidate(b.GetScope()); err != nil {
 			return trace.Wrap(err, "scope:")
 		}
 
 		// Validate unsupported fields aren't set.
-		if len(b.Spec.Roles) > 0 {
+		if len(b.GetSpec().GetRoles()) > 0 {
 			return trace.BadParameter("spec.roles: cannot be set on scoped bot")
 		}
-		if b.Spec.MaxSessionTtl.AsDuration() != 0 {
+		if b.GetSpec().GetMaxSessionTtl().AsDuration() != 0 {
 			return trace.BadParameter("spec.max_session_ttl: cannot be set on scoped bot")
 		}
-		if len(b.Spec.Traits) > 0 {
+		if len(b.GetSpec().GetTraits()) > 0 {
 			return trace.BadParameter("spec.traits: cannot be set on scoped bot")
 		}
 	}
@@ -970,33 +970,33 @@ func botFromUserAndRole(user types.User, role types.Role) (*pb.Bot, error) {
 		return nil, trace.BadParameter("botFromUserAndRole called on user with scope label")
 	}
 
-	b := &pb.Bot{
+	b := pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        botName,
 			Expires:     botExpiryFromUser(user),
 			Description: user.GetMetadata().Description,
-		},
-		Status: &pb.BotStatus{
+		}.Build(),
+		Status: pb.BotStatus_builder{
 			UserName: user.GetName(),
 			RoleName: role.GetName(),
-		},
-		Spec: &pb.BotSpec{
+		}.Build(),
+		Spec: pb.BotSpec_builder{
 			Roles:         role.GetImpersonateConditions(types.Allow).Roles,
 			MaxSessionTtl: durationpb.New(role.GetOptions().MaxSessionTTL.Duration()),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	// Copy in labels from the user
-	b.Metadata.Labels = map[string]string{}
+	b.GetMetadata().SetLabels(map[string]string{})
 	for k, v := range user.GetMetadata().Labels {
 		// We exclude the labels that are implicitly added to the user by the
 		// bot service.
 		if nonPropagatedLabels.Contains(k) {
 			continue
 		}
-		b.Metadata.Labels[k] = v
+		b.GetMetadata().GetLabels()[k] = v
 	}
 
 	// Copy in traits
@@ -1004,10 +1004,10 @@ func botFromUserAndRole(user types.User, role types.Role) (*pb.Bot, error) {
 		if len(v) == 0 {
 			continue
 		}
-		b.Spec.Traits = append(b.Spec.Traits, &pb.Trait{
+		b.GetSpec().SetTraits(append(b.GetSpec().GetTraits(), pb.Trait_builder{
 			Name:   k,
 			Values: v,
-		})
+		}.Build()))
 	}
 
 	return b, nil
@@ -1024,48 +1024,48 @@ func scopedBotFromUser(user types.User) (*pb.Bot, error) {
 		return nil, trace.BadParameter("scopedBotFromUser called on user without scope label")
 	}
 
-	b := &pb.Bot{
+	b := pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
 		Scope:   scope,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        botName,
 			Expires:     botExpiryFromUser(user),
 			Description: user.GetMetadata().Description,
-		},
-		Status: &pb.BotStatus{
+		}.Build(),
+		Status: pb.BotStatus_builder{
 			UserName: user.GetName(),
-		},
+		}.Build(),
 		Spec: &pb.BotSpec{},
-	}
+	}.Build()
 
 	// Copy in labels from the user
-	b.Metadata.Labels = map[string]string{}
+	b.GetMetadata().SetLabels(map[string]string{})
 	for k, v := range user.GetMetadata().Labels {
 		// We exclude the labels that are implicitly added to the user by the
 		// bot service.
 		if nonPropagatedLabels.Contains(k) {
 			continue
 		}
-		b.Metadata.Labels[k] = v
+		b.GetMetadata().GetLabels()[k] = v
 	}
 
 	return b, nil
 }
 
 func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User, types.Role, error) {
-	if bot.Scope != "" {
+	if bot.GetScope() != "" {
 		return nil, nil, trace.BadParameter("botToUserAndRole called on scoped bot")
 	}
 
 	// Setup role
-	resourceName := BotResourceName(bot.Metadata.Name)
+	resourceName := BotResourceName(bot.GetMetadata().GetName())
 
 	// Continue to use the legacy max session TTL (12 hours) as the default, but
 	// allow overrides via the optional bot spec field.
 	maxSessionTTL := defaults.DefaultBotMaxSessionTTL
-	if bot.Spec.MaxSessionTtl != nil {
-		maxSessionTTL = bot.Spec.MaxSessionTtl.AsDuration()
+	if bot.GetSpec().HasMaxSessionTtl() {
+		maxSessionTTL = bot.GetSpec().GetMaxSessionTtl().AsDuration()
 	}
 
 	role, err := types.NewRole(resourceName, types.RoleSpecV6{
@@ -1078,7 +1078,7 @@ func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 				types.NewRule(types.KindCertAuthority, []string{types.VerbReadNoSecrets}),
 			},
 			Impersonate: &types.ImpersonateConditions{
-				Roles: bot.Spec.Roles,
+				Roles: bot.GetSpec().GetRoles(),
 			},
 		},
 	})
@@ -1087,10 +1087,10 @@ func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 	}
 	roleMeta := role.GetMetadata()
 	roleMeta.Description = fmt.Sprintf(
-		"Automatically generated role for bot %s", bot.Metadata.Name,
+		"Automatically generated role for bot %s", bot.GetMetadata().GetName(),
 	)
 	roleMeta.Labels = map[string]string{
-		types.BotLabel: bot.Metadata.Name,
+		types.BotLabel: bot.GetMetadata().GetName(),
 	}
 	roleMeta.Expires = userAndRoleExpiryFromBot(bot)
 	role.SetMetadata(roleMeta)
@@ -1105,10 +1105,10 @@ func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 
 	// First copy in the labels from the Bot resource
 	userMeta.Labels = map[string]string{}
-	maps.Copy(userMeta.Labels, bot.Metadata.Labels)
+	maps.Copy(userMeta.Labels, bot.GetMetadata().GetLabels())
 	// Then set these labels over the top - we exclude these when converting
 	// back.
-	userMeta.Labels[types.BotLabel] = bot.Metadata.Name
+	userMeta.Labels[types.BotLabel] = bot.GetMetadata().GetName()
 	// We always set this to zero here - but in Upsert, we copy from the
 	// previous user before writing if necessary
 	userMeta.Labels[types.BotGenerationLabel] = "0"
@@ -1117,18 +1117,18 @@ func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 	userMeta.Expires = userAndRoleExpiryFromBot(bot)
 	// We track the Bot description within the User description field because
 	// the Role description already has a message.
-	userMeta.Description = bot.Metadata.Description
+	userMeta.Description = bot.GetMetadata().GetDescription()
 	user.SetMetadata(userMeta)
 
 	traits := map[string][]string{}
-	for _, t := range bot.Spec.Traits {
-		if len(t.Values) == 0 {
+	for _, t := range bot.GetSpec().GetTraits() {
+		if len(t.GetValues()) == 0 {
 			continue
 		}
-		if traits[t.Name] == nil {
-			traits[t.Name] = []string{}
+		if traits[t.GetName()] == nil {
+			traits[t.GetName()] = []string{}
 		}
-		traits[t.Name] = append(traits[t.Name], t.Values...)
+		traits[t.GetName()] = append(traits[t.GetName()], t.GetValues()...)
 	}
 	user.SetTraits(traits)
 	user.SetCreatedBy(types.CreatedBy{
@@ -1140,12 +1140,12 @@ func botToUserAndRole(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 }
 
 func scopedBotToUser(bot *pb.Bot, now time.Time, createdBy string) (types.User, error) {
-	if bot.Scope == "" {
+	if bot.GetScope() == "" {
 		return nil, trace.BadParameter("scopedBotToUser called on unscoped bot")
 	}
 
 	// Setup user
-	user, err := types.NewUser(BotResourceName(bot.Metadata.Name))
+	user, err := types.NewUser(BotResourceName(bot.GetMetadata().GetName()))
 	if err != nil {
 		return nil, trace.Wrap(err, "new user")
 	}
@@ -1153,18 +1153,18 @@ func scopedBotToUser(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 
 	// First copy in the labels from the Bot resource
 	userMeta.Labels = map[string]string{}
-	maps.Copy(userMeta.Labels, bot.Metadata.Labels)
+	maps.Copy(userMeta.Labels, bot.GetMetadata().GetLabels())
 	// Then set these labels over the top - we exclude these when converting
 	// back.
-	userMeta.Labels[types.BotLabel] = bot.Metadata.Name
+	userMeta.Labels[types.BotLabel] = bot.GetMetadata().GetName()
 	// We always set this to zero here - but in Upsert, we copy from the
 	// previous user before writing if necessary
 	userMeta.Labels[types.BotGenerationLabel] = "0"
-	userMeta.Labels[types.BotScopeLabel] = bot.Scope
+	userMeta.Labels[types.BotScopeLabel] = bot.GetScope()
 	userMeta.Expires = userAndRoleExpiryFromBot(bot)
 	// We track the Bot description within the User description field because
 	// the Role description already has a message.
-	userMeta.Description = bot.Metadata.Description
+	userMeta.Description = bot.GetMetadata().GetDescription()
 	user.SetMetadata(userMeta)
 
 	user.SetCreatedBy(types.CreatedBy{
@@ -1176,11 +1176,11 @@ func scopedBotToUser(bot *pb.Bot, now time.Time, createdBy string) (types.User,
 }
 
 func userAndRoleExpiryFromBot(bot *pb.Bot) *time.Time {
-	if bot.Metadata.GetExpires() == nil {
+	if bot.GetMetadata().GetExpires() == nil {
 		return nil
 	}
 
-	expiry := bot.Metadata.GetExpires().AsTime()
+	expiry := bot.GetMetadata().GetExpires().AsTime()
 	if expiry.IsZero() || expiry.Unix() == 0 {
 		return nil
 	}
diff --git a/lib/auth/machineid/machineidv1/expression/expression_test.go b/lib/auth/machineid/machineidv1/expression/expression_test.go
index 44a64da4075..53831726184 100644
--- a/lib/auth/machineid/machineidv1/expression/expression_test.go
+++ b/lib/auth/machineid/machineidv1/expression/expression_test.go
@@ -32,24 +32,24 @@ func TestBotInstanceExpressionParser(t *testing.T) {
 
 	makeBaseEnv := func() Environment {
 		return Environment{
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-bot-1/76efb07a-3077-471c-988a-54d0fa49fc71",
-			},
-			Spec: &machineidv1.BotInstanceSpec{
+			}.Build(),
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "test-bot-1",
 				InstanceId: "76efb07a-3077-471c-988a-54d0fa49fc71",
-			},
-			LatestAuthentication: &machineidv1.BotInstanceStatusAuthentication{
+			}.Build(),
+			LatestAuthentication: machineidv1.BotInstanceStatusAuthentication_builder{
 				JoinMethod: "kubernetes",
-			},
-			LatestHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			}.Build(),
+			LatestHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				IsStartup:    false,
 				Version:      "19.0.1",
 				OneShot:      false,
 				Architecture: "arm64",
 				Os:           "linux",
 				Hostname:     "test-hostname-1",
-			},
+			}.Build(),
 		}
 	}
 
@@ -100,9 +100,9 @@ func TestBotInstanceExpressionParser(t *testing.T) {
 			expFalse: `!status.latest_heartbeat.one_shot`,
 			envFns: []func(*Environment){
 				func(e *Environment) {
-					e.LatestHeartbeat = &machineidv1.BotInstanceStatusHeartbeat{
+					e.LatestHeartbeat = machineidv1.BotInstanceStatusHeartbeat_builder{
 						OneShot: true,
-					}
+					}.Build()
 				},
 			},
 		},
diff --git a/lib/auth/machineid/machineidv1/machineidv1_test.go b/lib/auth/machineid/machineidv1/machineidv1_test.go
index 8d34100f8d6..6fda0923c5b 100644
--- a/lib/auth/machineid/machineidv1/machineidv1_test.go
+++ b/lib/auth/machineid/machineidv1/machineidv1_test.go
@@ -120,65 +120,65 @@ func TestCreateBot(t *testing.T) {
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	expiry := time.Now().Add(time.Hour)
 
 	scopedSvc := client.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-creator",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbCreate},
 						Resources: []string{types.KindBot},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
 	// Create scoped role assignments linking users to scoped roles.
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
@@ -195,11 +195,11 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "success",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "success",
 						Labels: map[string]string{
 							"my-label":       "my-value",
@@ -209,52 +209,52 @@ func TestCreateBot(t *testing.T) {
 							types.BotScopeLabel: "/please-unset-me",
 						},
 						Description: "Property of US Robotics and Mechanical Men.",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{
-							{
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitLogins,
 								Values: []string{"root"},
-							},
-							{
+							}.Build(),
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitKubeUsers,
 								Values: []string{},
-							},
+							}.Build(),
 						},
 						// Note: Deliberately omitting MaxSessionTtl here to verify
 						// the default value.
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "success",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
 					Description: "Property of US Robotics and Mechanical Men.",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
 					Traits: []*machineidv1pb.Trait{
-						{
+						machineidv1pb.Trait_builder{
 							Name:   constants.TraitLogins,
 							Values: []string{"root"},
-						},
+						}.Build(),
 					},
 					MaxSessionTtl: durationpb.New(libdefaults.DefaultBotMaxSessionTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-success",
 					RoleName: "bot-success",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantUser: &types.UserV2{
 				Kind:    types.KindUser,
 				Version: types.V2,
@@ -314,63 +314,63 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "success with expiry",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "success-with-expiry",
 						Labels: map[string]string{
 							"my-label":       "my-value",
 							"my-other-label": "my-other-value",
 						},
 						Expires: timestamppb.New(expiry),
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{
-							{
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitLogins,
 								Values: []string{"root"},
-							},
-							{
+							}.Build(),
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitKubeUsers,
 								Values: []string{},
-							},
+							}.Build(),
 						},
 						// Note: Deliberately omitting MaxSessionTtl here to
 						// validate the default value.
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "success-with-expiry",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
 					Expires: timestamppb.New(expiry),
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
 					Traits: []*machineidv1pb.Trait{
-						{
+						machineidv1pb.Trait_builder{
 							Name:   constants.TraitLogins,
 							Values: []string{"root"},
-						},
+						}.Build(),
 					},
 					MaxSessionTtl: durationpb.New(libdefaults.DefaultBotMaxSessionTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-success-with-expiry",
 					RoleName: "bot-success-with-expiry",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantUser: &types.UserV2{
 				Kind:    types.KindUser,
 				Version: types.V2,
@@ -431,59 +431,59 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "success with max ttl",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "success-with-max-ttl",
 						Labels: map[string]string{
 							"my-label":       "my-value",
 							"my-other-label": "my-other-value",
 						},
 						Expires: timestamppb.New(expiry),
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{
-							{
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitLogins,
 								Values: []string{"root"},
-							},
-							{
+							}.Build(),
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitKubeUsers,
 								Values: []string{},
-							},
+							}.Build(),
 						},
 						MaxSessionTtl: durationpb.New(libdefaults.MaxRenewableCertTTL),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "success-with-max-ttl",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
 					Expires: timestamppb.New(expiry),
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
 					Traits: []*machineidv1pb.Trait{
-						{
+						machineidv1pb.Trait_builder{
 							Name:   constants.TraitLogins,
 							Values: []string{"root"},
-						},
+						}.Build(),
 					},
 					MaxSessionTtl: durationpb.New(libdefaults.MaxRenewableCertTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-success-with-max-ttl",
 					RoleName: "bot-success-with-max-ttl",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantRole: &types.RoleV6{
 				Kind:    types.KindRole,
 				Version: types.V8,
@@ -517,43 +517,43 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "success with where on name",
 			identity: authtest.TestUser(botCreatorWhere.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name:   "foo-xyzzy",
 						Labels: map[string]string{},
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles:  []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
 		},
 		{
 			name:     "failure with where on name",
 			identity: authtest.TestUser(botCreatorWhere.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name:   "bar-xyzzy",
 						Labels: map[string]string{},
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles:  []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: require.Error,
 		},
 		{
 			name:     "bot already exists",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
+			req: machineidv1pb.CreateBotRequest_builder{
 				Bot: preExistingBot,
-			},
+			}.Build(),
 
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAlreadyExists(err), "error should be already exists")
@@ -562,9 +562,9 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "no permissions",
 			identity: authtest.TestUser(unprivilegedUser.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
+			req: machineidv1pb.CreateBotRequest_builder{
 				Bot: preExistingBot,
-			},
+			}.Build(),
 
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
@@ -573,9 +573,9 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "validation - nil bot",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
+			req: machineidv1pb.CreateBotRequest_builder{
 				Bot: nil,
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -584,16 +584,16 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "validation - nil metadata",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:     types.KindBot,
 					Version:  types.V1,
 					Metadata: nil,
-					Spec: &machineidv1pb.BotSpec{
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -602,16 +602,16 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "validation - no name",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:     types.KindBot,
 					Version:  types.V1,
 					Metadata: &headerv1.Metadata{},
-					Spec: &machineidv1pb.BotSpec{
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -620,16 +620,16 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "validation - nil spec",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "terminator",
-					},
+					}.Build(),
 					Spec: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "spec: must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -638,19 +638,19 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "validation - empty role",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "empty-string-role",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles:  []string{"foo", "", "bar"},
 						Traits: []*machineidv1pb.Trait{},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "spec.roles: must not contain empty strings")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -659,67 +659,67 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "scoped identity creates scoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "scoped-bot-success",
-					},
+					}.Build(),
 					Scope: "/scopes/granted",
 					Spec:  &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-bot-success",
-				},
+				}.Build(),
 				Scope: "/scopes/granted",
 				Spec:  &machineidv1pb.BotSpec{},
-				Status: &machineidv1pb.BotStatus{
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-scoped-bot-success",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:     "unscoped identity creates scoped bot",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "scoped-bot-from-unscoped",
-					},
+					}.Build(),
 					Scope: "/scopes/granted",
 					Spec:  &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-bot-from-unscoped",
-				},
+				}.Build(),
 				Scope: "/scopes/granted",
 				Spec:  &machineidv1pb.BotSpec{},
-				Status: &machineidv1pb.BotStatus{
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-scoped-bot-from-unscoped",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:     "scoped identity wrong scope",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "scoped-bot-denied",
-					},
+					}.Build(),
 					Scope: "/scopes/ungranted",
 					Spec:  &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "expected access denied, got: %v", err)
 			},
@@ -727,16 +727,16 @@ func TestCreateBot(t *testing.T) {
 		{
 			name:     "scoped identity cannot create unscoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.CreateBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.CreateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "unscoped-from-scoped",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "expected access denied, got: %v", err)
 			},
@@ -804,31 +804,31 @@ func TestUpdateBot(t *testing.T) {
 	// Create a pre-existing bot so we can check you can update an existing bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	preExistingBot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	preExistingBot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:        "pre-existing",
 				Description: "before",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{beforeRole.GetName()},
 				Traits: []*machineidv1pb.Trait{
-					{
+					machineidv1pb.Trait_builder{
 						Name:   constants.TraitLogins,
 						Values: []string{"before"},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// We find the user associated with the Bot and set the generation label. This allows us to ensure that the
 	// generation label is preserved when UpsertBot is called.
 	{
-		preExistingBotUser, err := srv.Auth().GetUser(ctx, preExistingBot.Status.UserName, false)
+		preExistingBotUser, err := srv.Auth().GetUser(ctx, preExistingBot.GetStatus().GetUserName(), false)
 		require.NoError(t, err)
 		meta := preExistingBotUser.GetMetadata()
 		meta.Labels[types.BotGenerationLabel] = "1337"
@@ -850,79 +850,79 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "success",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
-						Name:        preExistingBot.Metadata.Name,
+					Metadata: headerv1.Metadata_builder{
+						Name:        preExistingBot.GetMetadata().GetName(),
 						Description: "after",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{afterRole.GetName()},
 						Traits: []*machineidv1pb.Trait{
-							{
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitLogins,
 								Values: []string{"after"},
-							},
-							{
+							}.Build(),
+							machineidv1pb.Trait_builder{
 								Name: constants.TraitKubeUsers,
 								Values: []string{
 									"after",
 								},
-							},
+							}.Build(),
 						},
 						MaxSessionTtl: durationpb.New(libdefaults.MaxRenewableCertTTL),
-					},
-				},
+					}.Build(),
+				}.Build(),
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{"spec.roles", "spec.traits", "spec.max_session_ttl", "metadata.description"},
 				},
-			},
+			}.Build(),
 
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
-					Name:        preExistingBot.Metadata.Name,
+				Metadata: headerv1.Metadata_builder{
+					Name:        preExistingBot.GetMetadata().GetName(),
 					Description: "after",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{afterRole.GetName()},
 					Traits: []*machineidv1pb.Trait{
-						{
+						machineidv1pb.Trait_builder{
 							Name:   constants.TraitLogins,
 							Values: []string{"after"},
-						},
-						{
+						}.Build(),
+						machineidv1pb.Trait_builder{
 							Name: constants.TraitKubeUsers,
 							Values: []string{
 								"after",
 							},
-						},
+						}.Build(),
 					},
 					MaxSessionTtl: durationpb.New(libdefaults.MaxRenewableCertTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
-					UserName: preExistingBot.Status.UserName,
-					RoleName: preExistingBot.Status.RoleName,
-				},
-			},
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
+					UserName: preExistingBot.GetStatus().GetUserName(),
+					RoleName: preExistingBot.GetStatus().GetRoleName(),
+				}.Build(),
+			}.Build(),
 			wantUser: &types.UserV2{
 				Kind:    types.KindUser,
 				Version: types.V2,
 				Metadata: types.Metadata{
-					Name:        preExistingBot.Status.UserName,
+					Name:        preExistingBot.GetStatus().GetUserName(),
 					Description: "after",
 					Namespace:   defaults.Namespace,
 					Labels: map[string]string{
-						types.BotLabel:           preExistingBot.Metadata.Name,
+						types.BotLabel:           preExistingBot.GetMetadata().GetName(),
 						types.BotGenerationLabel: "1337",
 					},
 				},
 				Spec: types.UserSpecV2{
-					Roles: []string{preExistingBot.Status.RoleName},
+					Roles: []string{preExistingBot.GetStatus().GetRoleName()},
 					Traits: map[string][]string{
 						constants.TraitLogins:    {"after"},
 						constants.TraitKubeUsers: {"after"},
@@ -941,10 +941,10 @@ func TestUpdateBot(t *testing.T) {
 				Kind:    types.KindRole,
 				Version: types.V8,
 				Metadata: types.Metadata{
-					Name:      preExistingBot.Status.RoleName,
+					Name:      preExistingBot.GetStatus().GetRoleName(),
 					Namespace: defaults.Namespace,
 					Labels: map[string]string{
-						types.BotLabel: preExistingBot.Metadata.Name,
+						types.BotLabel: preExistingBot.GetMetadata().GetName(),
 					},
 					Description: "Automatically generated role for bot pre-existing",
 				},
@@ -966,19 +966,19 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:        "valid-bot",
-						Description: preExistingBot.Metadata.Description,
-					},
-					Spec: &machineidv1pb.BotSpec{
+						Description: preExistingBot.GetMetadata().GetDescription(),
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{beforeRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -986,12 +986,12 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - nil bot",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
+			req: machineidv1pb.UpdateBotRequest_builder{
 				Bot: nil,
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{"spec.roles"},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "bot: must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1000,20 +1000,20 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - nil bot spec",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:        "bernard-lowe",
 						Description: "before",
-					},
+					}.Build(),
 					Spec: nil,
-				},
+				}.Build(),
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{"spec.roles"},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "bot.spec: must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1022,18 +1022,18 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - nil metadata",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Spec: &machineidv1pb.BotSpec{
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{beforeRole.GetName()},
-					},
-				},
+					}.Build(),
+				}.Build(),
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{"spec.roles"},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "bot.metadata: must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1042,22 +1042,22 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - no name",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:        "",
-						Description: preExistingBot.Metadata.Description,
-					},
-					Spec: &machineidv1pb.BotSpec{
+						Description: preExistingBot.GetMetadata().GetDescription(),
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{beforeRole.GetName()},
-					},
-				},
+					}.Build(),
+				}.Build(),
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{"spec.roles"},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "bot.metadata.name: must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1066,20 +1066,20 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - no update mask",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:        "foo",
 						Description: "before",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{beforeRole.GetName()},
-					},
-				},
+					}.Build(),
+				}.Build(),
 				UpdateMask: nil,
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "update_mask: must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1088,22 +1088,22 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - no update mask paths",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:        "foo",
-						Description: preExistingBot.Metadata.Description,
-					},
-					Spec: &machineidv1pb.BotSpec{
+						Description: preExistingBot.GetMetadata().GetDescription(),
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{beforeRole.GetName()},
-					},
-				},
+					}.Build(),
+				}.Build(),
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "update_mask.paths: must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1112,23 +1112,23 @@ func TestUpdateBot(t *testing.T) {
 		{
 			name: "validation - empty string role",
 			user: botUpdaterUser.GetName(),
-			req: &machineidv1pb.UpdateBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpdateBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
-						Name:        preExistingBot.Metadata.Name,
-						Description: preExistingBot.Metadata.Description,
-					},
-					Spec: &machineidv1pb.BotSpec{
+					Metadata: headerv1.Metadata_builder{
+						Name:        preExistingBot.GetMetadata().GetName(),
+						Description: preExistingBot.GetMetadata().GetDescription(),
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles:  []string{"foo", "", "bar"},
 						Traits: []*machineidv1pb.Trait{},
-					},
-				},
+					}.Build(),
+				}.Build(),
 				UpdateMask: &fieldmaskpb.FieldMask{
 					Paths: []string{"spec.roles"},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "spec.roles: must not contain empty strings")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1213,29 +1213,29 @@ func TestUpsertBot(t *testing.T) {
 	// Create a pre-existing bot so we can check you can upsert over an existing bot.
 	client, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	preExistingBot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	preExistingBot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "pre-existing",
 				Labels: map[string]string{
 					"my-label":       "my-value",
 					"my-other-label": "my-other-value",
 				},
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{testRole.GetName()},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	expiry := time.Now().Add(time.Hour)
 
 	// We find the user associated with the Bot and set the generation label. This allows us to ensure that the
 	// generation label is preserved when UpsertBot is called.
 	{
-		preExistingBotUser, err := srv.Auth().GetUser(ctx, preExistingBot.Status.UserName, false)
+		preExistingBotUser, err := srv.Auth().GetUser(ctx, preExistingBot.GetStatus().GetUserName(), false)
 		require.NoError(t, err)
 		meta := preExistingBotUser.GetMetadata()
 		meta.Labels[types.BotGenerationLabel] = "1337"
@@ -1246,58 +1246,58 @@ func TestUpsertBot(t *testing.T) {
 
 	// Scoped identity setup.
 	scopedSvc := client.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-upserter",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbCreate, types.VerbUpdate},
 						Resources: []string{types.KindBot},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
 	// Pre-existing scoped bot for scope-transition tests.
-	_, err = client.BotServiceClient().UpsertBot(ctx, &machineidv1pb.UpsertBotRequest{
-		Bot: &machineidv1pb.Bot{
-			Metadata: &headerv1.Metadata{Name: "scope-change-test"},
+	_, err = client.BotServiceClient().UpsertBot(ctx, machineidv1pb.UpsertBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
+			Metadata: headerv1.Metadata_builder{Name: "scope-change-test"}.Build(),
 			Scope:    "/scopes/granted",
 			Spec:     &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -1313,55 +1313,55 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "new",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new",
 						Labels: map[string]string{
 							"my-label":       "my-value",
 							"my-other-label": "my-other-value",
 						},
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{
-							{
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitLogins,
 								Values: []string{"root"},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "new",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
 					Traits: []*machineidv1pb.Trait{
-						{
+						machineidv1pb.Trait_builder{
 							Name:   constants.TraitLogins,
 							Values: []string{"root"},
-						},
+						}.Build(),
 					},
 					MaxSessionTtl: durationpb.New(libdefaults.DefaultBotMaxSessionTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-new",
 					RoleName: "bot-new",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantUser: &types.UserV2{
 				Kind:    types.KindUser,
 				Version: types.V2,
@@ -1414,57 +1414,57 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "new with expiry",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new-with-expiry",
 						Labels: map[string]string{
 							"my-label":       "my-value",
 							"my-other-label": "my-other-value",
 						},
 						Expires: timestamppb.New(expiry),
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
 						Traits: []*machineidv1pb.Trait{
-							{
+							machineidv1pb.Trait_builder{
 								Name:   constants.TraitLogins,
 								Values: []string{"root"},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "new-with-expiry",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
 					Expires: timestamppb.New(expiry),
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
 					Traits: []*machineidv1pb.Trait{
-						{
+						machineidv1pb.Trait_builder{
 							Name:   constants.TraitLogins,
 							Values: []string{"root"},
-						},
+						}.Build(),
 					},
 					MaxSessionTtl: durationpb.New(libdefaults.DefaultBotMaxSessionTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-new-with-expiry",
 					RoleName: "bot-new-with-expiry",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantUser: &types.UserV2{
 				Kind:    types.KindUser,
 				Version: types.V2,
@@ -1519,9 +1519,9 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "already exists",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
+			req: machineidv1pb.UpsertBotRequest_builder{
 				Bot: preExistingBot,
-			},
+			}.Build(),
 
 			assertError: require.NoError,
 			want:        preExistingBot,
@@ -1578,42 +1578,42 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "already exists with max session ttl",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "pre-existing",
 						Labels: map[string]string{
 							"my-label":       "my-value",
 							"my-other-label": "my-other-value",
 						},
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles:         []string{testRole.GetName()},
 						MaxSessionTtl: durationpb.New(libdefaults.MaxRenewableCertTTL),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles:         []string{testRole.GetName()},
 					MaxSessionTtl: durationpb.New(libdefaults.MaxRenewableCertTTL),
-				},
-				Status: &machineidv1pb.BotStatus{
+				}.Build(),
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-pre-existing",
 					RoleName: "bot-pre-existing",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantUser: &types.UserV2{
 				Kind:    types.KindUser,
 				Version: types.V2,
@@ -1667,35 +1667,35 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "new with where",
 			identity: authtest.TestUser(botWhereCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "foo-new",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
 		},
 		{
 			name:     "failed new with where",
 			identity: authtest.TestUser(botWhereCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "not-foo-new",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -1703,18 +1703,18 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "no permissions",
 			identity: authtest.TestUser(unprivilegedUser.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "not-foo-new",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
@@ -1723,9 +1723,9 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "validation - nil bot",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
+			req: machineidv1pb.UpsertBotRequest_builder{
 				Bot: nil,
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1734,16 +1734,16 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "validation - nil metadata",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:     types.KindBot,
 					Version:  types.V1,
 					Metadata: nil,
-					Spec: &machineidv1pb.BotSpec{
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1752,16 +1752,16 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "validation - no name",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:     types.KindBot,
 					Version:  types.V1,
 					Metadata: &headerv1.Metadata{},
-					Spec: &machineidv1pb.BotSpec{
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1770,19 +1770,19 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "validation - empty role",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
 					Kind:    types.KindBot,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "empty-string-role",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles:  []string{"foo", "", "bar"},
 						Traits: []*machineidv1pb.Trait{},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "spec.roles: must not contain empty strings")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -1791,67 +1791,67 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "scoped identity upserts scoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "scoped-upsert-success",
-					},
+					}.Build(),
 					Scope: "/scopes/granted",
 					Spec:  &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-upsert-success",
-				},
+				}.Build(),
 				Scope: "/scopes/granted",
 				Spec:  &machineidv1pb.BotSpec{},
-				Status: &machineidv1pb.BotStatus{
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-scoped-upsert-success",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:     "unscoped identity upserts scoped bot",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "scoped-upsert-from-unscoped",
-					},
+					}.Build(),
 					Scope: "/scopes/granted",
 					Spec:  &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: require.NoError,
-			want: &machineidv1pb.Bot{
+			want: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-upsert-from-unscoped",
-				},
+				}.Build(),
 				Scope: "/scopes/granted",
 				Spec:  &machineidv1pb.BotSpec{},
-				Status: &machineidv1pb.BotStatus{
+				Status: machineidv1pb.BotStatus_builder{
 					UserName: "bot-scoped-upsert-from-unscoped",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:     "scoped identity wrong scope",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "scoped-upsert-denied",
-					},
+					}.Build(),
 					Scope: "/scopes/ungranted",
 					Spec:  &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "expected access denied, got: %v", err)
 			},
@@ -1859,16 +1859,16 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "scoped identity cannot upsert unscoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{
 						Name: "unscoped-from-scoped",
-					},
-					Spec: &machineidv1pb.BotSpec{
+					}.Build(),
+					Spec: machineidv1pb.BotSpec_builder{
 						Roles: []string{testRole.GetName()},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "expected access denied, got: %v", err)
 			},
@@ -1876,12 +1876,12 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "cannot change scope: scoped to unscoped",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{Name: "scope-change-test"},
-					Spec:     &machineidv1pb.BotSpec{Roles: []string{testRole.GetName()}},
-				},
-			},
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{Name: "scope-change-test"}.Build(),
+					Spec:     machineidv1pb.BotSpec_builder{Roles: []string{testRole.GetName()}}.Build(),
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err), "expected bad parameter, got: %v", err)
 			},
@@ -1889,13 +1889,13 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "cannot change scope: unscoped to scoped",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{Name: "pre-existing"},
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{Name: "pre-existing"}.Build(),
 					Scope:    "/scopes/granted",
 					Spec:     &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err), "expected bad parameter, got: %v", err)
 			},
@@ -1903,13 +1903,13 @@ func TestUpsertBot(t *testing.T) {
 		{
 			name:     "cannot change scope: scoped to different scope",
 			identity: authtest.TestUser(botCreator.GetName()),
-			req: &machineidv1pb.UpsertBotRequest{
-				Bot: &machineidv1pb.Bot{
-					Metadata: &headerv1.Metadata{Name: "scope-change-test"},
+			req: machineidv1pb.UpsertBotRequest_builder{
+				Bot: machineidv1pb.Bot_builder{
+					Metadata: headerv1.Metadata_builder{Name: "scope-change-test"}.Build(),
 					Scope:    "/scopes/ungranted",
 					Spec:     &machineidv1pb.BotSpec{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err), "expected bad parameter, got: %v", err)
 			},
@@ -1995,111 +1995,111 @@ func TestGetBot(t *testing.T) {
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
 					Description: "The maze wasn't meant for you",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	preExistingBot2, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "foo-pre-existing",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 
 	// Scoped identity setup.
 	scopedSvc := client.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-getter",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbReadNoSecrets},
 						Resources: []string{types.KindBot},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
-	scopedPreExisting, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	scopedPreExisting, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-pre-existing",
-			},
+			}.Build(),
 			Spec:  &machineidv1pb.BotSpec{},
 			Scope: "/scopes/granted",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	_, err = client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-pre-existing-wrong-scope",
-			},
+			}.Build(),
 			Spec:  &machineidv1pb.BotSpec{},
 			Scope: "/scopes/ungranted",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2112,9 +2112,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "success",
 			identity: authtest.TestUser(botGetterUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: preExistingBot.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: preExistingBot.GetMetadata().GetName(),
+			}.Build(),
 
 			assertError: require.NoError,
 			want:        preExistingBot,
@@ -2122,9 +2122,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "success with where",
 			identity: authtest.TestUser(botGetterWhereUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: preExistingBot2.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: preExistingBot2.GetMetadata().GetName(),
+			}.Build(),
 
 			assertError: require.NoError,
 			want:        preExistingBot2,
@@ -2132,9 +2132,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "no permissions with where",
 			identity: authtest.TestUser(botGetterWhereUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: preExistingBot.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: preExistingBot.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
@@ -2142,9 +2142,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "no permissions",
 			identity: authtest.TestUser(unprivilegedUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: preExistingBot.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: preExistingBot.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -2152,9 +2152,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "validation - no bot name",
 			identity: authtest.TestUser(botGetterUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
+			req: machineidv1pb.GetBotRequest_builder{
 				BotName: "",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -2163,9 +2163,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "bot doesnt exist",
 			identity: authtest.TestUser(botGetterUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
+			req: machineidv1pb.GetBotRequest_builder{
 				BotName: "non-existent",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be bad parameter")
 			},
@@ -2173,27 +2173,27 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "scoped identity gets scoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: scopedPreExisting.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: scopedPreExisting.GetMetadata().GetName(),
+			}.Build(),
 			assertError: require.NoError,
 			want:        scopedPreExisting,
 		},
 		{
 			name:     "unscoped identity gets scoped bot",
 			identity: authtest.TestUser(botGetterUser.GetName()),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: scopedPreExisting.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: scopedPreExisting.GetMetadata().GetName(),
+			}.Build(),
 			assertError: require.NoError,
 			want:        scopedPreExisting,
 		},
 		{
 			name:     "scoped identity wrong scope",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.GetBotRequest{
+			req: machineidv1pb.GetBotRequest_builder{
 				BotName: "scoped-pre-existing-wrong-scope",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				// GetBot returns NotFound rather than AccessDenied to avoid leaking existence.
 				require.True(t, trace.IsNotFound(err), "expected not found, got: %v", err)
@@ -2202,9 +2202,9 @@ func TestGetBot(t *testing.T) {
 		{
 			name:     "scoped identity cannot get unscoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.GetBotRequest{
-				BotName: preExistingBot.Metadata.Name,
-			},
+			req: machineidv1pb.GetBotRequest_builder{
+				BotName: preExistingBot.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				// GetBot returns NotFound rather than AccessDenied to avoid leaking existence.
 				require.True(t, trace.IsNotFound(err), "expected not found, got: %v", err)
@@ -2268,136 +2268,136 @@ func TestListBots(t *testing.T) {
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing",
 					Labels: map[string]string{
 						"my-label":       "my-value",
 						"my-other-label": "my-other-value",
 					},
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	preExistingBot2, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing-2",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	preExistingBot3, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "foo-pre-existing-2",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 
 	// Scoped identity setup.
 	scopedSvc := client.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-lister",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbList},
 						Resources: []string{types.KindBot},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope:   "/scopes",
 			SubKind: scopedaccess.SubKindDynamic,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create a 2nd scoped user with assignment at /scopes/ungranted (where no bots exist).
 	scopedUser2, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user-2")
 	require.NoError(t, err)
-	sraResp2, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp2, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser2.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/ungranted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/ungranted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp, sraResp2)
 
-	scopedPreExisting, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	scopedPreExisting, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-pre-existing",
-			},
+			}.Build(),
 			Spec:  &machineidv1pb.BotSpec{},
 			Scope: "/scopes/granted",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2412,25 +2412,25 @@ func TestListBots(t *testing.T) {
 			identity:    authtest.TestUser(botListerUser.GetName()),
 			req:         &machineidv1pb.ListBotsRequest{},
 			assertError: require.NoError,
-			want: &machineidv1pb.ListBotsResponse{
+			want: machineidv1pb.ListBotsResponse_builder{
 				Bots: []*machineidv1pb.Bot{
 					preExistingBot,
 					preExistingBot2,
 					preExistingBot3,
 					scopedPreExisting,
 				},
-			},
+			}.Build(),
 		},
 		{
 			name:        "success with where",
 			identity:    authtest.TestUser(botListWhereUser.GetName()),
 			req:         &machineidv1pb.ListBotsRequest{},
 			assertError: require.NoError,
-			want: &machineidv1pb.ListBotsResponse{
+			want: machineidv1pb.ListBotsResponse_builder{
 				Bots: []*machineidv1pb.Bot{
 					preExistingBot3,
 				},
-			},
+			}.Build(),
 		},
 		{
 			name:     "no permissions",
@@ -2445,11 +2445,11 @@ func TestListBots(t *testing.T) {
 			identity:    authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
 			req:         &machineidv1pb.ListBotsRequest{},
 			assertError: require.NoError,
-			want: &machineidv1pb.ListBotsResponse{
+			want: machineidv1pb.ListBotsResponse_builder{
 				Bots: []*machineidv1pb.Bot{
 					scopedPreExisting,
 				},
-			},
+			}.Build(),
 		},
 		{
 			// Scoped user at /scopes/ungranted where no bots exist: returns empty list.
@@ -2457,9 +2457,9 @@ func TestListBots(t *testing.T) {
 			identity:    authtest.TestScopedUser(scopedUser2.GetName(), "/scopes/ungranted"),
 			req:         &machineidv1pb.ListBotsRequest{},
 			assertError: require.NoError,
-			want: &machineidv1pb.ListBotsResponse{
+			want: machineidv1pb.ListBotsResponse_builder{
 				Bots: []*machineidv1pb.Bot{},
-			},
+			}.Build(),
 		},
 	}
 	for _, tt := range tests {
@@ -2537,113 +2537,113 @@ func TestDeleteBot(t *testing.T) {
 	require.NoError(t, err)
 	preExistingBot, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	preExistingBot3, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "pre-existing-3",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	preExistingBot4, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "foo-pre-existing",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	preExistingBot5, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "not-foo-pre-existing",
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: []string{testRole.GetName()},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 
 	// Scoped identity setup: create a scoped role, user, and assignment.
 	scopedSvc := client.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-deleter",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbDelete},
 						Resources: []string{types.KindBot},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
 	// Create scoped role assignment linking user to scoped role.
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
@@ -2651,47 +2651,47 @@ func TestDeleteBot(t *testing.T) {
 	// Note: scoped bots cannot have roles set.
 	scopedPreExisting, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-pre-existing",
-				},
+				}.Build(),
 				Spec:  &machineidv1pb.BotSpec{},
 				Scope: "/scopes/granted",
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	scopedPreExistingUnscoped, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-pre-existing-unscoped",
-				},
+				}.Build(),
 				Spec:  &machineidv1pb.BotSpec{},
 				Scope: "/scopes/granted",
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	scopedPreExistingWrongScope, err := client.BotServiceClient().CreateBot(
 		ctx,
-		&machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
+		machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-pre-existing-wrong-scope",
-				},
+				}.Build(),
 				Spec:  &machineidv1pb.BotSpec{},
 				Scope: "/scopes/ungranted",
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -2706,27 +2706,27 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "success",
 			identity: authtest.TestUser(botDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: preExistingBot.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: preExistingBot.GetMetadata().GetName(),
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 		},
 		{
 			name:     "success with where",
 			identity: authtest.TestUser(botWhereDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: preExistingBot4.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: preExistingBot4.GetMetadata().GetName(),
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 		},
 		{
 			name:     "no permissions with where",
 			identity: authtest.TestUser(botWhereDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: preExistingBot5.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: preExistingBot5.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -2734,9 +2734,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "no permissions",
 			identity: authtest.TestUser(unprivilegedUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: preExistingBot3.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: preExistingBot3.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -2744,9 +2744,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "non existent",
 			identity: authtest.TestUser(botDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
+			req: machineidv1pb.DeleteBotRequest_builder{
 				BotName: "does-not-exist",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
@@ -2754,9 +2754,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "non-bot role",
 			identity: authtest.TestUser(botDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
+			req: machineidv1pb.DeleteBotRequest_builder{
 				BotName: "not-bot",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "missing bot label matching bot name")
 			},
@@ -2764,9 +2764,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "validation - no bot name",
 			identity: authtest.TestUser(botDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
+			req: machineidv1pb.DeleteBotRequest_builder{
 				BotName: "",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "bot_name: must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be access denied")
@@ -2775,9 +2775,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "scoped identity deletes scoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: scopedPreExisting.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: scopedPreExisting.GetMetadata().GetName(),
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 			scoped:                true,
@@ -2785,9 +2785,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "unscoped identity deletes scoped bot",
 			identity: authtest.TestUser(botDeleterUser.GetName()),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: scopedPreExistingUnscoped.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: scopedPreExistingUnscoped.GetMetadata().GetName(),
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 			scoped:                true,
@@ -2795,9 +2795,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "scoped identity wrong scope",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: scopedPreExistingWrongScope.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: scopedPreExistingWrongScope.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "expected access denied, got: %v", err)
 			},
@@ -2805,9 +2805,9 @@ func TestDeleteBot(t *testing.T) {
 		{
 			name:     "scoped identity cannot delete unscoped bot",
 			identity: authtest.TestScopedUser(scopedUser.GetName(), "/scopes/granted"),
-			req: &machineidv1pb.DeleteBotRequest{
-				BotName: preExistingBot3.Metadata.Name,
-			},
+			req: machineidv1pb.DeleteBotRequest_builder{
+				BotName: preExistingBot3.GetMetadata().GetName(),
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "expected access denied, got: %v", err)
 			},
@@ -2821,10 +2821,10 @@ func TestDeleteBot(t *testing.T) {
 			_, err = client.BotServiceClient().DeleteBot(ctx, tt.req)
 			tt.assertError(t, err)
 			if tt.checkResourcesDeleted {
-				_, err := srv.Auth().GetUser(ctx, machineidv1.BotResourceName(tt.req.BotName), false)
+				_, err := srv.Auth().GetUser(ctx, machineidv1.BotResourceName(tt.req.GetBotName()), false)
 				require.True(t, trace.IsNotFound(err), "bot user should be deleted")
 				if !tt.scoped {
-					_, err = srv.Auth().GetRole(ctx, machineidv1.BotResourceName(tt.req.BotName))
+					_, err = srv.Auth().GetRole(ctx, machineidv1.BotResourceName(tt.req.GetBotName()))
 					require.True(t, trace.IsNotFound(err), "bot role should be deleted")
 				}
 			}
@@ -2834,31 +2834,31 @@ func TestDeleteBot(t *testing.T) {
 
 func TestStrongValidateBot(t *testing.T) {
 	newBot := func(mutate func(bot *machineidv1pb.Bot)) *machineidv1pb.Bot {
-		bot := &machineidv1pb.Bot{
+		bot := machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-bot",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"test-role"},
-			},
-		}
+			}.Build(),
+		}.Build()
 		if mutate != nil {
 			mutate(bot)
 		}
 		return bot
 	}
 	newScopedBot := func(mutate func(bot *machineidv1pb.Bot)) *machineidv1pb.Bot {
-		bot := &machineidv1pb.Bot{
+		bot := machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-bot",
-			},
+			}.Build(),
 			Scope: "/test/scope",
 			Spec:  &machineidv1pb.BotSpec{},
-		}
+		}.Build()
 		if mutate != nil {
 			mutate(bot)
 		}
@@ -2881,23 +2881,23 @@ func TestStrongValidateBot(t *testing.T) {
 		},
 		{
 			name:        "nil metadata",
-			bot:         newBot(func(b *machineidv1pb.Bot) { b.Metadata = nil }),
+			bot:         newBot(func(b *machineidv1pb.Bot) { b.ClearMetadata() }),
 			assertError: isBadParam,
 		},
 		{
 			name:        "empty name",
-			bot:         newBot(func(b *machineidv1pb.Bot) { b.Metadata.Name = "" }),
+			bot:         newBot(func(b *machineidv1pb.Bot) { b.GetMetadata().SetName("") }),
 			assertError: isBadParam,
 		},
 		{
 			name:        "nil spec",
-			bot:         newBot(func(b *machineidv1pb.Bot) { b.Spec = nil }),
+			bot:         newBot(func(b *machineidv1pb.Bot) { b.ClearSpec() }),
 			assertError: isBadParam,
 		},
 		{
 			name: "roles contains empty string",
 			bot: newBot(func(b *machineidv1pb.Bot) {
-				b.Spec.Roles = []string{"valid-role", ""}
+				b.GetSpec().SetRoles([]string{"valid-role", ""})
 			}),
 			assertError: isBadParam,
 		},
@@ -2909,41 +2909,41 @@ func TestStrongValidateBot(t *testing.T) {
 		{
 			name: "valid unscoped bot with no roles",
 			bot: newBot(func(b *machineidv1pb.Bot) {
-				b.Spec.Roles = nil
+				b.GetSpec().SetRoles(nil)
 			}),
 			assertError: require.NoError,
 		},
 		{
 			name: "valid unscoped bot with traits and max_session_ttl",
 			bot: newBot(func(b *machineidv1pb.Bot) {
-				b.Spec.Traits = []*machineidv1pb.Trait{{Name: "foo", Values: []string{"bar"}}}
-				b.Spec.MaxSessionTtl = durationpb.New(time.Hour)
+				b.GetSpec().SetTraits([]*machineidv1pb.Trait{machineidv1pb.Trait_builder{Name: "foo", Values: []string{"bar"}}.Build()})
+				b.GetSpec().SetMaxSessionTtl(durationpb.New(time.Hour))
 			}),
 			assertError: require.NoError,
 		},
 		{
 			name:        "scoped bot with invalid scope",
-			bot:         newScopedBot(func(b *machineidv1pb.Bot) { b.Scope = "no-leading-slash" }),
+			bot:         newScopedBot(func(b *machineidv1pb.Bot) { b.SetScope("no-leading-slash") }),
 			assertError: isBadParam,
 		},
 		{
 			name: "scoped bot with roles set",
 			bot: newScopedBot(func(b *machineidv1pb.Bot) {
-				b.Spec.Roles = []string{"some-role"}
+				b.GetSpec().SetRoles([]string{"some-role"})
 			}),
 			assertError: isBadParam,
 		},
 		{
 			name: "scoped bot with traits set",
 			bot: newScopedBot(func(b *machineidv1pb.Bot) {
-				b.Spec.Traits = []*machineidv1pb.Trait{{Name: "foo", Values: []string{"bar"}}}
+				b.GetSpec().SetTraits([]*machineidv1pb.Trait{machineidv1pb.Trait_builder{Name: "foo", Values: []string{"bar"}}.Build()})
 			}),
 			assertError: isBadParam,
 		},
 		{
 			name: "scoped bot with max_session_ttl set",
 			bot: newScopedBot(func(b *machineidv1pb.Bot) {
-				b.Spec.MaxSessionTtl = durationpb.New(time.Hour)
+				b.GetSpec().SetMaxSessionTtl(durationpb.New(time.Hour))
 			}),
 			assertError: isBadParam,
 		},
@@ -2954,7 +2954,7 @@ func TestStrongValidateBot(t *testing.T) {
 		},
 		{
 			name:        "valid scoped bot at root scope",
-			bot:         newScopedBot(func(b *machineidv1pb.Bot) { b.Scope = "/" }),
+			bot:         newScopedBot(func(b *machineidv1pb.Bot) { b.SetScope("/") }),
 			assertError: require.NoError,
 		},
 	}
@@ -2986,11 +2986,11 @@ func TestStrongValidateBotScopedFuzz(t *testing.T) {
 			spec := &machineidv1pb.BotSpec{}
 			protoSetNonZeroField(spec.ProtoReflect(), fd)
 
-			bot := &machineidv1pb.Bot{
-				Metadata: &headerv1.Metadata{Name: "test-bot"},
+			bot := machineidv1pb.Bot_builder{
+				Metadata: headerv1.Metadata_builder{Name: "test-bot"}.Build(),
 				Scope:    "/test/scope",
 				Spec:     spec,
-			}
+			}.Build()
 
 			err := machineidv1.StrongValidateBot(bot)
 			if allowedScopedSpecFields[fd.Name()] {
@@ -3080,10 +3080,10 @@ func waitForSRACache(t *testing.T, srv *authtest.TLSServer, resps ...*scopedacce
 	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		for _, resp := range resps {
-			_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 				Name:    resp.GetAssignment().GetMetadata().GetName(),
 				SubKind: resp.GetAssignment().GetSubKind(),
-			})
+			}.Build())
 			require.NoError(t, err)
 		}
 	}, 10*time.Second, 100*time.Millisecond)
@@ -3098,19 +3098,19 @@ func createBotInstance(
 	if instanceID == "" {
 		instanceID = uuid.NewString()
 	}
-	bi := &machineidv1pb.BotInstance{
+	bi := machineidv1pb.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-		},
-		Spec: &machineidv1pb.BotInstanceSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotInstanceSpec_builder{
 			BotName:    botName,
 			InstanceId: instanceID,
-		},
+		}.Build(),
 		Status: &machineidv1pb.BotInstanceStatus{},
 		Scope:  scope,
-	}
+	}.Build()
 	created, err := srv.Auth().BotInstance.CreateBotInstance(t.Context(), bi)
 	require.NoError(t, err)
 	return created
@@ -3137,47 +3137,47 @@ func TestBotInstanceService_DeleteBotInstance(t *testing.T) {
 	require.NoError(t, err)
 
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-instance-deleter",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbDelete},
 						Resources: []string{types.KindBotInstance},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
@@ -3234,10 +3234,10 @@ func TestBotInstanceService_DeleteBotInstance(t *testing.T) {
 			client, err := srv.NewClient(tt.identity)
 			require.NoError(t, err)
 
-			_, err = client.BotInstanceServiceClient().DeleteBotInstance(ctx, &machineidv1pb.DeleteBotInstanceRequest{
-				BotName:    tt.instance.Spec.BotName,
-				InstanceId: tt.instance.Spec.InstanceId,
-			})
+			_, err = client.BotInstanceServiceClient().DeleteBotInstance(ctx, machineidv1pb.DeleteBotInstanceRequest_builder{
+				BotName:    tt.instance.GetSpec().GetBotName(),
+				InstanceId: tt.instance.GetSpec().GetInstanceId(),
+			}.Build())
 			tt.assertError(t, err)
 		})
 	}
@@ -3264,47 +3264,47 @@ func TestBotInstanceService_GetBotInstance(t *testing.T) {
 	require.NoError(t, err)
 
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-instance-reader",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbReadNoSecrets},
 						Resources: []string{types.KindBotInstance},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
-	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sraResp)
 
@@ -3358,13 +3358,13 @@ func TestBotInstanceService_GetBotInstance(t *testing.T) {
 			client, err := srv.NewClient(tt.identity)
 			require.NoError(t, err)
 
-			got, err := client.BotInstanceServiceClient().GetBotInstance(ctx, &machineidv1pb.GetBotInstanceRequest{
-				BotName:    tt.instance.Spec.BotName,
-				InstanceId: tt.instance.Spec.InstanceId,
-			})
+			got, err := client.BotInstanceServiceClient().GetBotInstance(ctx, machineidv1pb.GetBotInstanceRequest_builder{
+				BotName:    tt.instance.GetSpec().GetBotName(),
+				InstanceId: tt.instance.GetSpec().GetInstanceId(),
+			}.Build())
 			tt.assertError(t, err)
 			if err == nil {
-				require.Equal(t, tt.instance.Spec.InstanceId, got.Spec.InstanceId)
+				require.Equal(t, tt.instance.GetSpec().GetInstanceId(), got.GetSpec().GetInstanceId())
 			}
 		})
 	}
@@ -3391,65 +3391,65 @@ func TestBotInstanceService_ListBotInstancesV2(t *testing.T) {
 	require.NoError(t, err)
 
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-bot-instance-lister",
-			},
+			}.Build(),
 			Scope: "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/scopes/granted", "/scopes/ungranted", "/scopes/other"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
 						Resources: []string{types.KindBotInstance},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	scopedUser, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-user")
 	require.NoError(t, err)
 
-	sra1Resp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sra1Resp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/granted"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/granted"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	sra2Resp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sra2Resp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/scopes",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: scopedUser.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/other"},
+					scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/other"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, srv, sra1Resp, sra2Resp)
 
@@ -3473,11 +3473,11 @@ func TestBotInstanceService_ListBotInstancesV2(t *testing.T) {
 
 	allIDs := make(map[string]struct{})
 	for _, bi := range allInstances {
-		allIDs[bi.Spec.InstanceId] = struct{}{}
+		allIDs[bi.GetSpec().GetInstanceId()] = struct{}{}
 	}
 	grantedIDs := make(map[string]struct{})
 	for _, bi := range grantedInstances {
-		grantedIDs[bi.Spec.InstanceId] = struct{}{}
+		grantedIDs[bi.GetSpec().GetInstanceId()] = struct{}{}
 	}
 
 	listAll := func(t *testing.T, client machineidv1pb.BotInstanceServiceClient) []*machineidv1pb.BotInstance {
@@ -3487,11 +3487,11 @@ func TestBotInstanceService_ListBotInstancesV2(t *testing.T) {
 			func(
 				ctx context.Context, limit int, nextToken string,
 			) ([]*machineidv1pb.BotInstance, string, error) {
-				res, err := client.ListBotInstancesV2(ctx, &machineidv1pb.ListBotInstancesV2Request{
+				res, err := client.ListBotInstancesV2(ctx, machineidv1pb.ListBotInstancesV2Request_builder{
 					PageToken: nextToken,
 					PageSize:  int32(limit),
-				})
-				return res.BotInstances, res.NextPageToken, err
+				}.Build())
+				return res.GetBotInstances(), res.GetNextPageToken(), err
 			}),
 		)
 		require.NoError(t, err)
@@ -3505,7 +3505,7 @@ func TestBotInstanceService_ListBotInstancesV2(t *testing.T) {
 		got := listAll(t, client.BotInstanceServiceClient())
 		require.Len(t, got, len(allInstances))
 		for _, bi := range got {
-			require.Contains(t, allIDs, bi.Spec.InstanceId)
+			require.Contains(t, allIDs, bi.GetSpec().GetInstanceId())
 		}
 	})
 
@@ -3516,7 +3516,7 @@ func TestBotInstanceService_ListBotInstancesV2(t *testing.T) {
 		got := listAll(t, client.BotInstanceServiceClient())
 		require.Len(t, got, len(grantedInstances))
 		for _, bi := range got {
-			require.Contains(t, grantedIDs, bi.Spec.InstanceId)
+			require.Contains(t, grantedIDs, bi.GetSpec().GetInstanceId())
 		}
 	})
 
@@ -3561,96 +3561,96 @@ func TestBotInstanceService_SubmitHeartbeat(t *testing.T) {
 
 	t.Run("unscoped bot", func(t *testing.T) {
 		const botName = "heartbeat-unscoped"
-		_, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
-				Metadata: &headerv1.Metadata{Name: botName},
-				Spec:     &machineidv1pb.BotSpec{Roles: []string{testRole.GetName()}},
-			},
-		})
+		_, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
+				Metadata: headerv1.Metadata_builder{Name: botName}.Build(),
+				Spec:     machineidv1pb.BotSpec_builder{Roles: []string{testRole.GetName()}}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
 		botClient, instanceID := newBotClient(t, authtest.TestBot(botName, false))
 		createBotInstance(t, srv, botName, "", instanceID)
 
-		_, err = botClient.BotInstanceServiceClient().SubmitHeartbeat(ctx, &machineidv1pb.SubmitHeartbeatRequest{
-			Heartbeat: &machineidv1pb.BotInstanceStatusHeartbeat{Hostname: "unscoped-host"},
-		})
+		_, err = botClient.BotInstanceServiceClient().SubmitHeartbeat(ctx, machineidv1pb.SubmitHeartbeatRequest_builder{
+			Heartbeat: machineidv1pb.BotInstanceStatusHeartbeat_builder{Hostname: "unscoped-host"}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
-		got, err := adminClient.BotInstanceServiceClient().GetBotInstance(ctx, &machineidv1pb.GetBotInstanceRequest{
+		got, err := adminClient.BotInstanceServiceClient().GetBotInstance(ctx, machineidv1pb.GetBotInstanceRequest_builder{
 			BotName:    botName,
 			InstanceId: instanceID,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.NotNil(t, got.Status.InitialHeartbeat)
-		require.Equal(t, "unscoped-host", got.Status.InitialHeartbeat.Hostname)
+		require.NotNil(t, got.GetStatus().GetInitialHeartbeat())
+		require.Equal(t, "unscoped-host", got.GetStatus().GetInitialHeartbeat().GetHostname())
 	})
 
 	t.Run("scoped bot", func(t *testing.T) {
 		const botName = "heartbeat-scoped"
-		_, err := adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-			Bot: &machineidv1pb.Bot{
-				Metadata: &headerv1.Metadata{Name: botName},
+		_, err := adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+			Bot: machineidv1pb.Bot_builder{
+				Metadata: headerv1.Metadata_builder{Name: botName}.Build(),
 				Scope:    "/scopes/test",
 				Spec:     &machineidv1pb.BotSpec{},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
 		// We need to assign our bot a scoped role otherwise we won't be able
 		// to generate certificates for it.
 		scopedSvc := adminClient.ScopedAccessServiceClient()
-		scopedRole, err := scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-			Role: &scopedaccessv1.ScopedRole{
+		scopedRole, err := scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+			Role: scopedaccessv1.ScopedRole_builder{
 				Kind:    scopedaccess.KindScopedRole,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped-heartbeat-role",
-				},
+				}.Build(),
 				Scope: "/scopes",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/scopes/test"},
 					Rules:            []*scopedaccessv1.ScopedRule{},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+		sraResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+			Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    scopedaccess.KindScopedRoleAssignment,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.NewString(),
-				},
+				}.Build(),
 				SubKind: scopedaccess.SubKindDynamic,
 				Scope:   "/scopes",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					BotName:  botName,
 					BotScope: "/scopes/test",
 					Assignments: []*scopedaccessv1.Assignment{
-						{Role: scopedRole.Role.Metadata.Name, Scope: "/scopes/test"},
+						scopedaccessv1.Assignment_builder{Role: scopedRole.GetRole().GetMetadata().GetName(), Scope: "/scopes/test"}.Build(),
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 		waitForSRACache(t, srv, sraResp)
 
 		botClient, instanceID := newBotClient(t, authtest.TestScopedBot(botName, "/scopes/test", true))
 		createBotInstance(t, srv, botName, "/scopes/test", instanceID)
 
-		_, err = botClient.BotInstanceServiceClient().SubmitHeartbeat(ctx, &machineidv1pb.SubmitHeartbeatRequest{
-			Heartbeat: &machineidv1pb.BotInstanceStatusHeartbeat{Hostname: "scoped-host"},
-		})
+		_, err = botClient.BotInstanceServiceClient().SubmitHeartbeat(ctx, machineidv1pb.SubmitHeartbeatRequest_builder{
+			Heartbeat: machineidv1pb.BotInstanceStatusHeartbeat_builder{Hostname: "scoped-host"}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
-		got, err := adminClient.BotInstanceServiceClient().GetBotInstance(ctx, &machineidv1pb.GetBotInstanceRequest{
+		got, err := adminClient.BotInstanceServiceClient().GetBotInstance(ctx, machineidv1pb.GetBotInstanceRequest_builder{
 			BotName:    botName,
 			InstanceId: instanceID,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.NotNil(t, got.Status.InitialHeartbeat)
-		require.Equal(t, "scoped-host", got.Status.InitialHeartbeat.Hostname)
+		require.NotNil(t, got.GetStatus().GetInitialHeartbeat())
+		require.Equal(t, "scoped-host", got.GetStatus().GetInitialHeartbeat().GetHostname())
 	})
 }
 
diff --git a/lib/auth/machineid/machineidv1/spiffe_federation_service.go b/lib/auth/machineid/machineidv1/spiffe_federation_service.go
index 62d4290c922..d068296b409 100644
--- a/lib/auth/machineid/machineidv1/spiffe_federation_service.go
+++ b/lib/auth/machineid/machineidv1/spiffe_federation_service.go
@@ -119,11 +119,11 @@ func (s *SPIFFEFederationService) GetSPIFFEFederation(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	federation, err := s.cache.GetSPIFFEFederation(ctx, req.Name)
+	federation, err := s.cache.GetSPIFFEFederation(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -147,17 +147,17 @@ func (s *SPIFFEFederationService) ListSPIFFEFederations(
 
 	federations, nextToken, err := s.cache.ListSPIFFEFederations(
 		ctx,
-		int(req.PageSize),
-		req.PageToken,
+		int(req.GetPageSize()),
+		req.GetPageToken(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &machineidv1.ListSPIFFEFederationsResponse{
+	return machineidv1.ListSPIFFEFederationsResponse_builder{
 		SpiffeFederations: federations,
 		NextPageToken:     nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteSPIFFEFederation deletes a SPIFFE Federation by name.
@@ -176,11 +176,11 @@ func (s *SPIFFEFederationService) DeleteSPIFFEFederation(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	if err := s.backend.DeleteSPIFFEFederation(ctx, req.Name); err != nil {
+	if err := s.backend.DeleteSPIFFEFederation(ctx, req.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -192,7 +192,7 @@ func (s *SPIFFEFederationService) DeleteSPIFFEFederation(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Name,
+			Name: req.GetName(),
 		},
 	}); err != nil {
 		s.logger.ErrorContext(
@@ -226,7 +226,7 @@ func (s *SPIFFEFederationService) CreateSPIFFEFederation(
 		}
 	}
 
-	created, err := s.backend.CreateSPIFFEFederation(ctx, req.SpiffeFederation)
+	created, err := s.backend.CreateSPIFFEFederation(ctx, req.GetSpiffeFederation())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -239,7 +239,7 @@ func (s *SPIFFEFederationService) CreateSPIFFEFederation(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.SpiffeFederation.Metadata.Name,
+			Name: req.GetSpiffeFederation().GetMetadata().GetName(),
 		},
 	}); err != nil {
 		s.logger.ErrorContext(
diff --git a/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go b/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go
index fc56ea9753d..24360145be4 100644
--- a/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go
+++ b/lib/auth/machineid/machineidv1/spiffe_federation_service_test.go
@@ -78,20 +78,20 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	good := &machineidv1pb.SPIFFEFederation{
+	good := machineidv1pb.SPIFFEFederation_builder{
 		Kind:    types.KindSPIFFEFederation,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "example.com",
-		},
-		Spec: &machineidv1pb.SPIFFEFederationSpec{
-			BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-				HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+		}.Build(),
+		Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+			BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+				HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 					BundleEndpointUrl: "https://example.com/bundle.json",
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	tests := []struct {
 		name           string
@@ -104,9 +104,9 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 		{
 			name: "success",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.CreateSPIFFEFederationRequest{
+			req: machineidv1pb.CreateSPIFFEFederationRequest_builder{
 				SpiffeFederation: good,
-			},
+			}.Build(),
 			requireError:   require.NoError,
 			requireSuccess: true,
 			requireEvent: &events.SPIFFEFederationCreate{
@@ -128,15 +128,15 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 		{
 			name: "unable to set status",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.CreateSPIFFEFederationRequest{
+			req: machineidv1pb.CreateSPIFFEFederationRequest_builder{
 				SpiffeFederation: func() *machineidv1pb.SPIFFEFederation {
 					fed := proto.Clone(good).(*machineidv1pb.SPIFFEFederation)
-					fed.Status = &machineidv1pb.SPIFFEFederationStatus{
+					fed.SetStatus(machineidv1pb.SPIFFEFederationStatus_builder{
 						CurrentBundleSyncedAt: timestamppb.Now(),
-					}
+					}.Build())
 					return fed
 				}(),
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.Error(t, err)
 				require.True(t, trace.IsBadParameter(err))
@@ -146,13 +146,13 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 		{
 			name: "validation is run",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.CreateSPIFFEFederationRequest{
+			req: machineidv1pb.CreateSPIFFEFederationRequest_builder{
 				SpiffeFederation: func() *machineidv1pb.SPIFFEFederation {
 					fed := proto.Clone(good).(*machineidv1pb.SPIFFEFederation)
-					fed.Metadata.Name = "spiffe://im----invalid"
+					fed.GetMetadata().SetName("spiffe://im----invalid")
 					return fed
 				}(),
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.Error(t, err)
 				require.True(t, trace.IsBadParameter(err))
@@ -162,9 +162,9 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 		{
 			name: "unauthorized",
 			user: unauthorizedUser.GetName(),
-			req: &machineidv1pb.CreateSPIFFEFederationRequest{
+			req: machineidv1pb.CreateSPIFFEFederationRequest_builder{
 				SpiffeFederation: good,
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.Error(t, err)
 				require.True(t, trace.IsAccessDenied(err))
@@ -185,7 +185,7 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 				require.Empty(
 					t,
 					cmp.Diff(
-						tt.req.SpiffeFederation,
+						tt.req.GetSpiffeFederation(),
 						got,
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
@@ -194,13 +194,13 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 
 				// Then check the response is actually stored in the backend
 				got, err := srv.Auth().Services.SPIFFEFederations.GetSPIFFEFederation(
-					ctx, got.Metadata.GetName(),
+					ctx, got.GetMetadata().GetName(),
 				)
 				require.NoError(t, err)
 				require.Empty(
 					t,
 					cmp.Diff(
-						tt.req.SpiffeFederation,
+						tt.req.GetSpiffeFederation(),
 						got,
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
@@ -318,20 +318,20 @@ func TestSPIFFEFederationService_DeleteSPIFFEFederation(t *testing.T) {
 			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
-			resource := &machineidv1pb.SPIFFEFederation{
+			resource := machineidv1pb.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: name,
-				},
-				Spec: &machineidv1pb.SPIFFEFederationSpec{
-					BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/bundle.json",
-						},
-					},
-				},
-			}
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build()
 
 			if tt.create {
 				_, err := srv.Auth().Services.SPIFFEFederations.CreateSPIFFEFederation(
@@ -341,14 +341,14 @@ func TestSPIFFEFederationService_DeleteSPIFFEFederation(t *testing.T) {
 			}
 
 			mockEmitter.Reset()
-			_, err = client.SPIFFEFederationServiceClient().DeleteSPIFFEFederation(ctx, &machineidv1pb.DeleteSPIFFEFederationRequest{
-				Name: resource.Metadata.GetName(),
-			})
+			_, err = client.SPIFFEFederationServiceClient().DeleteSPIFFEFederation(ctx, machineidv1pb.DeleteSPIFFEFederationRequest_builder{
+				Name: resource.GetMetadata().GetName(),
+			}.Build())
 			tt.requireError(t, err)
 			if tt.requireSuccess {
 				// Check that it is no longer in the backend
 				_, err := srv.Auth().Services.SPIFFEFederations.GetSPIFFEFederation(
-					ctx, resource.Metadata.GetName(),
+					ctx, resource.GetMetadata().GetName(),
 				)
 				require.True(t, trace.IsNotFound(err))
 			}
@@ -397,20 +397,20 @@ func TestSPIFFEFederationService_GetSPIFFEFederation(t *testing.T) {
 
 	name := "example.com"
 	resource, err := srv.Auth().Services.SPIFFEFederations.CreateSPIFFEFederation(
-		ctx, &machineidv1pb.SPIFFEFederation{
+		ctx, machineidv1pb.SPIFFEFederation_builder{
 			Kind:    types.KindSPIFFEFederation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.SPIFFEFederationSpec{
-				BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-					HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+			}.Build(),
+			Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+				BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+					HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 						BundleEndpointUrl: "https://example.com/bundle.json",
-					},
-				},
-			},
-		},
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -444,9 +444,9 @@ func TestSPIFFEFederationService_GetSPIFFEFederation(t *testing.T) {
 			client, err := srv.NewClient(authtest.TestUser(tt.user))
 			require.NoError(t, err)
 
-			got, err := client.SPIFFEFederationServiceClient().GetSPIFFEFederation(ctx, &machineidv1pb.GetSPIFFEFederationRequest{
+			got, err := client.SPIFFEFederationServiceClient().GetSPIFFEFederation(ctx, machineidv1pb.GetSPIFFEFederationRequest_builder{
 				Name: tt.getName,
-			})
+			}.Build())
 			tt.requireError(t, err)
 			if tt.requireSuccess {
 				require.Empty(
@@ -495,20 +495,20 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 	for i := range 49 {
 		created, err := srv.AuthServer.AuthServer.Services.SPIFFEFederations.CreateSPIFFEFederation(
 			ctx,
-			&machineidv1pb.SPIFFEFederation{
+			machineidv1pb.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: fmt.Sprintf("%d.example.com", i),
-				},
-				Spec: &machineidv1pb.SPIFFEFederationSpec{
-					BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/bundle.json",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		)
 		require.NoError(t, err)
 		createdObjects = append(createdObjects, created)
@@ -549,19 +549,19 @@ func TestSPIFFEFederationService_ListSPIFFEFederations(t *testing.T) {
 			iterations := 0
 			for {
 				iterations++
-				resp, err := client.SPIFFEFederationServiceClient().ListSPIFFEFederations(ctx, &machineidv1pb.ListSPIFFEFederationsRequest{
+				resp, err := client.SPIFFEFederationServiceClient().ListSPIFFEFederations(ctx, machineidv1pb.ListSPIFFEFederationsRequest_builder{
 					PageSize:  int32(tt.pageSize),
 					PageToken: token,
-				})
+				}.Build())
 				tt.requireError(t, err)
 				if err != nil {
 					return
 				}
-				fetched = append(fetched, resp.SpiffeFederations...)
-				if resp.NextPageToken == "" {
+				fetched = append(fetched, resp.GetSpiffeFederations()...)
+				if resp.GetNextPageToken() == "" {
 					break
 				}
-				token = resp.NextPageToken
+				token = resp.GetNextPageToken()
 			}
 			if tt.assertResponse {
 				require.Equal(t, tt.wantIterations, iterations)
diff --git a/lib/auth/machineid/machineidv1/spiffe_federation_syncer.go b/lib/auth/machineid/machineidv1/spiffe_federation_syncer.go
index 127ee4516a0..b018a13936c 100644
--- a/lib/auth/machineid/machineidv1/spiffe_federation_syncer.go
+++ b/lib/auth/machineid/machineidv1/spiffe_federation_syncer.go
@@ -484,20 +484,20 @@ func (s *SPIFFEFederationSyncer) shouldSyncTrustDomain(
 	log *slog.Logger,
 	in *machineidv1.SPIFFEFederation,
 ) string {
-	if in.Status == nil {
+	if !in.HasStatus() {
 		log.DebugContext(ctx, "No status, will sync")
 		return "no_status"
 	}
-	if in.Status.CurrentBundle == "" {
+	if in.GetStatus().GetCurrentBundle() == "" {
 		log.DebugContext(ctx, "No status.current_bundle, will sync")
 		return "no_current_bundle"
 	}
-	if in.Status.CurrentBundleSyncedAt.AsTime().IsZero() {
+	if in.GetStatus().GetCurrentBundleSyncedAt().AsTime().IsZero() {
 		log.DebugContext(ctx, "No status.current_bundle_synced_at, will sync")
 		return "no_current_bundle_synced_at"
 	}
 	// Check if we've passed the next sync time.
-	nextSyncAt := in.Status.NextSyncAt.AsTime()
+	nextSyncAt := in.GetStatus().GetNextSyncAt().AsTime()
 	now := s.cfg.Clock.Now()
 	if !nextSyncAt.IsZero() && now.After(nextSyncAt) {
 		log.DebugContext(
@@ -509,8 +509,8 @@ func (s *SPIFFEFederationSyncer) shouldSyncTrustDomain(
 		return "next_sync_at_passed"
 	}
 	// Check to see if the configured bundle source has changed
-	if in.Status.CurrentBundleSyncedFrom != nil {
-		if !proto.Equal(in.Spec.BundleSource, in.Status.CurrentBundleSyncedFrom) {
+	if in.GetStatus().HasCurrentBundleSyncedFrom() {
+		if !proto.Equal(in.GetSpec().GetBundleSource(), in.GetStatus().GetCurrentBundleSyncedFrom()) {
 			log.DebugContext(ctx, "status.current_bundle_synced_from has changed, will sync")
 			return "bundle_source_changed"
 		}
@@ -554,15 +554,15 @@ func (s *SPIFFEFederationSyncer) syncTrustDomain(
 	out = proto.Clone(current).(*machineidv1.SPIFFEFederation)
 
 	// Refresh...
-	if out.Status == nil {
-		out.Status = &machineidv1.SPIFFEFederationStatus{}
+	if !out.HasStatus() {
+		out.SetStatus(&machineidv1.SPIFFEFederationStatus{})
 	}
 
 	var bundle *spiffebundle.Bundle
 	var nextSyncIn time.Duration
 	switch {
 	case current.GetSpec().GetBundleSource().GetHttpsWeb() != nil:
-		url := current.Spec.BundleSource.HttpsWeb.BundleEndpointUrl
+		url := current.GetSpec().GetBundleSource().GetHttpsWeb().GetBundleEndpointUrl()
 		log.DebugContext(
 			ctx,
 			"Fetching bundle using https_web profile",
@@ -602,7 +602,7 @@ func (s *SPIFFEFederationSyncer) syncTrustDomain(
 			ctx, "Fetching bundle using spec.bundle_source.static.bundle",
 		)
 		bundle, err = spiffebundle.Parse(
-			td, []byte(current.Spec.BundleSource.Static.Bundle),
+			td, []byte(current.GetSpec().GetBundleSource().GetStatic().GetBundle()),
 		)
 		if err != nil {
 			return nil, trace.Wrap(
@@ -619,14 +619,14 @@ func (s *SPIFFEFederationSyncer) syncTrustDomain(
 	if err != nil {
 		return nil, trace.Wrap(err, "marshaling bundle")
 	}
-	out.Status.CurrentBundle = string(bundleBytes)
-	out.Status.CurrentBundleSyncedFrom = current.Spec.BundleSource
+	out.GetStatus().SetCurrentBundle(string(bundleBytes))
+	out.GetStatus().SetCurrentBundleSyncedFrom(current.GetSpec().GetBundleSource())
 
 	syncedAt := s.cfg.Clock.Now().UTC()
-	out.Status.CurrentBundleSyncedAt = timestamppb.New(syncedAt)
+	out.GetStatus().SetCurrentBundleSyncedAt(timestamppb.New(syncedAt))
 	// For certain sources, we need to set a next sync time.
 	if nextSyncIn > 0 {
-		out.Status.NextSyncAt = timestamppb.New(syncedAt.Add(nextSyncIn))
+		out.GetStatus().SetNextSyncAt(timestamppb.New(syncedAt.Add(nextSyncIn)))
 	}
 
 	out, err = s.cfg.Store.UpdateSPIFFEFederation(ctx, out)
@@ -638,7 +638,7 @@ func (s *SPIFFEFederationSyncer) syncTrustDomain(
 	log.InfoContext(
 		ctx,
 		"Sync succeeded, new SPIFFEFederation persisted",
-		"new_revision", out.Metadata.Revision,
+		"new_revision", out.GetMetadata().GetRevision(),
 	)
 
 	return out, nil
diff --git a/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go b/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go
index 9d3cb138238..66744d8dcb4 100644
--- a/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go
+++ b/lib/auth/machineid/machineidv1/spiffe_federation_syncer_test.go
@@ -104,20 +104,20 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 	caPool.AddCert(testSrv2.Certificate())
 
 	// Create one trust domain prior to startng the syncer
-	created1, err := store.CreateSPIFFEFederation(ctx, &machineidv1pb.SPIFFEFederation{
+	created1, err := store.CreateSPIFFEFederation(ctx, machineidv1pb.SPIFFEFederation_builder{
 		Kind:    types.KindSPIFFEFederation,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "1.example.com",
-		},
-		Spec: &machineidv1pb.SPIFFEFederationSpec{
-			BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-				HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+		}.Build(),
+		Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+			BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+				HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 					BundleEndpointUrl: testSrv1.URL,
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	syncer, err := NewSPIFFEFederationSyncer(SPIFFEFederationSyncerConfig{
@@ -141,41 +141,41 @@ func TestSPIFFEFederationSyncer(t *testing.T) {
 
 	// Wait for the initially created SPIFFEFederation to be synced
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		got, err := store.GetSPIFFEFederation(ctx, created1.Metadata.Name)
+		got, err := store.GetSPIFFEFederation(ctx, created1.GetMetadata().GetName())
 		require.NoError(t, err)
 		// Check that some update as occurred (as indicated by the revision)
-		require.NotEqual(t, got.Metadata.Revision, created1.Metadata.Revision)
+		require.NotEqual(t, got.GetMetadata().GetRevision(), created1.GetMetadata().GetRevision())
 
 		// Check that the expected status fields have been set...
-		require.NotNil(t, got.Status)
-		require.Equal(t, string(marshaledBundle1), got.Status.CurrentBundle)
+		require.NotNil(t, got.GetStatus())
+		require.Equal(t, string(marshaledBundle1), got.GetStatus().GetCurrentBundle())
 	}, time.Second*10, time.Millisecond*200)
 
 	// Create a second SPIFFEFederation and wait for it to be synced
-	created2, err := store.CreateSPIFFEFederation(ctx, &machineidv1pb.SPIFFEFederation{
+	created2, err := store.CreateSPIFFEFederation(ctx, machineidv1pb.SPIFFEFederation_builder{
 		Kind:    types.KindSPIFFEFederation,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "2.example.com",
-		},
-		Spec: &machineidv1pb.SPIFFEFederationSpec{
-			BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-				HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+		}.Build(),
+		Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+			BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+				HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 					BundleEndpointUrl: testSrv2.URL,
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		got, err := store.GetSPIFFEFederation(ctx, created2.Metadata.Name)
+		got, err := store.GetSPIFFEFederation(ctx, created2.GetMetadata().GetName())
 		require.NoError(t, err)
 		// Check that some update as occurred (as indicated by the revision)
-		require.NotEqual(t, got.Metadata.Revision, created2.Metadata.Revision)
+		require.NotEqual(t, got.GetMetadata().GetRevision(), created2.GetMetadata().GetRevision())
 
 		// Check that the expected status fields have been set...
-		require.NotNil(t, got.Status)
-		require.Equal(t, string(marshaledBundle2), got.Status.CurrentBundle)
+		require.NotNil(t, got.GetStatus())
+		require.Equal(t, string(marshaledBundle2), got.GetStatus().GetCurrentBundle())
 	}, time.Second*10, time.Millisecond*200)
 
 	cancel()
@@ -231,20 +231,20 @@ func TestSPIFFEFederationSyncer_syncFederation(t *testing.T) {
 	require.NoError(t, err)
 
 	t.Run("https-web", func(t *testing.T) {
-		in := &machineidv1pb.SPIFFEFederation{
+		in := machineidv1pb.SPIFFEFederation_builder{
 			Kind:    types.KindSPIFFEFederation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "example.com",
-			},
-			Spec: &machineidv1pb.SPIFFEFederationSpec{
-				BundleSource: &machineidv1pb.SPIFFEFederationBundleSource{
-					HttpsWeb: &machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb{
+			}.Build(),
+			Spec: machineidv1pb.SPIFFEFederationSpec_builder{
+				BundleSource: machineidv1pb.SPIFFEFederationBundleSource_builder{
+					HttpsWeb: machineidv1pb.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 						BundleEndpointUrl: testSrv.URL,
-					},
-				},
-			},
-		}
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build()
 		created, err := store.CreateSPIFFEFederation(ctx, in)
 		require.NoError(t, err)
 
@@ -255,16 +255,16 @@ func TestSPIFFEFederationSyncer_syncFederation(t *testing.T) {
 		// Require that the persisted resource equals the resource output by syncTrustDomain
 		require.Empty(t, cmp.Diff(got, firstSync, protocmp.Transform()))
 		// Check that some update as occurred (as indicated by the revision)
-		require.NotEqual(t, created.Metadata.Revision, firstSync.Metadata.Revision)
+		require.NotEqual(t, created.GetMetadata().GetRevision(), firstSync.GetMetadata().GetRevision())
 		// Check that the expected status fields have been set...
-		require.NotNil(t, firstSync.Status)
-		wantStatus := &machineidv1pb.SPIFFEFederationStatus{
+		require.NotNil(t, firstSync.GetStatus())
+		wantStatus := machineidv1pb.SPIFFEFederationStatus_builder{
 			CurrentBundleSyncedAt:   timestamppb.New(clock.Now().UTC()),
-			CurrentBundleSyncedFrom: proto.Clone(created).(*machineidv1pb.SPIFFEFederation).Spec.BundleSource,
+			CurrentBundleSyncedFrom: proto.Clone(created).(*machineidv1pb.SPIFFEFederation).GetSpec().GetBundleSource(),
 			NextSyncAt:              timestamppb.New(clock.Now().UTC().Add(time.Minute * 12)),
 			CurrentBundle:           string(marshaledBundle),
-		}
-		require.Empty(t, cmp.Diff(firstSync.Status, wantStatus, protocmp.Transform()))
+		}.Build()
+		require.Empty(t, cmp.Diff(firstSync.GetStatus(), wantStatus, protocmp.Transform()))
 
 		// Check that syncing again does nothing.
 		secondSync, err := syncer.syncTrustDomain(ctx, "example.com")
@@ -275,14 +275,14 @@ func TestSPIFFEFederationSyncer_syncFederation(t *testing.T) {
 		clock.Advance(time.Minute * 15)
 		thirdSync, err := syncer.syncTrustDomain(ctx, "example.com")
 		require.NoError(t, err)
-		require.NotEqual(t, firstSync.Metadata.Revision, thirdSync.Metadata.Revision)
-		wantStatus = &machineidv1pb.SPIFFEFederationStatus{
+		require.NotEqual(t, firstSync.GetMetadata().GetRevision(), thirdSync.GetMetadata().GetRevision())
+		wantStatus = machineidv1pb.SPIFFEFederationStatus_builder{
 			CurrentBundleSyncedAt:   timestamppb.New(clock.Now().UTC()),
-			CurrentBundleSyncedFrom: proto.Clone(created).(*machineidv1pb.SPIFFEFederation).Spec.BundleSource,
+			CurrentBundleSyncedFrom: proto.Clone(created).(*machineidv1pb.SPIFFEFederation).GetSpec().GetBundleSource(),
 			NextSyncAt:              timestamppb.New(clock.Now().UTC().Add(time.Minute * 12)),
 			CurrentBundle:           string(marshaledBundle),
-		}
-		require.Empty(t, cmp.Diff(thirdSync.Status, wantStatus, protocmp.Transform()))
+		}.Build()
+		require.Empty(t, cmp.Diff(thirdSync.GetStatus(), wantStatus, protocmp.Transform()))
 
 		// Check that syncing again does nothing.
 		fourthSync, err := syncer.syncTrustDomain(ctx, "example.com")
@@ -290,18 +290,18 @@ func TestSPIFFEFederationSyncer_syncFederation(t *testing.T) {
 		require.Empty(t, cmp.Diff(fourthSync, thirdSync, protocmp.Transform()))
 
 		// Check that modifying the bundle source triggers a sync.
-		fourthSync.Spec.BundleSource.HttpsWeb.BundleEndpointUrl = fmt.Sprintf("%s/modified", testSrv.URL)
+		fourthSync.GetSpec().GetBundleSource().GetHttpsWeb().SetBundleEndpointUrl(fmt.Sprintf("%s/modified", testSrv.URL))
 		updated, err := store.UpdateSPIFFEFederation(ctx, fourthSync)
 		require.NoError(t, err)
 		fifthSync, err := syncer.syncTrustDomain(ctx, "example.com")
 		require.NoError(t, err)
-		require.NotEqual(t, updated.Metadata.Revision, fifthSync.Metadata.Revision)
-		wantStatus = &machineidv1pb.SPIFFEFederationStatus{
+		require.NotEqual(t, updated.GetMetadata().GetRevision(), fifthSync.GetMetadata().GetRevision())
+		wantStatus = machineidv1pb.SPIFFEFederationStatus_builder{
 			CurrentBundleSyncedAt:   timestamppb.New(clock.Now().UTC()),
-			CurrentBundleSyncedFrom: proto.Clone(updated).(*machineidv1pb.SPIFFEFederation).Spec.BundleSource,
+			CurrentBundleSyncedFrom: proto.Clone(updated).(*machineidv1pb.SPIFFEFederation).GetSpec().GetBundleSource(),
 			NextSyncAt:              timestamppb.New(clock.Now().UTC().Add(time.Minute * 12)),
 			CurrentBundle:           string(marshaledBundle),
-		}
-		require.Empty(t, cmp.Diff(fifthSync.Status, wantStatus, protocmp.Transform()))
+		}.Build()
+		require.Empty(t, cmp.Diff(fifthSync.GetStatus(), wantStatus, protocmp.Transform()))
 	})
 }
diff --git a/lib/auth/machineid/machineidv1/workload_identity_service.go b/lib/auth/machineid/machineidv1/workload_identity_service.go
index a761f7553c3..65694839420 100644
--- a/lib/auth/machineid/machineidv1/workload_identity_service.go
+++ b/lib/auth/machineid/machineidv1/workload_identity_service.go
@@ -242,10 +242,10 @@ func (wis *WorkloadIdentityService) signX509SVID(
 			},
 			UserMetadata:       authz.ClientUserMetadata(ctx),
 			ConnectionMetadata: authz.ConnectionMetadata(ctx),
-			Hint:               req.Hint,
+			Hint:               req.GetHint(),
 			SVIDType:           "x509",
-			DNSSANs:            req.DnsSans,
-			IPSANs:             req.IpSans,
+			DNSSANs:            req.GetDnsSans(),
+			IPSANs:             req.GetIpSans(),
 		}
 		if err != nil {
 			evt.Code = events.SPIFFESVIDIssuedFailureCode
@@ -265,25 +265,25 @@ func (wis *WorkloadIdentityService) signX509SVID(
 
 	// Parse and validate parameters
 	switch {
-	case req.SpiffeIdPath == "":
+	case req.GetSpiffeIdPath() == "":
 		return nil, trace.BadParameter("spiffeIdPath: must be non-empty")
-	case !strings.HasPrefix(req.SpiffeIdPath, "/"):
+	case !strings.HasPrefix(req.GetSpiffeIdPath(), "/"):
 		return nil, trace.BadParameter("spiffeIdPath: must start with '/'")
-	case len(req.PublicKey) == 0:
+	case len(req.GetPublicKey()) == 0:
 		return nil, trace.BadParameter("publicKey: must be non-empty")
 	}
 
 	spiffeID, err = spiffeid.FromURI(&url.URL{
 		Scheme: spiffeScheme,
 		Host:   clusterName,
-		Path:   req.SpiffeIdPath,
+		Path:   req.GetSpiffeIdPath(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err, "creating SPIFFE ID")
 	}
 
 	ipSans := []net.IP{}
-	for i, stringIP := range req.IpSans {
+	for i, stringIP := range req.GetIpSans() {
 		ip := net.ParseIP(stringIP)
 		if ip == nil {
 			return nil, trace.BadParameter(
@@ -296,7 +296,7 @@ func (wis *WorkloadIdentityService) signX509SVID(
 	// Default TTL is 1 hour - maximum is 24 hours. If TTL is greater than max,
 	// we will use the max.
 	ttl := defaultX509SVIDTTL
-	if reqTTL := req.Ttl.AsDuration(); reqTTL > 0 {
+	if reqTTL := req.GetTtl().AsDuration(); reqTTL > 0 {
 		ttl = reqTTL
 	}
 	if ttl > maxSVIDTTL {
@@ -310,8 +310,8 @@ func (wis *WorkloadIdentityService) signX509SVID(
 	// Perform authz checks. They must be allowed to issue the SPIFFE ID and
 	// any listed SANs.
 	if err := authCtx.Checker.CheckSPIFFESVID(
-		req.SpiffeIdPath,
-		req.DnsSans,
+		req.GetSpiffeIdPath(),
+		req.GetDnsSans(),
 		ipSans,
 	); err != nil {
 		return nil, trace.Wrap(err)
@@ -319,21 +319,21 @@ func (wis *WorkloadIdentityService) signX509SVID(
 
 	var pemBytes []byte
 	pemBytes, serialNumber, err = signx509SVID(
-		notBefore, notAfter, ca, req.PublicKey, spiffeID.URL(), req.DnsSans, ipSans,
+		notBefore, notAfter, ca, req.GetPublicKey(), spiffeID.URL(), req.GetDnsSans(), ipSans,
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &pb.SVIDResponse{
+	return pb.SVIDResponse_builder{
 		SpiffeId:    spiffeID.String(),
-		Hint:        req.Hint,
+		Hint:        req.GetHint(),
 		Certificate: pemBytes,
-	}, nil
+	}.Build(), nil
 }
 
 func (wis *WorkloadIdentityService) SignX509SVIDs(ctx context.Context, req *pb.SignX509SVIDsRequest) (*pb.SignX509SVIDsResponse, error) {
-	if len(req.Svids) == 0 {
+	if len(req.GetSvids()) == 0 {
 		return nil, trace.BadParameter("svids: must be non-empty")
 	}
 
@@ -364,14 +364,14 @@ func (wis *WorkloadIdentityService) SignX509SVIDs(ctx context.Context, req *pb.S
 	}
 
 	res := &pb.SignX509SVIDsResponse{}
-	for i, svidReq := range req.Svids {
+	for i, svidReq := range req.GetSvids() {
 		svidRes, err := wis.signX509SVID(
 			ctx, authCtx, svidReq, clusterName.GetClusterName(), tlsCA,
 		)
 		if err != nil {
 			return nil, trace.Wrap(err, "signing svid %d", i)
 		}
-		res.Svids = append(res.Svids, svidRes)
+		res.SetSvids(append(res.GetSvids(), svidRes))
 	}
 
 	wis.logger.WarnContext(
@@ -400,9 +400,9 @@ func (wis *WorkloadIdentityService) signJWTSVID(
 			},
 			UserMetadata:       authz.ClientUserMetadata(ctx),
 			ConnectionMetadata: authz.ConnectionMetadata(ctx),
-			Hint:               req.Hint,
+			Hint:               req.GetHint(),
 			SVIDType:           "jwt",
-			Audiences:          req.Audiences,
+			Audiences:          req.GetAudiences(),
 		}
 		if err != nil {
 			evt.Code = events.SPIFFESVIDIssuedFailureCode
@@ -423,18 +423,18 @@ func (wis *WorkloadIdentityService) signJWTSVID(
 	}()
 
 	switch {
-	case req.SpiffeIdPath == "":
+	case req.GetSpiffeIdPath() == "":
 		return nil, trace.BadParameter("spiffe_id_path: must be non-empty")
-	case !strings.HasPrefix(req.SpiffeIdPath, "/"):
+	case !strings.HasPrefix(req.GetSpiffeIdPath(), "/"):
 		return nil, trace.BadParameter("spiffe_id_path: must start with '/'")
-	case len(req.Audiences) == 0:
+	case len(req.GetAudiences()) == 0:
 		return nil, trace.BadParameter("audiences: must be non-empty")
 	}
 
 	// Perform authz checks. They must be allowed to issue the SPIFFE ID. Since
 	// this is a JWT SVID, there are no SANs to check.
 	if err := authCtx.Checker.CheckSPIFFESVID(
-		req.SpiffeIdPath,
+		req.GetSpiffeIdPath(),
 		[]string{},
 		[]net.IP{},
 	); err != nil {
@@ -450,14 +450,14 @@ func (wis *WorkloadIdentityService) signJWTSVID(
 	spiffeID, err = spiffeid.FromURI(&url.URL{
 		Scheme: spiffeScheme,
 		Host:   clusterName,
-		Path:   req.SpiffeIdPath,
+		Path:   req.GetSpiffeIdPath(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err, "creating SPIFFE ID")
 	}
 
 	ttl := defaultJWTSVIDTTL
-	if reqTTL := req.Ttl.AsDuration(); reqTTL > 0 {
+	if reqTTL := req.GetTtl().AsDuration(); reqTTL > 0 {
 		ttl = reqTTL
 	}
 	if ttl > maxSVIDTTL {
@@ -465,7 +465,7 @@ func (wis *WorkloadIdentityService) signJWTSVID(
 	}
 
 	signed, err := key.SignJWTSVID(jwt.SignParamsJWTSVID{
-		Audiences: req.Audiences,
+		Audiences: req.GetAudiences(),
 		SPIFFEID:  spiffeID,
 		TTL:       ttl,
 		JTI:       jti,
@@ -475,20 +475,20 @@ func (wis *WorkloadIdentityService) signJWTSVID(
 		return nil, trace.Wrap(err, "signing jwt")
 	}
 
-	return &pb.JWTSVIDResponse{
-		Audiences: req.Audiences,
+	return pb.JWTSVIDResponse_builder{
+		Audiences: req.GetAudiences(),
 		Jwt:       signed,
 		SpiffeId:  spiffeID.String(),
 		Jti:       jti,
-		Hint:      req.Hint,
-	}, nil
+		Hint:      req.GetHint(),
+	}.Build(), nil
 }
 
 // SignJWTSVIDs signs and returns the requested JWT SVIDs.
 func (wis *WorkloadIdentityService) SignJWTSVIDs(
 	ctx context.Context, req *pb.SignJWTSVIDsRequest,
 ) (*pb.SignJWTSVIDsResponse, error) {
-	if len(req.Svids) == 0 {
+	if len(req.GetSvids()) == 0 {
 		return nil, trace.BadParameter("svids: must be non-empty")
 	}
 
@@ -528,14 +528,14 @@ func (wis *WorkloadIdentityService) SignJWTSVIDs(
 	}
 
 	res := &pb.SignJWTSVIDsResponse{}
-	for i, svidReq := range req.Svids {
+	for i, svidReq := range req.GetSvids() {
 		svidRes, err := wis.signJWTSVID(
 			ctx, authCtx, clusterName.GetClusterName(), issuer, jwtKey, svidReq,
 		)
 		if err != nil {
 			return nil, trace.Wrap(err, "signing svid %d", i)
 		}
-		res.Svids = append(res.Svids, svidRes)
+		res.SetSvids(append(res.GetSvids(), svidRes))
 	}
 
 	wis.logger.WarnContext(
diff --git a/lib/auth/machineid/machineidv1/workload_identity_service_test.go b/lib/auth/machineid/machineidv1/workload_identity_service_test.go
index 0563b08281a..e6bd8707f1a 100644
--- a/lib/auth/machineid/machineidv1/workload_identity_service_test.go
+++ b/lib/auth/machineid/machineidv1/workload_identity_service_test.go
@@ -108,9 +108,9 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 		{
 			name: "success",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.SignX509SVIDsRequest{
+			req: machineidv1pb.SignX509SVIDsRequest_builder{
 				Svids: []*machineidv1pb.SVIDRequest{
-					{
+					machineidv1pb.SVIDRequest_builder{
 						SpiffeIdPath: "/alpha/foo",
 						PublicKey:    pubBytes,
 						Hint:         "llamas",
@@ -120,19 +120,19 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 							"bar.alpha.example.com",
 						},
 						IpSans: []string{"10.42.42.42"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			requireError: require.NoError,
 			assertResponse: func(t *testing.T, resp *machineidv1pb.SignX509SVIDsResponse) {
 				wantSPIFFEID := "spiffe://localhost/alpha/foo"
 
 				// Parse response
-				require.Len(t, resp.Svids, 1)
-				svid := resp.Svids[0]
-				require.Equal(t, "llamas", svid.Hint)
-				require.Equal(t, wantSPIFFEID, svid.SpiffeId)
-				cert, err := x509.ParseCertificate(svid.Certificate)
+				require.Len(t, resp.GetSvids(), 1)
+				svid := resp.GetSvids()[0]
+				require.Equal(t, "llamas", svid.GetHint())
+				require.Equal(t, wantSPIFFEID, svid.GetSpiffeId())
+				cert, err := x509.ParseCertificate(svid.GetCertificate())
 				require.NoError(t, err)
 
 				// Check TTL
@@ -174,20 +174,20 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 		{
 			name: "forbidden svid",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.SignX509SVIDsRequest{
+			req: machineidv1pb.SignX509SVIDsRequest_builder{
 				Svids: []*machineidv1pb.SVIDRequest{
 					// Include an ok SVID first to ensure we check perms for all
 					// SVIDs.
-					{
+					machineidv1pb.SVIDRequest_builder{
 						SpiffeIdPath: "/alpha/foo",
 						PublicKey:    pubBytes,
-					},
-					{
+					}.Build(),
+					machineidv1pb.SVIDRequest_builder{
 						SpiffeIdPath: "/alpha/forbidden",
 						PublicKey:    pubBytes,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -204,14 +204,14 @@ func TestWorkloadIdentityService_SignX509SVIDs(t *testing.T) {
 		{
 			name: "no permissions",
 			user: unauthorizedUser.GetName(),
-			req: &machineidv1pb.SignX509SVIDsRequest{
+			req: machineidv1pb.SignX509SVIDsRequest_builder{
 				Svids: []*machineidv1pb.SVIDRequest{
-					{
+					machineidv1pb.SVIDRequest_builder{
 						SpiffeIdPath: "/alpha/foo",
 						PublicKey:    pubBytes,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -309,29 +309,29 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 		{
 			name: "success",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.SignJWTSVIDsRequest{
+			req: machineidv1pb.SignJWTSVIDsRequest_builder{
 				Svids: []*machineidv1pb.JWTSVIDRequest{
-					{
+					machineidv1pb.JWTSVIDRequest_builder{
 						SpiffeIdPath: "/alpha/foo",
 						Hint:         "llamas",
 						Ttl:          durationpb.New(30 * time.Minute),
 						Audiences:    []string{"example.com"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			requireError: require.NoError,
 			assertResponse: func(t *testing.T, resp *machineidv1pb.SignJWTSVIDsResponse) {
-				require.Len(t, resp.Svids, 1)
+				require.Len(t, resp.GetSvids(), 1)
 
-				svid := resp.Svids[0]
+				svid := resp.GetSvids()[0]
 				wantSPIFFEID := "spiffe://localhost/alpha/foo"
-				require.Equal(t, wantSPIFFEID, svid.SpiffeId)
-				require.Equal(t, "llamas", svid.Hint)
-				require.Equal(t, []string{"example.com"}, svid.Audiences)
-				require.NotEmpty(t, svid.Jti)
-				require.NotEmpty(t, svid.Jwt)
+				require.Equal(t, wantSPIFFEID, svid.GetSpiffeId())
+				require.Equal(t, "llamas", svid.GetHint())
+				require.Equal(t, []string{"example.com"}, svid.GetAudiences())
+				require.NotEmpty(t, svid.GetJti())
+				require.NotEmpty(t, svid.GetJwt())
 
-				parsed, err := jwt.ParseSigned(svid.Jwt)
+				parsed, err := jwt.ParseSigned(svid.GetJwt())
 				require.NoError(t, err)
 
 				claims := jwt.Claims{}
@@ -344,7 +344,7 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 
 				// Check claims
 				require.Equal(t, wantSPIFFEID, claims.Subject)
-				require.Equal(t, svid.Jti, claims.ID)
+				require.Equal(t, svid.GetJti(), claims.ID)
 				require.Equal(t, "example.com", claims.Audience[0])
 				require.Equal(t, wantIssuer, claims.Issuer)
 				require.WithinDuration(t, srv.Clock().Now().Add(30*time.Minute), claims.Expiry.Time(), 5*time.Second)
@@ -354,20 +354,20 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 		{
 			name: "forbidden svid",
 			user: authorizedUser.GetName(),
-			req: &machineidv1pb.SignJWTSVIDsRequest{
+			req: machineidv1pb.SignJWTSVIDsRequest_builder{
 				Svids: []*machineidv1pb.JWTSVIDRequest{
 					// Include an ok SVID first to ensure we check perms for all
 					// SVIDs.
-					{
+					machineidv1pb.JWTSVIDRequest_builder{
 						SpiffeIdPath: "/alpha/foo",
 						Audiences:    []string{"example.com"},
-					},
-					{
+					}.Build(),
+					machineidv1pb.JWTSVIDRequest_builder{
 						SpiffeIdPath: "/alpha/forbidden",
 						Audiences:    []string{"example.com"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -375,14 +375,14 @@ func TestWorkloadIdentityService_SignJWTSVIDs(t *testing.T) {
 		{
 			name: "no permissions",
 			user: unauthorizedUser.GetName(),
-			req: &machineidv1pb.SignJWTSVIDsRequest{
+			req: machineidv1pb.SignJWTSVIDsRequest_builder{
 				Svids: []*machineidv1pb.JWTSVIDRequest{
-					{
+					machineidv1pb.JWTSVIDRequest_builder{
 						SpiffeIdPath: "/alpha/foo",
 						Audiences:    []string{"example.com"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
diff --git a/lib/auth/machineid/workloadidentityv1/decision.go b/lib/auth/machineid/workloadidentityv1/decision.go
index 47545ff1b4c..dd00127c68d 100644
--- a/lib/auth/machineid/workloadidentityv1/decision.go
+++ b/lib/auth/machineid/workloadidentityv1/decision.go
@@ -75,14 +75,14 @@ func decide(
 		d.reason = trace.Wrap(err, "templating spec.spiffe.id")
 		return d
 	}
-	d.templatedWorkloadIdentity.Spec.Spiffe.Id = templated
+	d.templatedWorkloadIdentity.GetSpec().GetSpiffe().SetId(templated)
 
 	templated, err = expression.RenderTemplate(wi.GetSpec().GetSpiffe().GetHint(), &expression.Environment{Attrs: attrs})
 	if err != nil {
 		d.reason = trace.Wrap(err, "templating spec.spiffe.hint")
 		return d
 	}
-	d.templatedWorkloadIdentity.Spec.Spiffe.Hint = templated
+	d.templatedWorkloadIdentity.GetSpec().GetSpiffe().SetHint(templated)
 
 	for i, san := range wi.GetSpec().GetSpiffe().GetX509().GetDnsSans() {
 		templated, err = expression.RenderTemplate(san, &expression.Environment{Attrs: attrs})
@@ -98,14 +98,14 @@ func decide(
 			)
 			return d
 		}
-		d.templatedWorkloadIdentity.Spec.Spiffe.X509.DnsSans[i] = templated
+		d.templatedWorkloadIdentity.GetSpec().GetSpiffe().GetX509().GetDnsSans()[i] = templated
 	}
 
 	st := wi.GetSpec().GetSpiffe().GetX509().GetSubjectTemplate()
 	if st != nil {
-		dst := d.templatedWorkloadIdentity.Spec.Spiffe.X509.SubjectTemplate
+		dst := d.templatedWorkloadIdentity.GetSpec().GetSpiffe().GetX509().GetSubjectTemplate()
 
-		templated, err = expression.RenderTemplate(st.CommonName, &expression.Environment{Attrs: attrs})
+		templated, err = expression.RenderTemplate(st.GetCommonName(), &expression.Environment{Attrs: attrs})
 		if err != nil {
 			d.reason = trace.Wrap(
 				err,
@@ -113,9 +113,9 @@ func decide(
 			)
 			return d
 		}
-		dst.CommonName = templated
+		dst.SetCommonName(templated)
 
-		templated, err = expression.RenderTemplate(st.Organization, &expression.Environment{Attrs: attrs})
+		templated, err = expression.RenderTemplate(st.GetOrganization(), &expression.Environment{Attrs: attrs})
 		if err != nil {
 			d.reason = trace.Wrap(
 				err,
@@ -123,9 +123,9 @@ func decide(
 			)
 			return d
 		}
-		dst.Organization = templated
+		dst.SetOrganization(templated)
 
-		templated, err = expression.RenderTemplate(st.OrganizationalUnit, &expression.Environment{Attrs: attrs})
+		templated, err = expression.RenderTemplate(st.GetOrganizationalUnit(), &expression.Environment{Attrs: attrs})
 		if err != nil {
 			d.reason = trace.Wrap(
 				err,
@@ -133,7 +133,7 @@ func decide(
 			)
 			return d
 		}
-		dst.OrganizationalUnit = templated
+		dst.SetOrganizationalUnit(templated)
 	}
 
 	if ec := wi.GetSpec().GetSpiffe().GetJwt().GetExtraClaims(); ec != nil {
@@ -145,7 +145,7 @@ func decide(
 			)
 			return d
 		}
-		d.templatedWorkloadIdentity.Spec.Spiffe.Jwt.ExtraClaims = templated
+		d.templatedWorkloadIdentity.GetSpec().GetSpiffe().GetJwt().SetExtraClaims(templated)
 	}
 
 	// Yay - made it to the end!
@@ -251,29 +251,29 @@ ruleLoop:
 		}
 
 		for _, condition := range rule.GetConditions() {
-			val, err := getFieldStringValue(attrs, condition.Attribute)
+			val, err := getFieldStringValue(attrs, condition.GetAttribute())
 			if err != nil {
 				return trace.Wrap(err)
 			}
-			switch c := condition.Operator.(type) {
-			case *workloadidentityv1pb.WorkloadIdentityCondition_Eq:
-				if val != c.Eq.Value {
+			switch c := condition.WhichOperator(); c {
+			case workloadidentityv1pb.WorkloadIdentityCondition_Eq_case:
+				if val != condition.GetEq().GetValue() {
 					continue ruleLoop
 				}
-			case *workloadidentityv1pb.WorkloadIdentityCondition_NotEq:
-				if val == c.NotEq.Value {
+			case workloadidentityv1pb.WorkloadIdentityCondition_NotEq_case:
+				if val == condition.GetNotEq().GetValue() {
 					continue ruleLoop
 				}
-			case *workloadidentityv1pb.WorkloadIdentityCondition_In:
-				if !slices.Contains(c.In.Values, val) {
+			case workloadidentityv1pb.WorkloadIdentityCondition_In_case:
+				if !slices.Contains(condition.GetIn().GetValues(), val) {
 					continue ruleLoop
 				}
-			case *workloadidentityv1pb.WorkloadIdentityCondition_NotIn:
-				if slices.Contains(c.NotIn.Values, val) {
+			case workloadidentityv1pb.WorkloadIdentityCondition_NotIn_case:
+				if slices.Contains(condition.GetNotIn().GetValues(), val) {
 					continue ruleLoop
 				}
 			default:
-				return trace.BadParameter("unsupported operator %T", c)
+				return trace.BadParameter("unsupported operator %v", c)
 			}
 		}
 		return nil
diff --git a/lib/auth/machineid/workloadidentityv1/decision_test.go b/lib/auth/machineid/workloadidentityv1/decision_test.go
index a532eb35900..92415dc3e1c 100644
--- a/lib/auth/machineid/workloadidentityv1/decision_test.go
+++ b/lib/auth/machineid/workloadidentityv1/decision_test.go
@@ -34,17 +34,17 @@ import (
 )
 
 func Test_decide(t *testing.T) {
-	standardAttrs := &workloadidentityv1pb.Attrs{
-		User: &workloadidentityv1pb.UserAttrs{
+	standardAttrs := workloadidentityv1pb.Attrs_builder{
+		User: workloadidentityv1pb.UserAttrs_builder{
 			Name: "jeff",
-		},
-		Workload: &workloadidentityv1pb.WorkloadAttrs{
-			Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+		}.Build(),
+		Workload: workloadidentityv1pb.WorkloadAttrs_builder{
+			Kubernetes: workloadidentityv1pb.WorkloadAttrsKubernetes_builder{
 				PodName:   "pod1",
 				Namespace: "default",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 	tests := []struct {
 		name         string
 		wid          *workloadidentityv1pb.WorkloadIdentity
@@ -54,18 +54,18 @@ func Test_decide(t *testing.T) {
 	}{
 		{
 			name: "invalid dns name",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/valid",
-						X509: &workloadidentityv1pb.WorkloadIdentitySPIFFEX509{
+						X509: workloadidentityv1pb.WorkloadIdentitySPIFFEX509_builder{
 							DnsSans: []string{
 								"//imvalid;;",
 							},
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:     standardAttrs,
 			wantIssue: false,
 			assertReason: func(t require.TestingT, err error, i ...any) {
@@ -83,17 +83,17 @@ func Test_decide(t *testing.T) {
 }
 
 func Test_evaluateRules(t *testing.T) {
-	attrs := &workloadidentityv1pb.Attrs{
-		User: &workloadidentityv1pb.UserAttrs{
+	attrs := workloadidentityv1pb.Attrs_builder{
+		User: workloadidentityv1pb.UserAttrs_builder{
 			Name: "foo",
-		},
-		Workload: &workloadidentityv1pb.WorkloadAttrs{
-			Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+		}.Build(),
+		Workload: workloadidentityv1pb.WorkloadAttrs_builder{
+			Kubernetes: workloadidentityv1pb.WorkloadAttrsKubernetes_builder{
 				PodName:   "pod1",
 				Namespace: "default",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	var noMatchRule require.ErrorAssertionFunc = func(t require.TestingT, err error, i ...any) {
 		require.Error(t, err)
@@ -108,294 +108,278 @@ func Test_evaluateRules(t *testing.T) {
 	}{
 		{
 			name: "no rules: pass",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
 					Rules: &workloadidentityv1pb.WorkloadIdentityRules{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: require.NoError,
 		},
 		{
 			name: "eq: pass",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-											Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-												Value: "foo",
-											},
-										},
-									},
+										Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+											Value: "foo",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: require.NoError,
 		},
 		{
 			name: "eq: fail",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-											Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-												Value: "not-foo",
-											},
-										},
-									},
+										Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+											Value: "not-foo",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: noMatchRule,
 		},
 		{
 			name: "not_eq: pass",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_NotEq{
-											NotEq: &workloadidentityv1pb.WorkloadIdentityConditionNotEq{
-												Value: "bar",
-											},
-										},
-									},
+										NotEq: workloadidentityv1pb.WorkloadIdentityConditionNotEq_builder{
+											Value: "bar",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: require.NoError,
 		},
 		{
 			name: "not_eq: fail",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_NotEq{
-											NotEq: &workloadidentityv1pb.WorkloadIdentityConditionNotEq{
-												Value: "foo",
-											},
-										},
-									},
+										NotEq: workloadidentityv1pb.WorkloadIdentityConditionNotEq_builder{
+											Value: "foo",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: noMatchRule,
 		},
 		{
 			name: "in: pass",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_In{
-											In: &workloadidentityv1pb.WorkloadIdentityConditionIn{
-												Values: []string{"bar", "foo"},
-											},
-										},
-									},
+										In: workloadidentityv1pb.WorkloadIdentityConditionIn_builder{
+											Values: []string{"bar", "foo"},
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: require.NoError,
 		},
 		{
 			name: "in: fail",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_In{
-											In: &workloadidentityv1pb.WorkloadIdentityConditionIn{
-												Values: []string{"bar", "fizz"},
-											},
-										},
-									},
+										In: workloadidentityv1pb.WorkloadIdentityConditionIn_builder{
+											Values: []string{"bar", "fizz"},
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: noMatchRule,
 		},
 		{
 			name: "not_in: pass",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_NotIn{
-											NotIn: &workloadidentityv1pb.WorkloadIdentityConditionNotIn{
-												Values: []string{"bar", "fizz"},
-											},
-										},
-									},
+										NotIn: workloadidentityv1pb.WorkloadIdentityConditionNotIn_builder{
+											Values: []string{"bar", "fizz"},
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: require.NoError,
 		},
 		{
 			name: "in: fail",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "user.name",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_NotIn{
-											NotIn: &workloadidentityv1pb.WorkloadIdentityConditionNotIn{
-												Values: []string{"bar", "foo"},
-											},
-										},
-									},
+										NotIn: workloadidentityv1pb.WorkloadIdentityConditionNotIn_builder{
+											Values: []string{"bar", "foo"},
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: noMatchRule,
 		},
 		{
 			name: "expression: pass",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{Expression: `user.name == "foo"`},
+							workloadidentityv1pb.WorkloadIdentityRule_builder{Expression: `user.name == "foo"`}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: require.NoError,
 		},
 		{
 			name: "expression: fail",
-			wid: &workloadidentityv1pb.WorkloadIdentity{
+			wid: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{Expression: `user.name == "not-foo"`},
+							workloadidentityv1pb.WorkloadIdentityRule_builder{Expression: `user.name == "not-foo"`}.Build(),
 						},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			attrs:      attrs,
 			requireErr: noMatchRule,
 		},
@@ -410,16 +394,16 @@ func Test_evaluateRules(t *testing.T) {
 }
 
 func Test_decision_sigstore(t *testing.T) {
-	identity := &workloadidentityv1pb.WorkloadIdentity{
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+	identity := workloadidentityv1pb.WorkloadIdentity_builder{
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 				Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-					{Expression: `sigstore.policy_satisfied("foo") && sigstore.policy_satisfied("bar")`},
+					workloadidentityv1pb.WorkloadIdentityRule_builder{Expression: `sigstore.policy_satisfied("foo") && sigstore.policy_satisfied("bar")`}.Build(),
 				},
-			},
+			}.Build(),
 			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{},
-		},
-	}
+		}.Build(),
+	}.Build()
 	attrs := &workloadidentityv1pb.Attrs{}
 
 	t.Run("success", func(t *testing.T) {
@@ -530,19 +514,19 @@ func TestTemplateExtraClaims_Success(t *testing.T) {
 	err = json.Unmarshal([]byte(expectedOutputJSON), &expectedOutput)
 	require.NoError(t, err)
 
-	output, err := templateExtraClaims(input, &workloadidentityv1pb.Attrs{
-		User: &workloadidentityv1pb.UserAttrs{
+	output, err := templateExtraClaims(input, workloadidentityv1pb.Attrs_builder{
+		User: workloadidentityv1pb.UserAttrs_builder{
 			Name: "Bobby",
-		},
-		Workload: &workloadidentityv1pb.WorkloadAttrs{
-			Podman: &workloadidentityv1pb.WorkloadAttrsPodman{
-				Pod: &workloadidentityv1pb.WorkloadAttrsPodmanPod{
+		}.Build(),
+		Workload: workloadidentityv1pb.WorkloadAttrs_builder{
+			Podman: workloadidentityv1pb.WorkloadAttrsPodman_builder{
+				Pod: workloadidentityv1pb.WorkloadAttrsPodmanPod_builder{
 					Name:   "webserver",
 					Labels: map[string]string{"a": "a", "b": "b"},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(expectedOutput, output, protocmp.Transform()))
 }
diff --git a/lib/auth/machineid/workloadidentityv1/expression/evaluate_test.go b/lib/auth/machineid/workloadidentityv1/expression/evaluate_test.go
index 3331c39cd97..3d9b72707f9 100644
--- a/lib/auth/machineid/workloadidentityv1/expression/evaluate_test.go
+++ b/lib/auth/machineid/workloadidentityv1/expression/evaluate_test.go
@@ -35,16 +35,16 @@ func TestEvaluate(t *testing.T) {
 	result, err := expression.Evaluate(
 		`workload.podman.attested && workload.podman.container.image == "ubuntu"`,
 		&expression.Environment{
-			Attrs: &workloadidentityv1.Attrs{
-				Workload: &workloadidentityv1.WorkloadAttrs{
-					Podman: &workloadidentityv1.WorkloadAttrsPodman{
+			Attrs: workloadidentityv1.Attrs_builder{
+				Workload: workloadidentityv1.WorkloadAttrs_builder{
+					Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
 						Attested: true,
-						Container: &workloadidentityv1.WorkloadAttrsPodmanContainer{
+						Container: workloadidentityv1.WorkloadAttrsPodmanContainer_builder{
 							Image: "ubuntu",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 	)
 	require.NoError(t, err)
@@ -54,11 +54,11 @@ func TestEvaluate(t *testing.T) {
 	result, err = expression.Evaluate(
 		`user.name != user.name`,
 		&expression.Environment{
-			Attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			Attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Name: "Bobby",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	)
 	require.NoError(t, err)
@@ -68,11 +68,11 @@ func TestEvaluate(t *testing.T) {
 	result, err = expression.Evaluate(
 		`user.name == ""`,
 		&expression.Environment{
-			Attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			Attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Name: "",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	)
 	require.NoError(t, err)
@@ -87,26 +87,26 @@ func TestEvaluate_Errors(t *testing.T) {
 	}{
 		"unset sub-message": {
 			expr: `workload.podman.pod.labels["foo"] == "bar"`,
-			attrs: &workloadidentityv1.Attrs{
-				Workload: &workloadidentityv1.WorkloadAttrs{
-					Podman: &workloadidentityv1.WorkloadAttrsPodman{
+			attrs: workloadidentityv1.Attrs_builder{
+				Workload: workloadidentityv1.WorkloadAttrs_builder{
+					Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
 						Pod: nil,
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			err: "workload.podman.pod is unset",
 		},
 		"unset map key": {
 			expr: `workload.podman.pod.labels["foo"] == "bar"`,
-			attrs: &workloadidentityv1.Attrs{
-				Workload: &workloadidentityv1.WorkloadAttrs{
-					Podman: &workloadidentityv1.WorkloadAttrsPodman{
-						Pod: &workloadidentityv1.WorkloadAttrsPodmanPod{
+			attrs: workloadidentityv1.Attrs_builder{
+				Workload: workloadidentityv1.WorkloadAttrs_builder{
+					Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
+						Pod: workloadidentityv1.WorkloadAttrsPodmanPod_builder{
 							Labels: map[string]string{"bar": "baz"},
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			err: `no value for key: "foo"`,
 		},
 		"non-boolean expression": {
@@ -127,16 +127,16 @@ func TestEvaluate_Traits(t *testing.T) {
 	result, err := expression.Evaluate(
 		`user.traits.logins.contains("root")`,
 		&expression.Environment{
-			Attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			Attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Traits: []*traitv1.Trait{
-						{
+						traitv1.Trait_builder{
 							Key:    "logins",
 							Values: []string{"root", "alice", "bob"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	)
 	require.NoError(t, err)
@@ -146,11 +146,11 @@ func TestEvaluate_Traits(t *testing.T) {
 	result, err = expression.Evaluate(
 		`is_empty(user.traits.logins)`,
 		&expression.Environment{
-			Attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			Attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Traits: []*traitv1.Trait{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	)
 	require.NoError(t, err)
diff --git a/lib/auth/machineid/workloadidentityv1/expression/expression.go b/lib/auth/machineid/workloadidentityv1/expression/expression.go
index 89821e88059..1b088298ff7 100644
--- a/lib/auth/machineid/workloadidentityv1/expression/expression.go
+++ b/lib/auth/machineid/workloadidentityv1/expression/expression.go
@@ -53,7 +53,7 @@ var (
 		vars["user.traits"] = typical.DynamicMapFunction(func(env *Environment, key string) (expression.Set, error) {
 			traits := make(map[string][]string)
 			for _, v := range env.Attrs.GetUser().GetTraits() {
-				traits[v.GetKey()] = append(traits[v.GetKey()], v.Values...)
+				traits[v.GetKey()] = append(traits[v.GetKey()], v.GetValues()...)
 			}
 			return expression.NewSet(traits[key]...), nil
 		})
@@ -80,7 +80,7 @@ var (
 		vars["user.traits"] = typical.DynamicMapFunction(func(env *Environment, key string) (string, error) {
 			traits := make(map[string][]string)
 			for _, v := range env.Attrs.GetUser().GetTraits() {
-				traits[v.GetKey()] = append(traits[v.GetKey()], v.Values...)
+				traits[v.GetKey()] = append(traits[v.GetKey()], v.GetValues()...)
 			}
 
 			vals := traits[key]
diff --git a/lib/auth/machineid/workloadidentityv1/expression/template_test.go b/lib/auth/machineid/workloadidentityv1/expression/template_test.go
index 74063c8ca01..41663a2d0df 100644
--- a/lib/auth/machineid/workloadidentityv1/expression/template_test.go
+++ b/lib/auth/machineid/workloadidentityv1/expression/template_test.go
@@ -41,36 +41,36 @@ func TestTemplate_Success(t *testing.T) {
 		},
 		"simple interpolation": {
 			tmpl: "{{user.name}}",
-			attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Name: "Larry",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			output: "Larry",
 		},
 		"multiple interpolations": {
 			tmpl: "{{user.name}} {{user.bot_name}}",
-			attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Name:    "Larry",
 					BotName: "LarryBot",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			output: "Larry LarryBot",
 		},
 		"map access": {
 			tmpl: `/region/{{workload.podman.pod.labels["com.mycloud/region"]}}/service`,
-			attrs: &workloadidentityv1.Attrs{
-				Workload: &workloadidentityv1.WorkloadAttrs{
-					Podman: &workloadidentityv1.WorkloadAttrsPodman{
-						Pod: &workloadidentityv1.WorkloadAttrsPodmanPod{
+			attrs: workloadidentityv1.Attrs_builder{
+				Workload: workloadidentityv1.WorkloadAttrs_builder{
+					Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
+						Pod: workloadidentityv1.WorkloadAttrsPodmanPod_builder{
 							Labels: map[string]string{
 								"com.mycloud/region": "eu",
 							},
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			output: "/region/eu/service",
 		},
 		"function calling": {
@@ -100,38 +100,38 @@ func TestTemplate_Success(t *testing.T) {
 		},
 		"int interpolation": {
 			tmpl: `{{ workload.unix.pid }}`,
-			attrs: &workloadidentityv1.Attrs{
-				Workload: &workloadidentityv1.WorkloadAttrs{
-					Unix: &workloadidentityv1.WorkloadAttrsUnix{
+			attrs: workloadidentityv1.Attrs_builder{
+				Workload: workloadidentityv1.WorkloadAttrs_builder{
+					Unix: workloadidentityv1.WorkloadAttrsUnix_builder{
 						Pid: 1337,
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			output: "1337",
 		},
 		"uint interpolation": {
 			tmpl: `{{ workload.unix.uid }}`,
-			attrs: &workloadidentityv1.Attrs{
-				Workload: &workloadidentityv1.WorkloadAttrs{
-					Unix: &workloadidentityv1.WorkloadAttrsUnix{
+			attrs: workloadidentityv1.Attrs_builder{
+				Workload: workloadidentityv1.WorkloadAttrs_builder{
+					Unix: workloadidentityv1.WorkloadAttrsUnix_builder{
 						Uid: 1337,
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			output: "1337",
 		},
 		"user traits": {
 			tmpl: `{{user.traits.skill}}`,
-			attrs: &workloadidentityv1.Attrs{
-				User: &workloadidentityv1.UserAttrs{
+			attrs: workloadidentityv1.Attrs_builder{
+				User: workloadidentityv1.UserAttrs_builder{
 					Traits: []*traitv1.Trait{
-						{
+						traitv1.Trait_builder{
 							Key:    "skill",
 							Values: []string{"coffee-drinker"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			output: "coffee-drinker",
 		},
 	}
@@ -170,16 +170,16 @@ func TestTemplate_MultipleTraitValues(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = tmpl.Render(&expression.Environment{
-		Attrs: &workloadidentityv1.Attrs{
-			User: &workloadidentityv1.UserAttrs{
+		Attrs: workloadidentityv1.Attrs_builder{
+			User: workloadidentityv1.UserAttrs_builder{
 				Traits: []*traitv1.Trait{
-					{
+					traitv1.Trait_builder{
 						Key:    "skills",
 						Values: []string{"sword-fighting", "sonnet-writing"},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	})
 	require.ErrorContains(t, err, "multiple values")
 }
@@ -189,9 +189,9 @@ func TestTemplate_MissingSubmessage(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = tmpl.Render(&expression.Environment{
-		Attrs: &workloadidentityv1.Attrs{
+		Attrs: workloadidentityv1.Attrs_builder{
 			Workload: &workloadidentityv1.WorkloadAttrs{},
-		},
+		}.Build(),
 	})
 	require.ErrorContains(t, err, "workload.podman is unset")
 }
@@ -201,15 +201,15 @@ func TestTemplate_MissingMapValue(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = tmpl.Render(&expression.Environment{
-		Attrs: &workloadidentityv1.Attrs{
-			Workload: &workloadidentityv1.WorkloadAttrs{
-				Podman: &workloadidentityv1.WorkloadAttrsPodman{
-					Container: &workloadidentityv1.WorkloadAttrsPodmanContainer{
+		Attrs: workloadidentityv1.Attrs_builder{
+			Workload: workloadidentityv1.WorkloadAttrs_builder{
+				Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
+					Container: workloadidentityv1.WorkloadAttrsPodmanContainer_builder{
 						Labels: map[string]string{"bar": "baz"},
-					},
-				},
-			},
-		},
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	})
 	require.ErrorContains(t, err, `no value for key: "foo"`)
 }
@@ -219,16 +219,16 @@ func TestTemplate_MissingTrait(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = tmpl.Render(&expression.Environment{
-		Attrs: &workloadidentityv1.Attrs{
-			User: &workloadidentityv1.UserAttrs{
+		Attrs: workloadidentityv1.Attrs_builder{
+			User: workloadidentityv1.UserAttrs_builder{
 				Traits: []*traitv1.Trait{
-					{
+					traitv1.Trait_builder{
 						Key:    "bar",
 						Values: []string{"baz"},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	})
 	require.ErrorContains(t, err, `no value for trait: "foo"`)
 }
@@ -238,15 +238,15 @@ func TestTemplate_UnsetValue(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = tmpl.Render(&expression.Environment{
-		Attrs: &workloadidentityv1.Attrs{
-			Workload: &workloadidentityv1.WorkloadAttrs{
-				Podman: &workloadidentityv1.WorkloadAttrsPodman{
-					Container: &workloadidentityv1.WorkloadAttrsPodmanContainer{
+		Attrs: workloadidentityv1.Attrs_builder{
+			Workload: workloadidentityv1.WorkloadAttrs_builder{
+				Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
+					Container: workloadidentityv1.WorkloadAttrsPodmanContainer_builder{
 						Name: "",
-					},
-				},
-			},
-		},
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	})
 	require.ErrorContains(t, err, "workload.podman.container.name is unset")
 }
diff --git a/lib/auth/machineid/workloadidentityv1/issuer_service.go b/lib/auth/machineid/workloadidentityv1/issuer_service.go
index 08499ee6dbd..00581c3e850 100644
--- a/lib/auth/machineid/workloadidentityv1/issuer_service.go
+++ b/lib/auth/machineid/workloadidentityv1/issuer_service.go
@@ -170,22 +170,22 @@ func (s *IssuanceService) deriveAttrs(
 	authzCtx *authz.Context,
 	workloadAttrs *workloadidentityv1pb.WorkloadAttrs,
 ) (*workloadidentityv1pb.Attrs, error) {
-	attrs := &workloadidentityv1pb.Attrs{
+	attrs := workloadidentityv1pb.Attrs_builder{
 		Workload: workloadAttrs,
-		User: &workloadidentityv1pb.UserAttrs{
+		User: workloadidentityv1pb.UserAttrs_builder{
 			Name:    authzCtx.Identity.GetIdentity().Username,
 			IsBot:   authzCtx.Identity.GetIdentity().BotName != "",
 			BotName: authzCtx.Identity.GetIdentity().BotName,
 			Labels:  authzCtx.User.GetAllLabels(),
-		},
+		}.Build(),
 		Join: authzCtx.Identity.GetIdentity().JoinAttributes,
-	}
+	}.Build()
 
 	for key, values := range authzCtx.Identity.GetIdentity().Traits {
-		attrs.User.Traits = append(attrs.User.Traits, &traitv1.Trait{
+		attrs.GetUser().SetTraits(append(attrs.GetUser().GetTraits(), traitv1.Trait_builder{
 			Key:    key,
 			Values: values,
-		})
+		}.Build()))
 	}
 
 	return attrs, nil
@@ -242,9 +242,9 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 	}
 
 	var cred *workloadidentityv1pb.Credential
-	switch v := req.GetCredential().(type) {
-	case *workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams:
-		ca, chain, err := s.getX509CA(ctx, types.SPIFFECA, v.X509SvidParams.GetUseIssuerOverrides())
+	switch req.WhichCredential() {
+	case workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams_case:
+		ca, chain, err := s.getX509CA(ctx, types.SPIFFECA, req.GetX509SvidParams().GetUseIssuerOverrides())
 		if err != nil {
 			return nil, trace.Wrap(err, "fetching X509 SPIFFE CA")
 		}
@@ -254,8 +254,8 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 				ca:                    ca,
 				chain:                 chain,
 				workloadIdentity:      decision.templatedWorkloadIdentity,
-				x509Params:            v.X509SvidParams,
-				requestedTTL:          req.RequestedTtl.AsDuration(),
+				x509Params:            req.GetX509SvidParams(),
+				requestedTTL:          req.GetRequestedTtl().AsDuration(),
 				attrs:                 attrs,
 				sigstorePolicyResults: decision.sigstorePolicyResults,
 				nameSelector:          req.GetName(),
@@ -264,7 +264,7 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 		if err != nil {
 			return nil, trace.Wrap(err, "issuing X509 SVID")
 		}
-	case *workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams:
+	case workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams_case:
 		key, issuer, err := s.getJWTIssuerKey(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err, "getting JWT issuer key")
@@ -275,8 +275,8 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 				issuerKey:             key,
 				issuerURI:             issuer,
 				workloadIdentity:      decision.templatedWorkloadIdentity,
-				jwtParams:             v.JwtSvidParams,
-				requestedTTL:          req.RequestedTtl.AsDuration(),
+				jwtParams:             req.GetJwtSvidParams(),
+				requestedTTL:          req.GetRequestedTtl().AsDuration(),
 				attrs:                 attrs,
 				sigstorePolicyResults: decision.sigstorePolicyResults,
 				nameSelector:          req.GetName(),
@@ -286,12 +286,12 @@ func (s *IssuanceService) IssueWorkloadIdentity(
 			return nil, trace.Wrap(err, "issuing JWT SVID")
 		}
 	default:
-		return nil, trace.BadParameter("credential: unknown type %T", req.GetCredential())
+		return nil, trace.BadParameter("credential: unknown type %v", req.WhichCredential())
 	}
 
-	return &workloadidentityv1pb.IssueWorkloadIdentityResponse{
+	return workloadidentityv1pb.IssueWorkloadIdentityResponse_builder{
 		Credential: cred,
-	}, nil
+	}.Build(), nil
 }
 
 // maxWorkloadIdentitiesIssued is the maximum number of workload identities that
@@ -305,7 +305,7 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 	req *workloadidentityv1pb.IssueWorkloadIdentitiesRequest,
 ) (*workloadidentityv1pb.IssueWorkloadIdentitiesResponse, error) {
 	switch {
-	case len(req.LabelSelectors) == 0:
+	case len(req.GetLabelSelectors()) == 0:
 		return nil, trace.BadParameter("label_selectors: at least one label selector must be specified")
 	case req.GetCredential() == nil:
 		return nil, trace.BadParameter("at least one credential type must be requested")
@@ -328,7 +328,7 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 	workloadIdentities, err := s.matchingAndAuthorizedWorkloadIdentities(
 		ctx,
 		authCtx,
-		convertLabels(req.LabelSelectors),
+		convertLabels(req.GetLabelSelectors()),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -352,9 +352,9 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 	}
 
 	creds := make([]*workloadidentityv1pb.Credential, 0, len(shouldIssue))
-	switch v := req.GetCredential().(type) {
-	case *workloadidentityv1pb.IssueWorkloadIdentitiesRequest_X509SvidParams:
-		ca, chain, err := s.getX509CA(ctx, types.SPIFFECA, v.X509SvidParams.GetUseIssuerOverrides())
+	switch req.WhichCredential() {
+	case workloadidentityv1pb.IssueWorkloadIdentitiesRequest_X509SvidParams_case:
+		ca, chain, err := s.getX509CA(ctx, types.SPIFFECA, req.GetX509SvidParams().GetUseIssuerOverrides())
 		if err != nil {
 			return nil, trace.Wrap(err, "fetching CA to sign X509 SVID")
 		}
@@ -365,10 +365,10 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 					ca:               ca,
 					chain:            chain,
 					workloadIdentity: wi,
-					x509Params:       v.X509SvidParams,
-					requestedTTL:     req.RequestedTtl.AsDuration(),
+					x509Params:       req.GetX509SvidParams(),
+					requestedTTL:     req.GetRequestedTtl().AsDuration(),
 					attrs:            attrs,
-					labelSelectors:   req.LabelSelectors,
+					labelSelectors:   req.GetLabelSelectors(),
 				},
 			)
 			if err != nil {
@@ -380,7 +380,7 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 			}
 			creds = append(creds, cred)
 		}
-	case *workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams:
+	case workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams_case:
 		key, issuer, err := s.getJWTIssuerKey(ctx)
 		if err != nil {
 			return nil, trace.Wrap(err, "getting JWT issuer key")
@@ -392,10 +392,10 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 					issuerKey:        key,
 					issuerURI:        issuer,
 					workloadIdentity: wi,
-					jwtParams:        v.JwtSvidParams,
-					requestedTTL:     req.RequestedTtl.AsDuration(),
+					jwtParams:        req.GetJwtSvidParams(),
+					requestedTTL:     req.GetRequestedTtl().AsDuration(),
 					attrs:            attrs,
-					labelSelectors:   req.LabelSelectors,
+					labelSelectors:   req.GetLabelSelectors(),
 				},
 			)
 			if err != nil {
@@ -408,12 +408,12 @@ func (s *IssuanceService) IssueWorkloadIdentities(
 			creds = append(creds, cred)
 		}
 	default:
-		return nil, trace.BadParameter("credential: unknown type %T", req.GetCredential())
+		return nil, trace.BadParameter("credential: unknown type %v", req.WhichCredential())
 	}
 
-	return &workloadidentityv1pb.IssueWorkloadIdentitiesResponse{
+	return workloadidentityv1pb.IssueWorkloadIdentitiesResponse_builder{
 		Credentials: creds,
-	}, nil
+	}.Build(), nil
 }
 
 // IssueTeleportWorkloadIdentity issues a workload identity credential for the
@@ -442,14 +442,14 @@ func (s *IssuanceService) IssueTeleportWorkloadIdentity(
 		return nil, trace.AccessDenied("only Teleport services can execute this request")
 	}
 
-	switch usage := req.Usage.(type) {
-	case *workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess:
+	switch req.WhichUsage() {
+	case workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess_case:
 		if !authz.HasBuiltinRole(*authCtx, string(types.RoleApp)) {
 			return nil, trace.AccessDenied("only app services can issue workload identity for app access")
 		}
 		switch credParams := req.Credential.(type) {
 		case *workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams:
-			return s.issueAppAccessX509Identity(ctx, builtin.GetServerID(), req, usage.AppAccess, credParams)
+			return s.issueAppAccessX509Identity(ctx, builtin.GetServerID(), req, req.GetAppAccess(), credParams)
 		default:
 			return nil, trace.BadParameter("app access usage only supports issuing x509 credentials")
 		}
@@ -482,7 +482,7 @@ func (s *IssuanceService) issueAppAccessX509Identity(
 		return nil, trace.Wrap(err, "unable to locate app")
 	}
 
-	pubKey, err := x509.ParsePKIXPublicKey(credParams.X509SvidParams.PublicKey)
+	pubKey, err := x509.ParsePKIXPublicKey(credParams.X509SvidParams.GetPublicKey())
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing public key")
 	}
@@ -497,7 +497,7 @@ func (s *IssuanceService) issueAppAccessX509Identity(
 		ctx,
 		s.logger,
 		s.clock,
-		req.RequestedTtl.AsDuration(),
+		req.GetRequestedTtl().AsDuration(),
 		// Cap the cert TTL at the session expiry, plus an alloweance for clock
 		// drift that mirrors [veirfyCertValidityWithSkew]. Without the
 		// allowance session that are within the skew window would yield app
@@ -534,9 +534,9 @@ func (s *IssuanceService) issueAppAccessX509Identity(
 			notAfter,
 			spiffeID,
 			nil, /* dnsSANs */
-			&workloadidentityv1pb.X509DistinguishedNameTemplate{
+			workloadidentityv1pb.X509DistinguishedNameTemplate_builder{
 				CommonName: userIdentity.Username,
-			},
+			}.Build(),
 		),
 		ca.Cert,
 		pubKey,
@@ -546,22 +546,20 @@ func (s *IssuanceService) issueAppAccessX509Identity(
 		return nil, trace.Wrap(err)
 	}
 
-	return &workloadidentityv1pb.IssueTeleportWorkloadIdentityResponse{
-		Credential: &workloadidentityv1pb.Credential{
+	return workloadidentityv1pb.IssueTeleportWorkloadIdentityResponse_builder{
+		Credential: workloadidentityv1pb.Credential_builder{
 			SpiffeId: spiffeID.String(),
 
 			ExpiresAt: timestamppb.New(notAfter),
 			Ttl:       durationpb.New(ttl),
 
-			Credential: &workloadidentityv1pb.Credential_X509Svid{
-				X509Svid: &workloadidentityv1pb.X509SVIDCredential{
-					Cert:         certBytes,
-					SerialNumber: serialString(certSerial),
-					Chain:        chain,
-				},
-			},
-		},
-	}, nil
+			X509Svid: workloadidentityv1pb.X509SVIDCredential_builder{
+				Cert:         certBytes,
+				SerialNumber: serialString(certSerial),
+				Chain:        chain,
+			}.Build(),
+		}.Build(),
+	}.Build(), nil
 }
 
 // routeToAppFromCert validates the certificate and extracts the RouteToApp info.
@@ -734,14 +732,14 @@ func x509Template(
 		DNSNames: dnsSANs,
 	}
 	if subjectTemplate != nil {
-		c.Subject.CommonName = subjectTemplate.CommonName
-		if subjectTemplate.Organization != "" {
+		c.Subject.CommonName = subjectTemplate.GetCommonName()
+		if subjectTemplate.GetOrganization() != "" {
 			c.Subject.Organization = []string{
-				subjectTemplate.Organization,
+				subjectTemplate.GetOrganization(),
 			}
 		}
-		if subjectTemplate.OrganizationalUnit != "" {
-			c.Subject.OrganizationalUnit = []string{subjectTemplate.OrganizationalUnit}
+		if subjectTemplate.GetOrganizationalUnit() != "" {
+			c.Subject.OrganizationalUnit = []string{subjectTemplate.GetOrganizationalUnit()}
 		}
 	}
 
@@ -868,8 +866,8 @@ func labelSelectorsToAudit(
 	out := make([]*apievents.LabelSelector, 0, len(in))
 	for _, ls := range in {
 		out = append(out, &apievents.LabelSelector{
-			Key:    ls.Key,
-			Values: ls.Values,
+			Key:    ls.GetKey(),
+			Values: ls.GetValues(),
 		})
 	}
 	return out
@@ -919,7 +917,7 @@ func (s *IssuanceService) issueX509SVID(ctx context.Context, params issueX509SVI
 	switch {
 	case params.x509Params == nil:
 		return nil, trace.BadParameter("x509_svid_params: is required")
-	case len(params.x509Params.PublicKey) == 0:
+	case len(params.x509Params.GetPublicKey()) == 0:
 		return nil, trace.BadParameter("x509_svid_params.public_key: is required")
 	}
 
@@ -939,7 +937,7 @@ func (s *IssuanceService) issueX509SVID(ctx context.Context, params issueX509SVI
 		params.workloadIdentity.GetSpec().GetSpiffe().GetX509().GetMaximumTtl().AsDuration(),
 	)
 
-	pubKey, err := x509.ParsePKIXPublicKey(params.x509Params.PublicKey)
+	pubKey, err := x509.ParsePKIXPublicKey(params.x509Params.GetPublicKey())
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing public key")
 	}
@@ -992,7 +990,7 @@ func (s *IssuanceService) issueX509SVID(ctx context.Context, params issueX509SVI
 		)
 	}
 
-	return &workloadidentityv1pb.Credential{
+	return workloadidentityv1pb.Credential_builder{
 		WorkloadIdentityName:     params.workloadIdentity.GetMetadata().GetName(),
 		WorkloadIdentityRevision: params.workloadIdentity.GetMetadata().GetRevision(),
 
@@ -1002,14 +1000,12 @@ func (s *IssuanceService) issueX509SVID(ctx context.Context, params issueX509SVI
 		ExpiresAt: timestamppb.New(notAfter),
 		Ttl:       durationpb.New(ttl),
 
-		Credential: &workloadidentityv1pb.Credential_X509Svid{
-			X509Svid: &workloadidentityv1pb.X509SVIDCredential{
-				Cert:         certBytes,
-				SerialNumber: serialString,
-				Chain:        params.chain,
-			},
-		},
-	}, nil
+		X509Svid: workloadidentityv1pb.X509SVIDCredential_builder{
+			Cert:         certBytes,
+			SerialNumber: serialString,
+			Chain:        params.chain,
+		}.Build(),
+	}.Build(), nil
 }
 
 const jtiLength = 16
@@ -1069,7 +1065,7 @@ func (s *IssuanceService) issueJWTSVID(ctx context.Context, params issueJWTSVIDP
 	switch {
 	case params.jwtParams == nil:
 		return nil, trace.BadParameter("jwt_svid_params: is required")
-	case len(params.jwtParams.Audiences) == 0:
+	case len(params.jwtParams.GetAudiences()) == 0:
 		return nil, trace.BadParameter("jwt_svid_params.audiences: at least one audience should be specified")
 	}
 
@@ -1095,7 +1091,7 @@ func (s *IssuanceService) issueJWTSVID(ctx context.Context, params issueJWTSVIDP
 	}
 
 	signed, err := params.issuerKey.SignJWTSVID(jwt.SignParamsJWTSVID{
-		Audiences: params.jwtParams.Audiences,
+		Audiences: params.jwtParams.GetAudiences(),
 		SPIFFEID:  spiffeID,
 		JTI:       jti,
 		Issuer:    params.issuerURI,
@@ -1132,7 +1128,7 @@ func (s *IssuanceService) issueJWTSVID(ctx context.Context, params issueJWTSVIDP
 		)
 	}
 
-	return &workloadidentityv1pb.Credential{
+	return workloadidentityv1pb.Credential_builder{
 		WorkloadIdentityName:     params.workloadIdentity.GetMetadata().GetName(),
 		WorkloadIdentityRevision: params.workloadIdentity.GetMetadata().GetRevision(),
 
@@ -1142,13 +1138,11 @@ func (s *IssuanceService) issueJWTSVID(ctx context.Context, params issueJWTSVIDP
 		ExpiresAt: timestamppb.New(notAfter),
 		Ttl:       durationpb.New(ttl),
 
-		Credential: &workloadidentityv1pb.Credential_JwtSvid{
-			JwtSvid: &workloadidentityv1pb.JWTSVIDCredential{
-				Jwt: signed,
-				Jti: jti,
-			},
-		},
-	}, nil
+		JwtSvid: workloadidentityv1pb.JWTSVIDCredential_builder{
+			Jwt: signed,
+			Jti: jti,
+		}.Build(),
+	}.Build(), nil
 }
 
 func (s *IssuanceService) getAllWorkloadIdentities(
@@ -1213,7 +1207,7 @@ func (s *IssuanceService) matchingAndAuthorizedWorkloadIdentities(
 func convertLabels(selectors []*workloadidentityv1pb.LabelSelector) types.Labels {
 	labels := types.Labels{}
 	for _, selector := range selectors {
-		labels[selector.Key] = selector.Values
+		labels[selector.GetKey()] = selector.GetValues()
 	}
 	return labels
 }
diff --git a/lib/auth/machineid/workloadidentityv1/resource_service.go b/lib/auth/machineid/workloadidentityv1/resource_service.go
index 9d074256722..74ab20836d9 100644
--- a/lib/auth/machineid/workloadidentityv1/resource_service.go
+++ b/lib/auth/machineid/workloadidentityv1/resource_service.go
@@ -113,11 +113,11 @@ func (s *ResourceService) GetWorkloadIdentity(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	resource, err := s.cache.GetWorkloadIdentity(ctx, req.Name)
+	resource, err := s.cache.GetWorkloadIdentity(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -131,10 +131,10 @@ func (s *ResourceService) GetWorkloadIdentity(
 func (s *ResourceService) ListWorkloadIdentities(
 	ctx context.Context, req *workloadidentityv1pb.ListWorkloadIdentitiesRequest,
 ) (*workloadidentityv1pb.ListWorkloadIdentitiesResponse, error) {
-	return s.ListWorkloadIdentitiesV2(ctx, &workloadidentityv1pb.ListWorkloadIdentitiesV2Request{
+	return s.ListWorkloadIdentitiesV2(ctx, workloadidentityv1pb.ListWorkloadIdentitiesV2Request_builder{
 		PageSize:  req.GetPageSize(),
 		PageToken: req.GetPageToken(),
-	})
+	}.Build())
 }
 
 // ListWorkloadIdentitiesV2 returns a list of WorkloadIdentity resources. It
@@ -154,8 +154,8 @@ func (s *ResourceService) ListWorkloadIdentitiesV2(
 
 	resources, nextToken, err := s.cache.ListWorkloadIdentities(
 		ctx,
-		int(req.PageSize),
-		req.PageToken,
+		int(req.GetPageSize()),
+		req.GetPageToken(),
 		&services.ListWorkloadIdentitiesRequestOptions{
 			SortField:        req.GetSortField(),
 			SortDesc:         req.GetSortDesc(),
@@ -166,10 +166,10 @@ func (s *ResourceService) ListWorkloadIdentitiesV2(
 		return nil, trace.Wrap(err)
 	}
 
-	return &workloadidentityv1pb.ListWorkloadIdentitiesResponse{
+	return workloadidentityv1pb.ListWorkloadIdentitiesResponse_builder{
 		WorkloadIdentities: resources,
 		NextPageToken:      nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteWorkloadIdentity deletes a WorkloadIdentity by name.
@@ -188,11 +188,11 @@ func (s *ResourceService) DeleteWorkloadIdentity(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	if err := s.backend.DeleteWorkloadIdentity(ctx, req.Name); err != nil {
+	if err := s.backend.DeleteWorkloadIdentity(ctx, req.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -204,7 +204,7 @@ func (s *ResourceService) DeleteWorkloadIdentity(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Name,
+			Name: req.GetName(),
 		},
 	}); err != nil {
 		s.logger.ErrorContext(
@@ -232,7 +232,7 @@ func (s *ResourceService) CreateWorkloadIdentity(
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.backend.CreateWorkloadIdentity(ctx, req.WorkloadIdentity)
+	created, err := s.backend.CreateWorkloadIdentity(ctx, req.GetWorkloadIdentity())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -245,7 +245,7 @@ func (s *ResourceService) CreateWorkloadIdentity(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.WorkloadIdentity.Metadata.Name,
+			Name: req.GetWorkloadIdentity().GetMetadata().GetName(),
 		},
 	}
 	evt.WorkloadIdentityData, err = resourceToStruct(created)
@@ -282,7 +282,7 @@ func (s *ResourceService) UpdateWorkloadIdentity(
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.backend.UpdateWorkloadIdentity(ctx, req.WorkloadIdentity)
+	created, err := s.backend.UpdateWorkloadIdentity(ctx, req.GetWorkloadIdentity())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -295,7 +295,7 @@ func (s *ResourceService) UpdateWorkloadIdentity(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.WorkloadIdentity.Metadata.Name,
+			Name: req.GetWorkloadIdentity().GetMetadata().GetName(),
 		},
 	}
 	evt.WorkloadIdentityData, err = resourceToStruct(created)
@@ -334,7 +334,7 @@ func (s *ResourceService) UpsertWorkloadIdentity(
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.backend.UpsertWorkloadIdentity(ctx, req.WorkloadIdentity)
+	created, err := s.backend.UpsertWorkloadIdentity(ctx, req.GetWorkloadIdentity())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -347,7 +347,7 @@ func (s *ResourceService) UpsertWorkloadIdentity(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.WorkloadIdentity.Metadata.Name,
+			Name: req.GetWorkloadIdentity().GetMetadata().GetName(),
 		},
 	}
 	evt.WorkloadIdentityData, err = resourceToStruct(created)
diff --git a/lib/auth/machineid/workloadidentityv1/revocation_service.go b/lib/auth/machineid/workloadidentityv1/revocation_service.go
index f2397fd073a..018207ca1ce 100644
--- a/lib/auth/machineid/workloadidentityv1/revocation_service.go
+++ b/lib/auth/machineid/workloadidentityv1/revocation_service.go
@@ -167,11 +167,11 @@ func (s *RevocationService) GetWorkloadIdentityX509Revocation(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	resource, err := s.store.GetWorkloadIdentityX509Revocation(ctx, req.Name)
+	resource, err := s.store.GetWorkloadIdentityX509Revocation(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -196,17 +196,17 @@ func (s *RevocationService) ListWorkloadIdentityX509Revocations(
 
 	resources, nextToken, err := s.store.ListWorkloadIdentityX509Revocations(
 		ctx,
-		int(req.PageSize),
-		req.PageToken,
+		int(req.GetPageSize()),
+		req.GetPageToken(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &workloadidentityv1pb.ListWorkloadIdentityX509RevocationsResponse{
+	return workloadidentityv1pb.ListWorkloadIdentityX509RevocationsResponse_builder{
 		WorkloadIdentityX509Revocations: resources,
 		NextPageToken:                   nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteWorkloadIdentityX509Revocation deletes a WorkloadIdentityX509Revocation
@@ -226,11 +226,11 @@ func (s *RevocationService) DeleteWorkloadIdentityX509Revocation(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be non-empty")
 	}
 
-	if err := s.store.DeleteWorkloadIdentityX509Revocation(ctx, req.Name); err != nil {
+	if err := s.store.DeleteWorkloadIdentityX509Revocation(ctx, req.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -242,7 +242,7 @@ func (s *RevocationService) DeleteWorkloadIdentityX509Revocation(
 		UserMetadata:       authz.ClientUserMetadata(ctx),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Name,
+			Name: req.GetName(),
 		},
 	}
 	if err := s.emitter.EmitAuditEvent(ctx, evt); err != nil {
@@ -271,7 +271,7 @@ func (s *RevocationService) CreateWorkloadIdentityX509Revocation(
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.store.CreateWorkloadIdentityX509Revocation(ctx, req.WorkloadIdentityX509Revocation)
+	created, err := s.store.CreateWorkloadIdentityX509Revocation(ctx, req.GetWorkloadIdentityX509Revocation())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -315,7 +315,7 @@ func (s *RevocationService) UpdateWorkloadIdentityX509Revocation(
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.store.UpdateWorkloadIdentityX509Revocation(ctx, req.WorkloadIdentityX509Revocation)
+	created, err := s.store.UpdateWorkloadIdentityX509Revocation(ctx, req.GetWorkloadIdentityX509Revocation())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -361,7 +361,7 @@ func (s *RevocationService) UpsertWorkloadIdentityX509Revocation(
 		return nil, trace.Wrap(err)
 	}
 
-	created, err := s.store.UpsertWorkloadIdentityX509Revocation(ctx, req.WorkloadIdentityX509Revocation)
+	created, err := s.store.UpsertWorkloadIdentityX509Revocation(ctx, req.GetWorkloadIdentityX509Revocation())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -402,9 +402,9 @@ func (s *RevocationService) StreamSignedCRL(
 		// The CRL may not yet have been signed, so, skip straight to waiting
 		// for an update.
 		if len(crl) != 0 {
-			if err := srv.Send(&workloadidentityv1pb.StreamSignedCRLResponse{
+			if err := srv.Send(workloadidentityv1pb.StreamSignedCRLResponse_builder{
 				Crl: crl,
-			}); err != nil {
+			}.Build()); err != nil {
 				return trace.Wrap(err)
 			}
 		}
@@ -484,7 +484,7 @@ func (s *RevocationService) watchAndSign(ctx context.Context) error {
 	}
 	revocationsMap := make(map[string]*workloadidentityv1pb.WorkloadIdentityX509Revocation, len(revocationsSlice))
 	for _, revocation := range revocationsSlice {
-		revocationsMap[revocation.Metadata.Name] = revocation
+		revocationsMap[revocation.GetMetadata().GetName()] = revocation
 	}
 
 	handleEvent := func(e types.Event) (bool, error) {
@@ -498,7 +498,7 @@ func (s *RevocationService) watchAndSign(ctx context.Context) error {
 				)
 			}
 			revocation := unwrapper.UnwrapT()
-			revocationsMap[revocation.Metadata.Name] = revocation
+			revocationsMap[revocation.GetMetadata().GetName()] = revocation
 			return true, nil
 		case types.OpDelete:
 			delete(revocationsMap, e.Resource.GetName())
@@ -565,7 +565,7 @@ func (s *RevocationService) watchAndSign(ctx context.Context) error {
 			}
 			newRevocationsMap := make(map[string]*workloadidentityv1pb.WorkloadIdentityX509Revocation, len(revocationsSlice))
 			for _, revocation := range revocationsSlice {
-				newRevocationsMap[revocation.Metadata.Name] = revocation
+				newRevocationsMap[revocation.GetMetadata().GetName()] = revocation
 			}
 			revocationsMap = newRevocationsMap
 			crl, err := s.signCRL(ctx, revocationsMap)
@@ -637,19 +637,19 @@ func (s *RevocationService) signCRL(
 
 	for _, revocation := range revocations {
 		serial := new(big.Int)
-		_, ok := serial.SetString(revocation.Metadata.Name, 16)
+		_, ok := serial.SetString(revocation.GetMetadata().GetName(), 16)
 		if !ok {
 			s.logger.WarnContext(
 				ctx,
 				"Encountered WorkloadIdentityX509Revocation with unparsable serial number, it will be omitted from the CRL",
-				"workload_identity_revocation_name", revocation.Metadata.Name,
+				"workload_identity_revocation_name", revocation.GetMetadata().GetName(),
 			)
 			continue
 		}
 
 		tmpl.RevokedCertificateEntries = append(tmpl.RevokedCertificateEntries, x509.RevocationListEntry{
 			SerialNumber:   serial,
-			RevocationTime: revocation.Spec.RevokedAt.AsTime(),
+			RevocationTime: revocation.GetSpec().GetRevokedAt().AsTime(),
 		})
 	}
 
diff --git a/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go b/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go
index 3f88b35b5bb..dbedf6cd31c 100644
--- a/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go
+++ b/lib/auth/machineid/workloadidentityv1/workloadidentityv1_test.go
@@ -230,57 +230,55 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	wid, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	wid, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "my-wid",
 			Labels: map[string]string{
 				"my-label": "my-value",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 				Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-					{
+					workloadidentityv1pb.WorkloadIdentityRule_builder{
 						Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-							{
+							workloadidentityv1pb.WorkloadIdentityCondition_builder{
 								Attribute: "join.kubernetes.service_account.namespace",
-								Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-									Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-										Value: "my-namespace",
-									},
-								},
-							},
+								Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+									Value: "my-namespace",
+								}.Build(),
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: `/example/{{ user.name }}/{{ user.traits["organizational-unit"] }}/{{ join.kubernetes.service_account.namespace }}/{{ join.kubernetes.pod.name }}/{{ workload.unix.pid }}`,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	bot := &machineidv1.Bot{
+	bot := machineidv1.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "my-bot",
-		},
-		Spec: &machineidv1.BotSpec{
+		}.Build(),
+		Spec: machineidv1.BotSpec_builder{
 			Roles: []string{
 				role.GetName(),
 			},
 			Traits: []*machineidv1.Trait{
-				{
+				machineidv1.Trait_builder{
 					Name:   "organizational-unit",
 					Values: []string{"finance-department"},
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	k8s, err := fakeissuer.NewKubernetesSigner(tp.clock)
 	require.NoError(t, err)
@@ -300,7 +298,7 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 		types.ProvisionTokenSpecV2{
 			Roles:      types.SystemRoles{types.RoleBot},
 			JoinMethod: types.JoinMethodKubernetes,
-			BotName:    bot.Metadata.Name,
+			BotName:    bot.GetMetadata().GetName(),
 			Kubernetes: &types.ProvisionTokenSpecV2Kubernetes{
 				Type: types.KubernetesJoinTypeStaticJWKS,
 				StaticJWKS: &types.ProvisionTokenSpecV2Kubernetes_StaticJWKSConfig{
@@ -320,9 +318,9 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	require.NoError(t, err)
 	_, err = adminClient.CreateRole(ctx, role)
 	require.NoError(t, err)
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1.CreateBotRequest{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1.CreateBotRequest_builder{
 		Bot: bot,
-	})
+	}.Build())
 	require.NoError(t, err)
 	err = adminClient.CreateToken(ctx, token)
 	require.NoError(t, err)
@@ -378,19 +376,17 @@ func TestIssueWorkloadIdentityE2E(t *testing.T) {
 	c := workloadidentityv1pb.NewWorkloadIdentityIssuanceServiceClient(
 		roleClient.GetConnection(),
 	)
-	res, err := c.IssueWorkloadIdentity(ctx, &workloadidentityv1pb.IssueWorkloadIdentityRequest{
-		Name: wid.Metadata.Name,
-		WorkloadAttrs: &workloadidentityv1pb.WorkloadAttrs{
-			Unix: &workloadidentityv1pb.WorkloadAttrsUnix{
+	res, err := c.IssueWorkloadIdentity(ctx, workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
+		Name: wid.GetMetadata().GetName(),
+		WorkloadAttrs: workloadidentityv1pb.WorkloadAttrs_builder{
+			Unix: workloadidentityv1pb.WorkloadAttrsUnix_builder{
 				Pid: 123,
-			},
-		},
-		Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-			X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-				PublicKey: workloadKeyPubBytes,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+		X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+			PublicKey: workloadKeyPubBytes,
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Perform a minimal validation of the returned credential - enough to prove
@@ -486,70 +482,66 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create some WorkloadIdentity resources
-	full, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	full, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "full",
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 				Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-					{
+					workloadidentityv1pb.WorkloadIdentityRule_builder{
 						Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-							{
+							workloadidentityv1pb.WorkloadIdentityCondition_builder{
 								Attribute: "user.name",
-								Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-									Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-										Value: "dog",
-									},
-								},
-							},
-							{
+								Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+									Value: "dog",
+								}.Build(),
+							}.Build(),
+							workloadidentityv1pb.WorkloadIdentityCondition_builder{
 								Attribute: "workload.kubernetes.namespace",
-								Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-									Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-										Value: "default",
-									},
-								},
-							},
+								Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+									Value: "default",
+								}.Build(),
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id:   "/example/{{user.name}}/{{ workload.kubernetes.namespace }}/{{ workload.kubernetes.service_account }}",
 				Hint: "Wow - what a lovely hint, {{user.name}}!",
-				X509: &workloadidentityv1pb.WorkloadIdentitySPIFFEX509{
+				X509: workloadidentityv1pb.WorkloadIdentitySPIFFEX509_builder{
 					DnsSans: []string{
 						"*.example.com",
 						"{{user.name}}.example.com",
 					},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	subjectTemplate, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	subjectTemplate, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "subject-template",
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/foo",
-				X509: &workloadidentityv1pb.WorkloadIdentitySPIFFEX509{
-					SubjectTemplate: &workloadidentityv1pb.X509DistinguishedNameTemplate{
+				X509: workloadidentityv1pb.WorkloadIdentitySPIFFEX509_builder{
+					SubjectTemplate: workloadidentityv1pb.X509DistinguishedNameTemplate_builder{
 						CommonName:         "{{user.name}}",
 						Organization:       "{{user.name}} Inc",
 						OrganizationalUnit: "Team {{user.name}}",
-					},
-				},
-			},
-		},
-	})
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	extraClaimTemplates, err := structpb.NewStruct(map[string]any{
@@ -560,77 +552,77 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	extraClaims, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	extraClaims, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "extra-claims",
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/foo",
-				Jwt: &workloadidentityv1pb.WorkloadIdentitySPIFFEJWT{
+				Jwt: workloadidentityv1pb.WorkloadIdentitySPIFFEJWT_builder{
 					ExtraClaims: extraClaimTemplates,
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	modifiedMaxTTL, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	modifiedMaxTTL, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "max-ttl-modified",
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/foo",
-				X509: &workloadidentityv1pb.WorkloadIdentitySPIFFEX509{
+				X509: workloadidentityv1pb.WorkloadIdentitySPIFFEX509_builder{
 					MaximumTtl: durationpb.New(time.Hour * 30),
-				},
-				Jwt: &workloadidentityv1pb.WorkloadIdentitySPIFFEJWT{
+				}.Build(),
+				Jwt: workloadidentityv1pb.WorkloadIdentitySPIFFEJWT_builder{
 					MaximumTtl: durationpb.New(time.Minute * 15),
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	sigstorePolicyRequired, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	sigstorePolicyRequired, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "sigstore-policy-required",
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/foo",
-			},
-			Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+			}.Build(),
+			Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 				Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-					{Expression: `sigstore.policy_satisfied("foo") || sigstore.policy_satisfied("bar")`},
+					workloadidentityv1pb.WorkloadIdentityRule_builder{Expression: `sigstore.policy_satisfied("foo") || sigstore.policy_satisfied("bar")`}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	traitsRequired, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	traitsRequired, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "traits-required",
 			Labels: map[string]string{
 				"trait-label": "trait-value-b",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/foo",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	for policy, result := range map[string]error{
@@ -642,14 +634,14 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 	}
 
 	workloadAttrs := func(f func(attrs *workloadidentityv1pb.WorkloadAttrs)) *workloadidentityv1pb.WorkloadAttrs {
-		attrs := &workloadidentityv1pb.WorkloadAttrs{
-			Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+		attrs := workloadidentityv1pb.WorkloadAttrs_builder{
+			Kubernetes: workloadidentityv1pb.WorkloadAttrsKubernetes_builder{
 				Attested:       true,
 				Namespace:      "default",
 				PodName:        "test",
 				ServiceAccount: "bar",
-			},
-		}
+			}.Build(),
+		}.Build()
 		if f != nil {
 			f(attrs)
 		}
@@ -665,32 +657,30 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "jwt svid",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: full.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				RequestedTtl:  durationpb.New(time.Minute * 14),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 
 				wantTTL := time.Minute * 14
 				wantSPIFFEID := "spiffe://localhost/example/dog/default/bar"
 				require.Empty(t, cmp.Diff(
 					cred,
-					&workloadidentityv1pb.Credential{
+					workloadidentityv1pb.Credential_builder{
 						Ttl:                      durationpb.New(wantTTL),
 						SpiffeId:                 wantSPIFFEID,
 						Hint:                     "Wow - what a lovely hint, dog!",
 						WorkloadIdentityName:     full.GetMetadata().GetName(),
 						WorkloadIdentityRevision: full.GetMetadata().GetRevision(),
-					},
+					}.Build(),
 					protocmp.Transform(),
 					protocmp.IgnoreFields(
 						&workloadidentityv1pb.Credential{},
@@ -760,15 +750,13 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "jwt svid - extra claims",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: extraClaims.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
 				// Checks for a bug where unix epoch timestamps (e.g. the `exp`
@@ -816,32 +804,30 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "x509 svid",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: full.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
 				RequestedTtl:  durationpb.New(time.Hour * 2),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 
 				wantSPIFFEID := "spiffe://localhost/example/dog/default/bar"
 				wantTTL := time.Hour * 2
 				require.Empty(t, cmp.Diff(
 					cred,
-					&workloadidentityv1pb.Credential{
+					workloadidentityv1pb.Credential_builder{
 						Ttl:                      durationpb.New(wantTTL),
 						SpiffeId:                 wantSPIFFEID,
 						Hint:                     "Wow - what a lovely hint, dog!",
 						WorkloadIdentityName:     full.GetMetadata().GetName(),
 						WorkloadIdentityRevision: full.GetMetadata().GetRevision(),
-					},
+					}.Build(),
 					protocmp.Transform(),
 					protocmp.IgnoreFields(
 						&workloadidentityv1pb.Credential{},
@@ -936,30 +922,28 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "x509 svid - subject templating",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: subjectTemplate.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 
 				wantSPIFFEID := "spiffe://localhost/foo"
 				wantTTL := time.Hour
 				require.Empty(t, cmp.Diff(
 					cred,
-					&workloadidentityv1pb.Credential{
+					workloadidentityv1pb.Credential_builder{
 						Ttl:                      durationpb.New(wantTTL),
 						SpiffeId:                 wantSPIFFEID,
 						WorkloadIdentityName:     subjectTemplate.GetMetadata().GetName(),
 						WorkloadIdentityRevision: subjectTemplate.GetMetadata().GetRevision(),
-					},
+					}.Build(),
 					protocmp.Transform(),
 					protocmp.IgnoreFields(
 						&workloadidentityv1pb.Credential{},
@@ -1053,20 +1037,18 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "x509 svid - ttl limited by default max",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: subjectTemplate.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				RequestedTtl:  durationpb.New(time.Hour * 32),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 				wantTTL := time.Hour * 24
 				// Check expiry makes sense
 				require.WithinDuration(t, tp.clock.Now().Add(wantTTL), cred.GetExpiresAt().AsTime(), time.Second)
@@ -1084,36 +1066,32 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "x509 svid - access via traits in labels",
 			client: traitAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: traitsRequired.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				require.NotNil(t, res.Credential)
+				require.NotNil(t, res.GetCredential())
 			},
 		},
 		{
 			name:   "x509 svid - unspecified ttl",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: subjectTemplate.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 				wantTTL := time.Hour
 				// Check expiry makes sense
 				require.WithinDuration(t, tp.clock.Now().Add(wantTTL), cred.GetExpiresAt().AsTime(), time.Second)
@@ -1131,20 +1109,18 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "x509 svid - ttl limited by configured limit",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: modifiedMaxTTL.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				RequestedTtl:  durationpb.New(time.Hour * 32),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 				wantTTL := time.Hour * 30
 				// Check expiry makes sense
 				require.WithinDuration(t, tp.clock.Now().Add(wantTTL), cred.GetExpiresAt().AsTime(), time.Second)
@@ -1162,20 +1138,18 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "x509 svid - ok ttl between default and configured limit",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: modifiedMaxTTL.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				RequestedTtl:  durationpb.New(time.Hour * 28),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 				wantTTL := time.Hour * 28
 				// Check expiry makes sense
 				require.WithinDuration(t, tp.clock.Now().Add(wantTTL), cred.GetExpiresAt().AsTime(), time.Second)
@@ -1193,20 +1167,18 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "jwt svid ttl exceeds max default",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: full.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				RequestedTtl:  durationpb.New(time.Hour * 30),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 
 				wantTTL := time.Hour * 24
 				// Check expiry makes sense
@@ -1223,20 +1195,18 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "jwt svid ttl exceeds configured default",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: modifiedMaxTTL.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				RequestedTtl:  durationpb.New(time.Hour * 14),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				cred := res.Credential
-				require.NotNil(t, res.Credential)
+				cred := res.GetCredential()
+				require.NotNil(t, res.GetCredential())
 
 				wantTTL := time.Minute * 15
 				// Check expiry makes sense
@@ -1253,26 +1223,24 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "sigstore policy required",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: sigstorePolicyRequired.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: func() *workloadidentityv1pb.WorkloadAttrs {
 					attrs := workloadAttrs(nil)
-					attrs.Sigstore = &workloadidentityv1pb.WorkloadAttrsSigstore{
+					attrs.SetSigstore(workloadidentityv1pb.WorkloadAttrsSigstore_builder{
 						Payloads: []*workloadidentityv1pb.SigstoreVerificationPayload{
-							{Bundle: []byte(`bundle`)},
+							workloadidentityv1pb.SigstoreVerificationPayload_builder{Bundle: []byte(`bundle`)}.Build(),
 						},
-					}
+					}.Build())
 					return attrs
 				}(),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentityResponse) {
-				require.NotNil(t, res.Credential)
+				require.NotNil(t, res.GetCredential())
 
 				evt, ok := tp.eventRecorder.LastEvent().(*events.SPIFFESVIDIssued)
 				require.True(t, ok)
@@ -1296,17 +1264,15 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized by rules",
 			client: wilcardAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: full.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(func(attrs *workloadidentityv1pb.WorkloadAttrs) {
-					attrs.Kubernetes.Namespace = "not-default"
+					attrs.GetKubernetes().SetNamespace("not-default")
 				}),
-			},
+			}.Build(),
 			requireErr: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -1314,15 +1280,13 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized by labels",
 			client: specificAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: full.GetMetadata().GetName(),
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -1330,15 +1294,13 @@ func TestIssueWorkloadIdentity(t *testing.T) {
 		{
 			name:   "does not exist",
 			client: specificAccessClient,
-			req: &workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: "does-not-exist",
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err))
 			},
@@ -1392,125 +1354,121 @@ func TestIssueWorkloadIdentities(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create some WorkloadIdentity resources
-	_, err = tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	_, err = tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "bar-labeled",
 			Labels: map[string]string{
 				"foo":    "bar",
 				"access": "yes",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 				Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-					{
+					workloadidentityv1pb.WorkloadIdentityRule_builder{
 						Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-							{
+							workloadidentityv1pb.WorkloadIdentityCondition_builder{
 								Attribute: "workload.kubernetes.namespace",
-								Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-									Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-										Value: "default",
-									},
-								},
-							},
+								Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+									Value: "default",
+								}.Build(),
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id:   "/example/{{user.name}}/{{ workload.kubernetes.namespace }}/{{ workload.kubernetes.service_account }}",
 				Hint: "Wow - what a lovely hint, {{user.name}}!",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	_, err = tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	_, err = tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "buzz-labeled",
 			Labels: map[string]string{
 				"foo":    "buzz",
 				"access": "yes",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 				Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-					{
+					workloadidentityv1pb.WorkloadIdentityRule_builder{
 						Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-							{
+							workloadidentityv1pb.WorkloadIdentityCondition_builder{
 								Attribute: "workload.kubernetes.namespace",
-								Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-									Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-										Value: "default",
-									},
-								},
-							},
+								Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+									Value: "default",
+								}.Build(),
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id:   "/example/{{user.name}}/{{ workload.kubernetes.namespace }}/{{ workload.kubernetes.service_account }}",
 				Hint: "Wow - what a lovely hint, {{user.name}}!",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	_, err = tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	_, err = tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "inaccessible",
 			Labels: map[string]string{
 				"foo":    "bar",
 				"access": "no",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
 			Rules: &workloadidentityv1pb.WorkloadIdentityRules{},
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/example",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Make enough to trip the "too many" error
 	for i := range 12 {
-		_, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		_, err := tp.srv.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: fmt.Sprintf("%d", i),
 				Labels: map[string]string{
 					"error":  "too-many",
 					"access": "yes",
 				},
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
 				Rules: &workloadidentityv1pb.WorkloadIdentityRules{},
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/exampled",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
 	workloadAttrs := func(f func(attrs *workloadidentityv1pb.WorkloadAttrs)) *workloadidentityv1pb.WorkloadAttrs {
-		attrs := &workloadidentityv1pb.WorkloadAttrs{
-			Kubernetes: &workloadidentityv1pb.WorkloadAttrsKubernetes{
+		attrs := workloadidentityv1pb.WorkloadAttrs_builder{
+			Kubernetes: workloadidentityv1pb.WorkloadAttrsKubernetes_builder{
 				Attested:       true,
 				Namespace:      "default",
 				PodName:        "test",
 				ServiceAccount: "bar",
-			},
-		}
+			}.Build(),
+		}.Build()
 		if f != nil {
 			f(attrs)
 		}
@@ -1526,25 +1484,23 @@ func TestIssueWorkloadIdentities(t *testing.T) {
 		{
 			name:   "jwt svid",
 			client: client,
-			req: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: []*workloadidentityv1pb.LabelSelector{
-					{
+					workloadidentityv1pb.LabelSelector_builder{
 						Key:    "foo",
 						Values: []string{"bar", "buzz"},
-					},
-				},
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
+					}.Build(),
 				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentitiesResponse) {
 				workloadIdentitiesIssued := []string{}
-				for _, cred := range res.Credentials {
-					workloadIdentitiesIssued = append(workloadIdentitiesIssued, cred.WorkloadIdentityName)
+				for _, cred := range res.GetCredentials() {
+					workloadIdentitiesIssued = append(workloadIdentitiesIssued, cred.GetWorkloadIdentityName())
 
 					// Check a credential was actually included and is valid.
 					parsed, err := jwt.ParseSigned(cred.GetJwtSvid().GetJwt())
@@ -1559,25 +1515,23 @@ func TestIssueWorkloadIdentities(t *testing.T) {
 		{
 			name:   "x509 svid",
 			client: client,
-			req: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: []*workloadidentityv1pb.LabelSelector{
-					{
+					workloadidentityv1pb.LabelSelector_builder{
 						Key:    "foo",
 						Values: []string{"bar", "buzz"},
-					},
-				},
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
+					}.Build(),
 				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentitiesResponse) {
 				workloadIdentitiesIssued := []string{}
-				for _, cred := range res.Credentials {
-					workloadIdentitiesIssued = append(workloadIdentitiesIssued, cred.WorkloadIdentityName)
+				for _, cred := range res.GetCredentials() {
+					workloadIdentitiesIssued = append(workloadIdentitiesIssued, cred.GetWorkloadIdentityName())
 					// Check X509 cert actually included and signed.
 					cert, err := x509.ParseCertificate(cred.GetX509Svid().GetCert())
 					require.NoError(t, err)
@@ -1595,66 +1549,60 @@ func TestIssueWorkloadIdentities(t *testing.T) {
 		{
 			name:   "rules prevent issuing",
 			client: client,
-			req: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: []*workloadidentityv1pb.LabelSelector{
-					{
+					workloadidentityv1pb.LabelSelector_builder{
 						Key:    "foo",
 						Values: []string{"bar", "buzz"},
-					},
-				},
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
+					}.Build(),
 				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(func(attrs *workloadidentityv1pb.WorkloadAttrs) {
-					attrs.Kubernetes.Namespace = "not-default"
+					attrs.GetKubernetes().SetNamespace("not-default")
 				}),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentitiesResponse) {
-				require.Empty(t, res.Credentials)
+				require.Empty(t, res.GetCredentials())
 			},
 		},
 		{
 			name:   "no matching labels",
 			client: client,
-			req: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: []*workloadidentityv1pb.LabelSelector{
-					{
+					workloadidentityv1pb.LabelSelector_builder{
 						Key:    "foo",
 						Values: []string{"muahah"},
-					},
-				},
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
+					}.Build(),
 				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: require.NoError,
 			assert: func(t *testing.T, res *workloadidentityv1pb.IssueWorkloadIdentitiesResponse) {
-				require.Empty(t, res.Credentials)
+				require.Empty(t, res.GetCredentials())
 			},
 		},
 		{
 			name:   "too many to issue",
 			client: client,
-			req: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			req: workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: []*workloadidentityv1pb.LabelSelector{
-					{
+					workloadidentityv1pb.LabelSelector_builder{
 						Key:    "error",
 						Values: []string{"too-many"},
-					},
-				},
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: []string{"example.com", "test.example.com"},
-					},
+					}.Build(),
 				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: []string{"example.com", "test.example.com"},
+				}.Build(),
 				WorkloadAttrs: workloadAttrs(nil),
-			},
+			}.Build(),
 			requireErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "number of identities that would be issued exceeds maximum permitted (max = 10), use more specific labels")
 			},
@@ -1754,23 +1702,19 @@ func TestIssueTeleportWorkloadIdentity(t *testing.T) {
 	}{
 		"app service generates workload identity for a session": {
 			clt: appServiceClt,
-			req: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-				Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
-				Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-					AppAccess: &workloadidentityv1pb.AppAccessUsage{
-						UserCertificate: aliceSessionCertBytes,
-					},
-				},
-			},
+			req: workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
+				AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+					UserCertificate: aliceSessionCertBytes,
+				}.Build(),
+			}.Build(),
 			expectErr: require.NoError,
 			expectResp: func(tt require.TestingT, i1 any, i2 ...any) {
 				resp, _ := i1.(*workloadidentityv1pb.IssueTeleportWorkloadIdentityResponse)
 				// Check X509 cert actually included and signed.
-				cert, err := x509.ParseCertificate(resp.Credential.GetX509Svid().GetCert())
+				cert, err := x509.ParseCertificate(resp.GetCredential().GetX509Svid().GetCert())
 				require.NoError(tt, err)
 				// Check included public key matches
 				require.Equal(tt, workloadKey.Public(), cert.PublicKey)
@@ -1794,18 +1738,14 @@ func TestIssueTeleportWorkloadIdentity(t *testing.T) {
 		},
 		"other service cannot generate workload identity for app access": {
 			clt: otherServiceClt,
-			req: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-				Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
-				Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-					AppAccess: &workloadidentityv1pb.AppAccessUsage{
-						UserCertificate: aliceSessionCertBytes,
-					},
-				},
-			},
+			req: workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
+				AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+					UserCertificate: aliceSessionCertBytes,
+				}.Build(),
+			}.Build(),
 			expectErr: func(tt require.TestingT, err error, i ...any) {
 				require.ErrorContains(tt, err, "only app services can issue workload identity for app access", i...)
 			},
@@ -1813,18 +1753,14 @@ func TestIssueTeleportWorkloadIdentity(t *testing.T) {
 		},
 		"app service not serving app cannot generate workload identity for requested session": {
 			clt: nonServingAppServiceClt,
-			req: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-				Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
-				Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-					AppAccess: &workloadidentityv1pb.AppAccessUsage{
-						UserCertificate: aliceSessionCertBytes,
-					},
-				},
-			},
+			req: workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
+				AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+					UserCertificate: aliceSessionCertBytes,
+				}.Build(),
+			}.Build(),
 			expectErr: func(tt require.TestingT, err error, i ...any) {
 				require.ErrorContains(tt, err, "unable to locate app", i...)
 			},
@@ -1832,18 +1768,14 @@ func TestIssueTeleportWorkloadIdentity(t *testing.T) {
 		},
 		"app service generates workload identity for an expired session": {
 			clt: appServiceClt,
-			req: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-				Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
-				Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-					AppAccess: &workloadidentityv1pb.AppAccessUsage{
-						UserCertificate: aliceExpiredSessionCertBytes,
-					},
-				},
-			},
+			req: workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
+				AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+					UserCertificate: aliceExpiredSessionCertBytes,
+				}.Build(),
+			}.Build(),
 			expectErr: func(tt require.TestingT, err error, i ...any) {
 				require.ErrorContains(tt, err, "certificate has expired", i...)
 			},
@@ -1851,18 +1783,14 @@ func TestIssueTeleportWorkloadIdentity(t *testing.T) {
 		},
 		"users cannot request the RPC": {
 			clt: userClt,
-			req: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-				Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey: workloadKeyPubBytes,
-					},
-				},
-				Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-					AppAccess: &workloadidentityv1pb.AppAccessUsage{
-						UserCertificate: aliceSessionCertBytes,
-					},
-				},
-			},
+			req: workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey: workloadKeyPubBytes,
+				}.Build(),
+				AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+					UserCertificate: aliceSessionCertBytes,
+				}.Build(),
+			}.Build(),
 			expectErr: func(tt require.TestingT, err error, i ...any) {
 				require.ErrorContains(tt, err, "only app services can issue workload identity for app access", i...)
 			},
@@ -1945,18 +1873,14 @@ func TestIssueTeleportWorkloadIdentityRejectsExpiredUserCA(t *testing.T) {
 	c := workloadidentityv1pb.NewWorkloadIdentityIssuanceServiceClient(appServiceClt.GetConnection())
 
 	// Here we ensure the certificate is OK and returns without errors.
-	res, err := c.IssueTeleportWorkloadIdentity(ctx, &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-		Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-			X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-				PublicKey: workloadKeyPubBytes,
-			},
-		},
-		Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-			AppAccess: &workloadidentityv1pb.AppAccessUsage{
-				UserCertificate: aliceSessionCertBytes,
-			},
-		},
-	})
+	res, err := c.IssueTeleportWorkloadIdentity(ctx, workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+		X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+			PublicKey: workloadKeyPubBytes,
+		}.Build(),
+		AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+			UserCertificate: aliceSessionCertBytes,
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	require.NotNil(t, res)
 
@@ -1999,18 +1923,14 @@ func TestIssueTeleportWorkloadIdentityRejectsExpiredUserCA(t *testing.T) {
 
 	// This time, the UserCA is expected to be expired, meaning it should fail
 	// the certificate verification.
-	res, err = c.IssueTeleportWorkloadIdentity(ctx, &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest{
-		Credential: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_X509SvidParams{
-			X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-				PublicKey: workloadKeyPubBytes,
-			},
-		},
-		Usage: &workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_AppAccess{
-			AppAccess: &workloadidentityv1pb.AppAccessUsage{
-				UserCertificate: aliceSessionCertBytes,
-			},
-		},
-	})
+	res, err = c.IssueTeleportWorkloadIdentity(ctx, workloadidentityv1pb.IssueTeleportWorkloadIdentityRequest_builder{
+		X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+			PublicKey: workloadKeyPubBytes,
+		}.Build(),
+		AppAccess: workloadidentityv1pb.AppAccessUsage_builder{
+			UserCertificate: aliceSessionCertBytes,
+		}.Build(),
+	}.Build())
 
 	require.ErrorContains(t, err, "requestor provided an invalid certificate")
 	require.ErrorContains(t, err, "certificate has expired")
@@ -2048,18 +1968,18 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 	// Create a pre-existing workload identity
 	preExisting, err := srv.Auth().CreateWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "preexisting",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/example",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2073,20 +1993,20 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/example",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError:        require.NoError,
 			checkResultReturned: true,
 			requireEvent: &events.WorkloadIdentityCreate{
@@ -2108,20 +2028,20 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "pre-existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: preExisting.GetMetadata().GetName(),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/example",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAlreadyExists(err))
 			},
@@ -2129,20 +2049,20 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "spec.spiffe.id: is required")
@@ -2151,20 +2071,20 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "unauthorized",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/example",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -2181,21 +2101,21 @@ func TestResourceService_CreateWorkloadIdentity(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkResultReturned {
-				require.NotEmpty(t, res.Metadata.Revision)
+				require.NotEmpty(t, res.GetMetadata().GetRevision())
 				// Expect returned result to match request, but also have a
 				// revision
 				require.Empty(
 					t,
 					cmp.Diff(
 						res,
-						tt.req.WorkloadIdentity,
+						tt.req.GetWorkloadIdentity(),
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 					),
 				)
 				// Expect the value fetched from the store to match returned
 				// item.
-				fetched, err := srv.Auth().GetWorkloadIdentity(ctx, res.Metadata.Name)
+				fetched, err := srv.Auth().GetWorkloadIdentity(ctx, res.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(
 					t,
@@ -2251,18 +2171,18 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 	// Create a pre-existing workload identity
 	preExisting, err := srv.Auth().CreateWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "preexisting",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/example",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2276,9 +2196,9 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityRequest_builder{
 				Name: preExisting.GetMetadata().GetName(),
-			},
+			}.Build(),
 			requireError:     require.NoError,
 			checkNonExisting: true,
 			requireEvent: &events.WorkloadIdentityDelete{
@@ -2300,9 +2220,9 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 		{
 			name:   "non-existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityRequest_builder{
 				Name: "i-do-not-exist",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err))
 			},
@@ -2310,9 +2230,9 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityRequest_builder{
 				Name: "",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "name: must be non-empty")
@@ -2321,9 +2241,9 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityRequest_builder{
 				Name: "unauthorized",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -2340,7 +2260,7 @@ func TestResourceService_DeleteWorkloadIdentity(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkNonExisting {
-				_, err := srv.Auth().GetWorkloadIdentity(ctx, tt.req.Name)
+				_, err := srv.Auth().GetWorkloadIdentity(ctx, tt.req.GetName())
 				require.True(t, trace.IsNotFound(err))
 			}
 			if tt.requireEvent != nil {
@@ -2388,18 +2308,18 @@ func TestResourceService_GetWorkloadIdentity(t *testing.T) {
 	// Create a pre-existing workload identity
 	preExisting, err := srv.Auth().CreateWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "preexisting",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/example",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2412,18 +2332,18 @@ func TestResourceService_GetWorkloadIdentity(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityRequest_builder{
 				Name: preExisting.GetMetadata().GetName(),
-			},
+			}.Build(),
 			wantRes:      preExisting,
 			requireError: require.NoError,
 		},
 		{
 			name:   "non-existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityRequest_builder{
 				Name: "i-do-not-exist",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err))
 			},
@@ -2431,9 +2351,9 @@ func TestResourceService_GetWorkloadIdentity(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityRequest_builder{
 				Name: "",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "name: must be non-empty")
@@ -2442,9 +2362,9 @@ func TestResourceService_GetWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityRequest_builder{
 				Name: "unauthorized",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -2507,18 +2427,18 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 	for i := range 29 {
 		r, err := srv.Auth().CreateWorkloadIdentity(
 			ctx,
-			&workloadidentityv1pb.WorkloadIdentity{
+			workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: fmt.Sprintf("preexisting-%d", i),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			})
+					}.Build(),
+				}.Build(),
+			}.Build())
 		require.NoError(t, err)
 		created = append(created, r)
 	}
@@ -2540,10 +2460,10 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 		// For the default page size, we expect to get all results in one page
 		res, err := client.ListWorkloadIdentities(ctx, &workloadidentityv1pb.ListWorkloadIdentitiesRequest{})
 		require.NoError(t, err)
-		require.Len(t, res.WorkloadIdentities, 29)
-		require.Empty(t, res.NextPageToken)
+		require.Len(t, res.GetWorkloadIdentities(), 29)
+		require.Empty(t, res.GetNextPageToken())
 		for _, created := range created {
-			require.True(t, slices.ContainsFunc(res.WorkloadIdentities, func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
+			require.True(t, slices.ContainsFunc(res.GetWorkloadIdentities(), func(resource *workloadidentityv1pb.WorkloadIdentity) bool {
 				return proto.Equal(created, resource)
 			}))
 		}
@@ -2559,16 +2479,16 @@ func TestResourceService_ListWorkloadIdentities(t *testing.T) {
 		iterations := 0
 		for {
 			iterations++
-			res, err := client.ListWorkloadIdentities(ctx, &workloadidentityv1pb.ListWorkloadIdentitiesRequest{
+			res, err := client.ListWorkloadIdentities(ctx, workloadidentityv1pb.ListWorkloadIdentitiesRequest_builder{
 				PageSize:  10,
 				PageToken: token,
-			})
+			}.Build())
 			require.NoError(t, err)
-			fetched = append(fetched, res.WorkloadIdentities...)
-			if res.NextPageToken == "" {
+			fetched = append(fetched, res.GetWorkloadIdentities()...)
+			if res.GetNextPageToken() == "" {
 				break
 			}
-			token = res.NextPageToken
+			token = res.GetNextPageToken()
 		}
 
 		require.Len(t, fetched, 29)
@@ -2612,33 +2532,33 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 	// Create a pre-existing workload identity
 	preExisting, err := srv.Auth().CreateWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "preexisting",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/example",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 	preExisting2, err := srv.Auth().CreateWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "preexisting-2",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/example",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2652,9 +2572,9 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpdateWorkloadIdentityRequest{
+			req: workloadidentityv1pb.UpdateWorkloadIdentityRequest_builder{
 				WorkloadIdentity: preExisting,
-			},
+			}.Build(),
 			requireError:        require.NoError,
 			checkResultReturned: true,
 			requireEvent: &events.WorkloadIdentityUpdate{
@@ -2677,10 +2597,10 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 			name:   "incorrect revision",
 			client: authorizedClient,
 			req: (func() *workloadidentityv1pb.UpdateWorkloadIdentityRequest {
-				preExisting2.Metadata.Revision = "incorrect"
-				return &workloadidentityv1pb.UpdateWorkloadIdentityRequest{
+				preExisting2.GetMetadata().SetRevision("incorrect")
+				return workloadidentityv1pb.UpdateWorkloadIdentityRequest_builder{
 					WorkloadIdentity: preExisting2,
-				}
+				}.Build()
 			})(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsCompareFailed(err))
@@ -2689,20 +2609,20 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "not existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpdateWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.UpdateWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/test",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.Error(t, err)
 			},
@@ -2710,9 +2630,9 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.UpdateWorkloadIdentityRequest{
+			req: workloadidentityv1pb.UpdateWorkloadIdentityRequest_builder{
 				WorkloadIdentity: preExisting,
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -2729,22 +2649,22 @@ func TestResourceService_UpdateWorkloadIdentity(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkResultReturned {
-				require.NotEmpty(t, res.Metadata.Revision)
-				require.NotEqual(t, tt.req.WorkloadIdentity.GetMetadata().GetRevision(), res.Metadata.Revision)
+				require.NotEmpty(t, res.GetMetadata().GetRevision())
+				require.NotEqual(t, tt.req.GetWorkloadIdentity().GetMetadata().GetRevision(), res.GetMetadata().GetRevision())
 				// Expect returned result to match request, but also have a
 				// revision
 				require.Empty(
 					t,
 					cmp.Diff(
 						res,
-						tt.req.WorkloadIdentity,
+						tt.req.GetWorkloadIdentity(),
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 					),
 				)
 				// Expect the value fetched from the store to match returned
 				// item.
-				fetched, err := srv.Auth().GetWorkloadIdentity(ctx, res.Metadata.Name)
+				fetched, err := srv.Auth().GetWorkloadIdentity(ctx, res.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(
 					t,
@@ -2808,20 +2728,20 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpsertWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.UpsertWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/example",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError:        require.NoError,
 			checkResultReturned: true,
 			requireEvent: &events.WorkloadIdentityCreate{
@@ -2843,20 +2763,20 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpsertWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.UpsertWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "new",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "spec.spiffe.id: is required")
@@ -2865,20 +2785,20 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.UpsertWorkloadIdentityRequest{
-				WorkloadIdentity: &workloadidentityv1pb.WorkloadIdentity{
+			req: workloadidentityv1pb.UpsertWorkloadIdentityRequest_builder{
+				WorkloadIdentity: workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "unauthorized",
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/example",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -2895,21 +2815,21 @@ func TestResourceService_UpsertWorkloadIdentity(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkResultReturned {
-				require.NotEmpty(t, res.Metadata.Revision)
+				require.NotEmpty(t, res.GetMetadata().GetRevision())
 				// Expect returned result to match request, but also have a
 				// revision
 				require.Empty(
 					t,
 					cmp.Diff(
 						res,
-						tt.req.WorkloadIdentity,
+						tt.req.GetWorkloadIdentity(),
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 					),
 				)
 				// Expect the value fetched from the store to match returned
 				// item.
-				fetched, err := srv.Auth().GetWorkloadIdentity(ctx, res.Metadata.Name)
+				fetched, err := srv.Auth().GetWorkloadIdentity(ctx, res.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(
 					t,
@@ -2965,18 +2885,18 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 	// Create a pre-existing workload identity revocation
 	preExisting, err := srv.Auth().CreateWorkloadIdentityX509Revocation(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+		workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 			Kind:    types.KindWorkloadIdentityX509Revocation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    "aabbccdd",
 				Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 				Reason:    "compromised",
 				RevokedAt: timestamppb.New(srv.Clock().Now()),
-			},
-		})
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -2990,20 +2910,20 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "aa",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError:        require.NoError,
 			checkResultReturned: true,
 			requireEvent: &events.WorkloadIdentityX509RevocationCreate{
@@ -3026,9 +2946,9 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "pre-existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest_builder{
 				WorkloadIdentityX509Revocation: preExisting,
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAlreadyExists(err))
 			},
@@ -3036,20 +2956,20 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "bb",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "",
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "spec.reason: is required")
@@ -3058,20 +2978,20 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "cc",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -3088,21 +3008,21 @@ func TestRevocationService_CreateWorkloadIdentityX509Revocation(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkResultReturned {
-				require.NotEmpty(t, res.Metadata.Revision)
+				require.NotEmpty(t, res.GetMetadata().GetRevision())
 				// Expect returned result to match request, but also have a
 				// revision
 				require.Empty(
 					t,
 					cmp.Diff(
 						res,
-						tt.req.WorkloadIdentityX509Revocation,
+						tt.req.GetWorkloadIdentityX509Revocation(),
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 					),
 				)
 				// Expect the value fetched from the store to match returned
 				// item.
-				fetched, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, res.Metadata.Name)
+				fetched, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, res.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(
 					t,
@@ -3158,18 +3078,18 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 	// Create a pre-existing workload identity revocation
 	preExisting, err := srv.Auth().CreateWorkloadIdentityX509Revocation(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+		workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 			Kind:    types.KindWorkloadIdentityX509Revocation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    "aabbccdd",
 				Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 				Reason:    "compromised",
 				RevokedAt: timestamppb.New(srv.Clock().Now()),
-			},
-		})
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -3183,9 +3103,9 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest_builder{
 				Name: preExisting.GetMetadata().GetName(),
-			},
+			}.Build(),
 			requireError:     require.NoError,
 			checkNonExisting: true,
 			requireEvent: &events.WorkloadIdentityX509RevocationDelete{
@@ -3207,9 +3127,9 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "non-existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest_builder{
 				Name: "i-do-not-exist",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err))
 			},
@@ -3217,9 +3137,9 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest_builder{
 				Name: "",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "name: must be non-empty")
@@ -3228,9 +3148,9 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest_builder{
 				Name: "unauthorized",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -3247,7 +3167,7 @@ func TestRevocationService_DeleteWorkloadIdentityX509Revocation(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkNonExisting {
-				_, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, tt.req.Name)
+				_, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, tt.req.GetName())
 				require.True(t, trace.IsNotFound(err))
 			}
 			if tt.requireEvent != nil {
@@ -3295,18 +3215,18 @@ func TestRevocationService_GetWorkloadIdentityX509Revocation(t *testing.T) {
 	// Create a pre-existing workload identity revocation
 	preExisting, err := srv.Auth().CreateWorkloadIdentityX509Revocation(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+		workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 			Kind:    types.KindWorkloadIdentityX509Revocation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    "aabbccdd",
 				Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 				Reason:    "compromised",
 				RevokedAt: timestamppb.New(srv.Clock().Now()),
-			},
-		})
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -3319,18 +3239,18 @@ func TestRevocationService_GetWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest_builder{
 				Name: preExisting.GetMetadata().GetName(),
-			},
+			}.Build(),
 			wantRes:      preExisting,
 			requireError: require.NoError,
 		},
 		{
 			name:   "non-existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest_builder{
 				Name: "i-do-not-exist",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err))
 			},
@@ -3338,9 +3258,9 @@ func TestRevocationService_GetWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest_builder{
 				Name: "",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "name: must be non-empty")
@@ -3349,9 +3269,9 @@ func TestRevocationService_GetWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest_builder{
 				Name: "unauthorized",
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -3414,18 +3334,18 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 	for i := range 29 {
 		r, err := srv.Auth().CreateWorkloadIdentityX509Revocation(
 			ctx,
-			&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    fmt.Sprintf("%d%d", i, i),
 					Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.New(srv.Clock().Now()),
-				},
-			})
+				}.Build(),
+			}.Build())
 		require.NoError(t, err)
 		created = append(created, r)
 	}
@@ -3450,10 +3370,10 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 		// For the default page size, we expect to get all results in one page
 		res, err := client.ListWorkloadIdentityX509Revocations(ctx, &workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest{})
 		require.NoError(t, err)
-		require.Len(t, res.WorkloadIdentityX509Revocations, 29)
-		require.Empty(t, res.NextPageToken)
+		require.Len(t, res.GetWorkloadIdentityX509Revocations(), 29)
+		require.Empty(t, res.GetNextPageToken())
 		for _, created := range created {
-			require.True(t, slices.ContainsFunc(res.WorkloadIdentityX509Revocations, func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
+			require.True(t, slices.ContainsFunc(res.GetWorkloadIdentityX509Revocations(), func(resource *workloadidentityv1pb.WorkloadIdentityX509Revocation) bool {
 				return proto.Equal(created, resource)
 			}))
 		}
@@ -3469,16 +3389,16 @@ func TestRevocationService_ListWorkloadIdentityX509Revocations(t *testing.T) {
 		iterations := 0
 		for {
 			iterations++
-			res, err := client.ListWorkloadIdentityX509Revocations(ctx, &workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest{
+			res, err := client.ListWorkloadIdentityX509Revocations(ctx, workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest_builder{
 				PageSize:  10,
 				PageToken: token,
-			})
+			}.Build())
 			require.NoError(t, err)
-			fetched = append(fetched, res.WorkloadIdentityX509Revocations...)
-			if res.NextPageToken == "" {
+			fetched = append(fetched, res.GetWorkloadIdentityX509Revocations()...)
+			if res.GetNextPageToken() == "" {
 				break
 			}
-			token = res.NextPageToken
+			token = res.GetNextPageToken()
 		}
 
 		require.Len(t, fetched, 29)
@@ -3522,34 +3442,34 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 	// Create a pre-existing workload identity revocation
 	preExisting, err := srv.Auth().CreateWorkloadIdentityX509Revocation(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+		workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 			Kind:    types.KindWorkloadIdentityX509Revocation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    "aabbccdd",
 				Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 				Reason:    "compromised",
 				RevokedAt: timestamppb.New(srv.Clock().Now()),
-			},
-		})
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 	// Create a pre-existing workload identity revocation
 	preExisting2, err := srv.Auth().CreateWorkloadIdentityX509Revocation(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+		workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 			Kind:    types.KindWorkloadIdentityX509Revocation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    "aabbccee",
 				Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 				Reason:    "compromised",
 				RevokedAt: timestamppb.New(srv.Clock().Now()),
-			},
-		})
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -3563,9 +3483,9 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest_builder{
 				WorkloadIdentityX509Revocation: preExisting,
-			},
+			}.Build(),
 			requireError:        require.NoError,
 			checkResultReturned: true,
 			requireEvent: &events.WorkloadIdentityX509RevocationUpdate{
@@ -3589,10 +3509,10 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 			name:   "incorrect revision",
 			client: authorizedClient,
 			req: (func() *workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest {
-				preExisting2.Metadata.Revision = "incorrect"
-				return &workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest{
+				preExisting2.GetMetadata().SetRevision("incorrect")
+				return workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest_builder{
 					WorkloadIdentityX509Revocation: preExisting2,
-				}
+				}.Build()
 			})(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsCompareFailed(err))
@@ -3601,20 +3521,20 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "not existing",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "aabbccdd404",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.Error(t, err)
 			},
@@ -3622,9 +3542,9 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest{
+			req: workloadidentityv1pb.UpdateWorkloadIdentityX509RevocationRequest_builder{
 				WorkloadIdentityX509Revocation: preExisting,
-			},
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -3641,22 +3561,22 @@ func TestRevocationService_UpdateWorkloadIdentityX509Revocation(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkResultReturned {
-				require.NotEmpty(t, res.Metadata.Revision)
-				require.NotEqual(t, tt.req.WorkloadIdentityX509Revocation.GetMetadata().GetRevision(), res.Metadata.Revision)
+				require.NotEmpty(t, res.GetMetadata().GetRevision())
+				require.NotEqual(t, tt.req.GetWorkloadIdentityX509Revocation().GetMetadata().GetRevision(), res.GetMetadata().GetRevision())
 				// Expect returned result to match request, but also have a
 				// revision
 				require.Empty(
 					t,
 					cmp.Diff(
 						res,
-						tt.req.WorkloadIdentityX509Revocation,
+						tt.req.GetWorkloadIdentityX509Revocation(),
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 					),
 				)
 				// Expect the value fetched from the store to match returned
 				// item.
-				fetched, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, res.Metadata.Name)
+				fetched, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, res.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(
 					t,
@@ -3720,20 +3640,20 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "success",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpsertWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.UpsertWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "aabbccdd",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError:        require.NoError,
 			checkResultReturned: true,
 			requireEvent: &events.WorkloadIdentityX509RevocationCreate{
@@ -3756,19 +3676,19 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "validation fail",
 			client: authorizedClient,
-			req: &workloadidentityv1pb.UpsertWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.UpsertWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "aabbccdd",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err))
 				require.ErrorContains(t, err, "spec.reason: is required")
@@ -3777,20 +3697,20 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 		{
 			name:   "unauthorized",
 			client: unauthorizedClient,
-			req: &workloadidentityv1pb.UpsertWorkloadIdentityX509RevocationRequest{
-				WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			req: workloadidentityv1pb.UpsertWorkloadIdentityX509RevocationRequest_builder{
+				WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "aabbccdd",
 						Expires: timestamppb.New(srv.Clock().Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(srv.Clock().Now()),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err))
 			},
@@ -3807,21 +3727,21 @@ func TestRevocationService_UpsertWorkloadIdentityX509Revocation(t *testing.T) {
 			tt.requireError(t, err)
 
 			if tt.checkResultReturned {
-				require.NotEmpty(t, res.Metadata.Revision)
+				require.NotEmpty(t, res.GetMetadata().GetRevision())
 				// Expect returned result to match request, but also have a
 				// revision
 				require.Empty(
 					t,
 					cmp.Diff(
 						res,
-						tt.req.WorkloadIdentityX509Revocation,
+						tt.req.GetWorkloadIdentityX509Revocation(),
 						protocmp.Transform(),
 						protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 					),
 				)
 				// Expect the value fetched from the store to match returned
 				// item.
-				fetched, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, res.Metadata.Name)
+				fetched, err := srv.Auth().GetWorkloadIdentityX509Revocation(ctx, res.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(
 					t,
@@ -3962,18 +3882,18 @@ func TestRevocationService_CRL(t *testing.T) {
 
 			_, err := store.CreateWorkloadIdentityX509Revocation(
 				t.Context(),
-				&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+				workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 					Kind:    types.KindWorkloadIdentityX509Revocation,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    name,
 						Expires: timestamppb.New(time.Now().Add(time.Hour)),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 						Reason:    "compromised",
 						RevokedAt: timestamppb.New(revokedAt),
-					},
-				},
+					}.Build(),
+				}.Build(),
 			)
 			require.NoError(t, err)
 
@@ -4007,7 +3927,7 @@ func TestRevocationService_CRL(t *testing.T) {
 		// Fetch the initial, empty, CRL
 		res, err := stream.Recv()
 		require.NoError(t, err)
-		checkCRL(t, res.Crl, nil)
+		checkCRL(t, res.GetCrl(), nil)
 
 		// Create new revocations
 		createRevocation(t, "ff")
@@ -4019,7 +3939,7 @@ func TestRevocationService_CRL(t *testing.T) {
 		// The client should now receive a new CRL
 		res, err = stream.Recv()
 		require.NoError(t, err)
-		checkCRL(t, res.Crl, []x509.RevocationListEntry{
+		checkCRL(t, res.GetCrl(), []x509.RevocationListEntry{
 			{
 				SerialNumber:   big.NewInt(170),
 				RevocationTime: revokedAt,
@@ -4040,7 +3960,7 @@ func TestRevocationService_CRL(t *testing.T) {
 		// The client should now receive a new CRL
 		res, err = stream.Recv()
 		require.NoError(t, err)
-		checkCRL(t, res.Crl, []x509.RevocationListEntry{
+		checkCRL(t, res.GetCrl(), []x509.RevocationListEntry{
 			{
 				SerialNumber:   big.NewInt(255),
 				RevocationTime: revokedAt,
@@ -4061,7 +3981,7 @@ func TestRevocationService_CRL(t *testing.T) {
 		// The client should now receive a new CRL
 		res, err = stream.Recv()
 		require.NoError(t, err)
-		checkCRL(t, res.Crl, nil)
+		checkCRL(t, res.GetCrl(), nil)
 
 		// Wait ten minutes to see if the periodic CRL is sent.
 		t.Log("Advancing fake clock to pass the periodic timer")
@@ -4069,7 +3989,7 @@ func TestRevocationService_CRL(t *testing.T) {
 
 		res, err = stream.Recv()
 		require.NoError(t, err)
-		checkCRL(t, res.Crl, nil)
+		checkCRL(t, res.GetCrl(), nil)
 
 		// Cancel the RPC context and check it didn't return an error.
 		cancel()
diff --git a/lib/auth/machineid/workloadidentityv1/x509_overrides_service.go b/lib/auth/machineid/workloadidentityv1/x509_overrides_service.go
index 8c61388d319..ae69646d055 100644
--- a/lib/auth/machineid/workloadidentityv1/x509_overrides_service.go
+++ b/lib/auth/machineid/workloadidentityv1/x509_overrides_service.go
@@ -134,10 +134,10 @@ func (s *X509OverridesService) ListX509IssuerOverrides(ctx context.Context, req
 		return nil, trace.Wrap(err)
 	}
 
-	return &workloadidentityv1pb.ListX509IssuerOverridesResponse{
+	return workloadidentityv1pb.ListX509IssuerOverridesResponse_builder{
 		X509IssuerOverrides: overrides,
 		NextPageToken:       nextPageToken,
-	}, nil
+	}.Build(), nil
 }
 
 // CreateX509IssuerOverride implements [workloadidentityv1pb.X509OverridesServiceServer].
diff --git a/lib/auth/methods.go b/lib/auth/methods.go
index e22909fa63e..6652270e714 100644
--- a/lib/auth/methods.go
+++ b/lib/auth/methods.go
@@ -89,10 +89,10 @@ func (a *Server) AccessCheckerForScope(ctx context.Context, scope string, userSt
 	}
 
 	// set up scope pin (invalid until populated)
-	scopePin := &scopesv1.Pin{
+	scopePin := scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_USER,
 		Scope: scope,
-	}
+	}.Build()
 
 	if userState.IsBot() {
 		botScope, _ := userState.GetLabel(types.BotScopeLabel)
diff --git a/lib/auth/mfa/mfav2/service.go b/lib/auth/mfa/mfav2/service.go
index 75508721900..61ce2e8094d 100644
--- a/lib/auth/mfa/mfav2/service.go
+++ b/lib/auth/mfa/mfav2/service.go
@@ -393,9 +393,9 @@ func (s *Service) ValidateSessionChallenge(
 		mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: mfaResp.GetName(),
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload: mfav2.SessionIdentifyingPayload_builder{
 					SshSessionId: details.Payload.SSHSessionID,
@@ -494,9 +494,9 @@ func (s *Service) ReplicateValidatedMFAChallenge(
 	chal := mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: req.GetName(),
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload:       req.GetPayload(),
 			SourceCluster: req.GetSourceCluster(),
diff --git a/lib/auth/mfa/mfav2/service_test.go b/lib/auth/mfa/mfav2/service_test.go
index 00b09c3ba44..8078e747647 100644
--- a/lib/auth/mfa/mfav2/service_test.go
+++ b/lib/auth/mfa/mfav2/service_test.go
@@ -135,9 +135,9 @@ func TestCreateValidateSessionChallenge_Webauthn(t *testing.T) {
 	wantedChallenge := mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: challengeResp.GetMfaChallenge().GetName(),
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload:       payload,
 			SourceCluster: sourceCluster,
@@ -244,9 +244,9 @@ func TestCreateValidateSessionChallenge_SSO(t *testing.T) {
 	wantedChallenge := mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: challengeResp.GetMfaChallenge().GetName(),
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload:       payload,
 			SourceCluster: sourceCluster,
@@ -666,9 +666,9 @@ func TestListValidatedMFAChallenges_Success(t *testing.T) {
 		mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-challenge-1",
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload:       payload,
 				SourceCluster: sourceCluster,
@@ -679,9 +679,9 @@ func TestListValidatedMFAChallenges_Success(t *testing.T) {
 		mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-challenge-2",
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload:       payload,
 				SourceCluster: sourceCluster,
@@ -692,9 +692,9 @@ func TestListValidatedMFAChallenges_Success(t *testing.T) {
 		mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-challenge-3",
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload:       payload,
 				SourceCluster: sourceCluster,
@@ -802,9 +802,9 @@ func TestListValidatedMFAChallenges_FilterByTargetCluster(t *testing.T) {
 		mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "challenge-for-target-cluster",
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload:       payload,
 				SourceCluster: sourceCluster,
@@ -867,9 +867,9 @@ func TestReplicateValidatedMFAChallenge_Success(t *testing.T) {
 		ReplicatedChallenge: mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: chalName,
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload:       payload,
 				SourceCluster: sourceCluster,
@@ -1118,9 +1118,9 @@ func TestVerifyValidatedMFAChallenge_Success(t *testing.T) {
 		chal := mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: chalName,
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				Payload:       payload,
 				SourceCluster: sourceCluster,
@@ -1166,9 +1166,9 @@ func TestVerifyValidatedMFAChallenge_PayloadMismatch(t *testing.T) {
 	chal := mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: chalName,
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload:       payload,
 			SourceCluster: sourceCluster,
@@ -1203,9 +1203,9 @@ func TestVerifyValidatedMFAChallenge_SourceClusterMismatch(t *testing.T) {
 	chal := mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: chalName,
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload:       payload,
 			SourceCluster: sourceCluster,
diff --git a/lib/auth/notification_test.go b/lib/auth/notification_test.go
index 30fe7620bc4..00868271e8c 100644
--- a/lib/auth/notification_test.go
+++ b/lib/auth/notification_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
@@ -110,130 +111,116 @@ func TestNotificationMatchers(t *testing.T) {
 
 		// A notification targeted at a specific role (managers)
 		{
-			globalNotification: newGlobalNotification("alice-2", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByRoles{
-					ByRoles: &notificationsv1.ByRoles{
-						Roles: []string{"managers"},
-					},
-				},
-			}),
+			globalNotification: newGlobalNotification("alice-2", notificationsv1.GlobalNotificationSpec_builder{
+				ByRoles: notificationsv1.ByRoles_builder{
+					Roles: []string{"managers"},
+				}.Build(),
+			}.Build()),
 		},
 
 		// A notification for everyone
 		{
-			globalNotification: newGlobalNotification("bob-2,alice-3,carol-1", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_All{All: true},
-			}),
+			globalNotification: newGlobalNotification("bob-2,alice-3,carol-1", notificationsv1.GlobalNotificationSpec_builder{
+				All: proto.Bool(true),
+			}.Build()),
 		},
 
 		// A notification targeted to users with specific permissions (create tokens)
 		{
-			globalNotification: newGlobalNotification("carol-2", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								Rules: []types.Rule{
-									{
-										Resources: []string{types.KindToken},
-										Verbs:     []string{types.VerbCreate},
-									},
+			globalNotification: newGlobalNotification("carol-2", notificationsv1.GlobalNotificationSpec_builder{
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							Rules: []types.Rule{
+								{
+									Resources: []string{types.KindToken},
+									Verbs:     []string{types.VerbCreate},
 								},
 							},
 						},
 					},
-				},
-			}),
+				}.Build(),
+			}.Build()),
 		},
 
 		// A notification targeted to users who can review certain access requests
 		{
-			globalNotification: newGlobalNotification("alice-4", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								ReviewRequests: &types.AccessReviewConditions{
-									Roles: []string{"intern"},
-								},
+			globalNotification: newGlobalNotification("alice-4", notificationsv1.GlobalNotificationSpec_builder{
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							ReviewRequests: &types.AccessReviewConditions{
+								Roles: []string{"intern"},
 							},
 						},
 					},
-				},
-			}),
+				}.Build(),
+			}.Build()),
 		},
 
 		// A notification for multiple users (by username)
 		{
-			globalNotification: newGlobalNotification("alice-5,bob-3", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByUsers{
-					ByUsers: &notificationsv1.ByUsers{
-						Users: []string{"alice", "bob"},
-					},
-				},
-			}),
+			globalNotification: newGlobalNotification("alice-5,bob-3", notificationsv1.GlobalNotificationSpec_builder{
+				ByUsers: notificationsv1.ByUsers_builder{
+					Users: []string{"alice", "bob"},
+				}.Build(),
+			}.Build()),
 		},
 
 		// Multiple matchers - logical OR
 		{
-			globalNotification: newGlobalNotification("alice-6,carol-3", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("alice-6,carol-3", notificationsv1.GlobalNotificationSpec_builder{
 				MatchAllConditions: false, // logical OR
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								Logins: []string{"user"},
-							},
-							{
-								Rules: []types.Rule{types.NewRule(types.KindToken, []string{types.VerbUpdate})},
-							},
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							Logins: []string{"user"},
+						},
+						{
+							Rules: []types.Rule{types.NewRule(types.KindToken, []string{types.VerbUpdate})},
 						},
 					},
-				},
-			}),
+				}.Build(),
+			}.Build()),
 		},
 
 		// Multiple matchers - logical AND
 		{
-			globalNotification: newGlobalNotification("nomatches", &notificationsv1.GlobalNotificationSpec{
+			globalNotification: newGlobalNotification("nomatches", notificationsv1.GlobalNotificationSpec_builder{
 				MatchAllConditions: true, // logical AND
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								Logins: []string{"user"},
-							},
-							{
-								Rules: []types.Rule{types.NewRule(types.KindToken, []string{types.VerbUpdate})},
-							},
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							Logins: []string{"user"},
+						},
+						{
+							Rules: []types.Rule{types.NewRule(types.KindToken, []string{types.VerbUpdate})},
 						},
 					},
-				},
-			}),
+				}.Build(),
+			}.Build()),
 		},
 
 		// A notification for everyone but alice.
 		{
-			globalNotification: newGlobalNotification("bob-4,carol-4", &notificationsv1.GlobalNotificationSpec{
-				Matcher:      &notificationsv1.GlobalNotificationSpec_All{All: true},
+			globalNotification: newGlobalNotification("bob-4,carol-4", notificationsv1.GlobalNotificationSpec_builder{
+				All:          proto.Bool(true),
 				ExcludeUsers: []string{"alice"},
-			}),
+			}.Build()),
 		},
 
 		// Multiple logins in a single rule. The notification goes to all users who
 		// have at least one of the logins mentioned here.
 		{
-			globalNotification: newGlobalNotification("alice-7", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								Logins: []string{"user", "fakeuser1", "fakeuser2"},
-							},
+			globalNotification: newGlobalNotification("alice-7", notificationsv1.GlobalNotificationSpec_builder{
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							Logins: []string{"user", "fakeuser1", "fakeuser2"},
 						},
 					},
-				},
-			}),
+				}.Build(),
+			}.Build()),
 		},
 	}
 
@@ -267,10 +254,10 @@ func TestNotificationMatchers(t *testing.T) {
 			require.NoError(t, err)
 			t.Cleanup(func() { client.Close() })
 
-			resp, err := client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 100})
+			resp, err := client.ListNotifications(t.Context(), notificationsv1.ListNotificationsRequest_builder{PageSize: 100}.Build())
 			require.NoError(t, err)
 
-			titles := notificationTitles(resp.Notifications)
+			titles := notificationTitles(resp.GetNotifications())
 			assert.Len(t, titles, test.count)
 
 			for _, title := range titles {
@@ -307,53 +294,53 @@ func TestNotificationStates(t *testing.T) {
 	t.Cleanup(func() { client.Close() })
 
 	// Update bob's last seen timestamp, which should make the bob-0 notification go away.
-	_, err = client.UpsertUserLastSeenNotification(t.Context(), "bob", &notificationsv1.UserLastSeenNotification{
-		Status: &notificationsv1.UserLastSeenNotificationStatus{
+	_, err = client.UpsertUserLastSeenNotification(t.Context(), "bob", notificationsv1.UserLastSeenNotification_builder{
+		Status: notificationsv1.UserLastSeenNotificationStatus_builder{
 			LastSeenTime: created[0].GetSpec().GetCreated(),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// RBAC check - bob should not be able to set last seen time for other users.
-	_, err = client.UpsertUserLastSeenNotification(t.Context(), "alice", &notificationsv1.UserLastSeenNotification{
-		Status: &notificationsv1.UserLastSeenNotificationStatus{
+	_, err = client.UpsertUserLastSeenNotification(t.Context(), "alice", notificationsv1.UserLastSeenNotification_builder{
+		Status: notificationsv1.UserLastSeenNotificationStatus_builder{
 			LastSeenTime: created[0].GetSpec().GetCreated(),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 
 	// Mark notification-1 as dismissed, so it stops showing up.
-	_, err = client.UpsertUserNotificationState(t.Context(), "bob", &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	_, err = client.UpsertUserNotificationState(t.Context(), "bob", notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: created[1].GetMetadata().GetName(),
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Mark notification-2 as clicked. It will still show up.
-	_, err = client.UpsertUserNotificationState(t.Context(), "bob", &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	_, err = client.UpsertUserNotificationState(t.Context(), "bob", notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: created[2].GetMetadata().GetName(),
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	resp, err := client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 10})
+	resp, err := client.ListNotifications(t.Context(), notificationsv1.ListNotificationsRequest_builder{PageSize: 10}.Build())
 	require.NoError(t, err)
 
-	require.Len(t, resp.Notifications, 3)
-	require.Equal(t, []string{"notification-3", "notification-2", "notification-0"}, notificationTitles(resp.Notifications))
+	require.Len(t, resp.GetNotifications(), 3)
+	require.Equal(t, []string{"notification-3", "notification-2", "notification-0"}, notificationTitles(resp.GetNotifications()))
 
-	require.Empty(t, resp.Notifications[0].GetMetadata().GetLabels()[types.NotificationClickedLabel])
-	require.Equal(t, "true", resp.Notifications[1].GetMetadata().GetLabels()[types.NotificationClickedLabel])
-	require.Empty(t, resp.Notifications[2].GetMetadata().GetLabels()[types.NotificationClickedLabel])
+	require.Empty(t, resp.GetNotifications()[0].GetMetadata().GetLabels()[types.NotificationClickedLabel])
+	require.Equal(t, "true", resp.GetNotifications()[1].GetMetadata().GetLabels()[types.NotificationClickedLabel])
+	require.Empty(t, resp.GetNotifications()[2].GetMetadata().GetLabels()[types.NotificationClickedLabel])
 }
 
 func TestNotificationPagination(t *testing.T) {
@@ -383,28 +370,28 @@ func TestNotificationPagination(t *testing.T) {
 	var all []*notificationsv1.Notification
 	var token string
 
-	resp, err := client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 3, PageToken: token})
+	resp, err := client.ListNotifications(t.Context(), notificationsv1.ListNotificationsRequest_builder{PageSize: 3, PageToken: token}.Build())
 	require.NoError(t, err)
-	require.Len(t, resp.Notifications, 3)
-	all = append(all, resp.Notifications...)
-	token = resp.NextPageToken
+	require.Len(t, resp.GetNotifications(), 3)
+	all = append(all, resp.GetNotifications()...)
+	token = resp.GetNextPageToken()
 
-	resp, err = client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 4, PageToken: token})
+	resp, err = client.ListNotifications(t.Context(), notificationsv1.ListNotificationsRequest_builder{PageSize: 4, PageToken: token}.Build())
 	require.NoError(t, err)
-	require.Len(t, resp.Notifications, 4)
-	all = append(all, resp.Notifications...)
-	token = resp.NextPageToken
+	require.Len(t, resp.GetNotifications(), 4)
+	all = append(all, resp.GetNotifications()...)
+	token = resp.GetNextPageToken()
 
-	resp, err = client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 1, PageToken: token})
+	resp, err = client.ListNotifications(t.Context(), notificationsv1.ListNotificationsRequest_builder{PageSize: 1, PageToken: token}.Build())
 	require.NoError(t, err)
-	require.Len(t, resp.Notifications, 1)
-	all = append(all, resp.Notifications...)
-	token = resp.NextPageToken
+	require.Len(t, resp.GetNotifications(), 1)
+	all = append(all, resp.GetNotifications()...)
+	token = resp.GetNextPageToken()
 
-	resp, err = client.ListNotifications(t.Context(), &notificationsv1.ListNotificationsRequest{PageSize: 10, PageToken: token})
+	resp, err = client.ListNotifications(t.Context(), notificationsv1.ListNotificationsRequest_builder{PageSize: 10, PageToken: token}.Build())
 	require.NoError(t, err)
-	require.Len(t, resp.Notifications, 2) // only 2 remaining
-	all = append(all, resp.Notifications...)
+	require.Len(t, resp.GetNotifications(), 2) // only 2 remaining
+	all = append(all, resp.GetNotifications()...)
 
 	require.Len(t, all, 10)
 
@@ -424,31 +411,31 @@ func TestNotificationPagination(t *testing.T) {
 }
 
 func newUserNotification(username string, title string) *notificationsv1.Notification {
-	return &notificationsv1.Notification{
+	return notificationsv1.Notification_builder{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: username,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func newGlobalNotification(title string, spec *notificationsv1.GlobalNotificationSpec) *notificationsv1.GlobalNotification {
-	spec.Notification = &notificationsv1.Notification{
+	spec.SetNotification(notificationsv1.Notification_builder{
 		SubKind: "test-subkind",
 		Spec:    &notificationsv1.NotificationSpec{},
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
-	}
+		}.Build(),
+	}.Build())
 
-	return &notificationsv1.GlobalNotification{Spec: spec}
+	return notificationsv1.GlobalNotification_builder{Spec: spec}.Build()
 }
 
 func mockAuth(t *testing.T) *authtest.TLSServer {
diff --git a/lib/auth/notifications/notificationsv1/service.go b/lib/auth/notifications/notificationsv1/service.go
index de0ddbcd7c4..4460a5706ba 100644
--- a/lib/auth/notifications/notificationsv1/service.go
+++ b/lib/auth/notifications/notificationsv1/service.go
@@ -108,11 +108,11 @@ func NewService(cfg ServiceConfig) (*Service, error) {
 // ListNotifications returns a paginated list of notifications which match the user.
 func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.ListNotificationsRequest) (*notificationsv1.ListNotificationsResponse, error) {
 	labelsMatch := func(resourceLabels map[string]string) bool {
-		if req.Filters == nil || len(req.Filters.Labels) == 0 {
+		if !req.HasFilters() || len(req.GetFilters().GetLabels()) == 0 {
 			// no labels to match against
 			return true
 		}
-		for k, v := range req.Filters.Labels {
+		for k, v := range req.GetFilters().GetLabels() {
 			if resourceLabels[k] != v {
 				return false
 			}
@@ -120,11 +120,11 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 		return true
 	}
 
-	if req.Filters != nil {
-		if req.Filters.GlobalOnly {
+	if req.HasFilters() {
+		if req.GetFilters().GetGlobalOnly() {
 			return s.listGlobalNotifications(ctx, req)
 		}
-		if req.Filters.Username != "" {
+		if req.GetFilters().GetUsername() != "" {
 			return s.listUserSpecificNotificationsForUser(ctx, req)
 		}
 
@@ -146,8 +146,8 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 			return nil, trace.Wrap(err)
 		}
 		for _, notificationState := range notificationStates {
-			if notificationState.Spec != nil && notificationState.Status != nil {
-				notificationStatesMap[notificationState.Spec.NotificationId] = notificationState.Status.GetNotificationState()
+			if notificationState.HasSpec() && notificationState.HasStatus() {
+				notificationStatesMap[notificationState.GetSpec().GetNotificationId()] = notificationState.GetStatus().GetNotificationState()
 			}
 		}
 		if nextKey == "" {
@@ -166,8 +166,8 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 		// Return true if the user hasn't dismissed this notification
 		return notificationStatesMap[n.GetMetadata().GetName()] != notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED
 	}
-	userKey, globalKey, found := strings.Cut(req.PageToken, ",")
-	if !found && req.PageToken != "" {
+	userKey, globalKey, found := strings.Cut(req.GetPageToken(), ",")
+	if !found && req.GetPageToken() != "" {
 		return nil, trace.BadParameter("invalid page token provided")
 	}
 
@@ -222,7 +222,7 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 		},
 		func(globalNotification *notificationsv1.GlobalNotification) *notificationsv1.Notification {
 			notification := globalNotification.GetSpec().GetNotification()
-			notification.Metadata.Name = globalNotification.GetMetadata().GetName()
+			notification.GetMetadata().SetName(globalNotification.GetMetadata().GetName())
 			return notification
 		},
 	)
@@ -234,7 +234,7 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 		if item != nil {
 			notifications = append(notifications, item)
 		}
-		if len(notifications) == int(req.PageSize) {
+		if len(notifications) == int(req.GetPageSize()) {
 			// The nextKeys should represent the next unconsumed items in their respective lists.
 			// If the last item in this page (ie. the current item in the stream) was a user-specific notification,
 			// then the userNotificationsNextKey should be the next item in the userNotifsStream, and
@@ -280,18 +280,18 @@ func (s *Service) ListNotifications(ctx context.Context, req *notificationsv1.Li
 	// Add label to indicate notifications that the user has clicked.
 	for _, notification := range notifications {
 		if (notificationStatesMap[notification.GetMetadata().GetName()]) == notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED {
-			notification.GetMetadata().Labels[types.NotificationClickedLabel] = "true"
+			notification.GetMetadata().GetLabels()[types.NotificationClickedLabel] = "true"
 		}
 	}
 	var nextPageToken string
 	if nextUserKey != "" || nextGlobalKey != "" {
 		nextPageToken = fmt.Sprintf("%s,%s", nextUserKey, nextGlobalKey)
 	}
-	response := &notificationsv1.ListNotificationsResponse{
+	response := notificationsv1.ListNotificationsResponse_builder{
 		Notifications:                     notifications,
 		NextPageToken:                     nextPageToken,
 		UserLastSeenNotificationTimestamp: userLastSeenNotification.GetStatus().GetLastSeenTime(),
-	}
+	}.Build()
 	return response, nil
 }
 
@@ -302,25 +302,25 @@ func (s *Service) matchGlobalNotification(ctx context.Context, authCtx *authz.Co
 	}
 
 	// If the user is explicitly excluded by the notification, return false early.
-	if gn.Spec.ExcludeUsers != nil && slices.Contains(gn.Spec.ExcludeUsers, authCtx.User.GetName()) {
+	if gn.GetSpec().GetExcludeUsers() != nil && slices.Contains(gn.GetSpec().GetExcludeUsers(), authCtx.User.GetName()) {
 		return false
 	}
 
-	switch matcher := gn.Spec.Matcher.(type) {
-	case *notificationsv1.GlobalNotificationSpec_All:
+	switch gn.GetSpec().WhichMatcher() {
+	case notificationsv1.GlobalNotificationSpec_All_case:
 		// Always return true if the matcher is "all."
 		return true
 
-	case *notificationsv1.GlobalNotificationSpec_ByUsers:
-		userList := matcher.ByUsers.GetUsers()
+	case notificationsv1.GlobalNotificationSpec_ByUsers_case:
+		userList := gn.GetSpec().GetByUsers().GetUsers()
 		return slices.Contains(userList, authCtx.User.GetName())
 
-	case *notificationsv1.GlobalNotificationSpec_ByRoles:
-		matcherRoles := matcher.ByRoles.GetRoles()
+	case notificationsv1.GlobalNotificationSpec_ByRoles_case:
+		matcherRoles := gn.GetSpec().GetByRoles().GetRoles()
 		userRoles := authCtx.User.GetRoles()
 
 		// If MatchAllConditions is true, then userRoles must contain every role in matcherRoles.
-		if gn.Spec.MatchAllConditions {
+		if gn.GetSpec().GetMatchAllConditions() {
 			for _, matcherRole := range matcherRoles {
 				// Return false if there is any role missing.
 				if !slices.Contains(userRoles, matcherRole) {
@@ -339,8 +339,8 @@ func (s *Service) matchGlobalNotification(ctx context.Context, authCtx *authz.Co
 
 		return false
 
-	case *notificationsv1.GlobalNotificationSpec_ByPermissions:
-		roleConditionsList := matcher.ByPermissions.GetRoleConditions()
+	case notificationsv1.GlobalNotificationSpec_ByPermissions_case:
+		roleConditionsList := gn.GetSpec().GetByPermissions().GetRoleConditions()
 
 		var results []bool
 		for _, roleConditions := range roleConditionsList {
@@ -351,12 +351,12 @@ func (s *Service) matchGlobalNotification(ctx context.Context, authCtx *authz.Co
 			}
 
 			// If MatchAllConditions is false, we can exit at the first match.
-			if !gn.Spec.MatchAllConditions && match {
+			if !gn.GetSpec().GetMatchAllConditions() && match {
 				return true
 			}
 
 			// If MatchAllConditions is true, we exit at the first non-match.
-			if gn.Spec.MatchAllConditions && !match {
+			if gn.GetSpec().GetMatchAllConditions() && !match {
 				return false
 			}
 
@@ -364,7 +364,7 @@ func (s *Service) matchGlobalNotification(ctx context.Context, authCtx *authz.Co
 		}
 
 		// Return false if any of the roleConditions didn't match.
-		if gn.Spec.MatchAllConditions {
+		if gn.GetSpec().GetMatchAllConditions() {
 			return !slices.Contains(results, false)
 		}
 
@@ -477,10 +477,10 @@ func isMoreRecent(userNotification *notificationsv1.Notification, globalNotifica
 
 // UpsertUserNotificationState creates or updates a user notification state which records whether the user has clicked on or dismissed a notification.
 func (s *Service) UpsertUserNotificationState(ctx context.Context, req *notificationsv1.UpsertUserNotificationStateRequest) (*notificationsv1.UserNotificationState, error) {
-	if req.Username == "" {
+	if req.GetUsername() == "" {
 		return nil, trace.BadParameter("missing username")
 	}
-	if req.UserNotificationState == nil {
+	if !req.HasUserNotificationState() {
 		return nil, trace.BadParameter("missing notification state")
 	}
 
@@ -489,11 +489,11 @@ func (s *Service) UpsertUserNotificationState(ctx context.Context, req *notifica
 		return nil, trace.Wrap(err)
 	}
 	username := authCtx.User.GetName()
-	if username != req.Username {
+	if username != req.GetUsername() {
 		return nil, trace.AccessDenied("a user may only update their own notification state")
 	}
 
-	out, err := s.backend.UpsertUserNotificationState(ctx, req.Username, req.UserNotificationState)
+	out, err := s.backend.UpsertUserNotificationState(ctx, req.GetUsername(), req.GetUserNotificationState())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -503,10 +503,10 @@ func (s *Service) UpsertUserNotificationState(ctx context.Context, req *notifica
 
 // UpsertUserLastSeenNotification creates or updates a user's last seen notification timestamp.
 func (s *Service) UpsertUserLastSeenNotification(ctx context.Context, req *notificationsv1.UpsertUserLastSeenNotificationRequest) (*notificationsv1.UserLastSeenNotification, error) {
-	if req.Username == "" {
+	if req.GetUsername() == "" {
 		return nil, trace.BadParameter("missing username")
 	}
-	if req.UserLastSeenNotification == nil {
+	if !req.HasUserLastSeenNotification() {
 		return nil, trace.BadParameter("missing user last seen notification")
 	}
 
@@ -516,11 +516,11 @@ func (s *Service) UpsertUserLastSeenNotification(ctx context.Context, req *notif
 	}
 
 	username := authCtx.User.GetName()
-	if username != req.Username {
+	if username != req.GetUsername() {
 		return nil, trace.AccessDenied("a user may only update their own last seen notification timestamp")
 	}
 
-	out, err := s.backend.UpsertUserLastSeenNotification(ctx, req.Username, req.UserLastSeenNotification)
+	out, err := s.backend.UpsertUserLastSeenNotification(ctx, req.GetUsername(), req.GetUserLastSeenNotification())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -543,7 +543,7 @@ func (s *Service) CreateGlobalNotification(ctx context.Context, req *notificatio
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := s.backend.CreateGlobalNotification(ctx, req.GlobalNotification)
+	out, err := s.backend.CreateGlobalNotification(ctx, req.GetGlobalNotification())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -553,7 +553,7 @@ func (s *Service) CreateGlobalNotification(ctx context.Context, req *notificatio
 
 // CreateUserNotification creates a user-specific notification.
 func (s *Service) CreateUserNotification(ctx context.Context, req *notificationsv1.CreateUserNotificationRequest) (*notificationsv1.Notification, error) {
-	if req.Username == "" {
+	if req.GetUsername() == "" {
 		return nil, trace.BadParameter("missing username")
 	}
 
@@ -570,7 +570,7 @@ func (s *Service) CreateUserNotification(ctx context.Context, req *notifications
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := s.backend.CreateUserNotification(ctx, req.Notification)
+	out, err := s.backend.CreateUserNotification(ctx, req.GetNotification())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -593,7 +593,7 @@ func (s *Service) DeleteGlobalNotification(ctx context.Context, req *notificatio
 		return nil, trace.Wrap(err)
 	}
 
-	err = s.backend.DeleteGlobalNotification(ctx, req.NotificationId)
+	err = s.backend.DeleteGlobalNotification(ctx, req.GetNotificationId())
 	return nil, trace.Wrap(err)
 }
 
@@ -612,7 +612,7 @@ func (s *Service) DeleteUserNotification(ctx context.Context, req *notifications
 		return nil, trace.Wrap(err)
 	}
 
-	err = s.backend.DeleteUserNotification(ctx, req.Username, req.NotificationId)
+	err = s.backend.DeleteUserNotification(ctx, req.GetUsername(), req.GetNotificationId())
 	return nil, trace.Wrap(err)
 }
 
@@ -625,7 +625,7 @@ func (s *Service) listUserSpecificNotificationsForUser(ctx context.Context, req
 
 	// If no username is provided, fetch notifications for the current user.
 	if req.GetFilters().GetUsername() == "" {
-		req.Filters.Username = authCtx.User.GetName()
+		req.GetFilters().SetUsername(authCtx.User.GetName())
 	}
 
 	// If the user is trying to fetch notifications for a different user, they need `list` permissions for `Notifications`.
@@ -668,10 +668,10 @@ func (s *Service) listUserSpecificNotificationsForUser(ctx context.Context, req
 		}
 	}
 
-	return &notificationsv1.ListNotificationsResponse{
+	return notificationsv1.ListNotificationsResponse_builder{
 		Notifications: notifications,
 		NextPageToken: nextKey,
-	}, nil
+	}.Build(), nil
 }
 
 // listGlobalNotifications returns a paginated list of all global notifications. This is a privileged operation requiring `list` access for `Notifications` and should only be used by cluster admins.
@@ -714,7 +714,7 @@ func (s *Service) listGlobalNotifications(ctx context.Context, req *notification
 		item := stream.Item()
 		if item != nil {
 			notification := item.GetSpec().GetNotification()
-			notification.Metadata.Name = item.GetMetadata().GetName()
+			notification.GetMetadata().SetName(item.GetMetadata().GetName())
 
 			notifications = append(notifications, notification)
 
@@ -725,8 +725,8 @@ func (s *Service) listGlobalNotifications(ctx context.Context, req *notification
 		}
 	}
 
-	return &notificationsv1.ListNotificationsResponse{
+	return notificationsv1.ListNotificationsResponse_builder{
 		Notifications: notifications,
 		NextPageToken: nextKey,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/auth/periodic_test.go b/lib/auth/periodic_test.go
index 7e58ba4e6d8..924f0897c37 100644
--- a/lib/auth/periodic_test.go
+++ b/lib/auth/periodic_test.go
@@ -34,10 +34,10 @@ func TestTotalInstances(t *testing.T) {
 	t.Parallel()
 	instances := []*proto.UpstreamInventoryHello{
 		{},
-		{Version: "15.0.0"},
-		{ServerID: "id"},
-		{ExternalUpgrader: "kube"},
-		{ExternalUpgraderVersion: "14.0.0"},
+		proto.UpstreamInventoryHello_builder{Version: "15.0.0"}.Build(),
+		proto.UpstreamInventoryHello_builder{ServerID: "id"}.Build(),
+		proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube"}.Build(),
+		proto.UpstreamInventoryHello_builder{ExternalUpgraderVersion: "14.0.0"}.Build(),
 	}
 
 	periodic := newInstanceMetricsPeriodic()
@@ -58,11 +58,11 @@ func TestTotalEnrolledInUpgrades(t *testing.T) {
 		{
 			desc: "mixed",
 			instances: []*proto.UpstreamInventoryHello{
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"},
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "14.0.0"},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"},
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube", ExternalUpgraderVersion: "14.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"}.Build(),
 				{},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "14.0.0"},
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit", ExternalUpgraderVersion: "14.0.0"}.Build(),
 				{},
 			},
 			expected: 4,
@@ -70,8 +70,8 @@ func TestTotalEnrolledInUpgrades(t *testing.T) {
 		{
 			desc: "version omitted",
 			instances: []*proto.UpstreamInventoryHello{
-				{ExternalUpgrader: "kube"},
-				{ExternalUpgrader: "unit"},
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit"}.Build(),
 			},
 			expected: 2,
 		},
@@ -110,19 +110,19 @@ func TestUpgraderCounts(t *testing.T) {
 		{
 			desc: "mixed",
 			instances: []*proto.UpstreamInventoryHello{
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0", UpdaterInfo: &types.UpdaterV2Info{
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0", UpdaterInfo: &types.UpdaterV2Info{
 					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
-				}},
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "14.0.0", UpdaterInfo: &types.UpdaterV2Info{
+				}}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube", ExternalUpgraderVersion: "14.0.0", UpdaterInfo: &types.UpdaterV2Info{
 					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
-				}},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0", UpdaterInfo: &types.UpdaterV2Info{
+				}}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0", UpdaterInfo: &types.UpdaterV2Info{
 					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_OK,
-				}},
+				}}.Build(),
 				{},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "14.0.0", UpdaterInfo: &types.UpdaterV2Info{
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit", ExternalUpgraderVersion: "14.0.0", UpdaterInfo: &types.UpdaterV2Info{
 					UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_PINNED,
-				}},
+				}}.Build(),
 				{},
 			},
 			expected: map[upgrader]int{
@@ -143,10 +143,10 @@ func TestUpgraderCounts(t *testing.T) {
 		{
 			desc: "all-enrolled",
 			instances: []*proto.UpstreamInventoryHello{
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"},
-				{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"},
-				{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"},
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube", ExternalUpgraderVersion: "13.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit", ExternalUpgraderVersion: "13.0.0"}.Build(),
 			},
 			expected: map[upgrader]int{
 				{"kube", "13.0.0", ""}: 2,
@@ -156,8 +156,8 @@ func TestUpgraderCounts(t *testing.T) {
 		{
 			desc: "nil version",
 			instances: []*proto.UpstreamInventoryHello{
-				{ExternalUpgrader: "kube"},
-				{ExternalUpgrader: "unit"},
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "kube"}.Build(),
+				proto.UpstreamInventoryHello_builder{ExternalUpgrader: "unit"}.Build(),
 			},
 			expected: map[upgrader]int{
 				{"kube", "", ""}: 1,
@@ -206,10 +206,10 @@ func TestInstallMethodCounts(t *testing.T) {
 		{
 			desc: "various install methods",
 			metadata: []*proto.UpstreamInventoryAgentMetadata{
-				{InstallMethods: []string{"systemctl"}},
-				{InstallMethods: []string{"systemctl"}},
-				{InstallMethods: []string{"helm_kube_agent"}},
-				{InstallMethods: []string{"dockerfile"}},
+				proto.UpstreamInventoryAgentMetadata_builder{InstallMethods: []string{"systemctl"}}.Build(),
+				proto.UpstreamInventoryAgentMetadata_builder{InstallMethods: []string{"systemctl"}}.Build(),
+				proto.UpstreamInventoryAgentMetadata_builder{InstallMethods: []string{"helm_kube_agent"}}.Build(),
+				proto.UpstreamInventoryAgentMetadata_builder{InstallMethods: []string{"dockerfile"}}.Build(),
 			},
 			expected: map[string]int{
 				"systemctl":       2,
@@ -220,8 +220,8 @@ func TestInstallMethodCounts(t *testing.T) {
 		{
 			desc: "multiple install methods",
 			metadata: []*proto.UpstreamInventoryAgentMetadata{
-				{InstallMethods: []string{"dockerfile", "helm_kube_agent"}},
-				{InstallMethods: []string{"helm_kube_agent", "dockerfile"}},
+				proto.UpstreamInventoryAgentMetadata_builder{InstallMethods: []string{"dockerfile", "helm_kube_agent"}}.Build(),
+				proto.UpstreamInventoryAgentMetadata_builder{InstallMethods: []string{"helm_kube_agent", "dockerfile"}}.Build(),
 			},
 			expected: map[string]int{
 				"dockerfile,helm_kube_agent": 2,
@@ -255,9 +255,9 @@ func TestRegisteredAgentsCounts(t *testing.T) {
 		{
 			desc: "automatic updates disabled",
 			instance: []*proto.UpstreamInventoryHello{
-				{Version: "13.0.0"},
-				{Version: "14.0.0"},
-				{Version: "15.0.0"},
+				proto.UpstreamInventoryHello_builder{Version: "13.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "14.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "15.0.0"}.Build(),
 			},
 			expected: map[registeredAgent]int{
 				{runtime.GOOS, "13.0.0", "false"}: 1,
@@ -268,15 +268,15 @@ func TestRegisteredAgentsCounts(t *testing.T) {
 		{
 			desc: "automatic updates enabled",
 			instance: []*proto.UpstreamInventoryHello{
-				{Version: "13.0.0", ExternalUpgrader: "unit"},
-				{Version: "13.0.0", ExternalUpgrader: "kube"},
-				{Version: "13.0.0"},
-				{Version: "14.0.0", ExternalUpgrader: "unit"},
-				{Version: "14.0.0", ExternalUpgrader: "kube"},
-				{Version: "14.0.0"},
-				{Version: "15.0.0", ExternalUpgrader: "unit"},
-				{Version: "15.0.0", ExternalUpgrader: "kube"},
-				{Version: "15.0.0"},
+				proto.UpstreamInventoryHello_builder{Version: "13.0.0", ExternalUpgrader: "unit"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "13.0.0", ExternalUpgrader: "kube"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "13.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "14.0.0", ExternalUpgrader: "unit"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "14.0.0", ExternalUpgrader: "kube"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "14.0.0"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "15.0.0", ExternalUpgrader: "unit"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "15.0.0", ExternalUpgrader: "kube"}.Build(),
+				proto.UpstreamInventoryHello_builder{Version: "15.0.0"}.Build(),
 			},
 			expected: map[registeredAgent]int{
 				{runtime.GOOS, "13.0.0", "true"}:  2,
@@ -293,9 +293,9 @@ func TestRegisteredAgentsCounts(t *testing.T) {
 			periodic := newInstanceMetricsPeriodic()
 
 			for _, instance := range tt.instance {
-				periodic.VisitInstance(instance, &proto.UpstreamInventoryAgentMetadata{
+				periodic.VisitInstance(instance, proto.UpstreamInventoryAgentMetadata_builder{
 					OS: runtime.GOOS,
-				})
+				}.Build())
 			}
 			require.Equal(t, tt.expected, periodic.RegisteredAgentsCount(), "tt=%q", tt.desc)
 		})
diff --git a/lib/auth/presence/presencev1/service.go b/lib/auth/presence/presencev1/service.go
index e4a559f40a0..24a4fbd4878 100644
--- a/lib/auth/presence/presencev1/service.go
+++ b/lib/auth/presence/presencev1/service.go
@@ -137,7 +137,7 @@ func NewService(cfg ServiceConfig) (*Service, error) {
 func (s *Service) GetRemoteCluster(
 	ctx context.Context, req *presencepb.GetRemoteClusterRequest,
 ) (*types.RemoteClusterV3, error) {
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be specified")
 	}
 
@@ -149,7 +149,7 @@ func (s *Service) GetRemoteCluster(
 		return nil, trace.Wrap(err)
 	}
 
-	rc, err := s.backend.GetRemoteCluster(ctx, req.Name)
+	rc, err := s.backend.GetRemoteCluster(ctx, req.GetName())
 	if err != nil {
 		return nil, utils.OpaqueAccessDenied(err)
 	}
@@ -184,7 +184,7 @@ func (s *Service) ListRemoteClusters(
 	}
 
 	page, nextToken, err := s.backend.ListRemoteClusters(
-		ctx, int(req.PageSize), req.PageToken,
+		ctx, int(req.GetPageSize()), req.GetPageToken(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -217,10 +217,10 @@ func (s *Service) ListRemoteClusters(
 		filteredPage = append(filteredPage, rc)
 	}
 
-	return &presencepb.ListRemoteClustersResponse{
+	return presencepb.ListRemoteClustersResponse_builder{
 		RemoteClusters: filteredPage,
 		NextPageToken:  nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // UpdateRemoteCluster updates a remote cluster.
@@ -228,9 +228,9 @@ func (s *Service) UpdateRemoteCluster(
 	ctx context.Context, req *presencepb.UpdateRemoteClusterRequest,
 ) (*types.RemoteClusterV3, error) {
 	switch {
-	case req.RemoteCluster == nil:
+	case !req.HasRemoteCluster():
 		return nil, trace.BadParameter("remote_cluster: must not be nil")
-	case req.RemoteCluster.GetName() == "":
+	case req.GetRemoteCluster().GetName() == "":
 		return nil, trace.BadParameter("remote_cluster.Metadata.Name: must be non-empty")
 	}
 
@@ -247,7 +247,7 @@ func (s *Service) UpdateRemoteCluster(
 
 	// If the update mask is empty, update the entire remote cluster.
 	if len(req.GetUpdateMask().GetPaths()) == 0 {
-		rc, err := s.backend.UpdateRemoteCluster(ctx, req.RemoteCluster)
+		rc, err := s.backend.UpdateRemoteCluster(ctx, req.GetRemoteCluster())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -266,23 +266,23 @@ func (s *Service) UpdateRemoteCluster(
 	// Otherwise, we apply the update mask to the current remote cluster using
 	// a patch operation.
 	req.GetUpdateMask().Normalize()
-	rc, err := s.backend.PatchRemoteCluster(ctx, req.RemoteCluster.GetName(), func(rc types.RemoteCluster) (types.RemoteCluster, error) {
+	rc, err := s.backend.PatchRemoteCluster(ctx, req.GetRemoteCluster().GetName(), func(rc types.RemoteCluster) (types.RemoteCluster, error) {
 		for _, path := range req.GetUpdateMask().GetPaths() {
 			switch path {
 			case "Metadata.Labels":
 				md := rc.GetMetadata()
-				md.Labels = req.RemoteCluster.GetMetadata().Labels
+				md.Labels = req.GetRemoteCluster().GetMetadata().Labels
 				rc.SetMetadata(md)
 			case "Metadata.Description":
 				md := rc.GetMetadata()
-				md.Description = req.RemoteCluster.GetMetadata().Description
+				md.Description = req.GetRemoteCluster().GetMetadata().Description
 				rc.SetMetadata(md)
 			case "Metadata.Expires":
-				rc.SetExpiry(req.RemoteCluster.Expiry())
+				rc.SetExpiry(req.GetRemoteCluster().Expiry())
 			case "Status.Connection":
-				rc.SetConnectionStatus(req.RemoteCluster.GetConnectionStatus())
+				rc.SetConnectionStatus(req.GetRemoteCluster().GetConnectionStatus())
 			case "Status.LastHeartbeat":
-				rc.SetLastHeartbeat(req.RemoteCluster.GetLastHeartbeat())
+				rc.SetLastHeartbeat(req.GetRemoteCluster().GetLastHeartbeat())
 			default:
 				return nil, trace.BadParameter("unsupported field: %q", path)
 			}
@@ -309,7 +309,7 @@ func (s *Service) UpdateRemoteCluster(
 func (s *Service) DeleteRemoteCluster(
 	ctx context.Context, req *presencepb.DeleteRemoteClusterRequest,
 ) (*emptypb.Empty, error) {
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be specified")
 	}
 
@@ -326,7 +326,7 @@ func (s *Service) DeleteRemoteCluster(
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.authServer.DeleteRemoteCluster(ctx, req.Name); err != nil {
+	if err := s.authServer.DeleteRemoteCluster(ctx, req.GetName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -346,7 +346,7 @@ func (s *Service) ListReverseTunnels(
 	}
 
 	page, nextToken, err := s.cache.ListReverseTunnels(
-		ctx, int(req.PageSize), req.PageToken,
+		ctx, int(req.GetPageSize()), req.GetPageToken(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -367,10 +367,10 @@ func (s *Service) ListReverseTunnels(
 		concretePage = append(concretePage, v3)
 	}
 
-	return &presencepb.ListReverseTunnelsResponse{
+	return presencepb.ListReverseTunnelsResponse_builder{
 		ReverseTunnels: concretePage,
 		NextPageToken:  nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // UpsertReverseTunnel upserts a reverse tunnel.
@@ -385,15 +385,15 @@ func (s *Service) UpsertReverseTunnel(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.ReverseTunnel == nil {
+	if !req.HasReverseTunnel() {
 		return nil, trace.BadParameter("reverse_tunnel: must not be nil")
 	}
 
-	if err := services.ValidateReverseTunnel(req.ReverseTunnel); err != nil {
+	if err := services.ValidateReverseTunnel(req.GetReverseTunnel()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	res, err := s.backend.UpsertReverseTunnel(ctx, req.ReverseTunnel)
+	res, err := s.backend.UpsertReverseTunnel(ctx, req.GetReverseTunnel())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -417,11 +417,11 @@ func (s *Service) DeleteReverseTunnel(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be specified")
 	}
 
-	return nil, trace.Wrap(s.backend.DeleteReverseTunnel(ctx, req.Name))
+	return nil, trace.Wrap(s.backend.DeleteReverseTunnel(ctx, req.GetName()))
 }
 
 // GetRelayServer implements [presencepb.PresenceServiceServer].
@@ -439,9 +439,9 @@ func (s *Service) GetRelayServer(ctx context.Context, req *presencepb.GetRelaySe
 		return nil, trace.Wrap(err)
 	}
 
-	return &presencepb.GetRelayServerResponse{
+	return presencepb.GetRelayServerResponse_builder{
 		RelayServer: relayServer,
-	}, nil
+	}.Build(), nil
 }
 
 // ListRelayServers implements [presencepb.PresenceServiceServer].
@@ -459,10 +459,10 @@ func (s *Service) ListRelayServers(ctx context.Context, req *presencepb.ListRela
 		return nil, trace.Wrap(err)
 	}
 
-	return &presencepb.ListRelayServersResponse{
+	return presencepb.ListRelayServersResponse_builder{
 		Relays:        relayServers,
 		NextPageToken: nextPageToken,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteRelayServer implements [presencepb.PresenceServiceServer].
@@ -523,9 +523,9 @@ func (s *Service) UpsertProxyServer(
 	if !ok {
 		return nil, trace.BadParameter("unsupported proxy server type %T", upserted)
 	}
-	return &presencepb.UpsertProxyServerResponse{
+	return presencepb.UpsertProxyServerResponse_builder{
 		Server: upsertedV2,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteProxyServer deletes a proxy server heartbeat by name.
@@ -540,7 +540,7 @@ func (s *Service) DeleteProxyServer(
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("name: must be specified")
 	}
 
diff --git a/lib/auth/presence/presencev1/service_test.go b/lib/auth/presence/presencev1/service_test.go
index f6cba809d38..c2f1f3ac3e0 100644
--- a/lib/auth/presence/presencev1/service_test.go
+++ b/lib/auth/presence/presencev1/service_test.go
@@ -142,18 +142,18 @@ func TestGetRemoteCluster(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.GetRemoteClusterRequest{
+			req: presencev1pb.GetRemoteClusterRequest_builder{
 				Name: matchingRC.GetName(),
-			},
+			}.Build(),
 			assertError: require.NoError,
 			want:        matchingRC.(*types.RemoteClusterV3),
 		},
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.GetRemoteClusterRequest{
+			req: presencev1pb.GetRemoteClusterRequest_builder{
 				Name: matchingRC.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -161,9 +161,9 @@ func TestGetRemoteCluster(t *testing.T) {
 		{
 			name: "no permissions - unmatching rc",
 			user: user.GetName(),
-			req: &presencev1pb.GetRemoteClusterRequest{
+			req: presencev1pb.GetRemoteClusterRequest_builder{
 				Name: notMatchingRC.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				// Opaque no permission presents as not found
 				require.True(t, trace.IsNotFound(err), "error should be not found")
@@ -172,9 +172,9 @@ func TestGetRemoteCluster(t *testing.T) {
 		{
 			name: "validation - no name",
 			user: user.GetName(),
-			req: &presencev1pb.GetRemoteClusterRequest{
+			req: presencev1pb.GetRemoteClusterRequest_builder{
 				Name: "",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "must be specified")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -183,9 +183,9 @@ func TestGetRemoteCluster(t *testing.T) {
 		{
 			name: "doesnt exist",
 			user: user.GetName(),
-			req: &presencev1pb.GetRemoteClusterRequest{
+			req: presencev1pb.GetRemoteClusterRequest_builder{
 				Name: "non-existent",
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
@@ -209,13 +209,13 @@ func TestGetRemoteCluster(t *testing.T) {
 		client, err := srv.NewClient(authtest.TestUser(user.GetName()))
 		require.NoError(t, err)
 
-		_, doesntExistError := client.PresenceServiceClient().GetRemoteCluster(ctx, &presencev1pb.GetRemoteClusterRequest{
+		_, doesntExistError := client.PresenceServiceClient().GetRemoteCluster(ctx, presencev1pb.GetRemoteClusterRequest_builder{
 			Name: "non-existent",
-		})
+		}.Build())
 		require.Error(t, doesntExistError)
-		_, noPermissionsError := client.PresenceServiceClient().GetRemoteCluster(ctx, &presencev1pb.GetRemoteClusterRequest{
+		_, noPermissionsError := client.PresenceServiceClient().GetRemoteCluster(ctx, presencev1pb.GetRemoteClusterRequest_builder{
 			Name: notMatchingRC.GetName(),
-		})
+		}.Build())
 		require.Error(t, noPermissionsError)
 
 		require.Equal(t, doesntExistError.Error(), noPermissionsError.Error(),
@@ -304,12 +304,12 @@ func TestListRemoteClusters(t *testing.T) {
 			user:        user.GetName(),
 			req:         &presencev1pb.ListRemoteClustersRequest{},
 			assertError: require.NoError,
-			want: &presencev1pb.ListRemoteClustersResponse{
+			want: presencev1pb.ListRemoteClustersResponse_builder{
 				RemoteClusters: []*types.RemoteClusterV3{
 					matchingRC.(*types.RemoteClusterV3),
 					matchingRC2.(*types.RemoteClusterV3),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "no permissions",
@@ -383,18 +383,18 @@ func TestDeleteRemoteCluster(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.DeleteRemoteClusterRequest{
+			req: presencev1pb.DeleteRemoteClusterRequest_builder{
 				Name: rc.GetName(),
-			},
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 		},
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.DeleteRemoteClusterRequest{
+			req: presencev1pb.DeleteRemoteClusterRequest_builder{
 				Name: rc.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -402,9 +402,9 @@ func TestDeleteRemoteCluster(t *testing.T) {
 		{
 			name: "non existent",
 			user: user.GetName(),
-			req: &presencev1pb.DeleteRemoteClusterRequest{
+			req: presencev1pb.DeleteRemoteClusterRequest_builder{
 				Name: rc.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
@@ -418,7 +418,7 @@ func TestDeleteRemoteCluster(t *testing.T) {
 			_, err = client.PresenceServiceClient().DeleteRemoteCluster(ctx, tt.req)
 			tt.assertError(t, err)
 			if tt.checkResourcesDeleted {
-				_, err := srv.Auth().GetRemoteCluster(ctx, tt.req.Name)
+				_, err := srv.Auth().GetRemoteCluster(ctx, tt.req.GetName())
 				require.True(t, trace.IsNotFound(err), "rc should be deleted")
 			}
 		})
@@ -483,7 +483,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.UpdateRemoteClusterRequest{
+			req: presencev1pb.UpdateRemoteClusterRequest_builder{
 				RemoteCluster: &types.RemoteClusterV3{
 					Kind:    types.KindRemoteCluster,
 					Version: types.V3,
@@ -499,7 +499,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 					},
 				},
 				UpdateMask: nil,
-			},
+			}.Build(),
 
 			assertError: require.NoError,
 			want: &types.RemoteClusterV3{
@@ -520,7 +520,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		{
 			name: "patch success",
 			user: user.GetName(),
-			req: &presencev1pb.UpdateRemoteClusterRequest{
+			req: presencev1pb.UpdateRemoteClusterRequest_builder{
 				RemoteCluster: &types.RemoteClusterV3{
 					Kind:    types.KindRemoteCluster,
 					Version: types.V3,
@@ -546,7 +546,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 						"Status.LastHeartbeat",
 					},
 				},
-			},
+			}.Build(),
 
 			assertError: require.NoError,
 			want: &types.RemoteClusterV3{
@@ -570,7 +570,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		{
 			name: "partial patch success",
 			user: user.GetName(),
-			req: &presencev1pb.UpdateRemoteClusterRequest{
+			req: presencev1pb.UpdateRemoteClusterRequest_builder{
 				RemoteCluster: &types.RemoteClusterV3{
 					Kind:    types.KindRemoteCluster,
 					Version: types.V3,
@@ -592,7 +592,7 @@ func TestUpdateRemoteCluster(t *testing.T) {
 						"Status.LastHeartbeat",
 					},
 				},
-			},
+			}.Build(),
 
 			assertError: require.NoError,
 			want: &types.RemoteClusterV3{
@@ -611,13 +611,13 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.UpdateRemoteClusterRequest{
+			req: presencev1pb.UpdateRemoteClusterRequest_builder{
 				RemoteCluster: &types.RemoteClusterV3{
 					Metadata: types.Metadata{
 						Name: rc.GetName(),
 					},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -625,10 +625,10 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		{
 			name: "validation - nil rc",
 			user: user.GetName(),
-			req: &presencev1pb.UpdateRemoteClusterRequest{
+			req: presencev1pb.UpdateRemoteClusterRequest_builder{
 				RemoteCluster: nil,
 				UpdateMask:    nil,
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "remote_cluster: must not be nil")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -637,14 +637,14 @@ func TestUpdateRemoteCluster(t *testing.T) {
 		{
 			name: "validation - no name",
 			user: user.GetName(),
-			req: &presencev1pb.UpdateRemoteClusterRequest{
+			req: presencev1pb.UpdateRemoteClusterRequest_builder{
 				RemoteCluster: &types.RemoteClusterV3{
 					Metadata: types.Metadata{
 						Name: "",
 					},
 				},
 				UpdateMask: nil,
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "remote_cluster.Metadata.Name: must be non-empty")
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
@@ -732,9 +732,9 @@ func TestListReverseTunnels(t *testing.T) {
 			user:        user.GetName(),
 			req:         &presencev1pb.ListReverseTunnelsRequest{},
 			assertError: require.NoError,
-			want: &presencev1pb.ListReverseTunnelsResponse{
+			want: presencev1pb.ListReverseTunnelsResponse_builder{
 				ReverseTunnels: created,
-			},
+			}.Build(),
 		},
 		{
 			name: "no permissions",
@@ -838,18 +838,18 @@ func TestDeleteReverseTunnel(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.DeleteReverseTunnelRequest{
+			req: presencev1pb.DeleteReverseTunnelRequest_builder{
 				Name: rt.GetName(),
-			},
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 		},
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.DeleteReverseTunnelRequest{
+			req: presencev1pb.DeleteReverseTunnelRequest_builder{
 				Name: rt.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -857,9 +857,9 @@ func TestDeleteReverseTunnel(t *testing.T) {
 		{
 			name: "non existent",
 			user: user.GetName(),
-			req: &presencev1pb.DeleteReverseTunnelRequest{
+			req: presencev1pb.DeleteReverseTunnelRequest_builder{
 				Name: rt.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
@@ -873,7 +873,7 @@ func TestDeleteReverseTunnel(t *testing.T) {
 			_, err = client.PresenceServiceClient().DeleteReverseTunnel(ctx, tt.req)
 			tt.assertError(t, err)
 			if tt.checkResourcesDeleted {
-				_, err := srv.Auth().GetReverseTunnel(ctx, tt.req.Name)
+				_, err := srv.Auth().GetReverseTunnel(ctx, tt.req.GetName())
 				require.True(t, trace.IsNotFound(err), "rt should be deleted")
 			}
 		})
@@ -920,18 +920,18 @@ func TestDeleteProxyServer(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.DeleteProxyServerRequest{
+			req: presencev1pb.DeleteProxyServerRequest_builder{
 				Name: proxy.GetName(),
-			},
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourcesDeleted: true,
 		},
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.DeleteProxyServerRequest{
+			req: presencev1pb.DeleteProxyServerRequest_builder{
 				Name: proxy.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -939,9 +939,9 @@ func TestDeleteProxyServer(t *testing.T) {
 		{
 			name: "non existent",
 			user: user.GetName(),
-			req: &presencev1pb.DeleteProxyServerRequest{
+			req: presencev1pb.DeleteProxyServerRequest_builder{
 				Name: proxy.GetName(),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsNotFound(err), "error should be not found")
 			},
@@ -966,7 +966,7 @@ func TestDeleteProxyServer(t *testing.T) {
 				proxies, err := stream.Collect(clientutils.Resources(ctx, srv.Auth().ListProxyServers))
 				require.NoError(t, err)
 				for _, p := range proxies {
-					require.NotEqual(t, tt.req.Name, p.GetName(), "proxy should be deleted")
+					require.NotEqual(t, tt.req.GetName(), p.GetName(), "proxy should be deleted")
 				}
 			}
 		})
@@ -1014,18 +1014,18 @@ func TestUpsertProxyServer(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.UpsertProxyServerRequest{
+			req: presencev1pb.UpsertProxyServerRequest_builder{
 				Server: proxy.(*types.ServerV2),
-			},
+			}.Build(),
 			assertError:           require.NoError,
 			checkResourceUpserted: true,
 		},
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.UpsertProxyServerRequest{
+			req: presencev1pb.UpsertProxyServerRequest_builder{
 				Server: proxy.(*types.ServerV2),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -1041,7 +1041,7 @@ func TestUpsertProxyServer(t *testing.T) {
 		{
 			name: "validation failure - blank name",
 			user: user.GetName(),
-			req: &presencev1pb.UpsertProxyServerRequest{
+			req: presencev1pb.UpsertProxyServerRequest_builder{
 				Server: &types.ServerV2{
 					Kind:    types.KindProxy,
 					Version: types.V2,
@@ -1049,7 +1049,7 @@ func TestUpsertProxyServer(t *testing.T) {
 						Name: "",
 					},
 				},
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
 			},
@@ -1067,7 +1067,7 @@ func TestUpsertProxyServer(t *testing.T) {
 				require.NoError(t, err)
 				var found bool
 				for _, p := range proxies {
-					if p.GetName() == tt.req.Server.GetName() {
+					if p.GetName() == tt.req.GetServer().GetName() {
 						found = true
 						break
 					}
@@ -1118,18 +1118,18 @@ func TestUpsertReverseTunnel(t *testing.T) {
 		{
 			name: "success",
 			user: user.GetName(),
-			req: &presencev1pb.UpsertReverseTunnelRequest{
+			req: presencev1pb.UpsertReverseTunnelRequest_builder{
 				ReverseTunnel: rt.(*types.ReverseTunnelV2),
-			},
+			}.Build(),
 			assertError: require.NoError,
 			want:        rt.(*types.ReverseTunnelV2),
 		},
 		{
 			name: "no permissions",
 			user: unprivilegedUser.GetName(),
-			req: &presencev1pb.UpsertReverseTunnelRequest{
+			req: presencev1pb.UpsertReverseTunnelRequest_builder{
 				ReverseTunnel: rt.(*types.ReverseTunnelV2),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsAccessDenied(err), "error should be access denied")
 			},
@@ -1137,9 +1137,9 @@ func TestUpsertReverseTunnel(t *testing.T) {
 		{
 			name: "no value",
 			user: user.GetName(),
-			req: &presencev1pb.UpsertReverseTunnelRequest{
+			req: presencev1pb.UpsertReverseTunnelRequest_builder{
 				ReverseTunnel: nil,
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.True(t, trace.IsBadParameter(err), "error should be bad parameter")
 			},
@@ -1147,9 +1147,9 @@ func TestUpsertReverseTunnel(t *testing.T) {
 		{
 			name: "validation - invalid",
 			user: user.GetName(),
-			req: &presencev1pb.UpsertReverseTunnelRequest{
+			req: presencev1pb.UpsertReverseTunnelRequest_builder{
 				ReverseTunnel: invalid.(*types.ReverseTunnelV2),
-			},
+			}.Build(),
 			assertError: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "failed to parse")
 			},
diff --git a/lib/auth/recordingencryption/manager.go b/lib/auth/recordingencryption/manager.go
index 81213048687..49f78cb6659 100644
--- a/lib/auth/recordingencryption/manager.go
+++ b/lib/auth/recordingencryption/manager.go
@@ -223,17 +223,17 @@ func (m *Manager) ensureManualEncryptionKeys(ctx context.Context, manualKeyCfg t
 			return nil, trace.Wrap(err)
 		}
 
-		encryptionKeys = append(encryptionKeys, &recordingencryptionv1.KeyPair{
+		encryptionKeys = append(encryptionKeys, recordingencryptionv1.KeyPair_builder{
 			KeyPair: &types.EncryptionKeyPair{
 				PublicKey: pubKey,
 			},
-		})
+		}.Build())
 	}
-	return &recordingencryptionv1.RecordingEncryption{
-		Spec: &recordingencryptionv1.RecordingEncryptionSpec{
+	return recordingencryptionv1.RecordingEncryption_builder{
+		Spec: recordingencryptionv1.RecordingEncryptionSpec_builder{
 			ActiveKeyPairs: encryptionKeys,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 // ensureActiveKeyPair checks that there is at least one accessible key in the list of active pairs given.
@@ -243,14 +243,14 @@ func (m *Manager) ensureActiveKeyPair(ctx context.Context, activePairs []*record
 	var foundActiveKey bool
 	if len(activePairs) > 0 {
 		for _, pair := range activePairs {
-			if pair.State != recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE {
+			if pair.GetState() != recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE {
 				continue
 			}
 
 			foundActiveKey = true
 			// fetch the decrypter to ensure we have access to it
-			if _, err := m.keyStore.GetDecrypter(ctx, pair.KeyPair); err != nil {
-				fp, _ := fingerprintPEM(pair.KeyPair.PublicKey)
+			if _, err := m.keyStore.GetDecrypter(ctx, pair.GetKeyPair()); err != nil {
+				fp, _ := fingerprintPEM(pair.GetKeyPair().PublicKey)
 				m.logger.DebugContext(ctx, "key not accessible", "fingerprint", fp)
 				continue
 			}
@@ -273,10 +273,10 @@ func (m *Manager) ensureActiveKeyPair(ctx context.Context, activePairs []*record
 	fp, _ := fingerprintPEM(encryptionPair.PublicKey)
 	m.logger.InfoContext(ctx, "no active encryption keys, generated new pair", "public_fingerprint", fp)
 
-	return append(activePairs, &recordingencryptionv1.KeyPair{
+	return append(activePairs, recordingencryptionv1.KeyPair_builder{
 		KeyPair: encryptionPair,
 		State:   recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE,
-	}), true, nil
+	}.Build()), true, nil
 }
 
 // resolveRecordingEncryption returns the configured [RecordingEncryption] resource if it exists with an
@@ -310,9 +310,9 @@ func (m *Manager) resolveRecordingEncryption(ctx context.Context, sessionRecordi
 			if !trace.IsNotFound(err) {
 				return nil, trace.Wrap(err)
 			}
-			encryption = &recordingencryptionv1.RecordingEncryption{
+			encryption = recordingencryptionv1.RecordingEncryption_builder{
 				Spec: &recordingencryptionv1.RecordingEncryptionSpec{},
-			}
+			}.Build()
 			persistFn = m.RecordingEncryption.CreateRecordingEncryption
 		}
 	}
@@ -326,7 +326,7 @@ func (m *Manager) resolveRecordingEncryption(ctx context.Context, sessionRecordi
 		return encryption, nil
 	}
 
-	encryption.Spec.ActiveKeyPairs = activePairs
+	encryption.GetSpec().SetActiveKeyPairs(activePairs)
 	encryption, err = persistFn(ctx, encryption)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -355,7 +355,7 @@ func (m *Manager) findDecrypter(ctx context.Context, fingerprint string) (crypto
 			continue
 		}
 
-		activeFP, err := fingerprintPEM(key.KeyPair.PublicKey)
+		activeFP, err := fingerprintPEM(key.GetKeyPair().PublicKey)
 		if err != nil {
 			m.logger.ErrorContext(ctx, "failed to fingerprint active public key", "error", err)
 			continue
@@ -365,7 +365,7 @@ func (m *Manager) findDecrypter(ctx context.Context, fingerprint string) (crypto
 			continue
 		}
 
-		decrypter, err := m.keyStore.GetDecrypter(ctx, key.KeyPair)
+		decrypter, err := m.keyStore.GetDecrypter(ctx, key.GetKeyPair())
 		if err != nil {
 			continue
 		}
@@ -457,7 +457,7 @@ func (m *Manager) RotateKey(ctx context.Context) error {
 		return trace.NotFound("no active key present to rotate")
 	}
 
-	activePair.State = recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING
+	activePair.SetState(recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING)
 	if _, err := m.modifyRecordingEncryption(ctx, encryption); err != nil {
 		return trace.Wrap(err)
 	}
@@ -501,7 +501,7 @@ func (m *Manager) CompleteRotation(ctx context.Context) error {
 		}
 	}
 
-	encryption.Spec.ActiveKeyPairs = remainingPairs
+	encryption.GetSpec().SetActiveKeyPairs(remainingPairs)
 	if _, err := m.modifyRecordingEncryption(ctx, encryption); err != nil {
 		return trace.Wrap(err)
 	}
@@ -530,7 +530,7 @@ func (m *Manager) RollbackRotation(ctx context.Context) error {
 	var rollbackPairs []*recordingencryptionv1.KeyPair
 	for _, pair := range activePairs {
 		if pair.GetState() == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING {
-			pair.State = recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE
+			pair.SetState(recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE)
 			rollbackPairs = append(rollbackPairs, pair)
 		}
 	}
@@ -539,7 +539,7 @@ func (m *Manager) RollbackRotation(ctx context.Context) error {
 		return trace.BadParameter("skipping rollback that would remove all encryption keys")
 	}
 
-	encryption.Spec.ActiveKeyPairs = rollbackPairs
+	encryption.GetSpec().SetActiveKeyPairs(rollbackPairs)
 	if _, err := m.modifyRecordingEncryption(ctx, encryption); err != nil {
 		return trace.Wrap(err)
 	}
@@ -575,10 +575,10 @@ func (m *Manager) GetRotationState(ctx context.Context) ([]*recordingencryptionv
 			return nil, trace.Wrap(err)
 		}
 
-		states = append(states, &recordingencryptionv1.FingerprintWithState{
+		states = append(states, recordingencryptionv1.FingerprintWithState_builder{
 			Fingerprint: fingerprint,
 			State:       pair.GetState(),
-		})
+		}.Build())
 	}
 
 	return states, nil
@@ -746,12 +746,12 @@ func (m *Manager) resolveRecordingEncryptionState(ctx context.Context, shouldRet
 func getAgeEncryptionKeys(keys []*recordingencryptionv1.KeyPair) iter.Seq[*types.AgeEncryptionKey] {
 	return func(yield func(*types.AgeEncryptionKey) bool) {
 		for _, key := range keys {
-			if key.KeyPair == nil {
+			if !key.HasKeyPair() {
 				continue
 			}
 
 			if !yield(&types.AgeEncryptionKey{
-				PublicKey: key.KeyPair.PublicKey,
+				PublicKey: key.GetKeyPair().PublicKey,
 			}) {
 				return
 			}
diff --git a/lib/auth/recordingencryption/manager_test.go b/lib/auth/recordingencryption/manager_test.go
index 98f1a3ee8fc..f7875ba85f0 100644
--- a/lib/auth/recordingencryption/manager_test.go
+++ b/lib/auth/recordingencryption/manager_test.go
@@ -283,9 +283,9 @@ func TestCreateUpdateSessionRecordingConfig(t *testing.T) {
 	require.NoError(t, err)
 	activePairs := encryption.GetSpec().GetActiveKeyPairs()
 	require.Len(t, activePairs, 1)
-	require.NotNil(t, activePairs[0].KeyPair)
-	require.NotEmpty(t, activePairs[0].KeyPair.PrivateKey)
-	require.NotEmpty(t, activePairs[0].KeyPair.PublicKey)
+	require.NotNil(t, activePairs[0].GetKeyPair())
+	require.NotEmpty(t, activePairs[0].GetKeyPair().PrivateKey)
+	require.NotEmpty(t, activePairs[0].GetKeyPair().PublicKey)
 
 	// update should change nothing
 	src, err = manager.UpdateSessionRecordingConfig(ctx, src)
@@ -331,16 +331,16 @@ func TestResolveRecordingEncryption(t *testing.T) {
 	require.Len(t, initialKeys, 1)
 	require.Len(t, src.GetEncryptionKeys(), 1)
 	key := initialKeys[0]
-	require.Equal(t, key.KeyPair.PublicKey, src.GetEncryptionKeys()[0].PublicKey)
-	require.NotNil(t, key.KeyPair)
+	require.Equal(t, key.GetKeyPair().PublicKey, src.GetEncryptionKeys()[0].PublicKey)
+	require.NotNil(t, key.GetKeyPair())
 
 	// CASE: service B should have access to the same key
 	encryption, src, err = resolve(ctx, service, managerB)
 	require.NoError(t, err)
 
-	activePairs := encryption.GetSpec().ActiveKeyPairs
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
 	require.Len(t, src.GetEncryptionKeys(), 1)
-	require.Equal(t, key.KeyPair.PublicKey, src.GetEncryptionKeys()[0].PublicKey)
+	require.Equal(t, key.GetKeyPair().PublicKey, src.GetEncryptionKeys()[0].PublicKey)
 	require.ElementsMatch(t, initialKeys, activePairs)
 
 	// service C should error without access to the current key
@@ -382,13 +382,13 @@ func TestResolveRecordingEncryptionConcurrent(t *testing.T) {
 	encryption, err := service.GetRecordingEncryption(ctx)
 	require.NoError(t, err)
 
-	activePairs := encryption.GetSpec().ActiveKeyPairs
+	activePairs := encryption.GetSpec().GetActiveKeyPairs()
 	// each service should share a single active key
 	require.Len(t, activePairs, 1)
-	require.NotNil(t, activePairs[0].KeyPair)
-	require.NotEmpty(t, activePairs[0].KeyPair.PrivateKey)
-	require.NotEmpty(t, activePairs[0].KeyPair.PublicKey)
-	require.Equal(t, types.PrivateKeyType_RAW, activePairs[0].KeyPair.PrivateKeyType)
+	require.NotNil(t, activePairs[0].GetKeyPair())
+	require.NotEmpty(t, activePairs[0].GetKeyPair().PrivateKey)
+	require.NotEmpty(t, activePairs[0].GetKeyPair().PublicKey)
+	require.Equal(t, types.PrivateKeyType_RAW, activePairs[0].GetKeyPair().PrivateKeyType)
 }
 
 func TestUnwrapKey(t *testing.T) {
@@ -464,10 +464,10 @@ func TestRotateKey(t *testing.T) {
 	activePairs := encryption.GetSpec().GetActiveKeyPairs()
 	require.Len(t, activePairs, 1)
 	initialKey := activePairs[0]
-	require.NotNil(t, initialKey.KeyPair)
-	require.NotEmpty(t, initialKey.KeyPair.PrivateKey)
-	require.NotEmpty(t, initialKey.KeyPair.PublicKey)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKey.State)
+	require.NotNil(t, initialKey.GetKeyPair())
+	require.NotEmpty(t, initialKey.GetKeyPair().PrivateKey)
+	require.NotEmpty(t, initialKey.GetKeyPair().PublicKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKey.GetState())
 
 	// rotate key
 	err = manager.RotateKey(ctx)
@@ -481,12 +481,12 @@ func TestRotateKey(t *testing.T) {
 	var foundInitialPair bool
 	var newPair *recordingencryptionv1.KeyPair
 	for _, pair := range activePairs {
-		if slices.Equal(initialKey.KeyPair.PublicKey, pair.KeyPair.PublicKey) {
-			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, pair.State)
+		if slices.Equal(initialKey.GetKeyPair().PublicKey, pair.GetKeyPair().PublicKey) {
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, pair.GetState())
 			foundInitialPair = true
 		} else {
 			newPair = pair
-			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, pair.State)
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, pair.GetState())
 		}
 	}
 
@@ -501,11 +501,11 @@ func TestRotateKey(t *testing.T) {
 	activePairs = encryption.GetSpec().GetActiveKeyPairs()
 	require.Len(t, activePairs, 1)
 
-	require.Equal(t, newPair.KeyPair.PublicKey, activePairs[0].KeyPair.PublicKey)
-	require.Equal(t, newPair.KeyPair.PrivateKey, activePairs[0].KeyPair.PrivateKey)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, activePairs[0].State)
+	require.Equal(t, newPair.GetKeyPair().PublicKey, activePairs[0].GetKeyPair().PublicKey)
+	require.Equal(t, newPair.GetKeyPair().PrivateKey, activePairs[0].GetKeyPair().PrivateKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, activePairs[0].GetState())
 
-	pubKey, err := x509.ParsePKIXPublicKey(initialKey.KeyPair.PublicKey)
+	pubKey, err := x509.ParsePKIXPublicKey(initialKey.GetKeyPair().PublicKey)
 	require.NoError(t, err)
 
 	fingerprint, err := recordingencryption.Fingerprint(pubKey)
@@ -514,8 +514,8 @@ func TestRotateKey(t *testing.T) {
 	rotatedKey, err := config.Backend.GetRotatedKey(ctx, fingerprint)
 	require.NoError(t, err)
 
-	require.Equal(t, initialKey.KeyPair.PublicKey, rotatedKey.Spec.EncryptionKeyPair.PublicKey)
-	require.Equal(t, initialKey.KeyPair.PrivateKey, rotatedKey.Spec.EncryptionKeyPair.PrivateKey)
+	require.Equal(t, initialKey.GetKeyPair().PublicKey, rotatedKey.GetSpec().GetEncryptionKeyPair().PublicKey)
+	require.Equal(t, initialKey.GetKeyPair().PrivateKey, rotatedKey.GetSpec().GetEncryptionKeyPair().PrivateKey)
 }
 
 func TestRotateRollback(t *testing.T) {
@@ -542,10 +542,10 @@ func TestRotateRollback(t *testing.T) {
 	activePairs := encryption.GetSpec().GetActiveKeyPairs()
 	require.Len(t, activePairs, 1)
 	initialKey := proto.CloneOf(activePairs[0])
-	require.NotNil(t, initialKey.KeyPair)
-	require.NotEmpty(t, initialKey.KeyPair.PrivateKey)
-	require.NotEmpty(t, initialKey.KeyPair.PublicKey)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKey.State)
+	require.NotNil(t, initialKey.GetKeyPair())
+	require.NotEmpty(t, initialKey.GetKeyPair().PrivateKey)
+	require.NotEmpty(t, initialKey.GetKeyPair().PublicKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKey.GetState())
 
 	// rotate key
 	err = manager.RotateKey(ctx)
@@ -559,12 +559,12 @@ func TestRotateRollback(t *testing.T) {
 	var foundInitialPair bool
 	var newPair *recordingencryptionv1.KeyPair
 	for _, pair := range activePairs {
-		if slices.Equal(initialKey.KeyPair.PublicKey, pair.KeyPair.PublicKey) {
-			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, pair.State)
+		if slices.Equal(initialKey.GetKeyPair().PublicKey, pair.GetKeyPair().PublicKey) {
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, pair.GetState())
 			foundInitialPair = true
 		} else {
 			newPair = pair
-			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, pair.State)
+			require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, pair.GetState())
 		}
 	}
 
@@ -579,11 +579,11 @@ func TestRotateRollback(t *testing.T) {
 	activePairs = encryption.GetSpec().GetActiveKeyPairs()
 	require.Len(t, activePairs, 1)
 
-	require.Equal(t, initialKey.KeyPair.PublicKey, activePairs[0].KeyPair.PublicKey)
-	require.Equal(t, initialKey.KeyPair.PrivateKey, activePairs[0].KeyPair.PrivateKey)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, activePairs[0].State)
+	require.Equal(t, initialKey.GetKeyPair().PublicKey, activePairs[0].GetKeyPair().PublicKey)
+	require.Equal(t, initialKey.GetKeyPair().PrivateKey, activePairs[0].GetKeyPair().PrivateKey)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, activePairs[0].GetState())
 
-	pubKey, err := x509.ParsePKIXPublicKey(initialKey.KeyPair.PublicKey)
+	pubKey, err := x509.ParsePKIXPublicKey(initialKey.GetKeyPair().PublicKey)
 	require.NoError(t, err)
 
 	fingerprint, err := recordingencryption.Fingerprint(pubKey)
diff --git a/lib/auth/recordingencryption/recordingencryptionv1/service.go b/lib/auth/recordingencryption/recordingencryptionv1/service.go
index f2c8598283a..3c145941860 100644
--- a/lib/auth/recordingencryption/recordingencryptionv1/service.go
+++ b/lib/auth/recordingencryption/recordingencryptionv1/service.go
@@ -114,30 +114,30 @@ type Service struct {
 }
 
 func streamUploadAsProto(upload events.StreamUpload) *recordingencryptionv1.Upload {
-	return &recordingencryptionv1.Upload{
+	return recordingencryptionv1.Upload_builder{
 		UploadId:    upload.ID,
 		SessionId:   upload.SessionID.String(),
 		InitiatedAt: timestamppb.New(upload.Initiated),
-	}
+	}.Build()
 }
 
 func protoAsStreamUpload(upload *recordingencryptionv1.Upload) (events.StreamUpload, error) {
-	sessionID, err := session.ParseID(upload.SessionId)
+	sessionID, err := session.ParseID(upload.GetSessionId())
 	if err != nil {
 		return events.StreamUpload{}, trace.Wrap(err)
 	}
 
 	return events.StreamUpload{
-		ID:        upload.UploadId,
+		ID:        upload.GetUploadId(),
 		SessionID: *sessionID,
-		Initiated: upload.InitiatedAt.AsTime(),
+		Initiated: upload.GetInitiatedAt().AsTime(),
 	}, nil
 }
 
 func protoAsStreamPart(part *recordingencryptionv1.Part) events.StreamPart {
 	return events.StreamPart{
-		Number:       part.PartNumber,
-		ETag:         part.Etag,
+		Number:       part.GetPartNumber(),
+		ETag:         part.GetEtag(),
 		LastModified: time.Now(),
 	}
 }
@@ -148,8 +148,8 @@ func (s *Service) CreateUpload(ctx context.Context, req *recordingencryptionv1.C
 		return nil, trace.AccessDenied("access denied")
 	}
 
-	s.logger.DebugContext(ctx, "creating encrypted session upload", "session_id", req.SessionId)
-	sessionID, err := session.ParseID(req.SessionId)
+	s.logger.DebugContext(ctx, "creating encrypted session upload", "session_id", req.GetSessionId())
+	sessionID, err := session.ParseID(req.GetSessionId())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -159,14 +159,14 @@ func (s *Service) CreateUpload(ctx context.Context, req *recordingencryptionv1.C
 		return nil, trace.Wrap(err, "creating encrypted recording upload")
 	}
 
-	return &recordingencryptionv1.CreateUploadResponse{
+	return recordingencryptionv1.CreateUploadResponse_builder{
 		Upload: streamUploadAsProto(*upload),
-	}, nil
+	}.Build(), nil
 }
 
 // UploadPart uploads an encrypted session recording part to the given upload ID.
 func (s *Service) UploadPart(ctx context.Context, req *recordingencryptionv1.UploadPartRequest) (*recordingencryptionv1.UploadPartResponse, error) {
-	if err := validateUpload(req.Upload); err != nil {
+	if err := validateUpload(req.GetUpload()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -174,39 +174,39 @@ func (s *Service) UploadPart(ctx context.Context, req *recordingencryptionv1.Upl
 		return nil, trace.AccessDenied("access denied")
 	}
 
-	s.logger.DebugContext(ctx, "uploading encrypted session part", "upload_id", req.Upload.UploadId, "session_id", req.Upload.SessionId, "part_number", req.PartNumber)
-	upload, err := protoAsStreamUpload(req.Upload)
+	s.logger.DebugContext(ctx, "uploading encrypted session part", "upload_id", req.GetUpload().GetUploadId(), "session_id", req.GetUpload().GetSessionId(), "part_number", req.GetPartNumber())
+	upload, err := protoAsStreamUpload(req.GetUpload())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.uploader.ReserveUploadPart(ctx, upload, req.PartNumber); err != nil {
+	if err := s.uploader.ReserveUploadPart(ctx, upload, req.GetPartNumber()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// If upload part is not at least the minimum upload part size, append an empty part
 	// to pad up to the minimum upload size.
-	part := req.Part
-	if !req.IsLast && len(part) < events.MinUploadPartSizeBytes {
+	part := req.GetPart()
+	if !req.GetIsLast() && len(part) < events.MinUploadPartSizeBytes {
 		part = events.PadUploadPart(part, events.MinUploadPartSizeBytes)
 	}
 
-	streamPart, err := s.uploader.UploadPart(ctx, upload, req.PartNumber, bytes.NewReader(part))
+	streamPart, err := s.uploader.UploadPart(ctx, upload, req.GetPartNumber(), bytes.NewReader(part))
 	if err != nil {
 		return nil, trace.Wrap(err, "uploading encrypted recording part")
 	}
 
-	return &recordingencryptionv1.UploadPartResponse{
-		Part: &recordingencryptionv1.Part{
+	return recordingencryptionv1.UploadPartResponse_builder{
+		Part: recordingencryptionv1.Part_builder{
 			PartNumber: streamPart.Number,
 			Etag:       streamPart.ETag,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 // CompleteUpload marks a given encrypted session upload as complete.
 func (s *Service) CompleteUpload(ctx context.Context, req *recordingencryptionv1.CompleteUploadRequest) (*recordingencryptionv1.CompleteUploadResponse, error) {
-	if err := validateUpload(req.Upload); err != nil {
+	if err := validateUpload(req.GetUpload()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -214,14 +214,14 @@ func (s *Service) CompleteUpload(ctx context.Context, req *recordingencryptionv1
 		return nil, trace.AccessDenied("access denied")
 	}
 
-	s.logger.DebugContext(ctx, "completing encrypted session upload", "upload_id", req.Upload.UploadId, "session_id", req.Upload.SessionId, "parts", len(req.Parts))
-	upload, err := protoAsStreamUpload(req.Upload)
+	s.logger.DebugContext(ctx, "completing encrypted session upload", "upload_id", req.GetUpload().GetUploadId(), "session_id", req.GetUpload().GetSessionId(), "parts", len(req.GetParts()))
+	upload, err := protoAsStreamUpload(req.GetUpload())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	parts := make([]events.StreamPart, len(req.Parts))
-	for idx, part := range req.Parts {
+	parts := make([]events.StreamPart, len(req.GetParts()))
+	for idx, part := range req.GetParts() {
 		parts[idx] = protoAsStreamPart(part)
 	}
 
@@ -319,18 +319,18 @@ func (s *Service) GetRotationState(ctx context.Context, req *recordingencryption
 		return nil, trace.Wrap(err)
 	}
 
-	return &recordingencryptionv1.GetRotationStateResponse{
+	return recordingencryptionv1.GetRotationStateResponse_builder{
 		KeyPairStates: states,
-	}, nil
+	}.Build(), nil
 }
 
 func validateUpload(upload *recordingencryptionv1.Upload) error {
 	switch {
 	case upload == nil:
 		return trace.BadParameter("upload is required")
-	case upload.UploadId == "":
+	case upload.GetUploadId() == "":
 		return trace.BadParameter("upload.upload_id is required")
-	case upload.SessionId == "":
+	case upload.GetSessionId() == "":
 		return trace.BadParameter("upload.session_id is required")
 	}
 	return nil
diff --git a/lib/auth/recordingencryption/recordingencryptionv1/service_test.go b/lib/auth/recordingencryption/recordingencryptionv1/service_test.go
index 2012bb96541..d171b7e87aa 100644
--- a/lib/auth/recordingencryption/recordingencryptionv1/service_test.go
+++ b/lib/auth/recordingencryption/recordingencryptionv1/service_test.go
@@ -178,7 +178,7 @@ func TestGetRotationState(t *testing.T) {
 			res, err := service.GetRotationState(withAuthCtx(t.Context(), c.ctx), nil)
 			c.assertErr(t, err)
 			if err == nil {
-				require.Len(t, res.KeyPairStates, 1)
+				require.Len(t, res.GetKeyPairStates(), 1)
 			} else {
 				require.Nil(t, res)
 			}
@@ -245,10 +245,10 @@ type fakeKeyRotater struct {
 func newFakeKeyRotater() *fakeKeyRotater {
 	return &fakeKeyRotater{
 		keys: []*recordingencryptionv1pb.FingerprintWithState{
-			{
+			recordingencryptionv1pb.FingerprintWithState_builder{
 				Fingerprint: uuid.New().String(),
 				State:       recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE,
-			},
+			}.Build(),
 		},
 	}
 }
@@ -258,15 +258,15 @@ func (f *fakeKeyRotater) RotateKey(ctx context.Context) error {
 		return errors.New("rotation in progress")
 	}
 
-	if f.keys[0].State != recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE {
-		return fmt.Errorf("keys in unexpected state: %v", f.keys[0].State)
+	if f.keys[0].GetState() != recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE {
+		return fmt.Errorf("keys in unexpected state: %v", f.keys[0].GetState())
 	}
 
-	f.keys[0].State = recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ROTATING
-	f.keys = append(f.keys, &recordingencryptionv1pb.FingerprintWithState{
+	f.keys[0].SetState(recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ROTATING)
+	f.keys = append(f.keys, recordingencryptionv1pb.FingerprintWithState_builder{
 		Fingerprint: uuid.New().String(),
 		State:       recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE,
-	})
+	}.Build())
 
 	return nil
 }
@@ -274,7 +274,7 @@ func (f *fakeKeyRotater) RotateKey(ctx context.Context) error {
 func (f *fakeKeyRotater) CompleteRotation(ctx context.Context) error {
 	var keys []*recordingencryptionv1pb.FingerprintWithState
 	for _, key := range f.keys {
-		if key.State == recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE {
+		if key.GetState() == recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ACTIVE {
 			keys = append(keys, key)
 		}
 	}
@@ -286,7 +286,7 @@ func (f *fakeKeyRotater) CompleteRotation(ctx context.Context) error {
 func (f *fakeKeyRotater) RollbackRotation(ctx context.Context) error {
 	var keys []*recordingencryptionv1pb.FingerprintWithState
 	for _, key := range f.keys {
-		if key.State == recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ROTATING {
+		if key.GetState() == recordingencryptionv1pb.KeyPairState_KEY_PAIR_STATE_ROTATING {
 			keys = append(keys, key)
 		}
 	}
@@ -335,13 +335,13 @@ func TestSessionCompleter(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := withAuthCtx(t.Context(), newServiceAuthCtx(t))
-	_, err = service.CompleteUpload(ctx, &recordingencryptionv1pb.CompleteUploadRequest{
-		Upload: &recordingencryptionv1pb.Upload{
+	_, err = service.CompleteUpload(ctx, recordingencryptionv1pb.CompleteUploadRequest_builder{
+		Upload: recordingencryptionv1pb.Upload_builder{
 			SessionId:   string(sessionID),
 			InitiatedAt: timestamppb.Now(),
 			UploadId:    uuid.NewString(),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	recorderMetadata.AssertExpectations(t)
@@ -427,13 +427,13 @@ func TestCompleteUploadRecoversMissingSessionEnd(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := withAuthCtx(t.Context(), newServiceAuthCtx(t))
-	_, err = service.CompleteUpload(ctx, &recordingencryptionv1pb.CompleteUploadRequest{
-		Upload: &recordingencryptionv1pb.Upload{
+	_, err = service.CompleteUpload(ctx, recordingencryptionv1pb.CompleteUploadRequest_builder{
+		Upload: recordingencryptionv1pb.Upload_builder{
 			SessionId:   string(sessionID),
 			InitiatedAt: timestamppb.Now(),
 			UploadId:    uuid.NewString(),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// The recovered session end event must have been emitted to the audit log.
@@ -486,21 +486,21 @@ func TestUploadValidation(t *testing.T) {
 		},
 		{
 			name: "missing upload_id",
-			uploadPartReq: &recordingencryptionv1pb.UploadPartRequest{
-				Upload: &recordingencryptionv1pb.Upload{SessionId: uuid.NewString()},
-			},
-			completeReq: &recordingencryptionv1pb.CompleteUploadRequest{
-				Upload: &recordingencryptionv1pb.Upload{SessionId: uuid.NewString()},
-			},
+			uploadPartReq: recordingencryptionv1pb.UploadPartRequest_builder{
+				Upload: recordingencryptionv1pb.Upload_builder{SessionId: uuid.NewString()}.Build(),
+			}.Build(),
+			completeReq: recordingencryptionv1pb.CompleteUploadRequest_builder{
+				Upload: recordingencryptionv1pb.Upload_builder{SessionId: uuid.NewString()}.Build(),
+			}.Build(),
 		},
 		{
 			name: "missing session_id",
-			uploadPartReq: &recordingencryptionv1pb.UploadPartRequest{
-				Upload: &recordingencryptionv1pb.Upload{UploadId: uuid.NewString()},
-			},
-			completeReq: &recordingencryptionv1pb.CompleteUploadRequest{
-				Upload: &recordingencryptionv1pb.Upload{UploadId: uuid.NewString()},
-			},
+			uploadPartReq: recordingencryptionv1pb.UploadPartRequest_builder{
+				Upload: recordingencryptionv1pb.Upload_builder{UploadId: uuid.NewString()}.Build(),
+			}.Build(),
+			completeReq: recordingencryptionv1pb.CompleteUploadRequest_builder{
+				Upload: recordingencryptionv1pb.Upload_builder{UploadId: uuid.NewString()}.Build(),
+			}.Build(),
 		},
 	}
 
@@ -521,14 +521,14 @@ func TestUploadValidation(t *testing.T) {
 
 func TestAuthorizeUpload(t *testing.T) {
 	newUpload := func() *recordingencryptionv1pb.Upload {
-		return &recordingencryptionv1pb.Upload{
+		return recordingencryptionv1pb.Upload_builder{
 			SessionId:   uuid.NewString(),
 			UploadId:    uuid.NewString(),
 			InitiatedAt: timestamppb.Now(),
-		}
+		}.Build()
 	}
 	newUploadReq := func() *recordingencryptionv1pb.CreateUploadRequest {
-		return &recordingencryptionv1pb.CreateUploadRequest{SessionId: uuid.NewString()}
+		return recordingencryptionv1pb.CreateUploadRequest_builder{SessionId: uuid.NewString()}.Build()
 	}
 
 	accessDeniedAssert := func(t require.TestingT, err error, i ...any) {
@@ -593,10 +593,10 @@ func TestAuthorizeUpload(t *testing.T) {
 			_, err := svc.CreateUpload(ctx, newUploadReq())
 			c.errAssertFunc(t, err)
 
-			_, err = svc.UploadPart(ctx, &recordingencryptionv1pb.UploadPartRequest{Upload: newUpload(), IsLast: true})
+			_, err = svc.UploadPart(ctx, recordingencryptionv1pb.UploadPartRequest_builder{Upload: newUpload(), IsLast: true}.Build())
 			c.errAssertFunc(t, err)
 
-			_, err = svc.CompleteUpload(ctx, &recordingencryptionv1pb.CompleteUploadRequest{Upload: newUpload()})
+			_, err = svc.CompleteUpload(ctx, recordingencryptionv1pb.CompleteUploadRequest_builder{Upload: newUpload()}.Build())
 			c.errAssertFunc(t, err)
 		})
 	}
@@ -692,29 +692,29 @@ func TestRecordingEncryptionService(t *testing.T) {
 
 			cli := authClient.RecordingEncryptionServiceClient()
 
-			upload := &recordingencryptionv1pb.Upload{
+			upload := recordingencryptionv1pb.Upload_builder{
 				UploadId:    uuid.NewString(),
 				SessionId:   uuid.NewString(),
 				InitiatedAt: timestamppb.Now(),
-			}
+			}.Build()
 
-			createResp, err := cli.CreateUpload(t.Context(), &recordingencryptionv1pb.CreateUploadRequest{
+			createResp, err := cli.CreateUpload(t.Context(), recordingencryptionv1pb.CreateUploadRequest_builder{
 				SessionId: uuid.NewString(),
-			})
+			}.Build())
 			c.assertErr(t, err)
 			if err == nil {
-				upload = createResp.Upload
+				upload = createResp.GetUpload()
 			}
 
-			_, err = cli.UploadPart(t.Context(), &recordingencryptionv1pb.UploadPartRequest{
+			_, err = cli.UploadPart(t.Context(), recordingencryptionv1pb.UploadPartRequest_builder{
 				Upload: upload,
 				IsLast: true,
-			})
+			}.Build())
 			c.assertErr(t, err)
 
-			_, err = cli.CompleteUpload(t.Context(), &recordingencryptionv1pb.CompleteUploadRequest{
+			_, err = cli.CompleteUpload(t.Context(), recordingencryptionv1pb.CompleteUploadRequest_builder{
 				Upload: upload,
-			})
+			}.Build())
 			c.assertErr(t, err)
 		})
 	}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/desktopprocessor.go b/lib/auth/recordingmetadata/recordingmetadatav1/desktopprocessor.go
index 6cc3e617d64..5b4110a3617 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/desktopprocessor.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/desktopprocessor.go
@@ -63,10 +63,10 @@ func (d *desktopProcessor) handleEvent(evt apievents.AuditEvent) error {
 func (d *desktopProcessor) handleWindowsDesktopSessionStart(evt *apievents.WindowsDesktopSessionStart) error {
 	d.startTime = evt.GetTime()
 
-	d.metadata.ClusterName = evt.ClusterName
-	d.metadata.User = evt.User
-	d.metadata.ResourceName = evt.DesktopName
-	d.metadata.Type = pb.SessionRecordingType_SESSION_RECORDING_TYPE_WINDOWS_DESKTOP
+	d.metadata.SetClusterName(evt.ClusterName)
+	d.metadata.SetUser(evt.User)
+	d.metadata.SetResourceName(evt.DesktopName)
+	d.metadata.SetType(pb.SessionRecordingType_SESSION_RECORDING_TYPE_WINDOWS_DESKTOP)
 
 	return nil
 }
@@ -82,11 +82,11 @@ func (d *desktopProcessor) handleDesktopRecording(evt *apievents.DesktopRecordin
 }
 
 func (d *desktopProcessor) handleWindowsDesktopSessionEnd(evt *apievents.WindowsDesktopSessionEnd) error {
-	if d.metadata.Type == pb.SessionRecordingType_SESSION_RECORDING_TYPE_UNSPECIFIED {
-		d.metadata.ClusterName = evt.ClusterName
-		d.metadata.User = evt.User
-		d.metadata.ResourceName = evt.DesktopName
-		d.metadata.Type = pb.SessionRecordingType_SESSION_RECORDING_TYPE_WINDOWS_DESKTOP
+	if d.metadata.GetType() == pb.SessionRecordingType_SESSION_RECORDING_TYPE_UNSPECIFIED {
+		d.metadata.SetClusterName(evt.ClusterName)
+		d.metadata.SetUser(evt.User)
+		d.metadata.SetResourceName(evt.DesktopName)
+		d.metadata.SetType(pb.SessionRecordingType_SESSION_RECORDING_TYPE_WINDOWS_DESKTOP)
 	}
 
 	d.captureThumbnailIfNeeded(evt.GetTime(), d.thumbnailInterval)
@@ -99,9 +99,9 @@ func (d *desktopProcessor) collect() (*pb.SessionRecordingMetadata, *pb.SessionR
 		return nil, nil
 	}
 
-	d.metadata.Duration = durationpb.New(d.lastEvent.GetTime().Sub(d.startTime))
-	d.metadata.StartTime = timestamppb.New(d.startTime)
-	d.metadata.EndTime = timestamppb.New(d.lastEvent.GetTime())
+	d.metadata.SetDuration(durationpb.New(d.lastEvent.GetTime().Sub(d.startTime)))
+	d.metadata.SetStartTime(timestamppb.New(d.startTime))
+	d.metadata.SetEndTime(timestamppb.New(d.lastEvent.GetTime()))
 
 	return d.metadata, d.thumbnail
 }
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/desktopthumbnail.go b/lib/auth/recordingmetadata/recordingmetadatav1/desktopthumbnail.go
index 6a2d15e3997..0c093d8216a 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/desktopthumbnail.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/desktopthumbnail.go
@@ -138,14 +138,14 @@ func (d *desktopThumbnailGenerator) produceThumbnail(maxDim int) (*pb.SessionRec
 		return nil, trace.Wrap(err, "encoding thumbnail PNG")
 	}
 
-	return &pb.SessionRecordingThumbnail{
+	return pb.SessionRecordingThumbnail_builder{
 		CursorX:       int32(cursor.X),
 		CursorY:       int32(cursor.Y),
 		CursorVisible: cursor.Visible,
 		ScreenWidth:   int32(screenWidth),
 		ScreenHeight:  int32(screenHeight),
 		Png:           bytes.Clone(d.buf.Bytes()),
-	}, nil
+	}.Build(), nil
 }
 
 func (d *desktopThumbnailGenerator) release() {
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/processor.go b/lib/auth/recordingmetadata/recordingmetadatav1/processor.go
index 9360da32e9c..61642cec39b 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/processor.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/processor.go
@@ -106,8 +106,8 @@ func (b *baseRecordingProcessor) captureThumbnailIfNeeded(eventTime time.Time, i
 
 	startOffset := durationpb.New(eventTime.Sub(b.startTime))
 	endOffset := durationpb.New(eventTime.Add(interval).Add(-1 * time.Millisecond).Sub(b.startTime))
-	frame.StartOffset = startOffset
-	frame.EndOffset = endOffset
+	frame.SetStartOffset(startOffset)
+	frame.SetEndOffset(endOffset)
 
 	if _, err := protodelim.MarshalTo(b.writer, frame); err != nil {
 		// log the error but continue processing other thumbnails and the session metadata (metadata is more important)
@@ -117,7 +117,7 @@ func (b *baseRecordingProcessor) captureThumbnailIfNeeded(eventTime time.Time, i
 	// Decide whether this frame should become the representative thumbnail. We only re-encode at
 	// the higher resolution when the frame is actually being kept, to avoid wasted work.
 	if b.thumbnail != nil {
-		previousDiff := math.Abs(float64(b.thumbnailTime - b.thumbnail.StartOffset.AsDuration()))
+		previousDiff := math.Abs(float64(b.thumbnailTime - b.thumbnail.GetStartOffset().AsDuration()))
 		diff := math.Abs(float64(b.thumbnailTime - eventTime.Sub(b.startTime)))
 		if diff >= previousDiff {
 			return
@@ -133,8 +133,8 @@ func (b *baseRecordingProcessor) captureThumbnailIfNeeded(eventTime time.Time, i
 	if representative == nil {
 		return
 	}
-	representative.StartOffset = startOffset
-	representative.EndOffset = endOffset
+	representative.SetStartOffset(startOffset)
+	representative.SetEndOffset(endOffset)
 	b.thumbnail = representative
 }
 
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/service.go b/lib/auth/recordingmetadata/recordingmetadatav1/service.go
index b014b68c167..01bd2710eed 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/service.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/service.go
@@ -97,11 +97,11 @@ func NewService(cfg ServiceConfig) (*Service, error) {
 // GetThumbnail retrieves the thumbnail for a session recording.
 func (r *Service) GetThumbnail(ctx context.Context, req *pb.GetThumbnailRequest) (*pb.GetThumbnailResponse, error) {
 	// Authorize will have checked the session end event to ensure the user has access to the session recording.
-	if err := r.authorizer.Authorize(ctx, req.SessionId); err != nil {
+	if err := r.authorizer.Authorize(ctx, req.GetSessionId()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	rc, err := r.downloadHandler.StreamSessionThumbnail(ctx, session.ID(req.SessionId))
+	rc, err := r.downloadHandler.StreamSessionThumbnail(ctx, session.ID(req.GetSessionId()))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -118,18 +118,18 @@ func (r *Service) GetThumbnail(ctx context.Context, req *pb.GetThumbnailRequest)
 		return nil, trace.Wrap(err)
 	}
 
-	return &pb.GetThumbnailResponse{Thumbnail: thumbnail}, nil
+	return pb.GetThumbnailResponse_builder{Thumbnail: thumbnail}.Build(), nil
 }
 
 // GetMetadata retrieves the metadata for a session recording, streaming it back in chunks (one for metadata and one
 // for each frame).
 func (r *Service) GetMetadata(req *pb.GetMetadataRequest, stream grpc.ServerStreamingServer[pb.GetMetadataResponseChunk]) error {
 	// Authorize will have checked the session end event to ensure the user has access to the session recording.
-	if err := r.authorizer.Authorize(stream.Context(), req.SessionId); err != nil {
+	if err := r.authorizer.Authorize(stream.Context(), req.GetSessionId()); err != nil {
 		return trace.Wrap(err)
 	}
 
-	rc, err := r.downloadHandler.StreamSessionMetadata(stream.Context(), session.ID(req.SessionId))
+	rc, err := r.downloadHandler.StreamSessionMetadata(stream.Context(), session.ID(req.GetSessionId()))
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -148,7 +148,7 @@ func (r *Service) GetMetadata(req *pb.GetMetadataRequest, stream grpc.ServerStre
 				break
 			}
 			r.logger.ErrorContext(stream.Context(), "Failed to read delimited message",
-				"session_id", req.SessionId, "error", err)
+				"session_id", req.GetSessionId(), "error", err)
 			return trace.Wrap(err)
 		}
 
@@ -164,7 +164,7 @@ func (r *Service) GetMetadata(req *pb.GetMetadataRequest, stream grpc.ServerStre
 			if err := stream.Send(metadataChunk); err != nil {
 				if !errors.Is(err, io.EOF) {
 					r.logger.ErrorContext(stream.Context(), "Failed to send session recording metadata",
-						"session_id", req.SessionId, "error", err)
+						"session_id", req.GetSessionId(), "error", err)
 				}
 				return trace.Wrap(err)
 			}
@@ -184,7 +184,7 @@ func (r *Service) GetMetadata(req *pb.GetMetadataRequest, stream grpc.ServerStre
 			if err := stream.Send(frameChunk); err != nil {
 				if !errors.Is(err, io.EOF) {
 					r.logger.ErrorContext(stream.Context(), "Failed to send session recording thumbnail",
-						"session_id", req.SessionId, "error", err)
+						"session_id", req.GetSessionId(), "error", err)
 				}
 				return trace.Wrap(err)
 			}
@@ -193,7 +193,7 @@ func (r *Service) GetMetadata(req *pb.GetMetadataRequest, stream grpc.ServerStre
 		}
 
 		r.logger.ErrorContext(stream.Context(), "Failed to parse message as metadata or thumbnail",
-			"session_id", req.SessionId)
+			"session_id", req.GetSessionId())
 
 		return trace.Errorf("unable to parse message as metadata or thumbnail")
 	}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go b/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go
index 4f0051cbc99..30e14c3b780 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/service_test.go
@@ -50,7 +50,7 @@ func TestService_GetThumbnail(t *testing.T) {
 
 	thumbnail := newThumbnail()
 
-	thumbnail.Svg = []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"50\" height=\"50\"><rect width=\"100%\" height=\"100%\" fill=\"red\"/></svg>")
+	thumbnail.SetSvg([]byte("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"50\" height=\"50\"><rect width=\"100%\" height=\"100%\" fill=\"red\"/></svg>"))
 
 	err := uploadThumbnail(ctx, uploader, session.ID("test-session"), thumbnail)
 	require.NoError(t, err, "failed to upload thumbnail")
@@ -60,13 +60,13 @@ func TestService_GetThumbnail(t *testing.T) {
 		downloadHandler: uploader,
 	}
 
-	resp, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+	resp, err := service.GetThumbnail(ctx, recordingmetadatav1pb.GetThumbnailRequest_builder{
 		SessionId: "test-session",
-	})
+	}.Build())
 	require.NoError(t, err, "failed to get thumbnail")
 	require.NotNil(t, resp, "expected non-nil response")
 
-	require.Equal(t, thumbnail.Svg, resp.Thumbnail.Svg, "thumbnail SVG does not match expected value")
+	require.Equal(t, thumbnail.GetSvg(), resp.GetThumbnail().GetSvg(), "thumbnail SVG does not match expected value")
 }
 
 func TestService_GetThumbnailNotFound(t *testing.T) {
@@ -80,9 +80,9 @@ func TestService_GetThumbnailNotFound(t *testing.T) {
 		downloadHandler: uploader,
 	}
 
-	_, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+	_, err := service.GetThumbnail(ctx, recordingmetadatav1pb.GetThumbnailRequest_builder{
 		SessionId: "test-session",
-	})
+	}.Build())
 	require.Error(t, err, "expected error for test session")
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 }
@@ -145,9 +145,9 @@ func TestService_GetThumbnailAuthorized(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			_, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+			_, err := service.GetThumbnail(ctx, recordingmetadatav1pb.GetThumbnailRequest_builder{
 				SessionId: tc.sessionID,
-			})
+			}.Build())
 
 			if tc.wantError {
 				require.Error(t, err)
@@ -174,7 +174,7 @@ func TestService_GetMetadata(t *testing.T) {
 		newThumbnail(),
 	}
 
-	metadata.ClusterName = "test-cluster"
+	metadata.SetClusterName("test-cluster")
 
 	err := uploadMetadata(ctx, uploader, session.ID("test-session"), metadata, frames)
 	require.NoError(t, err, "failed to upload metadata")
@@ -185,9 +185,9 @@ func TestService_GetMetadata(t *testing.T) {
 	}
 
 	stream := &fakeServerStream{ctx: ctx}
-	err = service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+	err = service.GetMetadata(recordingmetadatav1pb.GetMetadataRequest_builder{
 		SessionId: "test-session",
-	}, stream)
+	}.Build(), stream)
 
 	require.NoError(t, err, "failed to get metadata")
 	require.NotNil(t, stream, "expected non-nil stream")
@@ -200,7 +200,7 @@ func TestService_GetMetadata(t *testing.T) {
 		require.NotNil(t, chunk, "expected non-nil chunk")
 
 		require.NotNil(t, chunk.GetMetadata(), "expected metadata in chunk")
-		require.Equal(t, metadata.ClusterName, chunk.GetMetadata().ClusterName, "metadata cluster name does not match expected value")
+		require.Equal(t, metadata.GetClusterName(), chunk.GetMetadata().GetClusterName(), "metadata cluster name does not match expected value")
 	}
 
 	{
@@ -211,7 +211,7 @@ func TestService_GetMetadata(t *testing.T) {
 		require.NotNil(t, chunk, "expected non-nil chunk")
 
 		require.NotNil(t, chunk.GetFrame(), "expected frame in chunk")
-		require.Equal(t, frames[0].Svg, chunk.GetFrame().Svg,
+		require.Equal(t, frames[0].GetSvg(), chunk.GetFrame().GetSvg(),
 			"first frame SVG does not match expected value")
 	}
 
@@ -223,7 +223,7 @@ func TestService_GetMetadata(t *testing.T) {
 		require.NotNil(t, chunk, "expected non-nil chunk")
 
 		require.NotNil(t, chunk.GetFrame(), "expected frame in chunk")
-		require.Equal(t, frames[1].Svg, chunk.GetFrame().Svg,
+		require.Equal(t, frames[1].GetSvg(), chunk.GetFrame().GetSvg(),
 			"second frame SVG does not match expected value")
 	}
 }
@@ -240,9 +240,9 @@ func TestService_GetMetadataNotFound(t *testing.T) {
 	}
 
 	stream := &fakeServerStream{ctx: ctx}
-	err := service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+	err := service.GetMetadata(recordingmetadatav1pb.GetMetadataRequest_builder{
 		SessionId: "test-session",
-	}, stream)
+	}.Build(), stream)
 
 	require.Error(t, err, "expected error for test session")
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
@@ -306,9 +306,9 @@ func TestService_GetMetadataAuthorized(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			stream := &fakeServerStream{ctx: context.Background()}
 
-			err := service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+			err := service.GetMetadata(recordingmetadatav1pb.GetMetadataRequest_builder{
 				SessionId: tc.sessionID,
-			}, stream)
+			}.Build(), stream)
 
 			if tc.wantError {
 				require.Error(t, err)
@@ -334,22 +334,22 @@ func TestService_AuthorizerError(t *testing.T) {
 		authorizer: authorizer,
 	}
 
-	_, err := service.GetThumbnail(ctx, &recordingmetadatav1pb.GetThumbnailRequest{
+	_, err := service.GetThumbnail(ctx, recordingmetadatav1pb.GetThumbnailRequest_builder{
 		SessionId: "any-session",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 
 	stream := &fakeServerStream{ctx: ctx}
-	err = service.GetMetadata(&recordingmetadatav1pb.GetMetadataRequest{
+	err = service.GetMetadata(recordingmetadatav1pb.GetMetadataRequest_builder{
 		SessionId: "any-session",
-	}, stream)
+	}.Build(), stream)
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err))
 }
 
 func newThumbnail() *recordingmetadatav1pb.SessionRecordingThumbnail {
-	return &recordingmetadatav1pb.SessionRecordingThumbnail{
+	return recordingmetadatav1pb.SessionRecordingThumbnail_builder{
 		Svg:         []byte("<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><rect width=\"100%\" height=\"100%\" fill=\"red\"/></svg>"),
 		Cols:        80,
 		Rows:        24,
@@ -357,18 +357,18 @@ func newThumbnail() *recordingmetadatav1pb.SessionRecordingThumbnail {
 		CursorY:     0,
 		StartOffset: durationpb.New(0),
 		EndOffset:   durationpb.New(60),
-	}
+	}.Build()
 }
 
 func newMetadata() *recordingmetadatav1pb.SessionRecordingMetadata {
-	return &recordingmetadatav1pb.SessionRecordingMetadata{
+	return recordingmetadatav1pb.SessionRecordingMetadata_builder{
 		Duration:    durationpb.New(60),
 		StartCols:   80,
 		StartRows:   24,
 		StartTime:   timestamppb.New(time.Now().Add(-time.Minute)),
 		EndTime:     timestamppb.New(time.Now()),
 		ClusterName: "test-cluster",
-	}
+	}.Build()
 }
 
 func uploadThumbnail(ctx context.Context, uploader events.UploadHandler, sessionID session.ID, thumbnail *recordingmetadatav1pb.SessionRecordingThumbnail) error {
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor.go b/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor.go
index ab6f95f5791..b604a09120d 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor.go
@@ -86,20 +86,20 @@ func (t *ttyRecordingProcessor) handleSessionStart(evt *apievents.SessionStart)
 	}
 
 	// store the initial terminal size, this is typically 80:24 and is resized immediately
-	t.metadata.StartCols = int32(size.W)
-	t.metadata.StartRows = int32(size.H)
+	t.metadata.SetStartCols(int32(size.W))
+	t.metadata.SetStartRows(int32(size.H))
 
-	t.metadata.ClusterName = evt.ClusterName
-	t.metadata.User = evt.User
+	t.metadata.SetClusterName(evt.ClusterName)
+	t.metadata.SetUser(evt.User)
 
 	switch evt.Protocol {
 	case events.EventProtocolSSH:
-		t.metadata.ResourceName = evt.ServerHostname
-		t.metadata.Type = pb.SessionRecordingType_SESSION_RECORDING_TYPE_SSH
+		t.metadata.SetResourceName(evt.ServerHostname)
+		t.metadata.SetType(pb.SessionRecordingType_SESSION_RECORDING_TYPE_SSH)
 
 	case events.EventProtocolKube:
-		t.metadata.ResourceName = evt.KubernetesCluster
-		t.metadata.Type = pb.SessionRecordingType_SESSION_RECORDING_TYPE_KUBERNETES
+		t.metadata.SetResourceName(evt.KubernetesCluster)
+		t.metadata.SetType(pb.SessionRecordingType_SESSION_RECORDING_TYPE_KUBERNETES)
 	}
 
 	return t.thumbnailGenerator.handleEvent(evt)
@@ -115,19 +115,17 @@ func (t *ttyRecordingProcessor) handleResize(evt *apievents.Resize) error {
 	// this handles cases where the initial terminal size is not 80x24 and is resized immediately
 	// before any output is printed
 	if !t.hasSeenPrintEvent {
-		t.metadata.StartCols = int32(size.W)
-		t.metadata.StartRows = int32(size.H)
+		t.metadata.SetStartCols(int32(size.W))
+		t.metadata.SetStartRows(int32(size.H))
 	}
 
-	t.metadata.Events = append(t.metadata.Events, &pb.SessionRecordingEvent{
+	t.metadata.SetEvents(append(t.metadata.GetEvents(), pb.SessionRecordingEvent_builder{
 		StartOffset: durationpb.New(evt.Time.Sub(t.startTime)),
-		Event: &pb.SessionRecordingEvent_Resize{
-			Resize: &pb.SessionRecordingResizeEvent{
-				Cols: int32(size.W),
-				Rows: int32(size.H),
-			},
-		},
-	})
+		Resize: pb.SessionRecordingResizeEvent_builder{
+			Cols: int32(size.W),
+			Rows: int32(size.H),
+		}.Build(),
+	}.Build()))
 
 	return t.thumbnailGenerator.handleEvent(evt)
 }
@@ -161,15 +159,13 @@ func (t *ttyRecordingProcessor) handleSessionJoin(evt *apievents.SessionJoin) er
 
 func (t *ttyRecordingProcessor) handleSessionLeave(evt *apievents.SessionLeave) error {
 	if joinTime, ok := t.activeUsers[evt.User]; ok {
-		t.metadata.Events = append(t.metadata.Events, &pb.SessionRecordingEvent{
+		t.metadata.SetEvents(append(t.metadata.GetEvents(), pb.SessionRecordingEvent_builder{
 			StartOffset: durationpb.New(joinTime),
 			EndOffset:   durationpb.New(evt.Time.Sub(t.startTime)),
-			Event: &pb.SessionRecordingEvent_Join{
-				Join: &pb.SessionRecordingJoinEvent{
-					User: evt.User,
-				},
-			},
-		})
+			Join: pb.SessionRecordingJoinEvent_builder{
+				User: evt.User,
+			}.Build(),
+		}.Build()))
 
 		delete(t.activeUsers, evt.User)
 	}
@@ -191,13 +187,11 @@ func (t *ttyRecordingProcessor) addInactivityEvent(start, end time.Time) {
 	inactivityStart := durationpb.New(start.Sub(t.startTime))
 	inactivityEnd := durationpb.New(end.Sub(t.startTime))
 
-	t.metadata.Events = append(t.metadata.Events, &pb.SessionRecordingEvent{
+	t.metadata.SetEvents(append(t.metadata.GetEvents(), pb.SessionRecordingEvent_builder{
 		StartOffset: inactivityStart,
 		EndOffset:   inactivityEnd,
-		Event: &pb.SessionRecordingEvent_Inactivity{
-			Inactivity: &pb.SessionRecordingInactivityEvent{},
-		},
-	})
+		Inactivity:  &pb.SessionRecordingInactivityEvent{},
+	}.Build()))
 }
 
 func (t *ttyRecordingProcessor) collect() (*pb.SessionRecordingMetadata, *pb.SessionRecordingThumbnail) {
@@ -207,20 +201,18 @@ func (t *ttyRecordingProcessor) collect() (*pb.SessionRecordingMetadata, *pb.Ses
 
 	// Finish off any remaining activity events
 	for user, userStartOffset := range t.activeUsers {
-		t.metadata.Events = append(t.metadata.Events, &pb.SessionRecordingEvent{
+		t.metadata.SetEvents(append(t.metadata.GetEvents(), pb.SessionRecordingEvent_builder{
 			StartOffset: durationpb.New(userStartOffset),
 			EndOffset:   durationpb.New(t.lastEvent.GetTime().Sub(t.startTime)),
-			Event: &pb.SessionRecordingEvent_Join{
-				Join: &pb.SessionRecordingJoinEvent{
-					User: user,
-				},
-			},
-		})
+			Join: pb.SessionRecordingJoinEvent_builder{
+				User: user,
+			}.Build(),
+		}.Build()))
 	}
 
-	t.metadata.Duration = durationpb.New(t.lastEvent.GetTime().Sub(t.startTime))
-	t.metadata.StartTime = timestamppb.New(t.startTime)
-	t.metadata.EndTime = timestamppb.New(t.lastEvent.GetTime())
+	t.metadata.SetDuration(durationpb.New(t.lastEvent.GetTime().Sub(t.startTime)))
+	t.metadata.SetStartTime(timestamppb.New(t.startTime))
+	t.metadata.SetEndTime(timestamppb.New(t.lastEvent.GetTime()))
 
 	return t.metadata, t.thumbnail
 }
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor_test.go b/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor_test.go
index 7c93ae4acc5..1f084cdf29c 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor_test.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/ttyprocessor_test.go
@@ -49,13 +49,13 @@ func TestTTYRecordingProcessor(t *testing.T) {
 			events: generateBasicSession(startTime),
 			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
 				require.NotNil(t, metadata)
-				require.NotNil(t, metadata.Duration)
-				require.Equal(t, int32(80), metadata.StartCols)
-				require.Equal(t, int32(24), metadata.StartRows)
+				require.NotNil(t, metadata.GetDuration())
+				require.Equal(t, int32(80), metadata.GetStartCols())
+				require.Equal(t, int32(24), metadata.GetStartRows())
 			},
 			expectedThumbnail: func(t *testing.T, thumbnail *pb.SessionRecordingThumbnail) {
 				require.NotNil(t, thumbnail)
-				require.NotEmpty(t, thumbnail.Svg)
+				require.NotEmpty(t, thumbnail.GetSvg())
 			},
 		},
 		{
@@ -63,13 +63,13 @@ func TestTTYRecordingProcessor(t *testing.T) {
 			events: generateBasicSessionWithImmediateResize(startTime),
 			expectedMetadata: func(t *testing.T, metadata *pb.SessionRecordingMetadata) {
 				require.NotNil(t, metadata)
-				require.NotNil(t, metadata.Duration)
-				require.Equal(t, int32(100), metadata.StartCols)
-				require.Equal(t, int32(30), metadata.StartRows)
+				require.NotNil(t, metadata.GetDuration())
+				require.Equal(t, int32(100), metadata.GetStartCols())
+				require.Equal(t, int32(30), metadata.GetStartRows())
 			},
 			expectedThumbnail: func(t *testing.T, thumbnail *pb.SessionRecordingThumbnail) {
 				require.NotNil(t, thumbnail)
-				require.NotEmpty(t, thumbnail.Svg)
+				require.NotEmpty(t, thumbnail.GetSvg())
 			},
 		},
 		{
@@ -79,11 +79,11 @@ func TestTTYRecordingProcessor(t *testing.T) {
 				require.NotNil(t, metadata)
 
 				var hasResize bool
-				for _, event := range metadata.Events {
+				for _, event := range metadata.GetEvents() {
 					if resize := event.GetResize(); resize != nil {
 						hasResize = true
-						require.Equal(t, int32(120), resize.Cols)
-						require.Equal(t, int32(40), resize.Rows)
+						require.Equal(t, int32(120), resize.GetCols())
+						require.Equal(t, int32(40), resize.GetRows())
 					}
 				}
 				require.True(t, hasResize, "expected resize event")
@@ -96,12 +96,12 @@ func TestTTYRecordingProcessor(t *testing.T) {
 				require.NotNil(t, metadata)
 
 				var inactivityCount int
-				for _, event := range metadata.Events {
+				for _, event := range metadata.GetEvents() {
 					if event.GetInactivity() != nil {
 						inactivityCount++
 
-						require.Equal(t, 1*time.Second, event.StartOffset.AsDuration(), "inactivity should start at last activity time")
-						require.Equal(t, 21*time.Second, event.EndOffset.AsDuration(), "inactivity should end when activity resumes")
+						require.Equal(t, 1*time.Second, event.GetStartOffset().AsDuration(), "inactivity should start at last activity time")
+						require.Equal(t, 21*time.Second, event.GetEndOffset().AsDuration(), "inactivity should end when activity resumes")
 					}
 				}
 				require.Equal(t, 1, inactivityCount, "expected exactly one inactivity event")
@@ -114,19 +114,19 @@ func TestTTYRecordingProcessor(t *testing.T) {
 				require.NotNil(t, metadata)
 
 				joins := make(map[string]*pb.SessionRecordingEvent)
-				for _, event := range metadata.Events {
+				for _, event := range metadata.GetEvents() {
 					if join := event.GetJoin(); join != nil {
-						joins[join.User] = event
+						joins[join.GetUser()] = event
 					}
 				}
 
 				require.Len(t, joins, 2, "expected join events for alice and bob")
 
-				require.Equal(t, 2*time.Second, joins["alice"].StartOffset.AsDuration())
-				require.Equal(t, 6*time.Second, joins["alice"].EndOffset.AsDuration())
+				require.Equal(t, 2*time.Second, joins["alice"].GetStartOffset().AsDuration())
+				require.Equal(t, 6*time.Second, joins["alice"].GetEndOffset().AsDuration())
 
-				require.Equal(t, 4*time.Second, joins["bob"].StartOffset.AsDuration())
-				require.Equal(t, 10*time.Second, joins["bob"].EndOffset.AsDuration())
+				require.Equal(t, 4*time.Second, joins["bob"].GetStartOffset().AsDuration())
+				require.Equal(t, 10*time.Second, joins["bob"].GetEndOffset().AsDuration())
 			},
 		},
 	}
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail.go b/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail.go
index 6d232ab890c..d1bc24f2aab 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail.go
@@ -88,14 +88,14 @@ func (t *ttyThumbnailGenerator) produceThumbnail(_ int) (*pb.SessionRecordingThu
 	cols, rows := t.vt.Size()
 	cursor := t.vt.Cursor()
 
-	return &pb.SessionRecordingThumbnail{
+	return pb.SessionRecordingThumbnail_builder{
 		Svg:           terminal.VtToSvg(t.vt),
 		Cols:          int32(cols),
 		Rows:          int32(rows),
 		CursorX:       int32(cursor.X),
 		CursorY:       int32(cursor.Y),
 		CursorVisible: t.vt.CursorVisible(),
-	}, nil
+	}.Build(), nil
 }
 
 func (t *ttyThumbnailGenerator) release() {
diff --git a/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail_test.go b/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail_test.go
index 756f67c4ab0..11e04c128c4 100644
--- a/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail_test.go
+++ b/lib/auth/recordingmetadata/recordingmetadatav1/ttythumbnail_test.go
@@ -38,8 +38,8 @@ func TestTtyThumbnailGenerator_HandleEvent(t *testing.T) {
 		thumb, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
 
-		require.Equal(t, int32(100), thumb.Cols)
-		require.Equal(t, int32(50), thumb.Rows)
+		require.Equal(t, int32(100), thumb.GetCols())
+		require.Equal(t, int32(50), thumb.GetRows())
 	})
 
 	t.Run("resize updates terminal size", func(t *testing.T) {
@@ -51,8 +51,8 @@ func TestTtyThumbnailGenerator_HandleEvent(t *testing.T) {
 		thumb, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
 
-		require.Equal(t, int32(120), thumb.Cols)
-		require.Equal(t, int32(40), thumb.Rows)
+		require.Equal(t, int32(120), thumb.GetCols())
+		require.Equal(t, int32(40), thumb.GetRows())
 	})
 
 	t.Run("session print writes data to terminal", func(t *testing.T) {
@@ -64,9 +64,9 @@ func TestTtyThumbnailGenerator_HandleEvent(t *testing.T) {
 		thumb, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
 
-		require.NotEmpty(t, thumb.Svg)
-		require.Contains(t, string(thumb.Svg), "Hello")
-		require.Contains(t, string(thumb.Svg), "World")
+		require.NotEmpty(t, thumb.GetSvg())
+		require.Contains(t, string(thumb.GetSvg()), "Hello")
+		require.Contains(t, string(thumb.GetSvg()), "World")
 	})
 
 	t.Run("unhandled event types are ignored", func(t *testing.T) {
@@ -110,11 +110,11 @@ func TestTtyThumbnailGenerator_ProduceThumbnail(t *testing.T) {
 		require.NoError(t, err)
 
 		require.NotNil(t, thumb)
-		require.Equal(t, int32(80), thumb.Cols)
-		require.Equal(t, int32(24), thumb.Rows)
-		require.NotEmpty(t, thumb.Svg)
-		require.Contains(t, string(thumb.Svg), "<svg")
-		require.Contains(t, string(thumb.Svg), "hello")
+		require.Equal(t, int32(80), thumb.GetCols())
+		require.Equal(t, int32(24), thumb.GetRows())
+		require.NotEmpty(t, thumb.GetSvg())
+		require.Contains(t, string(thumb.GetSvg()), "<svg")
+		require.Contains(t, string(thumb.GetSvg()), "hello")
 	})
 
 	t.Run("cursor tracks print output position", func(t *testing.T) {
@@ -125,15 +125,15 @@ func TestTtyThumbnailGenerator_ProduceThumbnail(t *testing.T) {
 		thumb0, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
 
-		require.Equal(t, int32(0), thumb0.CursorX)
-		require.Equal(t, int32(0), thumb0.CursorY)
+		require.Equal(t, int32(0), thumb0.GetCursorX())
+		require.Equal(t, int32(0), thumb0.GetCursorY())
 
 		require.NoError(t, gen.handleEvent(sessionPrintEvent(startTime.Add(1*time.Second), "line1\r\nline2\r\nline3\r\n")))
 
 		thumb, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
-		require.Equal(t, int32(0), thumb.CursorX, "cursor should be at start of line after \\r\\n")
-		require.Equal(t, int32(3), thumb.CursorY, "cursor should be on 4th row after 3 lines")
+		require.Equal(t, int32(0), thumb.GetCursorX(), "cursor should be at start of line after \\r\\n")
+		require.Equal(t, int32(3), thumb.GetCursorY(), "cursor should be on 4th row after 3 lines")
 	})
 
 	t.Run("reflects latest terminal size after resize", func(t *testing.T) {
@@ -146,10 +146,10 @@ func TestTtyThumbnailGenerator_ProduceThumbnail(t *testing.T) {
 		thumb, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
 
-		require.Equal(t, int32(200), thumb.Cols)
-		require.Equal(t, int32(50), thumb.Rows)
-		require.Contains(t, string(thumb.Svg), "before")
-		require.Contains(t, string(thumb.Svg), "resize")
+		require.Equal(t, int32(200), thumb.GetCols())
+		require.Equal(t, int32(50), thumb.GetRows())
+		require.Contains(t, string(thumb.GetSvg()), "before")
+		require.Contains(t, string(thumb.GetSvg()), "resize")
 	})
 
 	t.Run("snapshots are independent after more output", func(t *testing.T) {
@@ -166,10 +166,10 @@ func TestTtyThumbnailGenerator_ProduceThumbnail(t *testing.T) {
 		thumb2, err := gen.produceThumbnail(thumbnailMaxDimensions)
 		require.NoError(t, err)
 
-		require.NotEqual(t, thumb1.Svg, thumb2.Svg, "thumbnails should differ after more output")
-		require.NotContains(t, string(thumb1.Svg), "second", "first snapshot should not contain later output")
-		require.Contains(t, string(thumb2.Svg), "first", "second snapshot should still contain earlier output")
-		require.Contains(t, string(thumb2.Svg), "second")
-		require.Greater(t, thumb2.CursorY, thumb1.CursorY, "cursor should have advanced")
+		require.NotEqual(t, thumb1.GetSvg(), thumb2.GetSvg(), "thumbnails should differ after more output")
+		require.NotContains(t, string(thumb1.GetSvg()), "second", "first snapshot should not contain later output")
+		require.Contains(t, string(thumb2.GetSvg()), "first", "second snapshot should still contain earlier output")
+		require.Contains(t, string(thumb2.GetSvg()), "second")
+		require.Greater(t, thumb2.GetCursorY(), thumb1.GetCursorY(), "cursor should have advanced")
 	})
 }
diff --git a/lib/auth/requestable_roles_test.go b/lib/auth/requestable_roles_test.go
index 07e71ab63d9..400f366713c 100644
--- a/lib/auth/requestable_roles_test.go
+++ b/lib/auth/requestable_roles_test.go
@@ -112,8 +112,8 @@ func TestListRequestableRoles(t *testing.T) {
 
 		// Verify that all the requestable roles were returned.
 		var receivedRoles []string
-		for _, role := range resp.Roles {
-			receivedRoles = append(receivedRoles, role.Name)
+		for _, role := range resp.GetRoles() {
+			receivedRoles = append(receivedRoles, role.GetName())
 		}
 		require.Empty(t, cmp.Diff(expectedRequestableRoles, receivedRoles))
 
@@ -122,39 +122,39 @@ func TestListRequestableRoles(t *testing.T) {
 		require.NotContains(t, receivedRoles, "user-role")
 
 		// There shouldn't be a nextKey
-		require.Empty(t, resp.NextPageToken)
+		require.Empty(t, resp.GetNextPageToken())
 	})
 
 	t.Run("list a page of requestable roles starting with a startKey", func(t *testing.T) {
 		// Get the first page of 3
-		firstPageReq := &authpb.ListRequestableRolesRequest{
+		firstPageReq := authpb.ListRequestableRolesRequest_builder{
 			PageSize: 3,
-		}
+		}.Build()
 		firstPageResp, err := client.ListRequestableRoles(userCtx, firstPageReq)
 		require.NoError(t, err)
-		require.NotEmpty(t, firstPageResp.NextPageToken)
+		require.NotEmpty(t, firstPageResp.GetNextPageToken())
 
-		secondPageReq := &authpb.ListRequestableRolesRequest{
+		secondPageReq := authpb.ListRequestableRolesRequest_builder{
 			PageSize:  3,
-			PageToken: firstPageResp.NextPageToken,
-		}
+			PageToken: firstPageResp.GetNextPageToken(),
+		}.Build()
 		secondPageResp, err := client.ListRequestableRoles(userCtx, secondPageReq)
 		require.NoError(t, err)
 
 		// Verify that the second page has the correct roles.
 		var receivedRoles []string
-		for _, role := range secondPageResp.Roles {
-			receivedRoles = append(receivedRoles, role.Name)
+		for _, role := range secondPageResp.GetRoles() {
+			receivedRoles = append(receivedRoles, role.GetName())
 		}
 		require.Empty(t, cmp.Diff(expectedRequestableRoles[3:6], receivedRoles))
 
 		// Verify there is no overlap in roles between the pages.
 		firstPageRoleNames := make(map[string]bool)
-		for _, role := range firstPageResp.Roles {
-			firstPageRoleNames[role.Name] = true
+		for _, role := range firstPageResp.GetRoles() {
+			firstPageRoleNames[role.GetName()] = true
 		}
-		for _, role := range secondPageResp.Roles {
-			require.False(t, firstPageRoleNames[role.Name])
+		for _, role := range secondPageResp.GetRoles() {
+			require.False(t, firstPageRoleNames[role.GetName()])
 		}
 	})
 
@@ -162,10 +162,10 @@ func TestListRequestableRoles(t *testing.T) {
 		limit := 3
 
 		respRoles, err := stream.Collect(clientutils.ResourcesWithPageSize(userCtx, func(ctx context.Context, pageSize int, pageToken string) ([]*authpb.ListRequestableRolesResponse_RequestableRole, string, error) {
-			req := &authpb.ListRequestableRolesRequest{
+			req := authpb.ListRequestableRolesRequest_builder{
 				PageSize:  int32(pageSize),
 				PageToken: pageToken,
-			}
+			}.Build()
 
 			resp, err := client.ListRequestableRoles(ctx, req)
 			if err != nil {
@@ -173,18 +173,18 @@ func TestListRequestableRoles(t *testing.T) {
 			}
 
 			// Verify that we got the correct page size (except for the last page).
-			if resp.NextPageToken != "" {
-				require.Len(t, resp.Roles, pageSize)
+			if resp.GetNextPageToken() != "" {
+				require.Len(t, resp.GetRoles(), pageSize)
 			}
 
-			return resp.Roles, resp.NextPageToken, nil
+			return resp.GetRoles(), resp.GetNextPageToken(), nil
 		}, limit))
 		require.NoError(t, err)
 
 		// Verify that all the requestable roles were returned.
 		var receivedRoles []string
 		for _, role := range respRoles {
-			receivedRoles = append(receivedRoles, role.Name)
+			receivedRoles = append(receivedRoles, role.GetName())
 		}
 		require.Empty(t, cmp.Diff(expectedRequestableRoles, receivedRoles))
 	})
@@ -219,25 +219,25 @@ func TestListRequestableRoles(t *testing.T) {
 		require.NoError(t, err)
 
 		// Verify that nothing is returned.
-		require.Empty(t, resp.Roles)
-		require.Empty(t, resp.NextPageToken)
+		require.Empty(t, resp.GetRoles())
+		require.Empty(t, resp.GetNextPageToken())
 	})
 
 	t.Run("list requestable roles with a search filter", func(t *testing.T) {
-		req := &authpb.ListRequestableRolesRequest{
-			Filter: &authpb.ListRequestableRolesRequest_Filter{
+		req := authpb.ListRequestableRolesRequest_builder{
+			Filter: authpb.ListRequestableRolesRequest_Filter_builder{
 				SearchKeywords: []string{"role-99"},
-			},
-		}
+			}.Build(),
+		}.Build()
 		resp, err := client.ListRequestableRoles(userCtx, req)
 		require.NoError(t, err)
 
 		// Verify that only "role-99" was returned
-		require.Len(t, resp.Roles, 1)
-		require.Equal(t, "role-99", resp.Roles[0].Name)
+		require.Len(t, resp.GetRoles(), 1)
+		require.Equal(t, "role-99", resp.GetRoles()[0].GetName())
 
 		// There shouldn't be a nextKey
-		require.Empty(t, resp.NextPageToken)
+		require.Empty(t, resp.GetNextPageToken())
 	})
 
 }
diff --git a/lib/auth/scopes/access/service.go b/lib/auth/scopes/access/service.go
index 287ff4b35fd..074cac375da 100644
--- a/lib/auth/scopes/access/service.go
+++ b/lib/auth/scopes/access/service.go
@@ -139,16 +139,16 @@ func (s *Server) CreateScopedRoleAssignment(ctx context.Context, req *scopedacce
 	}
 
 	if assignment := req.GetAssignment(); assignment.GetMetadata() == nil {
-		assignment.Metadata = &headerv1.Metadata{}
+		assignment.SetMetadata(&headerv1.Metadata{})
 	}
 
 	if req.GetAssignment().GetMetadata().GetName() == "" {
-		req.GetAssignment().GetMetadata().Name = uuid.New().String()
+		req.GetAssignment().GetMetadata().SetName(uuid.New().String())
 	}
 	// Currently, don't allow assignments created via the API to have a status,
 	// as they could impersonate an access-list-materialized assignment.
 	// TODO(nklaassen): set assignment status based on authenticated identity.
-	req.GetAssignment().Status = nil
+	req.GetAssignment().ClearStatus()
 
 	if err := scopedaccess.StrongValidateAssignment(req.GetAssignment()); err != nil {
 		return nil, trace.Wrap(err)
@@ -187,9 +187,9 @@ func (s *Server) DeleteScopedRole(ctx context.Context, req *scopedaccessv1.Delet
 	}
 
 	// load the role so we can determine the resource scope.
-	grsp, err := s.cfg.BackendReader.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	grsp, err := s.cfg.BackendReader.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: req.GetName(),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -215,7 +215,7 @@ func (s *Server) DeleteScopedRole(ctx context.Context, req *scopedaccessv1.Delet
 
 	// set the revision to the current revision to prevent deletion in the event of concurrent modification
 	// that might invalidate the access-control checks we just performed.
-	req.Revision = grsp.GetRole().GetMetadata().GetRevision()
+	req.SetRevision(grsp.GetRole().GetMetadata().GetRevision())
 
 	return s.cfg.Writer.DeleteScopedRole(ctx, req)
 }
@@ -241,10 +241,10 @@ func (s *Server) DeleteScopedRoleAssignment(ctx context.Context, req *scopedacce
 	}
 
 	// load the assignment so we can determine the resource scope.
-	grsp, err := s.cfg.BackendReader.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	grsp, err := s.cfg.BackendReader.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    req.GetName(),
 		SubKind: req.GetSubKind(),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -270,7 +270,7 @@ func (s *Server) DeleteScopedRoleAssignment(ctx context.Context, req *scopedacce
 
 	// set the revision to the current revision to prevent deletion in the event of concurrent modification
 	// that might invalidate the access-control checks we just performed.
-	req.Revision = grsp.GetAssignment().GetMetadata().GetRevision()
+	req.SetRevision(grsp.GetAssignment().GetMetadata().GetRevision())
 
 	return s.cfg.Writer.DeleteScopedRoleAssignment(ctx, req)
 }
@@ -373,14 +373,14 @@ func (s *Server) ListScopedRoleAssignments(ctx context.Context, req *scopedacces
 	// can be pre-built once at the beginning of the call.
 	ruleCtx := authzContext.RuleContext()
 
-	if req.AllCallerAssignments {
+	if req.GetAllCallerAssignments() {
 		// the all_caller_assignments flag indicates that the caller is specifically trying to discover
 		// their own assignments. in this mode we do not require resource verb permissions, instead filtering
 		// the results to only those assignments that apply to the caller.
 		if req.GetUser() != "" && req.GetUser() != authzContext.User.GetName() {
 			return nil, trace.AccessDenied("caller %q cannot list assignments for user %q using the all_caller_assignments flag", authzContext.User.GetName(), req.GetUser())
 		}
-		req.User = authzContext.User.GetName()
+		req.SetUser(authzContext.User.GetName())
 	} else {
 		// do a pre-check to weed out requests that definitely won't be authorized.
 		if err := authzContext.CheckerContext.CheckMaybeHasAccessToRules(&ruleCtx, scopedaccess.KindScopedRoleAssignment, types.VerbReadNoSecrets, types.VerbList); err != nil {
@@ -390,7 +390,7 @@ func (s *Server) ListScopedRoleAssignments(ctx context.Context, req *scopedacces
 
 	// list scoped role assignments with a filter that only passes assignments the user has access to.
 	rsp, err := s.cfg.Reader.ListScopedRoleAssignmentsWithFilter(ctx, req, func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
-		if req.AllCallerAssignments {
+		if req.GetAllCallerAssignments() {
 			// note that this short-circuit doesn't just bypass verb checks, it also bypasses scope pinning. this is
 			// intended behavior and an important part of what makes the all_caller_assignments mode useful, as it allows
 			// users to get an overview of their available privileges across all scopes.
@@ -492,7 +492,7 @@ func (s *Server) UpdateScopedRoleAssignment(ctx context.Context, req *scopedacce
 	// as they could impersonate an access-list-materialized assignment.
 	// TODO(nklaassen): set assignment status based on authenticated identity.
 	if req.GetAssignment().GetStatus() != nil {
-		req.GetAssignment().Status = nil
+		req.GetAssignment().ClearStatus()
 	}
 
 	return s.cfg.Writer.UpdateScopedRoleAssignment(ctx, req)
@@ -549,7 +549,7 @@ func (s *Server) UpsertScopedRoleAssignment(ctx context.Context, req *scopedacce
 	// as they could impersonate an access-list-materialized assignment.
 	// TODO(nklaassen): set assignment status based on authenticated identity.
 	if req.GetAssignment().GetStatus() != nil {
-		req.GetAssignment().Status = nil
+		req.GetAssignment().ClearStatus()
 	}
 
 	return s.cfg.Writer.UpsertScopedRoleAssignment(ctx, req)
diff --git a/lib/auth/scopes/access/service_test.go b/lib/auth/scopes/access/service_test.go
index 7019c4ffc78..b99dcf92c87 100644
--- a/lib/auth/scopes/access/service_test.go
+++ b/lib/auth/scopes/access/service_test.go
@@ -181,47 +181,47 @@ func TestRoleBasics(t *testing.T) {
 	defer bk.Close()
 
 	initialRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-admin",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "prod-admin",
-			},
+			}.Build(),
 			Scope: "/prod",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/prod"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	for _, role := range initialRoles {
 		// bootstrap in an initial role so that we can start using scoped permissions for our tests
-		_, err := bk.service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := bk.service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -232,28 +232,28 @@ func TestRoleBasics(t *testing.T) {
 
 	// set up server pinned to a staging admin identity
 	srv := newServerForIdentity(t, bk, &services.AccessInfo{
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/staging",
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/staging": {"/staging": {"staging-admin"}},
 			}),
-		},
+		}.Build(),
 		Username: "alice",
 	})
 
 	// verify expected successful read
-	rrsp, err := srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err := srv.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "staging-admin",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "staging-admin", rrsp.GetRole().GetMetadata().GetName())
 	require.Equal(t, "/staging", rrsp.GetRole().GetScope())
 
 	// verify expected denied read
-	_, err = srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	_, err = srv.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "prod-admin",
-	})
+	}.Build())
 	require.Error(t, err)
 	// within the scopes model, getting a disallowed resource by its name is always considered an access denied,
 	// this is a divergence from our traditional RBAC model where a not found might be returned instead. scopes don't
@@ -268,25 +268,25 @@ func TestRoleBasics(t *testing.T) {
 	require.Equal(t, "staging-admin", lrsp.GetRoles()[0].GetMetadata().GetName())
 
 	// verify expected successful create
-	crsp, err := srv.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	crsp, err := srv.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-user",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "staging-user", crsp.GetRole().GetMetadata().GetName())
 
@@ -296,33 +296,33 @@ func TestRoleBasics(t *testing.T) {
 	})
 
 	// verify expected denied create (out of scope)
-	_, err = srv.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = srv.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "prod-user",
-			},
+			}.Build(),
 			Scope: "/prod",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/prod"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that denied create really didn't create the role (requires using backend service
 	// directly to avoid false positive due to cache replication)
-	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = bk.service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "prod-user",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected not found error, got: %v", err)
 	require.Nil(t, rrsp)
@@ -330,20 +330,20 @@ func TestRoleBasics(t *testing.T) {
 	// verify expected successful update
 
 	// start by getting the existing role
-	rrsp, err = srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = srv.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "staging-user",
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// modify the role
-	rrsp.Role.Metadata.Labels = map[string]string{
+	rrsp.GetRole().GetMetadata().SetLabels(map[string]string{
 		"key": "val",
-	}
+	})
 
 	// update the role
-	ursp, err := srv.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	ursp, err := srv.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: rrsp.GetRole(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "staging-user", ursp.GetRole().GetMetadata().GetName())
 	require.NotEqual(t, rrsp.GetRole().GetMetadata().GetRevision(), ursp.GetRole().GetMetadata().GetRevision())
@@ -364,36 +364,36 @@ func TestRoleBasics(t *testing.T) {
 
 	// start by getting the existing role (requires using backend service
 	// directly since our server is using a scoped identity)
-	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = bk.service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "prod-admin",
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// modify the role
-	rrsp.Role.Metadata.Labels = map[string]string{
+	rrsp.GetRole().GetMetadata().SetLabels(map[string]string{
 		"key": "val",
-	}
+	})
 
 	// attempt to update the role
-	ursp, err = srv.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	ursp, err = srv.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: rrsp.GetRole(),
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 	require.Nil(t, ursp)
 
 	// verify that denied update really didn't update the role (requires using backend service
 	// directly to avoid false positive due to cache replication)
-	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = bk.service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "prod-admin",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Nil(t, rrsp.GetRole().GetMetadata().GetLabels())
 
 	// verify expected successful delete
-	_, err = srv.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+	_, err = srv.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 		Name: "staging-user",
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// wait for deletion to be populated into cache
@@ -407,34 +407,34 @@ func TestRoleBasics(t *testing.T) {
 	})
 
 	// verify expected denied delete (out of scope)
-	_, err = srv.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+	_, err = srv.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 		Name: "prod-admin",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that denied delete really didn't delete the role (requires using backend service
 	// directly to avoid false positive due to cache replication)
-	rrsp, err = bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = bk.service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "prod-admin",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "prod-admin", rrsp.GetRole().GetMetadata().GetName())
 
 	// verify expected successful upsert (creates new role)
-	ursp2, err := srv.UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	ursp2, err := srv.UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-upserted",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "staging-upserted", ursp2.GetRole().GetMetadata().GetName())
 
@@ -449,28 +449,28 @@ func TestRoleBasics(t *testing.T) {
 	})
 
 	// verify expected successful upsert (updates existing role)
-	ursp2.Role.Metadata.Labels = map[string]string{"upserted": "true"}
-	ursp3, err := srv.UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
+	ursp2.GetRole().GetMetadata().SetLabels(map[string]string{"upserted": "true"})
+	ursp3, err := srv.UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
 		Role: ursp2.GetRole(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "staging-upserted", ursp3.GetRole().GetMetadata().GetName())
 	require.Equal(t, "true", ursp3.GetRole().GetMetadata().GetLabels()["upserted"])
 
 	// verify expected denied upsert (out of scope)
-	_, err = srv.UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = srv.UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "prod-upserted",
-			},
+			}.Build(),
 			Scope: "/prod",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/prod"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 }
@@ -482,59 +482,59 @@ func TestAssignmentBasics(t *testing.T) {
 
 	ctx := t.Context()
 	newForgedStatus := func() *scopedaccessv1.ScopedRoleAssignmentStatus {
-		return &scopedaccessv1.ScopedRoleAssignmentStatus{
-			Origin: &scopedaccessv1.ScopedRoleAssignmentStatus_Origin{
+		return scopedaccessv1.ScopedRoleAssignmentStatus_builder{
+			Origin: scopedaccessv1.ScopedRoleAssignmentStatus_Origin_builder{
 				CreatorKind: scopedaccess.CreatorKindAccessList,
 				CreatorName: "forged-access-list",
-			},
-		}
+			}.Build(),
+		}.Build()
 	}
 
 	bk := newBackendPack(t)
 	defer bk.Close()
 
 	initialRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-admin",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "prod-admin",
-			},
+			}.Build(),
 			Scope: "/prod",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/prod"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	for _, role := range initialRoles {
 		// bootstrap in an initial role so that we can start using scoped permissions for our tests
-		_, err := bk.service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := bk.service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -550,9 +550,9 @@ func TestAssignmentBasics(t *testing.T) {
 	}
 
 	for _, assignment := range initialAssignments {
-		_, err := bk.service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		_, err := bk.service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: assignment,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -563,30 +563,30 @@ func TestAssignmentBasics(t *testing.T) {
 
 	// set up server pinned to a staging admin identity
 	srv := newServerForIdentity(t, bk, &services.AccessInfo{
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/staging",
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/staging": {"/staging": {"staging-admin"}},
 			}),
-		},
+		}.Build(),
 		Username: "alice",
 	})
 
 	// verify expected successful read
-	rasp, err := srv.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	rasp, err := srv.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    initialAssignments[0].GetMetadata().GetName(),
 		SubKind: initialAssignments[0].GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, initialAssignments[0].GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
 	require.Equal(t, "/staging", rasp.GetAssignment().GetScope())
 
 	// verify expected denied read
-	rasp, err = srv.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	rasp, err = srv.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    initialAssignments[1].GetMetadata().GetName(),
 		SubKind: initialAssignments[1].GetSubKind(),
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 	require.Nil(t, rasp)
@@ -600,10 +600,10 @@ func TestAssignmentBasics(t *testing.T) {
 
 	// verify expected successful create
 	a1 := newScopedRoleAssignmentAtScope("staging-admin", "/staging")
-	a1.Status = newForgedStatus()
-	carsp, err := srv.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	a1.SetStatus(newForgedStatus())
+	carsp, err := srv.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: a1,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, a1.GetMetadata().GetName(), carsp.GetAssignment().GetMetadata().GetName())
 	require.Nil(t, carsp.GetAssignment().GetStatus())
@@ -615,28 +615,28 @@ func TestAssignmentBasics(t *testing.T) {
 
 	// verify expected denied create (out of scope)
 	a2 := newScopedRoleAssignmentAtScope("prod-admin", "/prod")
-	carsp, err = srv.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	carsp, err = srv.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: a2,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 	require.Nil(t, carsp)
 
 	// verify that denied create really didn't create the assignment (requires using backend service
 	// directly to avoid false positive due to cache replication)
-	garsp, err := bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	garsp, err := bk.service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    a2.GetMetadata().GetName(),
 		SubKind: a2.GetSubKind(),
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected not found error, got: %v", err)
 	require.Nil(t, garsp)
 
 	// verify expected successful delete
-	_, err = srv.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+	_, err = srv.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    a1.GetMetadata().GetName(),
 		SubKind: a1.GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// wait for deletion to be populated into cache
@@ -650,19 +650,19 @@ func TestAssignmentBasics(t *testing.T) {
 	})
 
 	// verify expected denied delete (out of scope)
-	_, err = srv.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+	_, err = srv.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    initialAssignments[1].GetMetadata().GetName(),
 		SubKind: initialAssignments[1].GetSubKind(),
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that denied delete really didn't delete the assignment (requires using backend service
 	// directly to avoid false positive due to cache replication)
-	rasp, err = bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	rasp, err = bk.service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    initialAssignments[1].GetMetadata().GetName(),
 		SubKind: initialAssignments[1].GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, initialAssignments[1].GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
 
@@ -670,9 +670,9 @@ func TestAssignmentBasics(t *testing.T) {
 
 	// create an assignment to update
 	a3 := newScopedRoleAssignmentAtScope("staging-admin", "/staging")
-	ca3rsp, err := srv.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	ca3rsp, err := srv.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: a3,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// wait for assignment to be populated into cache
@@ -686,11 +686,11 @@ func TestAssignmentBasics(t *testing.T) {
 	})
 
 	// add a label and update
-	ca3rsp.Assignment.Metadata.Labels = map[string]string{"key": "val"}
-	ca3rsp.Assignment.Status = newForgedStatus()
-	ua3rsp, err := srv.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
+	ca3rsp.GetAssignment().GetMetadata().SetLabels(map[string]string{"key": "val"})
+	ca3rsp.GetAssignment().SetStatus(newForgedStatus())
+	ua3rsp, err := srv.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: ca3rsp.GetAssignment(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, a3.GetMetadata().GetName(), ua3rsp.GetAssignment().GetMetadata().GetName())
 	require.NotEqual(t, ca3rsp.GetAssignment().GetMetadata().GetRevision(), ua3rsp.GetAssignment().GetMetadata().GetRevision())
@@ -712,36 +712,36 @@ func TestAssignmentBasics(t *testing.T) {
 
 	// start by getting the existing assignment (requires using backend service
 	// directly since our server is using a scoped identity)
-	garsp, err = bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	garsp, err = bk.service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    initialAssignments[1].GetMetadata().GetName(),
 		SubKind: initialAssignments[1].GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// attempt to update the out-of-scope assignment
-	garsp.Assignment.Metadata.Labels = map[string]string{"key": "val"}
-	uarsp, err := srv.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
+	garsp.GetAssignment().GetMetadata().SetLabels(map[string]string{"key": "val"})
+	uarsp, err := srv.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: garsp.GetAssignment(),
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 	require.Nil(t, uarsp)
 
 	// verify that denied update really didn't update the assignment
-	garsp, err = bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	garsp, err = bk.service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    initialAssignments[1].GetMetadata().GetName(),
 		SubKind: initialAssignments[1].GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Nil(t, garsp.GetAssignment().GetMetadata().GetLabels())
 	require.Nil(t, garsp.GetAssignment().GetStatus())
 
 	// verify expected successful upsert (creates new assignment)
 	a4 := newScopedRoleAssignmentAtScope("staging-admin", "/staging")
-	a4.Status = newForgedStatus()
-	ua4rsp, err := srv.UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+	a4.SetStatus(newForgedStatus())
+	ua4rsp, err := srv.UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 		Assignment: a4,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, a4.GetMetadata().GetName(), ua4rsp.GetAssignment().GetMetadata().GetName())
 	require.Nil(t, ua4rsp.GetAssignment().GetStatus())
@@ -757,51 +757,51 @@ func TestAssignmentBasics(t *testing.T) {
 	})
 
 	// verify expected successful upsert (updates existing assignment)
-	ua4rsp.Assignment.Metadata.Labels = map[string]string{"upserted": "true"}
-	ua4rsp.Assignment.Status = newForgedStatus()
-	ua4rsp2, err := srv.UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+	ua4rsp.GetAssignment().GetMetadata().SetLabels(map[string]string{"upserted": "true"})
+	ua4rsp.GetAssignment().SetStatus(newForgedStatus())
+	ua4rsp2, err := srv.UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 		Assignment: ua4rsp.GetAssignment(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, a4.GetMetadata().GetName(), ua4rsp2.GetAssignment().GetMetadata().GetName())
 	require.Equal(t, "true", ua4rsp2.GetAssignment().GetMetadata().GetLabels()["upserted"])
 	require.Nil(t, ua4rsp2.GetAssignment().GetStatus())
 
-	garsp, err = bk.service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	garsp, err = bk.service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    a4.GetMetadata().GetName(),
 		SubKind: a4.GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Nil(t, garsp.GetAssignment().GetStatus())
 
 	// verify expected denied upsert (out of scope)
 	a5 := newScopedRoleAssignmentAtScope("prod-admin", "/prod")
-	_, err = srv.UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+	_, err = srv.UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 		Assignment: a5,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 }
 
 func newScopedRoleAssignmentAtScope(roleName string, scope string) *scopedaccessv1.ScopedRoleAssignment {
-	return &scopedaccessv1.ScopedRoleAssignment{
+	return scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: scope,
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "bob",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  roleName,
 					Scope: scope,
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 }
 
 // TestUnscopedBasics verifies that unscoped access control works as expected.
@@ -865,19 +865,19 @@ func TestUnscopedBasics(t *testing.T) {
 	})
 
 	// verify that admin can create a role
-	crsp, err := srvAlice.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	crsp, err := srvAlice.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "some-role",
-			},
+			}.Build(),
 			Scope: "/some-scope",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/some-scope"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// wait for roles to be populated into cache
@@ -886,9 +886,9 @@ func TestUnscopedBasics(t *testing.T) {
 	})
 
 	// verify that admin can read the role
-	rrsp, err := srvAlice.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err := srvAlice.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "some-role",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "some-role", rrsp.GetRole().GetMetadata().GetName())
 
@@ -900,26 +900,26 @@ func TestUnscopedBasics(t *testing.T) {
 	require.Equal(t, "some-role", lrsp.GetRoles()[0].GetMetadata().GetName())
 
 	// verify that auditor cannot create a role
-	_, err = srvBob.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = srvBob.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "some-other-role",
-			},
+			}.Build(),
 			Scope: "/some-scope",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/some-scope"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that auditor can read the admin-created role
-	rrsp, err = srvBob.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = srvBob.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "some-role",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, crsp.GetRole().GetMetadata().GetName(), rrsp.GetRole().GetMetadata().GetName())
 
@@ -931,26 +931,26 @@ func TestUnscopedBasics(t *testing.T) {
 	require.Equal(t, crsp.GetRole().GetMetadata().GetName(), lrsp.GetRoles()[0].GetMetadata().GetName())
 
 	// verify that admin can create an assignment
-	acrsp, err := srvAlice.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	acrsp, err := srvAlice.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.New().String(),
-			},
+			}.Build(),
 			Scope: "/some-scope",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "some-role",
 						Scope: "/some-scope",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "/some-scope", acrsp.GetAssignment().GetScope())
 
@@ -960,10 +960,10 @@ func TestUnscopedBasics(t *testing.T) {
 	})
 
 	// verify that admin can read the assignment
-	rasp, err := srvAlice.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	rasp, err := srvAlice.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    acrsp.GetAssignment().GetMetadata().GetName(),
 		SubKind: acrsp.GetAssignment().GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
 
@@ -975,34 +975,34 @@ func TestUnscopedBasics(t *testing.T) {
 	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), lasp.GetAssignments()[0].GetMetadata().GetName())
 
 	// verify that auditor cannot create an assignment
-	_, err = srvBob.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	_, err = srvBob.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.New().String(),
-			},
+			}.Build(),
 			Scope: "/some-scope",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "some-role",
 						Scope: "/some-scope",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that auditor can read the admin-created assignment
-	rasp, err = srvBob.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	rasp, err = srvBob.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    acrsp.GetAssignment().GetMetadata().GetName(),
 		SubKind: acrsp.GetAssignment().GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, acrsp.GetAssignment().GetMetadata().GetName(), rasp.GetAssignment().GetMetadata().GetName())
 
@@ -1016,50 +1016,50 @@ func TestUnscopedBasics(t *testing.T) {
 	// verify that admin can update roles
 
 	// start by getting the existing role
-	rrsp, err = srvAlice.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = srvAlice.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: "some-role",
-	})
+	}.Build())
 	require.NoError(t, err)
-	rrsp.Role.Metadata.Labels = map[string]string{
+	rrsp.GetRole().GetMetadata().SetLabels(map[string]string{
 		"key": "val",
-	}
+	})
 
 	// update the role
-	ursp, err := srvAlice.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	ursp, err := srvAlice.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: rrsp.GetRole(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, crsp.GetRole().GetMetadata().GetName(), ursp.GetRole().GetMetadata().GetName())
 	require.NotEqual(t, rrsp.GetRole().GetMetadata().GetRevision(), ursp.GetRole().GetMetadata().GetRevision())
 
 	// verify that auditor cannot update roles
-	rrsp, err = srvBob.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rrsp, err = srvBob.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: crsp.GetRole().GetMetadata().GetName(),
-	})
+	}.Build())
 	require.NoError(t, err)
-	rrsp.Role.Metadata.Labels = map[string]string{
+	rrsp.GetRole().GetMetadata().SetLabels(map[string]string{
 		"key": "val2",
-	}
-	ursp, err = srvBob.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
-		Role: rrsp.GetRole(),
 	})
+	ursp, err = srvBob.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
+		Role: rrsp.GetRole(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 	require.Nil(t, ursp)
 
 	// verify that auditor cannot delete assignments
-	_, err = srvBob.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+	_, err = srvBob.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    acrsp.GetAssignment().GetMetadata().GetName(),
 		SubKind: acrsp.GetAssignment().GetSubKind(),
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that admin can delete assignments
-	_, err = srvAlice.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+	_, err = srvAlice.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    acrsp.GetAssignment().GetMetadata().GetName(),
 		SubKind: acrsp.GetAssignment().GetSubKind(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// wait for deletion to be populated into cache
@@ -1073,16 +1073,16 @@ func TestUnscopedBasics(t *testing.T) {
 	})
 
 	// verify that auditor cannot delete roles
-	_, err = srvBob.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+	_, err = srvBob.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 		Name: "some-role",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 
 	// verify that admin can delete roles
-	_, err = srvAlice.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+	_, err = srvAlice.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 		Name: "some-role",
-	})
+	}.Build())
 	require.NoError(t, err)
 	// wait for deletion to be populated into cache
 	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
@@ -1112,44 +1112,44 @@ func TestAccessChecksSkipInconsistentAssignments(t *testing.T) {
 	// alice is assigned both. When staging-admin is later made inconsistent, alice should
 	// retain read access from staging-reader but lose write access.
 	initialRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-reader",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
-					},
+					}.Build(),
 				},
-			},
-		},
-		{
+			}.Build(),
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-admin",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{scopedaccess.KindScopedRole, scopedaccess.KindScopedRoleAssignment},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	for _, role := range initialRoles {
-		_, err := bk.service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{Role: role})
+		_, err := bk.service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{Role: role}.Build())
 		require.NoError(t, err)
 	}
 
@@ -1160,32 +1160,32 @@ func TestAccessChecksSkipInconsistentAssignments(t *testing.T) {
 	// alice is assigned both roles at /staging (this is the "certificate" state — it does not change
 	// even after we make staging-admin inconsistent below).
 	aliceAccessInfo := &services.AccessInfo{
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/staging",
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/staging": {"/staging": {"staging-reader", "staging-admin"}},
 			}),
-		},
+		}.Build(),
 		Username: "alice",
 	}
 
 	// with both roles consistent, alice has full read/write access.
 	srv := newServerForIdentity(t, bk, aliceAccessInfo)
 
-	_, err := srv.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err := srv.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-probe",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err, "alice should have write access when both roles are consistent")
 
 	waitForRoleCondition(t, bk.cache, func(roles []*scopedaccessv1.ScopedRole) bool {
@@ -1195,13 +1195,13 @@ func TestAccessChecksSkipInconsistentAssignments(t *testing.T) {
 	// now update staging-admin to change its assignable scopes so that it no longer covers /staging.
 	// this makes the assignment inconsistent: the role is still referenced in alice's certificate, but
 	// it will fail RoleIsEnforceableAt during access checks and be skipped.
-	adminRole, err := bk.service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{Name: "staging-admin"})
+	adminRole, err := bk.service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{Name: "staging-admin"}.Build())
 	require.NoError(t, err)
 	// /staging/sub is a valid sub-scope of the role's resource scope /staging, so it passes
 	// StrongValidateRole — but it no longer covers /staging as a scope of effect, making the
 	// existing assignment inconsistent.
-	adminRole.Role.Spec.AssignableScopes = []string{"/staging/sub"}
-	_, err = bk.service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{Role: adminRole.GetRole()})
+	adminRole.GetRole().GetSpec().SetAssignableScopes([]string{"/staging/sub"})
+	_, err = bk.service.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{Role: adminRole.GetRole()}.Build())
 	require.NoError(t, err)
 
 	// wait for the updated role to be visible in cache
@@ -1219,11 +1219,11 @@ func TestAccessChecksSkipInconsistentAssignments(t *testing.T) {
 	srv = newServerForIdentity(t, bk, aliceAccessInfo)
 
 	// read access should still succeed — staging-reader is still consistent and grants it.
-	_, err = srv.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{Name: "staging-probe"})
+	_, err = srv.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{Name: "staging-probe"}.Build())
 	require.NoError(t, err, "alice should retain read access from the still-consistent staging-reader role")
 
 	// write access should now be denied — staging-admin is skipped, and staging-reader does not grant write.
-	_, err = srv.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{Name: "staging-probe"})
+	_, err = srv.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{Name: "staging-probe"}.Build())
 	require.Error(t, err, "alice should lose write access when the write-granting role becomes inconsistent")
 	require.True(t, trace.IsAccessDenied(err), "expected access denied error, got: %v", err)
 }
diff --git a/lib/auth/scopes/joining/service.go b/lib/auth/scopes/joining/service.go
index 14e7dd6925b..3dda9211343 100644
--- a/lib/auth/scopes/joining/service.go
+++ b/lib/auth/scopes/joining/service.go
@@ -117,9 +117,9 @@ func (s *Server) DeleteScopedToken(ctx context.Context, req *scopedjoiningv1.Del
 	}
 
 	// fetch the token so we can determine the resource scope
-	preAuthzRes, err := s.backend.GetScopedToken(ctx, &scopedjoiningv1.GetScopedTokenRequest{
+	preAuthzRes, err := s.backend.GetScopedToken(ctx, scopedjoiningv1.GetScopedTokenRequest_builder{
 		Name: req.GetName(),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -179,7 +179,7 @@ func makeCursor(token *scopedjoiningv1.ScopedToken) string {
 func (s *Server) scopedTokenIter(ctx context.Context, req *scopedjoiningv1.ListScopedTokensRequest) iter.Seq2[*scopedjoiningv1.ScopedToken, error] {
 	return func(yield func(token *scopedjoiningv1.ScopedToken, err error) bool) {
 		iterReq := proto.CloneOf(req)
-		iterReq.Limit = s.maxPageSize
+		iterReq.SetLimit(s.maxPageSize)
 
 		var cursorFound bool
 		for {
@@ -204,7 +204,7 @@ func (s *Server) scopedTokenIter(ctx context.Context, req *scopedjoiningv1.ListS
 			if res.GetCursor() == "" {
 				return
 			}
-			iterReq.Cursor = res.GetCursor()
+			iterReq.SetCursor(res.GetCursor())
 		}
 	}
 }
@@ -254,10 +254,10 @@ func (s *Server) ListScopedTokens(ctx context.Context, req *scopedjoiningv1.List
 	if len(authorizedTokens) >= limit {
 		lastToken = authorizedTokens[len(authorizedTokens)-1]
 	}
-	return &scopedjoiningv1.ListScopedTokensResponse{
+	return scopedjoiningv1.ListScopedTokensResponse_builder{
 		Tokens: authorizedTokens,
 		Cursor: makeCursor(lastToken),
-	}, nil
+	}.Build(), nil
 }
 
 // UpsertScopedToken implements [scopedjoiningv1.ScopedJoiningServiceServer].
@@ -294,9 +294,9 @@ func (s *Server) UpdateScopedToken(ctx context.Context, req *scopedjoiningv1.Upd
 		return nil, trace.Wrap(err)
 	}
 
-	extant, err := s.backend.GetScopedToken(ctx, &scopedjoiningv1.GetScopedTokenRequest{
+	extant, err := s.backend.GetScopedToken(ctx, scopedjoiningv1.GetScopedTokenRequest_builder{
 		Name: req.GetToken().GetMetadata().GetName(),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/auth/scopes/joining/service_test.go b/lib/auth/scopes/joining/service_test.go
index 897073ac1f0..5052ef656ad 100644
--- a/lib/auth/scopes/joining/service_test.go
+++ b/lib/auth/scopes/joining/service_test.go
@@ -49,12 +49,12 @@ import (
 
 func createToken(ctx context.Context, server *joining.Server, token *joiningv1.ScopedToken) (*joiningv1.ScopedToken, error) {
 	cloned := proto.CloneOf(token)
-	cloned.Metadata = &headerv1.Metadata{
+	cloned.SetMetadata(headerv1.Metadata_builder{
 		Name: uuid.New().String(),
-	}
-	res, err := server.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+	}.Build())
+	res, err := server.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 		Token: cloned,
-	})
+	}.Build())
 	if err != nil {
 		return nil, err
 	}
@@ -68,27 +68,27 @@ func TestScopedJoiningService(t *testing.T) {
 
 	t.Run("basic", func(t *testing.T) {
 		service := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging": {"/staging": {"staging-admin"}},
 				}),
-			},
+			}.Build(),
 		})
 
-		baseToken := &joiningv1.ScopedToken{
+		baseToken := joiningv1.ScopedToken_builder{
 			Kind:     types.KindScopedToken,
 			Version:  types.V1,
 			Scope:    "/staging",
 			Metadata: &headerv1.Metadata{},
-			Spec: &joiningv1.ScopedTokenSpec{
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				AssignedScope: "/staging/aa",
 				JoinMethod:    "token",
 				Roles:         []string{"Node"},
 				UsageMode:     string(jointoken.TokenUsageModeUnlimited),
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		// create a token
 		token, err := createToken(ctx, service, baseToken)
@@ -108,146 +108,146 @@ func TestScopedJoiningService(t *testing.T) {
 
 		// fail to create a token with an assigned scope that is orthogonal to its own
 		tokenWithMismatchedScope := proto.CloneOf(baseToken)
-		tokenWithMismatchedScope.Metadata.Name = "invalid-token"
-		tokenWithMismatchedScope.Spec.AssignedScope = "/prod/aa"
+		tokenWithMismatchedScope.GetMetadata().SetName("invalid-token")
+		tokenWithMismatchedScope.GetSpec().SetAssignedScope("/prod/aa")
 		_, err = createToken(ctx, service, tokenWithMismatchedScope)
 		assert.True(t, trace.IsBadParameter(err))
 
 		// create a token with an explicit name
 		namedToken := proto.CloneOf(baseToken)
-		namedToken.Metadata.Name = "named-token"
+		namedToken.GetMetadata().SetName("named-token")
 		namedToken, err = createToken(ctx, service, namedToken)
 		require.NoError(t, err)
-		require.NotEmpty(t, namedToken.Metadata.Name)
+		require.NotEmpty(t, namedToken.GetMetadata().GetName())
 
 		// fetch a token
-		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-			Name:       token.Metadata.Name,
+		fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+			Name:       token.GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		assert.Empty(t, gocmp.Diff(token, fetched.GetToken(), cmpOpts...))
 
 		// delete a token
-		_, err = service.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
-			Name: namedToken.Metadata.Name,
-		})
+		_, err = service.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
+			Name: namedToken.GetMetadata().GetName(),
+		}.Build())
 		require.NoError(t, err)
 
 		// create some tokens to list
 		tokenStagingBB := proto.CloneOf(baseToken)
-		tokenStagingBB.Scope = "/staging/bb"
-		tokenStagingBB.Spec.AssignedScope = "/staging/bb"
+		tokenStagingBB.SetScope("/staging/bb")
+		tokenStagingBB.GetSpec().SetAssignedScope("/staging/bb")
 		_, err = createToken(ctx, service, tokenStagingBB)
 		require.NoError(t, err)
 
 		tokenStagingCC1 := proto.CloneOf(baseToken)
-		tokenStagingCC1.Scope = "/staging/cc"
-		tokenStagingCC1.Spec.AssignedScope = "/staging/cc"
+		tokenStagingCC1.SetScope("/staging/cc")
+		tokenStagingCC1.GetSpec().SetAssignedScope("/staging/cc")
 		tokenStagingCC1, err = createToken(ctx, service, tokenStagingCC1)
 		require.NoError(t, err)
 
 		tokenStagingCC2 := proto.CloneOf(baseToken)
-		tokenStagingCC2.Scope = "/staging/cc"
-		tokenStagingCC2.Spec.AssignedScope = "/staging/cc"
+		tokenStagingCC2.SetScope("/staging/cc")
+		tokenStagingCC2.GetSpec().SetAssignedScope("/staging/cc")
 		tokenStagingCC2, err = createToken(ctx, service, tokenStagingCC2)
 		require.NoError(t, err)
 
 		// list tokens while filtering their resource scope
-		res, err := service.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{
+		res, err := service.ListScopedTokens(ctx, joiningv1.ListScopedTokensRequest_builder{
 			WithSecrets: true,
-			ResourceScope: &scopesv1.Filter{
+			ResourceScope: scopesv1.Filter_builder{
 				Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 				Scope: "/staging/cc",
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		assert.Len(t, res.Tokens, 2)
+		assert.Len(t, res.GetTokens(), 2)
 		sortFn := func(left *joiningv1.ScopedToken, right *joiningv1.ScopedToken) int {
-			return cmp.Compare(left.Metadata.Name, right.Metadata.Name)
+			return cmp.Compare(left.GetMetadata().GetName(), right.GetMetadata().GetName())
 		}
 
 		expected := []*joiningv1.ScopedToken{tokenStagingCC1, tokenStagingCC2}
-		slices.SortStableFunc(res.Tokens, sortFn)
+		slices.SortStableFunc(res.GetTokens(), sortFn)
 		slices.SortStableFunc(expected, sortFn)
-		for idx, token := range res.Tokens {
+		for idx, token := range res.GetTokens() {
 			assert.Empty(t, gocmp.Diff(expected[idx], token, cmpOpts...))
 		}
 	})
 
 	t.Run("auth", func(t *testing.T) {
 		admin := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging": {"/staging": {"staging-admin"}},
 				}),
-			},
+			}.Build(),
 		})
 
 		writer := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging/aa",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/aa": {"/staging/aa": {"staging-create"}},
 				}),
-			},
+			}.Build(),
 		})
 
 		reader := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging/aa",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/aa": {"/staging/aa": {"staging-read"}},
 				}),
-			},
+			}.Build(),
 		})
 
 		readerNoSecrets := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging/aa",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/aa": {"/staging/aa": {"staging-readnosecrets"}},
 				}),
-			},
+			}.Build(),
 		})
 
 		deleter := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging/aa",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/aa": {"/staging/aa": {"staging-delete"}},
 				}),
-			},
+			}.Build(),
 		})
 
 		updater := newServerForIdentity(t, pack, &services.AccessInfo{
-			ScopePin: &scopesv1.Pin{
+			ScopePin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging/aa",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/aa": {"/staging/aa": {"staging-upserter"}},
 				}),
-			},
+			}.Build(),
 		})
 
-		baseToken := &joiningv1.ScopedToken{
+		baseToken := joiningv1.ScopedToken_builder{
 			Kind:     types.KindScopedToken,
 			Version:  types.V1,
 			Scope:    "/staging/aa",
 			Metadata: &headerv1.Metadata{},
-			Spec: &joiningv1.ScopedTokenSpec{
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				AssignedScope: "/staging/aa",
 				JoinMethod:    "token",
 				Roles:         []string{"Node"},
 				UsageMode:     string(jointoken.TokenUsageModeUnlimited),
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		var stageTokenAA *joiningv1.ScopedToken
 		// ensure writer can create a token at an accessible scope and create base token for use in subtests
@@ -261,12 +261,12 @@ func TestScopedJoiningService(t *testing.T) {
 			protocmp.Transform(),
 		}
 		expectedToken := proto.CloneOf(baseToken)
-		expectedToken.Status = &joiningv1.ScopedTokenStatus{}
+		expectedToken.SetStatus(&joiningv1.ScopedTokenStatus{})
 		assert.Empty(t, gocmp.Diff(expectedToken, stageTokenAA, cmpOpts...))
 
 		stageTokenBB := proto.CloneOf(baseToken)
-		stageTokenBB.Scope = "/staging/bb"
-		stageTokenBB.Spec.AssignedScope = "/staging/bb"
+		stageTokenBB.SetScope("/staging/bb")
+		stageTokenBB.GetSpec().SetAssignedScope("/staging/bb")
 		// create an orthogonal token for negative testing read ops
 		stageTokenBB, err = createToken(ctx, admin, stageTokenBB)
 		require.NoError(t, err)
@@ -288,25 +288,25 @@ func TestScopedJoiningService(t *testing.T) {
 
 		t.Run("user with readnosecret role cannot read secret at accessible scope", func(t *testing.T) {
 			t.Parallel()
-			getRes, err := readerNoSecrets.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-				Name: stageTokenAA.Metadata.Name,
-			})
+			getRes, err := readerNoSecrets.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+				Name: stageTokenAA.GetMetadata().GetName(),
+			}.Build())
 			require.NoError(t, err)
 			assert.Empty(t, getRes.GetToken().GetStatus().GetSecret())
 
-			_, err = readerNoSecrets.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-				Name:       stageTokenAA.Metadata.Name,
+			_, err = readerNoSecrets.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+				Name:       stageTokenAA.GetMetadata().GetName(),
 				WithSecret: true,
-			})
+			}.Build())
 			require.True(t, trace.IsAccessDenied(err))
 		})
 
 		t.Run("ensure reader can get token at accessible scope with secrets", func(t *testing.T) {
 			t.Parallel()
-			getRes, err := reader.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-				Name:       stageTokenAA.Metadata.Name,
+			getRes, err := reader.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+				Name:       stageTokenAA.GetMetadata().GetName(),
 				WithSecret: true,
-			})
+			}.Build())
 			require.NoError(t, err)
 			require.NotEmpty(t, getRes.GetToken().GetStatus().GetSecret())
 			require.Equal(t, stageTokenAA.GetStatus().GetSecret(), getRes.GetToken().GetStatus().GetSecret())
@@ -315,9 +315,9 @@ func TestScopedJoiningService(t *testing.T) {
 
 		t.Run("reader cannot get token at orthogonal scope", func(t *testing.T) {
 			t.Parallel()
-			_, err := reader.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-				Name: stageTokenBB.Metadata.Name,
-			})
+			_, err := reader.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+				Name: stageTokenBB.GetMetadata().GetName(),
+			}.Build())
 			require.True(t, trace.IsAccessDenied(err))
 		})
 
@@ -325,9 +325,9 @@ func TestScopedJoiningService(t *testing.T) {
 		t.Run("ensure other identities can't read a token", func(t *testing.T) {
 			t.Parallel()
 			for _, ident := range nonReaderIdents {
-				_, err := ident.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-					Name: stageTokenAA.Metadata.Name,
-				})
+				_, err := ident.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+					Name: stageTokenAA.GetMetadata().GetName(),
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			}
 		})
@@ -355,9 +355,9 @@ func TestScopedJoiningService(t *testing.T) {
 		t.Run("ensure other identities can't delete a token", func(t *testing.T) {
 			t.Parallel()
 			for _, ident := range nonDeleterIdents {
-				_, err := ident.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
-					Name: stageTokenAA.Metadata.Name,
-				})
+				_, err := ident.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
+					Name: stageTokenAA.GetMetadata().GetName(),
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err))
 			}
 		})
@@ -366,17 +366,17 @@ func TestScopedJoiningService(t *testing.T) {
 			t.Parallel()
 			tokenForDelete, err := createToken(ctx, admin, baseToken)
 			require.NoError(t, err)
-			_, err = deleter.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
-				Name: tokenForDelete.Metadata.Name,
-			})
+			_, err = deleter.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
+				Name: tokenForDelete.GetMetadata().GetName(),
+			}.Build())
 			require.NoError(t, err)
 		})
 
 		t.Run("ensure deleter can't delete a token at an orthogonal scope", func(t *testing.T) {
 			t.Parallel()
-			_, err := deleter.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
-				Name: stageTokenBB.Metadata.Name,
-			})
+			_, err := deleter.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
+				Name: stageTokenBB.GetMetadata().GetName(),
+			}.Build())
 			require.True(t, trace.IsAccessDenied(err))
 		})
 
@@ -386,21 +386,21 @@ func TestScopedJoiningService(t *testing.T) {
 			require.NoError(t, err)
 
 			tokenUpdate := proto.CloneOf(tokenForUpsert)
-			tokenUpdate.Metadata = proto.CloneOf(tokenForUpsert.GetMetadata())
-			tokenUpdate.Metadata.Labels = map[string]string{"env": "test"}
+			tokenUpdate.SetMetadata(proto.CloneOf(tokenForUpsert.GetMetadata()))
+			tokenUpdate.GetMetadata().SetLabels(map[string]string{"env": "test"})
 
-			_, err = updater.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{
+			_, err = updater.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{
 				Token: tokenUpdate,
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			t.Run("non upserter role cannot update a token", func(t *testing.T) {
 				t.Parallel()
 				nonUpdaterIdents := []*joining.Server{reader, readerNoSecrets, writer}
 				for _, ident := range nonUpdaterIdents {
-					_, err := ident.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{
+					_, err := ident.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{
 						Token: tokenUpdate,
-					})
+					}.Build())
 					require.True(t, trace.IsAccessDenied(err))
 				}
 			})
@@ -409,12 +409,12 @@ func TestScopedJoiningService(t *testing.T) {
 		t.Run("ensure upserter cannot upsert a token at an orthogonal scope", func(t *testing.T) {
 			t.Parallel()
 			tokenUpdate := proto.CloneOf(stageTokenBB)
-			tokenUpdate.Metadata = proto.CloneOf(stageTokenBB.GetMetadata())
-			tokenUpdate.Metadata.Labels = map[string]string{"env": "test"}
+			tokenUpdate.SetMetadata(proto.CloneOf(stageTokenBB.GetMetadata()))
+			tokenUpdate.GetMetadata().SetLabels(map[string]string{"env": "test"})
 
-			_, err := updater.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{
+			_, err := updater.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{
 				Token: tokenUpdate,
-			})
+			}.Build())
 			require.True(t, trace.IsAccessDenied(err))
 		})
 
@@ -423,27 +423,27 @@ func TestScopedJoiningService(t *testing.T) {
 			require.NoError(t, err)
 
 			tokenUpdate := proto.CloneOf(tokenForUpdate)
-			tokenUpdate.Metadata.Labels = map[string]string{"env": "updated"}
+			tokenUpdate.GetMetadata().SetLabels(map[string]string{"env": "updated"})
 
-			_, err = updater.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{
+			_, err = updater.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{
 				Token: tokenUpdate,
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			// Update should fail after updating if revisions don't match.
 			staleUpdate := proto.CloneOf(tokenForUpdate)
-			staleUpdate.Metadata.Labels = map[string]string{"bad": "update"}
-			_, err = updater.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{
+			staleUpdate.GetMetadata().SetLabels(map[string]string{"bad": "update"})
+			_, err = updater.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{
 				Token: staleUpdate,
-			})
+			}.Build())
 			require.True(t, trace.IsCompareFailed(err))
 
 			t.Run("non updater role cannot update a token", func(t *testing.T) {
 				nonUpdaterIdents := []*joining.Server{reader, readerNoSecrets, writer}
 				for _, ident := range nonUpdaterIdents {
-					_, err := ident.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{
+					_, err := ident.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{
 						Token: tokenUpdate,
-					})
+					}.Build())
 					require.True(t, trace.IsAccessDenied(err))
 				}
 			})
@@ -451,22 +451,22 @@ func TestScopedJoiningService(t *testing.T) {
 
 		t.Run("ensure updater cannot update a token at an orthogonal scope", func(t *testing.T) {
 			tokenUpdate := proto.CloneOf(stageTokenBB)
-			tokenUpdate.Metadata.Labels = map[string]string{"env": "test"}
+			tokenUpdate.GetMetadata().SetLabels(map[string]string{"env": "test"})
 
-			_, err := updater.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{
+			_, err := updater.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{
 				Token: tokenUpdate,
-			})
+			}.Build())
 			require.True(t, trace.IsAccessDenied(err))
 		})
 
 		t.Run("ensure updater cannot bypass scope auth by spoofing scope in request", func(t *testing.T) {
 			tokenUpdate := proto.CloneOf(stageTokenBB)
-			tokenUpdate.Scope = "/staging/aa"
-			tokenUpdate.Spec.AssignedScope = "/staging/aa"
+			tokenUpdate.SetScope("/staging/aa")
+			tokenUpdate.GetSpec().SetAssignedScope("/staging/aa")
 
-			_, err := updater.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{
+			_, err := updater.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{
 				Token: tokenUpdate,
-			})
+			}.Build())
 			require.True(t, trace.IsBadParameter(err))
 		})
 	})
@@ -546,125 +546,125 @@ func newBackendPack(t *testing.T) *backendPack {
 	require.NoError(t, err)
 
 	roles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-admin",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbCreate, types.VerbRead, types.VerbList, types.VerbDelete, types.VerbUpdate},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		}, {
+		}.Build(), scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-create",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/aa"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbCreate},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		}, {
+		}.Build(), scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-read",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/aa"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbRead, types.VerbList},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		}, {
+		}.Build(), scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-readnosecrets",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/aa"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbReadNoSecrets, types.VerbList},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		}, {
+		}.Build(), scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-delete",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/aa"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		}, {
+		}.Build(), scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-upserter",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/aa"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbUpdate, types.VerbCreate},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		}, {
+		}.Build(), scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "prod-admin",
-			},
+			}.Build(),
 			Scope: "/prod",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/prod"},
 				Rules: []*scopedaccessv1.ScopedRule{
-					{
+					scopedaccessv1.ScopedRule_builder{
 						Resources: []string{types.KindScopedToken},
 						Verbs:     []string{types.VerbRead, types.VerbList, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	for _, role := range roles {
-		_, err := service.CreateScopedRole(t.Context(), &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := service.CreateScopedRole(t.Context(), scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
diff --git a/lib/auth/server_info.go b/lib/auth/server_info.go
index 24db1ae7d9a..812e51c7527 100644
--- a/lib/auth/server_info.go
+++ b/lib/auth/server_info.go
@@ -168,10 +168,10 @@ func updateLabelsOnNode(ctx context.Context, ap ServerInfoAccessPoint, node type
 	for _, si := range serverInfos {
 		maps.Copy(newLabels, si.GetNewLabels())
 	}
-	err := ap.UpdateLabels(ctx, &proto.InventoryUpdateLabelsRequest{
+	err := ap.UpdateLabels(ctx, proto.InventoryUpdateLabelsRequest_builder{
 		ServerID: node.GetName(),
 		Kind:     proto.LabelUpdateKind_SSHServerCloudLabels,
 		Labels:   newLabels,
-	})
+	}.Build())
 	return trace.Wrap(err)
 }
diff --git a/lib/auth/server_info_test.go b/lib/auth/server_info_test.go
index ec8a9b39449..538a8e10505 100644
--- a/lib/auth/server_info_test.go
+++ b/lib/auth/server_info_test.go
@@ -69,7 +69,7 @@ func (m *mockServerInfoAccessPoint) GetServerInfo(_ context.Context, name string
 }
 
 func (m *mockServerInfoAccessPoint) UpdateLabels(_ context.Context, req *proto.InventoryUpdateLabelsRequest) error {
-	m.updatedLabels[req.GetServerID()] = req.Labels
+	m.updatedLabels[req.GetServerID()] = req.GetLabels()
 	return nil
 }
 
diff --git a/lib/auth/server_monitor.go b/lib/auth/server_monitor.go
index 91fb37cc1e9..0108d338305 100644
--- a/lib/auth/server_monitor.go
+++ b/lib/auth/server_monitor.go
@@ -26,6 +26,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -120,30 +121,28 @@ func (a *Server) checkInventorySystemClocks(ctx context.Context) {
 // servers related to the system clock difference in nodes.
 func upsertClockWarningGlobalNotification(ctx context.Context, notification services.Notifications, title, text string) error {
 	now := time.Now()
-	_, err := notification.UpsertGlobalNotification(ctx, &notificationsv1.GlobalNotification{
+	_, err := notification.UpsertGlobalNotification(ctx, notificationsv1.GlobalNotification_builder{
 		Kind:     types.KindGlobalNotification,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: systemClockNotificationWarningName},
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+		Metadata: headerv1.Metadata_builder{Name: systemClockNotificationWarningName}.Build(),
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: types.NotificationDefaultWarningSubKind,
-				Spec: &notificationsv1.NotificationSpec{
+				Spec: notificationsv1.NotificationSpec_builder{
 					Created: timestamppb.New(now),
-				},
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+				Metadata: headerv1.Metadata_builder{
 					Expires: timestamppb.New(now.Add(systemClockNotificationExpiration)),
 					Name:    systemClockNotificationWarningName,
 					Labels: map[string]string{
 						types.NotificationTitleLabel:       title,
 						types.NotificationTextContentLabel: text,
 					},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	return trace.Wrap(err)
 }
 
diff --git a/lib/auth/sessions.go b/lib/auth/sessions.go
index 8d6c1f92847..668894750b3 100644
--- a/lib/auth/sessions.go
+++ b/lib/auth/sessions.go
@@ -95,20 +95,20 @@ func (a *Server) augmentSessionForDeviceTrust(
 	// Create the device trust DeviceWebToken.
 	// We only get a token if the server is enabled for Device Trust and the user
 	// has a suitable trusted device.
-	webToken, err := a.createDeviceWebToken(ctx, &devicepb.DeviceWebToken{
+	webToken, err := a.createDeviceWebToken(ctx, devicepb.DeviceWebToken_builder{
 		WebSessionId:          session.GetName(),
 		BrowserMaxTouchPoints: uint32(maxTouchPoints),
 		BrowserUserAgent:      userAgent,
 		BrowserIp:             loginIP,
 		User:                  session.GetUser(),
-	})
+	}.Build())
 	switch {
 	case err != nil:
 		a.logger.WarnContext(ctx, "Failed to create DeviceWebToken for user", "error", err)
 	case webToken != nil: // May be nil even if err==nil.
 		session.SetDeviceWebToken(&types.DeviceWebToken{
-			Id:    webToken.Id,
-			Token: webToken.Token,
+			Id:    webToken.GetId(),
+			Token: webToken.GetToken(),
 		})
 	}
 
diff --git a/lib/auth/sessions_test.go b/lib/auth/sessions_test.go
index f2ad08e15a2..1be16cdf81a 100644
--- a/lib/auth/sessions_test.go
+++ b/lib/auth/sessions_test.go
@@ -181,20 +181,20 @@ func TestServer_CreateWebSessionFromReq_deviceWebToken(t *testing.T) {
 
 	var storedWebTokens utils.SyncMap[string, *devicepb.DeviceWebToken]
 	authServer.SetCreateDeviceWebTokenFunc(func(ctx context.Context, dwt *devicepb.DeviceWebToken) (*devicepb.DeviceWebToken, error) {
-		if dwt.BrowserMaxTouchPoints > 1 {
+		if dwt.GetBrowserMaxTouchPoints() > 1 {
 			// Simulate CreateDeviceWebToken not creating tokens for iPads.
 			return nil, nil
 		}
 
-		dwt.Id = uuid.NewString()
-		dwt.Token = uuid.NewString()
+		dwt.SetId(uuid.NewString())
+		dwt.SetToken(uuid.NewString())
 
-		storedWebTokens.Store(dwt.Id, dwt)
+		storedWebTokens.Store(dwt.GetId(), dwt)
 
-		return &devicepb.DeviceWebToken{
-			Id:    dwt.Id,
-			Token: dwt.Token,
-		}, nil
+		return devicepb.DeviceWebToken_builder{
+			Id:    dwt.GetId(),
+			Token: dwt.GetToken(),
+		}.Build(), nil
 	})
 
 	const userLlama = "llama"
@@ -249,10 +249,10 @@ func TestServer_CreateWebSessionFromReq_deviceWebToken(t *testing.T) {
 			storedWebToken, ok := storedWebTokens.Load(gotToken.Id)
 			require.True(t, ok, "created web token was not found")
 
-			require.Equal(t, storedWebToken.Token, gotToken.Token)
-			require.Equal(t, loginIP, storedWebToken.BrowserIp)
-			require.Equal(t, loginUserAgent, storedWebToken.BrowserUserAgent)
-			require.Equal(t, test.loginMaxTouchPoints, int(storedWebToken.BrowserMaxTouchPoints))
+			require.Equal(t, storedWebToken.GetToken(), gotToken.Token)
+			require.Equal(t, loginIP, storedWebToken.GetBrowserIp())
+			require.Equal(t, loginUserAgent, storedWebToken.GetBrowserUserAgent())
+			require.Equal(t, test.loginMaxTouchPoints, int(storedWebToken.GetBrowserMaxTouchPoints()))
 		})
 	}
 }
diff --git a/lib/auth/stableunixusers/stableunixusers.go b/lib/auth/stableunixusers/stableunixusers.go
index c948fef6164..58b44088a88 100644
--- a/lib/auth/stableunixusers/stableunixusers.go
+++ b/lib/auth/stableunixusers/stableunixusers.go
@@ -156,16 +156,16 @@ func (s *server) listStableUNIXUsers(ctx context.Context, req *stableunixusersv1
 
 	userspb := make([]*stableunixusersv1.StableUNIXUser, 0, len(users))
 	for _, user := range users {
-		userspb = append(userspb, &stableunixusersv1.StableUNIXUser{
+		userspb = append(userspb, stableunixusersv1.StableUNIXUser_builder{
 			Username: user.Username,
 			Uid:      user.UID,
-		})
+		}.Build())
 	}
 
-	return &stableunixusersv1.ListStableUNIXUsersResponse{
+	return stableunixusersv1.ListStableUNIXUsersResponse_builder{
 		StableUnixUsers: userspb,
 		NextPageToken:   nextPageToken,
-	}, nil
+	}.Build(), nil
 }
 
 // ObtainUIDForUsername implements [stableunixusersv1.StableUNIXUsersServiceServer].
@@ -184,9 +184,9 @@ func (s *server) ObtainUIDForUsername(ctx context.Context, req *stableunixusersv
 		return nil, trace.Wrap(err)
 	}
 
-	return &stableunixusersv1.ObtainUIDForUsernameResponse{
+	return stableunixusersv1.ObtainUIDForUsernameResponse_builder{
 		Uid: uid,
-	}, nil
+	}.Build(), nil
 }
 
 // obtainUIDForUsernameCached calls [*server.obtainUIDForUsernameUncached]
diff --git a/lib/auth/stableunixusers/stableunixusers_test.go b/lib/auth/stableunixusers/stableunixusers_test.go
index 9939dcfa63b..f77f4a4b4e0 100644
--- a/lib/auth/stableunixusers/stableunixusers_test.go
+++ b/lib/auth/stableunixusers/stableunixusers_test.go
@@ -105,7 +105,7 @@ func TestStableUNIXUsers(t *testing.T) {
 	}
 
 	obtainUIDForUsername := func(username string) (int32, error) {
-		r, err := svc.ObtainUIDForUsername(ctx, &stableunixusersv1.ObtainUIDForUsernameRequest{Username: username})
+		r, err := svc.ObtainUIDForUsername(ctx, stableunixusersv1.ObtainUIDForUsernameRequest_builder{Username: username}.Build())
 		if err != nil {
 			return 0, err
 		}
@@ -168,18 +168,18 @@ func TestStableUNIXUsers(t *testing.T) {
 	require.False(t, emitter.getAndReset())
 
 	// nodes are not allowed to list users
-	_, err = svc.ListStableUNIXUsers(ctx, &stableunixusersv1.ListStableUNIXUsersRequest{
+	_, err = svc.ListStableUNIXUsers(ctx, stableunixusersv1.ListStableUNIXUsersRequest_builder{
 		PageSize: 2,
-	})
+	}.Build())
 	require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 
 	authorizer = func(ctx context.Context) (*authz.Context, error) {
 		return authz.NewBuiltinRoleContext(types.RoleAdmin)
 	}
 
-	resp, err := svc.ListStableUNIXUsers(ctx, &stableunixusersv1.ListStableUNIXUsersRequest{
+	resp, err := svc.ListStableUNIXUsers(ctx, stableunixusersv1.ListStableUNIXUsersRequest_builder{
 		PageSize: 2,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "user3", resp.GetNextPageToken())
 	require.Len(t, resp.GetStableUnixUsers(), 2)
@@ -189,10 +189,10 @@ func TestStableUNIXUsers(t *testing.T) {
 	require.Equal(t, "user2", resp.GetStableUnixUsers()[1].GetUsername())
 	require.Equal(t, firstUID+1, resp.GetStableUnixUsers()[1].GetUid())
 
-	resp, err = svc.ListStableUNIXUsers(ctx, &stableunixusersv1.ListStableUNIXUsersRequest{
+	resp, err = svc.ListStableUNIXUsers(ctx, stableunixusersv1.ListStableUNIXUsersRequest_builder{
 		PageSize:  2,
 		PageToken: "user3",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Empty(t, resp.GetNextPageToken())
 	require.Len(t, resp.GetStableUnixUsers(), 2)
diff --git a/lib/auth/state/identity_test.go b/lib/auth/state/identity_test.go
index fe845fdb707..8d82559c448 100644
--- a/lib/auth/state/identity_test.go
+++ b/lib/auth/state/identity_test.go
@@ -55,25 +55,25 @@ func TestReadTLSIdentityFromKeyPairAgentPin(t *testing.T) {
 	}{
 		{
 			desc: "single-role agent pin",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 				Scope: "/staging",
-				SystemRoles: &scopesv1.SystemRoles{
+				SystemRoles: scopesv1.SystemRoles_builder{
 					Primary: string(types.RoleNode),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantRole: types.RoleNode,
 		},
 		{
 			desc: "multi-role instance agent pin",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 				Scope: "/staging",
-				SystemRoles: &scopesv1.SystemRoles{
+				SystemRoles: scopesv1.SystemRoles_builder{
 					Primary:    string(types.RoleInstance),
 					Additional: []string{string(types.RoleNode), string(types.RoleKube)},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantRole:        types.RoleInstance,
 			wantSystemRoles: []string{string(types.RoleNode), string(types.RoleKube)},
 		},
diff --git a/lib/auth/storage/storage_test.go b/lib/auth/storage/storage_test.go
index 42f5c5bb0ca..b8c1df190e9 100644
--- a/lib/auth/storage/storage_test.go
+++ b/lib/auth/storage/storage_test.go
@@ -291,11 +291,11 @@ func TestImmutableLabels(t *testing.T) {
 	}
 
 	const identName = "testname"
-	immutableLabels := &joiningv1.ImmutableLabels{
+	immutableLabels := joiningv1.ImmutableLabels_builder{
 		Ssh: map[string]string{
 			"foo": "bar",
 		},
-	}
+	}.Build()
 
 	ident := genIdentity(t, identName, immutableLabels)
 	ident.ImmutableLabels = immutableLabels
@@ -307,7 +307,7 @@ func TestImmutableLabels(t *testing.T) {
 		ident, err = storage.ReadIdentity(t.Context(), identName, types.RoleNode)
 		require.NoError(t, err)
 		require.Empty(t, cmp.Diff(immutableLabels, ident.ImmutableLabels, protocmp.Transform()))
-		immutableLabels.Ssh[fmt.Sprintf("label-%d", i)] = fmt.Sprintf("value-%d", i)
+		immutableLabels.GetSsh()[fmt.Sprintf("label-%d", i)] = fmt.Sprintf("value-%d", i)
 		ident.ImmutableLabels = immutableLabels
 	}
 }
diff --git a/lib/auth/summarizer/summarizerv1/service.go b/lib/auth/summarizer/summarizerv1/service.go
index 62b6ce4438a..e284631ba45 100644
--- a/lib/auth/summarizer/summarizerv1/service.go
+++ b/lib/auth/summarizer/summarizerv1/service.go
@@ -211,7 +211,7 @@ func (s *UnimplementedService) ListInferencePolicies(
 func (s *UnimplementedService) IsEnabled(
 	ctx context.Context, req *summarizerv1pb.IsEnabledRequest,
 ) (*summarizerv1pb.IsEnabledResponse, error) {
-	return &summarizerv1pb.IsEnabledResponse{Enabled: false}, nil
+	return summarizerv1pb.IsEnabledResponse_builder{Enabled: false}.Build(), nil
 }
 
 func requireEnterprise() error {
diff --git a/lib/auth/tls_test.go b/lib/auth/tls_test.go
index 9cb18da9f3b..b0e35a0a9f5 100644
--- a/lib/auth/tls_test.go
+++ b/lib/auth/tls_test.go
@@ -1230,10 +1230,10 @@ func TestListUsers(t *testing.T) {
 			rsp, err := clt.ListUsers(ctx, req)
 			require.NoError(t, err)
 
-			users = append(users, rsp.Users...)
+			users = append(users, rsp.GetUsers()...)
 
-			req.PageToken = rsp.NextPageToken
-			if req.PageToken == "" {
+			req.SetPageToken(rsp.GetNextPageToken())
+			if req.GetPageToken() == "" {
 				break
 			}
 		}
@@ -1252,41 +1252,41 @@ func TestListUsers(t *testing.T) {
 	users := getUsers(t, &userspb.ListUsersRequest{})
 	require.ElementsMatch(t, allUserNames, namesOf(users))
 
-	users = getUsers(t, &userspb.ListUsersRequest{
+	users = getUsers(t, userspb.ListUsersRequest_builder{
 		Filter: &types.UserFilter{
 			SearchKeywords: []string{
 				"mauka",
 				"red",
 			},
 		},
-	})
+	}.Build())
 
 	require.ElementsMatch(t, []string{
 		"alice@good.example.com",
 		"carol@evil.example.com",
 	}, namesOf(users))
 
-	users = getUsers(t, &userspb.ListUsersRequest{
+	users = getUsers(t, userspb.ListUsersRequest_builder{
 		Filter: &types.UserFilter{
 			SearchKeywords: []string{
 				"blue",
 				"good.example.com",
 			},
 		},
-	})
+	}.Build())
 
 	require.ElementsMatch(t, []string{
 		"bob@good.example.com",
 	}, namesOf(users))
 
-	users = getUsers(t, &userspb.ListUsersRequest{
+	users = getUsers(t, userspb.ListUsersRequest_builder{
 		Filter: &types.UserFilter{
 			SearchKeywords: []string{
 				"mauka",
 			},
 		},
 		PageSize: 2,
-	})
+	}.Build())
 
 	require.ElementsMatch(t, []string{
 		"alice@good.example.com",
@@ -1294,37 +1294,37 @@ func TestListUsers(t *testing.T) {
 		"carol@evil.example.com",
 	}, namesOf(users))
 
-	users = getUsers(t, &userspb.ListUsersRequest{
+	users = getUsers(t, userspb.ListUsersRequest_builder{
 		Filter: &types.UserFilter{
 			SearchKeywords: []string{
 				"good-role",
 			},
 		},
-	})
+	}.Build())
 
 	require.ElementsMatch(t, []string{
 		"alice@good.example.com",
 		"bob@good.example.com",
 	}, namesOf(users))
 
-	users = getUsers(t, &userspb.ListUsersRequest{
+	users = getUsers(t, userspb.ListUsersRequest_builder{
 		Filter: &types.UserFilter{
 			SearchKeywords: []string{
 				"good-login",
 			},
 		},
-	})
+	}.Build())
 
 	require.ElementsMatch(t, []string{
 		"alice@good.example.com",
 		"bob@good.example.com",
 	}, namesOf(users))
 
-	users = getUsers(t, &userspb.ListUsersRequest{
+	users = getUsers(t, userspb.ListUsersRequest_builder{
 		Filter: &types.UserFilter{
 			Traits: map[string][]string{"logins": {"good-login"}},
 		},
-	})
+	}.Build())
 
 	require.ElementsMatch(t, []string{
 		"alice@good.example.com",
@@ -1551,48 +1551,48 @@ func TestAuthPreferenceSettings_ScopedIdentity(t *testing.T) {
 	defer adminClient.Close()
 
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "empty-role",
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/test/scope"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	user, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-reader")
 	require.NoError(t, err)
 
-	createResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	createResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: user.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "empty-role", Scope: "/test/scope"},
+					scopedaccessv1.Assignment_builder{Role: "empty-role", Scope: "/test/scope"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := srv.AuthServer.AuthServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := srv.AuthServer.AuthServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    createResp.GetAssignment().GetMetadata().GetName(),
 			SubKind: createResp.GetAssignment().GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 	}, 10*time.Second, 100*time.Millisecond)
 
@@ -1858,9 +1858,9 @@ func TestDeleteProxy(t *testing.T) {
 		require.NoError(t, clt.UpsertProxyServerWithoutReturn(ctx, proxy))
 
 		_, err := clt.APIClient.PresenceServiceClient().DeleteProxyServer(
-			ctx, &presencev1.DeleteProxyServerRequest{
+			ctx, presencev1.DeleteProxyServerRequest_builder{
 				Name: proxy.GetName(),
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 
@@ -1931,9 +1931,9 @@ func TestUpsertProxy(t *testing.T) {
 	t.Run("direct gRPC RPC", func(t *testing.T) {
 		proxy := newProxy("proxy-grpc").(*types.ServerV2)
 		_, err := clt.APIClient.PresenceServiceClient().UpsertProxyServer(
-			ctx, &presencev1.UpsertProxyServerRequest{
+			ctx, presencev1.UpsertProxyServerRequest_builder{
 				Server: proxy,
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 
@@ -2830,48 +2830,48 @@ func TestGetCertAuthority_ScopedIdentity(t *testing.T) {
 	defer adminClient.Close()
 
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "empty-role",
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/test/scope"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	user, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-reader")
 	require.NoError(t, err)
 
-	createResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	createResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: user.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "empty-role", Scope: "/test/scope"},
+					scopedaccessv1.Assignment_builder{Role: "empty-role", Scope: "/test/scope"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := srv.AuthServer.AuthServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := srv.AuthServer.AuthServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    createResp.GetAssignment().GetMetadata().GetName(),
 			SubKind: createResp.GetAssignment().GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 	}, 10*time.Second, 100*time.Millisecond)
 
@@ -3688,7 +3688,7 @@ func TestClusterConfigContext(t *testing.T) {
 	// we are recording at the nodes not at the proxy, the proxy may
 	// need to generate host certs if a client wants to connect to an
 	// agentless node
-	_, err = proxy.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+	_, err = proxy.TrustClient().GenerateHostCert(ctx, trustpb.GenerateHostCertRequest_builder{
 		Key:         pub,
 		HostId:      "a",
 		NodeName:    "b",
@@ -3696,7 +3696,7 @@ func TestClusterConfigContext(t *testing.T) {
 		ClusterName: "localhost",
 		Role:        string(types.RoleProxy),
 		Ttl:         durationpb.New(0),
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// update cluster config to record at the proxy
@@ -3708,7 +3708,7 @@ func TestClusterConfigContext(t *testing.T) {
 	require.NoError(t, err)
 
 	// try and generate a host cert
-	_, err = proxy.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+	_, err = proxy.TrustClient().GenerateHostCert(ctx, trustpb.GenerateHostCertRequest_builder{
 		Key:         pub,
 		HostId:      "a",
 		NodeName:    "b",
@@ -3716,7 +3716,7 @@ func TestClusterConfigContext(t *testing.T) {
 		ClusterName: "localhost",
 		Role:        string(types.RoleProxy),
 		Ttl:         durationpb.New(0),
-	})
+	}.Build())
 	require.NoError(t, err)
 }
 
@@ -5231,48 +5231,48 @@ func TestWatchEvents_ScopedIdentity(t *testing.T) {
 
 	// Create a scoped role with an empty allow block (no permissions).
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "empty-role",
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/test/scope"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	user, err := authtest.CreateUser(ctx, srv.Auth(), "scoped-watcher")
 	require.NoError(t, err)
 
-	createResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	createResp, err := scopedSvc.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: user.GetName(),
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "empty-role", Scope: "/test/scope"},
+					scopedaccessv1.Assignment_builder{Role: "empty-role", Scope: "/test/scope"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := srv.AuthServer.AuthServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := srv.AuthServer.AuthServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    createResp.GetAssignment().GetMetadata().GetName(),
 			SubKind: createResp.GetAssignment().GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 	}, 10*time.Second, 100*time.Millisecond)
 
diff --git a/lib/auth/trust/trustv1/service.go b/lib/auth/trust/trustv1/service.go
index 55c8b8cbe75..f052a6b65f2 100644
--- a/lib/auth/trust/trustv1/service.go
+++ b/lib/auth/trust/trustv1/service.go
@@ -121,7 +121,7 @@ func (s *Service) GetCertAuthority(ctx context.Context, req *trustpb.GetCertAuth
 	}
 
 	checkAccess := func(ruleCtx services.RuleContext) error {
-		if req.IncludeKey {
+		if req.GetIncludeKey() {
 			return authCtx.CheckerContext.Decision(ctx, scopes.Root, func(checker *services.ScopedAccessChecker) error {
 				return checker.CheckAccessToRules(ruleCtx, types.KindCertAuthority, types.VerbRead)
 			})
@@ -138,8 +138,8 @@ func (s *Service) GetCertAuthority(ctx context.Context, req *trustpb.GetCertAuth
 	// leaking information about the requested CA if the call to GetCertAuthority
 	// fails.
 	contextCA, err := types.NewCertAuthority(types.CertAuthoritySpecV2{
-		Type:        types.CertAuthType(req.Type),
-		ClusterName: req.Domain,
+		Type:        types.CertAuthType(req.GetType()),
+		ClusterName: req.GetDomain(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -151,7 +151,7 @@ func (s *Service) GetCertAuthority(ctx context.Context, req *trustpb.GetCertAuth
 	}
 
 	// Require admin MFA to read secrets.
-	if req.IncludeKey {
+	if req.GetIncludeKey() {
 		unscopedCtx, ok := authCtx.UnscopedContext()
 		if !ok {
 			return nil, trace.AccessDenied(
@@ -166,7 +166,7 @@ func (s *Service) GetCertAuthority(ctx context.Context, req *trustpb.GetCertAuth
 
 	// Retrieve the requested CA and perform RBAC on it to ensure that
 	// the user has access to this particular CA.
-	ca, err := s.cache.GetCertAuthority(ctx, types.CertAuthID{Type: types.CertAuthType(req.Type), DomainName: req.Domain}, req.IncludeKey)
+	ca, err := s.cache.GetCertAuthority(ctx, types.CertAuthID{Type: types.CertAuthType(req.GetType()), DomainName: req.GetDomain()}, req.GetIncludeKey())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -176,7 +176,7 @@ func (s *Service) GetCertAuthority(ctx context.Context, req *trustpb.GetCertAuth
 		return nil, trace.Wrap(err)
 	}
 
-	if err := failPreWindowsCATctlUserCAQuery(ctx, req.Type); err != nil {
+	if err := failPreWindowsCATctlUserCAQuery(ctx, req.GetType()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 	authority, ok := ca.(*types.CertAuthorityV2)
@@ -248,7 +248,7 @@ func (s *Service) GetCertAuthorities(ctx context.Context, req *trustpb.GetCertAu
 	// on each decision invocation.
 	ruleCtx := authCtx.RuleContext()
 
-	if req.IncludeKey {
+	if req.GetIncludeKey() {
 		// For queries that include secrets we must enforce standard scope pinning rules.
 		//
 		// NOTE: technically we have no plans to introduce scoped CA secrets. as of the time of writing,
@@ -283,12 +283,12 @@ func (s *Service) GetCertAuthorities(ctx context.Context, req *trustpb.GetCertAu
 		}
 	}
 
-	cas, err := s.cache.GetCertAuthorities(ctx, types.CertAuthType(req.Type), req.IncludeKey)
+	cas, err := s.cache.GetCertAuthorities(ctx, types.CertAuthType(req.GetType()), req.GetIncludeKey())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp := &trustpb.GetCertAuthoritiesResponse{CertAuthoritiesV2: make([]*types.CertAuthorityV2, 0, len(cas))}
+	resp := trustpb.GetCertAuthoritiesResponse_builder{CertAuthoritiesV2: make([]*types.CertAuthorityV2, 0, len(cas))}.Build()
 
 	for _, ca := range cas {
 		cav2, ok := ca.(*types.CertAuthorityV2)
@@ -296,7 +296,7 @@ func (s *Service) GetCertAuthorities(ctx context.Context, req *trustpb.GetCertAu
 			return nil, trace.BadParameter("cert authority has invalid type %T", ca)
 		}
 
-		resp.CertAuthoritiesV2 = append(resp.CertAuthoritiesV2, cav2)
+		resp.SetCertAuthoritiesV2(append(resp.GetCertAuthoritiesV2(), cav2))
 	}
 
 	return resp, nil
@@ -317,7 +317,7 @@ func (s *Service) DeleteCertAuthority(ctx context.Context, req *trustpb.DeleteCe
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.backend.DeleteCertAuthority(ctx, types.CertAuthID{DomainName: req.Domain, Type: types.CertAuthType(req.Type)}); err != nil {
+	if err := s.backend.DeleteCertAuthority(ctx, types.CertAuthID{DomainName: req.GetDomain(), Type: types.CertAuthType(req.GetType())}); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -326,11 +326,11 @@ func (s *Service) DeleteCertAuthority(ctx context.Context, req *trustpb.DeleteCe
 
 // UpsertCertAuthority creates or updates the provided cert authority.
 func (s *Service) UpsertCertAuthority(ctx context.Context, req *trustpb.UpsertCertAuthorityRequest) (*types.CertAuthorityV2, error) {
-	if req.CertAuthority == nil {
+	if !req.HasCertAuthority() {
 		return nil, trace.BadParameter("missing certificate authority")
 	}
 
-	if err := services.ValidateCertAuthority(req.CertAuthority); err != nil {
+	if err := services.ValidateCertAuthority(req.GetCertAuthority()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -339,7 +339,7 @@ func (s *Service) UpsertCertAuthority(ctx context.Context, req *trustpb.UpsertCe
 		return nil, trace.Wrap(err)
 	}
 
-	if err := authzCtx.CheckAccessToResource(req.CertAuthority, types.VerbCreate, types.VerbUpdate); err != nil {
+	if err := authzCtx.CheckAccessToResource(req.GetCertAuthority(), types.VerbCreate, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -348,11 +348,11 @@ func (s *Service) UpsertCertAuthority(ctx context.Context, req *trustpb.UpsertCe
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.backend.UpsertCertAuthority(ctx, req.CertAuthority); err != nil {
+	if err := s.backend.UpsertCertAuthority(ctx, req.GetCertAuthority()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return req.CertAuthority, nil
+	return req.GetCertAuthority(), nil
 }
 
 // RotateCertAuthority rotates a cert authority.
@@ -371,21 +371,21 @@ func (s *Service) RotateCertAuthority(ctx context.Context, req *trustpb.RotateCe
 	}
 
 	rotateRequest := types.RotateRequest{
-		Type:        types.CertAuthType(req.Type),
-		TargetPhase: req.TargetPhase,
-		Mode:        req.Mode,
+		Type:        types.CertAuthType(req.GetType()),
+		TargetPhase: req.GetTargetPhase(),
+		Mode:        req.GetMode(),
 	}
 
-	if req.GracePeriod != nil {
-		duration := req.GracePeriod.AsDuration()
+	if req.HasGracePeriod() {
+		duration := req.GetGracePeriod().AsDuration()
 		rotateRequest.GracePeriod = &duration
 	}
 
-	if req.Schedule != nil {
+	if req.HasSchedule() {
 		rotateRequest.Schedule = &types.RotationSchedule{
-			UpdateClients: req.Schedule.UpdateClients.AsTime(),
-			UpdateServers: req.Schedule.UpdateServers.AsTime(),
-			Standby:       req.Schedule.Standby.AsTime(),
+			UpdateClients: req.GetSchedule().GetUpdateClients().AsTime(),
+			UpdateServers: req.GetSchedule().GetUpdateServers().AsTime(),
+			Standby:       req.GetSchedule().GetStandby().AsTime(),
 		}
 	}
 
@@ -400,11 +400,11 @@ func (s *Service) RotateCertAuthority(ctx context.Context, req *trustpb.RotateCe
 // this method is called by remote trusted cluster and is used to update
 // only public keys and certificates of the certificate authority.
 func (s *Service) RotateExternalCertAuthority(ctx context.Context, req *trustpb.RotateExternalCertAuthorityRequest) (*trustpb.RotateExternalCertAuthorityResponse, error) {
-	if req.CertAuthority == nil {
+	if !req.HasCertAuthority() {
 		return nil, trace.BadParameter("missing certificate authority")
 	}
 
-	if err := services.ValidateCertAuthority(req.CertAuthority); err != nil {
+	if err := services.ValidateCertAuthority(req.GetCertAuthority()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -413,7 +413,7 @@ func (s *Service) RotateExternalCertAuthority(ctx context.Context, req *trustpb.
 		return nil, trace.Wrap(err)
 	}
 
-	if err := authCtx.CheckAccessToResource(req.CertAuthority, types.VerbRotate); err != nil {
+	if err := authCtx.CheckAccessToResource(req.GetCertAuthority(), types.VerbRotate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -422,13 +422,13 @@ func (s *Service) RotateExternalCertAuthority(ctx context.Context, req *trustpb.
 	}
 
 	// ensure that the caller is rotating a CA from the same cluster
-	caClusterName := req.CertAuthority.GetClusterName()
+	caClusterName := req.GetCertAuthority().GetClusterName()
 	if caClusterName != authCtx.Identity.GetIdentity().TeleportCluster {
 		return nil, trace.BadParameter("can not rotate local certificate authority")
 	}
 	// ensure the subjects and issuers of the CA certs match what the
 	// cluster name of this CA is supposed to be
-	for _, keyPair := range req.CertAuthority.GetTrustedTLSKeyPairs() {
+	for _, keyPair := range req.GetCertAuthority().GetTrustedTLSKeyPairs() {
 		cert, err := tlsca.ParseCertificatePEM(keyPair.Cert)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -449,23 +449,23 @@ func (s *Service) RotateExternalCertAuthority(ctx context.Context, req *trustpb.
 
 	// this is just an extra precaution against local admins,
 	// because this is additionally enforced by RBAC as well
-	if req.CertAuthority.GetClusterName() == clusterName.GetClusterName() {
+	if req.GetCertAuthority().GetClusterName() == clusterName.GetClusterName() {
 		return nil, trace.BadParameter("can not rotate local certificate authority")
 	}
 
 	existing, err := s.cache.GetCertAuthority(ctx, types.CertAuthID{
-		Type:       req.CertAuthority.GetType(),
-		DomainName: req.CertAuthority.GetClusterName(),
+		Type:       req.GetCertAuthority().GetType(),
+		DomainName: req.GetCertAuthority().GetClusterName(),
 	}, true)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	updated := existing.Clone()
-	if err := updated.SetActiveKeys(req.CertAuthority.GetActiveKeys().Clone()); err != nil {
+	if err := updated.SetActiveKeys(req.GetCertAuthority().GetActiveKeys().Clone()); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := updated.SetAdditionalTrustedKeys(req.CertAuthority.GetAdditionalTrustedKeys().Clone()); err != nil {
+	if err := updated.SetAdditionalTrustedKeys(req.GetCertAuthority().GetAdditionalTrustedKeys().Clone()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -474,7 +474,7 @@ func (s *Service) RotateExternalCertAuthority(ctx context.Context, req *trustpb.
 	// this before checking if `updated` is the same as `existing` or the check
 	// will fail for no reason (CheckAndSetDefaults is idempotent, so it's fine
 	// to call it both here and in CompareAndSwapCertAuthority)
-	updated.SetRotation(req.CertAuthority.GetRotation())
+	updated.SetRotation(req.GetCertAuthority().GetRotation())
 	if err := services.CheckAndSetDefaults(updated); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -508,12 +508,12 @@ func (s *Service) GenerateHostCert(
 	ruleCtx := &services.Context{
 		User: authCtx.User,
 		HostCert: &services.HostCertContext{
-			HostID:      req.HostId,
-			NodeName:    req.NodeName,
-			Principals:  req.Principals,
-			ClusterName: req.ClusterName,
-			Role:        types.SystemRole(req.Role),
-			TTL:         req.Ttl.AsDuration(),
+			HostID:      req.GetHostId(),
+			NodeName:    req.GetNodeName(),
+			Principals:  req.GetPrincipals(),
+			ClusterName: req.GetClusterName(),
+			Role:        types.SystemRole(req.GetRole()),
+			TTL:         req.GetTtl().AsDuration(),
 		},
 	}
 	if err = authCtx.CheckAccessToRule(
@@ -533,19 +533,19 @@ func (s *Service) GenerateHostCert(
 	// up to here.
 	cert, err := s.authServer.GenerateHostCert(
 		ctx,
-		req.Key,
-		req.HostId,
-		req.NodeName,
-		req.Principals,
-		req.ClusterName,
-		types.SystemRole(req.Role),
-		req.Ttl.AsDuration(),
+		req.GetKey(),
+		req.GetHostId(),
+		req.GetNodeName(),
+		req.GetPrincipals(),
+		req.GetClusterName(),
+		types.SystemRole(req.GetRole()),
+		req.GetTtl().AsDuration(),
 	)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &trustpb.GenerateHostCertResponse{
+	return trustpb.GenerateHostCertResponse_builder{
 		SshCertificate: cert,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/auth/trust/trustv1/service_test.go b/lib/auth/trust/trustv1/service_test.go
index 42c93c15893..88308718695 100644
--- a/lib/auth/trust/trustv1/service_test.go
+++ b/lib/auth/trust/trustv1/service_test.go
@@ -207,10 +207,10 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get no access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthority(ctx, &trustpb.GetCertAuthorityRequest{
+				_, err := service.GetCertAuthority(ctx, trustpb.GetCertAuthorityRequest_builder{
 					Type:   string(ca.GetType()),
 					Domain: ca.GetClusterName(),
-				})
+				}.Build())
 
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
@@ -226,10 +226,10 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get no secrets",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthority(ctx, &trustpb.GetCertAuthorityRequest{
+				_, err := service.GetCertAuthority(ctx, trustpb.GetCertAuthorityRequest_builder{
 					Type:   string(ca.GetType()),
 					Domain: ca.GetClusterName(),
-				})
+				}.Build())
 
 				require.NoError(t, err)
 			},
@@ -248,11 +248,11 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get with secrets",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthority(ctx, &trustpb.GetCertAuthorityRequest{
+				_, err := service.GetCertAuthority(ctx, trustpb.GetCertAuthorityRequest_builder{
 					Type:       string(ca.GetType()),
 					Domain:     ca.GetClusterName(),
 					IncludeKey: true,
-				})
+				}.Build())
 
 				require.NoError(t, err)
 			},
@@ -271,9 +271,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get authorities no access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthorities(ctx, &trustpb.GetCertAuthoritiesRequest{
+				_, err := service.GetCertAuthorities(ctx, trustpb.GetCertAuthoritiesRequest_builder{
 					Type: string(ca.GetType()),
-				})
+				}.Build())
 
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
@@ -291,9 +291,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get authorities no read access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthorities(ctx, &trustpb.GetCertAuthoritiesRequest{
+				_, err := service.GetCertAuthorities(ctx, trustpb.GetCertAuthoritiesRequest_builder{
 					Type: string(ca.GetType()),
-				})
+				}.Build())
 
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
@@ -312,9 +312,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get authorities no secrets",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthorities(ctx, &trustpb.GetCertAuthoritiesRequest{
+				_, err := service.GetCertAuthorities(ctx, trustpb.GetCertAuthoritiesRequest_builder{
 					Type: string(ca.GetType()),
-				})
+				}.Build())
 
 				require.NoError(t, err)
 			},
@@ -334,10 +334,10 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get authorities with secrets",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.GetCertAuthorities(ctx, &trustpb.GetCertAuthoritiesRequest{
+				_, err := service.GetCertAuthorities(ctx, trustpb.GetCertAuthoritiesRequest_builder{
 					Type:       string(ca.GetType()),
 					IncludeKey: true,
-				})
+				}.Build())
 
 				require.NoError(t, err)
 			},
@@ -359,10 +359,10 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "delete no access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.DeleteCertAuthority(ctx, &trustpb.DeleteCertAuthorityRequest{
+				_, err := service.DeleteCertAuthority(ctx, trustpb.DeleteCertAuthorityRequest_builder{
 					Type:   string(ca.GetType()),
 					Domain: ca.GetClusterName(),
-				})
+				}.Build())
 
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
@@ -378,10 +378,10 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "delete",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.DeleteCertAuthority(ctx, &trustpb.DeleteCertAuthorityRequest{
+				_, err := service.DeleteCertAuthority(ctx, trustpb.DeleteCertAuthorityRequest_builder{
 					Type:   string(ca.GetType()),
 					Domain: ca.GetClusterName(),
-				})
+				}.Build())
 
 				require.NoError(t, err)
 			},
@@ -397,9 +397,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert without create",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpsertCertAuthority(ctx, &trustpb.UpsertCertAuthorityRequest{
+				_, err := service.UpsertCertAuthority(ctx, trustpb.UpsertCertAuthorityRequest_builder{
 					CertAuthority: newCertAuthority(t, types.UserCA, "user").(*types.CertAuthorityV2),
-				})
+				}.Build())
 
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
@@ -419,9 +419,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert without update",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpsertCertAuthority(ctx, &trustpb.UpsertCertAuthorityRequest{
+				_, err := service.UpsertCertAuthority(ctx, trustpb.UpsertCertAuthorityRequest_builder{
 					CertAuthority: newCertAuthority(t, types.UserCA, "user").(*types.CertAuthorityV2),
-				})
+				}.Build())
 
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
@@ -441,9 +441,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert",
 			f: func(t *testing.T, service *Service) {
-				ca, err := service.UpsertCertAuthority(ctx, &trustpb.UpsertCertAuthorityRequest{
+				ca, err := service.UpsertCertAuthority(ctx, trustpb.UpsertCertAuthorityRequest_builder{
 					CertAuthority: newCertAuthority(t, types.UserCA, "user").(*types.CertAuthorityV2),
-				})
+				}.Build())
 				require.NoError(t, err)
 				require.NotNil(t, ca)
 			},
@@ -526,10 +526,10 @@ func TestGetCertAuthority(t *testing.T) {
 	}{
 		{
 			name: "ca not found",
-			request: &trustpb.GetCertAuthorityRequest{
+			request: trustpb.GetCertAuthorityRequest_builder{
 				Type:   string(types.SAMLIDPCA),
 				Domain: "unknown",
-			},
+			}.Build(),
 			assertion: func(t *testing.T, authority types.CertAuthority, err error) {
 				require.True(t, trace.IsNotFound(err))
 				require.Nil(t, authority)
@@ -537,10 +537,10 @@ func TestGetCertAuthority(t *testing.T) {
 		},
 		{
 			name: "ca found without secrets",
-			request: &trustpb.GetCertAuthorityRequest{
+			request: trustpb.GetCertAuthorityRequest_builder{
 				Type:   string(types.HostCA),
 				Domain: "test",
-			},
+			}.Build(),
 			assertion: func(t *testing.T, authority types.CertAuthority, err error) {
 				require.NoError(t, err)
 
@@ -566,11 +566,11 @@ func TestGetCertAuthority(t *testing.T) {
 		},
 		{
 			name: "ca found with secrets",
-			request: &trustpb.GetCertAuthorityRequest{
+			request: trustpb.GetCertAuthorityRequest_builder{
 				Type:       string(types.HostCA),
 				Domain:     "test",
 				IncludeKey: true,
-			},
+			}.Build(),
 			assertion: func(t *testing.T, authority types.CertAuthority, err error) {
 				require.NoError(t, err)
 				require.Empty(t, cmp.Diff(authority, ca, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
@@ -667,11 +667,11 @@ func TestGetCertAuthority_outdatedTctl(t *testing.T) {
 	require.NoError(t, err, "CreateCertAuthorities errored")
 
 	requestForCA := func(ca types.CertAuthority) *trustpb.GetCertAuthorityRequest {
-		return &trustpb.GetCertAuthorityRequest{
+		return trustpb.GetCertAuthorityRequest_builder{
 			Type:       string(ca.GetType()),
 			Domain:     ca.GetClusterName(),
 			IncludeKey: true, // Makes for simpler assertions. Not necessary.
-		}
+		}.Build()
 	}
 
 	makeClientContext := func(ctx context.Context, component, version string) context.Context {
@@ -798,20 +798,20 @@ func TestGetCertAuthorities(t *testing.T) {
 	}{
 		{
 			name: "ca type does not exist",
-			request: &trustpb.GetCertAuthoritiesRequest{
+			request: trustpb.GetCertAuthoritiesRequest_builder{
 				Type: string(types.SAMLIDPCA),
-			},
+			}.Build(),
 			assertion: func(t *testing.T, resp *trustpb.GetCertAuthoritiesResponse, err error) {
 				require.NoError(t, err)
 				require.NotNil(t, resp)
-				require.Empty(t, resp.CertAuthoritiesV2)
+				require.Empty(t, resp.GetCertAuthoritiesV2())
 			},
 		},
 		{
 			name: "ca found without secrets",
-			request: &trustpb.GetCertAuthoritiesRequest{
+			request: trustpb.GetCertAuthoritiesRequest_builder{
 				Type: string(types.HostCA),
-			},
+			}.Build(),
 			assertion: func(t *testing.T, resp *trustpb.GetCertAuthoritiesResponse, err error) {
 				require.NoError(t, err)
 
@@ -826,13 +826,13 @@ func TestGetCertAuthorities(t *testing.T) {
 					}
 				}
 
-				require.Empty(t, cmp.Diff(expectedWithoutSecrets, resp.CertAuthoritiesV2,
+				require.Empty(t, cmp.Diff(expectedWithoutSecrets, resp.GetCertAuthoritiesV2(),
 					cmpopts.IgnoreFields(types.Metadata{}, "Revision"),
 					cmpopts.IgnoreFields(types.TLSKeyPair{}, "Key"),
 					cmpopts.IgnoreFields(types.JWTKeyPair{}, "PrivateKey"),
 				))
 
-				for _, ca := range resp.CertAuthoritiesV2 {
+				for _, ca := range resp.GetCertAuthoritiesV2() {
 					keys := ca.GetActiveKeys()
 					require.Nil(t, keys.TLS[0].Key)
 					require.Nil(t, keys.SSH[0].PrivateKey)
@@ -842,13 +842,13 @@ func TestGetCertAuthorities(t *testing.T) {
 		},
 		{
 			name: "ca found with secrets",
-			request: &trustpb.GetCertAuthoritiesRequest{
+			request: trustpb.GetCertAuthoritiesRequest_builder{
 				Type:       string(types.HostCA),
 				IncludeKey: true,
-			},
+			}.Build(),
 			assertion: func(t *testing.T, resp *trustpb.GetCertAuthoritiesResponse, err error) {
 				require.NoError(t, err)
-				require.Empty(t, cmp.Diff(expectedCAs, resp.CertAuthoritiesV2, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				require.Empty(t, cmp.Diff(expectedCAs, resp.GetCertAuthoritiesV2(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 		},
 	}
@@ -900,10 +900,10 @@ func TestDeleteCertAuthority(t *testing.T) {
 	}{
 		{
 			name: "ca not found",
-			request: &trustpb.DeleteCertAuthorityRequest{
+			request: trustpb.DeleteCertAuthorityRequest_builder{
 				Type:   string(types.SAMLIDPCA),
 				Domain: "unknown",
-			},
+			}.Build(),
 			assertion: func(t *testing.T, err error) {
 				// ca deletion doesn't generate not found errors. this is a quirk of
 				// the fact that deleting active and inactive CAs simultanesouly
@@ -915,14 +915,14 @@ func TestDeleteCertAuthority(t *testing.T) {
 		},
 		{
 			name: "ca deleted",
-			request: &trustpb.DeleteCertAuthorityRequest{
+			request: trustpb.DeleteCertAuthorityRequest_builder{
 				Type:   string(types.HostCA),
 				Domain: "test",
-			},
+			}.Build(),
 			assertion: func(t *testing.T, err error) {
 				require.NoError(t, err)
 
-				ca, err := service.GetCertAuthority(ctx, &trustpb.GetCertAuthorityRequest{Domain: "test", Type: string(types.HostCA)})
+				ca, err := service.GetCertAuthority(ctx, trustpb.GetCertAuthorityRequest_builder{Domain: "test", Type: string(types.HostCA)}.Build())
 				require.True(t, trace.IsNotFound(err), "got unexpected error retrieving a deleted ca: %v", err)
 				require.Nil(t, ca)
 			},
@@ -1008,9 +1008,9 @@ func TestUpsertCertAuthority(t *testing.T) {
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			ca, err := service.UpsertCertAuthority(ctx, &trustpb.UpsertCertAuthorityRequest{
+			ca, err := service.UpsertCertAuthority(ctx, trustpb.UpsertCertAuthorityRequest_builder{
 				CertAuthority: test.ca(hostCA),
-			})
+			}.Build())
 			test.assertion(t, ca, err)
 		})
 	}
@@ -1056,15 +1056,15 @@ func TestRotateCertAuthority(t *testing.T) {
 	}{
 		{
 			name: "success",
-			req: &trustpb.RotateCertAuthorityRequest{
+			req: trustpb.RotateCertAuthorityRequest_builder{
 				Type: "success",
-			},
+			}.Build(),
 		},
 		{
 			name: "fail",
-			req: &trustpb.RotateCertAuthorityRequest{
+			req: trustpb.RotateCertAuthorityRequest_builder{
 				Type: "fail",
-			},
+			}.Build(),
 			wantErr: fakeErr,
 		},
 	}
@@ -1216,9 +1216,9 @@ func TestRotateExternalCertAuthority(t *testing.T) {
 			service, err := NewService(cfg)
 			require.NoError(t, err)
 
-			_, err = service.RotateExternalCertAuthority(ctx, &trustpb.RotateExternalCertAuthorityRequest{
+			_, err = service.RotateExternalCertAuthority(ctx, trustpb.RotateExternalCertAuthorityRequest_builder{
 				CertAuthority: test.ca,
-			})
+			}.Build())
 			test.assertError(t, err, "RotateExternalCertAuthority error mismatch")
 		})
 	}
@@ -1271,19 +1271,19 @@ func TestGenerateHostCert(t *testing.T) {
 	}{
 		{
 			name: "success",
-			req: &trustpb.GenerateHostCertRequest{
+			req: trustpb.GenerateHostCertRequest_builder{
 				HostId: "success",
-			},
+			}.Build(),
 
-			want: &trustpb.GenerateHostCertResponse{
+			want: trustpb.GenerateHostCertResponse_builder{
 				SshCertificate: []byte("foo"),
-			},
+			}.Build(),
 		},
 		{
 			name: "fail",
-			req: &trustpb.GenerateHostCertRequest{
+			req: trustpb.GenerateHostCertRequest_builder{
 				HostId: "fail",
-			},
+			}.Build(),
 
 			wantErr: "bad thing happened",
 		},
diff --git a/lib/auth/trust/trustv1/trustedcluster.go b/lib/auth/trust/trustv1/trustedcluster.go
index 38faa980e11..f2ad4224fdf 100644
--- a/lib/auth/trust/trustv1/trustedcluster.go
+++ b/lib/auth/trust/trustv1/trustedcluster.go
@@ -134,22 +134,22 @@ func (s *Service) ListTrustedClusters(ctx context.Context, req *trustpb.ListTrus
 		return nil, trace.Wrap(err)
 	}
 
-	tcs, next, err := s.authServer.ListTrustedClusters(ctx, int(req.PageSize), req.PageToken)
+	tcs, next, err := s.authServer.ListTrustedClusters(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	resp := &trustpb.ListTrustedClustersResponse{
+	resp := trustpb.ListTrustedClustersResponse_builder{
 		TrustedClusters: make([]*types.TrustedClusterV2, 0, len(tcs)),
 		NextPageToken:   next,
-	}
+	}.Build()
 
 	for _, tc := range tcs {
 		trustedClusterV2, ok := tc.(*types.TrustedClusterV2)
 		if !ok {
 			return nil, trace.Errorf("encountered unexpected Trusted Cluster type: %T", tc)
 		}
-		resp.TrustedClusters = append(resp.TrustedClusters, trustedClusterV2)
+		resp.SetTrustedClusters(append(resp.GetTrustedClusters(), trustedClusterV2))
 	}
 
 	return resp, nil
diff --git a/lib/auth/trust/trustv1/trustedcluster_test.go b/lib/auth/trust/trustv1/trustedcluster_test.go
index 2ad90210347..0bbd377b909 100644
--- a/lib/auth/trust/trustv1/trustedcluster_test.go
+++ b/lib/auth/trust/trustv1/trustedcluster_test.go
@@ -65,23 +65,23 @@ func TestCloudProhibited(t *testing.T) {
 	require.True(t, ok)
 
 	t.Run("Cloud prohibits being a leaf cluster (UpsertTrustedCluster)", func(t *testing.T) {
-		_, err = service.UpsertTrustedCluster(ctx, &trustpb.UpsertTrustedClusterRequest{
+		_, err = service.UpsertTrustedCluster(ctx, trustpb.UpsertTrustedClusterRequest_builder{
 			TrustedCluster: trustedClusterV2,
-		})
+		}.Build())
 		require.True(t, trace.IsNotImplemented(err), "UpsertTrustedClusterV2 returned an unexpected error, got = %v (%T), want trace.NotImplementedError", err, err)
 	})
 
 	t.Run("Cloud prohibits being a leaf cluster (CreateTrustedCluster)", func(t *testing.T) {
-		_, err = service.CreateTrustedCluster(ctx, &trustpb.CreateTrustedClusterRequest{
+		_, err = service.CreateTrustedCluster(ctx, trustpb.CreateTrustedClusterRequest_builder{
 			TrustedCluster: trustedClusterV2,
-		})
+		}.Build())
 		require.True(t, trace.IsNotImplemented(err), "CreateTrustedCluster returned an unexpected error, got = %v (%T), want trace.NotImplementedError", err, err)
 	})
 
 	t.Run("Cloud prohibits being a leaf cluster (UpdateTrustedCluster)", func(t *testing.T) {
-		_, err = service.UpdateTrustedCluster(ctx, &trustpb.UpdateTrustedClusterRequest{
+		_, err = service.UpdateTrustedCluster(ctx, trustpb.UpdateTrustedClusterRequest_builder{
 			TrustedCluster: trustedClusterV2,
-		})
+		}.Build())
 		require.True(t, trace.IsNotImplemented(err), "UpdateTrustedCluster returned an unexpected error, got = %v (%T), want trace.NotImplementedError", err, err)
 	})
 }
@@ -110,9 +110,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "upsert no access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpsertTrustedCluster(ctx, &trustpb.UpsertTrustedClusterRequest{
+				_, err := service.UpsertTrustedCluster(ctx, trustpb.UpsertTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
 			authorizer: fakeAuthorizer{
@@ -128,9 +128,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "upsert no create access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpsertTrustedCluster(ctx, &trustpb.UpsertTrustedClusterRequest{
+				_, err := service.UpsertTrustedCluster(ctx, trustpb.UpsertTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
 			authorizer: fakeAuthorizer{
@@ -149,9 +149,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "upsert no update access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpsertTrustedCluster(ctx, &trustpb.UpsertTrustedClusterRequest{
+				_, err := service.UpsertTrustedCluster(ctx, trustpb.UpsertTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
 			authorizer: fakeAuthorizer{
@@ -170,9 +170,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "upsert ok",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpsertTrustedCluster(ctx, &trustpb.UpsertTrustedClusterRequest{
+				_, err := service.UpsertTrustedCluster(ctx, trustpb.UpsertTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 			authorizer: fakeAuthorizer{
@@ -191,9 +191,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "create no access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.CreateTrustedCluster(ctx, &trustpb.CreateTrustedClusterRequest{
+				_, err := service.CreateTrustedCluster(ctx, trustpb.CreateTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
 			authorizer: fakeAuthorizer{
@@ -208,9 +208,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "create ok",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.CreateTrustedCluster(ctx, &trustpb.CreateTrustedClusterRequest{
+				_, err := service.CreateTrustedCluster(ctx, trustpb.CreateTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 			authorizer: fakeAuthorizer{
@@ -227,9 +227,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "update no access",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpdateTrustedCluster(ctx, &trustpb.UpdateTrustedClusterRequest{
+				_, err := service.UpdateTrustedCluster(ctx, trustpb.UpdateTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.True(t, trace.IsAccessDenied(err), "expected AccessDenied error, got %v", err)
 			},
 			authorizer: fakeAuthorizer{
@@ -244,9 +244,9 @@ func TestTrustedClusterRBAC(t *testing.T) {
 		{
 			desc: "update ok",
 			f: func(t *testing.T, service *Service) {
-				_, err := service.UpdateTrustedCluster(ctx, &trustpb.UpdateTrustedClusterRequest{
+				_, err := service.UpdateTrustedCluster(ctx, trustpb.UpdateTrustedClusterRequest_builder{
 					TrustedCluster: trustedClusterV2,
-				})
+				}.Build())
 				require.NoError(t, err)
 			},
 			authorizer: fakeAuthorizer{
diff --git a/lib/auth/trust/trustv1/tunnelconnection.go b/lib/auth/trust/trustv1/tunnelconnection.go
index a78ded9fb88..bd247c2e287 100644
--- a/lib/auth/trust/trustv1/tunnelconnection.go
+++ b/lib/auth/trust/trustv1/tunnelconnection.go
@@ -30,7 +30,7 @@ import (
 
 // UpsertTunnelConnection creates or updates the provided tunnel connection.
 func (s *Service) UpsertTunnelConnection(ctx context.Context, req *trustpb.UpsertTunnelConnectionRequest) (*trustpb.UpsertTunnelConnectionResponse, error) {
-	if req.TunnelConnection == nil {
+	if !req.HasTunnelConnection() {
 		return nil, trace.BadParameter("missing tunnel connection")
 	}
 
@@ -46,7 +46,7 @@ func (s *Service) UpsertTunnelConnection(ctx context.Context, req *trustpb.Upser
 		return nil, trace.Wrap(err)
 	}
 
-	stored, err := s.backend.UpsertTunnelConnectionV2(ctx, req.TunnelConnection)
+	stored, err := s.backend.UpsertTunnelConnectionV2(ctx, req.GetTunnelConnection())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -55,18 +55,18 @@ func (s *Service) UpsertTunnelConnection(ctx context.Context, req *trustpb.Upser
 		return nil, trace.BadParameter("encountered unexpected tunnel connection type %T", stored)
 	}
 
-	return &trustpb.UpsertTunnelConnectionResponse{
+	return trustpb.UpsertTunnelConnectionResponse_builder{
 		TunnelConnection: storedV2,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteTunnelConnection removes a single tunnel connection by cluster and
 // connection name.
 func (s *Service) DeleteTunnelConnection(ctx context.Context, req *trustpb.DeleteTunnelConnectionRequest) (*emptypb.Empty, error) {
-	if req.ClusterName == "" {
+	if req.GetClusterName() == "" {
 		return nil, trace.BadParameter("missing cluster name")
 	}
-	if req.ConnectionName == "" {
+	if req.GetConnectionName() == "" {
 		return nil, trace.BadParameter("missing connection name")
 	}
 
@@ -82,7 +82,7 @@ func (s *Service) DeleteTunnelConnection(ctx context.Context, req *trustpb.Delet
 		return nil, trace.Wrap(err)
 	}
 
-	if err := s.backend.DeleteTunnelConnection(ctx, req.ClusterName, req.ConnectionName); err != nil {
+	if err := s.backend.DeleteTunnelConnection(ctx, req.GetClusterName(), req.GetConnectionName()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/auth/trust/trustv1/tunnelconnection_test.go b/lib/auth/trust/trustv1/tunnelconnection_test.go
index 026ed4b0ac4..2d9b6184904 100644
--- a/lib/auth/trust/trustv1/tunnelconnection_test.go
+++ b/lib/auth/trust/trustv1/tunnelconnection_test.go
@@ -56,7 +56,7 @@ func TestUpsertTunnelConnection(t *testing.T) {
 		{
 			name: "success",
 			req: func(t *testing.T) *trustpb.UpsertTunnelConnectionRequest {
-				return &trustpb.UpsertTunnelConnectionRequest{TunnelConnection: newConn(t)}
+				return trustpb.UpsertTunnelConnectionRequest_builder{TunnelConnection: newConn(t)}.Build()
 			},
 			allow: map[check]bool{
 				{types.KindTunnelConnection, types.VerbCreate}: true,
@@ -80,7 +80,7 @@ func TestUpsertTunnelConnection(t *testing.T) {
 		{
 			name: "access denied",
 			req: func(t *testing.T) *trustpb.UpsertTunnelConnectionRequest {
-				return &trustpb.UpsertTunnelConnectionRequest{TunnelConnection: newConn(t)}
+				return trustpb.UpsertTunnelConnectionRequest_builder{TunnelConnection: newConn(t)}.Build()
 			},
 			allow: map[check]bool{
 				{types.KindTunnelConnection, types.VerbCreate}: false,
@@ -113,14 +113,14 @@ func TestUpsertTunnelConnection(t *testing.T) {
 			if err != nil {
 				return
 			}
-			require.NotEmpty(t, resp.TunnelConnection.GetRevision(), "response should carry the backend-assigned revision")
-			require.Equal(t, req.TunnelConnection, resp.TunnelConnection)
+			require.NotEmpty(t, resp.GetTunnelConnection().GetRevision(), "response should carry the backend-assigned revision")
+			require.Equal(t, req.GetTunnelConnection(), resp.GetTunnelConnection())
 
-			stored, err := trust.GetTunnelConnections(req.TunnelConnection.GetClusterName())
+			stored, err := trust.GetTunnelConnections(req.GetTunnelConnection().GetClusterName())
 			require.NoError(t, err)
 			require.Len(t, stored, 1)
-			require.Equal(t, req.TunnelConnection.GetName(), stored[0].GetName())
-			require.Equal(t, resp.TunnelConnection.GetRevision(), stored[0].GetRevision())
+			require.Equal(t, req.GetTunnelConnection().GetName(), stored[0].GetName())
+			require.Equal(t, resp.GetTunnelConnection().GetRevision(), stored[0].GetRevision())
 		})
 	}
 }
@@ -153,32 +153,32 @@ func TestDeleteTunnelConnection(t *testing.T) {
 	}{
 		{
 			name: "success",
-			req: &trustpb.DeleteTunnelConnectionRequest{
+			req: trustpb.DeleteTunnelConnectionRequest_builder{
 				ClusterName:    clusterName,
 				ConnectionName: connName,
-			},
+			}.Build(),
 			allow:     map[check]bool{{types.KindTunnelConnection, types.VerbDelete}: true},
 			assertErr: require.NoError,
 			wantGone:  true,
 		},
 		{
 			name:      "missing cluster name",
-			req:       &trustpb.DeleteTunnelConnectionRequest{ConnectionName: connName},
+			req:       trustpb.DeleteTunnelConnectionRequest_builder{ConnectionName: connName}.Build(),
 			allow:     map[check]bool{{types.KindTunnelConnection, types.VerbDelete}: true},
 			assertErr: func(t require.TestingT, err error, _ ...any) { require.True(t, trace.IsBadParameter(err)) },
 		},
 		{
 			name:      "missing connection name",
-			req:       &trustpb.DeleteTunnelConnectionRequest{ClusterName: clusterName},
+			req:       trustpb.DeleteTunnelConnectionRequest_builder{ClusterName: clusterName}.Build(),
 			allow:     map[check]bool{{types.KindTunnelConnection, types.VerbDelete}: true},
 			assertErr: func(t require.TestingT, err error, _ ...any) { require.True(t, trace.IsBadParameter(err)) },
 		},
 		{
 			name: "access denied",
-			req: &trustpb.DeleteTunnelConnectionRequest{
+			req: trustpb.DeleteTunnelConnectionRequest_builder{
 				ClusterName:    clusterName,
 				ConnectionName: connName,
-			},
+			}.Build(),
 			allow:     map[check]bool{{types.KindTunnelConnection, types.VerbDelete}: false},
 			assertErr: func(t require.TestingT, err error, _ ...any) { require.True(t, trace.IsAccessDenied(err)) },
 		},
diff --git a/lib/auth/userloginstate/userloginstatev1/service.go b/lib/auth/userloginstate/userloginstatev1/service.go
index 2426556c86a..8cf370a336a 100644
--- a/lib/auth/userloginstate/userloginstatev1/service.go
+++ b/lib/auth/userloginstate/userloginstatev1/service.go
@@ -105,9 +105,9 @@ func (s *Service) GetUserLoginStates(ctx context.Context, _ *userloginstatev1.Ge
 		ulsList[i] = conv.ToProto(r)
 	}
 
-	return &userloginstatev1.GetUserLoginStatesResponse{
+	return userloginstatev1.GetUserLoginStatesResponse_builder{
 		UserLoginStates: ulsList,
-	}, nil
+	}.Build(), nil
 }
 
 // GetUserLoginState returns the specified user login state resource.
diff --git a/lib/auth/userloginstate/userloginstatev1/service_test.go b/lib/auth/userloginstate/userloginstatev1/service_test.go
index 05cd1c7ce9e..e85143794e0 100644
--- a/lib/auth/userloginstate/userloginstatev1/service_test.go
+++ b/lib/auth/userloginstate/userloginstatev1/service_test.go
@@ -70,20 +70,20 @@ func TestGetUserLoginStates(t *testing.T) {
 
 	getResp, err := svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, getResp.UserLoginStates)
+	require.Empty(t, getResp.GetUserLoginStates())
 
 	uls1 := newUserLoginState(t, "1", nil, stRoles, stTraits, stRoles, stTraits)
 	uls2 := newUserLoginState(t, "2", nil, stRoles, stTraits, stRoles, stTraits)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls1)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls1)}.Build())
 	require.NoError(t, err)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls2)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls2)}.Build())
 	require.NoError(t, err)
 
 	getResp, err = svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{uls1, uls2}, mustFromProtoAll(t, getResp.UserLoginStates...), cmpOpts...))
+	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{uls1, uls2}, mustFromProtoAll(t, getResp.GetUserLoginStates()...), cmpOpts...))
 
 	_, err = svc.GetUserLoginStates(noAccessCtx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.True(t, trace.IsAccessDenied(err))
@@ -96,20 +96,20 @@ func TestUpsertUserLoginStates(t *testing.T) {
 
 	getResp, err := svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, getResp.UserLoginStates)
+	require.Empty(t, getResp.GetUserLoginStates())
 
 	uls1 := newUserLoginState(t, "1", nil, stRoles, stTraits, stRoles, stTraits)
 	uls2 := newUserLoginState(t, "2", nil, stRoles, stTraits, stRoles, stTraits)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls1)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls1)}.Build())
 	require.NoError(t, err)
 
-	_, err = svc.UpsertUserLoginState(noAccessCtx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls2)})
+	_, err = svc.UpsertUserLoginState(noAccessCtx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls2)}.Build())
 	require.True(t, trace.IsAccessDenied(err))
 
 	getResp, err = svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{uls1}, mustFromProtoAll(t, getResp.UserLoginStates...), cmpOpts...))
+	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{uls1}, mustFromProtoAll(t, getResp.GetUserLoginStates()...), cmpOpts...))
 }
 
 func TestGetUserLoginState(t *testing.T) {
@@ -119,22 +119,22 @@ func TestGetUserLoginState(t *testing.T) {
 
 	getResp, err := svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, getResp.UserLoginStates)
+	require.Empty(t, getResp.GetUserLoginStates())
 
 	uls1 := newUserLoginState(t, "1", nil, stRoles, stTraits, stRoles, stTraits)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls1)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls1)}.Build())
 	require.NoError(t, err)
 
-	get, err := svc.GetUserLoginState(ctx, &userloginstatepb.GetUserLoginStateRequest{
+	get, err := svc.GetUserLoginState(ctx, userloginstatepb.GetUserLoginStateRequest_builder{
 		Name: uls1.GetName(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(uls1, mustFromProto(t, get), cmpOpts...))
 
-	_, err = svc.GetUserLoginState(noAccessCtx, &userloginstatepb.GetUserLoginStateRequest{
+	_, err = svc.GetUserLoginState(noAccessCtx, userloginstatepb.GetUserLoginStateRequest_builder{
 		Name: uls1.GetName(),
-	})
+	}.Build())
 	require.True(t, trace.IsAccessDenied(err))
 }
 
@@ -145,23 +145,23 @@ func TestDeleteUserLoginState(t *testing.T) {
 
 	getResp, err := svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, getResp.UserLoginStates)
+	require.Empty(t, getResp.GetUserLoginStates())
 
 	uls1 := newUserLoginState(t, "1", nil, stRoles, stTraits, stRoles, stTraits)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls1)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls1)}.Build())
 	require.NoError(t, err)
 
-	get, err := svc.GetUserLoginState(ctx, &userloginstatepb.GetUserLoginStateRequest{
+	get, err := svc.GetUserLoginState(ctx, userloginstatepb.GetUserLoginStateRequest_builder{
 		Name: uls1.GetName(),
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(uls1, mustFromProto(t, get), cmpOpts...))
 
-	_, err = svc.DeleteUserLoginState(ctx, &userloginstatepb.DeleteUserLoginStateRequest{Name: uls1.GetName()})
+	_, err = svc.DeleteUserLoginState(ctx, userloginstatepb.DeleteUserLoginStateRequest_builder{Name: uls1.GetName()}.Build())
 	require.NoError(t, err)
 
-	_, err = svc.GetUserLoginState(ctx, &userloginstatepb.GetUserLoginStateRequest{Name: uls1.GetName()})
+	_, err = svc.GetUserLoginState(ctx, userloginstatepb.GetUserLoginStateRequest_builder{Name: uls1.GetName()}.Build())
 	require.True(t, trace.IsNotFound(err))
 }
 
@@ -172,27 +172,27 @@ func TestDeleteAllAccessLists(t *testing.T) {
 
 	getResp, err := svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, getResp.UserLoginStates)
+	require.Empty(t, getResp.GetUserLoginStates())
 
 	uls1 := newUserLoginState(t, "1", nil, stRoles, stTraits, stRoles, stTraits)
 	uls2 := newUserLoginState(t, "2", nil, stRoles, stTraits, stRoles, stTraits)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls1)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls1)}.Build())
 	require.NoError(t, err)
 
-	_, err = svc.UpsertUserLoginState(ctx, &userloginstatepb.UpsertUserLoginStateRequest{UserLoginState: conv.ToProto(uls2)})
+	_, err = svc.UpsertUserLoginState(ctx, userloginstatepb.UpsertUserLoginStateRequest_builder{UserLoginState: conv.ToProto(uls2)}.Build())
 	require.NoError(t, err)
 
 	getResp, err = svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{uls1, uls2}, mustFromProtoAll(t, getResp.UserLoginStates...), cmpOpts...))
+	require.Empty(t, cmp.Diff([]*userloginstate.UserLoginState{uls1, uls2}, mustFromProtoAll(t, getResp.GetUserLoginStates()...), cmpOpts...))
 
 	_, err = svc.DeleteAllUserLoginStates(ctx, &userloginstatepb.DeleteAllUserLoginStatesRequest{})
 	require.NoError(t, err)
 
 	getResp, err = svc.GetUserLoginStates(ctx, &userloginstatepb.GetUserLoginStatesRequest{})
 	require.NoError(t, err)
-	require.Empty(t, getResp.UserLoginStates)
+	require.Empty(t, getResp.GetUserLoginStates())
 }
 
 type testClient struct {
diff --git a/lib/auth/userpreferences/userpreferencesv1/service.go b/lib/auth/userpreferences/userpreferencesv1/service.go
index 2bf7b1b3399..90e9d7e0298 100644
--- a/lib/auth/userpreferences/userpreferencesv1/service.go
+++ b/lib/auth/userpreferences/userpreferencesv1/service.go
@@ -72,9 +72,9 @@ func (a *Service) GetUserPreferences(ctx context.Context, _ *userpreferences.Get
 		return nil, trace.Wrap(err)
 	}
 
-	return &userpreferences.GetUserPreferencesResponse{
+	return userpreferences.GetUserPreferencesResponse_builder{
 		Preferences: prefs,
-	}, nil
+	}.Build(), nil
 }
 
 // UpsertUserPreferences creates or updates user preferences for a given username.
@@ -86,5 +86,5 @@ func (a *Service) UpsertUserPreferences(ctx context.Context, req *userpreference
 
 	username := authCtx.User.GetName()
 
-	return &emptypb.Empty{}, trace.Wrap(a.backend.UpsertUserPreferences(ctx, username, req.Preferences))
+	return &emptypb.Empty{}, trace.Wrap(a.backend.UpsertUserPreferences(ctx, username, req.GetPreferences()))
 }
diff --git a/lib/auth/userpreferences/userpreferencesv1/service_test.go b/lib/auth/userpreferences/userpreferencesv1/service_test.go
index 66ec42fcf01..028c308b4c9 100644
--- a/lib/auth/userpreferences/userpreferencesv1/service_test.go
+++ b/lib/auth/userpreferences/userpreferencesv1/service_test.go
@@ -53,25 +53,25 @@ func TestService_GetUserPreferences(t *testing.T) {
 			name:     "success",
 			userName: defaultUser,
 			req:      &userpreferencesv1.GetUserPreferencesRequest{},
-			want: &userpreferencesv1.GetUserPreferencesResponse{
-				Preferences: &userpreferencesv1.UserPreferences{
+			want: userpreferencesv1.GetUserPreferencesResponse_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
 					Theme:             userpreferencesv1.Theme_THEME_UNSPECIFIED,
 					SideNavDrawerMode: userpreferencesv1.SideNavDrawerMode_SIDE_NAV_DRAWER_MODE_UNSPECIFIED,
-					UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+					UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 						DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_ALL,
 						ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_CARD,
 						LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 						AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_NONE,
-					},
-					Onboard: &userpreferencesv1.OnboardUserPreferences{
+					}.Build(),
+					Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 						PreferredResources: []userpreferencesv1.Resource{},
 						MarketingParams:    &userpreferencesv1.MarketingParams{},
-					},
-					ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
+					}.Build(),
+					ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
 						PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			wantErr: assert.NoError,
 		},
 		{
@@ -100,17 +100,17 @@ func TestService_GetUserPreferences(t *testing.T) {
 func TestService_UpsertUserPreferences(t *testing.T) {
 	t.Parallel()
 
-	defaultPreferences := &userpreferencesv1.UserPreferences{
+	defaultPreferences := userpreferencesv1.UserPreferences_builder{
 		Theme: userpreferencesv1.Theme_THEME_LIGHT,
-		Onboard: &userpreferencesv1.OnboardUserPreferences{
+		Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 			PreferredResources: []userpreferencesv1.Resource{},
-		},
-		ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-			PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+		}.Build(),
+		ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+			PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 				ResourceIds: []string{"node1", "node2"},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	tests := []struct {
 		name     string
@@ -121,17 +121,17 @@ func TestService_UpsertUserPreferences(t *testing.T) {
 		{
 			name:     "success",
 			userName: defaultUser,
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
 				Preferences: defaultPreferences,
-			},
+			}.Build(),
 			wantErr: assert.NoError,
 		},
 		{
 			name:     "access denied - user doesn't exist",
 			userName: nonExistingUser,
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
 				Preferences: defaultPreferences,
-			},
+			}.Build(),
 			wantErr: assert.Error,
 		},
 	}
diff --git a/lib/auth/userprovisioning/userprovisioningv2/service.go b/lib/auth/userprovisioning/userprovisioningv2/service.go
index c11e59c200e..a34c5bb3cfa 100644
--- a/lib/auth/userprovisioning/userprovisioningv2/service.go
+++ b/lib/auth/userprovisioning/userprovisioningv2/service.go
@@ -95,19 +95,19 @@ func (s *Service) ListStaticHostUsers(ctx context.Context, req *userprovisioning
 		return nil, trace.Wrap(err)
 	}
 
-	users, nextToken, err := s.cache.ListStaticHostUsers(ctx, int(req.PageSize), req.PageToken)
+	users, nextToken, err := s.cache.ListStaticHostUsers(ctx, int(req.GetPageSize()), req.GetPageToken())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &userprovisioningpb.ListStaticHostUsersResponse{
+	return userprovisioningpb.ListStaticHostUsersResponse_builder{
 		Users:         users,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // GetStaticHostUser returns a static host user by name.
 func (s *Service) GetStaticHostUser(ctx context.Context, req *userprovisioningpb.GetStaticHostUserRequest) (*userprovisioningpb.StaticHostUser, error) {
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("missing name")
 	}
 	authCtx, err := s.authorizer.Authorize(ctx)
@@ -121,7 +121,7 @@ func (s *Service) GetStaticHostUser(ctx context.Context, req *userprovisioningpb
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := s.cache.GetStaticHostUser(ctx, req.Name)
+	out, err := s.cache.GetStaticHostUser(ctx, req.GetName())
 	return out, trace.Wrap(err)
 }
 
@@ -151,7 +151,7 @@ func (s *Service) CreateStaticHostUser(ctx context.Context, req *userprovisionin
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := s.backend.CreateStaticHostUser(ctx, req.User)
+	out, err := s.backend.CreateStaticHostUser(ctx, req.GetUser())
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.StaticHostUserCreate{
 		Metadata: apievents.Metadata{
@@ -161,7 +161,7 @@ func (s *Service) CreateStaticHostUser(ctx context.Context, req *userprovisionin
 		UserMetadata:       authCtx.GetUserMetadata(),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.User.Metadata.Name,
+			Name: req.GetUser().GetMetadata().GetName(),
 		},
 		Status: eventStatus(err),
 	}); err != nil {
@@ -184,7 +184,7 @@ func (s *Service) UpdateStaticHostUser(ctx context.Context, req *userprovisionin
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := s.backend.UpdateStaticHostUser(ctx, req.User)
+	out, err := s.backend.UpdateStaticHostUser(ctx, req.GetUser())
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.StaticHostUserUpdate{
 		Metadata: apievents.Metadata{
@@ -195,7 +195,7 @@ func (s *Service) UpdateStaticHostUser(ctx context.Context, req *userprovisionin
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		Status:             eventStatus(err),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.User.Metadata.Name,
+			Name: req.GetUser().GetMetadata().GetName(),
 		},
 	}); err != nil {
 		slog.WarnContext(ctx, "Failed to emit static host user update event.", "error", err)
@@ -217,7 +217,7 @@ func (s *Service) UpsertStaticHostUser(ctx context.Context, req *userprovisionin
 		return nil, trace.Wrap(err)
 	}
 
-	out, err := s.backend.UpsertStaticHostUser(ctx, req.User)
+	out, err := s.backend.UpsertStaticHostUser(ctx, req.GetUser())
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.StaticHostUserCreate{
 		Metadata: apievents.Metadata{
 			Type: events.StaticHostUserCreateEvent,
@@ -226,7 +226,7 @@ func (s *Service) UpsertStaticHostUser(ctx context.Context, req *userprovisionin
 		UserMetadata:       authCtx.GetUserMetadata(),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.User.Metadata.Name,
+			Name: req.GetUser().GetMetadata().GetName(),
 		},
 		Status: eventStatus(err),
 	}); err != nil {
@@ -239,7 +239,7 @@ func (s *Service) UpsertStaticHostUser(ctx context.Context, req *userprovisionin
 // DeleteStaticHostUser deletes a static host user. Note that this does not
 // remove any host users created on nodes from the resource.
 func (s *Service) DeleteStaticHostUser(ctx context.Context, req *userprovisioningpb.DeleteStaticHostUserRequest) (*emptypb.Empty, error) {
-	if req.Name == "" {
+	if req.GetName() == "" {
 		return nil, trace.BadParameter("missing name")
 	}
 	authCtx, err := s.authorizer.Authorize(ctx)
@@ -253,7 +253,7 @@ func (s *Service) DeleteStaticHostUser(ctx context.Context, req *userprovisionin
 		return nil, trace.Wrap(err)
 	}
 
-	err = s.backend.DeleteStaticHostUser(ctx, req.Name)
+	err = s.backend.DeleteStaticHostUser(ctx, req.GetName())
 
 	if err := s.emitter.EmitAuditEvent(ctx, &apievents.StaticHostUserDelete{
 		Metadata: apievents.Metadata{
@@ -263,7 +263,7 @@ func (s *Service) DeleteStaticHostUser(ctx context.Context, req *userprovisionin
 		UserMetadata:       authCtx.GetUserMetadata(),
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Name,
+			Name: req.GetName(),
 		},
 		Status: eventStatus(err),
 	}); err != nil {
diff --git a/lib/auth/userprovisioning/userprovisioningv2/service_test.go b/lib/auth/userprovisioning/userprovisioningv2/service_test.go
index e50d7e2f1b0..77ee3fa65c9 100644
--- a/lib/auth/userprovisioning/userprovisioningv2/service_test.go
+++ b/lib/auth/userprovisioning/userprovisioningv2/service_test.go
@@ -49,19 +49,19 @@ func staticHostUserName(i int) string {
 
 func makeStaticHostUser(i int) *userprovisioningpb.StaticHostUser {
 	name := staticHostUserName(i)
-	return userprovisioning.NewStaticHostUser(name, &userprovisioningpb.StaticHostUserSpec{
+	return userprovisioning.NewStaticHostUser(name, userprovisioningpb.StaticHostUserSpec_builder{
 		Matchers: []*userprovisioningpb.Matcher{
-			{
+			userprovisioningpb.Matcher_builder{
 				NodeLabels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "foo",
 						Values: []string{"bar"},
-					},
+					}.Build(),
 				},
 				Groups: []string{"foo", "bar"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 }
 
 func authorizeWithVerbs(verbs []string, mfaVerified bool) authorizerFactory {
@@ -91,20 +91,20 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 	ctx := context.Background()
 	user, err := env.resourceService.CreateStaticHostUser(
 		ctx,
-		&userprovisioningpb.CreateStaticHostUserRequest{
+		userprovisioningpb.CreateStaticHostUserRequest_builder{
 			User: userprovisioning.NewStaticHostUser(
 				"test",
-				&userprovisioningpb.StaticHostUserSpec{
+				userprovisioningpb.StaticHostUserSpec_builder{
 					Matchers: []*userprovisioningpb.Matcher{
-						{
+						userprovisioningpb.Matcher_builder{
 							Gid:                  1,
 							Uid:                  2,
 							Groups:               []string{"bar", "baz"},
 							NodeLabelsExpression: `labels.dev == "test"`,
-						},
+						}.Build(),
 					},
-				},
-			)},
+				}.Build(),
+			)}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -134,7 +134,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 
 	user, err = env.resourceService.UpdateStaticHostUser(
 		ctx,
-		&userprovisioningpb.UpdateStaticHostUserRequest{User: user},
+		userprovisioningpb.UpdateStaticHostUserRequest_builder{User: user}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -162,7 +162,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 	}
 	user, err = env.resourceService.UpsertStaticHostUser(
 		ctx,
-		&userprovisioningpb.UpsertStaticHostUserRequest{User: user},
+		userprovisioningpb.UpsertStaticHostUserRequest_builder{User: user}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -190,7 +190,7 @@ func TestStaticHostUserAuditEvents(t *testing.T) {
 	}
 	_, err = env.resourceService.DeleteStaticHostUser(
 		ctx,
-		&userprovisioningpb.DeleteStaticHostUserRequest{Name: user.Metadata.Name},
+		userprovisioningpb.DeleteStaticHostUserRequest_builder{Name: user.GetMetadata().GetName()}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -237,9 +237,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "get",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.GetStaticHostUser(ctx, &userprovisioningpb.GetStaticHostUserRequest{
+				_, err := svc.GetStaticHostUser(ctx, userprovisioningpb.GetStaticHostUserRequest_builder{
 					Name: staticHostUserName(0),
-				})
+				}.Build())
 				return err
 			},
 			allowVerbs: []string{types.VerbRead},
@@ -247,9 +247,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "create",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.CreateStaticHostUser(ctx, &userprovisioningpb.CreateStaticHostUserRequest{
+				_, err := svc.CreateStaticHostUser(ctx, userprovisioningpb.CreateStaticHostUserRequest_builder{
 					User: makeStaticHostUser(10),
-				})
+				}.Build())
 				return err
 			},
 			allowVerbs: []string{types.VerbCreate},
@@ -262,10 +262,10 @@ func TestStaticHostUserCRUD(t *testing.T) {
 				if err != nil {
 					return trace.Wrap(err)
 				}
-				hostUser.Spec.Matchers[0].Groups = []string{"baz", "quux"}
-				_, err = svc.UpdateStaticHostUser(ctx, &userprovisioningpb.UpdateStaticHostUserRequest{
+				hostUser.GetSpec().GetMatchers()[0].SetGroups([]string{"baz", "quux"})
+				_, err = svc.UpdateStaticHostUser(ctx, userprovisioningpb.UpdateStaticHostUserRequest_builder{
 					User: hostUser,
-				})
+				}.Build())
 				return err
 			},
 			allowVerbs: []string{types.VerbRead, types.VerbUpdate},
@@ -273,9 +273,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "upsert",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.UpsertStaticHostUser(ctx, &userprovisioningpb.UpsertStaticHostUserRequest{
+				_, err := svc.UpsertStaticHostUser(ctx, userprovisioningpb.UpsertStaticHostUserRequest_builder{
 					User: makeStaticHostUser(10),
-				})
+				}.Build())
 				return err
 			},
 			allowVerbs: []string{types.VerbCreate, types.VerbUpdate},
@@ -283,9 +283,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "delete",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.DeleteStaticHostUser(ctx, &userprovisioningpb.DeleteStaticHostUserRequest{
+				_, err := svc.DeleteStaticHostUser(ctx, userprovisioningpb.DeleteStaticHostUserRequest_builder{
 					Name: staticHostUserName(0),
-				})
+				}.Build())
 				return err
 			},
 			allowVerbs: []string{types.VerbDelete},
@@ -330,9 +330,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "get nonexistent resource",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.GetStaticHostUser(ctx, &userprovisioningpb.GetStaticHostUserRequest{
+				_, err := svc.GetStaticHostUser(ctx, userprovisioningpb.GetStaticHostUserRequest_builder{
 					Name: "fake",
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbRead},
@@ -341,9 +341,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "create resource twice",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.CreateStaticHostUser(ctx, &userprovisioningpb.CreateStaticHostUserRequest{
+				_, err := svc.CreateStaticHostUser(ctx, userprovisioningpb.CreateStaticHostUserRequest_builder{
 					User: makeStaticHostUser(0),
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbCreate},
@@ -352,9 +352,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "delete nonexisting resource",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.DeleteStaticHostUser(ctx, &userprovisioningpb.DeleteStaticHostUserRequest{
+				_, err := svc.DeleteStaticHostUser(ctx, userprovisioningpb.DeleteStaticHostUserRequest_builder{
 					Name: staticHostUserName(10),
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbDelete},
@@ -363,9 +363,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "update with wrong revision",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.UpdateStaticHostUser(ctx, &userprovisioningpb.UpdateStaticHostUserRequest{
+				_, err := svc.UpdateStaticHostUser(ctx, userprovisioningpb.UpdateStaticHostUserRequest_builder{
 					User: makeStaticHostUser(0),
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbUpdate},
@@ -374,9 +374,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "update nonexistent resource",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.UpdateStaticHostUser(ctx, &userprovisioningpb.UpdateStaticHostUserRequest{
+				_, err := svc.UpdateStaticHostUser(ctx, userprovisioningpb.UpdateStaticHostUserRequest_builder{
 					User: makeStaticHostUser(10),
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbUpdate},
@@ -385,9 +385,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "upsert with update permission only",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.UpsertStaticHostUser(ctx, &userprovisioningpb.UpsertStaticHostUserRequest{
+				_, err := svc.UpsertStaticHostUser(ctx, userprovisioningpb.UpsertStaticHostUserRequest_builder{
 					User: makeStaticHostUser(0),
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbUpdate},
@@ -396,9 +396,9 @@ func TestStaticHostUserCRUD(t *testing.T) {
 		{
 			name: "upsert with create permission only",
 			request: func(ctx context.Context, svc *Service, _ *local.StaticHostUserService) error {
-				_, err := svc.UpsertStaticHostUser(ctx, &userprovisioningpb.UpsertStaticHostUserRequest{
+				_, err := svc.UpsertStaticHostUser(ctx, userprovisioningpb.UpsertStaticHostUserRequest_builder{
 					User: makeStaticHostUser(10),
-				})
+				}.Build())
 				return err
 			},
 			verbs:  []string{types.VerbCreate},
diff --git a/lib/auth/users/usersv1/okta_test.go b/lib/auth/users/usersv1/okta_test.go
index 366395188ce..ed93c0e4dd7 100644
--- a/lib/auth/users/usersv1/okta_test.go
+++ b/lib/auth/users/usersv1/okta_test.go
@@ -82,7 +82,7 @@ func TestOktaCRUD(t *testing.T) {
 	t.Run("Create", func(t *testing.T) {
 		t.Run("okta service creating okta users is allowed", func(t *testing.T) {
 			user := newOktaUser(t)
-			_, err := env.CreateUser(oktaCtx, &userspb.CreateUserRequest{User: user.(*types.UserV2)})
+			_, err := env.CreateUser(oktaCtx, userspb.CreateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 			require.NoError(t, err)
 		})
 
@@ -90,7 +90,7 @@ func TestOktaCRUD(t *testing.T) {
 			user, err := types.NewUser(uuid.NewString())
 			require.NoError(t, err)
 
-			_, err = env.CreateUser(oktaCtx, &userspb.CreateUserRequest{User: user.(*types.UserV2)})
+			_, err = env.CreateUser(oktaCtx, userspb.CreateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 			require.Error(t, err)
 			require.Truef(t, trace.IsBadParameter(err), "Expected bad parameter, got %T: %s", err, err.Error())
 		})
@@ -99,7 +99,7 @@ func TestOktaCRUD(t *testing.T) {
 			user := newOktaUser(t)
 
 			_, err = env.CreateUser(adminCtx,
-				&userspb.CreateUserRequest{User: user.(*types.UserV2)})
+				userspb.CreateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 			require.Error(t, err)
 			require.Truef(t, trace.IsBadParameter(err), "Expected bad parameter, got %T: %s", err, err.Error())
 		})
@@ -116,7 +116,7 @@ func TestOktaCRUD(t *testing.T) {
 			// update the backend...
 			user.SetTraits(map[string][]string{"foo": {"bar", "baz"}})
 			_, err = env.UpdateUser(oktaCtx,
-				&userspb.UpdateUserRequest{User: user.(*types.UserV2)})
+				userspb.UpdateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation succeeds
 			require.NoError(t, err)
@@ -133,7 +133,7 @@ func TestOktaCRUD(t *testing.T) {
 			// update the backend...
 			user.SetOrigin(types.OriginOkta)
 			_, err = env.UpdateUser(oktaCtx,
-				&userspb.UpdateUserRequest{User: user.(*types.UserV2)})
+				userspb.UpdateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation fails with "access denied"
 			require.Error(t, err)
@@ -151,7 +151,7 @@ func TestOktaCRUD(t *testing.T) {
 			// Origin label, and attempt to update the backend...
 			user.SetOrigin(types.OriginDynamic)
 			_, err = env.UpdateUser(oktaCtx,
-				&userspb.UpdateUserRequest{User: user.(*types.UserV2)})
+				userspb.UpdateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation fails with "bad parameter"
 			require.Error(t, err)
@@ -164,7 +164,7 @@ func TestOktaCRUD(t *testing.T) {
 
 			// When I (as the Okta service) try to update that user...
 			_, err = env.UpdateUser(oktaCtx,
-				&userspb.UpdateUserRequest{User: user.(*types.UserV2)})
+				userspb.UpdateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that an error is returned rather than having the whole
 			// system crash
@@ -182,7 +182,7 @@ func TestOktaCRUD(t *testing.T) {
 			// backend as the...
 			user.SetOrigin(types.OriginDynamic)
 			_, err = env.UpdateUser(adminCtx,
-				&userspb.UpdateUserRequest{User: user.(*types.UserV2)})
+				userspb.UpdateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation fails with "bad parameter"
 			require.Error(t, err)
@@ -199,7 +199,7 @@ func TestOktaCRUD(t *testing.T) {
 			// non-okta service - to update the backend record...
 			user.AddRole(teleport.PresetAccessRoleName)
 			_, err = env.UpdateUser(adminCtx,
-				&userspb.UpdateUserRequest{User: user.(*types.UserV2)})
+				userspb.UpdateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation fails with "bad parameter"
 			require.Error(t, err)
@@ -215,7 +215,7 @@ func TestOktaCRUD(t *testing.T) {
 			// When I (as the Okta service) try to Upsert that user...
 			_, err = env.UpsertUser(
 				oktaCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect the operation to succeed
 			require.NoError(t, err)
@@ -229,7 +229,7 @@ func TestOktaCRUD(t *testing.T) {
 			// When I (as the Okta service) try to Upsert that user...
 			_, err = env.UpsertUser(
 				oktaCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect the operation to fail with Bad Parameter
 			require.Error(t, err)
@@ -247,7 +247,7 @@ func TestOktaCRUD(t *testing.T) {
 			user.SetTraits(map[string][]string{"foo": {"bar", "baz"}})
 			_, err = env.UpsertUser(
 				oktaCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect the operation to succeed
 			require.NoError(t, err)
@@ -265,7 +265,7 @@ func TestOktaCRUD(t *testing.T) {
 			user.SetOrigin(types.OriginOkta)
 			_, err = env.UpsertUser(
 				oktaCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect the operation to fail with access denied
 			require.Error(t, err)
@@ -284,7 +284,7 @@ func TestOktaCRUD(t *testing.T) {
 			user.SetOrigin(types.OriginDynamic)
 			_, err = env.UpsertUser(
 				oktaCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect the operation to fail
 			require.Error(t, err)
@@ -297,7 +297,7 @@ func TestOktaCRUD(t *testing.T) {
 
 			_, err = env.UpsertUser(
 				oktaCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			require.Error(t, err)
 			require.Truef(t, trace.IsBadParameter(err), "Expected bad parameter, got %T: %s", err, err.Error())
@@ -314,7 +314,7 @@ func TestOktaCRUD(t *testing.T) {
 			// backend as the...
 			user.SetOrigin(types.OriginDynamic)
 			_, err = env.UpsertUser(adminCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation fails with "bad parameter"
 			require.Error(t, err)
@@ -334,7 +334,7 @@ func TestOktaCRUD(t *testing.T) {
 			}
 			user.SetTraits(traits)
 			_, err = env.UpsertUser(adminCtx,
-				&userspb.UpsertUserRequest{User: user.(*types.UserV2)})
+				userspb.UpsertUserRequest_builder{User: user.(*types.UserV2)}.Build())
 
 			// Expect that the operation fails with "bad parameter"
 			require.Error(t, err)
@@ -352,7 +352,7 @@ func TestOktaCRUD(t *testing.T) {
 			// When I (as the Okta service) try to delete the user...
 			_, err = env.DeleteUser(
 				oktaCtx,
-				&userspb.DeleteUserRequest{Name: user.GetName()})
+				userspb.DeleteUserRequest_builder{Name: user.GetName()}.Build())
 
 			// Expect the operation to succeed
 			require.NoError(t, err)
@@ -360,10 +360,10 @@ func TestOktaCRUD(t *testing.T) {
 			// Expect that the user has been removed from the cache/backend
 			_, err = env.Service.GetUser(
 				oktaCtx,
-				&userspb.GetUserRequest{
+				userspb.GetUserRequest_builder{
 					Name:        user.GetName(),
 					WithSecrets: false,
-				})
+				}.Build())
 			require.Error(t, err)
 			require.True(t, trace.IsNotFound(err), "Expected not found, got %s", err.Error())
 		})
@@ -378,7 +378,7 @@ func TestOktaCRUD(t *testing.T) {
 			// When I (as the Okta service) try to delete the user...
 			_, err = env.DeleteUser(
 				oktaCtx,
-				&userspb.DeleteUserRequest{Name: user.GetName()})
+				userspb.DeleteUserRequest_builder{Name: user.GetName()}.Build())
 
 			// Expect the operation to fail with "access denied"
 			require.Error(t, err)
@@ -388,10 +388,10 @@ func TestOktaCRUD(t *testing.T) {
 			// Expect that the user still exists in the cache/backend
 			_, err = env.Service.GetUser(
 				oktaCtx,
-				&userspb.GetUserRequest{
+				userspb.GetUserRequest_builder{
 					Name:        user.GetName(),
 					WithSecrets: false,
-				})
+				}.Build())
 			require.NoError(t, err)
 		})
 
@@ -404,7 +404,7 @@ func TestOktaCRUD(t *testing.T) {
 			// When I (as the Okta service) try to delete the user...
 			_, err = env.DeleteUser(
 				adminCtx,
-				&userspb.DeleteUserRequest{Name: user.GetName()})
+				userspb.DeleteUserRequest_builder{Name: user.GetName()}.Build())
 
 			// Expect the operation to succeed
 			require.NoError(t, err)
@@ -412,10 +412,10 @@ func TestOktaCRUD(t *testing.T) {
 			// Expect that the user has been removed from the cache/backend
 			_, err = env.Service.GetUser(
 				oktaCtx,
-				&userspb.GetUserRequest{
+				userspb.GetUserRequest_builder{
 					Name:        user.GetName(),
 					WithSecrets: false,
-				})
+				}.Build())
 			require.Error(t, err)
 			require.True(t, trace.IsNotFound(err), "Expected not found, got %s", err.Error())
 		})
diff --git a/lib/auth/users/usersv1/service.go b/lib/auth/users/usersv1/service.go
index 0cba041b425..dec1be2c155 100644
--- a/lib/auth/users/usersv1/service.go
+++ b/lib/auth/users/usersv1/service.go
@@ -162,16 +162,16 @@ func (s *Service) GetUser(ctx context.Context, req *userspb.GetUserRequest) (*us
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Name == "" && req.CurrentUser {
+	if req.GetName() == "" && req.GetCurrentUser() {
 		user, err := s.getCurrentUser(ctx, authCtx)
-		return &userspb.GetUserResponse{User: user}, trace.Wrap(err)
+		return userspb.GetUserResponse_builder{User: user}.Build(), trace.Wrap(err)
 	}
 
-	if req.WithSecrets {
+	if req.GetWithSecrets() {
 		// TODO(fspmarshall): replace admin requirement with VerbReadWithSecrets once we've
 		// migrated to that model.
 		if !authz.HasBuiltinRole(*authCtx, string(types.RoleAdmin)) {
-			err := trace.AccessDenied("user %q requested access to user %q with secrets", authCtx.User.GetName(), req.Name)
+			err := trace.AccessDenied("user %q requested access to user %q with secrets", authCtx.User.GetName(), req.GetName())
 			s.logger.WarnContext(ctx, "user does not have permission to read user with secrets", "error", err)
 			if err := s.emitter.EmitAuditEvent(ctx, &apievents.UserLogin{
 				Metadata: apievents.Metadata{
@@ -192,7 +192,7 @@ func (s *Service) GetUser(ctx context.Context, req *userspb.GetUserRequest) (*us
 	} else {
 		// if secrets are not being accessed, let users always read
 		// their own info.
-		if err := currentUserAction(*authCtx, req.Name); err != nil {
+		if err := currentUserAction(*authCtx, req.GetName()); err != nil {
 			// not current user, perform normal permission check.
 			if err := authCtx.CheckAccessToKind(types.KindUser, types.VerbRead); err != nil {
 				return nil, trace.Wrap(err)
@@ -200,7 +200,7 @@ func (s *Service) GetUser(ctx context.Context, req *userspb.GetUserRequest) (*us
 		}
 	}
 
-	user, err := s.cache.GetUser(ctx, req.Name, req.WithSecrets)
+	user, err := s.cache.GetUser(ctx, req.GetName(), req.GetWithSecrets())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -215,7 +215,7 @@ func (s *Service) GetUser(ctx context.Context, req *userspb.GetUserRequest) (*us
 		return nil, trace.BadParameter("encountered unexpected user type")
 	}
 
-	return &userspb.GetUserResponse{User: v2}, nil
+	return userspb.GetUserResponse_builder{User: v2}.Build(), nil
 }
 
 func (s *Service) CreateUser(ctx context.Context, req *userspb.CreateUserRequest) (*userspb.CreateUserResponse, error) {
@@ -224,7 +224,7 @@ func (s *Service) CreateUser(ctx context.Context, req *userspb.CreateUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	if len(req.User.GetName()) > teleport.MaxUsernameLength {
+	if len(req.GetUser().GetName()) > teleport.MaxUsernameLength {
 		return nil, trace.BadParameter("username exceeds maximum length of %d characters", teleport.MaxUsernameLength)
 	}
 
@@ -237,26 +237,26 @@ func (s *Service) CreateUser(ctx context.Context, req *userspb.CreateUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	if err = okta.CheckOrigin(authCtx, req.User); err != nil {
+	if err = okta.CheckOrigin(authCtx, req.GetUser()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := services.ValidateUser(req.User); err != nil {
+	if err := services.ValidateUser(req.GetUser()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := services.ValidateUserRoles(ctx, req.User, s.cache); err != nil {
+	if err := services.ValidateUserRoles(ctx, req.GetUser(), s.cache); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if req.User.GetCreatedBy().IsEmpty() {
-		req.User.SetCreatedBy(types.CreatedBy{
+	if req.GetUser().GetCreatedBy().IsEmpty() {
+		req.GetUser().SetCreatedBy(types.CreatedBy{
 			User: types.UserRef{Name: authCtx.User.GetName()},
 			Time: s.clock.Now().UTC(),
 		})
 	}
 
-	created, err := s.backend.CreateUser(ctx, req.User)
+	created, err := s.backend.CreateUser(ctx, req.GetUser())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -295,7 +295,7 @@ func (s *Service) CreateUser(ctx context.Context, req *userspb.CreateUserRequest
 		return nil, trace.BadParameter("encountered unexpected user type")
 	}
 
-	return &userspb.CreateUserResponse{User: v2}, nil
+	return userspb.CreateUserResponse_builder{User: v2}.Build(), nil
 }
 
 func (s *Service) UpdateUser(ctx context.Context, req *userspb.UpdateUserRequest) (*userspb.UpdateUserResponse, error) {
@@ -313,22 +313,22 @@ func (s *Service) UpdateUser(ctx context.Context, req *userspb.UpdateUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	if err = okta.CheckOrigin(authCtx, req.User); err != nil {
+	if err = okta.CheckOrigin(authCtx, req.GetUser()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	// ValidateUser is called a bit later by LegacyUpdateUser. However, it's clearer
 	// to do it here like the other verbs, plus it won't break again when we'll
 	// get rid of the legacy update function.
-	if err := services.ValidateUser(req.User); err != nil {
+	if err := services.ValidateUser(req.GetUser()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := services.ValidateUserRoles(ctx, req.User, s.cache); err != nil {
+	if err := services.ValidateUserRoles(ctx, req.GetUser(), s.cache); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	prevUser, err := s.cache.GetUser(ctx, req.User.GetName(), false)
+	prevUser, err := s.cache.GetUser(ctx, req.GetUser().GetName(), false)
 	var omitEditorEvent bool
 	if err != nil {
 		// don't return error here since this call is for event emitting purposes only
@@ -338,14 +338,14 @@ func (s *Service) UpdateUser(ctx context.Context, req *userspb.UpdateUserRequest
 
 	if prevUser != nil {
 		// Preserve the users' created by information.
-		req.User.SetCreatedBy(prevUser.GetCreatedBy())
+		req.GetUser().SetCreatedBy(prevUser.GetCreatedBy())
 	}
 
 	if err = okta.CheckAccess(authCtx, prevUser, types.VerbUpdate); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	updated, err := s.backend.UpdateUser(ctx, req.User)
+	updated, err := s.backend.UpdateUser(ctx, req.GetUser())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -386,7 +386,7 @@ func (s *Service) UpdateUser(ctx context.Context, req *userspb.UpdateUserRequest
 		return nil, trace.BadParameter("encountered unexpected user type")
 	}
 
-	return &userspb.UpdateUserResponse{User: v2}, nil
+	return userspb.UpdateUserResponse_builder{User: v2}.Build(), nil
 }
 
 func (s *Service) UpsertUser(ctx context.Context, req *userspb.UpsertUserRequest) (*userspb.UpsertUserResponse, error) {
@@ -404,21 +404,21 @@ func (s *Service) UpsertUser(ctx context.Context, req *userspb.UpsertUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	if err := services.ValidateUser(req.User); err != nil {
+	if err := services.ValidateUser(req.GetUser()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if err := services.ValidateUserRoles(ctx, req.User, s.cache); err != nil {
+	if err := services.ValidateUserRoles(ctx, req.GetUser(), s.cache); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	if createdBy := req.User.GetCreatedBy(); createdBy.IsEmpty() {
-		req.User.SetCreatedBy(types.CreatedBy{
+	if createdBy := req.GetUser().GetCreatedBy(); createdBy.IsEmpty() {
+		req.GetUser().SetCreatedBy(types.CreatedBy{
 			User: types.UserRef{Name: authCtx.User.GetName()},
 		})
 	}
 
-	prevUser, err := s.cache.GetUser(ctx, req.User.GetName(), false)
+	prevUser, err := s.cache.GetUser(ctx, req.GetUser().GetName(), false)
 	var omitEditorEvent bool
 	if err != nil {
 		// don't return error here since this call is for event emitting purposes only
@@ -431,7 +431,7 @@ func (s *Service) UpsertUser(ctx context.Context, req *userspb.UpsertUserRequest
 		verb = types.VerbCreate
 	}
 
-	if err = okta.CheckOrigin(authCtx, req.User); err != nil {
+	if err = okta.CheckOrigin(authCtx, req.GetUser()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -439,7 +439,7 @@ func (s *Service) UpsertUser(ctx context.Context, req *userspb.UpsertUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	upserted, err := s.backend.UpsertUser(ctx, req.User)
+	upserted, err := s.backend.UpsertUser(ctx, req.GetUser())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -480,7 +480,7 @@ func (s *Service) UpsertUser(ctx context.Context, req *userspb.UpsertUserRequest
 		return nil, trace.BadParameter("encountered unexpected user type")
 	}
 
-	return &userspb.UpsertUserResponse{User: v2}, nil
+	return userspb.UpsertUserResponse_builder{User: v2}.Build(), nil
 }
 
 func (s *Service) DeleteUser(ctx context.Context, req *userspb.DeleteUserRequest) (*emptypb.Empty, error) {
@@ -497,7 +497,7 @@ func (s *Service) DeleteUser(ctx context.Context, req *userspb.DeleteUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	prevUser, err := s.cache.GetUser(ctx, req.Name, false)
+	prevUser, err := s.cache.GetUser(ctx, req.GetName(), false)
 	var omitEditorEvent bool
 	if err != nil && !trace.IsNotFound(err) {
 		// don't return error here, delete may still succeed
@@ -510,7 +510,7 @@ func (s *Service) DeleteUser(ctx context.Context, req *userspb.DeleteUserRequest
 		return nil, trace.Wrap(err)
 	}
 
-	role, err := s.cache.GetRole(ctx, services.RoleNameForUser(req.Name))
+	role, err := s.cache.GetRole(ctx, services.RoleNameForUser(req.GetName()))
 	if err != nil {
 		if !trace.IsNotFound(err) {
 			return &emptypb.Empty{}, trace.Wrap(err)
@@ -523,7 +523,7 @@ func (s *Service) DeleteUser(ctx context.Context, req *userspb.DeleteUserRequest
 		}
 	}
 
-	if err := s.backend.DeleteUser(ctx, req.Name); err != nil {
+	if err := s.backend.DeleteUser(ctx, req.GetName()); err != nil {
 		return &emptypb.Empty{}, trace.Wrap(err)
 	}
 
@@ -535,7 +535,7 @@ func (s *Service) DeleteUser(ctx context.Context, req *userspb.DeleteUserRequest
 		},
 		UserMetadata: authz.ClientUserMetadata(ctx),
 		ResourceMetadata: apievents.ResourceMetadata{
-			Name: req.Name,
+			Name: req.GetName(),
 		},
 		ConnectionMetadata: authz.ConnectionMetadata(ctx),
 	}); err != nil {
@@ -543,7 +543,7 @@ func (s *Service) DeleteUser(ctx context.Context, req *userspb.DeleteUserRequest
 	}
 
 	if !omitEditorEvent {
-		usagereporter.EmitEditorChangeEvent(req.Name, prevUser.GetRoles(), nil, s.reporter.AnonymizeAndSubmit)
+		usagereporter.EmitEditorChangeEvent(req.GetName(), prevUser.GetRoles(), nil, s.reporter.AnonymizeAndSubmit)
 	}
 
 	return &emptypb.Empty{}, nil
@@ -555,7 +555,7 @@ func (s *Service) ListUsers(ctx context.Context, req *userspb.ListUsersRequest)
 		return nil, trace.Wrap(err)
 	}
 
-	if req.WithSecrets {
+	if req.GetWithSecrets() {
 		// TODO(fspmarshall): replace admin requirement with VerbReadWithSecrets once we've
 		// migrated to that model.
 		if !authz.HasBuiltinRole(*authCtx, string(types.RoleAdmin)) {
diff --git a/lib/auth/users/usersv1/service_test.go b/lib/auth/users/usersv1/service_test.go
index 5d7933d35c9..fa132905847 100644
--- a/lib/auth/users/usersv1/service_test.go
+++ b/lib/auth/users/usersv1/service_test.go
@@ -213,16 +213,16 @@ func TestCreateUser(t *testing.T) {
 	require.NoError(t, err, "creating new user llama")
 
 	// Create a new user.
-	created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	require.NoError(t, err, "creating user llama")
 
 	// Validate that the user now exists.
-	resp, err := env.GetUser(ctx, &userspb.GetUserRequest{Name: created.User.GetName()})
+	resp, err := env.GetUser(ctx, userspb.GetUserRequest_builder{Name: created.GetUser().GetName()}.Build())
 	require.NoError(t, err, "failed getting created user")
-	require.Empty(t, cmp.Diff(created.User, resp.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.Empty(t, cmp.Diff(created.GetUser(), resp.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 
 	// Attempt to create a duplicate user
-	created2, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created2, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	assert.Error(t, err, "duplicate user was created successfully")
 	assert.Nil(t, created2, "received unexpected user ")
 	require.True(t, trace.IsAlreadyExists(err), "creating duplicate user allowed")
@@ -237,7 +237,7 @@ func TestCreateUser(t *testing.T) {
 	user, err := types.NewUser("alpaca")
 	require.NoError(t, err, "creating user alpaca")
 	user.SetRoles([]string{uuid.NewString()})
-	_, err = env.CreateUser(ctx, &userspb.CreateUserRequest{User: user.(*types.UserV2)})
+	_, err = env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 	assert.True(t, trace.IsNotFound(err), "expected a not found error, got %T", err)
 	require.Error(t, err, "user allowed to be created with a role that does not exist")
 	createEvent, ok = event.(*apievents.UserCreate)
@@ -253,7 +253,7 @@ func TestCreateUserMaxLength(t *testing.T) {
 	user, err := types.NewUser(strings.Repeat("A", 1001))
 	require.NoError(t, err)
 	user.AddRole("access")
-	_, err = env.CreateUser(t.Context(), &userspb.CreateUserRequest{User: user.(*types.UserV2)})
+	_, err = env.CreateUser(t.Context(), userspb.CreateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 	require.Error(t, err, "creating a user with a username too long should fail")
 }
 
@@ -268,7 +268,7 @@ func TestDeleteUser(t *testing.T) {
 	require.NoError(t, err, "creating new user llama")
 
 	// Create the user which will be deleted.
-	created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	require.NoError(t, err, "creating user llama")
 
 	event := <-env.emitter.C()
@@ -276,7 +276,7 @@ func TestDeleteUser(t *testing.T) {
 	assert.Equal(t, events.UserCreateCode, event.GetCode(), "unexpected event code")
 
 	// Delete the user.
-	_, err = env.DeleteUser(ctx, &userspb.DeleteUserRequest{Name: created.User.GetName()})
+	_, err = env.DeleteUser(ctx, userspb.DeleteUserRequest_builder{Name: created.GetUser().GetName()}.Build())
 	require.NoError(t, err)
 
 	event = <-env.emitter.C()
@@ -285,7 +285,7 @@ func TestDeleteUser(t *testing.T) {
 
 	// Attempt to delete the user again, this time deletion should fail because
 	// the user no longer exists.
-	_, err = env.DeleteUser(ctx, &userspb.DeleteUserRequest{Name: created.User.GetName()})
+	_, err = env.DeleteUser(ctx, userspb.DeleteUserRequest_builder{Name: created.GetUser().GetName()}.Build())
 	assert.Error(t, err, "deleting nonexistent user succeeded")
 	require.True(t, trace.IsNotFound(err), "expected a not found error deleting nonexistent user got %T", err)
 }
@@ -310,21 +310,21 @@ func TestGetUser(t *testing.T) {
 	require.NoError(t, generateUserSecrets(llama), "generating user secrets")
 
 	// Validate that the user does not exist.
-	resp, err := env.GetUser(ctx, &userspb.GetUserRequest{Name: llama.GetName()})
+	resp, err := env.GetUser(ctx, userspb.GetUserRequest_builder{Name: llama.GetName()}.Build())
 	assert.Error(t, err, "expected retrieving nonexistent user to fail")
 	assert.Nil(t, resp, "non-nil response returned from error")
 	assert.True(t, trace.IsNotFound(err), "expected not found error got %T", err)
 
 	// Create a new user.
-	created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	require.NoError(t, err, "creating user llama")
 
 	// Validate that the user now exists and that querying by name takes precedence over
 	// retrieving the current user.
-	resp, err = env.GetUser(ctx, &userspb.GetUserRequest{Name: created.User.GetName(), CurrentUser: true})
+	resp, err = env.GetUser(ctx, userspb.GetUserRequest_builder{Name: created.GetUser().GetName(), CurrentUser: true}.Build())
 	assert.NoError(t, err, "failed getting created user")
-	assert.Empty(t, cmp.Diff(created.User, resp.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision"), cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")))
-	assert.Nil(t, resp.User.GetLocalAuth(), "user secrets were provided when not requested")
+	assert.Empty(t, cmp.Diff(created.GetUser(), resp.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision"), cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")))
+	assert.Nil(t, resp.GetUser().GetLocalAuth(), "user secrets were provided when not requested")
 
 	// Validate that getting the current user returns "alice" and not "llama".
 	resp, err = env.GetUser(authz.ContextWithUser(ctx, &authz.LocalUser{
@@ -332,18 +332,18 @@ func TestGetUser(t *testing.T) {
 		Identity: tlsca.Identity{
 			Groups: []string{"dev"},
 		},
-	}), &userspb.GetUserRequest{CurrentUser: true})
+	}), userspb.GetUserRequest_builder{CurrentUser: true}.Build())
 	assert.NoError(t, err, "failed getting created user")
-	assert.NotEmpty(t, cmp.Diff(created.User, resp.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	assert.Equal(t, "alice", resp.User.GetName(), "expected current user to return alice")
-	assert.Nil(t, resp.User.GetLocalAuth(), "secrets returned with current user")
+	assert.NotEmpty(t, cmp.Diff(created.GetUser(), resp.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	assert.Equal(t, "alice", resp.GetUser().GetName(), "expected current user to return alice")
+	assert.Nil(t, resp.GetUser().GetLocalAuth(), "secrets returned with current user")
 
 	// Validate that requesting a users secrets returns them.
-	resp, err = env.GetUser(ctx, &userspb.GetUserRequest{Name: created.User.GetName(), WithSecrets: true})
+	resp, err = env.GetUser(ctx, userspb.GetUserRequest_builder{Name: created.GetUser().GetName(), WithSecrets: true}.Build())
 	assert.NoError(t, err, "failed getting created user")
-	assert.Empty(t, cmp.Diff(created.User, resp.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	assert.NotNil(t, resp.User.GetLocalAuth(), "user secrets were not provided requested")
-	assert.Empty(t, cmp.Diff(llama.GetLocalAuth(), resp.User.GetLocalAuth()), "user secrets do not match")
+	assert.Empty(t, cmp.Diff(created.GetUser(), resp.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	assert.NotNil(t, resp.GetUser().GetLocalAuth(), "user secrets were not provided requested")
+	assert.Empty(t, cmp.Diff(llama.GetLocalAuth(), resp.GetUser().GetLocalAuth()), "user secrets do not match")
 
 	// Validate that getting the current user never returns secrets
 	resp, err = env.GetUser(authz.ContextWithUser(ctx, &authz.LocalUser{
@@ -351,11 +351,11 @@ func TestGetUser(t *testing.T) {
 		Identity: tlsca.Identity{
 			Groups: []string{"dev"},
 		},
-	}), &userspb.GetUserRequest{CurrentUser: true, WithSecrets: true})
+	}), userspb.GetUserRequest_builder{CurrentUser: true, WithSecrets: true}.Build())
 	assert.NoError(t, err, "failed getting created user")
-	assert.NotEmpty(t, cmp.Diff(created.User, resp.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	assert.Equal(t, "alice", resp.User.GetName(), "expected current user to return alice")
-	assert.Nil(t, resp.User.GetLocalAuth(), "secrets returned with current user")
+	assert.NotEmpty(t, cmp.Diff(created.GetUser(), resp.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	assert.Equal(t, "alice", resp.GetUser().GetName(), "expected current user to return alice")
+	assert.Nil(t, resp.GetUser().GetLocalAuth(), "secrets returned with current user")
 }
 
 func TestUpdateUser(t *testing.T) {
@@ -369,13 +369,13 @@ func TestUpdateUser(t *testing.T) {
 	require.NoError(t, err, "creating new user llama")
 
 	// Attempt to update a nonexistent user.
-	updated, err := env.UpdateUser(ctx, &userspb.UpdateUserRequest{User: llama.(*types.UserV2)})
+	updated, err := env.UpdateUser(ctx, userspb.UpdateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	assert.Error(t, err, "duplicate user was created successfully")
 	assert.Nil(t, updated, "received unexpected user")
 	require.True(t, trace.IsCompareFailed(err), "updated nonexistent user")
 
 	// Create a new user.
-	created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	require.NoError(t, err, "creating user llama")
 
 	event := <-env.emitter.C()
@@ -386,11 +386,11 @@ func TestUpdateUser(t *testing.T) {
 	assert.Equal(t, "alice", createEvent.UserMetadata.User)
 
 	// Attempt to update the user again.
-	created.User.SetLogins([]string{"alpaca"})
-	updated, err = env.UpdateUser(ctx, &userspb.UpdateUserRequest{User: created.User})
+	created.GetUser().SetLogins([]string{"alpaca"})
+	updated, err = env.UpdateUser(ctx, userspb.UpdateUserRequest_builder{User: created.GetUser()}.Build())
 	require.NoError(t, err, "failed updating user")
-	require.Empty(t, cmp.Diff(created.User, updated.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.Equal(t, []string{"alpaca"}, updated.User.GetLogins(), "logins were not updated")
+	require.Empty(t, cmp.Diff(created.GetUser(), updated.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.Equal(t, []string{"alpaca"}, updated.GetUser().GetLogins(), "logins were not updated")
 
 	event = <-env.emitter.C()
 	assert.Equal(t, events.UserUpdatedEvent, event.GetType(), "unexpected event type")
@@ -400,8 +400,8 @@ func TestUpdateUser(t *testing.T) {
 	assert.Equal(t, "alice", createEvent.UserMetadata.User)
 
 	// Attempt to update an existing user and set invalid roles
-	updated.User.AddRole("does-not-exist")
-	_, err = env.UpdateUser(ctx, &userspb.UpdateUserRequest{User: updated.User})
+	updated.GetUser().AddRole("does-not-exist")
+	_, err = env.UpdateUser(ctx, userspb.UpdateUserRequest_builder{User: updated.GetUser()}.Build())
 	assert.True(t, trace.IsNotFound(err), "expected a not found error, got %T", err)
 	require.Error(t, err, "user allowed to be updated with a role that does not exist")
 }
@@ -417,11 +417,11 @@ func TestUpsertUser(t *testing.T) {
 	require.NoError(t, err, "creating new user llama")
 
 	// Create a user via upsert.
-	upserted, err := env.UpsertUser(ctx, &userspb.UpsertUserRequest{User: llama.(*types.UserV2)})
+	upserted, err := env.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	require.NoError(t, err, "failed upserting user")
 
 	// Validate that the user was created.
-	created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	assert.Error(t, err, "duplicate user was created successfully")
 	assert.Nil(t, created, "received unexpected user ")
 	require.True(t, trace.IsAlreadyExists(err), "creating duplicate user allowed")
@@ -434,11 +434,11 @@ func TestUpsertUser(t *testing.T) {
 	assert.Equal(t, "alice", createEvent.UserMetadata.User)
 
 	// Attempt to update the user again.
-	upserted.User.SetLogins([]string{"alpaca"})
-	updated, err := env.UpsertUser(ctx, &userspb.UpsertUserRequest{User: upserted.User})
+	upserted.GetUser().SetLogins([]string{"alpaca"})
+	updated, err := env.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: upserted.GetUser()}.Build())
 	require.NoError(t, err, "failed upserting user")
-	require.Empty(t, cmp.Diff(upserted.User, updated.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	require.Equal(t, []string{"alpaca"}, updated.User.GetLogins(), "logins were not updated")
+	require.Empty(t, cmp.Diff(upserted.GetUser(), updated.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	require.Equal(t, []string{"alpaca"}, updated.GetUser().GetLogins(), "logins were not updated")
 
 	event = <-env.emitter.C()
 	assert.Equal(t, events.UserCreateEvent, event.GetType(), "unexpected event type")
@@ -448,8 +448,8 @@ func TestUpsertUser(t *testing.T) {
 	assert.Equal(t, "alice", createEvent.UserMetadata.User)
 
 	// Attempt to upsert a  user and set invalid roles
-	updated.User.AddRole("does-not-exist")
-	_, err = env.UpsertUser(ctx, &userspb.UpsertUserRequest{User: updated.User})
+	updated.GetUser().AddRole("does-not-exist")
+	_, err = env.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: updated.GetUser()}.Build())
 	assert.True(t, trace.IsNotFound(err), "expected a not found error, got %T", err)
 	require.Error(t, err, "user allowed to be upserted with a role that does not exist")
 }
@@ -488,57 +488,57 @@ func TestListUsers(t *testing.T) {
 	llama.SetTraits(map[string][]string{"logins": {"test-login"}})
 
 	// Validate that the user does not exist.
-	resp, err := env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 10})
+	resp, err := env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 10}.Build())
 	assert.NoError(t, err, "expected list to return empty response when no users exist")
-	assert.Empty(t, resp.Users, "expected no users to be returned got %d", len(resp.Users))
-	assert.Empty(t, resp.NextPageToken, "expected next page token to be empty")
+	assert.Empty(t, resp.GetUsers(), "expected no users to be returned got %d", len(resp.GetUsers()))
+	assert.Empty(t, resp.GetNextPageToken(), "expected next page token to be empty")
 
 	// Create a new user.
-	created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+	created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 	require.NoError(t, err, "creating user llama")
 
 	// Validate that the user now exists.
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 10})
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 10}.Build())
 	assert.NoError(t, err, "failed listing created user")
-	assert.Len(t, resp.Users, 1, "expected one user to be returned got %d", len(resp.Users))
-	assert.Empty(t, resp.NextPageToken, "expected next page token to be empty")
-	assert.Empty(t, cmp.Diff(created.User, resp.Users[0], cmpopts.IgnoreFields(types.Metadata{}, "Revision"), cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")))
-	assert.Nil(t, resp.Users[0].GetLocalAuth(), "user secrets were provided when not requested")
+	assert.Len(t, resp.GetUsers(), 1, "expected one user to be returned got %d", len(resp.GetUsers()))
+	assert.Empty(t, resp.GetNextPageToken(), "expected next page token to be empty")
+	assert.Empty(t, cmp.Diff(created.GetUser(), resp.GetUsers()[0], cmpopts.IgnoreFields(types.Metadata{}, "Revision"), cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")))
+	assert.Nil(t, resp.GetUsers()[0].GetLocalAuth(), "user secrets were provided when not requested")
 
 	// Validate that requesting a users secrets returns them.
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 10, WithSecrets: true})
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 10, WithSecrets: true}.Build())
 	assert.NoError(t, err, "failed listing created user")
-	assert.Len(t, resp.Users, 1, "expected one user to be returned got %d", len(resp.Users))
-	assert.Empty(t, resp.NextPageToken, "expected next page token to be empty")
-	assert.Empty(t, cmp.Diff(created.User, resp.Users[0], cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
-	assert.Empty(t, cmp.Diff(llama.GetLocalAuth(), resp.Users[0].GetLocalAuth()), "user secrets do not match")
+	assert.Len(t, resp.GetUsers(), 1, "expected one user to be returned got %d", len(resp.GetUsers()))
+	assert.Empty(t, resp.GetNextPageToken(), "expected next page token to be empty")
+	assert.Empty(t, cmp.Diff(created.GetUser(), resp.GetUsers()[0], cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+	assert.Empty(t, cmp.Diff(llama.GetLocalAuth(), resp.GetUsers()[0].GetLocalAuth()), "user secrets do not match")
 
 	// Validate that searching by role returns matching users.
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{
 		PageSize: 10,
 		Filter:   &types.UserFilter{SearchKeywords: []string{"test-role"}},
-	})
+	}.Build())
 	require.NoError(t, err, "listing users with role filter")
-	require.Len(t, resp.Users, 1, "expected one user with test-role")
-	assert.Equal(t, "llama", resp.Users[0].GetName(), "expected llama to match role search")
+	require.Len(t, resp.GetUsers(), 1, "expected one user with test-role")
+	assert.Equal(t, "llama", resp.GetUsers()[0].GetName(), "expected llama to match role search")
 
 	// Validate that searching by trait returns matching users (SearchKeywords).
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{
 		PageSize: 10,
 		Filter:   &types.UserFilter{SearchKeywords: []string{"test-login"}},
-	})
+	}.Build())
 	require.NoError(t, err, "listing users with trait filter (SearchKeywords)")
-	require.Len(t, resp.Users, 1, "expected one user with trait logins: test-login")
-	assert.Equal(t, "llama", resp.Users[0].GetName(), "expected llama to match trait search")
+	require.Len(t, resp.GetUsers(), 1, "expected one user with trait logins: test-login")
+	assert.Equal(t, "llama", resp.GetUsers()[0].GetName(), "expected llama to match trait search")
 
 	// Validate that searching by trait returns matching users (Traits).
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{
 		PageSize: 10,
 		Filter:   &types.UserFilter{Traits: map[string][]string{"logins": {"test-login"}}},
-	})
+	}.Build())
 	require.NoError(t, err, "listing users with trait filter (Traits)")
-	require.Len(t, resp.Users, 1, "expected one user with trait logins: test-login")
-	assert.Equal(t, "llama", resp.Users[0].GetName(), "expected llama to match trait search")
+	require.Len(t, resp.GetUsers(), 1, "expected one user with trait logins: test-login")
+	assert.Equal(t, "llama", resp.GetUsers()[0].GetName(), "expected llama to match trait search")
 
 	// Create addition users to test pagination
 	createdUsers := []*types.UserV2{llama.(*types.UserV2)}
@@ -548,22 +548,22 @@ func TestListUsers(t *testing.T) {
 		require.NoError(t, generateUserSecrets(user), "generating user secrets")
 
 		// Create a new user.
-		created, err := env.CreateUser(ctx, &userspb.CreateUserRequest{User: user.(*types.UserV2)})
+		created, err := env.CreateUser(ctx, userspb.CreateUserRequest_builder{User: user.(*types.UserV2)}.Build())
 		require.NoError(t, err, "creating user %d", i)
 
-		createdUsers = append(createdUsers, created.User)
+		createdUsers = append(createdUsers, created.GetUser())
 	}
 
 	// List all users across multiple pages without secrets.
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 3})
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 3}.Build())
 	require.NoError(t, err, "unexpected error listing users")
 
-	listedUsers := resp.Users
-	for next := resp.NextPageToken; next != ""; {
-		resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 3, PageToken: next})
+	listedUsers := resp.GetUsers()
+	for next := resp.GetNextPageToken(); next != ""; {
+		resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 3, PageToken: next}.Build())
 		require.NoError(t, err, "unexpected error listing users")
-		listedUsers = append(listedUsers, resp.Users...)
-		next = resp.NextPageToken
+		listedUsers = append(listedUsers, resp.GetUsers()...)
+		next = resp.GetNextPageToken()
 	}
 
 	assert.Len(t, createdUsers, len(listedUsers), "expected to eventually retrieve all users from listing")
@@ -573,15 +573,15 @@ func TestListUsers(t *testing.T) {
 	))
 
 	// List all users across multiple pages with secrets.
-	resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 3, WithSecrets: true})
+	resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 3, WithSecrets: true}.Build())
 	require.NoError(t, err, "unexpected error listing users")
 
-	listedUsersWithSecrets := resp.Users
-	for next := resp.NextPageToken; next != ""; {
-		resp, err = env.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 3, PageToken: next, WithSecrets: true})
+	listedUsersWithSecrets := resp.GetUsers()
+	for next := resp.GetNextPageToken(); next != ""; {
+		resp, err = env.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 3, PageToken: next, WithSecrets: true}.Build())
 		require.NoError(t, err, "unexpected error listing users")
-		listedUsersWithSecrets = append(listedUsersWithSecrets, resp.Users...)
-		next = resp.NextPageToken
+		listedUsersWithSecrets = append(listedUsersWithSecrets, resp.GetUsers()...)
+		next = resp.GetNextPageToken()
 	}
 
 	assert.Len(t, createdUsers, len(listedUsersWithSecrets), "expected to eventually retrieve all users from listing")
@@ -625,7 +625,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.GetUser(ctx, &userspb.GetUserRequest{Name: "alice"})
+				_, err := service.GetUser(ctx, userspb.GetUserRequest_builder{Name: "alice"}.Build())
 				assert.Error(t, err, "expected RBAC to prevent getting user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -644,9 +644,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get current users when no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				user, err := service.GetUser(ctx, &userspb.GetUserRequest{CurrentUser: true})
+				user, err := service.GetUser(ctx, userspb.GetUserRequest_builder{CurrentUser: true}.Build())
 				assert.NoError(t, err, "expected RBAC to allow getting the current user")
-				assert.Empty(t, cmp.Diff(llama, user.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				assert.Empty(t, cmp.Diff(llama, user.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 			checker: &fakeChecker{
 				rules: []types.Rule{
@@ -659,7 +659,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get with secrets no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.GetUser(ctx, &userspb.GetUserRequest{Name: "alice", WithSecrets: true})
+				_, err := service.GetUser(ctx, userspb.GetUserRequest_builder{Name: "alice", WithSecrets: true}.Build())
 				assert.Error(t, err, "expected RBAC to prevent getting user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -676,9 +676,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "get",
 			f: func(t *testing.T, service *usersv1.Service) {
-				resp, err := service.GetUser(ctx, &userspb.GetUserRequest{Name: "llama"})
+				resp, err := service.GetUser(ctx, userspb.GetUserRequest_builder{Name: "llama"}.Build())
 				assert.NoError(t, err, "expected RBAC to allow getting user")
-				assert.Empty(t, cmp.Diff(llama, resp.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				assert.Empty(t, cmp.Diff(llama, resp.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 			checker: &fakeChecker{
 				rules: []types.Rule{
@@ -696,7 +696,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "create no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.CreateUser(ctx, &userspb.CreateUserRequest{User: llama.(*types.UserV2)})
+				_, err := service.CreateUser(ctx, userspb.CreateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 				assert.Error(t, err, "expected RBAC to prevent creating user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -716,9 +716,9 @@ func TestRBAC(t *testing.T) {
 			f: func(t *testing.T, service *usersv1.Service) {
 				u := utils.CloneProtoMsg(llama.(*types.UserV2))
 				u.SetName("alpaca")
-				created, err := service.CreateUser(ctx, &userspb.CreateUserRequest{User: u})
+				created, err := service.CreateUser(ctx, userspb.CreateUserRequest_builder{User: u}.Build())
 				assert.NoError(t, err, "expected RBAC to allow creating user")
-				assert.Empty(t, cmp.Diff(u, created.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				assert.Empty(t, cmp.Diff(u, created.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 			checker: &fakeChecker{
 				rules: []types.Rule{
@@ -735,7 +735,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "update no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.UpdateUser(ctx, &userspb.UpdateUserRequest{User: llama.(*types.UserV2)})
+				_, err := service.UpdateUser(ctx, userspb.UpdateUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 				assert.Error(t, err, "expected RBAC to prevent updating user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -755,9 +755,9 @@ func TestRBAC(t *testing.T) {
 			f: func(t *testing.T, service *usersv1.Service) {
 				u := utils.CloneProtoMsg(llama.(*types.UserV2))
 				u.SetLogins([]string{"alpaca"})
-				updated, err := service.UpdateUser(ctx, &userspb.UpdateUserRequest{User: u})
+				updated, err := service.UpdateUser(ctx, userspb.UpdateUserRequest_builder{User: u}.Build())
 				assert.NoError(t, err, "expected RBAC to allow updating user")
-				assert.Empty(t, cmp.Diff(u, updated.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				assert.Empty(t, cmp.Diff(u, updated.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 			checker: &fakeChecker{
 				rules: []types.Rule{
@@ -774,7 +774,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.UpsertUser(ctx, &userspb.UpsertUserRequest{User: llama.(*types.UserV2)})
+				_, err := service.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 				assert.Error(t, err, "expected RBAC to prevent upserting user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -793,7 +793,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert without create",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.UpsertUser(ctx, &userspb.UpsertUserRequest{User: llama.(*types.UserV2)})
+				_, err := service.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 				assert.Error(t, err, "expected RBAC to prevent upserting user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -813,7 +813,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert without update",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.UpsertUser(ctx, &userspb.UpsertUserRequest{User: llama.(*types.UserV2)})
+				_, err := service.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 				assert.Error(t, err, "expected RBAC to prevent upserting user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -833,9 +833,9 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "upsert",
 			f: func(t *testing.T, service *usersv1.Service) {
-				upserted, err := service.UpsertUser(ctx, &userspb.UpsertUserRequest{User: llama.(*types.UserV2)})
+				upserted, err := service.UpsertUser(ctx, userspb.UpsertUserRequest_builder{User: llama.(*types.UserV2)}.Build())
 				assert.NoError(t, err, "expected RBAC to allow updating user")
-				assert.Empty(t, cmp.Diff(llama, upserted.User, cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				assert.Empty(t, cmp.Diff(llama, upserted.GetUser(), cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 			checker: &fakeChecker{
 				rules: []types.Rule{
@@ -853,7 +853,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "delete no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.DeleteUser(ctx, &userspb.DeleteUserRequest{Name: llama.GetName()})
+				_, err := service.DeleteUser(ctx, userspb.DeleteUserRequest_builder{Name: llama.GetName()}.Build())
 				assert.Error(t, err, "expected RBAC to prevent deleting user")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -871,7 +871,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "delete",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.DeleteUser(ctx, &userspb.DeleteUserRequest{Name: llama.GetName()})
+				_, err := service.DeleteUser(ctx, userspb.DeleteUserRequest_builder{Name: llama.GetName()}.Build())
 				assert.NoError(t, err, "expected RBAC to allow deleting user")
 			},
 			checker: &fakeChecker{
@@ -889,7 +889,7 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "list no access",
 			f: func(t *testing.T, service *usersv1.Service) {
-				_, err := service.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 1})
+				_, err := service.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 1}.Build())
 				assert.Error(t, err, "expected RBAC to prevent listing users")
 				assert.True(t, trace.IsAccessDenied(err), "expected access denied error got %T", err)
 			},
@@ -908,10 +908,10 @@ func TestRBAC(t *testing.T) {
 		{
 			desc: "list",
 			f: func(t *testing.T, service *usersv1.Service) {
-				resp, err := service.ListUsers(ctx, &userspb.ListUsersRequest{PageSize: 1})
+				resp, err := service.ListUsers(ctx, userspb.ListUsersRequest_builder{PageSize: 1}.Build())
 				assert.NoError(t, err, "expected RBAC to prevent deleting user")
-				require.Len(t, resp.Users, 1, "expected list to return a single user got %d", len(resp.Users))
-				assert.Empty(t, cmp.Diff(llama, resp.Users[0], cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
+				require.Len(t, resp.GetUsers(), 1, "expected list to return a single user got %d", len(resp.GetUsers()))
+				assert.Empty(t, cmp.Diff(llama, resp.GetUsers()[0], cmpopts.IgnoreFields(types.Metadata{}, "Revision")))
 			},
 			checker: &fakeChecker{
 				rules: []types.Rule{
diff --git a/lib/auth/usertasks/usertasksv1/service.go b/lib/auth/usertasks/usertasksv1/service.go
index ee744ac1ad9..1d6b17586f8 100644
--- a/lib/auth/usertasks/usertasksv1/service.go
+++ b/lib/auth/usertasks/usertasksv1/service.go
@@ -131,9 +131,9 @@ func (s *Service) CreateUserTask(ctx context.Context, req *usertasksv1.CreateUse
 		return nil, trace.Wrap(err)
 	}
 
-	s.updateStatus(req.UserTask, nil /* existing user task */)
+	s.updateStatus(req.GetUserTask(), nil /* existing user task */)
 
-	rsp, err := s.backend.CreateUserTask(ctx, req.UserTask)
+	rsp, err := s.backend.CreateUserTask(ctx, req.GetUserTask())
 	s.emitCreateAuditEvent(ctx, rsp, authCtx, err)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -198,15 +198,15 @@ func (s *Service) ListUserTasks(ctx context.Context, req *usertasksv1.ListUserTa
 		return nil, trace.Wrap(err)
 	}
 
-	rsp, nextToken, err := s.cache.ListUserTasks(ctx, req.PageSize, req.PageToken, req.Filters)
+	rsp, nextToken, err := s.cache.ListUserTasks(ctx, req.GetPageSize(), req.GetPageToken(), req.GetFilters())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &usertasksv1.ListUserTasksResponse{
+	return usertasksv1.ListUserTasksResponse_builder{
 		UserTasks:     rsp,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // ListUserTasksByIntegration returns a list of user tasks filtered by an integration.
@@ -220,18 +220,18 @@ func (s *Service) ListUserTasksByIntegration(ctx context.Context, req *usertasks
 		return nil, trace.Wrap(err)
 	}
 
-	filters := &usertasksv1.ListUserTasksFilters{
-		Integration: req.Integration,
-	}
-	rsp, nextToken, err := s.cache.ListUserTasks(ctx, req.PageSize, req.PageToken, filters)
+	filters := usertasksv1.ListUserTasksFilters_builder{
+		Integration: req.GetIntegration(),
+	}.Build()
+	rsp, nextToken, err := s.cache.ListUserTasks(ctx, req.GetPageSize(), req.GetPageToken(), filters)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &usertasksv1.ListUserTasksResponse{
+	return usertasksv1.ListUserTasksResponse_builder{
 		UserTasks:     rsp,
 		NextPageToken: nextToken,
-	}, nil
+	}.Build(), nil
 }
 
 // GetUserTask returns user task resource.
@@ -270,9 +270,9 @@ func (s *Service) UpdateUserTask(ctx context.Context, req *usertasksv1.UpdateUse
 	}
 
 	stateChanged := existingUserTask.GetSpec().GetState() != req.GetUserTask().GetSpec().GetState()
-	s.updateStatus(req.UserTask, existingUserTask)
+	s.updateStatus(req.GetUserTask(), existingUserTask)
 
-	rsp, err := s.backend.UpdateUserTask(ctx, req.UserTask)
+	rsp, err := s.backend.UpdateUserTask(ctx, req.GetUserTask())
 	s.emitUpdateAuditEvent(ctx, existingUserTask, req.GetUserTask(), authCtx, err)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -336,9 +336,9 @@ func (s *Service) UpsertUserTask(ctx context.Context, req *usertasksv1.UpsertUse
 		stateChanged = existingUserTask.GetSpec().GetState() != req.GetUserTask().GetSpec().GetState()
 	}
 
-	s.updateStatus(req.UserTask, existingUserTask)
+	s.updateStatus(req.GetUserTask(), existingUserTask)
 
-	rsp, err := s.backend.UpsertUserTask(ctx, req.UserTask)
+	rsp, err := s.backend.UpsertUserTask(ctx, req.GetUserTask())
 	s.emitUpsertAuditEvent(ctx, existingUserTask, req.GetUserTask(), authCtx, err)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -353,17 +353,17 @@ func (s *Service) UpsertUserTask(ctx context.Context, req *usertasksv1.UpsertUse
 
 func (s *Service) updateStatus(ut *usertasksv1.UserTask, existing *usertasksv1.UserTask) {
 	// Default status for UserTask.
-	ut.Status = &usertasksv1.UserTaskStatus{
+	ut.SetStatus(usertasksv1.UserTaskStatus_builder{
 		LastStateChange: timestamppb.New(s.clock.Now()),
-	}
+	}.Build())
 
 	if existing != nil {
 		// Inherit everything from existing UserTask.
-		ut.Status.LastStateChange = cmp.Or(existing.GetStatus().GetLastStateChange(), ut.Status.LastStateChange)
+		ut.GetStatus().SetLastStateChange(cmp.Or(existing.GetStatus().GetLastStateChange(), ut.GetStatus().GetLastStateChange()))
 
 		// Update specific values.
 		if existing.GetSpec().GetState() != ut.GetSpec().GetState() {
-			ut.Status.LastStateChange = timestamppb.New(s.clock.Now())
+			ut.GetStatus().SetLastStateChange(timestamppb.New(s.clock.Now()))
 		}
 	}
 }
diff --git a/lib/auth/usertasks/usertasksv1/service_test.go b/lib/auth/usertasks/usertasksv1/service_test.go
index 0570a0b20de..7e89d47c11e 100644
--- a/lib/auth/usertasks/usertasksv1/service_test.go
+++ b/lib/auth/usertasks/usertasksv1/service_test.go
@@ -125,90 +125,90 @@ func TestEvents(t *testing.T) {
 	service := newService(t, fakeChecker{allowedVerbs: rwVerbs}, testReporter, auditEventsSink, fakeClock)
 	ctx := context.Background()
 
-	ut1, err := usertasks.NewDiscoverEC2UserTask(&usertasksv1.UserTaskSpec{
+	ut1, err := usertasks.NewDiscoverEC2UserTask(usertasksv1.UserTaskSpec_builder{
 		Integration: "my-integration",
 		TaskType:    "discover-ec2",
 		IssueType:   "ec2-ssm-invocation-failure",
 		State:       "OPEN",
-		DiscoverEc2: &usertasksv1.DiscoverEC2{
+		DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 			AccountId: "123456789012",
 			Region:    "us-east-1",
 			Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-				"i-123": {
+				"i-123": usertasksv1.DiscoverEC2Instance_builder{
 					InstanceId:      "i-123",
 					DiscoveryConfig: "dc01",
 					DiscoveryGroup:  "dg01",
-				},
+				}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	userTaskName := ut1.GetMetadata().GetName()
 
-	createUserTaskResp, err := service.CreateUserTask(ctx, &usertasksv1.CreateUserTaskRequest{UserTask: ut1})
+	createUserTaskResp, err := service.CreateUserTask(ctx, usertasksv1.CreateUserTaskRequest_builder{UserTask: ut1}.Build())
 	require.NoError(t, err)
 	// Usage reporting happens when user task is created, so we expect to see an event.
 	require.Len(t, testReporter.emittedEvents, 1)
 	consumeAssertEvent(t, auditEventsSink.C(), auditEventFor(userTaskName, "create", "", ""))
 	// LastStateChange is updated.
-	require.Equal(t, timestamppb.New(fakeClock.Now()), createUserTaskResp.Status.LastStateChange)
+	require.Equal(t, timestamppb.New(fakeClock.Now()), createUserTaskResp.GetStatus().GetLastStateChange())
 
-	expectedLastStateChange := createUserTaskResp.Status.LastStateChange
-	ut1.Spec.DiscoverEc2.Instances["i-345"] = &usertasksv1.DiscoverEC2Instance{
+	expectedLastStateChange := createUserTaskResp.GetStatus().GetLastStateChange()
+	ut1.GetSpec().GetDiscoverEc2().GetInstances()["i-345"] = usertasksv1.DiscoverEC2Instance_builder{
 		InstanceId:      "i-345",
 		DiscoveryConfig: "dc01",
 		DiscoveryGroup:  "dg01",
-	}
+	}.Build()
 	fakeClock.Advance(1 * time.Minute)
-	upsertUserTaskResp, err := service.UpsertUserTask(ctx, &usertasksv1.UpsertUserTaskRequest{UserTask: ut1})
+	upsertUserTaskResp, err := service.UpsertUserTask(ctx, usertasksv1.UpsertUserTaskRequest_builder{UserTask: ut1}.Build())
 	require.NoError(t, err)
 	// State was not updated, so usage events must not increase.
 	require.Len(t, testReporter.emittedEvents, 1)
 	consumeAssertEvent(t, auditEventsSink.C(), auditEventFor(userTaskName, "update", "OPEN", "OPEN"))
 	// LastStateChange is not updated.
-	require.Equal(t, expectedLastStateChange.AsTime(), upsertUserTaskResp.Status.LastStateChange.AsTime())
+	require.Equal(t, expectedLastStateChange.AsTime(), upsertUserTaskResp.GetStatus().GetLastStateChange().AsTime())
 
-	ut1.Spec.State = "RESOLVED"
+	ut1.GetSpec().SetState("RESOLVED")
 	fakeClock.Advance(1 * time.Minute)
-	updateUserTaskResp, err := service.UpdateUserTask(ctx, &usertasksv1.UpdateUserTaskRequest{UserTask: ut1})
+	updateUserTaskResp, err := service.UpdateUserTask(ctx, usertasksv1.UpdateUserTaskRequest_builder{UserTask: ut1}.Build())
 	require.NoError(t, err)
 	// State was updated, so usage events include this new usage report.
 	require.Len(t, testReporter.emittedEvents, 2)
 	consumeAssertEvent(t, auditEventsSink.C(), auditEventFor(userTaskName, "update", "OPEN", "RESOLVED"))
 	// LastStateChange was updated because the state changed.
-	require.Equal(t, timestamppb.New(fakeClock.Now()), updateUserTaskResp.Status.LastStateChange)
+	require.Equal(t, timestamppb.New(fakeClock.Now()), updateUserTaskResp.GetStatus().GetLastStateChange())
 
 	// Updating one of the instances.
-	expectedLastStateChange = updateUserTaskResp.Status.GetLastStateChange()
+	expectedLastStateChange = updateUserTaskResp.GetStatus().GetLastStateChange()
 	fakeClock.Advance(1 * time.Minute)
-	ut1.Spec.DiscoverEc2.Instances["i-345"] = &usertasksv1.DiscoverEC2Instance{
+	ut1.GetSpec().GetDiscoverEc2().GetInstances()["i-345"] = usertasksv1.DiscoverEC2Instance_builder{
 		InstanceId:      "i-345",
 		DiscoveryConfig: "dc01",
 		DiscoveryGroup:  "dg01",
 		SyncTime:        timestamppb.New(fakeClock.Now()),
-	}
-	updateUserTaskResp, err = service.UpdateUserTask(ctx, &usertasksv1.UpdateUserTaskRequest{UserTask: ut1})
+	}.Build()
+	updateUserTaskResp, err = service.UpdateUserTask(ctx, usertasksv1.UpdateUserTaskRequest_builder{UserTask: ut1}.Build())
 	require.NoError(t, err)
 	// Does not change the LastStateChange
-	require.Equal(t, expectedLastStateChange.AsTime(), updateUserTaskResp.Status.LastStateChange.AsTime())
+	require.Equal(t, expectedLastStateChange.AsTime(), updateUserTaskResp.GetStatus().GetLastStateChange().AsTime())
 	consumeAssertEvent(t, auditEventsSink.C(), auditEventFor(userTaskName, "update", "RESOLVED", "RESOLVED"))
 
 	// Upserting one of the instances.
-	expectedLastStateChange = updateUserTaskResp.Status.GetLastStateChange()
+	expectedLastStateChange = updateUserTaskResp.GetStatus().GetLastStateChange()
 	fakeClock.Advance(1 * time.Minute)
-	ut1.Spec.DiscoverEc2.Instances["i-345"] = &usertasksv1.DiscoverEC2Instance{
+	ut1.GetSpec().GetDiscoverEc2().GetInstances()["i-345"] = usertasksv1.DiscoverEC2Instance_builder{
 		InstanceId:      "i-345",
 		DiscoveryConfig: "dc01",
 		DiscoveryGroup:  "dg01",
 		SyncTime:        timestamppb.New(fakeClock.Now()),
-	}
-	upsertUserTaskResp, err = service.UpsertUserTask(ctx, &usertasksv1.UpsertUserTaskRequest{UserTask: ut1})
+	}.Build()
+	upsertUserTaskResp, err = service.UpsertUserTask(ctx, usertasksv1.UpsertUserTaskRequest_builder{UserTask: ut1}.Build())
 	require.NoError(t, err)
 	// Does not change the LastStateChange
-	require.Equal(t, expectedLastStateChange.AsTime(), upsertUserTaskResp.Status.LastStateChange.AsTime())
+	require.Equal(t, expectedLastStateChange.AsTime(), upsertUserTaskResp.GetStatus().GetLastStateChange().AsTime())
 	consumeAssertEvent(t, auditEventsSink.C(), auditEventFor(userTaskName, "update", "RESOLVED", "RESOLVED"))
 
-	_, err = service.DeleteUserTask(ctx, &usertasksv1.DeleteUserTaskRequest{Name: userTaskName})
+	_, err = service.DeleteUserTask(ctx, usertasksv1.DeleteUserTaskRequest_builder{Name: userTaskName}.Build())
 	require.NoError(t, err)
 	// No usage report for deleted resources.
 	require.Len(t, testReporter.emittedEvents, 2)
@@ -283,18 +283,18 @@ func consumeAssertEvent(t *testing.T, q <-chan apievents.AuditEvent, expectedEve
 
 // callMethod calls a method with given name in the UserTask service
 func callMethod(t *testing.T, service *Service, method string) error {
-	emptyUserTask := &usertasksv1.UserTask{
+	emptyUserTask := usertasksv1.UserTask_builder{
 		Spec: &usertasksv1.UserTaskSpec{},
-	}
+	}.Build()
 
 	for _, desc := range usertasksv1.UserTaskService_ServiceDesc.Methods {
 		if desc.MethodName == method {
 			_, err := desc.Handler(service, context.Background(), func(arg any) error {
 				switch arg := arg.(type) {
 				case *usertasksv1.CreateUserTaskRequest:
-					arg.UserTask = emptyUserTask
+					arg.SetUserTask(emptyUserTask)
 				case *usertasksv1.UpsertUserTaskRequest:
-					arg.UserTask = emptyUserTask
+					arg.SetUserTask(emptyUserTask)
 				}
 				return nil
 			}, nil)
diff --git a/lib/auth/version.go b/lib/auth/version.go
index a8824e3cb49..c2545a9442c 100644
--- a/lib/auth/version.go
+++ b/lib/auth/version.go
@@ -61,7 +61,7 @@ func validateAndUpdateTeleportVersion(
 		backendInfo, err := backendStorage.GetBackendInfo(ctx)
 		if trace.IsNotFound(err) {
 			createNewResource = true
-			backendInfo, err = backendinfo.NewBackendInfo(&backendinfov1.BackendInfoSpec{TeleportVersion: teleportVersion.String()})
+			backendInfo, err = backendinfo.NewBackendInfo(backendinfov1.BackendInfoSpec_builder{TeleportVersion: teleportVersion.String()}.Build())
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -94,7 +94,7 @@ func validateAndUpdateTeleportVersion(
 				lastKnownVersion, currentVersion.String())
 		}
 
-		backendInfo.GetSpec().TeleportVersion = currentVersion.String()
+		backendInfo.GetSpec().SetTeleportVersion(currentVersion.String())
 
 		if createNewResource {
 			_, err = backendStorage.CreateBackendInfo(ctx, backendInfo)
@@ -135,9 +135,9 @@ func upsertTeleportVersion(
 	backendStorage services.BackendInfoService,
 	currentVersion semver.Version,
 ) error {
-	backendInfo, err := backendinfo.NewBackendInfo(&backendinfov1.BackendInfoSpec{
+	backendInfo, err := backendinfo.NewBackendInfo(backendinfov1.BackendInfoSpec_builder{
 		TeleportVersion: currentVersion.String(),
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/auth/vnetconfig/vnetconfigv1/service.go b/lib/auth/vnetconfig/vnetconfigv1/service.go
index 100545d8994..5a5ed383e10 100644
--- a/lib/auth/vnetconfig/vnetconfigv1/service.go
+++ b/lib/auth/vnetconfig/vnetconfigv1/service.go
@@ -105,10 +105,10 @@ func (s *Service) CreateVnetConfig(ctx context.Context, req *vnet.CreateVnetConf
 	}
 
 	if req.GetVnetConfig() == nil {
-		req.VnetConfig = &vnet.VnetConfig{}
+		req.SetVnetConfig(&vnet.VnetConfig{})
 	}
-	typesvnet.SetDefaultsVnetConfig(req.VnetConfig)
-	vnetConfig, err := s.storage.CreateVnetConfig(ctx, req.VnetConfig)
+	typesvnet.SetDefaultsVnetConfig(req.GetVnetConfig())
+	vnetConfig, err := s.storage.CreateVnetConfig(ctx, req.GetVnetConfig())
 	status := eventStatus(err)
 	s.emitAuditEvent(ctx, newCreateAuditEvent(ctx, status))
 	if err != nil {
@@ -124,10 +124,10 @@ func (s *Service) UpdateVnetConfig(ctx context.Context, req *vnet.UpdateVnetConf
 	}
 
 	if req.GetVnetConfig() == nil {
-		req.VnetConfig = &vnet.VnetConfig{}
+		req.SetVnetConfig(&vnet.VnetConfig{})
 	}
-	typesvnet.SetDefaultsVnetConfig(req.VnetConfig)
-	vnetConfig, err := s.storage.UpdateVnetConfig(ctx, req.VnetConfig)
+	typesvnet.SetDefaultsVnetConfig(req.GetVnetConfig())
+	vnetConfig, err := s.storage.UpdateVnetConfig(ctx, req.GetVnetConfig())
 	status := eventStatus(err)
 	s.emitAuditEvent(ctx, newUpdateAuditEvent(ctx, status))
 	if err != nil {
@@ -143,10 +143,10 @@ func (s *Service) UpsertVnetConfig(ctx context.Context, req *vnet.UpsertVnetConf
 	}
 
 	if req.GetVnetConfig() == nil {
-		req.VnetConfig = &vnet.VnetConfig{}
+		req.SetVnetConfig(&vnet.VnetConfig{})
 	}
-	typesvnet.SetDefaultsVnetConfig(req.VnetConfig)
-	vnetConfig, err := s.storage.UpsertVnetConfig(ctx, req.VnetConfig)
+	typesvnet.SetDefaultsVnetConfig(req.GetVnetConfig())
+	vnetConfig, err := s.storage.UpsertVnetConfig(ctx, req.GetVnetConfig())
 	status := eventStatus(err)
 	s.emitAuditEvent(ctx, newCreateAuditEvent(ctx, status))
 	if err != nil {
diff --git a/lib/auth/vnetconfig/vnetconfigv1/service_test.go b/lib/auth/vnetconfig/vnetconfigv1/service_test.go
index a0f55bc16b7..d924ce90580 100644
--- a/lib/auth/vnetconfig/vnetconfigv1/service_test.go
+++ b/lib/auth/vnetconfig/vnetconfigv1/service_test.go
@@ -48,13 +48,13 @@ func TestServiceAccess(t *testing.T) {
 
 	ctx := context.Background()
 
-	vnetConfig := &vnet.VnetConfig{
+	vnetConfig := vnet.VnetConfig_builder{
 		Kind:    types.KindVnetConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "vnet-config",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	type testCase struct {
 		name          string
@@ -73,7 +73,7 @@ func TestServiceAccess(t *testing.T) {
 			},
 			allowedVerbs: []string{types.VerbCreate},
 			action: func(service *Service) error {
-				_, err := service.CreateVnetConfig(ctx, &vnet.CreateVnetConfigRequest{VnetConfig: vnetConfig})
+				_, err := service.CreateVnetConfig(ctx, vnet.CreateVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 				return trace.Wrap(err)
 			},
 			requireEvent: &apievents.VnetConfigCreate{},
@@ -90,7 +90,7 @@ func TestServiceAccess(t *testing.T) {
 				if _, err := service.storage.CreateVnetConfig(ctx, vnetConfig); err != nil {
 					return trace.Wrap(err, "creating vnet_config as pre-req for Update test")
 				}
-				_, err := service.UpdateVnetConfig(ctx, &vnet.UpdateVnetConfigRequest{VnetConfig: vnetConfig})
+				_, err := service.UpdateVnetConfig(ctx, vnet.UpdateVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 				return trace.Wrap(err)
 			},
 			requireEvent: &apievents.VnetConfigUpdate{},
@@ -121,7 +121,7 @@ func TestServiceAccess(t *testing.T) {
 			},
 			allowedVerbs: []string{types.VerbCreate, types.VerbUpdate},
 			action: func(service *Service) error {
-				_, err := service.UpsertVnetConfig(ctx, &vnet.UpsertVnetConfigRequest{VnetConfig: vnetConfig})
+				_, err := service.UpsertVnetConfig(ctx, vnet.UpsertVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 				return trace.Wrap(err)
 			},
 			requireEvent: &apievents.VnetConfigCreate{},
@@ -138,7 +138,7 @@ func TestServiceAccess(t *testing.T) {
 				if _, err := service.storage.CreateVnetConfig(ctx, vnetConfig); err != nil {
 					return trace.Wrap(err, "creating vnet_config as pre-req for Upsert test")
 				}
-				_, err := service.UpsertVnetConfig(ctx, &vnet.UpsertVnetConfigRequest{VnetConfig: vnetConfig})
+				_, err := service.UpsertVnetConfig(ctx, vnet.UpsertVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 				return trace.Wrap(err)
 			},
 			requireEvent: &apievents.VnetConfigCreate{},
@@ -231,13 +231,13 @@ func TestServiceAccess(t *testing.T) {
 func TestServiceScopedAccess(t *testing.T) {
 	t.Parallel()
 
-	vnetConfig := &vnet.VnetConfig{
+	vnetConfig := vnet.VnetConfig_builder{
 		Kind:    types.KindVnetConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameVnetConfig,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	t.Run("read allowed despite scope pin", func(t *testing.T) {
 		service, _ := newServiceWithScopedAuthorizer(t, newFakeScopedAuthorizer(t))
@@ -254,15 +254,15 @@ func TestServiceScopedAccess(t *testing.T) {
 	t.Run("write denied for scoped identity", func(t *testing.T) {
 		service, emitter := newServiceWithScopedAuthorizer(t, newFakeScopedAuthorizer(t))
 
-		_, err := service.CreateVnetConfig(t.Context(), &vnet.CreateVnetConfigRequest{VnetConfig: vnetConfig})
+		_, err := service.CreateVnetConfig(t.Context(), vnet.CreateVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 		require.Empty(t, emitter.Events(), "expected no audit events on access denied")
 
-		_, err = service.UpdateVnetConfig(t.Context(), &vnet.UpdateVnetConfigRequest{VnetConfig: vnetConfig})
+		_, err = service.UpdateVnetConfig(t.Context(), vnet.UpdateVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 		require.Empty(t, emitter.Events(), "expected no audit events on access denied")
 
-		_, err = service.UpsertVnetConfig(t.Context(), &vnet.UpsertVnetConfigRequest{VnetConfig: vnetConfig})
+		_, err = service.UpsertVnetConfig(t.Context(), vnet.UpsertVnetConfigRequest_builder{VnetConfig: vnetConfig}.Build())
 		require.ErrorAs(t, err, new(*trace.AccessDeniedError))
 		require.Empty(t, emitter.Events(), "expected no audit events on access denied")
 
@@ -373,7 +373,7 @@ func (f fakeScopedRoleReader) GetScopedRole(_ context.Context, req *scopedaccess
 	if role == nil {
 		return nil, trace.NotFound("scoped role %q not found", req.GetName())
 	}
-	return &scopedaccessv1.GetScopedRoleResponse{Role: role}, nil
+	return scopedaccessv1.GetScopedRoleResponse_builder{Role: role}.Build(), nil
 }
 
 func (f fakeScopedRoleReader) ListScopedRoles(context.Context, *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
@@ -381,7 +381,7 @@ func (f fakeScopedRoleReader) ListScopedRoles(context.Context, *scopedaccessv1.L
 	for _, role := range f.roles {
 		roles = append(roles, role)
 	}
-	return &scopedaccessv1.ListScopedRolesResponse{Roles: roles}, nil
+	return scopedaccessv1.ListScopedRolesResponse_builder{Roles: roles}.Build(), nil
 }
 
 func newFakeScopedAuthorizer(t *testing.T) fakeScopedAuthorizer {
@@ -389,10 +389,10 @@ func newFakeScopedAuthorizer(t *testing.T) fakeScopedAuthorizer {
 
 	checkerContext, err := services.NewScopedAccessCheckerContext(t.Context(), &services.AccessInfo{
 		Username: "alice",
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/test",
-		},
+		}.Build(),
 	}, "test-cluster", fakeScopedRoleReader{})
 	require.NoError(t, err)
 
diff --git a/lib/authz/middleware_test.go b/lib/authz/middleware_test.go
index c86d9fe450d..4e676742216 100644
--- a/lib/authz/middleware_test.go
+++ b/lib/authz/middleware_test.go
@@ -651,13 +651,13 @@ func TestMiddlewareGetUserAgentScopePin(t *testing.T) {
 
 	now := time.Now().UTC()
 
-	agentPin := &scopesv1.Pin{
+	agentPin := scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 		Scope: "/",
-		SystemRoles: &scopesv1.SystemRoles{
+		SystemRoles: scopesv1.SystemRoles_builder{
 			Primary: string(types.RoleNode),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	identity := tlsca.Identity{
 		Username:          serverFQDN,
diff --git a/lib/authz/permissions_test.go b/lib/authz/permissions_test.go
index ca5a045209b..55beb70d3f6 100644
--- a/lib/authz/permissions_test.go
+++ b/lib/authz/permissions_test.go
@@ -1631,13 +1631,13 @@ func TestAuthorizeRejectsScopedAgents(t *testing.T) {
 	_, _, authorizer := newTestResources(t)
 
 	scopedRole := authz.ScopedBuiltinRole{
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 			Scope: "/some/scope",
-			SystemRoles: &scopesv1.SystemRoles{
+			SystemRoles: scopesv1.SystemRoles_builder{
 				Primary: string(types.RoleNode),
-			},
-		},
+			}.Build(),
+		}.Build(),
 		ServerFQDN:  "node-uuid." + clusterName,
 		ClusterName: clusterName,
 		Identity: tlsca.Identity{
@@ -1657,13 +1657,13 @@ func TestScopedContextLockTargets(t *testing.T) {
 	t.Run("ScopedBuiltinRole", func(t *testing.T) {
 		scopedCtx := &authz.ScopedContext{
 			Identity: authz.ScopedBuiltinRole{
-				ScopePin: &scopesv1.Pin{
+				ScopePin: scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 					Scope: "/test",
-					SystemRoles: &scopesv1.SystemRoles{
+					SystemRoles: scopesv1.SystemRoles_builder{
 						Primary: string(types.RoleNode),
-					},
-				},
+					}.Build(),
+				}.Build(),
 				ServerFQDN:  "node-uuid." + clusterName,
 				ClusterName: clusterName,
 				Identity: tlsca.Identity{
@@ -1688,10 +1688,10 @@ func TestScopedContextLockTargets(t *testing.T) {
 				Identity: tlsca.Identity{
 					Username:    "alice",
 					MFAVerified: "mfa-device-id",
-					ScopePin: &scopesv1.Pin{
+					ScopePin: scopesv1.Pin_builder{
 						Kind:  scopesv1.PinKind_PIN_KIND_USER,
 						Scope: "/test",
-					},
+					}.Build(),
 				},
 			},
 		}
@@ -1732,13 +1732,13 @@ func TestAuthorizeScopedWithLocksForScopedBuiltinRole(t *testing.T) {
 	require.NoError(t, err)
 
 	scopedRole := authz.ScopedBuiltinRole{
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 			Scope: "/test/scope",
-			SystemRoles: &scopesv1.SystemRoles{
+			SystemRoles: scopesv1.SystemRoles_builder{
 				Primary: string(types.RoleNode),
-			},
-		},
+			}.Build(),
+		}.Build(),
 		ServerFQDN:  "node-uuid." + clusterName,
 		ClusterName: clusterName,
 		Identity: tlsca.Identity{
@@ -1815,14 +1815,14 @@ func TestAuthorizeScopedBuiltinRolePartialSkip(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.desc, func(t *testing.T) {
-			pin := &scopesv1.Pin{
+			pin := scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 				Scope: "/test/scope",
-				SystemRoles: &scopesv1.SystemRoles{
+				SystemRoles: scopesv1.SystemRoles_builder{
 					Primary:    string(types.RoleInstance),
 					Additional: tt.roles,
-				},
-			}
+				}.Build(),
+			}.Build()
 			role := authz.ScopedBuiltinRole{
 				ScopePin:    pin,
 				ServerFQDN:  "node-uuid." + clusterName,
@@ -1859,10 +1859,10 @@ func TestAuthorizeScopedWithLocksForScopedLocalUser(t *testing.T) {
 	user, _, err := authtest.CreateUserAndRole(client, "test-scoped-user", []string{}, nil)
 	require.NoError(t, err)
 
-	scopedPin := &scopesv1.Pin{
+	scopedPin := scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_USER,
 		Scope: "/test/scope",
-	}
+	}.Build()
 	localUser := authz.LocalUser{
 		Username: user.GetName(),
 		Identity: tlsca.Identity{
diff --git a/lib/autoupdate/lookup/resolver_test.go b/lib/autoupdate/lookup/resolver_test.go
index dd933913416..b48d398b71e 100644
--- a/lib/autoupdate/lookup/resolver_test.go
+++ b/lib/autoupdate/lookup/resolver_test.go
@@ -94,13 +94,13 @@ func TestAutoUpdateAgentVersion(t *testing.T) {
 	}{
 		{
 			name: "version is looked up from rollout if it is here",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					TargetVersion:  testVersionHigh,
 					Schedule:       autoupdate.AgentsScheduleImmediate,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
 			expectError:     require.NoError,
 			expectedVersion: semver.Must(version.EnsureSemver(testVersionHigh)),
@@ -201,26 +201,26 @@ func TestAutoUpdateAgentShouldUpdate(t *testing.T) {
 	}{
 		{
 			name: "trigger is looked up from rollout if it is here, trigger firing",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					TargetVersion:  testVersionHigh,
 					Schedule:       autoupdate.AgentsScheduleImmediate,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
 			expectError:     require.NoError,
 			expectedTrigger: true,
 		},
 		{
 			name: "trigger is looked up from rollout if it is here, trigger not firing",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeDisabled,
 					TargetVersion:  testVersionHigh,
 					Schedule:       autoupdate.AgentsScheduleImmediate,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			channel:         &automaticupgrades.Channel{StaticVersion: testVersionLow},
 			expectError:     require.NoError,
 			expectedTrigger: false,
diff --git a/lib/autoupdate/lookup/rfd_184.go b/lib/autoupdate/lookup/rfd_184.go
index 3b20292e28d..11b2881eb2f 100644
--- a/lib/autoupdate/lookup/rfd_184.go
+++ b/lib/autoupdate/lookup/rfd_184.go
@@ -79,7 +79,7 @@ func updaterIsCanary(group *autoupdatepb.AutoUpdateAgentRolloutStatusGroup, upda
 		return false
 	}
 	for _, canary := range group.GetCanaries() {
-		if canary.UpdaterId == updaterUUID {
+		if canary.GetUpdaterId() == updaterUUID {
 			return true
 		}
 	}
@@ -144,7 +144,7 @@ func getGroup(
 
 	// Try to find a group with our name
 	for _, group := range groups {
-		if group.Name == groupName {
+		if group.GetName() == groupName {
 			return group, nil
 		}
 	}
diff --git a/lib/autoupdate/lookup/rfd_184_test.go b/lib/autoupdate/lookup/rfd_184_test.go
index c458401b6e5..6a0f43b5692 100644
--- a/lib/autoupdate/lookup/rfd_184_test.go
+++ b/lib/autoupdate/lookup/rfd_184_test.go
@@ -81,24 +81,24 @@ func TestGetVersionFromRollout(t *testing.T) {
 				t.Run(fmt.Sprintf("%s/%s/%s", mode, schedule, state), func(t *testing.T) {
 					expectedSemVersion, err := version.EnsureSemver(expectedVersion)
 					require.NoError(t, err)
-					rollout := &autoupdatepb.AutoUpdateAgentRollout{
-						Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
+						Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 							StartVersion:   testVersionLow,
 							TargetVersion:  testVersionHigh,
 							Schedule:       schedule,
 							AutoupdateMode: mode,
 							// Strategy does not affect which version are served
 							Strategy: autoupdate.AgentsStrategyTimeBased,
-						},
-						Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+						}.Build(),
+						Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 							Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-								{
+								autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 									Name:  groupName,
 									State: state,
-								},
+								}.Build(),
 							},
-						},
-					}
+						}.Build(),
+					}.Build()
 					version, err := getVersionFromRollout(rollout, groupName, "")
 					require.NoError(t, err)
 					require.Equal(t, expectedSemVersion, version)
@@ -123,32 +123,32 @@ func TestGetVersionFromRollout(t *testing.T) {
 				expectedSemVersion, err := version.EnsureSemver(expectedVersion)
 				require.NoError(t, err)
 
-				rollout := &autoupdatepb.AutoUpdateAgentRollout{
-					Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+				rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
+					Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 						StartVersion:   testVersionLow,
 						TargetVersion:  testVersionHigh,
 						Schedule:       schedule,
 						AutoupdateMode: mode,
 						// Strategy does not affect which version are served
 						Strategy: autoupdate.AgentsStrategyTimeBased,
-					},
-					Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+					}.Build(),
+					Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 						Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-							{
+							autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 								Name:  groupName,
 								State: state,
 								Canaries: []*autoupdatepb.Canary{
-									{
+									autoupdatepb.Canary_builder{
 										UpdaterId: uuid.NewString(),
 										HostId:    uuid.NewString(),
 										Hostname:  "test-host",
 										Success:   false,
-									},
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				}
+					}.Build(),
+				}.Build()
 				var updaterID string
 				if canaryMatching {
 					updaterID = rollout.GetStatus().GetGroups()[0].GetCanaries()[0].GetUpdaterId()
@@ -235,23 +235,23 @@ func TestGetTriggerFromRollout(t *testing.T) {
 			for schedule, stateCases := range scheduleCases {
 				for state, expectedTrigger := range stateCases {
 					t.Run(fmt.Sprintf("%s/%s/%s/%s", mode, strategy, schedule, state), func(t *testing.T) {
-						rollout := &autoupdatepb.AutoUpdateAgentRollout{
-							Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+						rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
+							Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 								StartVersion:   testVersionLow,
 								TargetVersion:  testVersionHigh,
 								Schedule:       schedule,
 								AutoupdateMode: mode,
 								Strategy:       strategy,
-							},
-							Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+							}.Build(),
+							Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 								Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-									{
+									autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 										Name:  groupName,
 										State: state,
-									},
+									}.Build(),
 								},
-							},
-						}
+							}.Build(),
+						}.Build()
 						shouldUpdate, err := getTriggerFromRollout(rollout, groupName, "")
 						require.NoError(t, err)
 						require.Equal(t, expectedTrigger, shouldUpdate)
@@ -305,31 +305,31 @@ func TestGetTriggerFromRollout(t *testing.T) {
 		for strategy, statesCases := range strategyCases {
 			for state, expectedTrigger := range statesCases {
 				t.Run(fmt.Sprintf("canary(%s)/%s/%s", strconv.FormatBool(canaryMatching), strategy, state), func(t *testing.T) {
-					rollout := &autoupdatepb.AutoUpdateAgentRollout{
-						Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+					rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
+						Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 							StartVersion:   testVersionLow,
 							TargetVersion:  testVersionHigh,
 							Schedule:       schedule,
 							AutoupdateMode: mode,
 							Strategy:       strategy,
-						},
-						Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+						}.Build(),
+						Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 							Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-								{
+								autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 									Name:  groupName,
 									State: state,
 									Canaries: []*autoupdatepb.Canary{
-										{
+										autoupdatepb.Canary_builder{
 											UpdaterId: uuid.NewString(),
 											HostId:    uuid.NewString(),
 											Hostname:  "test-host",
 											Success:   false,
-										},
+										}.Build(),
 									},
-								},
+								}.Build(),
 							},
-						},
-					}
+						}.Build(),
+					}.Build()
 					var updaterID string
 					if canaryMatching {
 						updaterID = rollout.GetStatus().GetGroups()[0].GetCanaries()[0].GetUpdaterId()
@@ -368,51 +368,51 @@ func TestGetGroup(t *testing.T) {
 		},
 		{
 			name:        "nil status groups",
-			rollout:     &autoupdatepb.AutoUpdateAgentRollout{Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{}},
+			rollout:     autoupdatepb.AutoUpdateAgentRollout_builder{Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{}}.Build(),
 			expectError: require.Error,
 		},
 		{
 			name: "empty status groups",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+			rollout: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectError: require.Error,
 		},
 		{
 			name: "group matching name",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+			rollout: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{Name: "foo", State: 1},
-						{Name: "bar", State: 1},
-						{Name: groupName, State: 2},
-						{Name: "baz", State: 1},
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: "foo", State: 1}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: "bar", State: 1}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: groupName, State: 2}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: "baz", State: 1}.Build(),
 					},
-				},
-			},
-			expectedResult: &autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+				}.Build(),
+			}.Build(),
+			expectedResult: autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  groupName,
 				State: 2,
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
 			name: "no group matching name, should fallback to default",
-			rollout: &autoupdatepb.AutoUpdateAgentRollout{
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+			rollout: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{Name: "foo", State: 1},
-						{Name: "bar", State: 1},
-						{Name: "baz", State: 1},
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: "foo", State: 1}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: "bar", State: 1}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{Name: "baz", State: 1}.Build(),
 					},
-				},
-			},
-			expectedResult: &autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
+				}.Build(),
+			}.Build(),
+			expectedResult: autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "baz",
 				State: 1,
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 	}
diff --git a/lib/autoupdate/rollout/metrics.go b/lib/autoupdate/rollout/metrics.go
index 68fab89b5a8..5b87dd928a3 100644
--- a/lib/autoupdate/rollout/metrics.go
+++ b/lib/autoupdate/rollout/metrics.go
@@ -342,7 +342,7 @@ func (m *metrics) setGroupStates(groups []*autoupdatepb.AutoUpdateAgentRolloutSt
 	// Set the state for the groups specified in the rollout.
 	for i, group := range groups {
 		labels := prometheus.Labels{metricsGroupNumberLabelName: strconv.Itoa(i)}
-		m.rolloutGroupState.With(labels).Set(float64(group.State))
+		m.rolloutGroupState.With(labels).Set(float64(group.GetState()))
 	}
 
 	// If we have as many or more groups than before, no cleanup to do.
diff --git a/lib/autoupdate/rollout/metrics_test.go b/lib/autoupdate/rollout/metrics_test.go
index 948df1aca51..4723a364514 100644
--- a/lib/autoupdate/rollout/metrics_test.go
+++ b/lib/autoupdate/rollout/metrics_test.go
@@ -155,9 +155,9 @@ func Test_setVersionMetric(t *testing.T) {
 func Test_setGroupStates(t *testing.T) {
 	testMetricLabels := []string{metricsGroupNumberLabelName}
 	testGroups := []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-		{State: autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
-		{State: autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE},
-		{State: autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
+		autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
+		autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE}.Build(),
+		autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
 	}
 	tests := []struct {
 		name               string
diff --git a/lib/autoupdate/rollout/reconciler.go b/lib/autoupdate/rollout/reconciler.go
index 0185893035a..ae70854b28e 100644
--- a/lib/autoupdate/rollout/reconciler.go
+++ b/lib/autoupdate/rollout/reconciler.go
@@ -189,7 +189,7 @@ func (r *reconciler) tryReconcile(ctx context.Context) (err error) {
 	if !rolloutExists {
 		r.log.DebugContext(ctx, "creating rollout")
 		rollout, err = update.NewAutoUpdateAgentRollout(newSpec)
-		rollout.Status = newStatus
+		rollout.SetStatus(newStatus)
 		if err != nil {
 			return trace.Wrap(err, "validating new rollout")
 		}
@@ -200,8 +200,8 @@ func (r *reconciler) tryReconcile(ctx context.Context) (err error) {
 	r.log.DebugContext(ctx, "updating rollout")
 	// If there was a previous rollout, we update its spec and status and do an update.
 	// We don't create a new resource to keep the metadata containing the revision ID.
-	rollout.Spec = newSpec
-	rollout.Status = newStatus
+	rollout.SetSpec(newSpec)
+	rollout.SetStatus(newStatus)
 	err = update.ValidateAutoUpdateAgentRollout(rollout)
 	if err != nil {
 		return trace.Wrap(err, "validating mutated rollout")
@@ -222,14 +222,14 @@ func (r *reconciler) buildRolloutSpec(config *autoupdate.AutoUpdateConfigSpecAge
 		strategy = defaultStrategy
 	}
 
-	return &autoupdate.AutoUpdateAgentRolloutSpec{
+	return autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:              version.GetStartVersion(),
 		TargetVersion:             version.GetTargetVersion(),
 		Schedule:                  version.GetSchedule(),
 		AutoupdateMode:            mode,
 		Strategy:                  strategy,
 		MaintenanceWindowDuration: config.GetMaintenanceWindowDuration(),
-	}, nil
+	}.Build(), nil
 
 }
 
@@ -298,7 +298,7 @@ func (r *reconciler) computeStatus(
 	if shouldResetRollout || existingRollout.GetStatus() == nil {
 		status = new(autoupdate.AutoUpdateAgentRolloutStatus)
 		// We set the start time if this is a new rollout
-		status.StartTime = timestamppb.New(r.clock.Now())
+		status.SetStartTime(timestamppb.New(r.clock.Now()))
 	} else {
 		status = utils.CloneProtoMsg(existingRollout.GetStatus())
 	}
@@ -307,7 +307,7 @@ func (r *reconciler) computeStatus(
 	switch newSpec.GetSchedule() {
 	case update.AgentsScheduleImmediate:
 		// There are no groups with the immediate schedule, we must clean them
-		status.Groups = nil
+		status.SetGroups(nil)
 		return status, nil
 	case update.AgentsScheduleRegular:
 		// Regular schedule has groups, we will compute them after
@@ -338,7 +338,7 @@ func (r *reconciler) computeStatus(
 			return nil, trace.Wrap(err, "creating groups status")
 		}
 	}
-	status.Groups = groups
+	status.SetGroups(groups)
 
 	err = r.progressRollout(ctx, newSpec, status, now)
 	// Failing to progress the update is not a hard failure.
@@ -348,7 +348,7 @@ func (r *reconciler) computeStatus(
 			"error", err)
 	}
 
-	status.State = computeRolloutState(groups)
+	status.SetState(computeRolloutState(groups))
 	return status, nil
 }
 
@@ -379,17 +379,17 @@ func (r *reconciler) makeGroupsStatus(ctx context.Context, schedules *autoupdate
 
 	groups := make([]*autoupdate.AutoUpdateAgentRolloutStatusGroup, len(configGroups))
 	for i, group := range configGroups {
-		groups[i] = &autoupdate.AutoUpdateAgentRolloutStatusGroup{
-			Name:             group.Name,
+		groups[i] = autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
+			Name:             group.GetName(),
 			StartTime:        nil,
 			State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 			LastUpdateTime:   timestamppb.New(now),
 			LastUpdateReason: updateReasonCreated,
-			ConfigDays:       group.Days,
-			ConfigStartHour:  group.StartHour,
-			ConfigWaitHours:  group.WaitHours,
-			CanaryCount:      uint64(group.CanaryCount),
-		}
+			ConfigDays:       group.GetDays(),
+			ConfigStartHour:  group.GetStartHour(),
+			ConfigWaitHours:  group.GetWaitHours(),
+			CanaryCount:      uint64(group.GetCanaryCount()),
+		}.Build()
 	}
 	return groups, nil
 }
@@ -422,20 +422,20 @@ func (r *reconciler) defaultConfigGroup(ctx context.Context) (*autoupdate.AgentA
 		weekdays = []string{types.Wildcard}
 	}
 
-	return &autoupdate.AgentAutoUpdateGroup{
+	return autoupdate.AgentAutoUpdateGroup_builder{
 		Name:      defaultCMCGroupName,
 		Days:      weekdays,
 		StartHour: int32(upgradeWindow.UTCStartHour),
 		WaitHours: 0,
-	}, nil
+	}.Build(), nil
 
 }
 
 func defaultGroup() *autoupdate.AgentAutoUpdateGroup {
-	return &autoupdate.AgentAutoUpdateGroup{
+	return autoupdate.AgentAutoUpdateGroup_builder{
 		Name:      defaultGroupName,
 		Days:      defaultUpdateDays,
 		StartHour: defaultStartHour,
 		WaitHours: 0,
-	}
+	}.Build()
 }
diff --git a/lib/autoupdate/rollout/reconciler_test.go b/lib/autoupdate/rollout/reconciler_test.go
index b5f1e9a42c5..f0e957b855d 100644
--- a/lib/autoupdate/rollout/reconciler_test.go
+++ b/lib/autoupdate/rollout/reconciler_test.go
@@ -62,7 +62,7 @@ func cancelContext(assertionFunc require.ValueAssertionFunc, cancel func()) requ
 // This is used to test the conditional update retry logic.
 func withRevisionID(original *autoupdate.AutoUpdateAgentRollout, revision string) *autoupdate.AutoUpdateAgentRollout {
 	revisioned := apiutils.CloneProtoMsg(original)
-	revisioned.Metadata.Revision = revision
+	revisioned.GetMetadata().SetRevision(revision)
 	return revisioned
 }
 
@@ -141,63 +141,63 @@ func TestTryReconcile(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 
 	// Test setup: creating fixtures
-	configOK, err := update.NewAutoUpdateConfig(&autoupdate.AutoUpdateConfigSpec{
-		Tools: &autoupdate.AutoUpdateConfigSpecTools{
+	configOK, err := update.NewAutoUpdateConfig(autoupdate.AutoUpdateConfigSpec_builder{
+		Tools: autoupdate.AutoUpdateConfigSpecTools_builder{
 			Mode: update.ToolsUpdateModeEnabled,
-		},
-		Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+		}.Build(),
+		Agents: autoupdate.AutoUpdateConfigSpecAgents_builder{
 			Mode:     update.AgentsUpdateModeEnabled,
 			Strategy: update.AgentsStrategyHaltOnError,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	configNoAgent, err := update.NewAutoUpdateConfig(&autoupdate.AutoUpdateConfigSpec{
-		Tools: &autoupdate.AutoUpdateConfigSpecTools{
+	configNoAgent, err := update.NewAutoUpdateConfig(autoupdate.AutoUpdateConfigSpec_builder{
+		Tools: autoupdate.AutoUpdateConfigSpecTools_builder{
 			Mode: update.ToolsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	versionOK, err := update.NewAutoUpdateVersion(&autoupdate.AutoUpdateVersionSpec{
-		Tools: &autoupdate.AutoUpdateVersionSpecTools{
+	versionOK, err := update.NewAutoUpdateVersion(autoupdate.AutoUpdateVersionSpec_builder{
+		Tools: autoupdate.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-		Agents: &autoupdate.AutoUpdateVersionSpecAgents{
+		}.Build(),
+		Agents: autoupdate.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "1.2.3",
 			TargetVersion: "1.2.4",
 			Schedule:      update.AgentsScheduleImmediate,
 			Mode:          update.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	versionNoAgent, err := update.NewAutoUpdateVersion(&autoupdate.AutoUpdateVersionSpec{
-		Tools: &autoupdate.AutoUpdateVersionSpecTools{
+	versionNoAgent, err := update.NewAutoUpdateVersion(autoupdate.AutoUpdateVersionSpec_builder{
+		Tools: autoupdate.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	upToDateRollout, err := update.NewAutoUpdateAgentRollout(&autoupdate.AutoUpdateAgentRolloutSpec{
+	upToDateRollout, err := update.NewAutoUpdateAgentRollout(autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "1.2.4",
 		Schedule:       update.AgentsScheduleImmediate,
 		AutoupdateMode: update.AgentsUpdateModeEnabled,
 		Strategy:       update.AgentsStrategyHaltOnError,
-	})
+	}.Build())
 	require.NoError(t, err)
-	upToDateRollout.Status = &autoupdate.AutoUpdateAgentRolloutStatus{StartTime: timestamppb.New(clock.Now())}
+	upToDateRollout.SetStatus(autoupdate.AutoUpdateAgentRolloutStatus_builder{StartTime: timestamppb.New(clock.Now())}.Build())
 
-	outOfDateRollout, err := update.NewAutoUpdateAgentRollout(&autoupdate.AutoUpdateAgentRolloutSpec{
+	outOfDateRollout, err := update.NewAutoUpdateAgentRollout(autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.2",
 		TargetVersion:  "1.2.3",
 		Schedule:       update.AgentsScheduleImmediate,
 		AutoupdateMode: update.AgentsUpdateModeEnabled,
 		Strategy:       update.AgentsStrategyHaltOnError,
-	})
+	}.Build())
 	require.NoError(t, err)
-	outOfDateRollout.Status = &autoupdate.AutoUpdateAgentRolloutStatus{}
+	outOfDateRollout.SetStatus(&autoupdate.AutoUpdateAgentRolloutStatus{})
 
 	tests := []struct {
 		name            string
@@ -334,47 +334,47 @@ func TestReconciler_Reconcile(t *testing.T) {
 	ctx := context.Background()
 	clock := clockwork.NewFakeClock()
 	// Test setup: creating fixtures
-	config, err := update.NewAutoUpdateConfig(&autoupdate.AutoUpdateConfigSpec{
-		Tools: &autoupdate.AutoUpdateConfigSpecTools{
+	config, err := update.NewAutoUpdateConfig(autoupdate.AutoUpdateConfigSpec_builder{
+		Tools: autoupdate.AutoUpdateConfigSpecTools_builder{
 			Mode: update.ToolsUpdateModeEnabled,
-		},
-		Agents: &autoupdate.AutoUpdateConfigSpecAgents{
+		}.Build(),
+		Agents: autoupdate.AutoUpdateConfigSpecAgents_builder{
 			Mode:     update.AgentsUpdateModeEnabled,
 			Strategy: update.AgentsStrategyHaltOnError,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	version, err := update.NewAutoUpdateVersion(&autoupdate.AutoUpdateVersionSpec{
-		Tools: &autoupdate.AutoUpdateVersionSpecTools{
+	version, err := update.NewAutoUpdateVersion(autoupdate.AutoUpdateVersionSpec_builder{
+		Tools: autoupdate.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-		Agents: &autoupdate.AutoUpdateVersionSpecAgents{
+		}.Build(),
+		Agents: autoupdate.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "1.2.3",
 			TargetVersion: "1.2.4",
 			Schedule:      update.AgentsScheduleImmediate,
 			Mode:          update.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
-	upToDateRollout, err := update.NewAutoUpdateAgentRollout(&autoupdate.AutoUpdateAgentRolloutSpec{
+	upToDateRollout, err := update.NewAutoUpdateAgentRollout(autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "1.2.4",
 		Schedule:       update.AgentsScheduleImmediate,
 		AutoupdateMode: update.AgentsUpdateModeEnabled,
 		Strategy:       update.AgentsStrategyHaltOnError,
-	})
+	}.Build())
 	require.NoError(t, err)
-	upToDateRollout.Status = &autoupdate.AutoUpdateAgentRolloutStatus{StartTime: timestamppb.New(clock.Now())}
+	upToDateRollout.SetStatus(autoupdate.AutoUpdateAgentRolloutStatus_builder{StartTime: timestamppb.New(clock.Now())}.Build())
 
-	outOfDateRollout, err := update.NewAutoUpdateAgentRollout(&autoupdate.AutoUpdateAgentRolloutSpec{
+	outOfDateRollout, err := update.NewAutoUpdateAgentRollout(autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.2",
 		TargetVersion:  "1.2.3",
 		Schedule:       update.AgentsScheduleImmediate,
 		AutoupdateMode: update.AgentsUpdateModeEnabled,
 		Strategy:       update.AgentsStrategyHaltOnError,
-	})
+	}.Build())
 	require.NoError(t, err)
-	outOfDateRollout.Status = &autoupdate.AutoUpdateAgentRolloutStatus{}
+	outOfDateRollout.SetStatus(&autoupdate.AutoUpdateAgentRolloutStatus{})
 
 	// Those tests are not written in table format because the fixture setup it too complex and this would harm
 	// readability.
@@ -605,7 +605,7 @@ func Test_makeGroupsStatus(t *testing.T) {
 			name:      "nil schedules",
 			schedules: nil,
 			expected: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             defaultGroupName,
 					StartTime:        nil,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
@@ -613,14 +613,14 @@ func Test_makeGroupsStatus(t *testing.T) {
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       defaultUpdateDays,
 					ConfigStartHour:  defaultStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:      "no groups in schedule",
-			schedules: &autoupdate.AgentAutoUpdateSchedules{Regular: make([]*autoupdate.AgentAutoUpdateGroup, 0)},
+			schedules: autoupdate.AgentAutoUpdateSchedules_builder{Regular: make([]*autoupdate.AgentAutoUpdateGroup, 0)}.Build(),
 			expected: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             defaultGroupName,
 					StartTime:        nil,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
@@ -628,58 +628,58 @@ func Test_makeGroupsStatus(t *testing.T) {
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       defaultUpdateDays,
 					ConfigStartHour:  defaultStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "one group in schedule",
-			schedules: &autoupdate.AgentAutoUpdateSchedules{
+			schedules: autoupdate.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdate.AgentAutoUpdateGroup{
-					{
+					autoupdate.AgentAutoUpdateGroup_builder{
 						Name:      "group1",
 						Days:      everyWeekday,
 						StartHour: matchingStartHour,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expected: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             "group1",
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(now),
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       everyWeekday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "multiple groups in schedule",
-			schedules: &autoupdate.AgentAutoUpdateSchedules{
+			schedules: autoupdate.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdate.AgentAutoUpdateGroup{
-					{
+					autoupdate.AgentAutoUpdateGroup_builder{
 						Name:      "group1",
 						Days:      everyWeekday,
 						StartHour: matchingStartHour,
-					},
-					{
+					}.Build(),
+					autoupdate.AgentAutoUpdateGroup_builder{
 						Name:      "group2",
 						Days:      everyWeekdayButSunday,
 						StartHour: nonMatchingStartHour,
 						WaitHours: 1,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expected: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             "group1",
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(now),
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       everyWeekday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             "group2",
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(now),
@@ -687,7 +687,7 @@ func Test_makeGroupsStatus(t *testing.T) {
 					ConfigDays:       everyWeekdayButSunday,
 					ConfigStartHour:  nonMatchingStartHour,
 					ConfigWaitHours:  1,
-				},
+				}.Build(),
 			},
 		},
 	}
@@ -731,38 +731,38 @@ func Test_reconciler_computeStatus(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 	ctx := context.Background()
 
-	oldStatus := &autoupdate.AutoUpdateAgentRolloutStatus{
+	oldStatus := autoupdate.AutoUpdateAgentRolloutStatus_builder{
 		Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-			{
+			autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "old group",
 				State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
-			},
+			}.Build(),
 		},
 		State: autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSTARTED,
-	}
-	oldSpec := &autoupdate.AutoUpdateAgentRolloutSpec{
+	}.Build()
+	oldSpec := autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "1.2.4",
 		Schedule:       update.AgentsScheduleRegular,
 		AutoupdateMode: update.AgentsUpdateModeEnabled,
 		Strategy:       fakeRolloutStrategyName,
-	}
-	schedules := &autoupdate.AgentAutoUpdateSchedules{
+	}.Build()
+	schedules := autoupdate.AgentAutoUpdateSchedules_builder{
 		Regular: []*autoupdate.AgentAutoUpdateGroup{
-			{
+			autoupdate.AgentAutoUpdateGroup_builder{
 				Name: "new group",
 				Days: everyWeekday,
-			},
+			}.Build(),
 		},
-	}
+	}.Build()
 	r := reconciler{}
 	newGroups, err := r.makeGroupsStatus(ctx, schedules, clock.Now())
 	require.NoError(t, err)
-	newStatus := &autoupdate.AutoUpdateAgentRolloutStatus{
+	newStatus := autoupdate.AutoUpdateAgentRolloutStatus_builder{
 		Groups:    newGroups,
 		State:     autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSTARTED,
 		StartTime: timestamppb.New(clock.Now()),
-	}
+	}.Build()
 
 	tests := []struct {
 		name                  string
@@ -773,100 +773,100 @@ func Test_reconciler_computeStatus(t *testing.T) {
 	}{
 		{
 			name: "status is reset if start version changes",
-			existingRollout: &autoupdate.AutoUpdateAgentRollout{
+			existingRollout: autoupdate.AutoUpdateAgentRollout_builder{
 				Spec:   oldSpec,
 				Status: oldStatus,
-			},
-			newSpec: &autoupdate.AutoUpdateAgentRolloutSpec{
+			}.Build(),
+			newSpec: autoupdate.AutoUpdateAgentRolloutSpec_builder{
 				StartVersion:   "1.2.2",
 				TargetVersion:  "1.2.4",
 				Schedule:       update.AgentsScheduleRegular,
 				AutoupdateMode: update.AgentsUpdateModeEnabled,
 				Strategy:       fakeRolloutStrategyName,
-			},
+			}.Build(),
 			// status should have been reset and is now the new status
 			expectedStatus:        newStatus,
 			expectedStrategyCalls: 1,
 		},
 		{
 			name: "status is reset if target version changes",
-			existingRollout: &autoupdate.AutoUpdateAgentRollout{
+			existingRollout: autoupdate.AutoUpdateAgentRollout_builder{
 				Spec:   oldSpec,
 				Status: oldStatus,
-			},
-			newSpec: &autoupdate.AutoUpdateAgentRolloutSpec{
+			}.Build(),
+			newSpec: autoupdate.AutoUpdateAgentRolloutSpec_builder{
 				StartVersion:   "1.2.3",
 				TargetVersion:  "1.2.5",
 				Schedule:       update.AgentsScheduleRegular,
 				AutoupdateMode: update.AgentsUpdateModeEnabled,
 				Strategy:       fakeRolloutStrategyName,
-			},
+			}.Build(),
 			// status should have been reset and is now the new status
 			expectedStatus:        newStatus,
 			expectedStrategyCalls: 1,
 		},
 		{
 			name: "status is reset if strategy changes",
-			existingRollout: &autoupdate.AutoUpdateAgentRollout{
+			existingRollout: autoupdate.AutoUpdateAgentRollout_builder{
 				Spec:   oldSpec,
 				Status: oldStatus,
-			},
-			newSpec: &autoupdate.AutoUpdateAgentRolloutSpec{
+			}.Build(),
+			newSpec: autoupdate.AutoUpdateAgentRolloutSpec_builder{
 				StartVersion:   "1.2.3",
 				TargetVersion:  "1.2.4",
 				Schedule:       update.AgentsScheduleRegular,
 				AutoupdateMode: update.AgentsUpdateModeEnabled,
 				Strategy:       fakeRolloutStrategyName + "2",
-			},
+			}.Build(),
 			// status should have been reset and is now the new status
 			expectedStatus:        newStatus,
 			expectedStrategyCalls: 1,
 		},
 		{
 			name: "status is not reset if mode changes",
-			existingRollout: &autoupdate.AutoUpdateAgentRollout{
+			existingRollout: autoupdate.AutoUpdateAgentRollout_builder{
 				Spec:   oldSpec,
 				Status: oldStatus,
-			},
-			newSpec: &autoupdate.AutoUpdateAgentRolloutSpec{
+			}.Build(),
+			newSpec: autoupdate.AutoUpdateAgentRolloutSpec_builder{
 				StartVersion:   "1.2.3",
 				TargetVersion:  "1.2.4",
 				Schedule:       update.AgentsScheduleRegular,
 				AutoupdateMode: update.AgentsUpdateModeSuspended,
 				Strategy:       fakeRolloutStrategyName,
-			},
+			}.Build(),
 			// status should NOT have been reset and still contain the old groups
 			expectedStatus:        oldStatus,
 			expectedStrategyCalls: 1,
 		},
 		{
 			name: "groups are unset if schedule is immediate",
-			existingRollout: &autoupdate.AutoUpdateAgentRollout{
+			existingRollout: autoupdate.AutoUpdateAgentRollout_builder{
 				Spec:   oldSpec,
 				Status: oldStatus,
-			},
-			newSpec: &autoupdate.AutoUpdateAgentRolloutSpec{
+			}.Build(),
+			newSpec: autoupdate.AutoUpdateAgentRolloutSpec_builder{
 				StartVersion:   "1.2.3",
 				TargetVersion:  "1.2.4",
 				Schedule:       update.AgentsScheduleImmediate,
 				AutoupdateMode: update.AgentsUpdateModeEnabled,
 				Strategy:       fakeRolloutStrategyName,
-			},
+			}.Build(),
 			// groups should be unset
-			expectedStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+			expectedStatus: autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				StartTime: timestamppb.New(clock.Now()),
-			},
+			}.Build(),
 			expectedStrategyCalls: 0,
 		},
 		{
 			name: "new groups are populated if previous ones were empty",
-			existingRollout: &autoupdate.AutoUpdateAgentRollout{
+			existingRollout: autoupdate.AutoUpdateAgentRollout_builder{
 				Spec: oldSpec,
 				// old groups were empty
-				Status: &autoupdate.AutoUpdateAgentRolloutStatus{
+				Status: autoupdate.AutoUpdateAgentRolloutStatus_builder{
 					StartTime: timestamppb.New(clock.Now()),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			// no spec change
 			newSpec: oldSpec,
 			// still, we have the new groups set
@@ -876,7 +876,7 @@ func Test_reconciler_computeStatus(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			strategy := &fakeRolloutStrategy{strategyName: tt.newSpec.Strategy}
+			strategy := &fakeRolloutStrategy{strategyName: tt.newSpec.GetStrategy()}
 			r := &reconciler{
 				log:               log,
 				clock:             clock,
@@ -933,12 +933,12 @@ func TestDefaultConfigGroup(t *testing.T) {
 					},
 				}, nil,
 			},
-			expectedResult: &autoupdate.AgentAutoUpdateGroup{
+			expectedResult: autoupdate.AgentAutoUpdateGroup_builder{
 				Name:      defaultCMCGroupName,
 				Days:      []string{"*"},
 				StartHour: int32(testStartHour),
 				WaitHours: 0,
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
@@ -953,12 +953,12 @@ func TestDefaultConfigGroup(t *testing.T) {
 					},
 				}, nil,
 			},
-			expectedResult: &autoupdate.AgentAutoUpdateGroup{
+			expectedResult: autoupdate.AgentAutoUpdateGroup_builder{
 				Name:      defaultCMCGroupName,
 				Days:      everyWeekdayButSunday,
 				StartHour: int32(testStartHour),
 				WaitHours: 0,
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
diff --git a/lib/autoupdate/rollout/strategy.go b/lib/autoupdate/rollout/strategy.go
index 1bcfe90d4a5..b5fd348482f 100644
--- a/lib/autoupdate/rollout/strategy.go
+++ b/lib/autoupdate/rollout/strategy.go
@@ -48,7 +48,7 @@ type rolloutStrategy interface {
 // inWindow checks if the time is in the group's maintenance window.
 // The maintenance window is the semi-open interval: [windowStart, windowEnd).
 func inWindow(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time, duration time.Duration) (bool, error) {
-	dayOK, err := canUpdateToday(group.ConfigDays, now)
+	dayOK, err := canUpdateToday(group.GetConfigDays(), now)
 	if err != nil {
 		return false, trace.Wrap(err, "checking the day of the week")
 	}
@@ -57,7 +57,7 @@ func inWindow(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time
 	}
 
 	// We compute the theoretical window start and end
-	windowStart := now.Truncate(24 * time.Hour).Add(time.Duration(group.ConfigStartHour) * time.Hour)
+	windowStart := now.Truncate(24 * time.Hour).Add(time.Duration(group.GetConfigStartHour()) * time.Hour)
 	windowEnd := windowStart.Add(duration)
 
 	return !now.Before(windowStart) && now.Before(windowEnd), nil
@@ -91,30 +91,30 @@ func canUpdateToday(allowedDays []string, now time.Time) (bool, error) {
 
 func setGroupState(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, newState autoupdate.AutoUpdateAgentGroupState, reason string, now time.Time) {
 	changed := false
-	previousState := group.State
+	previousState := group.GetState()
 
 	// Check if there is a state transition
 	if previousState != newState {
-		group.State = newState
+		group.SetState(newState)
 		changed = true
 		// If we just started the group, also update the start time.
 		// If we are doing a canary -> active transition, we don't override the start date.
 		if (newState == autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE &&
 			previousState != autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY) ||
 			newState == autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY {
-			group.StartTime = timestamppb.New(now)
+			group.SetStartTime(timestamppb.New(now))
 		}
 	}
 
 	// Check if there is a reason change. Even if the state did not change, we
 	// might want to explain why.
-	if group.LastUpdateReason != reason {
-		group.LastUpdateReason = reason
+	if group.GetLastUpdateReason() != reason {
+		group.SetLastUpdateReason(reason)
 		changed = true
 	}
 
 	if changed {
-		group.LastUpdateTime = timestamppb.New(now)
+		group.SetLastUpdateTime(timestamppb.New(now))
 	}
 }
 
@@ -128,7 +128,7 @@ func computeRolloutState(groups []*autoupdate.AutoUpdateAgentRolloutStatusGroup)
 	var doneGroups, unstartedGroups int
 
 	for _, group := range groups {
-		switch group.State {
+		switch group.GetState() {
 		// If one or more groups have been rolled back, we consider the rollout rolledback
 		case autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK:
 			return autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ROLLEDBACK
diff --git a/lib/autoupdate/rollout/strategy_haltonerror.go b/lib/autoupdate/rollout/strategy_haltonerror.go
index 5741bdfe461..cb2c988abc8 100644
--- a/lib/autoupdate/rollout/strategy_haltonerror.go
+++ b/lib/autoupdate/rollout/strategy_haltonerror.go
@@ -84,59 +84,59 @@ func (h *haltOnErrorStrategy) progressRollout(ctx context.Context, spec *autoupd
 	// to transition "staging" to DONE.
 	previousGroupsAreDone := true
 
-	for i, group := range status.Groups {
+	for i, group := range status.GetGroups() {
 		var agentCount, agentUpToDateCount int
-		if i == len(status.Groups)-1 {
+		if i == len(status.GetGroups())-1 {
 			agentCount, agentUpToDateCount = countCatchAll(status, countByGroup, upToDateByGroup)
 		} else {
 			agentCount = countByGroup[group.GetName()]
 			agentUpToDateCount = upToDateByGroup[group.GetName()]
 		}
 
-		group.PresentCount = uint64(agentCount)
-		group.UpToDateCount = uint64(agentUpToDateCount)
+		group.SetPresentCount(uint64(agentCount))
+		group.SetUpToDateCount(uint64(agentUpToDateCount))
 
-		switch group.State {
+		switch group.GetState() {
 		case autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED:
 			var previousGroup *autoupdate.AutoUpdateAgentRolloutStatusGroup
 			if i != 0 {
-				previousGroup = status.Groups[i-1]
+				previousGroup = status.GetGroups()[i-1]
 			}
 			canStart, err := canStartHaltOnError(group, previousGroup, now)
 			if err != nil {
 				// In halt-on-error rollouts, groups are dependent.
 				// Failing to transition a group should prevent other groups from transitioning.
-				setGroupState(group, group.State, updateReasonReconcilerError, now)
+				setGroupState(group, group.GetState(), updateReasonReconcilerError, now)
 				return err
 			}
 
 			// Check if the rollout got created after the theoretical group start time
-			rolloutChangedDuringWindow, err := rolloutChangedInWindow(group, now, status.StartTime.AsTime(), haltOnErrorWindowDuration)
+			rolloutChangedDuringWindow, err := rolloutChangedInWindow(group, now, status.GetStartTime().AsTime(), haltOnErrorWindowDuration)
 			if err != nil {
-				setGroupState(group, group.State, updateReasonReconcilerError, now)
+				setGroupState(group, group.GetState(), updateReasonReconcilerError, now)
 				return err
 			}
 
 			switch {
 			case !previousGroupsAreDone:
 				// All previous groups are not DONE
-				setGroupState(group, group.State, updateReasonPreviousGroupsNotDone, now)
+				setGroupState(group, group.GetState(), updateReasonPreviousGroupsNotDone, now)
 			case !canStart:
 				// All previous groups are DONE, but time-related criteria are not met
 				// This can be because we are outside an update window, or because the
 				// specified wait_hours doesn't let us update yet.
-				setGroupState(group, group.State, updateReasonCannotStart, now)
+				setGroupState(group, group.GetState(), updateReasonCannotStart, now)
 			case rolloutChangedDuringWindow:
 				// All previous groups are DONE and time-related criteria are met.
 				// However, the rollout changed during the maintenance window.
-				setGroupState(group, group.State, updateReasonRolloutChanged, now)
+				setGroupState(group, group.GetState(), updateReasonRolloutChanged, now)
 			default:
 				// All previous groups are DONE and time-related criteria are met.
 				// We can start.
 
 				// We pass the list of groups to the sampler because it must compute the catch-call group
-				groups := make([]string, len(status.Groups))
-				for j, g := range status.Groups {
+				groups := make([]string, len(status.GetGroups()))
+				for j, g := range status.GetGroups() {
 					groups[j] = g.GetName()
 				}
 				h.startGroup(ctx, group, now, agentCount, status)
@@ -155,12 +155,12 @@ func (h *haltOnErrorStrategy) progressRollout(ctx context.Context, spec *autoupd
 			successfulCanaries := h.updateCanariesStatus(ctx, group, *targetVersion)
 
 			// If all canaries are OK, we can transition to the active state
-			if successfulCanaries == int(group.CanaryCount) {
-				h.log.DebugContext(ctx, "All canaries came back alive, transitioning to the active state", "group", group, "got", successfulCanaries, "want", int(group.CanaryCount))
+			if successfulCanaries == int(group.GetCanaryCount()) {
+				h.log.DebugContext(ctx, "All canaries came back alive, transitioning to the active state", "group", group, "got", successfulCanaries, "want", int(group.GetCanaryCount()))
 				setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE, updateReasonCanariesAlive, now)
 			} else {
-				h.log.DebugContext(ctx, "Not all canaries came back yet, staying into canary state", "group", group, "got", successfulCanaries, "want", int(group.CanaryCount))
-				setGroupState(group, group.State, updateReasonWaitingForCanaries, now)
+				h.log.DebugContext(ctx, "Not all canaries came back yet, staying into canary state", "group", group, "got", successfulCanaries, "want", int(group.GetCanaryCount()))
+				setGroupState(group, group.GetState(), updateReasonWaitingForCanaries, now)
 
 			}
 			previousGroupsAreDone = false
@@ -183,7 +183,7 @@ func (h *haltOnErrorStrategy) progressRollout(ctx context.Context, spec *autoupd
 			}
 
 		default:
-			return trace.BadParameter("unknown autoupdate group state: %v", group.State)
+			return trace.BadParameter("unknown autoupdate group state: %v", group.GetState())
 		}
 	}
 	return nil
@@ -192,14 +192,14 @@ func (h *haltOnErrorStrategy) progressRollout(ctx context.Context, spec *autoupd
 func shouldUseCanaries(group *autoupdate.AutoUpdateAgentRolloutStatusGroup) bool {
 	// in the future we might change this logic to be a multiple of the required canary count
 	// and make the canary count dynamic
-	return group.CanaryCount > 0
+	return group.GetCanaryCount() > 0
 }
 
 func (h *haltOnErrorStrategy) startGroup(ctx context.Context, group *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time, agentCount int, status *autoupdate.AutoUpdateAgentRolloutStatus) {
-	group.InitialCount = uint64(agentCount)
+	group.SetInitialCount(uint64(agentCount))
 
 	if !shouldUseCanaries(group) {
-		h.log.DebugContext(ctx, "Skipping canary rollout, transitioning directly to the active state", "group", group.Name)
+		h.log.DebugContext(ctx, "Skipping canary rollout, transitioning directly to the active state", "group", group.GetName())
 		setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE, updateReasonCanStart, now)
 		return
 	}
@@ -208,31 +208,31 @@ func (h *haltOnErrorStrategy) startGroup(ctx context.Context, group *autoupdate.
 	// This is a small optimization, as we just transitioned into the canary state we can sample canaries.
 	// This will allow us to start updating without having to wait for the next reconciliation cycle.
 	if err := h.sampleCanaries(ctx, group, status); err != nil {
-		h.log.WarnContext(ctx, "Failed to sample canaries", "group", group.Name)
+		h.log.WarnContext(ctx, "Failed to sample canaries", "group", group.GetName())
 	}
 }
 
 func (h *haltOnErrorStrategy) sampleCanaries(ctx context.Context, group *autoupdate.AutoUpdateAgentRolloutStatusGroup, status *autoupdate.AutoUpdateAgentRolloutStatus) error {
 	// Check if we need to pick more canaries
-	if len(group.Canaries) < int(group.CanaryCount) {
-		previousLength := len(group.Canaries)
-		h.log.DebugContext(ctx, "Group is missing canaries, sampling some more", "group", group, "got", previousLength, "want", int(group.CanaryCount))
+	if len(group.GetCanaries()) < int(group.GetCanaryCount()) {
+		previousLength := len(group.GetCanaries())
+		h.log.DebugContext(ctx, "Group is missing canaries, sampling some more", "group", group, "got", previousLength, "want", int(group.GetCanaryCount()))
 
 		// We pass the list of groups to the sampler because it must compute the catch-all group.
-		groups := make([]string, len(status.Groups))
-		for j, g := range status.Groups {
+		groups := make([]string, len(status.GetGroups()))
+		for j, g := range status.GetGroups() {
 			groups[j] = g.GetName()
 		}
 		// We sample as many canaries as possible instead of just the missing ones
 		// Because we might sample an already sampled canary.
-		additionalCanaries, err := h.clt.SampleAgentsFromAutoUpdateGroup(ctx, group.Name, int(group.CanaryCount), groups)
+		additionalCanaries, err := h.clt.SampleAgentsFromAutoUpdateGroup(ctx, group.GetName(), int(group.GetCanaryCount()), groups)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 		injectCanaries(group, additionalCanaries)
-		h.log.DebugContext(ctx, "Additional canaries sampled", "group", group, "before", previousLength, "after", len(group.Canaries))
+		h.log.DebugContext(ctx, "Additional canaries sampled", "group", group, "before", previousLength, "after", len(group.GetCanaries()))
 	} else {
-		h.log.DebugContext(ctx, "Canaries already sampled", "group", group.Name, "got", len(group.Canaries))
+		h.log.DebugContext(ctx, "Canaries already sampled", "group", group.GetName(), "got", len(group.GetCanaries()))
 	}
 	return nil
 }
@@ -241,8 +241,8 @@ func injectCanaries(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, additio
 	for _, canary := range additionalCanaries {
 		// We first check if the canary has already been sampled
 		alreadySampled := false
-		for _, existingCanary := range group.Canaries {
-			if existingCanary.UpdaterId == canary.UpdaterId {
+		for _, existingCanary := range group.GetCanaries() {
+			if existingCanary.GetUpdaterId() == canary.GetUpdaterId() {
 				alreadySampled = true
 				break
 			}
@@ -250,31 +250,31 @@ func injectCanaries(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, additio
 
 		// If it was not, great, we have a new canary.
 		if !alreadySampled {
-			group.Canaries = append(group.Canaries, canary)
+			group.SetCanaries(append(group.GetCanaries(), canary))
 		}
 
 		// Stop adding canaries once we have the right amount
-		if len(group.Canaries) == int(group.CanaryCount) {
+		if len(group.GetCanaries()) == int(group.GetCanaryCount()) {
 			return
 		}
 	}
 }
 
 func (h *haltOnErrorStrategy) updateCanariesStatus(ctx context.Context, group *autoupdate.AutoUpdateAgentRolloutStatusGroup, targetVersion semver.Version) int {
-	h.log.DebugContext(ctx, "Checking canaries", "group", group.Name)
+	h.log.DebugContext(ctx, "Checking canaries", "group", group.GetName())
 	var successfulCanaries int
-	for _, canary := range group.Canaries {
+	for _, canary := range group.GetCanaries() {
 		// If the canary already came back healthy, nothing to do
-		if canary.Success {
+		if canary.GetSuccess() {
 			successfulCanaries++
 			continue
 		}
 
-		canaryLogInfo := slog.Group("canary", "host_id", canary.HostId, "updater_id", canary.UpdaterId, "hostname", canary.Hostname)
-		log := h.log.With(canaryLogInfo).With("group", group.Name)
+		canaryLogInfo := slog.Group("canary", "host_id", canary.GetHostId(), "updater_id", canary.GetUpdaterId(), "hostname", canary.GetHostname())
+		log := h.log.With(canaryLogInfo).With("group", group.GetName())
 
 		// Check if the canary is connected to our auth
-		hellos, err := h.clt.LookupAgentInInventory(ctx, canary.HostId)
+		hellos, err := h.clt.LookupAgentInInventory(ctx, canary.GetHostId())
 		if err != nil {
 			if trace.IsNotFound(err) {
 				// Canary is not registered to our Auth Service.
@@ -288,7 +288,7 @@ func (h *haltOnErrorStrategy) updateCanariesStatus(ctx context.Context, group *a
 		}
 
 		if canaryIsRunningTargetVersion(ctx, hellos, targetVersion, log) {
-			canary.Success = true
+			canary.SetSuccess(true)
 			successfulCanaries++
 		}
 	}
@@ -299,9 +299,9 @@ func (h *haltOnErrorStrategy) updateCanariesStatus(ctx context.Context, group *a
 // the canary is running the target version.
 func canaryIsRunningTargetVersion(ctx context.Context, hellos []*proto.UpstreamInventoryHello, targetVersion semver.Version, log *slog.Logger) bool {
 	for _, hello := range hellos {
-		canaryVersion, err := version.EnsureSemver(hello.Version)
+		canaryVersion, err := version.EnsureSemver(hello.GetVersion())
 		if err != nil {
-			log.WarnContext(ctx, "Failed to parse canary version", "err", err, "current_version", hello.Version)
+			log.WarnContext(ctx, "Failed to parse canary version", "err", err, "current_version", hello.GetVersion())
 			continue
 		}
 		if !targetVersion.Equal(*canaryVersion) {
@@ -316,18 +316,18 @@ func canaryIsRunningTargetVersion(ctx context.Context, hellos []*proto.UpstreamI
 
 func canStartHaltOnError(group, previousGroup *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time) (bool, error) {
 	// check wait hours
-	if group.ConfigWaitHours != 0 {
+	if group.GetConfigWaitHours() != 0 {
 		if previousGroup == nil {
 			return false, trace.BadParameter("the first group cannot have non-zero wait hours")
 		}
 
-		previousStart := previousGroup.StartTime.AsTime()
+		previousStart := previousGroup.GetStartTime().AsTime()
 		if previousStart.IsZero() || previousStart.Unix() == 0 {
 			return false, trace.BadParameter("the previous group doesn't have a start time, cannot check the 'wait_hours' criterion")
 		}
 
 		// Check if the wait_hours criterion is OK, if we are at least after 'wait_hours' hours since the previous start.
-		if now.Before(previousGroup.StartTime.AsTime().Add(time.Duration(group.ConfigWaitHours) * time.Hour)) {
+		if now.Before(previousGroup.GetStartTime().AsTime().Add(time.Duration(group.GetConfigWaitHours()) * time.Hour)) {
 			return false, nil
 		}
 	}
@@ -344,14 +344,14 @@ const (
 
 func isDoneHaltOnError(group *autoupdate.AutoUpdateAgentRolloutStatusGroup, now time.Time) (bool, string) {
 	switch {
-	case group.InitialCount == 0:
+	case group.GetInitialCount() == 0:
 		// Currently we don't implement status reporting from groups/agents.
 		// So we just wait 60 minutes and consider the maintenance done.
-		if group.StartTime.AsTime().Add(haltOnErrorWindowDuration).Before(now) {
+		if group.GetStartTime().AsTime().Add(haltOnErrorWindowDuration).Before(now) {
 			return true, updateReasonUpdateComplete
 		}
 		return false, updateReasonUpdateInProgress
-	case float64(group.PresentCount)/float64(group.InitialCount) >= doneThreshold && float64(group.UpToDateCount)/float64(group.PresentCount) >= doneThreshold:
+	case float64(group.GetPresentCount())/float64(group.GetInitialCount()) >= doneThreshold && float64(group.GetUpToDateCount())/float64(group.GetPresentCount()) >= doneThreshold:
 		return true, updateReasonUpdateComplete
 	default:
 		return false, updateReasonUpdateInProgress
diff --git a/lib/autoupdate/rollout/strategy_haltonerror_test.go b/lib/autoupdate/rollout/strategy_haltonerror_test.go
index 8b7e9ecf284..37b9bcba8f3 100644
--- a/lib/autoupdate/rollout/strategy_haltonerror_test.go
+++ b/lib/autoupdate/rollout/strategy_haltonerror_test.go
@@ -52,80 +52,80 @@ func Test_canStartHaltOnError(t *testing.T) {
 	}{
 		{
 			name: "first group, no wait_hours",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "test-group",
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 0,
-			},
+			}.Build(),
 			want:    true,
 			wantErr: require.NoError,
 		},
 		{
 			name: "first group, wait_days (invalid)",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "test-group",
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 1,
-			},
+			}.Build(),
 			want:    false,
 			wantErr: require.Error,
 		},
 		{
 			name: "second group, no wait_days",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "test-group",
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 0,
-			},
-			previousGroup: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			}.Build(),
+			previousGroup: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "previous-group",
 				StartTime:       timestamppb.New(now),
 				State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 0,
-			},
+			}.Build(),
 			want:    true,
 			wantErr: require.NoError,
 		},
 		{
 			name: "second group, wait_days not over",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "test-group",
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 48,
-			},
-			previousGroup: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			}.Build(),
+			previousGroup: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "previous-group",
 				StartTime:       timestamppb.New(yesterday),
 				State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 0,
-			},
+			}.Build(),
 			want:    false,
 			wantErr: require.NoError,
 		},
 		{
 			name: "second group, wait_days over",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "test-group",
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 24,
-			},
-			previousGroup: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			}.Build(),
+			previousGroup: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:            "previous-group",
 				StartTime:       timestamppb.New(yesterday),
 				State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: int32(now.Hour()),
 				ConfigWaitHours: 0,
-			},
+			}.Build(),
 			want:    true,
 			wantErr: require.NoError,
 		},
@@ -159,74 +159,74 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 	group3Name := "group3"
 
 	testReports := []*autoupdate.AutoUpdateAgentReport{
-		{
-			Metadata: &headerv1.Metadata{Name: "auth1"},
-			Spec: &autoupdate.AutoUpdateAgentReportSpec{
+		autoupdate.AutoUpdateAgentReport_builder{
+			Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+			Spec: autoupdate.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(fewSecondsAgo),
 				Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
-					group1Name: {
+					group1Name: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 4},
-							targetVersion: {Count: 5},
-							otherVersion:  {Count: 1},
+							startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 4}.Build(),
+							targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+							otherVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					group2Name: {
+					}.Build(),
+					group2Name: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 3},
-							targetVersion: {Count: 5},
+							startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 3}.Build(),
+							targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-		},
-		{
+			}.Build(),
+		}.Build(),
+		autoupdate.AutoUpdateAgentReport_builder{
 			// This report is expired, it must be ignored
-			Metadata: &headerv1.Metadata{Name: "auth2"},
-			Spec: &autoupdate.AutoUpdateAgentReportSpec{
+			Metadata: headerv1.Metadata_builder{Name: "auth2"}.Build(),
+			Spec: autoupdate.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(fewMinutesAgo),
 				Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
-					group1Name: {
+					group1Name: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 123},
-							targetVersion: {Count: 123},
-							otherVersion:  {Count: 123},
+							startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+							targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+							otherVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
 						},
-					},
-					group2Name: {
+					}.Build(),
+					group2Name: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 123},
-							targetVersion: {Count: 123},
+							startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+							targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	// canaryTestReports contain more agents, so it triggers the canary logic
 	canaryTestReports := []*autoupdate.AutoUpdateAgentReport{
-		{
-			Metadata: &headerv1.Metadata{Name: "auth1"},
-			Spec: &autoupdate.AutoUpdateAgentReportSpec{
+		autoupdate.AutoUpdateAgentReport_builder{
+			Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+			Spec: autoupdate.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(fewSecondsAgo),
 				Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
-					group1Name: {
+					group1Name: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 20},
-							targetVersion: {Count: 5},
-							otherVersion:  {Count: 1},
+							startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 20}.Build(),
+							targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+							otherVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					group2Name: {
+					}.Build(),
+					group2Name: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 3},
-							targetVersion: {Count: 5},
+							startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 3}.Build(),
+							targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	var (
@@ -237,18 +237,18 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 		updaterId := uuid.NewString()
 		hostID := uuid.NewString()
 		hostName := fmt.Sprintf("canary-%d", i)
-		testCanaries = append(testCanaries, &autoupdate.Canary{
+		testCanaries = append(testCanaries, autoupdate.Canary_builder{
 			UpdaterId: updaterId,
 			HostId:    hostID,
 			Hostname:  hostName,
 			Success:   false,
-		})
-		healthyTestCanaries = append(healthyTestCanaries, &autoupdate.Canary{
+		}.Build())
+		healthyTestCanaries = append(healthyTestCanaries, autoupdate.Canary_builder{
 			UpdaterId: updaterId,
 			HostId:    hostID,
 			Hostname:  hostName,
 			Success:   true,
-		})
+		}.Build())
 	}
 
 	testCanariesLookupNotFound := make(map[string][]callAnswer[[]*proto.UpstreamInventoryHello])
@@ -257,54 +257,54 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 	testCanariesLookupTargetVersionDualHandles := make(map[string][]callAnswer[[]*proto.UpstreamInventoryHello])
 
 	for _, canary := range testCanaries {
-		testCanariesLookupNotFound[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+		testCanariesLookupNotFound[canary.GetHostId()] = []callAnswer[[]*proto.UpstreamInventoryHello]{
 			{err: trace.NotFound("handle not found")},
 		}
-		testCanariesLookupStartVersion[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+		testCanariesLookupStartVersion[canary.GetHostId()] = []callAnswer[[]*proto.UpstreamInventoryHello]{
 			{
 				result: []*proto.UpstreamInventoryHello{
-					{
+					proto.UpstreamInventoryHello_builder{
 						Version:                 startVersion,
-						ServerID:                canary.HostId,
-						Hostname:                canary.Hostname,
+						ServerID:                canary.GetHostId(),
+						Hostname:                canary.GetHostname(),
 						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
 						ExternalUpgraderVersion: startVersion,
-					},
+					}.Build(),
 				},
 				err: nil,
 			},
 		}
-		testCanariesLookupTargetVersion[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+		testCanariesLookupTargetVersion[canary.GetHostId()] = []callAnswer[[]*proto.UpstreamInventoryHello]{
 			{
 				result: []*proto.UpstreamInventoryHello{
-					{
+					proto.UpstreamInventoryHello_builder{
 						Version:                 targetVersion,
-						ServerID:                canary.HostId,
-						Hostname:                canary.Hostname,
+						ServerID:                canary.GetHostId(),
+						Hostname:                canary.GetHostname(),
 						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
 						ExternalUpgraderVersion: targetVersion,
-					},
+					}.Build(),
 				},
 				err: nil,
 			},
 		}
-		testCanariesLookupTargetVersionDualHandles[canary.HostId] = []callAnswer[[]*proto.UpstreamInventoryHello]{
+		testCanariesLookupTargetVersionDualHandles[canary.GetHostId()] = []callAnswer[[]*proto.UpstreamInventoryHello]{
 			{
 				result: []*proto.UpstreamInventoryHello{
-					{
+					proto.UpstreamInventoryHello_builder{
 						Version:                 startVersion,
-						ServerID:                canary.HostId,
-						Hostname:                canary.Hostname,
+						ServerID:                canary.GetHostId(),
+						Hostname:                canary.GetHostname(),
 						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
 						ExternalUpgraderVersion: startVersion,
-					},
-					{
+					}.Build(),
+					proto.UpstreamInventoryHello_builder{
 						Version:                 targetVersion,
-						ServerID:                canary.HostId,
-						Hostname:                canary.Hostname,
+						ServerID:                canary.GetHostId(),
+						Hostname:                canary.GetHostname(),
 						ExternalUpgrader:        types.UpgraderKindTeleportUpdate,
 						ExternalUpgraderVersion: targetVersion,
-					},
+					}.Build(),
 				},
 				err: nil,
 			},
@@ -323,64 +323,64 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 		{
 			name: "single group unstarted -> unstarted",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
 					LastUpdateReason: updateReasonCannotStart,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group unstarted -> unstarted because rollout changed in window",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			rolloutStartTime: timestamppb.New(clock.Now()),
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
 					LastUpdateReason: updateReasonRolloutChanged,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group unstarted -> active",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -388,13 +388,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonCanStart,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group active -> active",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(fewMinutesAgo),
@@ -402,10 +402,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonCanStart,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(fewMinutesAgo),
@@ -413,13 +413,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateInProgress,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group active -> done",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(yesterday),
@@ -427,10 +427,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateInProgress,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -438,13 +438,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateComplete,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group done -> done",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -452,10 +452,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateComplete,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -463,13 +463,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateComplete,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group rolledback -> rolledback",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					StartTime:        timestamppb.New(yesterday),
@@ -477,10 +477,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: "manual_rollback",
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					StartTime:        timestamppb.New(yesterday),
@@ -488,13 +488,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: "manual_rollback",
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "first group done, second should activate, third should not progress",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -502,8 +502,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateComplete,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -511,8 +511,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  24,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group3Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -520,10 +520,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -531,8 +531,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: updateReasonUpdateComplete,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -541,8 +541,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  24,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group3Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -550,13 +550,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "first group rolledback, second should not start",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					StartTime:        timestamppb.New(yesterday),
@@ -564,8 +564,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: "manual_rollback",
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -573,10 +573,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  24,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					StartTime:        timestamppb.New(yesterday),
@@ -584,8 +584,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: "manual_rollback",
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -593,13 +593,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  24,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "first group rolledback, second is active and should become done, third should not progress",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					StartTime:        timestamppb.New(yesterday),
@@ -607,8 +607,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: "manual_rollback",
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(yesterday),
@@ -617,8 +617,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group3Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -626,10 +626,10 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					StartTime:        timestamppb.New(yesterday),
@@ -637,8 +637,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					LastUpdateReason: "manual_rollback",
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -647,8 +647,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group3Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -656,24 +656,24 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group unstarted -> unstarted with reports",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			reports: testReports,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -683,13 +683,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					// Group1 is the catch-all group, so it should count group2 agents
 					PresentCount:  18,
 					UpToDateCount: 10,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group active -> active with reports",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(fewMinutesAgo),
@@ -700,11 +700,11 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					InitialCount:     25,
 					UpToDateCount:    0,
 					PresentCount:     10,
-				},
+				}.Build(),
 			},
 			reports: testReports,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(fewMinutesAgo),
@@ -717,13 +717,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					// InitialCount must not be changed during active -> active transitions
 					InitialCount: 25,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group unstarted -> active with reports",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -732,11 +732,11 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigStartHour:  matchingStartHour,
 					PresentCount:     12,
 					UpToDateCount:    3,
-				},
+				}.Build(),
 			},
 			reports: testReports,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -748,13 +748,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					InitialCount:  18,
 					PresentCount:  18,
 					UpToDateCount: 10,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "first group done, second should activate, third should not progress, with reports",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -765,8 +765,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					InitialCount:     10,
 					PresentCount:     8,
 					UpToDateCount:    5,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -776,8 +776,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigWaitHours:  24,
 					PresentCount:     2,
 					UpToDateCount:    2,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group3Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -785,11 +785,11 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
+				}.Build(),
 			},
 			reports: testReports,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        timestamppb.New(yesterday),
@@ -800,8 +800,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					InitialCount:     10,
 					PresentCount:     10,
 					UpToDateCount:    5,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group2Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -813,8 +813,8 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					InitialCount:     8,
 					PresentCount:     8,
 					UpToDateCount:    5,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group3Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -822,13 +822,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
 					ConfigWaitHours:  0,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group unstarted -> canary, no canaries sampled",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(yesterday),
@@ -838,12 +838,12 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					PresentCount:     12,
 					UpToDateCount:    3,
 					CanaryCount:      5,
-				},
+				}.Build(),
 			},
 			reports:       canaryTestReports,
 			canarySamples: []callAnswer[[]*autoupdate.Canary]{{}},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -856,13 +856,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					PresentCount:  34,
 					UpToDateCount: 10,
 					CanaryCount:   5,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group canary -> canary, sampling agents, agents not found",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -874,13 +874,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					PresentCount:  34,
 					UpToDateCount: 10,
 					CanaryCount:   5,
-				},
+				}.Build(),
 			},
 			reports:       canaryTestReports,
 			canarySamples: mockResponseForCanaries(testCanaries[:5]),
 			agentLookups:  testCanariesLookupNotFound,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -893,13 +893,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      testCanaries[:5],
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group canary -> canary, sampling agents, agents running old version",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -911,13 +911,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					PresentCount:  34,
 					UpToDateCount: 10,
 					CanaryCount:   5,
-				},
+				}.Build(),
 			},
 			reports:       canaryTestReports,
 			canarySamples: mockResponseForCanaries(testCanaries[:5]),
 			agentLookups:  testCanariesLookupStartVersion,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -930,13 +930,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      testCanaries[:5],
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group canary -> active, sampling agents, agents running target version",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -949,13 +949,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					PresentCount:  34,
 					UpToDateCount: 10,
 					CanaryCount:   5,
-				},
+				}.Build(),
 			},
 			reports:       canaryTestReports,
 			canarySamples: mockResponseForCanaries(testCanaries[:5]),
 			agentLookups:  testCanariesLookupTargetVersion,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -969,13 +969,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      healthyTestCanaries[:5],
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group canary -> active, already sampled agents, agents running target version",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -989,13 +989,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      testCanaries[:5],
-				},
+				}.Build(),
 			},
 			reports: canaryTestReports,
 			// no canarySamples set, we don't expect a sampling call
 			agentLookups: testCanariesLookupTargetVersion,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -1009,13 +1009,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      healthyTestCanaries[:5],
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group canary -> canary, incomplete sampled agents, agents running start version",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -1029,13 +1029,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					CanaryCount:   5,
 					// Only 2 canaries
 					Canaries: testCanaries[8:10],
-				},
+				}.Build(),
 			},
 			reports:       canaryTestReports,
 			canarySamples: mockResponseForCanaries(testCanaries[:5]),
 			agentLookups:  testCanariesLookupStartVersion,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -1049,13 +1049,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					CanaryCount:   5,
 					// We expect the 2 initial agents to stay here, and 3 additional agents
 					Canaries: append(testCanaries[8:10], testCanaries[0:3]...),
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "single group canary -> active, already sampled agents, agents running target version, several handles",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -1069,13 +1069,13 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      testCanaries[:5],
-				},
+				}.Build(),
 			},
 			reports: canaryTestReports,
 			// no canarySamples set, we don't expect a sampling call
 			agentLookups: testCanariesLookupTargetVersionDualHandles,
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             group1Name,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -1089,21 +1089,21 @@ func Test_progressGroupsHaltOnError(t *testing.T) {
 					UpToDateCount: 10,
 					CanaryCount:   5,
 					Canaries:      healthyTestCanaries[:5],
-				},
+				}.Build(),
 			},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			status := &autoupdate.AutoUpdateAgentRolloutStatus{
+			status := autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				Groups:    tt.initialState,
 				State:     0,
 				StartTime: tt.rolloutStartTime,
-			}
-			spec := &autoupdate.AutoUpdateAgentRolloutSpec{
+			}.Build()
+			spec := autoupdate.AutoUpdateAgentRolloutSpec_builder{
 				StartVersion:  startVersion,
 				TargetVersion: targetVersion,
-			}
+			}.Build()
 
 			stubs := mockClientStubs{
 				agentSamples:          tt.canarySamples,
@@ -1159,44 +1159,44 @@ func TestCountCatchAll(t *testing.T) {
 	}{
 		{
 			name: "all group hit",
-			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+			rolloutStatus: autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-					{Name: "dev"},
-					{Name: "stage"},
-					{Name: "prod"},
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "dev"}.Build(),
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "stage"}.Build(),
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "prod"}.Build(),
 				},
-			},
+			}.Build(),
 			expectedCount:    countByGroup["prod"],
 			expectedUpToDate: upToDateByGroup["prod"],
 		},
 		{
 			name: "one group miss",
-			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+			rolloutStatus: autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-					{Name: "dev"},
-					{Name: "prod"},
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "dev"}.Build(),
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "prod"}.Build(),
 				},
-			},
+			}.Build(),
 			expectedCount:    countByGroup["stage"] + countByGroup["prod"],
 			expectedUpToDate: upToDateByGroup["stage"] + upToDateByGroup["prod"],
 		},
 		{
 			name: "only catch-all group hit",
-			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+			rolloutStatus: autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-					{Name: "prod"},
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "prod"}.Build(),
 				},
-			},
+			}.Build(),
 			expectedCount:    countByGroup["dev"] + countByGroup["stage"] + countByGroup["prod"],
 			expectedUpToDate: upToDateByGroup["dev"] + upToDateByGroup["stage"] + upToDateByGroup["prod"],
 		},
 		{
 			name: "no common group",
-			rolloutStatus: &autoupdate.AutoUpdateAgentRolloutStatus{
+			rolloutStatus: autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-					{Name: "foobar"},
+					autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{Name: "foobar"}.Build(),
 				},
-			},
+			}.Build(),
 			expectedCount:    countByGroup["dev"] + countByGroup["stage"] + countByGroup["prod"],
 			expectedUpToDate: upToDateByGroup["dev"] + upToDateByGroup["stage"] + upToDateByGroup["prod"],
 		},
diff --git a/lib/autoupdate/rollout/strategy_test.go b/lib/autoupdate/rollout/strategy_test.go
index 0711d4043ae..723336d9387 100644
--- a/lib/autoupdate/rollout/strategy_test.go
+++ b/lib/autoupdate/rollout/strategy_test.go
@@ -104,10 +104,10 @@ func Test_inWindow(t *testing.T) {
 	}{
 		{
 			name: "out of window",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      everyWeekdayButSunday,
 				ConfigStartHour: matchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday,
 			duration: time.Hour,
 			want:     false,
@@ -115,10 +115,10 @@ func Test_inWindow(t *testing.T) {
 		},
 		{
 			name: "inside window, wrong hour",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: nonMatchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday,
 			duration: time.Hour,
 			want:     false,
@@ -126,10 +126,10 @@ func Test_inWindow(t *testing.T) {
 		},
 		{
 			name: "inside window, correct hour",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: matchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday,
 			duration: time.Hour,
 			want:     true,
@@ -137,10 +137,10 @@ func Test_inWindow(t *testing.T) {
 		},
 		{
 			name: "invalid weekdays",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      []string{"HelloThereGeneralKenobi"},
 				ConfigStartHour: matchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday,
 			duration: time.Hour,
 			want:     false,
@@ -148,10 +148,10 @@ func Test_inWindow(t *testing.T) {
 		},
 		{
 			name: "short window",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: matchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday,
 			duration: time.Second,
 			want:     false,
@@ -159,10 +159,10 @@ func Test_inWindow(t *testing.T) {
 		},
 		{
 			name: "window start time is included",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: matchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday.Truncate(24 * time.Hour).Add(time.Duration(matchingStartHour) * time.Hour),
 			duration: time.Hour,
 			want:     true,
@@ -170,10 +170,10 @@ func Test_inWindow(t *testing.T) {
 		},
 		{
 			name: "window end time is not included",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				ConfigDays:      everyWeekday,
 				ConfigStartHour: matchingStartHour,
-			},
+			}.Build(),
 			now:      testSunday.Truncate(24 * time.Hour).Add(time.Duration(matchingStartHour+1) * time.Hour),
 			duration: time.Hour,
 			want:     false,
@@ -191,11 +191,11 @@ func Test_inWindow(t *testing.T) {
 
 func Test_rolloutChangedInWindow(t *testing.T) {
 	// Test setup: creating fixtures.
-	group := &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+	group := autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 		Name:            "test-group",
 		ConfigDays:      everyWeekdayButSunday,
 		ConfigStartHour: 12,
-	}
+	}.Build()
 	tests := []struct {
 		name         string
 		now          time.Time
@@ -268,101 +268,101 @@ func Test_setGroupState(t *testing.T) {
 	}{
 		{
 			name: "same state, no change",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:             groupName,
 				StartTime:        nil,
 				State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 			newState: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 			reason:   updateReasonCannotStart,
 			now:      clock.Now(),
-			expected: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			expected: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:      groupName,
 				StartTime: nil,
 				State:     autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				// update time has not been bumped as nothing changed
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 		},
 		{
 			name: "same state, reason change",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:             groupName,
 				StartTime:        nil,
 				State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 			newState: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 			reason:   updateReasonReconcilerError,
 			now:      clock.Now(),
-			expected: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			expected: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:      groupName,
 				StartTime: nil,
 				State:     autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				// update time has been bumped because reason changed
 				LastUpdateTime:   timestamppb.New(clock.Now()),
 				LastUpdateReason: updateReasonReconcilerError,
-			},
+			}.Build(),
 		},
 		{
 			name: "new state, no reason change",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:             groupName,
 				StartTime:        nil,
 				State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 			newState: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 			reason:   updateReasonCannotStart,
 			now:      clock.Now(),
-			expected: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			expected: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:      groupName,
 				StartTime: nil,
 				State:     autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 				// update time has been bumped because state changed
 				LastUpdateTime:   timestamppb.New(clock.Now()),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 		},
 		{
 			name: "new state, reason change",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:             groupName,
 				StartTime:        nil,
 				State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 			newState: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 			reason:   updateReasonReconcilerError,
 			now:      clock.Now(),
-			expected: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			expected: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:      groupName,
 				StartTime: nil,
 				State:     autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 				// update time has been bumped because state and reason changed
 				LastUpdateTime:   timestamppb.New(clock.Now()),
 				LastUpdateReason: updateReasonReconcilerError,
-			},
+			}.Build(),
 		},
 		{
 			name: "new state, transition to active",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:             groupName,
 				StartTime:        nil,
 				State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCannotStart,
-			},
+			}.Build(),
 			newState: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			reason:   updateReasonCanStart,
 			now:      clock.Now(),
-			expected: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			expected: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name: groupName,
 				// We set start time during the transition
 				StartTime: timestamppb.New(clock.Now()),
@@ -370,21 +370,21 @@ func Test_setGroupState(t *testing.T) {
 				// update time has been bumped because state and reason changed
 				LastUpdateTime:   timestamppb.New(clock.Now()),
 				LastUpdateReason: updateReasonCanStart,
-			},
+			}.Build(),
 		},
 		{
 			name: "same state, transition from active to active",
-			group: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			group: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:             groupName,
 				StartTime:        timestamppb.New(oldUpdateTime),
 				State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 				LastUpdateTime:   timestamppb.New(oldUpdateTime),
 				LastUpdateReason: updateReasonCanStart,
-			},
+			}.Build(),
 			newState: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			reason:   updateReasonReconcilerError,
 			now:      clock.Now(),
-			expected: &autoupdate.AutoUpdateAgentRolloutStatusGroup{
+			expected: autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name: groupName,
 				// As the state was already active, the start time should not be refreshed
 				StartTime: timestamppb.New(oldUpdateTime),
@@ -392,7 +392,7 @@ func Test_setGroupState(t *testing.T) {
 				// update time has been bumped because reason changed
 				LastUpdateTime:   timestamppb.New(clock.Now()),
 				LastUpdateReason: updateReasonReconcilerError,
-			},
+			}.Build(),
 		},
 	}
 	for _, tt := range tests {
@@ -417,45 +417,45 @@ func Test_computeRolloutState(t *testing.T) {
 		{
 			name: "all groups unstarted",
 			groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
 			},
 			expectedState: autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_UNSTARTED,
 		},
 		{
 			name: "one group active",
 			groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
 			},
 			expectedState: autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 		},
 		{
 			name: "one group done",
 			groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED},
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED}.Build(),
 			},
 			expectedState: autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 		},
 		{
 			name: "every group done",
 			groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
 			},
 			expectedState: autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_DONE,
 		},
 		{
 			name: "one group rolledback",
 			groups: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK},
-				{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE},
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{State: autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE}.Build(),
 			},
 			expectedState: autoupdate.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ROLLEDBACK,
 		},
diff --git a/lib/autoupdate/rollout/strategy_timebased.go b/lib/autoupdate/rollout/strategy_timebased.go
index 8563a7d963c..02e5bf93868 100644
--- a/lib/autoupdate/rollout/strategy_timebased.go
+++ b/lib/autoupdate/rollout/strategy_timebased.go
@@ -71,18 +71,18 @@ func (h *timeBasedStrategy) progressRollout(ctx context.Context, spec *autoupdat
 
 	// We always process every group regardless of the order.
 	var errs []error
-	for i, group := range status.Groups {
+	for i, group := range status.GetGroups() {
 		var agentCount, agentUpToDateCount int
-		if i == len(status.Groups)-1 {
+		if i == len(status.GetGroups())-1 {
 			agentCount, agentUpToDateCount = countCatchAll(status, countByGroup, upToDateByGroup)
 		} else {
 			agentCount = countByGroup[group.GetName()]
 			agentUpToDateCount = upToDateByGroup[group.GetName()]
 		}
 
-		group.PresentCount = uint64(agentCount)
-		group.UpToDateCount = uint64(agentUpToDateCount)
-		switch group.State {
+		group.SetPresentCount(uint64(agentCount))
+		group.SetUpToDateCount(uint64(agentUpToDateCount))
+		switch group.GetState() {
 		case autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 			autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE:
 			// We start any group unstarted group in window.
@@ -93,24 +93,24 @@ func (h *timeBasedStrategy) progressRollout(ctx context.Context, spec *autoupdat
 				// In time-based rollouts, groups are not dependent.
 				// Failing to transition a group should affect other groups.
 				// We reflect that something went wrong in the status and go to the next group.
-				setGroupState(group, group.State, updateReasonReconcilerError, now)
+				setGroupState(group, group.GetState(), updateReasonReconcilerError, now)
 				errs = append(errs, err)
 				continue
 			}
 
 			// Check if the rollout got created after the theoretical group start time
-			rolloutChangedDuringWindow, err := rolloutChangedInWindow(group, now, status.StartTime.AsTime(), windowDuration)
+			rolloutChangedDuringWindow, err := rolloutChangedInWindow(group, now, status.GetStartTime().AsTime(), windowDuration)
 			if err != nil {
-				setGroupState(group, group.State, updateReasonReconcilerError, now)
+				setGroupState(group, group.GetState(), updateReasonReconcilerError, now)
 				errs = append(errs, err)
 				continue
 			}
 
 			switch {
 			case !shouldBeActive:
-				setGroupState(group, group.State, updateReasonOutsideWindow, now)
+				setGroupState(group, group.GetState(), updateReasonOutsideWindow, now)
 			case rolloutChangedDuringWindow:
-				setGroupState(group, group.State, updateReasonRolloutChanged, now)
+				setGroupState(group, group.GetState(), updateReasonRolloutChanged, now)
 			default:
 				setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE, updateReasonInWindow, now)
 			}
@@ -125,7 +125,7 @@ func (h *timeBasedStrategy) progressRollout(ctx context.Context, spec *autoupdat
 				// In time-based rollouts, groups are not dependent.
 				// Failing to transition a group should affect other groups.
 				// We reflect that something went wrong in the status and go to the next group.
-				setGroupState(group, group.State, updateReasonReconcilerError, now)
+				setGroupState(group, group.GetState(), updateReasonReconcilerError, now)
 				errs = append(errs, err)
 				continue
 			}
@@ -136,7 +136,7 @@ func (h *timeBasedStrategy) progressRollout(ctx context.Context, spec *autoupdat
 				setGroupState(group, autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE, updateReasonOutsideWindow, now)
 			}
 		default:
-			return trace.BadParameter("unknown autoupdate group state: %v", group.State)
+			return trace.BadParameter("unknown autoupdate group state: %v", group.GetState())
 		}
 	}
 	return trace.NewAggregate(errs...)
diff --git a/lib/autoupdate/rollout/strategy_timebased_test.go b/lib/autoupdate/rollout/strategy_timebased_test.go
index 8370f975ac8..01242737a58 100644
--- a/lib/autoupdate/rollout/strategy_timebased_test.go
+++ b/lib/autoupdate/rollout/strategy_timebased_test.go
@@ -48,11 +48,11 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 	targetVersion := "1.2.4"
 	fewSecondsAgo := clock.Now().Add(-5 * time.Second)
 	fewMinutesAgo := clock.Now().Add(-7 * time.Minute)
-	spec := &autoupdate.AutoUpdateAgentRolloutSpec{
+	spec := autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		MaintenanceWindowDuration: durationpb.New(time.Hour),
 		StartVersion:              startVersion,
 		TargetVersion:             targetVersion,
-	}
+	}.Build()
 
 	var tests = []struct {
 		name             string
@@ -64,70 +64,70 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 		{
 			name: "unstarted -> unstarted",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   lastUpdate,
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
 					LastUpdateReason: updateReasonOutsideWindow,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "unstarted -> unstarted, with reports",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   lastUpdate,
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			reports: []*autoupdate.AutoUpdateAgentReport{
-				{
-					Metadata: &headerv1.Metadata{Name: "auth1"},
-					Spec: &autoupdate.AutoUpdateAgentReportSpec{
+				autoupdate.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+					Spec: autoupdate.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewSecondsAgo),
 						Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
-							groupName: {
+							groupName: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-									startVersion:  {Count: 5},
-									targetVersion: {Count: 5},
+									startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+									targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-				{
-					Metadata: &headerv1.Metadata{Name: "auth2 (expired)"},
-					Spec: &autoupdate.AutoUpdateAgentReportSpec{
+					}.Build(),
+				}.Build(),
+				autoupdate.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth2 (expired)"}.Build(),
+					Spec: autoupdate.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewMinutesAgo),
 						Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
-							groupName: {
+							groupName: autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-									startVersion:  {Count: 5},
-									targetVersion: {Count: 5},
+									startVersion:  autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+									targetVersion: autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
@@ -136,47 +136,47 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					ConfigStartHour:  matchingStartHour,
 					PresentCount:     10,
 					UpToDateCount:    5,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "unstarted -> unstarted because rollout just changed",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   lastUpdate,
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			rolloutStartTime: timestamppb.New(clock.Now()),
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   timestamppb.New(clock.Now()),
 					LastUpdateReason: updateReasonRolloutChanged,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "unstarted -> active",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:   lastUpdate,
 					LastUpdateReason: updateReasonCreated,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -184,36 +184,36 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "done -> done",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					LastUpdateTime:   lastUpdate,
 					LastUpdateReason: updateReasonOutsideWindow,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					LastUpdateTime:   lastUpdate,
 					LastUpdateReason: updateReasonOutsideWindow,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "done -> active",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					LastUpdateTime:   lastUpdate,
@@ -221,10 +221,10 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonOutsideWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -232,13 +232,13 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "active -> active",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        lastUpdate,
@@ -246,10 +246,10 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        lastUpdate,
@@ -257,13 +257,13 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "active -> done",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        lastUpdate,
@@ -271,10 +271,10 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             groupName,
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        lastUpdate,
@@ -282,80 +282,80 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonOutsideWindow,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "rolledback is a dead end",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            groupName + "-in-maintenance",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      canStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            groupName + "-out-of-maintenance",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      cannotStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            groupName + "-in-maintenance",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      canStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            groupName + "-out-of-maintenance",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      cannotStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 		{
 			name: "mix of everything",
 			initialState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "new group should start",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      canStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "done group should start",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					LastUpdateTime:  lastUpdate,
 					StartTime:       lastUpdate,
 					ConfigDays:      canStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "rolledback group should do nothing",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      canStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "old group should stop",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					LastUpdateTime:  lastUpdate,
 					StartTime:       lastUpdate,
 					ConfigDays:      cannotStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
+				}.Build(),
 			},
 			expectedState: []*autoupdate.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             "new group should start",
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -363,8 +363,8 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             "done group should start",
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					StartTime:        timestamppb.New(clock.Now()),
@@ -372,15 +372,15 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonInWindow,
 					ConfigDays:       canStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "rolledback group should do nothing",
 					State:           autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 					LastUpdateTime:  lastUpdate,
 					ConfigDays:      canStartToday,
 					ConfigStartHour: matchingStartHour,
-				},
-				{
+				}.Build(),
+				autoupdate.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:             "old group should stop",
 					State:            autoupdate.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 					StartTime:        lastUpdate,
@@ -388,18 +388,18 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 					LastUpdateReason: updateReasonOutsideWindow,
 					ConfigDays:       cannotStartToday,
 					ConfigStartHour:  matchingStartHour,
-				},
+				}.Build(),
 			},
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			status := &autoupdate.AutoUpdateAgentRolloutStatus{
+			status := autoupdate.AutoUpdateAgentRolloutStatus_builder{
 				Groups:    tt.initialState,
 				State:     0,
 				StartTime: tt.rolloutStartTime,
-			}
+			}.Build()
 			stubs := mockClientStubs{}
 			if tt.reports == nil {
 				stubs.reportsAnswers = []callAnswer[[]*autoupdate.AutoUpdateAgentReport]{
@@ -424,7 +424,7 @@ func Test_progressGroupsTimeBased(t *testing.T) {
 			// It's not super important for time-based, but is crucial for halt-on-error.
 			// So it's better to be more conservative and validate order never changes for
 			// both strategies.
-			require.Equal(t, tt.expectedState, status.Groups)
+			require.Equal(t, tt.expectedState, status.GetGroups())
 		})
 	}
 }
diff --git a/lib/autoupdate/rollout/transitions.go b/lib/autoupdate/rollout/transitions.go
index 22a15ac37aa..5746802c652 100644
--- a/lib/autoupdate/rollout/transitions.go
+++ b/lib/autoupdate/rollout/transitions.go
@@ -132,9 +132,9 @@ func TriggerGroups(rollout *autoupdatev1pb.AutoUpdateAgentRollout, reports []*au
 		}
 
 		setGroupState(group, desiredState, updateReasonManualTrigger, now)
-		group.UpToDateCount = uint64(upToDateCount)
-		group.InitialCount = uint64(initialCount)
-		group.PresentCount = uint64(initialCount)
+		group.SetUpToDateCount(uint64(upToDateCount))
+		group.SetInitialCount(uint64(initialCount))
+		group.SetPresentCount(uint64(initialCount))
 	}
 
 	return nil
diff --git a/lib/autoupdate/rollout/transitions_test.go b/lib/autoupdate/rollout/transitions_test.go
index 236d1f4aaeb..9e2fb61efee 100644
--- a/lib/autoupdate/rollout/transitions_test.go
+++ b/lib/autoupdate/rollout/transitions_test.go
@@ -42,81 +42,81 @@ func TestTriggerGroups(t *testing.T) {
 	targetVersion := "1.2.4"
 	otherVersion := "1.2.5"
 
-	spec := &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+	spec := autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   startVersion,
 		TargetVersion:  targetVersion,
 		Schedule:       autoupdate.AgentsScheduleRegular,
 		AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 		Strategy:       autoupdate.AgentsStrategyHaltOnError,
-	}
-	status := &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+	}.Build()
+	status := autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 		Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-			{
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "blue",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "dev",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "stage",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "prod",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "backup",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
-			},
+			}.Build(),
 		},
-	}
+	}.Build()
 	testReports := []*autoupdatev1pb.AutoUpdateAgentReport{
-		{
-			Metadata: &headerv1.Metadata{Name: "auth1"},
-			Spec: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+		autoupdatev1pb.AutoUpdateAgentReport_builder{
+			Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+			Spec: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(fewSecondsAgo),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"blue": {
+					"blue": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 4},
-							targetVersion: {Count: 5},
-							otherVersion:  {Count: 1},
+							startVersion:  autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 4}.Build(),
+							targetVersion: autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+							otherVersion:  autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
 						},
-					},
-					"dev": {
+					}.Build(),
+					"dev": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 5},
-							targetVersion: {Count: 5},
+							startVersion:  autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+							targetVersion: autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-		},
-		{
+			}.Build(),
+		}.Build(),
+		autoupdatev1pb.AutoUpdateAgentReport_builder{
 			// This report is expired, it must be ignored
-			Metadata: &headerv1.Metadata{Name: "auth2"},
-			Spec: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+			Metadata: headerv1.Metadata_builder{Name: "auth2"}.Build(),
+			Spec: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 				Timestamp: timestamppb.New(fewMinutesAgo),
 				Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-					"blue": {
+					"blue": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 123},
-							targetVersion: {Count: 123},
-							otherVersion:  {Count: 123},
+							startVersion:  autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+							targetVersion: autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+							otherVersion:  autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
 						},
-					},
-					"stage": {
+					}.Build(),
+					"stage": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 						Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-							startVersion:  {Count: 123},
-							targetVersion: {Count: 123},
+							startVersion:  autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+							targetVersion: autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	tests := []struct {
@@ -130,60 +130,60 @@ func TestTriggerGroups(t *testing.T) {
 	}{
 		{
 			name: "valid transition",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: proto.CloneOf(status),
-			},
+			}.Build(),
 			groupNames:   []string{"blue", "prod", "backup"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			expectErr:    require.NoError,
-			expectedStatus: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+			expectedStatus: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-					{
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "blue",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 						StartTime:        nowPb,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualTrigger,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:  "dev",
 						State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:  "stage",
 						State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "prod",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 						StartTime:        nowPb,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualTrigger,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "backup",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 						StartTime:        nowPb,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualTrigger,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "valid transition, with reports",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: proto.CloneOf(status),
-			},
+			}.Build(),
 			groupNames:   []string{"blue", "prod", "backup"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			reports:      testReports,
 			expectErr:    require.NoError,
-			expectedStatus: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+			expectedStatus: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-					{
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "blue",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 						StartTime:        nowPb,
@@ -193,38 +193,38 @@ func TestTriggerGroups(t *testing.T) {
 						InitialCount:  10,
 						PresentCount:  10,
 						UpToDateCount: 5,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:  "dev",
 						State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:  "stage",
 						State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "prod",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 						StartTime:        nowPb,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualTrigger,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "backup",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 						StartTime:        nowPb,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualTrigger,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "no groups in rollout",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{},
-			},
+			}.Build(),
 			groupNames:   []string{"prod", "backup"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			expectErr: func(t require.TestingT, err error, i ...any) {
@@ -233,10 +233,10 @@ func TestTriggerGroups(t *testing.T) {
 		},
 		{
 			name: "unsupported desired state",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: proto.CloneOf(status),
-			},
+			}.Build(),
 			groupNames:   []string{"prod", "backup"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 			expectErr: func(t require.TestingT, err error, i ...any) {
@@ -245,16 +245,16 @@ func TestTriggerGroups(t *testing.T) {
 		},
 		{
 			name: "unsupported strategy",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   startVersion,
 					TargetVersion:  targetVersion,
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyTimeBased,
-				},
+				}.Build(),
 				Status: proto.CloneOf(status),
-			},
+			}.Build(),
 			groupNames:   []string{"prod", "backup"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			expectErr: func(t require.TestingT, err error, i ...any) {
@@ -263,15 +263,15 @@ func TestTriggerGroups(t *testing.T) {
 		},
 		{
 			name: "unsupported schedule",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   startVersion,
 					TargetVersion:  targetVersion,
 					Schedule:       autoupdate.AgentsScheduleImmediate,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-				},
+				}.Build(),
 				Status: proto.CloneOf(status),
-			},
+			}.Build(),
 			groupNames:   []string{"prod", "backup"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			expectErr: func(t require.TestingT, err error, i ...any) {
@@ -280,10 +280,10 @@ func TestTriggerGroups(t *testing.T) {
 		},
 		{
 			name: "group already active",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: status,
-			},
+			}.Build(),
 			groupNames:   []string{"stage"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			expectErr: func(t require.TestingT, err error, i ...any) {
@@ -292,10 +292,10 @@ func TestTriggerGroups(t *testing.T) {
 		},
 		{
 			name: "group already done",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: status,
-			},
+			}.Build(),
 			groupNames:   []string{"dev"},
 			desiredState: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 			expectErr: func(t require.TestingT, err error, i ...any) {
@@ -318,37 +318,37 @@ func TestTriggerGroups(t *testing.T) {
 func TestForceGroupsDone(t *testing.T) {
 	now := time.Now()
 	nowPb := timestamppb.New(now)
-	spec := &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+	spec := autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "1.2.4",
 		Schedule:       autoupdate.AgentsScheduleRegular,
 		AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 		Strategy:       autoupdate.AgentsStrategyHaltOnError,
-	}
-	status := &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+	}.Build()
+	status := autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 		Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-			{
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "blue",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "dev",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "stage",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "prod",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "backup",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
-			},
+			}.Build(),
 		},
-	}
+	}.Build()
 
 	tests := []struct {
 		name           string
@@ -359,51 +359,51 @@ func TestForceGroupsDone(t *testing.T) {
 	}{
 		{
 			name: "valid transition",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: status,
-			},
+			}.Build(),
 			groupNames: []string{"blue", "stage", "prod", "backup"},
 			expectErr:  require.NoError,
-			expectedStatus: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+			expectedStatus: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-					{
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "blue",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonForcedDone,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:  "dev",
 						State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "stage",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonForcedDone,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "prod",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonForcedDone,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "backup",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonForcedDone,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "no groups in rollout",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{},
-			},
+			}.Build(),
 			groupNames: []string{"prod", "backup"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "rollout has no groups")
@@ -411,16 +411,16 @@ func TestForceGroupsDone(t *testing.T) {
 		},
 		{
 			name: "unsupported strategy",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyTimeBased,
-				},
+				}.Build(),
 				Status: status,
-			},
+			}.Build(),
 			groupNames: []string{"prod", "backup"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "not supported for rollout strategy")
@@ -428,15 +428,15 @@ func TestForceGroupsDone(t *testing.T) {
 		},
 		{
 			name: "unsupported schedule",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleImmediate,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-				},
+				}.Build(),
 				Status: nil,
-			},
+			}.Build(),
 			groupNames: []string{"prod", "backup"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "rollout schedule is immediate")
@@ -444,10 +444,10 @@ func TestForceGroupsDone(t *testing.T) {
 		},
 		{
 			name: "group already done",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: status,
-			},
+			}.Build(),
 			groupNames: []string{"dev"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "is already done")
@@ -469,37 +469,37 @@ func TestForceGroupsDone(t *testing.T) {
 func TestRollbackGroups(t *testing.T) {
 	now := time.Now()
 	nowPb := timestamppb.New(now)
-	spec := &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+	spec := autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "1.2.4",
 		Schedule:       autoupdate.AgentsScheduleRegular,
 		AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 		Strategy:       autoupdate.AgentsStrategyHaltOnError,
-	}
-	status := &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+	}.Build()
+	status := autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 		Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-			{
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "blue",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "dev",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "stage",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "prod",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
-			},
-			{
+			}.Build(),
+			autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 				Name:  "backup",
 				State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
-			},
+			}.Build(),
 		},
-	}
+	}.Build()
 
 	tests := []struct {
 		name           string
@@ -510,51 +510,51 @@ func TestRollbackGroups(t *testing.T) {
 	}{
 		{
 			name: "valid transition",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: status,
-			},
+			}.Build(),
 			groupNames: []string{"dev", "stage", "prod", "backup"},
 			expectErr:  require.NoError,
-			expectedStatus: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+			expectedStatus: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 				Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-					{
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:  "blue",
 						State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "dev",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualRollback,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "stage",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualRollback,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "prod",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualRollback,
-					},
-					{
+					}.Build(),
+					autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 						Name:             "backup",
 						State:            autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
 						LastUpdateTime:   nowPb,
 						LastUpdateReason: updateReasonManualRollback,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		},
 		{
 			name: "no groups in rollout",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{},
-			},
+			}.Build(),
 			groupNames: []string{"prod", "backup"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "rollout has no groups")
@@ -562,16 +562,16 @@ func TestRollbackGroups(t *testing.T) {
 		},
 		{
 			name: "unsupported strategy",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyTimeBased,
-				},
+				}.Build(),
 				Status: status,
-			},
+			}.Build(),
 			groupNames: []string{"prod", "backup"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "not supported for rollout strategy")
@@ -579,15 +579,15 @@ func TestRollbackGroups(t *testing.T) {
 		},
 		{
 			name: "unsupported schedule",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleImmediate,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-				},
+				}.Build(),
 				Status: nil,
-			},
+			}.Build(),
 			groupNames: []string{"prod", "backup"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "rollout schedule is immediate")
@@ -595,10 +595,10 @@ func TestRollbackGroups(t *testing.T) {
 		},
 		{
 			name: "group already rolledback",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
 				Spec:   spec,
 				Status: status,
-			},
+			}.Build(),
 			groupNames: []string{"blue"},
 			expectErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "is already in a rolled-back state")
@@ -618,39 +618,39 @@ func TestRollbackGroups(t *testing.T) {
 }
 
 func TestStartedGroups(t *testing.T) {
-	rollout := &autoupdatev1pb.AutoUpdateAgentRollout{
-		Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+	rollout := autoupdatev1pb.AutoUpdateAgentRollout_builder{
+		Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:   "1.2.3",
 			TargetVersion:  "1.2.4",
 			Schedule:       autoupdate.AgentsScheduleRegular,
 			AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 			Strategy:       autoupdate.AgentsStrategyHaltOnError,
-		},
-		Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+		}.Build(),
+		Status: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 			Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:  "blue",
 					State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ROLLEDBACK,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:  "dev",
 					State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:  "stage",
 					State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:  "prod",
 					State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
-				},
-				{
+				}.Build(),
+				autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:  "backup",
 					State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSPECIFIED,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	expectedGroups := GroupListToGroupSet([]string{"dev", "stage"})
 	result := GetStartedGroups(rollout)
diff --git a/lib/cache/access_list_test.go b/lib/cache/access_list_test.go
index 017b5faaab1..22a40d20077 100644
--- a/lib/cache/access_list_test.go
+++ b/lib/cache/access_list_test.go
@@ -519,14 +519,14 @@ func TestListAccessListsV2(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			require.EventuallyWithT(t, func(t *assert.CollectT) {
-				results, nextToken, err := p.cache.ListAccessListsV2(ctx, &accesslistv1.ListAccessListsV2Request{
+				results, nextToken, err := p.cache.ListAccessListsV2(ctx, accesslistv1.ListAccessListsV2Request_builder{
 					PageSize:  int32(tc.pageSize),
 					PageToken: tc.startKey,
-					Filter: &accesslistv1.AccessListsFilter{
+					Filter: accesslistv1.AccessListsFilter_builder{
 						Search: tc.search,
-					},
+					}.Build(),
 					SortBy: tc.sortBy,
-				})
+				}.Build())
 				require.NoError(t, err)
 				require.Equal(t, tc.expectedNextKey, nextToken)
 
diff --git a/lib/cache/access_monitoring_rule.go b/lib/cache/access_monitoring_rule.go
index b77cc6d974b..6e8d650337a 100644
--- a/lib/cache/access_monitoring_rule.go
+++ b/lib/cache/access_monitoring_rule.go
@@ -45,7 +45,7 @@ func newAccessMonitoringRuleCollection(upstream services.AccessMonitoringRules,
 			proto.CloneOf[*accessmonitoringrulesv1.AccessMonitoringRule],
 			map[accessMonitoringRuleIndex]func(*accessmonitoringrulesv1.AccessMonitoringRule) string{
 				accessMonitoringRuleNameIndex: func(r *accessmonitoringrulesv1.AccessMonitoringRule) string {
-					return r.GetMetadata().Name
+					return r.GetMetadata().GetName()
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*accessmonitoringrulesv1.AccessMonitoringRule, error) {
@@ -53,13 +53,13 @@ func newAccessMonitoringRuleCollection(upstream services.AccessMonitoringRules,
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *accessmonitoringrulesv1.AccessMonitoringRule {
-			return &accessmonitoringrulesv1.AccessMonitoringRule{
+			return accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -76,7 +76,7 @@ func (c *Cache) ListAccessMonitoringRules(ctx context.Context, pageSize int, pag
 		index:        accessMonitoringRuleNameIndex,
 		upstreamList: c.Config.AccessMonitoringRules.ListAccessMonitoringRules,
 		nextToken: func(t *accessmonitoringrulesv1.AccessMonitoringRule) string {
-			return t.GetMetadata().Name
+			return t.GetMetadata().GetName()
 		},
 	}
 	out, next, err := lister.list(ctx, pageSize, pageToken)
@@ -94,7 +94,7 @@ func (c *Cache) ListAccessMonitoringRulesWithFilter(ctx context.Context, req *ac
 		index:        accessMonitoringRuleNameIndex,
 		upstreamList: c.Config.AccessMonitoringRules.ListAccessMonitoringRules,
 		nextToken: func(t *accessmonitoringrulesv1.AccessMonitoringRule) string {
-			return t.GetMetadata().Name
+			return t.GetMetadata().GetName()
 		},
 		filter: func(rule *accessmonitoringrulesv1.AccessMonitoringRule) bool {
 			return services.MatchAccessMonitoringRule(rule, req.GetSubjects(), req.GetNotificationName(), req.GetAutomaticReviewName())
diff --git a/lib/cache/access_monitoring_rule_test.go b/lib/cache/access_monitoring_rule_test.go
index a296d5a0c20..4e5b68679b7 100644
--- a/lib/cache/access_monitoring_rule_test.go
+++ b/lib/cache/access_monitoring_rule_test.go
@@ -67,123 +67,123 @@ func TestListAccessMonitoringRulesWithFilter(t *testing.T) {
 	}{
 		{
 			description: "filter by notification integration",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example-notification-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name: "notificationIntegration",
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:         []string{types.KindAccessRequest},
 				NotificationName: "notificationIntegration",
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "filter by automatic_review integration",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example-automatic-approval-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: "automaticReviewIntegration",
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: "automaticReviewIntegration",
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "filter by both notification and automatic_review integration",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example-combined-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name: "notificationIntegration",
-					},
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					}.Build(),
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: "automaticReviewIntegration",
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: "automaticReviewIntegration",
 				NotificationName:    "notificationIntegration",
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "filter by builtin automatic_review rules",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example-builtin-automatic_approval-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name: "notificationIntegration",
-					},
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					}.Build(),
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: types.BuiltInAutomaticReview,
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: types.BuiltInAutomaticReview,
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "no match",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "no-match-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: types.BuiltInAutomaticReview,
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: "automaticReviewIntegration",
-			},
+			}.Build(),
 			expectedRule: false,
 		},
 	}
diff --git a/lib/cache/appauthconfig.go b/lib/cache/appauthconfig.go
index e3a9ddf60e8..083641249cf 100644
--- a/lib/cache/appauthconfig.go
+++ b/lib/cache/appauthconfig.go
@@ -55,13 +55,13 @@ func newAppAuthConfigCollection(upstream services.AppAuthConfigReader, w types.W
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *appauthconfigv1.AppAuthConfig {
-			return &appauthconfigv1.AppAuthConfig{
+			return appauthconfigv1.AppAuthConfig_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/appauthconfig_test.go b/lib/cache/appauthconfig_test.go
index 1efcfc1de98..3fd03045439 100644
--- a/lib/cache/appauthconfig_test.go
+++ b/lib/cache/appauthconfig_test.go
@@ -21,6 +21,7 @@ import (
 	"testing"
 
 	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
 
 	appauthconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/appauthconfig/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -29,25 +30,21 @@ import (
 )
 
 func newAppAuthConfigJWT(name string) *appauthconfigv1.AppAuthConfig {
-	return &appauthconfigv1.AppAuthConfig{
+	return appauthconfigv1.AppAuthConfig_builder{
 		Kind:    types.KindAppAuthConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &appauthconfigv1.AppAuthConfigSpec{
-			AppLabels: []*labelv1.Label{{Name: "*", Values: []string{"*"}}},
-			SubKindSpec: &appauthconfigv1.AppAuthConfigSpec_Jwt{
-				Jwt: &appauthconfigv1.AppAuthConfigJWTSpec{
-					Issuer:   "https://issuer",
-					Audience: "teleport",
-					KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-						JwksUrl: "https://issuer/.well-known/jwks.json",
-					},
-				},
-			},
-		},
-	}
+		}.Build(),
+		Spec: appauthconfigv1.AppAuthConfigSpec_builder{
+			AppLabels: []*labelv1.Label{labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build()},
+			Jwt: appauthconfigv1.AppAuthConfigJWTSpec_builder{
+				Issuer:   "https://issuer",
+				Audience: "teleport",
+				JwksUrl:  proto.String("https://issuer/.well-known/jwks.json"),
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 func TestAppAuthConfigs(t *testing.T) {
diff --git a/lib/cache/auto_update.go b/lib/cache/auto_update.go
index 58e5d2b9eb7..41872e25fca 100644
--- a/lib/cache/auto_update.go
+++ b/lib/cache/auto_update.go
@@ -59,13 +59,13 @@ func newAutoUpdateConfigCollection(upstream services.AutoUpdateServiceGetter, w
 			return []*autoupdatev1.AutoUpdateConfig{cfg}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateConfig {
-			return &autoupdatev1.AutoUpdateConfig{
+			return autoupdatev1.AutoUpdateConfig_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -126,13 +126,13 @@ func newAutoUpdateVersionCollection(upstream services.AutoUpdateServiceGetter, w
 			return []*autoupdatev1.AutoUpdateVersion{version}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateVersion {
-			return &autoupdatev1.AutoUpdateVersion{
+			return autoupdatev1.AutoUpdateVersion_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -189,13 +189,13 @@ func newAutoUpdateRolloutCollection(upstream services.AutoUpdateServiceGetter, w
 			return []*autoupdatev1.AutoUpdateAgentRollout{rollout}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateAgentRollout {
-			return &autoupdatev1.AutoUpdateAgentRollout{
+			return autoupdatev1.AutoUpdateAgentRollout_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -240,7 +240,7 @@ func newAutoUpdateAgentReportCollection(upstream services.AutoUpdateServiceGette
 			proto.CloneOf[*autoupdatev1.AutoUpdateAgentReport],
 			map[autoUpdateAgentReportIndex]func(*autoupdatev1.AutoUpdateAgentReport) string{
 				autoUpdateAgentReportNameIndex: func(r *autoupdatev1.AutoUpdateAgentReport) string {
-					return r.GetMetadata().Name
+					return r.GetMetadata().GetName()
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*autoupdatev1.AutoUpdateAgentReport, error) {
@@ -248,13 +248,13 @@ func newAutoUpdateAgentReportCollection(upstream services.AutoUpdateServiceGette
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateAgentReport {
-			return &autoupdatev1.AutoUpdateAgentReport{
+			return autoupdatev1.AutoUpdateAgentReport_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -286,7 +286,7 @@ func (c *Cache) ListAutoUpdateAgentReports(ctx context.Context, pageSize int, pa
 		index:        autoUpdateAgentReportNameIndex,
 		upstreamList: c.Config.AutoUpdateService.ListAutoUpdateAgentReports,
 		nextToken: func(t *autoupdatev1.AutoUpdateAgentReport) string {
-			return t.GetMetadata().Name
+			return t.GetMetadata().GetName()
 		},
 	}
 	out, next, err := lister.list(ctx, pageSize, pageToken)
@@ -308,7 +308,7 @@ func newAutoUpdateBotInstanceReportCollection(upstream services.AutoUpdateServic
 			proto.CloneOf[*autoupdatev1.AutoUpdateBotInstanceReport],
 			map[autoUpdateBotInstanceReportIndex]func(*autoupdatev1.AutoUpdateBotInstanceReport) string{
 				autoUpdateBotInstanceReportNameIndex: func(r *autoupdatev1.AutoUpdateBotInstanceReport) string {
-					return r.GetMetadata().Name
+					return r.GetMetadata().GetName()
 				},
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]*autoupdatev1.AutoUpdateBotInstanceReport, error) {
@@ -319,13 +319,13 @@ func newAutoUpdateBotInstanceReportCollection(upstream services.AutoUpdateServic
 			return []*autoupdatev1.AutoUpdateBotInstanceReport{report}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *autoupdatev1.AutoUpdateBotInstanceReport {
-			return &autoupdatev1.AutoUpdateBotInstanceReport{
+			return autoupdatev1.AutoUpdateBotInstanceReport_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/beam.go b/lib/cache/beam.go
index a541e094066..18ed564a981 100644
--- a/lib/cache/beam.go
+++ b/lib/cache/beam.go
@@ -67,13 +67,13 @@ func newBeamCollection(upstream services.BeamReader, w types.WatchKind) (*collec
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *beamsv1.Beam {
-			return &beamsv1.Beam{
+			return beamsv1.Beam_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/beam_test.go b/lib/cache/beam_test.go
index 7e1400d66cc..ba9a0c790fc 100644
--- a/lib/cache/beam_test.go
+++ b/lib/cache/beam_test.go
@@ -358,23 +358,23 @@ func TestBeamCache_ListFallback(t *testing.T) {
 
 func newBeamResource(name, alias string, expires time.Time) *beamsv1.Beam {
 	ts := timestamppb.New(expires)
-	return &beamsv1.Beam{
+	return beamsv1.Beam_builder{
 		Kind:    types.KindBeam,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    name,
 			Expires: ts,
-		},
-		Spec: &beamsv1.BeamSpec{
+		}.Build(),
+		Spec: beamsv1.BeamSpec_builder{
 			Egress:         beamsv1.EgressMode_EGRESS_MODE_RESTRICTED,
 			AllowedDomains: []string{"example.com."},
-			Publish: &beamsv1.PublishSpec{
+			Publish: beamsv1.PublishSpec_builder{
 				Port:     8080,
 				Protocol: beamsv1.Protocol_PROTOCOL_HTTP,
-			},
+			}.Build(),
 			Expires: ts,
-		},
-		Status: &beamsv1.BeamStatus{
+		}.Build(),
+		Status: beamsv1.BeamStatus_builder{
 			User:                 "alice",
 			Alias:                alias,
 			BotName:              uuid.NewString(),
@@ -382,13 +382,13 @@ func newBeamResource(name, alias string, expires time.Time) *beamsv1.Beam {
 			DelegationSessionId:  uuid.NewString(),
 			WorkloadIdentityName: uuid.NewString(),
 			ComputeStatus:        beamsv1.ComputeStatus_COMPUTE_STATUS_PROVISION_PENDING,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func newBeamResourceWithUser(name, alias, user string, expires time.Time) *beamsv1.Beam {
 	beam := newBeamResource(name, alias, expires)
-	beam.Status.User = user
+	beam.GetStatus().SetUser(user)
 	return beam
 }
 
diff --git a/lib/cache/bot_instance_test.go b/lib/cache/bot_instance_test.go
index dd9b2f06afa..3c4813eb68f 100644
--- a/lib/cache/bot_instance_test.go
+++ b/lib/cache/bot_instance_test.go
@@ -43,16 +43,16 @@ func TestBotInstanceCache(t *testing.T) {
 
 	testResources153(t, p, testFuncs[*machineidv1.BotInstance]{
 		newResource: func(key string) (*machineidv1.BotInstance, error) {
-			return &machineidv1.BotInstance{
+			return machineidv1.BotInstance_builder{
 				Kind:     types.KindBotInstance,
 				Version:  types.V1,
 				Metadata: &headerv1.Metadata{},
-				Spec: &machineidv1.BotInstanceSpec{
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-1",
 					InstanceId: key,
-				},
+				}.Build(),
 				Status: &machineidv1.BotInstanceStatus{},
-			}, nil
+			}.Build(), nil
 		},
 		cacheGet: func(ctx context.Context, key string) (*machineidv1.BotInstance, error) {
 			return p.cache.GetBotInstance(ctx, "bot-1", key)
@@ -68,7 +68,7 @@ func TestBotInstanceCache(t *testing.T) {
 			return p.botInstanceService.ListBotInstances(ctx, pageSize, pageToken, nil)
 		},
 		update: func(ctx context.Context, bi *machineidv1.BotInstance) error {
-			_, err := p.botInstanceService.PatchBotInstance(ctx, "bot-1", bi.Metadata.GetName(), func(_ *machineidv1.BotInstance) (*machineidv1.BotInstance, error) {
+			_, err := p.botInstanceService.PatchBotInstance(ctx, "bot-1", bi.GetMetadata().GetName(), func(_ *machineidv1.BotInstance) (*machineidv1.BotInstance, error) {
 				return bi, nil
 			})
 			return err
@@ -92,16 +92,16 @@ func TestBotInstanceCachePaging(t *testing.T) {
 	t.Cleanup(p.Close)
 
 	for _, n := range []int{5, 1, 3, 4, 2} {
-		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-1",
 				InstanceId: "instance-" + strconv.Itoa(n),
-			},
+			}.Build(),
 			Status: &machineidv1.BotInstanceStatus{},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -151,16 +151,16 @@ func TestBotInstanceCacheBotFilter(t *testing.T) {
 	t.Cleanup(p.Close)
 
 	for n := range 10 {
-		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-" + strconv.Itoa(n%2),
 				InstanceId: "instance-" + strconv.Itoa(n),
-			},
+			}.Build(),
 			Status: &machineidv1.BotInstanceStatus{},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -193,22 +193,22 @@ func TestBotInstanceCacheSearchFilter(t *testing.T) {
 	t.Cleanup(p.Close)
 
 	for n := range 10 {
-		instance := &machineidv1.BotInstance{
+		instance := machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-1",
 				InstanceId: "instance-" + strconv.Itoa(n+1),
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						Hostname: "host-" + strconv.Itoa(n%2),
-					},
+					}.Build(),
 				},
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		_, err := p.botInstanceService.CreateBotInstance(ctx, instance)
 		require.NoError(t, err)
@@ -238,42 +238,42 @@ func TestBotInstanceCacheQueryFilter(t *testing.T) {
 	t.Cleanup(p.Close)
 
 	{
-		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-1",
 				InstanceId: "00000000-0000-0000-0000-000000000000",
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						Hostname: "host-1",
-					},
+					}.Build(),
 				},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
 	{
-		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-1",
 				InstanceId: uuid.New().String(),
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						Hostname: "host-2",
-					},
+					}.Build(),
 				},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -289,7 +289,7 @@ func TestBotInstanceCacheQueryFilter(t *testing.T) {
 	})
 	require.NoError(t, err)
 	require.Len(t, results, 1)
-	require.Equal(t, "00000000-0000-0000-0000-000000000000", results[0].Spec.InstanceId)
+	require.Equal(t, "00000000-0000-0000-0000-000000000000", results[0].GetSpec().GetInstanceId())
 }
 
 // TestBotInstanceCacheSorting tests that cache items are sorted.
@@ -314,26 +314,26 @@ func TestBotInstanceCacheSorting(t *testing.T) {
 	}
 
 	for _, b := range items {
-		instance := &machineidv1.BotInstance{
+		instance := machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    b.botName,
 				InstanceId: b.instanceId,
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						RecordedAt: &timestamppb.Timestamp{
 							Seconds: b.recordedAtSeconds,
 						},
 						Version:  b.version,
 						Hostname: b.hostname,
-					},
+					}.Build(),
 				},
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		_, err := p.botInstanceService.CreateBotInstance(ctx, instance)
 		require.NoError(t, err)
@@ -461,16 +461,16 @@ func TestBotInstanceCacheFilterFn(t *testing.T) {
 
 	// Create 10 instances across two bots: bot-0 and bot-1.
 	for n := range 10 {
-		_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := p.botInstanceService.CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:     types.KindBotInstance,
 			Version:  types.V1,
 			Metadata: &headerv1.Metadata{},
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-" + strconv.Itoa(n%2),
 				InstanceId: "instance-" + strconv.Itoa(n),
-			},
+			}.Build(),
 			Status: &machineidv1.BotInstanceStatus{},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -545,16 +545,16 @@ func TestBotInstanceCacheFallback(t *testing.T) {
 	})
 	t.Cleanup(p.Close)
 
-	_, err := p.botInstanceService.CreateBotInstance(ctx, &machineidv1.BotInstance{
+	_, err := p.botInstanceService.CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 		Kind:     types.KindBotInstance,
 		Version:  types.V1,
 		Metadata: &headerv1.Metadata{},
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    "bot-1",
 			InstanceId: "instance-1",
-		},
+		}.Build(),
 		Status: &machineidv1.BotInstanceStatus{},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// Let the cache catch up
@@ -605,68 +605,68 @@ func TestKeyForVersionIndex(t *testing.T) {
 		{
 			name: "invalid version",
 			mutatorFn: func(b *machineidv1.BotInstance) {
-				b.Status = &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				b.SetStatus(machineidv1.BotInstanceStatus_builder{
+					InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 						Version: "a.b.c",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 			key: "000000.000000.000000-~/bot-instance-1",
 		},
 		{
 			name: "initial heartbeat",
 			mutatorFn: func(b *machineidv1.BotInstance) {
-				b.Status = &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				b.SetStatus(machineidv1.BotInstanceStatus_builder{
+					InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 						Version: "1.0.0",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 			key: "000001.000000.000000-~/bot-instance-1",
 		},
 		{
 			name: "latest heartbeat",
 			mutatorFn: func(b *machineidv1.BotInstance) {
-				b.Status = &machineidv1.BotInstanceStatus{
+				b.SetStatus(machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							Version: "1.0.0",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			key: "000001.000000.000000-~/bot-instance-1",
 		},
 		{
 			name: "with release",
 			mutatorFn: func(b *machineidv1.BotInstance) {
-				b.Status = &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				b.SetStatus(machineidv1.BotInstanceStatus_builder{
+					InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 						Version: "1.0.0-dev",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 			key: "000001.000000.000000-dev/bot-instance-1",
 		},
 		{
 			name: "with build",
 			mutatorFn: func(b *machineidv1.BotInstance) {
-				b.Status = &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				b.SetStatus(machineidv1.BotInstanceStatus_builder{
+					InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 						Version: "1.0.0+build1",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 			key: "000001.000000.000000-~/bot-instance-1",
 		},
 		{
 			name: "with release and build",
 			mutatorFn: func(b *machineidv1.BotInstance) {
-				b.Status = &machineidv1.BotInstanceStatus{
-					InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+				b.SetStatus(machineidv1.BotInstanceStatus_builder{
+					InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 						Version: "1.0.0-dev+build1",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 			key: "000001.000000.000000-dev/bot-instance-1",
 		},
@@ -674,15 +674,15 @@ func TestKeyForVersionIndex(t *testing.T) {
 
 	for _, tc := range tcs {
 		t.Run(tc.name, func(t *testing.T) {
-			instance := &machineidv1.BotInstance{
+			instance := machineidv1.BotInstance_builder{
 				Kind:    types.KindBotInstance,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot-instance-1",
-				},
+				}.Build(),
 				Spec:   &machineidv1.BotInstanceSpec{},
 				Status: &machineidv1.BotInstanceStatus{},
-			}
+			}.Build()
 			tc.mutatorFn(instance)
 
 			versionKey := keyForBotInstanceVersionIndex(instance)
diff --git a/lib/cache/cache_singleton_test.go b/lib/cache/cache_singleton_test.go
index c5e1c299f82..a6c2c7751a7 100644
--- a/lib/cache/cache_singleton_test.go
+++ b/lib/cache/cache_singleton_test.go
@@ -50,25 +50,25 @@ func (f *testSingletonFuncs153[T]) CheckAndSetDefaults(t *testing.T) {
 	if f.setup == nil {
 		f.setup = func(t T) {
 			metadata := t.GetMetadata()
-			if metadata.Expires == nil {
-				metadata.Expires = timestamppb.New(time.Now().Add(30 * time.Minute))
+			if !metadata.HasExpires() {
+				metadata.SetExpires(timestamppb.New(time.Now().Add(30 * time.Minute)))
 			} else {
-				expiry := metadata.Expires.AsTime()
-				metadata.Expires = timestamppb.New(expiry.Add(30 * time.Minute))
+				expiry := metadata.GetExpires().AsTime()
+				metadata.SetExpires(timestamppb.New(expiry.Add(30 * time.Minute)))
 			}
-			metadata.Labels = map[string]string{"label": "value1"}
+			metadata.SetLabels(map[string]string{"label": "value1"})
 		}
 	}
 	if f.modify == nil {
 		f.modify = func(t T) {
 			metadata := t.GetMetadata()
-			if metadata.Expires == nil {
-				metadata.Expires = timestamppb.New(time.Now().Add(30 * time.Minute))
+			if !metadata.HasExpires() {
+				metadata.SetExpires(timestamppb.New(time.Now().Add(30 * time.Minute)))
 			} else {
-				expiry := metadata.Expires.AsTime()
-				metadata.Expires = timestamppb.New(expiry.Add(30 * time.Minute))
+				expiry := metadata.GetExpires().AsTime()
+				metadata.SetExpires(timestamppb.New(expiry.Add(30 * time.Minute)))
 			}
-			metadata.Labels["label"] = "value2"
+			metadata.GetLabels()["label"] = "value2"
 		}
 	}
 	if f.cmpOpts == nil {
diff --git a/lib/cache/cache_test.go b/lib/cache/cache_test.go
index b8eb6b2b82f..0d248816069 100644
--- a/lib/cache/cache_test.go
+++ b/lib/cache/cache_test.go
@@ -36,11 +36,12 @@ import (
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport/api/client"
-	"github.com/gravitational/teleport/api/client/proto"
+	clientproto "github.com/gravitational/teleport/api/client/proto"
 	apidefaults "github.com/gravitational/teleport/api/defaults"
 	accessmonitoringrulesv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/accessmonitoringrules/v1"
 	appauthconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/appauthconfig/v1"
@@ -221,23 +222,23 @@ func defaultResource153Ops[T types.Resource153]() *resourceOps[T] {
 	return &resourceOps[T]{
 		Setup: func(t T) {
 			metadata := t.GetMetadata()
-			if metadata.Expires == nil {
-				metadata.Expires = timestamppb.New(time.Now().Add(30 * time.Minute))
+			if !metadata.HasExpires() {
+				metadata.SetExpires(timestamppb.New(time.Now().Add(30 * time.Minute)))
 			} else {
-				expiry := metadata.Expires.AsTime()
-				metadata.Expires = timestamppb.New(expiry.Add(30 * time.Minute))
+				expiry := metadata.GetExpires().AsTime()
+				metadata.SetExpires(timestamppb.New(expiry.Add(30 * time.Minute)))
 			}
-			metadata.Labels = map[string]string{"label": "value1"}
+			metadata.SetLabels(map[string]string{"label": "value1"})
 		},
 		Modify: func(t T) {
 			metadata := t.GetMetadata()
-			if metadata.Expires == nil {
-				metadata.Expires = timestamppb.New(time.Now().Add(30 * time.Minute))
+			if !metadata.HasExpires() {
+				metadata.SetExpires(timestamppb.New(time.Now().Add(30 * time.Minute)))
 			} else {
-				expiry := metadata.Expires.AsTime()
-				metadata.Expires = timestamppb.New(expiry.Add(30 * time.Minute))
+				expiry := metadata.GetExpires().AsTime()
+				metadata.SetExpires(timestamppb.New(expiry.Add(30 * time.Minute)))
 			}
-			metadata.Labels["label"] = "value2"
+			metadata.GetLabels()["label"] = "value2"
 		},
 		Name: func(t T) string { return t.GetMetadata().GetName() },
 		cmpOpts: []cmp.Option{
@@ -1066,7 +1067,7 @@ func BenchmarkListResourcesWithSort(b *testing.B) {
 		for _, totalCount := range []bool{true, false} {
 			b.Run(fmt.Sprintf("limit=%d,needTotal=%t", limit, totalCount), func(b *testing.B) {
 				for b.Loop() {
-					resp, err := p.cache.ListResources(ctx, proto.ListResourcesRequest{
+					resp, err := p.cache.ListResources(ctx, clientproto.ListResourcesRequest{
 						ResourceType: types.KindNode,
 						Namespace:    apidefaults.Namespace,
 						SortBy: types.SortBy{
@@ -1179,7 +1180,7 @@ func TestListResources_NodesTTLVariant(t *testing.T) {
 		IsDesc: true,
 	}
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		resp, err := p.cache.ListResources(ctx, proto.ListResourcesRequest{
+		resp, err := p.cache.ListResources(ctx, clientproto.ListResourcesRequest{
 			Namespace:    apidefaults.Namespace,
 			ResourceType: types.KindNode,
 			StartKey:     listResourcesStartKey,
@@ -1386,24 +1387,24 @@ func mustCreateDatabase(t testing.TB, name, protocol, uri string) *types.Databas
 func newUserTasks(t *testing.T, name string) *usertasksv1.UserTask {
 	t.Helper()
 
-	ut, err := usertasks.NewDiscoverEC2UserTask(&usertasksv1.UserTaskSpec{
+	ut, err := usertasks.NewDiscoverEC2UserTask(usertasksv1.UserTaskSpec_builder{
 		Integration: "my-integration-" + name,
 		TaskType:    usertasks.TaskTypeDiscoverEC2,
 		IssueType:   "ec2-ssm-agent-not-registered",
 		State:       "OPEN",
-		DiscoverEc2: &usertasksv1.DiscoverEC2{
+		DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 			AccountId: "123456789012",
 			Region:    "us-east-1",
 			Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-				"i-123": {
+				"i-123": usertasksv1.DiscoverEC2Instance_builder{
 					InstanceId:      "i-123",
 					DiscoveryConfig: "dc01",
 					DiscoveryGroup:  "dg01",
 					SyncTime:        timestamppb.Now(),
-				},
+				}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	return ut
@@ -2504,7 +2505,7 @@ func newAccessListReview(t *testing.T, accessList, name string) *accesslist.Revi
 func newKubeWaitingContainer(t *testing.T) types.Resource {
 	t.Helper()
 
-	waitingCont, err := kubewaitingcontainer.NewKubeWaitingContainer("container", &kubewaitingcontainerpb.KubernetesWaitingContainerSpec{
+	waitingCont, err := kubewaitingcontainer.NewKubeWaitingContainer("container", kubewaitingcontainerpb.KubernetesWaitingContainerSpec_builder{
 		Username:      "user",
 		Cluster:       "cluster",
 		Namespace:     "namespace",
@@ -2512,7 +2513,7 @@ func newKubeWaitingContainer(t *testing.T) types.Resource {
 		ContainerName: "container",
 		Patch:         []byte("patch"),
 		PatchType:     "application/json-patch+json",
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	return types.Resource153ToLegacy(waitingCont)
@@ -2521,11 +2522,11 @@ func newKubeWaitingContainer(t *testing.T) types.Resource {
 func newCrownJewel(t *testing.T, name string) *crownjewelv1.CrownJewel {
 	t.Helper()
 
-	crownJewel := &crownjewelv1.CrownJewel{
-		Metadata: &headerv1.Metadata{
+	crownJewel := crownjewelv1.CrownJewel_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	return crownJewel
 }
@@ -2533,12 +2534,12 @@ func newCrownJewel(t *testing.T, name string) *crownjewelv1.CrownJewel {
 func newDatabaseObject(t *testing.T, name string) *dbobjectv1.DatabaseObject {
 	t.Helper()
 
-	r, err := databaseobject.NewDatabaseObject(name, &dbobjectv1.DatabaseObjectSpec{
+	r, err := databaseobject.NewDatabaseObject(name, dbobjectv1.DatabaseObjectSpec_builder{
 		Name:                name,
 		Protocol:            "postgres",
 		DatabaseServiceName: "pg",
 		ObjectKind:          "table",
-	})
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
@@ -2546,39 +2547,39 @@ func newDatabaseObject(t *testing.T, name string) *dbobjectv1.DatabaseObject {
 func newAccessGraphSettings(t *testing.T) *clusterconfigpb.AccessGraphSettings {
 	t.Helper()
 
-	r, err := clusterconfig.NewAccessGraphSettings(&clusterconfigpb.AccessGraphSettingsSpec{
+	r, err := clusterconfig.NewAccessGraphSettings(clusterconfigpb.AccessGraphSettingsSpec_builder{
 		SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED,
-	})
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
 
 func newLinuxDesktop(name string) *linuxdesktopv1.LinuxDesktop {
-	return &linuxdesktopv1.LinuxDesktop{
+	return linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "127.0.0.1:22",
 			Hostname: "host",
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func newUserNotification(t *testing.T, name string) *notificationsv1.Notification {
 	t.Helper()
 
-	notification := &notificationsv1.Notification{
+	notification := notificationsv1.Notification_builder{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: name,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{types.NotificationTitleLabel: "test-title"},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	return notification
 }
@@ -2586,68 +2587,66 @@ func newUserNotification(t *testing.T, name string) *notificationsv1.Notificatio
 func newGlobalNotification(t *testing.T, title string) *notificationsv1.GlobalNotification {
 	t.Helper()
 
-	notification := &notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+	notification := notificationsv1.GlobalNotification_builder{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Labels: map[string]string{types.NotificationTitleLabel: title},
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	return notification
 }
 
 func newAccessMonitoringRule(t *testing.T, name string) *accessmonitoringrulesv1.AccessMonitoringRule {
 	t.Helper()
-	notification := &accessmonitoringrulesv1.AccessMonitoringRule{
+	notification := accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
-			Notification: &accessmonitoringrulesv1.Notification{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
+			Notification: accessmonitoringrulesv1.Notification_builder{
 				Name: "test",
-			},
+			}.Build(),
 			Subjects:  []string{"llama", "shark"},
 			Condition: "test",
-		},
-	}
+		}.Build(),
+	}.Build()
 	return notification
 }
 
 func newStaticHostUser(t *testing.T, name string) *userprovisioningpb.StaticHostUser {
 	t.Helper()
-	return userprovisioning.NewStaticHostUser(name, &userprovisioningpb.StaticHostUserSpec{
+	return userprovisioning.NewStaticHostUser(name, userprovisioningpb.StaticHostUserSpec_builder{
 		Matchers: []*userprovisioningpb.Matcher{
-			{
+			userprovisioningpb.Matcher_builder{
 				NodeLabels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "foo",
 						Values: []string{"bar"},
-					},
+					}.Build(),
 				},
 				Groups: []string{"foo", "bar"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 }
 
 func newAutoUpdateConfig(t *testing.T) *autoupdate.AutoUpdateConfig {
 	t.Helper()
 
-	r, err := update.NewAutoUpdateConfig(&autoupdate.AutoUpdateConfigSpec{
-		Tools: &autoupdate.AutoUpdateConfigSpecTools{
+	r, err := update.NewAutoUpdateConfig(autoupdate.AutoUpdateConfigSpec_builder{
+		Tools: autoupdate.AutoUpdateConfigSpecTools_builder{
 			Mode: update.ToolsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
@@ -2655,11 +2654,11 @@ func newAutoUpdateConfig(t *testing.T) *autoupdate.AutoUpdateConfig {
 func newAutoUpdateVersion(t *testing.T) *autoupdate.AutoUpdateVersion {
 	t.Helper()
 
-	r, err := update.NewAutoUpdateVersion(&autoupdate.AutoUpdateVersionSpec{
-		Tools: &autoupdate.AutoUpdateVersionSpecTools{
+	r, err := update.NewAutoUpdateVersion(autoupdate.AutoUpdateVersionSpec_builder{
+		Tools: autoupdate.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
@@ -2667,13 +2666,13 @@ func newAutoUpdateVersion(t *testing.T) *autoupdate.AutoUpdateVersion {
 func newAutoUpdateAgentRollout(t *testing.T) *autoupdate.AutoUpdateAgentRollout {
 	t.Helper()
 
-	r, err := update.NewAutoUpdateAgentRollout(&autoupdate.AutoUpdateAgentRolloutSpec{
+	r, err := update.NewAutoUpdateAgentRollout(autoupdate.AutoUpdateAgentRolloutSpec_builder{
 		StartVersion:   "1.2.3",
 		TargetVersion:  "2.3.4",
 		Schedule:       update.AgentsScheduleImmediate,
 		AutoupdateMode: update.AgentsUpdateModeEnabled,
 		Strategy:       update.AgentsStrategyTimeBased,
-	})
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
@@ -2681,23 +2680,23 @@ func newAutoUpdateAgentRollout(t *testing.T) *autoupdate.AutoUpdateAgentRollout
 func newAutoUpdateAgentReport(t *testing.T, name string) *autoupdate.AutoUpdateAgentReport {
 	t.Helper()
 
-	r, err := update.NewAutoUpdateAgentReport(&autoupdate.AutoUpdateAgentReportSpec{
+	r, err := update.NewAutoUpdateAgentReport(autoupdate.AutoUpdateAgentReportSpec_builder{
 		Timestamp: timestamppb.Now(),
 		Groups: map[string]*autoupdate.AutoUpdateAgentReportSpecGroup{
-			"foo": {
+			"foo": autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 				Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-					"1.2.3": {Count: 1},
-					"1.2.4": {Count: 2},
+					"1.2.3": autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 1}.Build(),
+					"1.2.4": autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 2}.Build(),
 				},
-			},
-			"bar": {
+			}.Build(),
+			"bar": autoupdate.AutoUpdateAgentReportSpecGroup_builder{
 				Versions: map[string]*autoupdate.AutoUpdateAgentReportSpecGroupVersion{
-					"2.3.4": {Count: 3},
-					"2.3.5": {Count: 4},
+					"2.3.4": autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 3}.Build(),
+					"2.3.5": autoupdate.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 4}.Build(),
 				},
-			},
+			}.Build(),
 		},
-	}, name)
+	}.Build(), name)
 	require.NoError(t, err)
 	return r
 }
@@ -2705,30 +2704,30 @@ func newAutoUpdateAgentReport(t *testing.T, name string) *autoupdate.AutoUpdateA
 func newAutoUpdateBotInstanceReport(t *testing.T) *autoupdate.AutoUpdateBotInstanceReport {
 	t.Helper()
 
-	return &autoupdate.AutoUpdateBotInstanceReport{
+	return autoupdate.AutoUpdateBotInstanceReport_builder{
 		Kind:    types.KindAutoUpdateBotInstanceReport,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateBotInstanceReport,
-		},
-		Spec: &autoupdate.AutoUpdateBotInstanceReportSpec{
+		}.Build(),
+		Spec: autoupdate.AutoUpdateBotInstanceReportSpec_builder{
 			Timestamp: timestamppb.Now(),
 			Groups: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup{
-				"foo": {
+				"foo": autoupdate.AutoUpdateBotInstanceReportSpecGroup_builder{
 					Versions: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{
-						"1.2.3": {Count: 1},
-						"1.2.4": {Count: 2},
+						"1.2.3": autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),
+						"1.2.4": autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 2}.Build(),
 					},
-				},
-				"bar": {
+				}.Build(),
+				"bar": autoupdate.AutoUpdateBotInstanceReportSpecGroup_builder{
 					Versions: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{
-						"2.3.4": {Count: 3},
-						"2.3.5": {Count: 4},
+						"2.3.4": autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 3}.Build(),
+						"2.3.5": autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 4}.Build(),
 					},
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func withKeepalive[T any](fn func(context.Context, T) (*types.KeepAlive, error)) func(context.Context, T) error {
@@ -2899,11 +2898,11 @@ func testResourcePagination[T any](t *testing.T, p *testPack, funcs testFuncs[T]
 }
 
 type resourcesLister interface {
-	ListResources(ctx context.Context, req proto.ListResourcesRequest) (*types.ListResourcesResponse, error)
+	ListResources(ctx context.Context, req clientproto.ListResourcesRequest) (*types.ListResourcesResponse, error)
 }
 
 func listResource(ctx context.Context, lister resourcesLister, kind string, pageSize int, pageToken string) ([]types.ResourceWithLabels, string, error) {
-	resp, err := lister.ListResources(ctx, proto.ListResourcesRequest{
+	resp, err := lister.ListResources(ctx, clientproto.ListResourcesRequest{
 		ResourceType: kind,
 		Limit:        int32(pageSize),
 		StartKey:     pageToken,
diff --git a/lib/cache/cert_authority_override_test.go b/lib/cache/cert_authority_override_test.go
index d5373de4bfb..607d21e9d7d 100644
--- a/lib/cache/cert_authority_override_test.go
+++ b/lib/cache/cert_authority_override_test.go
@@ -87,13 +87,13 @@ func TestCertAuthorityOverrides(t *testing.T) {
 }
 
 func newCertAuthorityOverride(caType types.CertAuthType, clusterName string) *subcav1.CertAuthorityOverride {
-	return &subcav1.CertAuthorityOverride{
+	return subcav1.CertAuthorityOverride_builder{
 		Kind:    types.KindCertAuthorityOverride,
 		Version: types.V1,
 		SubKind: string(caType),
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: clusterName,
-		},
+		}.Build(),
 		Spec: &subcav1.CertAuthorityOverrideSpec{},
-	}
+	}.Build()
 }
diff --git a/lib/cache/cluster_config.go b/lib/cache/cluster_config.go
index 530bba598a0..5713bf0ded6 100644
--- a/lib/cache/cluster_config.go
+++ b/lib/cache/cluster_config.go
@@ -379,13 +379,13 @@ func newAccessGraphSettingsCollection(upstream services.ClusterConfiguration, w
 			return []*clusterconfigv1.AccessGraphSettings{set}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *clusterconfigv1.AccessGraphSettings {
-			return &clusterconfigv1.AccessGraphSettings{
+			return clusterconfigv1.AccessGraphSettings_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/crown_jewel.go b/lib/cache/crown_jewel.go
index 77f69196c62..132e16c3da9 100644
--- a/lib/cache/crown_jewel.go
+++ b/lib/cache/crown_jewel.go
@@ -55,13 +55,13 @@ func newCrownJewelCollection(upstream services.CrownJewels, w types.WatchKind) (
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *crownjewelv1.CrownJewel {
-			return &crownjewelv1.CrownJewel{
+			return crownjewelv1.CrownJewel_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/database.go b/lib/cache/database.go
index 942d051473c..eac087554cf 100644
--- a/lib/cache/database.go
+++ b/lib/cache/database.go
@@ -397,13 +397,13 @@ func newDatabaseObjectCollection(upstream services.DatabaseObjects, w types.Watc
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *dbobjectv1.DatabaseObject {
-			return &dbobjectv1.DatabaseObject{
+			return dbobjectv1.DatabaseObject_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/health_check_config.go b/lib/cache/health_check_config.go
index 90dce6536e3..01b83e2c7f9 100644
--- a/lib/cache/health_check_config.go
+++ b/lib/cache/health_check_config.go
@@ -55,13 +55,13 @@ func newHealthCheckConfigCollection(upstream services.HealthCheckConfigReader, w
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *healthcheckconfigv1.HealthCheckConfig {
-			return &healthcheckconfigv1.HealthCheckConfig{
+			return healthcheckconfigv1.HealthCheckConfig_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/health_check_config_test.go b/lib/cache/health_check_config_test.go
index d29734f469b..40fd092e5ea 100644
--- a/lib/cache/health_check_config_test.go
+++ b/lib/cache/health_check_config_test.go
@@ -34,11 +34,11 @@ import (
 func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	cfg, err := healthcheckconfig.NewHealthCheckConfig(name,
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
 				DbLabelsExpression: "labels.env == `test`",
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	return cfg
diff --git a/lib/cache/identitycenter.go b/lib/cache/identitycenter.go
index 5bb03c502e0..a2ffa9b090b 100644
--- a/lib/cache/identitycenter.go
+++ b/lib/cache/identitycenter.go
@@ -54,14 +54,14 @@ func newIdentityCenterAccountCollection(ic services.IdentityCenter, w types.Watc
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *identitycenterv1.Account {
-			return &identitycenterv1.Account{
+			return identitycenterv1.Account_builder{
 				Kind:    hdr.Kind,
 				SubKind: hdr.SubKind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -112,7 +112,7 @@ func (c *Cache) ListIdentityCenterAccounts(ctx context.Context, pageSize int, pa
 	var accounts []*identitycenterv1.Account
 	for account := range rg.store.resources(identityCenterAccountNameIndex, pageToken, "") {
 		if len(accounts) == pageSize {
-			return accounts, account.Metadata.GetName(), nil
+			return accounts, account.GetMetadata().GetName(), nil
 		}
 
 		accounts = append(accounts, utils.CloneProtoMsg(account))
@@ -144,14 +144,14 @@ func newIdentityCenterAccountAssignmentCollection(ic services.IdentityCenter, w
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *identitycenterv1.AccountAssignment {
-			return &identitycenterv1.AccountAssignment{
+			return identitycenterv1.AccountAssignment_builder{
 				Kind:    hdr.Kind,
 				SubKind: hdr.SubKind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -215,7 +215,7 @@ func (c *Cache) ListIdentityCenterAccountAssignments(ctx context.Context, pageSi
 	var assignments []*identitycenterv1.AccountAssignment
 	for assignment := range rg.store.resources(identityCenterAccountAssignmentNameIndex, pageToken, "") {
 		if len(assignments) == pageSize {
-			return assignments, assignment.GetMetadata().Name, nil
+			return assignments, assignment.GetMetadata().GetName(), nil
 		}
 
 		assignments = append(assignments, proto.CloneOf(assignment))
@@ -246,13 +246,13 @@ func newIdentityCenterPrincipalAssignmentCollection(upstream services.IdentityCe
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *identitycenterv1.PrincipalAssignment {
-			return &identitycenterv1.PrincipalAssignment{
+			return identitycenterv1.PrincipalAssignment_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/identitycenter_test.go b/lib/cache/identitycenter_test.go
index ed029ca8201..a6b92442d3b 100644
--- a/lib/cache/identitycenter_test.go
+++ b/lib/cache/identitycenter_test.go
@@ -29,19 +29,19 @@ import (
 )
 
 func newIdentityCenterAccount(id string) *identitycenterv1.Account {
-	return &identitycenterv1.Account{
+	return identitycenterv1.Account_builder{
 		Kind:    types.KindIdentityCenterAccount,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: id,
-		},
-		Spec: &identitycenterv1.AccountSpec{
+		}.Build(),
+		Spec: identitycenterv1.AccountSpec_builder{
 			Id:  id,
 			Arn: "arn:aws:sso:::permissionSet/ssoins-722326ecc902a06a/" + id,
-		},
+		}.Build(),
 		Status: &identitycenterv1.AccountStatus{},
-	}
+	}.Build()
 }
 
 // TestIdentityCenterAccount asserts that an Identity Center Account can be cached
@@ -75,22 +75,22 @@ func TestIdentityCenterAccount(t *testing.T) {
 }
 
 func newIdentityCenterPrincipalAssignment(id string) *identitycenterv1.PrincipalAssignment {
-	return &identitycenterv1.PrincipalAssignment{
+	return identitycenterv1.PrincipalAssignment_builder{
 		Kind:    types.KindIdentityCenterPrincipalAssignment,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: id,
-		},
-		Spec: &identitycenterv1.PrincipalAssignmentSpec{
+		}.Build(),
+		Spec: identitycenterv1.PrincipalAssignmentSpec_builder{
 			PrincipalType: identitycenterv1.PrincipalType_PRINCIPAL_TYPE_USER,
 			PrincipalId:   id,
 			ExternalId:    "ext_" + id,
-		},
-		Status: &identitycenterv1.PrincipalAssignmentStatus{
+		}.Build(),
+		Status: identitycenterv1.PrincipalAssignmentStatus_builder{
 			ProvisioningState: identitycenterv1.ProvisioningState_PROVISIONING_STATE_PROVISIONED,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // TestIdentityCenterPrincipalAssignment asserts that an Identity Center PrincipalAssignment can be cached
@@ -127,20 +127,20 @@ func TestIdentityCenterPrincipalAssignment(t *testing.T) {
 }
 
 func newIdentityCenterAccountAssignment(id string) *identitycenterv1.AccountAssignment {
-	return &identitycenterv1.AccountAssignment{
+	return identitycenterv1.AccountAssignment_builder{
 		Kind:    types.KindIdentityCenterAccountAssignment,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: id,
-		},
-		Spec: &identitycenterv1.AccountAssignmentSpec{
+		}.Build(),
+		Spec: identitycenterv1.AccountAssignmentSpec_builder{
 			Display:       "account " + id,
 			PermissionSet: &identitycenterv1.PermissionSetInfo{},
 			AccountName:   id,
 			AccountId:     id,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // TestIdentityCenterAccountAssignment asserts that an Identity Center
diff --git a/lib/cache/inventory/inventory_cache.go b/lib/cache/inventory/inventory_cache.go
index 113300b72c1..c0bfedfbac1 100644
--- a/lib/cache/inventory/inventory_cache.go
+++ b/lib/cache/inventory/inventory_cache.go
@@ -248,8 +248,8 @@ func (u *inventoryInstance) getVersionKey() bytestring {
 		name = u.instance.GetHostname()
 		id = u.instance.GetName()
 	} else {
-		if u.bot.Status != nil && len(u.bot.Status.LatestHeartbeats) > 0 {
-			versionStr = u.bot.Status.LatestHeartbeats[0].Version
+		if u.bot.HasStatus() && len(u.bot.GetStatus().GetLatestHeartbeats()) > 0 {
+			versionStr = u.bot.GetStatus().GetLatestHeartbeats()[0].GetVersion()
 		}
 		name = u.bot.GetSpec().GetBotName()
 		id = u.bot.GetSpec().GetInstanceId()
@@ -777,13 +777,13 @@ func (ic *InventoryCache) parseFilter(filter *inventoryv1.ListUnifiedInstancesFi
 		filter: filter,
 	}
 
-	if filter == nil || filter.PredicateExpression == "" {
+	if filter == nil || filter.GetPredicateExpression() == "" {
 		return pf, nil
 	}
 
 	parser := getUnifiedExpressionParser()
 
-	expr, err := parser.Parse(filter.PredicateExpression)
+	expr, err := parser.Parse(filter.GetPredicateExpression())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -802,14 +802,14 @@ func (ic *InventoryCache) ListUnifiedInstances(ctx context.Context, req *invento
 
 	ic.metrics.requests.Inc()
 
-	if req.PageSize <= 0 {
-		req.PageSize = defaults.DefaultChunkSize
+	if req.GetPageSize() <= 0 {
+		req.SetPageSize(defaults.DefaultChunkSize)
 	}
 
 	// Decode the PageToken from base32hex
 	var startKey string
-	if req.PageToken != "" {
-		decoded, err := base32.HexEncoding.WithPadding(base32.NoPadding).DecodeString(req.PageToken)
+	if req.GetPageToken() != "" {
+		decoded, err := base32.HexEncoding.WithPadding(base32.NoPadding).DecodeString(req.GetPageToken())
 		if err != nil {
 			return nil, trace.BadParameter("invalid page token: %v", err)
 		}
@@ -857,7 +857,7 @@ func (ic *InventoryCache) ListUnifiedInstances(ctx context.Context, req *invento
 			start, end = end, start
 		}
 
-		if req.PageToken == "" {
+		if req.GetPageToken() == "" {
 			startKey = start
 		}
 		endKey = end
@@ -874,7 +874,7 @@ func (ic *InventoryCache) ListUnifiedInstances(ctx context.Context, req *invento
 			continue
 		}
 
-		if len(items) == int(req.PageSize) {
+		if len(items) == int(req.GetPageSize()) {
 			// Get the key for the current item based on the index
 			rawKey, err := ic.getKeyForIndex(sf, index)
 			if err != nil {
@@ -889,10 +889,10 @@ func (ic *InventoryCache) ListUnifiedInstances(ctx context.Context, req *invento
 		items = append(items, item)
 	}
 
-	return &inventoryv1.ListUnifiedInstancesResponse{
+	return inventoryv1.ListUnifiedInstancesResponse_builder{
 		Items:         items,
 		NextPageToken: nextPageToken,
-	}, nil
+	}.Build(), nil
 }
 
 // matchesFilter checks if a unified instance matches the filter criteria.
@@ -906,7 +906,7 @@ func (ic *InventoryCache) matchesFilter(ui *inventoryInstance, parsed *parsedFil
 	// Filter by instance types
 	isInstance := ui.isInstance()
 	matchesType := false
-	for _, instanceType := range filter.InstanceTypes {
+	for _, instanceType := range filter.GetInstanceTypes() {
 		if instanceType == inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE && isInstance {
 			matchesType = true
 			break
@@ -916,22 +916,22 @@ func (ic *InventoryCache) matchesFilter(ui *inventoryInstance, parsed *parsedFil
 			break
 		}
 	}
-	if len(filter.InstanceTypes) > 0 && !matchesType {
+	if len(filter.GetInstanceTypes()) > 0 && !matchesType {
 		return false
 	}
 
 	// Basic search
-	if filter.Search != "" {
+	if filter.GetSearch() != "" {
 		var searchableText string
 		if ui.isInstance() {
 			// For instances, search by hostname or instance ID
 			searchableText = ui.instance.Spec.Hostname + " " + ui.instance.GetName()
 		} else {
 			// For bot instances, search by bot name or instance ID
-			searchableText = ui.bot.Spec.BotName + " " + ui.bot.GetMetadata().GetName()
+			searchableText = ui.bot.GetSpec().GetBotName() + " " + ui.bot.GetMetadata().GetName()
 		}
 
-		searchTerms := strings.Fields(filter.Search)
+		searchTerms := strings.Fields(filter.GetSearch())
 		matchedAll := true
 		for _, term := range searchTerms {
 			if !strcase.Contains(searchableText, term) {
@@ -946,12 +946,12 @@ func (ic *InventoryCache) matchesFilter(ui *inventoryInstance, parsed *parsedFil
 	}
 
 	// Filter by services (only applies to instances)
-	if len(filter.Services) > 0 {
+	if len(filter.GetServices()) > 0 {
 		// Bot instances don't have services, so exclude them when the services filter is active
 		if !ui.isInstance() {
 			return false
 		}
-		filterServices := set.New(filter.Services...)
+		filterServices := set.New(filter.GetServices()...)
 		hasService := false
 		for _, svc := range ui.instance.Spec.Services {
 			if filterServices.Contains(string(svc)) {
@@ -965,39 +965,39 @@ func (ic *InventoryCache) matchesFilter(ui *inventoryInstance, parsed *parsedFil
 	}
 
 	// Filter by updater groups
-	if len(filter.UpdaterGroups) > 0 {
+	if len(filter.GetUpdaterGroups()) > 0 {
 		var updateGroup string
 		if ui.isInstance() {
 			if ui.instance.Spec.UpdaterInfo != nil {
 				updateGroup = ui.instance.Spec.UpdaterInfo.UpdateGroup
 			}
 		} else {
-			if len(ui.bot.Status.LatestHeartbeats) > 0 && ui.bot.Status.LatestHeartbeats[0].UpdaterInfo != nil {
-				updateGroup = ui.bot.Status.LatestHeartbeats[0].UpdaterInfo.UpdateGroup
+			if len(ui.bot.GetStatus().GetLatestHeartbeats()) > 0 && ui.bot.GetStatus().GetLatestHeartbeats()[0].HasUpdaterInfo() {
+				updateGroup = ui.bot.GetStatus().GetLatestHeartbeats()[0].GetUpdaterInfo().UpdateGroup
 			}
 		}
-		if !slices.Contains(filter.UpdaterGroups, updateGroup) {
+		if !slices.Contains(filter.GetUpdaterGroups(), updateGroup) {
 			return false
 		}
 	}
 
 	// Filter by upgraders
-	if len(filter.Upgraders) > 0 {
+	if len(filter.GetUpgraders()) > 0 {
 		var upgrader string
 		if ui.isInstance() {
 			upgrader = ui.instance.Spec.ExternalUpgrader
 		} else {
-			if len(ui.bot.Status.LatestHeartbeats) > 0 {
-				upgrader = ui.bot.Status.LatestHeartbeats[0].ExternalUpdater
+			if len(ui.bot.GetStatus().GetLatestHeartbeats()) > 0 {
+				upgrader = ui.bot.GetStatus().GetLatestHeartbeats()[0].GetExternalUpdater()
 			}
 		}
-		if !slices.Contains(filter.Upgraders, upgrader) {
+		if !slices.Contains(filter.GetUpgraders(), upgrader) {
 			return false
 		}
 	}
 
 	// Filter with predicate language query
-	if filter.PredicateExpression != "" {
+	if filter.GetPredicateExpression() != "" {
 		match, err := ic.matchSearchKeywords(ui, parsed)
 		if err != nil {
 			ic.cfg.Logger.DebugContext(context.Background(), "Failed to filter instances using predicate expression", "error", err)
@@ -1043,9 +1043,9 @@ func (e *unifiedFilterEnvironment) GetVersion() string {
 		return strings.TrimPrefix(e.ui.instance.Spec.Version, "v")
 	}
 	// For bot instances, get version from latest heartbeat
-	if e.ui.bot.Status != nil && len(e.ui.bot.Status.LatestHeartbeats) > 0 {
+	if e.ui.bot.HasStatus() && len(e.ui.bot.GetStatus().GetLatestHeartbeats()) > 0 {
 		// Trim "v" prefix if it's there
-		return strings.TrimPrefix(e.ui.bot.Status.LatestHeartbeats[0].Version, "v")
+		return strings.TrimPrefix(e.ui.bot.GetStatus().GetLatestHeartbeats()[0].GetVersion(), "v")
 	}
 	return ""
 }
@@ -1058,8 +1058,8 @@ func (e *unifiedFilterEnvironment) GetHostname() string {
 		return e.ui.instance.Spec.Hostname
 	}
 	// For bot instances, get hostname from latest heartbeat
-	if e.ui.bot.Status != nil && len(e.ui.bot.Status.LatestHeartbeats) > 0 {
-		return e.ui.bot.Status.LatestHeartbeats[0].Hostname
+	if e.ui.bot.HasStatus() && len(e.ui.bot.GetStatus().GetLatestHeartbeats()) > 0 {
+		return e.ui.bot.GetStatus().GetLatestHeartbeats()[0].GetHostname()
 	}
 	return ""
 }
@@ -1078,7 +1078,7 @@ func (e *unifiedFilterEnvironment) GetBotName() string {
 	if e == nil || e.ui == nil || e.ui.isInstance() {
 		return ""
 	}
-	return e.ui.bot.Spec.BotName
+	return e.ui.bot.GetSpec().GetBotName()
 }
 
 func (e *unifiedFilterEnvironment) GetInstanceID() string {
@@ -1088,7 +1088,7 @@ func (e *unifiedFilterEnvironment) GetInstanceID() string {
 	if e.ui.isInstance() {
 		return e.ui.instance.GetName()
 	}
-	return e.ui.bot.Spec.InstanceId
+	return e.ui.bot.GetSpec().GetInstanceId()
 }
 
 func (e *unifiedFilterEnvironment) GetServices() []string {
@@ -1114,8 +1114,8 @@ func (e *unifiedFilterEnvironment) GetUpdaterGroup() string {
 		return ""
 	}
 	// For bot instances, get from latest heartbeat
-	if e.ui.bot.Status != nil && len(e.ui.bot.Status.LatestHeartbeats) > 0 && e.ui.bot.Status.LatestHeartbeats[0].UpdaterInfo != nil {
-		return e.ui.bot.Status.LatestHeartbeats[0].UpdaterInfo.UpdateGroup
+	if e.ui.bot.HasStatus() && len(e.ui.bot.GetStatus().GetLatestHeartbeats()) > 0 && e.ui.bot.GetStatus().GetLatestHeartbeats()[0].HasUpdaterInfo() {
+		return e.ui.bot.GetStatus().GetLatestHeartbeats()[0].GetUpdaterInfo().UpdateGroup
 	}
 	return ""
 }
@@ -1128,8 +1128,8 @@ func (e *unifiedFilterEnvironment) GetExternalUpgrader() string {
 		return e.ui.instance.Spec.ExternalUpgrader
 	}
 	// For bot instances, get from latest heartbeat
-	if e.ui.bot.Status != nil && len(e.ui.bot.Status.LatestHeartbeats) > 0 {
-		return e.ui.bot.Status.LatestHeartbeats[0].ExternalUpdater
+	if e.ui.bot.HasStatus() && len(e.ui.bot.GetStatus().GetLatestHeartbeats()) > 0 {
+		return e.ui.bot.GetStatus().GetLatestHeartbeats()[0].GetExternalUpdater()
 	}
 	return ""
 }
diff --git a/lib/cache/inventory/inventory_cache_test.go b/lib/cache/inventory/inventory_cache_test.go
index 5f71a7b12ce..81ea3fba057 100644
--- a/lib/cache/inventory/inventory_cache_test.go
+++ b/lib/cache/inventory/inventory_cache_test.go
@@ -73,7 +73,7 @@ func getItemName(item *inventoryv1.UnifiedInstanceItem) string {
 	if instance := item.GetInstance(); instance != nil {
 		return instance.Spec.Hostname
 	} else if bot := item.GetBotInstance(); bot != nil {
-		return bot.Spec.BotName
+		return bot.GetSpec().GetBotName()
 	}
 	return ""
 }
@@ -85,8 +85,8 @@ func getItemVersion(item *inventoryv1.UnifiedInstanceItem) string {
 	if instance := item.GetInstance(); instance != nil {
 		return instance.Spec.Version
 	} else if bot := item.GetBotInstance(); bot != nil {
-		if len(bot.Status.LatestHeartbeats) > 0 {
-			return bot.Status.LatestHeartbeats[0].Version
+		if len(bot.GetStatus().GetLatestHeartbeats()) > 0 {
+			return bot.GetStatus().GetLatestHeartbeats()[0].GetVersion()
 		}
 	}
 	return ""
@@ -433,74 +433,74 @@ func TestInventoryCache(t *testing.T) {
 
 		// Create mock bot instances
 		bots := []*machineidv1.BotInstance{
-			{
-				Metadata: &headerv1.Metadata{
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot1",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-1",
 					InstanceId: "bot1",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.1.0",
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot2",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-2",
 					InstanceId: "bot2",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.2.0",
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot3",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-3",
 					InstanceId: "bot3",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.2.0",
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot4",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-4",
 					InstanceId: "bot4",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.1.0",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		}
 
 		mockInventory := &mockInventoryService{instances: instances}
@@ -523,11 +523,11 @@ func TestInventoryCache(t *testing.T) {
 		require.True(t, inventoryCache.IsHealthy())
 
 		// Verify all the instances were loaded into the cache
-		listResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		listResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, listResp.Items, 12, "should have 8 instances + 4 bots")
+		require.Len(t, listResp.GetItems(), 12, "should have 8 instances + 4 bots")
 
 		// Verify results are correctly alphabetically sorted
 		expectedOrder := []string{
@@ -545,59 +545,59 @@ func TestInventoryCache(t *testing.T) {
 			"proxy1.example.com",
 		}
 
-		require.Equal(t, expectedOrder, libslices.Map(listResp.Items, getItemName))
+		require.Equal(t, expectedOrder, libslices.Map(listResp.GetItems(), getItemName))
 
 		// Verify pagination works as intended
-		firstPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		firstPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 5,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, firstPageResp.Items, 5, "first page should have 5 items, got %d", len(firstPageResp.Items))
+		require.Len(t, firstPageResp.GetItems(), 5, "first page should have 5 items, got %d", len(firstPageResp.GetItems()))
 
 		// The next page token should be the alphabetical key of the first item on the next page (6th item)
 		expectedNextPageToken := base32.HexEncoding.WithPadding(base32.NoPadding).EncodeToString([]byte(string(ordered.Encode("bot-3", "bot3", types.KindBotInstance))))
-		require.Equal(t, expectedNextPageToken, firstPageResp.NextPageToken)
+		require.Equal(t, expectedNextPageToken, firstPageResp.GetNextPageToken())
 
 		// Fetch another page of 5, this time using the page token from before
-		secondPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		secondPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize:  5,
-			PageToken: firstPageResp.NextPageToken,
-		})
+			PageToken: firstPageResp.GetNextPageToken(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, secondPageResp.Items, 5, "second page should have 5 items, got %d", len(secondPageResp.Items))
+		require.Len(t, secondPageResp.GetItems(), 5, "second page should have 5 items, got %d", len(secondPageResp.GetItems()))
 
 		// The returned next page token should be the alphabetical key of the first item on the third page (11th item)
 		expectedSecondPageToken := base32.HexEncoding.WithPadding(base32.NoPadding).EncodeToString([]byte(string(ordered.Encode("node1.example.com", "agent3", types.KindInstance))))
-		require.Equal(t, expectedSecondPageToken, secondPageResp.NextPageToken, "second page next token should match expected format")
+		require.Equal(t, expectedSecondPageToken, secondPageResp.GetNextPageToken(), "second page next token should match expected format")
 
 		// Fetch another page of 5, using the page token from before
-		thirdPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		thirdPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize:  5,
-			PageToken: secondPageResp.NextPageToken,
-		})
+			PageToken: secondPageResp.GetNextPageToken(),
+		}.Build())
 		require.NoError(t, err)
 		// We should only get 2 items, and no next page token
-		require.Len(t, thirdPageResp.Items, 2, "third page should have 2 items, got %d", len(thirdPageResp.Items))
-		require.Empty(t, thirdPageResp.NextPageToken, "third page should not have a next page token")
+		require.Len(t, thirdPageResp.GetItems(), 2, "third page should have 2 items, got %d", len(thirdPageResp.GetItems()))
+		require.Empty(t, thirdPageResp.GetNextPageToken(), "third page should not have a next page token")
 
 		// Verify filtering by kind works
-		instancesOnlyResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		instancesOnlyResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, instancesOnlyResp.Items, 8, "should have 8 results when filtering by KindInstance")
+		require.Len(t, instancesOnlyResp.GetItems(), 8, "should have 8 results when filtering by KindInstance")
 
-		botsOnlyResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		botsOnlyResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_BOT_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, botsOnlyResp.Items, 4, "should have 4 results when filtering by KindBotInstance")
+		require.Len(t, botsOnlyResp.GetItems(), 4, "should have 4 results when filtering by KindBotInstance")
 	})
 }
 
@@ -648,40 +648,40 @@ func TestInventoryCacheWatcher(t *testing.T) {
 
 		// Create 2 bot instances
 		bots := []*machineidv1.BotInstance{
-			{
-				Metadata: &headerv1.Metadata{
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot1",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-1",
 					InstanceId: "bot1",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.1.0",
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot2",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot-2",
 					InstanceId: "bot2",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.2.0",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		}
 
 		mockInventoryService := &mockInventoryService{
@@ -707,11 +707,11 @@ func TestInventoryCacheWatcher(t *testing.T) {
 		synctest.Wait()
 		require.True(t, inventoryCache.IsHealthy())
 
-		listResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		listResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, listResp.Items, 4, "should start with 4 items (2 instances + 2 bots)")
+		require.Len(t, listResp.GetItems(), 4, "should start with 4 items (2 instances + 2 bots)")
 
 		// Add a new instance and a bot instance to the backend
 		newInstance := &types.InstanceV1{
@@ -731,23 +731,23 @@ func TestInventoryCacheWatcher(t *testing.T) {
 			},
 		}
 
-		newBot := &machineidv1.BotInstance{
-			Metadata: &headerv1.Metadata{
+		newBot := machineidv1.BotInstance_builder{
+			Metadata: headerv1.Metadata_builder{
 				Name: "bot3",
-			},
-			Spec: &machineidv1.BotInstanceSpec{
+			}.Build(),
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "new-bot",
 				InstanceId: "bot3",
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						RecordedAt: timestamppb.Now(),
 						Version:    "18.2.0",
-					},
+					}.Build(),
 				},
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		newInstanceItem, err := generic.FastMarshal(backend.NewKey(instancePrefix, newInstance.GetName()), newInstance)
 		require.NoError(t, err)
@@ -757,33 +757,33 @@ func TestInventoryCacheWatcher(t *testing.T) {
 		newBotBytes, err := services.MarshalBotInstance(newBot)
 		require.NoError(t, err)
 		_, err = p.Backend.Put(ctx, backend.Item{
-			Key:   backend.NewKey(botInstancePrefix, newBot.Spec.BotName, newBot.Metadata.Name),
+			Key:   backend.NewKey(botInstancePrefix, newBot.GetSpec().GetBotName(), newBot.GetMetadata().GetName()),
 			Value: newBotBytes,
 		})
 		require.NoError(t, err)
 
 		// Wait for the inventory cache watcher to process the put events
 		synctest.Wait()
-		listResp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		listResp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, listResp.Items, 6, "should have 6 items after adding 2")
+		require.Len(t, listResp.GetItems(), 6, "should have 6 items after adding 2")
 
 		// Delete the newly added instances
 		err = p.Backend.Delete(ctx, backend.NewKey(instancePrefix, newInstance.GetName()))
 		require.NoError(t, err)
 
-		err = p.Backend.Delete(ctx, backend.NewKey(botInstancePrefix, newBot.Spec.BotName, newBot.Metadata.Name))
+		err = p.Backend.Delete(ctx, backend.NewKey(botInstancePrefix, newBot.GetSpec().GetBotName(), newBot.GetMetadata().GetName()))
 		require.NoError(t, err)
 
 		// Wait for the watcher to process the delete events
 		synctest.Wait()
-		listResp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		listResp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, listResp.Items, 4, "should have 4 items after deleting 2")
+		require.Len(t, listResp.GetItems(), 4, "should have 4 items after deleting 2")
 	})
 }
 
@@ -932,50 +932,50 @@ func TestInventoryCacheFiltering(t *testing.T) {
 		}
 
 		bots := []*machineidv1.BotInstance{
-			{
+			machineidv1.BotInstance_builder{
 				Kind:    types.KindBotInstance,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot1-instance1",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot1",
 					InstanceId: "instance1",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt:      timestamppb.Now(),
 							Version:         "18.1.5",
 							Hostname:        "bot-host1.example.com",
 							ExternalUpdater: "kube",
 							UpdaterInfo:     &types.UpdaterV2Info{UpdateGroup: "bot-group1"},
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
 				Kind:    types.KindBotInstance,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot2-instance2",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bot2",
 					InstanceId: "instance2",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt:      timestamppb.Now(),
 							Version:         "19.0.1",
 							Hostname:        "bot-host2.example.com",
 							ExternalUpdater: "unit",
 							UpdaterInfo:     &types.UpdaterV2Info{UpdateGroup: "bot-group2"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		}
 
 		mockInventory := &mockInventoryService{instances: instances}
@@ -997,182 +997,182 @@ func TestInventoryCacheFiltering(t *testing.T) {
 		require.True(t, inventoryCache.IsHealthy())
 
 		// Test searching by hostname
-		resp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Search: "node1",
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "node1.example.com", resp.Items[0].GetInstance().Spec.Hostname)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "node1.example.com", resp.GetItems()[0].GetInstance().Spec.Hostname)
 
 		// Test searching by bot name
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Search:        "bot2",
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_BOT_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "bot2", resp.Items[0].GetBotInstance().Spec.BotName)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "bot2", resp.GetItems()[0].GetBotInstance().GetSpec().GetBotName())
 
 		// Test filtering by services
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Services:      []string{string(types.RoleAuth), string(types.RoleProxy)},
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 2)
-		require.Equal(t, "auth1.example.com", resp.Items[0].GetInstance().Spec.Hostname)
-		require.Equal(t, "node2.example.com", resp.Items[1].GetInstance().Spec.Hostname)
+		require.Len(t, resp.GetItems(), 2)
+		require.Equal(t, "auth1.example.com", resp.GetItems()[0].GetInstance().Spec.Hostname)
+		require.Equal(t, "node2.example.com", resp.GetItems()[1].GetInstance().Spec.Hostname)
 
 		// Test filtering by updater groups
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				UpdaterGroups: []string{"group1"},
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 2)
+		require.Len(t, resp.GetItems(), 2)
 
 		// Test filtering by external upgraders
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Upgraders:     []string{"kube"},
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 2)
-		for _, item := range resp.Items {
+		require.Len(t, resp.GetItems(), 2)
+		for _, item := range resp.GetItems() {
 			require.Equal(t, "kube", item.GetInstance().Spec.ExternalUpgrader)
 		}
 
 		// Test predicate query filtering by version (less than)
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				PredicateExpression: `older_than(status.latest_heartbeat.version, "18.2.0")`,
 				InstanceTypes:       []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "18.1.0", resp.Items[0].GetInstance().Spec.Version)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "18.1.0", resp.GetItems()[0].GetInstance().Spec.Version)
 
 		// Test predicate query filtering by version (greater than) for both instance types.
 		// This should return 3 instances and 1 bot instance.
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				PredicateExpression: `newer_than(status.latest_heartbeat.version, "18.1.6")`,
 				InstanceTypes:       []inventoryv1.InstanceType{},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 4)
+		require.Len(t, resp.GetItems(), 4)
 
 		// Test predicate query filtering by version (between)
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				PredicateExpression: `between(status.latest_heartbeat.version, "18.0.0", "19.0.0")`,
 				InstanceTypes:       []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 3)
+		require.Len(t, resp.GetItems(), 3)
 
 		// Test predicate query filtering by hostname
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				PredicateExpression: `hostname == "node2.example.com"`,
 				InstanceTypes:       []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "node2.example.com", resp.Items[0].GetInstance().Spec.Hostname)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "node2.example.com", resp.GetItems()[0].GetInstance().Spec.Hostname)
 
 		// Test filtering with multiple filters.
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Services:            []string{string(types.RoleNode)},
 				UpdaterGroups:       []string{"group1"},
 				PredicateExpression: `older_than(status.latest_heartbeat.version, "18.2.0")`,
 				InstanceTypes:       []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "node1.example.com", resp.Items[0].GetInstance().Spec.Hostname)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "node1.example.com", resp.GetItems()[0].GetInstance().Spec.Hostname)
 
 		// Test filtering bot instances by updater group
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				UpdaterGroups: []string{"bot-group1"},
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_BOT_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "bot1", resp.Items[0].GetBotInstance().Spec.BotName)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "bot1", resp.GetItems()[0].GetBotInstance().GetSpec().GetBotName())
 
 		// Test filtering both instances and bot instances by upgrader
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Upgraders: []string{"kube"},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 3)
+		require.Len(t, resp.GetItems(), 3)
 		upgraders := make(map[string]bool)
-		for _, item := range resp.Items {
+		for _, item := range resp.GetItems() {
 			if item.GetInstance() != nil {
 				upgraders[item.GetInstance().Spec.ExternalUpgrader] = true
-			} else if item.GetBotInstance() != nil && len(item.GetBotInstance().Status.LatestHeartbeats) > 0 {
-				upgraders[item.GetBotInstance().Status.LatestHeartbeats[0].ExternalUpdater] = true
+			} else if item.GetBotInstance() != nil && len(item.GetBotInstance().GetStatus().GetLatestHeartbeats()) > 0 {
+				upgraders[item.GetBotInstance().GetStatus().GetLatestHeartbeats()[0].GetExternalUpdater()] = true
 			}
 		}
 		require.True(t, upgraders["kube"])
 		require.Len(t, upgraders, 1)
 
 		// Test filtering for no upgrader works
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Upgraders:     []string{""},
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 1)
-		require.Equal(t, "no-upgrader.example.com", resp.Items[0].GetInstance().Spec.Hostname)
-		require.Empty(t, resp.Items[0].GetInstance().Spec.ExternalUpgrader)
+		require.Len(t, resp.GetItems(), 1)
+		require.Equal(t, "no-upgrader.example.com", resp.GetItems()[0].GetInstance().Spec.Hostname)
+		require.Empty(t, resp.GetItems()[0].GetInstance().Spec.ExternalUpgrader)
 
 		// Test filtering for no upgrader or kube upgrader
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				Upgraders:     []string{"", "kube"},
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 3) // 2 with kube upgrader + 1 with no upgrader
+		require.Len(t, resp.GetItems(), 3) // 2 with kube upgrader + 1 with no upgrader
 	})
 }
 
@@ -1280,57 +1280,57 @@ func TestInventoryCacheSorting(t *testing.T) {
 
 		// Create test bot instances with different bot names and versions
 		bots := []*machineidv1.BotInstance{
-			{
-				Metadata: &headerv1.Metadata{
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot1",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "yyyy",
 					InstanceId: "bot1",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.0.0",
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot2",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "bbbb",
 					InstanceId: "bot2",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "19.2.0",
-						},
+						}.Build(),
 					},
-				},
-			},
-			{
-				Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			machineidv1.BotInstance_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "bot3",
-				},
-				Spec: &machineidv1.BotInstanceSpec{
+				}.Build(),
+				Spec: machineidv1.BotInstanceSpec_builder{
 					BotName:    "dddd",
 					InstanceId: "bot3",
-				},
-				Status: &machineidv1.BotInstanceStatus{
+				}.Build(),
+				Status: machineidv1.BotInstanceStatus_builder{
 					LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-						{
+						machineidv1.BotInstanceStatusHeartbeat_builder{
 							RecordedAt: timestamppb.Now(),
 							Version:    "18.1.5",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		}
 
 		mockInventory := &mockInventoryService{instances: instances}
@@ -1352,24 +1352,24 @@ func TestInventoryCacheSorting(t *testing.T) {
 		require.True(t, inventoryCache.IsHealthy())
 
 		// Version predicate filter should work whether the instance's version has "v" prefix or not
-		resp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				PredicateExpression: `version == "18.0.0"`,
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 2)
-		require.ElementsMatch(t, []string{"v18.0.0", "18.0.0"}, libslices.Map(resp.Items, getItemVersion))
+		require.Len(t, resp.GetItems(), 2)
+		require.ElementsMatch(t, []string{"v18.0.0", "18.0.0"}, libslices.Map(resp.GetItems(), getItemVersion))
 
 		// Test sort by name ascending
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_NAME,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 10)
+		require.Len(t, resp.GetItems(), 10)
 
 		expectedNames := []string{
 			"aaaa",
@@ -1384,16 +1384,16 @@ func TestInventoryCacheSorting(t *testing.T) {
 			"zzzz",
 		}
 
-		require.Equal(t, expectedNames, libslices.Map(resp.Items, getItemName))
+		require.Equal(t, expectedNames, libslices.Map(resp.GetItems(), getItemName))
 
 		// Test sort by name descending
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_NAME,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_DESCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 10)
+		require.Len(t, resp.GetItems(), 10)
 
 		expectedNames = []string{
 			"zzzz",
@@ -1408,16 +1408,16 @@ func TestInventoryCacheSorting(t *testing.T) {
 			"aaaa",
 		}
 
-		require.Equal(t, expectedNames, libslices.Map(resp.Items, getItemName))
+		require.Equal(t, expectedNames, libslices.Map(resp.GetItems(), getItemName))
 
 		// Test sort by type ascending
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_TYPE,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 10)
+		require.Len(t, resp.GetItems(), 10)
 
 		// Expect all bot instances first (sorted by name), then all instances (sorted by name)
 		expectedNames = []string{
@@ -1433,16 +1433,16 @@ func TestInventoryCacheSorting(t *testing.T) {
 			"zzzz",
 		}
 
-		require.Equal(t, expectedNames, libslices.Map(resp.Items, getItemName))
+		require.Equal(t, expectedNames, libslices.Map(resp.GetItems(), getItemName))
 
 		// Test sort by type descending
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_TYPE,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_DESCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 10)
+		require.Len(t, resp.GetItems(), 10)
 
 		// Expect all instances first (desc sorted by name), then all bot instances (desc sorted by name)
 		expectedNames = []string{
@@ -1458,16 +1458,16 @@ func TestInventoryCacheSorting(t *testing.T) {
 			"bbbb",
 		}
 
-		require.Equal(t, expectedNames, libslices.Map(resp.Items, getItemName))
+		require.Equal(t, expectedNames, libslices.Map(resp.GetItems(), getItemName))
 
 		// Test sorting by version ascending
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 10)
+		require.Len(t, resp.GetItems(), 10)
 
 		expectedVersions := []string{
 			"v18.0.0", // v-prefix version (treated as 18.0.0)
@@ -1482,16 +1482,16 @@ func TestInventoryCacheSorting(t *testing.T) {
 			"not-a-version", // invalid version
 		}
 
-		require.Equal(t, expectedVersions, libslices.Map(resp.Items, getItemVersion))
+		require.Equal(t, expectedVersions, libslices.Map(resp.GetItems(), getItemVersion))
 
 		// Test sort by version descending
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_DESCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 10)
+		require.Len(t, resp.GetItems(), 10)
 
 		expectedVersions = []string{
 			"not-a-version",
@@ -1506,104 +1506,104 @@ func TestInventoryCacheSorting(t *testing.T) {
 			"v18.0.0",
 		}
 
-		require.Equal(t, expectedVersions, libslices.Map(resp.Items, getItemVersion))
+		require.Equal(t, expectedVersions, libslices.Map(resp.GetItems(), getItemVersion))
 
 		// Test sorting by version with pagination
-		firstPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		firstPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 3,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, firstPageResp.Items, 3)
-		require.NotEmpty(t, firstPageResp.NextPageToken)
+		require.Len(t, firstPageResp.GetItems(), 3)
+		require.NotEmpty(t, firstPageResp.GetNextPageToken())
 
 		// Verify first page has the correct versions
 		expectedFirstPageVersions := []string{"v18.0.0", "18.0.0", "18.1.0"}
-		require.Equal(t, expectedFirstPageVersions, libslices.Map(firstPageResp.Items, getItemVersion))
+		require.Equal(t, expectedFirstPageVersions, libslices.Map(firstPageResp.GetItems(), getItemVersion))
 
 		// Fetch second page
-		secondPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		secondPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize:  3,
-			PageToken: firstPageResp.NextPageToken,
+			PageToken: firstPageResp.GetNextPageToken(),
 			Sort:      inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:     inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, secondPageResp.Items, 3)
-		require.NotEmpty(t, secondPageResp.NextPageToken)
+		require.Len(t, secondPageResp.GetItems(), 3)
+		require.NotEmpty(t, secondPageResp.GetNextPageToken())
 
 		// Verify second page has the correct versions
 		expectedSecondPageVersions := []string{"18.1.5", "18.2.5", "19.0.0"}
-		require.Equal(t, expectedSecondPageVersions, libslices.Map(secondPageResp.Items, getItemVersion))
+		require.Equal(t, expectedSecondPageVersions, libslices.Map(secondPageResp.GetItems(), getItemVersion))
 
 		// Fetch third page
-		thirdPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		thirdPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize:  3,
-			PageToken: secondPageResp.NextPageToken,
+			PageToken: secondPageResp.GetNextPageToken(),
 			Sort:      inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:     inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, thirdPageResp.Items, 3)
-		require.NotEmpty(t, thirdPageResp.NextPageToken)
+		require.Len(t, thirdPageResp.GetItems(), 3)
+		require.NotEmpty(t, thirdPageResp.GetNextPageToken())
 
 		// Verify third page has the correct versions
 		expectedThirdPageVersions := []string{"19.1.0-alpha", "19.1.0-beta.1", "19.2.0"}
-		require.Equal(t, expectedThirdPageVersions, libslices.Map(thirdPageResp.Items, getItemVersion))
+		require.Equal(t, expectedThirdPageVersions, libslices.Map(thirdPageResp.GetItems(), getItemVersion))
 
 		// Fetch fourth page
-		fourthPageResp, err := inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		fourthPageResp, err := inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize:  3,
-			PageToken: thirdPageResp.NextPageToken,
+			PageToken: thirdPageResp.GetNextPageToken(),
 			Sort:      inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:     inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, fourthPageResp.Items, 1)
-		require.Empty(t, fourthPageResp.NextPageToken)
+		require.Len(t, fourthPageResp.GetItems(), 1)
+		require.Empty(t, fourthPageResp.GetNextPageToken())
 
 		// Verify fourth page has the invalid version
 		var actualVersion string
-		if instance := fourthPageResp.Items[0].GetInstance(); instance != nil {
+		if instance := fourthPageResp.GetItems()[0].GetInstance(); instance != nil {
 			actualVersion = instance.Spec.Version
-		} else if bot := fourthPageResp.Items[0].GetBotInstance(); bot != nil {
-			actualVersion = bot.Status.LatestHeartbeats[0].Version
+		} else if bot := fourthPageResp.GetItems()[0].GetBotInstance(); bot != nil {
+			actualVersion = bot.GetStatus().GetLatestHeartbeats()[0].GetVersion()
 		}
 		require.Equal(t, "not-a-version", actualVersion)
 
 		// Test sorting by version while filtering for only instances
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 7)
+		require.Len(t, resp.GetItems(), 7)
 
 		expectedVersions = []string{"v18.0.0", "18.1.0", "18.2.5", "19.0.0", "19.1.0-alpha", "19.1.0-beta.1", "not-a-version"}
-		require.Equal(t, expectedVersions, libslices.Map(resp.Items, func(item *inventoryv1.UnifiedInstanceItem) string {
+		require.Equal(t, expectedVersions, libslices.Map(resp.GetItems(), func(item *inventoryv1.UnifiedInstanceItem) string {
 			return item.GetInstance().Spec.Version
 		}))
 
 		// Test sorting by version while filtering for only bot instances
-		resp, err = inventoryCache.ListUnifiedInstances(ctx, &inventoryv1.ListUnifiedInstancesRequest{
+		resp, err = inventoryCache.ListUnifiedInstances(ctx, inventoryv1.ListUnifiedInstancesRequest_builder{
 			PageSize: 100,
 			Sort:     inventoryv1.UnifiedInstanceSort_UNIFIED_INSTANCE_SORT_VERSION,
 			Order:    inventoryv1.SortOrder_SORT_ORDER_ASCENDING,
-			Filter: &inventoryv1.ListUnifiedInstancesFilter{
+			Filter: inventoryv1.ListUnifiedInstancesFilter_builder{
 				InstanceTypes: []inventoryv1.InstanceType{inventoryv1.InstanceType_INSTANCE_TYPE_BOT_INSTANCE},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		require.Len(t, resp.Items, 3)
+		require.Len(t, resp.GetItems(), 3)
 
 		expectedBotVersions := []string{"18.0.0", "18.1.5", "19.2.0"}
-		require.Equal(t, expectedBotVersions, libslices.Map(resp.Items, func(item *inventoryv1.UnifiedInstanceItem) string {
-			return item.GetBotInstance().Status.LatestHeartbeats[0].Version
+		require.Equal(t, expectedBotVersions, libslices.Map(resp.GetItems(), func(item *inventoryv1.UnifiedInstanceItem) string {
+			return item.GetBotInstance().GetStatus().GetLatestHeartbeats()[0].GetVersion()
 		}))
 	})
 }
diff --git a/lib/cache/kube_test.go b/lib/cache/kube_test.go
index e68a8ba831f..45149c6dfaf 100644
--- a/lib/cache/kube_test.go
+++ b/lib/cache/kube_test.go
@@ -181,7 +181,7 @@ func TestKubernetesWaitingContainers(t *testing.T) {
 		newResource: func(name string) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
 			waitingCont, err := kubewaitingcontainer.NewKubeWaitingContainer(
 				name,
-				&kubewaitingcontainerpb.KubernetesWaitingContainerSpec{
+				kubewaitingcontainerpb.KubernetesWaitingContainerSpec_builder{
 					Username:      "user",
 					Cluster:       "cluster",
 					Namespace:     "namespace",
@@ -189,7 +189,7 @@ func TestKubernetesWaitingContainers(t *testing.T) {
 					ContainerName: name,
 					Patch:         []byte("{}"),
 					PatchType:     "application/json-patch+json",
-				})
+				}.Build())
 
 			return waitingCont, trace.Wrap(err)
 		},
@@ -198,13 +198,13 @@ func TestKubernetesWaitingContainers(t *testing.T) {
 			return trace.Wrap(err)
 		},
 		cacheGet: func(ctx context.Context, name string) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
-			return p.cache.GetKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
+			return p.cache.GetKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest_builder{
 				Username:      "user",
 				Cluster:       "cluster",
 				Namespace:     "namespace",
 				PodName:       "pod",
 				ContainerName: name,
-			})
+			}.Build())
 		},
 		list: func(ctx context.Context, i int, s string) ([]*kubewaitingcontainerpb.KubernetesWaitingContainer, string, error) {
 			return p.kubeWaitingContainers.ListKubernetesWaitingContainers(ctx, i, s)
@@ -213,13 +213,13 @@ func TestKubernetesWaitingContainers(t *testing.T) {
 			return p.cache.ListKubernetesWaitingContainers(ctx, i, s)
 		},
 		delete: func(ctx context.Context, s string) error {
-			return p.kubeWaitingContainers.DeleteKubernetesWaitingContainer(ctx, &kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
+			return p.kubeWaitingContainers.DeleteKubernetesWaitingContainer(ctx, kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest_builder{
 				Username:      "user",
 				Cluster:       "cluster",
 				Namespace:     "namespace",
 				PodName:       "pod",
 				ContainerName: s,
-			})
+			}.Build())
 		},
 		deleteAll: func(ctx context.Context) error {
 			return p.kubeWaitingContainers.DeleteAllKubernetesWaitingContainers(ctx)
diff --git a/lib/cache/linux_desktop.go b/lib/cache/linux_desktop.go
index 9ec0744ac93..6f1558fa6eb 100644
--- a/lib/cache/linux_desktop.go
+++ b/lib/cache/linux_desktop.go
@@ -61,13 +61,13 @@ func newLinuxDesktopCollection(upstream services.LinuxDesktops, w types.WatchKin
 			return out, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *linuxdesktopv1.LinuxDesktop {
-			return &linuxdesktopv1.LinuxDesktop{
+			return linuxdesktopv1.LinuxDesktop_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/linux_desktop_test.go b/lib/cache/linux_desktop_test.go
index f34fc491791..aaa100d07e9 100644
--- a/lib/cache/linux_desktop_test.go
+++ b/lib/cache/linux_desktop_test.go
@@ -58,15 +58,15 @@ func TestLinuxDesktop(t *testing.T) {
 }
 
 func newLinuxDesktopResource(name string) *linuxdesktopv1.LinuxDesktop {
-	return &linuxdesktopv1.LinuxDesktop{
+	return linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "127.0.0.1:22",
 			Hostname: "host",
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/cache/provisioning.go b/lib/cache/provisioning.go
index 124a00f5661..4be42ba3ace 100644
--- a/lib/cache/provisioning.go
+++ b/lib/cache/provisioning.go
@@ -53,13 +53,13 @@ func newPrincipalStateCollection(upstream services.ProvisioningStates, w types.W
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *provisioningv1.PrincipalState {
-			return &provisioningv1.PrincipalState{
+			return provisioningv1.PrincipalState_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/provisioning_test.go b/lib/cache/provisioning_test.go
index 06362e9f183..058c19aa1ce 100644
--- a/lib/cache/provisioning_test.go
+++ b/lib/cache/provisioning_test.go
@@ -31,22 +31,22 @@ import (
 const testDownstreamID = services.DownstreamID("weyland-yutani")
 
 func newProvisioningPrincipalState(id string) *provisioningv1.PrincipalState {
-	return &provisioningv1.PrincipalState{
+	return provisioningv1.PrincipalState_builder{
 		Kind:    types.KindProvisioningPrincipalState,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: id,
-		},
-		Spec: &provisioningv1.PrincipalStateSpec{
+		}.Build(),
+		Spec: provisioningv1.PrincipalStateSpec_builder{
 			DownstreamId:  string(testDownstreamID),
 			PrincipalType: provisioningv1.PrincipalType_PRINCIPAL_TYPE_USER,
 			PrincipalId:   id,
-		},
-		Status: &provisioningv1.PrincipalStateStatus{
+		}.Build(),
+		Status: provisioningv1.PrincipalStateStatus_builder{
 			ProvisioningState: provisioningv1.ProvisioningState_PROVISIONING_STATE_PROVISIONED,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // TestProvisioningPrincipalState asserts that a ProvisioningPrincipalState can be cached
diff --git a/lib/cache/recording_encryption.go b/lib/cache/recording_encryption.go
index 50d8ffe33ae..3393991a4f0 100644
--- a/lib/cache/recording_encryption.go
+++ b/lib/cache/recording_encryption.go
@@ -56,13 +56,13 @@ func newRecordingEncryptionCollection(upstream services.RecordingEncryption, w t
 			return []*recordingencryptionv1.RecordingEncryption{recordingEncryption}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *recordingencryptionv1.RecordingEncryption {
-			return &recordingencryptionv1.RecordingEncryption{
+			return recordingencryptionv1.RecordingEncryption_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/recording_encryption_test.go b/lib/cache/recording_encryption_test.go
index 0e5b8841dfc..8e2303a06dc 100644
--- a/lib/cache/recording_encryption_test.go
+++ b/lib/cache/recording_encryption_test.go
@@ -26,16 +26,16 @@ import (
 )
 
 func newRecordingEncryption() *recordingencryptionv1.RecordingEncryption {
-	return &recordingencryptionv1.RecordingEncryption{
+	return recordingencryptionv1.RecordingEncryption_builder{
 		Kind:    types.KindRecordingEncryption,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameRecordingEncryption,
-		},
-		Spec: &recordingencryptionv1.RecordingEncryptionSpec{
+		}.Build(),
+		Spec: recordingencryptionv1.RecordingEncryptionSpec_builder{
 			ActiveKeyPairs: nil,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // TestRecordingEncryption tests that CRUD operations on the RecordingEncryption resource are
diff --git a/lib/cache/spiffe_federation.go b/lib/cache/spiffe_federation.go
index ec676bee196..87c70de658e 100644
--- a/lib/cache/spiffe_federation.go
+++ b/lib/cache/spiffe_federation.go
@@ -54,13 +54,13 @@ func newSPIFFEFederationCollection(upstream services.SPIFFEFederations, w types.
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *machineidv1.SPIFFEFederation {
-			return &machineidv1.SPIFFEFederation{
+			return machineidv1.SPIFFEFederation_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/spiffe_federation_test.go b/lib/cache/spiffe_federation_test.go
index 24830eb8981..14724b773a8 100644
--- a/lib/cache/spiffe_federation_test.go
+++ b/lib/cache/spiffe_federation_test.go
@@ -28,20 +28,20 @@ import (
 )
 
 func newSPIFFEFederation(name string) *machineidv1.SPIFFEFederation {
-	return &machineidv1.SPIFFEFederation{
+	return machineidv1.SPIFFEFederation_builder{
 		Kind:    types.KindSPIFFEFederation,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &machineidv1.SPIFFEFederationSpec{
-			BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-				HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+		}.Build(),
+		Spec: machineidv1.SPIFFEFederationSpec_builder{
+			BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+				HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 					BundleEndpointUrl: "https://example.com/bundle.json",
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 func TestSPIFFEFederations(t *testing.T) {
diff --git a/lib/cache/static_host_user.go b/lib/cache/static_host_user.go
index 582b8a2bb5f..812bb624dc6 100644
--- a/lib/cache/static_host_user.go
+++ b/lib/cache/static_host_user.go
@@ -53,13 +53,13 @@ func newStaticHostUserCollection(upstream services.StaticHostUser, w types.Watch
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *userprovisioningv2.StaticHostUser {
-			return &userprovisioningv2.StaticHostUser{
+			return userprovisioningv2.StaticHostUser_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/static_scoped_tokens.go b/lib/cache/static_scoped_tokens.go
index 7b7a2307d46..031b0c82cd6 100644
--- a/lib/cache/static_scoped_tokens.go
+++ b/lib/cache/static_scoped_tokens.go
@@ -52,13 +52,13 @@ func newStaticScopedTokensCollection(upstream services.StaticScopedTokenService,
 			return []*joiningv1.StaticScopedTokens{tokens}, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *joiningv1.StaticScopedTokens {
-			return &joiningv1.StaticScopedTokens{
+			return joiningv1.StaticScopedTokens_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameStaticScopedTokens,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/static_scoped_tokens_test.go b/lib/cache/static_scoped_tokens_test.go
index 8f86f67a421..38b4cc75515 100644
--- a/lib/cache/static_scoped_tokens_test.go
+++ b/lib/cache/static_scoped_tokens_test.go
@@ -31,31 +31,31 @@ import (
 )
 
 func newStaticScopedTokens() *joiningv1.StaticScopedTokens {
-	return &joiningv1.StaticScopedTokens{
+	return joiningv1.StaticScopedTokens_builder{
 		Kind:  types.KindStaticScopedTokens,
 		Scope: "/",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameStaticScopedTokens,
-		},
-		Spec: &joiningv1.StaticScopedTokensSpec{
+		}.Build(),
+		Spec: joiningv1.StaticScopedTokensSpec_builder{
 			Tokens: []*joiningv1.ScopedToken{
-				{
+				joiningv1.ScopedToken_builder{
 					Kind:  types.KindScopedToken,
 					Scope: "/",
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "tok1",
 						Expires: timestamppb.New(time.Now().UTC().Add(time.Hour)),
-					},
-					Spec: &joiningv1.ScopedTokenSpec{
+					}.Build(),
+					Spec: joiningv1.ScopedTokenSpec_builder{
 						Roles:         []string{types.RoleNode.String()},
 						JoinMethod:    string(types.JoinMethodToken),
 						UsageMode:     string(joining.TokenUsageModeUnlimited),
 						AssignedScope: "/local",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // TestStaticScopedTokens tests that CRUD operations on the StaticScopedTokens resource are
diff --git a/lib/cache/summarizer.go b/lib/cache/summarizer.go
index f059a8eeb9e..a0a0e5e2d90 100644
--- a/lib/cache/summarizer.go
+++ b/lib/cache/summarizer.go
@@ -54,13 +54,13 @@ func newInferenceModelCollection(upstream services.Summarizer, w types.WatchKind
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *summarizerv1.InferenceModel {
-			return &summarizerv1.InferenceModel{
+			return summarizerv1.InferenceModel_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -120,13 +120,13 @@ func newInferenceSecretCollection(upstream services.Summarizer, w types.WatchKin
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *summarizerv1.InferenceSecret {
-			return &summarizerv1.InferenceSecret{
+			return summarizerv1.InferenceSecret_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -186,13 +186,13 @@ func newInferencePolicyCollection(upstream services.Summarizer, w types.WatchKin
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *summarizerv1.InferencePolicy {
-			return &summarizerv1.InferencePolicy{
+			return summarizerv1.InferencePolicy_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -284,13 +284,13 @@ func newRetrievalModelCollection(upstream services.Summarizer, w types.WatchKind
 			return []*summarizerv1.RetrievalModel{model}, nil
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *summarizerv1.RetrievalModel {
-			return &summarizerv1.RetrievalModel{
+			return summarizerv1.RetrievalModel_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/summarizer_test.go b/lib/cache/summarizer_test.go
index bd0a50d3bb9..fa71beccc17 100644
--- a/lib/cache/summarizer_test.go
+++ b/lib/cache/summarizer_test.go
@@ -34,13 +34,11 @@ func TestInferenceModelCache(t *testing.T) {
 
 	testResources153(t, p, testFuncs[*summarizerv1.InferenceModel]{
 		newResource: func(name string) (*summarizerv1.InferenceModel, error) {
-			return summarizer.NewInferenceModel(name, &summarizerv1.InferenceModelSpec{
-				Provider: &summarizerv1.InferenceModelSpec_Openai{
-					Openai: &summarizerv1.OpenAIProvider{
-						OpenaiModelId: "gpt-4o",
-					},
-				},
-			}), nil
+			return summarizer.NewInferenceModel(name, summarizerv1.InferenceModelSpec_builder{
+				Openai: summarizerv1.OpenAIProvider_builder{
+					OpenaiModelId: "gpt-4o",
+				}.Build(),
+			}.Build()), nil
 		},
 		create: func(ctx context.Context, item *summarizerv1.InferenceModel) error {
 			_, err := p.summarizer.CreateInferenceModel(ctx, item)
@@ -60,9 +58,9 @@ func TestInferenceSecretCache(t *testing.T) {
 
 	testResources153(t, p, testFuncs[*summarizerv1.InferenceSecret]{
 		newResource: func(name string) (*summarizerv1.InferenceSecret, error) {
-			return summarizer.NewInferenceSecret(name, &summarizerv1.InferenceSecretSpec{
+			return summarizer.NewInferenceSecret(name, summarizerv1.InferenceSecretSpec_builder{
 				Value: "super-secret-value",
-			}), nil
+			}.Build()), nil
 		},
 		create: func(ctx context.Context, item *summarizerv1.InferenceSecret) error {
 			_, err := p.summarizer.CreateInferenceSecret(ctx, item)
@@ -82,10 +80,10 @@ func TestInferencePolicyCache(t *testing.T) {
 
 	testResources153(t, p, testFuncs[*summarizerv1.InferencePolicy]{
 		newResource: func(name string) (*summarizerv1.InferencePolicy, error) {
-			return summarizer.NewInferencePolicy(name, &summarizerv1.InferencePolicySpec{
+			return summarizer.NewInferencePolicy(name, summarizerv1.InferencePolicySpec_builder{
 				Kinds: []string{string(types.SSHSessionKind)},
 				Model: "test-model",
-			}), nil
+			}.Build()), nil
 		},
 		create: func(ctx context.Context, item *summarizerv1.InferencePolicy) error {
 			_, err := p.summarizer.CreateInferencePolicy(ctx, item)
@@ -104,15 +102,13 @@ func TestRetrievalModelCache(t *testing.T) {
 
 		testSingleton153(t, p, testSingletonFuncs153[*summarizerv1.RetrievalModel]{
 			newResource: func() *summarizerv1.RetrievalModel {
-				return summarizer.NewRetrievalModel(&summarizerv1.RetrievalModelSpec{
-					EmbeddingsProvider: &summarizerv1.RetrievalModelSpec_Openai{
-						Openai: &summarizerv1.OpenAIProvider{
-							OpenaiModelId:   "text-embedding-3-small",
-							ApiKeySecretRef: "some",
-						},
-					},
+				return summarizer.NewRetrievalModel(summarizerv1.RetrievalModelSpec_builder{
+					Openai: summarizerv1.OpenAIProvider_builder{
+						OpenaiModelId:   "text-embedding-3-small",
+						ApiKeySecretRef: "some",
+					}.Build(),
 					InferenceModelName: "some",
-				})
+				}.Build())
 			},
 			create:   p.summarizer.CreateRetrievalModel,
 			update:   p.summarizer.UpdateRetrievalModel,
diff --git a/lib/cache/user_task.go b/lib/cache/user_task.go
index 2c00e8d403d..b5f7cbe6026 100644
--- a/lib/cache/user_task.go
+++ b/lib/cache/user_task.go
@@ -55,13 +55,13 @@ func newUserTaskCollection(upstream services.UserTasks, w types.WatchKind) (*col
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *usertasksv1.UserTask {
-			return &usertasksv1.UserTask{
+			return usertasksv1.UserTask_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
@@ -81,7 +81,7 @@ func (c *Cache) ListUserTasks(ctx context.Context, pageSize int64, pageToken str
 			return out, next, trace.Wrap(err)
 		},
 		nextToken: func(t *usertasksv1.UserTask) string {
-			return t.GetMetadata().Name
+			return t.GetMetadata().GetName()
 		},
 		filter: func(ut *usertasksv1.UserTask) bool {
 			return services.MatchUserTask(ut, filters)
diff --git a/lib/cache/users.go b/lib/cache/users.go
index 33b621d829c..8bbea629e26 100644
--- a/lib/cache/users.go
+++ b/lib/cache/users.go
@@ -47,21 +47,21 @@ func newUserCollection(upstream services.UsersService, w types.WatchKind) (*coll
 			}),
 		fetcher: func(ctx context.Context, loadSecrets bool) ([]types.User, error) {
 			fn := func(ctx context.Context, pageSize int, token string) ([]types.User, string, error) {
-				rsp, err := upstream.ListUsers(ctx, &userspb.ListUsersRequest{
+				rsp, err := upstream.ListUsers(ctx, userspb.ListUsersRequest_builder{
 					WithSecrets: loadSecrets,
 					PageSize:    int32(pageSize),
 					PageToken:   token,
-				})
+				}.Build())
 				if err != nil {
 					return nil, "", trace.Wrap(err)
 				}
 
-				out := make([]types.User, 0, len(rsp.Users))
-				for _, user := range rsp.Users {
+				out := make([]types.User, 0, len(rsp.GetUsers()))
+				for _, user := range rsp.GetUsers() {
 					out = append(out, user)
 				}
 
-				return out, rsp.NextPageToken, nil
+				return out, rsp.GetNextPageToken(), nil
 			}
 
 			// Use clientutils for auto pagesize backoff.
@@ -160,7 +160,7 @@ func (c *Cache) ListUsers(ctx context.Context, req *userspb.ListUsersRequest) (*
 	ctx, span := c.Tracer.Start(ctx, "cache/ListUsers")
 	defer span.End()
 
-	if req.WithSecrets { // cache never tracks user secrets
+	if req.GetWithSecrets() { // cache never tracks user secrets
 		rsp, err := c.Config.Users.ListUsers(ctx, req)
 		return rsp, trace.Wrap(err)
 	}
@@ -177,31 +177,31 @@ func (c *Cache) ListUsers(ctx context.Context, req *userspb.ListUsersRequest) (*
 	}
 
 	// Adjust page size, so it can't be too large.
-	pageSize := int(req.PageSize)
+	pageSize := int(req.GetPageSize())
 	if pageSize <= 0 || pageSize > apidefaults.DefaultChunkSize {
 		pageSize = apidefaults.DefaultChunkSize
 	}
 
 	var resp userspb.ListUsersResponse
-	for u := range rg.store.resources(userNameIndex, req.PageToken, "") {
+	for u := range rg.store.resources(userNameIndex, req.GetPageToken(), "") {
 		uv2, ok := u.(*types.UserV2)
 		if !ok {
 			continue
 		}
 
-		if req.Filter != nil && !req.Filter.Match(uv2) {
+		if req.HasFilter() && !req.GetFilter().Match(uv2) {
 			continue
 		}
 
-		if len(resp.Users) == pageSize {
-			resp.NextPageToken = u.GetName()
+		if len(resp.GetUsers()) == pageSize {
+			resp.SetNextPageToken(u.GetName())
 			break
 		}
 
-		if req.WithSecrets {
-			resp.Users = append(resp.Users, u.Clone().(*types.UserV2))
+		if req.GetWithSecrets() {
+			resp.SetUsers(append(resp.GetUsers(), u.Clone().(*types.UserV2)))
 		} else {
-			resp.Users = append(resp.Users, u.WithoutSecrets().(*types.UserV2))
+			resp.SetUsers(append(resp.GetUsers(), u.WithoutSecrets().(*types.UserV2)))
 		}
 	}
 	return &resp, nil
diff --git a/lib/cache/users_test.go b/lib/cache/users_test.go
index 4b56e7c57c3..945850ed4a4 100644
--- a/lib/cache/users_test.go
+++ b/lib/cache/users_test.go
@@ -66,37 +66,37 @@ func TestUsers(t *testing.T) {
 			},
 			list: func(ctx context.Context, pageSize int, pageToken string) ([]types.User, string, error) {
 				var out []types.User
-				req := &userspb.ListUsersRequest{
+				req := userspb.ListUsersRequest_builder{
 					PageSize:  int32(pageSize),
 					PageToken: pageToken,
-				}
+				}.Build()
 				resp, err := p.usersS.ListUsers(ctx, req)
 				if err != nil {
 					return nil, "", trace.Wrap(err)
 				}
 
-				for _, u := range resp.Users {
+				for _, u := range resp.GetUsers() {
 					out = append(out, u)
 				}
 
-				return out, resp.NextPageToken, nil
+				return out, resp.GetNextPageToken(), nil
 			},
 			cacheList: func(ctx context.Context, pageSize int, pageToken string) ([]types.User, string, error) {
 				var out []types.User
-				req := &userspb.ListUsersRequest{
+				req := userspb.ListUsersRequest_builder{
 					PageSize:  int32(pageSize),
 					PageToken: pageToken,
-				}
+				}.Build()
 				resp, err := p.cache.ListUsers(ctx, req)
 				if err != nil {
 					return nil, "", trace.Wrap(err)
 				}
 
-				for _, u := range resp.Users {
+				for _, u := range resp.GetUsers() {
 					out = append(out, u)
 				}
 
-				return out, resp.NextPageToken, nil
+				return out, resp.GetNextPageToken(), nil
 			},
 			update: func(ctx context.Context, user types.User) error {
 				_, err := p.usersS.UpdateUser(ctx, user)
@@ -134,19 +134,19 @@ func TestUsers(t *testing.T) {
 		waitForUsersCacheLen(len(usersToCreate))
 
 		var allUsers []*types.UserV2
-		req := &userspb.ListUsersRequest{
+		req := userspb.ListUsersRequest_builder{
 			PageSize: 1,
-		}
+		}.Build()
 		for {
 			resp, err := p.cache.ListUsers(t.Context(), req)
 			require.NoError(t, err)
-			require.Len(t, resp.Users, 1)
+			require.Len(t, resp.GetUsers(), 1)
 
-			allUsers = append(allUsers, resp.Users...)
-			if resp.NextPageToken == "" {
+			allUsers = append(allUsers, resp.GetUsers()...)
+			if resp.GetNextPageToken() == "" {
 				break
 			}
-			req.PageToken = resp.NextPageToken
+			req.SetPageToken(resp.GetNextPageToken())
 		}
 		require.Len(t, allUsers, len(usersToCreate))
 	})
diff --git a/lib/cache/workload_identity.go b/lib/cache/workload_identity.go
index daa6fe9066c..d800818f226 100644
--- a/lib/cache/workload_identity.go
+++ b/lib/cache/workload_identity.go
@@ -61,13 +61,13 @@ func newWorkloadIdentityCollection(upstream services.WorkloadIdentities, w types
 			return out, trace.Wrap(err)
 		},
 		headerTransform: func(hdr *types.ResourceHeader) *workloadidentityv1pb.WorkloadIdentity {
-			return &workloadidentityv1pb.WorkloadIdentity{
+			return workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    hdr.Kind,
 				Version: hdr.Version,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: hdr.Metadata.Name,
-				},
-			}
+				}.Build(),
+			}.Build()
 		},
 		watch: w,
 	}, nil
diff --git a/lib/cache/workload_identity_test.go b/lib/cache/workload_identity_test.go
index f5f95a0027f..e78bf6cf521 100644
--- a/lib/cache/workload_identity_test.go
+++ b/lib/cache/workload_identity_test.go
@@ -33,18 +33,18 @@ import (
 )
 
 func newWorkloadIdentity(name string) *workloadidentityv1pb.WorkloadIdentity {
-	return &workloadidentityv1pb.WorkloadIdentity{
+	return workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/example",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 func TestWorkloadIdentity(t *testing.T) {
@@ -96,18 +96,18 @@ func TestWorkloadIdentityCacheSorting(t *testing.T) {
 	}
 
 	for _, r := range rs {
-		id := &workloadidentityv1pb.WorkloadIdentity{
+		id := workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: r.name,
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: r.spiffeID,
-				},
-			},
-		}
+				}.Build(),
+			}.Build(),
+		}.Build()
 
 		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, id)
 		require.NoError(t, err, "failed to create WorkloadIdentity %q", r.name)
@@ -190,18 +190,18 @@ func TestWorkloadIdentityCacheFallback(t *testing.T) {
 	})
 	t.Cleanup(p.Close)
 
-	_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-workload-identity-1",
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/test/spiffe/1",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Let the cache catch up
@@ -246,18 +246,18 @@ func TestWorkloadIdentityCacheSearchFilter(t *testing.T) {
 
 	for n := range 10 {
 		name := "test-workload-identity-" + strconv.Itoa(n)
-		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/test/" + strconv.Itoa(n%2) + "/id" + strconv.Itoa(n),
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err, "failed to create WorkloadIdentity %q", name)
 	}
 
@@ -287,34 +287,34 @@ func TestWorkloadIdentityCaseSensitiveName(t *testing.T) {
 	t.Cleanup(p.Close)
 
 	{
-		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "TEST-WORKLOAD-IDENTITY-1",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/test/spiffe/1",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
 	{
-		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		_, err := p.workloadIdentity.CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-workload-identity-1",
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/test/spiffe/1",
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -327,7 +327,7 @@ func TestWorkloadIdentityCaseSensitiveName(t *testing.T) {
 		require.NoError(t, err)
 		require.Len(t, results, 2)
 
-		require.Equal(t, "test-workload-identity-1", results[0].Metadata.Name)
-		require.Equal(t, "TEST-WORKLOAD-IDENTITY-1", results[1].Metadata.Name)
+		require.Equal(t, "test-workload-identity-1", results[0].GetMetadata().GetName())
+		require.Equal(t, "TEST-WORKLOAD-IDENTITY-1", results[1].GetMetadata().GetName())
 	}, 10*time.Second, 100*time.Millisecond)
 }
diff --git a/lib/client/api.go b/lib/client/api.go
index 3efe41f8095..d8284f4f10e 100644
--- a/lib/client/api.go
+++ b/lib/client/api.go
@@ -3664,11 +3664,11 @@ func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, keyRing *KeyRi
 
 	newCerts, err := tc.DeviceLogin(ctx, &dtauthntypes.CeremonyRunParams{
 		DevicesClient: rootAuthClient.DevicesClient(),
-		Certs: &devicepb.UserCertificates{
+		Certs: devicepb.UserCertificates_builder{
 			// Augment the SSH certificate.
 			// The TLS certificate is already part of the connection.
 			SshAuthorizedKey: keyRing.Cert,
-		},
+		}.Build(),
 		SSHSigner: keyRing.SSHPrivateKey,
 	})
 	switch {
@@ -3688,10 +3688,10 @@ func (tc *TeleportClient) AttemptDeviceLogin(ctx context.Context, keyRing *KeyRi
 
 	log.DebugContext(ctx, "Device Trust: acquired augmented user certificates")
 	cp := *keyRing
-	cp.Cert = newCerts.SshAuthorizedKey
+	cp.Cert = newCerts.GetSshAuthorizedKey()
 	cp.TLSCert = pem.EncodeToMemory(&pem.Block{
 		Type:  "CERTIFICATE",
-		Bytes: newCerts.X509Der,
+		Bytes: newCerts.GetX509Der(),
 	})
 
 	if err := tc.localAgent.AddKeyRing(&cp); err != nil {
@@ -4053,7 +4053,7 @@ func (tc *TeleportClient) SSHLogin(ctx context.Context, sshLoginFunc SSHLoginFun
 	}
 
 	if ident.ScopePin != nil {
-		log.DebugContext(ctx, "got scoped certificate identity", "scope", ident.ScopePin.Scope, "assignments", pinning.AssignmentTreeIntoMap(ident.ScopePin.AssignmentTree))
+		log.DebugContext(ctx, "got scoped certificate identity", "scope", ident.ScopePin.GetScope(), "assignments", pinning.AssignmentTreeIntoMap(ident.ScopePin.GetAssignmentTree()))
 	}
 
 	return keyRing, nil
diff --git a/lib/client/api_login_test.go b/lib/client/api_login_test.go
index c195a8410d6..97c683a96e1 100644
--- a/lib/client/api_login_test.go
+++ b/lib/client/api_login_test.go
@@ -361,13 +361,13 @@ func TestTeleportClient_Login_local(t *testing.T) {
 				require.NoError(t, err)
 
 				require.NotNil(t, sshIdent.ScopePin)
-				require.Empty(t, cmp.Diff(&scopesv1.Pin{
+				require.Empty(t, cmp.Diff(scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_USER,
 					Scope: "/aa",
 					AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 						"/aa": {"/aa": {"role-a"}},
 					}),
-				}, sshIdent.ScopePin, protocmp.Transform()))
+				}.Build(), sshIdent.ScopePin, protocmp.Transform()))
 				require.Empty(t, sshIdent.Roles)
 			}
 		})
@@ -432,10 +432,10 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 	// In a real scenario these would be augmented certs.
 	block, _ := pem.Decode(keyRing.TLSCert)
 	require.NotNil(t, block, "Decode failed")
-	validCerts := &devicepb.UserCertificates{
+	validCerts := devicepb.UserCertificates_builder{
 		X509Der:          block.Bytes,
 		SshAuthorizedKey: keyRing.Cert,
-	}
+	}.Build()
 
 	t.Run("device login", func(t *testing.T) {
 		// We need this because the running standalone process is not Enterprise.
@@ -470,9 +470,9 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 		// Test! Exercise DeviceLogin.
 		got, err := teleportClient.DeviceLogin(ctx, &dtauthntypes.CeremonyRunParams{
 			DevicesClient: rootAuthClient.DevicesClient(),
-			Certs: &devicepb.UserCertificates{
+			Certs: devicepb.UserCertificates_builder{
 				SshAuthorizedKey: keyRing.Cert,
-			},
+			}.Build(),
 			SSHSigner: keyRing.SSHPrivateKey,
 		})
 		require.NoError(t, err, "DeviceLogin failed")
@@ -529,9 +529,9 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 		teleportClient.SetDTAutoEnroll(func(_ context.Context, _ devicepb.DeviceTrustServiceClient) (*devicepb.Device, error) {
 			autoEnrollCalls++
 			enrolled = true
-			return &devicepb.Device{
+			return devicepb.Device_builder{
 				Id: "mydevice",
-			}, nil
+			}.Build(), nil
 		})
 
 		clusterClient, err := teleportClient.ConnectToCluster(ctx)
@@ -545,9 +545,9 @@ func TestTeleportClient_DeviceLogin(t *testing.T) {
 		// Test!
 		got, err := teleportClient.DeviceLogin(ctx, &dtauthntypes.CeremonyRunParams{
 			DevicesClient: rootAuthClient.DevicesClient(),
-			Certs: &devicepb.UserCertificates{
+			Certs: devicepb.UserCertificates_builder{
 				SshAuthorizedKey: keyRing.Cert,
-			},
+			}.Build(),
 			SSHSigner: keyRing.SSHPrivateKey,
 		})
 		require.NoError(t, err, "DeviceLogin failed")
@@ -746,59 +746,59 @@ func createAndAssignScopedRoles(t *testing.T, ctx context.Context, authServer *a
 	}
 
 	scopedRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-a",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/aa"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-b",
-			},
+			}.Build(),
 			Scope: "/bb",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/bb"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	for _, role := range scopedRoles {
-		_, err = authServer.ScopedAccess().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err = authServer.ScopedAccess().CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
 	// assign both roles to user
 	for _, role := range scopedRoles {
-		_, err = authServer.ScopedAccess().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-			Assignment: &scopedaccessv1.ScopedRoleAssignment{
+		_, err = authServer.ScopedAccess().CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+			Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    scopedaccess.KindScopedRoleAssignment,
 				SubKind: scopedaccess.SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.NewString(),
-				},
+				}.Build(),
 				Scope: role.GetScope(),
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: username,
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  role.GetMetadata().GetName(),
 							Scope: role.GetScope(),
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
diff --git a/lib/client/ca_export.go b/lib/client/ca_export.go
index b006b92c948..2ef60971180 100644
--- a/lib/client/ca_export.go
+++ b/lib/client/ca_export.go
@@ -485,13 +485,13 @@ func ExportIntegrationAuthorities(ctx context.Context, client authclient.ClientI
 }
 
 func fetchIntegrationCAKeySet(ctx context.Context, client authclient.ClientI, integration string) (*types.CAKeySet, error) {
-	resp, err := client.IntegrationsClient().ExportIntegrationCertAuthorities(ctx, &integrationpb.ExportIntegrationCertAuthoritiesRequest{
+	resp, err := client.IntegrationsClient().ExportIntegrationCertAuthorities(ctx, integrationpb.ExportIntegrationCertAuthoritiesRequest_builder{
 		Integration: integration,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return resp.CertAuthorities, nil
+	return resp.GetCertAuthorities(), nil
 }
 
 func exportGitHubCAs(keySet *types.CAKeySet, req ExportIntegrationAuthoritiesRequest) (string, error) {
diff --git a/lib/client/ca_export_test.go b/lib/client/ca_export_test.go
index df5e1024d6d..e24ff501eff 100644
--- a/lib/client/ca_export_test.go
+++ b/lib/client/ca_export_test.go
@@ -81,9 +81,9 @@ type mockIntegrationsClient struct {
 }
 
 func (m *mockIntegrationsClient) ExportIntegrationCertAuthorities(ctx context.Context, in *integrationpb.ExportIntegrationCertAuthoritiesRequest, opts ...grpc.CallOption) (*integrationpb.ExportIntegrationCertAuthoritiesResponse, error) {
-	return &integrationpb.ExportIntegrationCertAuthoritiesResponse{
+	return integrationpb.ExportIntegrationCertAuthoritiesResponse_builder{
 		CertAuthorities: m.caKeySet,
-	}, nil
+	}.Build(), nil
 }
 
 func TestExportAllAuthorities(t *testing.T) {
diff --git a/lib/client/client_store.go b/lib/client/client_store.go
index 5fd7b655399..fb80b6529cc 100644
--- a/lib/client/client_store.go
+++ b/lib/client/client_store.go
@@ -278,7 +278,7 @@ func (s *Store) ReadProfileStatus(proxyAddressOrProfile string) (*ProfileStatus,
 
 	var scopePin *scopesv1.Pin
 	if profile.Scope != "" {
-		scopePin = &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: profile.Scope}
+		scopePin = scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: profile.Scope}.Build()
 	}
 
 	// If we can't find a keyRing to match the profile, connect to the keyRing (hardware key),
diff --git a/lib/client/client_store_test.go b/lib/client/client_store_test.go
index fb6cb384fda..05f52408510 100644
--- a/lib/client/client_store_test.go
+++ b/lib/client/client_store_test.go
@@ -469,7 +469,7 @@ func TestPartialProfileStatusScope(t *testing.T) {
 			status, err := clientStore.ReadProfileStatus(p.Name())
 			require.NoError(t, err)
 			require.NotNil(t, status.ScopePin)
-			require.Equal(t, "/production", status.ScopePin.Scope)
+			require.Equal(t, "/production", status.ScopePin.GetScope())
 		})
 	})
 }
diff --git a/lib/client/ssh/ssh.go b/lib/client/ssh/ssh.go
index cda8a9b08a3..292f69f63d0 100644
--- a/lib/client/ssh/ssh.go
+++ b/lib/client/ssh/ssh.go
@@ -53,8 +53,8 @@ func KeyboardInteractive(ctx context.Context, p MFACeremonyPerformer, m ssh.Conn
 					return nil, trace.BadParameter("received sshpb.AuthPrompt with nil Prompt field")
 				}
 
-				switch pr.GetPrompt().(type) {
-				case *sshpb.AuthPrompt_MfaPrompt:
+				switch pr.WhichPrompt() {
+				case sshpb.AuthPrompt_MfaPrompt_case:
 					answer, err := handleMFAPrompt(ctx, p, m)
 					if err != nil {
 						return nil, trace.Wrap(err)
@@ -80,13 +80,11 @@ func handleMFAPrompt(ctx context.Context, p MFACeremonyPerformer, m ssh.ConnMeta
 	}
 
 	// Construct the response referencing the challenge solved by the user.
-	resp := &sshpb.MFAPromptResponse{
-		Response: &sshpb.MFAPromptResponse_Reference{
-			Reference: &sshpb.MFAPromptResponseReference{
-				ChallengeName: name,
-			},
-		},
-	}
+	resp := sshpb.MFAPromptResponse_builder{
+		Reference: sshpb.MFAPromptResponseReference_builder{
+			ChallengeName: name,
+		}.Build(),
+	}.Build()
 
 	// Marshal the response to JSON since the authentication method only supports UTF-8 strings.
 	answerBytes, err := protojson.Marshal(resp)
diff --git a/lib/client/ssh/ssh_test.go b/lib/client/ssh/ssh_test.go
index 24e42137d5a..699efd71233 100644
--- a/lib/client/ssh/ssh_test.go
+++ b/lib/client/ssh/ssh_test.go
@@ -45,11 +45,9 @@ func TestKeyboardInteractive_SuccessfulMFA(t *testing.T) {
 	)
 	require.NotNil(t, authMethod)
 
-	mfaPrompt := &sshpb.AuthPrompt{
-		Prompt: &sshpb.AuthPrompt_MfaPrompt{
-			MfaPrompt: &sshpb.MFAPrompt{},
-		},
-	}
+	mfaPrompt := sshpb.AuthPrompt_builder{
+		MfaPrompt: &sshpb.MFAPrompt{},
+	}.Build()
 	mfaPromptJSON, err := protojson.Marshal(mfaPrompt)
 	require.NoError(t, err)
 
@@ -79,11 +77,9 @@ func TestKeyboardInteractive_FailedMFA(t *testing.T) {
 	)
 	require.NotNil(t, authMethod)
 
-	mfaPrompt := &sshpb.AuthPrompt{
-		Prompt: &sshpb.AuthPrompt_MfaPrompt{
-			MfaPrompt: &sshpb.MFAPrompt{},
-		},
-	}
+	mfaPrompt := sshpb.AuthPrompt_builder{
+		MfaPrompt: &sshpb.MFAPrompt{},
+	}.Build()
 	mfaPromptJSON, err := protojson.Marshal(mfaPrompt)
 	require.NoError(t, err)
 
diff --git a/lib/cloud/awsconfig/awsconfig.go b/lib/cloud/awsconfig/awsconfig.go
index d307ad7bc9d..25852d5cdf8 100644
--- a/lib/cloud/awsconfig/awsconfig.go
+++ b/lib/cloud/awsconfig/awsconfig.go
@@ -537,23 +537,23 @@ func (p *integrationCredentialsProvider) Retrieve(ctx context.Context) (aws.Cred
 			return aws.Credentials{}, trace.BadParameter("missing roles anywhere integration client")
 		}
 
-		resp, err := p.rolesAnywhereIntegrationClient.GenerateAWSRACredentials(ctx, &integrationpb.GenerateAWSRACredentialsRequest{
+		resp, err := p.rolesAnywhereIntegrationClient.GenerateAWSRACredentials(ctx, integrationpb.GenerateAWSRACredentialsRequest_builder{
 			Integration:                   p.integrationName,
 			ProfileArn:                    p.rolesAnywhereProfileMetadata.ProfileARN,
 			ProfileAcceptsRoleSessionName: p.rolesAnywhereProfileMetadata.ProfileAcceptsRoleSessionName,
 			RoleArn:                       p.rolesAnywhereProfileMetadata.RoleARN,
 			SubjectName:                   p.rolesAnywhereProfileMetadata.IdentityUsername,
 			SessionMaxDuration:            durationpb.New(p.rolesAnywhereProfileMetadata.SessionDuration),
-		})
+		}.Build())
 		if err != nil {
 			return aws.Credentials{}, trace.Wrap(err)
 		}
 
 		return aws.Credentials{
-			AccessKeyID:     resp.AccessKeyId,
-			SecretAccessKey: resp.SecretAccessKey,
-			SessionToken:    resp.SessionToken,
-			Expires:         resp.Expiration.AsTime(),
+			AccessKeyID:     resp.GetAccessKeyId(),
+			SecretAccessKey: resp.GetSecretAccessKey(),
+			SessionToken:    resp.GetSessionToken(),
+			Expires:         resp.GetExpiration().AsTime(),
 			Source:          awsra.AWSCredentialsSourceRolesAnywhere,
 		}, nil
 
diff --git a/lib/cloud/awsconfig/awsconfig_test.go b/lib/cloud/awsconfig/awsconfig_test.go
index f0ae64fad70..4d7b5c7a21a 100644
--- a/lib/cloud/awsconfig/awsconfig_test.go
+++ b/lib/cloud/awsconfig/awsconfig_test.go
@@ -325,12 +325,12 @@ func (f *mockRolesAnywhereClient) GetIntegration(ctx context.Context, name strin
 }
 
 func (m *mockRolesAnywhereClient) GenerateAWSRACredentials(ctx context.Context, req *integrationpb.GenerateAWSRACredentialsRequest) (*integrationpb.GenerateAWSRACredentialsResponse, error) {
-	return &integrationpb.GenerateAWSRACredentialsResponse{
+	return integrationpb.GenerateAWSRACredentialsResponse_builder{
 		Expiration:      timestamppb.New(time.Now().Add(1 * time.Hour)),
 		AccessKeyId:     "mock-access-key-id",
 		SecretAccessKey: "mock-secret-access-key",
 		SessionToken:    "mock-session-token",
-	}, nil
+	}.Build(), nil
 }
 
 func TestNewCacheKey(t *testing.T) {
diff --git a/lib/config/fileconf.go b/lib/config/fileconf.go
index ce8f085718b..f8a32f0e5d8 100644
--- a/lib/config/fileconf.go
+++ b/lib/config/fileconf.go
@@ -1134,24 +1134,24 @@ func (t StaticScopedTokens) Parse() (*joiningv1.StaticScopedTokens, error) {
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		scopedToken := &joiningv1.ScopedToken{
+		scopedToken := joiningv1.ScopedToken_builder{
 			Version: types.V1,
 			Kind:    types.KindScopedToken,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: st.Name,
-			},
+			}.Build(),
 			Scope: scopes.Root,
-			Spec: &joiningv1.ScopedTokenSpec{
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				Roles:           roles.StringSlice(),
 				AssignedScope:   st.Scope,
 				JoinMethod:      string(types.JoinMethodToken),
 				UsageMode:       string(joining.TokenUsageModeUnlimited),
 				ImmutableLabels: immutableLabels,
-			},
-			Status: &joiningv1.ScopedTokenStatus{
+			}.Build(),
+			Status: joiningv1.ScopedTokenStatus_builder{
 				Secret: st.Secret,
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		if err := joining.StrongValidateToken(scopedToken); err != nil {
 			return nil, trace.Wrap(err)
@@ -1160,17 +1160,17 @@ func (t StaticScopedTokens) Parse() (*joiningv1.StaticScopedTokens, error) {
 		scopedTokens = append(scopedTokens, scopedToken)
 	}
 
-	return &joiningv1.StaticScopedTokens{
+	return joiningv1.StaticScopedTokens_builder{
 		Version: types.V1,
 		Kind:    types.KindStaticScopedTokens,
 		Scope:   scopes.Root,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameStaticScopedTokens,
-		},
-		Spec: &joiningv1.StaticScopedTokensSpec{
+		}.Build(),
+		Spec: joiningv1.StaticScopedTokensSpec_builder{
 			Tokens: scopedTokens,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 // ImmutableLabels capture yaml configuration used to generate [joiningv1.ImmutableLabels].
@@ -1185,9 +1185,9 @@ func (il *ImmutableLabels) Parse() (*joiningv1.ImmutableLabels, error) {
 		return nil, nil
 	}
 
-	return &joiningv1.ImmutableLabels{
+	return joiningv1.ImmutableLabels_builder{
 		Ssh: il.SSH,
-	}, nil
+	}.Build(), nil
 }
 
 // StaticScopedToken is a statically defined scoped token. It is meant to capture
diff --git a/lib/config/fileconf_test.go b/lib/config/fileconf_test.go
index 2b9c37f7022..a98822f46d7 100644
--- a/lib/config/fileconf_test.go
+++ b/lib/config/fileconf_test.go
@@ -674,28 +674,28 @@ teleport:
 `,
 			expectError: require.NoError,
 			expectTokens: []*joiningv1.ScopedToken{
-				{
+				joiningv1.ScopedToken_builder{
 					Version: types.V1,
 					Kind:    types.KindScopedToken,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "fully_defined_token",
-					},
+					}.Build(),
 					Scope: "/",
-					Spec: &joiningv1.ScopedTokenSpec{
+					Spec: joiningv1.ScopedTokenSpec_builder{
 						Roles:         []string{string(types.RoleNode)},
 						AssignedScope: "/test",
 						JoinMethod:    string(types.JoinMethodToken),
 						UsageMode:     string(joining.TokenUsageModeUnlimited),
-						ImmutableLabels: &joiningv1.ImmutableLabels{
+						ImmutableLabels: joiningv1.ImmutableLabels_builder{
 							Ssh: map[string]string{
 								"hello": "world",
 							},
-						},
-					},
-					Status: &joiningv1.ScopedTokenStatus{
+						}.Build(),
+					}.Build(),
+					Status: joiningv1.ScopedTokenStatus_builder{
 						Secret: "secret_token_value",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 		},
 		{
@@ -709,23 +709,23 @@ teleport:
 `, tokenFilePath),
 			expectError: require.NoError,
 			expectTokens: []*joiningv1.ScopedToken{
-				{
+				joiningv1.ScopedToken_builder{
 					Version: types.V1,
 					Kind:    types.KindScopedToken,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "file_scoped_token",
-					},
+					}.Build(),
 					Scope: "/",
-					Spec: &joiningv1.ScopedTokenSpec{
+					Spec: joiningv1.ScopedTokenSpec_builder{
 						Roles:         []string{string(types.RoleNode)},
 						AssignedScope: "/test",
 						JoinMethod:    string(types.JoinMethodToken),
 						UsageMode:     string(joining.TokenUsageModeUnlimited),
-					},
-					Status: &joiningv1.ScopedTokenStatus{
+					}.Build(),
+					Status: joiningv1.ScopedTokenStatus_builder{
 						Secret: "secret_token_value",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 		},
 		{
@@ -758,40 +758,40 @@ teleport:
 `, tokenFilePath),
 			expectError: require.NoError,
 			expectTokens: []*joiningv1.ScopedToken{
-				{
+				joiningv1.ScopedToken_builder{
 					Version: types.V1,
 					Kind:    types.KindScopedToken,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "fully_defined_token",
-					},
+					}.Build(),
 					Scope: "/",
-					Spec: &joiningv1.ScopedTokenSpec{
+					Spec: joiningv1.ScopedTokenSpec_builder{
 						Roles:         []string{string(types.RoleNode)},
 						AssignedScope: "/test",
 						JoinMethod:    string(types.JoinMethodToken),
 						UsageMode:     string(joining.TokenUsageModeUnlimited),
-					},
-					Status: &joiningv1.ScopedTokenStatus{
+					}.Build(),
+					Status: joiningv1.ScopedTokenStatus_builder{
 						Secret: "secret_token_value",
-					},
-				},
-				{
+					}.Build(),
+				}.Build(),
+				joiningv1.ScopedToken_builder{
 					Version: types.V1,
 					Kind:    types.KindScopedToken,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "file_scoped_token",
-					},
+					}.Build(),
 					Scope: "/",
-					Spec: &joiningv1.ScopedTokenSpec{
+					Spec: joiningv1.ScopedTokenSpec_builder{
 						Roles:         []string{string(types.RoleNode)},
 						AssignedScope: "/test",
 						JoinMethod:    string(types.JoinMethodToken),
 						UsageMode:     string(joining.TokenUsageModeUnlimited),
-					},
-					Status: &joiningv1.ScopedTokenStatus{
+					}.Build(),
+					Status: joiningv1.ScopedTokenStatus_builder{
 						Secret: "secret_token_value",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 		},
 	}
diff --git a/lib/decision/identity_generation.go b/lib/decision/identity_generation.go
index 3926204d2dc..ee37322da5e 100644
--- a/lib/decision/identity_generation.go
+++ b/lib/decision/identity_generation.go
@@ -37,7 +37,7 @@ func (s *Service) GenerateDryRunSSHIdentity(ctx context.Context, req *decisionpb
 	// various equivalent auth logic can have a single source of truth.
 
 	// get the core state user configuration
-	user, err := s.cfg.AccessPoint.GetUser(ctx, req.Username, false /* withSecrets */)
+	user, err := s.cfg.AccessPoint.GetUser(ctx, req.GetUsername(), false /* withSecrets */)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/decision/service.go b/lib/decision/service.go
index 71dd7f76715..083fe1762a5 100644
--- a/lib/decision/service.go
+++ b/lib/decision/service.go
@@ -111,24 +111,24 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Metadata.DryRun {
-		if opts := req.Metadata.DryRunOptions; opts != nil {
+	if req.GetMetadata().GetDryRun() {
+		if opts := req.GetMetadata().GetDryRunOptions(); opts != nil {
 			// dry-run requests may omit a true caller identity in favor of specifying a user for which a
 			// hypothetical identity should be generated.
-			if opts.GenerateIdentity != nil {
-				generatedIdent, err := s.GenerateDryRunSSHIdentity(ctx, opts.GenerateIdentity)
+			if opts.HasGenerateIdentity() {
+				generatedIdent, err := s.GenerateDryRunSSHIdentity(ctx, opts.GetGenerateIdentity())
 				if err != nil {
 					return nil, trace.Wrap(err)
 				}
 
-				req.SshIdentity = generatedIdent
+				req.SetSshIdentity(generatedIdent)
 			}
 		}
 	}
 
-	ident := SSHIdentityToSSHCA(req.SshIdentity)
+	ident := SSHIdentityToSSHCA(req.GetSshIdentity())
 
-	authority, err := s.resolveSSHAuthority(ctx, req.SshAuthority)
+	authority, err := s.resolveSSHAuthority(ctx, req.GetSshAuthority())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -155,7 +155,7 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 		return nil, trace.Wrap(err)
 	}
 
-	if req.OsUser == teleport.SSHSessionJoinPrincipal {
+	if req.GetOsUser() == teleport.SSHSessionJoinPrincipal {
 		// XXX: this is the point in the process where ahLoginChecker.canLoginWithRBAC forks into session access
 		// evaluation. It is still unclear how we should be handling session-joining within the decision method.
 		// For the time being, we will consider it an error, but this must be resolved before this method can
@@ -163,7 +163,7 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 		return nil, trace.Errorf("session joining is not yet supported by the decision service")
 	}
 
-	target, err := s.cfg.AccessPoint.GetNode(ctx, apidefaults.Namespace, req.Node.Name)
+	target, err := s.cfg.AccessPoint.GetNode(ctx, apidefaults.Namespace, req.GetNode().GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -172,19 +172,17 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 	if err := accessChecker.CheckAccess(
 		target,
 		state,
-		services.NewLoginMatcher(req.OsUser),
+		services.NewLoginMatcher(req.GetOsUser()),
 	); err != nil {
-		return &decisionpb.EvaluateSSHAccessResponse{
-			Decision: &decisionpb.EvaluateSSHAccessResponse_Denial{
-				Denial: &decisionpb.SSHAccessDenial{
-					Metadata: &decisionpb.DenialMetadata{
-						PdpVersion: teleport.Version,
-						UserMessage: fmt.Sprintf("user %s@%s is not authorized to login as %v@%s: %v",
-							ident.Username, authority.GetClusterName(), req.OsUser, localClusterName, err),
-					},
-				},
-			},
-		}, nil
+		return decisionpb.EvaluateSSHAccessResponse_builder{
+			Denial: decisionpb.SSHAccessDenial_builder{
+				Metadata: decisionpb.DenialMetadata_builder{
+					PdpVersion: teleport.Version,
+					UserMessage: fmt.Sprintf("user %s@%s is not authorized to login as %v@%s: %v",
+						ident.Username, authority.GetClusterName(), req.GetOsUser(), localClusterName, err),
+				}.Build(),
+			}.Build(),
+		}.Build(), nil
 	}
 
 	// load net config (used during calculation of client idle timeout)
@@ -204,7 +202,7 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 		return nil, trace.Wrap(err)
 	}
 
-	lockTargets := services.SSHAccessLockTargets(localClusterName, req.Node.Name, req.OsUser, accessInfo, ident)
+	lockTargets := services.SSHAccessLockTargets(localClusterName, req.GetNode().GetName(), req.GetOsUser(), accessInfo, ident)
 
 	hostSudoers, err := accessChecker.HostSudoers(target)
 	if err != nil {
@@ -221,11 +219,11 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 		return nil, trace.Wrap(err)
 	}
 
-	permit := &decisionpb.SSHAccessPermit{
-		Metadata: &decisionpb.PermitMetadata{
+	permit := decisionpb.SSHAccessPermit_builder{
+		Metadata: decisionpb.PermitMetadata_builder{
 			PdpVersion: teleport.Version,
-		},
-		ForwardAgent:          accessChecker.CheckAgentForward(req.OsUser) == nil,
+		}.Build(),
+		ForwardAgent:          accessChecker.CheckAgentForward(req.GetOsUser()) == nil,
 		X11Forwarding:         accessChecker.PermitX11Forwarding(),
 		MaxConnections:        accessChecker.MaxConnections(),
 		MaxSessions:           accessChecker.MaxSessions(),
@@ -241,16 +239,16 @@ func (s *Service) EvaluateSSHAccess(ctx context.Context, req *decisionpb.Evaluat
 		HostSudoers:           hostSudoers,
 		BpfEvents:             bpfEvents,
 		HostUsersInfo:         hostUsersDecision.Info,
-		DecisionContext: &decisionpb.SSHAccessPermitContext{
+		DecisionContext: decisionpb.SSHAccessPermitContext_builder{
 			HostUserCreationAllowedBy: hostUsersDecision.AllowedBy,
 			HostUserCreationDeniedBy:  hostUsersDecision.DeniedBy,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	if accessChecker.PinSourceIP() {
-		permit.Preconditions = append(permit.Preconditions, &decisionpb.Precondition{
+		permit.SetPreconditions(append(permit.GetPreconditions(), decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP,
-		})
+		}.Build()))
 	}
 
 	return &decisionpb.EvaluateSSHAccessResponse{
@@ -271,8 +269,8 @@ func (s *Service) getLocalClusterName(ctx context.Context) (string, error) {
 // resolveSSHAuthority is a helper used to resolve the SSHAuthority reference type from a decision request into a cert authority resource.
 func (s *Service) resolveSSHAuthority(ctx context.Context, sshAuthority *decisionpb.SSHAuthority) (types.CertAuthority, error) {
 	ca, err := s.cfg.AccessPoint.GetCertAuthority(ctx, types.CertAuthID{
-		DomainName: sshAuthority.ClusterName,
-		Type:       types.CertAuthType(sshAuthority.AuthorityType),
+		DomainName: sshAuthority.GetClusterName(),
+		Type:       types.CertAuthType(sshAuthority.GetAuthorityType()),
 	}, false)
 	return ca, trace.Wrap(err)
 }
@@ -292,29 +290,29 @@ func checkEvaluateSSHAccessRequest(req *decisionpb.EvaluateSSHAccessRequest) err
 	if err := checkSSHIdentityBasedRequest(req); err != nil {
 		return trace.Wrap(err)
 	}
-	if req.SshAuthority == nil {
+	if !req.HasSshAuthority() {
 		return trace.BadParameter("missing required parameter SshAuthority")
 	}
-	if req.SshAuthority.ClusterName == "" {
+	if req.GetSshAuthority().GetClusterName() == "" {
 		return trace.BadParameter("missing required parameter SshAuthority.ClusterName")
 	}
-	if req.SshAuthority.AuthorityType == "" {
+	if req.GetSshAuthority().GetAuthorityType() == "" {
 		return trace.BadParameter("missing required parameter SshAuthority.AuthorityType")
 	}
-	if types.CertAuthType(req.SshAuthority.AuthorityType) != types.UserCA {
-		return trace.BadParameter("unsupported cert authority type %q, expected type %q", req.SshAuthority.AuthorityType, types.UserCA)
+	if types.CertAuthType(req.GetSshAuthority().GetAuthorityType()) != types.UserCA {
+		return trace.BadParameter("unsupported cert authority type %q, expected type %q", req.GetSshAuthority().GetAuthorityType(), types.UserCA)
 	}
-	if req.Node == nil {
+	if !req.HasNode() {
 		return trace.BadParameter("missing required parameter Node")
 	}
-	if req.Node.Name == "" {
+	if req.GetNode().GetName() == "" {
 		return trace.BadParameter("missing required parameter Node.Name")
 	}
-	if req.Node.Kind != "" && req.Node.Kind != types.KindNode {
-		return trace.BadParameter("unsupported resource kind for ssh access eval %q, expected %q", req.Node.Kind, types.KindNode)
+	if req.GetNode().GetKind() != "" && req.GetNode().GetKind() != types.KindNode {
+		return trace.BadParameter("unsupported resource kind for ssh access eval %q, expected %q", req.GetNode().GetKind(), types.KindNode)
 	}
 
-	if req.OsUser == "" {
+	if req.GetOsUser() == "" {
 		// XXX: remove this requirement once we have login enumeration support
 		return trace.BadParameter("missing required parameter OsUser")
 	}
@@ -333,14 +331,14 @@ func checkSSHIdentityBasedRequest(req sshIdentityBasedRequest) error {
 		return trace.BadParameter("missing required parameter Metadata")
 	}
 
-	if meta.DryRun {
+	if meta.GetDryRun() {
 		// ensure that the dry run either specifies identity generation or an explicit identity but not both
-		if opts := meta.DryRunOptions; opts != nil && opts.GenerateIdentity != nil {
+		if opts := meta.GetDryRunOptions(); opts != nil && opts.HasGenerateIdentity() {
 			if req.GetSshIdentity() != nil {
 				return trace.BadParameter("cannot specify both SshIdentity and Metadata.DryRunOptions.GenerateIdentity")
 			}
 
-			if opts.GenerateIdentity.Username == "" {
+			if opts.GetGenerateIdentity().GetUsername() == "" {
 				return trace.BadParameter("missing required parameter Username in Metadata.DryRunOptions.GenerateIdentity")
 			}
 		} else {
@@ -362,7 +360,7 @@ func checkSSHIdentityBasedRequest(req sshIdentityBasedRequest) error {
 			return trace.Wrap(err)
 		}
 
-		if meta.DryRunOptions != nil {
+		if meta.HasDryRunOptions() {
 			return trace.BadParameter("unexpected parameter Metadata.DryRunOptions in non-dry-run request")
 		}
 	}
@@ -371,8 +369,8 @@ func checkSSHIdentityBasedRequest(req sshIdentityBasedRequest) error {
 }
 
 func checkSSHIdentity(ident *decisionpb.SSHIdentity) error {
-	if ident.CertType != ssh.UserCert {
-		return trace.BadParameter("unsupported cert type for ssh identity (%d), expected type 'user' (%d)", ident.CertType, ssh.UserCert)
+	if ident.GetCertType() != ssh.UserCert {
+		return trace.BadParameter("unsupported cert type for ssh identity (%d), expected type 'user' (%d)", ident.GetCertType(), ssh.UserCert)
 	}
 
 	return nil
@@ -388,7 +386,7 @@ func LockTargetsToProto(targets []types.LockTarget) []*decisionpb.LockTarget {
 }
 
 func lockTargetToProto(target types.LockTarget) *decisionpb.LockTarget {
-	return &decisionpb.LockTarget{
+	return decisionpb.LockTarget_builder{
 		User:           target.User,
 		Role:           target.Role,
 		Login:          target.Login,
@@ -400,7 +398,7 @@ func lockTargetToProto(target types.LockTarget) *decisionpb.LockTarget {
 		ServerId:       target.ServerID,
 		BotInstanceId:  target.BotInstanceID,
 		JoinToken:      target.JoinToken,
-	}
+	}.Build()
 }
 
 // LockTargetsFromProto converts a slice of decisionpb.LockTarget to a slice of LockTarget.
@@ -414,17 +412,17 @@ func LockTargetsFromProto(targets []*decisionpb.LockTarget) []types.LockTarget {
 
 func lockTargetFromProto(target *decisionpb.LockTarget) types.LockTarget {
 	return types.LockTarget{
-		User:           target.User,
-		Role:           target.Role,
-		Login:          target.Login,
-		MFADevice:      target.MfaDevice,
-		WindowsDesktop: target.WindowsDesktop,
-		LinuxDesktop:   target.LinuxDesktop,
-		AccessRequest:  target.AccessRequest,
-		Device:         target.Device,
-		ServerID:       target.ServerId,
-		BotInstanceID:  target.BotInstanceId,
-		JoinToken:      target.JoinToken,
+		User:           target.GetUser(),
+		Role:           target.GetRole(),
+		Login:          target.GetLogin(),
+		MFADevice:      target.GetMfaDevice(),
+		WindowsDesktop: target.GetWindowsDesktop(),
+		LinuxDesktop:   target.GetLinuxDesktop(),
+		AccessRequest:  target.GetAccessRequest(),
+		Device:         target.GetDevice(),
+		ServerID:       target.GetServerId(),
+		BotInstanceID:  target.GetBotInstanceId(),
+		JoinToken:      target.GetJoinToken(),
 	}
 }
 
diff --git a/lib/decision/ssh_identity.go b/lib/decision/ssh_identity.go
index 03db3e881c0..d0e428e8de3 100644
--- a/lib/decision/ssh_identity.go
+++ b/lib/decision/ssh_identity.go
@@ -32,47 +32,47 @@ func SSHIdentityToSSHCA(id *decisionpb.SSHIdentity) *sshca.Identity {
 	}
 
 	return &sshca.Identity{
-		ValidAfter:              id.ValidAfter,
-		ValidBefore:             id.ValidBefore,
-		CertType:                id.CertType,
-		ClusterName:             id.ClusterName,
-		SystemRole:              types.SystemRole(id.SystemRole),
-		Username:                id.Username,
-		ScopePin:                id.ScopePin,
-		Impersonator:            id.Impersonator,
-		Principals:              id.Principals,
-		PermitX11Forwarding:     id.PermitX11Forwarding,
-		PermitAgentForwarding:   id.PermitAgentForwarding,
-		PermitPortForwarding:    id.PermitPortForwarding,
-		Roles:                   id.Roles,
-		RouteToCluster:          id.RouteToCluster,
-		Traits:                  traitToWrappers(id.Traits),
-		ActiveRequests:          id.ActiveRequests,
-		MFAVerified:             id.MfaVerified,
-		PreviousIdentityExpires: timestampToGoTime(id.PreviousIdentityExpires),
-		LoginIP:                 id.LoginIp,
-		PinnedIP:                id.PinnedIp,
-		DisallowReissue:         id.DisallowReissue,
-		CertificateExtensions:   certExtensionsFromProto(id.CertificateExtensions),
-		Renewable:               id.Renewable,
-		Generation:              id.Generation,
-		BotName:                 id.BotName,
-		BotInstanceID:           id.BotInstanceId,
-		JoinToken:               id.JoinToken,
+		ValidAfter:              id.GetValidAfter(),
+		ValidBefore:             id.GetValidBefore(),
+		CertType:                id.GetCertType(),
+		ClusterName:             id.GetClusterName(),
+		SystemRole:              types.SystemRole(id.GetSystemRole()),
+		Username:                id.GetUsername(),
+		ScopePin:                id.GetScopePin(),
+		Impersonator:            id.GetImpersonator(),
+		Principals:              id.GetPrincipals(),
+		PermitX11Forwarding:     id.GetPermitX11Forwarding(),
+		PermitAgentForwarding:   id.GetPermitAgentForwarding(),
+		PermitPortForwarding:    id.GetPermitPortForwarding(),
+		Roles:                   id.GetRoles(),
+		RouteToCluster:          id.GetRouteToCluster(),
+		Traits:                  traitToWrappers(id.GetTraits()),
+		ActiveRequests:          id.GetActiveRequests(),
+		MFAVerified:             id.GetMfaVerified(),
+		PreviousIdentityExpires: timestampToGoTime(id.GetPreviousIdentityExpires()),
+		LoginIP:                 id.GetLoginIp(),
+		PinnedIP:                id.GetPinnedIp(),
+		DisallowReissue:         id.GetDisallowReissue(),
+		CertificateExtensions:   certExtensionsFromProto(id.GetCertificateExtensions()),
+		Renewable:               id.GetRenewable(),
+		Generation:              id.GetGeneration(),
+		BotName:                 id.GetBotName(),
+		BotInstanceID:           id.GetBotInstanceId(),
+		JoinToken:               id.GetJoinToken(),
 		//nolint:staticcheck // TODO(kiosion): deprecated, to be removed in v21
-		AllowedResourceIDs:       resourceIDsToTypes(id.AllowedResourceIds),
-		AllowedResourceAccessIDs: resourceAccessIDPointersToValues(id.AllowedResourceAccessIds),
-		ConnectionDiagnosticID:   id.ConnectionDiagnosticId,
-		PrivateKeyPolicy:         keys.PrivateKeyPolicy(id.PrivateKeyPolicy),
-		DeviceID:                 id.DeviceId,
-		DeviceAssetTag:           id.DeviceAssetTag,
-		DeviceCredentialID:       id.DeviceCredentialId,
-		GitHubUserID:             id.GithubUserId,
-		GitHubUsername:           id.GithubUsername,
-		AgentScope:               id.AgentScope,
-		ImmutableLabelHash:       id.ImmutableLabelHash,
-		DelegationSessionID:      id.DelegationSessionId,
-		HeadlessAuthenticationID: id.HeadlessAuthenticationId,
+		AllowedResourceIDs:       resourceIDsToTypes(id.GetAllowedResourceIds()),
+		AllowedResourceAccessIDs: resourceAccessIDPointersToValues(id.GetAllowedResourceAccessIds()),
+		ConnectionDiagnosticID:   id.GetConnectionDiagnosticId(),
+		PrivateKeyPolicy:         keys.PrivateKeyPolicy(id.GetPrivateKeyPolicy()),
+		DeviceID:                 id.GetDeviceId(),
+		DeviceAssetTag:           id.GetDeviceAssetTag(),
+		DeviceCredentialID:       id.GetDeviceCredentialId(),
+		GitHubUserID:             id.GetGithubUserId(),
+		GitHubUsername:           id.GetGithubUsername(),
+		AgentScope:               id.GetAgentScope(),
+		ImmutableLabelHash:       id.GetImmutableLabelHash(),
+		DelegationSessionID:      id.GetDelegationSessionId(),
+		HeadlessAuthenticationID: id.GetHeadlessAuthenticationId(),
 	}
 }
 
@@ -81,7 +81,7 @@ func SSHIdentityFromSSHCA(id *sshca.Identity) *decisionpb.SSHIdentity {
 		return nil
 	}
 
-	return &decisionpb.SSHIdentity{
+	return decisionpb.SSHIdentity_builder{
 		ValidAfter:              id.ValidAfter,
 		ValidBefore:             id.ValidBefore,
 		CertType:                id.CertType,
@@ -123,7 +123,7 @@ func SSHIdentityFromSSHCA(id *sshca.Identity) *decisionpb.SSHIdentity {
 		ImmutableLabelHash:       id.ImmutableLabelHash,
 		DelegationSessionId:      id.DelegationSessionID,
 		HeadlessAuthenticationId: id.HeadlessAuthenticationID,
-	}
+	}.Build()
 }
 
 func certExtensionsFromProto(extensions []*decisionpb.CertExtension) []*types.CertExtension {
@@ -133,10 +133,10 @@ func certExtensionsFromProto(extensions []*decisionpb.CertExtension) []*types.Ce
 	out := make([]*types.CertExtension, 0, len(extensions))
 	for _, extension := range extensions {
 		out = append(out, &types.CertExtension{
-			Mode:  types.CertExtensionMode(int32(extension.Mode) - 1), // enum is equivalent but off by 1
-			Type:  types.CertExtensionType(int32(extension.Type) - 1), // enum is equivalent but off by 1
-			Name:  extension.Name,
-			Value: extension.Value,
+			Mode:  types.CertExtensionMode(int32(extension.GetMode()) - 1), // enum is equivalent but off by 1
+			Type:  types.CertExtensionType(int32(extension.GetType()) - 1), // enum is equivalent but off by 1
+			Name:  extension.GetName(),
+			Value: extension.GetValue(),
 		})
 	}
 	return out
@@ -148,12 +148,12 @@ func certExtensionsToProto(extensions []*types.CertExtension) []*decisionpb.Cert
 	}
 	out := make([]*decisionpb.CertExtension, 0, len(extensions))
 	for _, extension := range extensions {
-		out = append(out, &decisionpb.CertExtension{
+		out = append(out, decisionpb.CertExtension_builder{
 			Mode:  decisionpb.CertExtensionMode(int32(extension.Mode) + 1), // enum is equivalent but off by 1
 			Type:  decisionpb.CertExtensionType(int32(extension.Type) + 1), // enum is equivalent but off by 1
 			Name:  extension.Name,
 			Value: extension.Value,
-		})
+		}.Build())
 	}
 	return out
 }
diff --git a/lib/decision/ssh_identity_test.go b/lib/decision/ssh_identity_test.go
index 9ac13af8dd1..13decef5479 100644
--- a/lib/decision/ssh_identity_test.go
+++ b/lib/decision/ssh_identity_test.go
@@ -45,17 +45,17 @@ func TestSSHIdentityConversion(t *testing.T) {
 		ClusterName: "some-cluster",
 		SystemRole:  types.RoleNode,
 		Username:    "user",
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/foo",
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/": {"/": {"role1", "role2"}},
 			}),
-			SystemRoles: &scopesv1.SystemRoles{
+			SystemRoles: scopesv1.SystemRoles_builder{
 				Primary:    string(types.RoleNode),
 				Additional: []string{string(types.RoleProxy)},
-			},
-		},
+			}.Build(),
+		}.Build(),
 		Impersonator:            "impersonator",
 		Principals:              []string{"login1", "login2"},
 		PermitX11Forwarding:     true,
@@ -113,12 +113,12 @@ func TestSSHIdentityConversion(t *testing.T) {
 		GitHubUsername:           "ghuser",
 		HeadlessAuthenticationID: "headless-auth-id",
 		AgentScope:               "/foo",
-		ImmutableLabelHash: joining.HashImmutableLabels(&joiningv1.ImmutableLabels{
+		ImmutableLabelHash: joining.HashImmutableLabels(joiningv1.ImmutableLabels_builder{
 			Ssh: map[string]string{
 				"one": "1",
 				"two": "2",
 			},
-		}),
+		}.Build()),
 		DelegationSessionID: "delegation-session",
 	}
 
diff --git a/lib/decision/tls_identity.go b/lib/decision/tls_identity.go
index 9202a8ab407..f10a0012691 100644
--- a/lib/decision/tls_identity.go
+++ b/lib/decision/tls_identity.go
@@ -40,47 +40,47 @@ func TLSIdentityToTLSCA(id *decisionpb.TLSIdentity) *tlsca.Identity {
 	}
 
 	return &tlsca.Identity{
-		Username:                id.Username,
-		ScopePin:                id.ScopePin,
-		Impersonator:            id.Impersonator,
-		Groups:                  id.Groups,
-		SystemRoles:             id.SystemRoles,
-		Usage:                   id.Usage,
-		Principals:              id.Principals,
-		KubernetesGroups:        id.KubernetesGroups,
-		KubernetesUsers:         id.KubernetesUsers,
-		Expires:                 timestampToGoTime(id.Expires),
-		RouteToCluster:          id.RouteToCluster,
-		KubernetesCluster:       id.KubernetesCluster,
-		Traits:                  traitToWrappers(id.Traits),
-		RouteToApp:              routeToAppFromProto(id.RouteToApp),
-		TeleportCluster:         id.TeleportCluster,
-		OriginClusterName:       id.TeleportCluster,
-		RouteToDatabase:         routeToDatabaseFromProto(id.RouteToDatabase),
-		DatabaseNames:           id.DatabaseNames,
-		DatabaseUsers:           id.DatabaseUsers,
-		MFAVerified:             id.MfaVerified,
-		PreviousIdentityExpires: timestampToGoTime(id.PreviousIdentityExpires),
-		LoginIP:                 id.LoginIp,
-		PinnedIP:                id.PinnedIp,
-		AWSRoleARNs:             id.AwsRoleArns,
-		AzureIdentities:         id.AzureIdentities,
-		GCPServiceAccounts:      id.GcpServiceAccounts,
-		ActiveRequests:          id.ActiveRequests,
-		DisallowReissue:         id.DisallowReissue,
-		Renewable:               id.Renewable,
-		Generation:              id.Generation,
-		BotName:                 id.BotName,
-		BotInstanceID:           id.BotInstanceId,
-		JoinToken:               id.JoinToken,
+		Username:                id.GetUsername(),
+		ScopePin:                id.GetScopePin(),
+		Impersonator:            id.GetImpersonator(),
+		Groups:                  id.GetGroups(),
+		SystemRoles:             id.GetSystemRoles(),
+		Usage:                   id.GetUsage(),
+		Principals:              id.GetPrincipals(),
+		KubernetesGroups:        id.GetKubernetesGroups(),
+		KubernetesUsers:         id.GetKubernetesUsers(),
+		Expires:                 timestampToGoTime(id.GetExpires()),
+		RouteToCluster:          id.GetRouteToCluster(),
+		KubernetesCluster:       id.GetKubernetesCluster(),
+		Traits:                  traitToWrappers(id.GetTraits()),
+		RouteToApp:              routeToAppFromProto(id.GetRouteToApp()),
+		TeleportCluster:         id.GetTeleportCluster(),
+		OriginClusterName:       id.GetTeleportCluster(),
+		RouteToDatabase:         routeToDatabaseFromProto(id.GetRouteToDatabase()),
+		DatabaseNames:           id.GetDatabaseNames(),
+		DatabaseUsers:           id.GetDatabaseUsers(),
+		MFAVerified:             id.GetMfaVerified(),
+		PreviousIdentityExpires: timestampToGoTime(id.GetPreviousIdentityExpires()),
+		LoginIP:                 id.GetLoginIp(),
+		PinnedIP:                id.GetPinnedIp(),
+		AWSRoleARNs:             id.GetAwsRoleArns(),
+		AzureIdentities:         id.GetAzureIdentities(),
+		GCPServiceAccounts:      id.GetGcpServiceAccounts(),
+		ActiveRequests:          id.GetActiveRequests(),
+		DisallowReissue:         id.GetDisallowReissue(),
+		Renewable:               id.GetRenewable(),
+		Generation:              id.GetGeneration(),
+		BotName:                 id.GetBotName(),
+		BotInstanceID:           id.GetBotInstanceId(),
+		JoinToken:               id.GetJoinToken(),
 		//nolint:staticcheck // TODO(kiosion): deprecated, to be removed in v21
-		AllowedResourceIDs:       resourceIDsToTypes(id.AllowedResourceIds),
-		AllowedResourceAccessIDs: resourceAccessIDPointersToValues(id.AllowedResourceAccessIds),
-		PrivateKeyPolicy:         keys.PrivateKeyPolicy(id.PrivateKeyPolicy),
-		ConnectionDiagnosticID:   id.ConnectionDiagnosticId,
-		DeviceExtensions:         deviceExtensionsFromProto(id.DeviceExtensions),
-		UserType:                 types.UserType(id.UserType),
-		DelegationSessionID:      id.DelegationSessionId,
+		AllowedResourceIDs:       resourceIDsToTypes(id.GetAllowedResourceIds()),
+		AllowedResourceAccessIDs: resourceAccessIDPointersToValues(id.GetAllowedResourceAccessIds()),
+		PrivateKeyPolicy:         keys.PrivateKeyPolicy(id.GetPrivateKeyPolicy()),
+		ConnectionDiagnosticID:   id.GetConnectionDiagnosticId(),
+		DeviceExtensions:         deviceExtensionsFromProto(id.GetDeviceExtensions()),
+		UserType:                 types.UserType(id.GetUserType()),
+		DelegationSessionID:      id.GetDelegationSessionId(),
 	}
 }
 
@@ -92,7 +92,7 @@ func TLSIdentityFromTLSCA(id *tlsca.Identity) *decisionpb.TLSIdentity {
 		return nil
 	}
 
-	return &decisionpb.TLSIdentity{
+	return decisionpb.TLSIdentity_builder{
 		Username:                id.Username,
 		ScopePin:                id.ScopePin,
 		Impersonator:            id.Impersonator,
@@ -133,7 +133,7 @@ func TLSIdentityFromTLSCA(id *tlsca.Identity) *decisionpb.TLSIdentity {
 		DeviceExtensions:         deviceExtensionsToProto(&id.DeviceExtensions),
 		UserType:                 string(id.UserType),
 		DelegationSessionId:      id.DelegationSessionID,
-	}
+	}.Build()
 }
 
 func timestampToGoTime(t *timestamppb.Timestamp) time.Time {
@@ -172,16 +172,16 @@ func routeToAppFromProto(routeToApp *decisionpb.RouteToApp) tlsca.RouteToApp {
 	}
 
 	return tlsca.RouteToApp{
-		SessionID:                       routeToApp.SessionId,
-		PublicAddr:                      routeToApp.PublicAddr,
-		ClusterName:                     routeToApp.ClusterName,
-		Name:                            routeToApp.Name,
-		AWSRoleARN:                      routeToApp.AwsRoleArn,
-		AWSCredentialProcessCredentials: routeToApp.AwsCredentialprocessCredentials,
-		AzureIdentity:                   routeToApp.AzureIdentity,
-		GCPServiceAccount:               routeToApp.GcpServiceAccount,
-		URI:                             routeToApp.Uri,
-		TargetPort:                      int(routeToApp.TargetPort),
+		SessionID:                       routeToApp.GetSessionId(),
+		PublicAddr:                      routeToApp.GetPublicAddr(),
+		ClusterName:                     routeToApp.GetClusterName(),
+		Name:                            routeToApp.GetName(),
+		AWSRoleARN:                      routeToApp.GetAwsRoleArn(),
+		AWSCredentialProcessCredentials: routeToApp.GetAwsCredentialprocessCredentials(),
+		AzureIdentity:                   routeToApp.GetAzureIdentity(),
+		GCPServiceAccount:               routeToApp.GetGcpServiceAccount(),
+		URI:                             routeToApp.GetUri(),
+		TargetPort:                      int(routeToApp.GetTargetPort()),
 	}
 }
 
@@ -190,7 +190,7 @@ func routeToAppToProto(routeToApp *tlsca.RouteToApp) *decisionpb.RouteToApp {
 		return nil
 	}
 
-	return &decisionpb.RouteToApp{
+	return decisionpb.RouteToApp_builder{
 		SessionId:                       routeToApp.SessionID,
 		PublicAddr:                      routeToApp.PublicAddr,
 		ClusterName:                     routeToApp.ClusterName,
@@ -201,7 +201,7 @@ func routeToAppToProto(routeToApp *tlsca.RouteToApp) *decisionpb.RouteToApp {
 		GcpServiceAccount:               routeToApp.GCPServiceAccount,
 		Uri:                             routeToApp.URI,
 		TargetPort:                      int32(routeToApp.TargetPort),
-	}
+	}.Build()
 }
 
 func routeToDatabaseFromProto(routeToDatabase *decisionpb.RouteToDatabase) tlsca.RouteToDatabase {
@@ -210,11 +210,11 @@ func routeToDatabaseFromProto(routeToDatabase *decisionpb.RouteToDatabase) tlsca
 	}
 
 	return tlsca.RouteToDatabase{
-		ServiceName: routeToDatabase.ServiceName,
-		Protocol:    routeToDatabase.Protocol,
-		Username:    routeToDatabase.Username,
-		Database:    routeToDatabase.Database,
-		Roles:       routeToDatabase.Roles,
+		ServiceName: routeToDatabase.GetServiceName(),
+		Protocol:    routeToDatabase.GetProtocol(),
+		Username:    routeToDatabase.GetUsername(),
+		Database:    routeToDatabase.GetDatabase(),
+		Roles:       routeToDatabase.GetRoles(),
 	}
 }
 
@@ -223,13 +223,13 @@ func routeToDatabaseToProto(routeToDatabase *tlsca.RouteToDatabase) *decisionpb.
 		return nil
 	}
 
-	return &decisionpb.RouteToDatabase{
+	return decisionpb.RouteToDatabase_builder{
 		ServiceName: routeToDatabase.ServiceName,
 		Protocol:    routeToDatabase.Protocol,
 		Username:    routeToDatabase.Username,
 		Database:    routeToDatabase.Database,
 		Roles:       routeToDatabase.Roles,
-	}
+	}.Build()
 }
 
 func resourceAccessIDPointersToValues(resourceAccessIDs []*types.ResourceAccessID) []types.ResourceAccessID {
@@ -280,10 +280,10 @@ func resourceIDsToTypes(resourceIDs []*decisionpb.ResourceId) []types.ResourceID
 	ret := make([]types.ResourceID, len(resourceIDs))
 	for i, r := range resourceIDs {
 		ret[i] = types.ResourceID{
-			ClusterName:     r.ClusterName,
-			Kind:            r.Kind,
-			Name:            r.Name,
-			SubResourceName: r.SubResourceName,
+			ClusterName:     r.GetClusterName(),
+			Kind:            r.GetKind(),
+			Name:            r.GetName(),
+			SubResourceName: r.GetSubResourceName(),
 		}
 	}
 	return ret
@@ -296,12 +296,12 @@ func resourceIDsFromTypes(resourceIDs []types.ResourceID) []*decisionpb.Resource
 
 	ret := make([]*decisionpb.ResourceId, len(resourceIDs))
 	for i, r := range resourceIDs {
-		ret[i] = &decisionpb.ResourceId{
+		ret[i] = decisionpb.ResourceId_builder{
 			ClusterName:     r.ClusterName,
 			Kind:            r.Kind,
 			Name:            r.Name,
 			SubResourceName: r.SubResourceName,
-		}
+		}.Build()
 	}
 	return ret
 }
@@ -312,9 +312,9 @@ func deviceExtensionsFromProto(exts *decisionpb.DeviceExtensions) tlsca.DeviceEx
 	}
 
 	return tlsca.DeviceExtensions{
-		DeviceID:     exts.DeviceId,
-		AssetTag:     exts.AssetTag,
-		CredentialID: exts.CredentialId,
+		DeviceID:     exts.GetDeviceId(),
+		AssetTag:     exts.GetAssetTag(),
+		CredentialID: exts.GetCredentialId(),
 	}
 }
 
@@ -323,9 +323,9 @@ func deviceExtensionsToProto(exts *tlsca.DeviceExtensions) *decisionpb.DeviceExt
 		return nil
 	}
 
-	return &decisionpb.DeviceExtensions{
+	return decisionpb.DeviceExtensions_builder{
 		DeviceId:     exts.DeviceID,
 		AssetTag:     exts.AssetTag,
 		CredentialId: exts.CredentialID,
-	}
+	}.Build()
 }
diff --git a/lib/decision/tls_identity_test.go b/lib/decision/tls_identity_test.go
index 5f80d982ff1..951952d9380 100644
--- a/lib/decision/tls_identity_test.go
+++ b/lib/decision/tls_identity_test.go
@@ -36,23 +36,23 @@ import (
 func TestTLSIdentity_roundtrip(t *testing.T) {
 	t.Parallel()
 
-	minimalTLSIdentity := &decisionpb.TLSIdentity{
+	minimalTLSIdentity := decisionpb.TLSIdentity_builder{
 		// tlsca.Identity has no pointer fields, so these are always non-nil after
 		// copying.
 		RouteToApp:       &decisionpb.RouteToApp{},
 		RouteToDatabase:  &decisionpb.RouteToDatabase{},
 		DeviceExtensions: &decisionpb.DeviceExtensions{},
-	}
+	}.Build()
 
-	fullIdentity := &decisionpb.TLSIdentity{
+	fullIdentity := decisionpb.TLSIdentity_builder{
 		Username: "user",
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/foo",
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/": {"/": {"role1", "role2"}},
 			}),
-		},
+		}.Build(),
 		Impersonator:      "impersonator",
 		Groups:            []string{"role1", "role2"},
 		SystemRoles:       []string{"system1", "system2"},
@@ -65,12 +65,12 @@ func TestTLSIdentity_roundtrip(t *testing.T) {
 		KubernetesCluster: "k8s-cluster",
 		Traits: []*traitpb.Trait{
 			// Note: sorted by key on conversion.
-			{Key: "", Values: []string{"missingkey"}},
-			{Key: "missingvalues", Values: nil},
-			{Key: "trait1", Values: []string{"val1"}},
-			{Key: "trait2", Values: []string{"val1", "val2"}},
+			traitpb.Trait_builder{Key: "", Values: []string{"missingkey"}}.Build(),
+			traitpb.Trait_builder{Key: "missingvalues", Values: nil}.Build(),
+			traitpb.Trait_builder{Key: "trait1", Values: []string{"val1"}}.Build(),
+			traitpb.Trait_builder{Key: "trait2", Values: []string{"val1", "val2"}}.Build(),
 		},
-		RouteToApp: &decisionpb.RouteToApp{
+		RouteToApp: decisionpb.RouteToApp_builder{
 			SessionId:                       "session-id",
 			PublicAddr:                      "public-addr",
 			ClusterName:                     "cluster-name",
@@ -81,15 +81,15 @@ func TestTLSIdentity_roundtrip(t *testing.T) {
 			Uri:                             "uri",
 			TargetPort:                      111,
 			AwsCredentialprocessCredentials: "aws-cred-process-creds",
-		},
+		}.Build(),
 		TeleportCluster: "teleport-cluster",
-		RouteToDatabase: &decisionpb.RouteToDatabase{
+		RouteToDatabase: decisionpb.RouteToDatabase_builder{
 			ServiceName: "service-name",
 			Protocol:    "protocol",
 			Username:    "username",
 			Database:    "database",
 			Roles:       []string{"role1", "role2"},
-		},
+		}.Build(),
 		DatabaseNames:           []string{"db1", "db2"},
 		DatabaseUsers:           []string{"dbuser1", "dbuser2"},
 		MfaVerified:             "mfa-device-id",
@@ -106,18 +106,18 @@ func TestTLSIdentity_roundtrip(t *testing.T) {
 		BotName:                 "bot-name",
 		BotInstanceId:           "bot-instance-id",
 		AllowedResourceIds: []*decisionpb.ResourceId{
-			{
+			decisionpb.ResourceId_builder{
 				ClusterName:     "cluster1",
 				Kind:            "kind1",
 				Name:            "name1",
 				SubResourceName: "sub-resource1",
-			},
-			{
+			}.Build(),
+			decisionpb.ResourceId_builder{
 				ClusterName:     "cluster2",
 				Kind:            "kind2",
 				Name:            "name2",
 				SubResourceName: "sub-resource2",
-			},
+			}.Build(),
 		},
 		AllowedResourceAccessIds: []*types.ResourceAccessID{
 			{
@@ -131,14 +131,14 @@ func TestTLSIdentity_roundtrip(t *testing.T) {
 		},
 		PrivateKeyPolicy:       "private-key-policy",
 		ConnectionDiagnosticId: "connection-diag-id",
-		DeviceExtensions: &decisionpb.DeviceExtensions{
+		DeviceExtensions: decisionpb.DeviceExtensions_builder{
 			DeviceId:     "device-id",
 			AssetTag:     "asset-tag",
 			CredentialId: "credential-id",
-		},
+		}.Build(),
 		UserType:            "user-type",
 		DelegationSessionId: "delegation-session",
-	}
+	}.Build()
 
 	tests := []struct {
 		name        string
@@ -184,10 +184,10 @@ func TestTLSIdentity_roundtrip(t *testing.T) {
 func TestTLSIdentityToTLSCA_zeroTimestamp(t *testing.T) {
 	t.Parallel()
 
-	id := decision.TLSIdentityToTLSCA(&decisionpb.TLSIdentity{
+	id := decision.TLSIdentityToTLSCA(decisionpb.TLSIdentity_builder{
 		Expires:                 &timestamppb.Timestamp{},
 		PreviousIdentityExpires: &timestamppb.Timestamp{},
-	})
+	}.Build())
 	assert.Zero(t, id.Expires, "id.Expires")
 	assert.Zero(t, id.PreviousIdentityExpires, "id.PreviousIdentityExpires")
 }
diff --git a/lib/devicetrust/assert/assert.go b/lib/devicetrust/assert/assert.go
index 74488fde755..43d67bdb26b 100644
--- a/lib/devicetrust/assert/assert.go
+++ b/lib/devicetrust/assert/assert.go
@@ -126,55 +126,51 @@ func (s *authnStreamAdapter) Recv() (*devicepb.AuthenticateDeviceResponse, error
 		return nil, trace.Wrap(err)
 	}
 
-	if resp == nil || resp.Payload == nil {
+	if resp == nil || !resp.HasPayload() {
 		return nil, trace.BadParameter("assertion response payload required")
 	}
 
-	switch resp.Payload.(type) {
-	case *devicepb.AssertDeviceResponse_Challenge:
+	switch resp.WhichPayload() {
+	case devicepb.AssertDeviceResponse_Challenge_case:
 		return &devicepb.AuthenticateDeviceResponse{
 			Payload: &devicepb.AuthenticateDeviceResponse_Challenge{
 				Challenge: resp.GetChallenge(),
 			},
 		}, nil
-	case *devicepb.AssertDeviceResponse_TpmChallenge:
+	case devicepb.AssertDeviceResponse_TpmChallenge_case:
 		return &devicepb.AuthenticateDeviceResponse{
 			Payload: &devicepb.AuthenticateDeviceResponse_TpmChallenge{
 				TpmChallenge: resp.GetTpmChallenge(),
 			},
 		}, nil
-	case *devicepb.AssertDeviceResponse_DeviceAsserted:
+	case devicepb.AssertDeviceResponse_DeviceAsserted_case:
 		// Pass an empty UserCertificates to signify success.
-		return &devicepb.AuthenticateDeviceResponse{
-			Payload: &devicepb.AuthenticateDeviceResponse_UserCertificates{
-				UserCertificates: &devicepb.UserCertificates{},
-			},
-		}, nil
+		return devicepb.AuthenticateDeviceResponse_builder{
+			UserCertificates: &devicepb.UserCertificates{},
+		}.Build(), nil
 	default:
 		return nil, trace.BadParameter("unexpected assertion response payload: %T", resp.Payload)
 	}
 }
 
 func (s *authnStreamAdapter) Send(authnReq *devicepb.AuthenticateDeviceRequest) error {
-	if authnReq == nil || authnReq.Payload == nil {
+	if authnReq == nil || !authnReq.HasPayload() {
 		return trace.BadParameter("authenticate request payload required")
 	}
 
 	req := &devicepb.AssertDeviceRequest{}
-	switch authnReq.Payload.(type) {
-	case *devicepb.AuthenticateDeviceRequest_Init:
+	switch authnReq.WhichPayload() {
+	case devicepb.AuthenticateDeviceRequest_Init_case:
 		init := authnReq.GetInit()
-		req.Payload = &devicepb.AssertDeviceRequest_Init{
-			Init: &devicepb.AssertDeviceInit{
-				CredentialId: init.GetCredentialId(),
-				DeviceData:   init.GetDeviceData(),
-			},
-		}
-	case *devicepb.AuthenticateDeviceRequest_ChallengeResponse:
+		req.SetInit(devicepb.AssertDeviceInit_builder{
+			CredentialId: init.GetCredentialId(),
+			DeviceData:   init.GetDeviceData(),
+		}.Build())
+	case devicepb.AuthenticateDeviceRequest_ChallengeResponse_case:
 		req.Payload = &devicepb.AssertDeviceRequest_ChallengeResponse{
 			ChallengeResponse: authnReq.GetChallengeResponse(),
 		}
-	case *devicepb.AuthenticateDeviceRequest_TpmChallengeResponse:
+	case devicepb.AuthenticateDeviceRequest_TpmChallengeResponse_case:
 		req.Payload = &devicepb.AssertDeviceRequest_TpmChallengeResponse{
 			TpmChallengeResponse: authnReq.GetTpmChallengeResponse(),
 		}
diff --git a/lib/devicetrust/authn/authn.go b/lib/devicetrust/authn/authn.go
index 8e91d2b2b9d..5b3234c0b37 100644
--- a/lib/devicetrust/authn/authn.go
+++ b/lib/devicetrust/authn/authn.go
@@ -77,13 +77,13 @@ func (c *Ceremony) Run(
 	}
 	// nil SSHSigner is okay.
 
-	resp, err := c.run(ctx, params.DevicesClient, &devicepb.AuthenticateDeviceInit{
-		UserCertificates: &devicepb.UserCertificates{
+	resp, err := c.run(ctx, params.DevicesClient, devicepb.AuthenticateDeviceInit_builder{
+		UserCertificates: devicepb.UserCertificates_builder{
 			// Forward only the SSH certificate, the TLS identity is part of the
 			// connection.
-			SshAuthorizedKey: params.Certs.SshAuthorizedKey,
-		},
-	}, params.SSHSigner)
+			SshAuthorizedKey: params.Certs.GetSshAuthorizedKey(),
+		}.Build(),
+	}.Build(), params.SSHSigner)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -116,9 +116,9 @@ func (c *Ceremony) RunWeb(
 
 	// It's not necessary to sign with the SSH key for Device Trust Web, the SSH
 	// cert is implicitly trusted when it's taken directly from the web session.
-	resp, err := c.run(ctx, devicesClient, &devicepb.AuthenticateDeviceInit{
+	resp, err := c.run(ctx, devicesClient, devicepb.AuthenticateDeviceInit_builder{
 		DeviceWebToken: webToken,
-	}, nil /*sshSigner*/)
+	}.Build(), nil /*sshSigner*/)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -155,8 +155,8 @@ func (c *Ceremony) run(
 	defer stream.CloseSend()
 
 	// 1. Init.
-	init.CredentialId = cred.Id
-	init.DeviceData = cd
+	init.SetCredentialId(cred.GetId())
+	init.SetDeviceData(cd)
 	if err := stream.Send(&devicepb.AuthenticateDeviceRequest{
 		Payload: &devicepb.AuthenticateDeviceRequest_Init{
 			Init: init,
@@ -204,25 +204,23 @@ func (c *Ceremony) authenticateDeviceMacOS(
 	if chalResp == nil {
 		return trace.BadParameter("unexpected payload from server, expected AuthenticateDeviceChallenge: %T", resp.Payload)
 	}
-	sig, err := c.SignChallenge(chalResp.Challenge)
+	sig, err := c.SignChallenge(chalResp.GetChallenge())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	var sshSig []byte
 	if sshSigner != nil {
-		sshSig, err = challenge.Sign(chalResp.Challenge, sshSigner)
+		sshSig, err = challenge.Sign(chalResp.GetChallenge(), sshSigner)
 		if err != nil {
 			return trace.Wrap(err)
 		}
 	}
-	err = stream.Send(&devicepb.AuthenticateDeviceRequest{
-		Payload: &devicepb.AuthenticateDeviceRequest_ChallengeResponse{
-			ChallengeResponse: &devicepb.AuthenticateDeviceChallengeResponse{
-				Signature:    sig,
-				SshSignature: sshSig,
-			},
-		},
-	})
+	err = stream.Send(devicepb.AuthenticateDeviceRequest_builder{
+		ChallengeResponse: devicepb.AuthenticateDeviceChallengeResponse_builder{
+			Signature:    sig,
+			SshSignature: sshSig,
+		}.Build(),
+	}.Build())
 	if err != nil && !errors.Is(err, io.EOF) {
 		// [io.EOF] indicates that the server has closed the stream.
 		// The client should handle the underlying error on the subsequent Recv call.
@@ -246,7 +244,7 @@ func (c *Ceremony) authenticateDeviceTPM(
 		return trace.Wrap(err)
 	}
 	if sshSigner != nil {
-		challengeResponse.SshSignature, err = challenge.Sign(tpmChallenge.AttestationNonce, sshSigner)
+		challengeResponse.SshSignature, err = challenge.Sign(tpmChallenge.GetAttestationNonce(), sshSigner)
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/lib/devicetrust/authn/authn_test.go b/lib/devicetrust/authn/authn_test.go
index dd45515a7f8..c9aa8793857 100644
--- a/lib/devicetrust/authn/authn_test.go
+++ b/lib/devicetrust/authn/authn_test.go
@@ -66,9 +66,9 @@ func TestCeremony_Run(t *testing.T) {
 
 	runParams := &authntypes.CeremonyRunParams{
 		DevicesClient: devices,
-		Certs: &devicepb.UserCertificates{
+		Certs: devicepb.UserCertificates_builder{
 			SshAuthorizedKey: sshCert,
-		},
+		}.Build(),
 		SSHSigner: sshSigner,
 	}
 
@@ -129,7 +129,7 @@ func TestCeremony_RunWeb(t *testing.T) {
 	t.Run("sanity checks", func(t *testing.T) {
 		t.Parallel()
 
-		devID := macOSDev1.Id
+		devID := macOSDev1.GetId()
 		dev := macOSFakeDev1
 
 		webToken1, err := fakeService.CreateDeviceWebTokenForTesting(testenv.CreateDeviceWebTokenParams{
@@ -147,16 +147,16 @@ func TestCeremony_RunWeb(t *testing.T) {
 		const wantErr = "invalid device web token"
 
 		// Unknown token fails.
-		runError(t, wantErr, dev, &devicepb.DeviceWebToken{
+		runError(t, wantErr, dev, devicepb.DeviceWebToken_builder{
 			Id:    "I'm a llama not a token",
-			Token: webToken1.Token,
-		})
+			Token: webToken1.GetToken(),
+		}.Build())
 
 		// Incorrect token fails (spends webToken1 regardless).
-		runError(t, wantErr, dev, &devicepb.DeviceWebToken{
-			Id:    webToken1.Id,
-			Token: webToken1.Token + "BAD",
-		})
+		runError(t, wantErr, dev, devicepb.DeviceWebToken_builder{
+			Id:    webToken1.GetId(),
+			Token: webToken1.GetToken() + "BAD",
+		}.Build())
 
 		// Spent token fails (spent above).
 		runError(t, wantErr, dev, webToken1)
@@ -166,7 +166,7 @@ func TestCeremony_RunWeb(t *testing.T) {
 	})
 
 	t.Run("ok", func(t *testing.T) {
-		devID := macOSDev1.Id
+		devID := macOSDev1.GetId()
 		dev := macOSFakeDev1
 
 		// Create a fake DeviceWebToken. This and a previous enrollment is all the
@@ -207,7 +207,7 @@ func enrollDevice(ctx context.Context, devices devicepb.DeviceTrustServiceClient
 	if err != nil {
 		return nil, fmt.Errorf("enroll device init: %w", err)
 	}
-	enrollDeviceInit.Token = testenv.FakeEnrollmentToken
+	enrollDeviceInit.SetToken(testenv.FakeEnrollmentToken)
 	if err := stream.Send(&devicepb.EnrollDeviceRequest{
 		Payload: &devicepb.EnrollDeviceRequest_Init{
 			Init: enrollDeviceInit,
@@ -223,17 +223,15 @@ func enrollDevice(ctx context.Context, devices devicepb.DeviceTrustServiceClient
 	}
 	switch osType := dev.GetDeviceOSType(); osType {
 	case devicepb.OSType_OS_TYPE_MACOS:
-		sig, err := dev.SignChallenge(resp.GetMacosChallenge().Challenge)
+		sig, err := dev.SignChallenge(resp.GetMacosChallenge().GetChallenge())
 		if err != nil {
 			return nil, err
 		}
-		if err := stream.Send(&devicepb.EnrollDeviceRequest{
-			Payload: &devicepb.EnrollDeviceRequest_MacosChallengeResponse{
-				MacosChallengeResponse: &devicepb.MacOSEnrollChallengeResponse{
-					Signature: sig,
-				},
-			},
-		}); err != nil {
+		if err := stream.Send(devicepb.EnrollDeviceRequest_builder{
+			MacosChallengeResponse: devicepb.MacOSEnrollChallengeResponse_builder{
+				Signature: sig,
+			}.Build(),
+		}.Build()); err != nil {
 			return nil, err
 		}
 	case devicepb.OSType_OS_TYPE_LINUX, devicepb.OSType_OS_TYPE_WINDOWS:
@@ -261,5 +259,5 @@ func enrollDevice(ctx context.Context, devices devicepb.DeviceTrustServiceClient
 	if success == nil {
 		return nil, fmt.Errorf("success response is nil, got %T instead", resp.Payload)
 	}
-	return success.Device, nil
+	return success.GetDevice(), nil
 }
diff --git a/lib/devicetrust/enroll/auto_enroll.go b/lib/devicetrust/enroll/auto_enroll.go
index 4ed5a943836..5cfbd318eb3 100644
--- a/lib/devicetrust/enroll/auto_enroll.go
+++ b/lib/devicetrust/enroll/auto_enroll.go
@@ -72,13 +72,13 @@ func (c *AutoEnrollCeremony) Run(ctx context.Context, devicesClient devicepb.Dev
 		return nil, trace.Wrap(err)
 	}
 
-	token, err := devicesClient.CreateDeviceEnrollToken(ctx, &devicepb.CreateDeviceEnrollTokenRequest{
-		DeviceData: init.DeviceData,
-	})
+	token, err := devicesClient.CreateDeviceEnrollToken(ctx, devicepb.CreateDeviceEnrollTokenRequest_builder{
+		DeviceData: init.GetDeviceData(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "creating auto-token")
 	}
-	init.Token = token.Token
+	init.SetToken(token.GetToken())
 
 	dev, err := c.run(ctx, devicesClient, false /* debug */, init)
 	return dev, trace.Wrap(err)
diff --git a/lib/devicetrust/enroll/enroll.go b/lib/devicetrust/enroll/enroll.go
index 764197487b9..53aba169abf 100644
--- a/lib/devicetrust/enroll/enroll.go
+++ b/lib/devicetrust/enroll/enroll.go
@@ -88,9 +88,9 @@ func (c *Ceremony) RunAdmin(
 	if err != nil {
 		return nil, 0, trace.Wrap(err)
 	}
-	cdd := init.DeviceData
-	osType := cdd.OsType
-	assetTag := cdd.SerialNumber
+	cdd := init.GetDeviceData()
+	osType := cdd.GetOsType()
+	assetTag := cdd.GetSerialNumber()
 
 	rewordAccessDenied := func(err error, action string) error {
 		if trace.IsAccessDenied(trail.FromGRPC(err)) {
@@ -104,21 +104,21 @@ func (c *Ceremony) RunAdmin(
 	}
 
 	// Query for current device.
-	findResp, err := devicesClient.FindDevices(ctx, &devicepb.FindDevicesRequest{
+	findResp, err := devicesClient.FindDevices(ctx, devicepb.FindDevicesRequest_builder{
 		IdOrTag: assetTag,
-	})
+	}.Build())
 	if err != nil {
 		return nil, 0, trace.Wrap(rewordAccessDenied(err, "list devices"))
 	}
 	var currentDev *devicepb.Device
-	for _, dev := range findResp.Devices {
-		if dev.OsType == osType {
+	for _, dev := range findResp.GetDevices() {
+		if dev.GetOsType() == osType {
 			currentDev = dev
 			slog.DebugContext(ctx, "Device Trust: Found device",
 				slog.Group("device",
-					slog.String("asset_tag", currentDev.AssetTag),
-					slog.String("os", devicetrust.FriendlyOSType(currentDev.OsType)),
-					slog.String("id", currentDev.Id),
+					slog.String("asset_tag", currentDev.GetAssetTag()),
+					slog.String("os", devicetrust.FriendlyOSType(currentDev.GetOsType())),
+					slog.String("id", currentDev.GetId()),
 				),
 			)
 			break
@@ -128,13 +128,13 @@ func (c *Ceremony) RunAdmin(
 	// If missing, create the device.
 	var outcome RunAdminOutcome
 	if currentDev == nil {
-		currentDev, err = devicesClient.CreateDevice(ctx, &devicepb.CreateDeviceRequest{
-			Device: &devicepb.Device{
+		currentDev, err = devicesClient.CreateDevice(ctx, devicepb.CreateDeviceRequest_builder{
+			Device: devicepb.Device_builder{
 				OsType:   osType,
 				AssetTag: assetTag,
-			},
+			}.Build(),
 			CreateEnrollToken: true, // Save an additional RPC.
-		})
+		}.Build())
 		if err != nil {
 			return nil, outcome, trace.Wrap(rewordAccessDenied(err, "register devices"))
 		}
@@ -143,22 +143,22 @@ func (c *Ceremony) RunAdmin(
 	// From here onwards, always return `currentDev` and `outcome`!
 
 	// If missing, create a new enrollment token.
-	if currentDev.EnrollToken.GetToken() == "" {
-		currentDev.EnrollToken, err = devicesClient.CreateDeviceEnrollToken(ctx, &devicepb.CreateDeviceEnrollTokenRequest{
-			DeviceId: currentDev.Id,
-		})
+	if currentDev.GetEnrollToken().GetToken() == "" {
+		currentDev.EnrollToken, err = devicesClient.CreateDeviceEnrollToken(ctx, devicepb.CreateDeviceEnrollTokenRequest_builder{
+			DeviceId: currentDev.GetId(),
+		}.Build())
 		if err != nil {
 			return currentDev, outcome, trace.Wrap(rewordAccessDenied(err, "create device enrollment tokens"))
 		}
 		slog.DebugContext(ctx, "Device Trust: Created enrollment token for device",
 			slog.Group("device",
-				slog.String("asset_tag", currentDev.AssetTag),
-				slog.String("os", devicetrust.FriendlyOSType(currentDev.OsType)),
-				slog.String("id", currentDev.Id),
+				slog.String("asset_tag", currentDev.GetAssetTag()),
+				slog.String("os", devicetrust.FriendlyOSType(currentDev.GetOsType())),
+				slog.String("id", currentDev.GetId()),
 			),
 		)
 	}
-	token := currentDev.EnrollToken.GetToken()
+	token := currentDev.GetEnrollToken().GetToken()
 
 	// Then proceed onto enrollment.
 	enrolled, err := c.Run(ctx, devicesClient, debug, token)
@@ -176,7 +176,7 @@ func (c *Ceremony) Run(ctx context.Context, devicesClient devicepb.DeviceTrustSe
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	init.Token = enrollToken
+	init.SetToken(enrollToken)
 
 	return c.run(ctx, devicesClient, debug, init)
 }
@@ -236,7 +236,7 @@ func (c *Ceremony) run(ctx context.Context, devicesClient devicepb.DeviceTrustSe
 	if successResp == nil {
 		return nil, trace.BadParameter("unexpected success payload from server: %T", resp.Payload)
 	}
-	return successResp.Device, nil
+	return successResp.GetDevice(), nil
 }
 
 func (c *Ceremony) enrollDeviceMacOS(stream devicepb.DeviceTrustService_EnrollDeviceClient, resp *devicepb.EnrollDeviceResponse) error {
@@ -244,17 +244,15 @@ func (c *Ceremony) enrollDeviceMacOS(stream devicepb.DeviceTrustService_EnrollDe
 	if chalResp == nil {
 		return trace.BadParameter("unexpected challenge payload from server: %T", resp.Payload)
 	}
-	sig, err := c.SignChallenge(chalResp.Challenge)
+	sig, err := c.SignChallenge(chalResp.GetChallenge())
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = stream.Send(&devicepb.EnrollDeviceRequest{
-		Payload: &devicepb.EnrollDeviceRequest_MacosChallengeResponse{
-			MacosChallengeResponse: &devicepb.MacOSEnrollChallengeResponse{
-				Signature: sig,
-			},
-		},
-	})
+	err = stream.Send(devicepb.EnrollDeviceRequest_builder{
+		MacosChallengeResponse: devicepb.MacOSEnrollChallengeResponse_builder{
+			Signature: sig,
+		}.Build(),
+	}.Build())
 	if err != nil && !errors.Is(err, io.EOF) {
 		// [io.EOF] indicates that the server has closed the stream.
 		// The client should handle the underlying error on the subsequent Recv call.
@@ -269,9 +267,9 @@ func (c *Ceremony) enrollDeviceTPM(ctx context.Context, stream devicepb.DeviceTr
 	switch {
 	case challenge == nil:
 		return trace.BadParameter("unexpected challenge payload from server: %T", resp.Payload)
-	case challenge.EncryptedCredential == nil:
+	case !challenge.HasEncryptedCredential():
 		return trace.BadParameter("missing encrypted_credential in challenge from server")
-	case len(challenge.AttestationNonce) == 0:
+	case len(challenge.GetAttestationNonce()) == 0:
 		return trace.BadParameter("missing attestation_nonce in challenge from server")
 	}
 
diff --git a/lib/devicetrust/enroll/enroll_test.go b/lib/devicetrust/enroll/enroll_test.go
index 09af731ad47..94649003b8f 100644
--- a/lib/devicetrust/enroll/enroll_test.go
+++ b/lib/devicetrust/enroll/enroll_test.go
@@ -45,12 +45,12 @@ func TestCeremony_RunAdmin(t *testing.T) {
 	require.NoError(t, err, "NewFakeMacOSDevice failed")
 
 	// Create the device corresponding to registeredDev.
-	_, err = devices.CreateDevice(ctx, &devicepb.CreateDeviceRequest{
-		Device: &devicepb.Device{
+	_, err = devices.CreateDevice(ctx, devicepb.CreateDeviceRequest_builder{
+		Device: devicepb.Device_builder{
 			OsType:   registeredDev.GetDeviceOSType(),
 			AssetTag: registeredDev.SerialNumber,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err, "CreateDevice(registeredDev) failed")
 
 	tests := []struct {
@@ -148,8 +148,8 @@ func TestCeremony_Run(t *testing.T) {
 			},
 			assertGotDevice: func(t *testing.T, d *devicepb.Device) {
 				require.NotNil(t, d, "RunCeremony returned nil device")
-				require.NotNil(t, d.Credential, "device credential is nil")
-				assert.Equal(t, linuxDev1.CredentialID, d.Credential.Id, "device credential mismatch")
+				require.NotNil(t, d.GetCredential(), "device credential is nil")
+				assert.Equal(t, linuxDev1.CredentialID, d.GetCredential().GetId(), "device credential mismatch")
 			},
 		},
 		{
@@ -160,8 +160,8 @@ func TestCeremony_Run(t *testing.T) {
 			},
 			assertGotDevice: func(t *testing.T, d *devicepb.Device) {
 				require.NotNil(t, d, "RunCeremony returned nil device")
-				require.NotNil(t, d.Credential, "device credential is nil")
-				assert.Equal(t, windowsDev1.CredentialID, d.Credential.Id, "device credential mismatch")
+				require.NotNil(t, d.GetCredential(), "device credential is nil")
+				assert.Equal(t, windowsDev1.CredentialID, d.GetCredential().GetId(), "device credential mismatch")
 			},
 		},
 	}
diff --git a/lib/devicetrust/native/api.go b/lib/devicetrust/native/api.go
index ad13f1189da..994db3aa457 100644
--- a/lib/devicetrust/native/api.go
+++ b/lib/devicetrust/native/api.go
@@ -82,7 +82,7 @@ func readCachedDeviceDataUnderLock(mode CollectDataMode) (cdd *devicepb.DeviceCo
 	const maxAgeSeconds = 60
 	cdd = cachedDeviceData.value
 	now := time.Now()
-	if now.Unix()-cdd.CollectTime.Seconds > maxAgeSeconds {
+	if now.Unix()-cdd.GetCollectTime().Seconds > maxAgeSeconds {
 		// "Evict" cache.
 		cachedDeviceData.mode = 0
 		cachedDeviceData.value = nil
@@ -91,7 +91,7 @@ func readCachedDeviceDataUnderLock(mode CollectDataMode) (cdd *devicepb.DeviceCo
 
 	slog.DebugContext(context.Background(), "Device Trust: Using in-process cached device data")
 	cdd = proto.Clone(cachedDeviceData.value).(*devicepb.DeviceCollectedData)
-	cdd.CollectTime = timestamppb.Now()
+	cdd.SetCollectTime(timestamppb.Now())
 	return cdd, true
 }
 
diff --git a/lib/devicetrust/testenv/fake_device_service.go b/lib/devicetrust/testenv/fake_device_service.go
index 6e8407ff647..a855f150c10 100644
--- a/lib/devicetrust/testenv/fake_device_service.go
+++ b/lib/devicetrust/testenv/fake_device_service.go
@@ -113,10 +113,10 @@ func (s *FakeDeviceService) CreateDeviceWebTokenForTesting(params CreateDeviceWe
 		webToken:         webToken,
 	})
 
-	return &devicepb.DeviceWebToken{
+	return devicepb.DeviceWebToken_builder{
 		Id:    id,
 		Token: webToken,
-	}, nil
+	}.Build(), nil
 }
 
 // VerifyConfirmationToken verifies that the token is valid within this
@@ -128,7 +128,7 @@ func (s *FakeDeviceService) VerifyConfirmationToken(token *devicepb.DeviceConfir
 	defer s.mu.Unlock()
 
 	for _, attempt := range s.deviceAuthnAttempts {
-		if attempt.id == token.Id && attempt.confirmToken == token.Token {
+		if attempt.id == token.GetId() && attempt.confirmToken == token.GetToken() {
 			return nil
 		}
 	}
@@ -145,13 +145,13 @@ func (s *FakeDeviceService) SetDevicesLimitReached(limitReached bool) {
 }
 
 func (s *FakeDeviceService) CreateDevice(ctx context.Context, req *devicepb.CreateDeviceRequest) (*devicepb.Device, error) {
-	dev := req.Device
+	dev := req.GetDevice()
 	switch {
 	case dev == nil:
 		return nil, trace.BadParameter("device required")
-	case dev.OsType == devicepb.OSType_OS_TYPE_UNSPECIFIED:
+	case dev.GetOsType() == devicepb.OSType_OS_TYPE_UNSPECIFIED:
 		return nil, trace.BadParameter("device OS type required")
-	case dev.AssetTag == "":
+	case dev.GetAssetTag() == "":
 		return nil, trace.BadParameter("device asset tag required")
 	}
 
@@ -161,26 +161,26 @@ func (s *FakeDeviceService) CreateDevice(ctx context.Context, req *devicepb.Crea
 	// Do some superficial checks.
 	// We don't deeply validate devices or check for ID collisions for brevity.
 	for _, sd := range s.devices {
-		if sd.pb.OsType == dev.OsType && sd.pb.AssetTag == dev.AssetTag {
+		if sd.pb.GetOsType() == dev.GetOsType() && sd.pb.GetAssetTag() == dev.GetAssetTag() {
 			return nil, trace.AlreadyExists("device already registered")
 		}
 	}
 
 	// Take a copy and ignore most fields, except what we need for testing.
 	now := timestamppb.Now()
-	created := &devicepb.Device{
+	created := devicepb.Device_builder{
 		ApiVersion:   "v1",
 		Id:           uuid.NewString(),
-		OsType:       dev.OsType,
-		AssetTag:     dev.AssetTag,
+		OsType:       dev.GetOsType(),
+		AssetTag:     dev.GetAssetTag(),
 		CreateTime:   now,
 		UpdateTime:   now,
 		EnrollStatus: devicepb.DeviceEnrollStatus_DEVICE_ENROLL_STATUS_NOT_ENROLLED,
-	}
+	}.Build()
 
 	// Prepare enroll token, if requested.
 	var enrollToken string
-	if req.CreateEnrollToken {
+	if req.GetCreateEnrollToken() {
 		enrollToken = uuid.NewString()
 	}
 
@@ -193,15 +193,15 @@ func (s *FakeDeviceService) CreateDevice(ctx context.Context, req *devicepb.Crea
 	resp := created
 	if enrollToken != "" {
 		resp = proto.Clone(created).(*devicepb.Device)
-		resp.EnrollToken = &devicepb.DeviceEnrollToken{
+		resp.SetEnrollToken(devicepb.DeviceEnrollToken_builder{
 			Token: enrollToken,
-		}
+		}.Build())
 	}
 	return resp, nil
 }
 
 func (s *FakeDeviceService) FindDevices(ctx context.Context, req *devicepb.FindDevicesRequest) (*devicepb.FindDevicesResponse, error) {
-	if req.IdOrTag == "" {
+	if req.GetIdOrTag() == "" {
 		return nil, trace.BadParameter("param id_or_tag required")
 	}
 
@@ -210,14 +210,14 @@ func (s *FakeDeviceService) FindDevices(ctx context.Context, req *devicepb.FindD
 
 	var devs []*devicepb.Device
 	for _, sd := range s.devices {
-		if sd.pb.Id == req.IdOrTag || sd.pb.AssetTag == req.IdOrTag {
+		if sd.pb.GetId() == req.GetIdOrTag() || sd.pb.GetAssetTag() == req.GetIdOrTag() {
 			devs = append(devs, sd.pb)
 		}
 	}
 
-	return &devicepb.FindDevicesResponse{
+	return devicepb.FindDevicesResponse_builder{
 		Devices: devs,
-	}, nil
+	}.Build(), nil
 }
 
 // CreateDeviceEnrollToken implements the creation of fake device enrollment
@@ -229,18 +229,18 @@ func (s *FakeDeviceService) FindDevices(ctx context.Context, req *devicepb.FindD
 // Auto-enrollment is completely fake, it doesn't require the device to exist.
 // Always returns [FakeEnrollmentToken].
 func (s *FakeDeviceService) CreateDeviceEnrollToken(ctx context.Context, req *devicepb.CreateDeviceEnrollTokenRequest) (*devicepb.DeviceEnrollToken, error) {
-	if req.DeviceId != "" {
-		return s.createEnrollTokenID(ctx, req.DeviceId)
+	if req.GetDeviceId() != "" {
+		return s.createEnrollTokenID(ctx, req.GetDeviceId())
 	}
 
 	// Auto-enrollment path.
-	if err := validateCollectedData(req.DeviceData); err != nil {
+	if err := validateCollectedData(req.GetDeviceData()); err != nil {
 		return nil, trace.AccessDenied("%s", err)
 	}
 
-	return &devicepb.DeviceEnrollToken{
+	return devicepb.DeviceEnrollToken_builder{
 		Token: FakeEnrollmentToken,
-	}, nil
+	}.Build(), nil
 }
 
 func (s *FakeDeviceService) createEnrollTokenID(ctx context.Context, deviceID string) (*devicepb.DeviceEnrollToken, error) {
@@ -256,9 +256,9 @@ func (s *FakeDeviceService) createEnrollTokenID(ctx context.Context, deviceID st
 	enrollToken := uuid.NewString()
 	sd.enrollToken = enrollToken
 
-	return &devicepb.DeviceEnrollToken{
+	return devicepb.DeviceEnrollToken_builder{
 		Token: enrollToken,
-	}, nil
+	}.Build(), nil
 }
 
 // EnrollDevice implements a fake, server-side device enrollment ceremony.
@@ -276,15 +276,15 @@ func (s *FakeDeviceService) EnrollDevice(stream devicepb.DeviceTrustService_Enro
 	switch {
 	case initReq == nil:
 		return trace.BadParameter("init required")
-	case initReq.Token == "":
+	case initReq.GetToken() == "":
 		return trace.BadParameter("token required")
-	case initReq.CredentialId == "":
+	case initReq.GetCredentialId() == "":
 		return trace.BadParameter("credential ID required")
 	}
-	if err := validateCollectedData(initReq.DeviceData); err != nil {
+	if err := validateCollectedData(initReq.GetDeviceData()); err != nil {
 		return trace.Wrap(err)
 	}
-	cd := initReq.DeviceData
+	cd := initReq.GetDeviceData()
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -294,20 +294,20 @@ func (s *FakeDeviceService) EnrollDevice(stream devicepb.DeviceTrustService_Enro
 	}
 
 	// Find or auto-create device.
-	sd, err := s.findDeviceByOSTag(cd.OsType, cd.SerialNumber)
+	sd, err := s.findDeviceByOSTag(cd.GetOsType(), cd.GetSerialNumber())
 	switch {
 	case s.autoCreateDevice && trace.IsNotFound(err):
 		// Auto-created device.
 		now := timestamppb.Now()
-		dev := &devicepb.Device{
+		dev := devicepb.Device_builder{
 			ApiVersion:   "v1",
 			Id:           uuid.NewString(),
-			OsType:       cd.OsType,
-			AssetTag:     cd.SerialNumber,
+			OsType:       cd.GetOsType(),
+			AssetTag:     cd.GetSerialNumber(),
 			CreateTime:   now,
 			UpdateTime:   now,
 			EnrollStatus: devicepb.DeviceEnrollStatus_DEVICE_ENROLL_STATUS_NOT_ENROLLED,
-		}
+		}.Build()
 		s.devices = append(s.devices, storedDevice{
 			pb: dev,
 		})
@@ -317,14 +317,14 @@ func (s *FakeDeviceService) EnrollDevice(stream devicepb.DeviceTrustService_Enro
 	}
 
 	// Spend enrollment token.
-	if err := s.spendEnrollmentToken(sd, initReq.Token); err != nil {
+	if err := s.spendEnrollmentToken(sd, initReq.GetToken()); err != nil {
 		return err
 	}
 
 	// OS-specific enrollment.
 	var cred *devicepb.DeviceCredential
 	var pub *ecdsa.PublicKey
-	switch initReq.DeviceData.OsType {
+	switch initReq.GetDeviceData().GetOsType() {
 	case devicepb.OSType_OS_TYPE_MACOS:
 		cred, pub, err = enrollMacOS(stream, initReq)
 		// err handled below
@@ -339,19 +339,17 @@ func (s *FakeDeviceService) EnrollDevice(stream devicepb.DeviceTrustService_Enro
 	}
 
 	// Save enrollment information.
-	sd.pb.UpdateTime = timestamppb.Now()
-	sd.pb.EnrollStatus = devicepb.DeviceEnrollStatus_DEVICE_ENROLL_STATUS_ENROLLED
-	sd.pb.Credential = cred
+	sd.pb.SetUpdateTime(timestamppb.Now())
+	sd.pb.SetEnrollStatus(devicepb.DeviceEnrollStatus_DEVICE_ENROLL_STATUS_ENROLLED)
+	sd.pb.SetCredential(cred)
 	sd.pub = pub
 
 	// Success.
-	err = stream.Send(&devicepb.EnrollDeviceResponse{
-		Payload: &devicepb.EnrollDeviceResponse_Success{
-			Success: &devicepb.EnrollDeviceSuccess{
-				Device: sd.pb,
-			},
-		},
-	})
+	err = stream.Send(devicepb.EnrollDeviceResponse_builder{
+		Success: devicepb.EnrollDeviceSuccess_builder{
+			Device: sd.pb,
+		}.Build(),
+	}.Build())
 	return trace.Wrap(err)
 }
 
@@ -378,11 +376,11 @@ func randomBytes() ([]byte, error) {
 
 func enrollTPM(stream devicepb.DeviceTrustService_EnrollDeviceServer, initReq *devicepb.EnrollDeviceInit) (*devicepb.DeviceCredential, error) {
 	switch {
-	case initReq.Tpm == nil:
+	case !initReq.HasTpm():
 		return nil, trace.BadParameter("init req missing tpm message")
-	case !bytes.Equal(validEKKey, initReq.Tpm.GetEkKey()):
+	case !bytes.Equal(validEKKey, initReq.GetTpm().GetEkKey()):
 		return nil, trace.BadParameter("ek key in init req did not match expected")
-	case !proto.Equal(initReq.Tpm.AttestationParameters, validAttestationParameters):
+	case !proto.Equal(initReq.GetTpm().GetAttestationParameters(), validAttestationParameters):
 		return nil, trace.BadParameter("init req tpm message attestation parameters mismatch")
 	}
 
@@ -399,17 +397,15 @@ func enrollTPM(stream devicepb.DeviceTrustService_EnrollDeviceServer, initReq *d
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	if err := stream.Send(&devicepb.EnrollDeviceResponse{
-		Payload: &devicepb.EnrollDeviceResponse_TpmChallenge{
-			TpmChallenge: &devicepb.TPMEnrollChallenge{
-				EncryptedCredential: &devicepb.TPMEncryptedCredential{
-					CredentialBlob: credentialBlob,
-					Secret:         secret,
-				},
-				AttestationNonce: nonce,
-			},
-		},
-	}); err != nil {
+	if err := stream.Send(devicepb.EnrollDeviceResponse_builder{
+		TpmChallenge: devicepb.TPMEnrollChallenge_builder{
+			EncryptedCredential: devicepb.TPMEncryptedCredential_builder{
+				CredentialBlob: credentialBlob,
+				Secret:         secret,
+			}.Build(),
+			AttestationNonce: nonce,
+		}.Build(),
+	}.Build()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -421,28 +417,28 @@ func enrollTPM(stream devicepb.DeviceTrustService_EnrollDeviceServer, initReq *d
 	switch {
 	case chalResp == nil:
 		return nil, trace.BadParameter("challenge response required")
-	case !bytes.Equal(expectSolution, chalResp.Solution):
+	case !bytes.Equal(expectSolution, chalResp.GetSolution()):
 		return nil, trace.BadParameter("activate credential solution in challenge response did not match expected")
-	case chalResp.PlatformParameters == nil:
+	case !chalResp.HasPlatformParameters():
 		return nil, trace.BadParameter("missing platform parameters in challenge response")
-	case !bytes.Equal(nonce, chalResp.PlatformParameters.EventLog):
+	case !bytes.Equal(nonce, chalResp.GetPlatformParameters().GetEventLog()):
 		return nil, trace.BadParameter("nonce in challenge response did not match expected")
 	}
 
-	return &devicepb.DeviceCredential{
-		Id:                    initReq.CredentialId,
+	return devicepb.DeviceCredential_builder{
+		Id:                    initReq.GetCredentialId(),
 		DeviceAttestationType: devicepb.DeviceAttestationType_DEVICE_ATTESTATION_TYPE_TPM_EKPUB,
-	}, nil
+	}.Build(), nil
 }
 
 func enrollMacOS(stream devicepb.DeviceTrustService_EnrollDeviceServer, initReq *devicepb.EnrollDeviceInit) (*devicepb.DeviceCredential, *ecdsa.PublicKey, error) {
 	switch {
-	case initReq.Macos == nil:
+	case !initReq.HasMacos():
 		return nil, nil, trace.BadParameter("device Macos data required")
-	case len(initReq.Macos.PublicKeyDer) == 0:
+	case len(initReq.GetMacos().GetPublicKeyDer()) == 0:
 		return nil, nil, trace.BadParameter("device Macos.PublicKeyDer required")
 	}
-	pubKey, err := x509.ParsePKIXPublicKey(initReq.Macos.PublicKeyDer)
+	pubKey, err := x509.ParsePKIXPublicKey(initReq.GetMacos().GetPublicKeyDer())
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
@@ -456,13 +452,11 @@ func enrollMacOS(stream devicepb.DeviceTrustService_EnrollDeviceServer, initReq
 	if err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
-	if err := stream.Send(&devicepb.EnrollDeviceResponse{
-		Payload: &devicepb.EnrollDeviceResponse_MacosChallenge{
-			MacosChallenge: &devicepb.MacOSEnrollChallenge{
-				Challenge: chal,
-			},
-		},
-	}); err != nil {
+	if err := stream.Send(devicepb.EnrollDeviceResponse_builder{
+		MacosChallenge: devicepb.MacOSEnrollChallenge_builder{
+			Challenge: chal,
+		}.Build(),
+	}.Build()); err != nil {
 		return nil, nil, trace.Wrap(err)
 	}
 
@@ -475,17 +469,17 @@ func enrollMacOS(stream devicepb.DeviceTrustService_EnrollDeviceServer, initReq
 	switch {
 	case chalResp == nil:
 		return nil, nil, trace.BadParameter("challenge response required")
-	case len(chalResp.Signature) == 0:
+	case len(chalResp.GetSignature()) == 0:
 		return nil, nil, trace.BadParameter("signature required")
 	}
-	if err := verifyChallenge(chal, chalResp.Signature, ecPubKey); err != nil {
+	if err := verifyChallenge(chal, chalResp.GetSignature(), ecPubKey); err != nil {
 		return nil, nil, trace.BadParameter("signature verification failed")
 	}
 
-	return &devicepb.DeviceCredential{
-		Id:           initReq.CredentialId,
-		PublicKeyDer: initReq.Macos.PublicKeyDer,
-	}, ecPubKey, nil
+	return devicepb.DeviceCredential_builder{
+		Id:           initReq.GetCredentialId(),
+		PublicKeyDer: initReq.GetMacos().GetPublicKeyDer(),
+	}.Build(), ecPubKey, nil
 }
 
 // CreateAssertCeremony creates a fake, server-side device assertion ceremony.
@@ -507,28 +501,28 @@ func (s *FakeDeviceService) AssertDevice(ctx context.Context, stream assertserve
 	switch {
 	case initReq == nil:
 		return nil, trace.BadParameter("init required")
-	case initReq.CredentialId == "":
+	case initReq.GetCredentialId() == "":
 		return nil, trace.BadParameter("credential ID required")
 	}
-	if err := validateCollectedData(initReq.DeviceData); err != nil {
+	if err := validateCollectedData(initReq.GetDeviceData()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	dev, err := s.findDeviceByCredential(initReq.DeviceData, initReq.CredentialId)
+	dev, err := s.findDeviceByCredential(initReq.GetDeviceData(), initReq.GetCredentialId())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	switch dev.pb.OsType {
+	switch dev.pb.GetOsType() {
 	case devicepb.OSType_OS_TYPE_MACOS:
 		err = authenticateDeviceMacOS(dev, assertStreamAdapter{stream: stream}, nil /*sshCert*/)
 	case devicepb.OSType_OS_TYPE_LINUX, devicepb.OSType_OS_TYPE_WINDOWS:
 		err = authenticateDeviceTPM(assertStreamAdapter{stream: stream}, nil /*sshCert*/)
 	default:
-		err = fmt.Errorf("unrecognized os type %q", dev.pb.OsType)
+		err = fmt.Errorf("unrecognized os type %q", dev.pb.GetOsType())
 	}
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -557,24 +551,24 @@ func (s *FakeDeviceService) AuthenticateDevice(stream devicepb.DeviceTrustServic
 	switch {
 	case initReq == nil:
 		return trace.BadParameter("init required")
-	case initReq.CredentialId == "":
+	case initReq.GetCredentialId() == "":
 		return trace.BadParameter("credential ID required")
 	}
-	if err := validateCollectedData(initReq.DeviceData); err != nil {
+	if err := validateCollectedData(initReq.GetDeviceData()); err != nil {
 		return trace.Wrap(err)
 	}
 
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	dev, err := s.findDeviceByCredential(initReq.DeviceData, initReq.CredentialId)
+	dev, err := s.findDeviceByCredential(initReq.GetDeviceData(), initReq.GetCredentialId())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
 	// Validate/spent the device web token, if present.
 	var confirmToken *devicepb.DeviceConfirmationToken
-	if webToken := initReq.DeviceWebToken; webToken != nil {
+	if webToken := initReq.GetDeviceWebToken(); webToken != nil {
 		var err error
 		confirmToken, err = s.spendDeviceWebToken(webToken, dev)
 		if err != nil {
@@ -582,13 +576,13 @@ func (s *FakeDeviceService) AuthenticateDevice(stream devicepb.DeviceTrustServic
 		}
 	}
 
-	switch dev.pb.OsType {
+	switch dev.pb.GetOsType() {
 	case devicepb.OSType_OS_TYPE_MACOS:
 		err = authenticateDeviceMacOS(dev, stream, initReq.GetUserCertificates().GetSshAuthorizedKey())
 	case devicepb.OSType_OS_TYPE_LINUX, devicepb.OSType_OS_TYPE_WINDOWS:
 		err = authenticateDeviceTPM(stream, initReq.GetUserCertificates().GetSshAuthorizedKey())
 	default:
-		err = fmt.Errorf("unrecognized os type %q", dev.pb.OsType)
+		err = fmt.Errorf("unrecognized os type %q", dev.pb.GetOsType())
 	}
 	if err != nil {
 		return trace.Wrap(err)
@@ -596,14 +590,12 @@ func (s *FakeDeviceService) AuthenticateDevice(stream devicepb.DeviceTrustServic
 
 	// Standalone device authentication.
 	if confirmToken == nil {
-		return trace.Wrap(stream.Send(&devicepb.AuthenticateDeviceResponse{
-			Payload: &devicepb.AuthenticateDeviceResponse_UserCertificates{
-				UserCertificates: &devicepb.UserCertificates{
-					X509Der:          []byte("<insert augmented X.509 cert here"),
-					SshAuthorizedKey: []byte("<insert augmented SSH cert here"),
-				},
-			},
-		}))
+		return trace.Wrap(stream.Send(devicepb.AuthenticateDeviceResponse_builder{
+			UserCertificates: devicepb.UserCertificates_builder{
+				X509Der:          []byte("<insert augmented X.509 cert here"),
+				SshAuthorizedKey: []byte("<insert augmented SSH cert here"),
+			}.Build(),
+		}.Build()))
 	}
 
 	// Web authentication.
@@ -618,7 +610,7 @@ func (s *FakeDeviceService) spendDeviceWebToken(webToken *devicepb.DeviceWebToke
 	const invalidWebTokenMessage = "invalid device web token"
 
 	for _, attempt := range s.deviceAuthnAttempts {
-		if attempt.id != webToken.Id {
+		if attempt.id != webToken.GetId() {
 			continue
 		}
 
@@ -630,19 +622,19 @@ func (s *FakeDeviceService) spendDeviceWebToken(webToken *devicepb.DeviceWebToke
 		switch {
 		case storedToken == "": // Invalid attempt state or token already spent.
 			return nil, trace.AccessDenied("%s", invalidWebTokenMessage)
-		case storedToken != webToken.Token: // Bad token
+		case storedToken != webToken.GetToken(): // Bad token
 			return nil, trace.AccessDenied("%s", invalidWebTokenMessage)
-		case attempt.expectedDeviceID != dev.pb.Id: // Failed expected device check.
+		case attempt.expectedDeviceID != dev.pb.GetId(): // Failed expected device check.
 			return nil, trace.AccessDenied("%s", invalidWebTokenMessage)
 		}
 
 		// Issue a new confirmation token.
 		attempt.confirmToken = uuid.NewString()
 
-		return &devicepb.DeviceConfirmationToken{
+		return devicepb.DeviceConfirmationToken_builder{
 			Id:    attempt.id,
 			Token: attempt.confirmToken,
-		}, nil
+		}.Build(), nil
 	}
 
 	// Token ID not found.
@@ -659,13 +651,11 @@ func authenticateDeviceMacOS(
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err := stream.Send(&devicepb.AuthenticateDeviceResponse{
-		Payload: &devicepb.AuthenticateDeviceResponse_Challenge{
-			Challenge: &devicepb.AuthenticateDeviceChallenge{
-				Challenge: chal,
-			},
-		},
-	}); err != nil {
+	if err := stream.Send(devicepb.AuthenticateDeviceResponse_builder{
+		Challenge: devicepb.AuthenticateDeviceChallenge_builder{
+			Challenge: chal,
+		}.Build(),
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	req, err := stream.Recv()
@@ -678,16 +668,16 @@ func authenticateDeviceMacOS(
 	switch {
 	case chalResp == nil:
 		return trace.BadParameter("challenge response required")
-	case len(chalResp.Signature) == 0:
+	case len(chalResp.GetSignature()) == 0:
 		return trace.BadParameter("signature required")
 	}
-	if err := challenge.Verify(chal, chalResp.Signature, dev.pub); err != nil {
+	if err := challenge.Verify(chal, chalResp.GetSignature(), dev.pub); err != nil {
 		return trace.Wrap(err)
 	}
 
 	// Verify SSH challenge signature if augmented SSH cert was requested.
 	if len(sshCert) != 0 {
-		if err := verifySSHChallenge(sshCert, chal, chalResp.SshSignature); err != nil {
+		if err := verifySSHChallenge(sshCert, chal, chalResp.GetSshSignature()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -702,13 +692,11 @@ func authenticateDeviceTPM(stream authenticateDeviceStream, sshCert []byte) erro
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if err := stream.Send(&devicepb.AuthenticateDeviceResponse{
-		Payload: &devicepb.AuthenticateDeviceResponse_TpmChallenge{
-			TpmChallenge: &devicepb.TPMAuthenticateDeviceChallenge{
-				AttestationNonce: nonce,
-			},
-		},
-	}); err != nil {
+	if err := stream.Send(devicepb.AuthenticateDeviceResponse_builder{
+		TpmChallenge: devicepb.TPMAuthenticateDeviceChallenge_builder{
+			AttestationNonce: nonce,
+		}.Build(),
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -720,15 +708,15 @@ func authenticateDeviceTPM(stream authenticateDeviceStream, sshCert []byte) erro
 	switch {
 	case chalResp == nil:
 		return trace.BadParameter("challenge response required")
-	case chalResp.PlatformParameters == nil:
+	case !chalResp.HasPlatformParameters():
 		return trace.BadParameter("missing platform parameters in challenge response")
-	case !bytes.Equal(nonce, chalResp.PlatformParameters.EventLog):
+	case !bytes.Equal(nonce, chalResp.GetPlatformParameters().GetEventLog()):
 		return trace.BadParameter("nonce in challenge response did not match expected")
 	}
 
 	// Verify SSH challenge signature if augmented SSH cert was requested.
 	if len(sshCert) != 0 {
-		if err := verifySSHChallenge(sshCert, nonce, chalResp.SshSignature); err != nil {
+		if err := verifySSHChallenge(sshCert, nonce, chalResp.GetSshSignature()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -763,22 +751,22 @@ func verifySSHChallenge(sshAuthorizedKey, chal, signature []byte) error {
 
 func (s *FakeDeviceService) findDeviceByID(deviceID string) (*storedDevice, error) {
 	return s.findDeviceByPredicate(func(sd *storedDevice) bool {
-		return sd.pb.Id == deviceID
+		return sd.pb.GetId() == deviceID
 	})
 }
 
 func (s *FakeDeviceService) findDeviceByOSTag(osType devicepb.OSType, assetTag string) (*storedDevice, error) {
 	return s.findDeviceByPredicate(func(sd *storedDevice) bool {
-		return sd.pb.OsType == osType && sd.pb.AssetTag == assetTag
+		return sd.pb.GetOsType() == osType && sd.pb.GetAssetTag() == assetTag
 	})
 }
 
 func (s *FakeDeviceService) findDeviceByCredential(cd *devicepb.DeviceCollectedData, credentialID string) (*storedDevice, error) {
-	sd, err := s.findDeviceByOSTag(cd.OsType, cd.SerialNumber)
+	sd, err := s.findDeviceByOSTag(cd.GetOsType(), cd.GetSerialNumber())
 	if err != nil {
 		return nil, err
 	}
-	if sd.pb.Credential.Id != credentialID {
+	if sd.pb.GetCredential().GetId() != credentialID {
 		return nil, trace.BadParameter("unknown credential for device")
 	}
 	return sd, nil
@@ -797,12 +785,12 @@ func validateCollectedData(cd *devicepb.DeviceCollectedData) error {
 	switch {
 	case cd == nil:
 		return trace.BadParameter("device data required")
-	case cd.OsType == devicepb.OSType_OS_TYPE_UNSPECIFIED:
+	case cd.GetOsType() == devicepb.OSType_OS_TYPE_UNSPECIFIED:
 		return trace.BadParameter("device OsType invalid")
-	case cd.SerialNumber == "":
+	case cd.GetSerialNumber() == "":
 		return trace.BadParameter("device SerialNumber required")
 	}
-	if err := cd.CollectTime.CheckValid(); err != nil {
+	if err := cd.GetCollectTime().CheckValid(); err != nil {
 		return trace.BadParameter("device CollectTime invalid: %v", err)
 	}
 	return nil
@@ -842,16 +830,16 @@ func (s assertStreamAdapter) Recv() (*devicepb.AuthenticateDeviceRequest, error)
 	}
 
 	// Convert AssertDeviceRequest to AuthenticateDeviceRequest.
-	if req == nil || req.Payload == nil {
+	if req == nil || !req.HasPayload() {
 		return nil, trace.BadParameter("assert request payload required")
 	}
 	authnReq := &devicepb.AuthenticateDeviceRequest{}
-	switch req.Payload.(type) {
-	case *devicepb.AssertDeviceRequest_ChallengeResponse:
+	switch req.WhichPayload() {
+	case devicepb.AssertDeviceRequest_ChallengeResponse_case:
 		authnReq.Payload = &devicepb.AuthenticateDeviceRequest_ChallengeResponse{
 			ChallengeResponse: req.GetChallengeResponse(),
 		}
-	case *devicepb.AssertDeviceRequest_TpmChallengeResponse:
+	case devicepb.AssertDeviceRequest_TpmChallengeResponse_case:
 		authnReq.Payload = &devicepb.AuthenticateDeviceRequest_TpmChallengeResponse{
 			TpmChallengeResponse: req.GetTpmChallengeResponse(),
 		}
@@ -863,18 +851,18 @@ func (s assertStreamAdapter) Recv() (*devicepb.AuthenticateDeviceRequest, error)
 }
 
 func (s assertStreamAdapter) Send(authnResp *devicepb.AuthenticateDeviceResponse) error {
-	if authnResp == nil || authnResp.Payload == nil {
+	if authnResp == nil || !authnResp.HasPayload() {
 		return trace.BadParameter("authenticate response payload required")
 	}
 
 	// Convert AuthenticateDeviceResponse to AssertDeviceResponse.
 	resp := &devicepb.AssertDeviceResponse{}
-	switch authnResp.Payload.(type) {
-	case *devicepb.AuthenticateDeviceResponse_Challenge:
+	switch authnResp.WhichPayload() {
+	case devicepb.AuthenticateDeviceResponse_Challenge_case:
 		resp.Payload = &devicepb.AssertDeviceResponse_Challenge{
 			Challenge: authnResp.GetChallenge(),
 		}
-	case *devicepb.AuthenticateDeviceResponse_TpmChallenge:
+	case devicepb.AuthenticateDeviceResponse_TpmChallenge_case:
 		resp.Payload = &devicepb.AssertDeviceResponse_TpmChallenge{
 			TpmChallenge: authnResp.GetTpmChallenge(),
 		}
diff --git a/lib/devicetrust/testenv/fake_macos_device.go b/lib/devicetrust/testenv/fake_macos_device.go
index 1914aaab52c..57521560fa2 100644
--- a/lib/devicetrust/testenv/fake_macos_device.go
+++ b/lib/devicetrust/testenv/fake_macos_device.go
@@ -63,18 +63,18 @@ func NewFakeMacOSDevice() (*FakeMacOSDevice, error) {
 }
 
 func (f *FakeMacOSDevice) CollectDeviceData(mode native.CollectDataMode) (*devicepb.DeviceCollectedData, error) {
-	return &devicepb.DeviceCollectedData{
+	return devicepb.DeviceCollectedData_builder{
 		CollectTime:  timestamppb.Now(),
 		OsType:       devicepb.OSType_OS_TYPE_MACOS,
 		SerialNumber: f.SerialNumber,
-	}, nil
+	}.Build(), nil
 }
 
 func (f *FakeMacOSDevice) GetDeviceCredential() *devicepb.DeviceCredential {
-	return &devicepb.DeviceCredential{
+	return devicepb.DeviceCredential_builder{
 		Id:           f.ID,
 		PublicKeyDer: f.PubKeyDER,
-	}
+	}.Build()
 }
 
 func (f *FakeMacOSDevice) GetDeviceOSType() devicepb.OSType {
@@ -83,14 +83,14 @@ func (f *FakeMacOSDevice) GetDeviceOSType() devicepb.OSType {
 
 func (f *FakeMacOSDevice) EnrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
 	cd, _ := f.CollectDeviceData(native.CollectedDataAlwaysEscalate)
-	return &devicepb.EnrollDeviceInit{
+	return devicepb.EnrollDeviceInit_builder{
 		Token:        "",
 		CredentialId: f.ID,
 		DeviceData:   cd,
-		Macos: &devicepb.MacOSEnrollPayload{
+		Macos: devicepb.MacOSEnrollPayload_builder{
 			PublicKeyDer: f.PubKeyDER,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 func (f *FakeMacOSDevice) SignChallenge(chal []byte) (sig []byte, err error) {
diff --git a/lib/devicetrust/testenv/fake_tpm_device.go b/lib/devicetrust/testenv/fake_tpm_device.go
index 85d84ccd1e6..d2ddd39e843 100644
--- a/lib/devicetrust/testenv/fake_tpm_device.go
+++ b/lib/devicetrust/testenv/fake_tpm_device.go
@@ -58,22 +58,22 @@ func (f *FakeTPMDevice) GetDeviceOSType() devicepb.OSType {
 }
 
 func (f *FakeTPMDevice) CollectDeviceData(mode native.CollectDataMode) (*devicepb.DeviceCollectedData, error) {
-	return &devicepb.DeviceCollectedData{
+	return devicepb.DeviceCollectedData_builder{
 		CollectTime:  timestamppb.Now(),
 		OsType:       f.OSType,
 		SerialNumber: f.SerialNumber,
 		// Note: other data points are nice to have, but not mandatory.
-	}, nil
+	}.Build(), nil
 }
 
 var validEKKey = []byte("FAKE_VALID_EK_KEY")
-var validAttestationParameters = &devicepb.TPMAttestationParameters{
+var validAttestationParameters = devicepb.TPMAttestationParameters_builder{
 	Public: []byte("FAKE_TPMT_PUBLIC_FOR_AK"),
-}
+}.Build()
 
 func (f *FakeTPMDevice) EnrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
 	cd, _ := f.CollectDeviceData(native.CollectedDataAlwaysEscalate)
-	return &devicepb.EnrollDeviceInit{
+	return devicepb.EnrollDeviceInit_builder{
 		CredentialId: f.CredentialID,
 		DeviceData:   cd,
 		Tpm: &devicepb.TPMEnrollPayload{
@@ -82,7 +82,7 @@ func (f *FakeTPMDevice) EnrollDeviceInit() (*devicepb.EnrollDeviceInit, error) {
 			},
 			AttestationParameters: validAttestationParameters,
 		},
-	}, nil
+	}.Build(), nil
 }
 
 func (f *FakeTPMDevice) SolveTPMEnrollChallenge(
@@ -95,15 +95,15 @@ func (f *FakeTPMDevice) SolveTPMEnrollChallenge(
 	// This lets us assert from the server that the `SolveTPMEnrollChallenge`
 	// is provided all the values from the server by `RunCeremony`.
 	solution := append(
-		challenge.EncryptedCredential.Secret,
-		challenge.EncryptedCredential.CredentialBlob...,
+		challenge.GetEncryptedCredential().GetSecret(),
+		challenge.GetEncryptedCredential().GetCredentialBlob()...,
 	)
-	return &devicepb.TPMEnrollChallengeResponse{
+	return devicepb.TPMEnrollChallengeResponse_builder{
 		Solution: solution,
-		PlatformParameters: &devicepb.TPMPlatformParameters{
-			EventLog: challenge.AttestationNonce,
-		},
-	}, nil
+		PlatformParameters: devicepb.TPMPlatformParameters_builder{
+			EventLog: challenge.GetAttestationNonce(),
+		}.Build(),
+	}.Build(), nil
 }
 
 func (f *FakeTPMDevice) SolveTPMAuthnDeviceChallenge(
@@ -112,11 +112,11 @@ func (f *FakeTPMDevice) SolveTPMAuthnDeviceChallenge(
 	// This fake is similar to the one used in SolveTPMEnrollChallenge except
 	// only the PlatformAttestation is faked, as CredentialActivation is not
 	// used in device authentication.
-	return &devicepb.TPMAuthenticateDeviceChallengeResponse{
-		PlatformParameters: &devicepb.TPMPlatformParameters{
-			EventLog: challenge.AttestationNonce,
-		},
-	}, nil
+	return devicepb.TPMAuthenticateDeviceChallengeResponse_builder{
+		PlatformParameters: devicepb.TPMPlatformParameters_builder{
+			EventLog: challenge.GetAttestationNonce(),
+		}.Build(),
+	}.Build(), nil
 }
 
 func (f *FakeTPMDevice) SignChallenge(_ []byte) (sig []byte, err error) {
@@ -124,7 +124,7 @@ func (f *FakeTPMDevice) SignChallenge(_ []byte) (sig []byte, err error) {
 }
 
 func (f *FakeTPMDevice) GetDeviceCredential() *devicepb.DeviceCredential {
-	return &devicepb.DeviceCredential{
+	return devicepb.DeviceCredential_builder{
 		Id: f.CredentialID,
-	}
+	}.Build()
 }
diff --git a/lib/devicetrust/testenv/testenv.go b/lib/devicetrust/testenv/testenv.go
index f342736340d..8aa0037944f 100644
--- a/lib/devicetrust/testenv/testenv.go
+++ b/lib/devicetrust/testenv/testenv.go
@@ -188,7 +188,7 @@ func CreateEnrolledDevice(deviceID string, d FakeDevice) (*devicepb.Device, *ecd
 
 	var pub *ecdsa.PublicKey
 	if d.GetDeviceOSType() == devicepb.OSType_OS_TYPE_MACOS {
-		pubKey, err := x509.ParsePKIXPublicKey(initReq.Macos.PublicKeyDer)
+		pubKey, err := x509.ParsePKIXPublicKey(initReq.GetMacos().GetPublicKeyDer())
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
 		}
@@ -199,16 +199,16 @@ func CreateEnrolledDevice(deviceID string, d FakeDevice) (*devicepb.Device, *ecd
 		}
 	}
 
-	dev := &devicepb.Device{
+	dev := devicepb.Device_builder{
 		ApiVersion:   "v1",
 		Id:           deviceID,
 		OsType:       d.GetDeviceOSType(),
-		AssetTag:     initReq.DeviceData.SerialNumber,
+		AssetTag:     initReq.GetDeviceData().GetSerialNumber(),
 		CreateTime:   now,
 		UpdateTime:   now,
 		Credential:   d.GetDeviceCredential(),
 		EnrollStatus: devicepb.DeviceEnrollStatus_DEVICE_ENROLL_STATUS_ENROLLED,
-	}
+	}.Build()
 	return dev, pub, nil
 }
 
diff --git a/lib/devicetrust/tpm_attest_proto.go b/lib/devicetrust/tpm_attest_proto.go
index f900e72e8a4..40e4c5889f7 100644
--- a/lib/devicetrust/tpm_attest_proto.go
+++ b/lib/devicetrust/tpm_attest_proto.go
@@ -29,12 +29,12 @@ import (
 // AttestationParametersToProto converts an attest.AttestationParameters to
 // its protobuf representation.
 func AttestationParametersToProto(in attest.AttestationParameters) *devicepb.TPMAttestationParameters {
-	return &devicepb.TPMAttestationParameters{
+	return devicepb.TPMAttestationParameters_builder{
 		Public:            in.Public,
 		CreateData:        in.CreateData,
 		CreateAttestation: in.CreateAttestation,
 		CreateSignature:   in.CreateSignature,
-	}
+	}.Build()
 }
 
 // AttestationParametersFromProto extracts an attest.AttestationParameters from
@@ -44,10 +44,10 @@ func AttestationParametersFromProto(in *devicepb.TPMAttestationParameters) attes
 		return attest.AttestationParameters{}
 	}
 	return attest.AttestationParameters{
-		Public:            in.Public,
-		CreateData:        in.CreateData,
-		CreateAttestation: in.CreateAttestation,
-		CreateSignature:   in.CreateSignature,
+		Public:            in.GetPublic(),
+		CreateData:        in.GetCreateData(),
+		CreateAttestation: in.GetCreateAttestation(),
+		CreateSignature:   in.GetCreateSignature(),
 	}
 }
 
@@ -57,10 +57,10 @@ func EncryptedCredentialToProto(in *attest.EncryptedCredential) *devicepb.TPMEnc
 	if in == nil {
 		return nil
 	}
-	return &devicepb.TPMEncryptedCredential{
+	return devicepb.TPMEncryptedCredential_builder{
 		CredentialBlob: in.Credential,
 		Secret:         in.Secret,
-	}
+	}.Build()
 }
 
 // EncryptedCredentialFromProto extracts an attest.EncryptedCredential from
@@ -70,8 +70,8 @@ func EncryptedCredentialFromProto(in *devicepb.TPMEncryptedCredential) *attest.E
 		return nil
 	}
 	return &attest.EncryptedCredential{
-		Credential: in.CredentialBlob,
-		Secret:     in.Secret,
+		Credential: in.GetCredentialBlob(),
+		Secret:     in.GetSecret(),
 	}
 }
 
@@ -81,11 +81,11 @@ func PlatformParametersToProto(in *attest.PlatformParameters) *devicepb.TPMPlatf
 	if in == nil {
 		return nil
 	}
-	return &devicepb.TPMPlatformParameters{
+	return devicepb.TPMPlatformParameters_builder{
 		EventLog: in.EventLog,
 		Quotes:   quotesToProto(in.Quotes),
 		Pcrs:     pcrsToProto(in.PCRs),
-	}
+	}.Build()
 }
 
 // PlatformParametersFromProto extracts an attest.PlatformParameters from
@@ -95,9 +95,9 @@ func PlatformParametersFromProto(in *devicepb.TPMPlatformParameters) *attest.Pla
 		return nil
 	}
 	return &attest.PlatformParameters{
-		Quotes:   quotesFromProto(in.Quotes),
-		PCRs:     pcrsFromProto(in.Pcrs),
-		EventLog: in.EventLog,
+		Quotes:   quotesFromProto(in.GetQuotes()),
+		PCRs:     pcrsFromProto(in.GetPcrs()),
+		EventLog: in.GetEventLog(),
 	}
 }
 
@@ -108,10 +108,10 @@ func PlatformAttestationToProto(in *attest.PlatformParameters, nonce []byte) *de
 		return nil
 	}
 	platParams := PlatformParametersToProto(in)
-	return &devicepb.TPMPlatformAttestation{
+	return devicepb.TPMPlatformAttestation_builder{
 		PlatformParameters: platParams,
 		Nonce:              nonce,
-	}
+	}.Build()
 }
 
 // PlatformAttestationFromProto extracts a attest.PlatformParameters and nonce
@@ -120,16 +120,16 @@ func PlatformAttestationFromProto(in *devicepb.TPMPlatformAttestation) (platPara
 	if in == nil {
 		return nil, nil
 	}
-	return PlatformParametersFromProto(in.PlatformParameters), in.Nonce
+	return PlatformParametersFromProto(in.GetPlatformParameters()), in.GetNonce()
 }
 
 func quotesToProto(in []attest.Quote) []*devicepb.TPMQuote {
 	out := make([]*devicepb.TPMQuote, len(in))
 	for i, q := range in {
-		out[i] = &devicepb.TPMQuote{
+		out[i] = devicepb.TPMQuote_builder{
 			Quote:     q.Quote,
 			Signature: q.Signature,
-		}
+		}.Build()
 	}
 	return out
 }
@@ -138,8 +138,8 @@ func quotesFromProto(in []*devicepb.TPMQuote) []attest.Quote {
 	out := make([]attest.Quote, len(in))
 	for i, q := range in {
 		out[i] = attest.Quote{
-			Quote:     q.Quote,
-			Signature: q.Signature,
+			Quote:     q.GetQuote(),
+			Signature: q.GetSignature(),
 		}
 	}
 	return out
@@ -148,11 +148,11 @@ func quotesFromProto(in []*devicepb.TPMQuote) []attest.Quote {
 func pcrsToProto(in []attest.PCR) []*devicepb.TPMPCR {
 	out := make([]*devicepb.TPMPCR, len(in))
 	for i, pcr := range in {
-		out[i] = &devicepb.TPMPCR{
+		out[i] = devicepb.TPMPCR_builder{
 			Index:     int32(pcr.Index),
 			Digest:    pcr.Digest,
 			DigestAlg: uint64(pcr.DigestAlg),
-		}
+		}.Build()
 	}
 	return out
 }
@@ -161,9 +161,9 @@ func pcrsFromProto(in []*devicepb.TPMPCR) []attest.PCR {
 	out := make([]attest.PCR, len(in))
 	for i, pcr := range in {
 		out[i] = attest.PCR{
-			Index:     int(pcr.Index),
-			Digest:    pcr.Digest,
-			DigestAlg: crypto.Hash(pcr.DigestAlg),
+			Index:     int(pcr.GetIndex()),
+			Digest:    pcr.GetDigest(),
+			DigestAlg: crypto.Hash(pcr.GetDigestAlg()),
 		}
 	}
 	return out
diff --git a/lib/events/athena/querier.go b/lib/events/athena/querier.go
index 41c08eef4b4..252bd1e2318 100644
--- a/lib/events/athena/querier.go
+++ b/lib/events/athena/querier.go
@@ -229,12 +229,12 @@ func (q *querier) SearchEvents(ctx context.Context, req events.SearchEventsReque
 // ExportUnstructuredEvents exports events from a given event chunk returned by GetEventExportChunks. This API prioritizes
 // performance over ordering and filtering, and is intended for bulk export of events.
 func (q *querier) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured] {
-	startTime := req.Date.AsTime()
+	startTime := req.GetDate().AsTime()
 	if startTime.IsZero() {
 		return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.BadParameter("missing required parameter 'date'"))
 	}
 
-	if req.Chunk == "" {
+	if req.GetChunk() == "" {
 		return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.BadParameter("missing required parameter 'chunk'"))
 	}
 
@@ -242,13 +242,13 @@ func (q *querier) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.
 
 	var cursor athenaExportCursor
 
-	if req.Cursor != "" {
-		if err := cursor.Decode(req.Cursor); err != nil {
+	if req.GetCursor() != "" {
+		if err := cursor.Decode(req.GetCursor()); err != nil {
 			return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.Wrap(err))
 		}
 	}
 
-	evts := q.streamEventsFromChunk(ctx, date, req.Chunk)
+	evts := q.streamEventsFromChunk(ctx, date, req.GetChunk())
 
 	evts = stream.Skip(evts, int(cursor.pos))
 
@@ -259,7 +259,7 @@ func (q *querier) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.
 			q.logger.WarnContext(ctx, "skipping export of audit event due to failed decoding",
 				"error", err,
 				"date", date,
-				"chunk", req.Chunk,
+				"chunk", req.GetChunk(),
 				"pos", cursor.pos,
 			)
 			return nil, false
@@ -270,17 +270,17 @@ func (q *querier) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.
 			q.logger.WarnContext(ctx, "skipping export of audit event due to failed conversion to unstructured event",
 				"error", err,
 				"date", date,
-				"chunk", req.Chunk,
+				"chunk", req.GetChunk(),
 				"pos", cursor.pos,
 			)
 
 			return nil, false
 		}
 
-		return &auditlogpb.ExportEventUnstructured{
+		return auditlogpb.ExportEventUnstructured_builder{
 			Event:  unstructuredEvent,
 			Cursor: cursor.Encode(),
-		}, true
+		}.Build(), true
 	})
 }
 
@@ -312,7 +312,7 @@ func (c *athenaExportCursor) Decode(key string) error {
 // GetEventExportChunks returns a stream of event chunks that can be exported via ExportUnstructuredEvents. The returned
 // list isn't ordered and polling for new chunks requires re-consuming the entire stream from the beginning.
 func (q *querier) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetEventExportChunksRequest) stream.Stream[*auditlogpb.EventExportChunk] {
-	dt := req.Date.AsTime()
+	dt := req.GetDate().AsTime()
 	if dt.IsZero() {
 		return stream.Fail[*auditlogpb.EventExportChunk](trace.BadParameter("missing required parameter 'date'"))
 	}
@@ -378,9 +378,9 @@ func (q *querier) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetE
 				continue
 			}
 
-			chunks = append(chunks, &auditlogpb.EventExportChunk{
+			chunks = append(chunks, auditlogpb.EventExportChunk_builder{
 				Chunk: chunkID,
-			})
+			}.Build())
 		}
 
 		return chunks, nil
diff --git a/lib/events/auditlog.go b/lib/events/auditlog.go
index 6f6a2064e78..eb41108fc7f 100644
--- a/lib/events/auditlog.go
+++ b/lib/events/auditlog.go
@@ -532,7 +532,7 @@ func (l *AuditLog) SearchUnstructuredEvents(ctx context.Context, req SearchEvent
 }
 
 func (l *AuditLog) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured] {
-	l.log.DebugContext(ctx, "ExportUnstructuredEvents", "date", req.Date, "chunk", req.Chunk, "cursor", req.Cursor)
+	l.log.DebugContext(ctx, "ExportUnstructuredEvents", "date", req.GetDate(), "chunk", req.GetChunk(), "cursor", req.GetCursor())
 	if l.ExternalLog != nil {
 		return l.ExternalLog.ExportUnstructuredEvents(ctx, req)
 	}
@@ -540,7 +540,7 @@ func (l *AuditLog) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb
 }
 
 func (l *AuditLog) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetEventExportChunksRequest) stream.Stream[*auditlogpb.EventExportChunk] {
-	l.log.DebugContext(ctx, "GetEventExportChunks", "date", req.Date)
+	l.log.DebugContext(ctx, "GetEventExportChunks", "date", req.GetDate())
 	if l.ExternalLog != nil {
 		return l.ExternalLog.GetEventExportChunks(ctx, req)
 	}
diff --git a/lib/events/dynamic.go b/lib/events/dynamic.go
index f60d0d9b769..c075fa9bcd6 100644
--- a/lib/events/dynamic.go
+++ b/lib/events/dynamic.go
@@ -739,13 +739,13 @@ func EventFieldsToUnstructured(evt EventFields) (*auditlogpb.EventUnstructured,
 
 	id := getOrComputeEventID(evt)
 
-	return &auditlogpb.EventUnstructured{
+	return auditlogpb.EventUnstructured_builder{
 		Type:         evt.GetType(),
 		Index:        int64(evt.GetInt(EventIndex)),
 		Time:         timestamppb.New(evt.GetTime(EventTime)),
 		Id:           id,
 		Unstructured: str,
-	}, nil
+	}.Build(), nil
 }
 
 // getOrComputeEventID computes the ID of the event. If the event already has an ID, it is returned.
diff --git a/lib/events/export/date_exporter.go b/lib/events/export/date_exporter.go
index fe288792d9e..61336ed8c34 100644
--- a/lib/events/export/date_exporter.go
+++ b/lib/events/export/date_exporter.go
@@ -362,9 +362,9 @@ func (e *DateExporter) fetchAndProcessChunks(ctx context.Context) (int, error) {
 	// and/or how many complete export cycles have been performed.
 	defer e.waitForInflightChunks()
 
-	chunks := e.cfg.Client.GetEventExportChunks(ctx, &auditlogpb.GetEventExportChunksRequest{
+	chunks := e.cfg.Client.GetEventExportChunks(ctx, auditlogpb.GetEventExportChunksRequest_builder{
 		Date: timestamppb.New(e.cfg.Date),
-	})
+	}.Build())
 
 	var newChunks int
 
@@ -372,7 +372,7 @@ func (e *DateExporter) fetchAndProcessChunks(ctx context.Context) (int, error) {
 		// known chunks should be skipped
 		var skip bool
 		e.withLock(func() {
-			if _, ok := e.chunks[chunks.Item().Chunk]; ok {
+			if _, ok := e.chunks[chunks.Item().GetChunk()]; ok {
 				skip = true
 				return
 			}
@@ -385,7 +385,7 @@ func (e *DateExporter) fetchAndProcessChunks(ctx context.Context) (int, error) {
 			continue
 		}
 
-		if ok := e.startProcessingChunk(ctx, chunks.Item().Chunk, "" /* cursor */); !ok {
+		if ok := e.startProcessingChunk(ctx, chunks.Item().GetChunk(), "" /* cursor */); !ok {
 			return newChunks, trace.Wrap(ctx.Err())
 		}
 
@@ -440,11 +440,11 @@ func (e *DateExporter) processChunk(ctx context.Context, chunk string, entry *ch
 Outer:
 	for {
 
-		events := e.cfg.Client.ExportUnstructuredEvents(ctx, &auditlogpb.ExportUnstructuredEventsRequest{
+		events := e.cfg.Client.ExportUnstructuredEvents(ctx, auditlogpb.ExportUnstructuredEventsRequest_builder{
 			Date:   timestamppb.New(e.cfg.Date),
 			Chunk:  chunk,
 			Cursor: entry.getCursor(),
-		})
+		}.Build())
 
 		var err error
 		if e.cfg.Export != nil {
@@ -596,7 +596,7 @@ func (e *DateExporter) exportEvents(ctx context.Context, events stream.Stream[*a
 			return trace.Wrap(err)
 		}
 
-		entry.setCursor(events.Item().Cursor)
+		entry.setCursor(events.Item().GetCursor())
 	}
 	return trace.Wrap(events.Done())
 }
diff --git a/lib/events/export/date_exporter_test.go b/lib/events/export/date_exporter_test.go
index 738d14307aa..337c04ba51a 100644
--- a/lib/events/export/date_exporter_test.go
+++ b/lib/events/export/date_exporter_test.go
@@ -377,10 +377,10 @@ func makeEventChunk(t *testing.T, ts time.Time, n int) ([]*auditlogpb.ExportEven
 
 		event, err := apievents.ToUnstructured(&baseEvent)
 		require.NoError(t, err)
-		chunk = append(chunk, &auditlogpb.ExportEventUnstructured{
+		chunk = append(chunk, auditlogpb.ExportEventUnstructured_builder{
 			Event:  event,
 			Cursor: strconv.Itoa(i + 1),
-		})
+		}.Build())
 		batchedEvents = append(batchedEvents, event)
 	}
 
@@ -417,22 +417,22 @@ func (c *fakeClient) addChunk(date string, chunk string, events []*auditlogpb.Ex
 func (c *fakeClient) ExportUnstructuredEvents(ctx context.Context, req *auditlogpb.ExportUnstructuredEventsRequest) stream.Stream[*auditlogpb.ExportEventUnstructured] {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	chunks, ok := c.data[req.Date.AsTime().Format(time.DateOnly)]
+	chunks, ok := c.data[req.GetDate().AsTime().Format(time.DateOnly)]
 	if !ok {
 		return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.NotFound("date not found"))
 	}
 
-	chunk, ok := chunks[req.Chunk]
+	chunk, ok := chunks[req.GetChunk()]
 	if !ok {
 		return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.NotFound("chunk not found"))
 	}
 
 	var cursor int
-	if req.Cursor != "" {
+	if req.GetCursor() != "" {
 		var err error
-		cursor, err = strconv.Atoi(req.Cursor)
+		cursor, err = strconv.Atoi(req.GetCursor())
 		if err != nil {
-			return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.BadParameter("invalid cursor %q", req.Cursor))
+			return stream.Fail[*auditlogpb.ExportEventUnstructured](trace.BadParameter("invalid cursor %q", req.GetCursor()))
 		}
 	}
 
@@ -457,16 +457,16 @@ func (c *fakeClient) ExportUnstructuredEvents(ctx context.Context, req *auditlog
 func (c *fakeClient) GetEventExportChunks(ctx context.Context, req *auditlogpb.GetEventExportChunksRequest) stream.Stream[*auditlogpb.EventExportChunk] {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	chunks, ok := c.data[req.Date.AsTime().Format(time.DateOnly)]
+	chunks, ok := c.data[req.GetDate().AsTime().Format(time.DateOnly)]
 	if !ok {
 		return stream.Empty[*auditlogpb.EventExportChunk]()
 	}
 
 	var eec []*auditlogpb.EventExportChunk
 	for name := range chunks {
-		eec = append(eec, &auditlogpb.EventExportChunk{
+		eec = append(eec, auditlogpb.EventExportChunk_builder{
 			Chunk: name,
-		})
+		}.Build())
 	}
 
 	// randomly truncate the chunk list and append an error to simulate flake. we target a 50% failure rate
diff --git a/lib/events/test/suite.go b/lib/events/test/suite.go
index 9e7ef4e6928..7b7699502b2 100644
--- a/lib/events/test/suite.go
+++ b/lib/events/test/suite.go
@@ -182,9 +182,9 @@ func (s *EventsSuite) EventExport(t *testing.T) {
 	baseTime := time.Now().UTC()
 
 	// initial state should contain no chunks
-	chunks := s.Log.GetEventExportChunks(ctx, &auditlogpb.GetEventExportChunksRequest{
+	chunks := s.Log.GetEventExportChunks(ctx, auditlogpb.GetEventExportChunksRequest_builder{
 		Date: timestamppb.New(baseTime),
-	})
+	}.Build())
 
 	require.False(t, chunks.Next())
 	require.NoError(t, chunks.Done())
@@ -208,19 +208,19 @@ func (s *EventsSuite) EventExport(t *testing.T) {
 
 	// wait for the events to be processed
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		chunks := s.Log.GetEventExportChunks(ctx, &auditlogpb.GetEventExportChunksRequest{
+		chunks := s.Log.GetEventExportChunks(ctx, auditlogpb.GetEventExportChunksRequest_builder{
 			Date: timestamppb.New(baseTime),
-		})
+		}.Build())
 
 		var chunkCount, eventCount int
 
 		for chunks.Next() {
 			chunkCount++
 
-			events := s.Log.ExportUnstructuredEvents(ctx, &auditlogpb.ExportUnstructuredEventsRequest{
+			events := s.Log.ExportUnstructuredEvents(ctx, auditlogpb.ExportUnstructuredEventsRequest_builder{
 				Date:  timestamppb.New(baseTime),
-				Chunk: chunks.Item().Chunk,
-			})
+				Chunk: chunks.Item().GetChunk(),
+			}.Build())
 
 			for events.Next() {
 				eventCount++
@@ -251,19 +251,19 @@ func (s *EventsSuite) EventExport(t *testing.T) {
 
 	// wait for the events to be processed
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		chunks := s.Log.GetEventExportChunks(ctx, &auditlogpb.GetEventExportChunksRequest{
+		chunks := s.Log.GetEventExportChunks(ctx, auditlogpb.GetEventExportChunksRequest_builder{
 			Date: timestamppb.New(baseTime),
-		})
+		}.Build())
 
 		var chunkCount, eventCount int
 
 		for chunks.Next() {
 			chunkCount++
 
-			events := s.Log.ExportUnstructuredEvents(ctx, &auditlogpb.ExportUnstructuredEventsRequest{
+			events := s.Log.ExportUnstructuredEvents(ctx, auditlogpb.ExportUnstructuredEventsRequest_builder{
 				Date:  timestamppb.New(baseTime),
-				Chunk: chunks.Item().Chunk,
-			})
+				Chunk: chunks.Item().GetChunk(),
+			}.Build())
 
 			for events.Next() {
 				eventCount++
@@ -278,18 +278,18 @@ func (s *EventsSuite) EventExport(t *testing.T) {
 	}, 30*time.Second, 500*time.Millisecond)
 
 	// generate a random chunk and verify that it is not found
-	events := s.Log.ExportUnstructuredEvents(ctx, &auditlogpb.ExportUnstructuredEventsRequest{
+	events := s.Log.ExportUnstructuredEvents(ctx, auditlogpb.ExportUnstructuredEventsRequest_builder{
 		Date:  timestamppb.New(baseTime),
 		Chunk: uuid.New().String(),
-	})
+	}.Build())
 
 	require.False(t, events.Next())
 	require.True(t, trace.IsNotFound(events.Done()))
 
 	// try a different day and verify that no chunks are found
-	chunks = s.Log.GetEventExportChunks(ctx, &auditlogpb.GetEventExportChunksRequest{
+	chunks = s.Log.GetEventExportChunks(ctx, auditlogpb.GetEventExportChunksRequest_builder{
 		Date: timestamppb.New(baseTime.AddDate(0, 0, 1)),
-	})
+	}.Build())
 
 	require.False(t, chunks.Next())
 
diff --git a/lib/hardwarekey/agent.go b/lib/hardwarekey/agent.go
index de2561f0196..f6596a57fb8 100644
--- a/lib/hardwarekey/agent.go
+++ b/lib/hardwarekey/agent.go
@@ -141,7 +141,7 @@ func newAgentListener(ctx context.Context, keyAgentDir string) (net.Listener, er
 	if err == nil {
 		pong, err := client.Ping(ctx, &hardwarekeyagentv1.PingRequest{})
 		if err == nil {
-			return nil, trace.AlreadyExists("another agent instance is already running; PID: %d", pong.Pid)
+			return nil, trace.AlreadyExists("another agent instance is already running; PID: %d", pong.GetPid())
 		}
 	}
 
diff --git a/lib/healthcheck/config.go b/lib/healthcheck/config.go
index 25953794ed1..96d054b9123 100644
--- a/lib/healthcheck/config.go
+++ b/lib/healthcheck/config.go
@@ -54,7 +54,7 @@ func newHealthCheckConfig(cfg *healthcheckconfigv1.HealthCheckConfig) *healthChe
 		interval:                cmp.Or(spec.GetInterval().AsDuration(), defaults.HealthCheckInterval),
 		healthyThreshold:        cmp.Or(spec.GetHealthyThreshold(), defaults.HealthCheckHealthyThreshold),
 		unhealthyThreshold:      cmp.Or(spec.GetUnhealthyThreshold(), defaults.HealthCheckUnhealthyThreshold),
-		disabled:                match.Disabled,
+		disabled:                match.GetDisabled(),
 		databaseLabelMatchers:   newLabelMatchers(match.GetDbLabelsExpression(), match.GetDbLabels()),
 		kubernetesLabelMatchers: newLabelMatchers(match.GetKubernetesLabelsExpression(), match.GetKubernetesLabels()),
 	}
diff --git a/lib/healthcheck/config_test.go b/lib/healthcheck/config_test.go
index 2c083545675..9de545caa8c 100644
--- a/lib/healthcheck/config_test.go
+++ b/lib/healthcheck/config_test.go
@@ -37,36 +37,36 @@ func Test_newHealthCheckConfig(t *testing.T) {
 	t.Parallel()
 	fullCfg, err := healthcheckconfig.NewHealthCheckConfig(
 		"full",
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
 				Disabled: true,
-				DbLabels: []*labelv1.Label{{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   "foo",
 					Values: []string{"bar", "baz"},
-				}},
+				}.Build()},
 				DbLabelsExpression: `labels["qux"] == "*"`,
-				KubernetesLabels: []*labelv1.Label{{
+				KubernetesLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   "app",
 					Values: []string{"web", "api"},
-				}},
+				}.Build()},
 				KubernetesLabelsExpression: `labels["lux"] == "*"`,
-			},
+			}.Build(),
 			Timeout:            durationpb.New(time.Second * 42),
 			Interval:           durationpb.New(time.Second * 43),
 			HealthyThreshold:   7,
 			UnhealthyThreshold: 8,
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 
 	minimalCfg, err := healthcheckconfig.NewHealthCheckConfig(
 		"minimal",
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
 				DbLabelsExpression:         `labels["*"] == "*"`,
 				KubernetesLabelsExpression: `labels["*"] == "*"`,
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 
diff --git a/lib/healthcheck/manager_test.go b/lib/healthcheck/manager_test.go
index 66ab3853acf..0c621f91ec9 100644
--- a/lib/healthcheck/manager_test.go
+++ b/lib/healthcheck/manager_test.go
@@ -131,7 +131,7 @@ func TestManager(t *testing.T) {
 
 	// create a health check config that only matches prod databases
 	prodHCC := healthCheckConfigFixture(t, "prod")
-	prodHCC.Spec.Match.DbLabelsExpression = `labels.env == "prod"`
+	prodHCC.GetSpec().GetMatch().SetDbLabelsExpression(`labels.env == "prod"`)
 	_, err = healthConfigSvc.CreateHealthCheckConfig(ctx, prodHCC)
 	require.NoError(t, err)
 
@@ -293,7 +293,7 @@ func TestManager(t *testing.T) {
 	// enable dev health checks for dev db and simulate an unhealthy endpoint on init
 	devDialer.deny()
 	devHCC := healthCheckConfigFixture(t, "dev")
-	devHCC.Spec.Match.DbLabelsExpression = `labels.env == "dev"`
+	devHCC.GetSpec().GetMatch().SetDbLabelsExpression(`labels.env == "dev"`)
 	devHCC, err = healthConfigSvc.CreateHealthCheckConfig(ctx, devHCC)
 	require.NoError(t, err)
 
@@ -322,7 +322,7 @@ func TestManager(t *testing.T) {
 
 	// set the unhealthy threshold high for dev, so we can simulate several
 	// failing checks after dev becomes healthy without making it become unhealthy
-	devHCC.Spec.UnhealthyThreshold = 10
+	devHCC.GetSpec().SetUnhealthyThreshold(10)
 	devHCC, err = healthConfigSvc.UpsertHealthCheckConfig(ctx, devHCC)
 	require.NoError(t, err)
 	awaitTestEvents(t, eventsCh, nil,
@@ -374,8 +374,8 @@ func TestManager(t *testing.T) {
 		denyAll(prodDB.GetName()),
 	)
 	requireTargetHealth(t, mgr, devDB, types.TargetHealthStatusHealthy, types.TargetHealthTransitionReasonThreshold)
-	devHCC.Spec.UnhealthyThreshold = 1
-	devHCC.Spec.Interval = durationpb.New(time.Second * 100)
+	devHCC.GetSpec().SetUnhealthyThreshold(1)
+	devHCC.GetSpec().SetInterval(durationpb.New(time.Second * 100))
 	_, err = healthConfigSvc.UpdateHealthCheckConfig(ctx, devHCC)
 	require.NoError(t, err)
 	awaitTestEvents(t, eventsCh, nil,
@@ -525,8 +525,8 @@ func TestManager_VirtualDefaults(t *testing.T) {
 			virtualDefault, err := healthConfigSvc.GetHealthCheckConfig(ctx, tt.virtualDefaultName)
 			require.NoError(t, err)
 			modifiedUnhealthyThreshold := uint32(3)
-			virtualDefault.Spec.UnhealthyThreshold = modifiedUnhealthyThreshold
-			virtualDefault.Spec.Match.Disabled = true
+			virtualDefault.GetSpec().SetUnhealthyThreshold(modifiedUnhealthyThreshold)
+			virtualDefault.GetSpec().GetMatch().SetDisabled(true)
 
 			// save modified virtual default to the backend
 			_, err = healthConfigSvc.CreateHealthCheckConfig(ctx, virtualDefault)
@@ -552,9 +552,9 @@ func TestManager_VirtualDefaults(t *testing.T) {
 			// expect original default values
 			afterDelete, err := healthConfigSvc.GetHealthCheckConfig(ctx, tt.virtualDefaultName)
 			require.NoError(t, err)
-			require.False(t, afterDelete.Spec.Match.Disabled,
+			require.False(t, afterDelete.GetSpec().GetMatch().GetDisabled(),
 				"expecting virtual default to revert enabled state")
-			require.NotEqual(t, modifiedUnhealthyThreshold, afterDelete.Spec.UnhealthyThreshold,
+			require.NotEqual(t, modifiedUnhealthyThreshold, afterDelete.GetSpec().GetUnhealthyThreshold(),
 				"expecting virtual default should revert to original unhealthy threshold")
 			awaitTestEvents(t, eventsCh, clock,
 				advanceCount(int(apidefaults.HealthCheckHealthyThreshold)),
@@ -567,7 +567,7 @@ func TestManager_VirtualDefaults(t *testing.T) {
 			// disable to stop checking health
 			virtualDefault, err = healthConfigSvc.GetHealthCheckConfig(ctx, tt.virtualDefaultName)
 			require.NoError(t, err)
-			virtualDefault.Spec.Match.Disabled = true
+			virtualDefault.GetSpec().GetMatch().SetDisabled(true)
 			_, err = healthConfigSvc.UpdateHealthCheckConfig(ctx, virtualDefault)
 			require.NoError(t, err)
 			awaitTestEvents(t, eventsCh, nil,
@@ -578,7 +578,7 @@ func TestManager_VirtualDefaults(t *testing.T) {
 				types.TargetHealthTransitionReasonDisabled)
 
 			// re-enabling config matcher starts health checks
-			virtualDefault.Spec.Match.Disabled = false
+			virtualDefault.GetSpec().GetMatch().SetDisabled(false)
 			_, err = healthConfigSvc.UpdateHealthCheckConfig(ctx, virtualDefault)
 			require.NoError(t, err)
 
@@ -606,18 +606,18 @@ func requireTargetHealth(t *testing.T, mgr Manager, r types.ResourceWithLabels,
 func healthCheckConfigFixture(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	out, err := healthcheckconfig.NewHealthCheckConfig(name,
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
-				DbLabels: []*labelv1.Label{{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   types.Wildcard,
 					Values: []string{types.Wildcard},
-				}},
-			},
+				}.Build()},
+			}.Build(),
 			Interval:           durationpb.New(apidefaults.HealthCheckInterval),
 			Timeout:            durationpb.New(apidefaults.HealthCheckTimeout),
 			HealthyThreshold:   2,
 			UnhealthyThreshold: 2,
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 	return out
@@ -826,7 +826,7 @@ func disableVirtualHealthCheckDefaults(t *testing.T, ctx context.Context, svc *l
 	for _, name := range virtualDefaults {
 		cfg, err := svc.GetHealthCheckConfig(ctx, name)
 		require.NoError(t, err)
-		cfg.Spec.Match.Disabled = true
+		cfg.GetSpec().GetMatch().SetDisabled(true)
 		_, err = svc.UpdateHealthCheckConfig(ctx, cfg)
 		require.NoError(t, err)
 	}
diff --git a/lib/integrations/awsra/list_rolesanywhere_profiles.go b/lib/integrations/awsra/list_rolesanywhere_profiles.go
index 9da6d115066..a430e244753 100644
--- a/lib/integrations/awsra/list_rolesanywhere_profiles.go
+++ b/lib/integrations/awsra/list_rolesanywhere_profiles.go
@@ -186,14 +186,14 @@ func convertRolesAnywhereProfilePageToProto(ctx context.Context, profilesListRes
 			labels[aws.ToString(tag.Key)] = aws.ToString(tag.Value)
 		}
 
-		ret = append(ret, &integrationv1.RolesAnywhereProfile{
+		ret = append(ret, integrationv1.RolesAnywhereProfile_builder{
 			Arn:                   aws.ToString(profile.ProfileArn),
 			Name:                  aws.ToString(profile.Name),
 			Enabled:               aws.ToBool(profile.Enabled),
 			AcceptRoleSessionName: aws.ToBool(profile.AcceptRoleSessionName),
 			Roles:                 profile.RoleArns,
 			Tags:                  labels,
-		})
+		}.Build())
 	}
 
 	return ret, nil
diff --git a/lib/integrations/awsra/list_rolesanywhere_profiles_test.go b/lib/integrations/awsra/list_rolesanywhere_profiles_test.go
index 534686e961e..0fbd309d7f2 100644
--- a/lib/integrations/awsra/list_rolesanywhere_profiles_test.go
+++ b/lib/integrations/awsra/list_rolesanywhere_profiles_test.go
@@ -105,7 +105,7 @@ func TestListRolesAnywhereProfilesPage(t *testing.T) {
 			},
 			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
 				require.Len(t, page, 1)
-				require.Equal(t, "ExampleProfile", page[0].Name)
+				require.Equal(t, "ExampleProfile", page[0].GetName())
 			},
 			expectedErrCheck: require.NoError,
 		},
@@ -128,8 +128,8 @@ func TestListRolesAnywhereProfilesPage(t *testing.T) {
 			expectedResp: func(t *testing.T, page []*integrationv1.RolesAnywhereProfile) {
 				require.Len(t, page, 3)
 				profile := page[0]
-				require.NotEmpty(t, profile.Arn)
-				require.Contains(t, profile.Name, "TeamB-subteam")
+				require.NotEmpty(t, profile.GetArn())
+				require.Contains(t, profile.GetName(), "TeamB-subteam")
 			},
 			expectedErrCheck: require.NoError,
 		},
@@ -159,7 +159,7 @@ func TestListRolesAnywhereProfilesPage(t *testing.T) {
 				require.Len(t, page, 6)
 				profileNames := make([]string, 0, len(page))
 				for _, profile := range page {
-					profileNames = append(profileNames, profile.Name)
+					profileNames = append(profileNames, profile.GetName())
 				}
 				require.Contains(t, profileNames, "TeamA-subteam1")
 			},
@@ -186,11 +186,11 @@ func TestListRolesAnywhereProfilesPage(t *testing.T) {
 					cmpopts.IgnoreUnexported(integrationv1.RolesAnywhereProfile{}),
 				}
 				require.Empty(t, cmp.Diff(page, []*integrationv1.RolesAnywhereProfile{
-					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id2", Name: "TeamA-subteam2", Tags: make(map[string]string)},
-					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id3", Name: "TeamA-subteam3", Tags: make(map[string]string)},
-					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id4", Name: "TeamB-subteam1", Tags: make(map[string]string)},
-					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id5", Name: "TeamB-subteam2", Tags: make(map[string]string)},
-					{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id6", Name: "TeamB-subteam3", Tags: make(map[string]string)},
+					integrationv1.RolesAnywhereProfile_builder{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id2", Name: "TeamA-subteam2", Tags: make(map[string]string)}.Build(),
+					integrationv1.RolesAnywhereProfile_builder{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id3", Name: "TeamA-subteam3", Tags: make(map[string]string)}.Build(),
+					integrationv1.RolesAnywhereProfile_builder{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id4", Name: "TeamB-subteam1", Tags: make(map[string]string)}.Build(),
+					integrationv1.RolesAnywhereProfile_builder{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id5", Name: "TeamB-subteam2", Tags: make(map[string]string)}.Build(),
+					integrationv1.RolesAnywhereProfile_builder{Arn: "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/id6", Name: "TeamB-subteam3", Tags: make(map[string]string)}.Build(),
 				}, cmpOpts...))
 			},
 			expectedErrCheck: require.NoError,
diff --git a/lib/integrations/awsra/ping.go b/lib/integrations/awsra/ping.go
index 148e6a6cd00..bd0910ef304 100644
--- a/lib/integrations/awsra/ping.go
+++ b/lib/integrations/awsra/ping.go
@@ -94,7 +94,7 @@ func Ping(ctx context.Context, clt PingClient, ignoredProfileARNs []string) (*Pi
 		}
 		for _, profile := range profiles {
 			// Ignore disabled profiles and profiles without assigned roles.
-			if profile.Enabled && len(profile.Roles) > 0 {
+			if profile.GetEnabled() && len(profile.GetRoles()) > 0 {
 				profileCounter++
 			}
 		}
diff --git a/lib/integrations/awsra/profile_syncer.go b/lib/integrations/awsra/profile_syncer.go
index e67ae50fc63..37e0caa9587 100644
--- a/lib/integrations/awsra/profile_syncer.go
+++ b/lib/integrations/awsra/profile_syncer.go
@@ -473,11 +473,11 @@ func syncProfileForIntegration(ctx context.Context, params AWSRolesAnywhereProfi
 			})
 			if err != nil {
 				if errors.Is(err, errDisabledProfile) {
-					logger.DebugContext(ctx, "Skipping profile", "profile_name", profile.Name, "error", err.Error())
+					logger.DebugContext(ctx, "Skipping profile", "profile_name", profile.GetName(), "error", err.Error())
 					continue
 				}
 
-				logger.WarnContext(ctx, "Failed to process profile", "profile_name", profile.Name, "error", err)
+				logger.WarnContext(ctx, "Failed to process profile", "profile_name", profile.GetName(), "error", err)
 				ret.profileErrors = append(ret.profileErrors, err)
 				continue
 			}
@@ -511,7 +511,7 @@ type processProfileRequest struct {
 }
 
 func processProfile(ctx context.Context, req processProfileRequest) error {
-	if !req.Profile.Enabled {
+	if !req.Profile.GetEnabled() {
 		return errDisabledProfile
 	}
 
@@ -524,14 +524,14 @@ func processProfile(ctx context.Context, req processProfileRequest) error {
 	if existing, ok := req.SeenAppNames[appName]; ok {
 		return trace.BadParameter(
 			"app name %q for profile %q conflicts with profile %q which was upserted first. Rename either profile or set the %q tag on one of them to a unique value.",
-			appName, req.Profile.Name, existing, types.AWSRolesAnywhereProfileNameOverrideLabel)
+			appName, req.Profile.GetName(), existing, types.AWSRolesAnywhereProfileNameOverrideLabel)
 	}
 
 	if _, err := req.Params.AppServerUpserter.UpsertApplicationServer(ctx, appServer); err != nil {
-		return trace.Wrap(err, "failed to upsert application server from profile %q", req.Profile.Name)
+		return trace.Wrap(err, "failed to upsert application server from profile %q", req.Profile.GetName())
 	}
 
-	req.SeenAppNames[appName] = req.Profile.Name
+	req.SeenAppNames[appName] = req.Profile.GetName()
 	return nil
 }
 
@@ -573,15 +573,15 @@ func sanitizeProfileName(name string) string {
 }
 
 func convertProfile(params AWSRolesAnywhereProfileSyncerParams, profile *integrationv1.RolesAnywhereProfile, integrationName string, proxyPublicAddr string) (types.AppServer, error) {
-	parsedProfileARN, err := arn.Parse(profile.Arn)
+	parsedProfileARN, err := arn.Parse(profile.GetArn())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	applicationName := profile.Name
+	applicationName := profile.GetName()
 
-	labels := make(map[string]string, len(profile.Tags))
-	for tagKey, tagValue := range profile.Tags {
+	labels := make(map[string]string, len(profile.GetTags()))
+	for tagKey, tagValue := range profile.GetTags() {
 		labels["aws/"+tagKey] = tagValue
 
 		if tagKey == types.AWSRolesAnywhereProfileNameOverrideLabel {
@@ -596,7 +596,7 @@ func convertProfile(params AWSRolesAnywhereProfileSyncerParams, profile *integra
 	if applicationName == "" {
 		return nil, trace.BadParameter(
 			"profile %q has no DNS-safe characters in its name; set the %q tag to override",
-			profile.Name, types.AWSRolesAnywhereProfileNameOverrideLabel)
+			profile.GetName(), types.AWSRolesAnywhereProfileNameOverrideLabel)
 	}
 	// Append the integration suffix so a tagger with iam:TagResource
 	// on one profile cannot pick a name that collides with another
@@ -607,7 +607,7 @@ func convertProfile(params AWSRolesAnywhereProfileSyncerParams, profile *integra
 	labels[types.AWSAccountIDLabel] = parsedProfileARN.AccountID
 	labels[constants.AWSAccountIDLabel] = parsedProfileARN.AccountID
 	labels[types.IntegrationLabel] = integrationName
-	labels[types.AWSRolesAnywhereProfileARNLabel] = profile.Arn
+	labels[types.AWSRolesAnywhereProfileARNLabel] = profile.GetArn()
 
 	// TODO(marco): add origin label in v19: teleport.dev/origin: integration_awsrolesanywhere
 	// types.Metadata.CheckAndSetDefaults in v17 returns an error if the origin label is set to AWS Roles Anywhere.
@@ -632,8 +632,8 @@ func convertProfile(params AWSRolesAnywhereProfileSyncerParams, profile *integra
 				PublicAddr:  appURL,
 				AWS: &types.AppAWS{
 					RolesAnywhereProfile: &types.AppAWSRolesAnywhereProfile{
-						ProfileARN:            profile.Arn,
-						AcceptRoleSessionName: profile.AcceptRoleSessionName,
+						ProfileARN:            profile.GetArn(),
+						AcceptRoleSessionName: profile.GetAcceptRoleSessionName(),
 					},
 				},
 			},
diff --git a/lib/integrations/awsra/profile_syncer_test.go b/lib/integrations/awsra/profile_syncer_test.go
index eebee2f8db5..1932cce724a 100644
--- a/lib/integrations/awsra/profile_syncer_test.go
+++ b/lib/integrations/awsra/profile_syncer_test.go
@@ -705,12 +705,12 @@ func TestConvertProfile(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			profile := &integrationv1.RolesAnywhereProfile{
+			profile := integrationv1.RolesAnywhereProfile_builder{
 				Name:    tt.profileName,
 				Arn:     "arn:aws:rolesanywhere:eu-west-2:123456789012:profile/uuid1",
 				Enabled: true,
 				Tags:    tt.tags,
-			}
+			}.Build()
 
 			appServer, err := convertProfile(AWSRolesAnywhereProfileSyncerParams{
 				Clock:    clockwork.NewFakeClock(),
diff --git a/lib/inventory/controller.go b/lib/inventory/controller.go
index 6d4c6211b2e..c93b186cab3 100644
--- a/lib/inventory/controller.go
+++ b/lib/inventory/controller.go
@@ -466,7 +466,7 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 		handle.kubeKeepAliveDelay.Stop()
 	}()
 
-	for _, service := range handle.hello.Services {
+	for _, service := range handle.hello.GetServices() {
 		c.serviceCounter.increment(types.SystemRole(service))
 	}
 
@@ -476,7 +476,7 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 		}
 
 		c.instanceHBVariableDuration.Dec()
-		for _, service := range handle.hello.Services {
+		for _, service := range handle.hello.GetServices() {
 			c.serviceCounter.decrement(types.SystemRole(service))
 		}
 		c.store.Remove(handle)
@@ -530,7 +530,7 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 		case msg := <-handle.Recv():
 			switch m := msg.(type) {
 			case *proto.UpstreamInventoryHello:
-				slog.WarnContext(c.closeContext, "Unexpected upstream hello on control stream of server", "server_id", handle.Hello().ServerID)
+				slog.WarnContext(c.closeContext, "Unexpected upstream hello on control stream of server", "server_id", handle.Hello().GetServerID())
 				handle.CloseWithError(trace.BadParameter("unexpected upstream hello"))
 				return
 			case *proto.UpstreamInventoryAgentMetadata:
@@ -542,7 +542,7 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 				// counting the control stream as a registered keepalive stream
 				// for that service.
 
-				if m.SSHServer != nil {
+				if m.HasSSHServer() {
 					// we initialize sshKeepAliveDelay before calling
 					// handleSSHServerHB unlike the other heartbeat types
 					// because handleSSHServerHB needs the delay to reset it
@@ -551,51 +551,51 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 						sshKeepAliveDelay = c.createKeepAliveDelay(c.sshHBVariableDuration)
 					}
 
-					if err := c.handleSSHServerHB(handle, m.SSHServer, sshKeepAliveDelay); err != nil {
+					if err := c.handleSSHServerHB(handle, m.GetSSHServer(), sshKeepAliveDelay); err != nil {
 						handle.CloseWithError(trace.Wrap(err))
 						return
 					}
 				}
 
-				if m.RelayServer != nil {
+				if m.HasRelayServer() {
 					if relayKeepAliveDelay == nil {
 						relayKeepAliveDelay = c.createKeepAliveDelay(c.relayHBVariableDuration)
 					}
 
-					if err := c.handleRelayServerHB(handle, m.RelayServer, relayKeepAliveDelay); err != nil {
+					if err := c.handleRelayServerHB(handle, m.GetRelayServer(), relayKeepAliveDelay); err != nil {
 						handle.CloseWithError(trace.Wrap(err))
 						return
 					}
 				}
 
-				if m.AppServer != nil {
+				if m.HasAppServer() {
 					if handle.appKeepAliveDelay == nil {
 						handle.appKeepAliveDelay = c.createKeepAliveMultiDelay(c.appHBVariableDuration)
 					}
 
-					if err := c.handleAppServerHB(handle, m.AppServer); err != nil {
+					if err := c.handleAppServerHB(handle, m.GetAppServer()); err != nil {
 						handle.CloseWithError(err)
 						return
 					}
 				}
 
-				if m.DatabaseServer != nil {
+				if m.HasDatabaseServer() {
 					if handle.dbKeepAliveDelay == nil {
 						handle.dbKeepAliveDelay = c.createKeepAliveMultiDelay(c.dbHBVariableDuration)
 					}
 
-					if err := c.handleDatabaseServerHB(handle, m.DatabaseServer); err != nil {
+					if err := c.handleDatabaseServerHB(handle, m.GetDatabaseServer()); err != nil {
 						handle.CloseWithError(err)
 						return
 					}
 				}
 
-				if m.KubernetesServer != nil {
+				if m.HasKubernetesServer() {
 					if handle.kubeKeepAliveDelay == nil {
 						handle.kubeKeepAliveDelay = c.createKeepAliveMultiDelay(c.kubeHBVariableDuration)
 					}
 
-					if err := c.handleKubernetesServerHB(handle, m.KubernetesServer); err != nil {
+					if err := c.handleKubernetesServerHB(handle, m.GetKubernetesServer()); err != nil {
 						handle.CloseWithError(err)
 						return
 					}
@@ -606,23 +606,23 @@ func (c *Controller) handleControlStream(handle *upstreamHandle) {
 			case *proto.UpstreamInventoryGoodbye:
 				handle.setGoodbye(m)
 			case *proto.UpstreamInventoryStopHeartbeat:
-				switch m.Kind {
+				switch m.GetKind() {
 				case proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER:
-					if err := c.handleStopDatabaseServerHB(handle, m.Name); err != nil {
+					if err := c.handleStopDatabaseServerHB(handle, m.GetName()); err != nil {
 						handle.CloseWithError(err)
 						return
 					}
 				default:
 					slog.WarnContext(c.closeContext, "Unexpected upstream stop heartbeat kind on control stream",
-						"server_id", handle.Hello().ServerID,
-						"kind", logutils.StringerAttr(m.Kind),
+						"server_id", handle.Hello().GetServerID(),
+						"kind", logutils.StringerAttr(m.GetKind()),
 					)
 				}
 
 			default:
 				slog.WarnContext(c.closeContext, "Unexpected upstream message type on control stream",
 					"message_type", logutils.TypeAttr(m),
-					"server_id", handle.Hello().ServerID,
+					"server_id", handle.Hello().GetServerID(),
 				)
 				handle.CloseWithError(trace.BadParameter("unexpected upstream message type %T", m))
 				return
@@ -728,7 +728,7 @@ func (c *Controller) doResourceCleanup(handle *upstreamHandle) {
 		"dbs", len(handle.databaseServers),
 		"kube", len(handle.kubernetesServers),
 		"relay", handle.relayServer != nil,
-		"server_id", handle.Hello().ServerID,
+		"server_id", handle.Hello().GetServerID(),
 	)
 
 	if handle.relayServer != nil {
@@ -742,17 +742,17 @@ func (c *Controller) doResourceCleanup(handle *upstreamHandle) {
 
 	for _, app := range handle.appServers {
 		if err := c.cleanupLimiter.Wait(cleanupCtx); err != nil {
-			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
+			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().GetServerID(), "error", err)
 			return
 		}
 
 		if err := c.auth.DeleteApplicationServer(cleanupCtx, apidefaults.Namespace, app.resource.GetHostID(), app.resource.GetName()); err != nil && !trace.IsNotFound(err) {
 			if cleanupCtx.Err() != nil {
-				slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
+				slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().GetServerID(), "error", err)
 				return
 			}
 			slog.WarnContext(c.closeContext, "Failed to remove app server on termination",
-				"app_server", handle.Hello().ServerID,
+				"app_server", handle.Hello().GetServerID(),
 				"error", err,
 			)
 		}
@@ -760,17 +760,17 @@ func (c *Controller) doResourceCleanup(handle *upstreamHandle) {
 
 	for _, db := range handle.databaseServers {
 		if err := c.cleanupLimiter.Wait(cleanupCtx); err != nil {
-			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
+			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().GetServerID(), "error", err)
 			return
 		}
 
 		if err := c.auth.DeleteDatabaseServer(cleanupCtx, apidefaults.Namespace, db.resource.GetHostID(), db.resource.GetName()); err != nil && !trace.IsNotFound(err) {
 			if cleanupCtx.Err() != nil {
-				slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
+				slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().GetServerID(), "error", err)
 				return
 			}
 			slog.WarnContext(c.closeContext, "Failed to remove db server on termination",
-				"db_server", handle.Hello().ServerID,
+				"db_server", handle.Hello().GetServerID(),
 				"error", err,
 			)
 		}
@@ -778,18 +778,18 @@ func (c *Controller) doResourceCleanup(handle *upstreamHandle) {
 
 	for _, kube := range handle.kubernetesServers {
 		if err := c.cleanupLimiter.Wait(cleanupCtx); err != nil {
-			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
+			slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().GetServerID(), "error", err)
 			return
 		}
 
 		if err := c.auth.DeleteKubernetesServer(c.closeContext, kube.resource.GetHostID(), kube.resource.GetName()); err != nil && !trace.IsNotFound(err) {
 			if cleanupCtx.Err() != nil {
-				slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().ServerID, "error", err)
+				slog.WarnContext(c.closeContext, "halting remaining resource cleanup", "instance_id", handle.Hello().GetServerID(), "error", err)
 				return
 			}
 
 			slog.WarnContext(c.closeContext, "Failed to remove kube server on termination",
-				"kube_server", handle.Hello().ServerID,
+				"kube_server", handle.Hello().GetServerID(),
 				"error", err,
 			)
 		}
@@ -819,7 +819,7 @@ func (c *Controller) heartbeatInstanceState(handle *upstreamHandle, now time.Tim
 	instance, err := tracker.nextHeartbeat(now, handle.Hello(), c.authID)
 	if err != nil {
 		slog.WarnContext(c.closeContext, "Failed to construct next heartbeat value for instance (this is a bug)",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 		)
 		return trace.Wrap(err)
@@ -835,7 +835,7 @@ func (c *Controller) heartbeatInstanceState(handle *upstreamHandle, now time.Tim
 
 	if err != nil {
 		slog.WarnContext(c.closeContext, "Failed to hb instance",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 		)
 		c.testEvent(instanceHeartbeatErr)
@@ -857,11 +857,11 @@ func (c *Controller) heartbeatInstanceState(handle *upstreamHandle, now time.Tim
 }
 
 func (c *Controller) handlePong(handle *upstreamHandle, msg *proto.UpstreamInventoryPong) {
-	pending, ok := handle.pings[msg.ID]
+	pending, ok := handle.pings[msg.GetID()]
 	if !ok {
 		slog.WarnContext(c.closeContext, "Unexpected upstream pong",
-			"server_id", handle.Hello().ServerID,
-			"pong_id", msg.ID)
+			"server_id", handle.Hello().GetServerID(),
+			"pong_id", msg.GetID())
 		return
 	}
 	now := c.clock.Now()
@@ -880,14 +880,14 @@ func (c *Controller) handlePong(handle *upstreamHandle, msg *proto.UpstreamInven
 	handle.stateTracker.mu.Unlock()
 
 	pending.rspC <- pong
-	delete(handle.pings, msg.ID)
+	delete(handle.pings, msg.GetID())
 	c.testEvent(pongOk)
 }
 
 func (c *Controller) handlePingRequest(handle *upstreamHandle, req pingRequest) error {
-	ping := &proto.DownstreamInventoryPing{
+	ping := proto.DownstreamInventoryPing_builder{
 		ID: req.id,
-	}
+	}.Build()
 	start := c.clock.Now()
 	if err := handle.Send(c.closeContext, ping); err != nil {
 		req.rspC <- pingResponse{
@@ -910,8 +910,8 @@ func (c *Controller) handleSSHServerHB(handle *upstreamHandle, sshServer *types.
 	if !handle.HasService(types.RoleNode) {
 		return trace.AccessDenied("control stream not configured to support ssh server heartbeats")
 	}
-	if sshServer.GetName() != handle.Hello().ServerID {
-		return trace.AccessDenied("incorrect ssh server ID (expected %q, got %q)", handle.Hello().ServerID, sshServer.GetName())
+	if sshServer.GetName() != handle.Hello().GetServerID() {
+		return trace.AccessDenied("incorrect ssh server ID (expected %q, got %q)", handle.Hello().GetServerID(), sshServer.GetName())
 	}
 
 	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
@@ -963,7 +963,7 @@ func (c *Controller) handleSSHServerHB(handle *upstreamHandle, sshServer *types.
 	} else {
 		c.testEvent(sshUpsertErr)
 		slog.WarnContext(c.closeContext, "Failed to announce SSH server",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 		)
 
@@ -996,13 +996,13 @@ func (c *Controller) handleRelayServerHB(handle *upstreamHandle, relayServer *pr
 
 	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
 	// scope to defer to what was found in the identity during the initial hello.
-	if relayServer.Scope == "" {
-		relayServer.Scope = handle.Hello().GetScope()
+	if relayServer.GetScope() == "" {
+		relayServer.SetScope(handle.Hello().GetScope())
 	}
 
 	// When an agent includes a scope in its heartbeat, we enforce that it matches what was found in the hello.
-	if relayServer.Scope != handle.Hello().GetScope() {
-		return trace.AccessDenied("incorrect relay server scope (expected %q, got %q)", handle.Hello().GetScope(), relayServer.Scope)
+	if relayServer.GetScope() != handle.Hello().GetScope() {
+		return trace.AccessDenied("incorrect relay server scope (expected %q, got %q)", handle.Hello().GetScope(), relayServer.GetScope())
 	}
 
 	// TODO(espadolini): check the relay_server for consistency if there's any
@@ -1023,7 +1023,7 @@ func (c *Controller) handleRelayServerHB(handle *upstreamHandle, relayServer *pr
 	handle.relayServer = relayServer
 
 	relayServer = gproto.CloneOf(handle.relayServer)
-	relayServer.GetMetadata().Expires = timestamppb.New(time.Now().Add(c.serverTTL))
+	relayServer.GetMetadata().SetExpires(timestamppb.New(time.Now().Add(c.serverTTL)))
 	if _, err := c.auth.UpsertRelayServer(c.closeContext, relayServer); err == nil {
 		// reset the error status
 		handle.relayServerErrorCount = 0
@@ -1052,8 +1052,8 @@ func (c *Controller) handleAppServerHB(handle *upstreamHandle, appServer *types.
 	if !handle.HasService(types.RoleApp) {
 		return trace.AccessDenied("control stream not configured to support app server heartbeats")
 	}
-	if appServer.GetHostID() != handle.Hello().ServerID {
-		return trace.AccessDenied("incorrect app server ID (expected %q, got %q)", handle.Hello().ServerID, appServer.GetHostID())
+	if appServer.GetHostID() != handle.Hello().GetServerID() {
+		return trace.AccessDenied("incorrect app server ID (expected %q, got %q)", handle.Hello().GetServerID(), appServer.GetHostID())
 	}
 
 	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
@@ -1109,7 +1109,7 @@ func (c *Controller) handleAppServerHB(handle *upstreamHandle, appServer *types.
 	} else {
 		c.testEvent(appUpsertErr)
 		slog.WarnContext(c.closeContext, "Failed to announce app server",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 		)
 
@@ -1135,8 +1135,8 @@ func (c *Controller) handleDatabaseServerHB(handle *upstreamHandle, databaseServ
 	if !handle.HasService(types.RoleDatabase) {
 		return trace.AccessDenied("control stream not configured to support database server heartbeats")
 	}
-	if databaseServer.GetHostID() != handle.Hello().ServerID {
-		return trace.AccessDenied("incorrect database server ID (expected %q, got %q)", handle.Hello().ServerID, databaseServer.GetHostID())
+	if databaseServer.GetHostID() != handle.Hello().GetServerID() {
+		return trace.AccessDenied("incorrect database server ID (expected %q, got %q)", handle.Hello().GetServerID(), databaseServer.GetHostID())
 	}
 
 	// Agent's that don't know about scopes can still have a scoped identity. In that case, we consider an empty
@@ -1180,7 +1180,7 @@ func (c *Controller) handleDatabaseServerHB(handle *upstreamHandle, databaseServ
 	} else {
 		c.testEvent(dbUpsertErr)
 		slog.WarnContext(c.closeContext, "Failed to upsert database server on heartbeat",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 		)
 
@@ -1201,8 +1201,8 @@ func (c *Controller) handleKubernetesServerHB(handle *upstreamHandle, kubernetes
 	if !handle.HasService(types.RoleKube) && !handle.HasService(types.RoleProxy) {
 		return trace.AccessDenied("control stream not configured to support kubernetes server heartbeats")
 	}
-	if kubernetesServer.GetHostID() != handle.Hello().ServerID {
-		return trace.AccessDenied("incorrect kubernetes server ID (expected %q, got %q)", handle.Hello().ServerID, kubernetesServer.GetHostID())
+	if kubernetesServer.GetHostID() != handle.Hello().GetServerID() {
+		return trace.AccessDenied("incorrect kubernetes server ID (expected %q, got %q)", handle.Hello().GetServerID(), kubernetesServer.GetHostID())
 	}
 
 	if kubernetesServer.Scope != handle.Hello().GetScope() {
@@ -1249,7 +1249,7 @@ func (c *Controller) handleKubernetesServerHB(handle *upstreamHandle, kubernetes
 	} else {
 		c.testEvent(kubeUpsertErr)
 		slog.WarnContext(c.closeContext, "Failed to upsert kubernetes server on heartbeat",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 		)
 
@@ -1266,24 +1266,24 @@ func (c *Controller) handleKubernetesServerHB(handle *upstreamHandle, kubernetes
 func (c *Controller) handleAgentMetadata(handle *upstreamHandle, m *proto.UpstreamInventoryAgentMetadata) {
 	handle.setAgentMetadata(m)
 
-	svcs := make([]string, 0, len(handle.Hello().Services))
-	for _, svc := range handle.Hello().Services {
+	svcs := make([]string, 0, len(handle.Hello().GetServices()))
+	for _, svc := range handle.Hello().GetServices() {
 		svcs = append(svcs, strings.ToLower(svc))
 	}
 
 	c.usageReporter.AnonymizeAndSubmit(&usagereporter.AgentMetadataEvent{
-		Version:               handle.Hello().Version,
-		HostId:                handle.Hello().ServerID,
+		Version:               handle.Hello().GetVersion(),
+		HostId:                handle.Hello().GetServerID(),
 		Services:              svcs,
-		Os:                    m.OS,
-		OsVersion:             m.OSVersion,
-		HostArchitecture:      m.HostArchitecture,
-		GlibcVersion:          m.GlibcVersion,
-		InstallMethods:        m.InstallMethods,
-		ContainerRuntime:      m.ContainerRuntime,
-		ContainerOrchestrator: m.ContainerOrchestrator,
-		CloudEnvironment:      m.CloudEnvironment,
-		ExternalUpgrader:      handle.Hello().ExternalUpgrader,
+		Os:                    m.GetOS(),
+		OsVersion:             m.GetOSVersion(),
+		HostArchitecture:      m.GetHostArchitecture(),
+		GlibcVersion:          m.GetGlibcVersion(),
+		InstallMethods:        m.GetInstallMethods(),
+		ContainerRuntime:      m.GetContainerRuntime(),
+		ContainerOrchestrator: m.GetContainerOrchestrator(),
+		CloudEnvironment:      m.GetCloudEnvironment(),
+		ExternalUpgrader:      handle.Hello().GetExternalUpgrader(),
 	})
 }
 
@@ -1319,7 +1319,7 @@ func (c *Controller) keepAliveAppServer(handle *upstreamHandle, now time.Time, n
 		if srv.retryUpsert {
 			c.testEvent(appUpsertRetryErr)
 			slog.WarnContext(c.closeContext, "Failed to update app server on retry",
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 			)
 			// retryUpsert is set when we get a new resource and we fail to
@@ -1332,7 +1332,7 @@ func (c *Controller) keepAliveAppServer(handle *upstreamHandle, now time.Time, n
 		srv.keepAliveErrs++
 		shouldRemove := srv.keepAliveErrs > c.maxKeepAliveErrs
 		slog.WarnContext(c.closeContext, "Failed to update app server on keepalive",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 			"error_count", srv.keepAliveErrs,
 			"should_remove", shouldRemove,
@@ -1368,7 +1368,7 @@ func (c *Controller) keepAliveDatabaseServer(handle *upstreamHandle, now time.Ti
 			handle.databaseServers[name] = srv
 			shouldRemove := srv.keepAliveErrs > c.maxKeepAliveErrs
 			slog.WarnContext(c.closeContext, "Failed to keep alive database server",
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 				"error_count", srv.keepAliveErrs,
 				"should_remove", shouldRemove,
@@ -1393,7 +1393,7 @@ func (c *Controller) keepAliveDatabaseServer(handle *upstreamHandle, now time.Ti
 		if err != nil {
 			c.testEvent(dbUpsertRetryErr)
 			slog.WarnContext(c.closeContext, "Failed to upsert database server on retry",
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 			)
 			// since this is retry-specific logic, an error here means that upsert failed twice in
@@ -1427,7 +1427,7 @@ func (c *Controller) keepAliveKubernetesServer(handle *upstreamHandle, now time.
 			handle.kubernetesServers[name] = srv
 			shouldRemove := srv.keepAliveErrs > c.maxKeepAliveErrs
 			slog.WarnContext(c.closeContext, "Failed to keep alive kubernetes server",
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 				"error_count", srv.keepAliveErrs,
 				"should_remove", shouldRemove,
@@ -1452,7 +1452,7 @@ func (c *Controller) keepAliveKubernetesServer(handle *upstreamHandle, now time.
 		if err != nil {
 			c.testEvent(kubeUpsertRetryErr)
 			slog.WarnContext(c.closeContext, "Failed to upsert kubernetes server on retry.",
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 			)
 			// since this is retry-specific logic, an error here means that upsert failed twice in
@@ -1487,7 +1487,7 @@ func (c *Controller) keepAliveSSHServer(handle *upstreamHandle, now time.Time) e
 		if handle.sshServer.retryUpsert {
 			c.testEvent(sshUpsertRetryErr)
 			slog.WarnContext(c.closeContext, "Failed to upsert SSH server on retry",
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 			)
 			// retryUpsert is set when we get a new resource and we fail to
@@ -1500,7 +1500,7 @@ func (c *Controller) keepAliveSSHServer(handle *upstreamHandle, now time.Time) e
 		handle.sshServer.keepAliveErrs++
 		closing := handle.sshServer.keepAliveErrs > c.maxKeepAliveErrs
 		slog.WarnContext(c.closeContext, "Failed to upsert SSH server on keepalive",
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 			"error", err,
 			"count", handle.sshServer.keepAliveErrs,
 			"closing", closing,
@@ -1520,7 +1520,7 @@ func (c *Controller) keepAliveRelayServer(handle *upstreamHandle, now time.Time)
 	}
 
 	relayServer := gproto.CloneOf(handle.relayServer)
-	relayServer.GetMetadata().Expires = timestamppb.New(now.Add(c.serverTTL))
+	relayServer.GetMetadata().SetExpires(timestamppb.New(now.Add(c.serverTTL)))
 	_, err := c.auth.UpsertRelayServer(c.closeContext, relayServer)
 	if err == nil {
 		handle.relayServerErrorCount = 0
@@ -1540,7 +1540,7 @@ func (c *Controller) keepAliveRelayServer(handle *upstreamHandle, now time.Time)
 
 	closing := handle.relayServerErrorCount > c.maxKeepAliveErrs
 	slog.WarnContext(c.closeContext, "Failed to keep alive relay server",
-		"server_id", handle.Hello().ServerID,
+		"server_id", handle.Hello().GetServerID(),
 		"error", err,
 		"error_count", handle.relayServerErrorCount,
 		"closing", closing,
@@ -1560,13 +1560,13 @@ func (c *Controller) handleStopDatabaseServerHB(handle *upstreamHandle, name str
 	if !handle.HasService(types.RoleDatabase) {
 		return trace.AccessDenied("control stream not configured to support database server heartbeats")
 	}
-	key := resourceKey{hostID: handle.Hello().ServerID, name: name}
+	key := resourceKey{hostID: handle.Hello().GetServerID(), name: name}
 
 	if _, ok := handle.databaseServers[key]; !ok {
 		c.testEvent(dbStopErr)
 		slog.DebugContext(c.closeContext, "Unexpected stop database heartbeat message on control stream",
 			"database_name", key.name,
-			"server_id", handle.Hello().ServerID,
+			"server_id", handle.Hello().GetServerID(),
 		)
 		return nil
 	}
@@ -1587,7 +1587,7 @@ func (c *Controller) handleStopDatabaseServerHB(handle *upstreamHandle, name str
 		if !trace.IsNotFound(err) {
 			slog.WarnContext(c.closeContext, "Failed to delete database server heartbeat",
 				"database_name", key.name,
-				"server_id", handle.Hello().ServerID,
+				"server_id", handle.Hello().GetServerID(),
 				"error", err,
 			)
 		}
diff --git a/lib/inventory/controller_test.go b/lib/inventory/controller_test.go
index 0c8df9ed5b6..91e54f6c50c 100644
--- a/lib/inventory/controller_test.go
+++ b/lib/inventory/controller_test.go
@@ -260,9 +260,9 @@ func testSSHServerScope(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -271,12 +271,12 @@ func testSSHServerScope(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
 		Scope:    "/aa/bb",
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -286,7 +286,7 @@ func testSSHServerScope(t *testing.T) {
 	require.Equal(t, int64(1), controller.instanceHBVariableDuration.Count())
 
 	// send a fake ssh server heartbeat with a scope matching registration
-	err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -296,7 +296,7 @@ func testSSHServerScope(t *testing.T) {
 			},
 			Scope: "/aa/bb",
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that heartbeat creates both an upsert and a keepalive
@@ -306,7 +306,7 @@ func testSSHServerScope(t *testing.T) {
 	)
 
 	// send an ssh server heartbeat with a scope different from registration
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -316,7 +316,7 @@ func testSSHServerScope(t *testing.T) {
 			},
 			Scope: "/aa/bb/cc",
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that the handler closes
@@ -377,9 +377,9 @@ func testSSHServerImmutableLabels(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -388,17 +388,17 @@ func testSSHServerImmutableLabels(t *testing.T) {
 		}
 	}()
 
-	immutableLabels := &joiningv1.ImmutableLabels{
+	immutableLabels := joiningv1.ImmutableLabels_builder{
 		Ssh: map[string]string{
 			"foo": "bar",
 		},
-	}
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	}.Build()
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID:        serverID,
 		Version:         teleport.Version,
 		Services:        types.SystemRoles{types.RoleNode}.StringSlice(),
 		ImmutableLabels: immutableLabels,
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -408,7 +408,7 @@ func testSSHServerImmutableLabels(t *testing.T) {
 	require.Equal(t, int64(1), controller.instanceHBVariableDuration.Count())
 
 	// send a fake ssh server heartbeat with a scope matching registration
-	err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -418,7 +418,7 @@ func testSSHServerImmutableLabels(t *testing.T) {
 				ImmutableLabels: immutableLabels.GetSsh(),
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that heartbeat creates both an upsert and a keepalive
@@ -428,7 +428,7 @@ func testSSHServerImmutableLabels(t *testing.T) {
 	)
 
 	// send an ssh server heartbeat with immutable labels different from registration
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -440,7 +440,7 @@ func testSSHServerImmutableLabels(t *testing.T) {
 				},
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that the handler closes
@@ -501,9 +501,9 @@ func testSSHServerBasics(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -512,11 +512,11 @@ func testSSHServerBasics(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -526,7 +526,7 @@ func testSSHServerBasics(t *testing.T) {
 	require.Equal(t, int64(1), controller.instanceHBVariableDuration.Count())
 
 	// send a fake ssh server heartbeat
-	err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -535,7 +535,7 @@ func testSSHServerBasics(t *testing.T) {
 				Addr: zeroAddr,
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that heartbeat creates both an upsert and a keepalive
@@ -561,7 +561,7 @@ func testSSHServerBasics(t *testing.T) {
 		deny(sshUpsertErr, handlerClose),
 	)
 
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -570,7 +570,7 @@ func testSSHServerBasics(t *testing.T) {
 				Addr: zeroAddr,
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// this explicit upsert will not happen since the server is the same, but
@@ -587,7 +587,7 @@ func testSSHServerBasics(t *testing.T) {
 	auth.failUpserts = 1
 	auth.mu.Unlock()
 
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -599,7 +599,7 @@ func testSSHServerBasics(t *testing.T) {
 				Addr: zeroAddr,
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// we should now see an upsert failure, but no additional
@@ -625,7 +625,7 @@ func testSSHServerBasics(t *testing.T) {
 	auth.failUpserts = 5
 	auth.mu.Unlock()
 
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		SSHServer: &types.ServerV2{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -634,7 +634,7 @@ func testSSHServerBasics(t *testing.T) {
 				Addr: zeroAddr,
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// both the initial upsert and the retry should fail, then the handle should
@@ -713,9 +713,9 @@ func testAppServerBasics(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -724,11 +724,11 @@ func testAppServerBasics(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleApp}.StringSlice(),
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -739,7 +739,7 @@ func testAppServerBasics(t *testing.T) {
 
 	// send a fake app server heartbeat
 	for i := range appCount {
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			AppServer: &types.AppServerV3{
 				Metadata: types.Metadata{
 					Name: fmt.Sprintf("app-%d", i),
@@ -756,7 +756,7 @@ func testAppServerBasics(t *testing.T) {
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -794,7 +794,7 @@ func testAppServerBasics(t *testing.T) {
 	)
 
 	for i := range appCount {
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			AppServer: &types.AppServerV3{
 				Metadata: types.Metadata{
 					Name: fmt.Sprintf("app-%d", i),
@@ -814,7 +814,7 @@ func testAppServerBasics(t *testing.T) {
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -864,7 +864,7 @@ func testAppServerBasics(t *testing.T) {
 	auth.failKeepAlives = 5
 	auth.mu.Unlock()
 
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		AppServer: &types.AppServerV3{
 			Metadata: types.Metadata{
 				Name: "app-0",
@@ -884,7 +884,7 @@ func testAppServerBasics(t *testing.T) {
 				},
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// both the initial upsert and the retry should fail, then the handle should
@@ -950,9 +950,9 @@ func testAppServerHeartbeatNormalization(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -961,17 +961,17 @@ func testAppServerHeartbeatNormalization(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleApp}.StringSlice(),
-	})
+	}.Build())
 
 	h, ok := controller.GetControlStream(serverID)
 	require.True(t, ok)
 	handle := h.(*upstreamHandle)
 
-	err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		AppServer: &types.AppServerV3{
 			Metadata: types.Metadata{
 				Name: "MixedCaseApp",
@@ -991,7 +991,7 @@ func testAppServerHeartbeatNormalization(t *testing.T) {
 				},
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	awaitEvents(t, events,
@@ -1038,9 +1038,9 @@ func testAppKeepAliveRetryRoutesThroughUpsert(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -1049,17 +1049,17 @@ func testAppKeepAliveRetryRoutesThroughUpsert(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleApp}.StringSlice(),
-	})
+	}.Build())
 
 	auth.mu.Lock()
 	auth.failUpserts = 1
 	auth.mu.Unlock()
 
-	err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		AppServer: &types.AppServerV3{
 			Metadata: types.Metadata{Name: "app-retry"},
 			Spec: types.AppServerSpecV3{
@@ -1075,7 +1075,7 @@ func testAppKeepAliveRetryRoutesThroughUpsert(t *testing.T) {
 				},
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	awaitEvents(t, events,
@@ -1145,9 +1145,9 @@ func testDatabaseServerBasics(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -1156,11 +1156,11 @@ func testDatabaseServerBasics(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleDatabase}.StringSlice(),
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -1171,7 +1171,7 @@ func testDatabaseServerBasics(t *testing.T) {
 
 	// send a fake db server heartbeat
 	for i := range dbCount {
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			DatabaseServer: &types.DatabaseServerV3{
 				Metadata: types.Metadata{
 					Name: serverID,
@@ -1189,7 +1189,7 @@ func testDatabaseServerBasics(t *testing.T) {
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -1205,10 +1205,10 @@ func testDatabaseServerBasics(t *testing.T) {
 	auth.mu.Unlock()
 
 	// stop a heartbeat
-	err := downstream.Send(ctx, &proto.UpstreamInventoryStopHeartbeat{
+	err := downstream.Send(ctx, proto.UpstreamInventoryStopHeartbeat_builder{
 		Kind: proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER,
 		Name: "db-1",
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that keep alive stops, even if the heartbeat couldn't be deleted
@@ -1219,10 +1219,10 @@ func testDatabaseServerBasics(t *testing.T) {
 	require.Equal(t, dbCount-1, rc.count())
 
 	// verify heartbeat stop keepalive idempotency
-	err = downstream.Send(ctx, &proto.UpstreamInventoryStopHeartbeat{
+	err = downstream.Send(ctx, proto.UpstreamInventoryStopHeartbeat_builder{
 		Kind: proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER,
 		Name: "db-1",
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, dbCount-1, rc.count())
 
@@ -1260,7 +1260,7 @@ func testDatabaseServerBasics(t *testing.T) {
 	)
 
 	for i := range dbCount {
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			DatabaseServer: &types.DatabaseServerV3{
 				Metadata: types.Metadata{
 					Name: serverID,
@@ -1277,7 +1277,7 @@ func testDatabaseServerBasics(t *testing.T) {
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -1326,7 +1326,7 @@ func testDatabaseServerBasics(t *testing.T) {
 	auth.failUpserts = 5
 	auth.mu.Unlock()
 
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		DatabaseServer: &types.DatabaseServerV3{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -1341,7 +1341,7 @@ func testDatabaseServerBasics(t *testing.T) {
 				},
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// both the initial upsert and the retry should fail, then the handle should
@@ -1397,11 +1397,11 @@ func testInstanceHeartbeat_Disabled(t *testing.T) {
 	// set up fake in-memory control stream
 	upstream, _ := client.InventoryControlStreamPipe(client.ICSPipePeerAddr(peerAddr))
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	_, ok := controller.GetControlStream(serverID)
@@ -1464,11 +1464,11 @@ func testInstanceHeartbeat(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode, types.RoleApp}.StringSlice(),
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -1568,15 +1568,15 @@ func testUpdateLabels(t *testing.T) {
 
 	// Set up fake in-memory control stream.
 	upstream, downstream := client.InventoryControlStreamPipe(client.ICSPipePeerAddr(peerAddr))
-	upstreamHello := &proto.UpstreamInventoryHello{
+	upstreamHello := proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
-	}
-	downstreamHello := &proto.DownstreamInventoryHello{
+	}.Build()
+	downstreamHello := proto.DownstreamInventoryHello_builder{
 		Version:  teleport.Version,
 		ServerID: "auth",
-	}
+	}.Build()
 
 	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
@@ -1641,15 +1641,15 @@ func testAgentMetadata(t *testing.T) {
 
 	// Set up fake in-memory control stream.
 	upstream, downstream := client.InventoryControlStreamPipe(client.ICSPipePeerAddr(peerAddr))
-	upstreamHello := &proto.UpstreamInventoryHello{
+	upstreamHello := proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
-	}
-	downstreamHello := &proto.DownstreamInventoryHello{
+	}.Build()
+	downstreamHello := proto.DownstreamInventoryHello_builder{
 		Version:  teleport.Version,
 		ServerID: "auth",
-	}
+	}.Build()
 
 	ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second)
 	defer cancel()
@@ -1694,8 +1694,8 @@ func testAgentMetadata(t *testing.T) {
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		md := upstreamHandle.AgentMetadata()
 		require.NotNil(t, md)
-		require.ElementsMatch(t, []string{"llama", "alpaca"}, md.InstallMethods)
-		require.Equal(t, "llamaOS", md.OS)
+		require.ElementsMatch(t, []string{"llama", "alpaca"}, md.GetInstallMethods())
+		require.Equal(t, "llamaOS", md.GetOS())
 	}, 10*time.Second, 200*time.Millisecond)
 }
 
@@ -1721,11 +1721,11 @@ func TestGoodbye(t *testing.T) {
 		},
 	}
 
-	upstreamHello := &proto.UpstreamInventoryHello{
+	upstreamHello := proto.UpstreamInventoryHello_builder{
 		ServerID: "llama",
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode, types.RoleApp}.StringSlice(),
-	}
+	}.Build()
 
 	for _, test := range tests {
 		inner := func(t *testing.T) {
@@ -1739,15 +1739,15 @@ func TestGoodbye(t *testing.T) {
 			upstream, downstream := client.InventoryControlStreamPipe(client.ICSPipePeerAddr("127.0.0.1:8090"))
 
 			currentDownstream := downstream
-			downstreamHello := &proto.DownstreamInventoryHello{
+			downstreamHello := proto.DownstreamInventoryHello_builder{
 				Version:  teleport.Version,
 				ServerID: "auth",
-				Capabilities: &proto.DownstreamInventoryHello_SupportedCapabilities{
+				Capabilities: proto.DownstreamInventoryHello_SupportedCapabilities_builder{
 					AppCleanup:     test.supportsGoodbye,
 					AppHeartbeats:  true,
 					NodeHeartbeats: true,
-				},
-			}
+				}.Build(),
+			}.Build()
 
 			// Test setup: creating downstream handler
 			clock := clockwork.NewFakeClock()
@@ -1796,7 +1796,7 @@ func TestGoodbye(t *testing.T) {
 				// (SendGoodBye is synchronous, and we send messages over the same channel)
 				select {
 				case sender := <-handle.Sender():
-					sender.Send(ctx, &proto.UpstreamInventoryPong{ID: uint64(nonce)})
+					sender.Send(ctx, proto.UpstreamInventoryPong_builder{ID: uint64(nonce)}.Build())
 				case <-ctx.Done():
 					assert.Fail(t, "never got downstream sender, was not able to send 'end-of-test pong'")
 				}
@@ -1818,7 +1818,7 @@ func TestGoodbye(t *testing.T) {
 						receivedGoodbye = msg
 					case *proto.UpstreamInventoryPong:
 						// The emitter routine is done with its part, we stop waiting for events
-						require.Equal(t, nonce, int(msg.ID), "received pong message without the 'end-of-test ID'")
+						require.Equal(t, nonce, int(msg.GetID()), "received pong message without the 'end-of-test ID'")
 						break OuterLoop
 					default:
 						require.Fail(t, "unexpected message type", msg)
@@ -1833,8 +1833,8 @@ func TestGoodbye(t *testing.T) {
 			// Test validation pt.1: Check if we received a pong
 			if test.supportsGoodbye {
 				require.NotNil(t, receivedGoodbye)
-				require.Equal(t, test.deleteResources, receivedGoodbye.DeleteResources)
-				require.Equal(t, test.softReload, receivedGoodbye.SoftReload)
+				require.Equal(t, test.deleteResources, receivedGoodbye.GetDeleteResources())
+				require.Equal(t, test.softReload, receivedGoodbye.GetSoftReload())
 			} else {
 				require.Nil(t, receivedGoodbye)
 			}
@@ -1942,9 +1942,9 @@ func testKubernetesServerScoped(initialScope, serverScope, clusterScope string)
 			for {
 				select {
 				case msg := <-downstream.Recv():
-					downstream.Send(ctx, &proto.UpstreamInventoryPong{
+					downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 						ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-					})
+					}.Build())
 				case <-downstream.Done():
 					return
 				case <-ctx.Done():
@@ -1953,12 +1953,12 @@ func testKubernetesServerScoped(initialScope, serverScope, clusterScope string)
 			}
 		}()
 
-		controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+		controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 			ServerID: serverID,
 			Version:  teleport.Version,
 			Services: types.SystemRoles{types.RoleKube}.StringSlice(),
 			Scope:    initialScope,
-		})
+		}.Build())
 
 		// verify that control stream handle is now accessible
 		_, ok := controller.GetControlStream(serverID)
@@ -1968,7 +1968,7 @@ func testKubernetesServerScoped(initialScope, serverScope, clusterScope string)
 		require.Equal(t, int64(1), controller.instanceHBVariableDuration.Count())
 
 		// send server heartbeat with scopes applied
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			KubernetesServer: &types.KubernetesServerV3{
 				Metadata: types.Metadata{
 					Name: serverID,
@@ -1988,7 +1988,7 @@ func testKubernetesServerScoped(initialScope, serverScope, clusterScope string)
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		if serverScope != initialScope {
@@ -2044,9 +2044,9 @@ func testKubernetesServerBasics(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID: msg.(*proto.DownstreamInventoryPing).GetID(),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -2055,11 +2055,11 @@ func testKubernetesServerBasics(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleKube}.StringSlice(),
-	})
+	}.Build())
 
 	// verify that control stream handle is now accessible
 	handle, ok := controller.GetControlStream(serverID)
@@ -2070,7 +2070,7 @@ func testKubernetesServerBasics(t *testing.T) {
 
 	// send a fake kube server heartbeat
 	for i := range kubeCount {
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			KubernetesServer: &types.KubernetesServerV3{
 				Metadata: types.Metadata{
 					Name: serverID,
@@ -2088,7 +2088,7 @@ func testKubernetesServerBasics(t *testing.T) {
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -2126,7 +2126,7 @@ func testKubernetesServerBasics(t *testing.T) {
 	)
 
 	for i := range kubeCount {
-		err := downstream.Send(ctx, &proto.InventoryHeartbeat{
+		err := downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 			KubernetesServer: &types.KubernetesServerV3{
 				Metadata: types.Metadata{
 					Name: serverID,
@@ -2144,7 +2144,7 @@ func testKubernetesServerBasics(t *testing.T) {
 					},
 				},
 			},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -2193,7 +2193,7 @@ func testKubernetesServerBasics(t *testing.T) {
 	auth.failUpserts = 5
 	auth.mu.Unlock()
 
-	err = downstream.Send(ctx, &proto.InventoryHeartbeat{
+	err = downstream.Send(ctx, proto.InventoryHeartbeat_builder{
 		KubernetesServer: &types.KubernetesServerV3{
 			Metadata: types.Metadata{
 				Name: serverID,
@@ -2211,7 +2211,7 @@ func testKubernetesServerBasics(t *testing.T) {
 				},
 			},
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// both the initial upsert and the retry should fail, then the handle should
@@ -2258,21 +2258,21 @@ func testGetSender(t *testing.T) {
 	// Set up fake in-memory control stream.
 	upstream, downstream := client.InventoryControlStreamPipe(client.ICSPipePeerAddr("127.0.0.1:8090"))
 
-	downstreamHello := &proto.DownstreamInventoryHello{
+	downstreamHello := proto.DownstreamInventoryHello_builder{
 		Version:  teleport.Version,
 		ServerID: "auth",
-		Capabilities: &proto.DownstreamInventoryHello_SupportedCapabilities{
+		Capabilities: proto.DownstreamInventoryHello_SupportedCapabilities_builder{
 			AppCleanup:     true,
 			AppHeartbeats:  true,
 			NodeHeartbeats: true,
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	upstreamHello := &proto.UpstreamInventoryHello{
+	upstreamHello := proto.UpstreamInventoryHello_builder{
 		ServerID: "llama",
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode, types.RoleApp}.StringSlice(),
-	}
+	}.Build()
 
 	handle, err := NewDownstreamHandle(
 		func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
@@ -2354,10 +2354,10 @@ func testTimeReconciliation(t *testing.T) {
 		for {
 			select {
 			case msg := <-downstream.Recv():
-				downstream.Send(ctx, &proto.UpstreamInventoryPong{
+				downstream.Send(ctx, proto.UpstreamInventoryPong_builder{
 					ID:          msg.(*proto.DownstreamInventoryPing).GetID(),
 					SystemClock: timestamppb.New(clock.Now().Add(-time.Minute)),
-				})
+				}.Build())
 			case <-downstream.Done():
 				return
 			case <-ctx.Done():
@@ -2366,11 +2366,11 @@ func testTimeReconciliation(t *testing.T) {
 		}
 	}()
 
-	controller.RegisterControlStream(upstream, &proto.UpstreamInventoryHello{
+	controller.RegisterControlStream(upstream, proto.UpstreamInventoryHello_builder{
 		ServerID: serverID,
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
-	})
+	}.Build())
 
 	_, ok := controller.GetControlStream(serverID)
 	require.True(t, ok)
diff --git a/lib/inventory/inventory.go b/lib/inventory/inventory.go
index a6a68538035..35fdd1194cb 100644
--- a/lib/inventory/inventory.go
+++ b/lib/inventory/inventory.go
@@ -231,7 +231,7 @@ func (h *downstreamHandle) autoEmitMetadata() {
 		}
 		return
 	}
-	msg := &proto.UpstreamInventoryAgentMetadata{
+	msg := proto.UpstreamInventoryAgentMetadata_builder{
 		OS:                    md.OS,
 		OSVersion:             md.OSVersion,
 		HostArchitecture:      md.HostArchitecture,
@@ -240,7 +240,7 @@ func (h *downstreamHandle) autoEmitMetadata() {
 		ContainerRuntime:      md.ContainerRuntime,
 		ContainerOrchestrator: md.ContainerOrchestrator,
 		CloudEnvironment:      md.CloudEnvironment,
-	}
+	}.Build()
 	for {
 		// Wait for stream to be opened.
 		var sender DownstreamSender
@@ -374,7 +374,7 @@ func (h *downstreamHandle) handlePing(sender DownstreamSender, msg *proto.Downst
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	if len(h.pingHandlers) == 0 {
-		slog.WarnContext(h.closeContext, "Got ping with no handlers registered", "ping_id", msg.ID)
+		slog.WarnContext(h.closeContext, "Got ping with no handlers registered", "ping_id", msg.GetID())
 		return
 	}
 	for _, handler := range h.pingHandlers {
@@ -398,8 +398,8 @@ func (h *downstreamHandle) RegisterPingHandler(handler DownstreamPingHandler) (u
 func (h *downstreamHandle) handleUpdateLabels(msg *proto.DownstreamInventoryUpdateLabels) {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	if msg.Kind == proto.LabelUpdateKind_SSHServerCloudLabels {
-		h.upstreamSSHLabels = msg.Labels
+	if msg.GetKind() == proto.LabelUpdateKind_SSHServerCloudLabels {
+		h.upstreamSSHLabels = msg.GetLabels()
 	}
 }
 
@@ -437,7 +437,7 @@ func (h *downstreamHandle) Close() error {
 // SendGoodbye crafts a goodbye message, save it, waits for a working stream and sends it to the auth.
 // If the downstreamHandle were to reconnect later, the h.autoEmitGoodbye routine would re-emit it.
 func (h *downstreamHandle) SetAndSendGoodbye(ctx context.Context, deleteResources bool, softReload bool) error {
-	goodbye := &proto.UpstreamInventoryGoodbye{DeleteResources: deleteResources, SoftReload: softReload}
+	goodbye := proto.UpstreamInventoryGoodbye_builder{DeleteResources: deleteResources, SoftReload: softReload}.Build()
 	h.goodbye.Store(goodbye)
 
 	// Wait for an available stream
@@ -456,11 +456,11 @@ func (h *downstreamHandle) sendGoodbye(ctx context.Context, sender DownstreamSen
 		return trace.BadParameter("trying to send a nil goodbye, this is a bug")
 	}
 
-	capabilities := sender.Hello().Capabilities
+	capabilities := sender.Hello().GetCapabilities()
 	switch {
 	case capabilities == nil:
 		return nil
-	case !capabilities.AppCleanup:
+	case !capabilities.GetAppCleanup():
 		return nil
 	}
 
@@ -650,10 +650,10 @@ func (i *instanceStateTracker) nextHeartbeat(now time.Time, hello *proto.Upstrea
 		services = append(services, types.SystemRole(s))
 	}
 
-	instance, err := types.NewInstance(hello.ServerID, types.InstanceSpecV1{
-		Version:                 vc.Normalize(hello.Version),
+	instance, err := types.NewInstance(hello.GetServerID(), types.InstanceSpecV1{
+		Version:                 vc.Normalize(hello.GetVersion()),
 		Services:                services,
-		Hostname:                hello.Hostname,
+		Hostname:                hello.GetHostname(),
 		AuthID:                  authID,
 		LastSeen:                now.UTC(),
 		ExternalUpgrader:        hello.GetExternalUpgrader(),
@@ -833,7 +833,7 @@ func (h *upstreamHandle) HasService(service types.SystemRole) bool {
 // HasControlPlaneService implements UpstreamHandle and returns true if at
 // least a control plane service is associated with this stream.
 func (h *upstreamHandle) HasControlPlaneService() bool {
-	for _, s := range h.hello.Services {
+	for _, s := range h.hello.GetServices() {
 		if types.SystemRole(s).IsControlPlane() {
 			return true
 		}
@@ -842,9 +842,9 @@ func (h *upstreamHandle) HasControlPlaneService() bool {
 }
 
 func (h *upstreamHandle) UpdateLabels(ctx context.Context, kind proto.LabelUpdateKind, labels map[string]string) error {
-	req := &proto.DownstreamInventoryUpdateLabels{
+	req := proto.DownstreamInventoryUpdateLabels_builder{
 		Kind:   kind,
 		Labels: labels,
-	}
+	}.Build()
 	return trace.Wrap(h.Send(ctx, req))
 }
diff --git a/lib/inventory/store.go b/lib/inventory/store.go
index a7d140bd117..ac93a9a4bc3 100644
--- a/lib/inventory/store.go
+++ b/lib/inventory/store.go
@@ -72,12 +72,12 @@ func (s *Store) Handles(serverID string) iter.Seq[UpstreamHandle] {
 
 // Insert adds a new handle to the store.
 func (s *Store) Insert(handle UpstreamHandle) {
-	s.getShard(handle.Hello().ServerID).insert(handle)
+	s.getShard(handle.Hello().GetServerID()).insert(handle)
 }
 
 // Remove removes the handle from the store.
 func (s *Store) Remove(handle UpstreamHandle) {
-	s.getShard(handle.Hello().ServerID).remove(handle)
+	s.getShard(handle.Hello().GetServerID()).remove(handle)
 }
 
 // UniqueHandles iterates across unique handles registered with this store.
@@ -194,10 +194,10 @@ func (s *shard) iterWithDuplicates(fn func(UpstreamHandle)) {
 func (s *shard) insert(handle UpstreamHandle) {
 	s.rw.Lock()
 	defer s.rw.Unlock()
-	e, ok := s.m[handle.Hello().ServerID]
+	e, ok := s.m[handle.Hello().GetServerID()]
 	if !ok {
 		e = &entry{}
-		s.m[handle.Hello().ServerID] = e
+		s.m[handle.Hello().GetServerID()] = e
 	}
 	e.handles = append(e.handles, handle)
 }
@@ -205,7 +205,7 @@ func (s *shard) insert(handle UpstreamHandle) {
 func (s *shard) remove(handle UpstreamHandle) {
 	s.rw.Lock()
 	defer s.rw.Unlock()
-	e, ok := s.m[handle.Hello().ServerID]
+	e, ok := s.m[handle.Hello().GetServerID()]
 	if !ok {
 		return
 	}
@@ -213,7 +213,7 @@ func (s *shard) remove(handle UpstreamHandle) {
 		if handle == h {
 			e.handles = swapRemove(e.handles, i)
 			if len(e.handles) == 0 {
-				delete(s.m, handle.Hello().ServerID)
+				delete(s.m, handle.Hello().GetServerID())
 			}
 			return
 		}
diff --git a/lib/inventory/store_test.go b/lib/inventory/store_test.go
index 93911c8a514..2e37033eb7c 100644
--- a/lib/inventory/store_test.go
+++ b/lib/inventory/store_test.go
@@ -59,9 +59,9 @@ func BenchmarkStore(b *testing.B) {
 				defer wg.Done()
 				serverID := fmt.Sprintf("server-%d", sn%uniqueServers)
 				handle := &upstreamHandle{
-					hello: &proto.UpstreamInventoryHello{
+					hello: proto.UpstreamInventoryHello_builder{
 						ServerID: serverID,
-					},
+					}.Build(),
 				}
 				store.Insert(handle)
 				_, ok := store.Get(serverID)
@@ -77,7 +77,7 @@ func BenchmarkStore(b *testing.B) {
 						defer wg.Done()
 						var foundServer bool
 						store.UniqueHandles(func(h UpstreamHandle) {
-							if h.Hello().ServerID == serverID {
+							if h.Hello().GetServerID() == serverID {
 								foundServer = true
 							}
 						})
@@ -119,9 +119,9 @@ func TestStoreAccess(t *testing.T) {
 	for i := range 1_000 {
 		serverID := fmt.Sprintf("server-%d", i%100)
 		handle := &upstreamHandle{
-			hello: &proto.UpstreamInventoryHello{
+			hello: proto.UpstreamInventoryHello_builder{
 				ServerID: serverID,
-			},
+			}.Build(),
 		}
 		store.Insert(handle)
 		handles[handle] = 0
@@ -129,7 +129,7 @@ func TestStoreAccess(t *testing.T) {
 
 	// ensure that all server IDs yield a handle
 	for h := range handles {
-		_, ok := store.Get(h.Hello().ServerID)
+		_, ok := store.Get(h.Hello().GetServerID())
 		require.True(t, ok)
 	}
 
@@ -178,9 +178,9 @@ func TestAllHandles(t *testing.T) {
 	for i := range 1_000 {
 		serverID := fmt.Sprintf("server-%d", i%100)
 		handle := &upstreamHandle{
-			hello: &proto.UpstreamInventoryHello{
+			hello: proto.UpstreamInventoryHello_builder{
 				ServerID: serverID,
-			},
+			}.Build(),
 		}
 		store.Insert(handle)
 		handles[handle] = 0
diff --git a/lib/join/azuredevops/azuredevops.go b/lib/join/azuredevops/azuredevops.go
index fe514c5c676..ecb2df2e470 100644
--- a/lib/join/azuredevops/azuredevops.go
+++ b/lib/join/azuredevops/azuredevops.go
@@ -102,8 +102,8 @@ func (c *IDTokenClaims) ForAudit() map[string]any {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsAzureDevops {
-	return &workloadidentityv1pb.JoinAttrsAzureDevops{
-		Pipeline: &workloadidentityv1pb.JoinAttrsAzureDevopsPipeline{
+	return workloadidentityv1pb.JoinAttrsAzureDevops_builder{
+		Pipeline: workloadidentityv1pb.JoinAttrsAzureDevopsPipeline_builder{
 			Sub:               c.Sub,
 			OrganizationName:  c.OrganizationName,
 			ProjectName:       c.ProjectName,
@@ -115,8 +115,8 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsAzureDevops {
 			RepositoryVersion: c.RepositoryVersion,
 			RepositoryRef:     c.RepositoryRef,
 			RunId:             c.RunID,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // CheckIDTokenParams are parameters used to validate Azure Devops OIDC tokens.
diff --git a/lib/join/azurejoin/azure.go b/lib/join/azurejoin/azure.go
index 1eae7f21027..44fc2ab764c 100644
--- a/lib/join/azurejoin/azure.go
+++ b/lib/join/azurejoin/azure.go
@@ -409,13 +409,13 @@ func checkAzureAllowRules(vmID string, attrs *workloadidentityv1pb.JoinAttrsAzur
 			// require at least tenant or subscription is set to restrict joins.
 			continue
 		}
-		if rule.Tenant != "" && rule.Tenant != attrs.Tenant {
+		if rule.Tenant != "" && rule.Tenant != attrs.GetTenant() {
 			continue
 		}
-		if rule.Subscription != "" && rule.Subscription != attrs.Subscription {
+		if rule.Subscription != "" && rule.Subscription != attrs.GetSubscription() {
 			continue
 		}
-		if !azureResourceGroupIsAllowed(rule.ResourceGroups, attrs.ResourceGroup) {
+		if !azureResourceGroupIsAllowed(rule.ResourceGroups, attrs.GetResourceGroup()) {
 			continue
 		}
 		return nil
@@ -443,11 +443,11 @@ func azureResourceGroupIsAllowed(allowedResourceGroups []string, vmResourceGroup
 }
 
 func azureJoinToAttrs(tenantID, subscriptionID, resourceGroupID string) *workloadidentityv1pb.JoinAttrsAzure {
-	return &workloadidentityv1pb.JoinAttrsAzure{
+	return workloadidentityv1pb.JoinAttrsAzure_builder{
 		Tenant:        tenantID,
 		Subscription:  subscriptionID,
 		ResourceGroup: resourceGroupID,
-	}
+	}.Build()
 }
 
 // CheckAzureRequestParams holds all parameters for [CheckAzureRequest].
diff --git a/lib/join/azurejoin/join_azure_test.go b/lib/join/azurejoin/join_azure_test.go
index a3c1f115215..b9afff02666 100644
--- a/lib/join/azurejoin/join_azure_test.go
+++ b/lib/join/azurejoin/join_azure_test.go
@@ -559,26 +559,26 @@ func TestJoinAzure(t *testing.T) {
 				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
 			})
 
-			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, &joiningv1.ScopedToken{
+			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, joiningv1.ScopedToken_builder{
 				Scope: "/test",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped_" + token.GetName(),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/test/one",
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
-			_, err = a.CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+			_, err = a.CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: scopedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				_, err := a.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+				_, err := a.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
 					Name: scopedToken.GetMetadata().GetName(),
-				})
+				}.Build())
 				require.NoError(t, err)
 			})
 
@@ -695,14 +695,14 @@ func TestJoinAzureClaims(t *testing.T) {
 	defaultVMID := "my-vm-id"
 
 	botName := "botty"
-	_, err = machineidv1.UpsertBot(ctx, a, &machineidv1pb.Bot{
+	_, err = machineidv1.UpsertBot(ctx, a, machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: botName,
-		},
+		}.Build(),
 		Spec: &machineidv1pb.BotSpec{},
-	}, a.GetClock().Now(), "", scopes.Features{})
+	}.Build(), a.GetClock().Now(), "", scopes.Features{})
 	require.NoError(t, err)
 
 	tests := []struct {
@@ -1023,26 +1023,26 @@ func TestJoinAzureClaims(t *testing.T) {
 				require.NoError(t, a.DeleteToken(ctx, token.GetName()))
 			})
 
-			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, &joiningv1.ScopedToken{
+			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, joiningv1.ScopedToken_builder{
 				Scope: "/test",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped_" + token.GetName(),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/test/one",
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
-			_, err = a.CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+			_, err = a.CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: scopedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				_, err := a.DeleteScopedToken(t.Context(), &joiningv1.DeleteScopedTokenRequest{
+				_, err := a.DeleteScopedToken(t.Context(), joiningv1.DeleteScopedTokenRequest_builder{
 					Name: scopedToken.GetMetadata().GetName(),
-				})
+				}.Build())
 				require.NoError(t, err)
 			})
 
@@ -1164,8 +1164,8 @@ func TestJoinAzureClaims(t *testing.T) {
 
 				// Make sure the JoinAttributes were set.
 				require.NotNil(t, identity.JoinAttributes)
-				require.NotNil(t, identity.JoinAttributes.Azure)
-				require.Equal(t, tc.tokenSubscription, identity.JoinAttributes.Azure.Subscription)
+				require.NotNil(t, identity.JoinAttributes.GetAzure())
+				require.Equal(t, tc.tokenSubscription, identity.JoinAttributes.GetAzure().GetSubscription())
 			})
 		})
 	}
diff --git a/lib/join/bitbucket/bitbucket.go b/lib/join/bitbucket/bitbucket.go
index aeeae00bb55..22f5bb7f5c4 100644
--- a/lib/join/bitbucket/bitbucket.go
+++ b/lib/join/bitbucket/bitbucket.go
@@ -88,7 +88,7 @@ func (c *IDTokenClaims) GetSubject() string {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsBitbucket {
-	return &workloadidentityv1pb.JoinAttrsBitbucket{
+	return workloadidentityv1pb.JoinAttrsBitbucket_builder{
 		Sub:                       c.Sub,
 		StepUuid:                  c.StepUUID,
 		RepositoryUuid:            c.RepositoryUUID,
@@ -96,7 +96,7 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsBitbucket {
 		WorkspaceUuid:             c.WorkspaceUUID,
 		DeploymentEnvironmentUuid: c.DeploymentEnvironmentUUID,
 		BranchName:                c.BranchName,
-	}
+	}.Build()
 }
 
 // CheckIDTokenParams are parameters used to validate Bitbucket OIDC tokens.
diff --git a/lib/join/boundkeypair/boundkeypair.go b/lib/join/boundkeypair/boundkeypair.go
index 3239c23f0ff..59dad29b9e0 100644
--- a/lib/join/boundkeypair/boundkeypair.go
+++ b/lib/join/boundkeypair/boundkeypair.go
@@ -265,8 +265,8 @@ func (m *consumeRecoveryMutator) mutateScopedToken(
 	spec *joiningv1.BoundKeypairSpec,
 	status *joiningv1.BoundKeypairStatus,
 ) {
-	status.RecoveryCount += 1
-	status.LastRecoveredAt = timestamppb.New(m.now)
+	status.SetRecoveryCount(status.GetRecoveryCount() + 1)
+	status.SetLastRecoveredAt(timestamppb.New(m.now))
 }
 
 // mutateStatusConsumeRecovery consumes a "hard" join on the backend, incrementing
@@ -310,7 +310,7 @@ func (m *boundPublicKeyMutator) mutateScopedToken(
 	spec *joiningv1.BoundKeypairSpec,
 	status *joiningv1.BoundKeypairStatus,
 ) {
-	status.BoundPublicKey = m.newPublicKey
+	status.SetBoundPublicKey(m.newPublicKey)
 }
 
 // mutateStatusBoundPublicKey is a mutator that updates the bound public key
@@ -355,7 +355,7 @@ func (m *boundBotInstanceMutator) mutateScopedToken(
 	spec *joiningv1.BoundKeypairSpec,
 	status *joiningv1.BoundKeypairStatus,
 ) {
-	status.BoundBotInstanceId = m.newBotInstance
+	status.SetBoundBotInstanceId(m.newBotInstance)
 }
 
 // mutateStatusBoundBotInstance updates the bot instance ID currently bound to
@@ -400,7 +400,7 @@ func (m *boundHostIDMutator) mutateScopedToken(
 	spec *joiningv1.BoundKeypairSpec,
 	status *joiningv1.BoundKeypairStatus,
 ) {
-	status.BoundHostId = m.newHostID
+	status.SetBoundHostId(m.newHostID)
 }
 
 // mutateStatusBoundHostID updates the host ID currently bound to this token. It
@@ -458,9 +458,9 @@ func (m *lastRotatedAtMutator) mutateScopedToken(
 	status *joiningv1.BoundKeypairStatus,
 ) {
 	if m.newValue == nil {
-		status.LastRotatedAt = nil
+		status.ClearLastRotatedAt()
 	} else {
-		status.LastRotatedAt = timestamppb.New(*m.newValue)
+		status.SetLastRotatedAt(timestamppb.New(*m.newValue))
 	}
 }
 
@@ -500,7 +500,7 @@ func (m *clearRegistrationSecretMutator) mutateScopedToken(
 	spec *joiningv1.BoundKeypairSpec,
 	status *joiningv1.BoundKeypairStatus,
 ) {
-	status.RegistrationSecret = ""
+	status.SetRegistrationSecret("")
 }
 
 // mutateStatusClearRegistrationSecret clears the registration secret field to
diff --git a/lib/join/circleci/circleci.go b/lib/join/circleci/circleci.go
index a93962c4341..fb8a4628746 100644
--- a/lib/join/circleci/circleci.go
+++ b/lib/join/circleci/circleci.go
@@ -83,11 +83,11 @@ func (c *IDTokenClaims) GetSubject() string {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsCircleCI {
-	return &workloadidentityv1pb.JoinAttrsCircleCI{
+	return workloadidentityv1pb.JoinAttrsCircleCI_builder{
 		Sub:        c.Sub,
 		ContextIds: c.ContextIDs,
 		ProjectId:  c.ProjectID,
-	}
+	}.Build()
 }
 
 // CheckIDTokenParams are parameters used to validate CircleCI OIDC tokens.
diff --git a/lib/join/env0/env0.go b/lib/join/env0/env0.go
index f330794d875..3c52454a06d 100644
--- a/lib/join/env0/env0.go
+++ b/lib/join/env0/env0.go
@@ -113,7 +113,7 @@ type IDTokenClaims struct {
 }
 
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsEnv0 {
-	return &workloadidentityv1pb.JoinAttrsEnv0{
+	return workloadidentityv1pb.JoinAttrsEnv0_builder{
 		Sub:             c.Subject,
 		OrganizationId:  c.OrganizationID,
 		ProjectId:       c.ProjectID,
@@ -127,5 +127,5 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsEnv0 {
 		DeploymentType:  c.DeploymentType,
 		DeployerEmail:   c.DeployerEmail,
 		Env0Tag:         c.Env0Tag,
-	}
+	}.Build()
 }
diff --git a/lib/join/gcp/gcp.go b/lib/join/gcp/gcp.go
index 802d015877f..ee287a312a8 100644
--- a/lib/join/gcp/gcp.go
+++ b/lib/join/gcp/gcp.go
@@ -74,16 +74,16 @@ type IDTokenClaims struct {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGCP {
-	attrs := &workloadidentityv1pb.JoinAttrsGCP{
+	attrs := workloadidentityv1pb.JoinAttrsGCP_builder{
 		ServiceAccount: c.Email,
-	}
+	}.Build()
 	if c.Google.ComputeEngine.InstanceName != "" {
-		attrs.Gce = &workloadidentityv1pb.JoinAttrsGCPGCE{
+		attrs.SetGce(workloadidentityv1pb.JoinAttrsGCPGCE_builder{
 			Project: c.Google.ComputeEngine.ProjectID,
 			Zone:    c.Google.ComputeEngine.Zone,
 			Id:      c.Google.ComputeEngine.InstanceID,
 			Name:    c.Google.ComputeEngine.InstanceName,
-		}
+		}.Build())
 	}
 
 	return attrs
diff --git a/lib/join/githubactions/githubactions.go b/lib/join/githubactions/githubactions.go
index cf8fb07b09e..c94a8f7c497 100644
--- a/lib/join/githubactions/githubactions.go
+++ b/lib/join/githubactions/githubactions.go
@@ -131,7 +131,7 @@ func (c *IDTokenClaims) GetSubject() string {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitHub {
-	attrs := &workloadidentityv1pb.JoinAttrsGitHub{
+	attrs := workloadidentityv1pb.JoinAttrsGitHub_builder{
 		Sub:             c.Sub,
 		Actor:           c.Actor,
 		Environment:     c.Environment,
@@ -145,7 +145,7 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitHub {
 		RunId:           c.RunID,
 		Enterprise:      c.Enterprise,
 		EnterpriseId:    c.EnterpriseID,
-	}
+	}.Build()
 
 	return attrs
 }
diff --git a/lib/join/gitlab/gitlab.go b/lib/join/gitlab/gitlab.go
index c9b11cc6be8..df0663e694b 100644
--- a/lib/join/gitlab/gitlab.go
+++ b/lib/join/gitlab/gitlab.go
@@ -143,7 +143,7 @@ func (c *IDTokenClaims) GetSubject() string {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitLab {
-	attrs := &workloadidentityv1pb.JoinAttrsGitLab{
+	attrs := workloadidentityv1pb.JoinAttrsGitLab_builder{
 		Sub:                  c.Sub,
 		Ref:                  c.Ref,
 		RefType:              c.RefType,
@@ -160,7 +160,7 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsGitLab {
 		Sha:                  c.SHA,
 		CiConfigRefUri:       c.CIConfigRefURI,
 		CiConfigSha:          c.CIConfigSHA,
-	}
+	}.Build()
 
 	return attrs
 }
diff --git a/lib/join/iamjoin/iam.go b/lib/join/iamjoin/iam.go
index cb2dd5fc9e0..ba677f72c60 100644
--- a/lib/join/iamjoin/iam.go
+++ b/lib/join/iamjoin/iam.go
@@ -215,10 +215,10 @@ type AWSIdentity struct {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *AWSIdentity) JoinAttrs() *workloadidentityv1pb.JoinAttrsAWSIAM {
-	attrs := &workloadidentityv1pb.JoinAttrsAWSIAM{
+	attrs := workloadidentityv1pb.JoinAttrsAWSIAM_builder{
 		Account: c.Account,
 		Arn:     c.Arn,
-	}
+	}.Build()
 
 	return attrs
 }
diff --git a/lib/join/join_azuredevops_test.go b/lib/join/join_azuredevops_test.go
index 7ffbfa2d7f6..1aaa2bfad7a 100644
--- a/lib/join/join_azuredevops_test.go
+++ b/lib/join/join_azuredevops_test.go
@@ -329,26 +329,26 @@ func TestJoinAzureDevops(t *testing.T) {
 			require.NoError(t, err)
 			require.NoError(t, auth.UpsertToken(ctx, token))
 
-			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tt.tokenSpec, &joiningv1.ScopedToken{
+			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tt.tokenSpec, joiningv1.ScopedToken_builder{
 				Scope: "/test",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped_" + token.GetName(),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/test/one",
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
-			_, err = auth.CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+			_, err = auth.CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: scopedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				_, err := auth.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
+				_, err := auth.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
 					Name: scopedToken.GetMetadata().GetName(),
-				})
+				}.Build())
 				require.NoError(t, err)
 			})
 
diff --git a/lib/join/join_bound_keypair_test.go b/lib/join/join_bound_keypair_test.go
index b6ae16b2191..1531d147108 100644
--- a/lib/join/join_bound_keypair_test.go
+++ b/lib/join/join_bound_keypair_test.go
@@ -296,18 +296,18 @@ func TestJoinBoundKeypair(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	jwtCA, err := authServer.GetCertAuthority(ctx, types.CertAuthID{
@@ -1203,18 +1203,18 @@ func TestJoinBoundKeypair_GenerationCounter(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpecAndStatus(
@@ -1390,18 +1390,18 @@ func TestJoinBoundKeypair_JoinStateFailure(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpecAndStatus(
@@ -1544,18 +1544,18 @@ func TestJoinBoundKeypair_JoinStateFailureDuringRenewal(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := types.NewProvisionTokenFromSpecAndStatus(
@@ -1830,62 +1830,62 @@ func createScopedBot(t *testing.T, srv *authtest.TLSServer, adminClient *authcli
 
 	// Create a scoped role for the bot.
 	scopedSvc := adminClient.ScopedAccessServiceClient()
-	_, err := scopedSvc.CreateScopedRole(t.Context(), &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err := scopedSvc.CreateScopedRole(t.Context(), scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped-example",
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/test"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create the scoped bot.
-	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
 			Scope:   "/test",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test-scoped",
-			},
+			}.Build(),
 			Spec: &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Create a scoped role assignment for the bot.
-	resp, err := srv.Auth().ScopedAccess().CreateScopedRoleAssignment(t.Context(), &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	resp, err := srv.Auth().ScopedAccess().CreateScopedRoleAssignment(t.Context(), scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.NewString(),
-			},
+			}.Build(),
 			SubKind: scopedaccess.SubKindDynamic,
 			Scope:   "/test",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "test-scoped",
 				BotScope: "/test",
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "scoped-example", Scope: "/test"},
+					scopedaccessv1.Assignment_builder{Role: "scoped-example", Scope: "/test"}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
-		_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := srv.Auth().ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    resp.GetAssignment().GetMetadata().GetName(),
 			SubKind: resp.GetAssignment().GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 	}, time.Second*10, 100*time.Millisecond)
 }
@@ -1911,45 +1911,45 @@ func TestJoinBoundKeypair_ScopedToken(t *testing.T) {
 	adminClient, err := srv.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
 
-	_, err = adminClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	_, err = adminClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{"example"},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	createScopedBot(t, srv, adminClient)
 
-	scopedToken := &joiningv1.ScopedToken{
+	scopedToken := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
 		Scope:   "/test",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "example-token",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			JoinMethod: string(types.JoinMethodBoundKeypair),
 			Roles:      []string{string(types.RoleBot)},
 			UsageMode:  joining.TokenUsageModeBot,
 			BotName:    "test-scoped",
 			BotScope:   "/test",
-			BoundKeypair: &joiningv1.BoundKeypairSpec{
-				Onboarding: &joiningv1.BoundKeypairSpec_OnboardingSpec{
+			BoundKeypair: joiningv1.BoundKeypairSpec_builder{
+				Onboarding: joiningv1.BoundKeypairSpec_OnboardingSpec_builder{
 					InitialPublicKey: correctPublicKey,
-				},
-				Recovery: &joiningv1.BoundKeypairSpec_RecoverySpec{
+				}.Build(),
+				Recovery: joiningv1.BoundKeypairSpec_RecoverySpec_builder{
 					Limit: 2,
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	_, err = adminClient.CreateScopedToken(ctx, scopedToken)
 	require.NoError(t, err)
@@ -1978,10 +1978,10 @@ func TestJoinBoundKeypair_ScopedToken(t *testing.T) {
 	require.Equal(t, uint64(1), generation)
 
 	// The BotInstance should have the scope set.
-	botInstance, err := adminClient.BotInstanceServiceClient().GetBotInstance(ctx, &machineidv1pb.GetBotInstanceRequest{
+	botInstance, err := adminClient.BotInstanceServiceClient().GetBotInstance(ctx, machineidv1pb.GetBotInstanceRequest_builder{
 		BotName:    "test-scoped",
 		InstanceId: firstInstance,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.Equal(t, "/test", botInstance.GetScope())
 
diff --git a/lib/join/join_ec2_test.go b/lib/join/join_ec2_test.go
index b5bc2e0910c..015ef4a85aa 100644
--- a/lib/join/join_ec2_test.go
+++ b/lib/join/join_ec2_test.go
@@ -482,26 +482,26 @@ func TestJoinEC2(t *testing.T) {
 			err = testServer.Auth().UpsertToken(t.Context(), token)
 			require.NoError(t, err)
 
-			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, &joiningv1.ScopedToken{
+			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, joiningv1.ScopedToken_builder{
 				Scope: "/test",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped_" + token.GetName(),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/test/one",
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
-			_, err = testServer.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+			_, err = testServer.Auth().CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: scopedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				_, err := testServer.Auth().DeleteScopedToken(t.Context(), &joiningv1.DeleteScopedTokenRequest{
+				_, err := testServer.Auth().DeleteScopedToken(t.Context(), joiningv1.DeleteScopedTokenRequest_builder{
 					Name: scopedToken.GetMetadata().GetName(),
-				})
+				}.Build())
 				require.NoError(t, err)
 			})
 
diff --git a/lib/join/join_gcp_test.go b/lib/join/join_gcp_test.go
index 6ce8864bd80..992ce7a35b3 100644
--- a/lib/join/join_gcp_test.go
+++ b/lib/join/join_gcp_test.go
@@ -226,26 +226,26 @@ func TestJoinGCP(t *testing.T) {
 			require.NoError(t, auth.CreateToken(ctx, token))
 			tc.request.Token = tc.name
 
-			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, &joiningv1.ScopedToken{
+			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, joiningv1.ScopedToken_builder{
 				Scope: "/test",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped_" + token.GetName(),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/test/one",
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
-			_, err = auth.CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+			_, err = auth.CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: scopedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				_, err := auth.DeleteScopedToken(t.Context(), &joiningv1.DeleteScopedTokenRequest{
+				_, err := auth.DeleteScopedToken(t.Context(), joiningv1.DeleteScopedTokenRequest_builder{
 					Name: scopedToken.GetMetadata().GetName(),
-				})
+				}.Build())
 				require.NoError(t, err)
 			})
 
diff --git a/lib/join/join_iam_test.go b/lib/join/join_iam_test.go
index e2c084d88dd..29c1f4b6bb9 100644
--- a/lib/join/join_iam_test.go
+++ b/lib/join/join_iam_test.go
@@ -866,26 +866,26 @@ func testIAMJoin(t *testing.T, tc *iamJoinTestCase) {
 		assert.NoError(t, tc.authServer.Auth().DeleteToken(ctx, token.GetName()))
 	})
 
-	scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, &joiningv1.ScopedToken{
+	scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(tc.tokenSpec, joiningv1.ScopedToken_builder{
 		Scope: "/test",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "scoped_" + token.GetName(),
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test/one",
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	_, err = tc.authServer.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+	_, err = tc.authServer.Auth().CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 		Token: scopedToken,
-	})
+	}.Build())
 	require.NoError(t, err)
 	t.Cleanup(func() {
-		_, err := tc.authServer.Auth().DeleteScopedToken(t.Context(), &joiningv1.DeleteScopedTokenRequest{
+		_, err := tc.authServer.Auth().DeleteScopedToken(t.Context(), joiningv1.DeleteScopedTokenRequest_builder{
 			Name: scopedToken.GetMetadata().GetName(),
-		})
+		}.Build())
 		require.NoError(t, err)
 	})
 
diff --git a/lib/join/join_kubernetes_test.go b/lib/join/join_kubernetes_test.go
index b26057ea701..e8efb9f4ad4 100644
--- a/lib/join/join_kubernetes_test.go
+++ b/lib/join/join_kubernetes_test.go
@@ -286,18 +286,18 @@ func TestJoinKubernetes(t *testing.T) {
 	for _, pt := range []types.ProvisionToken{implicitInClusterPT, explicitInClusterPT, staticJWKSPT, oidcPT, wildcardInClusterPT, wildcardStaticJWKSPT, wildcardOIDCPT, exactInClusterPT, namespaceOnlyInClusterPT, combinedInClusterPT, combinedStrictInClusterPT} {
 		ptv2, ok := pt.(*types.ProvisionTokenV2)
 		require.True(t, ok, "expected provision token to be types.ProvisionTokenSpecV2")
-		scoped, err := jointest.ScopedTokenFromProvisionTokenSpec(ptv2.Spec, &joiningv1.ScopedToken{
+		scoped, err := jointest.ScopedTokenFromProvisionTokenSpec(ptv2.Spec, joiningv1.ScopedToken_builder{
 			Scope: "/test",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "scoped_" + pt.GetName(),
-			},
-			Spec: &joiningv1.ScopedTokenSpec{
+			}.Build(),
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				AssignedScope: "/test/one",
 				UsageMode:     string(joining.TokenUsageModeUnlimited),
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
-		_, err = auth.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: scoped})
+		_, err = auth.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{Token: scoped}.Build())
 		require.NoError(t, err)
 	}
 
diff --git a/lib/join/join_test.go b/lib/join/join_test.go
index 38265041e84..7ed29aee1dc 100644
--- a/lib/join/join_test.go
+++ b/lib/join/join_test.go
@@ -94,38 +94,38 @@ func TestJoinToken(t *testing.T) {
 	require.NoError(t, authService.Auth().UpsertToken(t.Context(), token2))
 
 	// generate scoped tokens
-	scopedToken1 := &joiningv1.ScopedToken{
+	scopedToken1 := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
 		Scope:   "/aa",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "scoped1",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/aa/bb",
 			Roles:         []string{types.RoleNode.String()},
 			JoinMethod:    string(types.JoinMethodToken),
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
+		}.Build(),
+	}.Build()
 	scopedToken2 := proto.CloneOf(scopedToken1)
-	scopedToken2.Spec.AssignedScope = "/aa/cc"
-	scopedToken2.Metadata.Name = "scoped2"
+	scopedToken2.GetSpec().SetAssignedScope("/aa/cc")
+	scopedToken2.GetMetadata().SetName("scoped2")
 
 	scopedToken3 := proto.CloneOf(scopedToken1)
-	scopedToken3.Metadata.Name = "scoped3"
+	scopedToken3.GetMetadata().SetName("scoped3")
 
 	singleUseToken := proto.CloneOf(scopedToken1)
-	singleUseToken.Spec.UsageMode = string(joining.TokenUsageModeSingle)
-	singleUseToken.Metadata.Name = "scoped-single-use-1"
+	singleUseToken.GetSpec().SetUsageMode(string(joining.TokenUsageModeSingle))
+	singleUseToken.GetMetadata().SetName("scoped-single-use-1")
 
 	for _, tok := range []*joiningv1.ScopedToken{scopedToken1, scopedToken2, scopedToken3, singleUseToken} {
-		_, err = authService.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+		_, err = authService.Auth().CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 			Token: tok,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -390,7 +390,7 @@ func TestJoinToken(t *testing.T) {
 		{
 			name: "join after upsert modifies assigned scope",
 			updateTokenFunc: func(token *joiningv1.ScopedToken) {
-				token.Spec.AssignedScope = "/aa/cc"
+				token.GetSpec().SetAssignedScope("/aa/cc")
 			},
 			assertRejoinExpectation: func(t *testing.T, identity *state.Identity, err error) {
 				require.Error(t, err)
@@ -399,7 +399,7 @@ func TestJoinToken(t *testing.T) {
 		{
 			name: "join after upsert preserves assigned scope",
 			updateTokenFunc: func(token *joiningv1.ScopedToken) {
-				token.Metadata.Labels = map[string]string{"env": "updated"}
+				token.GetMetadata().SetLabels(map[string]string{"env": "updated"})
 			},
 			assertRejoinExpectation: func(t *testing.T, identity *state.Identity, err error) {
 				require.NoError(t, err)
@@ -410,26 +410,26 @@ func TestJoinToken(t *testing.T) {
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
-			token := &joiningv1.ScopedToken{
+			token := joiningv1.ScopedToken_builder{
 				Kind:    types.KindScopedToken,
 				Version: types.V1,
 				Scope:   "/aa",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: fmt.Sprintf("upsertcheck%d", i),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/aa/bb",
 					Roles:         []string{types.RoleNode.String()},
 					JoinMethod:    string(types.JoinMethodToken),
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-				Status: &joiningv1.ScopedTokenStatus{
+				}.Build(),
+				Status: joiningv1.ScopedTokenStatus_builder{
 					Secret: "somesecret",
-				},
-			}
-			_, err := authService.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+				}.Build(),
+			}.Build()
+			_, err := authService.Auth().CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: token,
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			// Join with the original assigned scope.
@@ -443,17 +443,17 @@ func TestJoinToken(t *testing.T) {
 			require.Equal(t, "/aa/bb", identity.AgentScope)
 
 			// Change and upsert token
-			fetchedRes, err := authService.Auth().GetScopedToken(t.Context(), &joiningv1.GetScopedTokenRequest{
+			fetchedRes, err := authService.Auth().GetScopedToken(t.Context(), joiningv1.GetScopedTokenRequest_builder{
 				Name:       token.GetMetadata().GetName(),
 				WithSecret: true,
-			})
+			}.Build())
 			require.NoError(t, err)
 			updatedToken := proto.CloneOf(fetchedRes.GetToken())
 			tc.updateTokenFunc(updatedToken)
 
-			_, err = authService.Auth().UpsertScopedToken(t.Context(), &joiningv1.UpsertScopedTokenRequest{
+			_, err = authService.Auth().UpsertScopedToken(t.Context(), joiningv1.UpsertScopedTokenRequest_builder{
 				Token: updatedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 
 			// Attempt to rejoin using the identity from the first join.
diff --git a/lib/join/jointest/scoped_token.go b/lib/join/jointest/scoped_token.go
index c7f3febf07f..333f6df4799 100644
--- a/lib/join/jointest/scoped_token.go
+++ b/lib/join/jointest/scoped_token.go
@@ -43,78 +43,78 @@ func ScopedTokenFromProvisionTokenSpec(base types.ProvisionTokenSpecV2, override
 		}
 	}
 
-	scopedToken := &joiningv1.ScopedToken{
+	scopedToken := joiningv1.ScopedToken_builder{
 		Kind:     types.KindScopedToken,
 		Version:  types.V1,
 		Scope:    override.GetScope(),
 		Metadata: override.GetMetadata(),
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: override.GetSpec().GetAssignedScope(),
 			JoinMethod:    cmp.Or(override.GetSpec().GetJoinMethod(), string(base.JoinMethod)),
 			Roles:         roles,
 			UsageMode:     override.GetSpec().GetUsageMode(),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	switch base.JoinMethod {
 	case types.JoinMethodEC2:
 		allow := make([]*joiningv1.AWS_Rule, len(base.Allow))
 		for i, rule := range base.Allow {
-			allow[i] = &joiningv1.AWS_Rule{
+			allow[i] = joiningv1.AWS_Rule_builder{
 				AwsAccount:        rule.AWSAccount,
 				AwsRegions:        rule.AWSRegions,
 				AwsRole:           rule.AWSRole,
 				AwsArn:            rule.AWSARN,
 				AwsOrganizationId: rule.AWSOrganizationID,
-			}
+			}.Build()
 		}
-		scopedToken.Spec.Aws = &joiningv1.AWS{
+		scopedToken.GetSpec().SetAws(joiningv1.AWS_builder{
 			Allow:  allow,
 			IidTtl: base.AWSIIDTTL.Duration().String(),
-		}
+		}.Build())
 	case types.JoinMethodIAM:
 		allow := make([]*joiningv1.AWS_Rule, len(base.Allow))
 		for i, rule := range base.Allow {
-			allow[i] = &joiningv1.AWS_Rule{
+			allow[i] = joiningv1.AWS_Rule_builder{
 				AwsAccount:        rule.AWSAccount,
 				AwsRegions:        rule.AWSRegions,
 				AwsRole:           rule.AWSRole,
 				AwsArn:            rule.AWSARN,
 				AwsOrganizationId: rule.AWSOrganizationID,
-			}
+			}.Build()
 		}
-		scopedToken.Spec.Aws = &joiningv1.AWS{
+		scopedToken.GetSpec().SetAws(joiningv1.AWS_builder{
 			Allow:       allow,
 			Integration: base.Integration,
-		}
+		}.Build())
 	case types.JoinMethodGCP:
 		allow := make([]*joiningv1.GCP_Rule, len(base.GCP.Allow))
 		for i, rule := range base.GCP.Allow {
-			allow[i] = &joiningv1.GCP_Rule{
+			allow[i] = joiningv1.GCP_Rule_builder{
 				ProjectIds:      rule.ProjectIDs,
 				Locations:       rule.Locations,
 				ServiceAccounts: rule.ServiceAccounts,
-			}
+			}.Build()
 		}
-		scopedToken.Spec.Gcp = &joiningv1.GCP{
+		scopedToken.GetSpec().SetGcp(joiningv1.GCP_builder{
 			Allow: allow,
-		}
+		}.Build())
 	case types.JoinMethodAzure:
 		allow := make([]*joiningv1.Azure_Rule, len(base.Azure.Allow))
 		for i, rule := range base.Azure.Allow {
-			allow[i] = &joiningv1.Azure_Rule{
+			allow[i] = joiningv1.Azure_Rule_builder{
 				Tenant:         rule.Tenant,
 				Subscription:   rule.Subscription,
 				ResourceGroups: rule.ResourceGroups,
-			}
+			}.Build()
 		}
-		scopedToken.Spec.Azure = &joiningv1.Azure{
+		scopedToken.GetSpec().SetAzure(joiningv1.Azure_builder{
 			Allow: allow,
-		}
+		}.Build())
 	case types.JoinMethodAzureDevops:
 		allow := make([]*joiningv1.AzureDevops_Rule, len(base.AzureDevops.Allow))
 		for i, rule := range base.AzureDevops.Allow {
-			allow[i] = &joiningv1.AzureDevops_Rule{
+			allow[i] = joiningv1.AzureDevops_Rule_builder{
 				Sub:               rule.Sub,
 				ProjectName:       rule.ProjectName,
 				PipelineName:      rule.PipelineName,
@@ -123,59 +123,59 @@ func ScopedTokenFromProvisionTokenSpec(base types.ProvisionTokenSpecV2, override
 				RepositoryUri:     rule.RepositoryURI,
 				RepositoryVersion: rule.RepositoryVersion,
 				RepositoryRef:     rule.RepositoryRef,
-			}
+			}.Build()
 		}
-		scopedToken.Spec.AzureDevops = &joiningv1.AzureDevops{
+		scopedToken.GetSpec().SetAzureDevops(joiningv1.AzureDevops_builder{
 			Allow:          allow,
 			OrganizationId: base.AzureDevops.OrganizationID,
-		}
+		}.Build())
 	case types.JoinMethodOracle:
 		allow := make([]*joiningv1.Oracle_Rule, len(base.Oracle.Allow))
 		for i, rule := range base.Oracle.Allow {
-			allow[i] = &joiningv1.Oracle_Rule{
+			allow[i] = joiningv1.Oracle_Rule_builder{
 				Tenancy:            rule.Tenancy,
 				ParentCompartments: rule.ParentCompartments,
 				Regions:            rule.Regions,
 				Instances:          rule.Instances,
-			}
+			}.Build()
 		}
-		scopedToken.Spec.Oracle = &joiningv1.Oracle{
+		scopedToken.GetSpec().SetOracle(joiningv1.Oracle_builder{
 			Allow: allow,
-		}
+		}.Build())
 	case types.JoinMethodKubernetes:
 		if base.Kubernetes == nil {
 			return nil, trace.BadParameter("kubernetes configuration must be defined for kubernetes join method")
 		}
 		allow := make([]*joiningv1.Kubernetes_Rule, len(base.Kubernetes.Allow))
 		for i, rule := range base.Kubernetes.Allow {
-			allow[i] = &joiningv1.Kubernetes_Rule{
+			allow[i] = joiningv1.Kubernetes_Rule_builder{
 				ServiceAccount:          rule.ServiceAccount,
 				ServiceAccountNamespace: rule.ServiceAccountNamespace,
 				ServiceAccountName:      rule.ServiceAccountName,
-			}
+			}.Build()
 		}
 
 		var staticJWKS *joiningv1.Kubernetes_StaticJWKSConfig
 		if base.Kubernetes.StaticJWKS != nil {
-			staticJWKS = &joiningv1.Kubernetes_StaticJWKSConfig{
+			staticJWKS = joiningv1.Kubernetes_StaticJWKSConfig_builder{
 				Jwks: base.Kubernetes.StaticJWKS.JWKS,
-			}
+			}.Build()
 		}
 
 		var oidc *joiningv1.Kubernetes_OIDCConfig
 		if base.Kubernetes.OIDC != nil {
-			oidc = &joiningv1.Kubernetes_OIDCConfig{
+			oidc = joiningv1.Kubernetes_OIDCConfig_builder{
 				Issuer:                  base.Kubernetes.OIDC.Issuer,
 				InsecureAllowHttpIssuer: base.Kubernetes.OIDC.InsecureAllowHTTPIssuer,
-			}
+			}.Build()
 		}
 
-		scopedToken.Spec.Kubernetes = &joiningv1.Kubernetes{
+		scopedToken.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 			Allow:      allow,
 			Type:       string(base.Kubernetes.Type),
 			StaticJwks: staticJWKS,
 			Oidc:       oidc,
-		}
+		}.Build())
 	default:
 		return nil, trace.BadParameter("unsupported join method %q", base.JoinMethod)
 	}
diff --git a/lib/join/joinv1/forwarding_server.go b/lib/join/joinv1/forwarding_server.go
index 23809754b0e..4e80d8e1427 100644
--- a/lib/join/joinv1/forwarding_server.go
+++ b/lib/join/joinv1/forwarding_server.go
@@ -58,10 +58,10 @@ func (s *forwardingServer) Join(serverStream grpc.BidiStreamingServer[joinv1.Joi
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	proxySuppliedParams := &joinv1.ClientInit_ProxySuppliedParams{
+	proxySuppliedParams := joinv1.ClientInit_ProxySuppliedParams_builder{
 		RemoteAddr:    peerInfo.remoteAddr,
 		ClientVersion: peerInfo.clientVersion,
-	}
+	}.Build()
 
 	ctx, cancel := context.WithTimeoutCause(serverStream.Context(), joinRequestTimeout,
 		trace.LimitExceeded(
@@ -131,8 +131,8 @@ func (s *forwardingServer) forwardRequests(
 		}
 		if _, ok := req.Payload.(*joinv1.JoinRequest_ClientInit); ok {
 			clientInit := req.Payload.(*joinv1.JoinRequest_ClientInit).ClientInit
-			clientInit.ForwardedByProxy = true
-			clientInit.ProxySuppliedParameters = proxySuppliedParams
+			clientInit.SetForwardedByProxy(true)
+			clientInit.SetProxySuppliedParameters(proxySuppliedParams)
 		}
 		if err := clientStream.Send(req); err != nil {
 			return trace.Wrap(err)
diff --git a/lib/join/joinv1/messages.go b/lib/join/joinv1/messages.go
index ea355200cc0..da3d141850b 100644
--- a/lib/join/joinv1/messages.go
+++ b/lib/join/joinv1/messages.go
@@ -27,31 +27,31 @@ import (
 
 // requestToMessage converts a gRPC JoinRequest into a protocol-agnostic [messages.Request].
 func requestToMessage(req *joinv1.JoinRequest) (messages.Request, error) {
-	switch msg := req.GetPayload().(type) {
-	case *joinv1.JoinRequest_ClientInit:
-		return clientInitToMessage(msg.ClientInit), nil
-	case *joinv1.JoinRequest_TokenInit:
-		return tokenInitToMessage(msg.TokenInit)
-	case *joinv1.JoinRequest_BoundKeypairInit:
-		return boundKeypairInitToMessage(msg.BoundKeypairInit)
-	case *joinv1.JoinRequest_IamInit:
-		return iamInitToMessage(msg.IamInit)
-	case *joinv1.JoinRequest_Ec2Init:
-		return ec2InitToMessage(msg.Ec2Init)
-	case *joinv1.JoinRequest_OidcInit:
-		return oidcInitToMessage(msg.OidcInit)
-	case *joinv1.JoinRequest_OracleInit:
-		return oracleInitToMessage(msg.OracleInit)
-	case *joinv1.JoinRequest_TpmInit:
-		return tpmInitToMessage(msg.TpmInit)
-	case *joinv1.JoinRequest_AzureInit:
-		return azureInitToMessage(msg.AzureInit)
-	case *joinv1.JoinRequest_Solution:
-		return challengeSolutionToMessage(msg.Solution)
-	case *joinv1.JoinRequest_GivingUp:
-		return givingUpToMessage(msg.GivingUp), nil
+	switch msg := req.WhichPayload(); msg {
+	case joinv1.JoinRequest_ClientInit_case:
+		return clientInitToMessage(req.GetClientInit()), nil
+	case joinv1.JoinRequest_TokenInit_case:
+		return tokenInitToMessage(req.GetTokenInit())
+	case joinv1.JoinRequest_BoundKeypairInit_case:
+		return boundKeypairInitToMessage(req.GetBoundKeypairInit())
+	case joinv1.JoinRequest_IamInit_case:
+		return iamInitToMessage(req.GetIamInit())
+	case joinv1.JoinRequest_Ec2Init_case:
+		return ec2InitToMessage(req.GetEc2Init())
+	case joinv1.JoinRequest_OidcInit_case:
+		return oidcInitToMessage(req.GetOidcInit())
+	case joinv1.JoinRequest_OracleInit_case:
+		return oracleInitToMessage(req.GetOracleInit())
+	case joinv1.JoinRequest_TpmInit_case:
+		return tpmInitToMessage(req.GetTpmInit())
+	case joinv1.JoinRequest_AzureInit_case:
+		return azureInitToMessage(req.GetAzureInit())
+	case joinv1.JoinRequest_Solution_case:
+		return challengeSolutionToMessage(req.GetSolution())
+	case joinv1.JoinRequest_GivingUp_case:
+		return givingUpToMessage(req.GetGivingUp()), nil
 	default:
-		return nil, trace.BadParameter("unrecognized join request message type %T", msg)
+		return nil, trace.BadParameter("unrecognized join request message type %v", msg)
 	}
 }
 
@@ -190,17 +190,17 @@ func clientInitToMessage(req *joinv1.ClientInit) *messages.ClientInit {
 }
 
 func clientInitFromMessage(msg *messages.ClientInit) *joinv1.ClientInit {
-	req := &joinv1.ClientInit{
+	req := joinv1.ClientInit_builder{
 		JoinMethod:       msg.JoinMethod,
 		TokenName:        msg.TokenName,
 		SystemRole:       msg.SystemRole,
 		ForwardedByProxy: msg.ForwardedByProxy,
-	}
+	}.Build()
 	if proxySuppliedParams := msg.ProxySuppliedParams; proxySuppliedParams != nil {
-		req.ProxySuppliedParameters = &joinv1.ClientInit_ProxySuppliedParams{
+		req.SetProxySuppliedParameters(joinv1.ClientInit_ProxySuppliedParams_builder{
 			RemoteAddr:    proxySuppliedParams.RemoteAddr,
 			ClientVersion: proxySuppliedParams.ClientVersion,
-		}
+		}.Build())
 	}
 	return req
 }
@@ -221,21 +221,21 @@ func tokenInitFromMessage(msg *messages.TokenInit) (*joinv1.TokenInit, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.TokenInit{
+	return joinv1.TokenInit_builder{
 		ClientParams: clientParams,
 		Secret:       msg.Secret,
-	}, nil
+	}.Build(), nil
 }
 
 func clientParamsToMessage(req *joinv1.ClientParams) (messages.ClientParams, error) {
 	var msg messages.ClientParams
-	switch payload := req.GetPayload().(type) {
-	case *joinv1.ClientParams_HostParams:
-		msg.HostParams = hostParamsToMessage(payload.HostParams)
-	case *joinv1.ClientParams_BotParams:
-		msg.BotParams = botParamsToMessage(payload.BotParams)
+	switch payload := req.WhichPayload(); payload {
+	case joinv1.ClientParams_HostParams_case:
+		msg.HostParams = hostParamsToMessage(req.GetHostParams())
+	case joinv1.ClientParams_BotParams_case:
+		msg.BotParams = botParamsToMessage(req.GetBotParams())
 	default:
-		return msg, trace.BadParameter("unrecognized ClientParams payload type %T", payload)
+		return msg, trace.BadParameter("unrecognized ClientParams payload type %v", payload)
 	}
 	return msg, nil
 }
@@ -267,19 +267,19 @@ func hostParamsToMessage(req *joinv1.HostParams) *messages.HostParams {
 }
 
 func hostParamsFromMessage(msg *messages.HostParams) *joinv1.HostParams {
-	return &joinv1.HostParams{
+	return joinv1.HostParams_builder{
 		PublicKeys:           publicKeysFromMessage(msg.PublicKeys),
 		HostName:             msg.HostName,
 		AdditionalPrincipals: msg.AdditionalPrincipals,
 		DnsNames:             msg.DNSNames,
-	}
+	}.Build()
 }
 
 func botParamsToMessage(req *joinv1.BotParams) *messages.BotParams {
 	msg := &messages.BotParams{
 		PublicKeys: publicKeysToMessage(req.GetPublicKeys()),
 	}
-	if req.Expires != nil {
+	if req.HasExpires() {
 		expires := req.GetExpires().AsTime()
 		msg.Expires = &expires
 	}
@@ -287,11 +287,11 @@ func botParamsToMessage(req *joinv1.BotParams) *messages.BotParams {
 }
 
 func botParamsFromMessage(msg *messages.BotParams) *joinv1.BotParams {
-	req := &joinv1.BotParams{
+	req := joinv1.BotParams_builder{
 		PublicKeys: publicKeysFromMessage(msg.PublicKeys),
-	}
+	}.Build()
 	if msg.Expires != nil {
-		req.Expires = timestamppb.New(*msg.Expires)
+		req.SetExpires(timestamppb.New(*msg.Expires))
 	}
 	return req
 }
@@ -304,28 +304,28 @@ func publicKeysToMessage(req *joinv1.PublicKeys) messages.PublicKeys {
 }
 
 func publicKeysFromMessage(msg messages.PublicKeys) *joinv1.PublicKeys {
-	return &joinv1.PublicKeys{
+	return joinv1.PublicKeys_builder{
 		PublicTlsKey: msg.PublicTLSKey,
 		PublicSshKey: msg.PublicSSHKey,
-	}
+	}.Build()
 }
 
 func challengeSolutionToMessage(req *joinv1.ChallengeSolution) (messages.Request, error) {
-	switch payload := req.GetPayload().(type) {
-	case *joinv1.ChallengeSolution_BoundKeypairChallengeSolution:
-		return boundKeypairChallengeSolutionToMessage(payload.BoundKeypairChallengeSolution), nil
-	case *joinv1.ChallengeSolution_BoundKeypairRotationResponse:
-		return boundKeypairRotationResponseToMessage(payload.BoundKeypairRotationResponse), nil
-	case *joinv1.ChallengeSolution_IamChallengeSolution:
-		return iamChallengeSolutionToMessage(payload.IamChallengeSolution), nil
-	case *joinv1.ChallengeSolution_OracleChallengeSolution:
-		return oracleChallengeSolutionToMessage(payload.OracleChallengeSolution), nil
-	case *joinv1.ChallengeSolution_TpmSolution:
-		return tpmSolutionToMessage(payload.TpmSolution), nil
-	case *joinv1.ChallengeSolution_AzureChallengeSolution:
-		return azureChallengeSolutionToMessage(payload.AzureChallengeSolution), nil
+	switch payload := req.WhichPayload(); payload {
+	case joinv1.ChallengeSolution_BoundKeypairChallengeSolution_case:
+		return boundKeypairChallengeSolutionToMessage(req.GetBoundKeypairChallengeSolution()), nil
+	case joinv1.ChallengeSolution_BoundKeypairRotationResponse_case:
+		return boundKeypairRotationResponseToMessage(req.GetBoundKeypairRotationResponse()), nil
+	case joinv1.ChallengeSolution_IamChallengeSolution_case:
+		return iamChallengeSolutionToMessage(req.GetIamChallengeSolution()), nil
+	case joinv1.ChallengeSolution_OracleChallengeSolution_case:
+		return oracleChallengeSolutionToMessage(req.GetOracleChallengeSolution()), nil
+	case joinv1.ChallengeSolution_TpmSolution_case:
+		return tpmSolutionToMessage(req.GetTpmSolution()), nil
+	case joinv1.ChallengeSolution_AzureChallengeSolution_case:
+		return azureChallengeSolutionToMessage(req.GetAzureChallengeSolution()), nil
 	default:
-		return nil, trace.BadParameter("unrecognized challenge solution message type %T", payload)
+		return nil, trace.BadParameter("unrecognized challenge solution message type %v", payload)
 	}
 }
 
@@ -374,15 +374,15 @@ func challengeSolutionFromMessage(msg messages.Request) (*joinv1.ChallengeSoluti
 
 // responseToMessage converts a gRPC JoinResponse into a protocol-agnostic [messages.Response].
 func responseToMessage(resp *joinv1.JoinResponse) (messages.Response, error) {
-	switch typedResp := resp.GetPayload().(type) {
-	case *joinv1.JoinResponse_Init:
-		return serverInitToMessage(typedResp.Init)
-	case *joinv1.JoinResponse_Challenge:
-		return challengeToMessage(typedResp.Challenge)
-	case *joinv1.JoinResponse_Result:
-		return resultToMessage(typedResp.Result)
+	switch typedResp := resp.WhichPayload(); typedResp {
+	case joinv1.JoinResponse_Init_case:
+		return serverInitToMessage(resp.GetInit())
+	case joinv1.JoinResponse_Challenge_case:
+		return challengeToMessage(resp.GetChallenge())
+	case joinv1.JoinResponse_Result_case:
+		return resultToMessage(resp.GetResult())
 	default:
-		return nil, trace.BadParameter("unrecognized join response message type %T", typedResp)
+		return nil, trace.BadParameter("unrecognized join response message type %v", typedResp)
 	}
 }
 
@@ -412,25 +412,21 @@ func responseFromMessage(msg messages.Response) (*joinv1.JoinResponse, error) {
 			},
 		}, nil
 	case *messages.HostResult:
-		return &joinv1.JoinResponse{
-			Payload: &joinv1.JoinResponse_Result{
-				Result: &joinv1.Result{
-					Payload: &joinv1.Result_HostResult{
-						HostResult: hostResultFromMessage(typedMsg),
-					},
+		return joinv1.JoinResponse_builder{
+			Result: &joinv1.Result{
+				Payload: &joinv1.Result_HostResult{
+					HostResult: hostResultFromMessage(typedMsg),
 				},
 			},
-		}, nil
+		}.Build(), nil
 	case *messages.BotResult:
-		return &joinv1.JoinResponse{
-			Payload: &joinv1.JoinResponse_Result{
-				Result: &joinv1.Result{
-					Payload: &joinv1.Result_BotResult{
-						BotResult: botResultFromMessage(typedMsg),
-					},
+		return joinv1.JoinResponse_builder{
+			Result: &joinv1.Result{
+				Payload: &joinv1.Result_BotResult{
+					BotResult: botResultFromMessage(typedMsg),
 				},
 			},
-		}, nil
+		}.Build(), nil
 	default:
 		return nil, trace.BadParameter("unrecognized join response message type %T", msg)
 	}
@@ -448,28 +444,28 @@ func serverInitToMessage(resp *joinv1.ServerInit) (*messages.ServerInit, error)
 }
 
 func serverInitFromMessage(msg *messages.ServerInit) *joinv1.ServerInit {
-	return &joinv1.ServerInit{
+	return joinv1.ServerInit_builder{
 		JoinMethod:              msg.JoinMethod,
 		SignatureAlgorithmSuite: types.SignatureAlgorithmSuiteToString(msg.SignatureAlgorithmSuite),
-	}
+	}.Build()
 }
 
 func challengeToMessage(resp *joinv1.Challenge) (messages.Response, error) {
-	switch payload := resp.GetPayload().(type) {
-	case *joinv1.Challenge_BoundKeypairChallenge:
-		return boundKeypairChallengeToMessage(payload.BoundKeypairChallenge), nil
-	case *joinv1.Challenge_BoundKeypairRotationRequest:
-		return boundKeypairRotationRequestToMessage(payload.BoundKeypairRotationRequest), nil
-	case *joinv1.Challenge_IamChallenge:
-		return iamChallengeToMessage(payload.IamChallenge), nil
-	case *joinv1.Challenge_OracleChallenge:
-		return oracleChallengeToMessage(payload.OracleChallenge), nil
-	case *joinv1.Challenge_TpmEncryptedCredential:
-		return tpmEncryptedCredentialToMessage(payload.TpmEncryptedCredential), nil
-	case *joinv1.Challenge_AzureChallenge:
-		return azureChallengeToMessage(payload.AzureChallenge), nil
+	switch payload := resp.WhichPayload(); payload {
+	case joinv1.Challenge_BoundKeypairChallenge_case:
+		return boundKeypairChallengeToMessage(resp.GetBoundKeypairChallenge()), nil
+	case joinv1.Challenge_BoundKeypairRotationRequest_case:
+		return boundKeypairRotationRequestToMessage(resp.GetBoundKeypairRotationRequest()), nil
+	case joinv1.Challenge_IamChallenge_case:
+		return iamChallengeToMessage(resp.GetIamChallenge()), nil
+	case joinv1.Challenge_OracleChallenge_case:
+		return oracleChallengeToMessage(resp.GetOracleChallenge()), nil
+	case joinv1.Challenge_TpmEncryptedCredential_case:
+		return tpmEncryptedCredentialToMessage(resp.GetTpmEncryptedCredential()), nil
+	case joinv1.Challenge_AzureChallenge_case:
+		return azureChallengeToMessage(resp.GetAzureChallenge()), nil
 	default:
-		return nil, trace.BadParameter("unrecognized challenge payload type %T", payload)
+		return nil, trace.BadParameter("unrecognized challenge payload type %v", payload)
 	}
 }
 
@@ -517,13 +513,13 @@ func challengeFromMessage(resp messages.Response) (*joinv1.Challenge, error) {
 }
 
 func resultToMessage(resp *joinv1.Result) (messages.Response, error) {
-	switch payload := resp.GetPayload().(type) {
-	case *joinv1.Result_HostResult:
-		return hostResultToMessage(payload.HostResult), nil
-	case *joinv1.Result_BotResult:
-		return botResultToMessage(payload.BotResult), nil
+	switch payload := resp.WhichPayload(); payload {
+	case joinv1.Result_HostResult_case:
+		return hostResultToMessage(resp.GetHostResult()), nil
+	case joinv1.Result_BotResult_case:
+		return botResultToMessage(resp.GetBotResult()), nil
 	default:
-		return nil, trace.BadParameter("unrecognized result payload type %T", payload)
+		return nil, trace.BadParameter("unrecognized result payload type %v", payload)
 	}
 }
 
@@ -537,12 +533,12 @@ func hostResultToMessage(resp *joinv1.HostResult) *messages.HostResult {
 }
 
 func hostResultFromMessage(msg *messages.HostResult) *joinv1.HostResult {
-	return &joinv1.HostResult{
+	return joinv1.HostResult_builder{
 		Certificates:       certificatesFromMessage(&msg.Certificates),
 		HostId:             msg.HostID,
 		ImmutableLabels:    msg.ImmutableLabels,
 		BoundKeypairResult: boundKeypairResultFromMessage(msg.BoundKeypairResult),
-	}
+	}.Build()
 }
 
 func botResultToMessage(resp *joinv1.BotResult) *messages.BotResult {
@@ -553,10 +549,10 @@ func botResultToMessage(resp *joinv1.BotResult) *messages.BotResult {
 }
 
 func botResultFromMessage(msg *messages.BotResult) *joinv1.BotResult {
-	return &joinv1.BotResult{
+	return joinv1.BotResult_builder{
 		Certificates:       certificatesFromMessage(&msg.Certificates),
 		BoundKeypairResult: boundKeypairResultFromMessage(msg.BoundKeypairResult),
-	}
+	}.Build()
 }
 
 func certificatesToMessage(certs *joinv1.Certificates) messages.Certificates {
@@ -569,12 +565,12 @@ func certificatesToMessage(certs *joinv1.Certificates) messages.Certificates {
 }
 
 func certificatesFromMessage(certs *messages.Certificates) *joinv1.Certificates {
-	return &joinv1.Certificates{
+	return joinv1.Certificates_builder{
 		TlsCert:    certs.TLSCert,
 		TlsCaCerts: certs.TLSCACerts,
 		SshCert:    certs.SSHCert,
 		SshCaKeys:  certs.SSHCAKeys,
-	}
+	}.Build()
 }
 
 func givingUpToMessage(req *joinv1.GivingUp) *messages.GivingUp {
@@ -603,8 +599,8 @@ func givingUpFromMessage(msg *messages.GivingUp) *joinv1.GivingUp {
 	case messages.GivingUpReasonChallengeSolutionFailed:
 		reason = joinv1.GivingUp_REASON_CHALLENGE_SOLUTION_FAILED
 	}
-	return &joinv1.GivingUp{
+	return joinv1.GivingUp_builder{
 		Reason: reason,
 		Msg:    msg.Msg,
-	}
+	}.Build()
 }
diff --git a/lib/join/joinv1/messages_azure.go b/lib/join/joinv1/messages_azure.go
index 8fa1872e6b8..6b8dee0c6b1 100644
--- a/lib/join/joinv1/messages_azure.go
+++ b/lib/join/joinv1/messages_azure.go
@@ -38,9 +38,9 @@ func azureInitFromMessage(msg *messages.AzureInit) (*joinv1.AzureInit, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.AzureInit{
+	return joinv1.AzureInit_builder{
 		ClientParams: clientParams,
-	}, nil
+	}.Build(), nil
 }
 
 func azureChallengeToMessage(req *joinv1.AzureChallenge) *messages.AzureChallenge {
@@ -50,9 +50,9 @@ func azureChallengeToMessage(req *joinv1.AzureChallenge) *messages.AzureChalleng
 }
 
 func azureChallengeFromMessage(msg *messages.AzureChallenge) *joinv1.AzureChallenge {
-	return &joinv1.AzureChallenge{
+	return joinv1.AzureChallenge_builder{
 		Challenge: msg.Challenge,
-	}
+	}.Build()
 }
 
 func azureChallengeSolutionToMessage(req *joinv1.AzureChallengeSolution) *messages.AzureChallengeSolution {
@@ -64,9 +64,9 @@ func azureChallengeSolutionToMessage(req *joinv1.AzureChallengeSolution) *messag
 }
 
 func azureChallengeSolutionFromMessage(msg *messages.AzureChallengeSolution) *joinv1.AzureChallengeSolution {
-	return &joinv1.AzureChallengeSolution{
+	return joinv1.AzureChallengeSolution_builder{
 		AttestedData: msg.AttestedData,
 		Intermediate: msg.Intermediate,
 		AccessToken:  msg.AccessToken,
-	}
+	}.Build()
 }
diff --git a/lib/join/joinv1/messages_boundkeypair.go b/lib/join/joinv1/messages_boundkeypair.go
index 10a28dad6df..678c6bc464b 100644
--- a/lib/join/joinv1/messages_boundkeypair.go
+++ b/lib/join/joinv1/messages_boundkeypair.go
@@ -40,11 +40,11 @@ func boundKeypairInitFromMessage(msg *messages.BoundKeypairInit) (*joinv1.BoundK
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.BoundKeypairInit{
+	return joinv1.BoundKeypairInit_builder{
 		ClientParams:      clientParams,
 		InitialJoinSecret: msg.InitialJoinSecret,
 		PreviousJoinState: msg.PreviousJoinState,
-	}, nil
+	}.Build(), nil
 }
 
 func boundKeypairChallengeToMessage(resp *joinv1.BoundKeypairChallenge) *messages.BoundKeypairChallenge {
@@ -55,10 +55,10 @@ func boundKeypairChallengeToMessage(resp *joinv1.BoundKeypairChallenge) *message
 }
 
 func boundKeypairChallengeFromMessage(msg *messages.BoundKeypairChallenge) *joinv1.BoundKeypairChallenge {
-	return &joinv1.BoundKeypairChallenge{
+	return joinv1.BoundKeypairChallenge_builder{
 		PublicKey: msg.PublicKey,
 		Challenge: msg.Challenge,
-	}
+	}.Build()
 }
 
 func boundKeypairChallengeSolutionToMessage(req *joinv1.BoundKeypairChallengeSolution) *messages.BoundKeypairChallengeSolution {
@@ -74,15 +74,15 @@ func boundKeypairRotationRequestToMessage(resp *joinv1.BoundKeypairRotationReque
 }
 
 func boundKeypairRotationRequestFromMessage(resp *messages.BoundKeypairRotationRequest) *joinv1.BoundKeypairRotationRequest {
-	return &joinv1.BoundKeypairRotationRequest{
+	return joinv1.BoundKeypairRotationRequest_builder{
 		SignatureAlgorithmSuite: resp.SignatureAlgorithmSuite,
-	}
+	}.Build()
 }
 
 func boundKeypairChallengeSolutionFromMessage(msg *messages.BoundKeypairChallengeSolution) *joinv1.BoundKeypairChallengeSolution {
-	return &joinv1.BoundKeypairChallengeSolution{
+	return joinv1.BoundKeypairChallengeSolution_builder{
 		Solution: msg.Solution,
-	}
+	}.Build()
 }
 
 func boundKeypairRotationResponseToMessage(req *joinv1.BoundKeypairRotationResponse) *messages.BoundKeypairRotationResponse {
@@ -92,9 +92,9 @@ func boundKeypairRotationResponseToMessage(req *joinv1.BoundKeypairRotationRespo
 }
 
 func boundKeypairRotationResponseFromMessage(msg *messages.BoundKeypairRotationResponse) *joinv1.BoundKeypairRotationResponse {
-	return &joinv1.BoundKeypairRotationResponse{
+	return joinv1.BoundKeypairRotationResponse_builder{
 		PublicKey: msg.PublicKey,
-	}
+	}.Build()
 }
 
 func boundKeypairResultToMessage(req *joinv1.BoundKeypairResult) *messages.BoundKeypairResult {
@@ -111,8 +111,8 @@ func boundKeypairResultFromMessage(msg *messages.BoundKeypairResult) *joinv1.Bou
 	if msg == nil {
 		return nil
 	}
-	return &joinv1.BoundKeypairResult{
+	return joinv1.BoundKeypairResult_builder{
 		JoinState: msg.JoinState,
 		PublicKey: msg.PublicKey,
-	}
+	}.Build()
 }
diff --git a/lib/join/joinv1/messages_ec2.go b/lib/join/joinv1/messages_ec2.go
index 2f7280f4a39..3cd2ad057bb 100644
--- a/lib/join/joinv1/messages_ec2.go
+++ b/lib/join/joinv1/messages_ec2.go
@@ -39,8 +39,8 @@ func ec2InitFromMessage(msg *messages.EC2Init) (*joinv1.EC2Init, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.EC2Init{
+	return joinv1.EC2Init_builder{
 		ClientParams: clientParams,
 		Document:     msg.Document,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/join/joinv1/messages_iam.go b/lib/join/joinv1/messages_iam.go
index 641b6f31fe1..3d341b20416 100644
--- a/lib/join/joinv1/messages_iam.go
+++ b/lib/join/joinv1/messages_iam.go
@@ -38,9 +38,9 @@ func iamInitFromMessage(msg *messages.IAMInit) (*joinv1.IAMInit, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.IAMInit{
+	return joinv1.IAMInit_builder{
 		ClientParams: clientParams,
-	}, nil
+	}.Build(), nil
 }
 
 func iamChallengeToMessage(req *joinv1.IAMChallenge) *messages.IAMChallenge {
@@ -50,9 +50,9 @@ func iamChallengeToMessage(req *joinv1.IAMChallenge) *messages.IAMChallenge {
 }
 
 func iamChallengeFromMessage(msg *messages.IAMChallenge) *joinv1.IAMChallenge {
-	return &joinv1.IAMChallenge{
+	return joinv1.IAMChallenge_builder{
 		Challenge: msg.Challenge,
-	}
+	}.Build()
 }
 
 func iamChallengeSolutionToMessage(req *joinv1.IAMChallengeSolution) *messages.IAMChallengeSolution {
@@ -62,7 +62,7 @@ func iamChallengeSolutionToMessage(req *joinv1.IAMChallengeSolution) *messages.I
 }
 
 func iamChallengeSolutionFromMessage(msg *messages.IAMChallengeSolution) *joinv1.IAMChallengeSolution {
-	return &joinv1.IAMChallengeSolution{
+	return joinv1.IAMChallengeSolution_builder{
 		StsIdentityRequest: msg.STSIdentityRequest,
-	}
+	}.Build()
 }
diff --git a/lib/join/joinv1/messages_oidc.go b/lib/join/joinv1/messages_oidc.go
index 044f4a65939..d1402f26739 100644
--- a/lib/join/joinv1/messages_oidc.go
+++ b/lib/join/joinv1/messages_oidc.go
@@ -39,8 +39,8 @@ func oidcInitFromMessage(msg *messages.OIDCInit) (*joinv1.OIDCInit, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.OIDCInit{
+	return joinv1.OIDCInit_builder{
 		ClientParams: clientParams,
 		IdToken:      msg.IDToken,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/join/joinv1/messages_oracle.go b/lib/join/joinv1/messages_oracle.go
index 3dad4998f4a..ac3543d411c 100644
--- a/lib/join/joinv1/messages_oracle.go
+++ b/lib/join/joinv1/messages_oracle.go
@@ -38,9 +38,9 @@ func oracleInitFromMessage(msg *messages.OracleInit) (*joinv1.OracleInit, error)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joinv1.OracleInit{
+	return joinv1.OracleInit_builder{
 		ClientParams: clientParams,
-	}, nil
+	}.Build(), nil
 }
 
 func oracleChallengeToMessage(req *joinv1.OracleChallenge) *messages.OracleChallenge {
@@ -50,9 +50,9 @@ func oracleChallengeToMessage(req *joinv1.OracleChallenge) *messages.OracleChall
 }
 
 func oracleChallengeFromMessage(msg *messages.OracleChallenge) *joinv1.OracleChallenge {
-	return &joinv1.OracleChallenge{
+	return joinv1.OracleChallenge_builder{
 		Challenge: msg.Challenge,
-	}
+	}.Build()
 }
 
 func oracleChallengeSolutionToMessage(req *joinv1.OracleChallengeSolution) *messages.OracleChallengeSolution {
@@ -65,10 +65,10 @@ func oracleChallengeSolutionToMessage(req *joinv1.OracleChallengeSolution) *mess
 }
 
 func oracleChallengeSolutionFromMessage(msg *messages.OracleChallengeSolution) *joinv1.OracleChallengeSolution {
-	return &joinv1.OracleChallengeSolution{
+	return joinv1.OracleChallengeSolution_builder{
 		Cert:            msg.Cert,
 		Intermediate:    msg.Intermediate,
 		Signature:       msg.Signature,
 		SignedRootCaReq: msg.SignedRootCAReq,
-	}
+	}.Build()
 }
diff --git a/lib/join/joinv1/messages_test.go b/lib/join/joinv1/messages_test.go
index 3b0999ab091..6ea19d8cd7b 100644
--- a/lib/join/joinv1/messages_test.go
+++ b/lib/join/joinv1/messages_test.go
@@ -96,27 +96,23 @@ func TestRequestToMessage(t *testing.T) {
 		},
 		{
 			desc: "empty HostParams",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_TokenInit{
-					TokenInit: &joinv1.TokenInit{
-						ClientParams: &joinv1.ClientParams{
-							Payload: &joinv1.ClientParams_HostParams{},
-						},
+			req: joinv1.JoinRequest_builder{
+				TokenInit: joinv1.TokenInit_builder{
+					ClientParams: &joinv1.ClientParams{
+						Payload: &joinv1.ClientParams_HostParams{},
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "empty BotParams",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_TokenInit{
-					TokenInit: &joinv1.TokenInit{
-						ClientParams: &joinv1.ClientParams{
-							Payload: &joinv1.ClientParams_BotParams{},
-						},
+			req: joinv1.JoinRequest_builder{
+				TokenInit: joinv1.TokenInit_builder{
+					ClientParams: &joinv1.ClientParams{
+						Payload: &joinv1.ClientParams_BotParams{},
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "empty Solution",
@@ -126,63 +122,51 @@ func TestRequestToMessage(t *testing.T) {
 		},
 		{
 			desc: "empty BoundKeypairChallengeSolution",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_Solution{
-					Solution: &joinv1.ChallengeSolution{
-						Payload: &joinv1.ChallengeSolution_BoundKeypairChallengeSolution{},
-					},
+			req: joinv1.JoinRequest_builder{
+				Solution: &joinv1.ChallengeSolution{
+					Payload: &joinv1.ChallengeSolution_BoundKeypairChallengeSolution{},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty BoundKeypairRotationResponse",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_Solution{
-					Solution: &joinv1.ChallengeSolution{
-						Payload: &joinv1.ChallengeSolution_BoundKeypairRotationResponse{},
-					},
+			req: joinv1.JoinRequest_builder{
+				Solution: &joinv1.ChallengeSolution{
+					Payload: &joinv1.ChallengeSolution_BoundKeypairRotationResponse{},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty IamChallengeSolution",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_Solution{
-					Solution: &joinv1.ChallengeSolution{
-						Payload: &joinv1.ChallengeSolution_IamChallengeSolution{},
-					},
+			req: joinv1.JoinRequest_builder{
+				Solution: &joinv1.ChallengeSolution{
+					Payload: &joinv1.ChallengeSolution_IamChallengeSolution{},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty OracleChallengeSolution",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_Solution{
-					Solution: &joinv1.ChallengeSolution{
-						Payload: &joinv1.ChallengeSolution_OracleChallengeSolution{},
-					},
+			req: joinv1.JoinRequest_builder{
+				Solution: &joinv1.ChallengeSolution{
+					Payload: &joinv1.ChallengeSolution_OracleChallengeSolution{},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty TpmSolution",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_Solution{
-					Solution: &joinv1.ChallengeSolution{
-						Payload: &joinv1.ChallengeSolution_TpmSolution{},
-					},
+			req: joinv1.JoinRequest_builder{
+				Solution: &joinv1.ChallengeSolution{
+					Payload: &joinv1.ChallengeSolution_TpmSolution{},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty AzureSolution",
-			req: &joinv1.JoinRequest{
-				Payload: &joinv1.JoinRequest_Solution{
-					Solution: &joinv1.ChallengeSolution{
-						Payload: &joinv1.ChallengeSolution_AzureChallengeSolution{},
-					},
+			req: joinv1.JoinRequest_builder{
+				Solution: &joinv1.ChallengeSolution{
+					Payload: &joinv1.ChallengeSolution_AzureChallengeSolution{},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty GivingUp",
diff --git a/lib/join/joinv1/messages_tpm.go b/lib/join/joinv1/messages_tpm.go
index 8b2c23ddaa3..6f46f2b8666 100644
--- a/lib/join/joinv1/messages_tpm.go
+++ b/lib/join/joinv1/messages_tpm.go
@@ -24,16 +24,16 @@ import (
 )
 
 func tpmInitToMessage(req *joinv1.TPMInit) (*messages.TPMInit, error) {
-	clientParams, err := clientParamsToMessage(req.ClientParams)
+	clientParams, err := clientParamsToMessage(req.GetClientParams())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &messages.TPMInit{
 		ClientParams:      clientParams,
-		Public:            req.Public,
-		CreateData:        req.CreateData,
-		CreateAttestation: req.CreateAttestation,
-		CreateSignature:   req.CreateSignature,
+		Public:            req.GetPublic(),
+		CreateData:        req.GetCreateData(),
+		CreateAttestation: req.GetCreateAttestation(),
+		CreateSignature:   req.GetCreateSignature(),
 		EKCert:            req.GetEkCert(),
 		EKKey:             req.GetEkKey(),
 	}, nil
@@ -44,13 +44,13 @@ func tpmInitFromMessage(msg *messages.TPMInit) (*joinv1.TPMInit, error) {
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	req := &joinv1.TPMInit{
+	req := joinv1.TPMInit_builder{
 		ClientParams:      clientParams,
 		Public:            msg.Public,
 		CreateData:        msg.CreateData,
 		CreateAttestation: msg.CreateAttestation,
 		CreateSignature:   msg.CreateSignature,
-	}
+	}.Build()
 	var (
 		hasEKCert = len(msg.EKCert) > 0
 		hasEKKey  = len(msg.EKKey) > 0
@@ -72,26 +72,26 @@ func tpmInitFromMessage(msg *messages.TPMInit) (*joinv1.TPMInit, error) {
 
 func tpmEncryptedCredentialToMessage(req *joinv1.TPMEncryptedCredential) *messages.TPMEncryptedCredential {
 	return &messages.TPMEncryptedCredential{
-		CredentialBlob: req.CredentialBlob,
-		Secret:         req.Secret,
+		CredentialBlob: req.GetCredentialBlob(),
+		Secret:         req.GetSecret(),
 	}
 }
 
 func tpmEncryptedCredentialFromMessage(msg *messages.TPMEncryptedCredential) *joinv1.TPMEncryptedCredential {
-	return &joinv1.TPMEncryptedCredential{
+	return joinv1.TPMEncryptedCredential_builder{
 		CredentialBlob: msg.CredentialBlob,
 		Secret:         msg.Secret,
-	}
+	}.Build()
 }
 
 func tpmSolutionToMessage(req *joinv1.TPMSolution) *messages.TPMSolution {
 	return &messages.TPMSolution{
-		Solution: req.Solution,
+		Solution: req.GetSolution(),
 	}
 }
 
 func tpmSolutionFromMessage(msg *messages.TPMSolution) *joinv1.TPMSolution {
-	return &joinv1.TPMSolution{
+	return joinv1.TPMSolution_builder{
 		Solution: msg.Solution,
-	}
+	}.Build()
 }
diff --git a/lib/join/oraclejoin/claims.go b/lib/join/oraclejoin/claims.go
index 2eb67d977a6..151208fdea8 100644
--- a/lib/join/oraclejoin/claims.go
+++ b/lib/join/oraclejoin/claims.go
@@ -34,11 +34,11 @@ type Claims struct {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c Claims) JoinAttrs() *workloadidentityv1pb.JoinAttrsOracle {
-	return &workloadidentityv1pb.JoinAttrsOracle{
+	return workloadidentityv1pb.JoinAttrsOracle_builder{
 		TenancyId:     c.TenancyID,
 		CompartmentId: c.CompartmentID,
 		InstanceId:    c.InstanceID,
-	}
+	}.Build()
 }
 
 // Region extracts the region from an instance's claims.
diff --git a/lib/join/oraclejoin/join_test.go b/lib/join/oraclejoin/join_test.go
index 87d402893aa..b8fa21f37b2 100644
--- a/lib/join/oraclejoin/join_test.go
+++ b/lib/join/oraclejoin/join_test.go
@@ -357,25 +357,25 @@ func TestJoinOracle(t *testing.T) {
 			require.NoError(t, err)
 			require.NoError(t, server.Auth().UpsertToken(t.Context(), token))
 
-			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(spec, &joiningv1.ScopedToken{
+			scopedToken, err := jointest.ScopedTokenFromProvisionTokenSpec(spec, joiningv1.ScopedToken_builder{
 				Scope: "/test",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "scoped_" + token.GetName(),
-				},
-				Spec: &joiningv1.ScopedTokenSpec{
+				}.Build(),
+				Spec: joiningv1.ScopedTokenSpec_builder{
 					AssignedScope: "/test/one",
 					UsageMode:     string(joining.TokenUsageModeUnlimited),
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
-			_, err = server.Auth().CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
+			_, err = server.Auth().CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
 				Token: scopedToken,
-			})
+			}.Build())
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				_, err := server.Auth().DeleteScopedToken(t.Context(), &joiningv1.DeleteScopedTokenRequest{
+				_, err := server.Auth().DeleteScopedToken(t.Context(), joiningv1.DeleteScopedTokenRequest_builder{
 					Name: scopedToken.GetMetadata().GetName(),
-				})
+				}.Build())
 				require.NoError(t, err)
 			})
 
diff --git a/lib/join/server.go b/lib/join/server.go
index e86e637b033..306e999bd4a 100644
--- a/lib/join/server.go
+++ b/lib/join/server.go
@@ -171,10 +171,10 @@ func (s *Server) getProvisionToken(ctx context.Context, name string) (provision.
 			}
 		}
 
-		res, err := s.cfg.ScopedTokenService.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		res, err := s.cfg.ScopedTokenService.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       name,
 			WithSecret: true,
-		})
+		}.Build())
 		if err != nil {
 			scopedErr = err
 			return
diff --git a/lib/join/server_azure.go b/lib/join/server_azure.go
index 0aed29207c0..9d6819d2db9 100644
--- a/lib/join/server_azure.go
+++ b/lib/join/server_azure.go
@@ -104,9 +104,9 @@ func (s *Server) handleAzureJoin(
 		&azureInit.ClientParams,
 		token,
 		nil, // rawClaims
-		&workloadidentityv1pb.JoinAttrs{
+		workloadidentityv1pb.JoinAttrs_builder{
 			Azure: claims,
-		},
+		}.Build(),
 	)
 	return result, trace.Wrap(err)
 }
diff --git a/lib/join/server_azuredevops.go b/lib/join/server_azuredevops.go
index b07f35b79e8..d2ca16b9c58 100644
--- a/lib/join/server_azuredevops.go
+++ b/lib/join/server_azuredevops.go
@@ -42,9 +42,9 @@ func (s *Server) validateAzureDevopsToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			AzureDevops: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_bitbucket.go b/lib/join/server_bitbucket.go
index 5b6546f99a9..6b1a3e44797 100644
--- a/lib/join/server_bitbucket.go
+++ b/lib/join/server_bitbucket.go
@@ -45,9 +45,9 @@ func (a *Server) validateBitbucketToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Bitbucket: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_circleci.go b/lib/join/server_circleci.go
index 346fd283ef2..b8b9d3e9da4 100644
--- a/lib/join/server_circleci.go
+++ b/lib/join/server_circleci.go
@@ -44,9 +44,9 @@ func (a *Server) validateCircleCIToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Circleci: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_env0.go b/lib/join/server_env0.go
index 838b7a6fc7c..6108829ecbf 100644
--- a/lib/join/server_env0.go
+++ b/lib/join/server_env0.go
@@ -55,9 +55,9 @@ func (s *Server) validateEnv0Token(
 		return nil, nil, trace.Wrap(err)
 	}
 
-	return verifiedIdentity, &workloadidentityv1.JoinAttrs{
+	return verifiedIdentity, workloadidentityv1.JoinAttrs_builder{
 		Env0: verifiedIdentity.JoinAttrs(),
-	}, nil
+	}.Build(), nil
 }
 
 func checkEnv0AllowRules(token *types.ProvisionTokenV2, claims *env0.IDTokenClaims) error {
diff --git a/lib/join/server_gcp.go b/lib/join/server_gcp.go
index 3058bec665d..f8ac2ebdd93 100644
--- a/lib/join/server_gcp.go
+++ b/lib/join/server_gcp.go
@@ -46,9 +46,9 @@ func (a *Server) validateGCPToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Gcp: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_github.go b/lib/join/server_github.go
index 4c15d99d41a..c57f27473e3 100644
--- a/lib/join/server_github.go
+++ b/lib/join/server_github.go
@@ -46,9 +46,9 @@ func (a *Server) validateGithubToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Github: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_gitlab.go b/lib/join/server_gitlab.go
index 25c295bec22..dc4ff09a0be 100644
--- a/lib/join/server_gitlab.go
+++ b/lib/join/server_gitlab.go
@@ -46,9 +46,9 @@ func (a *Server) validateGitlabToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Gitlab: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_iam.go b/lib/join/server_iam.go
index 31a56a2155c..d37d059c669 100644
--- a/lib/join/server_iam.go
+++ b/lib/join/server_iam.go
@@ -103,9 +103,9 @@ func (s *Server) handleIAMJoin(
 		&iamInit.ClientParams,
 		token,
 		verifiedIdentity,
-		&workloadidentityv1pb.JoinAttrs{
+		workloadidentityv1pb.JoinAttrs_builder{
 			Iam: verifiedIdentity.JoinAttrs(),
-		},
+		}.Build(),
 	)
 	return result, trace.Wrap(err)
 }
diff --git a/lib/join/server_kubernetes.go b/lib/join/server_kubernetes.go
index 115be5d5b60..3eb1fc8aed0 100644
--- a/lib/join/server_kubernetes.go
+++ b/lib/join/server_kubernetes.go
@@ -55,9 +55,9 @@ func (a *Server) validateKubernetesToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Kubernetes: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_oracle.go b/lib/join/server_oracle.go
index b1eccb8b4be..cd173ec6d15 100644
--- a/lib/join/server_oracle.go
+++ b/lib/join/server_oracle.go
@@ -100,9 +100,9 @@ func (s *Server) handleOracleJoin(
 		&oracleInit.ClientParams,
 		provisionToken,
 		claims,
-		&workloadidentityv1pb.JoinAttrs{
+		workloadidentityv1pb.JoinAttrs_builder{
 			Oracle: claims.JoinAttrs(),
-		},
+		}.Build(),
 	)
 	return result, trace.Wrap(err)
 }
diff --git a/lib/join/server_spacelift.go b/lib/join/server_spacelift.go
index b11d76a5814..366f0ef9e87 100644
--- a/lib/join/server_spacelift.go
+++ b/lib/join/server_spacelift.go
@@ -44,9 +44,9 @@ func (a *Server) validateSpaceliftToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			Spacelift: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_terraformcloud.go b/lib/join/server_terraformcloud.go
index 8186f0cb503..cbb2984263e 100644
--- a/lib/join/server_terraformcloud.go
+++ b/lib/join/server_terraformcloud.go
@@ -52,9 +52,9 @@ func (a *Server) validateTerraformCloudToken(
 	// events remain useful.
 	var workloadIDAttrs *workloadidentityv1.JoinAttrs
 	if claims != nil {
-		workloadIDAttrs = &workloadidentityv1.JoinAttrs{
+		workloadIDAttrs = workloadidentityv1.JoinAttrs_builder{
 			TerraformCloud: claims.JoinAttrs(),
-		}
+		}.Build()
 	}
 
 	return claims, workloadIDAttrs, trace.Wrap(err)
diff --git a/lib/join/server_tpm.go b/lib/join/server_tpm.go
index c636cbc0e72..3e5e7c800d7 100644
--- a/lib/join/server_tpm.go
+++ b/lib/join/server_tpm.go
@@ -108,9 +108,9 @@ func (s *Server) handleTPMJoin(
 		&tpmInit.ClientParams,
 		provisionToken,
 		validatedEK,
-		&workloadidentityv1.JoinAttrs{
+		workloadidentityv1.JoinAttrs_builder{
 			Tpm: validatedEK.JoinAttrs(),
-		},
+		}.Build(),
 	)
 	return result, trace.Wrap(err)
 }
diff --git a/lib/join/spacelift/spacelift.go b/lib/join/spacelift/spacelift.go
index c9523e722e1..a1355d737b1 100644
--- a/lib/join/spacelift/spacelift.go
+++ b/lib/join/spacelift/spacelift.go
@@ -78,7 +78,7 @@ func (c *IDTokenClaims) GetSubject() string {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsSpacelift {
-	return &workloadidentityv1pb.JoinAttrsSpacelift{
+	return workloadidentityv1pb.JoinAttrsSpacelift_builder{
 		Sub:        c.Sub,
 		SpaceId:    c.SpaceID,
 		CallerType: c.CallerType,
@@ -86,7 +86,7 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsSpacelift {
 		RunType:    c.RunType,
 		RunId:      c.RunID,
 		Scope:      c.Scope,
-	}
+	}.Build()
 }
 
 // CheckIDTokenParams are parameters used to validate Spacelift OIDC tokens.
diff --git a/lib/join/terraformcloud/terraform.go b/lib/join/terraformcloud/terraform.go
index 58184c1dac0..1e27e9fcec4 100644
--- a/lib/join/terraformcloud/terraform.go
+++ b/lib/join/terraformcloud/terraform.go
@@ -79,7 +79,7 @@ func (c *IDTokenClaims) GetSubject() string {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsTerraformCloud {
-	return &workloadidentityv1pb.JoinAttrsTerraformCloud{
+	return workloadidentityv1pb.JoinAttrsTerraformCloud_builder{
 		Sub:              c.Sub,
 		OrganizationName: c.OrganizationName,
 		ProjectName:      c.ProjectName,
@@ -87,7 +87,7 @@ func (c *IDTokenClaims) JoinAttrs() *workloadidentityv1pb.JoinAttrsTerraformClou
 		FullWorkspace:    c.FullWorkspace,
 		RunId:            c.RunID,
 		RunPhase:         c.RunPhase,
-	}
+	}.Build()
 }
 
 // CheckIDTokenParams are parameters used to validate CircleCI OIDC tokens.
diff --git a/lib/join/tpmjoin/join_test.go b/lib/join/tpmjoin/join_test.go
index 79d505ae1e0..f5086a491b7 100644
--- a/lib/join/tpmjoin/join_test.go
+++ b/lib/join/tpmjoin/join_test.go
@@ -57,15 +57,15 @@ func TestJoinTPM(t *testing.T) {
 
 	adminClient, err := server.NewClient(authtest.TestAdmin())
 	require.NoError(t, err)
-	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), &machineidv1.CreateBotRequest{
-		Bot: &machineidv1.Bot{
-			Metadata: &headerv1.Metadata{
+	_, err = adminClient.BotServiceClient().CreateBot(t.Context(), machineidv1.CreateBotRequest_builder{
+		Bot: machineidv1.Bot_builder{
+			Metadata: headerv1.Metadata_builder{
 				Name: "testbot",
-			},
+			}.Build(),
 			Kind: types.KindBot,
 			Spec: &machineidv1.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	nopClient, err := server.NewClient(authtest.TestNop())
@@ -303,12 +303,12 @@ func TestJoinTPM(t *testing.T) {
 
 				id, err := tlsca.FromSubject(botCert.Subject, botCert.NotAfter)
 				require.NoError(t, err)
-				tpmAttrs := id.JoinAttributes.Tpm
+				tpmAttrs := id.JoinAttributes.GetTpm()
 				require.NotNil(t, tpmAttrs)
 				gotAttrs := verifiedAttrs{
-					ekPubHash:      tpmAttrs.EkPubHash,
-					ekCertSerial:   tpmAttrs.EkCertSerial,
-					ekCertVerified: tpmAttrs.EkCertVerified,
+					ekPubHash:      tpmAttrs.GetEkPubHash(),
+					ekCertSerial:   tpmAttrs.GetEkCertSerial(),
+					ekCertVerified: tpmAttrs.GetEkCertVerified(),
 				}
 				assert.Equal(t, tc.expectJoinAttrs, gotAttrs)
 			}
diff --git a/lib/kube/grpc/grpc.go b/lib/kube/grpc/grpc.go
index a17d580e7da..1dfc7b6eef4 100644
--- a/lib/kube/grpc/grpc.go
+++ b/lib/kube/grpc/grpc.go
@@ -160,13 +160,13 @@ func (s *Server) ListKubernetesResources(ctx context.Context, req *proto.ListKub
 		return nil, trail.ToGRPC(err)
 	}
 
-	if req.UseSearchAsRoles || req.UsePreviewAsRoles {
+	if req.GetUseSearchAsRoles() || req.GetUsePreviewAsRoles() {
 		var extraRoles []string
-		if req.UseSearchAsRoles {
-			allowedSearchAsRoles := userContext.Checker.GetAllowedSearchAsRolesForKubeResourceKind(req.ResourceType)
+		if req.GetUseSearchAsRoles() {
+			allowedSearchAsRoles := userContext.Checker.GetAllowedSearchAsRolesForKubeResourceKind(req.GetResourceType())
 			extraRoles = append(extraRoles, allowedSearchAsRoles...)
 		}
-		if req.UsePreviewAsRoles {
+		if req.GetUsePreviewAsRoles() {
 			extraRoles = append(extraRoles, userContext.Checker.GetAllowedPreviewAsRoles()...)
 		}
 
@@ -185,20 +185,20 @@ func (s *Server) ListKubernetesResources(ctx context.Context, req *proto.ListKub
 	// the forwarding of the request to the correct leaf cluster if that's the case
 	// and it handles the mapping of the identity to the leaf cluster.
 	identity := userContext.UnmappedIdentity.GetIdentity()
-	identity.KubernetesCluster = req.KubernetesCluster
+	identity.KubernetesCluster = req.GetKubernetesCluster()
 	identity.Groups = userContext.Checker.RoleNames()
-	identity.RouteToCluster = req.TeleportCluster
+	identity.RouteToCluster = req.GetTeleportCluster()
 	ctx = authz.ContextWithUser(ctx, authz.WrapIdentity(identity)) // wrap the identity in the context
 
 	switch {
 	case requiresFakePagination(req):
 		rsp, err := s.listResourcesUsingFakePagination(ctx, req)
 		return rsp, trail.ToGRPC(err)
-	case slices.Contains(types.KubernetesResourcesKinds, req.ResourceType) || strings.HasPrefix(req.ResourceType, types.AccessRequestPrefixKindKube):
+	case slices.Contains(types.KubernetesResourcesKinds, req.GetResourceType()) || strings.HasPrefix(req.GetResourceType(), types.AccessRequestPrefixKindKube):
 		rsp, err := s.listKubernetesResources(ctx, true, req)
 		return rsp, trail.ToGRPC(err)
 	default:
-		return nil, trail.ToGRPC(trace.BadParameter("unsupported resource type %q", req.ResourceType))
+		return nil, trail.ToGRPC(trace.BadParameter("unsupported resource type %q", req.GetResourceType()))
 	}
 }
 
@@ -223,11 +223,11 @@ func (s *Server) emitAuditEvent(ctx context.Context, userContext *authz.Context,
 			},
 			UserMetadata:        authz.ClientUserMetadata(ctx),
 			SearchAsRoles:       userContext.Checker.RoleNames(),
-			ResourceType:        req.ResourceType,
+			ResourceType:        req.GetResourceType(),
 			Namespace:           defaults.Namespace,
-			Labels:              req.Labels,
-			PredicateExpression: req.PredicateExpression,
-			SearchKeywords:      req.SearchKeywords,
+			Labels:              req.GetLabels(),
+			PredicateExpression: req.GetPredicateExpression(),
+			SearchKeywords:      req.GetSearchKeywords(),
 		})
 	return trace.Wrap(err)
 }
@@ -243,22 +243,22 @@ func (s *Server) listKubernetesResources(
 	respectLimit bool,
 	req *proto.ListKubernetesResourcesRequest,
 ) (*proto.ListKubernetesResourcesResponse, error) {
-	if req.KubernetesCluster == "" {
+	if req.GetKubernetesCluster() == "" {
 		return nil, trace.BadParameter("missing parameter KubernetesCluster")
 	}
-	if req.TeleportCluster == "" {
+	if req.GetTeleportCluster() == "" {
 		return nil, trace.BadParameter("missing parameter TeleportCluster")
 	}
 
-	limit := int(req.Limit)
+	limit := int(req.GetLimit())
 	filter := services.MatchResourceFilter{
-		ResourceKind:   req.ResourceType,
-		Labels:         req.Labels,
-		SearchKeywords: req.SearchKeywords,
+		ResourceKind:   req.GetResourceType(),
+		Labels:         req.GetLabels(),
+		SearchKeywords: req.GetSearchKeywords(),
 	}
 
-	if req.PredicateExpression != "" {
-		expression, err := services.NewResourceExpression(req.PredicateExpression)
+	if req.GetPredicateExpression() != "" {
+		expression, err := services.NewResourceExpression(req.GetPredicateExpression())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -271,16 +271,16 @@ func (s *Server) listKubernetesResources(
 		func(r *types.KubernetesResourceV1, continueKey string) (int, error) {
 			switch match, err := services.MatchResourceByFilters(r, filter, nil /* ignore dup matches  */); {
 			case err != nil:
-				return len(rsp.Resources), trace.Wrap(err)
+				return len(rsp.GetResources()), trace.Wrap(err)
 			case match:
-				rsp.Resources = append(rsp.Resources, r)
+				rsp.SetResources(append(rsp.GetResources(), r))
 			}
 			// repectLimit is true only if we do not require the fake pagination field.
-			if len(rsp.Resources) == limit && respectLimit {
-				rsp.NextKey = continueKey
-				return len(rsp.Resources), errDone
+			if len(rsp.GetResources()) == limit && respectLimit {
+				rsp.SetNextKey(continueKey)
+				return len(rsp.GetResources()), errDone
 			}
-			return len(rsp.Resources), nil
+			return len(rsp.GetResources()), nil
 		},
 	)
 	return rsp, trace.Wrap(err)
@@ -377,11 +377,11 @@ func (s *Server) iterateKubernetesResources(
 	kubeDynamicClient := s.kubeDynamicClient
 
 	// Pagination.
-	continueKey := req.StartKey
+	continueKey := req.GetStartKey()
 	itemsAppended := 0
 
 	// Unknown resources.
-	resourceType := req.ResourceType
+	resourceType := req.GetResourceType()
 	apiGroup := ""
 	version := ""
 
@@ -392,29 +392,29 @@ func (s *Server) iterateKubernetesResources(
 			items           []kObject
 			nextContinueKey string
 			listOpts        = metav1.ListOptions{
-				Limit:    decideLimit(int64(req.Limit), int64(itemsAppended), respectLimit),
+				Limit:    decideLimit(int64(req.GetLimit()), int64(itemsAppended), respectLimit),
 				Continue: continueKey,
 			}
 		)
 
 		// TODO(@creack): DELETE IN v20.0.0 when we no longer support tsh v18.
-		switch req.ResourceType {
+		switch req.GetResourceType() {
 		case types.KindKubePod:
-			lItems, err := kubeClient.CoreV1().Pods(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.CoreV1().Pods(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeSecret:
-			lItems, err := kubeClient.CoreV1().Secrets(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.CoreV1().Secrets(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeConfigmap:
-			lItems, err := kubeClient.CoreV1().ConfigMaps(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.CoreV1().ConfigMaps(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -429,14 +429,14 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeService:
-			lItems, err := kubeClient.CoreV1().Services(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.CoreV1().Services(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeServiceAccount:
-			lItems, err := kubeClient.CoreV1().ServiceAccounts(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.CoreV1().ServiceAccounts(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -459,35 +459,35 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubePersistentVolumeClaim:
-			lItems, err := kubeClient.CoreV1().PersistentVolumeClaims(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.CoreV1().PersistentVolumeClaims(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeDeployment:
-			lItems, err := kubeClient.AppsV1().Deployments(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.AppsV1().Deployments(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeReplicaSet:
-			lItems, err := kubeClient.AppsV1().ReplicaSets(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.AppsV1().ReplicaSets(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeStatefulset:
-			lItems, err := kubeClient.AppsV1().StatefulSets(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.AppsV1().StatefulSets(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeDaemonSet:
-			lItems, err := kubeClient.AppsV1().DaemonSets(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.AppsV1().DaemonSets(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -502,7 +502,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeRole:
-			lItems, err := kubeClient.RbacV1().Roles(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.RbacV1().Roles(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -517,21 +517,21 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeRoleBinding:
-			lItems, err := kubeClient.RbacV1().RoleBindings(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.RbacV1().RoleBindings(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeCronjob:
-			lItems, err := kubeClient.BatchV1().CronJobs(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.BatchV1().CronJobs(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeJob:
-			lItems, err := kubeClient.BatchV1().Jobs(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.BatchV1().Jobs(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -546,7 +546,7 @@ func (s *Server) iterateKubernetesResources(
 			items = itemListToKObjectList(itemListToItemListPtr(lItems.Items))
 			nextContinueKey = lItems.Continue
 		case types.KindKubeIngress:
-			lItems, err := kubeClient.NetworkingV1().Ingresses(req.KubernetesNamespace).List(ctx, listOpts)
+			lItems, err := kubeClient.NetworkingV1().Ingresses(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -554,7 +554,7 @@ func (s *Server) iterateKubernetesResources(
 			nextContinueKey = lItems.Continue
 		default:
 			// If we don't have a known legacy value, we expect a 'kube:' prefix.
-			if !strings.HasPrefix(req.ResourceType, types.AccessRequestPrefixKindKube) {
+			if !strings.HasPrefix(req.GetResourceType(), types.AccessRequestPrefixKindKube) {
 				return trace.BadParameter("unsupported resource type %q", resourceType)
 			}
 
@@ -565,7 +565,7 @@ func (s *Server) iterateKubernetesResources(
 				// TODO(@creack): Consider caching the discovery. Needs to be periodically invalidated.
 				// As it is only for the access request search, it is likely not heavily used and the request
 				// is between us and kube_proxy which is likely on the same host.
-				gk := schema.ParseGroupKind(strings.TrimPrefix(req.ResourceType, types.AccessRequestPrefixKindKube))
+				gk := schema.ParseGroupKind(strings.TrimPrefix(req.GetResourceType(), types.AccessRequestPrefixKindKube))
 				resourceType = gk.Kind
 				g, versions, err := lookupAPIGroupVersions(ctx, kubeClient, gk)
 				if err != nil {
@@ -579,15 +579,15 @@ func (s *Server) iterateKubernetesResources(
 			}
 
 			// NOTE: The CLI sends the 'default' namespace regardless of the kind. Make sure to clear it out for globals.
-			if req.KubernetesNamespace == defaults.Namespace && isClusterWide {
-				req.KubernetesNamespace = ""
+			if req.GetKubernetesNamespace() == defaults.Namespace && isClusterWide {
+				req.SetKubernetesNamespace("")
 			}
 
 			lItems, err := kubeDynamicClient.Resource(schema.GroupVersionResource{
 				Group:    apiGroup,
 				Version:  version,
 				Resource: resourceType,
-			}).Namespace(req.KubernetesNamespace).List(ctx, listOpts)
+			}).Namespace(req.GetKubernetesNamespace()).List(ctx, listOpts)
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -596,7 +596,7 @@ func (s *Server) iterateKubernetesResources(
 		}
 
 		for _, resource := range items {
-			resource, err := getKubernetesResourceFromKObject(resource, !isClusterWide, req.ResourceType)
+			resource, err := getKubernetesResourceFromKObject(resource, !isClusterWide, req.GetResourceType())
 			if err != nil {
 				return trace.Wrap(err)
 			}
@@ -689,33 +689,33 @@ func (s *Server) listResourcesUsingFakePagination(
 		err error
 	)
 	switch {
-	case slices.Contains(types.KubernetesResourcesKinds, req.ResourceType) || strings.HasPrefix(req.ResourceType, types.AccessRequestPrefixKindKube):
+	case slices.Contains(types.KubernetesResourcesKinds, req.GetResourceType()) || strings.HasPrefix(req.GetResourceType(), types.AccessRequestPrefixKindKube):
 		rsp, err = s.listKubernetesResources(ctx, false /* do not respect the limit value */, req)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 	default:
-		return nil, trace.BadParameter("unsupported resource type %q", req.ResourceType)
+		return nil, trace.BadParameter("unsupported resource type %q", req.GetResourceType())
 	}
 
-	sortedClusters := types.KubeResources(rsp.Resources)
-	if req.SortBy != nil {
-		if err := sortedClusters.SortByCustom(*req.SortBy); err != nil {
+	sortedClusters := types.KubeResources(rsp.GetResources())
+	if req.HasSortBy() {
+		if err := sortedClusters.SortByCustom(*req.GetSortBy()); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	}
 
 	// map the request to the fake pagination request.
 	params := local.FakePaginateParams{
-		StartKey:       req.StartKey,
-		Limit:          req.Limit,
-		ResourceType:   req.ResourceType,
-		Labels:         req.Labels,
-		SearchKeywords: req.SearchKeywords,
+		StartKey:       req.GetStartKey(),
+		Limit:          req.GetLimit(),
+		ResourceType:   req.GetResourceType(),
+		Labels:         req.GetLabels(),
+		SearchKeywords: req.GetSearchKeywords(),
 	}
 
-	if req.PredicateExpression != "" {
-		expression, err := services.NewResourceExpression(req.PredicateExpression)
+	if req.GetPredicateExpression() != "" {
+		expression, err := services.NewResourceExpression(req.GetPredicateExpression())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -731,16 +731,16 @@ func (s *Server) listResourcesUsingFakePagination(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &proto.ListKubernetesResourcesResponse{
+	return proto.ListKubernetesResourcesResponse_builder{
 		Resources:  resources,
 		NextKey:    fakeRsp.NextKey,
 		TotalCount: int32(fakeRsp.TotalCount),
-	}, nil
+	}.Build(), nil
 }
 
 // requiresFakePagination returns true if the request requires the fake pagination.
 func requiresFakePagination(req *proto.ListKubernetesResourcesRequest) bool {
-	return req.SortBy != nil && req.SortBy.Field != "" || req.NeedTotalCount
+	return req.HasSortBy() && req.GetSortBy().Field != "" || req.GetNeedTotalCount()
 }
 
 // resourcesToKubeResources converts a list of resources to a list of Kubernetes resources.
diff --git a/lib/kube/grpc/grpc_test.go b/lib/kube/grpc/grpc_test.go
index e55cf6e63f0..a4e513c57b4 100644
--- a/lib/kube/grpc/grpc_test.go
+++ b/lib/kube/grpc/grpc_test.go
@@ -184,7 +184,7 @@ func TestListKubernetesResources(t *testing.T) {
 				searchAsRoles: false,
 				resourceKind:  types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind:    "pod",
@@ -242,7 +242,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -253,7 +253,7 @@ func TestListKubernetesResources(t *testing.T) {
 				namespace:     "dev",
 				resourceKind:  types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind: "pod",
@@ -274,7 +274,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -295,7 +295,7 @@ func TestListKubernetesResources(t *testing.T) {
 				namespace:     "dev",
 				resourceKind:  types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind: "pod",
@@ -316,7 +316,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -328,7 +328,7 @@ func TestListKubernetesResources(t *testing.T) {
 				searchKeywords: []string{"nginx-1"},
 				resourceKind:   types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind: "pod",
@@ -340,7 +340,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -355,7 +355,7 @@ func TestListKubernetesResources(t *testing.T) {
 				},
 				resourceKind: types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				TotalCount: 2,
 				Resources: []*types.KubernetesResourceV1{
 					{
@@ -377,7 +377,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -393,7 +393,7 @@ func TestListKubernetesResources(t *testing.T) {
 				startKey:     "nginx-1",
 				resourceKind: types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				TotalCount: 2,
 				Resources: []*types.KubernetesResourceV1{
 					{
@@ -406,7 +406,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -427,7 +427,7 @@ func TestListKubernetesResources(t *testing.T) {
 				namespace:     "dev",
 				resourceKind:  types.KindKubeSecret,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind:    types.KindKubeSecret,
@@ -450,7 +450,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -461,7 +461,7 @@ func TestListKubernetesResources(t *testing.T) {
 				namespace:     "dev",
 				resourceKind:  types.KindKubePod,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind: "pod",
@@ -482,7 +482,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -492,7 +492,7 @@ func TestListKubernetesResources(t *testing.T) {
 				searchAsRoles: false,
 				resourceKind:  types.KindKubeSecret,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind:    types.KindKubeSecret,
@@ -550,7 +550,7 @@ func TestListKubernetesResources(t *testing.T) {
 						},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 		{
@@ -560,7 +560,7 @@ func TestListKubernetesResources(t *testing.T) {
 				searchAsRoles: false,
 				resourceKind:  types.KindKubeClusterRole,
 			},
-			want: &proto.ListKubernetesResourcesResponse{
+			want: proto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind:    types.KindKubeClusterRole,
@@ -590,7 +590,7 @@ func TestListKubernetesResources(t *testing.T) {
 						Spec: types.KubernetesResourceSpecV1{},
 					},
 				},
-			},
+			}.Build(),
 			assertErr: require.NoError,
 		},
 	}
@@ -605,7 +605,7 @@ func TestListKubernetesResources(t *testing.T) {
 
 			rsp, err := kubeClient.ListKubernetesResources(
 				context.Background(),
-				&proto.ListKubernetesResourcesRequest{
+				proto.ListKubernetesResourcesRequest_builder{
 					ResourceType:        tt.args.resourceKind,
 					Limit:               100,
 					KubernetesCluster:   kubeCluster,
@@ -615,11 +615,11 @@ func TestListKubernetesResources(t *testing.T) {
 					SearchKeywords:      tt.args.searchKeywords,
 					SortBy:              tt.args.sortBy,
 					StartKey:            tt.args.startKey,
-				},
+				}.Build(),
 			)
 			tt.assertErr(t, err)
 			if tt.want != nil {
-				for _, want := range tt.want.Resources {
+				for _, want := range tt.want.GetResources() {
 					isClusterWide := slices.Contains(types.KubernetesClusterWideResourceKinds, want.Kind)
 					// fill in defaults
 					err := want.CheckAndSetDefaults(!isClusterWide)
diff --git a/lib/kube/grpc/utils_test.go b/lib/kube/grpc/utils_test.go
index 71bbf80b766..a6dc84a553c 100644
--- a/lib/kube/grpc/utils_test.go
+++ b/lib/kube/grpc/utils_test.go
@@ -257,12 +257,12 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 
 	inventoryHandle, err := inventory.NewDownstreamHandle(client.InventoryControlStream,
 		func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
-			return &proto.UpstreamInventoryHello{
+			return proto.UpstreamInventoryHello_builder{
 				ServerID: testCtx.HostID,
 				Version:  teleport.Version,
 				Services: types.SystemRoles{types.RoleKube}.StringSlice(),
 				Hostname: "test",
-			}, nil
+			}.Build(), nil
 		})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, inventoryHandle.Close()) })
@@ -410,9 +410,9 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		case sender := <-inventoryHandle.Sender():
 			server, err := testCtx.KubeServer.GetServerInfo(cluster.Name)
 			require.NoError(t, err)
-			require.NoError(t, sender.Send(ctx, &proto.InventoryHeartbeat{
+			require.NoError(t, sender.Send(ctx, proto.InventoryHeartbeat_builder{
 				KubernetesServer: server,
-			}))
+			}.Build()))
 		case <-time.After(20 * time.Second):
 			t.Fatal("timed out waiting for inventory handle sender")
 		}
diff --git a/lib/kube/proxy/ephemeral_containers.go b/lib/kube/proxy/ephemeral_containers.go
index 57a14bba1dc..14779204878 100644
--- a/lib/kube/proxy/ephemeral_containers.go
+++ b/lib/kube/proxy/ephemeral_containers.go
@@ -223,7 +223,7 @@ func (f *Forwarder) mergeEphemeralPatchWithCurrentPod(
 func (f *Forwarder) createWaitingContainer(ctx context.Context, ephemeralContName string, authCtx *authContext, podPatch []byte, patchType apimachinerytypes.PatchType) error {
 	waitingCont, err := kubewaitingcontainer.NewKubeWaitingContainer(
 		ephemeralContName,
-		&kubewaitingcontainerpb.KubernetesWaitingContainerSpec{
+		kubewaitingcontainerpb.KubernetesWaitingContainerSpec_builder{
 			Username:      authCtx.User.GetName(),
 			Cluster:       authCtx.kubeClusterName,
 			Namespace:     authCtx.metaResource.requestedResource.namespace,
@@ -231,7 +231,7 @@ func (f *Forwarder) createWaitingContainer(ctx context.Context, ephemeralContNam
 			ContainerName: ephemeralContName,
 			Patch:         podPatch,
 			PatchType:     string(patchType),
-		})
+		}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -312,7 +312,7 @@ func patchPodWithDebugContainer(decoder runtime.Decoder, podJson, podPatch []byt
 // a session which can be safely waiting on until the moderated session
 // is approved.
 func (f *Forwarder) getPatchedPodEvent(ctx context.Context, sess *clusterSession, waitingCont *kubewaitingcontainerpb.KubernetesWaitingContainer) (*watch.Event, error) {
-	contentType, err := patchTypeToContentType(apimachinerytypes.PatchType(waitingCont.Spec.PatchType))
+	contentType, err := patchTypeToContentType(apimachinerytypes.PatchType(waitingCont.GetSpec().GetPatchType()))
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -327,13 +327,13 @@ func (f *Forwarder) getPatchedPodEvent(ctx context.Context, sess *clusterSession
 	patchedPod, _, err := f.mergeEphemeralPatchWithCurrentPod(
 		ctx,
 		mergeEphemeralPatchWithCurrentPodConfig{
-			kubeCluster:   waitingCont.Spec.Cluster,
-			kubeNamespace: waitingCont.Spec.Namespace,
-			podName:       waitingCont.Spec.PodName,
+			kubeCluster:   waitingCont.GetSpec().GetCluster(),
+			kubeNamespace: waitingCont.GetSpec().GetNamespace(),
+			podName:       waitingCont.GetSpec().GetPodName(),
 			decoder:       decoder,
 			encoder:       encoder,
-			podPatch:      waitingCont.Spec.Patch,
-			patchType:     apimachinerytypes.PatchType(waitingCont.Spec.PatchType),
+			podPatch:      waitingCont.GetSpec().GetPatch(),
+			patchType:     apimachinerytypes.PatchType(waitingCont.GetSpec().GetPatchType()),
 		},
 	)
 	if err != nil {
@@ -365,10 +365,10 @@ func (f *Forwarder) getUserEphemeralContainersForPod(ctx context.Context, userna
 			return nil, trace.Wrap(err)
 		}
 		for _, cont := range waitingContainers {
-			if cont.Spec.Username != username ||
-				cont.Spec.Cluster != kubeCluster ||
-				cont.Spec.Namespace != namespace ||
-				cont.Spec.PodName != pod {
+			if cont.GetSpec().GetUsername() != username ||
+				cont.GetSpec().GetCluster() != kubeCluster ||
+				cont.GetSpec().GetNamespace() != namespace ||
+				cont.GetSpec().GetPodName() != pod {
 				continue
 			}
 
diff --git a/lib/kube/proxy/forwarder_test.go b/lib/kube/proxy/forwarder_test.go
index 3759b564dcf..86985d1d35f 100644
--- a/lib/kube/proxy/forwarder_test.go
+++ b/lib/kube/proxy/forwarder_test.go
@@ -1625,40 +1625,40 @@ func newScopedKubeAuthorizer(t *testing.T, cfg scopedKubeAuthorizerConfig) mockA
 
 	var lock *scopedaccessv1.Lock
 	if cfg.kubeLockMode != "" {
-		lock = &scopedaccessv1.Lock{Mode: string(cfg.kubeLockMode)}
+		lock = scopedaccessv1.Lock_builder{Mode: string(cfg.kubeLockMode)}.Build()
 	}
 
-	role := &scopedaccessv1.ScopedRole{
+	role := scopedaccessv1.ScopedRole_builder{
 		Kind: "scoped_role",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: scopedTestRole,
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{scopedTestScope},
-			Kube: &scopedaccessv1.ScopedRoleKube{
+			Kube: scopedaccessv1.ScopedRoleKube_builder{
 				Labels: []*labelv1.Label{
-					{Name: types.Wildcard, Values: []string{types.Wildcard}},
+					labelv1.Label_builder{Name: types.Wildcard, Values: []string{types.Wildcard}}.Build(),
 				},
 				Groups:                cfg.kubeGroups,
 				Users:                 cfg.kubeUsers,
 				Lock:                  lock,
 				DisconnectExpiredCert: cfg.kubeDisconnectExpired,
-			},
-		},
+			}.Build(),
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
 	reader := &fakeScopedRoleReader{
 		role: role,
 	}
 
-	pin := &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: scopedTestScope}
-	pin.AssignmentTree = pinning.AssignmentTreeFromMap(map[string]map[string][]string{
+	pin := scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: scopedTestScope}.Build()
+	pin.SetAssignmentTree(pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 		"/": {
 			scopedTestScope: {scopedTestRole},
 		},
-	})
+	}))
 
 	checkerCtx, err := services.NewScopedAccessCheckerContext(t.Context(), &services.AccessInfo{
 		Username: cfg.user.GetName(),
@@ -1683,11 +1683,11 @@ type fakeScopedRoleReader struct {
 
 func (r *fakeScopedRoleReader) GetScopedRole(_ context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
 
-	return &scopedaccessv1.GetScopedRoleResponse{Role: r.role}, nil
+	return scopedaccessv1.GetScopedRoleResponse_builder{Role: r.role}.Build(), nil
 }
 
 func (r *fakeScopedRoleReader) ListScopedRoles(context.Context, *scopedaccessv1.ListScopedRolesRequest) (*scopedaccessv1.ListScopedRolesResponse, error) {
-	return &scopedaccessv1.ListScopedRolesResponse{Roles: []*scopedaccessv1.ScopedRole{r.role}}, nil
+	return scopedaccessv1.ListScopedRolesResponse_builder{Roles: []*scopedaccessv1.ScopedRole{r.role}}.Build(), nil
 }
 
 type mockEventClient struct {
@@ -2479,13 +2479,13 @@ func TestForwarderConfig(t *testing.T) {
 			name:        "scoped with scope pin",
 			expectScope: "/test",
 			mutateFn: func(cfg ForwarderConfig) *ForwarderConfig {
-				cfg.ScopePin = &scopesv1.Pin{
+				cfg.ScopePin = scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 					Scope: "/test",
-					SystemRoles: &scopesv1.SystemRoles{
+					SystemRoles: scopesv1.SystemRoles_builder{
 						Primary: types.RoleKube.String(),
-					},
-				}
+					}.Build(),
+				}.Build()
 				return &cfg
 			},
 		},
@@ -2493,13 +2493,13 @@ func TestForwarderConfig(t *testing.T) {
 			name: "scoped with both an agent scope and scope pin",
 			mutateFn: func(cfg ForwarderConfig) *ForwarderConfig {
 				cfg.Scope = "/test"
-				cfg.ScopePin = &scopesv1.Pin{
+				cfg.ScopePin = scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 					Scope: "/test",
-					SystemRoles: &scopesv1.SystemRoles{
+					SystemRoles: scopesv1.SystemRoles_builder{
 						Primary: types.RoleKube.String(),
-					},
-				}
+					}.Build(),
+				}.Build()
 				return &cfg
 			},
 			expectErr: "either a scope pin or a bare scope must be set for a scoped kube forwarder, not both",
diff --git a/lib/kube/proxy/resource_list.go b/lib/kube/proxy/resource_list.go
index 95da777326b..9049074aad9 100644
--- a/lib/kube/proxy/resource_list.go
+++ b/lib/kube/proxy/resource_list.go
@@ -284,7 +284,7 @@ func (f *Forwarder) sendEphemeralContainerEvents(ctx context.Context, rw *respon
 		}
 
 		for _, wc := range wcs {
-			if _, ok := sentDebugContainers[wc.Spec.ContainerName]; ok {
+			if _, ok := sentDebugContainers[wc.GetSpec().GetContainerName()]; ok {
 				continue
 			}
 			evt, err := f.getPatchedPodEvent(ctx, sess, wc)
@@ -292,7 +292,7 @@ func (f *Forwarder) sendEphemeralContainerEvents(ctx context.Context, rw *respon
 				f.log.WarnContext(ctx, "error pushing pod event", "error", err)
 				continue
 			}
-			sentDebugContainers[wc.Spec.ContainerName] = struct{}{}
+			sentDebugContainers[wc.GetSpec().GetContainerName()] = struct{}{}
 			// push the event to the client
 			// this will lock until the event is pushed or the
 			// request context is done.
diff --git a/lib/kube/proxy/sess.go b/lib/kube/proxy/sess.go
index 33c96d1eaf8..a497de685c8 100644
--- a/lib/kube/proxy/sess.go
+++ b/lib/kube/proxy/sess.go
@@ -1166,13 +1166,13 @@ func (s *session) createEphemeralContainer() (*corev1.ContainerStatus, error) {
 	}
 	waitingCont, err := s.forwarder.cfg.CachingAuthClient.GetKubernetesWaitingContainer(
 		s.forwarder.ctx,
-		&kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest{
+		kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest_builder{
 			Username:      username,
 			Cluster:       s.ctx.kubeClusterName,
 			Namespace:     namespace,
 			PodName:       podName,
 			ContainerName: container,
-		},
+		}.Build(),
 	)
 	if trace.IsNotFound(err) {
 		return nil, nil
@@ -1182,13 +1182,13 @@ func (s *session) createEphemeralContainer() (*corev1.ContainerStatus, error) {
 
 	if err = s.forwarder.cfg.AuthClient.DeleteKubernetesWaitingContainer(
 		s.forwarder.ctx,
-		&kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest{
+		kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest_builder{
 			Username:      username,
 			Cluster:       s.ctx.kubeClusterName,
 			Namespace:     namespace,
 			PodName:       podName,
 			ContainerName: container,
-		},
+		}.Build(),
 	); err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1527,7 +1527,7 @@ func (s *session) patchAndWaitForPodEphemeralContainer(
 	headers http.Header,
 	waitingCont *kubewaitingcontainerpb.KubernetesWaitingContainer,
 ) (containerStatus *corev1.ContainerStatus, err error) {
-	fmt.Fprintf(s.io, "\r\nCreating ephemeral container %s in pod %s/%s\r\n", waitingCont.Spec.ContainerName, waitingCont.Spec.Namespace, waitingCont.Spec.PodName)
+	fmt.Fprintf(s.io, "\r\nCreating ephemeral container %s in pod %s/%s\r\n", waitingCont.GetSpec().GetContainerName(), waitingCont.GetSpec().GetNamespace(), waitingCont.GetSpec().GetPodName())
 
 	clientSet, _, err := s.forwarder.impersonatedKubeClient(authCtx, headers)
 	if err != nil {
@@ -1535,9 +1535,9 @@ func (s *session) patchAndWaitForPodEphemeralContainer(
 	}
 	podClient := clientSet.CoreV1().Pods(authCtx.metaResource.requestedResource.namespace)
 	result, err := podClient.Patch(ctx,
-		waitingCont.Spec.PodName,
+		waitingCont.GetSpec().GetPodName(),
 		apimachinerytypes.StrategicMergePatchType,
-		waitingCont.Spec.Patch,
+		waitingCont.GetSpec().GetPatch(),
 		metav1.PatchOptions{},
 		"ephemeralcontainers")
 	if err != nil {
@@ -1545,10 +1545,10 @@ func (s *session) patchAndWaitForPodEphemeralContainer(
 	}
 
 	fmt.Fprintf(s.io, "Pod %s/%s successfully patched. Waiting for container to become ready.\r\n",
-		waitingCont.Spec.Namespace,
-		waitingCont.Spec.PodName)
+		waitingCont.GetSpec().GetNamespace(),
+		waitingCont.GetSpec().GetPodName())
 
-	fieldSelector := fields.OneTermEqualSelector("metadata.name", waitingCont.Spec.PodName).String()
+	fieldSelector := fields.OneTermEqualSelector("metadata.name", waitingCont.GetSpec().GetPodName()).String()
 	lw := &cache.ListWatch{
 		ListFunc: func(options metav1.ListOptions) (runtime.Object, error) {
 			options.FieldSelector = fieldSelector
@@ -1566,7 +1566,7 @@ func (s *session) patchAndWaitForPodEphemeralContainer(
 	_, err = watchtools.UntilWithSync(ctx, lw, &corev1.Pod{}, nil, func(ev watch.Event) (bool, error) {
 		switch ev.Type {
 		case watch.Deleted:
-			return false, trace.NotFound("pod %s not found", waitingCont.Spec.PodName)
+			return false, trace.NotFound("pod %s not found", waitingCont.GetSpec().GetPodName())
 		}
 
 		p, ok := ev.Object.(*corev1.Pod)
@@ -1574,7 +1574,7 @@ func (s *session) patchAndWaitForPodEphemeralContainer(
 			return false, trace.BadParameter("watch did not return a pod: %v", ev.Object)
 		}
 
-		s := getEphemeralContainerStatusByName(p, waitingCont.Spec.ContainerName)
+		s := getEphemeralContainerStatusByName(p, waitingCont.GetSpec().GetContainerName())
 		if s == nil {
 			return false, nil
 		}
@@ -1588,7 +1588,7 @@ func (s *session) patchAndWaitForPodEphemeralContainer(
 		return nil, trace.Wrap(err)
 	}
 
-	fmt.Fprintf(s.io, "Ephemeral container %s is ready.\r\n", waitingCont.Spec.ContainerName)
+	fmt.Fprintf(s.io, "Ephemeral container %s is ready.\r\n", waitingCont.GetSpec().GetContainerName())
 
 	return containerStatus, nil
 }
@@ -1633,7 +1633,7 @@ func (s *session) retrieveEphemeralContainerCommand(ctx context.Context, usernam
 			continue
 		}
 
-		contentType, err := patchTypeToContentType(apimachinerytypes.PatchType(container.Spec.PatchType))
+		contentType, err := patchTypeToContentType(apimachinerytypes.PatchType(container.GetSpec().GetPatchType()))
 		if err != nil {
 			return nil
 		}
@@ -1653,8 +1653,8 @@ func (s *session) retrieveEphemeralContainerCommand(ctx context.Context, usernam
 				podName:       s.podName,
 				decoder:       decoder,
 				encoder:       encoder,
-				podPatch:      container.GetSpec().Patch,
-				patchType:     apimachinerytypes.PatchType(container.GetSpec().PatchType),
+				podPatch:      container.GetSpec().GetPatch(),
+				patchType:     apimachinerytypes.PatchType(container.GetSpec().GetPatchType()),
 			},
 		)
 		if err != nil {
diff --git a/lib/kube/proxy/utils_test.go b/lib/kube/proxy/utils_test.go
index 481d6da32a9..5465e85bb68 100644
--- a/lib/kube/proxy/utils_test.go
+++ b/lib/kube/proxy/utils_test.go
@@ -253,12 +253,12 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 
 	inventoryHandle, err := inventory.NewDownstreamHandle(client.InventoryControlStream,
 		func(_ context.Context) (*proto.UpstreamInventoryHello, error) {
-			return &proto.UpstreamInventoryHello{
+			return proto.UpstreamInventoryHello_builder{
 				ServerID: testCtx.HostID,
 				Version:  teleport.Version,
 				Services: types.SystemRoles{types.RoleKube}.StringSlice(),
 				Hostname: "test",
-			}, nil
+			}.Build(), nil
 		})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, inventoryHandle.Close()) })
@@ -424,9 +424,9 @@ func SetupTestContext(ctx context.Context, t *testing.T, cfg TestConfig) *TestCo
 		case sender := <-inventoryHandle.Sender():
 			server, err := testCtx.KubeServer.GetServerInfo(cluster.Name)
 			require.NoError(t, err)
-			require.NoError(t, sender.Send(ctx, &proto.InventoryHeartbeat{
+			require.NoError(t, sender.Send(ctx, proto.InventoryHeartbeat_builder{
 				KubernetesServer: server,
-			}))
+			}.Build()))
 		case <-time.After(20 * time.Second):
 			t.Fatal("timed out waiting for inventory handle sender")
 		}
diff --git a/lib/kube/proxy/watcher.go b/lib/kube/proxy/watcher.go
index 2b898eea858..c1df88d9b8c 100644
--- a/lib/kube/proxy/watcher.go
+++ b/lib/kube/proxy/watcher.go
@@ -233,8 +233,8 @@ func (s *TLSServer) unregisterKubeCluster(ctx context.Context, cluster types.Kub
 		// Manual deletion per cluster is only required if the auth server
 		// doesn't support actively cleaning up database resources when the
 		// inventory control stream is terminated during shutdown.
-		if capabilities := sender.Hello().Capabilities; capabilities != nil {
-			shouldDeleteOnShutdown = shouldDeleteOnShutdown && !capabilities.KubernetesCleanup
+		if capabilities := sender.Hello().GetCapabilities(); capabilities != nil {
+			shouldDeleteOnShutdown = shouldDeleteOnShutdown && !capabilities.GetKubernetesCleanup()
 		}
 	}
 
diff --git a/lib/kube/token/validator.go b/lib/kube/token/validator.go
index 923385f8685..0cbc245b2cf 100644
--- a/lib/kube/token/validator.go
+++ b/lib/kube/token/validator.go
@@ -213,17 +213,17 @@ func (v *TokenReviewValidator) Validate(ctx context.Context, token, clusterName
 		)
 	}
 
-	attrs := &workloadidentityv1pb.JoinAttrsKubernetes{
+	attrs := workloadidentityv1pb.JoinAttrsKubernetes_builder{
 		Subject: reviewResult.Status.User.Username,
-		ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+		ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 			Name:      serviceAccount,
 			Namespace: namespace,
-		},
-	}
+		}.Build(),
+	}.Build()
 	if podNamePresent && len(podName) == 1 {
-		attrs.Pod = &workloadidentityv1pb.JoinAttrsKubernetesPod{
+		attrs.SetPod(workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 			Name: podName[0],
-		}
+		}.Build())
 	}
 
 	return &ValidationResult{
@@ -324,16 +324,16 @@ func ValidateTokenWithJWKS(
 		Raw:      claims,
 		Type:     types.KubernetesJoinTypeStaticJWKS,
 		Username: claims.Subject,
-		attrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+		attrs: workloadidentityv1pb.JoinAttrsKubernetes_builder{
 			Subject: claims.Subject,
-			Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+			Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 				Name: claims.Kubernetes.Pod.Name,
-			},
-			ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+			}.Build(),
+			ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 				Name:      claims.Kubernetes.ServiceAccount.Name,
 				Namespace: claims.Kubernetes.Namespace,
-			},
-		},
+			}.Build(),
+		}.Build(),
 		ServiceAccountName:      claims.Kubernetes.ServiceAccount.Name,
 		ServiceAccountNamespace: claims.Kubernetes.Namespace,
 	}, nil
@@ -392,15 +392,15 @@ func (v *KubernetesOIDCTokenValidator) ValidateToken(
 		Username:                claims.GetSubject(),
 		ServiceAccountName:      claims.Kubernetes.ServiceAccount.Name,
 		ServiceAccountNamespace: claims.Kubernetes.Namespace,
-		attrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+		attrs: workloadidentityv1pb.JoinAttrsKubernetes_builder{
 			Subject: claims.GetSubject(),
-			Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+			Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 				Name: claims.Kubernetes.Pod.Name,
-			},
-			ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+			}.Build(),
+			ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 				Name:      claims.Kubernetes.ServiceAccount.Name,
 				Namespace: claims.Kubernetes.Namespace,
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}, nil
 }
diff --git a/lib/kube/token/validator_test.go b/lib/kube/token/validator_test.go
index 997b632a16a..553481012d4 100644
--- a/lib/kube/token/validator_test.go
+++ b/lib/kube/token/validator_test.go
@@ -207,16 +207,16 @@ func TestIDTokenValidator_Validate(t *testing.T) {
 				ServiceAccountName:      "my-service-account",
 				// Raw will be filled in during test run to value of review
 			},
-			wantAttrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+			wantAttrs: workloadidentityv1pb.JoinAttrsKubernetes_builder{
 				Subject: "system:serviceaccount:namespace:my-service-account",
-				Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+				Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 					Name: "podA",
-				},
-				ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+				}.Build(),
+				ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 					Name:      "my-service-account",
 					Namespace: "namespace",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			kubeVersion:   &boundTokenKubernetesVersion,
 			expectedError: nil,
 			// As the cluster doesn't have default audiences, we should not set
@@ -249,16 +249,16 @@ func TestIDTokenValidator_Validate(t *testing.T) {
 				ServiceAccountName:      "my-service-account",
 				// Raw will be filled in during test run to value of review
 			},
-			wantAttrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+			wantAttrs: workloadidentityv1pb.JoinAttrsKubernetes_builder{
 				Subject: "system:serviceaccount:namespace:my-service-account",
-				Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+				Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 					Name: "podA",
-				},
-				ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+				}.Build(),
+				ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 					Name:      "my-service-account",
 					Namespace: "namespace",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			kubeVersion:      &boundTokenKubernetesVersion,
 			expectedError:    nil,
 			clusterAudiences: defaultKubeAudiences,
@@ -288,13 +288,13 @@ func TestIDTokenValidator_Validate(t *testing.T) {
 				ServiceAccountName:      "my-service-account",
 				// Raw will be filled in during test run to value of review
 			},
-			wantAttrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+			wantAttrs: workloadidentityv1pb.JoinAttrsKubernetes_builder{
 				Subject: "system:serviceaccount:namespace:my-service-account",
-				ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+				ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 					Name:      "my-service-account",
 					Namespace: "namespace",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			kubeVersion:   &legacyTokenKubernetesVersion,
 			expectedError: nil,
 		},
@@ -515,16 +515,16 @@ func TestValidateTokenWithJWKS(t *testing.T) {
 				ServiceAccountNamespace: "default",
 				ServiceAccountName:      "my-service-account",
 			},
-			wantAttrs: &workloadidentityv1pb.JoinAttrsKubernetes{
+			wantAttrs: workloadidentityv1pb.JoinAttrsKubernetes_builder{
 				Subject: "system:serviceaccount:default:my-service-account",
-				Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+				Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 					Name: "my-pod-797959fdf-wptbj",
-				},
-				ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+				}.Build(),
+				ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 					Name:      "my-service-account",
 					Namespace: "default",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:   "missing bound pod claim",
diff --git a/lib/multiplexer/multiplexer_test.go b/lib/multiplexer/multiplexer_test.go
index 6fdb0dc6b2e..f411180c5b1 100644
--- a/lib/multiplexer/multiplexer_test.go
+++ b/lib/multiplexer/multiplexer_test.go
@@ -1393,7 +1393,7 @@ type server struct {
 }
 
 func (s *server) Ping(ctx context.Context, req *test.Request) (*test.Response, error) {
-	return &test.Response{Payload: "grpc backend"}, nil
+	return test.Response_builder{Payload: "grpc backend"}.Build(), nil
 }
 
 // clientConfig returns tls client config from test http server
diff --git a/lib/proxy/peer/quic/client.go b/lib/proxy/peer/quic/client.go
index 43e586c673f..e22d46c3522 100644
--- a/lib/proxy/peer/quic/client.go
+++ b/lib/proxy/peer/quic/client.go
@@ -234,21 +234,21 @@ func (c *ClientConn) Dial(nodeID, scope string, src net.Addr, dst net.Addr, tunn
 
 	log := c.log.With("conn_nonce", nonce)
 
-	req := &quicpeeringv1a.DialRequest{
+	req := quicpeeringv1a.DialRequest_builder{
 		TargetHostId:   nodeID,
 		TargetScope:    scope,
 		ConnectionType: string(tunnelType),
-		Source: &quicpeeringv1a.Addr{
+		Source: quicpeeringv1a.Addr_builder{
 			Network: src.Network(),
 			Addr:    src.String(),
-		},
-		Destination: &quicpeeringv1a.Addr{
+		}.Build(),
+		Destination: quicpeeringv1a.Addr_builder{
 			Network: dst.Network(),
 			Addr:    dst.String(),
-		},
+		}.Build(),
 		Timestamp: timestamppb.Now(),
 		Nonce:     nonce,
-	}
+	}.Build()
 	sizedReqBuf, err := marshalSized(req)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -399,11 +399,11 @@ func (c *ClientConn) Ping(ctx context.Context) error {
 
 	log := c.log.With("ping_nonce", nonce)
 
-	req := &quicpeeringv1a.DialRequest{
+	req := quicpeeringv1a.DialRequest_builder{
 		Timestamp: timestamppb.Now(),
 		Nonce:     nonce,
 		Ping:      true,
-	}
+	}.Build()
 	sizedReqBuf, err := marshalSized(req)
 	if err != nil {
 		return trace.Wrap(err)
diff --git a/lib/proxy/peer/quic/server.go b/lib/proxy/peer/quic/server.go
index 8f8721884b7..4f213185843 100644
--- a/lib/proxy/peer/quic/server.go
+++ b/lib/proxy/peer/quic/server.go
@@ -278,9 +278,9 @@ func (s *Server) handleStream(stream *quic.Stream, conn *quic.Conn, log *slog.Lo
 
 	sendErr := func(toSend error) {
 		stream.CancelRead(noStreamErrorCode)
-		errBuf, err := marshalSized(&quicpeeringv1a.DialResponse{
+		errBuf, err := marshalSized(quicpeeringv1a.DialResponse_builder{
 			Status: status.Convert(trail.ToGRPC(toSend)).Proto(),
-		})
+		}.Build())
 		if err != nil {
 			return
 		}
diff --git a/lib/proxy/router_test.go b/lib/proxy/router_test.go
index 9dae3f8a617..3704db79797 100644
--- a/lib/proxy/router_test.go
+++ b/lib/proxy/router_test.go
@@ -182,45 +182,45 @@ func TestScopePinning(t *testing.T) {
 		{
 			name:      "unscoped node unreachable when pinned",
 			host:      "unscoped.example.com",
-			pin:       &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"},
+			pin:       scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"}.Build(),
 			unmatched: true,
 		},
 		{
 			name: "parent scoped node reachable when pinned to exact scope",
 			host: "unique-parent.example.com",
-			pin:  &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"},
+			pin:  scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"}.Build(),
 		},
 		{
 			name:      "parent scoped node unreachable when pinned to child scope",
 			host:      "unique-parent.example.com",
-			pin:       &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging/west"},
+			pin:       scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging/west"}.Build(),
 			unmatched: true,
 		},
 		{
 			name: "child scoped node reachable when pinned to child scope",
 			host: "unique-child.example.com",
-			pin:  &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging/west"},
+			pin:  scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging/west"}.Build(),
 		},
 		{
 			name: "child scoped node reachable when pinned to parent scope",
 			host: "unique-child.example.com",
-			pin:  &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"},
+			pin:  scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"}.Build(),
 		},
 		{
 			name: "no collisions from orthogonal scopes when pinned",
 			host: "orthogonal.example.com",
-			pin:  &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"},
+			pin:  scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"}.Build(),
 		},
 		{
 			name:      "parent/child conflict when pinned to parent",
 			host:      "parent-child.example.com",
-			pin:       &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"},
+			pin:       scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging"}.Build(),
 			ambiguous: true,
 		},
 		{
 			name: "parent/child doesn't conflict when pinned to child",
 			host: "parent-child.example.com",
-			pin:  &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging/west"},
+			pin:  scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "/staging/west"}.Build(),
 		},
 		{
 			name:      "parent/child conflict when unpinned",
diff --git a/lib/relaypeer/client.go b/lib/relaypeer/client.go
index ce4bd66002c..816e2a4e407 100644
--- a/lib/relaypeer/client.go
+++ b/lib/relaypeer/client.go
@@ -241,12 +241,12 @@ func (c *Client) dialRelay(ctx context.Context, dialTarget string, tunnelType ty
 	})
 	defer defuse()
 
-	if err := writeProto(tc, &relaypeeringv1alpha.DialRequest{
+	if err := writeProto(tc, relaypeeringv1alpha.DialRequest_builder{
 		TargetHostId:   dialTarget,
 		ConnectionType: string(tunnelType),
 		Source:         addrToProto(src),
 		Destination:    addrToProto(dst),
-	}); err != nil {
+	}.Build()); err != nil {
 		defuse()
 		_ = tc.Close()
 		return nil, trace.Wrap(err)
diff --git a/lib/relaypeer/common.go b/lib/relaypeer/common.go
index 1f94eb05371..6e1f298c391 100644
--- a/lib/relaypeer/common.go
+++ b/lib/relaypeer/common.go
@@ -92,10 +92,10 @@ func addrToProto(a net.Addr) *relaypeeringv1alpha.Addr {
 		return nil
 	}
 
-	return &relaypeeringv1alpha.Addr{
+	return relaypeeringv1alpha.Addr_builder{
 		Network: a.Network(),
 		Addr:    a.String(),
-	}
+	}.Build()
 }
 
 func addrFromProto(a *relaypeeringv1alpha.Addr) net.Addr {
diff --git a/lib/relaypeer/server.go b/lib/relaypeer/server.go
index cf84ef0f526..3830b049b4e 100644
--- a/lib/relaypeer/server.go
+++ b/lib/relaypeer/server.go
@@ -285,16 +285,16 @@ func (s *Server) handleTLSConnection(nc net.Conn) error {
 		addrFromProto(req.GetDestination()),
 	)
 	if err != nil {
-		_ = writeProto(tc, &relaypeeringv1alpha.DialResponse{
+		_ = writeProto(tc, relaypeeringv1alpha.DialResponse_builder{
 			Status: status.Convert(trail.ToGRPC(err)).Proto(),
-		})
+		}.Build())
 		return trace.Wrap(err)
 	}
 	defer lc.Close()
 
-	if err := writeProto(tc, &relaypeeringv1alpha.DialResponse{
+	if err := writeProto(tc, relaypeeringv1alpha.DialResponse_builder{
 		Status: nil, // i.e. status.Convert(error(nil)).Proto()
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/lib/relaytunnel/discover.go b/lib/relaytunnel/discover.go
index 5cab12b6c4e..607660a9fe1 100644
--- a/lib/relaytunnel/discover.go
+++ b/lib/relaytunnel/discover.go
@@ -50,11 +50,11 @@ var _ relaytunnelv1alpha.DiscoveryServiceServer = (*StaticDiscoverServiceServer)
 
 // Discover implements [relaytunnelv1alpha.DiscoveryServiceServer].
 func (d *StaticDiscoverServiceServer) Discover(ctx context.Context, req *relaytunnelv1alpha.DiscoverRequest) (*relaytunnelv1alpha.DiscoverResponse, error) {
-	return &relaytunnelv1alpha.DiscoverResponse{
+	return relaytunnelv1alpha.DiscoverResponse_builder{
 		RelayGroup:            d.RelayGroup,
 		TargetConnectionCount: d.TargetConnectionCount,
 		SupportedTunnelTypes:  d.SupportedTunnelTypes,
-	}, nil
+	}.Build(), nil
 }
 
 type DiscoverParams struct {
diff --git a/lib/relaytunnel/tunnel_client.go b/lib/relaytunnel/tunnel_client.go
index 16f7679dcc1..de3aacde7f2 100644
--- a/lib/relaytunnel/tunnel_client.go
+++ b/lib/relaytunnel/tunnel_client.go
@@ -481,9 +481,9 @@ func (c *Client) dialOnceGrouped(log *slog.Logger) error {
 	helloDeadline, _ := helloCtx.Deadline()
 	controlStream.SetDeadline(helloDeadline)
 
-	if err := writeProto(controlStream, &relaytunnelv1alpha.ClientHello{
+	if err := writeProto(controlStream, relaytunnelv1alpha.ClientHello_builder{
 		TunnelType: string(c.tunnelType),
-	}); err != nil {
+	}.Build()); err != nil {
 		_ = controlStream.Close()
 		_ = session.Close()
 		return trace.Wrap(err)
@@ -603,19 +603,19 @@ func (c *yamuxClientConn) handleStream(stream *yamux.Stream, handleConnection fu
 	if err := readProto(stream, dialReq); err != nil {
 		return
 	}
-	src := addrFromProto(dialReq.Source)
-	dst := addrFromProto(dialReq.Destination)
+	src := addrFromProto(dialReq.GetSource())
+	dst := addrFromProto(dialReq.GetDestination())
 	if src == nil || dst == nil {
 		err := trace.BadParameter("missing source or destination address")
-		_ = writeProto(stream, &relaytunnelv1alpha.DialResponse{
+		_ = writeProto(stream, relaytunnelv1alpha.DialResponse_builder{
 			Status: status.Convert(trail.ToGRPC(err)).Proto(),
-		})
+		}.Build())
 		return
 	}
 
-	if err := writeProto(stream, &relaytunnelv1alpha.DialResponse{
+	if err := writeProto(stream, relaytunnelv1alpha.DialResponse_builder{
 		Status: nil, // i.e. status.Convert(error(nil)).Proto()
-	}); err != nil {
+	}.Build()); err != nil {
 		return
 	}
 
diff --git a/lib/relaytunnel/tunnel_common.go b/lib/relaytunnel/tunnel_common.go
index 7a739410ed8..e32d75bd18e 100644
--- a/lib/relaytunnel/tunnel_common.go
+++ b/lib/relaytunnel/tunnel_common.go
@@ -107,10 +107,10 @@ func addrToProto(a net.Addr) *relaytunnelv1alpha.Addr {
 		return nil
 	}
 
-	return &relaytunnelv1alpha.Addr{
+	return relaytunnelv1alpha.Addr_builder{
 		Network: a.Network(),
 		Addr:    a.String(),
-	}
+	}.Build()
 }
 
 func addrFromProto(a *relaytunnelv1alpha.Addr) net.Addr {
diff --git a/lib/relaytunnel/tunnel_server.go b/lib/relaytunnel/tunnel_server.go
index 27b5b65dfdc..e77ad578efe 100644
--- a/lib/relaytunnel/tunnel_server.go
+++ b/lib/relaytunnel/tunnel_server.go
@@ -343,9 +343,9 @@ func (s *Server) handleYamuxTunnel(c io.ReadWriteCloser, clientID *tlsca.Identit
 		return nil
 	}()
 	if helloErr != nil {
-		_ = writeProto(controlStream, &relaytunnelv1alpha.ServerHello{
+		_ = writeProto(controlStream, relaytunnelv1alpha.ServerHello_builder{
 			Status: status.Convert(trail.ToGRPC(helloErr)).Proto(),
-		})
+		}.Build())
 		return trace.Wrap(helloErr)
 	}
 
@@ -357,9 +357,9 @@ func (s *Server) handleYamuxTunnel(c io.ReadWriteCloser, clientID *tlsca.Identit
 		// have advertised termination but before the load balancer has stopped
 		// sending connections our way
 		err := &trace.ConnectionProblemError{Message: "server is shutting down"}
-		_ = writeProto(controlStream, &relaytunnelv1alpha.ServerHello{
+		_ = writeProto(controlStream, relaytunnelv1alpha.ServerHello_builder{
 			Status: status.Convert(trail.ToGRPC(err)).Proto(),
-		})
+		}.Build())
 		return trace.Wrap(err)
 	}
 	s.log.InfoContext(context.Background(), "new client connected", "client_id", clientID.Username, "tunnel_type", tunnelType)
@@ -368,12 +368,12 @@ func (s *Server) handleYamuxTunnel(c io.ReadWriteCloser, clientID *tlsca.Identit
 
 	controlStream.SetDeadline(time.Time{})
 
-	if err := writeProto(controlStream, &relaytunnelv1alpha.ServerHello{
+	if err := writeProto(controlStream, relaytunnelv1alpha.ServerHello_builder{
 		Status: nil, // i.e. status.Convert(error(nil)).Proto()
 
 		RelayGroup:            s.relayGroup,
 		TargetConnectionCount: s.targetConnectionCount,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -387,9 +387,9 @@ func (s *Server) handleYamuxTunnel(c io.ReadWriteCloser, clientID *tlsca.Identit
 		}
 
 		// currently the only message we have to send and we only send it once
-		_ = writeProto(controlStream, &relaytunnelv1alpha.ServerControl{
+		_ = writeProto(controlStream, relaytunnelv1alpha.ServerControl_builder{
 			Terminating: true,
-		})
+		}.Build())
 	}()
 
 	for {
@@ -517,10 +517,10 @@ func (c *yamuxServerConn) dial(ctx context.Context, src net.Addr, dst net.Addr)
 	})
 	defer defuse()
 
-	req := &relaytunnelv1alpha.DialRequest{
+	req := relaytunnelv1alpha.DialRequest_builder{
 		Source:      addrToProto(src),
 		Destination: addrToProto(dst),
-	}
+	}.Build()
 	if err := writeProto(stream, req); err != nil {
 		defuse()
 		_ = stream.Close()
diff --git a/lib/reversetunnel/cache.go b/lib/reversetunnel/cache.go
index 3b2e0ab41c5..a539bdb9af7 100644
--- a/lib/reversetunnel/cache.go
+++ b/lib/reversetunnel/cache.go
@@ -113,7 +113,7 @@ func (c *certificateCache) generateHostCert(ctx context.Context, principals []st
 		return nil, trace.Wrap(err)
 	}
 
-	res, err := c.authClient.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+	res, err := c.authClient.TrustClient().GenerateHostCert(ctx, trustpb.GenerateHostCertRequest_builder{
 		Key:         pubBytes,
 		HostId:      principals[0],
 		NodeName:    principals[0],
@@ -121,11 +121,11 @@ func (c *certificateCache) generateHostCert(ctx context.Context, principals []st
 		ClusterName: clusterName,
 		Role:        string(types.RoleNode),
 		Ttl:         durationpb.New(0),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	certBytes := res.SshCertificate
+	certBytes := res.GetSshCertificate()
 
 	// create a *ssh.Certificate
 	sshSigner, err := ssh.NewSignerFromSigner(hostKey)
diff --git a/lib/reversetunnel/leaf_cluster_test.go b/lib/reversetunnel/leaf_cluster_test.go
index 358dc24d831..048fa14b4d9 100644
--- a/lib/reversetunnel/leaf_cluster_test.go
+++ b/lib/reversetunnel/leaf_cluster_test.go
@@ -183,7 +183,7 @@ func TestRunValidatedMFAChallengeSync_DropsExpiredFailedChallenges(t *testing.T)
 		t,
 		func(t *testing.T) {
 			expired := newValidatedMFAChallenge("challenge-for-leaf")
-			expired.GetMetadata().Expires = timestamppb.New(time.Now().Add(expiredValidatedMFAChallengeGracePeriod + time.Nanosecond))
+			expired.GetMetadata().SetExpires(timestamppb.New(time.Now().Add(expiredValidatedMFAChallengeGracePeriod + time.Nanosecond)))
 
 			leafMFAClient := newMockMFAServiceClient()
 			leafMFAClient.errByName[expired.GetMetadata().GetName()] = []error{
@@ -355,7 +355,7 @@ func TestSyncValidatedMFAChallenges_SkipsExpiredChallenges(t *testing.T) {
 	leaf := newLeafClusterForSyncTest(leafMFAClient)
 
 	expired := newValidatedMFAChallenge("expired")
-	expired.GetMetadata().Expires = timestamppb.New(time.Now().Add(expiredValidatedMFAChallengeGracePeriod).Add(-time.Nanosecond))
+	expired.GetMetadata().SetExpires(timestamppb.New(time.Now().Add(expiredValidatedMFAChallengeGracePeriod).Add(-time.Nanosecond)))
 
 	failed := leaf.syncValidatedMFAChallenges(
 		t.Context(),
@@ -496,10 +496,10 @@ func newValidatedMFAChallenge(name string) *mfav2.ValidatedMFAChallenge {
 	return mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: "v1",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    name,
 			Expires: timestamppb.New(expires),
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload: mfav2.SessionIdentifyingPayload_builder{
 				SshSessionId: []byte("session-id"),
diff --git a/lib/reversetunnel/srv_test.go b/lib/reversetunnel/srv_test.go
index bcb006ee2bd..00dff7a5f6b 100644
--- a/lib/reversetunnel/srv_test.go
+++ b/lib/reversetunnel/srv_test.go
@@ -195,7 +195,7 @@ func TestServerKeyAuth(t *testing.T) {
 						Username:   con.User(),
 						Principals: []string{con.User()},
 						Roles:      []string{"dev", "admin"},
-						ScopePin:   &scopesv1.Pin{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "test"},
+						ScopePin:   scopesv1.Pin_builder{Kind: scopesv1.PinKind_PIN_KIND_USER, Scope: "test"}.Build(),
 					},
 				})
 				require.NoError(t, err)
@@ -338,13 +338,13 @@ func TestServerKeyAuth(t *testing.T) {
 					NodeName:      con.User(),
 					Identity: sshca.Identity{
 						ClusterName: "root",
-						ScopePin: &scopesv1.Pin{
+						ScopePin: scopesv1.Pin_builder{
 							Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 							Scope: "test-scope",
-							SystemRoles: &scopesv1.SystemRoles{
+							SystemRoles: scopesv1.SystemRoles_builder{
 								Primary: string(types.RoleNode),
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
 				})
 				require.NoError(t, err)
diff --git a/lib/reversetunnel/watcher_mfa_test.go b/lib/reversetunnel/watcher_mfa_test.go
index 982dfdcbb94..3d9f517f837 100644
--- a/lib/reversetunnel/watcher_mfa_test.go
+++ b/lib/reversetunnel/watcher_mfa_test.go
@@ -183,9 +183,9 @@ func newValidatedMFAChallengeWithTargetCluster(name, targetCluster string) *mfav
 	return mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: "v1",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload: mfav2.SessionIdentifyingPayload_builder{
 				SshSessionId: []byte("session-id"),
diff --git a/lib/scopes/access/access_test.go b/lib/scopes/access/access_test.go
index 66d094dad12..03a657cbf73 100644
--- a/lib/scopes/access/access_test.go
+++ b/lib/scopes/access/access_test.go
@@ -45,631 +45,631 @@ func TestValidateRole(t *testing.T) {
 	}{
 		{
 			name: "basic",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "unknown sub_kind",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind:    KindScopedRole,
 				SubKind: "unknown",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing name",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind:     KindScopedRole,
 				Metadata: &headerv1.Metadata{},
 				Scope:    "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing kind",
-			role: &scopedaccessv1.ScopedRole{
-				Metadata: &headerv1.Metadata{
+			role: scopedaccessv1.ScopedRole_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				}.Build(),
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing version",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "malformed name",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "foo/bar",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "malformed kind",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: "role",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "slightly malformed scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "foo/bar",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo/bar"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "siginifcantly malformed scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "foo@bar",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo/bar"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing assignable scopes",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope:   "/",
 				Spec:    &scopedaccessv1.ScopedRoleSpec{},
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "slightly malformed assignable scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"foo/bar"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "siginifcantly malformed assignable scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"foo@bar"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true, // invalid assignable scopes are totally ignored, even if they don't pass weak validation rules
 		},
 		{
 			name: "impermissable assignable scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/foo/bar",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "root assignable scope",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "invalid ssh.client_idle_timeout",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 						ClientIdleTimeout: "not-a-duration",
-					},
-				},
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "invalid defaults.client_idle_timeout",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 						ClientIdleTimeout: "not-a-duration",
-					},
-				},
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "invalid create_host_user_mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						HostUserCreation: &scopedaccessv1.CreateHostUser{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 							Mode: "invalid-mode",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "valid create_host_user_mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						HostUserCreation: &scopedaccessv1.CreateHostUser{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 							Mode: "keep",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "negative max_sessions",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 						MaxSessions: proto.Int64(-1),
-					},
-				},
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "positive max_sessions",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 						MaxSessions: proto.Int64(1),
-					},
-				},
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "invalid defaults.session_recording_mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind:     KindScopedRole,
-				Metadata: &headerv1.Metadata{Name: "test"},
+				Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 				Scope:    "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
-						SessionRecording: &scopedaccessv1.SessionRecording{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+						SessionRecording: scopedaccessv1.SessionRecording_builder{
 							Mode: "blah",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "invalid defaults.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
-						Lock: &scopedaccessv1.Lock{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "invalid",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "valid defaults.session_recording_mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind:     KindScopedRole,
-				Metadata: &headerv1.Metadata{Name: "test"},
+				Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 				Scope:    "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
-						SessionRecording: &scopedaccessv1.SessionRecording{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+						SessionRecording: scopedaccessv1.SessionRecording_builder{
 							Mode: string(constants.SessionRecordingModeStrict),
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "invalid ssh.session_recording_mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind:     KindScopedRole,
-				Metadata: &headerv1.Metadata{Name: "test"},
+				Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 				Scope:    "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						SessionRecording: &scopedaccessv1.SessionRecording{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						SessionRecording: scopedaccessv1.SessionRecording_builder{
 							Mode: "blah",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "invalid ssh.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						Lock: &scopedaccessv1.Lock{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "invalid",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "valid ssh.session_recording_mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind:     KindScopedRole,
-				Metadata: &headerv1.Metadata{Name: "test"},
+				Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 				Scope:    "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						SessionRecording: &scopedaccessv1.SessionRecording{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						SessionRecording: scopedaccessv1.SessionRecording_builder{
 							Mode: string(constants.SessionRecordingModeStrict),
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "valid ssh.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						Lock: &scopedaccessv1.Lock{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: string(constants.LockingModeStrict),
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 
 		{
 			name: "empty ssh.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Ssh: &scopedaccessv1.ScopedRoleSSH{
-						Lock: &scopedaccessv1.Lock{
+					Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "invalid kube.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Kube: &scopedaccessv1.ScopedRoleKube{
-						Lock: &scopedaccessv1.Lock{
+					Kube: scopedaccessv1.ScopedRoleKube_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "invalid",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "valid Kube.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Kube: &scopedaccessv1.ScopedRoleKube{
-						Lock: &scopedaccessv1.Lock{
+					Kube: scopedaccessv1.ScopedRoleKube_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: string(constants.LockingModeStrict),
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "empty Kube.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Kube: &scopedaccessv1.ScopedRoleKube{
-						Lock: &scopedaccessv1.Lock{
+					Kube: scopedaccessv1.ScopedRoleKube_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "invalid defaults.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
-						Lock: &scopedaccessv1.Lock{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "invalid",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "valid defaults.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
-						Lock: &scopedaccessv1.Lock{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: string(constants.LockingModeStrict),
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "empty defaults.lock.mode",
-			role: &scopedaccessv1.ScopedRole{
+			role: scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo"},
-					Defaults: &scopedaccessv1.ScopedRoleDefaults{
-						Lock: &scopedaccessv1.Lock{
+					Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+						Lock: scopedaccessv1.Lock_builder{
 							Mode: "",
-						},
-					},
-				},
+						}.Build(),
+					}.Build(),
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
@@ -704,486 +704,486 @@ func TestValidateAsssignment(t *testing.T) {
 	}{
 		{
 			name: "basic",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "unknown sub_kind",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: "unknown",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "missing name",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:     KindScopedRoleAssignment,
 				Metadata: &headerv1.Metadata{},
 				Scope:    "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing kind",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
-				Metadata: &headerv1.Metadata{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing sub_kind",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind: KindScopedRoleAssignment,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "missing scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				}.Build(),
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing version",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "malformed name - long name",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "thisiswaytoolongofanameaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "malformed kind",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind: "not_scoped_role_assignment",
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "slightly malformed scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "foo",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "significantly malformed scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "foo@bar",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "impermissable assigned scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/foo/bar",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "malformed assigned scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "root scope of effect",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind: KindScopedRoleAssignment,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "basic",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User: "alice",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "valid bot assignment",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					BotName:  "mybot",
 					BotScope: "/foo/bar",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo/bar/child",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "bot_name and user both set",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User:     "alice",
 					BotName:  "mybot",
 					BotScope: "/foo/bar",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "bot_name without bot_scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					BotName: "mybot",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "bot_scope without bot_name",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					User:     "alice",
 					BotScope: "/foo/bar",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "invalid bot_scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					BotName:  "mybot",
 					BotScope: "not-a-scope",
 					Assignments: []*scopedaccessv1.Assignment{
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "sub-assignment scope outside bot scope",
-			assignment: &scopedaccessv1.ScopedRoleAssignment{
+			assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 				Kind:    KindScopedRoleAssignment,
 				SubKind: SubKindDynamic,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: uuid.New().String(),
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					BotName:  "mybot",
 					BotScope: "/foo/bar",
 					Assignments: []*scopedaccessv1.Assignment{
 						// Valid
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo/bar",
-						},
+						}.Build(),
 						// Invalid
-						{
+						scopedaccessv1.Assignment_builder{
 							Role:  "test",
 							Scope: "/foo/baz",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
@@ -1251,12 +1251,12 @@ func TestWeakValidatedAssignableScopes(t *testing.T) {
 
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
-			result := slices.Collect(WeakValidatedAssignableScopes(&scopedaccessv1.ScopedRole{
+			result := slices.Collect(WeakValidatedAssignableScopes(scopedaccessv1.ScopedRole_builder{
 				Scope: tt.scope,
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: tt.assignableScopes,
-				},
-			}))
+				}.Build(),
+			}.Build()))
 			require.Equal(t, tt.expect, result)
 		})
 	}
@@ -1275,140 +1275,140 @@ func TestWeakValidatedSubAssignments(t *testing.T) {
 			name:  "basic",
 			scope: "/foo",
 			assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 			expect: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:  "mildly malformed scope",
 			scope: "/foo",
 			assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 			expect: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:  "significantly malformed scope",
 			scope: "/foo",
 			assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "foo@bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 			expect: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:  "impermissible scope",
 			scope: "/foo/bar",
 			assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 			expect: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/bar",
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:  "missing scope",
 			scope: "/foo",
 			assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 			expect: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 		},
 		{
 			name:  "missing role",
 			scope: "/foo",
 			assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "",
 					Scope: "/foo/baz",
-				},
+				}.Build(),
 			},
 			expect: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "test",
 					Scope: "/foo/bar",
-				},
+				}.Build(),
 			},
 		},
 	}
 
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
-			result := slices.Collect(WeakValidatedSubAssignments(&scopedaccessv1.ScopedRoleAssignment{
+			result := slices.Collect(WeakValidatedSubAssignments(scopedaccessv1.ScopedRoleAssignment_builder{
 				Scope: tt.scope,
-				Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+				Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 					Assignments: tt.assignments,
-				},
-			}))
+				}.Build(),
+			}.Build()))
 			require.Equal(t, tt.expect, result)
 		})
 	}
@@ -1491,82 +1491,82 @@ func TestScopedRoleSpecTopLevelFieldsAreMessages(t *testing.T) {
 func TestStrongValidateRoleSpecAllFieldsValidated(t *testing.T) {
 	t.Parallel()
 
-	spec := &scopedaccessv1.ScopedRoleSpec{
+	spec := scopedaccessv1.ScopedRoleSpec_builder{
 		AssignableScopes: []string{"/foo"},
-		Defaults: &scopedaccessv1.ScopedRoleDefaults{
+		Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 			ClientIdleTimeout: "30m",
-			SessionRecording: &scopedaccessv1.SessionRecording{
+			SessionRecording: scopedaccessv1.SessionRecording_builder{
 				Mode: string(constants.SessionRecordingModeStrict),
-			},
-			Lock: &scopedaccessv1.Lock{
+			}.Build(),
+			Lock: scopedaccessv1.Lock_builder{
 				Mode: "strict",
-			},
+			}.Build(),
 			DisconnectExpiredCert: ptr(true),
-		},
+		}.Build(),
 		Rules: []*scopedaccessv1.ScopedRule{
-			{
+			scopedaccessv1.ScopedRule_builder{
 				Resources: []string{KindScopedRole},
 				Verbs:     []string{types.VerbReadNoSecrets},
-			},
+			}.Build(),
 		},
-		Ssh: &scopedaccessv1.ScopedRoleSSH{
+		Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 			Logins: []string{"alice"},
 			Labels: []*labelv1.Label{
-				{Name: "env", Values: []string{"prod"}},
+				labelv1.Label_builder{Name: "env", Values: []string{"prod"}}.Build(),
 			},
 			ClientIdleTimeout:   "1h",
 			PermitX11Forwarding: proto.Bool(true),
 			FileCopy:            proto.Bool(true),
 			ForwardAgent:        proto.Bool(true),
-			PortForwarding: &scopedaccessv1.SSHPortForwarding{
-				Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: proto.Bool(true)},
-				Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: proto.Bool(true)},
-			},
-			HostUserCreation: &scopedaccessv1.CreateHostUser{
+			PortForwarding: scopedaccessv1.SSHPortForwarding_builder{
+				Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: proto.Bool(true)}.Build(),
+				Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: proto.Bool(true)}.Build(),
+			}.Build(),
+			HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 				Mode:   "keep",
 				Groups: []string{"wheel"},
 				Shell:  "/bin/bash",
-			},
+			}.Build(),
 			HostSudoers: []string{"ALL=(ALL) NOPASSWD:ALL"},
 			MaxSessions: proto.Int64(10),
-			EnhancedRecording: &scopedaccessv1.EnhancedRecording{
+			EnhancedRecording: scopedaccessv1.EnhancedRecording_builder{
 				Disk:    proto.Bool(true),
 				Network: proto.Bool(true),
 				Command: proto.Bool(true),
-			},
-			SessionRecording: &scopedaccessv1.SessionRecording{
+			}.Build(),
+			SessionRecording: scopedaccessv1.SessionRecording_builder{
 				Mode: string(constants.SessionRecordingModeStrict),
-			},
-			Lock: &scopedaccessv1.Lock{
+			}.Build(),
+			Lock: scopedaccessv1.Lock_builder{
 				Mode: string(constants.LockingModeBestEffort),
-			},
+			}.Build(),
 			DisconnectExpiredCert: proto.Bool(true),
-		},
-		Kube: &scopedaccessv1.ScopedRoleKube{
+		}.Build(),
+		Kube: scopedaccessv1.ScopedRoleKube_builder{
 			Groups: []string{"viewer"},
 			Users:  []string{"alice"},
 			Labels: []*labelv1.Label{
-				{Name: "env", Values: []string{"prod"}},
+				labelv1.Label_builder{Name: "env", Values: []string{"prod"}}.Build(),
 			},
 			ClientIdleTimeout:     "1h",
 			DisconnectExpiredCert: ptr(true),
-			Lock: &scopedaccessv1.Lock{
+			Lock: scopedaccessv1.Lock_builder{
 				Mode: "strict",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	require.True(t, testutils.ExhaustiveNonEmpty(spec),
 		"spec is not exhaustively non-empty; if you added a new field, set it to a valid non-zero value here AND evaluate whether StrongValidateRole needs to validate it (adding test cases to TestValidateRole if so) — empty fields: %v",
 		testutils.FindAllEmpty(spec),
 	)
 
-	role := &scopedaccessv1.ScopedRole{
+	role := scopedaccessv1.ScopedRole_builder{
 		Kind:     KindScopedRole,
-		Metadata: &headerv1.Metadata{Name: "test"},
+		Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 		Scope:    "/",
 		Spec:     spec,
 		Version:  types.V1,
-	}
+	}.Build()
 	require.NoError(t, StrongValidateRole(role))
 }
diff --git a/lib/scopes/access/compat_test.go b/lib/scopes/access/compat_test.go
index c6e49600659..43f5cf94394 100644
--- a/lib/scopes/access/compat_test.go
+++ b/lib/scopes/access/compat_test.go
@@ -36,17 +36,17 @@ import (
 func TestEmptyRoleConverts(t *testing.T) {
 	t.Parallel()
 
-	role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+	role, err := ScopedRoleToRole(scopedaccessv1.ScopedRole_builder{
 		Kind: KindScopedRole,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test",
-		},
+		}.Build(),
 		Scope: "/foo",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/foo/bar"},
-		},
+		}.Build(),
 		Version: types.V1,
-	}, "/foo/bar")
+	}.Build(), "/foo/bar")
 	require.NoError(t, err)
 	require.NotNil(t, role)
 	require.Equal(t, "test@/foo/bar", role.GetName())
@@ -73,15 +73,15 @@ func TestSSHConversion(t *testing.T) {
 		},
 		{
 			name: "sparse",
-			ssh: &scopedaccessv1.ScopedRoleSSH{
+			ssh: scopedaccessv1.ScopedRoleSSH_builder{
 				Logins: []string{"root"},
 				Labels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "team",
 						Values: []string{"red"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expect: types.RoleConditions{
 				Logins: []string{"root"},
 				NodeLabels: types.Labels{
@@ -91,19 +91,19 @@ func TestSSHConversion(t *testing.T) {
 		},
 		{
 			name: "full",
-			ssh: &scopedaccessv1.ScopedRoleSSH{
+			ssh: scopedaccessv1.ScopedRoleSSH_builder{
 				Logins: []string{"root", "admin"},
 				Labels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "env",
 						Values: []string{"prod", "staging"},
-					},
-					{
+					}.Build(),
+					labelv1.Label_builder{
 						Name:   "team",
 						Values: []string{"blue"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expect: types.RoleConditions{
 				Logins: []string{"root", "admin"},
 				NodeLabels: types.Labels{
@@ -116,18 +116,18 @@ func TestSSHConversion(t *testing.T) {
 
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
-			role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+			role, err := ScopedRoleToRole(scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/foo",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo/bar"},
 					Ssh:              tt.ssh,
-				},
+				}.Build(),
 				Version: types.V1,
-			}, "/foo/bar")
+			}.Build(), "/foo/bar")
 			require.NoError(t, err)
 			tt.expect.Namespaces = []string{"default"}
 			require.Empty(t, cmp.Diff(tt.expect, role.GetRoleConditions(types.Allow)))
@@ -147,14 +147,14 @@ func TestRulesConversion(t *testing.T) {
 		{
 			name: "basic",
 			rules: []*scopedaccessv1.ScopedRule{
-				{
+				scopedaccessv1.ScopedRule_builder{
 					Resources: []string{KindScopedRole},
 					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
-				},
-				{
+				}.Build(),
+				scopedaccessv1.ScopedRule_builder{
 					Resources: []string{KindScopedRoleAssignment},
 					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets, types.VerbCreate, types.VerbUpdate, types.VerbDelete},
-				},
+				}.Build(),
 			},
 			expect: []types.Rule{
 				{
@@ -170,10 +170,10 @@ func TestRulesConversion(t *testing.T) {
 		{
 			name: "unsupported verb",
 			rules: []*scopedaccessv1.ScopedRule{
-				{
+				scopedaccessv1.ScopedRule_builder{
 					Resources: []string{KindScopedRole},
 					Verbs:     []string{types.VerbList, types.VerbRead},
-				},
+				}.Build(),
 			},
 			expect: []types.Rule{
 				{
@@ -185,14 +185,14 @@ func TestRulesConversion(t *testing.T) {
 		{
 			name: "unsupported resource",
 			rules: []*scopedaccessv1.ScopedRule{
-				{
+				scopedaccessv1.ScopedRule_builder{
 					Resources: []string{types.KindCertAuthority},
 					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
-				},
-				{
+				}.Build(),
+				scopedaccessv1.ScopedRule_builder{
 					Resources: []string{KindScopedRole},
 					Verbs:     []string{types.VerbList, types.VerbReadNoSecrets},
-				},
+				}.Build(),
 			},
 			expect: []types.Rule{
 				{
@@ -205,18 +205,18 @@ func TestRulesConversion(t *testing.T) {
 
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
-			role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+			role, err := ScopedRoleToRole(scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/foo",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/foo/bar"},
 					Rules:            tt.rules,
-				},
+				}.Build(),
 				Version: types.V1,
-			}, "/foo/bar")
+			}.Build(), "/foo/bar")
 			require.NoError(t, err)
 			require.Empty(t, cmp.Diff(tt.expect, role.GetRules(types.Allow)))
 		})
@@ -224,17 +224,17 @@ func TestRulesConversion(t *testing.T) {
 }
 
 func baseScopedRole() *scopedaccessv1.ScopedRole {
-	return &scopedaccessv1.ScopedRole{
+	return scopedaccessv1.ScopedRole_builder{
 		Kind:     KindScopedRole,
-		Metadata: &headerv1.Metadata{Name: "test"},
+		Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 		Scope:    "/foo",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/foo/bar"},
 			Ssh:              &scopedaccessv1.ScopedRoleSSH{},
 			Kube:             &scopedaccessv1.ScopedRoleKube{},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 }
 
 func ptr[T any](v T) *T { return &v }
@@ -246,7 +246,7 @@ func TestClientIdleTimeoutNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.ClientIdleTimeout = "30m"
+	sr.GetSpec().GetSsh().SetClientIdleTimeout("30m")
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -260,7 +260,7 @@ func TestX11ForwardingNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.PermitX11Forwarding = ptr(true)
+	sr.GetSpec().GetSsh().PermitX11Forwarding = ptr(true)
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -271,7 +271,7 @@ func TestForwardAgentNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.ForwardAgent = ptr(true)
+	sr.GetSpec().GetSsh().ForwardAgent = ptr(true)
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -282,7 +282,7 @@ func TestMaxSessionsNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.MaxSessions = ptr(int64(10))
+	sr.GetSpec().GetSsh().MaxSessions = ptr(int64(10))
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -293,10 +293,10 @@ func TestSSHPortForwardingNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.PortForwarding = &scopedaccessv1.SSHPortForwarding{
-		Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: ptr(false)},
-		Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: ptr(false)},
-	}
+	sr.GetSpec().GetSsh().SetPortForwarding(scopedaccessv1.SSHPortForwarding_builder{
+		Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: ptr(false)}.Build(),
+		Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: ptr(false)}.Build(),
+	}.Build())
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -307,9 +307,9 @@ func TestHostUserCreationNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.HostUserCreation = &scopedaccessv1.CreateHostUser{
+	sr.GetSpec().GetSsh().SetHostUserCreation(scopedaccessv1.CreateHostUser_builder{
 		Mode: "keep",
-	}
+	}.Build())
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -320,7 +320,7 @@ func TestSSHFileCopyNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.FileCopy = ptr(false)
+	sr.GetSpec().GetSsh().FileCopy = ptr(false)
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -331,11 +331,11 @@ func TestEnhancedRecordingNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.EnhancedRecording = &scopedaccessv1.EnhancedRecording{
+	sr.GetSpec().GetSsh().SetEnhancedRecording(scopedaccessv1.EnhancedRecording_builder{
 		Command: ptr(true),
 		Network: ptr(true),
 		Disk:    ptr(true),
-	}
+	}.Build())
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
 	// BPF is the classic role equivalent of enhanced_recording.
@@ -346,7 +346,7 @@ func TestDisconnectExpiredCertNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.DisconnectExpiredCert = ptr(true)
+	sr.GetSpec().GetSsh().DisconnectExpiredCert = ptr(true)
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -357,9 +357,9 @@ func TestKubeDisconnectExpiredCertNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Kube = &scopedaccessv1.ScopedRoleKube{
+	sr.GetSpec().SetKube(scopedaccessv1.ScopedRoleKube_builder{
 		DisconnectExpiredCert: ptr(true),
-	}
+	}.Build())
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -370,9 +370,9 @@ func TestSessionRecordingNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.SessionRecording = &scopedaccessv1.SessionRecording{
+	sr.GetSpec().GetSsh().SetSessionRecording(scopedaccessv1.SessionRecording_builder{
 		Mode: string(constants.SessionRecordingModeBestEffort),
-	}
+	}.Build())
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -388,9 +388,9 @@ func TestSSHLockingModeNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Ssh.Lock = &scopedaccessv1.Lock{
+	sr.GetSpec().GetSsh().SetLock(scopedaccessv1.Lock_builder{
 		Mode: "strict",
-	}
+	}.Build())
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -402,9 +402,9 @@ func TestKubeLockingModeNotInClassicRole(t *testing.T) {
 	t.Parallel()
 
 	sr := baseScopedRole()
-	sr.Spec.Kube.Lock = &scopedaccessv1.Lock{
+	sr.GetSpec().GetKube().SetLock(scopedaccessv1.Lock_builder{
 		Mode: "strict",
-	}
+	}.Build())
 
 	role, err := ScopedRoleToRole(sr, "/foo/bar")
 	require.NoError(t, err)
@@ -436,16 +436,16 @@ func TestKubeConversion(t *testing.T) {
 		},
 		{
 			name: "sparse",
-			kube: &scopedaccessv1.ScopedRoleKube{
+			kube: scopedaccessv1.ScopedRoleKube_builder{
 				Users:  []string{"system:user"},
 				Groups: []string{"viewer"},
 				Labels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "team",
 						Values: []string{"red"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expect: types.RoleConditions{
 				KubeUsers:  []string{"system:user"},
 				KubeGroups: []string{"viewer"},
@@ -457,20 +457,20 @@ func TestKubeConversion(t *testing.T) {
 		},
 		{
 			name: "full",
-			kube: &scopedaccessv1.ScopedRoleKube{
+			kube: scopedaccessv1.ScopedRoleKube_builder{
 				Users:  []string{"system:user", "system:admin"},
 				Groups: []string{"viewer", "editor"},
 				Labels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "env",
 						Values: []string{"prod", "staging"},
-					},
-					{
+					}.Build(),
+					labelv1.Label_builder{
 						Name:   "team",
 						Values: []string{"blue"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expect: types.RoleConditions{
 				KubeUsers:  []string{"system:user", "system:admin"},
 				KubeGroups: []string{"viewer", "editor"},
@@ -485,18 +485,18 @@ func TestKubeConversion(t *testing.T) {
 
 	for _, tt := range tts {
 		t.Run(tt.name, func(t *testing.T) {
-			role, err := ScopedRoleToRole(&scopedaccessv1.ScopedRole{
+			role, err := ScopedRoleToRole(scopedaccessv1.ScopedRole_builder{
 				Kind: KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test",
-				},
+				}.Build(),
 				Scope: "/foo",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					Kube:             tt.kube,
 					AssignableScopes: []string{"/foo/bar"},
-				},
+				}.Build(),
 				Version: types.V1,
-			}, "/foo/bar")
+			}.Build(), "/foo/bar")
 			require.NoError(t, err)
 			tt.expect.Namespaces = []string{"default"}
 			require.Empty(t, cmp.Diff(tt.expect, role.GetRoleConditions(types.Allow)))
diff --git a/lib/scopes/cache/access/access_test.go b/lib/scopes/cache/access/access_test.go
index 7385913771f..9a3a0f75366 100644
--- a/lib/scopes/cache/access/access_test.go
+++ b/lib/scopes/cache/access/access_test.go
@@ -62,9 +62,9 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 	var expectedRoleNames []string
 	for i := 0; i < 10; i++ {
 		name := fmt.Sprintf("role-%d", i)
-		_, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: newScopedRole(name),
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedRoleNames = append(expectedRoleNames, name)
@@ -75,9 +75,9 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 	var expectedAssignmentNames []string
 	for i := 0; i < 10; i++ {
 		assignment := newScopedRoleAssignment(expectedRoleNames[i])
-		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		_, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: assignment,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
@@ -134,9 +134,9 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 	// perform additional role writes to cover event replication
 	for i := 10; i < 20; i++ {
 		name := fmt.Sprintf("role-%d", i)
-		_, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: newScopedRole(name),
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedRoleNames = append(expectedRoleNames, name)
@@ -145,9 +145,9 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 	// perform additional assignment writes to cover event replication
 	for i := 10; i < 20; i++ {
 		assignment := newScopedRoleAssignment(expectedRoleNames[i])
-		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		_, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: assignment,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
@@ -183,11 +183,11 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 	for role, err := range scopedutils.RangeScopedRoles(ctx, cache, &scopedaccessv1.ListScopedRolesRequest{}) {
 		require.NoError(t, err)
 
-		role.Metadata.Labels = map[string]string{"updated": "true"}
+		role.GetMetadata().SetLabels(map[string]string{"updated": "true"})
 
-		_, err := service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		_, err := service.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -203,10 +203,10 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 
 	// test that cache can handle partial deletes for assignments
 	for _, name := range expectedAssignmentNames[0:10] {
-		_, err := service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		_, err := service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 			Name:    name,
 			SubKind: scopedaccess.SubKindDynamic,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -225,10 +225,10 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 
 	// test that cache can handle delete of all assignments
 	for _, name := range expectedAssignmentNames[10:] {
-		_, err := service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+		_, err := service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 			Name:    name,
 			SubKind: scopedaccess.SubKindDynamic,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -239,9 +239,9 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 
 	// test that cache can handle partial deletes for roles
 	for _, name := range expectedRoleNames[0:10] {
-		_, err := service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		_, err := service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 			Name: name,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -259,9 +259,9 @@ func TestScopedAccessCacheReplication(t *testing.T) {
 
 	// test that cache can handle delete of all roles
 	for _, name := range expectedRoleNames[10:] {
-		_, err := service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+		_, err := service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 			Name: name,
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -295,9 +295,9 @@ func TestScopedAccessCacheFallback(t *testing.T) {
 	var expectedRoleNames []string
 	for i := 0; i < 10; i++ {
 		name := fmt.Sprintf("role-%d", i)
-		_, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: newScopedRole(name),
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedRoleNames = append(expectedRoleNames, name)
@@ -308,9 +308,9 @@ func TestScopedAccessCacheFallback(t *testing.T) {
 	var expectedAssignmentNames []string
 	for i := 0; i < 10; i++ {
 		assignment := newScopedRoleAssignment(expectedRoleNames[i])
-		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		_, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: assignment,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
@@ -368,9 +368,9 @@ func TestScopedAccessCacheFallback(t *testing.T) {
 	// perform additional role writes to cover subsequent ttl-cache image loads
 	for i := 10; i < 20; i++ {
 		name := fmt.Sprintf("role-%d", i)
-		_, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		_, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: newScopedRole(name),
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedRoleNames = append(expectedRoleNames, name)
@@ -379,9 +379,9 @@ func TestScopedAccessCacheFallback(t *testing.T) {
 	// perform additional assignment writes to cover ttl-cache image loads
 	for i := 10; i < 20; i++ {
 		assignment := newScopedRoleAssignment(expectedRoleNames[i])
-		_, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		_, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: assignment,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		expectedAssignmentNames = append(expectedAssignmentNames, assignment.GetMetadata().GetName())
@@ -415,38 +415,38 @@ func TestScopedAccessCacheFallback(t *testing.T) {
 }
 
 func newScopedRole(name string) *scopedaccessv1.ScopedRole {
-	return &scopedaccessv1.ScopedRole{
+	return scopedaccessv1.ScopedRole_builder{
 		Kind: scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/foo"},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 }
 
 func newScopedRoleAssignment(roleName string) *scopedaccessv1.ScopedRoleAssignment {
-	return &scopedaccessv1.ScopedRoleAssignment{
+	return scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "alice",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  roleName,
 					Scope: "/foo",
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 }
 
 func waitForRoleCondition(t *testing.T, reader services.ScopedRoleReader, condition func([]*scopedaccessv1.ScopedRole) bool) {
diff --git a/lib/scopes/cache/access/materializer.go b/lib/scopes/cache/access/materializer.go
index efe2e5eac0f..e6e137b02f1 100644
--- a/lib/scopes/cache/access/materializer.go
+++ b/lib/scopes/cache/access/materializer.go
@@ -831,39 +831,39 @@ func (m *Materializer) materializeAssignment(
 		return nil
 	}
 
-	assignment := &scopedaccessv1.ScopedRoleAssignment{
+	assignment := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindMaterialized,
 		Version: types.V1,
 		Scope:   "/",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: key.AssignmentName(),
-		},
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		}.Build(),
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: userName,
-		},
-		Status: &scopedaccessv1.ScopedRoleAssignmentStatus{
-			Origin: &scopedaccessv1.ScopedRoleAssignmentStatus_Origin{
+		}.Build(),
+		Status: scopedaccessv1.ScopedRoleAssignmentStatus_builder{
+			Origin: scopedaccessv1.ScopedRoleAssignmentStatus_Origin_builder{
 				CreatorKind: scopedaccess.CreatorKindAccessList,
 				CreatorName: list.GetName(),
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	if relation.isMember {
 		for _, grant := range list.Spec.Grants.ScopedRoles {
-			assignment.Spec.Assignments = append(assignment.Spec.Assignments, &scopedaccessv1.Assignment{
+			assignment.GetSpec().SetAssignments(append(assignment.GetSpec().GetAssignments(), scopedaccessv1.Assignment_builder{
 				Role:  grant.Role,
 				Scope: grant.Scope,
-			})
+			}.Build()))
 		}
 	}
 	if relation.isOwner {
 		for _, grant := range list.Spec.OwnerGrants.ScopedRoles {
-			assignment.Spec.Assignments = append(assignment.Spec.Assignments, &scopedaccessv1.Assignment{
+			assignment.GetSpec().SetAssignments(append(assignment.GetSpec().GetAssignments(), scopedaccessv1.Assignment_builder{
 				Role:  grant.Role,
 				Scope: grant.Scope,
-			})
+			}.Build()))
 		}
 	}
 
diff --git a/lib/scopes/cache/access/materializer_test.go b/lib/scopes/cache/access/materializer_test.go
index 68f1d5f118a..5425736647d 100644
--- a/lib/scopes/cache/access/materializer_test.go
+++ b/lib/scopes/cache/access/materializer_test.go
@@ -193,18 +193,18 @@ func TestMaterializerSimpleChain(t *testing.T) {
 			},
 		},
 		expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-			expectedScopedRoleAssignment("tester", "base", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("tester", "base", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "baserole",
 				Scope: "/aa",
-			}}),
-			expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{{
+			}.Build()}),
+			expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "parentrole",
 				Scope: "/aa/bb",
-			}}),
-			expectedScopedRoleAssignment("tester", "grandparent", []*scopedaccessv1.Assignment{{
+			}.Build()}),
+			expectedScopedRoleAssignment("tester", "grandparent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "grandparentrole",
 				Scope: "/aa/bb/cc",
-			}}),
+			}.Build()}),
 		},
 	})
 }
@@ -240,22 +240,22 @@ func TestMaterializerDoubleListMembership(t *testing.T) {
 		expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 			// All users should be direct or nested members of the parent role,
 			// expect exactly one materialized assignment each.
-			expectedScopedRoleAssignment("testerA", "parent", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("testerA", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "parentrole",
 				Scope: "/parentscope",
-			}}),
-			expectedScopedRoleAssignment("testerB", "parent", []*scopedaccessv1.Assignment{{
+			}.Build()}),
+			expectedScopedRoleAssignment("testerB", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "parentrole",
 				Scope: "/parentscope",
-			}}),
-			expectedScopedRoleAssignment("testerC", "parent", []*scopedaccessv1.Assignment{{
+			}.Build()}),
+			expectedScopedRoleAssignment("testerC", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "parentrole",
 				Scope: "/parentscope",
-			}}),
-			expectedScopedRoleAssignment("testerD", "parent", []*scopedaccessv1.Assignment{{
+			}.Build()}),
+			expectedScopedRoleAssignment("testerD", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "parentrole",
 				Scope: "/parentscope",
-			}}),
+			}.Build()}),
 		},
 	})
 }
@@ -289,14 +289,14 @@ func TestMaterializerDoubleListParents(t *testing.T) {
 		},
 		expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 			// User should be a nested member of both parents and get an assignment for each.
-			expectedScopedRoleAssignment("tester", "parentA", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("tester", "parentA", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "roleA",
 				Scope: "/aa",
-			}}),
-			expectedScopedRoleAssignment("tester", "parentB", []*scopedaccessv1.Assignment{{
+			}.Build()}),
+			expectedScopedRoleAssignment("tester", "parentB", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "roleB",
 				Scope: "/bb",
-			}}),
+			}.Build()}),
 		},
 	})
 }
@@ -321,10 +321,10 @@ func TestMaterializerDirectOwner(t *testing.T) {
 		expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 			// The user is simply a direct owner of the access list and an
 			// assignment is expected.
-			expectedScopedRoleAssignment("tester", "testlist", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("tester", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "testrole",
 				Scope: "/aa",
-			}}),
+			}.Build()}),
 		},
 	})
 }
@@ -359,10 +359,10 @@ func TestMaterializerUserMemberPutPreservesExistingOwnerGrant(t *testing.T) {
 				},
 			},
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "ownerrole",
 					Scope: "/owner",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{{
 				mutateState: func(t *testing.T, state *materializerTestcaseState) {
@@ -373,13 +373,13 @@ func TestMaterializerUserMemberPutPreservesExistingOwnerGrant(t *testing.T) {
 				expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 					// tester is now both a direct owner of granted and a nested member via child,
 					// so the materialized assignment must include both grants.
-					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 						Role:  "memberrole",
 						Scope: "/member",
-					}, {
+					}.Build(), scopedaccessv1.Assignment_builder{
 						Role:  "ownerrole",
 						Scope: "/owner",
-					}}),
+					}.Build()}),
 				},
 			}},
 		})
@@ -420,10 +420,10 @@ func TestMaterializerListMemberPutPreservesExistingOwnerGrant(t *testing.T) {
 				},
 			},
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "ownerrole",
 					Scope: "/owner",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{{
 				mutateState: func(t *testing.T, state *materializerTestcaseState) {
@@ -434,13 +434,13 @@ func TestMaterializerListMemberPutPreservesExistingOwnerGrant(t *testing.T) {
 				expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 					// tester is now both a direct owner of granted and a nested member via
 					// parent->child, so the materialized assignment must include both grants.
-					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 						Role:  "memberrole",
 						Scope: "/member",
-					}, {
+					}.Build(), scopedaccessv1.Assignment_builder{
 						Role:  "ownerrole",
 						Scope: "/owner",
-					}}),
+					}.Build()}),
 				},
 			}},
 		})
@@ -482,10 +482,10 @@ func TestMaterializerAccessListPutPreservesExistingOwnerGrant(t *testing.T) {
 			},
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 				// tests is initially ownly an owner of the granted list.
-				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "ownerrole",
 					Scope: "/owner",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{{
 				mutateState: func(t *testing.T, state *materializerTestcaseState) {
@@ -497,13 +497,13 @@ func TestMaterializerAccessListPutPreservesExistingOwnerGrant(t *testing.T) {
 				expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 					// as tests is now a member and owner of granted, make sure
 					// the materialiazed assignment includes both grants.
-					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 						Role:  "memberrole",
 						Scope: "/member",
-					}, {
+					}.Build(), scopedaccessv1.Assignment_builder{
 						Role:  "ownerrole",
 						Scope: "/owner",
-					}}),
+					}.Build()}),
 				},
 			}},
 		})
@@ -539,10 +539,10 @@ func TestMaterializerOwnerRequirements(t *testing.T) {
 				// tester is a valid member of list "owners". All valid members of
 				// list "owners" are valid _owners_ of list "granted", so the
 				// assignment should be materialized.
-				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "ownerrole",
 					Scope: "/aa",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{{
 				mutateState: func(t *testing.T, state *materializerTestcaseState) {
@@ -560,14 +560,14 @@ func TestMaterializerOwnerRequirements(t *testing.T) {
 				expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 					// The nested user is also a valid member of the owners list so
 					// should also have an assignment materialized.
-					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{{
+					expectedScopedRoleAssignment("tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 						Role:  "ownerrole",
 						Scope: "/aa",
-					}}),
-					expectedScopedRoleAssignment("nested_tester", "granted", []*scopedaccessv1.Assignment{{
+					}.Build()}),
+					expectedScopedRoleAssignment("nested_tester", "granted", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 						Role:  "ownerrole",
 						Scope: "/aa",
-					}}),
+					}.Build()}),
 				},
 			}},
 		})
@@ -617,25 +617,25 @@ func TestMaterializerOwnerChain(t *testing.T) {
 		},
 		expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
 			// baseowner is a direct owner of base list. Ownership is not inherited.
-			expectedScopedRoleAssignment("baseowner", "base", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("baseowner", "base", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "baseownerrole",
 				Scope: "/aa",
-			}}),
+			}.Build()}),
 			// basemember is a member of base list, base list is an owner of parent list.
-			expectedScopedRoleAssignment("basemember", "parent", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("basemember", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "parentownerrole",
 				Scope: "/aa/bb",
-			}}),
+			}.Build()}),
 			// basemember is a nested member of parent list, parent list is an owner of grandparent list.
-			expectedScopedRoleAssignment("basemember", "grandparent", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("basemember", "grandparent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "grandparentownerrole",
 				Scope: "/aa/bb/cc",
-			}}),
+			}.Build()}),
 			// parentmember is a member of parent list, parent list is an owner of grandparent list.
-			expectedScopedRoleAssignment("parentmember", "grandparent", []*scopedaccessv1.Assignment{{
+			expectedScopedRoleAssignment("parentmember", "grandparent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 				Role:  "grandparentownerrole",
 				Scope: "/aa/bb/cc",
-			}}),
+			}.Build()}),
 		},
 	})
 }
@@ -662,10 +662,10 @@ func TestMaterializerAccessListPutWithMembershipRequirements(t *testing.T) {
 				},
 			},
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-				expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "toprole",
 					Scope: "/aa",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{{
 				// Add membership requires to the middle list, the materialized
@@ -706,10 +706,10 @@ func TestMaterializerAccessListMemberKindUpdateInvalidatesPriorKind(t *testing.T
 				// Initially tester is a member of list child which is a member
 				// of list parent, resulting in a materialized assignment for
 				// tester in parent.
-				expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "parentrole",
 					Scope: "/aa",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{
 				{
@@ -728,10 +728,10 @@ func TestMaterializerAccessListMemberKindUpdateInvalidatesPriorKind(t *testing.T
 					// member because the path through the list named child is
 					// now broken.
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("child", "parent", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("child", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "parentrole",
 							Scope: "/aa",
-						}}),
+						}.Build()}),
 					},
 				},
 				{
@@ -748,10 +748,10 @@ func TestMaterializerAccessListMemberKindUpdateInvalidatesPriorKind(t *testing.T
 						require.Equal(t, accesslist.MembershipKindList, updatedMember.Spec.MembershipKind)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "parentrole",
 							Scope: "/aa",
-						}}),
+						}.Build()}),
 					},
 				},
 			},
@@ -807,10 +807,10 @@ func TestMaterializerDiamond(t *testing.T) {
 			},
 			// Initially the user is a valid member of the top list by 2 paths.
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-				expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "toprole",
 					Scope: "/aa",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{
 				{
@@ -822,10 +822,10 @@ func TestMaterializerDiamond(t *testing.T) {
 						require.NoError(t, err)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "toprole",
 							Scope: "/aa",
-						}}),
+						}.Build()}),
 					},
 				},
 				{
@@ -846,10 +846,10 @@ func TestMaterializerDiamond(t *testing.T) {
 						require.NoError(t, err)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "toprole",
 							Scope: "/aa",
-						}}),
+						}.Build()}),
 					},
 				},
 			},
@@ -881,18 +881,18 @@ func TestMaterializerCascadingMemberExpiries(t *testing.T) {
 			},
 			// Initially all users are valid members of testlist.
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-				expectedScopedRoleAssignment("alice", "testlist", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("alice", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "testrole",
 					Scope: "/test",
-				}}),
-				expectedScopedRoleAssignment("bob", "testlist", []*scopedaccessv1.Assignment{{
+				}.Build()}),
+				expectedScopedRoleAssignment("bob", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "testrole",
 					Scope: "/test",
-				}}),
-				expectedScopedRoleAssignment("charlie", "testlist", []*scopedaccessv1.Assignment{{
+				}.Build()}),
+				expectedScopedRoleAssignment("charlie", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "testrole",
 					Scope: "/test",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{
 				{
@@ -902,14 +902,14 @@ func TestMaterializerCascadingMemberExpiries(t *testing.T) {
 						time.Sleep(time.Minute)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("bob", "testlist", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("bob", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "testrole",
 							Scope: "/test",
-						}}),
-						expectedScopedRoleAssignment("charlie", "testlist", []*scopedaccessv1.Assignment{{
+						}.Build()}),
+						expectedScopedRoleAssignment("charlie", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "testrole",
 							Scope: "/test",
-						}}),
+						}.Build()}),
 					},
 				},
 				{
@@ -919,10 +919,10 @@ func TestMaterializerCascadingMemberExpiries(t *testing.T) {
 						time.Sleep(time.Minute)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("charlie", "testlist", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("charlie", "testlist", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "testrole",
 							Scope: "/test",
-						}}),
+						}.Build()}),
 					},
 				},
 				{
@@ -979,10 +979,10 @@ func TestMaterializerRepairFailedReads(t *testing.T) {
 						time.Sleep(access.MissedMembersRepairBackoff)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "child", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "child", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "testrole",
 							Scope: "/test/child",
-						}}),
+						}.Build()}),
 					},
 				},
 				{
@@ -1009,14 +1009,14 @@ func TestMaterializerRepairFailedReads(t *testing.T) {
 						time.Sleep(access.MissedMembersRepairBackoff)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "child", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "child", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "testrole",
 							Scope: "/test/child",
-						}}),
-						expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{{
+						}.Build()}),
+						expectedScopedRoleAssignment("tester", "parent", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "testrole",
 							Scope: "/test/parent",
-						}}),
+						}.Build()}),
 					},
 				},
 			},
@@ -1077,10 +1077,10 @@ func TestMaterializerDiamondExpiry(t *testing.T) {
 			},
 			// Initially the user is a valid member of the top list by 2 paths.
 			expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-				expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+				expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "toprole",
 					Scope: "/aa",
-				}}),
+				}.Build()}),
 			},
 			steps: []materializerTestcaseStep{
 				{
@@ -1091,10 +1091,10 @@ func TestMaterializerDiamondExpiry(t *testing.T) {
 						time.Sleep(time.Minute)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "toprole",
 							Scope: "/aa",
-						}}),
+						}.Build()}),
 					},
 				},
 				{
@@ -1114,10 +1114,10 @@ func TestMaterializerDiamondExpiry(t *testing.T) {
 						require.NoError(t, err)
 					},
 					expectedAssignments: []*scopedaccessv1.ScopedRoleAssignment{
-						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{{
+						expectedScopedRoleAssignment("tester", "top", []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 							Role:  "toprole",
 							Scope: "/aa",
-						}}),
+						}.Build()}),
 					},
 				},
 			},
@@ -1254,10 +1254,10 @@ initializing acl cache: %v`, t1.Sub(t0), t2.Sub(t1), t3.Sub(t2))
 						List: listName,
 						User: member.GetName(),
 					}
-					_, err := assignmentCache.GetScopedRoleAssignment(b.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+					_, err := assignmentCache.GetScopedRoleAssignment(b.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 						Name:    key.AssignmentName(),
 						SubKind: scopedaccess.SubKindMaterialized,
-					})
+					}.Build())
 					assert.NoError(b, err)
 				}
 			}
@@ -1395,25 +1395,25 @@ func expectedScopedRoleAssignment(userName, listName string, assignments []*scop
 		User: userName,
 		List: listName,
 	}
-	return &scopedaccessv1.ScopedRoleAssignment{
+	return scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindMaterialized,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: key.AssignmentName(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User:        userName,
 			Assignments: assignments,
-		},
-		Status: &scopedaccessv1.ScopedRoleAssignmentStatus{
-			Origin: &scopedaccessv1.ScopedRoleAssignmentStatus_Origin{
+		}.Build(),
+		Status: scopedaccessv1.ScopedRoleAssignmentStatus_builder{
+			Origin: scopedaccessv1.ScopedRoleAssignmentStatus_Origin_builder{
 				CreatorKind: scopedaccess.CreatorKindAccessList,
 				CreatorName: listName,
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 type breakableAccessListReader struct {
diff --git a/lib/scopes/cache/assignments/assignment_cache.go b/lib/scopes/cache/assignments/assignment_cache.go
index da14ae1ee51..aed6a117d56 100644
--- a/lib/scopes/cache/assignments/assignment_cache.go
+++ b/lib/scopes/cache/assignments/assignment_cache.go
@@ -98,9 +98,9 @@ func (c *AssignmentCache) GetScopedRoleAssignment(ctx context.Context, req *scop
 		return nil, trace.NotFound("scoped role assignment %q not found", req.GetName())
 	}
 
-	return &scopedaccessv1.GetScopedRoleAssignmentResponse{
+	return scopedaccessv1.GetScopedRoleAssignmentResponse_builder{
 		Assignment: assignment,
-	}, nil
+	}.Build(), nil
 }
 
 // ListScopedRoleAssignments returns a paginated list of scoped role assignments.
@@ -129,7 +129,7 @@ func (c *AssignmentCache) ListScopedRoleAssignmentsWithFilter(ctx context.Contex
 		}
 
 		if req.GetRole() != "" {
-			if !slices.ContainsFunc(assignment.GetSpec().Assignments, func(a *scopedaccessv1.Assignment) bool { return a.GetRole() == req.GetRole() }) {
+			if !slices.ContainsFunc(assignment.GetSpec().GetAssignments(), func(a *scopedaccessv1.Assignment) bool { return a.GetRole() == req.GetRole() }) {
 				// if the assignment does not have the requested role, skip it
 				return false
 			}
@@ -205,10 +205,10 @@ Outer:
 		}
 	}
 
-	return &scopedaccessv1.ListScopedRoleAssignmentsResponse{
+	return scopedaccessv1.ListScopedRoleAssignmentsResponse_builder{
 		Assignments:   out,
 		NextPageToken: nextPageToken,
-	}, nil
+	}.Build(), nil
 }
 
 // Put adds a new assignment to the cache. It will overwrite any existing assignment with the same name.
diff --git a/lib/scopes/cache/assignments/assignment_cache_test.go b/lib/scopes/cache/assignments/assignment_cache_test.go
index 82f639af00a..eec44249637 100644
--- a/lib/scopes/cache/assignments/assignment_cache_test.go
+++ b/lib/scopes/cache/assignments/assignment_cache_test.go
@@ -37,263 +37,263 @@ func TestListScopedRoleAssignmentsScenarios(t *testing.T) {
 	t.Parallel()
 
 	assignments := []*scopedaccessv1.ScopedRoleAssignment{
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: "/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-02",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: "/aa/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: "/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-02",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: "/aa/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-03",
-			},
+			}.Build(),
 			Scope: "/aa/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-05",
 						Scope: "/aa/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-06",
 						Scope: "/aa/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-03",
-			},
+			}.Build(),
 			Scope: "/aa/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-05",
 						Scope: "/aa/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-06",
 						Scope: "/aa/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "carol-01",
-			},
+			}.Build(),
 			Scope: "/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "carol",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-07",
 						Scope: "/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-08",
 						Scope: "/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	cache := NewAssignmentCache(AssignmentCacheConfig{})
 	for _, assignment := range assignments {
-		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 		cache.Put(assignment)
 
-		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, rsp.GetAssignment())
 	}
 
 	// verify expected behavior for standard cursors in resources subject to scope mode
-	rsp, err := cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err := cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:bob-02/dynamic@/aa",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.Assignments))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.GetAssignments()))
 
 	// try to inject a malicious root out-of-band cursor in resources subject to scope mode (no effect)
-	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:bob-01/dynamic@/",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"alice-02", "bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.Assignments))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"alice-02", "bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.GetAssignments()))
 
 	// try to inject a malicious orthogonal out-of-band cursor in resources subject to scope mode (no effect)
-	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:carol-01/dynamic@/bb",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"alice-02", "bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.Assignments))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"alice-02", "bob-02", "alice-03", "bob-03"}, collectAssignmentNames(rsp.GetAssignments()))
 
 	// verify expected behavior for standard cursors in policies applicable to scope mode
-	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:bob-01/dynamic@/",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"bob-01", "alice-02", "bob-02"}, collectAssignmentNames(rsp.Assignments))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"bob-01", "alice-02", "bob-02"}, collectAssignmentNames(rsp.GetAssignments()))
 
 	// try to inject a malicious child out-of-band cursor in policies applicable to scope mode (effect is
 	// to ignore all items in valid query path).
-	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:bob-03/dynamic@/aa/bb",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Empty(t, collectAssignmentNames(rsp.Assignments))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Empty(t, collectAssignmentNames(rsp.GetAssignments()))
 
 	// try to inject a malicious orthogonal out-of-band cursor in policies applicable to scope mode (effect is to
 	// ignore root, but process leaf normally).
-	rsp, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:carol-01/dynamic@/bb",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"alice-02", "bob-02"}, collectAssignmentNames(rsp.Assignments))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"alice-02", "bob-02"}, collectAssignmentNames(rsp.GetAssignments()))
 
 	// verify rejection of unknown cursor version
-	_, err = cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-		ResourceScope: &scopespb.Filter{
+	_, err = cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v2:bob-02/dynamic@/aa",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 }
@@ -303,116 +303,116 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 	t.Parallel()
 
 	assignments := []*scopedaccessv1.ScopedRoleAssignment{
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: "/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-02",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: "/aa/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: "/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-02",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: "/aa/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "carol-01",
-			},
+			}.Build(),
 			Scope: "/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "carol",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-05",
 						Scope: "/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-06",
 						Scope: "/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	tts := []struct {
@@ -422,9 +422,9 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 	}{
 		{
 			name: "all single page explicit excess",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				PageSize: int32(len(assignments) + 1),
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -450,9 +450,9 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "all single page exact",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				PageSize: int32(len(assignments)),
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -465,9 +465,9 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "all multi page",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				PageSize: 2,
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -484,9 +484,9 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "user single page",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				User: "alice",
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -496,10 +496,10 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "user multi page",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				PageSize: 1,
 				User:     "alice",
-			},
+			}.Build(),
 			expect: [][]string{
 				{"alice-01"},
 				{"alice-02"},
@@ -507,16 +507,16 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "user nonexistent",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				User: "dave",
-			},
+			}.Build(),
 			expect: nil,
 		},
 		{
 			name: "role single page",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				Role: "role-01",
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -526,10 +526,10 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "role multi page",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				PageSize: 1,
 				Role:     "role-01",
-			},
+			}.Build(),
 			expect: [][]string{
 				{"alice-01"},
 				{"bob-01"},
@@ -537,19 +537,19 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "role nonexistent",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 				Role: "role-99",
-			},
+			}.Build(),
 			expect: nil,
 		},
 		{
 			name: "resource scope root",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -562,12 +562,12 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "resource scope non-root",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/aa",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-02",
@@ -577,12 +577,12 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "policy scope root",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -592,12 +592,12 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 		},
 		{
 			name: "policy scope non-root",
-			req: &scopedaccessv1.ListScopedRoleAssignmentsRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/aa",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"alice-01",
@@ -611,19 +611,19 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 
 	cache := NewAssignmentCache(AssignmentCacheConfig{})
 	for _, assignment := range assignments {
-		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 		cache.Put(assignment)
 
-		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, rsp.GetAssignment())
 	}
@@ -635,17 +635,17 @@ func TestListScopedRoleAssignmentsBasics(t *testing.T) {
 				rsp, err := cache.ListScopedRoleAssignments(t.Context(), tt.req)
 				require.NoError(t, err)
 
-				if len(rsp.Assignments) == 0 {
+				if len(rsp.GetAssignments()) == 0 {
 					break
 				}
 
-				out = append(out, collectAssignmentNames(rsp.Assignments))
+				out = append(out, collectAssignmentNames(rsp.GetAssignments()))
 
-				if rsp.NextPageToken == "" {
+				if rsp.GetNextPageToken() == "" {
 					break
 				}
 
-				tt.req.PageToken = rsp.NextPageToken
+				tt.req.SetPageToken(rsp.GetNextPageToken())
 			}
 
 			require.Equal(t, tt.expect, out)
@@ -662,22 +662,22 @@ func TestScopedRoleAssignmentSubKinds(t *testing.T) {
 	cache := NewAssignmentCache(AssignmentCacheConfig{})
 
 	makeAssignment := func(name, subKind, user string) *scopedaccessv1.ScopedRoleAssignment {
-		return &scopedaccessv1.ScopedRoleAssignment{
+		return scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: subKind,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: name,
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: user,
-				Assignments: []*scopedaccessv1.Assignment{{
+				Assignments: []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "role-01",
 					Scope: "/foo",
-				}},
-			},
+				}.Build()},
+			}.Build(),
 			Version: types.V1,
-		}
+		}.Build()
 	}
 
 	// Populate the cache with a dynamic and a materialized assignment with the same name.
@@ -688,19 +688,19 @@ func TestScopedRoleAssignmentSubKinds(t *testing.T) {
 
 	// Make sure getting each assignment by (name, subkind) returns the right one.
 	for _, tt := range []*scopedaccessv1.ScopedRoleAssignment{dynamic, materialized} {
-		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    tt.GetMetadata().GetName(),
 			SubKind: tt.GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.Equal(t, tt.GetSpec().GetUser(), rsp.GetAssignment().GetSpec().GetUser())
 		require.Equal(t, tt.GetSubKind(), rsp.GetAssignment().GetSubKind())
 	}
 
 	// Trying to get an assignment without specifying a subkind returns NotFound.
-	_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	_, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name: "shared-name",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
@@ -709,10 +709,10 @@ func TestScopedRoleAssignmentSubKinds(t *testing.T) {
 	var got []string
 	pageToken := ""
 	for {
-		rsp, err := cache.ListScopedRoleAssignments(t.Context(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		rsp, err := cache.ListScopedRoleAssignments(t.Context(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 			PageSize:  1,
 			PageToken: pageToken,
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.Len(t, rsp.GetAssignments(), 1)
 
@@ -737,7 +737,7 @@ func TestScopedRoleAssignmentSubKinds(t *testing.T) {
 func collectAssignmentNames(assignments []*scopedaccessv1.ScopedRoleAssignment) []string {
 	var names []string
 	for _, assignment := range assignments {
-		names = append(names, assignment.Metadata.Name)
+		names = append(names, assignment.GetMetadata().GetName())
 	}
 	return names
 }
diff --git a/lib/scopes/cache/assignments/pinning.go b/lib/scopes/cache/assignments/pinning.go
index 0fe75bb5921..530441e5d4a 100644
--- a/lib/scopes/cache/assignments/pinning.go
+++ b/lib/scopes/cache/assignments/pinning.go
@@ -60,7 +60,7 @@ func (c *AssignmentCache) PopulatePinnedAssignmentsForUser(ctx context.Context,
 	var lastErr error
 
 	// all non-orthogonal assignments for this user *may* assign roles relevant to this pin
-	assignments := c.cache.AllNonOrthogonalResources(pin.Scope, c.cache.WithFilter(func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
+	assignments := c.cache.AllNonOrthogonalResources(pin.GetScope(), c.cache.WithFilter(func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
 		return assignment.GetSpec().GetUser() == user
 	}))
 
@@ -199,7 +199,7 @@ func (c *AssignmentCache) PopulatePinnedAssignmentsForBot(
 	var lastErr error
 
 	// all non-orthogonal assignments for this bot *may* assign roles relevant to this pin
-	assignments := c.cache.AllNonOrthogonalResources(pin.Scope, c.cache.WithFilter(func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
+	assignments := c.cache.AllNonOrthogonalResources(pin.GetScope(), c.cache.WithFilter(func(assignment *scopedaccessv1.ScopedRoleAssignment) bool {
 		matchesBotName := assignment.GetSpec().GetBotName() == botName
 		// ignore assignments where actual bot scope mismatches bot scope
 		// specified in SRA. this mitigates name reuse attacks across scopes.
diff --git a/lib/scopes/cache/assignments/pinning_test.go b/lib/scopes/cache/assignments/pinning_test.go
index d414295b94b..94de30c0204 100644
--- a/lib/scopes/cache/assignments/pinning_test.go
+++ b/lib/scopes/cache/assignments/pinning_test.go
@@ -40,177 +40,177 @@ func TestPopulatePinnedAssignmentsForUser(t *testing.T) {
 	t.Parallel()
 
 	assignments := []*scopedaccessv1.ScopedRoleAssignment{
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: "/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-02",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: "/aa/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: "/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-02",
-			},
+			}.Build(),
 			Scope: "/aa",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: "/aa",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: "/aa/bb",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-03",
-			},
+			}.Build(),
 			Scope: "/aa/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-05",
 						Scope: "/aa/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-06",
 						Scope: "/aa/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bob-03",
-			},
+			}.Build(),
 			Scope: "/aa/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-05",
 						Scope: "/aa/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-06",
 						Scope: "/aa/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "carol-01",
-			},
+			}.Build(),
 			Scope: "/bb",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "carol",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-07",
 						Scope: "/bb",
-					},
-					{
+					}.Build(),
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-08",
 						Scope: "/bb/cc",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	cache := NewAssignmentCache(AssignmentCacheConfig{})
 	for _, assignment := range assignments {
-		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 		cache.Put(assignment)
 
-		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, rsp.GetAssignment())
 	}
@@ -225,29 +225,29 @@ func TestPopulatePinnedAssignmentsForUser(t *testing.T) {
 		{
 			name: "descendant",
 			user: "bob",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/aa/bb",
-			},
+			}.Build(),
 			ok: true,
-			expect: &scopesv1.Pin{
+			expect: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/aa/bb",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/":   {"/aa": {"role-01"}},
 					"/aa": {"/aa": {"role-03"}, "/aa/bb": {"role-04"}},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "ancestral",
 			user: "alice",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/",
-			},
+			}.Build(),
 			ok: true,
-			expect: &scopesv1.Pin{
+			expect: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -255,15 +255,15 @@ func TestPopulatePinnedAssignmentsForUser(t *testing.T) {
 					"/aa":    {"/aa": {"role-03"}, "/aa/bb": {"role-04"}},
 					"/aa/bb": {"/aa/bb": {"role-05"}, "/aa/bb/cc": {"role-06"}},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "orthogonal",
 			user: "carol",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/xx",
-			},
+			}.Build(),
 			ok: false,
 		},
 	}
@@ -297,51 +297,51 @@ func TestAssignmentTreePruning(t *testing.T) {
 	// set up some initial assignments. pruning operates at the scope of origin level, so assignments
 	// must have a mix of resource scopes to provide a natural pruning boundary.
 	assignments := []*scopedaccessv1.ScopedRoleAssignment{
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-root",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "root-role", Scope: "/staging"},
+					scopedaccessv1.Assignment_builder{Role: "root-role", Scope: "/staging"}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-staging",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "staging-role", Scope: "/staging"},
+					scopedaccessv1.Assignment_builder{Role: "staging-role", Scope: "/staging"}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "alice-staging-west",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "west-role", Scope: "/staging/west"},
+					scopedaccessv1.Assignment_builder{Role: "west-role", Scope: "/staging/west"}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	for _, assignment := range assignments {
@@ -349,18 +349,18 @@ func TestAssignmentTreePruning(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	pin := &scopesv1.Pin{
+	pin := scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_USER,
 		Scope: "/staging/west",
-	}
+	}.Build()
 	err := cache.PopulatePinnedAssignmentsForUser(t.Context(), "alice", pin)
 	require.NoError(t, err)
 
 	// verify the tree was populated
-	require.NotNil(t, pin.AssignmentTree)
+	require.NotNil(t, pin.GetAssignmentTree())
 
 	// verify the tree fits within the size limit
-	treeSize := proto.Size(pin.AssignmentTree)
+	treeSize := proto.Size(pin.GetAssignmentTree())
 	require.LessOrEqual(t, treeSize, cache.cfg.MaxAssignmentTreeBytes,
 		"assignment tree should be pruned to fit within configured limit")
 
@@ -370,7 +370,7 @@ func TestAssignmentTreePruning(t *testing.T) {
 			"/staging": {"root-role"},
 		},
 	}
-	actualTree := pinning.AssignmentTreeIntoMap(pin.AssignmentTree)
+	actualTree := pinning.AssignmentTreeIntoMap(pin.GetAssignmentTree())
 	require.Equal(t, expectedTree, actualTree,
 		"pruning should preserve highest authority assignments (root level)")
 }
@@ -382,143 +382,143 @@ func TestPopulatePinnedAssignmentsForBot(t *testing.T) {
 	assignments := []*scopedaccessv1.ScopedRoleAssignment{
 		// Very "normal" assignment. Scope of SRA matches Bot scope, and
 		// assigned scope is same.
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bernard-01",
-			},
+			}.Build(),
 			Scope: bernardScope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "bernard",
 				BotScope: bernardScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-01",
 						Scope: bernardScope,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 		// Assignment to child-scope of main scope
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bernard-02",
-			},
+			}.Build(),
 			Scope: bernardScope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "bernard",
 				BotScope: bernardScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-02",
 						Scope: bernardScope + "/child",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 		// SRA in parent scope, assigning to bot scope.
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bernard-03",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "bernard",
 				BotScope: bernardScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-03",
 						Scope: bernardScope,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 		// SRA in parent scope, assigning to bot's child scope
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bernard-04",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "bernard",
 				BotScope: bernardScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "role-04",
 						Scope: bernardScope + "/child",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 		// `bot_scope` mismatches bot's actual scope - this should be ignored.
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bernard-invalid-01",
-			},
+			}.Build(),
 			Scope: bernardScope,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "bernard",
 				BotScope: "/mismatched",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "bernard-invalid-01",
 						Scope: bernardScope,
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 		// SRA above bot scope ignored.
 		// nb: we may eventually loosen this to behave more like users.
-		{
+		scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "bernard-invalid-02",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  "bernard",
 				BotScope: bernardScope,
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "bernard-invalid-02",
 						Scope: "/",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	cache := NewAssignmentCache(AssignmentCacheConfig{})
 	for _, assignment := range assignments {
-		_, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: scopedaccess.SubKindDynamic,
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 		require.NoError(t, cache.Put(assignment))
 
-		rsp, err := cache.GetScopedRoleAssignment(t.Context(), &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		rsp, err := cache.GetScopedRoleAssignment(t.Context(), scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: scopedaccess.SubKindDynamic,
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, rsp.GetAssignment())
 	}
@@ -535,85 +535,85 @@ func TestPopulatePinnedAssignmentsForBot(t *testing.T) {
 			name:     "standard",
 			botName:  "bernard",
 			botScope: bernardScope,
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: bernardScope,
-			},
-			expect: &scopesv1.Pin{
+			}.Build(),
+			expect: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: bernardScope,
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/":          {bernardScope: {"role-03"}, bernardScope + "/child": {"role-04"}},
 					bernardScope: {bernardScope: {"role-01"}, bernardScope + "/child": {"role-02"}},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name:     "pin scope at child of bot scope",
 			botName:  "bernard",
 			botScope: bernardScope,
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: bernardScope + "/child",
-			},
-			expect: &scopesv1.Pin{
+			}.Build(),
+			expect: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: bernardScope + "/child",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/":          {bernardScope: {"role-03"}, bernardScope + "/child": {"role-04"}},
 					bernardScope: {bernardScope: {"role-01"}, bernardScope + "/child": {"role-02"}},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name:     "pin scope outside bot scope",
 			botName:  "bernard",
 			botScope: bernardScope,
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/bb",
-			},
+			}.Build(),
 			errContains: "is not subject to bot scope",
 		},
 		{
 			name:     "no matching assignments",
 			botName:  "no-such-bot",
 			botScope: "/aa",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/aa",
-			},
+			}.Build(),
 			errContains: "no scoped role assignments found",
 		},
 		{
 			name:     "empty bot name",
 			botScope: "/aa",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/aa",
-			},
+			}.Build(),
 			errContains: "missing bot name",
 		},
 		{
 			name:    "empty bot scope",
 			botName: "bernard",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/aa",
-			},
+			}.Build(),
 			errContains: "missing bot scope",
 		},
 		{
 			name:     "pin with pre-existing assignment tree",
 			botName:  "bernard",
 			botScope: bernardScope,
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: bernardScope,
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {bernardScope: {"role-03"}},
 				}),
-			},
+			}.Build(),
 			errContains: "already contains an assignment tree",
 		},
 	}
diff --git a/lib/scopes/cache/roles/role_cache.go b/lib/scopes/cache/roles/role_cache.go
index 5f599454528..74f99a685c7 100644
--- a/lib/scopes/cache/roles/role_cache.go
+++ b/lib/scopes/cache/roles/role_cache.go
@@ -68,9 +68,9 @@ func (c *RoleCache) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetSc
 		return nil, trace.NotFound("scoped role %q not found", req.GetName())
 	}
 
-	return &scopedaccessv1.GetScopedRoleResponse{
+	return scopedaccessv1.GetScopedRoleResponse_builder{
 		Role: role,
-	}, nil
+	}.Build(), nil
 }
 
 // ListScopedRoles returns a paginated list of scoped roles.
@@ -157,10 +157,10 @@ Outer:
 		}
 	}
 
-	return &scopedaccessv1.ListScopedRolesResponse{
+	return scopedaccessv1.ListScopedRolesResponse_builder{
 		Roles:         out,
 		NextPageToken: nextPageToken,
-	}, nil
+	}.Build(), nil
 }
 
 // Put adds a new role to the cache. It will overwrite any existing role with the same name.
diff --git a/lib/scopes/cache/roles/role_cache_test.go b/lib/scopes/cache/roles/role_cache_test.go
index 68d510f0c76..4416e4edb5c 100644
--- a/lib/scopes/cache/roles/role_cache_test.go
+++ b/lib/scopes/cache/roles/role_cache_test.go
@@ -37,170 +37,170 @@ func TestListScopedRolesScenarios(t *testing.T) {
 	t.Parallel()
 
 	roles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "admin-01",
-			},
+			}.Build(),
 			Scope:   "/",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "admin-02",
-			},
+			}.Build(),
 			Scope:   "/aa",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "user-01",
-			},
+			}.Build(),
 			Scope:   "/",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "user-02",
-			},
+			}.Build(),
 			Scope:   "/aa",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "admin-03",
-			},
+			}.Build(),
 			Scope:   "/aa/bb",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "user-03",
-			},
+			}.Build(),
 			Scope:   "/aa/bb",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "intern-01",
-			},
+			}.Build(),
 			Scope:   "/bb",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	cache := NewRoleCache()
 	for _, role := range roles {
-		_, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+		_, err := cache.GetScopedRole(t.Context(), scopedaccessv1.GetScopedRoleRequest_builder{
 			Name: role.GetMetadata().GetName(),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 		cache.Put(role)
 
-		rsp, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+		rsp, err := cache.GetScopedRole(t.Context(), scopedaccessv1.GetScopedRoleRequest_builder{
 			Name: role.GetMetadata().GetName(),
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, rsp.GetRole())
 	}
 
 	// verify expected behavior for standard cursors in resources subject to scope mode
-	rsp, err := cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err := cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:user-02@/aa",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"user-02", "admin-03", "user-03"}, collectRoleNames(rsp.Roles))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"user-02", "admin-03", "user-03"}, collectRoleNames(rsp.GetRoles()))
 
 	// try to inject a malicious root out-of-band cursor in resources subject to scope mode (no effect)
-	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:user-01@/",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"admin-02", "user-02", "admin-03", "user-03"}, collectRoleNames(rsp.Roles))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"admin-02", "user-02", "admin-03", "user-03"}, collectRoleNames(rsp.GetRoles()))
 
 	// try to inject a malicious orthogonal out-of-band cursor in resources subject to scope mode (no effect)
-	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:intern-01@/bb",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"admin-02", "user-02", "admin-03", "user-03"}, collectRoleNames(rsp.Roles))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"admin-02", "user-02", "admin-03", "user-03"}, collectRoleNames(rsp.GetRoles()))
 
 	// verify expected behavior for standard cursors in policies applicable to scope mode
-	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:user-01@/",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"user-01", "admin-02", "user-02"}, collectRoleNames(rsp.Roles))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"user-01", "admin-02", "user-02"}, collectRoleNames(rsp.GetRoles()))
 
 	// try to inject a malicious child out-of-band cursor in policies applicable to scope mode (effect is
 	// to ignore all items in valid query path).
-	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:user-03@/aa/bb",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Empty(t, collectRoleNames(rsp.Roles))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Empty(t, collectRoleNames(rsp.GetRoles()))
 
 	// try to inject a malicious orthogonal out-of-band cursor in policies applicable to scope mode (effect is to
 	// ignore root, but process leaf normally).
-	rsp, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	rsp, err = cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v1:intern-01@/bb",
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, rsp.NextPageToken)
-	require.Equal(t, []string{"admin-02", "user-02"}, collectRoleNames(rsp.Roles))
+	require.Empty(t, rsp.GetNextPageToken())
+	require.Equal(t, []string{"admin-02", "user-02"}, collectRoleNames(rsp.GetRoles()))
 
 	// verify rejection of unknown cursor version
-	_, err = cache.ListScopedRoles(t.Context(), &scopedaccessv1.ListScopedRolesRequest{
-		ResourceScope: &scopespb.Filter{
+	_, err = cache.ListScopedRoles(t.Context(), scopedaccessv1.ListScopedRolesRequest_builder{
+		ResourceScope: scopespb.Filter_builder{
 			Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 			Scope: "/aa",
-		},
+		}.Build(),
 		PageToken: "v2:user-02@/aa",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 }
@@ -210,51 +210,51 @@ func TestListScopedRolesBasics(t *testing.T) {
 	t.Parallel()
 
 	roles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "admin-01",
-			},
+			}.Build(),
 			Scope:   "/",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "admin-02",
-			},
+			}.Build(),
 			Scope:   "/aa",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "user-01",
-			},
+			}.Build(),
 			Scope:   "/",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "user-02",
-			},
+			}.Build(),
 			Scope:   "/aa",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerpb.Metadata{
+			Metadata: headerpb.Metadata_builder{
 				Name: "intern-01",
-			},
+			}.Build(),
 			Scope:   "/bb",
 			Spec:    &scopedaccessv1.ScopedRoleSpec{},
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	tts := []struct {
@@ -264,9 +264,9 @@ func TestListScopedRolesBasics(t *testing.T) {
 	}{
 		{
 			name: "all single page explicit excess",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				PageSize: int32(len(roles) + 1),
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -292,9 +292,9 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "all single page exact",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				PageSize: int32(len(roles)),
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -307,9 +307,9 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "all multi page",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				PageSize: 2,
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -326,12 +326,12 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "resource scope root",
-			req: &scopedaccessv1.ListScopedRolesRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -344,12 +344,12 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "resource scope non-root",
-			req: &scopedaccessv1.ListScopedRolesRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/aa",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-02",
@@ -359,12 +359,12 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "policy scope root",
-			req: &scopedaccessv1.ListScopedRolesRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -374,12 +374,12 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "policy scope non-root",
-			req: &scopedaccessv1.ListScopedRolesRequest{
-				ResourceScope: &scopespb.Filter{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/aa",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -391,9 +391,9 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "name filter",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				NameFilter: "admin",
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -403,9 +403,9 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "name case insensitive",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				NameFilter: "AdMiN",
-			},
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -415,10 +415,10 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "name filter paged",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				NameFilter: "min",
 				PageSize:   1,
-			},
+			}.Build(),
 			expect: [][]string{
 				{"admin-01"},
 				{"admin-02"},
@@ -426,13 +426,13 @@ func TestListScopedRolesBasics(t *testing.T) {
 		},
 		{
 			name: "name filter policy scope root",
-			req: &scopedaccessv1.ListScopedRolesRequest{
+			req: scopedaccessv1.ListScopedRolesRequest_builder{
 				NameFilter: "01",
-				ResourceScope: &scopespb.Filter{
+				ResourceScope: scopespb.Filter_builder{
 					Mode:  scopespb.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: [][]string{
 				{
 					"admin-01",
@@ -444,17 +444,17 @@ func TestListScopedRolesBasics(t *testing.T) {
 
 	cache := NewRoleCache()
 	for _, role := range roles {
-		_, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+		_, err := cache.GetScopedRole(t.Context(), scopedaccessv1.GetScopedRoleRequest_builder{
 			Name: role.GetMetadata().GetName(),
-		})
+		}.Build())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 		cache.Put(role)
 
-		rsp, err := cache.GetScopedRole(t.Context(), &scopedaccessv1.GetScopedRoleRequest{
+		rsp, err := cache.GetScopedRole(t.Context(), scopedaccessv1.GetScopedRoleRequest_builder{
 			Name: role.GetMetadata().GetName(),
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, rsp.GetRole())
 	}
@@ -466,17 +466,17 @@ func TestListScopedRolesBasics(t *testing.T) {
 				rsp, err := cache.ListScopedRoles(t.Context(), tt.req)
 				require.NoError(t, err)
 
-				if len(rsp.Roles) == 0 {
+				if len(rsp.GetRoles()) == 0 {
 					break
 				}
 
-				out = append(out, collectRoleNames(rsp.Roles))
+				out = append(out, collectRoleNames(rsp.GetRoles()))
 
-				if rsp.NextPageToken == "" {
+				if rsp.GetNextPageToken() == "" {
 					break
 				}
 
-				tt.req.PageToken = rsp.NextPageToken
+				tt.req.SetPageToken(rsp.GetNextPageToken())
 			}
 
 			require.Equal(t, tt.expect, out)
@@ -487,7 +487,7 @@ func TestListScopedRolesBasics(t *testing.T) {
 func collectRoleNames(roles []*scopedaccessv1.ScopedRole) []string {
 	var names []string
 	for _, role := range roles {
-		names = append(names, role.Metadata.Name)
+		names = append(names, role.GetMetadata().GetName())
 	}
 	return names
 }
diff --git a/lib/scopes/joining/token.go b/lib/scopes/joining/token.go
index 6501fc6052d..c18da9428d9 100644
--- a/lib/scopes/joining/token.go
+++ b/lib/scopes/joining/token.go
@@ -61,9 +61,9 @@ func validateKubernetes(kube *joiningv1.Kubernetes) error {
 	}
 
 	for i, rule := range kube.GetAllow() {
-		serviceAccountSet := rule.ServiceAccount != ""
-		serviceAccountNameSet := rule.ServiceAccountName != ""
-		serviceAccountNamespaceSet := rule.ServiceAccountNamespace != ""
+		serviceAccountSet := rule.GetServiceAccount() != ""
+		serviceAccountNameSet := rule.GetServiceAccountName() != ""
+		serviceAccountNamespaceSet := rule.GetServiceAccountNamespace() != ""
 
 		if !serviceAccountSet && (!serviceAccountNameSet || !serviceAccountNamespaceSet) {
 			return trace.BadParameter(
@@ -73,12 +73,12 @@ func validateKubernetes(kube *joiningv1.Kubernetes) error {
 		}
 
 		if serviceAccountSet {
-			parts := strings.Split(rule.ServiceAccount, ":")
+			parts := strings.Split(rule.GetServiceAccount(), ":")
 			if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
 				return trace.BadParameter(
 					"allow[%d].service_account should be in format \"namespace:service_account\", got %q instead",
 					i,
-					rule.ServiceAccount,
+					rule.GetServiceAccount(),
 				)
 			}
 		}
@@ -323,11 +323,11 @@ func validateBotToken(token *joiningv1.ScopedToken, roles types.SystemRoles) err
 		return trace.BadParameter("scoped token bot_scope must be a descendant of or equivalent to its resource scope")
 	}
 
-	if spec.AssignedScope != "" {
+	if spec.GetAssignedScope() != "" {
 		return trace.BadParameter("scoped tokens for bots cannot have an assigned_scope")
 	}
 
-	if spec.JoinMethod == string(types.JoinMethodToken) {
+	if spec.GetJoinMethod() == string(types.JoinMethodToken) {
 		return trace.BadParameter("scoped bot tokens do not support the `token` join method, `bound_keypair` should be used instead")
 	}
 
@@ -351,11 +351,11 @@ func validateNonBotToken(token *joiningv1.ScopedToken) error {
 		return trace.BadParameter("usage_mode cannot be 'bot' for a non-bot token")
 	}
 
-	if err := scopes.StrongValidate(spec.AssignedScope); err != nil {
+	if err := scopes.StrongValidate(spec.GetAssignedScope()); err != nil {
 		return trace.Wrap(err, "validating scoped token assigned scope")
 	}
 
-	if !scopes.ScopeOfOrigin(token.GetScope()).IsAssignableToScopeOfEffect(spec.AssignedScope) {
+	if !scopes.ScopeOfOrigin(token.GetScope()).IsAssignableToScopeOfEffect(spec.GetAssignedScope()) {
 		return trace.BadParameter("scoped token assigned scope must be descendant of or equivalent to the token's resource scope")
 	}
 
@@ -404,11 +404,11 @@ func StrongValidateToken(token *joiningv1.ScopedToken) error {
 		return trace.BadParameter("scoped token mode is not supported")
 	}
 
-	if len(spec.Roles) == 0 {
+	if len(spec.GetRoles()) == 0 {
 		return trace.BadParameter("scoped token must have at least one role")
 	}
 
-	roles, err := types.NewTeleportRoles(spec.Roles)
+	roles, err := types.NewTeleportRoles(spec.GetRoles())
 	if err != nil {
 		return trace.Wrap(err, "validating scoped token roles")
 	}
diff --git a/lib/scopes/joining/token_test.go b/lib/scopes/joining/token_test.go
index 32f1d70cc3d..830b033a965 100644
--- a/lib/scopes/joining/token_test.go
+++ b/lib/scopes/joining/token_test.go
@@ -37,55 +37,53 @@ func TestValidateScopedToken(t *testing.T) {
 	// baseToken contains a valid scoped token using the token join method.
 	// It's used as a base for constructing scoped tokens in various valid
 	// and invalid states.
-	baseToken := &joiningv1.ScopedToken{
+	baseToken := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Scope:   "/aa/bb",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "testtoken",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			Roles:         []string{types.RoleNode.String()},
 			AssignedScope: "/aa/bb",
 			JoinMethod:    string(types.JoinMethodToken),
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-			ImmutableLabels: &joiningv1.ImmutableLabels{
+			ImmutableLabels: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"one":   "1",
 					"two":   "2",
 					"three": "3",
 				},
-			},
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+			}.Build(),
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	baseBotToken := &joiningv1.ScopedToken{
+	baseBotToken := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Scope:   "/aa/bb",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "testtoken",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			Roles:      []string{types.RoleBot.String()},
 			BotScope:   "/aa/bb",
 			BotName:    "test-bot",
 			JoinMethod: string(types.JoinMethodBoundKeypair),
 			UsageMode:  joining.TokenUsageModeBot,
-		},
-		Status: &joiningv1.ScopedTokenStatus{
-			Usage: &joiningv1.UsageStatus{
-				Status: &joiningv1.UsageStatus_BoundKeypair{
-					BoundKeypair: &joiningv1.BoundKeypairStatus{
-						RegistrationSecret: "secret",
-					},
-				},
-			},
-		},
-	}
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
+			Usage: joiningv1.UsageStatus_builder{
+				BoundKeypair: joiningv1.BoundKeypairStatus_builder{
+					RegistrationSecret: "secret",
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	cases := []struct {
 		name              string
@@ -97,35 +95,35 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "invalid kind",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Kind = ""
+				tok.SetKind("")
 			},
 			expectedStrongErr: fmt.Sprintf("expected kind %v, got %q", types.KindScopedToken, ""),
 		},
 		{
 			name: "invalid version",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Version = ""
+				tok.SetVersion("")
 			},
 			expectedStrongErr: fmt.Sprintf("expected version %v, got %q", types.V1, ""),
 		},
 		{
 			name: "invalid subkind",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.SubKind = "subkind"
+				tok.SetSubKind("subkind")
 			},
 			expectedStrongErr: fmt.Sprintf("expected sub_kind %v, got %q", "", "subkind"),
 		},
 		{
 			name: "missing name",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Metadata.Name = ""
+				tok.GetMetadata().SetName("")
 			},
 			expectedStrongErr: "missing name",
 		},
 		{
 			name: "missing spec",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec = nil
+				tok.ClearSpec()
 			},
 			expectedStrongErr: "spec must not be nil",
 			expectedWeakErr:   "validating scoped token assigned scope",
@@ -133,7 +131,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "missing scope",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Scope = ""
+				tok.SetScope("")
 			},
 			expectedStrongErr: "scoped token must have a scope assigned",
 			expectedWeakErr:   "validating scoped token resource scope",
@@ -141,14 +139,14 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "non-absolute scope",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Scope = "aa/bb"
+				tok.SetScope("aa/bb")
 			},
 			expectedStrongErr: "validating scoped token resource scope",
 		},
 		{
 			name: "scope with invalid characters",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Scope = "/aa/bb}"
+				tok.SetScope("/aa/bb}")
 			},
 			expectedStrongErr: "validating scoped token resource scope",
 			expectedWeakErr:   "validating scoped token resource scope",
@@ -156,7 +154,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "missing assigned scope",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.AssignedScope = ""
+				tok.GetSpec().SetAssignedScope("")
 			},
 			expectedStrongErr: "validating scoped token assigned scope",
 			expectedWeakErr:   "validating scoped token assigned scope",
@@ -164,14 +162,14 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "non-absolute assigned scope",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.AssignedScope = "aa/bb"
+				tok.GetSpec().SetAssignedScope("aa/bb")
 			},
 			expectedStrongErr: "validating scoped token assigned scope",
 		},
 		{
 			name: "assigned scope with invalid character",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.AssignedScope = "aa/bb}"
+				tok.GetSpec().SetAssignedScope("aa/bb}")
 			},
 			expectedStrongErr: "validating scoped token assigned scope",
 			expectedWeakErr:   "validating scoped token assigned scope",
@@ -179,14 +177,14 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "assigned scope is not descendant of token scope",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.AssignedScope = "/bb/aa"
+				tok.GetSpec().SetAssignedScope("/bb/aa")
 			},
 			expectedStrongErr: "scoped token assigned scope must be descendant of or equivalent to the token's resource scope",
 		},
 		{
 			name: "invalid join method",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodUnspecified)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodUnspecified))
 			},
 			expectedStrongErr: fmt.Sprintf("join method %q does not support scoping", types.JoinMethodUnspecified),
 			expectedWeakErr:   fmt.Sprintf("join method %q does not support scoping", types.JoinMethodUnspecified),
@@ -194,7 +192,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "missing roles",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.Roles = nil
+				tok.GetSpec().SetRoles(nil)
 			},
 			expectedStrongErr: "scoped token must have at least one role",
 			expectedWeakErr:   "scoped token must have at least one role",
@@ -202,54 +200,54 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "invalid roles",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.Roles = []string{"random_role"}
+				tok.GetSpec().SetRoles([]string{"random_role"})
 			},
 			expectedStrongErr: "validating scoped token roles",
 		},
 		{
 			name: "unsupported roles",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.Roles = []string{types.RoleNode.String(), types.RoleInstance.String()}
+				tok.GetSpec().SetRoles([]string{types.RoleNode.String(), types.RoleInstance.String()})
 			},
 			expectedStrongErr: fmt.Sprintf("role %q does not support scoping", types.RoleInstance),
 		},
 		{
 			name: "invalid usage mode",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.UsageMode = "invalid"
+				tok.GetSpec().SetUsageMode("invalid")
 			},
 			expectedStrongErr: "scoped token mode is not supported",
 		},
 		{
 			name: "invalid labels key",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.ImmutableLabels = &joiningv1.ImmutableLabels{
+				tok.GetSpec().SetImmutableLabels(joiningv1.ImmutableLabels_builder{
 					Ssh: map[string]string{
 						"one":  "1",
 						"two;": "2",
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "invalid immutable label key \"two;\"",
 		},
 		{
 			name: "setting ssh labels for role other than node",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.Roles = []string{types.RoleApp.String()}
-				tok.Spec.ImmutableLabels = &joiningv1.ImmutableLabels{
+				tok.GetSpec().SetRoles([]string{types.RoleApp.String()})
+				tok.GetSpec().SetImmutableLabels(joiningv1.ImmutableLabels_builder{
 					Ssh: map[string]string{
 						"one":   "1",
 						"two":   "2",
 						"three": "3",
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "immutable ssh labels are only supported for tokens that allow the node role",
 		},
 		{
 			name: "no secret with token join method",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Status = nil
+				tok.ClearStatus()
 			},
 			expectedStrongErr: "secret value must be defined for a scoped token when using the token join method",
 			expectedWeakErr:   "secret value must be defined for a scoped token when using the token join method",
@@ -257,7 +255,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "ec2 token without aws configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
 			},
 			expectedStrongErr: "aws configuration with at least one allow rule must be defined",
 			expectedWeakErr:   "aws configuration with at least one allow rule must be defined",
@@ -265,15 +263,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "ec2 token with invalid IID TTL",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
-						},
+						}.Build(),
 					},
 					IidTtl: "123", // no unit specified
-				}
+				}.Build())
 			},
 			expectedStrongErr: "invalid IID TTL value",
 			expectedWeakErr:   "invalid IID TTL value",
@@ -281,15 +279,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "ec2 token with aws_arn",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
 							AwsArn:     "arn:aws:sts::1234567890:assumed-role/role/i-1234567890abcdef0",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: "aws_arn" parameter not supported`,
 			expectedWeakErr:   `allow[0]: "aws_arn" parameter not supported`,
@@ -297,15 +295,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "ec2 token with aws_organization_id",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount:        "1234567890",
 							AwsOrganizationId: "o-123abcd",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: "aws_organization_id" parameter not supported`,
 			expectedWeakErr:   `allow[0]: "aws_organization_id" parameter not supported`,
@@ -313,10 +311,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "ec2 token with empty allow rule",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{{}},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: must set "aws_account" or "aws_role"`,
 			expectedWeakErr:   `allow[0]: must set "aws_account" or "aws_role"`,
@@ -324,7 +322,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "iam token without aws configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodIAM)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodIAM))
 			},
 			expectedStrongErr: "aws configuration with at least one allow rule must be defined",
 			expectedWeakErr:   "aws configuration with at least one allow rule must be defined",
@@ -332,15 +330,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "iam token with aws_role",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodIAM)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodIAM))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
 							AwsRole:    "arn:aws:iam::1234567890:role/TeleportJoin",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: "aws_role" parameter not supported`,
 			expectedWeakErr:   `allow[0]: "aws_role" parameter not supported`,
@@ -348,15 +346,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "iam token with aws_regions",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodIAM)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodIAM))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
 							AwsRegions: []string{"us-west-2"},
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: "aws_regions" parameter not supported`,
 			expectedWeakErr:   `allow[0]: "aws_regions" parameter not supported`,
@@ -364,10 +362,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "iam token with empty allow rule",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodIAM)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodIAM))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{{}},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: must set "aws_account", "aws_arn", or "aws_organization"`,
 			expectedWeakErr:   `allow[0]: must set "aws_account", "aws_arn", or "aws_organization"`,
@@ -375,7 +373,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "gcp token without gcp configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodGCP)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodGCP))
 			},
 			expectedStrongErr: "gcp configuration with at least one allow rule must be defined",
 			expectedWeakErr:   "gcp configuration with at least one allow rule must be defined",
@@ -383,10 +381,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "gcp token with empty allow rule",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodGCP)
-				tok.Spec.Gcp = &joiningv1.GCP{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodGCP))
+				tok.GetSpec().SetGcp(joiningv1.GCP_builder{
 					Allow: []*joiningv1.GCP_Rule{{}},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0]: requires at least one project ID",
 			expectedWeakErr:   "allow[0]: requires at least one project ID",
@@ -394,10 +392,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "gcp token with allow rule with empty project ID",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodGCP)
-				tok.Spec.Gcp = &joiningv1.GCP{
-					Allow: []*joiningv1.GCP_Rule{{ProjectIds: []string{""}}},
-				}
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodGCP))
+				tok.GetSpec().SetGcp(joiningv1.GCP_builder{
+					Allow: []*joiningv1.GCP_Rule{joiningv1.GCP_Rule_builder{ProjectIds: []string{""}}.Build()},
+				}.Build())
 			},
 			expectedStrongErr: "allow[0].project_ids[0]: must not be empty",
 			expectedWeakErr:   "allow[0].project_ids[0]: must not be empty",
@@ -405,7 +403,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "azure token without azure configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzure)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzure))
 			},
 			expectedStrongErr: "azure configuration with at least one allow rule must be defined",
 			expectedWeakErr:   "azure configuration with at least one allow rule must be defined",
@@ -413,10 +411,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "azure token with empty allow rule",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzure)
-				tok.Spec.Azure = &joiningv1.Azure{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzure))
+				tok.GetSpec().SetAzure(joiningv1.Azure_builder{
 					Allow: []*joiningv1.Azure_Rule{{}},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: must set "subscription" or "tenant"`,
 			expectedWeakErr:   `allow[0]: must set "subscription" or "tenant"`,
@@ -424,7 +422,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "azure_devops token without azure configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzureDevops)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzureDevops))
 			},
 			expectedStrongErr: "azure_devops configuration with at least one allow rule must be defined",
 			expectedWeakErr:   "azure_devops configuration with at least one allow rule must be defined",
@@ -432,14 +430,14 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "azure_devops token without organization_id",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzureDevops)
-				tok.Spec.AzureDevops = &joiningv1.AzureDevops{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzureDevops))
+				tok.GetSpec().SetAzureDevops(joiningv1.AzureDevops_builder{
 					Allow: []*joiningv1.AzureDevops_Rule{
-						{
+						joiningv1.AzureDevops_Rule_builder{
 							Sub: "p://my-org/my-project/my-pipeline",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `"organization_id" must be set`,
 			expectedWeakErr:   `"organization_id" must be set`,
@@ -447,15 +445,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "azure_devops token with allow rule missing key field",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzureDevops)
-				tok.Spec.AzureDevops = &joiningv1.AzureDevops{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzureDevops))
+				tok.GetSpec().SetAzureDevops(joiningv1.AzureDevops_builder{
 					OrganizationId: "00000000-0000-0000-0000-000000000000",
 					Allow: []*joiningv1.AzureDevops_Rule{
-						{
+						joiningv1.AzureDevops_Rule_builder{
 							RepositoryVersion: "aaabbccddeefgghhjjiii",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: must set "sub", "project_name", or "project_id"`,
 			expectedWeakErr:   `allow[0]: must set "sub", "project_name", or "project_id"`,
@@ -463,7 +461,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "oracle token without oracle configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodOracle)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodOracle))
 			},
 			expectedStrongErr: "oracle configuration with at least one allow rule must be defined",
 			expectedWeakErr:   "oracle configuration with at least one allow rule must be defined",
@@ -471,10 +469,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "oracle token without tenancy",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodOracle)
-				tok.Spec.Oracle = &joiningv1.Oracle{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodOracle))
+				tok.GetSpec().SetOracle(joiningv1.Oracle_builder{
 					Allow: []*joiningv1.Oracle_Rule{{}},
-				}
+				}.Build())
 			},
 			expectedStrongErr: `allow[0]: "tenancy" must be set`,
 			expectedWeakErr:   `allow[0]: "tenancy" must be set`,
@@ -482,15 +480,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "oracle token with too many instance IDs",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodOracle)
-				tok.Spec.Oracle = &joiningv1.Oracle{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodOracle))
+				tok.GetSpec().SetOracle(joiningv1.Oracle_builder{
 					Allow: []*joiningv1.Oracle_Rule{
-						{
+						joiningv1.Oracle_Rule_builder{
 							Tenancy:   "ocid1.tenancy.oc1..aaaaaaaa",
 							Instances: make([]string, 101),
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0]: maximum 100 instances may be set (found 101)",
 			expectedWeakErr:   "allow[0]: maximum 100 instances may be set (found 101)",
@@ -498,7 +496,7 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token without configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
 			},
 			expectedStrongErr: "at least one allow rule must be set",
 			expectedWeakErr:   "at least one allow rule must be set",
@@ -506,10 +504,10 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with empty allow rules",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "at least one allow rule must be set",
 			expectedWeakErr:   "at least one allow rule must be set",
@@ -517,11 +515,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with empty service account allow rule",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccount: ""}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccount: ""}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0]: must specify service_account or (service_account_name and service_account_namespace)",
 			expectedWeakErr:   "allow[0]: must specify service_account or (service_account_name and service_account_namespace)",
@@ -529,11 +527,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with service_account_name without service_account_namespace",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccountName: "my-sa"}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccountName: "my-sa"}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0]: must specify service_account or (service_account_name and service_account_namespace)",
 			expectedWeakErr:   "allow[0]: must specify service_account or (service_account_name and service_account_namespace)",
@@ -541,11 +539,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with service_account_namespace without service_account_name",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccountNamespace: "my-ns"}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccountNamespace: "my-ns"}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0]: must specify service_account or (service_account_name and service_account_namespace)",
 			expectedWeakErr:   "allow[0]: must specify service_account or (service_account_name and service_account_namespace)",
@@ -553,11 +551,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with malformed service account allow rule",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccount: "malformed"}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccount: "malformed"}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0].service_account should be in format \"namespace:service_account\"",
 			expectedWeakErr:   "allow[0].service_account should be in format \"namespace:service_account\"",
@@ -565,11 +563,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with service account allow rule made up of too many parts",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccount: "too:many:parts"}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccount: "too:many:parts"}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0].service_account should be in format \"namespace:service_account\"",
 			expectedWeakErr:   "allow[0].service_account should be in format \"namespace:service_account\"",
@@ -577,11 +575,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with service account allow rule with empty account name",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccount: "namespace:"}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccount: "namespace:"}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0].service_account should be in format \"namespace:service_account\"",
 			expectedWeakErr:   "allow[0].service_account should be in format \"namespace:service_account\"",
@@ -589,11 +587,11 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with service account allow rule with empty namespace",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
-					Allow: []*joiningv1.Kubernetes_Rule{{ServiceAccount: ":service_account"}},
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
+					Allow: []*joiningv1.Kubernetes_Rule{joiningv1.Kubernetes_Rule_builder{ServiceAccount: ":service_account"}.Build()},
 					Type:  string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 			expectedStrongErr: "allow[0].service_account should be in format \"namespace:service_account\"",
 			expectedWeakErr:   "allow[0].service_account should be in format \"namespace:service_account\"",
@@ -601,15 +599,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with unrecognized join type",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: "unknown",
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "unrecognized type \"unknown\"",
 			expectedWeakErr:   "unrecognized type \"unknown\"",
@@ -617,14 +615,14 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes token with no join type",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "type must be specified",
 			expectedWeakErr:   "type must be specified",
@@ -632,15 +630,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes static_jwks token without configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: "static_jwks",
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "static_jwks must be set when type is \"static_jwks\"",
 			expectedWeakErr:   "static_jwks must be set when type is \"static_jwks\"",
@@ -648,16 +646,16 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes in_cluster token with static_jwks configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: string(types.KubernetesJoinTypeInCluster),
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
 					StaticJwks: &joiningv1.Kubernetes_StaticJWKSConfig{},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "static_jwks must not be set when type is \"in_cluster\"",
 			expectedWeakErr:   "static_jwks must not be set when type is \"in_cluster\"",
@@ -665,16 +663,16 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes in_cluster token with oidc configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: string(types.KubernetesJoinTypeInCluster),
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
 					Oidc: &joiningv1.Kubernetes_OIDCConfig{},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "oidc must not be set when type is \"in_cluster\"",
 			expectedWeakErr:   "oidc must not be set when type is \"in_cluster\"",
@@ -682,17 +680,17 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes static_jwks token with oidc configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: string(types.KubernetesJoinTypeStaticJWKS),
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-					StaticJwks: &joiningv1.Kubernetes_StaticJWKSConfig{Jwks: "{\"keys\":[]}"},
+					StaticJwks: joiningv1.Kubernetes_StaticJWKSConfig_builder{Jwks: "{\"keys\":[]}"}.Build(),
 					Oidc:       &joiningv1.Kubernetes_OIDCConfig{},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "oidc must not be set when type is \"static_jwks\"",
 			expectedWeakErr:   "oidc must not be set when type is \"static_jwks\"",
@@ -700,15 +698,15 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes oidc token without configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: "oidc",
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "oidc.issuer must be set when type is \"oidc\"",
 			expectedWeakErr:   "oidc.issuer must be set when type is \"oidc\"",
@@ -716,17 +714,17 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes oidc token with static_jwks configuration",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: string(types.KubernetesJoinTypeOIDC),
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-					Oidc:       &joiningv1.Kubernetes_OIDCConfig{Issuer: "https://oidc.example.com"},
+					Oidc:       joiningv1.Kubernetes_OIDCConfig_builder{Issuer: "https://oidc.example.com"}.Build(),
 					StaticJwks: &joiningv1.Kubernetes_StaticJWKSConfig{},
-				}
+				}.Build())
 			},
 			expectedStrongErr: "static_jwks must not be set when type is \"oidc\"",
 			expectedWeakErr:   "static_jwks must not be set when type is \"oidc\"",
@@ -734,16 +732,16 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes oidc token with malformed issuer",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: string(types.KubernetesJoinTypeOIDC),
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-					Oidc: &joiningv1.Kubernetes_OIDCConfig{Issuer: "://bad-url"},
-				}
+					Oidc: joiningv1.Kubernetes_OIDCConfig_builder{Issuer: "://bad-url"}.Build(),
+				}.Build())
 			},
 			expectedStrongErr: "oidc.issuer must be a valid URL",
 			expectedWeakErr:   "oidc.issuer must be a valid URL",
@@ -751,16 +749,16 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "kubernetes oidc token with http issuer and insecure flag disabled",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Type: string(types.KubernetesJoinTypeOIDC),
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
-					Oidc: &joiningv1.Kubernetes_OIDCConfig{Issuer: "http://oidc.example.com"},
-				}
+					Oidc: joiningv1.Kubernetes_OIDCConfig_builder{Issuer: "http://oidc.example.com"}.Build(),
+				}.Build())
 			},
 			expectedStrongErr: "oidc.issuer must be https:// unless insecure_allow_http_issuer is set",
 			expectedWeakErr:   "oidc.issuer must be https:// unless insecure_allow_http_issuer is set",
@@ -768,212 +766,212 @@ func TestValidateScopedToken(t *testing.T) {
 		{
 			name: "valid scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.Roles = types.SystemRoles{types.RoleNode, types.RoleKube}.StringSlice()
+				tok.GetSpec().SetRoles(types.SystemRoles{types.RoleNode, types.RoleKube}.StringSlice())
 			},
 		},
 		{
 			name: "valid ec2 scoped token with TTL",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
-						},
+						}.Build(),
 					},
 					IidTtl: "6mo",
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid ec2 scoped token without TTL",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodEC2)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodEC2))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid iam scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodIAM)
-				tok.Spec.Aws = &joiningv1.AWS{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodIAM))
+				tok.GetSpec().SetAws(joiningv1.AWS_builder{
 					Allow: []*joiningv1.AWS_Rule{
-						{
+						joiningv1.AWS_Rule_builder{
 							AwsAccount: "1234567890",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid gcp scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodGCP)
-				tok.Spec.Gcp = &joiningv1.GCP{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodGCP))
+				tok.GetSpec().SetGcp(joiningv1.GCP_builder{
 					Allow: []*joiningv1.GCP_Rule{
-						{
+						joiningv1.GCP_Rule_builder{
 							ProjectIds: []string{"1234567890"},
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid azure scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzure)
-				tok.Spec.Azure = &joiningv1.Azure{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzure))
+				tok.GetSpec().SetAzure(joiningv1.Azure_builder{
 					Allow: []*joiningv1.Azure_Rule{
-						{
+						joiningv1.Azure_Rule_builder{
 							Subscription: "1234567890",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid azure scoped token with tenant",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzure)
-				tok.Spec.Azure = &joiningv1.Azure{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzure))
+				tok.GetSpec().SetAzure(joiningv1.Azure_builder{
 					Allow: []*joiningv1.Azure_Rule{
-						{
+						joiningv1.Azure_Rule_builder{
 							Tenant: "tenant-id",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid azure_devops scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodAzureDevops)
-				tok.Spec.AzureDevops = &joiningv1.AzureDevops{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodAzureDevops))
+				tok.GetSpec().SetAzureDevops(joiningv1.AzureDevops_builder{
 					OrganizationId: "00000000-0000-0000-0000-000000000000",
 					Allow: []*joiningv1.AzureDevops_Rule{
-						{
+						joiningv1.AzureDevops_Rule_builder{
 							Sub: "1234567890",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid oracle scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodOracle)
-				tok.Spec.Oracle = &joiningv1.Oracle{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodOracle))
+				tok.GetSpec().SetOracle(joiningv1.Oracle_builder{
 					Allow: []*joiningv1.Oracle_Rule{
-						{
+						joiningv1.Oracle_Rule_builder{
 							Tenancy: "1234567890",
-						},
+						}.Build(),
 					},
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid kubernetes in_cluster scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
 					Type: string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid kubernetes static_jwks scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
 					Type: string(types.KubernetesJoinTypeStaticJWKS),
-					StaticJwks: &joiningv1.Kubernetes_StaticJWKSConfig{
+					StaticJwks: joiningv1.Kubernetes_StaticJWKSConfig_builder{
 						Jwks: "{\"keys\":[]}",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 		},
 		{
 			name: "valid kubernetes oidc scoped token",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount: "test:test",
-						},
+						}.Build(),
 					},
 					Type: string(types.KubernetesJoinTypeOIDC),
-					Oidc: &joiningv1.Kubernetes_OIDCConfig{
+					Oidc: joiningv1.Kubernetes_OIDCConfig_builder{
 						Issuer: "https://oidc.example.com/my-cluster",
-					},
-				}
+					}.Build(),
+				}.Build())
 			},
 		},
 		{
 			name: "valid kubernetes scoped token with service_account_name and service_account_namespace",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccountName:      "my-sa",
 							ServiceAccountNamespace: "my-ns",
-						},
+						}.Build(),
 					},
 					Type: string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "valid kubernetes scoped token with service_account, service_account_name, and service_account_namespace",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodKubernetes)
-				tok.Spec.Kubernetes = &joiningv1.Kubernetes{
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodKubernetes))
+				tok.GetSpec().SetKubernetes(joiningv1.Kubernetes_builder{
 					Allow: []*joiningv1.Kubernetes_Rule{
-						{
+						joiningv1.Kubernetes_Rule_builder{
 							ServiceAccount:          "my-ns:my-sa",
 							ServiceAccountName:      "my-sa",
 							ServiceAccountNamespace: "my-ns",
-						},
+						}.Build(),
 					},
 					Type: string(types.KubernetesJoinTypeInCluster),
-				}
+				}.Build())
 			},
 		},
 		{
 			name: "non-bot token with bot_scope",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.BotScope = "/aa/bb"
+				tok.GetSpec().SetBotScope("/aa/bb")
 			},
 			expectedStrongErr: "bot_scope cannot be set",
 		},
 		{
 			name: "non-bot token with bot_name",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.BotName = "foo"
+				tok.GetSpec().SetBotName("foo")
 			},
 			expectedStrongErr: "bot_name cannot be set",
 		},
 		{
 			name: "non-bot token with bot usage mode",
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.UsageMode = joining.TokenUsageModeBot
+				tok.GetSpec().SetUsageMode(joining.TokenUsageModeBot)
 			},
 			expectedStrongErr: "usage_mode cannot be 'bot'",
 		},
@@ -985,7 +983,7 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token without a bot_name",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.BotName = ""
+				tok.GetSpec().SetBotName("")
 			},
 			expectedStrongErr: "expected non-empty bot_name",
 			expectedWeakErr:   "expected non-empty bot_name",
@@ -994,7 +992,7 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token without a bot_scope",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.BotScope = ""
+				tok.GetSpec().SetBotScope("")
 			},
 			expectedStrongErr: "expected non-empty bot_scope",
 			expectedWeakErr:   "expected non-empty bot_scope",
@@ -1003,7 +1001,7 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token with an invalid bot scope",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.BotScope = "aa/bb}"
+				tok.GetSpec().SetBotScope("aa/bb}")
 			},
 			expectedStrongErr: "validating scoped token bot_scope",
 			expectedWeakErr:   "validating scoped token bot_scope",
@@ -1012,7 +1010,7 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token with invalid usage mode",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.UsageMode = string(joining.TokenUsageModeSingle)
+				tok.GetSpec().SetUsageMode(string(joining.TokenUsageModeSingle))
 			},
 			expectedStrongErr: "usage_mode must be 'bot'",
 		},
@@ -1020,7 +1018,7 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token with invalid roles",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.Roles = append(tok.Spec.Roles, types.RoleNode.String())
+				tok.GetSpec().SetRoles(append(tok.GetSpec().GetRoles(), types.RoleNode.String()))
 			},
 			expectedStrongErr: "roles must only be '[Bot]'",
 		},
@@ -1028,8 +1026,8 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot with non-assignable scope of origin",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Scope = "/aa/bb"
-				tok.Spec.BotScope = "/aa/cc"
+				tok.SetScope("/aa/bb")
+				tok.GetSpec().SetBotScope("/aa/cc")
 			},
 			expectedStrongErr: "scoped token bot_scope must be a descendant of",
 		},
@@ -1037,7 +1035,7 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token with assigned_scope",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.AssignedScope = "/aa/bb"
+				tok.GetSpec().SetAssignedScope("/aa/bb")
 			},
 			expectedStrongErr: "scoped tokens for bots cannot have an assigned_scope",
 		},
@@ -1045,8 +1043,8 @@ func TestValidateScopedToken(t *testing.T) {
 			name:      "bot token with token join method",
 			baseToken: baseBotToken,
 			modFn: func(tok *joiningv1.ScopedToken) {
-				tok.Spec.JoinMethod = string(types.JoinMethodToken)
-				tok.Status.Secret = "abc123"
+				tok.GetSpec().SetJoinMethod(string(types.JoinMethodToken))
+				tok.GetStatus().SetSecret("abc123")
 			},
 			expectedStrongErr: "scoped bot tokens do not support the `token` join method",
 		},
@@ -1091,16 +1089,16 @@ func TestScopedTokenAzureRoundTrip(t *testing.T) {
 				},
 			},
 		},
-	}, &joiningv1.ScopedToken{
+	}, joiningv1.ScopedToken_builder{
 		Scope: "/test",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-token",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test",
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	token, err := joining.NewToken(scopedToken)
@@ -1118,24 +1116,24 @@ func TestScopedTokenAzureRoundTrip(t *testing.T) {
 }
 
 func TestImmutableLabelHashing(t *testing.T) {
-	labels := &joiningv1.ImmutableLabels{
+	labels := joiningv1.ImmutableLabels_builder{
 		Ssh: map[string]string{
 			"one":   "1",
 			"two":   "2",
 			"hello": "world",
 		},
-	}
+	}.Build()
 
 	// assert that the same labels match with their hash
 	initialHash := joining.HashImmutableLabels(labels)
 	require.True(t, joining.VerifyImmutableLabelsHash(proto.CloneOf(labels), initialHash))
 
 	// assert that changing a label value fails the hash check
-	labels.Ssh["hello"] = "other"
+	labels.GetSsh()["hello"] = "other"
 	require.False(t, joining.VerifyImmutableLabelsHash(proto.CloneOf(labels), initialHash))
 
 	// assert that adding a label fails the hash check
-	labels.Ssh["three"] = "3"
+	labels.GetSsh()["three"] = "3"
 	require.False(t, joining.VerifyImmutableLabelsHash(proto.CloneOf(labels), initialHash))
 }
 
@@ -1152,34 +1150,34 @@ func TestImmutableLabelHashCollision(t *testing.T) {
 			// guards against map entries being naively concatenated as they're hashed. e.g.
 			// aaa=bbbcccddd should not collide with aaa=bbb,ccc=ddd
 			name: "split label concatenation",
-			labelsA: &joiningv1.ImmutableLabels{
+			labelsA: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"aaa": "bbbcccddd",
 				},
-			},
+			}.Build(),
 
-			labelsB: &joiningv1.ImmutableLabels{
+			labelsB: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"aaa": "bbb",
 					"ccc": "ddd",
 				},
-			},
+			}.Build(),
 		},
 		{
 			// guards against single entries being naively concatenated as they're hashed. e.g.
 			// aaa=bbb should not collide with aaab=bb
 			name: "single label concatenation",
-			labelsA: &joiningv1.ImmutableLabels{
+			labelsA: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"aaa": "bbb",
 				},
-			},
+			}.Build(),
 
-			labelsB: &joiningv1.ImmutableLabels{
+			labelsB: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"aaab": "bb",
 				},
-			},
+			}.Build(),
 		},
 		// TODO (eriktate): add test case for identical labels applied to different service types once immutable
 		// labels support more than SSH
@@ -1203,29 +1201,29 @@ func TestImmutableLabelHashGolden(t *testing.T) {
 	}{
 		{
 			name: "single ssh label",
-			labels: &joiningv1.ImmutableLabels{
+			labels: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"aaa": "bbb",
 				},
-			},
+			}.Build(),
 			hash: "5dd8fad69587f17535a4dea3ab41400914c3fbecd1972d4e194b1c18c0f4c4ff",
 		},
 		{
 			name: "multiple ssh labels",
-			labels: &joiningv1.ImmutableLabels{
+			labels: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{
 					"aaa": "bbb",
 					"ccc": "ddd",
 					"eee": "fff",
 				},
-			},
+			}.Build(),
 			hash: "b4757712bb94a422f835ca983e9ab3a9ce9925617496e9eeea676fb65b28f2b9",
 		},
 		{
 			name: "empty labels",
-			labels: &joiningv1.ImmutableLabels{
+			labels: joiningv1.ImmutableLabels_builder{
 				Ssh: map[string]string{},
-			},
+			}.Build(),
 		},
 	}
 
@@ -1246,19 +1244,19 @@ func FuzzImmutableLabelHash(f *testing.F) {
 	f.Add("aaa", "bbb", "aaab", "bb", "", "", false)            // single label concatenation
 
 	f.Fuzz(func(t *testing.T, key1, value1, key2, value2, key3, value3 string, multiLabel bool) {
-		labelsA := &joiningv1.ImmutableLabels{
+		labelsA := joiningv1.ImmutableLabels_builder{
 			Ssh: map[string]string{
 				key1: value1,
 			},
-		}
-		labelsB := &joiningv1.ImmutableLabels{
+		}.Build()
+		labelsB := joiningv1.ImmutableLabels_builder{
 			Ssh: map[string]string{
 				key2: value2,
 			},
-		}
+		}.Build()
 		// assign a second label only if multiLabel is true
 		if multiLabel {
-			labelsB.Ssh[key3] = value3
+			labelsB.GetSsh()[key3] = value3
 		}
 
 		// assert we can generate hashes for both labels without panicking
@@ -1273,7 +1271,7 @@ func FuzzImmutableLabelHash(f *testing.F) {
 
 		// assert that the same labels always result in the same hash and different labels always result in different hashes
 		assertFn := assert.False
-		if maps.Equal(labelsA.Ssh, labelsB.Ssh) {
+		if maps.Equal(labelsA.GetSsh(), labelsB.GetSsh()) {
 			assertFn = assert.True
 		}
 
@@ -1283,23 +1281,23 @@ func FuzzImmutableLabelHash(f *testing.F) {
 }
 
 func TestValidateTokenUpdate(t *testing.T) {
-	baseToken := &joiningv1.ScopedToken{
+	baseToken := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-token",
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test/one",
 			JoinMethod:    string(types.JoinMethodToken),
 			Roles:         []string{types.RoleNode.String()},
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret-value",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	for _, tc := range []struct {
 		name            string
@@ -1309,36 +1307,36 @@ func TestValidateTokenUpdate(t *testing.T) {
 		{
 			name: "check scope change",
 			modifyTokenFunc: func(t *joiningv1.ScopedToken) {
-				t.Scope = "/other"
-				t.Spec.AssignedScope = "/other/one"
+				t.SetScope("/other")
+				t.GetSpec().SetAssignedScope("/other/one")
 			},
 			wantErr: "cannot modify scope of existing scoped token test-token with scope /test to /other",
 		},
 		{
 			name: "check usage mode change",
 			modifyTokenFunc: func(t *joiningv1.ScopedToken) {
-				t.Spec.UsageMode = string(joining.TokenUsageModeSingle)
+				t.GetSpec().SetUsageMode(string(joining.TokenUsageModeSingle))
 			},
 			wantErr: fmt.Sprintf("cannot modify usage mode of existing scoped token test-token from usage mode %s to %s", joining.TokenUsageModeUnlimited, joining.TokenUsageModeSingle),
 		},
 		{
 			name: "check secret change",
 			modifyTokenFunc: func(t *joiningv1.ScopedToken) {
-				t.Status.Secret = "new-secret-value"
+				t.GetStatus().SetSecret("new-secret-value")
 			},
 			wantErr: "cannot modify secret of existing scoped token test-token",
 		},
 		{
 			name: "valid update",
 			modifyTokenFunc: func(t *joiningv1.ScopedToken) {
-				t.Metadata.Labels = map[string]string{"env": "production"}
-				t.Spec.AssignedScope = "/test/one/two"
+				t.GetMetadata().SetLabels(map[string]string{"env": "production"})
+				t.GetSpec().SetAssignedScope("/test/one/two")
 			},
 		},
 		{
 			name: "status is nil in update (no change)",
 			modifyTokenFunc: func(t *joiningv1.ScopedToken) {
-				t.Status = nil
+				t.ClearStatus()
 			},
 		},
 	} {
@@ -1357,17 +1355,17 @@ func TestValidateTokenUpdate(t *testing.T) {
 }
 
 func TestValidateTokenForUse(t *testing.T) {
-	token := &joiningv1.ScopedToken{
+	token := joiningv1.ScopedToken_builder{
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			Roles:         []string{types.RoleNode.String()},
 			JoinMethod:    string(types.JoinMethodToken),
 			AssignedScope: "/test",
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
+		}.Build(),
+	}.Build()
 	// we want to ensure that token validation before use is always the strongest
 	// available, so we confirm that the test token passes weak validation and then
 	// assert that StrongValidateToken and ValidateTokenForUse fail with the same error
diff --git a/lib/scopes/pinning/encoding_test.go b/lib/scopes/pinning/encoding_test.go
index e743c1dcc35..67bac8c597a 100644
--- a/lib/scopes/pinning/encoding_test.go
+++ b/lib/scopes/pinning/encoding_test.go
@@ -38,29 +38,29 @@ func TestEncodeDecode(t *testing.T) {
 	}{
 		{
 			name: "single role assignment",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/foo": {
 						"/foo": {"role1"},
 					},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "multiple roles at same scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/staging",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging": {
 						"/staging": {"admin", "developer", "viewer"},
 					},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "hierarchical assignments",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -76,11 +76,11 @@ func TestEncodeDecode(t *testing.T) {
 						"/foo/bar": {"bar-bar"},
 					},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "complex multi-branch tree",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/staging/west",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -98,29 +98,29 @@ func TestEncodeDecode(t *testing.T) {
 						"/staging/west": {"west-local"},
 					},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "empty assignment tree",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope:          "/foo",
 				AssignmentTree: &scopesv1.AssignmentNode{},
-			},
+			}.Build(),
 		},
 		{
 			name: "root scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
 						"/": {"global-admin"},
 					},
 				}),
-			},
+			}.Build(),
 		},
 		{
 			name: "deep hierarchy",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/a/b/c/d",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -139,7 +139,7 @@ func TestEncodeDecode(t *testing.T) {
 						"/a/b/c/d": {"role-from-abcd"},
 					},
 				}),
-			},
+			}.Build(),
 		},
 	}
 
@@ -188,24 +188,24 @@ func TestEncodeDecodeAgentPin(t *testing.T) {
 	}{
 		{
 			name: "scope and primary system role only",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 				Scope: "/foo",
-				SystemRoles: &scopesv1.SystemRoles{
+				SystemRoles: scopesv1.SystemRoles_builder{
 					Primary: "Node",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "with additional system roles",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 				Scope: "/staging/west",
-				SystemRoles: &scopesv1.SystemRoles{
+				SystemRoles: scopesv1.SystemRoles_builder{
 					Primary:    "Instance",
 					Additional: []string{"Node", "Proxy", "KubeProxy"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	}
 
@@ -236,14 +236,14 @@ func TestDecodeKnown(t *testing.T) {
 
 	encodedJSON := `{"scope":"/test", "assignmentTree":{"children":{"test":{"roleTree":{"children":{"test":{"roles":["role1"]}}}}}}}`
 
-	expect := &scopesv1.Pin{
+	expect := scopesv1.Pin_builder{
 		Scope: "/test",
 		AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 			"/test": {
 				"/test": {"role1"},
 			},
 		}),
-	}
+	}.Build()
 
 	decoded, err := Decode(encoded)
 	require.NoError(t, err)
diff --git a/lib/scopes/pinning/pinning.go b/lib/scopes/pinning/pinning.go
index 917ec5c4a53..d261c81ad82 100644
--- a/lib/scopes/pinning/pinning.go
+++ b/lib/scopes/pinning/pinning.go
@@ -201,7 +201,7 @@ func AssignmentTreeFromMap(m map[string]map[string][]string) *scopesv1.Assignmen
 		}
 	}
 
-	return pin.AssignmentTree
+	return pin.GetAssignmentTree()
 }
 
 // AssignmentTreeIntoMap converts an assignment tree back into a nested map of the form scopeOfOrigin -> scopeOfEffect -> roles.
@@ -213,7 +213,7 @@ func AssignmentTreeIntoMap(tree *scopesv1.AssignmentNode) map[string]map[string]
 
 	out := make(map[string]map[string][]string)
 
-	for assignment := range EnumerateAllAssignments(&scopesv1.Pin{AssignmentTree: tree}) {
+	for assignment := range EnumerateAllAssignments(scopesv1.Pin_builder{AssignmentTree: tree}.Build()) {
 		if out[assignment.ScopeOfOrigin] == nil {
 			out[assignment.ScopeOfOrigin] = make(map[string][]string)
 		}
@@ -279,56 +279,56 @@ func WriteRoleAssignment(pin *scopesv1.Pin, assignment RoleAssignment) error {
 // for tests.
 func writeRoleAssignmentUnchecked(pin *scopesv1.Pin, assignment RoleAssignment) {
 	// ensure the pin's assignment tree is initialized
-	if pin.AssignmentTree == nil {
-		pin.AssignmentTree = &scopesv1.AssignmentNode{}
+	if !pin.HasAssignmentTree() {
+		pin.SetAssignmentTree(&scopesv1.AssignmentNode{})
 	}
 
 	// start at the root of the assignment tree
-	assignmentNode := pin.AssignmentTree
+	assignmentNode := pin.GetAssignmentTree()
 
 	// descend to the correct assignment node for the scope of origin
 	for segment := range scopes.DescendingSegments(assignment.ScopeOfOrigin) {
-		if assignmentNode.Children == nil {
-			assignmentNode.Children = make(map[string]*scopesv1.AssignmentNode)
+		if assignmentNode.GetChildren() == nil {
+			assignmentNode.SetChildren(make(map[string]*scopesv1.AssignmentNode))
 		}
 
-		child, ok := assignmentNode.Children[segment]
+		child, ok := assignmentNode.GetChildren()[segment]
 		if !ok {
 			child = &scopesv1.AssignmentNode{}
-			assignmentNode.Children[segment] = child
+			assignmentNode.GetChildren()[segment] = child
 		}
 
 		assignmentNode = child
 	}
 
 	// ensure the role tree is initialized for this assignment node
-	if assignmentNode.RoleTree == nil {
-		assignmentNode.RoleTree = &scopesv1.RoleNode{}
+	if !assignmentNode.HasRoleTree() {
+		assignmentNode.SetRoleTree(&scopesv1.RoleNode{})
 	}
 
 	// start at the root of the role tree for this assignment node
-	roleNode := assignmentNode.RoleTree
+	roleNode := assignmentNode.GetRoleTree()
 
 	// descend to the correct role node for the scope of effect
 	for segment := range scopes.DescendingSegments(assignment.ScopeOfEffect) {
-		if roleNode.Children == nil {
-			roleNode.Children = make(map[string]*scopesv1.RoleNode)
+		if roleNode.GetChildren() == nil {
+			roleNode.SetChildren(make(map[string]*scopesv1.RoleNode))
 		}
 
-		child, ok := roleNode.Children[segment]
+		child, ok := roleNode.GetChildren()[segment]
 		if !ok {
 			child = &scopesv1.RoleNode{}
-			roleNode.Children[segment] = child
+			roleNode.GetChildren()[segment] = child
 		}
 
 		roleNode = child
 	}
 
 	// append the role to the role list for this role node if it's not already present
-	if !slices.Contains(roleNode.Roles, assignment.RoleName) {
-		roleNode.Roles = append(roleNode.Roles, assignment.RoleName)
+	if !slices.Contains(roleNode.GetRoles(), assignment.RoleName) {
+		roleNode.SetRoles(append(roleNode.GetRoles(), assignment.RoleName))
 		// ensure the role list is sorted for deterministic iteration
-		slices.Sort(roleNode.Roles)
+		slices.Sort(roleNode.GetRoles())
 	}
 }
 
@@ -347,12 +347,12 @@ func DescendAssignmentTree(pin *scopesv1.Pin, resourceScope string) (iter.Seq[Ro
 		return nil, trace.BadParameter("invalid resource scope %q for scope pin at %q in assignment lookup (this is a bug)", resourceScope, pin.GetScope())
 	}
 	return func(yield func(RoleAssignment) bool) {
-		if pin.AssignmentTree == nil {
+		if !pin.HasAssignmentTree() {
 			return
 		}
 
 		resourceScopeSegments := scopes.Split(resourceScope)
-		yieldAssignmentNode(pin.AssignmentTree, resourceScopeSegments, 0 /*depth*/, yield)
+		yieldAssignmentNode(pin.GetAssignmentTree(), resourceScopeSegments, 0 /*depth*/, yield)
 	}, nil
 }
 
@@ -362,15 +362,15 @@ func DescendAssignmentTree(pin *scopesv1.Pin, resourceScope string) (iter.Seq[Ro
 // to preserve scope hierarchy during evaluation.
 func yieldAssignmentNode(node *scopesv1.AssignmentNode, resourceScopeSegments []string, depth int, yield func(RoleAssignment) bool) bool {
 	// first yield any matching roles from the current depth's role tree
-	if node.RoleTree != nil {
+	if node.HasRoleTree() {
 		scopeOfOrigin := scopes.Join(resourceScopeSegments[:depth]...)
-		if !yeildRoleNode(node.RoleTree, scopeOfOrigin, resourceScopeSegments, 0 /*role tree depth*/, yield) {
+		if !yeildRoleNode(node.GetRoleTree(), scopeOfOrigin, resourceScopeSegments, 0 /*role tree depth*/, yield) {
 			return false
 		}
 	}
 
 	if len(resourceScopeSegments) > depth {
-		if child, ok := node.Children[resourceScopeSegments[depth]]; ok {
+		if child, ok := node.GetChildren()[resourceScopeSegments[depth]]; ok {
 			if !yieldAssignmentNode(child, resourceScopeSegments, depth+1, yield) {
 				return false
 			}
@@ -390,19 +390,19 @@ func yieldAssignmentNode(node *scopesv1.AssignmentNode, resourceScopeSegments []
 // details on scoped role evaluation ordering and its implications.
 func yeildRoleNode(node *scopesv1.RoleNode, scopeOfOrigin string, resourceScopeSegments []string, depth int, yield func(RoleAssignment) bool) bool {
 	if len(resourceScopeSegments) > depth {
-		if child, ok := node.Children[resourceScopeSegments[depth]]; ok {
+		if child, ok := node.GetChildren()[resourceScopeSegments[depth]]; ok {
 			if !yeildRoleNode(child, scopeOfOrigin, resourceScopeSegments, depth+1, yield) {
 				return false
 			}
 		}
 	}
 
-	if len(node.Roles) == 0 {
+	if len(node.GetRoles()) == 0 {
 		return true
 	}
 
 	scopeOfEffect := scopes.Join(resourceScopeSegments[:depth]...)
-	for _, roleName := range node.Roles {
+	for _, roleName := range node.GetRoles() {
 		if !yield(RoleAssignment{
 			RoleKind:      RoleKindUser,
 			ScopeOfOrigin: scopeOfOrigin,
@@ -456,7 +456,7 @@ func GetRolesAtEnforcementPoint(pin *scopesv1.Pin, point scopes.EnforcementPoint
 // getUserRolesAtEnforcementPoint yields user-assigned role assignments from the pin's assignment tree at
 // the given enforcement point.
 func getUserRolesAtEnforcementPoint(pin *scopesv1.Pin, point scopes.EnforcementPoint, yield func(RoleAssignment) bool) {
-	if pin.AssignmentTree == nil {
+	if !pin.HasAssignmentTree() {
 		return
 	}
 
@@ -465,9 +465,9 @@ func getUserRolesAtEnforcementPoint(pin *scopesv1.Pin, point scopes.EnforcementP
 	}
 
 	// navigate to the assignment node for the Scope of Origin
-	assignmentNode := pin.AssignmentTree
+	assignmentNode := pin.GetAssignmentTree()
 	for segment := range scopes.DescendingSegments(point.ScopeOfOrigin) {
-		child, ok := assignmentNode.Children[segment]
+		child, ok := assignmentNode.GetChildren()[segment]
 		if !ok {
 			// the scope of origin doesn't exist in the tree
 			return
@@ -476,13 +476,13 @@ func getUserRolesAtEnforcementPoint(pin *scopesv1.Pin, point scopes.EnforcementP
 	}
 
 	// navigate to the role node for the Scope of Effect within this assignment node
-	if assignmentNode.RoleTree == nil {
+	if !assignmentNode.HasRoleTree() {
 		return
 	}
 
-	roleNode := assignmentNode.RoleTree
+	roleNode := assignmentNode.GetRoleTree()
 	for segment := range scopes.DescendingSegments(point.ScopeOfEffect) {
-		child, ok := roleNode.Children[segment]
+		child, ok := roleNode.GetChildren()[segment]
 		if !ok {
 			// the scope of effect doesn't exist in the tree
 			return
@@ -492,7 +492,7 @@ func getUserRolesAtEnforcementPoint(pin *scopesv1.Pin, point scopes.EnforcementP
 
 	// yield each role in the order that they are stored. it is the responsibility
 	// of pin construction logic to ensure deterministic ordering.
-	for _, roleName := range roleNode.Roles {
+	for _, roleName := range roleNode.GetRoles() {
 		if !yield(RoleAssignment{
 			RoleKind:      RoleKindUser,
 			ScopeOfOrigin: point.ScopeOfOrigin,
@@ -531,12 +531,12 @@ func getSystemRolesAtEnforcementPoint(pin *scopesv1.Pin, point scopes.Enforcemen
 // *NOTE*: this function is not suitable for being the basis of access control evaluation ordering.
 func EnumerateAllAssignments(pin *scopesv1.Pin) iter.Seq[RoleAssignment] {
 	return func(yield func(RoleAssignment) bool) {
-		if pin == nil || pin.AssignmentTree == nil {
+		if pin == nil || !pin.HasAssignmentTree() {
 			return
 		}
 
 		// Start enumeration at the root of the assignment tree with empty segment list (representing root scope)
-		enumerateAssignmentNode(pin.AssignmentTree, nil, yield)
+		enumerateAssignmentNode(pin.GetAssignmentTree(), nil, yield)
 	}
 }
 
@@ -547,14 +547,14 @@ func enumerateAssignmentNode(node *scopesv1.AssignmentNode, originSegments []str
 	scopeOfOrigin := scopes.Join(originSegments...)
 
 	// Enumerate all roles in this node's role tree
-	if node.RoleTree != nil {
-		if !enumerateRoleNode(node.RoleTree, scopeOfOrigin, nil, yield) {
+	if node.HasRoleTree() {
+		if !enumerateRoleNode(node.GetRoleTree(), scopeOfOrigin, nil, yield) {
 			return false
 		}
 	}
 
 	// Recursively enumerate all child assignment nodes
-	for segment, child := range node.Children {
+	for segment, child := range node.GetChildren() {
 		childOriginSegments := append(originSegments, segment)
 		if !enumerateAssignmentNode(child, childOriginSegments, yield) {
 			return false
@@ -571,7 +571,7 @@ func enumerateRoleNode(node *scopesv1.RoleNode, scopeOfOrigin string, effectSegm
 	scopeOfEffect := scopes.Join(effectSegments...)
 
 	// Yield all roles at this node
-	for _, roleName := range node.Roles {
+	for _, roleName := range node.GetRoles() {
 		if !yield(RoleAssignment{
 			RoleKind:      RoleKindUser,
 			ScopeOfOrigin: scopeOfOrigin,
@@ -583,7 +583,7 @@ func enumerateRoleNode(node *scopesv1.RoleNode, scopeOfOrigin string, effectSegm
 	}
 
 	// Recursively enumerate all child role nodes
-	for segment, child := range node.Children {
+	for segment, child := range node.GetChildren() {
 		childEffectSegments := append(effectSegments, segment)
 		if !enumerateRoleNode(child, scopeOfOrigin, childEffectSegments, yield) {
 			return false
@@ -621,25 +621,25 @@ func enumerateRoleNode(node *scopesv1.RoleNode, scopeOfOrigin string, effectSegm
 // solving the orthogonal ranking problem, but may be something to revisit if the scenarios where it performs better
 // end up being more common in practice than we anticipate.
 func PruneAssignmentTree(ctx context.Context, pin *scopesv1.Pin, maxBytes int) (prunedCount int) {
-	if pin == nil || pin.AssignmentTree == nil {
+	if pin == nil || !pin.HasAssignmentTree() {
 		return 0
 	}
 
 	// check if pruning is actually needed
-	initialSize := proto.Size(pin.AssignmentTree)
+	initialSize := proto.Size(pin.GetAssignmentTree())
 	if initialSize <= maxBytes {
 		return 0
 	}
 
 	// get count of assignments before pruning
-	initialCount := countAssignments(pin.AssignmentTree)
+	initialCount := countAssignments(pin.GetAssignmentTree())
 
 	currentSize := initialSize
 
 	// iteratively prune the deepest depth level until we fit within the size limit
 	for {
 		// find the deepest Scope of Origin depth currently contained in the tree
-		maxDepth := maxAssignmentDepth(pin.AssignmentTree)
+		maxDepth := maxAssignmentDepth(pin.GetAssignmentTree())
 		if maxDepth == 0 {
 			slog.WarnContext(ctx, "assignment tree exceeds prescribed size limit but will not be pruned further due to all remaining assignments originating from root scope",
 				"pin_scope", pin.GetScope(),
@@ -647,7 +647,7 @@ func PruneAssignmentTree(ctx context.Context, pin *scopesv1.Pin, maxBytes int) (
 				"current_size", currentSize,
 				"max_size", maxBytes,
 				"initial_count", initialCount,
-				"current_count", countAssignments(pin.AssignmentTree),
+				"current_count", countAssignments(pin.GetAssignmentTree()),
 			)
 			// note that the pin may still contain root level assignments. we opt not to prune
 			// those as they would render the pin (and therefore the resulting certificate)
@@ -656,9 +656,9 @@ func PruneAssignmentTree(ctx context.Context, pin *scopesv1.Pin, maxBytes int) (
 		}
 
 		// prune the tree in-place
-		pruneTreeToDepth(pin.AssignmentTree, maxDepth-1)
+		pruneTreeToDepth(pin.GetAssignmentTree(), maxDepth-1)
 
-		currentSize = proto.Size(pin.AssignmentTree)
+		currentSize = proto.Size(pin.GetAssignmentTree())
 		if currentSize <= maxBytes {
 			// we've pruned enough to fit within the size limit
 			break
@@ -666,7 +666,7 @@ func PruneAssignmentTree(ctx context.Context, pin *scopesv1.Pin, maxBytes int) (
 	}
 
 	// return total number of assignments pruned
-	return initialCount - countAssignments(pin.AssignmentTree)
+	return initialCount - countAssignments(pin.GetAssignmentTree())
 }
 
 // maxAssignmentDepth returns the maximum Scope of Origin depth present in the assignment tree.
@@ -684,7 +684,7 @@ func maxAssignmentDepth(tree *scopesv1.AssignmentNode) int {
 func maxDepthOfAssignmentNode(node *scopesv1.AssignmentNode, depth int) int {
 	// maxDepth tracks the maximum depth found among child nodes
 	maxDepth := depth
-	for _, child := range node.Children {
+	for _, child := range node.GetChildren() {
 		maxDepth = max(maxDepth, maxDepthOfAssignmentNode(child, depth+1))
 	}
 
@@ -704,12 +704,12 @@ func countAssignmentsInTree(node *scopesv1.AssignmentNode) int {
 	count := 0
 
 	// count roles in this node's role tree
-	if node.RoleTree != nil {
-		count += countRolesInTree(node.RoleTree)
+	if node.HasRoleTree() {
+		count += countRolesInTree(node.GetRoleTree())
 	}
 
 	// recursively count in children
-	for _, child := range node.Children {
+	for _, child := range node.GetChildren() {
 		count += countAssignmentsInTree(child)
 	}
 
@@ -718,10 +718,10 @@ func countAssignmentsInTree(node *scopesv1.AssignmentNode) int {
 
 // countRolesInTree recursively counts roles in a role tree node.
 func countRolesInTree(node *scopesv1.RoleNode) int {
-	count := len(node.Roles)
+	count := len(node.GetRoles())
 
 	// recursively count in children
-	for _, child := range node.Children {
+	for _, child := range node.GetChildren() {
 		count += countRolesInTree(child)
 	}
 
@@ -739,12 +739,12 @@ func pruneTreeToDepth(tree *scopesv1.AssignmentNode, maxDepth int) {
 func pruneAssignmentNodeToDepth(node *scopesv1.AssignmentNode, maxDepth, currentDepth int) {
 	if currentDepth == maxDepth {
 		// This is the last level we want to keep, remove all children
-		node.Children = nil
+		node.SetChildren(nil)
 		return
 	}
 
 	// currentDepth < maxDepth, so recursively prune children
-	for _, child := range node.Children {
+	for _, child := range node.GetChildren() {
 		pruneAssignmentNodeToDepth(child, maxDepth, currentDepth+1)
 	}
 }
diff --git a/lib/scopes/pinning/pinning_test.go b/lib/scopes/pinning/pinning_test.go
index 84aa63f6096..6e6bda17409 100644
--- a/lib/scopes/pinning/pinning_test.go
+++ b/lib/scopes/pinning/pinning_test.go
@@ -41,77 +41,77 @@ func TestValidate(t *testing.T) {
 	}{
 		{
 			name: "basic",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {"/": {"r1"}, "/foo": {"r2"}, "/foo/bar": {"r3"}},
 				}),
-			},
+			}.Build(),
 			strongOk: true,
 			weakOk:   true,
 		},
 		{
 			name: "missing scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {"/": {"r1"}},
 				}),
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
 		{
 			name: "missing assignments",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/foo",
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "orthogonal assignment",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {"/": {"r1"}, "/bar": {"r2"}},
 				}),
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "empty assignments",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/foo",
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "malformed assignment scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/":             {"/": {"r1"}},
 					"invalid@scope": {"invalid@scope": {"r2"}},
 				}),
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   true,
 		},
 		{
 			name: "malformed pin scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "invalid@scope",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {"/": {"r1"}},
 				}),
-			},
+			}.Build(),
 			strongOk: false,
 			weakOk:   false,
 		},
@@ -151,14 +151,14 @@ func TestDescendAssignmentTree(t *testing.T) {
 	}{
 		{
 			name: "single-role",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/foo": {
 						"/foo": {"r1"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/foo",
 			ok:    true,
 			expect: []RoleAssignment{
@@ -172,7 +172,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 		},
 		{
 			name: "hierarchical multi",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -185,7 +185,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 						"/foo/bar": {"r3"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/foo",
 			ok:    true,
 			expect: []RoleAssignment{
@@ -205,7 +205,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 		},
 		{
 			name: "single scope multi",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -214,7 +214,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 						"/foo/bar": {"r3"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/foo",
 			ok:    true,
 			expect: []RoleAssignment{
@@ -234,7 +234,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 		},
 		{
 			name: "partially orthogonal",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -247,7 +247,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 						"/foo/baz": {"r3"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/foo/bar",
 			ok:    true,
 			expect: []RoleAssignment{
@@ -267,28 +267,28 @@ func TestDescendAssignmentTree(t *testing.T) {
 		},
 		{
 			name: "fully orthogonal",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/foo/bar": {
 						"/foo/bar": {"r1"},
 					},
 				}),
-			},
+			}.Build(),
 			scope:  "/foo/baz",
 			ok:     true,
 			expect: nil,
 		},
 		{
 			name: "equivalent scoping",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/foo": {
 						"/foo": {"b", "c", "a", "x", "q"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/foo",
 			ok:    true,
 			expect: []RoleAssignment{
@@ -326,7 +326,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 		},
 		{
 			name: "comprehensive",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -343,7 +343,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 						"/foo/bar/baz": {"rb2"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/foo/bar",
 			ok:    true,
 			expect: []RoleAssignment{
@@ -387,21 +387,21 @@ func TestDescendAssignmentTree(t *testing.T) {
 		},
 		{
 			name: "no assignments for scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/foo/bar": {
 						"/foo/bar": {"r1"},
 					},
 				}),
-			},
+			}.Build(),
 			scope:  "/foo",
 			ok:     true,
 			expect: nil,
 		},
 		{
 			name: "orthogonal resource scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -409,13 +409,13 @@ func TestDescendAssignmentTree(t *testing.T) {
 						"/foo": {"r2"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/bar",
 			ok:    false,
 		},
 		{
 			name: "parent resource scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -423,7 +423,7 @@ func TestDescendAssignmentTree(t *testing.T) {
 						"/foo": {"r2"},
 					},
 				}),
-			},
+			}.Build(),
 			scope: "/",
 			ok:    false,
 		},
@@ -456,7 +456,7 @@ func TestGetRolesAtEnforcementPoint(t *testing.T) {
 	t.Parallel()
 
 	// Build a test pin with a populated assignment tree
-	pin := &scopesv1.Pin{
+	pin := scopesv1.Pin_builder{
 		Scope: "/staging/west",
 		AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 			"/": {
@@ -473,7 +473,7 @@ func TestGetRolesAtEnforcementPoint(t *testing.T) {
 				"/staging/west": {"west-west-a", "west-west-b", "west-west-c"},
 			},
 		}),
-	}
+	}.Build()
 
 	tests := []struct {
 		name          string
@@ -547,10 +547,10 @@ func TestGetRolesAtEnforcementPoint(t *testing.T) {
 		},
 		{
 			name: "nil assignment tree",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope:          "/foo",
 				AssignmentTree: nil,
-			},
+			}.Build(),
 			scopeOfOrigin: "/",
 			scopeOfEffect: "/foo",
 			expect:        nil,
@@ -581,7 +581,7 @@ func TestGetRolesAtEnforcementPoint(t *testing.T) {
 func TestRolesAtEnforcementPointComposition(t *testing.T) {
 	t.Parallel()
 
-	pin := &scopesv1.Pin{
+	pin := scopesv1.Pin_builder{
 		Scope: "/staging/west",
 		AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 			"/": {
@@ -597,7 +597,7 @@ func TestRolesAtEnforcementPointComposition(t *testing.T) {
 				"/staging/west": {"west-west-a", "west-west-b"},
 			},
 		}),
-	}
+	}.Build()
 
 	resourceScope := "/staging/west"
 
@@ -633,29 +633,29 @@ func TestEnumerateAllAssignments(t *testing.T) {
 	}{
 		{
 			name: "empty pin",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope:          "/foo",
 				AssignmentTree: nil,
-			},
+			}.Build(),
 			expect: []RoleAssignment{},
 		},
 		{
 			name: "single assignment at root",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
 						"/": {"role1"},
 					},
 				}),
-			},
+			}.Build(),
 			expect: []RoleAssignment{
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/", RoleName: "role1"},
 			},
 		},
 		{
 			name: "multiple assignments at different origins",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/staging/west",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -671,7 +671,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 						"/staging/west": {"west-west"},
 					},
 				}),
-			},
+			}.Build(),
 			expect: []RoleAssignment{
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/", RoleName: "root-root"},
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/staging", RoleName: "root-staging"},
@@ -683,7 +683,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 		},
 		{
 			name: "assignments at scopes beyond pin scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/staging",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -699,7 +699,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 						"/staging/west/rack": {"west-rack"},
 					},
 				}),
-			},
+			}.Build(),
 			expect: []RoleAssignment{
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/staging", RoleName: "root-staging"},
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/staging/west", RoleName: "root-west"},
@@ -711,7 +711,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 		},
 		{
 			name: "multiple roles at same scope combination",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/foo",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -721,7 +721,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 						"/foo": {"owner", "user"},
 					},
 				}),
-			},
+			}.Build(),
 			expect: []RoleAssignment{
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/foo", RoleName: "admin"},
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/foo", RoleName: "developer"},
@@ -732,7 +732,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 		},
 		{
 			name: "complex tree with multiple branches",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Scope: "/",
 				AssignmentTree: AssignmentTreeFromMap(map[string]map[string][]string{
 					"/": {
@@ -749,7 +749,7 @@ func TestEnumerateAllAssignments(t *testing.T) {
 						"/prod/eu": {"eu-admin"},
 					},
 				}),
-			},
+			}.Build(),
 			expect: []RoleAssignment{
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/", RoleName: "global"},
 				{RoleKind: RoleKindUser, ScopeOfOrigin: "/", ScopeOfEffect: "/prod", RoleName: "prod-policy"},
@@ -1103,16 +1103,16 @@ func TestPruneAssignmentTree(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			// set up pin with assignment tree
-			pin := &scopesv1.Pin{
+			pin := scopesv1.Pin_builder{
 				Scope:          "/staging/west",
 				AssignmentTree: AssignmentTreeFromMap(tt.before),
-			}
+			}.Build()
 
 			// perform pruning
 			prunedCount := PruneAssignmentTree(context.Background(), pin, tt.maxBytes)
 
 			// verify resulting tree matches expected
-			afterMap := AssignmentTreeIntoMap(pin.AssignmentTree)
+			afterMap := AssignmentTreeIntoMap(pin.GetAssignmentTree())
 			require.Equal(t, tt.after, afterMap, "tree after pruning should match expected")
 
 			// verify pruned count (this is more about making sure the function returns the expected
@@ -1120,8 +1120,8 @@ func TestPruneAssignmentTree(t *testing.T) {
 			require.Equal(t, tt.expectPruned, prunedCount, "pruned count should match expected")
 
 			// verify final size is on the expected side of the limit
-			if pin.AssignmentTree != nil {
-				finalSize := proto.Size(pin.AssignmentTree)
+			if pin.HasAssignmentTree() {
+				finalSize := proto.Size(pin.GetAssignmentTree())
 				if tt.expectOversized {
 					require.Greater(t, finalSize, tt.maxBytes, "pruned tree should still exceed size limit")
 				} else {
diff --git a/lib/scopes/utils/range.go b/lib/scopes/utils/range.go
index 814ea78de9d..c8077e2ca08 100644
--- a/lib/scopes/utils/range.go
+++ b/lib/scopes/utils/range.go
@@ -31,8 +31,8 @@ import (
 // NOTE: this function mutates the request's PageToken field during iteration.
 func RangeScopedRoles(ctx context.Context, reader services.ScopedRoleReader, req *scopedaccessv1.ListScopedRolesRequest) stream.Stream[*scopedaccessv1.ScopedRole] {
 	return clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageToken string) ([]*scopedaccessv1.ScopedRole, string, error) {
-		req.PageSize = int32(pageSize)
-		req.PageToken = pageToken
+		req.SetPageSize(int32(pageSize))
+		req.SetPageToken(pageToken)
 		rsp, err := reader.ListScopedRoles(ctx, req)
 		if err != nil {
 			return nil, "", err
@@ -45,8 +45,8 @@ func RangeScopedRoles(ctx context.Context, reader services.ScopedRoleReader, req
 // NOTE: this function mutates the request's PageToken field during iteration.
 func RangeScopedRoleAssignments(ctx context.Context, reader services.ScopedRoleAssignmentReader, req *scopedaccessv1.ListScopedRoleAssignmentsRequest) stream.Stream[*scopedaccessv1.ScopedRoleAssignment] {
 	return clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageToken string) ([]*scopedaccessv1.ScopedRoleAssignment, string, error) {
-		req.PageSize = int32(pageSize)
-		req.PageToken = pageToken
+		req.SetPageSize(int32(pageSize))
+		req.SetPageToken(pageToken)
 		rsp, err := reader.ListScopedRoleAssignments(ctx, req)
 		if err != nil {
 			return nil, "", err
diff --git a/lib/scopes/utils/range_test.go b/lib/scopes/utils/range_test.go
index c54be1039cf..801b118a748 100644
--- a/lib/scopes/utils/range_test.go
+++ b/lib/scopes/utils/range_test.go
@@ -45,17 +45,17 @@ func TestRangeScopedRoles(t *testing.T) {
 
 	for i := range roleCount {
 		name := fmt.Sprintf("role-%d", i)
-		err := upstream.Put(&scopedaccessv1.ScopedRole{
+		err := upstream.Put(scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
+			}.Build(),
 			Scope: "/foo",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/foo"},
-			},
+			}.Build(),
 			Version: types.V1,
-		})
+		}.Build())
 		require.NoError(t, err)
 		expectedRoleNames = append(expectedRoleNames, name)
 	}
@@ -84,24 +84,24 @@ func TestRangeScopedRoleAssignments(t *testing.T) {
 
 	for range assignmentCount {
 		name := uuid.New().String()
-		err := upstream.Put(&scopedaccessv1.ScopedRoleAssignment{
+		err := upstream.Put(scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{
+					scopedaccessv1.Assignment_builder{
 						Role:  "some-role",
 						Scope: "/foo",
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		})
+		}.Build())
 		require.NoError(t, err)
 		expectedAssignmentNames = append(expectedAssignmentNames, name)
 	}
diff --git a/lib/secretsscanner/authorizedkeys/authorized_keys.go b/lib/secretsscanner/authorizedkeys/authorized_keys.go
index bdcb45e78b3..ae7f5736462 100644
--- a/lib/secretsscanner/authorizedkeys/authorized_keys.go
+++ b/lib/secretsscanner/authorizedkeys/authorized_keys.go
@@ -351,17 +351,17 @@ func (w *Watcher) fetchAndReportAuthorizedKeys(
 		start := i
 		end := min(i+maxKeysPerReport, len(keys))
 		if err := stream.Send(
-			&accessgraphsecretsv1pb.ReportAuthorizedKeysRequest{
+			accessgraphsecretsv1pb.ReportAuthorizedKeysRequest_builder{
 				Keys:      keys[start:end],
 				Operation: accessgraphsecretsv1pb.OperationType_OPERATION_TYPE_ADD,
-			},
+			}.Build(),
 		); err != nil {
 			return false, trace.Wrap(err)
 		}
 	}
 
 	if err := stream.Send(
-		&accessgraphsecretsv1pb.ReportAuthorizedKeysRequest{Operation: accessgraphsecretsv1pb.OperationType_OPERATION_TYPE_SYNC},
+		accessgraphsecretsv1pb.ReportAuthorizedKeysRequest_builder{Operation: accessgraphsecretsv1pb.OperationType_OPERATION_TYPE_SYNC}.Build(),
 	); err != nil {
 		return false, trace.Wrap(err)
 	}
@@ -396,13 +396,13 @@ func (w *Watcher) parseAuthorizedKeysFile(ctx context.Context, u user.User, auth
 		}
 
 		authorizedKey, err := accessgraph.NewAuthorizedKey(
-			&accessgraphsecretsv1pb.AuthorizedKeySpec{
+			accessgraphsecretsv1pb.AuthorizedKeySpec_builder{
 				HostId:         w.hostID,
 				HostUser:       u.Username,
 				KeyFingerprint: ssh.FingerprintSHA256(parsedKey),
 				KeyComment:     comment,
 				KeyType:        parsedKey.Type(),
-			},
+			}.Build(),
 		)
 		if err != nil {
 			w.logger.WarnContext(ctx, "Failed to create authorized key", "error", err)
diff --git a/lib/secretsscanner/authorizedkeys/authorized_keys_test.go b/lib/secretsscanner/authorizedkeys/authorized_keys_test.go
index cc5638bdba1..663690fea4f 100644
--- a/lib/secretsscanner/authorizedkeys/authorized_keys_test.go
+++ b/lib/secretsscanner/authorizedkeys/authorized_keys_test.go
@@ -88,19 +88,19 @@ func TestAuthorizedKeys(t *testing.T) {
 	got := client.getReqReceived()
 	require.Len(t, got, 2)
 	expected := []*accessgraphsecretsv1pb.ReportAuthorizedKeysRequest{
-		{
+		accessgraphsecretsv1pb.ReportAuthorizedKeysRequest_builder{
 			Keys:      createKeysForUsers(t, hostID),
 			Operation: accessgraphsecretsv1pb.OperationType_OPERATION_TYPE_ADD,
-		},
-		{
+		}.Build(),
+		accessgraphsecretsv1pb.ReportAuthorizedKeysRequest_builder{
 			Operation: accessgraphsecretsv1pb.OperationType_OPERATION_TYPE_SYNC,
-		},
+		}.Build(),
 	}
 	require.Empty(t, cmp.Diff(got, expected,
 		protocmp.Transform(),
 		protocmp.SortRepeated(
 			func(a, b *accessgraphsecretsv1pb.AuthorizedKey) bool {
-				return a.Metadata.Name < b.Metadata.Name
+				return a.GetMetadata().GetName() < b.GetMetadata().GetName()
 			},
 		),
 		protocmp.IgnoreFields(&headerv1.Metadata{}, "expires"),
@@ -179,12 +179,12 @@ type fakeClient struct {
 }
 
 func (f *fakeClient) GetClusterAccessGraphConfig(_ context.Context) (*clusterconfigpb.AccessGraphConfig, error) {
-	return &clusterconfigpb.AccessGraphConfig{
+	return clusterconfigpb.AccessGraphConfig_builder{
 		Enabled: true,
-		SecretsScanConfig: &clusterconfigpb.AccessGraphSecretsScanConfiguration{
+		SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfiguration_builder{
 			SshScanEnabled: true,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 func (f *fakeClient) AccessGraphSecretsScannerClient() accessgraphsecretsv1pb.SecretsScannerServiceClient {
 	return f
@@ -237,13 +237,13 @@ func createKeysForUsers(t *testing.T, hostID string) []*accessgraphsecretsv1pb.A
 		},
 	} {
 		for _, user := range []string{"root", "user"} {
-			at, err := accessgraph.NewAuthorizedKey(&accessgraphsecretsv1pb.AuthorizedKeySpec{
+			at, err := accessgraph.NewAuthorizedKey(accessgraphsecretsv1pb.AuthorizedKeySpec_builder{
 				HostId:         hostID,
 				HostUser:       user,
 				KeyFingerprint: k.fingerprint,
 				KeyComment:     "friel@test",
 				KeyType:        k.keyType,
-			})
+			}.Build())
 			require.NoError(t, err)
 			keys = append(keys, at)
 		}
diff --git a/lib/secretsscanner/proxy/proxy_test.go b/lib/secretsscanner/proxy/proxy_test.go
index 9fa105ed02e..32bfead49f9 100644
--- a/lib/secretsscanner/proxy/proxy_test.go
+++ b/lib/secretsscanner/proxy/proxy_test.go
@@ -61,15 +61,11 @@ func TestProxy(t *testing.T) {
 	require.NoError(t, err)
 
 	// Send the device assertion init message
-	err = stream.Send(&accessgraphsecretsv1pb.ReportSecretsRequest{
-		Payload: &accessgraphsecretsv1pb.ReportSecretsRequest_DeviceAssertion{
-			DeviceAssertion: &devicepb.AssertDeviceRequest{
-				Payload: &devicepb.AssertDeviceRequest_Init{
-					Init: &devicepb.AssertDeviceInit{},
-				},
-			},
-		},
-	})
+	err = stream.Send(accessgraphsecretsv1pb.ReportSecretsRequest_builder{
+		DeviceAssertion: devicepb.AssertDeviceRequest_builder{
+			Init: &devicepb.AssertDeviceInit{},
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Receive the device assertion challenge message
@@ -78,15 +74,11 @@ func TestProxy(t *testing.T) {
 	assert.NotNil(t, msg.GetDeviceAssertion().GetChallenge())
 
 	// Send the device assertion challenge response message
-	err = stream.Send(&accessgraphsecretsv1pb.ReportSecretsRequest{
-		Payload: &accessgraphsecretsv1pb.ReportSecretsRequest_DeviceAssertion{
-			DeviceAssertion: &devicepb.AssertDeviceRequest{
-				Payload: &devicepb.AssertDeviceRequest_ChallengeResponse{
-					ChallengeResponse: &devicepb.AuthenticateDeviceChallengeResponse{Signature: []byte("response")},
-				},
-			},
-		},
-	})
+	err = stream.Send(accessgraphsecretsv1pb.ReportSecretsRequest_builder{
+		DeviceAssertion: devicepb.AssertDeviceRequest_builder{
+			ChallengeResponse: devicepb.AuthenticateDeviceChallengeResponse_builder{Signature: []byte("response")}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Receive the device assertion response message
@@ -147,15 +139,11 @@ func (f *fakeSecretsScannerSvc) ReportSecrets(in accessgraphsecretsv1pb.SecretsS
 		return trace.BadParameter("missing device init")
 	}
 
-	err = in.Send(&accessgraphsecretsv1pb.ReportSecretsResponse{
-		Payload: &accessgraphsecretsv1pb.ReportSecretsResponse_DeviceAssertion{
-			DeviceAssertion: &devicepb.AssertDeviceResponse{
-				Payload: &devicepb.AssertDeviceResponse_Challenge{
-					Challenge: &devicepb.AuthenticateDeviceChallenge{Challenge: []byte("challenge")},
-				},
-			},
-		},
-	})
+	err = in.Send(accessgraphsecretsv1pb.ReportSecretsResponse_builder{
+		DeviceAssertion: devicepb.AssertDeviceResponse_builder{
+			Challenge: devicepb.AuthenticateDeviceChallenge_builder{Challenge: []byte("challenge")}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -168,15 +156,11 @@ func (f *fakeSecretsScannerSvc) ReportSecrets(in accessgraphsecretsv1pb.SecretsS
 		return trace.BadParameter("missing device challenge")
 	}
 
-	err = in.Send(&accessgraphsecretsv1pb.ReportSecretsResponse{
-		Payload: &accessgraphsecretsv1pb.ReportSecretsResponse_DeviceAssertion{
-			DeviceAssertion: &devicepb.AssertDeviceResponse{
-				Payload: &devicepb.AssertDeviceResponse_DeviceAsserted{
-					DeviceAsserted: &devicepb.DeviceAsserted{},
-				},
-			},
-		},
-	})
+	err = in.Send(accessgraphsecretsv1pb.ReportSecretsResponse_builder{
+		DeviceAssertion: devicepb.AssertDeviceResponse_builder{
+			DeviceAsserted: &devicepb.DeviceAsserted{},
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/lib/secretsscanner/reporter/report.go b/lib/secretsscanner/reporter/report.go
index 9396c111fde..3e655bc4e65 100644
--- a/lib/secretsscanner/reporter/report.go
+++ b/lib/secretsscanner/reporter/report.go
@@ -129,13 +129,11 @@ func (r *Reporter) reportPrivateKeys(stream accessgraphsecretsv1pb.SecretsScanne
 	for i := 0; len(privateKeys) > i; i += batchSize {
 		start := i
 		end := min(i+batchSize, len(privateKeys))
-		if err := stream.Send(&accessgraphsecretsv1pb.ReportSecretsRequest{
-			Payload: &accessgraphsecretsv1pb.ReportSecretsRequest_PrivateKeys{
-				PrivateKeys: &accessgraphsecretsv1pb.ReportPrivateKeys{
-					Keys: privateKeys[start:end],
-				},
-			},
-		}); err != nil && !errors.Is(err, io.EOF) {
+		if err := stream.Send(accessgraphsecretsv1pb.ReportSecretsRequest_builder{
+			PrivateKeys: accessgraphsecretsv1pb.ReportPrivateKeys_builder{
+				Keys: privateKeys[start:end],
+			}.Build(),
+		}.Build()); err != nil && !errors.Is(err, io.EOF) {
 			// [io.EOF] indicates that the server has closed the stream.
 			// The client should handle the underlying error on the subsequent Recv call.
 			// All other errors are client-side errors and should be returned.
diff --git a/lib/secretsscanner/reporter/report_test.go b/lib/secretsscanner/reporter/report_test.go
index 9755e1ad725..47cf64234b7 100644
--- a/lib/secretsscanner/reporter/report_test.go
+++ b/lib/secretsscanner/reporter/report_test.go
@@ -143,7 +143,7 @@ func TestReporter(t *testing.T) {
 
 func sortPrivateKeys(keys []*accessgraphsecretsv1pb.PrivateKey) {
 	sort.Slice(keys, func(i, j int) bool {
-		return keys[i].Metadata.Name < keys[j].Metadata.Name
+		return keys[i].GetMetadata().GetName() < keys[j].GetMetadata().GetName()
 	})
 }
 
@@ -152,11 +152,11 @@ func newPrivateKeys(t *testing.T, deviceID string) []*accessgraphsecretsv1pb.Pri
 	var pks []*accessgraphsecretsv1pb.PrivateKey
 	for i := range 10 {
 		pk, err := accessgraph.NewPrivateKey(
-			&accessgraphsecretsv1pb.PrivateKeySpec{
+			accessgraphsecretsv1pb.PrivateKeySpec_builder{
 				PublicKeyFingerprint: "key" + strconv.Itoa(i),
 				DeviceId:             deviceID,
 				PublicKeyMode:        accessgraphsecretsv1pb.PublicKeyMode_PUBLIC_KEY_MODE_DERIVED,
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 		pks = append(pks, pk)
diff --git a/lib/secretsscanner/scanner/scan.go b/lib/secretsscanner/scanner/scan.go
index 79de0b89f05..a9cdb7ac3e0 100644
--- a/lib/secretsscanner/scanner/scan.go
+++ b/lib/secretsscanner/scanner/scan.go
@@ -235,11 +235,11 @@ func extractSSHKey(ctx context.Context, path, deviceID string, fileData []byte)
 
 	key, err := accessgraph.NewPrivateKeyWithName(
 		privateKeyNameGen(path, deviceID, fingerprint),
-		&accessgraphsecretsv1pb.PrivateKeySpec{
+		accessgraphsecretsv1pb.PrivateKeySpec_builder{
 			PublicKeyFingerprint: fingerprint,
 			DeviceId:             deviceID,
 			PublicKeyMode:        mode,
-		},
+		}.Build(),
 	)
 	return key, trace.Wrap(err)
 }
diff --git a/lib/secretsscanner/scanner/scan_test.go b/lib/secretsscanner/scanner/scan_test.go
index ab834384ae8..861d2fde10e 100644
--- a/lib/secretsscanner/scanner/scan_test.go
+++ b/lib/secretsscanner/scanner/scan_test.go
@@ -114,7 +114,7 @@ func TestNewScanner(t *testing.T) {
 
 func sortPrivateKeys(keys []*accessgraphsecretsv1pb.PrivateKey) {
 	sort.Slice(keys, func(i, j int) bool {
-		return keys[i].Metadata.Name < keys[j].Metadata.Name
+		return keys[i].GetMetadata().GetName() < keys[j].GetMetadata().GetName()
 	})
 }
 
@@ -148,11 +148,11 @@ func writeEncryptedKeys(t *testing.T, dir string) []*accessgraphsecretsv1pb.Priv
 
 		key, err := accessgraph.NewPrivateKeyWithName(
 			privateKeyNameGen(filePath, deviceID, fingerprint),
-			&accessgraphsecretsv1pb.PrivateKeySpec{
+			accessgraphsecretsv1pb.PrivateKeySpec_builder{
 				PublicKeyFingerprint: fingerprint,
 				DeviceId:             deviceID,
 				PublicKeyMode:        mode,
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 
@@ -181,11 +181,11 @@ func writeUnEncryptedKeys(t *testing.T, dir string) []*accessgraphsecretsv1pb.Pr
 
 		key, err := accessgraph.NewPrivateKeyWithName(
 			privateKeyNameGen(filePath, deviceID, fingerprint),
-			&accessgraphsecretsv1pb.PrivateKeySpec{
+			accessgraphsecretsv1pb.PrivateKeySpec_builder{
 				PublicKeyFingerprint: fingerprint,
 				DeviceId:             deviceID,
 				PublicKeyMode:        accessgraphsecretsv1pb.PublicKeyMode_PUBLIC_KEY_MODE_DERIVED,
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 
@@ -209,11 +209,11 @@ func writeEncryptedKeyWithoutPubFile(t *testing.T, dir string) []*accessgraphsec
 
 	key, err := accessgraph.NewPrivateKeyWithName(
 		privateKeyNameGen(filePath, deviceID, ""),
-		&accessgraphsecretsv1pb.PrivateKeySpec{
+		accessgraphsecretsv1pb.PrivateKeySpec_builder{
 			PublicKeyFingerprint: "",
 			DeviceId:             deviceID,
 			PublicKeyMode:        accessgraphsecretsv1pb.PublicKeyMode_PUBLIC_KEY_MODE_PROTECTED,
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 
diff --git a/lib/service/discovery.go b/lib/service/discovery.go
index 42b87c3a9fb..9005e6f0295 100644
--- a/lib/service/discovery.go
+++ b/lib/service/discovery.go
@@ -171,10 +171,10 @@ func buildAccessGraphFromTAGOrFallbackToAuth(ctx context.Context, config *servic
 		case err != nil:
 			return discovery.AccessGraphConfig{}, trace.Wrap(err)
 		default:
-			accessGraphCfg.Enabled = rsp.Enabled
-			accessGraphCfg.Addr = rsp.Address
-			accessGraphCfg.CA = rsp.Ca
-			accessGraphCfg.Insecure = rsp.Insecure
+			accessGraphCfg.Enabled = rsp.GetEnabled()
+			accessGraphCfg.Addr = rsp.GetAddress()
+			accessGraphCfg.CA = rsp.GetCa()
+			accessGraphCfg.Insecure = rsp.GetInsecure()
 		}
 	}
 	return accessGraphCfg, nil
diff --git a/lib/service/discovery_test.go b/lib/service/discovery_test.go
index 07f0cf15dd5..8e87e6d9339 100644
--- a/lib/service/discovery_test.go
+++ b/lib/service/discovery_test.go
@@ -111,11 +111,11 @@ func TestTeleportProcess_initDiscoveryService(t *testing.T) {
 			cfg: servicecfg.AccessGraphConfig{
 				Enabled: false,
 			},
-			rsp: &clusterconfigpb.AccessGraphConfig{
+			rsp: clusterconfigpb.AccessGraphConfig_builder{
 				Enabled:  true,
 				Address:  "localhost:5000",
 				Insecure: true,
-			},
+			}.Build(),
 			err: nil,
 			want: discovery.AccessGraphConfig{
 				Enabled:  true,
diff --git a/lib/service/relay.go b/lib/service/relay.go
index a606e6bf128..136a6b4db33 100644
--- a/lib/service/relay.go
+++ b/lib/service/relay.go
@@ -387,20 +387,20 @@ func (process *TeleportProcess) runRelayService() error {
 
 	nonce := uuid.NewString()
 	var relayServer atomic.Pointer[presencev1.RelayServer]
-	relayServer.Store(&presencev1.RelayServer{
+	relayServer.Store(presencev1.RelayServer_builder{
 		Kind:    apitypes.KindRelayServer,
 		SubKind: "",
 		Version: apitypes.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: conn.HostUUID(),
-		},
-		Spec: &presencev1.RelayServer_Spec{
+		}.Build(),
+		Spec: presencev1.RelayServer_Spec_builder{
 			Hostname:   process.Config.Hostname,
 			RelayGroup: process.Config.Relay.RelayGroup,
 			PeerAddr:   peerPublicAddr,
 			Nonce:      nonce,
-		},
-	})
+		}.Build(),
+	}.Build())
 
 	hb, err := srv.NewRelayServerHeartbeat(srv.HeartbeatV2Config[*presencev1.RelayServer]{
 		InventoryHandle: process.inventoryHandle,
@@ -433,7 +433,7 @@ func (process *TeleportProcess) runRelayService() error {
 
 	{
 		r := proto.CloneOf(relayServer.Load())
-		r.GetSpec().Terminating = true
+		r.GetSpec().SetTerminating(true)
 		relayServer.Store(r)
 	}
 
diff --git a/lib/service/service.go b/lib/service/service.go
index fc7f7f798b9..e31817d5d1c 100644
--- a/lib/service/service.go
+++ b/lib/service/service.go
@@ -1406,18 +1406,18 @@ func NewTeleport(cfg *servicecfg.Config) (_ *TeleportProcess, err error) {
 		for _, r := range instanceRoles {
 			services = append(services, string(r))
 		}
-		hello := &proto.UpstreamInventoryHello{
+		hello := proto.UpstreamInventoryHello_builder{
 			ServerID:         hostID,
 			Version:          teleport.Version,
 			Services:         services,
 			Hostname:         cfg.Hostname,
 			ExternalUpgrader: externalUpgrader,
 			ImmutableLabels:  process.getImmutableLabels(),
-		}
+		}.Build()
 
 		if upgraderVersion != nil {
 			// The UpstreamInventoryHello message wants versions with the leading "v".
-			hello.ExternalUpgraderVersion = "v" + upgraderVersion.String()
+			hello.SetExternalUpgraderVersion("v" + upgraderVersion.String())
 		}
 
 		if upgraderKind == types.UpgraderKindTeleportUpdate ||
@@ -1434,7 +1434,7 @@ func NewTeleport(cfg *servicecfg.Config) (_ *TeleportProcess, err error) {
 				cfg.Logger.WarnContext(supervisor.ExitContext(), "Error recovering updater status, this might affect automatic update tracking and progress.", "error", err)
 				info = &types.UpdaterV2Info{UpdaterStatus: types.UpdaterStatus_UPDATER_STATUS_UNREADABLE}
 			}
-			hello.UpdaterInfo = info
+			hello.SetUpdaterInfo(info)
 		}
 		return hello, nil
 	}
@@ -1455,12 +1455,12 @@ func NewTeleport(cfg *servicecfg.Config) (_ *TeleportProcess, err error) {
 		process.logger.InfoContext(process.ExitContext(), "Handling incoming inventory ping.",
 			"id", ping.GetID(),
 			"clock", systemClock)
-		err := sender.Send(process.ExitContext(), &proto.UpstreamInventoryPong{
+		err := sender.Send(process.ExitContext(), proto.UpstreamInventoryPong_builder{
 			ID:          ping.GetID(),
 			SystemClock: timestamppb.New(systemClock),
-		})
+		}.Build())
 		if err != nil {
-			process.logger.WarnContext(process.ExitContext(), "Failed to respond to inventory ping.", "id", ping.ID, "error", err)
+			process.logger.WarnContext(process.ExitContext(), "Failed to respond to inventory ping.", "id", ping.GetID(), "error", err)
 		}
 	})
 
diff --git a/lib/service/service_test.go b/lib/service/service_test.go
index de22f7b637f..17ee27bda4d 100644
--- a/lib/service/service_test.go
+++ b/lib/service/service_test.go
@@ -2056,14 +2056,14 @@ func TestAgentRolloutController(t *testing.T) {
 
 	// Test execution: create the autoupdate_version resource
 	authServer := process.GetAuthServer()
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatepb.AutoUpdateVersionSpec{
-		Agents: &autoupdatepb.AutoUpdateVersionSpecAgents{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatepb.AutoUpdateVersionSpec_builder{
+		Agents: autoupdatepb.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "1.2.3",
 			TargetVersion: "1.2.4",
 			Schedule:      autoupdate.AgentsScheduleImmediate,
 			Mode:          autoupdate.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	version, err = authServer.CreateAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
@@ -2074,7 +2074,7 @@ func TestAgentRolloutController(t *testing.T) {
 		if err != nil {
 			return false
 		}
-		return rollout.Spec.GetTargetVersion() == version.Spec.GetAgents().GetTargetVersion()
+		return rollout.GetSpec().GetTargetVersion() == version.GetSpec().GetAgents().GetTargetVersion()
 	}, 5*time.Second, 10*time.Millisecond)
 }
 
diff --git a/lib/services/access_checker.go b/lib/services/access_checker.go
index c39abb943d2..558358d8f0c 100644
--- a/lib/services/access_checker.go
+++ b/lib/services/access_checker.go
@@ -1367,17 +1367,17 @@ func (a *accessChecker) HostUsers(s types.Server) (*HostUsersDecision, error) {
 		}
 
 		if createHostUserMode == types.CreateHostUserMode_HOST_USER_MODE_OFF {
-			decision.DeniedBy = append(decision.DeniedBy, &decisionpb.Determinant{
+			decision.DeniedBy = append(decision.DeniedBy, decisionpb.Determinant_builder{
 				Kind: role.GetKind(),
 				Name: role.GetName(),
-			})
+			}.Build())
 			continue
 		}
 
-		decision.AllowedBy = append(decision.AllowedBy, &decisionpb.Determinant{
+		decision.AllowedBy = append(decision.AllowedBy, decisionpb.Determinant_builder{
 			Kind: role.GetKind(),
 			Name: role.GetName(),
-		})
+		}.Build())
 
 		if mode == types.CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED {
 			mode = createHostUserMode
@@ -1443,13 +1443,13 @@ func (a *accessChecker) HostUsers(s types.Server) (*HostUsersDecision, error) {
 		uid = uidL[0]
 	}
 
-	decision.Info = &decisionpb.HostUsersInfo{
+	decision.Info = decisionpb.HostUsersInfo_builder{
 		Groups: groups.Elements(),
 		Mode:   convertHostUserMode(mode),
 		Uid:    uid,
 		Gid:    gid,
 		Shell:  shell,
-	}
+	}.Build()
 
 	return decision, nil
 }
diff --git a/lib/services/access_checker_test.go b/lib/services/access_checker_test.go
index 0db019f6700..f70ca831118 100644
--- a/lib/services/access_checker_test.go
+++ b/lib/services/access_checker_test.go
@@ -601,7 +601,7 @@ func TestAccessCheckerHostUsersShell(t *testing.T) {
 
 	// the first value for shell encountered while checking roles should be used, which means
 	// secondaryShell should never be the result here
-	require.Equal(t, expectedShell, hui.Info.Shell)
+	require.Equal(t, expectedShell, hui.Info.GetShell())
 }
 
 func TestAccessCheckerDesktopGroups(t *testing.T) {
@@ -1185,21 +1185,21 @@ func (serverStub) GetKind() string {
 func TestAccessCheckerWorkloadIdentity(t *testing.T) {
 	localCluster := "cluster"
 
-	noLabelsWI := &workloadidentityv1pb.WorkloadIdentity{
+	noLabelsWI := workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind: types.KindWorkloadIdentity,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "no-labels",
-		},
-	}
-	fooLabeledWI := &workloadidentityv1pb.WorkloadIdentity{
+		}.Build(),
+	}.Build()
+	fooLabeledWI := workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind: types.KindWorkloadIdentity,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "foo-labeled",
 			Labels: map[string]string{
 				"foo": "bar",
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	roleNoLabels := newRole(func(rv *types.RoleV6) {})
 	roleWildcard := newRole(func(rv *types.RoleV6) {
diff --git a/lib/services/access_list_test.go b/lib/services/access_list_test.go
index b0083b98950..aaf803b51f0 100644
--- a/lib/services/access_list_test.go
+++ b/lib/services/access_list_test.go
@@ -392,12 +392,12 @@ func TestMatchAccessList(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			filter := &accesslistv1.AccessListsFilter{
+			filter := accesslistv1.AccessListsFilter_builder{
 				Search: tt.search,
 				Owners: tt.owners,
 				Roles:  tt.roles,
 				Origin: tt.origin,
-			}
+			}.Build()
 			result := MatchAccessList(al, filter)
 			if result != tt.expected {
 				t.Errorf("MatchAccessList(search: %q, owners: %v, roles: %v) = %v, want %v",
diff --git a/lib/services/access_monitoring_rules.go b/lib/services/access_monitoring_rules.go
index baf4f1704b4..b2e0453f145 100644
--- a/lib/services/access_monitoring_rules.go
+++ b/lib/services/access_monitoring_rules.go
@@ -54,16 +54,16 @@ type AccessMonitoringRules interface {
 
 // NewAccessMonitoringRuleWithLabels creates a new AccessMonitoringRule  with the given spec and labels.
 func NewAccessMonitoringRuleWithLabels(name string, labels map[string]string, spec *accessmonitoringrulesv1.AccessMonitoringRuleSpec) (*accessmonitoringrulesv1.AccessMonitoringRule, error) {
-	amr := &accessmonitoringrulesv1.AccessMonitoringRule{
+	amr := accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:      name,
 			Namespace: defaults.Namespace,
 			Labels:    labels,
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 
 	err := ValidateAccessMonitoringRule(amr)
 	if err != nil {
@@ -74,24 +74,24 @@ func NewAccessMonitoringRuleWithLabels(name string, labels map[string]string, sp
 
 // ValidateAccessMonitoringRule checks that the provided access monitoring rule is valid.
 func ValidateAccessMonitoringRule(accessMonitoringRule *accessmonitoringrulesv1.AccessMonitoringRule) error {
-	if accessMonitoringRule.Kind != types.KindAccessMonitoringRule {
-		return trace.BadParameter("invalid kind for access monitoring rule: %q", accessMonitoringRule.Kind)
+	if accessMonitoringRule.GetKind() != types.KindAccessMonitoringRule {
+		return trace.BadParameter("invalid kind for access monitoring rule: %q", accessMonitoringRule.GetKind())
 	}
-	if accessMonitoringRule.Metadata == nil {
+	if !accessMonitoringRule.HasMetadata() {
 		return trace.BadParameter("accessMonitoringRule metadata is missing")
 	}
-	if accessMonitoringRule.Version != types.V1 {
-		return trace.BadParameter("accessMonitoringRule version %q is not supported", accessMonitoringRule.Version)
+	if accessMonitoringRule.GetVersion() != types.V1 {
+		return trace.BadParameter("accessMonitoringRule version %q is not supported", accessMonitoringRule.GetVersion())
 	}
-	if accessMonitoringRule.Spec == nil {
+	if !accessMonitoringRule.HasSpec() {
 		return trace.BadParameter("accessMonitoringRule spec is missing")
 	}
 
-	if len(accessMonitoringRule.Spec.Subjects) == 0 {
+	if len(accessMonitoringRule.GetSpec().GetSubjects()) == 0 {
 		return trace.BadParameter("accessMonitoringRule subject is missing")
 	}
 
-	if accessMonitoringRule.Spec.Condition == "" {
+	if accessMonitoringRule.GetSpec().GetCondition() == "" {
 		return trace.BadParameter("accessMonitoringRule condition is missing")
 	}
 
@@ -99,7 +99,7 @@ func ValidateAccessMonitoringRule(accessMonitoringRule *accessmonitoringrulesv1.
 		return trace.Wrap(err, "validating spec.schedules")
 	}
 
-	if accessMonitoringRule.Spec.Notification != nil && accessMonitoringRule.Spec.Notification.Name == "" {
+	if accessMonitoringRule.GetSpec().HasNotification() && accessMonitoringRule.GetSpec().GetNotification().GetName() == "" {
 		return trace.BadParameter("accessMonitoringRule notification plugin name is missing")
 	}
 
@@ -219,7 +219,7 @@ func MatchAccessMonitoringRule(rule *accessmonitoringrulesv1.AccessMonitoringRul
 		}
 	}
 	for _, subject := range subjects {
-		if ok := slices.ContainsFunc(rule.Spec.Subjects, func(s string) bool {
+		if ok := slices.ContainsFunc(rule.GetSpec().GetSubjects(), func(s string) bool {
 			return s == subject
 		}); !ok {
 			return false
diff --git a/lib/services/access_monitoring_rules_test.go b/lib/services/access_monitoring_rules_test.go
index 06037353543..c123621ef54 100644
--- a/lib/services/access_monitoring_rules_test.go
+++ b/lib/services/access_monitoring_rules_test.go
@@ -43,7 +43,7 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "notification name required",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.Notification.Name = ""
+				amr.GetSpec().GetNotification().SetName("")
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "notification plugin name is missing")
@@ -52,7 +52,7 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "automatic_review integration required",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.AutomaticReview.Integration = ""
+				amr.GetSpec().GetAutomaticReview().SetIntegration("")
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "automatic_review integration is missing")
@@ -61,7 +61,7 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "automatic_review decision required",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.AutomaticReview.Decision = ""
+				amr.GetSpec().GetAutomaticReview().SetDecision("")
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "automatic_review decision is missing")
@@ -70,8 +70,8 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "notification or automatic_review required",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.Notification = nil
-				amr.Spec.AutomaticReview = nil
+				amr.GetSpec().ClearNotification()
+				amr.GetSpec().ClearAutomaticReview()
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "notification or automatic_review must be configured")
@@ -80,21 +80,21 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "allow automatic_review to be nil",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.AutomaticReview = nil
+				amr.GetSpec().ClearAutomaticReview()
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "allow notifications to be nil",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.Notification = nil
+				amr.GetSpec().ClearNotification()
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "invalid automatic_review decision",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.AutomaticReview.Decision = "invalid-decision"
+				amr.GetSpec().GetAutomaticReview().SetDecision("invalid-decision")
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, `accessMonitoringRule automatic_review decision "invalid-decision" is not supported`)
@@ -103,7 +103,7 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "invalid desired_state",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.DesiredState = "invalid-desired-state"
+				amr.GetSpec().SetDesiredState("invalid-desired-state")
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, `accessMonitoringRule desired_state "invalid-desired-state" is not supported`)
@@ -112,7 +112,7 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "invalid condition",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.Condition = "invalid-condition"
+				amr.GetSpec().SetCondition("invalid-condition")
 			},
 			assertErr: func(t require.TestingT, err error, i ...any) {
 				require.ErrorContains(t, err, "accessMonitoringRule condition is invalid")
@@ -121,48 +121,48 @@ func TestValidateAccessMonitoringRule(t *testing.T) {
 		{
 			description: "allow desired_state to be empty",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.DesiredState = ""
+				amr.GetSpec().SetDesiredState("")
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "valid time schedule",
 			modifyAMR: func(amr *accessmonitoringrulesv1.AccessMonitoringRule) {
-				amr.Spec.Schedules = map[string]*accessmonitoringrulesv1.Schedule{
-					"default": {
-						Time: &accessmonitoringrulesv1.TimeSchedule{
+				amr.GetSpec().SetSchedules(map[string]*accessmonitoringrulesv1.Schedule{
+					"default": accessmonitoringrulesv1.Schedule_builder{
+						Time: accessmonitoringrulesv1.TimeSchedule_builder{
 							Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-								{
+								accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 									Weekday: time.Monday.String(),
 									Start:   "00:00",
 									End:     "23:59",
-								},
+								}.Build(),
 							},
-						},
-					},
-				}
+						}.Build(),
+					}.Build(),
+				})
 			},
 			assertErr: require.NoError,
 		},
 	}
 
-	validAMR := &accessmonitoringrulesv1.AccessMonitoringRule{
+	validAMR := accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:     types.KindAccessMonitoringRule,
 		Metadata: &headerv1.Metadata{},
 		Version:  types.V1,
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:     []string{types.KindAccessRequest},
 			Condition:    "true",
 			DesiredState: types.AccessMonitoringRuleStateReviewed,
-			Notification: &accessmonitoringrulesv1.Notification{
+			Notification: accessmonitoringrulesv1.Notification_builder{
 				Name: "fakePlugin",
-			},
-			AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+			}.Build(),
+			AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 				Integration: "fakePlugin",
 				Decision:    types.RequestState_APPROVED.String(),
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	for _, test := range tests {
 		t.Run(test.description, func(t *testing.T) {
@@ -187,45 +187,45 @@ func TestValidateSchedules(t *testing.T) {
 		{
 			description: "valid schedules",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "multiple schedules",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"on-call-1": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"on-call-1": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Saturday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
-				"on-call-2": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+					}.Build(),
+				}.Build(),
+				"on-call-2": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Sunday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: require.NoError,
 		},
@@ -241,9 +241,9 @@ func TestValidateSchedules(t *testing.T) {
 		{
 			description: "does not contain any shifts",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
+				"default": accessmonitoringrulesv1.Schedule_builder{
 					Time: &accessmonitoringrulesv1.TimeSchedule{},
-				},
+				}.Build(),
 			},
 			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
 				require.ErrorContains(t, err, "at least one shift is require")
@@ -252,90 +252,90 @@ func TestValidateSchedules(t *testing.T) {
 		{
 			description: "valid timezone (UTC)",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "UTC",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "valid timezone (America/Los_Angeles)",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "America/Los_Angeles",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "valid timezone (Europe/Lisbon)",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "Europe/Lisbon",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "valid timezone (Asia/Singapore)",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "Asia/Singapore",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: require.NoError,
 		},
 		{
 			description: "invalid timezone",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Timezone: "invalid",
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "00:00",
 								End:     "23:59",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
 				require.ErrorContains(t, err, "invalid timezone")
@@ -344,17 +344,17 @@ func TestValidateSchedules(t *testing.T) {
 		{
 			description: "start time is not before end time",
 			schedules: map[string]*accessmonitoringrulesv1.Schedule{
-				"default": {
-					Time: &accessmonitoringrulesv1.TimeSchedule{
+				"default": accessmonitoringrulesv1.Schedule_builder{
+					Time: accessmonitoringrulesv1.TimeSchedule_builder{
 						Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-							{
+							accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 								Weekday: time.Monday.String(),
 								Start:   "23:59",
 								End:     "00:00",
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			assertErr: func(t require.TestingT, err error, _ ...interface{}) {
 				require.ErrorContains(t, err, "start time must be before end time")
diff --git a/lib/services/appauthconfig.go b/lib/services/appauthconfig.go
index 6f15df2ae04..9cfaf8ae041 100644
--- a/lib/services/appauthconfig.go
+++ b/lib/services/appauthconfig.go
@@ -64,29 +64,29 @@ func ValidateAppAuthConfig(s *appauthconfigv1.AppAuthConfig) error {
 	switch {
 	case s == nil:
 		return trace.BadParameter("app auth config must not be empty")
-	case s.Version != types.V1:
-		return trace.BadParameter("app auth config only supports version %q, got %q", types.V1, s.Version)
-	case s.Kind != types.KindAppAuthConfig:
-		return trace.BadParameter("app auth config kind must be %q, got %q", types.KindAppAuthConfig, s.Kind)
-	case s.Metadata == nil:
+	case s.GetVersion() != types.V1:
+		return trace.BadParameter("app auth config only supports version %q, got %q", types.V1, s.GetVersion())
+	case s.GetKind() != types.KindAppAuthConfig:
+		return trace.BadParameter("app auth config kind must be %q, got %q", types.KindAppAuthConfig, s.GetKind())
+	case !s.HasMetadata():
 		return trace.BadParameter("app auth config metadata is missing")
-	case s.Metadata.Name == "":
+	case s.GetMetadata().GetName() == "":
 		return trace.BadParameter("app auth config metadata.name is missing")
-	case s.Spec == nil:
+	case !s.HasSpec():
 		return trace.BadParameter("app auth config spec is missing")
-	case len(s.Spec.AppLabels) == 0:
+	case len(s.GetSpec().GetAppLabels()) == 0:
 		return trace.BadParameter("app auth config spec.app_labels must at least contain a single label, otherwise this config won't be effective")
 	}
 
-	for _, label := range s.Spec.AppLabels {
+	for _, label := range s.GetSpec().GetAppLabels() {
 		if err := validateLabel(label); err != nil {
 			return trace.BadParameter("invalid app auth config spec.app_labels: %v", err)
 		}
 	}
 
-	switch spec := s.Spec.SubKindSpec.(type) {
-	case *appauthconfigv1.AppAuthConfigSpec_Jwt:
-		return validateJWTAppAuthConfig(spec.Jwt)
+	switch s.GetSpec().WhichSubKindSpec() {
+	case appauthconfigv1.AppAuthConfigSpec_Jwt_case:
+		return validateJWTAppAuthConfig(s.GetSpec().GetJwt())
 	default:
 		return trace.BadParameter("unsupported app auth config type")
 	}
@@ -96,9 +96,9 @@ func validateJWTAppAuthConfig(s *appauthconfigv1.AppAuthConfigJWTSpec) error {
 	switch {
 	case s == nil:
 		return trace.BadParameter("app auth config spec.jwt is required")
-	case s.Audience == "":
+	case s.GetAudience() == "":
 		return trace.BadParameter("app auth config spec.jwt.audience cannot be empty")
-	case s.Issuer == "":
+	case s.GetIssuer() == "":
 		return trace.BadParameter("app auth config spec.jwt.issuer cannot be empty")
 	case s.GetJwksUrl() == "" && s.GetStaticJwks() == "":
 		return trace.BadParameter("app auth config spec.jwt.jwks_url or spec.jwt.static_jwks must be provided")
diff --git a/lib/services/appauthconfig_test.go b/lib/services/appauthconfig_test.go
index f92fe058c94..e4a9a05f0d5 100644
--- a/lib/services/appauthconfig_test.go
+++ b/lib/services/appauthconfig_test.go
@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	appauthconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/appauthconfig/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
@@ -32,13 +33,11 @@ func TestValidatAppAuthConfig(t *testing.T) {
 
 	t.Run("Base", func(t *testing.T) {
 		validConfig := &appauthconfigv1.AppAuthConfigSpec_Jwt{
-			Jwt: &appauthconfigv1.AppAuthConfigJWTSpec{
+			Jwt: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 				Audience: "teleport",
 				Issuer:   "https://issuer-url/",
-				KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-					JwksUrl: "https://issuer-url/.well-known/jwks.json",
-				},
-			},
+				JwksUrl:  proto.String("https://issuer-url/.well-known/jwks.json"),
+			}.Build(),
 		}
 		require.NoError(t, validateJWTAppAuthConfig(validConfig.Jwt), "this test expects the config to be valid, ensure it is up-to-date")
 
@@ -47,77 +46,77 @@ func TestValidatAppAuthConfig(t *testing.T) {
 			assertErr require.ErrorAssertionFunc
 		}{
 			"default is valid": {
-				res: &appauthconfigv1.AppAuthConfig{
+				res: appauthconfigv1.AppAuthConfig_builder{
 					Version: types.V1,
 					Kind:    types.KindAppAuthConfig,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "example",
-					},
+					}.Build(),
 					Spec: &appauthconfigv1.AppAuthConfigSpec{
 						AppLabels: []*labelv1.Label{
-							{Name: "*", Values: []string{"*"}},
+							labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build(),
 						},
 						SubKindSpec: validConfig,
 					},
-				},
+				}.Build(),
 				assertErr: require.NoError,
 			},
 			"unknown is invalid": {
-				res: &appauthconfigv1.AppAuthConfig{
+				res: appauthconfigv1.AppAuthConfig_builder{
 					Version: "999",
 					Kind:    types.KindAppAuthConfig,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "example",
-					},
+					}.Build(),
 					Spec: &appauthconfigv1.AppAuthConfigSpec{
 						AppLabels: []*labelv1.Label{
-							{Name: "*", Values: []string{"*"}},
+							labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build(),
 						},
 						SubKindSpec: validConfig,
 					},
-				},
+				}.Build(),
 				assertErr: require.Error,
 			},
 			"missing metadata is invalid": {
-				res: &appauthconfigv1.AppAuthConfig{
+				res: appauthconfigv1.AppAuthConfig_builder{
 					Version: types.V1,
 					Kind:    types.KindAppAuthConfig,
 					Spec: &appauthconfigv1.AppAuthConfigSpec{
 						AppLabels: []*labelv1.Label{
-							{Name: "*", Values: []string{"*"}},
+							labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build(),
 						},
 						SubKindSpec: validConfig,
 					},
-				},
+				}.Build(),
 				assertErr: require.Error,
 			},
 			"missing app labels is invalid": {
-				res: &appauthconfigv1.AppAuthConfig{
+				res: appauthconfigv1.AppAuthConfig_builder{
 					Version: types.V1,
 					Kind:    types.KindAppAuthConfig,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "example",
-					},
+					}.Build(),
 					Spec: &appauthconfigv1.AppAuthConfigSpec{
 						SubKindSpec: validConfig,
 					},
-				},
+				}.Build(),
 				assertErr: require.Error,
 			},
 			"invalid app labels wildcard is invalid": {
-				res: &appauthconfigv1.AppAuthConfig{
+				res: appauthconfigv1.AppAuthConfig_builder{
 					Version: types.V1,
 					Kind:    types.KindAppAuthConfig,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "example",
-					},
+					}.Build(),
 					Spec: &appauthconfigv1.AppAuthConfigSpec{
 						AppLabels: []*labelv1.Label{
-							{Name: "*", Values: []string{"some-random-value"}},
+							labelv1.Label_builder{Name: "*", Values: []string{"some-random-value"}}.Build(),
 						},
 						SubKindSpec: validConfig,
 					},
-				},
+				}.Build(),
 				assertErr: require.Error,
 			},
 			"nil is invalid": {
@@ -137,28 +136,24 @@ func TestValidatAppAuthConfig(t *testing.T) {
 			assertErr require.ErrorAssertionFunc
 		}{
 			"minimal is valid": {
-				res: &appauthconfigv1.AppAuthConfigJWTSpec{
+				res: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 					Audience: "teleport",
 					Issuer:   "https://issuer-url/",
-					KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-						JwksUrl: "https://issuer-url/.well-known/jwks.json",
-					},
-				},
+					JwksUrl:  proto.String("https://issuer-url/.well-known/jwks.json"),
+				}.Build(),
 				assertErr: require.NoError,
 			},
 			"missing jwks_url and static_jwks is invalid": {
-				res: &appauthconfigv1.AppAuthConfigJWTSpec{
+				res: appauthconfigv1.AppAuthConfigJWTSpec_builder{
 					Audience: "teleport",
-				},
+				}.Build(),
 				assertErr: require.Error,
 			},
 			"missing audience is invalid": {
-				res: &appauthconfigv1.AppAuthConfigJWTSpec{
-					Issuer: "https://issuer-url/",
-					KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-						JwksUrl: "https://issuer-url/.well-known/jwks.json",
-					},
-				},
+				res: appauthconfigv1.AppAuthConfigJWTSpec_builder{
+					Issuer:  "https://issuer-url/",
+					JwksUrl: proto.String("https://issuer-url/.well-known/jwks.json"),
+				}.Build(),
 				assertErr: require.Error,
 			},
 			"nil is invalid": {
diff --git a/lib/services/beam.go b/lib/services/beam.go
index 826231d67f7..6cfecef07dd 100644
--- a/lib/services/beam.go
+++ b/lib/services/beam.go
@@ -90,25 +90,25 @@ func ValidateBeam(b *beamsv1.Beam) error {
 	switch {
 	case b == nil:
 		return trace.BadParameter("beam must not be nil")
-	case b.Version != types.V1:
-		return trace.BadParameter("version: only supports version %q, got %q", types.V1, b.Version)
-	case b.Kind != types.KindBeam:
-		return trace.BadParameter("kind: must be %q, got %q", types.KindBeam, b.Kind)
-	case b.Metadata == nil:
+	case b.GetVersion() != types.V1:
+		return trace.BadParameter("version: only supports version %q, got %q", types.V1, b.GetVersion())
+	case b.GetKind() != types.KindBeam:
+		return trace.BadParameter("kind: must be %q, got %q", types.KindBeam, b.GetKind())
+	case !b.HasMetadata():
 		return trace.BadParameter("metadata: is required")
-	case b.Metadata.Name == "":
+	case b.GetMetadata().GetName() == "":
 		return trace.BadParameter("metadata.name: is required")
-	case b.Spec == nil:
+	case !b.HasSpec():
 		return trace.BadParameter("spec: is required")
-	case b.Spec.Expires == nil:
+	case !b.GetSpec().HasExpires():
 		return trace.BadParameter("spec.expires: is required")
-	case b.Status == nil:
+	case !b.HasStatus():
 		return trace.BadParameter("status: is required")
 	}
 
-	switch b.Spec.GetEgress() {
+	switch b.GetSpec().GetEgress() {
 	case beamsv1.EgressMode_EGRESS_MODE_RESTRICTED:
-		for i, domain := range b.Spec.GetAllowedDomains() {
+		for i, domain := range b.GetSpec().GetAllowedDomains() {
 			// Must be fully-qualified, up to the root.
 			if !strings.HasSuffix(domain, ".") {
 				return trace.BadParameter("spec.allowed_domains[%d]: %q must be a fully qualified domain name ending with '.'", i, domain)
@@ -127,18 +127,18 @@ func ValidateBeam(b *beamsv1.Beam) error {
 			}
 		}
 	case beamsv1.EgressMode_EGRESS_MODE_UNRESTRICTED:
-		if len(b.Spec.GetAllowedDomains()) > 0 {
+		if len(b.GetSpec().GetAllowedDomains()) > 0 {
 			return trace.BadParameter("spec.allowed_domains: may only be set when spec.egress is EGRESS_MODE_RESTRICTED")
 		}
 	default:
-		return trace.BadParameter("spec.egress: must be EGRESS_MODE_RESTRICTED or EGRESS_MODE_UNRESTRICTED, got %s", b.Spec.GetEgress())
+		return trace.BadParameter("spec.egress: must be EGRESS_MODE_RESTRICTED or EGRESS_MODE_UNRESTRICTED, got %s", b.GetSpec().GetEgress())
 	}
 
-	if pub := b.Spec.Publish; pub != nil {
-		if pub.Port != 8080 {
+	if pub := b.GetSpec().GetPublish(); pub != nil {
+		if pub.GetPort() != 8080 {
 			return trace.BadParameter("spec.publish.port: must be 8080")
 		}
-		switch pub.Protocol {
+		switch pub.GetProtocol() {
 		case beamsv1.Protocol_PROTOCOL_HTTP, beamsv1.Protocol_PROTOCOL_TCP:
 		default:
 			return trace.BadParameter("spec.publish.protocol: must be HTTP or TCP")
diff --git a/lib/services/beam_test.go b/lib/services/beam_test.go
index f7861c555c7..871cf3076e5 100644
--- a/lib/services/beam_test.go
+++ b/lib/services/beam_test.go
@@ -40,8 +40,8 @@ func TestValidateBeam(t *testing.T) {
 	require.NoError(t, services.ValidateBeam(testBeam(withBeamAlias("beam-alias"))))
 
 	unrestrictedBeam := testBeam(withBeamAlias("beam-alias"))
-	unrestrictedBeam.Spec.Egress = beamsv1.EgressMode_EGRESS_MODE_UNRESTRICTED
-	unrestrictedBeam.Spec.AllowedDomains = nil
+	unrestrictedBeam.GetSpec().SetEgress(beamsv1.EgressMode_EGRESS_MODE_UNRESTRICTED)
+	unrestrictedBeam.GetSpec().SetAllowedDomains(nil)
 	require.NoError(t, services.ValidateBeam(unrestrictedBeam))
 
 	testCases := map[string]struct {
@@ -56,126 +56,126 @@ func TestValidateBeam(t *testing.T) {
 		"wrong version": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Version = ""
+				b.SetVersion("")
 			},
 			err: `version: only supports version "v1", got ""`,
 		},
 		"wrong kind": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Kind = ""
+				b.SetKind("")
 			},
 			err: `kind: must be "beam", got ""`,
 		},
 		"missing metadata": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Metadata = nil
+				b.ClearMetadata()
 			},
 			err: "metadata: is required",
 		},
 		"missing metadata name": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Metadata.Name = ""
+				b.GetMetadata().SetName("")
 			},
 			err: "metadata.name: is required",
 		},
 		"missing spec": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec = nil
+				b.ClearSpec()
 			},
 			err: "spec: is required",
 		},
 		"unspecified egress": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.Egress = beamsv1.EgressMode_EGRESS_MODE_UNSPECIFIED
+				b.GetSpec().SetEgress(beamsv1.EgressMode_EGRESS_MODE_UNSPECIFIED)
 			},
 			err: "spec.egress: must be EGRESS_MODE_RESTRICTED or EGRESS_MODE_UNRESTRICTED",
 		},
 		"invalid egress": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.Egress = beamsv1.EgressMode(42)
+				b.GetSpec().SetEgress(beamsv1.EgressMode(42))
 			},
 			err: "spec.egress: must be EGRESS_MODE_RESTRICTED or EGRESS_MODE_UNRESTRICTED",
 		},
 		"allowed domains with unrestricted egress": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.Egress = beamsv1.EgressMode_EGRESS_MODE_UNRESTRICTED
+				b.GetSpec().SetEgress(beamsv1.EgressMode_EGRESS_MODE_UNRESTRICTED)
 			},
 			err: "spec.allowed_domains: may only be set when spec.egress is EGRESS_MODE_RESTRICTED",
 		},
 		"empty allowed domain": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.AllowedDomains = []string{""}
+				b.GetSpec().SetAllowedDomains([]string{""})
 			},
 			err: `spec.allowed_domains[0]: "" must be a fully qualified domain name ending with '.'`,
 		},
 		"invalid allowed domain": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.AllowedDomains = []string{"Example.COM."}
+				b.GetSpec().SetAllowedDomains([]string{"Example.COM."})
 			},
 			err: `spec.allowed_domains[0]: "Example.COM." is invalid`,
 		},
 		"wildcard allowed domain": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.AllowedDomains = []string{"*.example.com."}
+				b.GetSpec().SetAllowedDomains([]string{"*.example.com."})
 			},
 			err: `spec.allowed_domains[0]: "*.example.com." is invalid`,
 		},
 		"allowed domain missing trailing dot": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.AllowedDomains = []string{"example.com"}
+				b.GetSpec().SetAllowedDomains([]string{"example.com"})
 			},
 			err: `spec.allowed_domains[0]: "example.com" must be a fully qualified domain name ending with '.'`,
 		},
 		"allowed domain is not fqdn": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.AllowedDomains = []string{"localhost."}
+				b.GetSpec().SetAllowedDomains([]string{"localhost."})
 			},
 			err: `spec.allowed_domains[0]: "localhost." must be a fully qualified domain name ending with '.'`,
 		},
 		"invalid publish port": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.Publish.Port = 9090
+				b.GetSpec().GetPublish().SetPort(9090)
 			},
 			err: `spec.publish.port: must be 8080`,
 		},
 		"invalid publish protocol": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.Publish.Protocol = beamsv1.Protocol(9999)
+				b.GetSpec().GetPublish().SetProtocol(beamsv1.Protocol(9999))
 			},
 			err: `spec.publish.protocol: must be HTTP or TCP`,
 		},
 		"missing expires": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Spec.Expires = nil
+				b.GetSpec().ClearExpires()
 			},
 			err: "spec.expires: is required",
 		},
 		"missing status": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Status = nil
+				b.ClearStatus()
 			},
 			err: "status: is required",
 		},
 		"invalid alias": {
 			beam: testBeam(withBeamAlias("beam-alias")),
 			modFn: func(b *beamsv1.Beam) {
-				b.Status.Alias = "beam-123"
+				b.GetStatus().SetAlias("beam-123")
 			},
 			err: "beam alias must be a hyphen-separated pair of two lowercase words",
 		},
@@ -278,37 +278,37 @@ type testBeamOption = func(*beamsv1.Beam)
 
 func withBeamAlias(alias string) testBeamOption {
 	return func(beam *beamsv1.Beam) {
-		beam.Status.Alias = alias
+		beam.GetStatus().SetAlias(alias)
 	}
 }
 
 func withBeamUser(user string) testBeamOption {
 	return func(beam *beamsv1.Beam) {
-		beam.Status.User = user
+		beam.GetStatus().SetUser(user)
 	}
 }
 
 func testBeam(options ...testBeamOption) *beamsv1.Beam {
-	beam := &beamsv1.Beam{
+	beam := beamsv1.Beam_builder{
 		Kind:    types.KindBeam,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.NewString(),
-		},
-		Spec: &beamsv1.BeamSpec{
+		}.Build(),
+		Spec: beamsv1.BeamSpec_builder{
 			Egress:         beamsv1.EgressMode_EGRESS_MODE_RESTRICTED,
 			AllowedDomains: []string{"example.com."},
-			Publish: &beamsv1.PublishSpec{
+			Publish: beamsv1.PublishSpec_builder{
 				Port:     8080,
 				Protocol: beamsv1.Protocol_PROTOCOL_HTTP,
-			},
+			}.Build(),
 			Expires: timestamppb.New(time.Now().Add(time.Hour)),
-		},
-		Status: &beamsv1.BeamStatus{
+		}.Build(),
+		Status: beamsv1.BeamStatus_builder{
 			User:  "alice",
 			Alias: "beam",
-		},
-	}
+		}.Build(),
+	}.Build()
 	for _, opt := range options {
 		opt(beam)
 	}
diff --git a/lib/services/bot_instance.go b/lib/services/bot_instance.go
index 5b60c8484a1..476760adc74 100644
--- a/lib/services/bot_instance.go
+++ b/lib/services/bot_instance.go
@@ -55,19 +55,19 @@ type BotInstance interface {
 
 // ValidateBotInstance verifies that required fields for a new BotInstance are present
 func ValidateBotInstance(b *machineidv1.BotInstance) error {
-	if b.Spec == nil {
+	if !b.HasSpec() {
 		return trace.BadParameter("spec is required")
 	}
 
-	if b.Spec.BotName == "" {
+	if b.GetSpec().GetBotName() == "" {
 		return trace.BadParameter("spec.bot_name is required")
 	}
 
-	if b.Spec.InstanceId == "" {
+	if b.GetSpec().GetInstanceId() == "" {
 		return trace.BadParameter("spec.instance_id is required")
 	}
 
-	if b.Status == nil {
+	if !b.HasStatus() {
 		return trace.BadParameter("status is required")
 	}
 
@@ -108,12 +108,12 @@ func MatchBotInstance(b *machineidv1.BotInstance, botName string, search string,
 	}
 
 	values := []string{
-		b.Spec.BotName,
-		b.Spec.InstanceId,
+		b.GetSpec().GetBotName(),
+		b.GetSpec().GetInstanceId(),
 	}
 
 	if heartbeat != nil {
-		values = append(values, heartbeat.Hostname, heartbeat.JoinMethod, heartbeat.Version, "v"+heartbeat.Version)
+		values = append(values, heartbeat.GetHostname(), heartbeat.GetJoinMethod(), heartbeat.GetVersion(), "v"+heartbeat.GetVersion())
 	}
 
 	return slices.ContainsFunc(values, func(val string) bool {
diff --git a/lib/services/crown_jewels_test.go b/lib/services/crown_jewels_test.go
index 4b9347ea61d..3ceb58843ee 100644
--- a/lib/services/crown_jewels_test.go
+++ b/lib/services/crown_jewels_test.go
@@ -35,12 +35,12 @@ func TestMarshalCrownJewelRoundTrip(t *testing.T) {
 	t.Parallel()
 
 	spec := &crownjewelv1.CrownJewelSpec{}
-	obj := &crownjewelv1.CrownJewel{
-		Metadata: &headerv1.Metadata{
+	obj := crownjewelv1.CrownJewel_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: "dummy-crown-jewel",
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 
 	out, err := MarshalCrownJewel(obj)
 	require.NoError(t, err)
@@ -55,44 +55,44 @@ func TestUnmarshalCrownJewel(t *testing.T) {
 	data, err := utils.ToJSON([]byte(correctCrownJewelYAML))
 	require.NoError(t, err)
 
-	expected := &crownjewelv1.CrownJewel{
+	expected := crownjewelv1.CrownJewel_builder{
 		Version: "v1",
 		Kind:    "crown_jewel",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "example-crown-jewel",
 			Labels: map[string]string{
 				"env": "example",
 			},
-		},
-		Spec: &crownjewelv1.CrownJewelSpec{
+		}.Build(),
+		Spec: crownjewelv1.CrownJewelSpec_builder{
 			Query: "SELECT * FROM nodes",
 			TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-				{
+				crownjewelv1.TeleportMatcher_builder{
 					Kinds: []string{"node"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "abc",
 							Values: []string{"xyz"},
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 			},
 			AwsMatchers: []*crownjewelv1.AWSMatcher{
-				{
+				crownjewelv1.AWSMatcher_builder{
 					Types:   []string{"ec2"},
 					Regions: []string{"us-west-1"},
 					Tags: []*crownjewelv1.AWSTag{
-						{
+						crownjewelv1.AWSTag_builder{
 							Key: "env",
 							Values: []*wrapperspb.StringValue{
 								wrapperspb.String("prod"),
 							},
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	obj, err := UnmarshalCrownJewel(data)
 	require.NoError(t, err)
diff --git a/lib/services/delegation_sessions_test.go b/lib/services/delegation_sessions_test.go
index 66ed16b48e1..a0ef76d2abc 100644
--- a/lib/services/delegation_sessions_test.go
+++ b/lib/services/delegation_sessions_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	delegationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/delegation/v1"
@@ -41,85 +42,85 @@ func TestValidateDelegationSession(t *testing.T) {
 		error string
 	}{
 		"wrong kind": {
-			func(p *delegationv1.DelegationSession) { p.Kind = "" },
+			func(p *delegationv1.DelegationSession) { p.SetKind("") },
 			"kind: must be delegation_session",
 		},
 		"wrong version": {
-			func(p *delegationv1.DelegationSession) { p.Version = "" },
+			func(p *delegationv1.DelegationSession) { p.SetVersion("") },
 			"version: must be v1",
 		},
 		"missing name": {
-			func(p *delegationv1.DelegationSession) { p.Metadata.Name = "" },
+			func(p *delegationv1.DelegationSession) { p.GetMetadata().SetName("") },
 			"metadata.name: is required",
 		},
 		"no expiration": {
-			func(p *delegationv1.DelegationSession) { p.Metadata.Expires = nil },
+			func(p *delegationv1.DelegationSession) { p.GetMetadata().ClearExpires() },
 			"metadata.expires: is required",
 		},
 		"no resources": {
-			func(p *delegationv1.DelegationSession) { p.Spec.Resources = nil },
+			func(p *delegationv1.DelegationSession) { p.GetSpec().SetResources(nil) },
 			"spec.resources: at least one resource is required",
 		},
 		"missing user": {
-			func(p *delegationv1.DelegationSession) { p.Spec.User = "" },
+			func(p *delegationv1.DelegationSession) { p.GetSpec().SetUser("") },
 			"spec.user: is required",
 		},
 		"invalid resource identifier": {
 			func(p *delegationv1.DelegationSession) {
-				p.Spec.Resources[0] = &delegationv1.DelegationResourceSpec{Kind: "no-such-kind"}
+				p.GetSpec().GetResources()[0] = delegationv1.DelegationResourceSpec_builder{Kind: "no-such-kind"}.Build()
 			},
 			"spec.resources[0]: invalid resource spec",
 		},
 		"wildcard resource kind but not name": {
 			func(p *delegationv1.DelegationSession) {
-				p.Spec.Resources = []*delegationv1.DelegationResourceSpec{
-					{
+				p.GetSpec().SetResources([]*delegationv1.DelegationResourceSpec{
+					delegationv1.DelegationResourceSpec_builder{
 						Kind: types.Wildcard,
 						Name: "something-specific",
-					},
-				}
+					}.Build(),
+				})
 			},
 			"name must also be '*'",
 		},
 		"wildcard resource name but not kind": {
 			func(p *delegationv1.DelegationSession) {
-				p.Spec.Resources = []*delegationv1.DelegationResourceSpec{
-					{
+				p.GetSpec().SetResources([]*delegationv1.DelegationResourceSpec{
+					delegationv1.DelegationResourceSpec_builder{
 						Kind: types.KindApp,
 						Name: types.Wildcard,
-					},
-				}
+					}.Build(),
+				})
 			},
 			"kind must also be '*'",
 		},
 		"mixed wildcard and explicit resources": {
 			func(p *delegationv1.DelegationSession) {
-				p.Spec.Resources = []*delegationv1.DelegationResourceSpec{
-					{
+				p.GetSpec().SetResources([]*delegationv1.DelegationResourceSpec{
+					delegationv1.DelegationResourceSpec_builder{
 						Kind: types.Wildcard,
 						Name: types.Wildcard,
-					},
-					{
+					}.Build(),
+					delegationv1.DelegationResourceSpec_builder{
 						Kind: types.KindApp,
 						Name: "my-app",
-					},
-				}
+					}.Build(),
+				})
 			},
 			"wildcard is mutually exclusive with explicit resources",
 		},
 		"no authorized users": {
-			func(p *delegationv1.DelegationSession) { p.Spec.AuthorizedUsers = nil },
+			func(p *delegationv1.DelegationSession) { p.GetSpec().SetAuthorizedUsers(nil) },
 			"spec.authorized_users: at least one user is required",
 		},
 		"invalid user kind": {
 			func(p *delegationv1.DelegationSession) {
-				p.Spec.AuthorizedUsers[0].Kind = "dragon"
+				p.GetSpec().GetAuthorizedUsers()[0].SetKind("dragon")
 			},
 			"spec.authorized_users[0].kind: must be bot",
 		},
 		"no bot name": {
 			func(p *delegationv1.DelegationSession) {
-				p.Spec.AuthorizedUsers[0].Matcher = &delegationv1.DelegationUserSpec_BotName{}
+				p.GetSpec().GetAuthorizedUsers()[0].SetBotName("")
 			},
 			"spec.authorized_users[0].bot_name: is required",
 		},
@@ -139,39 +140,39 @@ func TestValidateDelegationSession(t *testing.T) {
 }
 
 func validDelegationSession() *delegationv1.DelegationSession {
-	return &delegationv1.DelegationSession{
+	return delegationv1.DelegationSession_builder{
 		Kind:    types.KindDelegationSession,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    uuid.NewString(),
 			Expires: timestamppb.New(time.Now().Add(1 * time.Hour)),
-		},
-		Spec: &delegationv1.DelegationSessionSpec{
+		}.Build(),
+		Spec: delegationv1.DelegationSessionSpec_builder{
 			User: "alex@example.com",
 			Resources: []*delegationv1.DelegationResourceSpec{
-				{
+				delegationv1.DelegationResourceSpec_builder{
 					Kind: types.KindApp,
 					Name: "my-app",
-				},
-				{
+				}.Build(),
+				delegationv1.DelegationResourceSpec_builder{
 					Kind: types.KindDatabase,
 					Name: "my-database",
-				},
-				{
+				}.Build(),
+				delegationv1.DelegationResourceSpec_builder{
 					Kind: types.KindKubernetesCluster,
 					Name: "my-k8s-cluster",
-				},
-				{
+				}.Build(),
+				delegationv1.DelegationResourceSpec_builder{
 					Kind: types.KindNode,
 					Name: "my-node",
-				},
+				}.Build(),
 			},
 			AuthorizedUsers: []*delegationv1.DelegationUserSpec{
-				{
+				delegationv1.DelegationUserSpec_builder{
 					Kind:    types.KindBot,
-					Matcher: &delegationv1.DelegationUserSpec_BotName{BotName: "my-bot"},
-				},
+					BotName: proto.String("my-bot"),
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/services/discoveryconfig_test.go b/lib/services/discoveryconfig_test.go
index 7935cb6fd61..9972ff2908b 100644
--- a/lib/services/discoveryconfig_test.go
+++ b/lib/services/discoveryconfig_test.go
@@ -156,12 +156,12 @@ status:
 	expected.Status = discoveryconfig.Status{
 		IntegrationDiscoveredResources: map[string]*discoveryconfig.IntegrationDiscoveredSummary{
 			"integration": {
-				IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-					AwsEc2: &discoveryconfigv1.ResourcesDiscoveredSummary{
+				IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+					AwsEc2: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 						Found:  5,
 						Failed: 5,
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 		},
 	}
diff --git a/lib/services/health_check_config.go b/lib/services/health_check_config.go
index cdced82ca7c..fa1eebf0c17 100644
--- a/lib/services/health_check_config.go
+++ b/lib/services/health_check_config.go
@@ -59,43 +59,43 @@ func ValidateHealthCheckConfig(s *healthcheckconfigv1.HealthCheckConfig) error {
 	switch {
 	case s == nil:
 		return trace.BadParameter("object must not be nil")
-	case s.Version != types.V1:
-		return trace.BadParameter("only version %q is supported, got %q", types.V1, s.Version)
-	case s.Kind != types.KindHealthCheckConfig:
-		return trace.BadParameter("kind must be %q, got %q", types.KindHealthCheckConfig, s.Kind)
-	case s.Metadata == nil:
+	case s.GetVersion() != types.V1:
+		return trace.BadParameter("only version %q is supported, got %q", types.V1, s.GetVersion())
+	case s.GetKind() != types.KindHealthCheckConfig:
+		return trace.BadParameter("kind must be %q, got %q", types.KindHealthCheckConfig, s.GetKind())
+	case !s.HasMetadata():
 		return trace.BadParameter("metadata is missing")
-	case s.Metadata.Name == "":
+	case s.GetMetadata().GetName() == "":
 		return trace.BadParameter("metadata.name is missing")
-	case s.Spec == nil:
+	case !s.HasSpec():
 		return trace.BadParameter("spec is missing")
-	case s.Spec.Match == nil:
+	case !s.GetSpec().HasMatch():
 		return trace.BadParameter("spec.match is missing")
 	}
 
-	for _, label := range s.Spec.Match.DbLabels {
+	for _, label := range s.GetSpec().GetMatch().GetDbLabels() {
 		if err := validateLabel(label); err != nil {
 			return trace.BadParameter("invalid spec.db_labels: %v", err)
 		}
 	}
-	if expr := s.Spec.Match.DbLabelsExpression; len(expr) > 0 {
+	if expr := s.GetSpec().GetMatch().GetDbLabelsExpression(); len(expr) > 0 {
 		if _, err := parseLabelExpression(expr); err != nil {
 			return trace.BadParameter("invalid spec.db_labels_expression: %v", err)
 		}
 	}
 
-	for _, label := range s.Spec.Match.KubernetesLabels {
+	for _, label := range s.GetSpec().GetMatch().GetKubernetesLabels() {
 		if err := validateLabel(label); err != nil {
 			return trace.BadParameter("invalid spec.kubernetes_labels: %v", err)
 		}
 	}
-	if expr := s.Spec.Match.KubernetesLabelsExpression; len(expr) > 0 {
+	if expr := s.GetSpec().GetMatch().GetKubernetesLabelsExpression(); len(expr) > 0 {
 		if _, err := parseLabelExpression(expr); err != nil {
 			return trace.BadParameter("invalid spec.kubernetes_labels_expression: %v", err)
 		}
 	}
 
-	timeout := s.Spec.Timeout.AsDuration()
+	timeout := s.GetSpec().GetTimeout().AsDuration()
 	switch {
 	case timeout == 0:
 		timeout = defaults.HealthCheckTimeout
@@ -103,7 +103,7 @@ func ValidateHealthCheckConfig(s *healthcheckconfigv1.HealthCheckConfig) error {
 		return trace.BadParameter("spec.timeout must be at least %s", constants.MinHealthCheckTimeout)
 	}
 
-	interval := s.Spec.Interval.AsDuration()
+	interval := s.GetSpec().GetInterval().AsDuration()
 	switch {
 	case interval == 0:
 		interval = defaults.HealthCheckInterval
@@ -114,26 +114,26 @@ func ValidateHealthCheckConfig(s *healthcheckconfigv1.HealthCheckConfig) error {
 	}
 
 	if timeout > interval {
-		if s.Spec.Timeout.AsDuration() == 0 {
+		if s.GetSpec().GetTimeout().AsDuration() == 0 {
 			return trace.BadParameter("spec.interval (%s) must not be less than the default timeout (%s)", interval, defaults.HealthCheckTimeout)
 		}
-		if s.Spec.Interval.AsDuration() == 0 {
+		if s.GetSpec().GetInterval().AsDuration() == 0 {
 			return trace.BadParameter("spec.timeout (%s) must not be greater than the default interval (%s)", timeout, defaults.HealthCheckInterval)
 		}
 		return trace.BadParameter("spec.timeout (%s) must not be greater than spec.interval (%s)", timeout, interval)
 	}
 
-	if s.Spec.HealthyThreshold > constants.MaxHealthCheckHealthyThreshold {
+	if s.GetSpec().GetHealthyThreshold() > constants.MaxHealthCheckHealthyThreshold {
 		return trace.BadParameter(
 			"spec.healthy_threshold (%v) must not be greater than %v",
-			s.Spec.HealthyThreshold,
+			s.GetSpec().GetHealthyThreshold(),
 			constants.MaxHealthCheckHealthyThreshold,
 		)
 	}
-	if s.Spec.UnhealthyThreshold > constants.MaxHealthCheckUnhealthyThreshold {
+	if s.GetSpec().GetUnhealthyThreshold() > constants.MaxHealthCheckUnhealthyThreshold {
 		return trace.BadParameter(
 			"spec.unhealthy_threshold (%v) must not be greater than %v",
-			s.Spec.UnhealthyThreshold,
+			s.GetSpec().GetUnhealthyThreshold(),
 			constants.MaxHealthCheckUnhealthyThreshold,
 		)
 	}
@@ -141,9 +141,9 @@ func ValidateHealthCheckConfig(s *healthcheckconfigv1.HealthCheckConfig) error {
 }
 
 func validateLabel(label *labelv1.Label) error {
-	if label.Name == types.Wildcard {
-		if len(label.Values) != 1 || label.Values[0] != types.Wildcard {
-			return trace.BadParameter("selector *:%s is not supported, a wildcard label key may only be used with a wildcard label value", label.Values[0])
+	if label.GetName() == types.Wildcard {
+		if len(label.GetValues()) != 1 || label.GetValues()[0] != types.Wildcard {
+			return trace.BadParameter("selector *:%s is not supported, a wildcard label key may only be used with a wildcard label value", label.GetValues()[0])
 		}
 	}
 	return nil
diff --git a/lib/services/health_check_config_test.go b/lib/services/health_check_config_test.go
index d85184f5329..30429143eca 100644
--- a/lib/services/health_check_config_test.go
+++ b/lib/services/health_check_config_test.go
@@ -52,43 +52,43 @@ func TestValidateHealthCheckConfig(t *testing.T) {
 	}{
 		{
 			name: "default is valid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "default",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "*",
 							Values: []string{"*"},
-						}},
-					},
-				},
-			},
+						}.Build()},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
 			name: "valid custom",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
+						}.Build()},
 						DbLabelsExpression: "labels.env == `prod`",
-					},
+					}.Build(),
 					Timeout:  durationpb.New(1 * time.Second),
 					Interval: durationpb.New(30 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
@@ -98,299 +98,299 @@ func TestValidateHealthCheckConfig(t *testing.T) {
 		},
 		{
 			name: "unknown version is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: "v999",
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`only version "v1" is supported`),
 		},
 		{
 			name: "mismatched kind is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindUser,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`kind must be "health_check_config"`),
 		},
 		{
 			name: "missing metadata is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata is missing"),
 		},
 		{
 			name: "missing name is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name is missing"),
 		},
 		{
 			name: "missing spec is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
+				}.Build(),
 				Spec: nil,
-			},
+			}.Build(),
 			requireErr: errContains("spec is missing"),
 		},
 		{
 			name: "missing match section is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
 					Match:    nil,
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.match is missing"),
 		},
 		{
 			name: "invalid label matcher",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   types.Wildcard,
 							Values: []string{"asdf"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("invalid spec.db_labels: selector *:asdf is not supported, a wildcard label key may only be used with a wildcard label value"),
 		},
 		{
 			name: "invalid label expression matcher",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
 						DbLabelsExpression: "abc",
-					},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(2 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("invalid spec.db_labels_expression: parsing label expression"),
 		},
 		{
 			name: "timeout less than minimum is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(500 * time.Millisecond),
 					Interval: durationpb.New(5 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.timeout must be at least"),
 		},
 		{
 			name: "interval less than minimum is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(250 * time.Millisecond),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.interval must be at least"),
 		},
 		{
 			name: "timeout greater than interval is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(31 * time.Second),
 					Interval: durationpb.New(30 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.timeout (31s) must not be greater than spec.interval (30s)"),
 		},
 		{
 			name: "timeout greater than default interval is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(31 * time.Second),
 					Interval: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.timeout (31s) must not be greater than the default interval (30s)"),
 		},
 		{
 			name: "interval greater than maximum is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:  durationpb.New(time.Second),
 					Interval: durationpb.New(601 * time.Second),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.interval must not be greater than 10m0s"),
 		},
 		{
 			name: "healthy threshold greater than maximum is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:          durationpb.New(time.Second),
 					Interval:         durationpb.New(30 * time.Second),
 					HealthyThreshold: 11,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.healthy_threshold (11) must not be greater than 10"),
 		},
 		{
 			name: "unhealthy threshold greater than maximum is invalid",
-			in: &healthcheckconfigv1.HealthCheckConfig{
+			in: healthcheckconfigv1.HealthCheckConfig_builder{
 				Version: types.V1,
 				Kind:    types.KindHealthCheckConfig,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-					Match: &healthcheckconfigv1.Matcher{
-						DbLabels: []*labelv1.Label{{
+				}.Build(),
+				Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+					Match: healthcheckconfigv1.Matcher_builder{
+						DbLabels: []*labelv1.Label{labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"prod"},
-						}},
-					},
+						}.Build()},
+					}.Build(),
 					Timeout:            durationpb.New(time.Second),
 					Interval:           durationpb.New(30 * time.Second),
 					UnhealthyThreshold: 11,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.unhealthy_threshold (11) must not be greater than 10"),
 		},
 		{
diff --git a/lib/services/identitycenter.go b/lib/services/identitycenter.go
index 7d7407a074b..5d8c788be3a 100644
--- a/lib/services/identitycenter.go
+++ b/lib/services/identitycenter.go
@@ -237,9 +237,9 @@ func IdentityCenterAccountToAppServer(acct *identitycenterv1.Account) *types.App
 	pss := make([]*types.IdentityCenterPermissionSet, len(srcPSs))
 	for i, ps := range acct.GetSpec().GetPermissionSetInfo() {
 		pss[i] = &types.IdentityCenterPermissionSet{
-			ARN:          ps.Arn,
-			Name:         ps.Name,
-			AssignmentID: ps.AssignmentId,
+			ARN:          ps.GetArn(),
+			Name:         ps.GetName(),
+			AssignmentID: ps.GetAssignmentId(),
 		}
 	}
 
@@ -249,7 +249,7 @@ func IdentityCenterAccountToAppServer(acct *identitycenterv1.Account) *types.App
 	// here. The web Launch button (ResourceActionButton.tsx) builds the
 	// SSO launch URL as `${publicAddr}&role_name=...`, which requires
 	// the full StartUrl - scheme, path, and case preserved.
-	metadata := types.Metadata153ToLegacy(acct.Metadata)
+	metadata := types.Metadata153ToLegacy(acct.GetMetadata())
 	metadata.Description = acct.GetSpec().GetName()
 
 	return &types.AppServerV3{
@@ -331,7 +331,7 @@ func (m *IdentityCenterAccountMatcher) String() string {
 func NewIdentityCenterAccountAssignmentMatcher(assignment IdentityCenterAccountAssignment) *IdentityCenterAccountAssignmentMatcher {
 	return &IdentityCenterAccountAssignmentMatcher{
 		accountID:        assignment.GetSpec().GetAccountId(),
-		permissionSetARN: assignment.GetSpec().GetPermissionSet().Arn,
+		permissionSetARN: assignment.GetSpec().GetPermissionSet().GetArn(),
 	}
 }
 
diff --git a/lib/services/identitycenter_test.go b/lib/services/identitycenter_test.go
index 3df65219cb7..489ef6c0491 100644
--- a/lib/services/identitycenter_test.go
+++ b/lib/services/identitycenter_test.go
@@ -355,17 +355,17 @@ func TestIdentityCenterAccountToAppServer(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			acct := &identitycenterv1.Account{
+			acct := identitycenterv1.Account_builder{
 				Kind:    types.KindIdentityCenterAccount,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: tt.acctName,
-				},
-				Spec: &identitycenterv1.AccountSpec{
+				}.Build(),
+				Spec: identitycenterv1.AccountSpec_builder{
 					Id:       "123456789012",
 					StartUrl: tt.startURL,
-				},
-			}
+				}.Build(),
+			}.Build()
 
 			srv := IdentityCenterAccountToAppServer(acct)
 			require.Equal(t, tt.acctName, srv.GetApp().GetName())
diff --git a/lib/services/kube_access_checker_test.go b/lib/services/kube_access_checker_test.go
index 158680c62be..58087c65c59 100644
--- a/lib/services/kube_access_checker_test.go
+++ b/lib/services/kube_access_checker_test.go
@@ -37,48 +37,48 @@ func TestKubeAccessCheckerAdjustDisconnectExpiredCert(t *testing.T) {
 	}{
 		{
 			name: "unset defers to default false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Kube: &scopedaccessv1.ScopedRoleKube{},
-			},
+			}.Build(),
 			defaultVal: false,
 			expect:     false,
 		},
 		{
 			name: "unset kube and default defers to default true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Kube: &scopedaccessv1.ScopedRoleKube{},
-			},
+			}.Build(),
 			defaultVal: true,
 			expect:     true,
 		},
 		{
 			name: "explicit true overrides default false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Kube: &scopedaccessv1.ScopedRoleKube{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 					DisconnectExpiredCert: ptr(true),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			defaultVal: false,
 			expect:     true,
 		},
 		{
 			name: "explicit false overrides default true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Kube: &scopedaccessv1.ScopedRoleKube{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 					DisconnectExpiredCert: ptr(false),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			defaultVal: true,
 			expect:     false,
 		},
 		{
 			name: "default block is applied when kube block is empty",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 					DisconnectExpiredCert: ptr(false),
-				},
+				}.Build(),
 				Kube: &scopedaccessv1.ScopedRoleKube{},
-			},
+			}.Build(),
 			defaultVal: true,
 			expect:     false,
 		},
@@ -102,61 +102,61 @@ func TestKubeAccessCheckerLockingMode(t *testing.T) {
 	}{
 		{
 			name: "unset kube and default blocks defers to default mode",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Kube: &scopedaccessv1.ScopedRoleKube{},
-			},
+			}.Build(),
 			defaultMode: constants.LockingModeBestEffort,
 			expect:      constants.LockingModeBestEffort,
 		},
 		{
 			name: "strict from role",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Kube: &scopedaccessv1.ScopedRoleKube{
-					Lock: &scopedaccessv1.Lock{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: string(constants.LockingModeStrict),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeBestEffort,
 			expect:      constants.LockingModeStrict,
 		},
 		{
 			name: "best effort from role",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Kube: &scopedaccessv1.ScopedRoleKube{
-					Lock: &scopedaccessv1.Lock{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: string(constants.LockingModeBestEffort),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeStrict,
 			expect:      constants.LockingModeBestEffort,
 		},
 		{
 			name: "invalid value falls back to default",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Kube: &scopedaccessv1.ScopedRoleKube{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 
-					Lock: &scopedaccessv1.Lock{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: "invalid",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeStrict,
 			expect:      constants.LockingModeStrict,
 		},
 		{
 			name: "empty mode falls back to default block",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
-					Lock: &scopedaccessv1.Lock{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: string(constants.LockingModeStrict),
-					},
-				},
-				Kube: &scopedaccessv1.ScopedRoleKube{
+					}.Build(),
+				}.Build(),
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 					Lock: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeBestEffort,
 			expect:      constants.LockingModeStrict,
 		},
diff --git a/lib/services/linux_desktop_test.go b/lib/services/linux_desktop_test.go
index 60ccb4bd2c6..5e7c9363949 100644
--- a/lib/services/linux_desktop_test.go
+++ b/lib/services/linux_desktop_test.go
@@ -30,20 +30,20 @@ import (
 func TestMarshalUnmarshalLinuxDesktop(t *testing.T) {
 	t.Parallel()
 
-	desktop := &linuxdesktopv1.LinuxDesktop{
+	desktop := linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "desktop-1",
 			Labels: map[string]string{
 				"env": "test",
 			},
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "127.0.0.1:22",
 			Hostname: "host",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	out, err := MarshalLinuxDesktop(desktop)
 	require.NoError(t, err)
diff --git a/lib/services/local/access_graph.go b/lib/services/local/access_graph.go
index 184fae68791..decd0d81697 100644
--- a/lib/services/local/access_graph.go
+++ b/lib/services/local/access_graph.go
@@ -101,7 +101,7 @@ func (k *AccessGraphSecretsService) ListAuthorizedKeysForServer(ctx context.Cont
 
 // UpsertAuthorizedKey upserts a new authorized key.
 func (k *AccessGraphSecretsService) UpsertAuthorizedKey(ctx context.Context, in *accessgraphsecretspb.AuthorizedKey) (*accessgraphsecretspb.AuthorizedKey, error) {
-	svc := k.authorizedKeysSvc.WithPrefix(in.Spec.HostId)
+	svc := k.authorizedKeysSvc.WithPrefix(in.GetSpec().GetHostId())
 	out, err := svc.UpsertResource(ctx, in)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -145,7 +145,7 @@ func (k *AccessGraphSecretsService) ListPrivateKeysForDevice(ctx context.Context
 
 // UpsertPrivateKey upserts a new private key.
 func (k *AccessGraphSecretsService) UpsertPrivateKey(ctx context.Context, in *accessgraphsecretspb.PrivateKey) (*accessgraphsecretspb.PrivateKey, error) {
-	svc := k.privateKeysSvc.WithPrefix(in.Spec.DeviceId)
+	svc := k.privateKeysSvc.WithPrefix(in.GetSpec().GetDeviceId())
 	out, err := svc.UpsertResource(ctx, in)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/services/local/access_graph_test.go b/lib/services/local/access_graph_test.go
index ff594a59b0c..c0c1432665e 100644
--- a/lib/services/local/access_graph_test.go
+++ b/lib/services/local/access_graph_test.go
@@ -50,30 +50,30 @@ func TestAccessGraphAuthorizedKeys(t *testing.T) {
 
 	// Test case 2: Non-empty list
 	authorizedKeys := []*accessgraphsecretspb.AuthorizedKeySpec{
-		{
+		accessgraphsecretspb.AuthorizedKeySpec_builder{
 			HostId:         "host1",
 			HostUser:       "user1",
 			KeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
 			KeyType:        "ssh-rsa",
-		},
-		{
+		}.Build(),
+		accessgraphsecretspb.AuthorizedKeySpec_builder{
 			HostId:         "host1",
 			HostUser:       "user2",
 			KeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
 			KeyType:        "ssh-rsa",
-		},
-		{
+		}.Build(),
+		accessgraphsecretspb.AuthorizedKeySpec_builder{
 			HostId:         "host2",
 			HostUser:       "user1",
 			KeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
 			KeyType:        "ssh-rsa",
-		},
-		{
+		}.Build(),
+		accessgraphsecretspb.AuthorizedKeySpec_builder{
 			HostId:         "host2",
 			HostUser:       "user2",
 			KeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
 			KeyType:        "ssh-rsa",
-		},
+		}.Build(),
 	}
 	var authKeys []*accessgraphsecretspb.AuthorizedKey
 	for _, key := range authorizedKeys {
@@ -89,7 +89,7 @@ func TestAccessGraphAuthorizedKeys(t *testing.T) {
 	require.Empty(t, cmp.Diff(authKeys, keys,
 		protocmp.Transform(),
 		cmpopts.SortSlices(func(a, b *accessgraphsecretspb.AuthorizedKey) bool {
-			return a.Metadata.Name < b.Metadata.Name
+			return a.GetMetadata().GetName() < b.GetMetadata().GetName()
 		})))
 	require.Empty(t, nextToken)
 
@@ -160,26 +160,26 @@ func TestAccessGraphPrivateKeys(t *testing.T) {
 
 	// Test case 2: Non-empty list
 	privateKeysSpec := []*accessgraphsecretspb.PrivateKeySpec{
-		{
+		accessgraphsecretspb.PrivateKeySpec_builder{
 			DeviceId:             "device1",
 			PublicKeyMode:        accessgraphsecretspb.PublicKeyMode_PUBLIC_KEY_MODE_DERIVED,
 			PublicKeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
-		},
-		{
+		}.Build(),
+		accessgraphsecretspb.PrivateKeySpec_builder{
 			DeviceId:             "device1",
 			PublicKeyMode:        accessgraphsecretspb.PublicKeyMode_PUBLIC_KEY_MODE_PUB_FILE,
 			PublicKeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
-		},
-		{
+		}.Build(),
+		accessgraphsecretspb.PrivateKeySpec_builder{
 			DeviceId:             "device2",
 			PublicKeyMode:        accessgraphsecretspb.PublicKeyMode_PUBLIC_KEY_MODE_DERIVED,
 			PublicKeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
-		},
-		{
+		}.Build(),
+		accessgraphsecretspb.PrivateKeySpec_builder{
 			DeviceId:             "device2",
 			PublicKeyMode:        accessgraphsecretspb.PublicKeyMode_PUBLIC_KEY_MODE_PUB_FILE,
 			PublicKeyFingerprint: "AAAAB3NzaC1yc2EAAAADAQABAAABAQC...",
-		},
+		}.Build(),
 	}
 	var authKeys []*accessgraphsecretspb.PrivateKey
 	for _, key := range privateKeysSpec {
@@ -196,7 +196,7 @@ func TestAccessGraphPrivateKeys(t *testing.T) {
 	require.Empty(t, cmp.Diff(authKeys, keys,
 		protocmp.Transform(),
 		cmpopts.SortSlices(func(a, b *accessgraphsecretspb.PrivateKey) bool {
-			return a.Metadata.Name < b.Metadata.Name
+			return a.GetMetadata().GetName() < b.GetMetadata().GetName()
 		})))
 	require.Empty(t, nextToken)
 
diff --git a/lib/services/local/access_list.go b/lib/services/local/access_list.go
index 5557aefc40b..5cf628206ad 100644
--- a/lib/services/local/access_list.go
+++ b/lib/services/local/access_list.go
@@ -200,7 +200,7 @@ func (a *AccessListService) ListAccessLists(ctx context.Context, pageSize int, n
 func (a *AccessListService) ListAccessListsV2(ctx context.Context, req *accesslistv1.ListAccessListsV2Request) ([]*accesslist.AccessList, string, error) {
 	// Currently, the backend only sorts on lexicographical keys and not
 	// based on fields within a resource
-	if req.SortBy != nil && (req.GetSortBy().Field != "name" || req.GetSortBy().IsDesc != false) {
+	if req.HasSortBy() && (req.GetSortBy().Field != "name" || req.GetSortBy().IsDesc != false) {
 		return nil, "", trace.CompareFailed("unsupported sort, only name:asc is supported, but got %q (desc = %t)", req.GetSortBy().Field, req.GetSortBy().IsDesc)
 	}
 
diff --git a/lib/services/local/access_list_test.go b/lib/services/local/access_list_test.go
index b8c672f7d12..28c40442342 100644
--- a/lib/services/local/access_list_test.go
+++ b/lib/services/local/access_list_test.go
@@ -178,19 +178,19 @@ func TestAccessListCRUDScopedRoleGrants(t *testing.T) {
 	scopedAccessService := NewScopedAccessService(mem)
 
 	for _, role := range []string{"scoped-role-1", "scoped-role-2", "scoped-role-3"} {
-		_, err = scopedAccessService.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-			Role: &scopedaccessv1.ScopedRole{
+		_, err = scopedAccessService.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+			Role: scopedaccessv1.ScopedRole_builder{
 				Kind: scopedaccess.KindScopedRole,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: role,
-				},
+				}.Build(),
 				Scope: "/",
-				Spec: &scopedaccessv1.ScopedRoleSpec{
+				Spec: scopedaccessv1.ScopedRoleSpec_builder{
 					AssignableScopes: []string{"/eng", "/platform", "/ops"},
-				},
+				}.Build(),
 				Version: types.V1,
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
diff --git a/lib/services/local/access_monitoring_rules_test.go b/lib/services/local/access_monitoring_rules_test.go
index 1ddf4e00a9e..6c0c134e8e0 100644
--- a/lib/services/local/access_monitoring_rules_test.go
+++ b/lib/services/local/access_monitoring_rules_test.go
@@ -49,29 +49,29 @@ func TestAccessMonitoringRulesCRUD(t *testing.T) {
 	service, err := NewAccessMonitoringRulesService(mem)
 	require.NoError(t, err)
 
-	AccessMonitoringRule1 := &accessmonitoringrulesv1.AccessMonitoringRule{
+	AccessMonitoringRule1 := accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &v1.Metadata{
+		Metadata: v1.Metadata_builder{
 			Name: "p1",
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:  []string{"someSubject"},
 			Condition: "someCondition",
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	AccessMonitoringRule2 := &accessmonitoringrulesv1.AccessMonitoringRule{
+	AccessMonitoringRule2 := accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &v1.Metadata{
+		Metadata: v1.Metadata_builder{
 			Name: "p2",
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:  []string{"someSubject"},
 			Condition: "someCondition",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	// Create both AccessMonitoringRules.
 	_, err = service.CreateAccessMonitoringRule(ctx, AccessMonitoringRule1)
@@ -80,7 +80,7 @@ func TestAccessMonitoringRulesCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	// Fetch a specific AccessMonitoringRule.
-	rule, err := service.GetAccessMonitoringRule(ctx, AccessMonitoringRule2.Metadata.Name)
+	rule, err := service.GetAccessMonitoringRule(ctx, AccessMonitoringRule2.GetMetadata().GetName())
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(rule, AccessMonitoringRule2,
 		cmpopts.IgnoreUnexported(accessmonitoringrulesv1.AccessMonitoringRule{}),
@@ -97,9 +97,9 @@ func TestAccessMonitoringRulesCRUD(t *testing.T) {
 	require.ErrorAs(t, err, new(*trace.AlreadyExistsError))
 
 	// Delete a AccessMonitoringRule.
-	err = service.DeleteAccessMonitoringRule(ctx, AccessMonitoringRule1.Metadata.Name)
+	err = service.DeleteAccessMonitoringRule(ctx, AccessMonitoringRule1.GetMetadata().GetName())
 	require.NoError(t, err)
-	_, err = service.GetAccessMonitoringRule(ctx, AccessMonitoringRule1.Metadata.Name)
+	_, err = service.GetAccessMonitoringRule(ctx, AccessMonitoringRule1.GetMetadata().GetName())
 	require.ErrorAs(t, err, new(*trace.NotFoundError))
 
 	// Try to delete a AccessMonitoringRule that doesn't exist.
@@ -109,9 +109,9 @@ func TestAccessMonitoringRulesCRUD(t *testing.T) {
 	// Delete all AccessMonitoringRule.
 	err = service.DeleteAllAccessMonitoringRules(ctx)
 	require.NoError(t, err)
-	_, err = service.GetAccessMonitoringRule(ctx, AccessMonitoringRule1.Metadata.Name)
+	_, err = service.GetAccessMonitoringRule(ctx, AccessMonitoringRule1.GetMetadata().GetName())
 	require.ErrorAs(t, err, new(*trace.NotFoundError))
-	_, err = service.GetAccessMonitoringRule(ctx, AccessMonitoringRule2.Metadata.Name)
+	_, err = service.GetAccessMonitoringRule(ctx, AccessMonitoringRule2.GetMetadata().GetName())
 	require.ErrorAs(t, err, new(*trace.NotFoundError))
 }
 
@@ -124,123 +124,123 @@ func TestListAccessMonitoringRulesWithFilter(t *testing.T) {
 	}{
 		{
 			description: "filter by notification integration",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &v1.Metadata{
+				Metadata: v1.Metadata_builder{
 					Name: "example-notification-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name: "notificationIntegration",
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:         []string{types.KindAccessRequest},
 				NotificationName: "notificationIntegration",
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "filter by automatic_review integration",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &v1.Metadata{
+				Metadata: v1.Metadata_builder{
 					Name: "example-automatic-approval-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: "automaticReviewIntegration",
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: "automaticReviewIntegration",
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "filter by both notification and automatic_review integration",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &v1.Metadata{
+				Metadata: v1.Metadata_builder{
 					Name: "example-combined-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name: "notificationIntegration",
-					},
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					}.Build(),
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: "automaticReviewIntegration",
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: "automaticReviewIntegration",
 				NotificationName:    "notificationIntegration",
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "filter by builtin automatic_review rules",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &v1.Metadata{
+				Metadata: v1.Metadata_builder{
 					Name: "example-builtin-automatic_approval-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name: "notificationIntegration",
-					},
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					}.Build(),
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: types.BuiltInAutomaticReview,
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: types.BuiltInAutomaticReview,
-			},
+			}.Build(),
 			expectedRule: true,
 		},
 		{
 			description: "no match",
-			rule: &accessmonitoringrulesv1.AccessMonitoringRule{
+			rule: accessmonitoringrulesv1.AccessMonitoringRule_builder{
 				Kind:    types.KindAccessMonitoringRule,
 				Version: types.V1,
-				Metadata: &v1.Metadata{
+				Metadata: v1.Metadata_builder{
 					Name: "no-match-rule",
-				},
-				Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				}.Build(),
+				Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: types.BuiltInAutomaticReview,
 						Decision:    types.RequestState_APPROVED.String(),
-					},
-				},
-			},
-			req: &accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			req: accessmonitoringrulesv1.ListAccessMonitoringRulesWithFilterRequest_builder{
 				Subjects:            []string{types.KindAccessRequest},
 				AutomaticReviewName: "automaticReviewIntegration",
-			},
+			}.Build(),
 			expectedRule: false,
 		},
 	}
@@ -290,17 +290,17 @@ func TestListAccessMonitoringRules(t *testing.T) {
 
 	var insertedAccessMonitoringRules []*accessmonitoringrulesv1.AccessMonitoringRule
 	for i := range numAccessMonitoringRules {
-		AccessMonitoringRule := &accessmonitoringrulesv1.AccessMonitoringRule{
+		AccessMonitoringRule := accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: fmt.Sprintf("p%02d", i+1),
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:  []string{"someSubject"},
 				Condition: "someCondition",
-			},
-		}
+			}.Build(),
+		}.Build()
 		_, err := service.CreateAccessMonitoringRule(ctx, AccessMonitoringRule)
 		require.NoError(t, err)
 		insertedAccessMonitoringRules = append(insertedAccessMonitoringRules, AccessMonitoringRule)
diff --git a/lib/services/local/appauthconfig_test.go b/lib/services/local/appauthconfig_test.go
index 4099edf8aa4..35bfa1c1eb4 100644
--- a/lib/services/local/appauthconfig_test.go
+++ b/lib/services/local/appauthconfig_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 
 	appauthconfigv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/appauthconfig/v1"
@@ -54,7 +55,7 @@ func TestAppAuthConfigService(t *testing.T) {
 	t.Run("create invalid", func(t *testing.T) {
 		cfg := appauthconfig.NewAppAuthConfigJWT(
 			"jwt-invalid",
-			[]*labelv1.Label{{Name: "*", Values: []string{"*"}}},
+			[]*labelv1.Label{labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build()},
 			&appauthconfigv1.AppAuthConfigJWTSpec{},
 		)
 
@@ -103,7 +104,7 @@ func TestAppAuthConfigService(t *testing.T) {
 
 		cfgCreated, err := svc.CreateAppAuthConfig(t.Context(), makeAppAuthJWTConfig("jwt1"))
 		require.NoError(t, err)
-		cfgRetrieved, err := svc.GetAppAuthConfig(t.Context(), cfgCreated.Metadata.Name)
+		cfgRetrieved, err := svc.GetAppAuthConfig(t.Context(), cfgCreated.GetMetadata().GetName())
 		require.NoError(t, err)
 
 		requireAppAuthConfigEqual(t, []*appauthconfigv1.AppAuthConfig{cfgCreated}, []*appauthconfigv1.AppAuthConfig{cfgRetrieved})
@@ -113,15 +114,15 @@ func TestAppAuthConfigService(t *testing.T) {
 		cfg := makeAppAuthJWTConfig("jwt1")
 		svc := setupAppAuthService(t, []*appauthconfigv1.AppAuthConfig{cfg})
 
-		err := svc.DeleteAppAuthConfig(t.Context(), cfg.Metadata.Name)
+		err := svc.DeleteAppAuthConfig(t.Context(), cfg.GetMetadata().GetName())
 		require.NoError(t, err)
 
 		// Deleting again should return error.
-		err = svc.DeleteAppAuthConfig(t.Context(), cfg.Metadata.Name)
+		err = svc.DeleteAppAuthConfig(t.Context(), cfg.GetMetadata().GetName())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected error to be NotFound but got %T", err)
 
-		_, err = svc.GetAppAuthConfig(t.Context(), cfg.Metadata.Name)
+		_, err = svc.GetAppAuthConfig(t.Context(), cfg.GetMetadata().GetName())
 		require.Error(t, err)
 		require.True(t, trace.IsNotFound(err), "expected error to be NotFound but got %T", err)
 	})
@@ -132,11 +133,11 @@ func TestAppAuthConfigService(t *testing.T) {
 
 		firstCfg, err := svc.UpsertAppAuthConfig(t.Context(), baseCfg)
 		require.NoError(t, err)
-		firstRev := firstCfg.Metadata.Revision
+		firstRev := firstCfg.GetMetadata().GetRevision()
 
 		secondCfg, err := svc.UpsertAppAuthConfig(t.Context(), baseCfg)
 		require.NoError(t, err)
-		secondRev := secondCfg.Metadata.Revision
+		secondRev := secondCfg.GetMetadata().GetRevision()
 
 		require.NotEqual(t, firstRev, secondRev)
 	})
@@ -154,14 +155,12 @@ func requireAppAuthConfigEqual(t *testing.T, expected []*appauthconfigv1.AppAuth
 func makeAppAuthJWTConfig(name string) *appauthconfigv1.AppAuthConfig {
 	return appauthconfig.NewAppAuthConfigJWT(
 		name,
-		[]*labelv1.Label{{Name: "*", Values: []string{"*"}}},
-		&appauthconfigv1.AppAuthConfigJWTSpec{
+		[]*labelv1.Label{labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build()},
+		appauthconfigv1.AppAuthConfigJWTSpec_builder{
 			Audience: "teleport",
 			Issuer:   "https://my-issuer",
-			KeysSource: &appauthconfigv1.AppAuthConfigJWTSpec_JwksUrl{
-				JwksUrl: "https://my-issuer/.well-known/jwks.json",
-			},
-		},
+			JwksUrl:  proto.String("https://my-issuer/.well-known/jwks.json"),
+		}.Build(),
 	)
 }
 
diff --git a/lib/services/local/autoupdate_test.go b/lib/services/local/autoupdate_test.go
index fba92662c70..fedf5af14f8 100644
--- a/lib/services/local/autoupdate_test.go
+++ b/lib/services/local/autoupdate_test.go
@@ -50,16 +50,16 @@ func TestAutoUpdateServiceConfigCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	config := &autoupdatev1pb.AutoUpdateConfig{
+	config := autoupdatev1pb.AutoUpdateConfig_builder{
 		Kind:     types.KindAutoUpdateConfig,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: types.MetaNameAutoUpdateConfig},
-		Spec: &autoupdatev1pb.AutoUpdateConfigSpec{
-			Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+		Metadata: headerv1.Metadata_builder{Name: types.MetaNameAutoUpdateConfig}.Build(),
+		Spec: autoupdatev1pb.AutoUpdateConfigSpec_builder{
+			Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 				Mode: autoupdate.ToolsUpdateModeEnabled,
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	created, err := service.CreateAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
@@ -79,9 +79,9 @@ func TestAutoUpdateServiceConfigCRUD(t *testing.T) {
 	require.Empty(t, diff)
 	require.Equal(t, created.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 
-	config.Spec.Tools = &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	config.GetSpec().SetTools(autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 		Mode: autoupdate.ToolsUpdateModeDisabled,
-	}
+	}.Build())
 	updated, err := service.UpdateAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 	require.NotEqual(t, got.GetSpec().GetTools(), updated.GetSpec().GetTools())
@@ -115,16 +115,16 @@ func TestAutoUpdateServiceVersionCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	version := &autoupdatev1pb.AutoUpdateVersion{
+	version := autoupdatev1pb.AutoUpdateVersion_builder{
 		Kind:     types.KindAutoUpdateVersion,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: types.MetaNameAutoUpdateVersion},
-		Spec: &autoupdatev1pb.AutoUpdateVersionSpec{
-			Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+		Metadata: headerv1.Metadata_builder{Name: types.MetaNameAutoUpdateVersion}.Build(),
+		Spec: autoupdatev1pb.AutoUpdateVersionSpec_builder{
+			Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 				TargetVersion: "1.2.3",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	created, err := service.CreateAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
@@ -144,9 +144,9 @@ func TestAutoUpdateServiceVersionCRUD(t *testing.T) {
 	require.Empty(t, diff)
 	require.Equal(t, created.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 
-	version.Spec.Tools = &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	version.GetSpec().SetTools(autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 		TargetVersion: "3.2.1",
-	}
+	}.Build())
 	updated, err := service.UpdateAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 	require.NotEqual(t, got.GetSpec().GetTools().GetTargetVersion(), updated.GetSpec().GetTools().GetTargetVersion())
@@ -184,27 +184,27 @@ func TestAutoUpdateServiceAgentReportCRUD(t *testing.T) {
 	newDate := time.Now().Add(2 * time.Minute)
 
 	ctx := context.Background()
-	report := &autoupdatev1pb.AutoUpdateAgentReport{
+	report := autoupdatev1pb.AutoUpdateAgentReport_builder{
 		Kind:     types.KindAutoUpdateAgentReport,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: authID.String()},
-		Spec: &autoupdatev1pb.AutoUpdateAgentReportSpec{
+		Metadata: headerv1.Metadata_builder{Name: authID.String()}.Build(),
+		Spec: autoupdatev1pb.AutoUpdateAgentReportSpec_builder{
 			Timestamp: timestamppb.New(oldDate),
 			Groups: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroup{
-				"": {
+				"": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 					Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-						"1.2.3": {Count: 10},
-						"1.2.4": {Count: 2},
+						"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 10}.Build(),
+						"1.2.4": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 2}.Build(),
 					},
-				},
-				"prod": {
+				}.Build(),
+				"prod": autoupdatev1pb.AutoUpdateAgentReportSpecGroup_builder{
 					Versions: map[string]*autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion{
-						"1.2.3": {Count: 5},
+						"1.2.3": autoupdatev1pb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
 					},
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	created, err := service.CreateAutoUpdateAgentReport(ctx, report)
 	require.NoError(t, err)
@@ -224,7 +224,7 @@ func TestAutoUpdateServiceAgentReportCRUD(t *testing.T) {
 	require.Empty(t, diff)
 	require.Equal(t, created.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 
-	report.Spec.Timestamp = timestamppb.New(newDate)
+	report.GetSpec().SetTimestamp(timestamppb.New(newDate))
 
 	updated, err := service.UpdateAutoUpdateAgentReport(ctx, report)
 	require.NoError(t, err)
@@ -259,31 +259,31 @@ func TestAutoUpdateServiceInvalidNameCreate(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	config := &autoupdatev1pb.AutoUpdateConfig{
+	config := autoupdatev1pb.AutoUpdateConfig_builder{
 		Kind:     types.KindAutoUpdateConfig,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: "invalid-auto-update-config-name"},
-		Spec: &autoupdatev1pb.AutoUpdateConfigSpec{
-			Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+		Metadata: headerv1.Metadata_builder{Name: "invalid-auto-update-config-name"}.Build(),
+		Spec: autoupdatev1pb.AutoUpdateConfigSpec_builder{
+			Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 				Mode: autoupdate.ToolsUpdateModeEnabled,
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	createdConfig, err := service.CreateAutoUpdateConfig(ctx, config)
 	require.Error(t, err)
 	require.Nil(t, createdConfig)
 
-	version := &autoupdatev1pb.AutoUpdateVersion{
+	version := autoupdatev1pb.AutoUpdateVersion_builder{
 		Kind:     types.KindAutoUpdateVersion,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: "invalid-auto-update-version-name"},
-		Spec: &autoupdatev1pb.AutoUpdateVersionSpec{
-			Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+		Metadata: headerv1.Metadata_builder{Name: "invalid-auto-update-version-name"}.Build(),
+		Spec: autoupdatev1pb.AutoUpdateVersionSpec_builder{
+			Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 				TargetVersion: "1.2.3",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	createdVersion, err := service.CreateAutoUpdateVersion(ctx, version)
 	require.Error(t, err)
@@ -304,34 +304,34 @@ func TestAutoUpdateServiceInvalidNameUpdate(t *testing.T) {
 	ctx := context.Background()
 
 	// Validate the config update restriction.
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatev1pb.AutoUpdateConfigSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 			Mode: autoupdate.ToolsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	createdConfig, err := service.UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 
-	createdConfig.GetMetadata().Name = "invalid-auto-update-config-name"
+	createdConfig.GetMetadata().SetName("invalid-auto-update-config-name")
 
 	createdConfig, err = service.UpdateAutoUpdateConfig(ctx, createdConfig)
 	require.Error(t, err)
 	require.Nil(t, createdConfig)
 
 	// Validate the version update restriction.
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
-		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatev1pb.AutoUpdateVersionSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	createdVersion, err := service.UpsertAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 
-	createdVersion.GetMetadata().Name = "invalid-auto-update-version-name"
+	createdVersion.GetMetadata().SetName("invalid-auto-update-version-name")
 
 	createdVersion, err = service.UpdateAutoUpdateVersion(ctx, createdVersion)
 	require.Error(t, err)
diff --git a/lib/services/local/backendinfo_test.go b/lib/services/local/backendinfo_test.go
index 63a56bb7418..0c25e2bc3d1 100644
--- a/lib/services/local/backendinfo_test.go
+++ b/lib/services/local/backendinfo_test.go
@@ -46,14 +46,14 @@ func TestAutoInfoServiceCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	info := &backendinfo1pb.BackendInfo{
+	info := backendinfo1pb.BackendInfo_builder{
 		Kind:     types.KindBackendInfo,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: types.MetaNameBackendInfo},
-		Spec: &backendinfo1pb.BackendInfoSpec{
+		Metadata: headerv1.Metadata_builder{Name: types.MetaNameBackendInfo}.Build(),
+		Spec: backendinfo1pb.BackendInfoSpec_builder{
 			TeleportVersion: "1.2.3",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	created, err := service.CreateBackendInfo(ctx, info)
 	require.NoError(t, err)
@@ -73,7 +73,7 @@ func TestAutoInfoServiceCRUD(t *testing.T) {
 	require.Empty(t, diff)
 	require.Equal(t, created.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 
-	info.Spec.TeleportVersion = "3.2.1"
+	info.GetSpec().SetTeleportVersion("3.2.1")
 	updated, err := service.UpdateBackendInfo(ctx, info)
 	require.NoError(t, err)
 	require.NotEqual(t, got.GetSpec().GetTeleportVersion(), updated.GetSpec().GetTeleportVersion())
diff --git a/lib/services/local/bot_instance.go b/lib/services/local/bot_instance.go
index 8d671ca8dc0..ee9c9e38419 100644
--- a/lib/services/local/bot_instance.go
+++ b/lib/services/local/bot_instance.go
@@ -69,16 +69,16 @@ func NewBotInstanceService(b backend.Backend, clock clockwork.Clock) (*BotInstan
 // Note that new BotInstances will have their .Metadata.Name overwritten by the
 // instance UUID.
 func (b *BotInstanceService) CreateBotInstance(ctx context.Context, instance *machineidv1.BotInstance) (*machineidv1.BotInstance, error) {
-	instance.Kind = types.KindBotInstance
-	instance.Version = types.V1
+	instance.SetKind(types.KindBotInstance)
+	instance.SetVersion(types.V1)
 
-	if instance.Metadata == nil {
-		instance.Metadata = &headerv1.Metadata{}
+	if !instance.HasMetadata() {
+		instance.SetMetadata(&headerv1.Metadata{})
 	}
 
-	instance.Metadata.Name = instance.Spec.InstanceId
+	instance.GetMetadata().SetName(instance.GetSpec().GetInstanceId())
 
-	serviceWithPrefix := b.service.WithPrefix(instance.Spec.BotName)
+	serviceWithPrefix := b.service.WithPrefix(instance.GetSpec().GetBotName())
 	created, err := serviceWithPrefix.CreateResource(ctx, instance)
 	return created, trace.Wrap(err)
 }
@@ -198,7 +198,7 @@ func (b *BotInstanceService) PatchBotInstance(
 			return nil, trace.Wrap(err)
 		}
 
-		updated.GetMetadata().Revision = lease.GetMetadata().Revision
+		updated.GetMetadata().SetRevision(lease.GetMetadata().GetRevision())
 		return updated, nil
 	}
 
diff --git a/lib/services/local/bot_instance_test.go b/lib/services/local/bot_instance_test.go
index 472727569ed..8847db1b96c 100644
--- a/lib/services/local/bot_instance_test.go
+++ b/lib/services/local/bot_instance_test.go
@@ -43,15 +43,15 @@ import (
 func newBotInstance(botName string, fns ...func(*machineidv1.BotInstance)) *machineidv1.BotInstance {
 	id := uuid.New()
 
-	bi := &machineidv1.BotInstance{
+	bi := machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    botName,
 			InstanceId: id.String(),
-		},
+		}.Build(),
 		Status: &machineidv1.BotInstanceStatus{},
-	}
+	}.Build()
 
 	for _, fn := range fns {
 		fn(bi)
@@ -64,9 +64,9 @@ func newBotInstance(botName string, fns ...func(*machineidv1.BotInstance)) *mach
 // raise an error during an insert attempt.
 func withBotInstanceInvalidMetadata() func(*machineidv1.BotInstance) {
 	return func(bi *machineidv1.BotInstance) {
-		bi.Metadata = &headerv1.Metadata{
+		bi.SetMetadata(headerv1.Metadata_builder{
 			Name: "invalid",
-		}
+		}.Build())
 	}
 }
 
@@ -74,11 +74,11 @@ func withBotInstanceInvalidMetadata() func(*machineidv1.BotInstance) {
 // the given timestamp.
 func withBotInstanceExpiry(expiry time.Time) func(*machineidv1.BotInstance) {
 	return func(bi *machineidv1.BotInstance) {
-		if bi.Metadata == nil {
-			bi.Metadata = &headerv1.Metadata{}
+		if !bi.HasMetadata() {
+			bi.SetMetadata(&headerv1.Metadata{})
 		}
 
-		bi.Metadata.Expires = timestamppb.New(expiry)
+		bi.GetMetadata().SetExpires(timestamppb.New(expiry))
 	}
 }
 
@@ -86,11 +86,11 @@ func withBotInstanceExpiry(expiry time.Time) func(*machineidv1.BotInstance) {
 // the given value.
 func withBotInstanceId(value string) func(*machineidv1.BotInstance) {
 	return func(bi *machineidv1.BotInstance) {
-		if bi.Spec == nil {
-			bi.Spec = &machineidv1.BotInstanceSpec{}
+		if !bi.HasSpec() {
+			bi.SetSpec(&machineidv1.BotInstanceSpec{})
 		}
 
-		bi.Spec.InstanceId = value
+		bi.GetSpec().SetInstanceId(value)
 	}
 }
 
@@ -98,15 +98,15 @@ func withBotInstanceId(value string) func(*machineidv1.BotInstance) {
 // field of a bot instance to the given value.
 func withBotInstanceHeartbeatJoinMethod(value string) func(*machineidv1.BotInstance) {
 	return func(bi *machineidv1.BotInstance) {
-		if bi.Status == nil {
-			bi.Status = &machineidv1.BotInstanceStatus{}
+		if !bi.HasStatus() {
+			bi.SetStatus(&machineidv1.BotInstanceStatus{})
 		}
 
-		if bi.Status.InitialHeartbeat == nil {
-			bi.Status.InitialHeartbeat = &machineidv1.BotInstanceStatusHeartbeat{}
+		if !bi.GetStatus().HasInitialHeartbeat() {
+			bi.GetStatus().SetInitialHeartbeat(&machineidv1.BotInstanceStatusHeartbeat{})
 		}
 
-		bi.Status.InitialHeartbeat.JoinMethod = value
+		bi.GetStatus().GetInitialHeartbeat().SetJoinMethod(value)
 	}
 }
 
@@ -114,15 +114,15 @@ func withBotInstanceHeartbeatJoinMethod(value string) func(*machineidv1.BotInsta
 // field of a bot instance to the given value.
 func withBotInstanceHeartbeatVersion(value string) func(*machineidv1.BotInstance) {
 	return func(bi *machineidv1.BotInstance) {
-		if bi.Status == nil {
-			bi.Status = &machineidv1.BotInstanceStatus{}
+		if !bi.HasStatus() {
+			bi.SetStatus(&machineidv1.BotInstanceStatus{})
 		}
 
-		if bi.Status.InitialHeartbeat == nil {
-			bi.Status.InitialHeartbeat = &machineidv1.BotInstanceStatusHeartbeat{}
+		if !bi.GetStatus().HasInitialHeartbeat() {
+			bi.GetStatus().SetInitialHeartbeat(&machineidv1.BotInstanceStatusHeartbeat{})
 		}
 
-		bi.Status.InitialHeartbeat.Version = value
+		bi.GetStatus().GetInitialHeartbeat().SetVersion(value)
 	}
 }
 
@@ -130,15 +130,15 @@ func withBotInstanceHeartbeatVersion(value string) func(*machineidv1.BotInstance
 // field of a bot instance to the given value.
 func withBotInstanceHeartbeatHostname(value string) func(*machineidv1.BotInstance) {
 	return func(bi *machineidv1.BotInstance) {
-		if bi.Status == nil {
-			bi.Status = &machineidv1.BotInstanceStatus{}
+		if !bi.HasStatus() {
+			bi.SetStatus(&machineidv1.BotInstanceStatus{})
 		}
 
-		if bi.Status.InitialHeartbeat == nil {
-			bi.Status.InitialHeartbeat = &machineidv1.BotInstanceStatusHeartbeat{}
+		if !bi.GetStatus().HasInitialHeartbeat() {
+			bi.GetStatus().SetInitialHeartbeat(&machineidv1.BotInstanceStatusHeartbeat{})
 		}
 
-		bi.Status.InitialHeartbeat.Hostname = value
+		bi.GetStatus().GetInitialHeartbeat().SetHostname(value)
 	}
 }
 
@@ -153,7 +153,7 @@ func createInstances(t *testing.T, ctx context.Context, service *BotInstanceServ
 		_, err := service.CreateBotInstance(ctx, bi)
 		require.NoError(t, err)
 
-		ids[bi.Spec.InstanceId] = struct{}{}
+		ids[bi.GetSpec().GetInstanceId()] = struct{}{}
 	}
 
 	return ids
@@ -204,8 +204,8 @@ func TestBotInstanceCreateMetadata(t *testing.T) {
 				require.True(t, ok)
 
 				// .Metadata.Name should be overwritten with the correct value
-				require.Equal(t, bi.Spec.InstanceId, bi.Metadata.Name)
-				require.Nil(t, bi.Metadata.Expires)
+				require.Equal(t, bi.GetSpec().GetInstanceId(), bi.GetMetadata().GetName())
+				require.Nil(t, bi.GetMetadata().GetExpires())
 			},
 		},
 		{
@@ -216,8 +216,8 @@ func TestBotInstanceCreateMetadata(t *testing.T) {
 				bi, ok := i.(*machineidv1.BotInstance)
 				require.True(t, ok)
 
-				require.Equal(t, bi.Spec.InstanceId, bi.Metadata.Name)
-				require.Nil(t, bi.Metadata.Expires)
+				require.Equal(t, bi.GetSpec().GetInstanceId(), bi.GetMetadata().GetName())
+				require.Nil(t, bi.GetMetadata().GetExpires())
 			},
 		},
 		{
@@ -228,8 +228,8 @@ func TestBotInstanceCreateMetadata(t *testing.T) {
 				bi, ok := i.(*machineidv1.BotInstance)
 				require.True(t, ok)
 
-				require.Equal(t, bi.Spec.InstanceId, bi.Metadata.Name)
-				require.Equal(t, clock.Now().Add(time.Hour).UTC(), bi.Metadata.Expires.AsTime())
+				require.Equal(t, bi.GetSpec().GetInstanceId(), bi.GetMetadata().GetName())
+				require.Equal(t, clock.Now().Add(time.Hour).UTC(), bi.GetMetadata().GetExpires().AsTime())
 			},
 		},
 	}
@@ -300,13 +300,13 @@ func TestBotInstanceCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	// metadata should be generated from the bot spec
-	require.Equal(t, bi.Spec.InstanceId, patched.Metadata.Name)
+	require.Equal(t, bi.GetSpec().GetInstanceId(), patched.GetMetadata().GetName())
 
 	// we should be able to retrieve a matching instance
-	bi2, err := service.GetBotInstance(ctx, bi.Spec.BotName, bi.Spec.InstanceId)
+	bi2, err := service.GetBotInstance(ctx, bi.GetSpec().GetBotName(), bi.GetSpec().GetInstanceId())
 	require.NoError(t, err)
 	require.EqualExportedValues(t, patched, bi2)
-	require.Equal(t, bi.Metadata.Name, bi2.Metadata.Name)
+	require.Equal(t, bi.GetMetadata().GetName(), bi2.GetMetadata().GetName())
 
 	resources := listInstances(t, ctx, service, &services.ListBotInstancesRequestOptions{
 		FilterBotName: "example",
@@ -316,24 +316,24 @@ func TestBotInstanceCRUD(t *testing.T) {
 	require.EqualExportedValues(t, patched, resources[0])
 
 	// append a heartbeat to a stored instance
-	heartbeat := &machineidv1.BotInstanceStatusHeartbeat{
+	heartbeat := machineidv1.BotInstanceStatusHeartbeat_builder{
 		Hostname: "foo",
-	}
+	}.Build()
 
-	patched, err = service.PatchBotInstance(ctx, bi.Spec.BotName, bi.Spec.InstanceId, func(bi *machineidv1.BotInstance) (*machineidv1.BotInstance, error) {
-		bi.Status.LatestHeartbeats = append([]*machineidv1.BotInstanceStatusHeartbeat{heartbeat}, bi.Status.LatestHeartbeats...)
+	patched, err = service.PatchBotInstance(ctx, bi.GetSpec().GetBotName(), bi.GetSpec().GetInstanceId(), func(bi *machineidv1.BotInstance) (*machineidv1.BotInstance, error) {
+		bi.GetStatus().SetLatestHeartbeats(append([]*machineidv1.BotInstanceStatusHeartbeat{heartbeat}, bi.GetStatus().GetLatestHeartbeats()...))
 		return bi, nil
 	})
 	require.NoError(t, err)
 
-	require.Len(t, patched.Status.LatestHeartbeats, 1)
-	require.EqualExportedValues(t, heartbeat, patched.Status.LatestHeartbeats[0])
+	require.Len(t, patched.GetStatus().GetLatestHeartbeats(), 1)
+	require.EqualExportedValues(t, heartbeat, patched.GetStatus().GetLatestHeartbeats()[0])
 
 	// delete the stored instance
-	require.NoError(t, service.DeleteBotInstance(ctx, bi.Spec.BotName, bi.Spec.InstanceId))
+	require.NoError(t, service.DeleteBotInstance(ctx, bi.GetSpec().GetBotName(), bi.GetSpec().GetInstanceId()))
 
 	// subsequent delete attempts should fail
-	require.Error(t, service.DeleteBotInstance(ctx, bi.Spec.BotName, bi.Spec.InstanceId))
+	require.Error(t, service.DeleteBotInstance(ctx, bi.GetSpec().GetBotName(), bi.GetSpec().GetInstanceId()))
 }
 
 // TestBotInstanceList verifies list and filtering by bot functionality for bot
@@ -362,7 +362,7 @@ func TestBotInstanceList(t *testing.T) {
 	})
 	require.Len(t, aInstances, 3)
 	for _, ins := range aInstances {
-		require.Contains(t, aIds, ins.Spec.InstanceId)
+		require.Contains(t, aIds, ins.GetSpec().GetInstanceId())
 	}
 
 	// listing "b" should only return known "b" instances
@@ -371,7 +371,7 @@ func TestBotInstanceList(t *testing.T) {
 	})
 	require.Len(t, bInstances, 4)
 	for _, ins := range bInstances {
-		require.Contains(t, bIds, ins.Spec.InstanceId)
+		require.Contains(t, bIds, ins.GetSpec().GetInstanceId())
 	}
 
 	allIds := map[string]struct{}{}
@@ -388,7 +388,7 @@ func TestBotInstanceList(t *testing.T) {
 	})
 	require.Len(t, allInstances, 7)
 	for _, ins := range allInstances {
-		require.Contains(t, allIds, ins.Spec.InstanceId)
+		require.Contains(t, allIds, ins.GetSpec().GetInstanceId())
 	}
 }
 
@@ -459,7 +459,7 @@ func TestBotInstanceListWithSearchFilter(t *testing.T) {
 			})
 
 			require.Len(t, instances, 1)
-			require.Equal(t, tc.instance.Spec.InstanceId, instances[0].Spec.InstanceId)
+			require.Equal(t, tc.instance.GetSpec().GetInstanceId(), instances[0].GetSpec().GetInstanceId())
 		})
 	}
 }
@@ -490,7 +490,7 @@ func TestBotInstanceListWithQuery(t *testing.T) {
 	})
 
 	require.Len(t, instances, 1)
-	require.Equal(t, instance.Spec.InstanceId, instances[0].Spec.InstanceId)
+	require.Equal(t, instance.GetSpec().GetInstanceId(), instances[0].GetSpec().GetInstanceId())
 }
 
 // TestBotInstanceListWithSort verifies sorting returns a not-implemented error.
@@ -556,7 +556,7 @@ func TestBotInstanceListWithFilterFn(t *testing.T) {
 	accepted := map[string]struct{}{}
 	for i, bi := range created {
 		if i%2 == 0 {
-			accepted[bi.Spec.InstanceId] = struct{}{}
+			accepted[bi.GetSpec().GetInstanceId()] = struct{}{}
 		}
 	}
 
@@ -569,6 +569,6 @@ func TestBotInstanceListWithFilterFn(t *testing.T) {
 
 	require.Len(t, instances, len(accepted))
 	for _, bi := range instances {
-		require.Contains(t, accepted, bi.Spec.InstanceId)
+		require.Contains(t, accepted, bi.GetSpec().GetInstanceId())
 	}
 }
diff --git a/lib/services/local/configuration.go b/lib/services/local/configuration.go
index 25e83d65ed8..bdf418e5572 100644
--- a/lib/services/local/configuration.go
+++ b/lib/services/local/configuration.go
@@ -841,7 +841,7 @@ func (s *ClusterConfigurationService) CreateAccessGraphSettings(ctx context.Cont
 		return nil, trace.Wrap(err)
 	}
 
-	set.Metadata.Revision = lease.Revision
+	set.GetMetadata().SetRevision(lease.Revision)
 	return set, nil
 }
 
@@ -865,7 +865,7 @@ func (s *ClusterConfigurationService) UpdateAccessGraphSettings(ctx context.Cont
 		return nil, trace.Wrap(err)
 	}
 
-	set.Metadata.Revision = lease.Revision
+	set.GetMetadata().SetRevision(lease.Revision)
 	return set, nil
 }
 
@@ -888,7 +888,7 @@ func (s *ClusterConfigurationService) UpsertAccessGraphSettings(ctx context.Cont
 		return nil, trace.Wrap(err)
 	}
 
-	set.Metadata.Revision = lease.Revision
+	set.GetMetadata().SetRevision(lease.Revision)
 	return set, nil
 }
 
diff --git a/lib/services/local/crown_jewels_test.go b/lib/services/local/crown_jewels_test.go
index 2959fa5badd..f41605b3022 100644
--- a/lib/services/local/crown_jewels_test.go
+++ b/lib/services/local/crown_jewels_test.go
@@ -44,14 +44,14 @@ func TestCreateCrownJewel(t *testing.T) {
 	ctx := context.Background()
 	service := getService(t)
 
-	obj, err := crownjewel.NewCrownJewel("obj", &crownjewelv1.CrownJewelSpec{
+	obj, err := crownjewel.NewCrownJewel("obj", crownjewelv1.CrownJewelSpec_builder{
 		TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-			{
+			crownjewelv1.TeleportMatcher_builder{
 				Kinds: []string{"node"},
 				Names: []string{"test"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// first attempt should succeed
@@ -70,14 +70,14 @@ func TestUpsertCrownJewel(t *testing.T) {
 	ctx := context.Background()
 	service := getService(t)
 
-	obj, err := crownjewel.NewCrownJewel("obj", &crownjewelv1.CrownJewelSpec{
+	obj, err := crownjewel.NewCrownJewel("obj", crownjewelv1.CrownJewelSpec_builder{
 		TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-			{
+			crownjewelv1.TeleportMatcher_builder{
 				Kinds: []string{"node"},
 				Names: []string{"test"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// the first attempt should succeed
@@ -150,15 +150,15 @@ func TestUpdateCrownJewel(t *testing.T) {
 	obj, err := service.GetCrownJewel(ctx, getObject(t, 0).GetMetadata().GetName())
 	require.NoError(t, err)
 	// update the expiry time
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	objUpdated, err := service.UpdateCrownJewel(ctx, obj)
 	require.NoError(t, err)
-	require.Equal(t, expiry, objUpdated.Metadata.Expires)
+	require.Equal(t, expiry, objUpdated.GetMetadata().GetExpires())
 
-	objFresh, err := service.GetCrownJewel(ctx, obj.Metadata.Name)
+	objFresh, err := service.GetCrownJewel(ctx, obj.GetMetadata().GetName())
 	require.NoError(t, err)
-	require.Equal(t, expiry, objFresh.Metadata.Expires)
+	require.Equal(t, expiry, objFresh.GetMetadata().GetExpires())
 }
 
 func TestUpdateCrownJewelMissingRevision(t *testing.T) {
@@ -171,7 +171,7 @@ func TestUpdateCrownJewelMissingRevision(t *testing.T) {
 	expiry := timestamppb.New(time.Now().Add(30 * time.Minute))
 
 	obj := getObject(t, 0)
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	// Update should be rejected as the revision is missing.
 	_, err := service.UpdateCrownJewel(ctx, obj)
@@ -283,14 +283,14 @@ func getService(t *testing.T) services.CrownJewels {
 
 func getObject(t *testing.T, index int) *crownjewelv1.CrownJewel {
 	name := fmt.Sprintf("obj%v", index)
-	obj, err := crownjewel.NewCrownJewel(name, &crownjewelv1.CrownJewelSpec{
+	obj, err := crownjewel.NewCrownJewel(name, crownjewelv1.CrownJewelSpec_builder{
 		TeleportMatchers: []*crownjewelv1.TeleportMatcher{
-			{
+			crownjewelv1.TeleportMatcher_builder{
 				Kinds: []string{"node"},
 				Names: []string{"test"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	return obj
diff --git a/lib/services/local/databaseobject_test.go b/lib/services/local/databaseobject_test.go
index 38423abbd56..f17e9cef91f 100644
--- a/lib/services/local/databaseobject_test.go
+++ b/lib/services/local/databaseobject_test.go
@@ -52,7 +52,7 @@ func getService(t *testing.T) services.DatabaseObjects {
 
 func getObject(t *testing.T, index int) *dbobjectv1.DatabaseObject {
 	name := fmt.Sprintf("obj%v", index)
-	obj, err := databaseobject.NewDatabaseObject(name, &dbobjectv1.DatabaseObjectSpec{Name: name, Protocol: "postgres"})
+	obj, err := databaseobject.NewDatabaseObject(name, dbobjectv1.DatabaseObjectSpec_builder{Name: name, Protocol: "postgres"}.Build())
 	require.NoError(t, err)
 
 	return obj
@@ -71,7 +71,7 @@ func TestCreateDatabaseObjects(t *testing.T) {
 	ctx := context.Background()
 	service := getService(t)
 
-	obj, err := databaseobject.NewDatabaseObject("obj", &dbobjectv1.DatabaseObjectSpec{Name: "obj", Protocol: "postgres"})
+	obj, err := databaseobject.NewDatabaseObject("obj", dbobjectv1.DatabaseObjectSpec_builder{Name: "obj", Protocol: "postgres"}.Build())
 	require.NoError(t, err)
 
 	// first attempt should succeed
@@ -90,7 +90,7 @@ func TestUpsertDatabaseObjects(t *testing.T) {
 	ctx := context.Background()
 	service := getService(t)
 
-	obj, err := databaseobject.NewDatabaseObject("obj", &dbobjectv1.DatabaseObjectSpec{Name: "obj", Protocol: "postgres"})
+	obj, err := databaseobject.NewDatabaseObject("obj", dbobjectv1.DatabaseObjectSpec_builder{Name: "obj", Protocol: "postgres"}.Build())
 	require.NoError(t, err)
 
 	// first attempt should succeed
@@ -160,15 +160,15 @@ func TestUpdateDatabaseObject(t *testing.T) {
 	expiry := timestamppb.New(time.Now().Add(30 * time.Minute))
 
 	obj := getObject(t, 0)
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	objUpdated, err := service.UpdateDatabaseObject(ctx, obj)
 	require.NoError(t, err)
-	require.Equal(t, expiry, objUpdated.Metadata.Expires)
+	require.Equal(t, expiry, objUpdated.GetMetadata().GetExpires())
 
-	objFresh, err := service.GetDatabaseObject(ctx, obj.Metadata.Name)
+	objFresh, err := service.GetDatabaseObject(ctx, obj.GetMetadata().GetName())
 	require.NoError(t, err)
-	require.Equal(t, expiry, objFresh.Metadata.Expires)
+	require.Equal(t, expiry, objFresh.GetMetadata().GetExpires())
 }
 
 func TestDeleteDatabaseObject(t *testing.T) {
@@ -265,7 +265,7 @@ func TestListDatabaseObjects(t *testing.T) {
 func TestMarshalDatabaseObjectRoundTrip(t *testing.T) {
 	t.Parallel()
 
-	spec := &dbobjectv1.DatabaseObjectSpec{Name: "dummy", Protocol: "postgres"}
+	spec := dbobjectv1.DatabaseObjectSpec_builder{Name: "dummy", Protocol: "postgres"}.Build()
 	obj, err := databaseobject.NewDatabaseObject("dummy-table", spec)
 	require.NoError(t, err)
 
diff --git a/lib/services/local/databaseobjectimportrule_test.go b/lib/services/local/databaseobjectimportrule_test.go
index 6a0502d8f13..3d3d791a90b 100644
--- a/lib/services/local/databaseobjectimportrule_test.go
+++ b/lib/services/local/databaseobjectimportrule_test.go
@@ -54,38 +54,38 @@ func TestDatabaseObjectImportRuleCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a couple import rules.
-	importRule1, err := databaseobjectimportrule.NewDatabaseObjectImportRule("r1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+	importRule1, err := databaseobjectimportrule.NewDatabaseObjectImportRule("r1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 		Priority:       10,
 		DatabaseLabels: label.FromMap(map[string][]string{"env": {"dev"}}),
 		Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-			{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"dev_access":    "rw",
 					"flag_from_dev": "dummy",
 				},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
-	importRule2, err := databaseobjectimportrule.NewDatabaseObjectImportRule("r2", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+	importRule2, err := databaseobjectimportrule.NewDatabaseObjectImportRule("r2", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 		Priority:       20,
 		DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
 		Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-			{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"dev_access":     "ro",
 					"flag_from_prod": "dummy",
 				},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// Initially we expect no import rules.
@@ -127,7 +127,7 @@ func TestDatabaseObjectImportRuleCRUD(t *testing.T) {
 	require.True(t, proto.Equal(importRule2, paginatedOut[1]))
 
 	// Fetch a specific import rule.
-	importRule, err = service.GetDatabaseObjectImportRule(ctx, importRule2.Metadata.GetName())
+	importRule, err = service.GetDatabaseObjectImportRule(ctx, importRule2.GetMetadata().GetName())
 	require.NoError(t, err)
 	require.True(t, proto.Equal(importRule2, importRule))
 
@@ -140,7 +140,7 @@ func TestDatabaseObjectImportRuleCRUD(t *testing.T) {
 	require.True(t, trace.IsAlreadyExists(err), "expected already exists error, got %v", err)
 
 	// Update an import rule.
-	importRule1.Metadata.Expires = timestamppb.New(clock.Now().Add(30 * time.Minute))
+	importRule1.GetMetadata().SetExpires(timestamppb.New(clock.Now().Add(30 * time.Minute)))
 	_, err = service.UpdateDatabaseObjectImportRule(ctx, importRule1)
 	require.NoError(t, err)
 	importRule, err = service.GetDatabaseObjectImportRule(ctx, importRule1.GetMetadata().GetName())
@@ -174,36 +174,36 @@ func TestDatabaseObjectImportRuleCRUD(t *testing.T) {
 }
 
 func TestMarshalDatabaseObjectImportRuleRoundTrip(t *testing.T) {
-	spec := &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+	spec := databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 		Priority:       30,
 		DatabaseLabels: label.FromMap(map[string][]string{"env": {"staging", "prod"}, "owner_org": {"trading"}}),
 		Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-			{
-				Scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 					SchemaNames:   []string{"public"},
 					DatabaseNames: []string{"foo", "bar", "baz"},
-				},
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+				}.Build(),
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames:     []string{"*"},
 					ViewNames:      []string{"1", "2", "3"},
 					ProcedureNames: []string{"aaa", "bbb", "ccc"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"env":          "staging",
 					"custom_label": "my_custom_value",
 				},
-			},
+			}.Build(),
 		},
-	}
-	obj := &databaseobjectimportrulev1.DatabaseObjectImportRule{
+	}.Build()
+	obj := databaseobjectimportrulev1.DatabaseObjectImportRule_builder{
 		Kind:    types.KindDatabaseObjectImportRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:      "import_all_staging_tables",
 			Namespace: defaults.Namespace,
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 
 	//nolint:staticcheck // SA1019. Using this marshaler for json compatibility.
 	out, err := services.FastMarshalProtoResourceDeprecated(obj)
diff --git a/lib/services/local/events.go b/lib/services/local/events.go
index ecf875ea026..aecd25ec2fd 100644
--- a/lib/services/local/events.go
+++ b/lib/services/local/events.go
@@ -2879,7 +2879,7 @@ func (p *kubeWaitingContainerParser) parse(event backend.Event) (types.Resource,
 
 		resource, err := kubewaitingcontainer.NewKubeWaitingContainer(
 			parts[5],
-			&kubewaitingcontainerpb.KubernetesWaitingContainerSpec{
+			kubewaitingcontainerpb.KubernetesWaitingContainerSpec_builder{
 				Username:      parts[1],
 				Cluster:       parts[2],
 				Namespace:     parts[3],
@@ -2887,7 +2887,7 @@ func (p *kubeWaitingContainerParser) parse(event backend.Event) (types.Resource,
 				ContainerName: parts[5],
 				Patch:         []byte("{}"),                       // default to empty patch. It doesn't matter for delete ops.
 				PatchType:     kubewaitingcontainer.JSONPatchType, // default to JSON patch. It doesn't matter for delete ops.
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -2966,16 +2966,16 @@ func (p *userNotificationParser) parse(event backend.Event) (types.Resource, err
 			return nil, trace.BadParameter("malformed key for %s event: %s", types.KindNotification, event.Item.Key)
 		}
 
-		notification := &notificationsv1.Notification{
+		notification := notificationsv1.Notification_builder{
 			Kind:    types.KindNotification,
 			Version: types.V1,
-			Spec: &notificationsv1.NotificationSpec{
+			Spec: notificationsv1.NotificationSpec_builder{
 				Username: parts[2],
-			},
-			Metadata: &headerv1.Metadata{
+			}.Build(),
+			Metadata: headerv1.Metadata_builder{
 				Name: parts[3],
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		return types.Resource153ToLegacy(notification), nil
 	case types.OpPut:
@@ -3010,18 +3010,18 @@ func (p *globalNotificationParser) parse(event backend.Event) (types.Resource, e
 			return nil, trace.BadParameter("malformed key for %s event: %s", types.KindGlobalNotification, event.Item.Key)
 		}
 
-		globalNotification := &notificationsv1.GlobalNotification{
+		globalNotification := notificationsv1.GlobalNotification_builder{
 			Kind:    types.KindGlobalNotification,
 			Version: types.V1,
-			Spec: &notificationsv1.GlobalNotificationSpec{
-				Notification: &notificationsv1.Notification{
+			Spec: notificationsv1.GlobalNotificationSpec_builder{
+				Notification: notificationsv1.Notification_builder{
 					Spec: &notificationsv1.NotificationSpec{},
-				},
-			},
-			Metadata: &headerv1.Metadata{
+				}.Build(),
+			}.Build(),
+			Metadata: headerv1.Metadata_builder{
 				Name: parts[2],
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		return types.Resource153ToLegacy(globalNotification), nil
 	case types.OpPut:
@@ -3056,17 +3056,17 @@ func (p *botInstanceParser) parse(event backend.Event) (types.Resource, error) {
 			return nil, trace.BadParameter("malformed key for %s event: %s", types.KindBotInstance, event.Item.Key)
 		}
 
-		botInstance := &machineidv1.BotInstance{
+		botInstance := machineidv1.BotInstance_builder{
 			Kind:    types.KindBotInstance,
 			Version: types.V1,
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    parts[1],
 				InstanceId: parts[2],
-			},
-			Metadata: &headerv1.Metadata{
+			}.Build(),
+			Metadata: headerv1.Metadata_builder{
 				Name: parts[2],
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		return types.Resource153ToLegacy(botInstance), nil
 	case types.OpPut:
@@ -3260,16 +3260,16 @@ func (p *accessGraphSecretPrivateKeyParser) parse(event backend.Event) (types.Re
 		}
 		deviceID := key.Components()[0]
 
-		privateKey := &accessgraphsecretsv1pb.PrivateKey{
+		privateKey := accessgraphsecretsv1pb.PrivateKey_builder{
 			Kind:    types.KindAccessGraphSecretPrivateKey,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: strings.TrimPrefix(key.TrimPrefix(backend.NewKey(deviceID)).String(), backend.SeparatorString),
-			},
-			Spec: &accessgraphsecretsv1pb.PrivateKeySpec{
+			}.Build(),
+			Spec: accessgraphsecretsv1pb.PrivateKeySpec_builder{
 				DeviceId: deviceID,
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		return types.Resource153ToLegacy(privateKey), nil
 	case types.OpPut:
@@ -3305,16 +3305,16 @@ func (p *accessGraphSecretAuthorizedKeyParser) parse(event backend.Event) (types
 		}
 		hostID := key.Components()[0]
 
-		authorizedKey := &accessgraphsecretsv1pb.AuthorizedKey{
+		authorizedKey := accessgraphsecretsv1pb.AuthorizedKey_builder{
 			Kind:    types.KindAccessGraphSecretAuthorizedKey,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: strings.TrimPrefix(key.TrimPrefix(backend.NewKey(hostID)).String(), backend.SeparatorString),
-			},
-			Spec: &accessgraphsecretsv1pb.AuthorizedKeySpec{
+			}.Build(),
+			Spec: accessgraphsecretsv1pb.AuthorizedKeySpec_builder{
 				HostId: hostID,
-			},
-		}
+			}.Build(),
+		}.Build()
 
 		return types.Resource153ToLegacy(authorizedKey), nil
 	case types.OpPut:
@@ -3409,16 +3409,16 @@ func (p *provisioningStateParser) parse(event backend.Event) (types.Resource, er
 		downstreamID := keyComponents[0]
 		resourceID := keyComponents[1]
 
-		pseudoState := &provisioningv1.PrincipalState{
+		pseudoState := provisioningv1.PrincipalState_builder{
 			Kind:    types.KindProvisioningPrincipalState,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: resourceID,
-			},
-			Spec: &provisioningv1.PrincipalStateSpec{
+			}.Build(),
+			Spec: provisioningv1.PrincipalStateSpec_builder{
 				DownstreamId: downstreamID,
-			},
-		}
+			}.Build(),
+		}.Build()
 		return types.Resource153ToLegacy(pseudoState), nil
 
 	case types.OpPut:
diff --git a/lib/services/local/events_test.go b/lib/services/local/events_test.go
index 53d8095c60f..7675fe71a5f 100644
--- a/lib/services/local/events_test.go
+++ b/lib/services/local/events_test.go
@@ -174,8 +174,8 @@ func TestWatchers(t *testing.T) {
 				// EXPECT that the resource attached event represents the created
 				// PrincipalState record
 				s0 := unwrapResource153[*provisioningv1.PrincipalState](subtestT, event.Resource)
-				require.Equal(subtestT, "foocorp", s0.Spec.DownstreamId)
-				require.Equal(subtestT, "u-alice", s0.Metadata.Name)
+				require.Equal(subtestT, "foocorp", s0.GetSpec().GetDownstreamId())
+				require.Equal(subtestT, "u-alice", s0.GetMetadata().GetName())
 			},
 		},
 		{
@@ -209,8 +209,8 @@ func TestWatchers(t *testing.T) {
 				// EXPECT that the supplied resource is a PrincipalState record
 				// containing the downstream ID of the deleted resource
 				principalState := unwrapResource153[*provisioningv1.PrincipalState](subtestT, event.Resource)
-				require.NotNil(t, principalState.Spec)
-				require.Equal(subtestT, "foocorp", principalState.Spec.DownstreamId)
+				require.NotNil(t, principalState.GetSpec())
+				require.Equal(subtestT, "foocorp", principalState.GetSpec().GetDownstreamId())
 			},
 		},
 		{
@@ -221,21 +221,21 @@ func TestWatchers(t *testing.T) {
 				svc, err := NewLinuxDesktopService(backend)
 				require.NoError(subtestT, err)
 
-				desktop := &linuxdesktopv1.LinuxDesktop{
+				desktop := linuxdesktopv1.LinuxDesktop_builder{
 					Kind:    types.KindLinuxDesktop,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "desktop-1",
 						Labels: map[string]string{
 							"env":  "test",
 							"team": "engineering",
 						},
-					},
-					Spec: &linuxdesktopv1.LinuxDesktopSpec{
+					}.Build(),
+					Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 						Addr:     "127.0.0.1:22",
 						Hostname: "test-host",
-					},
-				}
+					}.Build(),
+				}.Build()
 
 				_, err = svc.CreateLinuxDesktop(subtestCtx, desktop)
 				require.NoError(subtestT, err)
@@ -247,13 +247,13 @@ func TestWatchers(t *testing.T) {
 
 				// EXPECT that the resource attached to the event is a Linux desktop
 				desktop := unwrapResource153[*linuxdesktopv1.LinuxDesktop](subtestT, event.Resource)
-				require.Equal(subtestT, "desktop-1", desktop.Metadata.Name)
-				require.Equal(subtestT, "127.0.0.1:22", desktop.Spec.Addr)
-				require.Equal(subtestT, "test-host", desktop.Spec.Hostname)
+				require.Equal(subtestT, "desktop-1", desktop.GetMetadata().GetName())
+				require.Equal(subtestT, "127.0.0.1:22", desktop.GetSpec().GetAddr())
+				require.Equal(subtestT, "test-host", desktop.GetSpec().GetHostname())
 				require.Equal(subtestT, map[string]string{
 					"env":  "test",
 					"team": "engineering",
-				}, desktop.Metadata.Labels)
+				}, desktop.GetMetadata().GetLabels())
 			},
 		},
 		{
@@ -264,20 +264,20 @@ func TestWatchers(t *testing.T) {
 				svc, err := NewLinuxDesktopService(backend)
 				require.NoError(subtestT, err)
 
-				desktop := &linuxdesktopv1.LinuxDesktop{
+				desktop := linuxdesktopv1.LinuxDesktop_builder{
 					Kind:    types.KindLinuxDesktop,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "desktop-to-delete",
 						Labels: map[string]string{
 							"env": "staging",
 						},
-					},
-					Spec: &linuxdesktopv1.LinuxDesktopSpec{
+					}.Build(),
+					Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 						Addr:     "192.168.1.10:22",
 						Hostname: "delete-me",
-					},
-				}
+					}.Build(),
+				}.Build()
 
 				_, err = svc.CreateLinuxDesktop(subtestCtx, desktop)
 				require.NoError(subtestT, err)
@@ -314,9 +314,9 @@ func TestWatchers(t *testing.T) {
 					mfav2.ValidatedMFAChallenge_builder{
 						Kind:    types.KindValidatedMFAChallenge,
 						Version: types.V1,
-						Metadata: &headerv1.Metadata{
+						Metadata: headerv1.Metadata_builder{
 							Name: "test-challenge",
-						},
+						}.Build(),
 						Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 							Payload: mfav2.SessionIdentifyingPayload_builder{
 								SshSessionId: []byte("session-id"),
@@ -349,9 +349,9 @@ func TestWatchers(t *testing.T) {
 				_, err = svc.CreateValidatedMFAChallenge(subtestCtx, "leaf.example.com", mfav2.ValidatedMFAChallenge_builder{
 					Kind:    types.KindValidatedMFAChallenge,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "test-challenge",
-					},
+					}.Build(),
 					Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 						Payload: mfav2.SessionIdentifyingPayload_builder{
 							SshSessionId: []byte("session-id"),
diff --git a/lib/services/local/generic/generic_wrapper_test.go b/lib/services/local/generic/generic_wrapper_test.go
index 43e8bff44ea..fc1cae1ef25 100644
--- a/lib/services/local/generic/generic_wrapper_test.go
+++ b/lib/services/local/generic/generic_wrapper_test.go
@@ -47,11 +47,11 @@ func (t *testResource153) GetMetadata() *headerv1.Metadata {
 
 func newTestResource153(name string) *testResource153 {
 	tr := &testResource153{
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
+		}.Build(),
 	}
-	tr.Metadata.Expires = timestamppb.New(time.Now().AddDate(0, 0, 3))
+	tr.Metadata.SetExpires(timestamppb.New(time.Now().AddDate(0, 0, 3)))
 	return tr
 }
 
@@ -80,10 +80,10 @@ func unmarshalResource153(data []byte, opts ...services.MarshalOption) (*testRes
 	}
 
 	if cfg.Revision != "" {
-		r.Metadata.Revision = cfg.Revision
+		r.Metadata.SetRevision(cfg.Revision)
 	}
 	if !cfg.Expires.IsZero() {
-		r.Metadata.Expires = timestamppb.New(cfg.Expires)
+		r.Metadata.SetExpires(timestamppb.New(cfg.Expires))
 	}
 	return &r, nil
 }
@@ -205,7 +205,7 @@ func TestGenericWrapperCRUD(t *testing.T) {
 	require.True(t, trace.IsAlreadyExists(err))
 
 	// Update a resource.
-	r1.Metadata.Labels = map[string]string{"newlabel": "newvalue"}
+	r1.Metadata.SetLabels(map[string]string{"newlabel": "newvalue"})
 	r1, err = service.UnconditionalUpdateResource(ctx, r1)
 	require.NoError(t, err)
 	r, err = service.GetResource(ctx, r1.GetMetadata().GetName())
@@ -216,12 +216,12 @@ func TestGenericWrapperCRUD(t *testing.T) {
 	))
 
 	// Conditionally updating a resource fails if revisions do not match
-	r.Metadata.Revision = "fake"
+	r.Metadata.SetRevision("fake")
 	_, err = service.ConditionalUpdateResource(ctx, r)
 	require.True(t, trace.IsCompareFailed(err))
 
 	// Conditionally updating a resource is allowed when revisions match
-	r.Metadata.Revision = r1.Metadata.Revision
+	r.Metadata.SetRevision(r1.Metadata.GetRevision())
 	r1, err = service.ConditionalUpdateResource(ctx, r1)
 	require.NoError(t, err)
 
@@ -250,7 +250,7 @@ func TestGenericWrapperCRUD(t *testing.T) {
 	))
 
 	// Upsert a resource (update).
-	r1.Metadata.Labels = map[string]string{"newerlabel": "newervalue"}
+	r1.Metadata.SetLabels(map[string]string{"newerlabel": "newervalue"})
 	r1, err = service.UpsertResource(ctx, r1)
 	require.NoError(t, err)
 	out, nextToken, err = service.ListResources(ctx, 200, "")
diff --git a/lib/services/local/health_check_config_test.go b/lib/services/local/health_check_config_test.go
index c534741ec62..e0751d02402 100644
--- a/lib/services/local/health_check_config_test.go
+++ b/lib/services/local/health_check_config_test.go
@@ -64,7 +64,7 @@ func TestHealthCheckConfigService(t *testing.T) {
 			name: "create invalid",
 			run: func(t *testing.T, ctx context.Context, svc *HealthCheckConfigService) {
 				cfg := newHealthCfg(t, "invalid")
-				cfg.Spec = nil
+				cfg.ClearSpec()
 				_, err := svc.CreateHealthCheckConfig(ctx, cfg)
 				require.Error(t, err)
 			},
@@ -206,19 +206,19 @@ func TestHealthCheckConfigService(t *testing.T) {
 				cfg1, err := svc.CreateHealthCheckConfig(ctx, cfg1)
 				require.NoError(t, err)
 
-				cfg1.Spec.HealthyThreshold = 3
+				cfg1.GetSpec().SetHealthyThreshold(3)
 				cfgUpd, err := svc.UpdateHealthCheckConfig(ctx, cfg1)
 				require.NoError(t, err)
-				require.Equal(t, cfg1.Spec.HealthyThreshold, cfgUpd.Spec.HealthyThreshold)
+				require.Equal(t, cfg1.GetSpec().GetHealthyThreshold(), cfgUpd.GetSpec().GetHealthyThreshold())
 
 				cfgGet, err := svc.GetHealthCheckConfig(ctx, cfg1.GetMetadata().GetName())
 				require.NoError(t, err)
 				require.Empty(t, cmp.Diff(cfgUpd, cfgGet, protocmp.Transform()))
 
-				cfgGet.Spec.HealthyThreshold = 9
+				cfgGet.GetSpec().SetHealthyThreshold(9)
 				cfgUpd2, err := svc.UpdateHealthCheckConfig(ctx, cfgGet)
 				require.NoError(t, err)
-				require.Equal(t, cfgGet.Spec.HealthyThreshold, cfgUpd2.Spec.HealthyThreshold)
+				require.Equal(t, cfgGet.GetSpec().GetHealthyThreshold(), cfgUpd2.GetSpec().GetHealthyThreshold())
 			},
 		},
 		{
@@ -230,10 +230,10 @@ func TestHealthCheckConfigService(t *testing.T) {
 						// then update.
 						cfg, err := svc.GetHealthCheckConfig(ctx, name)
 						require.NoError(t, err)
-						cfg.Spec.Match.Disabled = true
+						cfg.GetSpec().GetMatch().SetDisabled(true)
 						out, err := svc.UpdateHealthCheckConfig(ctx, cfg)
 						require.NoError(t, err)
-						require.Equal(t, cfg.Spec.Match.Disabled, out.Spec.Match.Disabled)
+						require.Equal(t, cfg.GetSpec().GetMatch().GetDisabled(), out.GetSpec().GetMatch().GetDisabled())
 					})
 				}
 			},
@@ -247,7 +247,7 @@ func TestHealthCheckConfigService(t *testing.T) {
 						// then update.
 						cfgCrt, err := svc.CreateHealthCheckConfig(ctx, cfg)
 						require.NoError(t, err)
-						cfgCrt.Spec.Match.Disabled = true
+						cfgCrt.GetSpec().GetMatch().SetDisabled(true)
 						out, err := svc.UpdateHealthCheckConfig(ctx, cfgCrt)
 						require.NoError(t, err)
 						require.Empty(t, cmp.Diff(cfgCrt, out, protocmp.Transform()))
@@ -267,7 +267,7 @@ func TestHealthCheckConfigService(t *testing.T) {
 				require.NoError(t, err)
 				require.Empty(t, cmp.Diff(cfgUps, cfgGet, protocmp.Transform()))
 
-				cfgGet.Spec.HealthyThreshold = 9
+				cfgGet.GetSpec().SetHealthyThreshold(9)
 				out, err := svc.UpsertHealthCheckConfig(ctx, cfgGet)
 				require.NoError(t, err)
 				require.Empty(t, cmp.Diff(cfgGet, out, protocmp.Transform()))
@@ -286,7 +286,7 @@ func TestHealthCheckConfigService(t *testing.T) {
 						require.NoError(t, err)
 						require.Empty(t, cmp.Diff(cfgUps, cfgGet, protocmp.Transform()))
 
-						cfgGet.Spec.Match.Disabled = true
+						cfgGet.GetSpec().GetMatch().SetDisabled(true)
 						out, err := svc.UpsertHealthCheckConfig(ctx, cfgGet)
 						require.NoError(t, err)
 						require.Empty(t, cmp.Diff(cfgGet, out, protocmp.Transform()))
@@ -395,14 +395,14 @@ func newHealthSvc(t *testing.T, ctx context.Context) *HealthCheckConfigService {
 func newHealthCfg(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	cfg, err := healthcheckconfig.NewHealthCheckConfig(name,
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
-				DbLabels: []*labelv1.Label{{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   types.Wildcard,
 					Values: []string{types.Wildcard},
-				}},
-			},
-		},
+				}.Build()},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	return cfg
diff --git a/lib/services/local/identitycenter_test.go b/lib/services/local/identitycenter_test.go
index 51a3364e250..c4e973fb1d4 100644
--- a/lib/services/local/identitycenter_test.go
+++ b/lib/services/local/identitycenter_test.go
@@ -153,13 +153,13 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				// WHEN I modify the backend record for that resource...
 				tmpResource, err := test.getResource(ctx, uut, resourceID)
 				require.NoError(t, err)
-				tmpResource.GetMetadata().Labels = map[string]string{"update": "1"}
+				tmpResource.GetMetadata().SetLabels(map[string]string{"update": "1"})
 				updatedResource, err := test.updateResource(ctx, uut, tmpResource)
 				require.NoError(t, err)
 
 				// EXPECT that any attempt to update backend via the original in-memory
 				// version of the resource fails with a comparison error
-				createdResource.GetMetadata().Labels = map[string]string{"update": "2"}
+				createdResource.GetMetadata().SetLabels(map[string]string{"update": "2"})
 				_, err = test.updateResource(ctx, uut, createdResource)
 				require.True(t, trace.IsCompareFailed(err), "expected a compare failed error, got %T (%s)", err, err)
 
@@ -167,11 +167,11 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				// rather than failed update
 				r, err := test.getResource(ctx, uut, resourceID)
 				require.NoError(t, err)
-				require.Equal(t, "1", r.GetMetadata().Labels["update"])
+				require.Equal(t, "1", r.GetMetadata().GetLabels()["update"])
 
 				// WHEN I attempt update the backend via the latest revision of the
 				// record...
-				updatedResource.GetMetadata().Labels["update"] = "3"
+				updatedResource.GetMetadata().GetLabels()["update"] = "3"
 				_, err = test.updateResource(ctx, uut, updatedResource)
 
 				// EXPECT the update to succeed, and the backend record to have been
@@ -179,7 +179,7 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				require.NoError(t, err)
 				r, err = test.getResource(ctx, uut, resourceID)
 				require.NoError(t, err)
-				require.Equal(t, "3", r.GetMetadata().Labels["update"])
+				require.Equal(t, "3", r.GetMetadata().GetLabels()["update"])
 			})
 
 			t.Run("UnconditionalUpsert", func(t *testing.T) {
@@ -203,7 +203,7 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				// any changes to it...
 				tmpResource, err := test.getResource(ctx, uut, resourceID)
 				require.NoError(t, err)
-				tmpResource.GetMetadata().Labels = map[string]string{"update": "1"}
+				tmpResource.GetMetadata().SetLabels(map[string]string{"update": "1"})
 				_, err = test.updateResource(ctx, uut, tmpResource)
 				require.NoError(t, err)
 
@@ -214,7 +214,7 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				require.True(t, trace.IsCompareFailed(err), "expected a compare failed error, got %T (%s)", err, err)
 
 				// WHEN I attempt to Upsert the modified original resource
-				originalResource.GetMetadata().Labels = map[string]string{"update": "2"}
+				originalResource.GetMetadata().SetLabels(map[string]string{"update": "2"})
 				_, err = test.upsertResource(ctx, uut, originalResource)
 
 				// EXPECT that an upsert will succeed, even though the underlying
@@ -225,7 +225,7 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 				// upsert
 				r, err := test.getResource(ctx, uut, resourceID)
 				require.NoError(t, err)
-				require.Equal(t, "2", r.GetMetadata().Labels["update"])
+				require.Equal(t, "2", r.GetMetadata().GetLabels()["update"])
 			})
 
 			t.Run("DeleteAllResources", func(t *testing.T) {
@@ -269,78 +269,78 @@ func TestIdentityCenterResourceCRUD(t *testing.T) {
 
 func makeTestIdentityCenterAccount(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) *identitycenterv1.Account {
 	t.Helper()
-	created, err := svc.CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+	created, err := svc.CreateIdentityCenterAccount(ctx, identitycenterv1.Account_builder{
 		Kind:     types.KindIdentityCenterAccount,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: id},
-		Spec: &identitycenterv1.AccountSpec{
+		Metadata: headerv1.Metadata_builder{Name: id}.Build(),
+		Spec: identitycenterv1.AccountSpec_builder{
 			Id:          "aws-account-id-" + id,
 			Arn:         fmt.Sprintf("arn:aws:sso::%s:", id),
 			Description: "Test account " + id,
 			PermissionSetInfo: []*identitycenterv1.PermissionSetInfo{
-				{
+				identitycenterv1.PermissionSetInfo_builder{
 					Name: "dummy",
 					Arn:  "arn:aws:sso:::permissionSet/ic-instance/ps-instance",
-				},
+				}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return created
 }
 
 func makeTestIdentityCenterPermissionSet(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) *identitycenterv1.PermissionSet {
 	t.Helper()
-	created, err := svc.CreatePermissionSet(ctx, &identitycenterv1.PermissionSet{
+	created, err := svc.CreatePermissionSet(ctx, identitycenterv1.PermissionSet_builder{
 		Kind:     types.KindIdentityCenterPermissionSet,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: id},
-		Spec: &identitycenterv1.PermissionSetSpec{
+		Metadata: headerv1.Metadata_builder{Name: id}.Build(),
+		Spec: identitycenterv1.PermissionSetSpec_builder{
 			Arn:         fmt.Sprintf("arn:aws:sso:::permissionSet/ic-instance/%s", id),
 			Name:        "aws-permission-set-" + id,
 			Description: "Test permission set " + id,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return created
 }
 
 func makeTestIdentityCenterAccountAssignment(t *testing.T, ctx context.Context, svc services.IdentityCenter, id string) *identitycenterv1.AccountAssignment {
 	t.Helper()
-	created, err := svc.CreateIdentityCenterAccountAssignment(ctx, &identitycenterv1.AccountAssignment{
+	created, err := svc.CreateIdentityCenterAccountAssignment(ctx, identitycenterv1.AccountAssignment_builder{
 		Kind:     types.KindIdentityCenterAccountAssignment,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: id},
-		Spec: &identitycenterv1.AccountAssignmentSpec{
+		Metadata: headerv1.Metadata_builder{Name: id}.Build(),
+		Spec: identitycenterv1.AccountAssignmentSpec_builder{
 			Display: "Some-Permission-set on Some-AWS-account",
-			PermissionSet: &identitycenterv1.PermissionSetInfo{
+			PermissionSet: identitycenterv1.PermissionSetInfo_builder{
 				Arn:  "arn:aws:sso:::permissionSet/ic-instance/ps-instance",
 				Name: "some permission set",
-			},
+			}.Build(),
 			AccountName: "Some Account Name",
 			AccountId:   "some account id",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return created
 }
 
 func makeTestIdentityCenterPrincipalAssignment(t *testing.T, ctx context.Context, svc services.IdentityCenterPrincipalAssignments, id string) *identitycenterv1.PrincipalAssignment {
 	t.Helper()
-	created, err := svc.CreatePrincipalAssignment(ctx, &identitycenterv1.PrincipalAssignment{
+	created, err := svc.CreatePrincipalAssignment(ctx, identitycenterv1.PrincipalAssignment_builder{
 		Kind:     types.KindIdentityCenterPrincipalAssignment,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: id},
-		Spec: &identitycenterv1.PrincipalAssignmentSpec{
+		Metadata: headerv1.Metadata_builder{Name: id}.Build(),
+		Spec: identitycenterv1.PrincipalAssignmentSpec_builder{
 			PrincipalType:    identitycenterv1.PrincipalType_PRINCIPAL_TYPE_USER,
 			PrincipalId:      id,
 			ExternalIdSource: "scim",
 			ExternalId:       "some external id",
-		},
-		Status: &identitycenterv1.PrincipalAssignmentStatus{
+		}.Build(),
+		Status: identitycenterv1.PrincipalAssignmentStatus_builder{
 			ProvisioningState: identitycenterv1.ProvisioningState_PROVISIONING_STATE_STALE,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return created
 }
diff --git a/lib/services/local/kubewaitingcontainer.go b/lib/services/local/kubewaitingcontainer.go
index 810e835320d..0831b79365d 100644
--- a/lib/services/local/kubewaitingcontainer.go
+++ b/lib/services/local/kubewaitingcontainer.go
@@ -76,7 +76,7 @@ func (k *KubeWaitingContainerService) ListKubernetesWaitingContainers(ctx contex
 // container that are waiting to be created until moderated
 // session conditions are met.
 func (k *KubeWaitingContainerService) GetKubernetesWaitingContainer(ctx context.Context, req *kubewaitingcontainerpb.GetKubernetesWaitingContainerRequest) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
-	out, err := k.svc.WithPrefix(req.Username, req.Cluster, req.Namespace, req.PodName).GetResource(ctx, req.ContainerName)
+	out, err := k.svc.WithPrefix(req.GetUsername(), req.GetCluster(), req.GetNamespace(), req.GetPodName()).GetResource(ctx, req.GetContainerName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -88,7 +88,7 @@ func (k *KubeWaitingContainerService) GetKubernetesWaitingContainer(ctx context.
 // container that are waiting to be created until moderated
 // session conditions are met.
 func (k *KubeWaitingContainerService) CreateKubernetesWaitingContainer(ctx context.Context, in *kubewaitingcontainerpb.KubernetesWaitingContainer) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
-	svc := k.svc.WithPrefix(in.Spec.Username, in.Spec.Cluster, in.Spec.Namespace, in.Spec.PodName)
+	svc := k.svc.WithPrefix(in.GetSpec().GetUsername(), in.GetSpec().GetCluster(), in.GetSpec().GetNamespace(), in.GetSpec().GetPodName())
 	out, err := svc.CreateResource(ctx, in)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -101,7 +101,7 @@ func (k *KubeWaitingContainerService) CreateKubernetesWaitingContainer(ctx conte
 // container that are waiting to be created until moderated
 // session conditions are met.
 func (k *KubeWaitingContainerService) UpsertKubernetesWaitingContainer(ctx context.Context, in *kubewaitingcontainerpb.KubernetesWaitingContainer) (*kubewaitingcontainerpb.KubernetesWaitingContainer, error) {
-	svc := k.svc.WithPrefix(in.Spec.Username, in.Spec.Cluster, in.Spec.Namespace, in.Spec.PodName)
+	svc := k.svc.WithPrefix(in.GetSpec().GetUsername(), in.GetSpec().GetCluster(), in.GetSpec().GetNamespace(), in.GetSpec().GetPodName())
 	out, err := svc.UpsertResource(ctx, in)
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -114,7 +114,7 @@ func (k *KubeWaitingContainerService) UpsertKubernetesWaitingContainer(ctx conte
 // container that are waiting to be created until moderated
 // session conditions are met.
 func (k *KubeWaitingContainerService) DeleteKubernetesWaitingContainer(ctx context.Context, req *kubewaitingcontainerpb.DeleteKubernetesWaitingContainerRequest) error {
-	return trace.Wrap(k.svc.WithPrefix(req.Username, req.Cluster, req.Namespace, req.PodName).DeleteResource(ctx, req.ContainerName))
+	return trace.Wrap(k.svc.WithPrefix(req.GetUsername(), req.GetCluster(), req.GetNamespace(), req.GetPodName()).DeleteResource(ctx, req.GetContainerName()))
 }
 
 // DeleteAllKubernetesWaitingContainers deletes all Kubernetes ephemeral
diff --git a/lib/services/local/linux_desktop_test.go b/lib/services/local/linux_desktop_test.go
index dbdd540f5e2..82055b64e7d 100644
--- a/lib/services/local/linux_desktop_test.go
+++ b/lib/services/local/linux_desktop_test.go
@@ -58,10 +58,10 @@ func TestLinuxDesktopServiceCRUD(t *testing.T) {
 	require.Len(t, out, 1)
 
 	update := proto.Clone(created).(*linuxdesktopv1.LinuxDesktop)
-	update.Spec.Hostname = "updated-host"
+	update.GetSpec().SetHostname("updated-host")
 	updated, err := service.UpdateLinuxDesktop(ctx, update)
 	require.NoError(t, err)
-	require.Equal(t, "updated-host", updated.Spec.Hostname)
+	require.Equal(t, "updated-host", updated.GetSpec().GetHostname())
 
 	require.NoError(t, service.DeleteLinuxDesktop(ctx, "desktop-1"))
 	out, _, err = service.ListLinuxDesktops(ctx, 10, "")
@@ -79,15 +79,15 @@ func TestLinuxDesktopServiceCRUD(t *testing.T) {
 }
 
 func newLinuxDesktop(name string) *linuxdesktopv1.LinuxDesktop {
-	return &linuxdesktopv1.LinuxDesktop{
+	return linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "127.0.0.1:22",
 			Hostname: "host",
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/services/local/mfa.go b/lib/services/local/mfa.go
index 12b2a45178f..c978b7cd7f1 100644
--- a/lib/services/local/mfa.go
+++ b/lib/services/local/mfa.go
@@ -91,7 +91,7 @@ func (s *MFAService) CreateValidatedMFAChallenge(
 	svc := s.service.WithPrefix(targetCluster)
 
 	// All validated MFA challenges must expire after 5 minutes.
-	chal.GetMetadata().Expires = timestamppb.New(time.Now().Add(ValidatedMFAChallengeExpiry))
+	chal.GetMetadata().SetExpires(timestamppb.New(time.Now().Add(ValidatedMFAChallengeExpiry)))
 
 	res, err := svc.CreateResource(ctx, chal)
 	if err != nil {
@@ -183,11 +183,11 @@ func UnmarshalValidatedMFAChallenge(b []byte, opts ...services.MarshalOption) (*
 		}
 
 		if cfg.Revision != "" {
-			metadata.Revision = cfg.Revision
+			metadata.SetRevision(cfg.Revision)
 		}
 
 		if !cfg.Expires.IsZero() {
-			metadata.Expires = timestamppb.New(cfg.Expires)
+			metadata.SetExpires(timestamppb.New(cfg.Expires))
 		}
 	}
 
@@ -251,9 +251,9 @@ func (p *validatedMFAChallengeParser) parse(event backend.Event) (types.Resource
 		chal = mfav2.ValidatedMFAChallenge_builder{
 			Kind:    types.KindValidatedMFAChallenge,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: keyComponents[len(keyComponents)-1], // The challenge name is the last component of the key.
-			},
+			}.Build(),
 			Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 				TargetCluster: keyComponents[0], // The target cluster is the first component of the key.
 			}.Build(),
diff --git a/lib/services/local/mfa_test.go b/lib/services/local/mfa_test.go
index 7562fead4bf..f19045c947a 100644
--- a/lib/services/local/mfa_test.go
+++ b/lib/services/local/mfa_test.go
@@ -157,7 +157,7 @@ func TestMFAService_CreateValidatedMFAChallenge_Validation(t *testing.T) {
 			targetCluster: &defaultTargetCluster,
 			chal: func() *mfav2.ValidatedMFAChallenge {
 				c := newValidatedMFAChallenge()
-				c.GetMetadata().Name = ""
+				c.GetMetadata().SetName("")
 				return c
 			}(),
 			wantErr: trace.BadParameter("name must be set"),
@@ -265,7 +265,7 @@ func TestMFAService_ListValidatedMFAChallenges_Success(t *testing.T) {
 		{name: "chal-3", username: "bob"},
 	} {
 		chal := newValidatedMFAChallenge()
-		chal.GetMetadata().Name = tc.name
+		chal.GetMetadata().SetName(tc.name)
 		chal.GetSpec().SetUsername(tc.username)
 
 		challenges = append(challenges, chal)
@@ -322,7 +322,7 @@ func TestMFAService_ListValidatedMFAChallenges_FilterByTargetCluster(t *testing.
 		{name: "chal-target-a-2", username: "bob", targetCluster: "leaf-a"},
 	} {
 		chal := newValidatedMFAChallenge()
-		chal.GetMetadata().Name = tc.name
+		chal.GetMetadata().SetName(tc.name)
 		chal.GetSpec().SetUsername(tc.username)
 		chal.GetSpec().SetTargetCluster(tc.targetCluster)
 
@@ -362,9 +362,9 @@ func newValidatedMFAChallenge() *mfav2.ValidatedMFAChallenge {
 	return mfav2.ValidatedMFAChallenge_builder{
 		Kind:    types.KindValidatedMFAChallenge,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-challenge",
-		},
+		}.Build(),
 		Spec: mfav2.ValidatedMFAChallengeSpec_builder{
 			Payload: mfav2.SessionIdentifyingPayload_builder{
 				SshSessionId: []byte("session-id"),
diff --git a/lib/services/local/notifications.go b/lib/services/local/notifications.go
index a0586f1b94c..6648692e521 100644
--- a/lib/services/local/notifications.go
+++ b/lib/services/local/notifications.go
@@ -172,30 +172,30 @@ func (s *NotificationsService) CreateUserNotification(ctx context.Context, notif
 		return nil, trace.Wrap(err)
 	}
 
-	if notification.Spec.Username == "" {
+	if notification.GetSpec().GetUsername() == "" {
 		return nil, trace.BadParameter("a username must be specified")
 	}
 
-	notification.Kind = types.KindNotification
-	notification.Version = types.V1
+	notification.SetKind(types.KindNotification)
+	notification.SetVersion(types.V1)
 
 	// Generate uuidv7 ID.
 	uuid, err := uuid.NewV7()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	notification.Metadata.Name = uuid.String()
+	notification.GetMetadata().SetName(uuid.String())
 
-	if err := CheckAndSetExpiry(notification.Metadata, s.clock); err != nil {
+	if err := CheckAndSetExpiry(notification.GetMetadata(), s.clock); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	notification.Spec.Created = timestamppb.New(s.clock.Now())
+	notification.GetSpec().SetCreated(timestamppb.New(s.clock.Now()))
 
-	notification.Metadata.Labels[types.NotificationScope] = "user"
+	notification.GetMetadata().GetLabels()[types.NotificationScope] = "user"
 
 	// Append username prefix.
-	serviceWithPrefix := s.userNotificationService.WithPrefix(notification.Spec.Username)
+	serviceWithPrefix := s.userNotificationService.WithPrefix(notification.GetSpec().GetUsername())
 
 	created, err := serviceWithPrefix.CreateResource(ctx, notification)
 	return created, trace.Wrap(err)
@@ -208,12 +208,12 @@ func (s *NotificationsService) UpsertUserNotification(ctx context.Context, notif
 	}
 
 	// Precautionary check in case of accidental misuse.
-	if notification.Metadata.Name == "" {
+	if notification.GetMetadata().GetName() == "" {
 		return nil, trace.BadParameter("notification id is missing. Did you mean to use CreateUserNotification?")
 	}
 
 	// Append username prefix.
-	serviceWithPrefix := s.userNotificationService.WithPrefix(notification.Spec.Username)
+	serviceWithPrefix := s.userNotificationService.WithPrefix(notification.GetSpec().GetUsername())
 
 	created, err := serviceWithPrefix.UpsertResource(ctx, notification)
 	return created, trace.Wrap(err)
@@ -261,12 +261,12 @@ func (s *NotificationsService) CreateGlobalNotification(ctx context.Context, glo
 	// Check to ensure that the metadata for the globalNotification isn't configured, this shouldn't be used and if it is configured, the caller likely meant to
 	// configure the notification's metadata, which is in spec.notification.metadata.
 	// We do this check here instead of in `ValidateGlobalNotification` because we only want to do this check on creation.
-	if globalNotification.Metadata != nil {
+	if globalNotification.HasMetadata() {
 		return nil, trace.BadParameter("metadata should be nil, metadata for a notification should be in spec.notification.metadata")
 	}
 
-	globalNotification.Kind = types.KindGlobalNotification
-	globalNotification.Version = types.V1
+	globalNotification.SetKind(types.KindGlobalNotification)
+	globalNotification.SetVersion(types.V1)
 
 	// Generate uuidv7 ID.
 	uuid, err := uuid.NewV7()
@@ -274,20 +274,20 @@ func (s *NotificationsService) CreateGlobalNotification(ctx context.Context, glo
 		return nil, trace.Wrap(err)
 	}
 
-	if err := CheckAndSetExpiry(globalNotification.Spec.Notification.Metadata, s.clock); err != nil {
+	if err := CheckAndSetExpiry(globalNotification.GetSpec().GetNotification().GetMetadata(), s.clock); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	globalNotification.Metadata = &headerv1.Metadata{
+	globalNotification.SetMetadata(headerv1.Metadata_builder{
 		Name: uuid.String(),
 		// Set the same expiry on the outer GlobalNotification wrapper's metadata. This is necessary for the sqlite cleanup routine
 		// to be able to delete this notification when it expires.
-		Expires: globalNotification.GetSpec().GetNotification().GetMetadata().Expires,
-	}
+		Expires: globalNotification.GetSpec().GetNotification().GetMetadata().GetExpires(),
+	}.Build())
 
-	globalNotification.Spec.Notification.Spec.Created = timestamppb.New(s.clock.Now())
-	globalNotification.Spec.Notification.Metadata.Name = uuid.String()
-	globalNotification.Spec.Notification.Metadata.Labels[types.NotificationScope] = "global"
+	globalNotification.GetSpec().GetNotification().GetSpec().SetCreated(timestamppb.New(s.clock.Now()))
+	globalNotification.GetSpec().GetNotification().GetMetadata().SetName(uuid.String())
+	globalNotification.GetSpec().GetNotification().GetMetadata().GetLabels()[types.NotificationScope] = "global"
 
 	created, err := s.globalNotificationService.CreateResource(ctx, globalNotification)
 	return created, trace.Wrap(err)
@@ -300,7 +300,7 @@ func (s *NotificationsService) UpsertGlobalNotification(ctx context.Context, glo
 	}
 
 	// Precautionary check in case of accidental misuse.
-	if globalNotification.Spec.Notification.Metadata.Name == "" {
+	if globalNotification.GetSpec().GetNotification().GetMetadata().GetName() == "" {
 		return nil, trace.BadParameter("notification id is missing. Did you mean to use CreateGlobalNotification?")
 	}
 
@@ -322,33 +322,33 @@ func (s *NotificationsService) UpsertUserNotificationState(ctx context.Context,
 
 	// Verify that the notification this state is for exists.
 	notifServiceWithPrefix := s.userNotificationService.WithPrefix(username)
-	_, err := notifServiceWithPrefix.GetResource(ctx, state.Spec.NotificationId)
+	_, err := notifServiceWithPrefix.GetResource(ctx, state.GetSpec().GetNotificationId())
 	if err != nil {
 		if !trace.IsNotFound(err) {
 			return nil, trace.Wrap(err)
 		}
 
 		// If we didn't find a user-specific notification with this ID, try finding a global notification.
-		_, err := s.globalNotificationService.GetResource(ctx, state.Spec.NotificationId)
+		_, err := s.globalNotificationService.GetResource(ctx, state.GetSpec().GetNotificationId())
 		if err != nil {
 			if !trace.IsNotFound(err) {
 				return nil, trace.Wrap(err)
 			}
 
-			return nil, trace.NotFound("notification '%s' does not exist", state.Spec.NotificationId)
+			return nil, trace.NotFound("notification '%s' does not exist", state.GetSpec().GetNotificationId())
 		}
 	}
 
-	state.Kind = types.KindUserNotificationState
-	state.Version = types.V1
-	state.Spec.Username = username
+	state.SetKind(types.KindUserNotificationState)
+	state.SetVersion(types.V1)
+	state.GetSpec().SetUsername(username)
 
-	if state.Metadata == nil {
-		state.Metadata = &headerv1.Metadata{}
+	if !state.HasMetadata() {
+		state.SetMetadata(&headerv1.Metadata{})
 	}
 
 	// We set this to the notification UUID because the service adapter uses `getName()` to determine the backend key to use when storing the object.
-	state.Metadata.Name = state.Spec.NotificationId
+	state.GetMetadata().SetName(state.GetSpec().GetNotificationId())
 
 	// Append username prefix.
 	serviceWithPrefix := s.userNotificationStateService.WithPrefix(username)
@@ -400,14 +400,14 @@ func (s *NotificationsService) UpsertUserLastSeenNotification(ctx context.Contex
 		return nil, trace.Wrap(err)
 	}
 
-	ulsn.Kind = types.KindUserLastSeenNotification
-	ulsn.Version = types.V1
+	ulsn.SetKind(types.KindUserLastSeenNotification)
+	ulsn.SetVersion(types.V1)
 
-	if ulsn.Metadata == nil {
-		ulsn.Metadata = &headerv1.Metadata{}
+	if !ulsn.HasMetadata() {
+		ulsn.SetMetadata(&headerv1.Metadata{})
 	}
 	// We set this to the username because the service adapter uses `getName()` to determine the backend key to use when storing the object.
-	ulsn.Metadata.Name = username
+	ulsn.GetMetadata().SetName(username)
 
 	upserted, err := s.userLastSeenNotificationService.UpsertResource(ctx, ulsn)
 	return upserted, trace.Wrap(err)
@@ -446,20 +446,20 @@ func (s *NotificationsService) CreateUniqueNotificationIdentifier(ctx context.Co
 		return nil, trace.BadParameter("identifier is missing")
 	}
 
-	uniqueNotificationIdentifier := &notificationsv1.UniqueNotificationIdentifier{
-		Spec: &notificationsv1.UniqueNotificationIdentifierSpec{
+	uniqueNotificationIdentifier := notificationsv1.UniqueNotificationIdentifier_builder{
+		Spec: notificationsv1.UniqueNotificationIdentifierSpec_builder{
 			UniqueIdentifier:       identifier,
 			UniqueIdentifierPrefix: prefix,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			// the service adapter uses `getName()` to determine the backend key
 			Name: identifier,
-		},
+		}.Build(),
 		Kind:    types.KindUniqueNotificationIdentifier,
 		Version: types.V1,
-	}
+	}.Build()
 
-	if err := CheckAndSetExpiry(uniqueNotificationIdentifier.Metadata, s.clock); err != nil {
+	if err := CheckAndSetExpiry(uniqueNotificationIdentifier.GetMetadata(), s.clock); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -500,10 +500,10 @@ func (s *NotificationsService) DeleteUniqueNotificationIdentifier(ctx context.Co
 // CheckAndSetExpiry checks and sets the default expiry for a notification.
 func CheckAndSetExpiry(metadata *headerv1.Metadata, clock clockwork.Clock) error {
 	// If the expiry hasn't been provided, set the default to 30 days from now.
-	if metadata.Expires == nil {
+	if !metadata.HasExpires() {
 		now := clock.Now()
 		futureTime := now.Add(defaultExpiry)
-		metadata.Expires = timestamppb.New(futureTime)
+		metadata.SetExpires(timestamppb.New(futureTime))
 		return nil
 	}
 
@@ -512,7 +512,7 @@ func CheckAndSetExpiry(metadata *headerv1.Metadata, clock clockwork.Clock) error
 	now := clock.Now()
 	timeOfMaxExpiry := now.Add(maxExpiry)
 
-	if metadata.Expires.AsTime().After(timeOfMaxExpiry) {
+	if metadata.GetExpires().AsTime().After(timeOfMaxExpiry) {
 		return trace.BadParameter("notification expiry cannot be more than %d days from its creation", int(maxExpiry.Hours()/24))
 	}
 
diff --git a/lib/services/local/notifications_test.go b/lib/services/local/notifications_test.go
index 2ebc7e68f24..27fd44fc9a6 100644
--- a/lib/services/local/notifications_test.go
+++ b/lib/services/local/notifications_test.go
@@ -27,6 +27,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
@@ -116,34 +117,32 @@ func TestGlobalNotificationCRUD(t *testing.T) {
 	// Create a couple notifications.
 	globalNotification1 := newGlobalNotification(t, "test-notification-1")
 	globalNotification2 := newGlobalNotification(t, "test-notification-2")
-	globalNotificationNoMatcher := &notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Notification: &notificationsv1.Notification{
+	globalNotificationNoMatcher := notificationsv1.GlobalNotification_builder{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Description: "Test Description",
-				},
-			},
-		},
-	}
-	globalNotificationLateExpiry := &notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
+	globalNotificationLateExpiry := notificationsv1.GlobalNotification_builder{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Description: "Test Description",
 					Labels:      map[string]string{"description": "notification-late-expiry"},
 					// Set the expiry to 91 days from now, which is past the 90 day expiry limit.
 					Expires: timestamppb.New(clock.Now().AddDate(0, 0, 91)),
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	// Create notifications.
 	notification, err := service.CreateGlobalNotification(ctx, globalNotification1)
@@ -161,7 +160,7 @@ func TestGlobalNotificationCRUD(t *testing.T) {
 	require.True(t, trace.IsBadParameter(err), "got error %T, expected a bad parameter error due to notification-late-expiry having an expiry date more than 90 days later", err)
 
 	// Verify that the Metada.Expires on the global notification wrapper is the same as in the inner notification.
-	require.Equal(t, notification.Metadata.Expires, notification.Spec.Notification.Metadata.Expires)
+	require.Equal(t, notification.GetMetadata().GetExpires(), notification.GetSpec().GetNotification().GetMetadata().GetExpires())
 
 	// Test deleting a notification.
 	err = service.DeleteGlobalNotification(ctx, globalNotification1Id)
@@ -200,33 +199,33 @@ func TestUserNotificationStateCRUD(t *testing.T) {
 	require.NoError(t, err)
 	notification2Id := notification.GetMetadata().GetName()
 
-	userNotificationState1 := &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	userNotificationState1 := notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: notification1Id,
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	// Duplicate of the above but with the state set to dismissed instead of clicked.
-	userNotificationState1Dismissed := &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	userNotificationState1Dismissed := notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: notification1Id,
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED,
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	userNotificationState2 := &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	userNotificationState2 := notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: notification2Id,
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	// Initially we expect no user notification states.
 	out, nextToken, err := service.ListUserNotificationStates(ctx, testUsername, 0, "")
@@ -282,10 +281,10 @@ func TestUserNotificationStateCRUD(t *testing.T) {
 
 	require.Len(t, paginatedOut, 2)
 	// Verify that notification id's and states are correct, userNotificationState1 should now have the dismissed state.
-	require.Equal(t, userNotificationState1.Spec.NotificationId, paginatedOut[0].Spec.NotificationId)
-	require.Equal(t, notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED, paginatedOut[0].Status.NotificationState)
-	require.Equal(t, userNotificationState2.Spec.NotificationId, paginatedOut[1].Spec.NotificationId)
-	require.Equal(t, notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED, paginatedOut[1].Status.NotificationState)
+	require.Equal(t, userNotificationState1.GetSpec().GetNotificationId(), paginatedOut[0].GetSpec().GetNotificationId())
+	require.Equal(t, notificationsv1.NotificationState_NOTIFICATION_STATE_DISMISSED, paginatedOut[0].GetStatus().GetNotificationState())
+	require.Equal(t, userNotificationState2.GetSpec().GetNotificationId(), paginatedOut[1].GetSpec().GetNotificationId())
+	require.Equal(t, notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED, paginatedOut[1].GetStatus().GetNotificationState())
 
 	// Test deleting a notification state.
 	err = service.DeleteUserNotificationState(ctx, testUsername, notification1Id)
@@ -328,14 +327,14 @@ func TestUserNotificationStateCRUD(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a notification state for this notification
-	userNotificationStateGlobal := &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	userNotificationStateGlobal := notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: globalNotification.GetMetadata().GetName(),
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-		},
-	}
+		}.Build(),
+	}.Build()
 	// Upsert a notification state for user 1
 	_, err = service.UpsertUserNotificationState(ctx, testUsername, userNotificationStateGlobal)
 	require.NoError(t, err)
@@ -366,11 +365,11 @@ func TestUserLastSeenNotificationCRUD(t *testing.T) {
 	testUsername := "test-username"
 	testTimestamp := timestamppb.New(time.UnixMilli(1708041600000)) // February 16, 2024 12:00:00 AM UTC
 
-	userLastSeenNotification := &notificationsv1.UserLastSeenNotification{
-		Status: &notificationsv1.UserLastSeenNotificationStatus{
+	userLastSeenNotification := notificationsv1.UserLastSeenNotification_builder{
+		Status: notificationsv1.UserLastSeenNotificationStatus_builder{
 			LastSeenTime: testTimestamp,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	// Initially we expect the user's last seen notification object to not exist.
 	_, err = service.GetUserLastSeenNotification(ctx, testUsername)
@@ -434,40 +433,40 @@ func TestUniqueNotificationIdentifierCRUD(t *testing.T) {
 	// Create unique notification identifiers with the testPrefix1 prefix.
 	identifier, err := service.CreateUniqueNotificationIdentifier(ctx, testPrefix1, "1")
 	require.NoError(t, err)
-	require.Equal(t, "1", identifier.Spec.UniqueIdentifier)
-	require.Equal(t, testPrefix1, identifier.Spec.UniqueIdentifierPrefix)
+	require.Equal(t, "1", identifier.GetSpec().GetUniqueIdentifier())
+	require.Equal(t, testPrefix1, identifier.GetSpec().GetUniqueIdentifierPrefix())
 
 	identifier, err = service.CreateUniqueNotificationIdentifier(ctx, testPrefix1, "2")
 	require.NoError(t, err)
-	require.Equal(t, "2", identifier.Spec.UniqueIdentifier)
-	require.Equal(t, testPrefix1, identifier.Spec.UniqueIdentifierPrefix)
+	require.Equal(t, "2", identifier.GetSpec().GetUniqueIdentifier())
+	require.Equal(t, testPrefix1, identifier.GetSpec().GetUniqueIdentifierPrefix())
 
 	// Create a unique notification identifier with the testPrefix2 prefix.
 	identifier, err = service.CreateUniqueNotificationIdentifier(ctx, testPrefix2, "1")
 	require.NoError(t, err)
-	require.Equal(t, "1", identifier.Spec.UniqueIdentifier)
-	require.Equal(t, testPrefix2, identifier.Spec.UniqueIdentifierPrefix)
+	require.Equal(t, "1", identifier.GetSpec().GetUniqueIdentifier())
+	require.Equal(t, testPrefix2, identifier.GetSpec().GetUniqueIdentifierPrefix())
 
 	// List identifiers with the testPrefix1 prefix.
 	out, _, err = service.ListUniqueNotificationIdentifiersForPrefix(ctx, testPrefix1, 5, "")
 	require.NoError(t, err)
 	// Verify that only the identifiers with testPrefix1 as prefix are returned.
 	require.Len(t, out, 2)
-	require.Equal(t, "1", out[0].Spec.UniqueIdentifier)
-	require.Equal(t, "2", out[1].Spec.UniqueIdentifier)
+	require.Equal(t, "1", out[0].GetSpec().GetUniqueIdentifier())
+	require.Equal(t, "2", out[1].GetSpec().GetUniqueIdentifier())
 
 	// List identifiers with the testPrefix2 prefix.
 	out, _, err = service.ListUniqueNotificationIdentifiersForPrefix(ctx, testPrefix2, 5, "")
 	require.NoError(t, err)
 	// Verify that only the identifier with testPrefix2 as prefix is returned.
 	require.Len(t, out, 1)
-	require.Equal(t, "1", out[0].Spec.UniqueIdentifier)
+	require.Equal(t, "1", out[0].GetSpec().GetUniqueIdentifier())
 
 	// Test that getting a unique notification identifier works.
 	uni, err := service.GetUniqueNotificationIdentifier(ctx, testPrefix1, "1")
 	require.NoError(t, err)
-	require.Equal(t, "1", uni.Spec.UniqueIdentifier)
-	require.Equal(t, testPrefix1, uni.Spec.UniqueIdentifierPrefix)
+	require.Equal(t, "1", uni.GetSpec().GetUniqueIdentifier())
+	require.Equal(t, testPrefix1, uni.GetSpec().GetUniqueIdentifierPrefix())
 
 	// Delete one of the identifiers with testPrefix1 prefix.
 	err = service.DeleteUniqueNotificationIdentifier(ctx, testPrefix1, "1")
@@ -477,8 +476,8 @@ func TestUniqueNotificationIdentifierCRUD(t *testing.T) {
 	out, _, err = service.ListUniqueNotificationIdentifiersForPrefix(ctx, testPrefix1, 5, "")
 	require.NoError(t, err)
 	require.Len(t, out, 1)
-	require.Equal(t, "2", out[0].Spec.UniqueIdentifier)
-	require.Equal(t, testPrefix1, out[0].Spec.UniqueIdentifierPrefix)
+	require.Equal(t, "2", out[0].GetSpec().GetUniqueIdentifier())
+	require.Equal(t, testPrefix1, out[0].GetSpec().GetUniqueIdentifierPrefix())
 
 	// Try to create an identifier with an empty prefix and identifier and verify that there is an error.
 	_, err = service.CreateUniqueNotificationIdentifier(ctx, "", "")
@@ -490,14 +489,14 @@ func newUserNotification(t *testing.T, username string, title string) *notificat
 
 	notification := notificationsv1.Notification{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: username,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
+		}.Build(),
 	}
 
 	return &notification
@@ -507,20 +506,18 @@ func newGlobalNotification(t *testing.T, title string) *notificationsv1.GlobalNo
 	t.Helper()
 
 	notification := notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Labels: map[string]string{
 						types.NotificationTitleLabel: title,
 					},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	}
 
 	return &notification
diff --git a/lib/services/local/presence.go b/lib/services/local/presence.go
index a5ec6140254..a50b732a35f 100644
--- a/lib/services/local/presence.go
+++ b/lib/services/local/presence.go
@@ -2032,14 +2032,14 @@ type relayServerParser struct{}
 func (relayServerParser) parse(event backend.Event) (types.Resource, error) {
 	switch event.Type {
 	case types.OpDelete:
-		return types.Resource153ToLegacy(&presencev1.RelayServer{
+		return types.Resource153ToLegacy(presencev1.RelayServer_builder{
 			Kind:    types.KindRelayServer,
 			SubKind: "",
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: event.Item.Key.TrimPrefix(backend.ExactKey(relayServersPrefix)).String(),
-			},
-		}), nil
+			}.Build(),
+		}.Build()), nil
 	case types.OpPut:
 		r, err := services.UnmarshalProtoResource[*presencev1.RelayServer](
 			event.Item.Value,
diff --git a/lib/services/local/presence_test.go b/lib/services/local/presence_test.go
index 3781c96533f..09f03b6d0c1 100644
--- a/lib/services/local/presence_test.go
+++ b/lib/services/local/presence_test.go
@@ -1722,14 +1722,14 @@ func TestPresenceService_RelayServer(t *testing.T) {
 	_, err = p.UpsertRelayServer(ctx, nil)
 	require.ErrorAs(t, err, new(*trace.BadParameterError))
 
-	relayA := &presencev1.RelayServer{
+	relayA := presencev1.RelayServer_builder{
 		Kind:    types.KindRelayServer,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "a",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	upsertedA, err := p.UpsertRelayServer(ctx, gproto.CloneOf(relayA))
 	require.NoError(t, err)
@@ -1757,14 +1757,14 @@ func TestPresenceService_RelayServer(t *testing.T) {
 	err = p.DeleteRelayServer(ctx, "a")
 	require.ErrorAs(t, err, new(*trace.NotFoundError))
 
-	relayB := &presencev1.RelayServer{
+	relayB := presencev1.RelayServer_builder{
 		Kind:    types.KindRelayServer,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "b",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	_, err = p.UpsertRelayServer(ctx, gproto.CloneOf(relayA))
 	require.NoError(t, err)
diff --git a/lib/services/local/provisioning_test.go b/lib/services/local/provisioning_test.go
index fb38074aa58..2ab78d0fbec 100644
--- a/lib/services/local/provisioning_test.go
+++ b/lib/services/local/provisioning_test.go
@@ -340,26 +340,26 @@ func TestProvisioningServiceTokenNameConflict(t *testing.T) {
 	require.NoError(t, err)
 
 	// create a scoped token
-	scopedToken := &joiningv1.ScopedToken{
+	scopedToken := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "testtoken2",
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test/one",
 			JoinMethod:    "token",
 			Roles:         []string{types.RoleNode.String()},
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
-	_, err = scopedTokenService.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		}.Build(),
+	}.Build()
+	_, err = scopedTokenService.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 		Token: scopedToken,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	token.SetName(scopedToken.GetMetadata().GetName())
diff --git a/lib/services/local/provisioningstates.go b/lib/services/local/provisioningstates.go
index c61d82f04b6..2f9403795ae 100644
--- a/lib/services/local/provisioningstates.go
+++ b/lib/services/local/provisioningstates.go
@@ -77,7 +77,7 @@ func (ss *ProvisioningStateService) CreateProvisioningState(ctx context.Context,
 		return nil, trace.Wrap(err, "creating provisioning state record")
 	}
 
-	createdState, err := ss.service.WithPrefix(state.Spec.DownstreamId).CreateResource(ctx, state)
+	createdState, err := ss.service.WithPrefix(state.GetSpec().GetDownstreamId()).CreateResource(ctx, state)
 	if err != nil {
 		return nil, trace.Wrap(err, "creating provisioning state record")
 	}
@@ -91,7 +91,7 @@ func (ss *ProvisioningStateService) UpdateProvisioningState(ctx context.Context,
 		return nil, trace.Wrap(err, "updating provisioning state record")
 	}
 
-	updatedState, err := ss.service.WithPrefix(state.Spec.DownstreamId).ConditionalUpdateResource(ctx, state)
+	updatedState, err := ss.service.WithPrefix(state.GetSpec().GetDownstreamId()).ConditionalUpdateResource(ctx, state)
 	if err != nil {
 		return nil, trace.Wrap(err, "updating provisioning state record")
 	}
@@ -105,7 +105,7 @@ func (ss *ProvisioningStateService) UpsertProvisioningState(ctx context.Context,
 		return nil, trace.Wrap(err, "upserting provisioning state record")
 	}
 
-	updatedState, err := ss.service.WithPrefix(state.Spec.DownstreamId).UpsertResource(ctx, state)
+	updatedState, err := ss.service.WithPrefix(state.GetSpec().GetDownstreamId()).UpsertResource(ctx, state)
 	if err != nil {
 		return nil, trace.Wrap(err, "upserting provisioning state record")
 	}
diff --git a/lib/services/local/provisioningstates_test.go b/lib/services/local/provisioningstates_test.go
index c5640cc3f86..c2e14249af0 100644
--- a/lib/services/local/provisioningstates_test.go
+++ b/lib/services/local/provisioningstates_test.go
@@ -65,24 +65,24 @@ func TestProvisioningUpdate(t *testing.T) {
 		require.NoError(t, err)
 
 		// WHEN I try to fetch the user from Downstream A
-		retrievedStateA, err := uut.GetProvisioningState(ctx, downstreamA, services.ProvisioningStateID(stateA.Metadata.Name))
+		retrievedStateA, err := uut.GetProvisioningState(ctx, downstreamA, services.ProvisioningStateID(stateA.GetMetadata().GetName()))
 
 		// EXPECT the operation to succeed, and  to have retrieved the correct record
 		require.NoError(t, err)
-		require.Equal(t, string(downstreamA), retrievedStateA.Spec.DownstreamId)
+		require.Equal(t, string(downstreamA), retrievedStateA.GetSpec().GetDownstreamId())
 		require.Equal(t,
 			provisioningv1.ProvisioningState_PROVISIONING_STATE_STALE,
-			retrievedStateA.Status.ProvisioningState)
+			retrievedStateA.GetStatus().GetProvisioningState())
 
 		// WHEN I try to fetch the user from Downstream B
-		retrievedStateB, err := uut.GetProvisioningState(ctx, downstreamA, services.ProvisioningStateID(stateB.Metadata.Name))
+		retrievedStateB, err := uut.GetProvisioningState(ctx, downstreamA, services.ProvisioningStateID(stateB.GetMetadata().GetName()))
 
 		// EXPECT the operation to succeed, and  to have retrieved the correct record
 		require.NoError(t, err)
-		require.Equal(t, string(downstreamA), retrievedStateB.Spec.DownstreamId)
+		require.Equal(t, string(downstreamA), retrievedStateB.GetSpec().GetDownstreamId())
 		require.Equal(t,
 			provisioningv1.ProvisioningState_PROVISIONING_STATE_STALE,
-			retrievedStateB.Status.ProvisioningState)
+			retrievedStateB.GetStatus().GetProvisioningState())
 
 	})
 
@@ -96,15 +96,15 @@ func TestProvisioningUpdate(t *testing.T) {
 		require.NoError(t, err)
 
 		// GIVEN also that the resource has been updated...
-		s1, err := uut.GetProvisioningState(ctx, downstreamID, services.ProvisioningStateID(s0.Metadata.Name))
+		s1, err := uut.GetProvisioningState(ctx, downstreamID, services.ProvisioningStateID(s0.GetMetadata().GetName()))
 		require.NoError(t, err)
-		s1.Status.ProvisioningState = provisioningv1.ProvisioningState_PROVISIONING_STATE_PROVISIONED
+		s1.GetStatus().SetProvisioningState(provisioningv1.ProvisioningState_PROVISIONING_STATE_PROVISIONED)
 		_, err = uut.UpdateProvisioningState(ctx, s1)
 		require.NoError(t, err)
 
 		// WHEN I try to update the resource based on the original version...
-		s0.Status.ProvisioningState = provisioningv1.ProvisioningState_PROVISIONING_STATE_STALE
-		s0.Status.Error = "I can't find the database"
+		s0.GetStatus().SetProvisioningState(provisioningv1.ProvisioningState_PROVISIONING_STATE_STALE)
+		s0.GetStatus().SetError("I can't find the database")
 		_, err = uut.UpdateProvisioningState(ctx, s0)
 
 		// EXPECT the update to fail due to optimistic locking
@@ -114,20 +114,20 @@ func TestProvisioningUpdate(t *testing.T) {
 }
 
 func mkUserProvisioningState(username string, downstream services.DownstreamID, initialStatus provisioningv1.ProvisioningState) *provisioningv1.PrincipalState {
-	return &provisioningv1.PrincipalState{
+	return provisioningv1.PrincipalState_builder{
 		Kind:    types.KindProvisioningPrincipalState,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "u-" + username,
-		},
-		Spec: &provisioningv1.PrincipalStateSpec{
+		}.Build(),
+		Spec: provisioningv1.PrincipalStateSpec_builder{
 			DownstreamId:  string(downstream),
 			PrincipalType: provisioningv1.PrincipalType_PRINCIPAL_TYPE_USER,
 			PrincipalId:   username,
-		},
-		Status: &provisioningv1.PrincipalStateStatus{
+		}.Build(),
+		Status: provisioningv1.PrincipalStateStatus_builder{
 			ProvisioningState: initialStatus,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/services/local/recording_encryption.go b/lib/services/local/recording_encryption.go
index 7d503f0876e..46887653e80 100644
--- a/lib/services/local/recording_encryption.go
+++ b/lib/services/local/recording_encryption.go
@@ -80,22 +80,22 @@ func NewRecordingEncryptionService(b backend.Backend) (*RecordingEncryptionServi
 
 // CreateRecordingEncryption creates a new RecordingEncryption in the backend.
 func (s *RecordingEncryptionService) CreateRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error) {
-	if encryption.Metadata == nil {
-		encryption.Metadata = &headerv1.Metadata{}
+	if !encryption.HasMetadata() {
+		encryption.SetMetadata(&headerv1.Metadata{})
 	}
-	encryption.Metadata.Name = types.MetaNameRecordingEncryption
-	encryption.Kind = types.KindRecordingEncryption
+	encryption.GetMetadata().SetName(types.MetaNameRecordingEncryption)
+	encryption.SetKind(types.KindRecordingEncryption)
 	created, err := s.encryption.CreateResource(ctx, encryption)
 	return created, trace.Wrap(err)
 }
 
 // UpdateRecordingEncryption replaces the RecordingEncryption resource with the given one.
 func (s *RecordingEncryptionService) UpdateRecordingEncryption(ctx context.Context, encryption *recordingencryptionv1.RecordingEncryption) (*recordingencryptionv1.RecordingEncryption, error) {
-	if encryption.Metadata == nil {
-		encryption.Metadata = &headerv1.Metadata{}
+	if !encryption.HasMetadata() {
+		encryption.SetMetadata(&headerv1.Metadata{})
 	}
-	encryption.Metadata.Name = types.MetaNameRecordingEncryption
-	encryption.Kind = types.KindRecordingEncryption
+	encryption.GetMetadata().SetName(types.MetaNameRecordingEncryption)
+	encryption.SetKind(types.KindRecordingEncryption)
 	updated, err := s.encryption.ConditionalUpdateResource(ctx, encryption)
 	return updated, trace.Wrap(err)
 }
@@ -122,15 +122,15 @@ func (s *RecordingEncryptionService) CreateRotatedKey(ctx context.Context, key *
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	created, err := s.rotatedKey.CreateResource(ctx, &recordingencryptionv1.RotatedKey{
-		Metadata: &headerv1.Metadata{
+	created, err := s.rotatedKey.CreateResource(ctx, recordingencryptionv1.RotatedKey_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: fp,
-		},
+		}.Build(),
 		Kind: types.KindRotatedKey,
-		Spec: &recordingencryptionv1.RotatedKeySpec{
+		Spec: recordingencryptionv1.RotatedKeySpec_builder{
 			EncryptionKeyPair: key,
-		},
-	})
+		}.Build(),
+	}.Build())
 	return created, trace.Wrap(err)
 }
 
diff --git a/lib/services/local/recording_encryption_test.go b/lib/services/local/recording_encryption_test.go
index 5cdcc75afc8..7fa1a2a31f1 100644
--- a/lib/services/local/recording_encryption_test.go
+++ b/lib/services/local/recording_encryption_test.go
@@ -40,9 +40,9 @@ func TestRecordingEncryption(t *testing.T) {
 	ctx := context.Background()
 
 	initialEncryption := pb.RecordingEncryption{
-		Spec: &pb.RecordingEncryptionSpec{
+		Spec: pb.RecordingEncryptionSpec_builder{
 			ActiveKeyPairs: nil,
-		},
+		}.Build(),
 	}
 
 	// get should fail when there's no recording encryption
@@ -55,28 +55,28 @@ func TestRecordingEncryption(t *testing.T) {
 	encryption, err := service.GetRecordingEncryption(ctx)
 	require.NoError(t, err)
 
-	require.Empty(t, created.Spec.ActiveKeyPairs)
-	require.Empty(t, encryption.Spec.ActiveKeyPairs)
+	require.Empty(t, created.GetSpec().GetActiveKeyPairs())
+	require.Empty(t, encryption.GetSpec().GetActiveKeyPairs())
 
-	encryption.Spec.ActiveKeyPairs = []*pb.KeyPair{
-		{
+	encryption.GetSpec().SetActiveKeyPairs([]*pb.KeyPair{
+		pb.KeyPair_builder{
 			KeyPair: &types.EncryptionKeyPair{
 				PrivateKey: []byte("recording encryption private"),
 				PublicKey:  []byte("recording encryption public"),
 				Hash:       0,
 			},
-		},
-	}
+		}.Build(),
+	})
 
 	updated, err := service.UpdateRecordingEncryption(ctx, encryption)
 	require.NoError(t, err)
-	require.Len(t, updated.Spec.ActiveKeyPairs, 1)
-	require.EqualExportedValues(t, encryption.Spec.ActiveKeyPairs[0], updated.Spec.ActiveKeyPairs[0])
+	require.Len(t, updated.GetSpec().GetActiveKeyPairs(), 1)
+	require.EqualExportedValues(t, encryption.GetSpec().GetActiveKeyPairs()[0], updated.GetSpec().GetActiveKeyPairs()[0])
 
 	encryption, err = service.GetRecordingEncryption(ctx)
 	require.NoError(t, err)
-	require.Len(t, encryption.Spec.ActiveKeyPairs, 1)
-	require.EqualExportedValues(t, updated.Spec.ActiveKeyPairs[0], encryption.Spec.ActiveKeyPairs[0])
+	require.Len(t, encryption.GetSpec().GetActiveKeyPairs(), 1)
+	require.EqualExportedValues(t, updated.GetSpec().GetActiveKeyPairs()[0], encryption.GetSpec().GetActiveKeyPairs()[0])
 
 	err = service.DeleteRecordingEncryption(ctx)
 	require.NoError(t, err)
@@ -112,16 +112,16 @@ func TestRotatedKeys(t *testing.T) {
 		PrivateKeyType: types.PrivateKeyType_RAW,
 	})
 	require.NoError(t, err)
-	require.Equal(t, testRSA4096PrivateKeyPEM, created.Spec.EncryptionKeyPair.PrivateKey)
-	require.Equal(t, publicKeyDER, created.Spec.EncryptionKeyPair.PublicKey)
-	require.Equal(t, types.PrivateKeyType_RAW, created.Spec.EncryptionKeyPair.PrivateKeyType)
+	require.Equal(t, testRSA4096PrivateKeyPEM, created.GetSpec().GetEncryptionKeyPair().PrivateKey)
+	require.Equal(t, publicKeyDER, created.GetSpec().GetEncryptionKeyPair().PublicKey)
+	require.Equal(t, types.PrivateKeyType_RAW, created.GetSpec().GetEncryptionKeyPair().PrivateKeyType)
 
 	rotatedKey, err := service.GetRotatedKey(ctx, fingerprint)
 	require.NoError(t, err)
 
-	require.Equal(t, testRSA4096PrivateKeyPEM, rotatedKey.Spec.EncryptionKeyPair.PrivateKey)
-	require.Equal(t, publicKeyDER, rotatedKey.Spec.EncryptionKeyPair.PublicKey)
-	require.Equal(t, types.PrivateKeyType_RAW, rotatedKey.Spec.EncryptionKeyPair.PrivateKeyType)
+	require.Equal(t, testRSA4096PrivateKeyPEM, rotatedKey.GetSpec().GetEncryptionKeyPair().PrivateKey)
+	require.Equal(t, publicKeyDER, rotatedKey.GetSpec().GetEncryptionKeyPair().PublicKey)
+	require.Equal(t, types.PrivateKeyType_RAW, rotatedKey.GetSpec().GetEncryptionKeyPair().PrivateKeyType)
 
 	err = service.DeleteRotatedKey(ctx, fingerprint)
 	require.NoError(t, err)
diff --git a/lib/services/local/scoped_access.go b/lib/services/local/scoped_access.go
index 9c099c46ccb..0c66cc15844 100644
--- a/lib/services/local/scoped_access.go
+++ b/lib/services/local/scoped_access.go
@@ -97,9 +97,9 @@ func (s *ScopedAccessService) GetScopedRole(ctx context.Context, req *scopedacce
 		return nil, trace.Wrap(err)
 	}
 
-	return &scopedaccessv1.GetScopedRoleResponse{
+	return scopedaccessv1.GetScopedRoleResponse_builder{
 		Role: role,
-	}, nil
+	}.Build(), nil
 }
 
 // ListScopedRoles returns a paginated list of scoped roles.
@@ -130,9 +130,9 @@ func (s *ScopedAccessService) ListScopedRoles(ctx context.Context, req *scopedac
 		out = append(out, role)
 	}
 
-	return &scopedaccessv1.ListScopedRolesResponse{
+	return scopedaccessv1.ListScopedRolesResponse_builder{
 		Roles: out,
-	}, nil
+	}.Build(), nil
 }
 
 // StreamScopedRoles returns a stream of all scoped roles in the backend. Malformed roles are skipped. Returned roles
@@ -196,9 +196,9 @@ func (s *ScopedAccessService) CreateScopedRole(ctx context.Context, req *scopeda
 		return nil, trace.Wrap(err)
 	}
 
-	return &scopedaccessv1.CreateScopedRoleResponse{
+	return scopedaccessv1.CreateScopedRoleResponse_builder{
 		Role: scopedRoleWithRevision(role, lease.Revision),
-	}, nil
+	}.Build(), nil
 }
 
 func (s *ScopedAccessService) UpdateScopedRole(ctx context.Context, req *scopedaccessv1.UpdateScopedRoleRequest) (*scopedaccessv1.UpdateScopedRoleResponse, error) {
@@ -211,9 +211,9 @@ func (s *ScopedAccessService) UpdateScopedRole(ctx context.Context, req *scopeda
 		return nil, trace.Wrap(err)
 	}
 
-	extant, err := s.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	extant, err := s.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: role.GetMetadata().GetName(),
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotFound(err) {
 			// generic condition failure keeps error handling simpler
@@ -250,9 +250,9 @@ func (s *ScopedAccessService) UpdateScopedRole(ctx context.Context, req *scopeda
 		return nil, trace.Wrap(err)
 	}
 
-	return &scopedaccessv1.UpdateScopedRoleResponse{
+	return scopedaccessv1.UpdateScopedRoleResponse_builder{
 		Role: scopedRoleWithRevision(role, lease.Revision),
-	}, nil
+	}.Build(), nil
 }
 
 func (s *ScopedAccessService) DeleteScopedRole(ctx context.Context, req *scopedaccessv1.DeleteScopedRoleRequest) (*scopedaccessv1.DeleteScopedRoleResponse, error) {
@@ -303,35 +303,35 @@ func (s *ScopedAccessService) UpsertScopedRole(ctx context.Context, req *scopeda
 			}
 		}
 
-		existing, err := s.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		existing, err := s.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 			Name: role.GetMetadata().GetName(),
-		})
+		}.Build())
 		if trace.IsNotFound(err) {
-			rsp, err := s.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+			rsp, err := s.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 				Role: role,
-			})
+			}.Build())
 			if err != nil {
 				if trace.IsCompareFailed(err) {
 					continue
 				}
 				return nil, trace.Wrap(err)
 			}
-			return &scopedaccessv1.UpsertScopedRoleResponse{Role: rsp.GetRole()}, nil
+			return scopedaccessv1.UpsertScopedRoleResponse_builder{Role: rsp.GetRole()}.Build(), nil
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		rsp, err := s.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+		rsp, err := s.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 			Role: scopedRoleWithRevision(role, existing.GetRole().GetMetadata().GetRevision()),
-		})
+		}.Build())
 		if err != nil {
 			if trace.IsCompareFailed(err) || trace.IsNotFound(err) {
 				continue
 			}
 			return nil, trace.Wrap(err)
 		}
-		return &scopedaccessv1.UpsertScopedRoleResponse{Role: rsp.GetRole()}, nil
+		return scopedaccessv1.UpsertScopedRoleResponse_builder{Role: rsp.GetRole()}.Build(), nil
 	}
 
 	return nil, trace.LimitExceeded("exceeded max retries attempting to upsert scoped role %q", role.GetMetadata().GetName())
@@ -367,9 +367,9 @@ func (s *ScopedAccessService) GetScopedRoleAssignment(ctx context.Context, req *
 		return nil, trace.Wrap(err)
 	}
 
-	return &scopedaccessv1.GetScopedRoleAssignmentResponse{
+	return scopedaccessv1.GetScopedRoleAssignmentResponse_builder{
 		Assignment: assignment,
-	}, nil
+	}.Build(), nil
 }
 
 // ListScopedRoleAssignments returns a paginated list of scoped role assignments.
@@ -395,9 +395,9 @@ func (s *ScopedAccessService) ListScopedRoleAssignments(ctx context.Context, req
 		out = append(out, assignment)
 	}
 
-	return &scopedaccessv1.ListScopedRoleAssignmentsResponse{
+	return scopedaccessv1.ListScopedRoleAssignmentsResponse_builder{
 		Assignments: out,
-	}, nil
+	}.Build(), nil
 }
 
 // StreamScopedRoleAssignments returns a stream of all scoped role assignments in the backend. Malformed assignments are skipped.
@@ -481,9 +481,9 @@ func (s *ScopedAccessService) CreateScopedRoleAssignment(ctx context.Context, re
 		return nil, trace.Wrap(err)
 	}
 
-	return &scopedaccessv1.CreateScopedRoleAssignmentResponse{
+	return scopedaccessv1.CreateScopedRoleAssignmentResponse_builder{
 		Assignment: scopedRoleAssignmentWithRevision(assignment, lease.Revision),
-	}, nil
+	}.Build(), nil
 }
 
 // UpdateScopedRoleAssignment updates an existing scoped role assignment.
@@ -501,10 +501,10 @@ func (s *ScopedAccessService) UpdateScopedRoleAssignment(ctx context.Context, re
 		return nil, trace.BadParameter("scoped role assignment resource %q contains too many sub-assignments (max %d)", assignment.GetMetadata().GetName(), scopedaccess.MaxRolesPerAssignment)
 	}
 
-	extant, err := s.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+	extant, err := s.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 		Name:    assignment.GetMetadata().GetName(),
 		SubKind: assignment.GetSubKind(),
-	})
+	}.Build())
 	if trace.IsNotFound(err) {
 		// generic condition failure keeps error handling simpler
 		return nil, trace.CompareFailed("scoped role assignment %q not found", assignment.GetMetadata().GetName())
@@ -537,9 +537,9 @@ func (s *ScopedAccessService) UpdateScopedRoleAssignment(ctx context.Context, re
 		return nil, trace.Wrap(err)
 	}
 
-	return &scopedaccessv1.UpdateScopedRoleAssignmentResponse{
+	return scopedaccessv1.UpdateScopedRoleAssignmentResponse_builder{
 		Assignment: scopedRoleAssignmentWithRevision(assignment, lease.Revision),
-	}, nil
+	}.Build(), nil
 }
 
 func (s *ScopedAccessService) UpsertScopedRoleAssignment(ctx context.Context, req *scopedaccessv1.UpsertScopedRoleAssignmentRequest) (*scopedaccessv1.UpsertScopedRoleAssignmentResponse, error) {
@@ -564,35 +564,35 @@ func (s *ScopedAccessService) UpsertScopedRoleAssignment(ctx context.Context, re
 			}
 		}
 
-		_, err := s.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		_, err := s.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    assignment.GetMetadata().GetName(),
 			SubKind: assignment.GetSubKind(),
-		})
+		}.Build())
 		if trace.IsNotFound(err) {
-			rsp, err := s.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+			rsp, err := s.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 				Assignment: assignment,
-			})
+			}.Build())
 			if err != nil {
 				if trace.IsCompareFailed(err) {
 					continue
 				}
 				return nil, trace.Wrap(err)
 			}
-			return &scopedaccessv1.UpsertScopedRoleAssignmentResponse{Assignment: rsp.GetAssignment()}, nil
+			return scopedaccessv1.UpsertScopedRoleAssignmentResponse_builder{Assignment: rsp.GetAssignment()}.Build(), nil
 		}
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
 		// update path
-		ursp, err := s.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{Assignment: assignment})
+		ursp, err := s.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{Assignment: assignment}.Build())
 		if err != nil {
 			if trace.IsCompareFailed(err) || trace.IsNotFound(err) {
 				continue
 			}
 			return nil, trace.Wrap(err)
 		}
-		return &scopedaccessv1.UpsertScopedRoleAssignmentResponse{Assignment: ursp.GetAssignment()}, nil
+		return scopedaccessv1.UpsertScopedRoleAssignmentResponse_builder{Assignment: ursp.GetAssignment()}.Build(), nil
 	}
 
 	return nil, trace.LimitExceeded("exceeded max retries attempting to upsert scoped role assignment %q", assignment.GetMetadata().GetName())
@@ -671,8 +671,8 @@ func scopedRoleFromItem(item *backend.Item) (*scopedaccessv1.ScopedRole, error)
 		return nil, trace.BadParameter("role at %q is critically malformed (missing metadata)", item.Key)
 	}
 
-	role.Metadata.Revision = item.Revision
-	role.Metadata.Expires = utils.TimeIntoProto(item.Expires)
+	role.GetMetadata().SetRevision(item.Revision)
+	role.GetMetadata().SetExpires(utils.TimeIntoProto(item.Expires))
 	return &role, nil
 }
 
@@ -681,7 +681,7 @@ func scopedRoleToItem(role *scopedaccessv1.ScopedRole) (backend.Item, error) {
 		return backend.Item{}, trace.BadParameter("missing metadata in scoped role")
 	}
 
-	if role.GetMetadata().Expires != nil {
+	if role.GetMetadata().HasExpires() {
 		return backend.Item{}, trace.BadParameter("scoped roles do not support expiration")
 	}
 
@@ -707,8 +707,8 @@ func scopedRoleAssignmentFromItem(item *backend.Item) (*scopedaccessv1.ScopedRol
 		return nil, trace.BadParameter("assignment at %q is critically malformed (missing metadata)", item.Key)
 	}
 
-	assignment.Metadata.Revision = item.Revision
-	assignment.Metadata.Expires = utils.TimeIntoProto(item.Expires)
+	assignment.GetMetadata().SetRevision(item.Revision)
+	assignment.GetMetadata().SetExpires(utils.TimeIntoProto(item.Expires))
 	return &assignment, nil
 }
 
@@ -717,7 +717,7 @@ func scopedRoleAssignmentToItem(assignment *scopedaccessv1.ScopedRoleAssignment)
 		return backend.Item{}, trace.BadParameter("missing metadata in scoped role assignment")
 	}
 
-	if assignment.GetMetadata().Expires != nil {
+	if assignment.GetMetadata().HasExpires() {
 		return backend.Item{}, trace.BadParameter("scoped role assignments do not support expiration")
 	}
 
@@ -743,13 +743,13 @@ func scopedRoleAssignmentToItem(assignment *scopedaccessv1.ScopedRoleAssignment)
 // scopedRoleWithRevision creates a copy of the provided role with an updated revision.
 func scopedRoleWithRevision(role *scopedaccessv1.ScopedRole, revision string) *scopedaccessv1.ScopedRole {
 	role = apiutils.CloneProtoMsg(role)
-	role.Metadata.Revision = revision
+	role.GetMetadata().SetRevision(revision)
 	return role
 }
 
 // scopedRoleAssignmentWithRevision creates a shallow copy of the provided assignment with an updated revision.
 func scopedRoleAssignmentWithRevision(assignment *scopedaccessv1.ScopedRoleAssignment, revision string) *scopedaccessv1.ScopedRoleAssignment {
 	assignment = apiutils.CloneProtoMsg(assignment)
-	assignment.Metadata.Revision = revision
+	assignment.GetMetadata().SetRevision(revision)
 	return assignment
 }
diff --git a/lib/services/local/scoped_access_test.go b/lib/services/local/scoped_access_test.go
index 32ed05fff46..a4c0c2ac318 100644
--- a/lib/services/local/scoped_access_test.go
+++ b/lib/services/local/scoped_access_test.go
@@ -88,33 +88,33 @@ func testScopedRoleEvents(t *testing.T) {
 	require.Equal(t, types.OpInit, event.Type)
 
 	// Create a ScopedRole and verify create event is well-formed.
-	role := &scopedaccessv1.ScopedRole{
+	role := scopedaccessv1.ScopedRole_builder{
 		Kind: scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-role",
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/foo", "/bar"},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
-	crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	crsp, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
 	require.Equal(t, types.OpPut, event.Type)
 
 	resource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRole]).UnwrapT()
-	require.Empty(t, cmp.Diff(crsp.Role, resource, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(crsp.GetRole(), resource, protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// delete the role and verify delete event is well-formed.
-	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
-		Name: role.Metadata.Name,
-	})
+	_, err = service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
+		Name: role.GetMetadata().GetName(),
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
@@ -123,52 +123,52 @@ func testScopedRoleEvents(t *testing.T) {
 	require.Empty(t, cmp.Diff(&types.ResourceHeader{
 		Kind: scopedaccess.KindScopedRole,
 		Metadata: types.Metadata{
-			Name: role.Metadata.Name,
+			Name: role.GetMetadata().GetName(),
 		},
 	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
 
 	// recreate scoped role so that we can use it for testing assignment events
-	_, err = service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	_, err = service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: role,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	_ = getNextEvent() // drain the role create event
 
-	assignment := &scopedaccessv1.ScopedRoleAssignment{
+	assignment := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "alice",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
-					Role:  role.Metadata.Name,
+				scopedaccessv1.Assignment_builder{
+					Role:  role.GetMetadata().GetName(),
 					Scope: "/foo",
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
-	acrsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	acrsp, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
 	require.Equal(t, types.OpPut, event.Type)
 	assignmentResource := (event.Resource).(types.Resource153UnwrapperT[*scopedaccessv1.ScopedRoleAssignment]).UnwrapT()
-	require.Empty(t, cmp.Diff(acrsp.Assignment, assignmentResource, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(acrsp.GetAssignment(), assignmentResource, protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// delete the assignment and verify delete event is well-formed.
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:    assignment.Metadata.Name,
-		SubKind: assignment.SubKind,
-	})
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:    assignment.GetMetadata().GetName(),
+		SubKind: assignment.GetSubKind(),
+	}.Build())
 	require.NoError(t, err)
 
 	event = getNextEvent()
@@ -178,14 +178,14 @@ func testScopedRoleEvents(t *testing.T) {
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
 		Metadata: types.Metadata{
-			Name: assignment.Metadata.Name,
+			Name: assignment.GetMetadata().GetName(),
 		},
 	}, event.Resource.(*types.ResourceHeader), protocmp.Transform()))
 
 	// Assert that any materialized assignments put into the backend (possibly
 	// by an auth service on a later version) don't make it into the event
 	// stream. Use the backend directly to skip subkind validation.
-	assignment.SubKind = scopedaccess.SubKindMaterialized
+	assignment.SetSubKind(scopedaccess.SubKindMaterialized)
 	item, err := scopedRoleAssignmentToItem(assignment)
 	require.NoError(t, err)
 	_, err = service.bk.Put(ctx, item)
@@ -215,204 +215,204 @@ func TestScopedRoleBasicCRUD(t *testing.T) {
 	service := NewScopedAccessService(backend)
 
 	basicRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "basic-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/foo"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "basic-02",
-			},
+			}.Build(),
 			Scope: "/bar",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/bar/**"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "basic-03",
-			},
+			}.Build(),
 			Scope: "/baz",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/baz/**"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	var revisions []string
 
 	// verify the expected behavior of CreateScopedRole
 	for _, role := range basicRoles {
-		crsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		crsp, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
-		require.NotEmpty(t, crsp.Role.Metadata.Revision)
-		require.Empty(t, cmp.Diff(role, crsp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+		require.NotEmpty(t, crsp.GetRole().GetMetadata().GetRevision())
+		require.Empty(t, cmp.Diff(role, crsp.GetRole(), protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 		// Check that the role can be retrieved.
-		grsp, err := service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
-			Name: role.Metadata.Name,
-		})
+		grsp, err := service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
+			Name: role.GetMetadata().GetName(),
+		}.Build())
 		require.NoError(t, err)
-		require.Empty(t, cmp.Diff(crsp.Role, grsp.Role, protocmp.Transform() /* deliberately not ignoring revision */))
+		require.Empty(t, cmp.Diff(crsp.GetRole(), grsp.GetRole(), protocmp.Transform() /* deliberately not ignoring revision */))
 
-		revisions = append(revisions, grsp.Role.Metadata.Revision)
+		revisions = append(revisions, grsp.GetRole().GetMetadata().GetRevision())
 	}
 
 	require.Len(t, revisions, len(basicRoles))
 
 	// verify that create fails if the role already exists
-	_, err = service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	_, err = service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: basicRoles[0],
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify a basic allowable update
 	basic01Mod := apiutils.CloneProtoMsg(basicRoles[0])
-	basic01Mod.Spec.AssignableScopes = []string{"/foo", "/bar"}
-	basic01Mod.Metadata.Revision = revisions[0]
+	basic01Mod.GetSpec().SetAssignableScopes([]string{"/foo", "/bar"})
+	basic01Mod.GetMetadata().SetRevision(revisions[0])
 
-	ursp, err := service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	ursp, err := service.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: basic01Mod,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, ursp.Role.Metadata.Revision)
-	require.Empty(t, cmp.Diff(basic01Mod, ursp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.NotEmpty(t, ursp.GetRole().GetMetadata().GetRevision())
+	require.Empty(t, cmp.Diff(basic01Mod, ursp.GetRole(), protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// verify that update really happened
-	grsp, err := service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
-		Name: basic01Mod.Metadata.Name,
-	})
+	grsp, err := service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
+		Name: basic01Mod.GetMetadata().GetName(),
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(ursp.Role, grsp.Role, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(ursp.GetRole(), grsp.GetRole(), protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// verify that update fails if the revision is wrong
-	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	_, err = service.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: basic01Mod,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify that update is rejected if the role's scope is changed
-	basic01Mod = apiutils.CloneProtoMsg(ursp.Role)
-	basic01Mod.Scope = "/foo"
+	basic01Mod = apiutils.CloneProtoMsg(ursp.GetRole())
+	basic01Mod.SetScope("/foo")
 
-	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	_, err = service.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: basic01Mod,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// verify that update fails if the role does not exist
-	_, err = service.UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = service.UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:     "non-existent",
 				Revision: revisions[0],
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/foo"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify that delete fails if the role does not exist
-	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+	_, err = service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 		Name: "non-existent",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 	// verify that delete fails if the revision does not match
-	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
-		Name:     basicRoles[0].Metadata.Name,
+	_, err = service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
+		Name:     basicRoles[0].GetMetadata().GetName(),
 		Revision: revisions[0],
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify successful unconditional delete
-	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
-		Name: basicRoles[0].Metadata.Name,
-	})
+	_, err = service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
+		Name: basicRoles[0].GetMetadata().GetName(),
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that the role is gone
-	_, err = service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
-		Name: basicRoles[0].Metadata.Name,
-	})
+	_, err = service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
+		Name: basicRoles[0].GetMetadata().GetName(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 	// verify successful conditional delete
-	_, err = service.DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
-		Name:     basicRoles[1].Metadata.Name,
+	_, err = service.DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
+		Name:     basicRoles[1].GetMetadata().GetName(),
 		Revision: revisions[1],
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that the role is gone
-	_, err = service.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
-		Name: basicRoles[1].Metadata.Name,
-	})
+	_, err = service.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
+		Name: basicRoles[1].GetMetadata().GetName(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
 	// verify upsert creates when role does not exist
-	basic04 := &scopedaccessv1.ScopedRole{
+	basic04 := scopedaccessv1.ScopedRole_builder{
 		Kind: scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "basic-04",
-		},
+		}.Build(),
 		Scope: "/qux",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/qux"},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
-	uprsp, err := service.UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
+	}.Build()
+	uprsp, err := service.UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
 		Role: basic04,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, uprsp.Role.Metadata.Revision)
-	require.Empty(t, cmp.Diff(basic04, uprsp.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.NotEmpty(t, uprsp.GetRole().GetMetadata().GetRevision())
+	require.Empty(t, cmp.Diff(basic04, uprsp.GetRole(), protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// verify upsert updates when role already exists (including with a stale/wrong revision)
-	basic04Mod := apiutils.CloneProtoMsg(uprsp.Role)
-	basic04Mod.Spec.AssignableScopes = []string{"/qux", "/qux/sub"}
-	basic04Mod.Metadata.Revision = revisions[2] // deliberately stale revision
+	basic04Mod := apiutils.CloneProtoMsg(uprsp.GetRole())
+	basic04Mod.GetSpec().SetAssignableScopes([]string{"/qux", "/qux/sub"})
+	basic04Mod.GetMetadata().SetRevision(revisions[2]) // deliberately stale revision
 
-	uprsp2, err := service.UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
+	uprsp2, err := service.UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
 		Role: basic04Mod,
-	})
+	}.Build())
 	require.NoError(t, err, "upsert should succeed despite stale revision")
-	require.Empty(t, cmp.Diff(basic04Mod, uprsp2.Role, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.Empty(t, cmp.Diff(basic04Mod, uprsp2.GetRole(), protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// verify upsert rejects scope change
-	basic04ScopeChange := apiutils.CloneProtoMsg(uprsp2.Role)
-	basic04ScopeChange.Scope = "/other"
-	basic04ScopeChange.Spec.AssignableScopes = []string{"/other"}
-	_, err = service.UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
+	basic04ScopeChange := apiutils.CloneProtoMsg(uprsp2.GetRole())
+	basic04ScopeChange.SetScope("/other")
+	basic04ScopeChange.GetSpec().SetAssignableScopes([]string{"/other"})
+	_, err = service.UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
 		Role: basic04ScopeChange,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 }
@@ -434,250 +434,250 @@ func TestScopedRoleAssignmentBasicCRD(t *testing.T) {
 	service := NewScopedAccessService(backend)
 
 	roles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-01",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/foo", "/bar"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-02",
-			},
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/foo"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "role-03",
-			},
+			}.Build(),
 			Scope: "/foo",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/foo"},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	var roleRevisions []string
 
 	// Create the roles.
 	for _, role := range roles {
-		rsp, err := service.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+		rsp, err := service.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 			Role: role,
-		})
+		}.Build())
 		require.NoError(t, err)
 
-		roleRevisions = append(roleRevisions, rsp.Role.Metadata.Revision)
+		roleRevisions = append(roleRevisions, rsp.GetRole().GetMetadata().GetRevision())
 	}
 
 	// basic root assignment to test standard CRD operations with
-	assignment01 := &scopedaccessv1.ScopedRoleAssignment{
+	assignment01 := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "alice",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "role-02",
 					Scope: "/", // root scope of effect is not permitted
-				},
+				}.Build(),
 			},
-		},
-		Status: &scopedaccessv1.ScopedRoleAssignmentStatus{
-			Origin: &scopedaccessv1.ScopedRoleAssignmentStatus_Origin{
+		}.Build(),
+		Status: scopedaccessv1.ScopedRoleAssignmentStatus_builder{
+			Origin: scopedaccessv1.ScopedRoleAssignmentStatus_Origin_builder{
 				CreatorKind: scopedaccess.CreatorKindAccessList,
 				CreatorName: "test-list",
-			},
-		},
+			}.Build(),
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
 	// check that root scope of effect is rejected
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// check that a sub-assignment scope outside the assignment's resource scope is rejected
-	assignment01.Spec.Assignments[0].Scope = "/bar" // non-root, but outside resource scope /foo
-	assignment01.Scope = "/foo"
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	assignment01.GetSpec().GetAssignments()[0].SetScope("/bar") // non-root, but outside resource scope /foo
+	assignment01.SetScope("/foo")
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// check that otherwise valid assignment fails if subkind is unset.
-	assignment01.Scope = "/" // fix resource scope
-	assignment01.SubKind = ""
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	assignment01.SetScope("/") // fix resource scope
+	assignment01.SetSubKind("")
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// check that otherwise valid assignment fails if subkind is materialized.
-	assignment01.SubKind = scopedaccess.SubKindMaterialized
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	assignment01.SetSubKind(scopedaccess.SubKindMaterialized)
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// check that otherwise valid assignment fails if subkind is unknown.
-	assignment01.SubKind = "unknown"
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	assignment01.SetSubKind("unknown")
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// check that a valid assignment succeeds
-	assignment01.SubKind = scopedaccess.SubKindDynamic
-	crsp, err := service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	assignment01.SetSubKind(scopedaccess.SubKindDynamic)
+	crsp, err := service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(crsp.Assignment, assignment01, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.NotEmpty(t, crsp.GetAssignment().GetMetadata().GetRevision())
+	require.Empty(t, cmp.Diff(crsp.GetAssignment(), assignment01, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// check that the assignment can be retrieved.
-	grsp, err := service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
-		Name:    assignment01.Metadata.Name,
+	grsp, err := service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
+		Name:    assignment01.GetMetadata().GetName(),
 		SubKind: scopedaccess.SubKindDynamic,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(crsp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(crsp.GetAssignment(), grsp.GetAssignment(), protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// verify that getting a materialized assignment from the backend is an error.
-	_, err = service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
-		Name:    assignment01.Metadata.Name,
+	_, err = service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
+		Name:    assignment01.GetMetadata().GetName(),
 		SubKind: scopedaccess.SubKindMaterialized,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// verify that create fails if the assignment already exists
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify a basic allowable update
-	assignment01Mod := apiutils.CloneProtoMsg(crsp.Assignment)
-	assignment01Mod.Spec.Assignments[0].Scope = "/foo"
-	assignment01Mod.Metadata.Revision = crsp.Assignment.Metadata.Revision
+	assignment01Mod := apiutils.CloneProtoMsg(crsp.GetAssignment())
+	assignment01Mod.GetSpec().GetAssignments()[0].SetScope("/foo")
+	assignment01Mod.GetMetadata().SetRevision(crsp.GetAssignment().GetMetadata().GetRevision())
 
-	ursp, err := service.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
+	ursp, err := service.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01Mod,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, ursp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(assignment01Mod, ursp.Assignment, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.NotEmpty(t, ursp.GetAssignment().GetMetadata().GetRevision())
+	require.Empty(t, cmp.Diff(assignment01Mod, ursp.GetAssignment(), protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// verify that update really happened
-	grsp, err = service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
-		Name:    assignment01Mod.Metadata.Name,
-		SubKind: assignment01Mod.SubKind,
-	})
+	grsp, err = service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
+		Name:    assignment01Mod.GetMetadata().GetName(),
+		SubKind: assignment01Mod.GetSubKind(),
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(ursp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(ursp.GetAssignment(), grsp.GetAssignment(), protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// verify that update fails if the revision is wrong (stale revision from before the update)
-	_, err = service.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
+	_, err = service.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01Mod,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify that update is rejected if the assignment's resource scope is changed
-	assignment01ScopeChange := apiutils.CloneProtoMsg(ursp.Assignment)
-	assignment01ScopeChange.Scope = "/foo"
-	_, err = service.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
+	assignment01ScopeChange := apiutils.CloneProtoMsg(ursp.GetAssignment())
+	assignment01ScopeChange.SetScope("/foo")
+	_, err = service.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment01ScopeChange,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// verify that update fails if the assignment does not exist
-	_, err = service.UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	_, err = service.UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:     "00000000-0000-0000-0000-000000000000",
-				Revision: crsp.Assignment.Metadata.Revision,
-			},
+				Revision: crsp.GetAssignment().GetMetadata().GetRevision(),
+			}.Build(),
 			Scope: "/",
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: "role-02", Scope: "/foo"},
+					scopedaccessv1.Assignment_builder{Role: "role-02", Scope: "/foo"}.Build(),
 				},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify that delete of assignment with incorrect revision fails
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:     assignment01.GetMetadata().GetName(),
 		Revision: roleRevisions[0],
-		SubKind:  crsp.Assignment.SubKind,
-	})
+		SubKind:  crsp.GetAssignment().GetSubKind(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsCompareFailed(err), "expected CompareFailed error, got %v", err)
 
 	// verify that delete of assignment with materialized subkind fails
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
-		Revision: crsp.Assignment.Metadata.Revision,
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:     assignment01.GetMetadata().GetName(),
+		Revision: crsp.GetAssignment().GetMetadata().GetRevision(),
 		SubKind:  scopedaccess.SubKindMaterialized,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// verify that delete of assignment with unknown subkind fails
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
-		Revision: crsp.Assignment.Metadata.Revision,
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:     assignment01.GetMetadata().GetName(),
+		Revision: crsp.GetAssignment().GetMetadata().GetRevision(),
 		SubKind:  "unknown",
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 
 	// verify that delete of assignment with correct revision works
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:     assignment01.Metadata.Name,
-		Revision: ursp.Assignment.Metadata.Revision,
-		SubKind:  ursp.Assignment.SubKind,
-	})
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:     assignment01.GetMetadata().GetName(),
+		Revision: ursp.GetAssignment().GetMetadata().GetRevision(),
+		SubKind:  ursp.GetAssignment().GetSubKind(),
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that the assignment is gone
-	_, err = service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
-		Name:    assignment01.Metadata.Name,
-		SubKind: assignment01.SubKind,
-	})
+	_, err = service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
+		Name:    assignment01.GetMetadata().GetName(),
+		SubKind: assignment01.GetSubKind(),
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsNotFound(err), "expected NotFound error, got %v", err)
 
@@ -685,129 +685,129 @@ func TestScopedRoleAssignmentBasicCRD(t *testing.T) {
 	// assignment02 mixes roles from different resource scopes. cross-resource consistency (e.g. whether
 	// a role at a given resource scope is accessible from the assignment's resource scope) is not enforced
 	// at write time; it is enforced exclusively at the policy decision point.
-	assignment02 := &scopedaccessv1.ScopedRoleAssignment{
+	assignment02 := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "bob",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "role-01",
 					Scope: "/foo",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "role-02",
 					Scope: "/foo/bar",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "role-03", // resource scope /foo, different from assignment resource scope /
 					Scope: "/foo",
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
-	crsp, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	crsp, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment02,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, crsp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(crsp.Assignment, assignment02, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.NotEmpty(t, crsp.GetAssignment().GetMetadata().GetRevision())
+	require.Empty(t, cmp.Diff(crsp.GetAssignment(), assignment02, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// Check that the assignment can be retrieved
-	grsp, err = service.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
-		Name:    assignment02.Metadata.Name,
-		SubKind: assignment02.SubKind,
-	})
+	grsp, err = service.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
+		Name:    assignment02.GetMetadata().GetName(),
+		SubKind: assignment02.GetSubKind(),
+	}.Build())
 	require.NoError(t, err)
-	require.Empty(t, cmp.Diff(crsp.Assignment, grsp.Assignment, protocmp.Transform() /* deliberately not ignoring revision */))
+	require.Empty(t, cmp.Diff(crsp.GetAssignment(), grsp.GetAssignment(), protocmp.Transform() /* deliberately not ignoring revision */))
 
 	// create an assignment that assigns the same role at multiple separate scopes (covers a specific
 	// bug where original impl would construct invalid conditional actions when multiple sub-assignments
 	// are made for the same role).
-	assignment03 := &scopedaccessv1.ScopedRoleAssignment{
+	assignment03 := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "carol",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "role-01",
 					Scope: "/foo",
-				},
-				{
+				}.Build(),
+				scopedaccessv1.Assignment_builder{
 					Role:  "role-01",
 					Scope: "/bar",
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
 	// check that creation of assignment works
-	_, err = service.CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	_, err = service.CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: assignment03,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// verify that deletion of assignment works
-	_, err = service.DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
-		Name:    assignment03.Metadata.Name,
-		SubKind: assignment03.SubKind,
-	})
+	_, err = service.DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
+		Name:    assignment03.GetMetadata().GetName(),
+		SubKind: assignment03.GetSubKind(),
+	}.Build())
 	require.NoError(t, err)
 
 	// verify upsert creates when assignment does not exist
-	assignment04 := &scopedaccessv1.ScopedRoleAssignment{
+	assignment04 := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "dave",
 			Assignments: []*scopedaccessv1.Assignment{
-				{Role: "role-01", Scope: "/foo"},
+				scopedaccessv1.Assignment_builder{Role: "role-01", Scope: "/foo"}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
-	uaprsp, err := service.UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+	}.Build()
+	uaprsp, err := service.UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 		Assignment: assignment04,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, uaprsp.Assignment.Metadata.Revision)
-	require.Empty(t, cmp.Diff(assignment04, uaprsp.Assignment, protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
+	require.NotEmpty(t, uaprsp.GetAssignment().GetMetadata().GetRevision())
+	require.Empty(t, cmp.Diff(assignment04, uaprsp.GetAssignment(), protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
 	// verify upsert updates when assignment already exists (including with a stale/wrong revision)
-	assignment04Mod := apiutils.CloneProtoMsg(uaprsp.Assignment)
-	assignment04Mod.Spec.Assignments = append(assignment04Mod.Spec.Assignments, &scopedaccessv1.Assignment{
+	assignment04Mod := apiutils.CloneProtoMsg(uaprsp.GetAssignment())
+	assignment04Mod.GetSpec().SetAssignments(append(assignment04Mod.GetSpec().GetAssignments(), scopedaccessv1.Assignment_builder{
 		Role: "role-02", Scope: "/foo",
-	})
-	assignment04Mod.Metadata.Revision = roleRevisions[0] // deliberately stale revision
+	}.Build()))
+	assignment04Mod.GetMetadata().SetRevision(roleRevisions[0]) // deliberately stale revision
 
-	uaprsp2, err := service.UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+	uaprsp2, err := service.UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 		Assignment: assignment04Mod,
-	})
+	}.Build())
 	require.NoError(t, err, "upsert should succeed despite stale revision")
-	require.Len(t, uaprsp2.Assignment.Spec.Assignments, 2)
+	require.Len(t, uaprsp2.GetAssignment().GetSpec().GetAssignments(), 2)
 
 	// verify upsert rejects scope change
-	assignment04ScopeChange := apiutils.CloneProtoMsg(uaprsp2.Assignment)
-	assignment04ScopeChange.Scope = "/foo"
-	_, err = service.UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+	assignment04ScopeChange := apiutils.CloneProtoMsg(uaprsp2.GetAssignment())
+	assignment04ScopeChange.SetScope("/foo")
+	_, err = service.UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 		Assignment: assignment04ScopeChange,
-	})
+	}.Build())
 	require.Error(t, err)
 	require.True(t, trace.IsBadParameter(err), "expected BadParameter error, got %v", err)
 }
diff --git a/lib/services/local/scoped_tokens.go b/lib/services/local/scoped_tokens.go
index a4d575716f7..2286cf94031 100644
--- a/lib/services/local/scoped_tokens.go
+++ b/lib/services/local/scoped_tokens.go
@@ -139,10 +139,10 @@ func (s *ScopedTokenService) CreateScopedToken(ctx context.Context, req *joining
 	}
 
 	created := proto.CloneOf(req.GetToken())
-	created.Metadata.Revision = revision
-	return &joiningv1.CreateScopedTokenResponse{
+	created.GetMetadata().SetRevision(revision)
+	return joiningv1.CreateScopedTokenResponse_builder{
 		Token: created,
-	}, nil
+	}.Build(), nil
 }
 
 // GetScopedToken finds and returns a scoped token by name.
@@ -159,7 +159,7 @@ func (s *ScopedTokenService) GetScopedToken(ctx context.Context, req *joiningv1.
 	if !req.GetWithSecret() {
 		setScopedTokenWithoutSecret(token)
 	}
-	return &joiningv1.GetScopedTokenResponse{Token: token}, nil
+	return joiningv1.GetScopedTokenResponse_builder{Token: token}.Build(), nil
 }
 
 // tokenReuseDuration is how long a scoped token can be reused by the host that consumed it
@@ -176,19 +176,17 @@ func (s *ScopedTokenService) UseScopedToken(ctx context.Context, token *joiningv
 		return nil, trace.Wrap(err)
 	}
 
-	if joining.TokenUsageMode(token.Spec.UsageMode) != joining.TokenUsageModeSingle {
+	if joining.TokenUsageMode(token.GetSpec().GetUsageMode()) != joining.TokenUsageModeSingle {
 		return token, nil
 	}
 
 	// make sure the correct, non-nil usage status is set
-	token.Status = cmp.Or(token.Status, &joiningv1.ScopedTokenStatus{})
-	token.Status.Usage = cmp.Or(token.Status.Usage, &joiningv1.UsageStatus{})
-	if token.Status.Usage.Status == nil {
-		token.Status.Usage.Status = &joiningv1.UsageStatus_SingleUse{
-			SingleUse: &joiningv1.SingleUseStatus{},
-		}
+	token.SetStatus(cmp.Or(token.GetStatus(), &joiningv1.ScopedTokenStatus{}))
+	token.GetStatus().SetUsage(cmp.Or(token.GetStatus().GetUsage(), &joiningv1.UsageStatus{}))
+	if !token.GetStatus().GetUsage().HasStatus() {
+		token.GetStatus().GetUsage().SetSingleUse(&joiningv1.SingleUseStatus{})
 	}
-	usage := token.Status.Usage.GetSingleUse()
+	usage := token.GetStatus().GetUsage().GetSingleUse()
 	if usage == nil {
 		return nil, trace.Errorf("single use token does not have a single use status")
 	}
@@ -204,9 +202,9 @@ func (s *ScopedTokenService) UseScopedToken(ctx context.Context, token *joiningv
 	}
 
 	// set the public key if this is the first time this token has been used
-	usage.UsedByFingerprint = fp[:]
-	usage.UsedAt = timestamppb.New(time.Now())
-	usage.ReusableUntil = timestamppb.New(time.Now().Add(tokenReuseDuration))
+	usage.SetUsedByFingerprint(fp[:])
+	usage.SetUsedAt(timestamppb.New(time.Now()))
+	usage.SetReusableUntil(timestamppb.New(time.Now().Add(tokenReuseDuration)))
 
 	token, err := s.svc.ConditionalUpdateResource(ctx, token)
 	if err != nil {
@@ -221,11 +219,11 @@ func evalScopeFilter(filter *scopesv1.Filter, scope string) bool {
 		return true
 	}
 
-	switch filter.Mode {
+	switch filter.GetMode() {
 	case scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE:
-		return scopes.ResourceScope(scope).IsSubjectToScopeOfEffect(filter.Scope)
+		return scopes.ResourceScope(scope).IsSubjectToScopeOfEffect(filter.GetScope())
 	case scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE:
-		return scopes.ScopeOfEffect(scope).AppliesToResourceScope(filter.Scope)
+		return scopes.ScopeOfEffect(scope).AppliesToResourceScope(filter.GetScope())
 	}
 
 	return true
@@ -238,10 +236,10 @@ func (s *ScopedTokenService) ListScopedTokens(ctx context.Context, req *joiningv
 	// backend can choose to perform a simple list operation instead
 	// of a list with filter
 	switch {
-	case req.ResourceScope != nil:
-	case req.AssignedScope != nil:
-	case len(req.Roles) > 0:
-	case len(req.Labels) > 0:
+	case req.HasResourceScope():
+	case req.HasAssignedScope():
+	case len(req.GetRoles()) > 0:
+	case len(req.GetLabels()) > 0:
 	default:
 		tokens, cursor, err := s.svc.ListResources(ctx, int(req.GetLimit()), req.GetCursor())
 
@@ -251,10 +249,10 @@ func (s *ScopedTokenService) ListScopedTokens(ctx context.Context, req *joiningv
 		if !req.GetWithSecrets() {
 			setScopedTokenWithoutSecret(tokens...)
 		}
-		return &joiningv1.ListScopedTokensResponse{
+		return joiningv1.ListScopedTokensResponse_builder{
 			Tokens: tokens,
 			Cursor: cursor,
-		}, nil
+		}.Build(), nil
 	}
 
 	if req.GetAssignedScope().GetScope() != "" {
@@ -277,7 +275,7 @@ func (s *ScopedTokenService) ListScopedTokens(ctx context.Context, req *joiningv
 
 	filterFn := func(token *joiningv1.ScopedToken) bool {
 		if len(req.GetRoles()) > 0 {
-			roles, err := types.NewTeleportRoles(token.Spec.Roles)
+			roles, err := types.NewTeleportRoles(token.GetSpec().GetRoles())
 			if err != nil {
 				return false
 			}
@@ -287,11 +285,11 @@ func (s *ScopedTokenService) ListScopedTokens(ctx context.Context, req *joiningv
 			}
 		}
 
-		if !evalScopeFilter(req.GetAssignedScope(), token.Spec.AssignedScope) {
+		if !evalScopeFilter(req.GetAssignedScope(), token.GetSpec().GetAssignedScope()) {
 			return false
 		}
 
-		if !evalScopeFilter(req.GetResourceScope(), token.Scope) {
+		if !evalScopeFilter(req.GetResourceScope(), token.GetScope()) {
 			return false
 		}
 
@@ -317,10 +315,10 @@ func (s *ScopedTokenService) ListScopedTokens(ctx context.Context, req *joiningv
 		setScopedTokenWithoutSecret(tokens...)
 	}
 
-	return &joiningv1.ListScopedTokensResponse{
+	return joiningv1.ListScopedTokensResponse_builder{
 		Tokens: tokens,
 		Cursor: cursor,
-	}, nil
+	}.Build(), nil
 }
 
 // DeleteScopedToken deletes a scoped token by name.
@@ -359,11 +357,11 @@ func (s *ScopedTokenService) UpsertScopedToken(ctx context.Context, req *joining
 			// Use conditional update with revision checking to ensure the token hasn't changed since we validated it.
 			// This prevents race conditions where the token could be deleted and recreated with
 			// different properties between our validation check and the write.
-			tokenUpsert.GetMetadata().Revision = existingToken.GetMetadata().GetRevision()
+			tokenUpsert.GetMetadata().SetRevision(existingToken.GetMetadata().GetRevision())
 
 			// The status and its secret shouldn't ever change, so preserve it when updates occur. The secret is
 			// should not be changed after creation
-			tokenUpsert.Status = existingToken.GetStatus()
+			tokenUpsert.SetStatus(existingToken.GetStatus())
 
 			if err := joining.StrongValidateToken(tokenUpsert); err != nil {
 				return nil, trace.Wrap(err)
@@ -377,9 +375,9 @@ func (s *ScopedTokenService) UpsertScopedToken(ctx context.Context, req *joining
 				return nil, trace.Wrap(err)
 			}
 
-			return &joiningv1.UpsertScopedTokenResponse{
+			return joiningv1.UpsertScopedTokenResponse_builder{
 				Token: upsertedToken,
-			}, nil
+			}.Build(), nil
 		}
 
 		if err := maybeSetTokenSecret(tokenUpsert); err != nil {
@@ -404,9 +402,9 @@ func (s *ScopedTokenService) UpsertScopedToken(ctx context.Context, req *joining
 			return nil, trace.Wrap(err)
 		}
 
-		return &joiningv1.UpsertScopedTokenResponse{
+		return joiningv1.UpsertScopedTokenResponse_builder{
 			Token: createdToken,
-		}, nil
+		}.Build(), nil
 	}
 
 	return nil, trace.LimitExceeded("exceeded max retries attempting to upsert scoped token - too many concurrent modifications")
@@ -427,7 +425,7 @@ func (s *ScopedTokenService) UpdateScopedToken(ctx context.Context, req *joining
 
 	// The status and its secret shouldn't ever change, so preserve it when updates occur. The secret
 	// should not be changed after creation.
-	tokenUpdate.Status = existingToken.GetStatus()
+	tokenUpdate.SetStatus(existingToken.GetStatus())
 
 	if err := joining.StrongValidateToken(tokenUpdate); err != nil {
 		return nil, trace.Wrap(err)
@@ -437,9 +435,9 @@ func (s *ScopedTokenService) UpdateScopedToken(ctx context.Context, req *joining
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &joiningv1.UpdateScopedTokenResponse{
+	return joiningv1.UpdateScopedTokenResponse_builder{
 		Token: updatedToken,
-	}, nil
+	}.Build(), nil
 }
 
 // PatchScopedToken uses the supplied function to attempt to patch a scoped
@@ -499,14 +497,14 @@ func setScopedTokenWithoutSecret(token ...*joiningv1.ScopedToken) {
 		}
 
 		if ob := t.GetSpec().GetBoundKeypair().GetOnboarding(); ob != nil {
-			ob.RegistrationSecret = ""
+			ob.SetRegistrationSecret("")
 		}
 
-		if t.Status != nil {
-			t.Status.Secret = ""
+		if t.HasStatus() {
+			t.GetStatus().SetSecret("")
 
-			if t.Status.GetUsage().GetBoundKeypair() != nil {
-				t.Status.GetUsage().GetBoundKeypair().RegistrationSecret = ""
+			if t.GetStatus().GetUsage().GetBoundKeypair() != nil {
+				t.GetStatus().GetUsage().GetBoundKeypair().SetRegistrationSecret("")
 			}
 		}
 	}
@@ -605,7 +603,7 @@ func maybeInitBoundKeypair(token *joiningv1.ScopedToken) error {
 	// can assume defaults. (That field is initialized automatically anyway.)
 
 	if spec.GetRecovery() == nil {
-		spec.Recovery = &joiningv1.BoundKeypairSpec_RecoverySpec{}
+		spec.SetRecovery(&joiningv1.BoundKeypairSpec_RecoverySpec{})
 	}
 
 	// Tokens should have a limit of 1 at creation to allow first use without
@@ -613,25 +611,25 @@ func maybeInitBoundKeypair(token *joiningv1.ScopedToken) error {
 	// `RecoveryModeStandard` at join time, and a registration secret is
 	// generated if needed.
 	if spec.GetRecovery().GetLimit() == 0 {
-		spec.GetRecovery().Limit = 1
+		spec.GetRecovery().SetLimit(1)
 	}
 
 	if spec.GetOnboarding() == nil {
-		spec.Onboarding = &joiningv1.BoundKeypairSpec_OnboardingSpec{}
+		spec.SetOnboarding(&joiningv1.BoundKeypairSpec_OnboardingSpec{})
 	}
 
 	if token.GetStatus() == nil {
-		token.Status = &joiningv1.ScopedTokenStatus{}
+		token.SetStatus(&joiningv1.ScopedTokenStatus{})
 	}
 
-	status := token.Status.GetUsage().GetBoundKeypair()
+	status := token.GetStatus().GetUsage().GetBoundKeypair()
 	if status == nil {
 		status = &joiningv1.BoundKeypairStatus{}
-		token.Status.Usage = &joiningv1.UsageStatus{
+		token.GetStatus().SetUsage(&joiningv1.UsageStatus{
 			Status: &joiningv1.UsageStatus_BoundKeypair{
 				BoundKeypair: status,
 			},
-		}
+		})
 	}
 
 	// If necessary, generate a registration secret.
@@ -646,7 +644,7 @@ func maybeInitBoundKeypair(token *joiningv1.ScopedToken) error {
 
 	// If the user specified their own secret, copy that into status.
 	if secret := spec.GetOnboarding().GetRegistrationSecret(); secret != "" {
-		status.RegistrationSecret = secret
+		status.SetRegistrationSecret(secret)
 		return nil
 	}
 
@@ -657,23 +655,23 @@ func maybeInitBoundKeypair(token *joiningv1.ScopedToken) error {
 		return trace.Wrap(err)
 	}
 
-	status.RegistrationSecret = s
+	status.SetRegistrationSecret(s)
 	return nil
 }
 
 // maybeSetTokenSecret sets a random secret if not provided.
 func maybeSetTokenSecret(token *joiningv1.ScopedToken) error {
 	if token.GetSpec().GetJoinMethod() == string(types.JoinMethodToken) {
-		if token.Status == nil {
-			token.Status = &joiningv1.ScopedTokenStatus{}
+		if !token.HasStatus() {
+			token.SetStatus(&joiningv1.ScopedTokenStatus{})
 		}
 
-		if token.Status.Secret == "" {
+		if token.GetStatus().GetSecret() == "" {
 			secret, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
 			if err != nil {
 				return trace.Wrap(err, "generating token secret")
 			}
-			token.Status.Secret = secret
+			token.GetStatus().SetSecret(secret)
 		}
 	}
 
diff --git a/lib/services/local/scoped_tokens_test.go b/lib/services/local/scoped_tokens_test.go
index c9b030fcdda..b4f488ccb5a 100644
--- a/lib/services/local/scoped_tokens_test.go
+++ b/lib/services/local/scoped_tokens_test.go
@@ -54,107 +54,107 @@ func TestScopedTokenService(t *testing.T) {
 
 	ctx := t.Context()
 
-	token := &joiningv1.ScopedToken{
+	token := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "testtoken",
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test/one",
 			Roles:         []string{types.RoleNode.String()},
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
 			JoinMethod:    string(types.JoinMethodToken),
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+	created, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 		Token: token,
-	})
+	}.Build())
 	require.NoError(t, err)
 	cmpOpts := []gocmp.Option{
 		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 		protocmp.Transform(),
 	}
-	assert.Empty(t, gocmp.Diff(token, created.Token, cmpOpts...))
+	assert.Empty(t, gocmp.Diff(token, created.GetToken(), cmpOpts...))
 	// ensure the token secret was set if not specified
-	assert.NotEmpty(t, created.Token.GetStatus().GetSecret())
-	token = created.Token
+	assert.NotEmpty(t, created.GetToken().GetStatus().GetSecret())
+	token = created.GetToken()
 
 	updatedToken := proto.CloneOf(token)
-	updatedToken.Spec.AssignedScope = "/test/test"
+	updatedToken.GetSpec().SetAssignedScope("/test/test")
 
-	updated, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{
+	updated, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{
 		Token: created.GetToken(),
-	})
+	}.Build())
 	require.NoError(t, err)
 
-	fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-		Name: token.Metadata.Name,
-	})
+	fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+		Name: token.GetMetadata().GetName(),
+	}.Build())
 	require.NoError(t, err)
-	require.Equal(t, fetched.Token.Spec.AssignedScope, updated.Token.Spec.AssignedScope)
-	require.Empty(t, fetched.Token.Status.Secret)
+	require.Equal(t, fetched.GetToken().GetSpec().GetAssignedScope(), updated.GetToken().GetSpec().GetAssignedScope())
+	require.Empty(t, fetched.GetToken().GetStatus().GetSecret())
 
 	list, err := service.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{})
 	require.NoError(t, err)
-	require.Len(t, list.Tokens, 1)
+	require.Len(t, list.GetTokens(), 1)
 
-	fetched, err = service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-		Name:       token.Metadata.Name,
+	fetched, err = service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+		Name:       token.GetMetadata().GetName(),
 		WithSecret: true,
-	})
+	}.Build())
 	require.NoError(t, err)
-	require.NotEmpty(t, fetched.Token.Status.Secret)
-	assert.Empty(t, gocmp.Diff(updated.Token, fetched.Token, cmpOpts...))
+	require.NotEmpty(t, fetched.GetToken().GetStatus().GetSecret())
+	assert.Empty(t, gocmp.Diff(updated.GetToken(), fetched.GetToken(), cmpOpts...))
 
-	_, err = service.DeleteScopedToken(ctx, &joiningv1.DeleteScopedTokenRequest{
-		Name: fetched.Token.Metadata.Name,
-	})
+	_, err = service.DeleteScopedToken(ctx, joiningv1.DeleteScopedTokenRequest_builder{
+		Name: fetched.GetToken().GetMetadata().GetName(),
+	}.Build())
 	require.NoError(t, err)
-	_, err = service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-		Name: fetched.Token.Metadata.Name,
-	})
+	_, err = service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+		Name: fetched.GetToken().GetMetadata().GetName(),
+	}.Build())
 	require.True(t, trace.IsNotFound(err))
 
 	expiredToken := proto.CloneOf(token)
-	expiredToken.Metadata.Name = "expiredtoken"
-	expiredToken.Metadata.Expires = timestamppb.New(time.Now().UTC().Add(-25 * time.Hour))
+	expiredToken.GetMetadata().SetName("expiredtoken")
+	expiredToken.GetMetadata().SetExpires(timestamppb.New(time.Now().UTC().Add(-25 * time.Hour)))
 
 	activeToken := proto.CloneOf(token)
-	activeToken.Metadata.Name = "activetoken"
-	activeToken.Metadata.Expires = timestamppb.New(time.Now().UTC().Add(25 * time.Hour))
+	activeToken.GetMetadata().SetName("activetoken")
+	activeToken.GetMetadata().SetExpires(timestamppb.New(time.Now().UTC().Add(25 * time.Hour)))
 
-	expiredRes, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+	expiredRes, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 		Token: expiredToken,
-	})
+	}.Build())
 	require.NoError(t, err)
 
-	activeRes, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+	activeRes, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 		Token: activeToken,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	// expired tokens should error and delete the token
-	expiredToken, err = service.UseScopedToken(ctx, expiredRes.Token, nil)
+	expiredToken, err = service.UseScopedToken(ctx, expiredRes.GetToken(), nil)
 	// If for some reason the expired token is not automatically deleted by the backend, a
 	// LimitExceededError will be returned. Otherwise, we should expect the token not to be found.
 	require.True(t, trace.IsLimitExceeded(err) || trace.IsNotFound(err))
 	require.Nil(t, expiredToken)
 
-	_, err = service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-		Name: expiredRes.Token.Metadata.Name,
-	})
+	_, err = service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+		Name: expiredRes.GetToken().GetMetadata().GetName(),
+	}.Build())
 	require.True(t, trace.IsNotFound(err))
 
-	fetchedActive, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
-		Name:       activeRes.Token.Metadata.Name,
+	fetchedActive, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
+		Name:       activeRes.GetToken().GetMetadata().GetName(),
 		WithSecret: true,
-	})
+	}.Build())
 
 	require.NoError(t, err)
-	assert.Empty(t, gocmp.Diff(activeRes.Token, fetchedActive.Token, cmpOpts...))
+	assert.Empty(t, gocmp.Diff(activeRes.GetToken(), fetchedActive.GetToken(), cmpOpts...))
 }
 
 func TestScopedTokenList(t *testing.T) {
@@ -165,72 +165,72 @@ func TestScopedTokenList(t *testing.T) {
 
 	ctx := t.Context()
 
-	test := &joiningv1.ScopedToken{
+	test := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test",
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test",
 			JoinMethod:    "token",
 			Roles: []string{
 				types.RoleNode.String(),
 			},
 			UsageMode: string(joining.TokenUsageModeUnlimited),
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	test1 := proto.CloneOf(test)
-	test1.Metadata.Name = "test1"
-	test1.Scope = "/test/aa"
-	test1.Spec.AssignedScope = test1.Scope
+	test1.GetMetadata().SetName("test1")
+	test1.SetScope("/test/aa")
+	test1.GetSpec().SetAssignedScope(test1.GetScope())
 
 	test2 := proto.CloneOf(test)
-	test2.Metadata.Name = "test2"
-	test2.Scope = "/test/bb"
-	test2.Spec.AssignedScope = test2.Scope
-	test2.Metadata.Labels = map[string]string{
+	test2.GetMetadata().SetName("test2")
+	test2.SetScope("/test/bb")
+	test2.GetSpec().SetAssignedScope(test2.GetScope())
+	test2.GetMetadata().SetLabels(map[string]string{
 		"hello": "world",
-	}
+	})
 
 	test3 := proto.CloneOf(test)
-	test3.Metadata.Name = "test3"
-	test3.Scope = "/test/aa/bb"
-	test3.Spec.AssignedScope = test3.Scope
+	test3.GetMetadata().SetName("test3")
+	test3.SetScope("/test/aa/bb")
+	test3.GetSpec().SetAssignedScope(test3.GetScope())
 
 	test4 := proto.CloneOf(test)
-	test4.Metadata.Name = "test4"
-	test4.Spec.AssignedScope = "/test/aa"
-	test4.Scope = "/test/aa"
-	test4.Spec.AssignedScope = test4.Scope
+	test4.GetMetadata().SetName("test4")
+	test4.GetSpec().SetAssignedScope("/test/aa")
+	test4.SetScope("/test/aa")
+	test4.GetSpec().SetAssignedScope(test4.GetScope())
 
 	stage := proto.CloneOf(test)
-	stage.Metadata.Name = "stage"
-	stage.Scope = "/stage"
-	stage.Spec.AssignedScope = stage.Scope
+	stage.GetMetadata().SetName("stage")
+	stage.SetScope("/stage")
+	stage.GetSpec().SetAssignedScope(stage.GetScope())
 
 	stage1 := proto.CloneOf(stage)
-	stage1.Metadata.Name = "stage1"
-	stage1.Spec.AssignedScope = "/stage/aa"
+	stage1.GetMetadata().SetName("stage1")
+	stage1.GetSpec().SetAssignedScope("/stage/aa")
 
 	stage2 := proto.CloneOf(stage)
-	stage2.Metadata.Name = "stage2"
-	stage2.Scope = "/stage/aa"
-	stage2.Spec.AssignedScope = "/stage/aa"
+	stage2.GetMetadata().SetName("stage2")
+	stage2.SetScope("/stage/aa")
+	stage2.GetSpec().SetAssignedScope("/stage/aa")
 
 	allTokens := []*joiningv1.ScopedToken{test, test1, test2, test3, test4, stage, stage1, stage2}
 	for _, token := range allTokens {
-		_, err = service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: token})
+		_, err = service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 	}
 
 	sortFn := func(left *joiningv1.ScopedToken, right *joiningv1.ScopedToken) int {
-		return cmp.Compare(left.Metadata.Name, right.Metadata.Name)
+		return cmp.Compare(left.GetMetadata().GetName(), right.GetMetadata().GetName())
 	}
 	cases := []struct {
 		name     string
@@ -239,139 +239,139 @@ func TestScopedTokenList(t *testing.T) {
 	}{
 		{
 			name: "all tokens (no filters)",
-			req: &joiningv1.ListScopedTokensRequest{
+			req: joiningv1.ListScopedTokensRequest_builder{
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4, stage, stage1, stage2},
 		},
 		{
 			name: "tokens assigning scope descendant of /test",
-			req: &joiningv1.ListScopedTokensRequest{
-				AssignedScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				AssignedScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/test",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4},
 		},
 		{
 			name: "tokens assigning scope descendant of /test/aa",
-			req: &joiningv1.ListScopedTokensRequest{
-				AssignedScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				AssignedScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/test/aa",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test1, test3, test4},
 		},
 		{
 			name: "tokens assigning scope ancestor to /test/bb",
-			req: &joiningv1.ListScopedTokensRequest{
-				AssignedScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				AssignedScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/test/bb",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test, test2},
 		},
 		{
 			name: "tokens descendants of /test",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/test",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4},
 		},
 		{
 			name: "tokens descendants of /test/aa",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/test/aa",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test1, test3, test4},
 		},
 		{
 			name: "tokens ancestor to /test/bb",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_POLICIES_APPLICABLE_TO_SCOPE,
 					Scope: "/test/bb",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test, test2},
 		},
 		{
 			name: "tokens descendant of /stage assigning /stage/aa",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/stage",
-				},
-				AssignedScope: &scopesv1.Filter{
+				}.Build(),
+				AssignedScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/stage/aa",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{stage1, stage2},
 		},
 		{
 			name: "tokens descendant of /stage/aa assigning /stage/aa",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/stage/aa",
-				},
-				AssignedScope: &scopesv1.Filter{
+				}.Build(),
+				AssignedScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/stage/aa",
-				},
+				}.Build(),
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{stage2},
 		},
 		{
 			name: "tokens in /test scope applying auth role",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/test",
-				},
+				}.Build(),
 				Roles:       []string{types.RoleAuth.String()},
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{},
 		},
 		{
 			name: "tokens in /test scope filtered by label",
-			req: &joiningv1.ListScopedTokensRequest{
-				ResourceScope: &scopesv1.Filter{
+			req: joiningv1.ListScopedTokensRequest_builder{
+				ResourceScope: scopesv1.Filter_builder{
 					Mode:  scopesv1.Mode_MODE_RESOURCES_SUBJECT_TO_SCOPE,
 					Scope: "/test",
-				},
+				}.Build(),
 				Roles: []string{types.RoleNode.String()},
 				Labels: map[string]string{
 					"hello": "world",
 				},
 				WithSecrets: true,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test2},
 		},
 		{
 			name: "tokens have no secrets when WithSecrets is false",
-			req: &joiningv1.ListScopedTokensRequest{
+			req: joiningv1.ListScopedTokensRequest_builder{
 				WithSecrets: false,
-			},
+			}.Build(),
 			expected: []*joiningv1.ScopedToken{test, test1, test2, test3, test4, stage, stage1, stage2},
 		},
 	}
@@ -379,7 +379,7 @@ func TestScopedTokenList(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			req := proto.CloneOf(c.req)
-			req.Limit = 10
+			req.SetLimit(10)
 			res, err := service.ListScopedTokens(ctx, req)
 			require.NoError(t, err)
 
@@ -390,11 +390,11 @@ func TestScopedTokenList(t *testing.T) {
 				protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 				protocmp.Transform(),
 			}
-			if !req.WithSecrets {
+			if !req.GetWithSecrets() {
 				cmpOpts = append(cmpOpts, protocmp.IgnoreFields(&joiningv1.ScopedTokenStatus{}, "secret"))
 			}
 			for i, token := range res.GetTokens() {
-				if !req.WithSecrets {
+				if !req.GetWithSecrets() {
 					assert.Empty(t, token.GetStatus().GetSecret())
 				}
 				assert.Empty(t, gocmp.Diff(c.expected[i], token, cmpOpts...))
@@ -413,35 +413,35 @@ func TestScopedTokenNameCollisions(t *testing.T) {
 
 	ctx := t.Context()
 
-	token := &joiningv1.ScopedToken{
+	token := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "testtoken",
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test/one",
 			JoinMethod:    "token",
 			Roles:         []string{types.RoleNode.String()},
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	t.Run("basic", func(t *testing.T) {
 		// create initial scoped token
-		_, err = service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		_, err = service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 			Token: token,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		// assert that creating another scoped token with the same name fails
-		_, err = service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		_, err = service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 			Token: token,
-		})
+		}.Build())
 		require.True(t, trace.IsAlreadyExists(err))
 
 		// create a 'classic' token
@@ -461,10 +461,10 @@ func TestScopedTokenNameCollisions(t *testing.T) {
 		// assert that creating a scoped token with a name that conflicts with
 		// a classic token fails
 		conflictWithClassic := proto.CloneOf(token)
-		conflictWithClassic.Metadata.Name = classicToken.GetName()
-		_, err = service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		conflictWithClassic.GetMetadata().SetName(classicToken.GetName())
+		_, err = service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 			Token: conflictWithClassic,
-		})
+		}.Build())
 		require.True(t, trace.IsAlreadyExists(err))
 	})
 
@@ -489,10 +489,10 @@ func TestScopedTokenNameCollisions(t *testing.T) {
 
 			wg.Go(func() {
 				token := proto.CloneOf(token)
-				token.Metadata.Name = name
-				_, scopedErr = service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+				token.GetMetadata().SetName(name)
+				_, scopedErr = service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 					Token: token,
-				})
+				}.Build())
 			})
 			wg.Wait()
 
@@ -518,28 +518,28 @@ func TestScopedTokenUse(t *testing.T) {
 
 		ctx := t.Context()
 
-		token := &joiningv1.ScopedToken{
+		token := joiningv1.ScopedToken_builder{
 			Kind:    types.KindScopedToken,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    "testtoken",
 				Expires: timestamppb.New(time.Now().Add(24 * time.Hour)),
-			},
+			}.Build(),
 			Scope: "/test",
-			Spec: &joiningv1.ScopedTokenSpec{
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				AssignedScope: "/test/one",
 				JoinMethod:    "token",
 				Roles:         []string{types.RoleNode.String()},
 				UsageMode:     string(joining.TokenUsageModeSingle),
-			},
-			Status: &joiningv1.ScopedTokenStatus{
+			}.Build(),
+			Status: joiningv1.ScopedTokenStatus_builder{
 				Secret: "secret",
-			},
-		}
+			}.Build(),
+		}.Build()
 
-		created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
+		created, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
 			Token: token,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		testKey := []byte("test")
@@ -577,34 +577,34 @@ func TestScopedTokenUse(t *testing.T) {
 }
 
 func newToken() *joiningv1.ScopedToken {
-	return &joiningv1.ScopedToken{
+	return joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/test/one",
 			JoinMethod:    "token",
 			Roles:         []string{types.RoleNode.String()},
 			UsageMode:     string(joining.TokenUsageModeUnlimited),
-		},
-		Status: &joiningv1.ScopedTokenStatus{
+		}.Build(),
+		Status: joiningv1.ScopedTokenStatus_builder{
 			Secret: "secret",
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func newBoundKeypairToken() *joiningv1.ScopedToken {
-	return &joiningv1.ScopedToken{
+	return joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: uuid.New().String(),
-		},
+		}.Build(),
 		Scope: "/test",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "",
 			BotName:       "example",
 			BotScope:      "/test",
@@ -612,8 +612,8 @@ func newBoundKeypairToken() *joiningv1.ScopedToken {
 			Roles:         []string{types.RoleBot.String()},
 			UsageMode:     string(joining.TokenUsageModeBot),
 			BoundKeypair:  &joiningv1.BoundKeypairSpec{},
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func TestScopedTokenUpdate(t *testing.T) {
@@ -633,8 +633,8 @@ func TestScopedTokenUpdate(t *testing.T) {
 		{
 			name: "mutable fields are updated",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Metadata.Labels = map[string]string{"env": "test"}
-				update.Spec.AssignedScope = "/test/one/two"
+				update.GetMetadata().SetLabels(map[string]string{"env": "test"})
+				update.GetSpec().SetAssignedScope("/test/one/two")
 			},
 			assert: func(t *testing.T, created, result *joiningv1.ScopedToken, err error) {
 				require.Equal(t, "/test/one/two", result.GetSpec().GetAssignedScope())
@@ -644,7 +644,7 @@ func TestScopedTokenUpdate(t *testing.T) {
 		{
 			name: "scope changes result in an error",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Scope = "/other"
+				update.SetScope("/other")
 			},
 			assert: func(t *testing.T, created, result *joiningv1.ScopedToken, err error) {
 				require.ErrorContains(t, err, "cannot modify scope of existing scoped token")
@@ -654,7 +654,7 @@ func TestScopedTokenUpdate(t *testing.T) {
 		{
 			name: "usage mode changes result in an error",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Spec.UsageMode = string(joining.TokenUsageModeSingle)
+				update.GetSpec().SetUsageMode(string(joining.TokenUsageModeSingle))
 			},
 			assert: func(t *testing.T, created, result *joiningv1.ScopedToken, err error) {
 				require.ErrorContains(t, err, "cannot modify usage mode of existing scoped token")
@@ -663,7 +663,7 @@ func TestScopedTokenUpdate(t *testing.T) {
 		{
 			name: "secret change is not allowed",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Status = &joiningv1.ScopedTokenStatus{Secret: "new-secret"}
+				update.SetStatus(joiningv1.ScopedTokenStatus_builder{Secret: "new-secret"}.Build())
 			},
 			assert: func(t *testing.T, created, result *joiningv1.ScopedToken, err error) {
 				require.ErrorContains(t, err, "cannot modify secret of existing scoped token")
@@ -672,7 +672,7 @@ func TestScopedTokenUpdate(t *testing.T) {
 		{
 			name: "assigned scope changed to a non-descendant scope fails",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Spec.AssignedScope = "/notadescendant"
+				update.GetSpec().SetAssignedScope("/notadescendant")
 			},
 			assert: func(t *testing.T, created, result *joiningv1.ScopedToken, err error) {
 				require.ErrorContains(t, err, "scoped token assigned scope must be descendant of or equivalent to the token's resource scope")
@@ -684,13 +684,13 @@ func TestScopedTokenUpdate(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 			token := newToken()
-			created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: token})
+			created, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{Token: token}.Build())
 			require.NoError(t, err)
 
 			updated := proto.CloneOf(created.GetToken())
 			tc.mutate(t, updated)
 
-			res, err := service.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{Token: updated})
+			res, err := service.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{Token: updated}.Build())
 
 			tc.assert(t, created.GetToken(), res.GetToken(), err)
 		})
@@ -699,28 +699,28 @@ func TestScopedTokenUpdate(t *testing.T) {
 	t.Run("fails for nonexistent token", func(t *testing.T) {
 		t.Parallel()
 		token := newToken()
-		_, err := service.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{Token: token})
+		_, err := service.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{Token: token}.Build())
 		require.True(t, trace.IsNotFound(err))
 	})
 
 	t.Run("editing concurrently fails since revision doesn't match", func(t *testing.T) {
 		t.Parallel()
 		token := newToken()
-		created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: token})
+		created, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
 		updated := proto.CloneOf(created.GetToken())
-		updated.Metadata.Labels = map[string]string{"env": "test"}
-		updated.Spec.AssignedScope = "/test/one/two"
+		updated.GetMetadata().SetLabels(map[string]string{"env": "test"})
+		updated.GetSpec().SetAssignedScope("/test/one/two")
 
 		updated2 := proto.CloneOf(updated)
-		updated2.Metadata.Labels = map[string]string{"env": "production"}
+		updated2.GetMetadata().SetLabels(map[string]string{"env": "production"})
 
-		updateRes1, err := service.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{Token: updated})
+		updateRes1, err := service.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{Token: updated}.Build())
 		require.NoError(t, err)
 		require.Equal(t, "test", updateRes1.GetToken().GetMetadata().GetLabels()["env"])
 
-		_, err = service.UpdateScopedToken(ctx, &joiningv1.UpdateScopedTokenRequest{Token: updated2})
+		_, err = service.UpdateScopedToken(ctx, joiningv1.UpdateScopedTokenRequest_builder{Token: updated2}.Build())
 		require.True(t, trace.IsCompareFailed(err))
 	})
 }
@@ -743,13 +743,13 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Parallel()
 		token := newToken()
 
-		upsertedToken, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		upsertedToken, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
-		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       upsertedToken.GetToken().GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		assert.Empty(t, gocmp.Diff(upsertedToken.GetToken(), fetched.GetToken(), cmpOpts...))
 	})
@@ -758,22 +758,22 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Parallel()
 		// Submit a minimal token with no name, join method, or secret — the
 		// create path of UpsertScopedToken will fill in missing information
-		token := &joiningv1.ScopedToken{
+		token := joiningv1.ScopedToken_builder{
 			Kind:    types.KindScopedToken,
 			Version: types.V1,
 			Scope:   "/test",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.New().String(),
-			},
-			Spec: &joiningv1.ScopedTokenSpec{
+			}.Build(),
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				AssignedScope: "/test/one",
 				Roles:         []string{types.RoleNode.String()},
 				UsageMode:     string(joining.TokenUsageModeUnlimited),
 				JoinMethod:    string(types.JoinMethodToken),
-			},
-		}
+			}.Build(),
+		}.Build()
 
-		upserted, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		upserted, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 		require.NotEmpty(t, upserted.GetToken().GetMetadata().GetName(), "name should be generated")
 		require.Equal(t, string(types.JoinMethodToken), upserted.GetToken().GetSpec().GetJoinMethod(), "join method should default to token")
@@ -783,20 +783,20 @@ func TestScopedTokenUpsert(t *testing.T) {
 	t.Run("upsert updates existing entry", func(t *testing.T) {
 		t.Parallel()
 		token := newToken()
-		_, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		_, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
 		updated := proto.CloneOf(token)
-		updated.Metadata.Labels = map[string]string{"env": "test"}
-		updated.Spec.AssignedScope = "/test/one/two"
+		updated.GetMetadata().SetLabels(map[string]string{"env": "test"})
+		updated.GetSpec().SetAssignedScope("/test/one/two")
 
-		updatedToken, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: updated})
+		updatedToken, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: updated}.Build())
 		require.NoError(t, err)
 
-		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       token.GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		assert.Empty(t, gocmp.Diff(updatedToken.GetToken(), fetched.GetToken(), cmpOpts...))
 	})
@@ -805,9 +805,9 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Parallel()
 
 		token := newBoundKeypairToken()
-		token.Spec.BoundKeypair = nil
+		token.GetSpec().ClearBoundKeypair()
 
-		_, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		_, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.ErrorContains(t, err, "bound_keypair tokens require a non-nil spec.bound_keypair")
 	})
 
@@ -816,7 +816,7 @@ func TestScopedTokenUpsert(t *testing.T) {
 
 		token := newBoundKeypairToken()
 
-		upserted, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		upserted, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
 		spec := upserted.GetToken().GetSpec().GetBoundKeypair()
@@ -835,11 +835,11 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Parallel()
 
 		token := newBoundKeypairToken()
-		token.Spec.BoundKeypair.Onboarding = &joiningv1.BoundKeypairSpec_OnboardingSpec{
+		token.GetSpec().GetBoundKeypair().SetOnboarding(joiningv1.BoundKeypairSpec_OnboardingSpec_builder{
 			RegistrationSecret: "abc123",
-		}
+		}.Build())
 
-		upserted, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		upserted, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
 		status := upserted.GetToken().GetStatus().GetUsage().GetBoundKeypair()
@@ -850,11 +850,11 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Parallel()
 
 		token := newBoundKeypairToken()
-		token.Spec.BoundKeypair.Onboarding = &joiningv1.BoundKeypairSpec_OnboardingSpec{
+		token.GetSpec().GetBoundKeypair().SetOnboarding(joiningv1.BoundKeypairSpec_OnboardingSpec_builder{
 			InitialPublicKey: "abc123",
-		}
+		}.Build())
 
-		upserted, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		upserted, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
 		status := upserted.GetToken().GetStatus().GetUsage().GetBoundKeypair()
@@ -871,16 +871,16 @@ func TestScopedTokenUpsert(t *testing.T) {
 		{
 			name: "scope is changed",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Scope = "/other"
-				update.Spec.AssignedScope = "/other/one"
+				update.SetScope("/other")
+				update.GetSpec().SetAssignedScope("/other/one")
 			},
 			wantErr: "cannot modify scope of existing scoped token",
 		},
 		{
 			name: "usage mode is changed",
 			mutate: func(t *testing.T, update *joiningv1.ScopedToken) {
-				update.Spec = proto.CloneOf(update.Spec)
-				update.Spec.UsageMode = string(joining.TokenUsageModeSingle)
+				update.SetSpec(proto.CloneOf(update.GetSpec()))
+				update.GetSpec().SetUsageMode(string(joining.TokenUsageModeSingle))
 			},
 			wantErr: "cannot modify usage mode of existing scoped token",
 		},
@@ -890,13 +890,13 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Run("upsert fails because "+tc.name, func(t *testing.T) {
 			t.Parallel()
 			token := newToken()
-			_, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+			_, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 			require.NoError(t, err)
 
 			updated := proto.CloneOf(token)
 			tc.mutate(t, updated)
 
-			_, err = service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: updated})
+			_, err = service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: updated}.Build())
 			require.ErrorContains(t, err, tc.wantErr)
 		})
 	}
@@ -904,24 +904,24 @@ func TestScopedTokenUpsert(t *testing.T) {
 	t.Run("secret is preserved when not included", func(t *testing.T) {
 		t.Parallel()
 		token := newToken()
-		created, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		created, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 		originalSecret := created.GetToken().GetStatus().GetSecret()
 		require.NotEmpty(t, originalSecret)
 
 		// attempt to overwrite the secret via upsert
 		updated := proto.CloneOf(token)
-		updated.Status = nil
+		updated.ClearStatus()
 
 		// upsert should succeed but preserve the original secret
-		_, err = service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: updated})
+		_, err = service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: updated}.Build())
 		require.NoError(t, err)
 
 		// confirm the original secret is still in place
-		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       token.GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.Equal(t, originalSecret, fetched.GetToken().GetStatus().GetSecret())
 	})
@@ -930,32 +930,32 @@ func TestScopedTokenUpsert(t *testing.T) {
 		t.Parallel()
 		token := newToken()
 
-		_, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: token})
+		_, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
-		fetched1, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		fetched1, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       token.GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		update1 := proto.CloneOf(fetched1.GetToken())
-		update1.Metadata.Labels = map[string]string{"env": "production"}
-		_, err = service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: update1})
+		update1.GetMetadata().SetLabels(map[string]string{"env": "production"})
+		_, err = service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: update1}.Build())
 		require.NoError(t, err)
 
 		// This should succeed as we set the revision before comparing
 		update2 := proto.CloneOf(fetched1.GetToken())
-		update2.GetMetadata().Revision = "somerev"
-		update2.Metadata.Labels = map[string]string{"env": "staging"}
-		_, err = service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: update2})
+		update2.GetMetadata().SetRevision("somerev")
+		update2.GetMetadata().SetLabels(map[string]string{"env": "staging"})
+		_, err = service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: update2}.Build())
 		require.NoError(t, err, "upsert should succeed with retry on modification with stale revision")
 
 		// Verify that update2 succeeded and overwrote update1's label
-		final, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		final, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       token.GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.Equal(t, "staging", final.GetToken().GetMetadata().GetLabels()["env"])
 	})
@@ -973,20 +973,20 @@ func TestScopedTokenUpsert(t *testing.T) {
 		for i := range numUsers {
 			wg.Go(func() error {
 				update := proto.CloneOf(token)
-				update.Metadata.Labels = map[string]string{
+				update.GetMetadata().SetLabels(map[string]string{
 					"user": fmt.Sprintf("user-%d", i),
-				}
-				_, err := service.UpsertScopedToken(ctx, &joiningv1.UpsertScopedTokenRequest{Token: update})
+				})
+				_, err := service.UpsertScopedToken(ctx, joiningv1.UpsertScopedTokenRequest_builder{Token: update}.Build())
 				return err
 			})
 		}
 		require.NoError(t, wg.Wait(), "concurrent upserts should all succeed")
 
 		// Verify the token still exists and is consistent.
-		final, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		final, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       token.GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		require.NotNil(t, final.GetToken())
 		// One of the concurrent writers must have won; the label should
@@ -1014,13 +1014,13 @@ func TestScopedTokenCreate(t *testing.T) {
 		t.Parallel()
 		token := newToken()
 
-		created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: token})
+		created, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
-		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       created.GetToken().GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 		assert.Empty(t, gocmp.Diff(created.GetToken(), fetched.GetToken(), cmpOpts...))
 	})
@@ -1028,14 +1028,14 @@ func TestScopedTokenCreate(t *testing.T) {
 	t.Run("create a token with no secret", func(t *testing.T) {
 		t.Parallel()
 		token := newToken()
-		token.Status.Secret = ""
-		created, err := service.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{Token: token})
+		token.GetStatus().SetSecret("")
+		created, err := service.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{Token: token}.Build())
 		require.NoError(t, err)
 
-		fetched, err := service.GetScopedToken(ctx, &joiningv1.GetScopedTokenRequest{
+		fetched, err := service.GetScopedToken(ctx, joiningv1.GetScopedTokenRequest_builder{
 			Name:       created.GetToken().GetMetadata().GetName(),
 			WithSecret: true,
-		})
+		}.Build())
 		require.NoError(t, err)
 
 		opts := append(slices.Clone(cmpOpts), protocmp.IgnoreFields(&joiningv1.ScopedTokenStatus{}, "secret"))
diff --git a/lib/services/local/spiffe_federations_test.go b/lib/services/local/spiffe_federations_test.go
index 50e839b0e90..c3c65ba29cc 100644
--- a/lib/services/local/spiffe_federations_test.go
+++ b/lib/services/local/spiffe_federations_test.go
@@ -37,20 +37,20 @@ import (
 )
 
 func newSPIFFEFederation(name string) *machineidv1.SPIFFEFederation {
-	return &machineidv1.SPIFFEFederation{
+	return machineidv1.SPIFFEFederation_builder{
 		Kind:    types.KindSPIFFEFederation,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &machineidv1.SPIFFEFederationSpec{
-			BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-				HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+		}.Build(),
+		Spec: machineidv1.SPIFFEFederationSpec_builder{
+			BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+				HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 					BundleEndpointUrl: "https://example.com/bundle.json",
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 func setupSPIFFEFederationTest(
@@ -80,7 +80,7 @@ func TestSPIFFEFederationService_CreateSPIFFEFederation(t *testing.T) {
 			proto.Clone(want).(*machineidv1.SPIFFEFederation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -122,7 +122,7 @@ func TestSPIFFEFederationService_UpsertSPIFFEFederation(t *testing.T) {
 			proto.Clone(want).(*machineidv1.SPIFFEFederation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -210,7 +210,7 @@ func TestSPIFFEFederationService_GetSPIFFEFederation(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetSPIFFEFederation(ctx, "example.com")
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -288,7 +288,7 @@ func TestSPIFFEFederationService_UpdateSPIFFEFederation(t *testing.T) {
 		)
 		require.NoError(t, err)
 		want := proto.Clone(created).(*machineidv1.SPIFFEFederation)
-		want.Spec.BundleSource.HttpsWeb.BundleEndpointUrl = "https://example.com/new-bundle.json"
+		want.GetSpec().GetBundleSource().GetHttpsWeb().SetBundleEndpointUrl("https://example.com/new-bundle.json")
 
 		updated, err := service.UpdateSPIFFEFederation(
 			ctx,
@@ -296,7 +296,7 @@ func TestSPIFFEFederationService_UpdateSPIFFEFederation(t *testing.T) {
 			proto.Clone(want).(*machineidv1.SPIFFEFederation),
 		)
 		require.NoError(t, err)
-		require.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		require.NotEqual(t, created.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			updated,
@@ -312,7 +312,7 @@ func TestSPIFFEFederationService_UpdateSPIFFEFederation(t *testing.T) {
 			protocmp.Transform(),
 			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 		))
-		require.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+		require.Equal(t, updated.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 	})
 	t.Run("validation occurs", func(t *testing.T) {
 		out, err := service.UpdateSPIFFEFederation(ctx, newSPIFFEFederation("spiffe://i-will-fail"))
diff --git a/lib/services/local/stableunixusers.go b/lib/services/local/stableunixusers.go
index a10a1b3cc12..a846b02883c 100644
--- a/lib/services/local/stableunixusers.go
+++ b/lib/services/local/stableunixusers.go
@@ -146,10 +146,10 @@ func (s *StableUNIXUsersService) SearchFreeUID(ctx context.Context, first int32,
 
 // AppendCreateUsernameUID implements [services.StableUNIXUsersInternal].
 func (s *StableUNIXUsersService) AppendCreateStableUNIXUser(actions []backend.ConditionalAction, username string, uid int32) ([]backend.ConditionalAction, error) {
-	b, err := proto.Marshal(&stableunixusersv1.StableUNIXUser{
+	b, err := proto.Marshal(stableunixusersv1.StableUNIXUser_builder{
 		Username: username,
 		Uid:      uid,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/services/local/statichostuser_test.go b/lib/services/local/statichostuser_test.go
index 0c9cccd4168..ae6515fdbee 100644
--- a/lib/services/local/statichostuser_test.go
+++ b/lib/services/local/statichostuser_test.go
@@ -135,15 +135,15 @@ func TestUpdateStaticHostUser(t *testing.T) {
 	key := getStaticHostUser(0).GetMetadata().GetName()
 	obj, err := service.GetStaticHostUser(ctx, key)
 	require.NoError(t, err)
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	objUpdated, err := service.UpdateStaticHostUser(ctx, obj)
 	require.NoError(t, err)
-	require.Equal(t, expiry, objUpdated.Metadata.Expires)
+	require.Equal(t, expiry, objUpdated.GetMetadata().GetExpires())
 
 	objFresh, err := service.GetStaticHostUser(ctx, key)
 	require.NoError(t, err)
-	require.Equal(t, expiry, objFresh.Metadata.Expires)
+	require.Equal(t, expiry, objFresh.GetMetadata().GetExpires())
 }
 
 func TestUpdateStaticHostUserMissingRevision(t *testing.T) {
@@ -156,7 +156,7 @@ func TestUpdateStaticHostUserMissingRevision(t *testing.T) {
 	expiry := timestamppb.New(time.Now().Add(30 * time.Minute))
 
 	obj := getStaticHostUser(0)
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	// Update should be rejected as the revision is missing.
 	_, err := service.UpdateStaticHostUser(ctx, obj)
@@ -264,21 +264,21 @@ func getStaticHostUserService(t *testing.T) services.StaticHostUser {
 
 func getStaticHostUser(index int) *userprovisioningpb.StaticHostUser {
 	name := fmt.Sprintf("obj%v", index)
-	return userprovisioning.NewStaticHostUser(name, &userprovisioningpb.StaticHostUserSpec{
+	return userprovisioning.NewStaticHostUser(name, userprovisioningpb.StaticHostUserSpec_builder{
 		Matchers: []*userprovisioningpb.Matcher{
-			{
+			userprovisioningpb.Matcher_builder{
 				NodeLabels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "foo",
 						Values: []string{"bar"},
-					},
+					}.Build(),
 				},
 				Groups: []string{"foo", "bar"},
 				Uid:    1234,
 				Gid:    5678,
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 }
 
 func prepopulateStaticHostUsers(t *testing.T, service services.StaticHostUser, count int) {
diff --git a/lib/services/local/subca_service.go b/lib/services/local/subca_service.go
index b7963919a03..eea6bb4cb64 100644
--- a/lib/services/local/subca_service.go
+++ b/lib/services/local/subca_service.go
@@ -241,14 +241,14 @@ func (p *certAuthorityOverrideParser) parse(event backend.Event) (types.Resource
 		name := parts[0]
 		subKind := parts[1]
 
-		return types.Resource153ToLegacy(&subcav1.CertAuthorityOverride{
+		return types.Resource153ToLegacy(subcav1.CertAuthorityOverride_builder{
 			Kind:    types.KindCertAuthorityOverride,
 			Version: types.V1,
 			SubKind: subKind,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-		}), nil
+			}.Build(),
+		}.Build()), nil
 	case types.OpPut:
 		r, err := services.UnmarshalCertAuthorityOverride(event.Item.Value,
 			services.WithExpires(event.Item.Expires),
@@ -278,13 +278,13 @@ func itemFromCertAuthorityOverride(resource *subcav1.CertAuthorityOverride) (*ba
 	}
 
 	key := newCAOverridesPrefix().AppendKey(backend.NewKey(
-		resource.Metadata.Name,
-		resource.SubKind,
+		resource.GetMetadata().GetName(),
+		resource.GetSubKind(),
 	))
 	return &backend.Item{
 		Key:      key,
 		Value:    value,
 		Expires:  expires,
-		Revision: resource.Metadata.Revision,
+		Revision: resource.GetMetadata().GetRevision(),
 	}, nil
 }
diff --git a/lib/services/local/subca_service_test.go b/lib/services/local/subca_service_test.go
index 7b9ad33d745..0232a78dcc1 100644
--- a/lib/services/local/subca_service_test.go
+++ b/lib/services/local/subca_service_test.go
@@ -73,7 +73,7 @@ func TestSubCAService_CRUD(t *testing.T) {
 		// Upsert and verify response.
 		created, err := service.UpsertCertAuthorityOverride(t.Context(), caOverride)
 		require.NoError(t, err, "UpsertCertAuthorityOverride errored")
-		want.Metadata.Revision = created.Metadata.Revision
+		want.GetMetadata().SetRevision(created.GetMetadata().GetRevision())
 		if diff := cmp.Diff(want, created, protocmp.Transform()); diff != "" {
 			t.Errorf("Upsert mismatch (-want +got)\n%s", diff)
 		}
@@ -82,7 +82,7 @@ func TestSubCAService_CRUD(t *testing.T) {
 		assertStored(t, service, want)
 
 		invalid := proto.Clone(created).(*subcav1.CertAuthorityOverride)
-		invalid.Spec.CertificateOverrides[0].Certificate = "ceci n'est pas a certificate"
+		invalid.GetSpec().GetCertificateOverrides()[0].SetCertificate("ceci n'est pas a certificate")
 		const wantInvalidErr = "certificate: expected PEM"
 
 		t.Run("Upsert (invalid)", func(t *testing.T) {
@@ -96,17 +96,17 @@ func TestSubCAService_CRUD(t *testing.T) {
 		})
 
 		t.Run("Upsert (update)", func(t *testing.T) {
-			co := created.Spec.CertificateOverrides[0]
-			co.Disabled = false // Enable override.
+			co := created.GetSpec().GetCertificateOverrides()[0]
+			co.SetDisabled(false) // Enable override.
 
 			want := proto.Clone(created).(*subcav1.CertAuthorityOverride)
 
 			updated, err := service.UpsertCertAuthorityOverride(t.Context(), created)
 			require.NoError(t, err, "UpsertCertAuthorityOverride errored")
 			assert.NotEqual(t,
-				want.Metadata.Revision, updated.Metadata.Revision,
+				want.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision(),
 				"Revision unchanged after update")
-			want.Metadata.Revision = updated.Metadata.Revision
+			want.GetMetadata().SetRevision(updated.GetMetadata().GetRevision())
 			if diff := cmp.Diff(want, updated, protocmp.Transform()); diff != "" {
 				t.Errorf("Upsert mismatch (-want +got)\n%s", diff)
 			}
@@ -120,7 +120,7 @@ func TestSubCAService_CRUD(t *testing.T) {
 			// Create an altogether different override.
 			caOverride2 := env.NewOverrideForCAType(t, caType)
 			// Enable, like the previous update.
-			caOverride2.Spec.CertificateOverrides[0].Disabled = false
+			caOverride2.GetSpec().GetCertificateOverrides()[0].SetDisabled(false)
 
 			// Fetch stored override...
 			id := local.CertAuthorityOverrideIDFromResource(created)
@@ -129,16 +129,16 @@ func TestSubCAService_CRUD(t *testing.T) {
 
 			// ...and replace its contents with "caOverride2".
 			in := stored
-			in.Spec.CertificateOverrides = caOverride2.Spec.CertificateOverrides
+			in.GetSpec().SetCertificateOverrides(caOverride2.GetSpec().GetCertificateOverrides())
 
 			want := proto.Clone(in).(*subcav1.CertAuthorityOverride)
 
 			updated, err := service.UpdateCertAuthorityOverride(ctx, in)
 			require.NoError(t, err, "UpdateCertAuthorityOverride errored")
 			assert.NotEqual(t,
-				want.Metadata.Revision, updated.Metadata.Revision,
+				want.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision(),
 				"Revision unchanged after update")
-			want.Metadata.Revision = updated.Metadata.Revision
+			want.GetMetadata().SetRevision(updated.GetMetadata().GetRevision())
 			if diff := cmp.Diff(want, updated, protocmp.Transform()); diff != "" {
 				t.Errorf("Upsert mismatch (-want +got)\n%s", diff)
 			}
@@ -246,8 +246,8 @@ func TestSubCAService_Create(t *testing.T) {
 		wantKey := backend.NewKey(
 			"cert_authority_overrides",
 			"cluster",
-			caOverride.Metadata.Name,
-			caOverride.SubKind,
+			caOverride.GetMetadata().GetName(),
+			caOverride.GetSubKind(),
 		)
 
 		// Get resource from customized key.
@@ -258,7 +258,7 @@ func TestSubCAService_Create(t *testing.T) {
 		notWantKey := backend.NewKey(
 			"cert_authority_overrides",
 			"cluster",
-			caOverride.Metadata.Name,
+			caOverride.GetMetadata().GetName(),
 		)
 		_, err = be.Get(ctx, notWantKey)
 		assert.ErrorAs(t, err, new(*trace.NotFoundError), "Read resource by notWantKey")
@@ -278,7 +278,7 @@ func TestSubCAService_Create(t *testing.T) {
 		{
 			name: "CAOverride is validated",
 			modify: func(ca *subcav1.CertAuthorityOverride) {
-				ca.Spec.CertificateOverrides[0].Certificate = "ceci n'est pas a certificate"
+				ca.GetSpec().GetCertificateOverrides()[0].SetCertificate("ceci n'est pas a certificate")
 			},
 			wantErr: "expected PEM",
 		},
@@ -302,7 +302,7 @@ func TestSubCAService_Create(t *testing.T) {
 			}
 			// Assert success.
 			require.NoError(t, err, "CreateCertAuthorityOverride errored")
-			want.Metadata.Revision = got.Metadata.Revision
+			want.GetMetadata().SetRevision(got.GetMetadata().GetRevision())
 			if diff := cmp.Diff(want, got, protocmp.Transform()); diff != "" {
 				t.Errorf("Create mismatch (-want +got)\n%s", diff)
 			}
@@ -330,15 +330,15 @@ func TestSubCAService_Update_wrongRevision(t *testing.T) {
 	caOverride := env.NewOverrideForCAType(t, caType)
 	caOverride, err := service.CreateCertAuthorityOverride(ctx, caOverride)
 	require.NoError(t, err)
-	rev1 := caOverride.Metadata.Revision
+	rev1 := caOverride.GetMetadata().GetRevision()
 
 	caOverride, err = service.UpdateCertAuthorityOverride(ctx, caOverride)
 	require.NoError(t, err)
-	rev2 := caOverride.Metadata.Revision
+	rev2 := caOverride.GetMetadata().GetRevision()
 	require.NotEqual(t, rev1, rev2, "Revision didn't change on update")
 
 	// Update using an old revision.
-	caOverride.Metadata.Revision = rev1
+	caOverride.GetMetadata().SetRevision(rev1)
 	_, err = service.UpdateCertAuthorityOverride(ctx, caOverride)
 	assert.ErrorAs(t, err, new(*trace.CompareFailedError),
 		"UpdateCertAuthorityOverride() revision mismatch error")
@@ -395,15 +395,15 @@ func TestCreateResource_CertAuthorityOverride(t *testing.T) {
 	t.Run("ok", func(t *testing.T) {
 		t.Parallel()
 
-		want := &subcav1.CertAuthorityOverride{
+		want := subcav1.CertAuthorityOverride_builder{
 			Kind:    types.KindCertAuthorityOverride,
 			SubKind: string(types.DatabaseClientCA),
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: env.ClusterName,
-			},
+			}.Build(),
 			Spec: &subcav1.CertAuthorityOverrideSpec{},
-		}
+		}.Build()
 
 		// CreateResources.
 		r := types.Resource153ToLegacy(want)
@@ -415,7 +415,7 @@ func TestCreateResource_CertAuthorityOverride(t *testing.T) {
 		got, err := service.GetCertAuthorityOverride(
 			t.Context(), local.CertAuthorityOverrideIDFromResource(want))
 		require.NoError(t, err)
-		want.Metadata.Revision = got.Metadata.Revision
+		want.GetMetadata().SetRevision(got.GetMetadata().GetRevision())
 		if diff := cmp.Diff(want, got, protocmp.Transform()); diff != "" {
 			t.Errorf("CertAuthorityOverride mismatch (-want +got)\n%s", diff)
 		}
diff --git a/lib/services/local/suite_test.go b/lib/services/local/suite_test.go
index 9597e51b62a..7e8327db358 100644
--- a/lib/services/local/suite_test.go
+++ b/lib/services/local/suite_test.go
@@ -1571,9 +1571,9 @@ func (s *ServicesTestSuite) AuthPreference(t *testing.T) {
 func (s *ServicesTestSuite) AccessGraphSettings(t *testing.T) {
 	ctx := context.Background()
 	ap, err := clusterconfig.NewAccessGraphSettings(
-		&clusterconfigpb.AccessGraphSettingsSpec{
+		clusterconfigpb.AccessGraphSettingsSpec_builder{
 			SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -1587,7 +1587,7 @@ func (s *ServicesTestSuite) AccessGraphSettings(t *testing.T) {
 	require.Empty(t, cmp.Diff(ap, got, protocmp.Transform()))
 
 	// Validate that update only works if the revision matches.
-	got.Metadata.Revision = "123"
+	got.GetMetadata().SetRevision("123")
 	_, err = s.ConfigS.UpdateAccessGraphSettings(ctx, got)
 	require.True(t, trace.IsCompareFailed(err))
 
@@ -1595,8 +1595,8 @@ func (s *ServicesTestSuite) AccessGraphSettings(t *testing.T) {
 	upserted, err := s.ConfigS.UpsertAccessGraphSettings(ctx, protobuf.Clone(got).(*clusterconfigpb.AccessGraphSettings))
 	require.NoError(t, err)
 	require.NotEmpty(t, upserted.GetMetadata().GetRevision())
-	upserted.Metadata.Revision = ""
-	got.Metadata.Revision = ""
+	upserted.GetMetadata().SetRevision("")
+	got.GetMetadata().SetRevision("")
 	require.Empty(t, cmp.Diff(upserted, got, protocmp.Transform()))
 }
 
@@ -1671,31 +1671,31 @@ func (s *ServicesTestSuite) StaticTokens(t *testing.T) {
 func (s *ServicesTestSuite) StaticScopedTokens(t *testing.T) {
 	ctx := t.Context()
 	// set static tokens
-	staticTokens := &joiningv1.StaticScopedTokens{
+	staticTokens := joiningv1.StaticScopedTokens_builder{
 		Kind:  types.KindStaticScopedTokens,
 		Scope: "/",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameStaticScopedTokens,
-		},
-		Spec: &joiningv1.StaticScopedTokensSpec{
+		}.Build(),
+		Spec: joiningv1.StaticScopedTokensSpec_builder{
 			Tokens: []*joiningv1.ScopedToken{
-				{
+				joiningv1.ScopedToken_builder{
 					Kind:  types.KindScopedToken,
 					Scope: "/",
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name:    "tok1",
 						Expires: timestamppb.New(time.Now().UTC().Add(time.Hour)),
-					},
-					Spec: &joiningv1.ScopedTokenSpec{
+					}.Build(),
+					Spec: joiningv1.ScopedTokenSpec_builder{
 						Roles:         []string{types.RoleNode.String()},
 						JoinMethod:    string(types.JoinMethodToken),
 						UsageMode:     string(joining.TokenUsageModeUnlimited),
 						AssignedScope: "/local",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	err := s.LocalConfigS.SetStaticScopedTokens(ctx, staticTokens)
 	require.NoError(t, err)
diff --git a/lib/services/local/summarizer_test.go b/lib/services/local/summarizer_test.go
index 5470b6e534b..48d1f8cdafb 100644
--- a/lib/services/local/summarizer_test.go
+++ b/lib/services/local/summarizer_test.go
@@ -39,26 +39,24 @@ import (
 )
 
 func newInferenceModel(name string) *summarizerv1.InferenceModel {
-	return summarizer.NewInferenceModel(name, &summarizerv1.InferenceModelSpec{
-		Provider: &summarizerv1.InferenceModelSpec_Openai{
-			Openai: &summarizerv1.OpenAIProvider{
-				OpenaiModelId: "gpt-4o",
-			},
-		},
-	})
+	return summarizer.NewInferenceModel(name, summarizerv1.InferenceModelSpec_builder{
+		Openai: summarizerv1.OpenAIProvider_builder{
+			OpenaiModelId: "gpt-4o",
+		}.Build(),
+	}.Build())
 }
 
 func newInferenceSecret(name string) *summarizerv1.InferenceSecret {
-	return summarizer.NewInferenceSecret(name, &summarizerv1.InferenceSecretSpec{
+	return summarizer.NewInferenceSecret(name, summarizerv1.InferenceSecretSpec_builder{
 		Value: "super-secret-value",
-	})
+	}.Build())
 }
 
 func newInferencePolicy(name string) *summarizerv1.InferencePolicy {
-	return summarizer.NewInferencePolicy(name, &summarizerv1.InferencePolicySpec{
+	return summarizer.NewInferencePolicy(name, summarizerv1.InferencePolicySpec_builder{
 		Kinds: []string{string(types.SSHSessionKind)},
 		Model: "dummy-model",
-	})
+	}.Build())
 }
 
 func setupSummarizerTest(
@@ -90,7 +88,7 @@ func TestSummarizerService_CreateInferenceModel(t *testing.T) {
 			proto.Clone(want).(*summarizerv1.InferenceModel),
 		)
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -100,7 +98,7 @@ func TestSummarizerService_CreateInferenceModel(t *testing.T) {
 	})
 	t.Run("invalid", func(t *testing.T) {
 		m := newInferenceModel("invalid-model")
-		m.Spec.GetOpenai().OpenaiModelId = ""
+		m.GetSpec().GetOpenai().SetOpenaiModelId("")
 		_, err := service.CreateInferenceModel(
 			ctx,
 			proto.Clone(m).(*summarizerv1.InferenceModel),
@@ -109,14 +107,12 @@ func TestSummarizerService_CreateInferenceModel(t *testing.T) {
 		assert.ErrorIs(t, err, trace.BadParameter("spec.openai.openai_model_id is required"))
 	})
 	t.Run("no Bedrock unless enabled", func(t *testing.T) {
-		m := summarizer.NewInferenceModel("bedrock-model", &summarizerv1.InferenceModelSpec{
-			Provider: &summarizerv1.InferenceModelSpec_Bedrock{
-				Bedrock: &summarizerv1.BedrockProvider{
-					Region:         "us-east-1",
-					BedrockModelId: "amazon.nova-pro-v1:0",
-				},
-			},
-		})
+		m := summarizer.NewInferenceModel("bedrock-model", summarizerv1.InferenceModelSpec_builder{
+			Bedrock: summarizerv1.BedrockProvider_builder{
+				Region:         "us-east-1",
+				BedrockModelId: "amazon.nova-pro-v1:0",
+			}.Build(),
+		}.Build())
 		_, err := service.CreateInferenceModel(ctx, m)
 		require.Error(t, err)
 		assert.ErrorIs(t, err, trace.BadParameter(
@@ -157,14 +153,12 @@ func TestSummarizerService_CreateInferenceModel_BedrockAllowed(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	want := summarizer.NewInferenceModel("bedrock-model", &summarizerv1.InferenceModelSpec{
-		Provider: &summarizerv1.InferenceModelSpec_Bedrock{
-			Bedrock: &summarizerv1.BedrockProvider{
-				Region:         "us-east-1",
-				BedrockModelId: "amazon.nova-pro-v1:0",
-			},
-		},
-	})
+	want := summarizer.NewInferenceModel("bedrock-model", summarizerv1.InferenceModelSpec_builder{
+		Bedrock: summarizerv1.BedrockProvider_builder{
+			Region:         "us-east-1",
+			BedrockModelId: "amazon.nova-pro-v1:0",
+		}.Build(),
+	}.Build())
 
 	got, err := service.CreateInferenceModel(
 		ctx,
@@ -172,7 +166,7 @@ func TestSummarizerService_CreateInferenceModel_BedrockAllowed(t *testing.T) {
 		proto.Clone(want).(*summarizerv1.InferenceModel),
 	)
 	require.NoError(t, err)
-	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.NotEmpty(t, got.GetMetadata().GetRevision())
 	assert.Empty(t, cmp.Diff(
 		want,
 		got,
@@ -191,7 +185,7 @@ func TestSummarizerService_UpsertInferenceModel(t *testing.T) {
 		proto.Clone(want).(*summarizerv1.InferenceModel),
 	)
 	require.NoError(t, err)
-	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.NotEmpty(t, got.GetMetadata().GetRevision())
 	assert.Empty(t, cmp.Diff(
 		want,
 		got,
@@ -273,7 +267,7 @@ func TestSummarizerService_GetInferenceModel(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetInferenceModel(ctx, "dummy-model")
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -326,7 +320,7 @@ func TestSummarizerService_UpdateInferenceModel(t *testing.T) {
 		)
 		require.NoError(t, err)
 		want := proto.Clone(created).(*summarizerv1.InferenceModel)
-		want.Spec.GetOpenai().BaseUrl = "https://localhost:4000"
+		want.GetSpec().GetOpenai().SetBaseUrl("https://localhost:4000")
 
 		updated, err := service.UpdateInferenceModel(
 			ctx,
@@ -334,7 +328,7 @@ func TestSummarizerService_UpdateInferenceModel(t *testing.T) {
 			proto.Clone(want).(*summarizerv1.InferenceModel),
 		)
 		require.NoError(t, err)
-		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.NotEqual(t, created.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			updated,
@@ -350,7 +344,7 @@ func TestSummarizerService_UpdateInferenceModel(t *testing.T) {
 			protocmp.Transform(),
 			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 		))
-		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+		assert.Equal(t, updated.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 	})
 	t.Run("no create", func(t *testing.T) {
 		_, err := service.UpdateInferenceModel(
@@ -372,7 +366,7 @@ func TestSummarizerService_CreateInferenceSecret(t *testing.T) {
 			proto.Clone(want).(*summarizerv1.InferenceSecret),
 		)
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -382,7 +376,7 @@ func TestSummarizerService_CreateInferenceSecret(t *testing.T) {
 	})
 	t.Run("invalid", func(t *testing.T) {
 		s := newInferenceSecret("invalid-secret")
-		s.Spec.Value = ""
+		s.GetSpec().SetValue("")
 		_, err := service.CreateInferenceSecret(
 			ctx,
 			proto.Clone(s).(*summarizerv1.InferenceSecret),
@@ -418,7 +412,7 @@ func TestSummarizerService_UpsertInferenceSecret(t *testing.T) {
 		proto.Clone(want).(*summarizerv1.InferenceSecret),
 	)
 	require.NoError(t, err)
-	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.NotEmpty(t, got.GetMetadata().GetRevision())
 	assert.Empty(t, cmp.Diff(
 		want,
 		got,
@@ -500,7 +494,7 @@ func TestSummarizerService_GetInferenceSecret(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetInferenceSecret(ctx, "dummy-secret")
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -553,7 +547,7 @@ func TestSummarizerService_UpdateInferenceSecret(t *testing.T) {
 		)
 		require.NoError(t, err)
 		want := proto.Clone(created).(*summarizerv1.InferenceSecret)
-		want.Spec.Value = "new-secret-value"
+		want.GetSpec().SetValue("new-secret-value")
 
 		updated, err := service.UpdateInferenceSecret(
 			ctx,
@@ -561,7 +555,7 @@ func TestSummarizerService_UpdateInferenceSecret(t *testing.T) {
 			proto.Clone(want).(*summarizerv1.InferenceSecret),
 		)
 		require.NoError(t, err)
-		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.NotEqual(t, created.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			updated,
@@ -577,7 +571,7 @@ func TestSummarizerService_UpdateInferenceSecret(t *testing.T) {
 			protocmp.Transform(),
 			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 		))
-		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+		assert.Equal(t, updated.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 	})
 	t.Run("no create", func(t *testing.T) {
 		_, err := service.UpdateInferenceSecret(
@@ -599,7 +593,7 @@ func TestSummarizerService_CreateInferencePolicy(t *testing.T) {
 			proto.Clone(want).(*summarizerv1.InferencePolicy),
 		)
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -609,7 +603,7 @@ func TestSummarizerService_CreateInferencePolicy(t *testing.T) {
 	})
 	t.Run("invalid", func(t *testing.T) {
 		p := newInferencePolicy("invalid-policy")
-		p.Spec.Filter = "$%^@$"
+		p.GetSpec().SetFilter("$%^@$")
 		_, err := service.CreateInferencePolicy(
 			ctx,
 			proto.Clone(p).(*summarizerv1.InferencePolicy),
@@ -645,7 +639,7 @@ func TestSummarizerService_UpsertInferencePolicy(t *testing.T) {
 		proto.Clone(want).(*summarizerv1.InferencePolicy),
 	)
 	require.NoError(t, err)
-	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.NotEmpty(t, got.GetMetadata().GetRevision())
 	assert.Empty(t, cmp.Diff(
 		want,
 		got,
@@ -727,7 +721,7 @@ func TestSummarizerService_GetInferencePolicy(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetInferencePolicy(ctx, "dummy-policy")
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -780,7 +774,7 @@ func TestSummarizerService_UpdateInferencePolicy(t *testing.T) {
 		)
 		require.NoError(t, err)
 		want := proto.Clone(created).(*summarizerv1.InferencePolicy)
-		want.Spec.Kinds = []string{string(types.SSHSessionKind), string(types.DatabaseSessionKind)}
+		want.GetSpec().SetKinds([]string{string(types.SSHSessionKind), string(types.DatabaseSessionKind)})
 
 		updated, err := service.UpdateInferencePolicy(
 			ctx,
@@ -788,7 +782,7 @@ func TestSummarizerService_UpdateInferencePolicy(t *testing.T) {
 			proto.Clone(want).(*summarizerv1.InferencePolicy),
 		)
 		require.NoError(t, err)
-		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.NotEqual(t, created.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			updated,
@@ -804,7 +798,7 @@ func TestSummarizerService_UpdateInferencePolicy(t *testing.T) {
 			protocmp.Transform(),
 			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 		))
-		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+		assert.Equal(t, updated.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 	})
 	t.Run("no create", func(t *testing.T) {
 		_, err := service.UpdateInferencePolicy(
@@ -844,15 +838,13 @@ func TestSummarizerService_AllInferencePolicies(t *testing.T) {
 }
 
 func newRetrievalModel() *summarizerv1.RetrievalModel {
-	return summarizer.NewRetrievalModel(&summarizerv1.RetrievalModelSpec{
-		EmbeddingsProvider: &summarizerv1.RetrievalModelSpec_Openai{
-			Openai: &summarizerv1.OpenAIProvider{
-				OpenaiModelId:   "text-embedding-3-small",
-				ApiKeySecretRef: "something",
-			},
-		},
+	return summarizer.NewRetrievalModel(summarizerv1.RetrievalModelSpec_builder{
+		Openai: summarizerv1.OpenAIProvider_builder{
+			OpenaiModelId:   "text-embedding-3-small",
+			ApiKeySecretRef: "something",
+		}.Build(),
 		InferenceModelName: "gpt-4o",
-	})
+	}.Build())
 }
 
 func TestSummarizerService_CreateRetrievalModel(t *testing.T) {
@@ -865,7 +857,7 @@ func TestSummarizerService_CreateRetrievalModel(t *testing.T) {
 			proto.CloneOf(want),
 		)
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -876,7 +868,7 @@ func TestSummarizerService_CreateRetrievalModel(t *testing.T) {
 	t.Run("invalid", func(t *testing.T) {
 		ctx, service := setupSummarizerTest(t)
 		m := newRetrievalModel()
-		m.Spec.GetOpenai().OpenaiModelId = ""
+		m.GetSpec().GetOpenai().SetOpenaiModelId("")
 		_, err := service.CreateRetrievalModel(
 			ctx,
 			proto.CloneOf(m),
@@ -919,15 +911,13 @@ func TestSummarizerService_CreateRetrievalModel_BedrockAllowed(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	want := summarizer.NewRetrievalModel(&summarizerv1.RetrievalModelSpec{
-		EmbeddingsProvider: &summarizerv1.RetrievalModelSpec_Bedrock{
-			Bedrock: &summarizerv1.BedrockProvider{
-				Region:         "us-east-1",
-				BedrockModelId: "amazon.titan-embed-text-v2:0",
-			},
-		},
+	want := summarizer.NewRetrievalModel(summarizerv1.RetrievalModelSpec_builder{
+		Bedrock: summarizerv1.BedrockProvider_builder{
+			Region:         "us-east-1",
+			BedrockModelId: "amazon.titan-embed-text-v2:0",
+		}.Build(),
 		InferenceModelName: "gpt-4o",
-	})
+	}.Build())
 
 	got, err := service.CreateRetrievalModel(
 		ctx,
@@ -935,7 +925,7 @@ func TestSummarizerService_CreateRetrievalModel_BedrockAllowed(t *testing.T) {
 		proto.CloneOf(want),
 	)
 	require.NoError(t, err)
-	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.NotEmpty(t, got.GetMetadata().GetRevision())
 	assert.Empty(t, cmp.Diff(
 		want,
 		got,
@@ -954,7 +944,7 @@ func TestSummarizerService_UpsertRetrievalModel(t *testing.T) {
 		proto.CloneOf(want),
 	)
 	require.NoError(t, err)
-	assert.NotEmpty(t, got.Metadata.Revision)
+	assert.NotEmpty(t, got.GetMetadata().GetRevision())
 	assert.Empty(t, cmp.Diff(
 		want,
 		got,
@@ -983,7 +973,7 @@ func TestSummarizerService_GetRetrievalModel(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetRetrievalModel(ctx)
 		require.NoError(t, err)
-		assert.NotEmpty(t, got.Metadata.Revision)
+		assert.NotEmpty(t, got.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -1037,7 +1027,7 @@ func TestSummarizerService_UpdateRetrievalModel(t *testing.T) {
 		)
 		require.NoError(t, err)
 		want := proto.CloneOf(created)
-		want.Spec.GetOpenai().BaseUrl = "https://localhost:4000"
+		want.GetSpec().GetOpenai().SetBaseUrl("https://localhost:4000")
 
 		updated, err := service.UpdateRetrievalModel(
 			ctx,
@@ -1045,7 +1035,7 @@ func TestSummarizerService_UpdateRetrievalModel(t *testing.T) {
 			proto.CloneOf(want),
 		)
 		require.NoError(t, err)
-		assert.NotEqual(t, created.Metadata.Revision, updated.Metadata.Revision)
+		assert.NotEqual(t, created.GetMetadata().GetRevision(), updated.GetMetadata().GetRevision())
 		assert.Empty(t, cmp.Diff(
 			want,
 			updated,
@@ -1061,7 +1051,7 @@ func TestSummarizerService_UpdateRetrievalModel(t *testing.T) {
 			protocmp.Transform(),
 			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
 		))
-		assert.Equal(t, updated.Metadata.Revision, got.Metadata.Revision)
+		assert.Equal(t, updated.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 	})
 	t.Run("no create", func(t *testing.T) {
 		_, err := service.UpdateRetrievalModel(
diff --git a/lib/services/local/user_task_test.go b/lib/services/local/user_task_test.go
index 6058bdd45e8..2228396578f 100644
--- a/lib/services/local/user_task_test.go
+++ b/lib/services/local/user_task_test.go
@@ -134,15 +134,15 @@ func TestUpdateUserTask(t *testing.T) {
 	obj, err := service.GetUserTask(ctx, getUserTaskObject(t, 0).GetMetadata().GetName())
 	require.NoError(t, err)
 	// update the expiry time
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	objUpdated, err := service.UpdateUserTask(ctx, obj)
 	require.NoError(t, err)
-	require.Equal(t, expiry, objUpdated.Metadata.Expires)
+	require.Equal(t, expiry, objUpdated.GetMetadata().GetExpires())
 
-	objFresh, err := service.GetUserTask(ctx, obj.Metadata.Name)
+	objFresh, err := service.GetUserTask(ctx, obj.GetMetadata().GetName())
 	require.NoError(t, err)
-	require.Equal(t, expiry, objFresh.Metadata.Expires)
+	require.Equal(t, expiry, objFresh.GetMetadata().GetExpires())
 }
 
 func TestUpdateUserTaskMissingRevision(t *testing.T) {
@@ -155,7 +155,7 @@ func TestUpdateUserTaskMissingRevision(t *testing.T) {
 	expiry := timestamppb.New(time.Now().Add(30 * time.Minute))
 
 	obj := getUserTaskObject(t, 0)
-	obj.Metadata.Expires = expiry
+	obj.GetMetadata().SetExpires(expiry)
 
 	// Update should be rejected as the revision is missing.
 	_, err := service.UpdateUserTask(ctx, obj)
@@ -209,7 +209,7 @@ func TestListUserTask(t *testing.T) {
 		protocmp.Transform(),
 	}
 	sortUserTasksFn := func(a *usertasksv1.UserTask, b *usertasksv1.UserTask) int {
-		return strings.Compare(a.Metadata.GetName(), b.Metadata.GetName())
+		return strings.Compare(a.GetMetadata().GetName(), b.GetMetadata().GetName())
 	}
 	counts := []int{0, 1, 5, 10}
 	for _, count := range counts {
@@ -272,24 +272,24 @@ func getUserTasksService(t *testing.T) services.UserTasks {
 func getUserTaskObject(t *testing.T, index int) *usertasksv1.UserTask {
 	integrationName := fmt.Sprintf("integration-%d", index)
 
-	obj, err := usertasks.NewDiscoverEC2UserTask(&usertasksv1.UserTaskSpec{
+	obj, err := usertasks.NewDiscoverEC2UserTask(usertasksv1.UserTaskSpec_builder{
 		Integration: integrationName,
 		TaskType:    "discover-ec2",
 		IssueType:   "ec2-ssm-agent-not-registered",
 		State:       "OPEN",
-		DiscoverEc2: &usertasksv1.DiscoverEC2{
+		DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 			AccountId: "123456789012",
 			Region:    "us-east-1",
 			Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-				"i-123": {
+				"i-123": usertasksv1.DiscoverEC2Instance_builder{
 					InstanceId:      "i-123",
 					Name:            "my-instance",
 					DiscoveryConfig: "dc01",
 					DiscoveryGroup:  "dg01",
-				},
+				}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	return obj
diff --git a/lib/services/local/userpreferences.go b/lib/services/local/userpreferences.go
index 29862c4ffcb..1dfb6f31509 100644
--- a/lib/services/local/userpreferences.go
+++ b/lib/services/local/userpreferences.go
@@ -35,26 +35,26 @@ type UserPreferencesService struct {
 }
 
 func DefaultUserPreferences() *userpreferencesv1.UserPreferences {
-	return &userpreferencesv1.UserPreferences{
+	return userpreferencesv1.UserPreferences_builder{
 		Theme: userpreferencesv1.Theme_THEME_UNSPECIFIED,
-		UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+		UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 			DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_ALL,
 			ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_CARD,
 			LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 			AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_NONE,
-		},
-		Onboard: &userpreferencesv1.OnboardUserPreferences{
+		}.Build(),
+		Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 			PreferredResources: []userpreferencesv1.Resource{},
 			MarketingParams:    &userpreferencesv1.MarketingParams{},
-		},
-		ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
+		}.Build(),
+		ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
 			PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{},
-		},
+		}.Build(),
 		// Leave SideNavDrawerMode unset so the UI can detect a first-time
 		// user and apply its own default (or onboarding behavior) instead of
 		// storing a value the user never explicitly chose.
 		SideNavDrawerMode: userpreferencesv1.SideNavDrawerMode_SIDE_NAV_DRAWER_MODE_UNSPECIFIED,
-	}
+	}.Build()
 }
 
 // NewUserPreferencesService returns a new instance of the UserPreferencesService.
diff --git a/lib/services/local/userpreferences_test.go b/lib/services/local/userpreferences_test.go
index 638c909773d..8479ab4eddc 100644
--- a/lib/services/local/userpreferences_test.go
+++ b/lib/services/local/userpreferences_test.go
@@ -48,11 +48,11 @@ func TestUserPreferences_ClusterPreferences(t *testing.T) {
 
 	ctx := context.Background()
 	defaultPref := local.DefaultUserPreferences()
-	defaultPref.ClusterPreferences = &userpreferencesv1.ClusterUserPreferences{
-		PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+	defaultPref.SetClusterPreferences(userpreferencesv1.ClusterUserPreferences_builder{
+		PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 			ResourceIds: []string{"123", "234"},
-		},
-	}
+		}.Build(),
+	}.Build())
 
 	username := "something"
 	identity := newUserPreferencesService(t)
@@ -93,218 +93,218 @@ func TestUserPreferencesCRUD(t *testing.T) {
 		},
 		{
 			name: "update the theme preference only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
 					Theme: userpreferencesv1.Theme_THEME_DARK,
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Onboard:                    defaultPref.Onboard,
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Onboard:                    defaultPref.GetOnboard(),
 				Theme:                      userpreferencesv1.Theme_THEME_DARK,
-				UnifiedResourcePreferences: defaultPref.UnifiedResourcePreferences,
-				ClusterPreferences:         defaultPref.ClusterPreferences,
-				SideNavDrawerMode:          defaultPref.SideNavDrawerMode,
-			},
+				UnifiedResourcePreferences: defaultPref.GetUnifiedResourcePreferences(),
+				ClusterPreferences:         defaultPref.GetClusterPreferences(),
+				SideNavDrawerMode:          defaultPref.GetSideNavDrawerMode(),
+			}.Build(),
 		},
 		{
 			name: "update the availability view only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
-					UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
+					UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 						AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_ACCESSIBLE,
-					},
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Onboard: defaultPref.Onboard,
-				Theme:   defaultPref.Theme,
-				UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Onboard: defaultPref.GetOnboard(),
+				Theme:   defaultPref.GetTheme(),
+				UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 					DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_ALL,
 					ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_CARD,
 					LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 					AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_ACCESSIBLE,
-				},
-				ClusterPreferences: defaultPref.ClusterPreferences,
-				SideNavDrawerMode:  defaultPref.SideNavDrawerMode,
-			},
+				}.Build(),
+				ClusterPreferences: defaultPref.GetClusterPreferences(),
+				SideNavDrawerMode:  defaultPref.GetSideNavDrawerMode(),
+			}.Build(),
 		},
 		{
 			name: "update the unified tab preference only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
-					UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
+					UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 						DefaultTab: userpreferencesv1.DefaultTab_DEFAULT_TAB_PINNED,
-					},
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Onboard: defaultPref.Onboard,
-				Theme:   defaultPref.Theme,
-				UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Onboard: defaultPref.GetOnboard(),
+				Theme:   defaultPref.GetTheme(),
+				UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 					DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_PINNED,
 					ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_CARD,
 					LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 					AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_NONE,
-				},
-				ClusterPreferences: defaultPref.ClusterPreferences,
-				SideNavDrawerMode:  defaultPref.SideNavDrawerMode,
-			},
+				}.Build(),
+				ClusterPreferences: defaultPref.GetClusterPreferences(),
+				SideNavDrawerMode:  defaultPref.GetSideNavDrawerMode(),
+			}.Build(),
 		},
 		{
 			name: "update the onboard preference only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
-					Onboard: &userpreferencesv1.OnboardUserPreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
+					Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 						PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_DATABASES},
-						MarketingParams: &userpreferencesv1.MarketingParams{
+						MarketingParams: userpreferencesv1.MarketingParams_builder{
 							Campaign: "c_1",
 							Source:   "s_1",
 							Medium:   "m_1",
 							Intent:   "i_1",
-						},
-					},
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Theme:                      defaultPref.Theme,
-				UnifiedResourcePreferences: defaultPref.UnifiedResourcePreferences,
-				SideNavDrawerMode:          defaultPref.SideNavDrawerMode,
-				Onboard: &userpreferencesv1.OnboardUserPreferences{
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Theme:                      defaultPref.GetTheme(),
+				UnifiedResourcePreferences: defaultPref.GetUnifiedResourcePreferences(),
+				SideNavDrawerMode:          defaultPref.GetSideNavDrawerMode(),
+				Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 					PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_DATABASES},
-					MarketingParams: &userpreferencesv1.MarketingParams{
+					MarketingParams: userpreferencesv1.MarketingParams_builder{
 						Campaign: "c_1",
 						Source:   "s_1",
 						Medium:   "m_1",
 						Intent:   "i_1",
-					},
-				},
-				ClusterPreferences: defaultPref.ClusterPreferences,
-			},
+					}.Build(),
+				}.Build(),
+				ClusterPreferences: defaultPref.GetClusterPreferences(),
+			}.Build(),
 		},
 		{
 			name: "update cluster preference only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
-					ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-						PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
+					ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+						PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 							ResourceIds: []string{"node1", "node2"},
-						},
-					},
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Theme:                      defaultPref.Theme,
-				UnifiedResourcePreferences: defaultPref.UnifiedResourcePreferences,
-				Onboard:                    defaultPref.Onboard,
-				SideNavDrawerMode:          defaultPref.SideNavDrawerMode,
-				ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-					PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Theme:                      defaultPref.GetTheme(),
+				UnifiedResourcePreferences: defaultPref.GetUnifiedResourcePreferences(),
+				Onboard:                    defaultPref.GetOnboard(),
+				SideNavDrawerMode:          defaultPref.GetSideNavDrawerMode(),
+				ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+					PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 						ResourceIds: []string{"node1", "node2"},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "update sidenav preference only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
 					SideNavDrawerMode: userpreferencesv1.SideNavDrawerMode_SIDE_NAV_DRAWER_MODE_STICKY,
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Theme:                      defaultPref.Theme,
-				UnifiedResourcePreferences: defaultPref.UnifiedResourcePreferences,
-				Onboard:                    defaultPref.Onboard,
-				ClusterPreferences:         defaultPref.ClusterPreferences,
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Theme:                      defaultPref.GetTheme(),
+				UnifiedResourcePreferences: defaultPref.GetUnifiedResourcePreferences(),
+				Onboard:                    defaultPref.GetOnboard(),
+				ClusterPreferences:         defaultPref.GetClusterPreferences(),
 				SideNavDrawerMode:          userpreferencesv1.SideNavDrawerMode_SIDE_NAV_DRAWER_MODE_STICKY,
-			},
+			}.Build(),
 		},
 		{
 			name: "update the discover resource guide preference only",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
-					DiscoverResourcePreferences: &userpreferencesv1.DiscoverResourcePreferences{
-						DiscoverGuide: &userpreferencesv1.DiscoverGuide{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
+					DiscoverResourcePreferences: userpreferencesv1.DiscoverResourcePreferences_builder{
+						DiscoverGuide: userpreferencesv1.DiscoverGuide_builder{
 							Pinned: []string{"guide-1", "guide-2"},
-						},
-					},
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
-				Onboard:                    defaultPref.Onboard,
-				Theme:                      defaultPref.Theme,
-				UnifiedResourcePreferences: defaultPref.UnifiedResourcePreferences,
-				ClusterPreferences:         defaultPref.ClusterPreferences,
-				SideNavDrawerMode:          defaultPref.SideNavDrawerMode,
-				DiscoverResourcePreferences: &userpreferencesv1.DiscoverResourcePreferences{
-					DiscoverGuide: &userpreferencesv1.DiscoverGuide{
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
+				Onboard:                    defaultPref.GetOnboard(),
+				Theme:                      defaultPref.GetTheme(),
+				UnifiedResourcePreferences: defaultPref.GetUnifiedResourcePreferences(),
+				ClusterPreferences:         defaultPref.GetClusterPreferences(),
+				SideNavDrawerMode:          defaultPref.GetSideNavDrawerMode(),
+				DiscoverResourcePreferences: userpreferencesv1.DiscoverResourcePreferences_builder{
+					DiscoverGuide: userpreferencesv1.DiscoverGuide_builder{
 						Pinned: []string{"guide-1", "guide-2"},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name: "update all the settings at once",
-			req: &userpreferencesv1.UpsertUserPreferencesRequest{
-				Preferences: &userpreferencesv1.UserPreferences{
+			req: userpreferencesv1.UpsertUserPreferencesRequest_builder{
+				Preferences: userpreferencesv1.UserPreferences_builder{
 					Theme: userpreferencesv1.Theme_THEME_LIGHT,
-					UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+					UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 						DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_PINNED,
 						ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_LIST,
 						LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 						AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_NONE,
-					},
+					}.Build(),
 					SideNavDrawerMode: userpreferencesv1.SideNavDrawerMode_SIDE_NAV_DRAWER_MODE_STICKY,
-					Onboard: &userpreferencesv1.OnboardUserPreferences{
+					Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 						PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_KUBERNETES},
-						MarketingParams: &userpreferencesv1.MarketingParams{
+						MarketingParams: userpreferencesv1.MarketingParams_builder{
 							Campaign: "c_2",
 							Source:   "s_2",
 							Medium:   "m_2",
 							Intent:   "i_2",
-						},
-					},
-					ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-						PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+						}.Build(),
+					}.Build(),
+					ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+						PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 							ResourceIds: []string{"node1", "node2"},
-						},
-					},
-					DiscoverResourcePreferences: &userpreferencesv1.DiscoverResourcePreferences{
-						DiscoverGuide: &userpreferencesv1.DiscoverGuide{
+						}.Build(),
+					}.Build(),
+					DiscoverResourcePreferences: userpreferencesv1.DiscoverResourcePreferences_builder{
+						DiscoverGuide: userpreferencesv1.DiscoverGuide_builder{
 							Pinned: []string{"guide-3", "guide-4"},
-						},
-					},
-				},
-			},
-			expected: &userpreferencesv1.UserPreferences{
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			expected: userpreferencesv1.UserPreferences_builder{
 				Theme: userpreferencesv1.Theme_THEME_LIGHT,
-				UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+				UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 					DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_PINNED,
 					ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_LIST,
 					LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 					AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_NONE,
-				},
-				Onboard: &userpreferencesv1.OnboardUserPreferences{
+				}.Build(),
+				Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 					PreferredResources: []userpreferencesv1.Resource{userpreferencesv1.Resource_RESOURCE_KUBERNETES},
-					MarketingParams: &userpreferencesv1.MarketingParams{
+					MarketingParams: userpreferencesv1.MarketingParams_builder{
 						Campaign: "c_2",
 						Source:   "s_2",
 						Medium:   "m_2",
 						Intent:   "i_2",
-					},
-				},
-				ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-					PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+					}.Build(),
+				}.Build(),
+				ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+					PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 						ResourceIds: []string{"node1", "node2"},
-					},
-				},
-				DiscoverResourcePreferences: &userpreferencesv1.DiscoverResourcePreferences{
-					DiscoverGuide: &userpreferencesv1.DiscoverGuide{
+					}.Build(),
+				}.Build(),
+				DiscoverResourcePreferences: userpreferencesv1.DiscoverResourcePreferences_builder{
+					DiscoverGuide: userpreferencesv1.DiscoverGuide_builder{
 						Pinned: []string{"guide-3", "guide-4"},
-					},
-				},
+					}.Build(),
+				}.Build(),
 				SideNavDrawerMode: userpreferencesv1.SideNavDrawerMode_SIDE_NAV_DRAWER_MODE_STICKY,
-			},
+			}.Build(),
 		},
 	}
 
@@ -320,7 +320,7 @@ func TestUserPreferencesCRUD(t *testing.T) {
 			require.Empty(t, cmp.Diff(defaultPref, proto.Clone(res), protocmp.Transform()))
 
 			if test.req != nil {
-				err := identity.UpsertUserPreferences(ctx, username, test.req.Preferences)
+				err := identity.UpsertUserPreferences(ctx, username, test.req.GetPreferences())
 				require.NoError(t, err)
 			}
 
diff --git a/lib/services/local/users.go b/lib/services/local/users.go
index 94ba6f8091b..884b390c165 100644
--- a/lib/services/local/users.go
+++ b/lib/services/local/users.go
@@ -106,9 +106,9 @@ func (s *IdentityService) DeleteAllUsers(ctx context.Context) error {
 
 // ListUsers returns a page of users.
 func (s *IdentityService) ListUsers(ctx context.Context, req *userspb.ListUsersRequest) (*userspb.ListUsersResponse, error) {
-	rangeStart := backend.NewKey(webPrefix, usersPrefix).AppendKey(backend.KeyFromString(req.PageToken))
+	rangeStart := backend.NewKey(webPrefix, usersPrefix).AppendKey(backend.KeyFromString(req.GetPageToken()))
 	rangeEnd := backend.RangeEnd(backend.ExactKey(webPrefix, usersPrefix))
-	pageSize := req.PageSize
+	pageSize := req.GetPageSize()
 
 	// Adjust page size, so it can't be too large.
 	if pageSize <= 0 || pageSize > apidefaults.DefaultChunkSize {
@@ -118,15 +118,15 @@ func (s *IdentityService) ListUsers(ctx context.Context, req *userspb.ListUsersR
 	itemStream := s.Backend.Items(ctx, backend.ItemsParams{StartKey: rangeStart, EndKey: rangeEnd})
 
 	var userStream iter.Seq2[*types.UserV2, error]
-	if req.WithSecrets {
+	if req.GetWithSecrets() {
 		userStream = s.streamUsersWithSecrets(itemStream)
 	} else {
 		userStream = s.streamUsersWithoutSecrets(itemStream)
 	}
 
-	if req.Filter != nil {
+	if req.HasFilter() {
 		userStream = stream.FilterMap(userStream, func(user *types.UserV2) (*types.UserV2, bool) {
-			if !req.Filter.Match(user) {
+			if !req.GetFilter().Match(user) {
 				return nil, false
 			}
 
@@ -140,12 +140,12 @@ func (s *IdentityService) ListUsers(ctx context.Context, req *userspb.ListUsersR
 			return nil, trace.Wrap(err)
 		}
 
-		if len(resp.Users) >= int(pageSize) {
-			resp.NextPageToken = nextUserToken(resp.Users[len(resp.Users)-1])
+		if len(resp.GetUsers()) >= int(pageSize) {
+			resp.SetNextPageToken(nextUserToken(resp.GetUsers()[len(resp.GetUsers())-1]))
 			return &resp, nil
 		}
 
-		resp.Users = append(resp.Users, user)
+		resp.SetUsers(append(resp.GetUsers(), user))
 	}
 	return &resp, nil
 }
diff --git a/lib/services/local/users_test.go b/lib/services/local/users_test.go
index ff1a2c094d3..bbd3204bf52 100644
--- a/lib/services/local/users_test.go
+++ b/lib/services/local/users_test.go
@@ -291,27 +291,27 @@ func TestNotificationCleanupOnUserDelete(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create a notification for this user.
-	testNotification := &notificationsv1.Notification{
+	testNotification := notificationsv1.Notification_builder{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: username,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{types.NotificationTitleLabel: "test"},
-		},
-	}
+		}.Build(),
+	}.Build()
 	notif, err := notificationsSvc.CreateUserNotification(ctx, testNotification)
 	require.NoError(t, err)
 
 	// Create a notification state for this user.
-	userNotificationState := &notificationsv1.UserNotificationState{
-		Spec: &notificationsv1.UserNotificationStateSpec{
+	userNotificationState := notificationsv1.UserNotificationState_builder{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: notif.GetMetadata().GetName(),
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = notificationsSvc.UpsertUserNotificationState(ctx, username, userNotificationState)
 	require.NoError(t, err)
 
@@ -1357,15 +1357,15 @@ func TestIdentityService_ListUsers(t *testing.T) {
 	// Validate that no users returns an empty page.
 	rsp, err := identity.ListUsers(ctx, &userspb.ListUsersRequest{})
 	assert.NoError(t, err, "no error returned when no users exist")
-	assert.Empty(t, rsp.Users, "users returned from listing when no users exist")
-	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing when no users exist")
+	assert.Empty(t, rsp.GetUsers(), "users returned from listing when no users exist")
+	assert.Empty(t, rsp.GetNextPageToken(), "next page token returned from listing when no users exist")
 
-	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{
+	rsp, err = identity.ListUsers(ctx, userspb.ListUsersRequest_builder{
 		WithSecrets: true,
-	})
+	}.Build())
 	assert.NoError(t, err, "no error returned when no users exist")
-	assert.Empty(t, rsp.Users, "users returned from listing when no users exist")
-	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing when no users exist")
+	assert.Empty(t, rsp.GetUsers(), "users returned from listing when no users exist")
+	assert.Empty(t, rsp.GetNextPageToken(), "next page token returned from listing when no users exist")
 
 	// Validate that listing works when there is only a single user
 	user, err := types.NewUser("fish0")
@@ -1377,13 +1377,13 @@ func TestIdentityService_ListUsers(t *testing.T) {
 
 	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{})
 	assert.NoError(t, err, "no error returned when no users exist")
-	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing when no more users exist")
-	assert.Empty(t, cmp.Diff(expectedUsers, rsp.Users, cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")), "not all users returned from listing operation")
+	assert.Empty(t, rsp.GetNextPageToken(), "next page token returned from listing when no more users exist")
+	assert.Empty(t, cmp.Diff(expectedUsers, rsp.GetUsers(), cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")), "not all users returned from listing operation")
 
-	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{WithSecrets: true})
+	rsp, err = identity.ListUsers(ctx, userspb.ListUsersRequest_builder{WithSecrets: true}.Build())
 	assert.NoError(t, err, "no error returned when no users exist")
-	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing when no users exist")
-	assert.Empty(t, cmp.Diff(expectedUsers, rsp.Users), "not all users returned from listing operation")
+	assert.Empty(t, rsp.GetNextPageToken(), "next page token returned from listing when no users exist")
+	assert.Empty(t, cmp.Diff(expectedUsers, rsp.GetUsers()), "not all users returned from listing operation")
 
 	// Create a number of users.
 	usernames := []string{"llama", "alpaca", "fox", "fish", "fish+", "fish2"}
@@ -1430,14 +1430,14 @@ func TestIdentityService_ListUsers(t *testing.T) {
 		rsp, err := identity.ListUsers(ctx, &req)
 		require.NoError(t, err, "no error returned when no users exist")
 
-		for _, user := range rsp.Users {
+		for _, user := range rsp.GetUsers() {
 			assert.Empty(t, user.GetLocalAuth(), "expected no secrets to be returned with user %s", user.GetName())
 		}
 
-		retrieved = append(retrieved, rsp.Users...)
+		retrieved = append(retrieved, rsp.GetUsers()...)
 
-		req.PageToken = rsp.NextPageToken
-		if req.PageToken == "" {
+		req.SetPageToken(rsp.GetNextPageToken())
+		if req.GetPageToken() == "" {
 			break
 		}
 
@@ -1452,14 +1452,14 @@ func TestIdentityService_ListUsers(t *testing.T) {
 	assert.Empty(t, cmp.Diff(expectedUsers, retrieved, cmpopts.IgnoreFields(types.UserSpecV2{}, "LocalAuth")), "not all users returned from listing operation")
 
 	// Validate that listing all users at once returns all expected users with secrets.
-	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{
+	rsp, err = identity.ListUsers(ctx, userspb.ListUsersRequest_builder{
 		PageSize:    200,
 		WithSecrets: true,
-	})
+	}.Build())
 	require.NoError(t, err, "unexpected error listing users")
-	assert.Empty(t, rsp.NextPageToken, "got a next page token when page size was greater than number of items")
+	assert.Empty(t, rsp.GetNextPageToken(), "got a next page token when page size was greater than number of items")
 
-	users := rsp.Users
+	users := rsp.GetUsers()
 
 	slices.SortFunc(users, func(a, b *types.UserV2) int {
 		return strings.Compare(a.GetName(), b.GetName())
@@ -1479,10 +1479,10 @@ func TestIdentityService_ListUsers(t *testing.T) {
 		rsp, err := identity.ListUsers(ctx, &req)
 		require.NoError(t, err, "no error returned when no users exist")
 
-		retrieved = append(retrieved, rsp.Users...)
+		retrieved = append(retrieved, rsp.GetUsers()...)
 
-		req.PageToken = rsp.NextPageToken
-		if req.PageToken == "" {
+		req.SetPageToken(rsp.GetNextPageToken())
+		if req.GetPageToken() == "" {
 			break
 		}
 
@@ -1505,13 +1505,13 @@ func TestIdentityService_ListUsers(t *testing.T) {
 
 	clock.Advance(time.Hour)
 
-	rsp, err = identity.ListUsers(ctx, &userspb.ListUsersRequest{
+	rsp, err = identity.ListUsers(ctx, userspb.ListUsersRequest_builder{
 		WithSecrets: true,
-	})
+	}.Build())
 	assert.NoError(t, err, "got an error while listing over an expired user")
-	assert.Empty(t, rsp.NextPageToken, "next page token returned from listing all users")
+	assert.Empty(t, rsp.GetNextPageToken(), "next page token returned from listing all users")
 
-	retrieved = rsp.Users
+	retrieved = rsp.GetUsers()
 
 	slices.SortFunc(retrieved, func(a, b *types.UserV2) int {
 		return strings.Compare(a.GetName(), b.GetName())
diff --git a/lib/services/local/vnet_config_test.go b/lib/services/local/vnet_config_test.go
index 06d1c360fe2..d11f4af9a18 100644
--- a/lib/services/local/vnet_config_test.go
+++ b/lib/services/local/vnet_config_test.go
@@ -41,12 +41,12 @@ func TestVnetConfigService(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	vnetConfig := &vnet.VnetConfig{
+	vnetConfig := vnet.VnetConfig_builder{
 		Kind:     types.KindVnetConfig,
 		Version:  types.V1,
-		Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-		Spec:     &vnet.VnetConfigSpec{Ipv4CidrRange: "192.168.1.0/24"},
-	}
+		Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+		Spec:     vnet.VnetConfigSpec_builder{Ipv4CidrRange: "192.168.1.0/24"}.Build(),
+	}.Build()
 
 	// The following are not subtests because they depend on each other.
 
@@ -71,7 +71,7 @@ func TestVnetConfigService(t *testing.T) {
 	require.Equal(t, created.GetMetadata().GetRevision(), got.GetMetadata().GetRevision())
 
 	// Update
-	vnetConfig.Spec.CustomDnsZones = append(vnetConfig.Spec.CustomDnsZones, &vnet.CustomDNSZone{Suffix: "example.com"})
+	vnetConfig.GetSpec().SetCustomDnsZones(append(vnetConfig.GetSpec().GetCustomDnsZones(), vnet.CustomDNSZone_builder{Suffix: "example.com"}.Build()))
 	updated, err := service.UpdateVnetConfig(ctx, vnetConfig)
 	require.NoError(t, err)
 	require.NotEqual(t, got.GetSpec().GetCustomDnsZones(), updated.GetSpec().GetCustomDnsZones())
@@ -113,93 +113,93 @@ func TestVnetConfigValidation(t *testing.T) {
 	}{
 		{
 			name: "invalid kind",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     "invalidKind",
 				Version:  types.V1,
-				Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-				Spec:     &vnet.VnetConfigSpec{Ipv4CidrRange: "192.168.1.0/24"},
-			},
+				Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+				Spec:     vnet.VnetConfigSpec_builder{Ipv4CidrRange: "192.168.1.0/24"}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "invalid version",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     types.KindVnetConfig,
 				Version:  "v2",
-				Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-				Spec:     &vnet.VnetConfigSpec{Ipv4CidrRange: "192.168.1.0/24"},
-			},
+				Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+				Spec:     vnet.VnetConfigSpec_builder{Ipv4CidrRange: "192.168.1.0/24"}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "invalid name",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     types.KindVnetConfig,
 				Version:  types.V1,
-				Metadata: &headerv1.Metadata{Name: "wrong-name"},
-				Spec:     &vnet.VnetConfigSpec{Ipv4CidrRange: "192.168.1.0/24"},
-			},
+				Metadata: headerv1.Metadata_builder{Name: "wrong-name"}.Build(),
+				Spec:     vnet.VnetConfigSpec_builder{Ipv4CidrRange: "192.168.1.0/24"}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "invalid CIDR",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     types.KindVnetConfig,
 				Version:  types.V1,
-				Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-				Spec:     &vnet.VnetConfigSpec{Ipv4CidrRange: "192.168.300.0/24"},
-			},
+				Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+				Spec:     vnet.VnetConfigSpec_builder{Ipv4CidrRange: "192.168.300.0/24"}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "empty zone suffix",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     types.KindVnetConfig,
 				Version:  types.V1,
-				Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-				Spec: &vnet.VnetConfigSpec{
+				Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+				Spec: vnet.VnetConfigSpec_builder{
 					Ipv4CidrRange: "192.168.1.0/24",
 					CustomDnsZones: []*vnet.CustomDNSZone{
-						&vnet.CustomDNSZone{
+						vnet.CustomDNSZone_builder{
 							Suffix: "",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "invalid zone suffix",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     types.KindVnetConfig,
 				Version:  types.V1,
-				Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-				Spec: &vnet.VnetConfigSpec{
+				Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+				Spec: vnet.VnetConfigSpec_builder{
 					Ipv4CidrRange: "192.168.1.0/24",
 					CustomDnsZones: []*vnet.CustomDNSZone{
-						&vnet.CustomDNSZone{
+						vnet.CustomDNSZone_builder{
 							Suffix: "invalid.character$",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantErr: true,
 		},
 		{
 			name: "valid",
-			config: &vnet.VnetConfig{
+			config: vnet.VnetConfig_builder{
 				Kind:     types.KindVnetConfig,
 				Version:  types.V1,
-				Metadata: &headerv1.Metadata{Name: types.MetaNameVnetConfig},
-				Spec: &vnet.VnetConfigSpec{
+				Metadata: headerv1.Metadata_builder{Name: types.MetaNameVnetConfig}.Build(),
+				Spec: vnet.VnetConfigSpec_builder{
 					Ipv4CidrRange: "192.168.1.0/24",
 					CustomDnsZones: []*vnet.CustomDNSZone{
-						&vnet.CustomDNSZone{
+						vnet.CustomDNSZone_builder{
 							Suffix: "teleport.example.com",
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/lib/services/local/workload_identity_test.go b/lib/services/local/workload_identity_test.go
index 99bf6749d91..7d667c4c119 100644
--- a/lib/services/local/workload_identity_test.go
+++ b/lib/services/local/workload_identity_test.go
@@ -55,19 +55,19 @@ func setupWorkloadIdentityServiceTest(
 }
 
 func newValidWorkloadIdentity(name string) *workloadidentityv1pb.WorkloadIdentity {
-	return &workloadidentityv1pb.WorkloadIdentity{
+	return workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id:   "/test/" + name,
 				Hint: "This is hint " + name,
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 func TestWorkloadIdentityService_CreateWorkloadIdentity(t *testing.T) {
@@ -81,7 +81,7 @@ func TestWorkloadIdentityService_CreateWorkloadIdentity(t *testing.T) {
 			proto.Clone(want).(*workloadidentityv1pb.WorkloadIdentity),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -123,7 +123,7 @@ func TestWorkloadIdentityService_UpsertWorkloadIdentity(t *testing.T) {
 			proto.Clone(want).(*workloadidentityv1pb.WorkloadIdentity),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -256,7 +256,7 @@ func TestWorkloadIdentityService_GetWorkloadIdentity(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetWorkloadIdentity(ctx, "example")
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -335,15 +335,15 @@ func TestWorkloadIdentityService_UpdateWorkloadIdentity(t *testing.T) {
 			proto.Clone(toCreate).(*workloadidentityv1pb.WorkloadIdentity),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
-		got.Spec.Spiffe.Id = "/changed"
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
+		got.GetSpec().GetSpiffe().SetId("/changed")
 		got2, err := service.UpdateWorkloadIdentity(
 			ctx,
 			// Clone to avoid Marshaling modifying want
 			proto.Clone(got).(*workloadidentityv1pb.WorkloadIdentity),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got2.Metadata.Revision)
+		require.NotEmpty(t, got2.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			got,
 			got2,
@@ -360,8 +360,8 @@ func TestWorkloadIdentityService_UpdateWorkloadIdentity(t *testing.T) {
 			proto.Clone(toCreate).(*workloadidentityv1pb.WorkloadIdentity),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
-		got.Spec.Spiffe.Id = ""
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
+		got.GetSpec().GetSpiffe().SetId("")
 		got2, err := service.UpdateWorkloadIdentity(
 			ctx,
 			// Clone to avoid Marshaling modifying want
diff --git a/lib/services/local/workload_identity_x509_revocation_test.go b/lib/services/local/workload_identity_x509_revocation_test.go
index f79cb470c43..94f82469c66 100644
--- a/lib/services/local/workload_identity_x509_revocation_test.go
+++ b/lib/services/local/workload_identity_x509_revocation_test.go
@@ -55,18 +55,18 @@ func setupWorkloadIdentityX509RevocationServiceTest(
 }
 
 func newValidWorkloadIdentityX509Revocation(clock clockwork.Clock, name string) *workloadidentityv1pb.WorkloadIdentityX509Revocation {
-	return &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+	return workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 		Kind:    types.KindWorkloadIdentityX509Revocation,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    name,
 			Expires: timestamppb.New(clock.Now().Add(time.Hour)),
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 			Reason:    "compromised",
 			RevokedAt: timestamppb.New(clock.Now()),
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func TestWorkloadIdentityX509RevocationService_Create(t *testing.T) {
@@ -80,7 +80,7 @@ func TestWorkloadIdentityX509RevocationService_Create(t *testing.T) {
 			proto.Clone(want).(*workloadidentityv1pb.WorkloadIdentityX509Revocation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -124,7 +124,7 @@ func TestWorkloadIdentityX509RevocationService_Upsert(t *testing.T) {
 			proto.Clone(want).(*workloadidentityv1pb.WorkloadIdentityX509Revocation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -214,7 +214,7 @@ func TestWorkloadIdentityX509RevocationService_Get(t *testing.T) {
 		require.NoError(t, err)
 		got, err := service.GetWorkloadIdentityX509Revocation(ctx, "aa")
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			want,
 			got,
@@ -293,15 +293,15 @@ func TestWorkloadIdentityX509RevocationService_Update(t *testing.T) {
 			proto.Clone(toCreate).(*workloadidentityv1pb.WorkloadIdentityX509Revocation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
-		got.Spec.Reason = "changed"
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
+		got.GetSpec().SetReason("changed")
 		got2, err := service.UpdateWorkloadIdentityX509Revocation(
 			ctx,
 			// Clone to avoid Marshaling modifying want
 			proto.Clone(got).(*workloadidentityv1pb.WorkloadIdentityX509Revocation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got2.Metadata.Revision)
+		require.NotEmpty(t, got2.GetMetadata().GetRevision())
 		require.Empty(t, cmp.Diff(
 			got,
 			got2,
@@ -318,8 +318,8 @@ func TestWorkloadIdentityX509RevocationService_Update(t *testing.T) {
 			proto.Clone(toCreate).(*workloadidentityv1pb.WorkloadIdentityX509Revocation),
 		)
 		require.NoError(t, err)
-		require.NotEmpty(t, got.Metadata.Revision)
-		got.Spec.Reason = ""
+		require.NotEmpty(t, got.GetMetadata().GetRevision())
+		got.GetSpec().SetReason("")
 		got2, err := service.UpdateWorkloadIdentityX509Revocation(
 			ctx,
 			// Clone to avoid Marshaling modifying want
diff --git a/lib/services/notifications.go b/lib/services/notifications.go
index d560111e025..9b7443f68e9 100644
--- a/lib/services/notifications.go
+++ b/lib/services/notifications.go
@@ -55,19 +55,19 @@ type Notifications interface {
 
 // ValidateNotification verifies that the necessary fields are configured for a notification object.
 func ValidateNotification(notification *notificationsv1.Notification) error {
-	if notification.SubKind == "" {
+	if notification.GetSubKind() == "" {
 		return trace.BadParameter("notification subkind is missing")
 	}
 
-	if notification.Spec == nil {
+	if !notification.HasSpec() {
 		return trace.BadParameter("notification spec is missing")
 	}
 
-	if notification.Metadata == nil {
+	if !notification.HasMetadata() {
 		return trace.BadParameter("notification metadata is missing")
 	}
 
-	if _, exists := notification.Metadata.GetLabels()[types.NotificationTitleLabel]; !exists {
+	if _, exists := notification.GetMetadata().GetLabels()[types.NotificationTitleLabel]; !exists {
 		return trace.BadParameter("notification title label is missing")
 	}
 
@@ -90,19 +90,19 @@ func UnmarshalNotification(data []byte, opts ...MarshalOption) (*notificationsv1
 
 // ValidateGlobalNotification verifies that the necessary fields are configured for a global notification object.
 func ValidateGlobalNotification(globalNotification *notificationsv1.GlobalNotification) error {
-	if globalNotification.Spec == nil {
+	if !globalNotification.HasSpec() {
 		return trace.BadParameter("notification spec is missing")
 	}
 
-	if globalNotification.Spec.Matcher == nil {
+	if !globalNotification.GetSpec().HasMatcher() {
 		return trace.BadParameter("matcher is missing, a matcher is required for a global notification")
 	}
 
-	if err := ValidateNotification(globalNotification.Spec.Notification); err != nil {
+	if err := ValidateNotification(globalNotification.GetSpec().GetNotification()); err != nil {
 		return trace.Wrap(err)
 	}
 
-	if globalNotification.Spec.Notification.Spec.Username != "" {
+	if globalNotification.GetSpec().GetNotification().GetSpec().GetUsername() != "" {
 		return trace.BadParameter("a global notification cannot have a username")
 	}
 
@@ -125,11 +125,11 @@ func UnmarshalGlobalNotification(data []byte, opts ...MarshalOption) (*notificat
 
 // ValidateUserNotificationState verifies that the necessary fields are configured for user notification state object.
 func ValidateUserNotificationState(notificationState *notificationsv1.UserNotificationState) error {
-	if notificationState.Spec.NotificationId == "" {
+	if notificationState.GetSpec().GetNotificationId() == "" {
 		return trace.BadParameter("notification id is missing")
 	}
 
-	if notificationState.Status == nil {
+	if !notificationState.HasStatus() {
 		return trace.BadParameter("notification state status is missing")
 	}
 
@@ -152,7 +152,7 @@ func UnmarshalUserNotificationState(data []byte, opts ...MarshalOption) (*notifi
 
 // ValidateUserLastSeenNotification verifies that the necessary fields are configured for a user's last seen notification timestamp object.
 func ValidateUserLastSeenNotification(lastSeenNotification *notificationsv1.UserLastSeenNotification) error {
-	if lastSeenNotification.Status.LastSeenTime == nil {
+	if !lastSeenNotification.GetStatus().HasLastSeenTime() {
 		return trace.BadParameter("last seen time is missing")
 	}
 
@@ -175,7 +175,7 @@ func UnmarshalUserLastSeenNotification(data []byte, opts ...MarshalOption) (*not
 
 // ValidateUniqueNotificationIdentifier verifies that the necessary fields are configured for a unique notification identifier object.
 func ValidateUniqueNotificationIdentifier(uni *notificationsv1.UniqueNotificationIdentifier) error {
-	if uni.Spec.UniqueIdentifier == "" {
+	if uni.GetSpec().GetUniqueIdentifier() == "" {
 		return trace.BadParameter("unique notification identifier key is missing")
 	}
 
diff --git a/lib/services/notifications_cache_test.go b/lib/services/notifications_cache_test.go
index 083a731f8bd..128b59ec44a 100644
--- a/lib/services/notifications_cache_test.go
+++ b/lib/services/notifications_cache_test.go
@@ -26,6 +26,7 @@ import (
 	"github.com/gravitational/trace"
 	"github.com/jonboulle/clockwork"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
@@ -423,14 +424,14 @@ func newUserNotification(t *testing.T, username string, title string) *notificat
 
 	notification := notificationsv1.Notification{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: username,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
+		}.Build(),
 	}
 
 	return &notification
@@ -440,20 +441,18 @@ func newGlobalNotification(t *testing.T, title string) *notificationsv1.GlobalNo
 	t.Helper()
 
 	notification := notificationsv1.GlobalNotification{
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Labels: map[string]string{
 						types.NotificationTitleLabel: title,
 					},
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	}
 
 	return &notification
diff --git a/lib/services/notifications_test.go b/lib/services/notifications_test.go
index e199a928c20..39923b23f55 100644
--- a/lib/services/notifications_test.go
+++ b/lib/services/notifications_test.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
@@ -34,16 +35,16 @@ import (
 
 // TestMarshalNotificationRoundTrip tests the marshaling and unmarshaling functions for Notification objects.
 func TestMarshalNotificationRoundTrip(t *testing.T) {
-	notification := &notificationsv1.Notification{
+	notification := notificationsv1.Notification_builder{
 		Kind:    types.KindNotification,
 		Version: types.V1,
 		SubKind: "test-subkind",
 		Spec:    &notificationsv1.NotificationSpec{},
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:   "test-notification-1",
 			Labels: map[string]string{types.NotificationTitleLabel: "title-1"},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	payload, err := MarshalNotification(notification)
 	require.NoError(t, err)
@@ -56,24 +57,22 @@ func TestMarshalNotificationRoundTrip(t *testing.T) {
 
 // TestMarshalGlobalNotificationRoundTrip tests the marshaling and unmarshaling functions for GlobalNotification objects.
 func TestMarshalGlobalNotificationRoundTrip(t *testing.T) {
-	notification := &notificationsv1.GlobalNotification{
+	notification := notificationsv1.GlobalNotification_builder{
 		Kind:     types.KindGlobalNotification,
 		Metadata: &headerv1.Metadata{},
 		Version:  types.V1,
-		Spec: &notificationsv1.GlobalNotificationSpec{
-			Matcher: &notificationsv1.GlobalNotificationSpec_All{
-				All: true,
-			},
-			Notification: &notificationsv1.Notification{
+		Spec: notificationsv1.GlobalNotificationSpec_builder{
+			All: proto.Bool(true),
+			Notification: notificationsv1.Notification_builder{
 				SubKind: "test-subkind",
 				Spec:    &notificationsv1.NotificationSpec{},
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:   "test-notification-id",
 					Labels: map[string]string{types.NotificationTitleLabel: "title-1"},
-				},
-			},
-		},
-	}
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	payload, err := MarshalGlobalNotification(notification)
 	require.NoError(t, err)
@@ -86,15 +85,15 @@ func TestMarshalGlobalNotificationRoundTrip(t *testing.T) {
 
 // TestUserNotificationStateRoundTrip tests the marshaling and unmarshaling functions for UserNotificationState objects.
 func TestUserNotificationStateRoundTrip(t *testing.T) {
-	userNotificationState := &notificationsv1.UserNotificationState{
+	userNotificationState := notificationsv1.UserNotificationState_builder{
 		Metadata: &headerv1.Metadata{},
-		Spec: &notificationsv1.UserNotificationStateSpec{
+		Spec: notificationsv1.UserNotificationStateSpec_builder{
 			NotificationId: "test-notification-1",
-		},
-		Status: &notificationsv1.UserNotificationStateStatus{
+		}.Build(),
+		Status: notificationsv1.UserNotificationStateStatus_builder{
 			NotificationState: notificationsv1.NotificationState_NOTIFICATION_STATE_CLICKED,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	payload, err := MarshalUserNotificationState(userNotificationState)
 	require.NoError(t, err)
@@ -108,12 +107,12 @@ func TestUserNotificationStateRoundTrip(t *testing.T) {
 // TestUserLastSeenNotificationRoundTrip tests the marshaling and unmarshaling functions for Notification objects.
 func TestUserLastSeenNotificationStateRoundTrip(t *testing.T) {
 	timestamp := timestamppb.New(time.UnixMilli(1708041600000)) // February 16, 2024 12:00:00 AM UTC
-	userLastSeenNotification := &notificationsv1.UserLastSeenNotification{
+	userLastSeenNotification := notificationsv1.UserLastSeenNotification_builder{
 		Metadata: &headerv1.Metadata{},
-		Status: &notificationsv1.UserLastSeenNotificationStatus{
+		Status: notificationsv1.UserLastSeenNotificationStatus_builder{
 			LastSeenTime: timestamp,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	payload, err := MarshalUserLastSeenNotification(userLastSeenNotification)
 	require.NoError(t, err)
diff --git a/lib/services/presets.go b/lib/services/presets.go
index df24f9d2aca..7a94ef2108a 100644
--- a/lib/services/presets.go
+++ b/lib/services/presets.go
@@ -1054,52 +1054,52 @@ func NewSystemBeamRole(buildType string) types.Role {
 // health checks for all databases resources, and is intended to be used as a
 // virtual default resource. Its name is "default" for historical reasons.
 func VirtualDefaultHealthCheckConfigDB() *healthcheckconfigv1.HealthCheckConfig {
-	return &healthcheckconfigv1.HealthCheckConfig{
+	return healthcheckconfigv1.HealthCheckConfig_builder{
 		Kind:    types.KindHealthCheckConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        teleport.VirtualDefaultHealthCheckConfigDBName,
 			Description: "Enables health checks for all databases by default",
 			// this revision MUST be changed every time we change the contents
 			// of the preset so that conditional updates can check against it
 			Revision: "af391615-1e42-4237-aa2b-155e6abbd41a",
-		},
-		Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
+		}.Build(),
+		Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
 				// match all databases
-				DbLabels: []*labelv1.Label{{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   types.Wildcard,
 					Values: []string{types.Wildcard},
-				}},
-			},
-		},
-	}
+				}.Build()},
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 // VirtualDefaultHealthCheckConfigKube returns a health_check_config enabling
 // health checks for all Kubernetes resources. It's intended to be used as a
 // virtual default resource.
 func VirtualDefaultHealthCheckConfigKube() *healthcheckconfigv1.HealthCheckConfig {
-	return &healthcheckconfigv1.HealthCheckConfig{
+	return healthcheckconfigv1.HealthCheckConfig_builder{
 		Kind:    types.KindHealthCheckConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        teleport.VirtualDefaultHealthCheckConfigKubeName,
 			Description: "Enables health checks for all Kubernetes clusters by default.",
 			// this revision MUST be changed every time we change the contents
 			// of the preset so that conditional updates can check against it
 			Revision: "d796f007-e60c-4747-8dde-f479aff6b743",
-		},
-		Spec: &healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
+		}.Build(),
+		Spec: healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
 				// match all kubernetes clusters
-				KubernetesLabels: []*labelv1.Label{{
+				KubernetesLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   types.Wildcard,
 					Values: []string{types.Wildcard},
-				}},
-			},
-		},
-	}
+				}.Build()},
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 // bootstrapRoleMetadataLabels are metadata labels that will be applied to each role.
diff --git a/lib/services/readonly/readonly_test.go b/lib/services/readonly/readonly_test.go
index 811eaa600b4..ae0fa7abe5d 100644
--- a/lib/services/readonly/readonly_test.go
+++ b/lib/services/readonly/readonly_test.go
@@ -153,12 +153,12 @@ func TestAccessGraphSettings(t *testing.T) {
 	// Create a new cache instance.
 	cache, err := NewCache(CacheConfig{
 		Upstream: &testUpstream{
-			accessGraphSettings: &clusterconfigpb.AccessGraphSettings{
+			accessGraphSettings: clusterconfigpb.AccessGraphSettings_builder{
 				Kind: types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "access-graph-settings",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		TTL: time.Hour,
 	})
diff --git a/lib/services/reconciler_test.go b/lib/services/reconciler_test.go
index 2a4017b7872..d3313fc78fe 100644
--- a/lib/services/reconciler_test.go
+++ b/lib/services/reconciler_test.go
@@ -74,7 +74,7 @@ func TestReconciler(t *testing.T) {
 			registeredResources: []testResource{makeDynamicResource("res1", nil)},
 			newResources: []testResource{
 				makeDynamicResource("res1", nil, func(r *testResource) {
-					r.Metadata.Labels = map[string]string{"env": "dev"}
+					r.Metadata.SetLabels(map[string]string{"env": "dev"})
 				}),
 			},
 		},
@@ -207,9 +207,9 @@ func TestReconciler(t *testing.T) {
 				makeDynamicResource("res4", map[string]string{"env": "prod", "updated": "yes"}),
 			},
 			comparator: func(a, b testResource) int {
-				updated, ok := a.Metadata.Labels["updated"]
+				updated, ok := a.Metadata.GetLabels()["updated"]
 				if !ok {
-					updated, ok = b.Metadata.Labels["updated"]
+					updated, ok = b.Metadata.GetLabels()["updated"]
 					if !ok {
 						panic(`neither resource has "updated" label`)
 					}
@@ -243,16 +243,16 @@ func TestReconciler(t *testing.T) {
 
 			cfg := ReconcilerConfig[testResource]{
 				Matcher: func(tr testResource) bool {
-					return MatchResourceLabels(test.selectors, tr.GetMetadata().Labels)
+					return MatchResourceLabels(test.selectors, tr.GetMetadata().GetLabels())
 				},
 				GetCurrentResources: func() map[string]testResource {
 					return utils.FromSlice[testResource](test.registeredResources, func(t testResource) string {
-						return t.Metadata.Name
+						return t.Metadata.GetName()
 					})
 				},
 				GetNewResources: func() map[string]testResource {
 					return utils.FromSlice[testResource](test.newResources, func(t testResource) string {
-						return t.Metadata.Name
+						return t.Metadata.GetName()
 					})
 				},
 				CompareResources: func(tr1, tr2 testResource) int {
@@ -328,7 +328,7 @@ func TestGenericReconciler(t *testing.T) {
 			selectors := []ResourceMatcher{{
 				Labels: types.Labels{"env": []string{"prod"}},
 			}}
-			return MatchResourceLabels(selectors, tr.GetMetadata().Labels)
+			return MatchResourceLabels(selectors, tr.GetMetadata().GetLabels())
 		},
 		CompareResources: func(tr1, tr2 testResource) int {
 			return EqualFromBool(cmp.Equal(tr1, tr2, cmpopts.IgnoreUnexported(headerv1.Metadata{})))
@@ -488,10 +488,10 @@ func makeResource(name string, labels map[string]string, additionalLabels map[st
 	}
 	maps.Copy(labels, additionalLabels)
 	r := testResource{
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:   name,
 			Labels: labels,
-		},
+		}.Build(),
 	}
 	for _, opt := range opts {
 		opt(&r)
diff --git a/lib/services/resource.go b/lib/services/resource.go
index 7bd66cc8816..6efa5bcfabc 100644
--- a/lib/services/resource.go
+++ b/lib/services/resource.go
@@ -989,7 +989,7 @@ func maybeResetProtoRevisionv2[T ProtoResource](preserveRevision bool, r T) T {
 	}
 
 	cp := proto.Clone(r).(T)
-	cp.GetMetadata().Revision = ""
+	cp.GetMetadata().SetRevision("")
 	return cp
 }
 
@@ -1025,10 +1025,10 @@ func UnmarshalProtoResource[T ProtoResourcePtr[U], U any](data []byte, opts ...M
 		return nil, trace.Wrap(err)
 	}
 	if cfg.Revision != "" {
-		resource.GetMetadata().Revision = cfg.Revision
+		resource.GetMetadata().SetRevision(cfg.Revision)
 	}
 	if !cfg.Expires.IsZero() {
-		resource.GetMetadata().Expires = timestamppb.New(cfg.Expires)
+		resource.GetMetadata().SetExpires(timestamppb.New(cfg.Expires))
 	}
 	return resource, nil
 }
@@ -1091,10 +1091,10 @@ func FastUnmarshalProtoResourceDeprecated[T ProtoResourcePtr[U], U any](data []b
 		return nil, trace.Wrap(err)
 	}
 	if cfg.Revision != "" {
-		resource.GetMetadata().Revision = cfg.Revision
+		resource.GetMetadata().SetRevision(cfg.Revision)
 	}
 	if !cfg.Expires.IsZero() {
-		resource.GetMetadata().Expires = timestamppb.New(cfg.Expires)
+		resource.GetMetadata().SetExpires(timestamppb.New(cfg.Expires))
 	}
 	return resource, nil
 }
diff --git a/lib/services/resource_test.go b/lib/services/resource_test.go
index 2a989cd4d57..018a786df26 100644
--- a/lib/services/resource_test.go
+++ b/lib/services/resource_test.go
@@ -265,14 +265,14 @@ func Test_setResourceName(t *testing.T) {
 func TestProtoResourceRoundtrip(t *testing.T) {
 	t.Parallel()
 
-	resource := &vnet.VnetConfig{
-		Metadata: &headerv1.Metadata{
+	resource := vnet.VnetConfig_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: "vnet_config",
-		},
-		Spec: &vnet.VnetConfigSpec{
+		}.Build(),
+		Spec: vnet.VnetConfigSpec_builder{
 			Ipv4CidrRange: "100.64.0.0/10",
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	for _, tc := range []struct {
 		desc          string
diff --git a/lib/services/role.go b/lib/services/role.go
index eb3de9c493b..fabdbeeb48f 100644
--- a/lib/services/role.go
+++ b/lib/services/role.go
@@ -2743,7 +2743,7 @@ func (set RoleSet) checkAccess(
 		}
 
 		// Mark that MFA is required and continue evaluating access.
-		preconds = append(preconds, &decisionpb.Precondition{Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA})
+		preconds = append(preconds, decisionpb.Precondition_builder{Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA}.Build())
 	}
 
 	requiresLabelMatching := resourceRequiresLabelMatching(r)
@@ -2896,7 +2896,7 @@ func (set RoleSet) checkAccess(
 			}
 
 			// Mark that MFA is required and continue evaluating access.
-			preconds = append(preconds, &decisionpb.Precondition{Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA})
+			preconds = append(preconds, decisionpb.Precondition_builder{Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA}.Build())
 		}
 
 		// Device verification.
@@ -2937,7 +2937,7 @@ func deduplicateAndSortPreconditions(preconds []*decisionpb.Precondition) []*dec
 	// Deduplicate preconditions by kind.
 	preconds = slices.CompactFunc(
 		preconds, func(a, b *decisionpb.Precondition) bool {
-			return a.Kind == b.Kind
+			return a.GetKind() == b.GetKind()
 		},
 	)
 
@@ -2945,7 +2945,7 @@ func deduplicateAndSortPreconditions(preconds []*decisionpb.Precondition) []*dec
 	slices.SortFunc(
 		preconds,
 		func(a, b *decisionpb.Precondition) int {
-			return cmp.Compare(a.Kind, b.Kind)
+			return cmp.Compare(a.GetKind(), b.GetKind())
 		},
 	)
 
diff --git a/lib/services/role_test.go b/lib/services/role_test.go
index b88dc910ac7..d73c4d51650 100644
--- a/lib/services/role_test.go
+++ b/lib/services/role_test.go
@@ -8558,7 +8558,7 @@ func TestHostUsers_getGroups(t *testing.T) {
 			accessChecker := makeAccessCheckerWithRoleSet(tc.roles)
 			hu, err := accessChecker.HostUsers(tc.server)
 			require.NoError(t, err)
-			require.ElementsMatch(t, tc.groups, hu.Info.Groups)
+			require.ElementsMatch(t, tc.groups, hu.Info.GetGroups())
 		})
 	}
 }
@@ -9043,7 +9043,7 @@ func TestHostUsers_CanCreateHostUser(t *testing.T) {
 			if tc.canCreate {
 				require.NotEmpty(t, hu.AllowedBy)
 				require.Empty(t, hu.DeniedBy)
-				require.Equal(t, convertHostUserMode(tc.expectedMode), hu.Info.Mode)
+				require.Equal(t, convertHostUserMode(tc.expectedMode), hu.Info.GetMode())
 			} else {
 				require.NotEmpty(t, hu.DeniedBy)
 				require.Nil(t, hu.Info)
@@ -9855,13 +9855,13 @@ func TestCheckAccessWithLabelExpressions(t *testing.T) {
 		&types.WindowsDesktopV3{ResourceHeader: types.ResourceHeader{Kind: types.KindWindowsDesktop}},
 		&types.WindowsDesktopServiceV3{ResourceHeader: types.ResourceHeader{Kind: types.KindWindowsDesktopService}},
 		&types.UserGroupV1{ResourceHeader: types.ResourceHeader{Kind: types.KindUserGroup}},
-		types.Resource153ToResourceWithLabels(&beamsv1.Beam{
+		types.Resource153ToResourceWithLabels(beamsv1.Beam_builder{
 			Kind:    types.KindBeam,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Labels: map[string]string{},
-			},
-		}),
+			}.Build(),
+		}.Build()),
 	}
 	for _, r := range resources {
 		r.SetStaticLabels(map[string]string{"env": "prod"})
diff --git a/lib/services/scoped_access_checker.go b/lib/services/scoped_access_checker.go
index db721c5532d..c6f2df88400 100644
--- a/lib/services/scoped_access_checker.go
+++ b/lib/services/scoped_access_checker.go
@@ -86,9 +86,9 @@ func (b *scopedAccessCheckerBuilder) newCheckerForRole(ctx context.Context, key
 		return nil, trace.BadParameter("cannot build checker for non-user role kind %q (this is a bug)", key.RoleKind)
 	}
 
-	rsp, err := b.reader.GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+	rsp, err := b.reader.GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 		Name: key.RoleName,
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotFound(err) {
 			return nil, errMissingAssignedRole
@@ -99,7 +99,7 @@ func (b *scopedAccessCheckerBuilder) newCheckerForRole(ctx context.Context, key
 	// verify that the role is enforceable at this enforcement point. if not, the assignment is
 	// skipped. this check is a critical part of the scopes security model and must always be
 	// performed prior to any enforcement logic related to a scoped role.
-	if !scopedaccess.RoleIsEnforceableAt(rsp.Role, scopes.EnforcementPoint{
+	if !scopedaccess.RoleIsEnforceableAt(rsp.GetRole(), scopes.EnforcementPoint{
 		ScopeOfOrigin: key.ScopeOfOrigin,
 		ScopeOfEffect: key.ScopeOfEffect,
 	}) {
@@ -108,7 +108,7 @@ func (b *scopedAccessCheckerBuilder) newCheckerForRole(ctx context.Context, key
 
 	// Convert the scoped role to a classic role using the scope of effect.
 	// The scope of effect determines which resources this role's privileges apply to.
-	role, err := scopedaccess.ScopedRoleToRole(rsp.Role, key.ScopeOfEffect)
+	role, err := scopedaccess.ScopedRoleToRole(rsp.GetRole(), key.ScopeOfEffect)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -123,7 +123,7 @@ func (b *scopedAccessCheckerBuilder) newCheckerForRole(ctx context.Context, key
 	return &ScopedAccessChecker{
 		scopeOfOrigin:       key.ScopeOfOrigin,
 		scopeOfEffect:       key.ScopeOfEffect,
-		role:                rsp.Role,
+		role:                rsp.GetRole(),
 		scopedCompatChecker: checker,
 	}, nil
 }
@@ -139,16 +139,16 @@ func (b *scopedAccessCheckerBuilder) newDefaultImplicitChecker(_ context.Context
 		scopeOfOrigin:       scopes.Root,
 		scopeOfEffect:       scopes.Root,
 		scopedCompatChecker: newAccessChecker(b.info, b.localCluster, NewRoleSet()), // default implicit role definition is auto-populated by NewRoleSet()
-		role: &scopedaccessv1.ScopedRole{
-			Metadata: &headerv1.Metadata{
+		role: scopedaccessv1.ScopedRole_builder{
+			Metadata: headerv1.Metadata_builder{
 				Name: constants.DefaultImplicitRole,
-			},
+			}.Build(),
 			Scope: scopes.Root,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{scopes.Root},
-			},
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 }
 
@@ -201,16 +201,16 @@ func NewScopedAccessCheckerForSystemRole(roleName string, checker AccessChecker)
 	return &ScopedAccessChecker{
 		scopeOfOrigin: scopes.Root,
 		scopeOfEffect: scopes.Root,
-		role: &scopedaccessv1.ScopedRole{
-			Metadata: &headerv1.Metadata{
+		role: scopedaccessv1.ScopedRole_builder{
+			Metadata: headerv1.Metadata_builder{
 				Name: "system/" + roleName,
-			},
+			}.Build(),
 			Scope:   scopes.Root,
 			Version: types.V1,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{scopes.Root},
-			},
-		},
+			}.Build(),
+		}.Build(),
 		scopedCompatChecker: checker,
 	}
 }
diff --git a/lib/services/scoped_access_checker_context_test.go b/lib/services/scoped_access_checker_context_test.go
index 3886c83007c..268be9d600a 100644
--- a/lib/services/scoped_access_checker_context_test.go
+++ b/lib/services/scoped_access_checker_context_test.go
@@ -33,10 +33,10 @@ func TestScopedAccessCheckerContextRiskyAuthorizeUnpinnedRead(t *testing.T) {
 	ctx := t.Context()
 	checkerContext, err := NewScopedAccessCheckerContext(ctx, &AccessInfo{
 		Username: "alice",
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/test/scope",
-		},
+		}.Build(),
 	}, "test-cluster", emptyScopedRoleReader{})
 	require.NoError(t, err)
 
@@ -98,13 +98,13 @@ func TestScopedAccessCheckerContextAgentPin(t *testing.T) {
 	const pinScope = "/test/scope"
 
 	newAgentPin := func(scope string, role types.SystemRole) *scopesv1.Pin {
-		return &scopesv1.Pin{
+		return scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 			Scope: scope,
-			SystemRoles: &scopesv1.SystemRoles{
+			SystemRoles: scopesv1.SystemRoles_builder{
 				Primary: role.String(),
-			},
-		}
+			}.Build(),
+		}.Build()
 	}
 
 	t.Run("constructor rejects nil pin", func(t *testing.T) {
diff --git a/lib/services/sigstore_policies.go b/lib/services/sigstore_policies.go
index 2a659884a60..da5082e487b 100644
--- a/lib/services/sigstore_policies.go
+++ b/lib/services/sigstore_policies.go
@@ -108,9 +108,9 @@ func ValidateSigstorePolicy(s *workloadidentityv1pb.SigstorePolicy) error {
 		return trace.BadParameter("spec.requirements: is required")
 	}
 
-	switch v := s.GetSpec().GetAuthority().(type) {
-	case *workloadidentityv1pb.SigstorePolicySpec_Key:
-		public := v.Key.GetPublic()
+	switch s.GetSpec().WhichAuthority() {
+	case workloadidentityv1pb.SigstorePolicySpec_Key_case:
+		public := s.GetSpec().GetKey().GetPublic()
 		if public == "" {
 			return trace.BadParameter("spec.key.public: is required")
 		}
@@ -128,12 +128,12 @@ func ValidateSigstorePolicy(s *workloadidentityv1pb.SigstorePolicy) error {
 		if _, err := x509.ParsePKIXPublicKey(block.Bytes); err != nil {
 			return trace.BadParameter("spec.key.public: failed to parse public key: %v", err)
 		}
-	case *workloadidentityv1pb.SigstorePolicySpec_Keyless:
-		if len(v.Keyless.GetIdentities()) == 0 {
+	case workloadidentityv1pb.SigstorePolicySpec_Keyless_case:
+		if len(s.GetSpec().GetKeyless().GetIdentities()) == 0 {
 			return trace.BadParameter("spec.keyless.identities: at least one trusted identity is required")
 		}
 
-		for idx, identity := range v.Keyless.GetIdentities() {
+		for idx, identity := range s.GetSpec().GetKeyless().GetIdentities() {
 			switch {
 			case identity.GetIssuer() != "":
 			case identity.GetIssuerRegex() != "":
@@ -156,7 +156,7 @@ func ValidateSigstorePolicy(s *workloadidentityv1pb.SigstorePolicy) error {
 		}
 
 		roots := make(root.TrustedMaterialCollection, 0)
-		for idx, trustedRoot := range v.Keyless.GetTrustedRoots() {
+		for idx, trustedRoot := range s.GetSpec().GetKeyless().GetTrustedRoots() {
 			root, err := root.NewTrustedRootFromJSON([]byte(trustedRoot))
 			if err != nil {
 				return trace.BadParameter("spec.keyless.trusted_roots[%d]: failed to parse trusted root: %v", idx, err)
diff --git a/lib/services/sigstore_policies_test.go b/lib/services/sigstore_policies_test.go
index 9a300621c09..98211217af3 100644
--- a/lib/services/sigstore_policies_test.go
+++ b/lib/services/sigstore_policies_test.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	workloadidentityv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/workloadidentity/v1"
@@ -38,173 +39,155 @@ func TestValidateSigstorePolicy(t *testing.T) {
 	}{
 		"no metadata": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Metadata = nil
+				p.ClearMetadata()
 			},
 			err: "metadata: is required",
 		},
 		"no name": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Metadata.Name = ""
+				p.GetMetadata().SetName("")
 			},
 			err: "metadata.name: is required",
 		},
 		"invalid version": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Version = "1000000"
+				p.SetVersion("1000000")
 			},
 			err: `version: only "v1" is supported`,
 		},
 		"invalid kind": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Kind = types.KindWorkloadIdentity
+				p.SetKind(types.KindWorkloadIdentity)
 			},
 			err: `kind: must be "sigstore_policy`,
 		},
 		"invalid sub_kind": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.SubKind = "hello world"
+				p.SetSubKind("hello world")
 			},
 			err: `sub_kind: must be empty`,
 		},
 		"no spec": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec = nil
+				p.ClearSpec()
 			},
 			err: "spec: is required",
 		},
 		"no authority": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = nil
+				p.GetSpec().ClearAuthority()
 			},
 			err: "spec.authority: key or keyless authority is required",
 		},
 		"empty key authority": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Key{}
+				p.GetSpec().Authority = &workloadidentityv1.SigstorePolicySpec_Key{}
 			},
 			err: "spec.authority: key or keyless authority is required",
 		},
 		"empty keyless authority": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Keyless{}
+				p.GetSpec().Authority = &workloadidentityv1.SigstorePolicySpec_Keyless{}
 			},
 			err: "spec.authority: key or keyless authority is required",
 		},
 		"no public key": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Key{
-					Key: &workloadidentityv1.SigstoreKeyAuthority{
-						Public: "",
-					},
-				}
+				p.GetSpec().SetKey(workloadidentityv1.SigstoreKeyAuthority_builder{
+					Public: "",
+				}.Build())
 			},
 			err: "spec.key.public: is required",
 		},
 		"public key is not PEM": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Key{
-					Key: &workloadidentityv1.SigstoreKeyAuthority{
-						Public: "NOT PEM",
-					},
-				}
+				p.GetSpec().SetKey(workloadidentityv1.SigstoreKeyAuthority_builder{
+					Public: "NOT PEM",
+				}.Build())
 			},
 			err: "spec.key.public: is not PEM encoded",
 		},
 		"public key is not a public key": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Key{
-					Key: &workloadidentityv1.SigstoreKeyAuthority{
-						Public: "\n-----BEGIN RSA PRIVATE KEY-----\n-----END RSA PRIVATE KEY-----\n",
-					},
-				}
+				p.GetSpec().SetKey(workloadidentityv1.SigstoreKeyAuthority_builder{
+					Public: "\n-----BEGIN RSA PRIVATE KEY-----\n-----END RSA PRIVATE KEY-----\n",
+				}.Build())
 			},
 			err: "spec.key.public: must contain a public key, not: 'RSA PRIVATE KEY'",
 		},
 		"public key contains more than one key": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Key{
-					Key: &workloadidentityv1.SigstoreKeyAuthority{
-						Public: strings.Repeat("\n-----BEGIN PUBLIC KEY-----\n-----END PUBLIC KEY-----\n", 2),
-					},
-				}
+				p.GetSpec().SetKey(workloadidentityv1.SigstoreKeyAuthority_builder{
+					Public: strings.Repeat("\n-----BEGIN PUBLIC KEY-----\n-----END PUBLIC KEY-----\n", 2),
+				}.Build())
 			},
 			err: "spec.key.public: must contain exactly one public key",
 		},
 		"public key is malformed": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Authority = &workloadidentityv1.SigstorePolicySpec_Key{
-					Key: &workloadidentityv1.SigstoreKeyAuthority{
-						Public: "\n-----BEGIN PUBLIC KEY-----\nYm9ndXMK\n-----END PUBLIC KEY-----\n",
-					},
-				}
+				p.GetSpec().SetKey(workloadidentityv1.SigstoreKeyAuthority_builder{
+					Public: "\n-----BEGIN PUBLIC KEY-----\nYm9ndXMK\n-----END PUBLIC KEY-----\n",
+				}.Build())
 			},
 			err: "spec.key.public: failed to parse public key: asn1: structure error",
 		},
 		"no keyless authorities": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.GetKeyless().Identities = nil
+				p.GetSpec().GetKeyless().SetIdentities(nil)
 			},
 			err: "spec.keyless.identities: at least one trusted identity is required",
 		},
 		"no keyless identity subject": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.GetKeyless().Identities = []*workloadidentityv1.SigstoreKeylessSigningIdentity{
+				p.GetSpec().GetKeyless().SetIdentities([]*workloadidentityv1.SigstoreKeylessSigningIdentity{
 					{
 						SubjectMatcher: nil,
 						IssuerMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_Issuer{
 							Issuer: "some issuer",
 						},
 					},
-				}
+				})
 			},
 			err: "spec.keyless.identities[0].subject_matcher: subject or subject_regex is required",
 		},
 		"keyless identity subject_regex invalid": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.GetKeyless().Identities = []*workloadidentityv1.SigstoreKeylessSigningIdentity{
-					{
-						SubjectMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_SubjectRegex{
-							SubjectRegex: `(abc[def`,
-						},
-						IssuerMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_Issuer{
-							Issuer: "some issuer",
-						},
-					},
-				}
+				p.GetSpec().GetKeyless().SetIdentities([]*workloadidentityv1.SigstoreKeylessSigningIdentity{
+					workloadidentityv1.SigstoreKeylessSigningIdentity_builder{
+						SubjectRegex: proto.String(`(abc[def`),
+						Issuer:       proto.String("some issuer"),
+					}.Build(),
+				})
 			},
 			err: "spec.keyless.identities[0].subject_regex: failed to parse regex",
 		},
 		"no keyless identity issuer": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.GetKeyless().Identities = []*workloadidentityv1.SigstoreKeylessSigningIdentity{
+				p.GetSpec().GetKeyless().SetIdentities([]*workloadidentityv1.SigstoreKeylessSigningIdentity{
 					{
 						IssuerMatcher: nil,
 						SubjectMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_Subject{
 							Subject: "some subject",
 						},
 					},
-				}
+				})
 			},
 			err: "spec.keyless.identities[0].issuer_matcher: issuer or issuer_regex is required",
 		},
 		"keyless identity issuer_regex invalid": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.GetKeyless().Identities = []*workloadidentityv1.SigstoreKeylessSigningIdentity{
-					{
-						IssuerMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_IssuerRegex{
-							IssuerRegex: `(abc[def`,
-						},
-						SubjectMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_Subject{
-							Subject: "some subject",
-						},
-					},
-				}
+				p.GetSpec().GetKeyless().SetIdentities([]*workloadidentityv1.SigstoreKeylessSigningIdentity{
+					workloadidentityv1.SigstoreKeylessSigningIdentity_builder{
+						IssuerRegex: proto.String(`(abc[def`),
+						Subject:     proto.String("some subject"),
+					}.Build(),
+				})
 			},
 			err: "spec.keyless.identities[0].issuer_regex: failed to parse regex",
 		},
 		"keyless invalid trusted_roots": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.GetKeyless().TrustedRoots = []string{`{}`}
+				p.GetSpec().GetKeyless().SetTrustedRoots([]string{`{}`})
 			},
 			err: "spec.keyless.trusted_roots[0]: failed to parse trusted root",
 		},
@@ -244,38 +227,38 @@ func TestValidateSigstorePolicy(t *testing.T) {
 				  "tlogs": []
 				}
 				`
-				p.Spec.GetKeyless().TrustedRoots = []string{root}
+				p.GetSpec().GetKeyless().SetTrustedRoots([]string{root})
 			},
 			err: "spec.keyless.trusted_roots: must configure at least one transparency log or timestamp authority",
 		},
 		"no requirements": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Requirements = nil
+				p.GetSpec().ClearRequirements()
 			},
 			err: "spec.requirements: is required",
 		},
 		"empty requirements": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Requirements = &workloadidentityv1.SigstorePolicyRequirements{}
+				p.GetSpec().SetRequirements(&workloadidentityv1.SigstorePolicyRequirements{})
 			},
 			err: "spec.requirements: either artifact_signature or attestations is required",
 		},
 		"required attestation empty predicate": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Requirements.Attestations = []*workloadidentityv1.InTotoAttestationMatcher{
-					{PredicateType: ""},
-				}
+				p.GetSpec().GetRequirements().SetAttestations([]*workloadidentityv1.InTotoAttestationMatcher{
+					workloadidentityv1.InTotoAttestationMatcher_builder{PredicateType: ""}.Build(),
+				})
 			},
 			err: "spec.requirements.attestations[0].predicate_type: is required",
 		},
 		"attestations and artifact signature": {
 			mod: func(p *workloadidentityv1.SigstorePolicy) {
-				p.Spec.Requirements = &workloadidentityv1.SigstorePolicyRequirements{
+				p.GetSpec().SetRequirements(workloadidentityv1.SigstorePolicyRequirements_builder{
 					ArtifactSignature: true,
 					Attestations: []*workloadidentityv1.InTotoAttestationMatcher{
-						{PredicateType: "https://slsa.dev/provenance/v1"},
+						workloadidentityv1.InTotoAttestationMatcher_builder{PredicateType: "https://slsa.dev/provenance/v1"}.Build(),
 					},
-				}
+				}.Build())
 			},
 			err: "spec.requirements: artifact_signature and attestations are mutually exclusive",
 		},
@@ -293,32 +276,26 @@ func TestValidateSigstorePolicy(t *testing.T) {
 }
 
 func validSigstorePolicy() *workloadidentityv1.SigstorePolicy {
-	return &workloadidentityv1.SigstorePolicy{
+	return workloadidentityv1.SigstorePolicy_builder{
 		Kind:    types.KindSigstorePolicy,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "github-provenance",
-		},
-		Spec: &workloadidentityv1.SigstorePolicySpec{
-			Authority: &workloadidentityv1.SigstorePolicySpec_Keyless{
-				Keyless: &workloadidentityv1.SigstoreKeylessAuthority{
-					Identities: []*workloadidentityv1.SigstoreKeylessSigningIdentity{
-						{
-							IssuerMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_Issuer{
-								Issuer: "https://token.actions.githubusercontent.com",
-							},
-							SubjectMatcher: &workloadidentityv1.SigstoreKeylessSigningIdentity_SubjectRegex{
-								SubjectRegex: `https://github.com/mycompany/.*/\.github/workflows/.*@.*`,
-							},
-						},
-					},
+		}.Build(),
+		Spec: workloadidentityv1.SigstorePolicySpec_builder{
+			Keyless: workloadidentityv1.SigstoreKeylessAuthority_builder{
+				Identities: []*workloadidentityv1.SigstoreKeylessSigningIdentity{
+					workloadidentityv1.SigstoreKeylessSigningIdentity_builder{
+						Issuer:       proto.String("https://token.actions.githubusercontent.com"),
+						SubjectRegex: proto.String(`https://github.com/mycompany/.*/\.github/workflows/.*@.*`),
+					}.Build(),
 				},
-			},
-			Requirements: &workloadidentityv1.SigstorePolicyRequirements{
+			}.Build(),
+			Requirements: workloadidentityv1.SigstorePolicyRequirements_builder{
 				Attestations: []*workloadidentityv1.InTotoAttestationMatcher{
-					{PredicateType: "https://slsa.dev/provenance/v1"},
+					workloadidentityv1.InTotoAttestationMatcher_builder{PredicateType: "https://slsa.dev/provenance/v1"}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/services/spiffe_federations.go b/lib/services/spiffe_federations.go
index 266c7b759fa..189b65a2265 100644
--- a/lib/services/spiffe_federations.go
+++ b/lib/services/spiffe_federations.go
@@ -74,26 +74,26 @@ func ValidateSPIFFEFederation(s *machineidv1.SPIFFEFederation) error {
 	switch {
 	case s == nil:
 		return trace.BadParameter("object cannot be nil")
-	case s.Version != types.V1:
+	case s.GetVersion() != types.V1:
 		return trace.BadParameter("version: only %q is supported", types.V1)
-	case s.Kind != types.KindSPIFFEFederation:
+	case s.GetKind() != types.KindSPIFFEFederation:
 		return trace.BadParameter("kind: must be %q", types.KindSPIFFEFederation)
-	case s.Metadata == nil:
+	case !s.HasMetadata():
 		return trace.BadParameter("metadata: is required")
-	case s.Metadata.Name == "":
+	case s.GetMetadata().GetName() == "":
 		return trace.BadParameter("metadata.name: is required")
-	case s.Spec == nil:
+	case !s.HasSpec():
 		return trace.BadParameter("spec: is required")
-	case s.Spec.BundleSource == nil:
+	case !s.GetSpec().HasBundleSource():
 		return trace.BadParameter("spec.bundle_source: is required")
-	case s.Spec.BundleSource.HttpsWeb != nil && s.Spec.BundleSource.Static != nil:
+	case s.GetSpec().GetBundleSource().HasHttpsWeb() && s.GetSpec().GetBundleSource().HasStatic():
 		return trace.BadParameter("spec.bundle_source: at most one of https_web or static can be set")
-	case s.Spec.BundleSource.HttpsWeb == nil && s.Spec.BundleSource.Static == nil:
+	case !s.GetSpec().GetBundleSource().HasHttpsWeb() && !s.GetSpec().GetBundleSource().HasStatic():
 		return trace.BadParameter("spec.bundle_source: at least one of https_web or static must be set")
 	}
 
 	// Validate name is valid SPIFFE Trust Domain name without the "spiffe://"
-	name := s.Metadata.Name
+	name := s.GetMetadata().GetName()
 	if strings.HasPrefix(name, "spiffe://") {
 		return trace.BadParameter(
 			"metadata.name: must not include the spiffe:// prefix",
@@ -105,25 +105,25 @@ func ValidateSPIFFEFederation(s *machineidv1.SPIFFEFederation) error {
 	}
 
 	// Validate Static
-	if s.Spec.BundleSource.Static != nil {
-		if s.Spec.BundleSource.Static.Bundle == "" {
+	if s.GetSpec().GetBundleSource().HasStatic() {
+		if s.GetSpec().GetBundleSource().GetStatic().GetBundle() == "" {
 			return trace.BadParameter("spec.bundle_source.static.bundle: is required")
 		}
 		// Validate contents
 		// TODO(noah): Is this a bit intense to run on every validation?
 		// This could easily be moved into reconciliation...
-		_, err := spiffebundle.Parse(td, []byte(s.Spec.BundleSource.Static.Bundle))
+		_, err := spiffebundle.Parse(td, []byte(s.GetSpec().GetBundleSource().GetStatic().GetBundle()))
 		if err != nil {
 			return trace.Wrap(err, "validating spec.bundle_source.static.bundle")
 		}
 	}
 
 	// Validate HTTPSWeb
-	if s.Spec.BundleSource.HttpsWeb != nil {
-		if s.Spec.BundleSource.HttpsWeb.BundleEndpointUrl == "" {
+	if s.GetSpec().GetBundleSource().HasHttpsWeb() {
+		if s.GetSpec().GetBundleSource().GetHttpsWeb().GetBundleEndpointUrl() == "" {
 			return trace.BadParameter("spec.bundle_source.https_web.bundle_endpoint_url: is required")
 		}
-		_, err := url.Parse(s.Spec.BundleSource.HttpsWeb.BundleEndpointUrl)
+		_, err := url.Parse(s.GetSpec().GetBundleSource().GetHttpsWeb().GetBundleEndpointUrl())
 		if err != nil {
 			return trace.Wrap(err, "validating spec.bundle_source.https_web.bundle_endpoint_url")
 		}
@@ -131,9 +131,9 @@ func ValidateSPIFFEFederation(s *machineidv1.SPIFFEFederation) error {
 
 	// Ensure that all key status fields are set if any are set. This is a safeguard against weird inconsistent states
 	// where some fields are set and others are not.
-	currentBundleSet := s.Status.GetCurrentBundle() != ""
-	currentBundledSyncedAtSet := s.Status.GetCurrentBundleSyncedAt() != nil
-	currentBundleSyncedFromSet := s.Status.GetCurrentBundleSyncedFrom() != nil
+	currentBundleSet := s.GetStatus().GetCurrentBundle() != ""
+	currentBundledSyncedAtSet := s.GetStatus().GetCurrentBundleSyncedAt() != nil
+	currentBundleSyncedFromSet := s.GetStatus().GetCurrentBundleSyncedFrom() != nil
 	anyStatusFieldSet := currentBundleSet || currentBundledSyncedAtSet || currentBundleSyncedFromSet
 	allStatusFieldsSet := currentBundleSet && currentBundledSyncedAtSet && currentBundleSyncedFromSet
 	if anyStatusFieldSet && !allStatusFieldsSet {
diff --git a/lib/services/spiffe_federations_test.go b/lib/services/spiffe_federations_test.go
index b499e9fdb27..a2f028fb95b 100644
--- a/lib/services/spiffe_federations_test.go
+++ b/lib/services/spiffe_federations_test.go
@@ -47,38 +47,38 @@ func TestValidateSPIFFEFederation(t *testing.T) {
 	}{
 		{
 			name: "success - https_web",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/foo",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
 			name: "success - static",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						Static: &machineidv1.SPIFFEFederationBundleSourceStatic{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						Static: machineidv1.SPIFFEFederationBundleSourceStatic_builder{
 							Bundle: `{"keys":[{"use":"x509-svid","kty":"RSA","n":"1AgwZOvyaX_rdEzZsTk6WPAmW0rkz_yM2KTo_6tp8Qck7F1O75ssLUWRJh7IIZlWjXA0Nfc7DQiJw40ClGRds2kD-hJnsVa1UhP0QF9a02dP4ormhoCtOQMRsOJq4CkiuzowfkIRNkc1As5cMocAHhIKcu9H15fYEve390Oy7k3cJwTroRL0JXx8eYS32ae_d5S5QtgXYJvNpB1IumC2hJrkddTW97ozP53H6Vt6JdFpnZNqLXTCKm-pUebzEQ6RCCeLbKNS_NLvixL-4hlPelokUaMaPWnqZvJ0u4txhTSDbcwzjFXznqs6C9LUt3mzUQ_OudX1nsDk0wPab32HgQ","e":"AQAB","x5c":["MIIDnjCCAoagAwIBAgIQQwsx6y8q17q9cU6TsyuQ6zANBgkqhkiG9w0BAQsFADBpMRowGAYDVQQKExFsZWFmLnRlbGUub3R0ci5zaDEaMBgGA1UEAxMRbGVhZi50ZWxlLm90dHIuc2gxLzAtBgNVBAUTJjg5MTE2NDAzNDU0MzE5NjA1NDcyMDA1MDQyMDc3NDU1NTg1NTE1MB4XDTI0MDgwMTA5NDQ0NloXDTM0MDczMDA5NDQ0NlowaTEaMBgGA1UEChMRbGVhZi50ZWxlLm90dHIuc2gxGjAYBgNVBAMTEWxlYWYudGVsZS5vdHRyLnNoMS8wLQYDVQQFEyY4OTExNjQwMzQ1NDMxOTYwNTQ3MjAwNTA0MjA3NzQ1NTU4NTUxNTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANQIMGTr8ml/63RM2bE5OljwJltK5M/8jNik6P+rafEHJOxdTu+bLC1FkSYeyCGZVo1wNDX3Ow0IicONApRkXbNpA/oSZ7FWtVIT9EBfWtNnT+KK5oaArTkDEbDiauApIrs6MH5CETZHNQLOXDKHAB4SCnLvR9eX2BL3t/dDsu5N3CcE66ES9CV8fHmEt9mnv3eUuULYF2CbzaQdSLpgtoSa5HXU1ve6Mz+dx+lbeiXRaZ2Tai10wipvqVHm8xEOkQgni2yjUvzS74sS/uIZT3paJFGjGj1p6mbydLuLcYU0g23MM4xV856rOgvS1Ld5s1EPzrnV9Z7A5NMD2m99h4ECAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgGmMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFrGpt59RUgaAoD5MQEa8McxNOIPMA0GCSqGSIb3DQEBCwUAA4IBAQBRhYIeYU7YW+DxQgIB4gtoM+d0+FOCbteq2IAOjCzZC0rqds4nO1hCFSLaBa8a7GIrW4KoObBJDANRXUokrbbm+zwzj66Rcjj9cKOw/YTbYDu/FXGxY4nNwuI0oFg5CWV+XGepQ5xtGavISTqFK+ctrrIhlvhw+z4xMz4kw6IsMta+WrYPJv1DDoAm/qdZ8Ituvx1cx8THLCSxiXCVgm+AwzlKV4CXU12oY6xrBbHrSxUb/EfnX1KkvFGqQgjDZE+PjClNIN1qS0G2BuWYtjl3pRhiuA9I4B4u31F3wX7LtSlNdzesJeTEGJzcmgHjVr5voozHIeNq/fV/SgjYz2Do"]}],"spiffe_refresh_hint":300}`,
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
@@ -88,125 +88,125 @@ func TestValidateSPIFFEFederation(t *testing.T) {
 		},
 		{
 			name: "fail - nil metadata",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/foo",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata: is required"),
 		},
 		{
 			name: "fail - no name",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/foo",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: is required"),
 		},
 		{
 			name: "fail - bad url",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: ":::::",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("validating spec.bundle_source.https_web.bundle_endpoint_url"),
 		},
 		{
 			name: "fail - bad bundle",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						Static: &machineidv1.SPIFFEFederationBundleSourceStatic{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						Static: machineidv1.SPIFFEFederationBundleSourceStatic_builder{
 							Bundle: "xyzzy",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("validating spec.bundle_source.static.bundle"),
 		},
 		{
 			name: "fail - name contains prefix",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "spiffe://example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/foo",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: must not include the spiffe:// prefix"),
 		},
 		{
 			name: "fail - wrong kind",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindUser,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/foo",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`kind: must be "spiffe_federation"`),
 		},
 		{
 			name: "fail - wrong version",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindUser,
 				Version: types.V3,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example.com",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com/foo",
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`version: only "v1" is supported`),
 		},
 	}
@@ -229,24 +229,24 @@ func TestSPIFFEFederationMarshaling(t *testing.T) {
 	}{
 		{
 			name: "normal",
-			in: &machineidv1.SPIFFEFederation{
+			in: machineidv1.SPIFFEFederation_builder{
 				Kind:    types.KindSPIFFEFederation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &machineidv1.SPIFFEFederationSpec{
-					BundleSource: &machineidv1.SPIFFEFederationBundleSource{
-						HttpsWeb: &machineidv1.SPIFFEFederationBundleSourceHTTPSWeb{
+				}.Build(),
+				Spec: machineidv1.SPIFFEFederationSpec_builder{
+					BundleSource: machineidv1.SPIFFEFederationBundleSource_builder{
+						HttpsWeb: machineidv1.SPIFFEFederationBundleSourceHTTPSWeb_builder{
 							BundleEndpointUrl: "https://example.com",
-						},
-					},
-				},
-				Status: &machineidv1.SPIFFEFederationStatus{
+						}.Build(),
+					}.Build(),
+				}.Build(),
+				Status: machineidv1.SPIFFEFederationStatus_builder{
 					CurrentBundle:         "xyzzy",
 					CurrentBundleSyncedAt: timestamppb.New(testTime),
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	}
 	for _, tc := range testCases {
diff --git a/lib/services/ssh_access_checker.go b/lib/services/ssh_access_checker.go
index b9b1a0a1458..f0219fc0d37 100644
--- a/lib/services/ssh_access_checker.go
+++ b/lib/services/ssh_access_checker.go
@@ -138,10 +138,10 @@ func (c *SSHAccessChecker) SSHPortForwardMode() decisionpb.SSHPortForwardMode {
 	local := c.checker.role.GetSpec().GetSsh().GetPortForwarding().GetLocal()
 
 	var denyRemote, denyLocal bool
-	if remote != nil && remote.Enabled != nil && !*remote.Enabled {
+	if remote != nil && remote.HasEnabled() && !remote.GetEnabled() {
 		denyRemote = true
 	}
-	if local != nil && local.Enabled != nil && !*local.Enabled {
+	if local != nil && local.HasEnabled() && !local.GetEnabled() {
 		denyLocal = true
 	}
 
@@ -203,10 +203,10 @@ func (c *SSHAccessChecker) HostUsers(srv types.Server) (*HostUsersDecision, erro
 		hostUserMode == types.CreateHostUserMode_HOST_USER_MODE_UNSPECIFIED {
 		return &HostUsersDecision{
 			Info: nil,
-			DeniedBy: []*decisionpb.Determinant{{
+			DeniedBy: []*decisionpb.Determinant{decisionpb.Determinant_builder{
 				Kind: c.checker.role.GetKind(),
 				Name: c.checker.role.GetMetadata().GetName(),
-			}},
+			}.Build()},
 		}, nil
 	}
 
@@ -231,17 +231,17 @@ func (c *SSHAccessChecker) HostUsers(srv types.Server) (*HostUsersDecision, erro
 	}
 
 	return &HostUsersDecision{
-		Info: &decisionpb.HostUsersInfo{
+		Info: decisionpb.HostUsersInfo_builder{
 			Groups: createHostUser.GetGroups(),
 			Mode:   decisionMode,
 			Uid:    uid,
 			Gid:    gid,
 			Shell:  createHostUser.GetShell(),
-		},
-		AllowedBy: []*decisionpb.Determinant{{
+		}.Build(),
+		AllowedBy: []*decisionpb.Determinant{decisionpb.Determinant_builder{
 			Kind: c.checker.role.GetKind(),
 			Name: c.checker.role.GetMetadata().GetName(),
-		}},
+		}.Build()},
 	}, nil
 }
 
@@ -293,7 +293,7 @@ func (c *SSHAccessChecker) CanCopyFiles() bool {
 	}
 
 	ssh := c.checker.role.GetSpec().GetSsh()
-	if ssh == nil || ssh.FileCopy == nil {
+	if ssh == nil || !ssh.HasFileCopy() {
 		return true
 	}
 	return ssh.GetFileCopy()
diff --git a/lib/services/ssh_access_checker_test.go b/lib/services/ssh_access_checker_test.go
index 8286ed24065..25cf6e22338 100644
--- a/lib/services/ssh_access_checker_test.go
+++ b/lib/services/ssh_access_checker_test.go
@@ -36,12 +36,12 @@ import (
 // with a role whose Spec is set to the provided value.
 func newScopedCheckerWithRole(spec *scopedaccessv1.ScopedRoleSpec) *ScopedAccessChecker {
 	return &ScopedAccessChecker{
-		role: &scopedaccessv1.ScopedRole{
-			Metadata: &headerv1.Metadata{Name: "test-role"},
+		role: scopedaccessv1.ScopedRole_builder{
+			Metadata: headerv1.Metadata_builder{Name: "test-role"}.Build(),
 			Scope:    "/test",
 			Spec:     spec,
 			Version:  types.V1,
-		},
+		}.Build(),
 		// scopedCompatChecker is nil; tests that don't exercise delegation paths don't need it.
 	}
 }
@@ -68,110 +68,110 @@ func TestSSHAccessCheckerAdjustClientIdleTimeout(t *testing.T) {
 		},
 		{
 			name: "ssh timeout more restrictive than global",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "10m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expect:        10 * time.Minute,
 		},
 		{
 			name: "ssh timeout less restrictive than global is ignored",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "2h",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expect:        30 * time.Minute,
 		},
 		{
 			name: "defaults timeout used when ssh timeout absent",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 					ClientIdleTimeout: "15m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expect:        15 * time.Minute,
 		},
 		{
 			name: "ssh timeout overrides defaults timeout",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 					ClientIdleTimeout: "5m",
-				},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				}.Build(),
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "20m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			// ssh (20m) overrides defaults (5m), and 20m < 30m so 20m wins
 			expect: 20 * time.Minute,
 		},
 		{
 			name: "ssh timeout overrides defaults even when defaults is more restrictive",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 					ClientIdleTimeout: "5m",
-				},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				}.Build(),
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					// SSH block explicitly overrides defaults with a less restrictive value;
 					// the SSH block takes precedence, and since 25m < 30m global it still applies.
 					ClientIdleTimeout: "25m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expect:        25 * time.Minute,
 		},
 		{
 			name: "role timeout applied when global is unlimited (zero)",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "1h",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 0, // zero means no global limit
 			expect:        time.Hour,
 		},
 		{
 			name: "empty ssh timeout defers to global",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expect:        30 * time.Minute,
 		},
 		{
 			name: "invalid duration string returns error",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "not-a-duration",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expectErr:     true,
 		},
 		{
 			name: "zero duration string defers to global",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "0s",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 30 * time.Minute,
 			expect:        30 * time.Minute,
 		},
 		{
 			name: "various valid duration formats",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ClientIdleTimeout: "1h30m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			globalTimeout: 3 * time.Hour,
 			expect:        time.Hour + 30*time.Minute,
 		},
@@ -205,48 +205,48 @@ func TestSSHAccessCheckerAdjustDisconnectExpiredCert(t *testing.T) {
 	}{
 		{
 			name: "unset defers to default false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			defaultVal: false,
 			expect:     false,
 		},
 		{
 			name: "unset defers to default true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			defaultVal: true,
 			expect:     true,
 		},
 		{
 			name: "explicit true overrides default false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					DisconnectExpiredCert: ptr(true),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			defaultVal: false,
 			expect:     true,
 		},
 		{
 			name: "explicit false overrides default true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					DisconnectExpiredCert: ptr(false),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			defaultVal: true,
 			expect:     false,
 		},
 		{
 			name: "unset ssh block defaults to default block",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
 					DisconnectExpiredCert: ptr(false),
-				},
+				}.Build(),
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			defaultVal: true,
 			expect:     false,
 		},
@@ -272,57 +272,57 @@ func TestSSHAccessCheckerLockingMode(t *testing.T) {
 	}{
 		{
 			name: "unset defers to default",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			defaultMode: constants.LockingModeBestEffort,
 			expect:      constants.LockingModeBestEffort,
 		},
 		{
 			name: "strict from role",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					Lock: &scopedaccessv1.Lock{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: string(constants.LockingModeStrict),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeBestEffort,
 			expect:      constants.LockingModeStrict,
 		},
 		{
 			name: "best effort from role",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					Lock: &scopedaccessv1.Lock{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: string(constants.LockingModeBestEffort),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeStrict,
 			expect:      constants.LockingModeBestEffort,
 		},
 		{
 			name: "invalid value falls back to default",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 
-					Lock: &scopedaccessv1.Lock{
+					Lock: scopedaccessv1.Lock_builder{
 						Mode: "invalid",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeStrict,
 			expect:      constants.LockingModeStrict,
 		},
 		{
 			name: "empty mode falls back to default",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 
 					Lock: &scopedaccessv1.Lock{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			defaultMode: constants.LockingModeStrict,
 			expect:      constants.LockingModeStrict,
 		},
@@ -347,27 +347,27 @@ func TestSSHAccessCheckerPermitX11Forwarding(t *testing.T) {
 	}{
 		{
 			name: "nil ssh block defaults to false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			expect: false,
 		},
 		{
 			name: "set true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					PermitX11Forwarding: ptr(true),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: true,
 		},
 		{
 			name: "set false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					PermitX11Forwarding: ptr(false),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: false,
 		},
 	}
@@ -391,27 +391,27 @@ func TestSSHAccessCheckerCheckAgentForward(t *testing.T) {
 	}{
 		{
 			name: "nil agent forwarding denies",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			expectErr: true,
 		},
 		{
 			name: "set true allows",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ForwardAgent: ptr(true),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: false,
 		},
 		{
 			name: "set false denies",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					ForwardAgent: ptr(false),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectErr: true,
 		},
 	}
@@ -440,29 +440,29 @@ func TestSSHAccessCheckerCanCopyFiles(t *testing.T) {
 	}{
 		{
 			name: "nil file_copy defaults to true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					FileCopy: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: true,
 		},
 		{
 			name: "true",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					FileCopy: ptr(true),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: true,
 		},
 		{
 			name: "false",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					FileCopy: ptr(false),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: false,
 		},
 	}
@@ -486,71 +486,71 @@ func TestSSHAccessCheckerSSHPortForwardMode(t *testing.T) {
 	}{
 		{
 			name: "nil port forwarding defaults to ON",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					PortForwarding: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_ON,
 		},
 		{
 			name: "both enabled",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					PortForwarding: &scopedaccessv1.SSHPortForwarding{
-						Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: ptr(true)},
-						Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: ptr(true)},
-					},
-				},
-			},
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					PortForwarding: scopedaccessv1.SSHPortForwarding_builder{
+						Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: ptr(true)}.Build(),
+						Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: ptr(true)}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_ON,
 		},
 		{
 			name: "both disabled",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					PortForwarding: &scopedaccessv1.SSHPortForwarding{
-						Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: ptr(false)},
-						Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: ptr(false)},
-					},
-				},
-			},
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					PortForwarding: scopedaccessv1.SSHPortForwarding_builder{
+						Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: ptr(false)}.Build(),
+						Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: ptr(false)}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_OFF,
 		},
 		{
 			name: "local enabled remote disabled",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					PortForwarding: &scopedaccessv1.SSHPortForwarding{
-						Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: ptr(true)},
-						Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: ptr(false)},
-					},
-				},
-			},
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					PortForwarding: scopedaccessv1.SSHPortForwarding_builder{
+						Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: ptr(true)}.Build(),
+						Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: ptr(false)}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_LOCAL,
 		},
 		{
 			name: "local disabled remote enabled",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					PortForwarding: &scopedaccessv1.SSHPortForwarding{
-						Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: ptr(false)},
-						Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: ptr(true)},
-					},
-				},
-			},
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					PortForwarding: scopedaccessv1.SSHPortForwarding_builder{
+						Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: ptr(false)}.Build(),
+						Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: ptr(true)}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_REMOTE,
 		},
 		{
 			name: "local and remote enabled not set defaults to ON",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					PortForwarding: &scopedaccessv1.SSHPortForwarding{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					PortForwarding: scopedaccessv1.SSHPortForwarding_builder{
 						Local:  &scopedaccessv1.SSHLocalPortForwarding{},
 						Remote: &scopedaccessv1.SSHRemotePortForwarding{},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_ON,
 		},
 	}
@@ -574,27 +574,27 @@ func TestSSHAccessCheckerMaxSessions(t *testing.T) {
 	}{
 		{
 			name: "not set defaults to 0",
-			spec: &scopedaccessv1.ScopedRoleSpec{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
 				Ssh: &scopedaccessv1.ScopedRoleSSH{},
-			},
+			}.Build(),
 			expect: 0,
 		},
 		{
 			name: "set to 5",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					MaxSessions: ptr(int64(5)),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: 5,
 		},
 		{
 			name: "set to 0",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					MaxSessions: ptr(int64(0)),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: 0,
 		},
 	}
@@ -620,20 +620,20 @@ func TestSSHAccessCheckerHostSudoers(t *testing.T) {
 	}{
 		{
 			name: "no sudoers",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					HostSudoers: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: nil,
 		},
 		{
 			name: "has sudoers",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					HostSudoers: []string{"ALL=(ALL) NOPASSWD: ALL"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: []string{"ALL=(ALL) NOPASSWD: ALL"},
 		},
 	}
@@ -659,45 +659,45 @@ func TestSSHAccessCheckerSessionRecordingMode(t *testing.T) {
 	}{
 		{
 			name:   "unset defaults to best_effort",
-			spec:   &scopedaccessv1.ScopedRoleSpec{Ssh: &scopedaccessv1.ScopedRoleSSH{}},
+			spec:   scopedaccessv1.ScopedRoleSpec_builder{Ssh: &scopedaccessv1.ScopedRoleSSH{}}.Build(),
 			expect: constants.SessionRecordingModeBestEffort,
 		},
 		{
 			name: "ssh strict",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					SessionRecording: &scopedaccessv1.SessionRecording{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					SessionRecording: scopedaccessv1.SessionRecording_builder{
 						Mode: string(constants.SessionRecordingModeStrict),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: constants.SessionRecordingModeStrict,
 		},
 		{
 			name: "defaults used when ssh unset",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
-					SessionRecording: &scopedaccessv1.SessionRecording{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+					SessionRecording: scopedaccessv1.SessionRecording_builder{
 						Mode: string(constants.SessionRecordingModeStrict),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: constants.SessionRecordingModeStrict,
 		},
 		{
 			name: "ssh overrides defaults",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Defaults: &scopedaccessv1.ScopedRoleDefaults{
-					SessionRecording: &scopedaccessv1.SessionRecording{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Defaults: scopedaccessv1.ScopedRoleDefaults_builder{
+					SessionRecording: scopedaccessv1.SessionRecording_builder{
 						Mode: string(constants.SessionRecordingModeBestEffort),
-					},
-				},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					SessionRecording: &scopedaccessv1.SessionRecording{
+					}.Build(),
+				}.Build(),
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					SessionRecording: scopedaccessv1.SessionRecording_builder{
 						Mode: string(constants.SessionRecordingModeBestEffort),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: constants.SessionRecordingModeBestEffort,
 		},
 	}
@@ -721,24 +721,24 @@ func TestSSHAccessCheckerEnhancedRecording(t *testing.T) {
 	}{
 		{
 			name: "no events",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					EnhancedRecording: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expect: map[string]bool{},
 		},
 		{
 			name: "has events",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					EnhancedRecording: &scopedaccessv1.EnhancedRecording{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					EnhancedRecording: scopedaccessv1.EnhancedRecording_builder{
 						Network: ptr(true),
 						Command: ptr(true),
 						Disk:    ptr(true),
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expect: map[string]bool{"command": true, "network": true, "disk": true},
 		},
 	}
@@ -771,46 +771,46 @@ func TestSSHAccessCheckerHostUsers(t *testing.T) {
 	}{
 		{
 			name: "nil host_user_creation - denied",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					HostUserCreation: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectNil: true,
 		},
 		{
 			name: "empty mode string - denied",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					HostUserCreation: &scopedaccessv1.CreateHostUser{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 						Mode: "",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expectNil: true,
 		},
 		{
 			name: "mode off - denied",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					HostUserCreation: &scopedaccessv1.CreateHostUser{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 						Mode: "off",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expectNil: true,
 		},
 		{
 			name: "mode keep",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					HostUserCreation: &scopedaccessv1.CreateHostUser{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 						Mode:   "keep",
 						Groups: []string{"test"},
 						Shell:  "/bin/bash",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expectNil:    false,
 			expectMode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 			expectGroups: []string{"test"},
@@ -818,27 +818,27 @@ func TestSSHAccessCheckerHostUsers(t *testing.T) {
 		},
 		{
 			name: "mode insecure-drop",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					HostUserCreation: &scopedaccessv1.CreateHostUser{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 						Mode:   "insecure-drop",
 						Groups: []string{"test"},
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expectNil:    false,
 			expectMode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 			expectGroups: []string{"test"},
 		},
 		{
 			name: "uid and gid from traits",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					HostUserCreation: &scopedaccessv1.CreateHostUser{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 						Mode: "keep",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			traits: wrappers.Traits{
 				constants.TraitHostUserUID: []string{"1001"},
 				constants.TraitHostUserGID: []string{"1001"},
@@ -850,13 +850,13 @@ func TestSSHAccessCheckerHostUsers(t *testing.T) {
 		},
 		{
 			name: "invalid mode returns error",
-			spec: &scopedaccessv1.ScopedRoleSpec{
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
-					HostUserCreation: &scopedaccessv1.CreateHostUser{
+			spec: scopedaccessv1.ScopedRoleSpec_builder{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
+					HostUserCreation: scopedaccessv1.CreateHostUser_builder{
 						Mode: "invalid",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			expectErr: true,
 		},
 	}
@@ -886,11 +886,11 @@ func TestSSHAccessCheckerHostUsers(t *testing.T) {
 
 			require.NotNil(t, decision.Info, "expected Info to be non-nil (allowed)")
 			require.NotEmpty(t, decision.AllowedBy, "expected AllowedBy to be populated")
-			require.Equal(t, tt.expectMode, decision.Info.Mode)
-			require.Equal(t, tt.expectGroups, decision.Info.Groups)
-			require.Equal(t, tt.expectShell, decision.Info.Shell)
-			require.Equal(t, tt.expectUID, decision.Info.Uid)
-			require.Equal(t, tt.expectGID, decision.Info.Gid)
+			require.Equal(t, tt.expectMode, decision.Info.GetMode())
+			require.Equal(t, tt.expectGroups, decision.Info.GetGroups())
+			require.Equal(t, tt.expectShell, decision.Info.GetShell())
+			require.Equal(t, tt.expectUID, decision.Info.GetUid())
+			require.Equal(t, tt.expectGID, decision.Info.GetGid())
 		})
 	}
 }
diff --git a/lib/services/statichostuser.go b/lib/services/statichostuser.go
index b3a21c7bb8c..57762438b98 100644
--- a/lib/services/statichostuser.go
+++ b/lib/services/statichostuser.go
@@ -51,31 +51,31 @@ func ValidateStaticHostUser(u *userprovisioningpb.StaticHostUser) error {
 	if u == nil {
 		return trace.BadParameter("StaticHostUser is nil")
 	}
-	if u.Metadata == nil {
+	if !u.HasMetadata() {
 		return trace.BadParameter("Metadata is nil")
 	}
-	if u.Metadata.Name == "" {
+	if u.GetMetadata().GetName() == "" {
 		return trace.BadParameter("missing name")
 	}
-	if u.Spec == nil {
+	if !u.HasSpec() {
 		return trace.BadParameter("Spec is nil")
 	}
 
-	if len(u.Spec.Matchers) == 0 {
+	if len(u.GetSpec().GetMatchers()) == 0 {
 		return trace.BadParameter("missing matchers")
 	}
-	for _, matcher := range u.Spec.Matchers {
+	for _, matcher := range u.GetSpec().GetMatchers() {
 		// Check if matcher can match any resources.
-		if len(matcher.NodeLabels) == 0 && len(matcher.NodeLabelsExpression) == 0 {
+		if len(matcher.GetNodeLabels()) == 0 && len(matcher.GetNodeLabelsExpression()) == 0 {
 			return trace.BadParameter("either NodeLabels or NodeLabelsExpression must be set")
 		}
-		for _, label := range matcher.NodeLabels {
-			if label.Name == types.Wildcard && (len(label.Values) != 1 || label.Values[0] != types.Wildcard) {
+		for _, label := range matcher.GetNodeLabels() {
+			if label.GetName() == types.Wildcard && (len(label.GetValues()) != 1 || label.GetValues()[0] != types.Wildcard) {
 				return trace.BadParameter("selector *:<val> is not supported")
 			}
 		}
-		if len(matcher.NodeLabelsExpression) > 0 {
-			if _, err := parseLabelExpression(matcher.NodeLabelsExpression); err != nil {
+		if len(matcher.GetNodeLabelsExpression()) > 0 {
+			if _, err := parseLabelExpression(matcher.GetNodeLabelsExpression()); err != nil {
 				return trace.BadParameter("parsing node labels expression: %v", err)
 			}
 		}
diff --git a/lib/services/statichostuser_test.go b/lib/services/statichostuser_test.go
index 39af255229f..35a4ffaf036 100644
--- a/lib/services/statichostuser_test.go
+++ b/lib/services/statichostuser_test.go
@@ -43,18 +43,18 @@ func TestValidateStaticHostUser(t *testing.T) {
 		},
 		{
 			name: "no name",
-			hostUser: userprovisioning.NewStaticHostUser("", &userprovisioningpb.StaticHostUserSpec{
+			hostUser: userprovisioning.NewStaticHostUser("", userprovisioningpb.StaticHostUserSpec_builder{
 				Matchers: []*userprovisioningpb.Matcher{
-					{
+					userprovisioningpb.Matcher_builder{
 						NodeLabels: []*labelv1.Label{
-							{
+							labelv1.Label_builder{
 								Name:   "foo",
 								Values: []string{"bar"},
-							},
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			}),
+			}.Build()),
 			assert: require.Error,
 		},
 		{
@@ -69,73 +69,73 @@ func TestValidateStaticHostUser(t *testing.T) {
 		},
 		{
 			name: "invalid node labels",
-			hostUser: userprovisioning.NewStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{
+			hostUser: userprovisioning.NewStaticHostUser("alice_user", userprovisioningpb.StaticHostUserSpec_builder{
 				Matchers: []*userprovisioningpb.Matcher{
-					{
+					userprovisioningpb.Matcher_builder{
 						NodeLabels: []*labelv1.Label{
-							{
+							labelv1.Label_builder{
 								Name:   types.Wildcard,
 								Values: []string{"bar"},
-							},
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			}),
+			}.Build()),
 			assert: require.Error,
 		},
 		{
 			name: "invalid node labels expression",
-			hostUser: userprovisioning.NewStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{
+			hostUser: userprovisioning.NewStaticHostUser("alice_user", userprovisioningpb.StaticHostUserSpec_builder{
 				Matchers: []*userprovisioningpb.Matcher{
-					{
+					userprovisioningpb.Matcher_builder{
 						NodeLabelsExpression: "foo bar xyz",
-					},
+					}.Build(),
 				},
-			}),
+			}.Build()),
 			assert: require.Error,
 		},
 		{
 			name: "valid wildcard labels",
-			hostUser: userprovisioning.NewStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{
+			hostUser: userprovisioning.NewStaticHostUser("alice_user", userprovisioningpb.StaticHostUserSpec_builder{
 				Matchers: []*userprovisioningpb.Matcher{
-					{
+					userprovisioningpb.Matcher_builder{
 						NodeLabels: []*labelv1.Label{
-							{
+							labelv1.Label_builder{
 								Name:   "foo",
 								Values: []string{types.Wildcard},
-							},
+							}.Build(),
 						},
-					},
-					{
+					}.Build(),
+					userprovisioningpb.Matcher_builder{
 						NodeLabels: []*labelv1.Label{
-							{
+							labelv1.Label_builder{
 								Name:   types.Wildcard,
 								Values: []string{types.Wildcard},
-							},
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
-			}),
+			}.Build()),
 			assert: require.NoError,
 		},
 		{
 			name: "ok",
-			hostUser: userprovisioning.NewStaticHostUser("alice_user", &userprovisioningpb.StaticHostUserSpec{
+			hostUser: userprovisioning.NewStaticHostUser("alice_user", userprovisioningpb.StaticHostUserSpec_builder{
 				Matchers: []*userprovisioningpb.Matcher{
-					{
+					userprovisioningpb.Matcher_builder{
 						NodeLabels: []*labelv1.Label{
-							{
+							labelv1.Label_builder{
 								Name:   "foo",
 								Values: []string{"bar"},
-							},
+							}.Build(),
 						},
 						Groups:               []string{"foo", "bar"},
 						NodeLabelsExpression: `labels["env"] == "staging" || labels["env"] == "test"`,
 						Uid:                  1234,
 						Gid:                  1234,
-					},
+					}.Build(),
 				},
-			}),
+			}.Build()),
 			assert: require.NoError,
 		},
 	}
diff --git a/lib/services/subca_test.go b/lib/services/subca_test.go
index c080d8f77cc..683939aceab 100644
--- a/lib/services/subca_test.go
+++ b/lib/services/subca_test.go
@@ -31,15 +31,15 @@ import (
 func TestMarshalCertAuthorityOverrideRoundtrip(t *testing.T) {
 	t.Parallel()
 
-	want := &subcav1.CertAuthorityOverride{
+	want := subcav1.CertAuthorityOverride_builder{
 		Kind:    types.KindCertAuthorityOverride,
 		SubKind: string(types.DatabaseClientCA),
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "zarquon",
-		},
+		}.Build(),
 		Spec: &subcav1.CertAuthorityOverrideSpec{},
-	}
+	}.Build()
 
 	t.Run("ok", func(t *testing.T) {
 		t.Parallel()
diff --git a/lib/services/summarizer_test.go b/lib/services/summarizer_test.go
index 5fe0b54fec2..f402f03dffb 100644
--- a/lib/services/summarizer_test.go
+++ b/lib/services/summarizer_test.go
@@ -260,11 +260,11 @@ func TestValidateInferencePolicy(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			p := apisummarizer.NewInferencePolicy("my-policy", &summarizerv1.InferencePolicySpec{
+			p := apisummarizer.NewInferencePolicy("my-policy", summarizerv1.InferencePolicySpec_builder{
 				Kinds:  tc.kinds,
 				Filter: tc.filter,
 				Model:  "my-model",
-			})
+			}.Build())
 			err := ValidateInferencePolicy(p)
 			if tc.errorMessage == "" {
 				require.NoError(t, err)
diff --git a/lib/services/unified_resource_test.go b/lib/services/unified_resource_test.go
index 5bfb681d3f7..a73ab4053ac 100644
--- a/lib/services/unified_resource_test.go
+++ b/lib/services/unified_resource_test.go
@@ -1200,32 +1200,32 @@ func newICAccount(t *testing.T, ctx context.Context, svc services.IdentityCenter
 
 	accountID := t.Name()
 
-	icAcct, err := svc.CreateIdentityCenterAccount(ctx, &identitycenterv1.Account{
+	icAcct, err := svc.CreateIdentityCenterAccount(ctx, identitycenterv1.Account_builder{
 		Kind:    types.KindIdentityCenterAccount,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: t.Name(),
 			Labels: map[string]string{
 				types.OriginLabel: common.OriginAWSIdentityCenter,
 			},
-		},
-		Spec: &identitycenterv1.AccountSpec{
+		}.Build(),
+		Spec: identitycenterv1.AccountSpec_builder{
 			Id:          accountID,
 			Arn:         "arn:aws:sso:::account/" + accountID,
 			Name:        "Test AWS Account",
 			Description: "Used for testing",
 			PermissionSetInfo: []*identitycenterv1.PermissionSetInfo{
-				{
+				identitycenterv1.PermissionSetInfo_builder{
 					Name: "Alpha",
 					Arn:  "arn:aws:sso:::permissionSet/ssoins-1234567890/ps-alpha",
-				},
-				{
+				}.Build(),
+				identitycenterv1.PermissionSetInfo_builder{
 					Name: "Beta",
 					Arn:  "arn:aws:sso:::permissionSet/ssoins-1234567890/ps-beta",
-				},
+				}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err, "creating Identity Center Account")
 	return icAcct
 }
@@ -1442,22 +1442,22 @@ func TestUnifiedResourceLinuxDesktop(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create and upsert a Linux desktop
-	linuxDesktop1 := &linuxdesktopv1.LinuxDesktop{
+	linuxDesktop1 := linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V3,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "linux-desktop-1",
 			Labels: map[string]string{
 				"env":    "production",
 				"region": "us-west-1",
 			},
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "10.0.0.1:22",
 			Hostname: "linux-host-1",
 			ProxyIds: []string{"proxy-1"},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = clt.UpsertLinuxDesktop(ctx, linuxDesktop1)
 	require.NoError(t, err)
 
@@ -1481,26 +1481,26 @@ func TestUnifiedResourceLinuxDesktop(t *testing.T) {
 	unwrapper, ok := resource.(types.Resource153UnwrapperT[*linuxdesktopv1.LinuxDesktop])
 	require.True(t, ok, "resource should be unwrappable to LinuxDesktop")
 	unwrapped := unwrapper.UnwrapT()
-	require.Equal(t, "linux-desktop-1", unwrapped.Metadata.Name)
-	require.Equal(t, "10.0.0.1:22", unwrapped.Spec.Addr)
-	require.Equal(t, "linux-host-1", unwrapped.Spec.Hostname)
+	require.Equal(t, "linux-desktop-1", unwrapped.GetMetadata().GetName())
+	require.Equal(t, "10.0.0.1:22", unwrapped.GetSpec().GetAddr())
+	require.Equal(t, "linux-host-1", unwrapped.GetSpec().GetHostname())
 
 	// Add a second Linux desktop
-	linuxDesktop2 := &linuxdesktopv1.LinuxDesktop{
+	linuxDesktop2 := linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V3,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "linux-desktop-2",
 			Labels: map[string]string{
 				"env": "staging",
 			},
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "10.0.0.2:22",
 			Hostname: "linux-host-2",
 			ProxyIds: []string{"proxy-2"},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = clt.UpsertLinuxDesktop(ctx, linuxDesktop2)
 	require.NoError(t, err)
 
@@ -1549,20 +1549,20 @@ func TestUnifiedResourceLinuxDesktopFiltering(t *testing.T) {
 	assert.Eventually(t, w.IsInitialized, 5*time.Second, 10*time.Millisecond, "Timed out waiting for all resources cache initialization")
 
 	// Add a Linux desktop
-	linuxDesktop := &linuxdesktopv1.LinuxDesktop{
+	linuxDesktop := linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V3,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "linux-desktop",
 			Labels: map[string]string{
 				"env": "test",
 			},
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     "10.0.0.10:22",
 			Hostname: "test-host",
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = clt.UpsertLinuxDesktop(ctx, linuxDesktop)
 	require.NoError(t, err)
 
@@ -1636,37 +1636,37 @@ func TestMakePaginatedResourceLinuxDesktop(t *testing.T) {
 	}{
 		{
 			name: "basic linux desktop",
-			desktop: &linuxdesktopv1.LinuxDesktop{
+			desktop: linuxdesktopv1.LinuxDesktop_builder{
 				Kind:    types.KindLinuxDesktop,
 				Version: types.V3,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "test-desktop",
 					Labels: map[string]string{
 						"env": "production",
 					},
-				},
-				Spec: &linuxdesktopv1.LinuxDesktopSpec{
+				}.Build(),
+				Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 					Addr:     "192.168.1.100:22",
 					Hostname: "desktop-host",
 					ProxyIds: []string{"proxy-1"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requiresRequest: false,
 			logins:          []string{"ubuntu", "root"},
 		},
 		{
 			name: "linux desktop requiring request",
-			desktop: &linuxdesktopv1.LinuxDesktop{
+			desktop: linuxdesktopv1.LinuxDesktop_builder{
 				Kind:    types.KindLinuxDesktop,
 				Version: types.V3,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "protected-desktop",
-				},
-				Spec: &linuxdesktopv1.LinuxDesktopSpec{
+				}.Build(),
+				Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 					Addr:     "10.0.0.50:22",
 					Hostname: "protected-host",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requiresRequest: true,
 			logins:          []string{"admin"},
 		},
@@ -1687,27 +1687,27 @@ func TestMakePaginatedResourceLinuxDesktop(t *testing.T) {
 			require.NotNil(t, wireDesktop, "paginated resource should contain LinuxDesktop")
 
 			// Verify fields match
-			require.Equal(t, tt.desktop.Kind, wireDesktop.Kind)
-			require.Equal(t, tt.desktop.Version, wireDesktop.Version)
-			require.Equal(t, tt.desktop.Metadata.Name, wireDesktop.Metadata.Name)
-			require.Equal(t, tt.desktop.Spec.Addr, wireDesktop.Addr)
-			require.Equal(t, tt.desktop.Spec.Hostname, wireDesktop.Hostname)
-			require.Equal(t, tt.desktop.Spec.ProxyIds, wireDesktop.ProxyIds)
+			require.Equal(t, tt.desktop.GetKind(), wireDesktop.Kind)
+			require.Equal(t, tt.desktop.GetVersion(), wireDesktop.Version)
+			require.Equal(t, tt.desktop.GetMetadata().GetName(), wireDesktop.Metadata.Name)
+			require.Equal(t, tt.desktop.GetSpec().GetAddr(), wireDesktop.Addr)
+			require.Equal(t, tt.desktop.GetSpec().GetHostname(), wireDesktop.Hostname)
+			require.Equal(t, tt.desktop.GetSpec().GetProxyIds(), wireDesktop.ProxyIds)
 			require.Equal(t, tt.requiresRequest, paginated.RequiresRequest)
 
 			// Test unpacking
 			unpacked := proto.UnpackLinuxDesktop(wireDesktop)
 			require.NotNil(t, unpacked)
 			require.Equal(t, types.KindLinuxDesktop, unpacked.GetKind())
-			require.Equal(t, tt.desktop.Metadata.Name, unpacked.GetName())
+			require.Equal(t, tt.desktop.GetMetadata().GetName(), unpacked.GetName())
 
 			// Verify it can be unwrapped back to the original type
 			unwrapper, ok := unpacked.(types.Resource153UnwrapperT[*linuxdesktopv1.LinuxDesktop])
 			require.True(t, ok, "unpacked resource should be unwrappable")
 			unpackedDesktop := unwrapper.UnwrapT()
-			require.Equal(t, tt.desktop.Metadata.Name, unpackedDesktop.Metadata.Name)
-			require.Equal(t, tt.desktop.Spec.Addr, unpackedDesktop.Spec.Addr)
-			require.Equal(t, tt.desktop.Spec.Hostname, unpackedDesktop.Spec.Hostname)
+			require.Equal(t, tt.desktop.GetMetadata().GetName(), unpackedDesktop.GetMetadata().GetName())
+			require.Equal(t, tt.desktop.GetSpec().GetAddr(), unpackedDesktop.GetSpec().GetAddr())
+			require.Equal(t, tt.desktop.GetSpec().GetHostname(), unpackedDesktop.GetSpec().GetHostname())
 		})
 	}
 }
diff --git a/lib/services/user_task_test.go b/lib/services/user_task_test.go
index b11a5e27f53..899c7904400 100644
--- a/lib/services/user_task_test.go
+++ b/lib/services/user_task_test.go
@@ -35,35 +35,35 @@ import (
 func TestMarshalUserTaskRoundTrip(t *testing.T) {
 	t.Parallel()
 
-	obj := &usertasksv1.UserTask{
+	obj := usertasksv1.UserTask_builder{
 		Version: "v1",
 		Kind:    "user_task",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "example-user-task",
 			Labels: map[string]string{
 				"env": "example",
 			},
-		},
-		Spec: &usertasksv1.UserTaskSpec{
+		}.Build(),
+		Spec: usertasksv1.UserTaskSpec_builder{
 			Integration: "my-integration",
 			TaskType:    "discover-ec2",
 			IssueType:   "SSM_AGENT_MISSING",
 			State:       "OPEN",
-			DiscoverEc2: &usertasksv1.DiscoverEC2{
+			DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 				Region:    "us-east-1",
 				AccountId: "123456789012",
 				Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-					"i-1234567890": {
+					"i-1234567890": usertasksv1.DiscoverEC2Instance_builder{
 						Name:            "instance-name",
 						InvocationUrl:   "https://example.com/",
 						DiscoveryConfig: "config",
 						DiscoveryGroup:  "group",
 						SyncTime:        timestamppb.Now(),
-					},
+					}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	out, err := MarshalUserTask(obj)
 	require.NoError(t, err)
@@ -105,35 +105,35 @@ spec:
 	data, err := utils.ToJSON([]byte(correctUserTaskYAML))
 	require.NoError(t, err)
 
-	expected := &usertasksv1.UserTask{
+	expected := usertasksv1.UserTask_builder{
 		Version: "v1",
 		Kind:    "user_task",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "example-user-task",
 			Labels: map[string]string{
 				"env": "example",
 			},
-		},
-		Spec: &usertasksv1.UserTaskSpec{
+		}.Build(),
+		Spec: usertasksv1.UserTaskSpec_builder{
 			Integration: "my-integration",
 			TaskType:    "discover-ec2",
 			IssueType:   "SSM_AGENT_MISSING",
 			State:       "OPEN",
-			DiscoverEc2: &usertasksv1.DiscoverEC2{
+			DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 				Region:    "us-east-1",
 				AccountId: "123456789012",
 				Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-					"i-1234567890": {
+					"i-1234567890": usertasksv1.DiscoverEC2Instance_builder{
 						Name:            "instance-name",
 						InvocationUrl:   "https://example.com/",
 						DiscoveryConfig: "config",
 						DiscoveryGroup:  "group",
 						SyncTime:        syncTime,
-					},
+					}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	obj, err := UnmarshalUserTask(data)
 	require.NoError(t, err)
diff --git a/lib/services/watcher_test.go b/lib/services/watcher_test.go
index 56d5bcee786..588c67325bd 100644
--- a/lib/services/watcher_test.go
+++ b/lib/services/watcher_test.go
@@ -1842,14 +1842,14 @@ func TestHealthCheckConfigWatcher(t *testing.T) {
 func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	c, err := healthcheckconfig.NewHealthCheckConfig(name,
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
-				DbLabels: []*labelv1.Label{{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   types.Wildcard,
 					Values: []string{types.Wildcard},
-				}},
-			},
-		},
+				}.Build()},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	return c
diff --git a/lib/services/workload_identity.go b/lib/services/workload_identity.go
index b72288caeb9..abf61e4d01e 100644
--- a/lib/services/workload_identity.go
+++ b/lib/services/workload_identity.go
@@ -108,45 +108,45 @@ func ValidateWorkloadIdentity(s *workloadidentityv1pb.WorkloadIdentity) error {
 	switch {
 	case s == nil:
 		return trace.BadParameter("object cannot be nil")
-	case s.Version != types.V1:
+	case s.GetVersion() != types.V1:
 		return trace.BadParameter("version: only %q is supported", types.V1)
-	case s.Kind != types.KindWorkloadIdentity:
+	case s.GetKind() != types.KindWorkloadIdentity:
 		return trace.BadParameter("kind: must be %q", types.KindWorkloadIdentity)
-	case s.Metadata == nil:
+	case !s.HasMetadata():
 		return trace.BadParameter("metadata: is required")
-	case s.Metadata.Name == "":
+	case s.GetMetadata().GetName() == "":
 		return trace.BadParameter("metadata.name: is required")
-	case s.Spec == nil:
+	case !s.HasSpec():
 		return trace.BadParameter("spec: is required")
-	case s.Spec.Spiffe.Id == "":
+	case s.GetSpec().GetSpiffe().GetId() == "":
 		return trace.BadParameter("spec.spiffe.id: is required")
-	case !strings.HasPrefix(s.Spec.Spiffe.Id, "/"):
+	case !strings.HasPrefix(s.GetSpec().GetSpiffe().GetId(), "/"):
 		return trace.BadParameter("spec.spiffe.id: must start with a /")
-	case s.Spec.Spiffe.GetX509().GetMaximumTtl().AsDuration() > maxMaxX509SVIDTTL:
+	case s.GetSpec().GetSpiffe().GetX509().GetMaximumTtl().AsDuration() > maxMaxX509SVIDTTL:
 		return trace.BadParameter("spec.spiffe.x509.maximum_ttl: must be less than %s", maxMaxX509SVIDTTL)
-	case s.Spec.Spiffe.GetJwt().GetMaximumTtl().AsDuration() > maxMaxJWTSVIDTTL:
+	case s.GetSpec().GetSpiffe().GetJwt().GetMaximumTtl().AsDuration() > maxMaxJWTSVIDTTL:
 		return trace.BadParameter("spec.spiffe.jwt.maximum_ttl: must be less than %s", maxMaxJWTSVIDTTL)
 	}
 
 	for i, rule := range s.GetSpec().GetRules().GetAllow() {
-		if rule.Expression == "" {
-			if len(rule.Conditions) == 0 {
+		if rule.GetExpression() == "" {
+			if len(rule.GetConditions()) == 0 {
 				return trace.BadParameter("spec.rules.allow[%d].conditions: must be non-empty", i)
 			}
 		} else {
-			if len(rule.Conditions) != 0 {
+			if len(rule.GetConditions()) != 0 {
 				return trace.BadParameter("spec.rules.allow[%d].conditions: is mutually exclusive with expression", i)
 			}
-			if err := expression.Validate(rule.Expression); err != nil {
+			if err := expression.Validate(rule.GetExpression()); err != nil {
 				return trace.BadParameter("spec.rules.allow[%d].expression: invalid expression: %s", i, err.Error())
 			}
 		}
 
-		for j, condition := range rule.Conditions {
-			if condition.Attribute == "" {
+		for j, condition := range rule.GetConditions() {
+			if condition.GetAttribute() == "" {
 				return trace.BadParameter("spec.rules.allow[%d].conditions[%d].attribute: must be non-empty", i, j)
 			}
-			if condition.Operator == nil {
+			if !condition.HasOperator() {
 				return trace.BadParameter("spec.rules.allow[%d].conditions[%d]: operator must be specified", i, j)
 			}
 		}
diff --git a/lib/services/workload_identity_test.go b/lib/services/workload_identity_test.go
index 02263069e8e..edb5f5aa1a5 100644
--- a/lib/services/workload_identity_test.go
+++ b/lib/services/workload_identity_test.go
@@ -39,18 +39,18 @@ func TestWorkloadIdentityMarshaling(t *testing.T) {
 	}{
 		{
 			name: "normal",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 	}
 	for _, tc := range testCases {
@@ -81,274 +81,268 @@ func TestValidateWorkloadIdentity(t *testing.T) {
 	}{
 		{
 			name: "success - full",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "example",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-											Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-												Value: "foo",
-											},
-										},
-									},
+										Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+											Value: "foo",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-						X509: &workloadidentityv1pb.WorkloadIdentitySPIFFEX509{
+						X509: workloadidentityv1pb.WorkloadIdentitySPIFFEX509_builder{
 							MaximumTtl: durationpb.New(time.Hour * 24 * 14),
-						},
-						Jwt: &workloadidentityv1pb.WorkloadIdentitySPIFFEJWT{
+						}.Build(),
+						Jwt: workloadidentityv1pb.WorkloadIdentitySPIFFEJWT_builder{
 							MaximumTtl: durationpb.New(time.Hour * 24),
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
 			name: "success - minimal",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
 			name: "missing name",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:     types.KindWorkloadIdentity,
 				Version:  types.V1,
 				Metadata: &headerv1.Metadata{},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: is required"),
 		},
 		{
 			name: "missing spiffe id",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
 					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.spiffe.id: is required"),
 		},
 		{
 			name: "spiffe id must have leading /",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.spiffe.id: must start with a /"),
 		},
 		{
 			name: "missing attribute",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-											Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-												Value: "foo",
-											},
-										},
-									},
+										Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+											Value: "foo",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.rules.allow[0].conditions[0].attribute: must be non-empty"),
 		},
 		{
 			name: "missing operator",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "example",
-									},
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.rules.allow[0].conditions[0]: operator must be specified"),
 		},
 		{
 			name: "expression and conditions",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Expression: `user.name == "Alan Partridge"`,
 								Conditions: []*workloadidentityv1pb.WorkloadIdentityCondition{
-									{
+									workloadidentityv1pb.WorkloadIdentityCondition_builder{
 										Attribute: "example",
-										Operator: &workloadidentityv1pb.WorkloadIdentityCondition_Eq{
-											Eq: &workloadidentityv1pb.WorkloadIdentityConditionEq{
-												Value: "foo",
-											},
-										},
-									},
+										Eq: workloadidentityv1pb.WorkloadIdentityConditionEq_builder{
+											Value: "foo",
+										}.Build(),
+									}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.rules.allow[0].conditions: is mutually exclusive with expression"),
 		},
 		{
 			name: "neither expression or conditions",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
 							{}, // Empty rule.
 						},
-					},
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.rules.allow[0].conditions: must be non-empty"),
 		},
 		{
 			name: "invalid expression",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Rules: &workloadidentityv1pb.WorkloadIdentityRules{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Rules: workloadidentityv1pb.WorkloadIdentityRules_builder{
 						Allow: []*workloadidentityv1pb.WorkloadIdentityRule{
-							{
+							workloadidentityv1pb.WorkloadIdentityRule_builder{
 								Expression: `does_not_exist`,
-							},
+							}.Build(),
 						},
-					},
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`unknown identifier: "does_not_exist"`),
 		},
 		{
 			name: "maximum x509 ttl too large",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-						X509: &workloadidentityv1pb.WorkloadIdentitySPIFFEX509{
+						X509: workloadidentityv1pb.WorkloadIdentitySPIFFEX509_builder{
 							MaximumTtl: durationpb.New(time.Hour * 24 * 365),
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`spec.spiffe.x509.maximum_ttl: must be less than 336h0m0s`),
 		},
 		{
 			name: "maximum jwt ttl too large",
-			in: &workloadidentityv1pb.WorkloadIdentity{
+			in: workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "example",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/example",
-						Jwt: &workloadidentityv1pb.WorkloadIdentitySPIFFEJWT{
+						Jwt: workloadidentityv1pb.WorkloadIdentitySPIFFEJWT_builder{
 							MaximumTtl: durationpb.New(time.Hour * 24 * 365),
-						},
-					},
-				},
-			},
+						}.Build(),
+					}.Build(),
+				}.Build(),
+			}.Build(),
 			requireErr: errContains(`spec.spiffe.jwt.maximum_ttl: must be less than 24h0m0s`),
 		},
 	}
diff --git a/lib/services/workload_identity_x509_revocation.go b/lib/services/workload_identity_x509_revocation.go
index 95d503dd52b..54cf88655f9 100644
--- a/lib/services/workload_identity_x509_revocation.go
+++ b/lib/services/workload_identity_x509_revocation.go
@@ -91,29 +91,29 @@ func ValidateWorkloadIdentityX509Revocation(s *workloadidentityv1pb.WorkloadIden
 	switch {
 	case s == nil:
 		return trace.BadParameter("object cannot be nil")
-	case s.Version != types.V1:
+	case s.GetVersion() != types.V1:
 		return trace.BadParameter("version: only %q is supported", types.V1)
-	case s.Kind != types.KindWorkloadIdentityX509Revocation:
+	case s.GetKind() != types.KindWorkloadIdentityX509Revocation:
 		return trace.BadParameter("kind: must be %q", types.KindWorkloadIdentityX509Revocation)
-	case s.Metadata == nil:
+	case !s.HasMetadata():
 		return trace.BadParameter("metadata: is required")
-	case s.Metadata.Name == "":
+	case s.GetMetadata().GetName() == "":
 		return trace.BadParameter("metadata.name: is required")
-	case s.Metadata.Expires == nil:
+	case !s.GetMetadata().HasExpires():
 		return trace.BadParameter("metadata.expires: is required")
-	case s.Metadata.Expires.IsValid() == false:
+	case s.GetMetadata().GetExpires().IsValid() == false:
 		return trace.BadParameter("metadata.expires: must be valid")
-	case s.Metadata.Expires.AsTime().IsZero():
+	case s.GetMetadata().GetExpires().AsTime().IsZero():
 		return trace.BadParameter("metadata.expires: must be non-zero")
-	case s.Spec == nil:
+	case !s.HasSpec():
 		return trace.BadParameter("spec: is required")
-	case s.Spec.Reason == "":
+	case s.GetSpec().GetReason() == "":
 		return trace.BadParameter("spec.reason: is required")
-	case s.Spec.RevokedAt == nil:
+	case !s.GetSpec().HasRevokedAt():
 		return trace.BadParameter("spec.revoked_at: is required")
-	case s.Spec.RevokedAt.IsValid() == false:
+	case s.GetSpec().GetRevokedAt().IsValid() == false:
 		return trace.BadParameter("spec.revoked_at: must be valid")
-	case s.Spec.RevokedAt.AsTime().IsZero():
+	case s.GetSpec().GetRevokedAt().AsTime().IsZero():
 		return trace.BadParameter("spec.revoked_at: must be non-zero")
 	}
 
@@ -121,7 +121,7 @@ func ValidateWorkloadIdentityX509Revocation(s *workloadidentityv1pb.WorkloadIden
 	// X509 cert. Whilst typically presented using a colon separated hex string,
 	// here we will remove the colons. We will also ensure it is encoded in
 	// lowercase, to ensure consistency.
-	if !validSerialRe.MatchString(s.Metadata.Name) {
+	if !validSerialRe.MatchString(s.GetMetadata().GetName()) {
 		return trace.BadParameter("metadata.name: must be a lower-case hex encoded integer without colons")
 	}
 
diff --git a/lib/services/workload_identity_x509_revocation_test.go b/lib/services/workload_identity_x509_revocation_test.go
index 4b632ac9404..14c618e5f83 100644
--- a/lib/services/workload_identity_x509_revocation_test.go
+++ b/lib/services/workload_identity_x509_revocation_test.go
@@ -46,126 +46,126 @@ func TestValidateWorkloadIdentityX509Revocation(t *testing.T) {
 	}{
 		{
 			name: "success - full",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aabbccddeeff",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: require.NoError,
 		},
 		{
 			name: "missing name",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: is required"),
 		},
 		{
 			name: "missing reason",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aabbccddeeff",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.reason: is required"),
 		},
 		{
 			name: "invalid name: colons",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aa:bb:cc:dd:ee:ff",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: must be a lower-case hex encoded integer without colons"),
 		},
 		{
 			name: "invalid name: not lowercase",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "AAbbCCddEE",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: must be a lower-case hex encoded integer without colons"),
 		},
 		{
 			name: "invalid name: not base 16",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aabbxx",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.name: must be a lower-case hex encoded integer without colons"),
 		},
 		{
 			name: "missing expiry",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "aabbccddeeff",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("metadata.expires: is required"),
 		},
 		{
 			name: "missing revoked at",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aabbccddeeff",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason: "compromised",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			requireErr: errContains("spec.revoked_at: is required"),
 		},
 	}
@@ -187,18 +187,18 @@ func TestWorkloadIdentityX509RevocationMarshaling(t *testing.T) {
 	}{
 		{
 			name: "normal",
-			in: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			in: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aabbccddeeff",
 					Expires: timestamppb.New(time.Now().Add(time.Hour)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.Now(),
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	}
 	for _, tc := range testCases {
diff --git a/lib/services/workloadcluster_test.go b/lib/services/workloadcluster_test.go
index a0f94adb2ef..e1ab4b8a3f1 100644
--- a/lib/services/workloadcluster_test.go
+++ b/lib/services/workloadcluster_test.go
@@ -32,30 +32,30 @@ import (
 func TestMarshalWorkloadClusterRoundTrip(t *testing.T) {
 	t.Parallel()
 
-	obj := &workloadclusterv1.WorkloadCluster{
-		Metadata: &headerv1.Metadata{
+	obj := workloadclusterv1.WorkloadCluster_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-workload-cluster",
-		},
-		Spec: &workloadclusterv1.WorkloadClusterSpec{
+		}.Build(),
+		Spec: workloadclusterv1.WorkloadClusterSpec_builder{
 			Regions: []*workloadclusterv1.Region{
-				{
+				workloadclusterv1.Region_builder{
 					Name: "us-west-2",
-				},
+				}.Build(),
 			},
-			Bot: &workloadclusterv1.Bot{
+			Bot: workloadclusterv1.Bot_builder{
 				Name: "test",
-			},
-			Token: &workloadclusterv1.Token{
+			}.Build(),
+			Token: workloadclusterv1.Token_builder{
 				JoinMethod: "iam",
 				Allow: []*workloadclusterv1.Allow{
-					{
+					workloadclusterv1.Allow_builder{
 						AwsAccount: "account",
 						AwsArn:     "arn",
-					},
+					}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	out, err := MarshalWorkloadCluster(obj)
 	require.NoError(t, err)
@@ -70,35 +70,35 @@ func TestUnmarshalWorkloadCluster(t *testing.T) {
 	data, err := utils.ToJSON([]byte(correctWorkloadClusterYAML))
 	require.NoError(t, err)
 
-	expected := &workloadclusterv1.WorkloadCluster{
+	expected := workloadclusterv1.WorkloadCluster_builder{
 		Version: "v1",
 		Kind:    "workload_cluster",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-workload-cluster",
 			Labels: map[string]string{
 				"env": "example",
 			},
-		},
-		Spec: &workloadclusterv1.WorkloadClusterSpec{
+		}.Build(),
+		Spec: workloadclusterv1.WorkloadClusterSpec_builder{
 			Regions: []*workloadclusterv1.Region{
-				{
+				workloadclusterv1.Region_builder{
 					Name: "us-west-2",
-				},
+				}.Build(),
 			},
-			Bot: &workloadclusterv1.Bot{
+			Bot: workloadclusterv1.Bot_builder{
 				Name: "test",
-			},
-			Token: &workloadclusterv1.Token{
+			}.Build(),
+			Token: workloadclusterv1.Token_builder{
 				JoinMethod: "iam",
 				Allow: []*workloadclusterv1.Allow{
-					{
+					workloadclusterv1.Allow_builder{
 						AwsAccount: "account",
 						AwsArn:     "arn",
-					},
+					}.Build(),
 				},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	obj, err := UnmarshalWorkloadCluster(data)
 	require.NoError(t, err)
diff --git a/lib/srv/app/server.go b/lib/srv/app/server.go
index 9f96ec07374..06b556ddf66 100644
--- a/lib/srv/app/server.go
+++ b/lib/srv/app/server.go
@@ -575,8 +575,8 @@ func (s *Server) close(ctx context.Context) error {
 		// Manual deletion per app is only required if the auth server
 		// doesn't support actively cleaning up app resources when the
 		// inventory control stream is terminated during shutdown.
-		if capabilities := sender.Hello().Capabilities; capabilities != nil {
-			shouldDeleteApps = shouldDeleteApps && !capabilities.AppCleanup
+		if capabilities := sender.Hello().GetCapabilities(); capabilities != nil {
+			shouldDeleteApps = shouldDeleteApps && !capabilities.GetAppCleanup()
 		}
 	}
 
diff --git a/lib/srv/app/server_test.go b/lib/srv/app/server_test.go
index c427de95929..b08dc3fe28d 100644
--- a/lib/srv/app/server_test.go
+++ b/lib/srv/app/server_test.go
@@ -400,12 +400,12 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 
 	inventoryHandle, err := inventory.NewDownstreamHandle(s.authClient.InventoryControlStream,
 		func(ctx context.Context) (*proto.UpstreamInventoryHello, error) {
-			return &proto.UpstreamInventoryHello{
+			return proto.UpstreamInventoryHello_builder{
 				ServerID: s.hostUUID,
 				Version:  teleport.Version,
 				Services: types.SystemRoles{types.RoleApp}.StringSlice(),
 				Hostname: "test",
-			}, nil
+			}.Build(), nil
 		})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, inventoryHandle.Close()) })
@@ -449,9 +449,9 @@ func SetUpSuiteWithConfig(t *testing.T, config suiteConfig) *Suite {
 		case sender := <-inventoryHandle.Sender():
 			appServer, err := s.appServer.getServerInfo(app)
 			require.NoError(t, err)
-			require.NoError(t, sender.Send(s.closeContext, &proto.InventoryHeartbeat{
+			require.NoError(t, sender.Send(s.closeContext, proto.InventoryHeartbeat_builder{
 				AppServer: appServer,
-			}))
+			}.Build()))
 		case <-time.After(20 * time.Second):
 			t.Fatal("timed out waiting for inventory handle sender")
 		}
diff --git a/lib/srv/authhandlers.go b/lib/srv/authhandlers.go
index 6fe66032ba0..53e379d2229 100644
--- a/lib/srv/authhandlers.go
+++ b/lib/srv/authhandlers.go
@@ -292,7 +292,7 @@ func (h *AuthHandlers) CreateIdentityContext(sconn *ssh.ServerConn) (IdentityCon
 
 // CheckAgentForward checks if agent forwarding is allowed for the users RoleSet.
 func (h *AuthHandlers) CheckAgentForward(ctx *ServerContext) error {
-	if ctx.Identity.AccessPermit != nil && ctx.Identity.AccessPermit.ForwardAgent {
+	if ctx.Identity.AccessPermit != nil && ctx.Identity.AccessPermit.GetForwardAgent() {
 		return nil
 	}
 
@@ -308,7 +308,7 @@ func (h *AuthHandlers) CheckAgentForward(ctx *ServerContext) error {
 
 // CheckX11Forward checks if X11 forwarding is permitted for the user's RoleSet.
 func (h *AuthHandlers) CheckX11Forward(ctx *ServerContext) error {
-	if ctx.Identity.AccessPermit != nil && ctx.Identity.AccessPermit.X11Forwarding {
+	if ctx.Identity.AccessPermit != nil && ctx.Identity.AccessPermit.GetX11Forwarding() {
 		return nil
 	}
 
@@ -327,7 +327,7 @@ func (h *AuthHandlers) CheckPortForward(addr string, ctx *ServerContext, request
 		return trace.AccessDenied("port forwarding not permitted")
 	}
 
-	allowedMode := ctx.Identity.AccessPermit.PortForwardMode
+	allowedMode := ctx.Identity.AccessPermit.GetPortForwardMode()
 	if allowedMode == decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_ON {
 		return nil
 	}
@@ -1209,7 +1209,7 @@ func (a *ahLoginChecker) evaluateScopedSSHAccess(ident *sshca.Identity, ca types
 		return nil, trace.Wrap(err)
 	}
 
-	permit := &decisionpb.SSHAccessPermit{
+	permit := decisionpb.SSHAccessPermit_builder{
 		ForwardAgent:          checker.SSH().CheckAgentForward(osUser) == nil,
 		X11Forwarding:         checker.SSH().PermitX11Forwarding(),
 		MaxConnections:        checker.SSH().MaxConnections(),
@@ -1226,16 +1226,16 @@ func (a *ahLoginChecker) evaluateScopedSSHAccess(ident *sshca.Identity, ca types
 		HostSudoers:           hostSudoers,
 		BpfEvents:             bpfEvents,
 		HostUsersInfo:         hostUsersDecision.Info,
-		DecisionContext: &decisionpb.SSHAccessPermitContext{
+		DecisionContext: decisionpb.SSHAccessPermitContext_builder{
 			HostUserCreationAllowedBy: hostUsersDecision.AllowedBy,
 			HostUserCreationDeniedBy:  hostUsersDecision.DeniedBy,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	if checker.PinSourceIP() {
-		permit.Preconditions = append(permit.Preconditions, &decisionpb.Precondition{
+		permit.SetPreconditions(append(permit.GetPreconditions(), decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP,
-		})
+		}.Build()))
 	}
 
 	return permit, nil
@@ -1331,12 +1331,12 @@ func (a *ahLoginChecker) evaluateSSHAccess(ident *sshca.Identity, ca types.CertA
 	}
 
 	if accessChecker.PinSourceIP() {
-		preconds = append(preconds, &decisionpb.Precondition{
+		preconds = append(preconds, decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP,
-		})
+		}.Build())
 	}
 
-	return &decisionpb.SSHAccessPermit{
+	return decisionpb.SSHAccessPermit_builder{
 		ForwardAgent:          accessChecker.CheckAgentForward(osUser) == nil,
 		X11Forwarding:         accessChecker.PermitX11Forwarding(),
 		MaxConnections:        accessChecker.MaxConnections(),
@@ -1354,11 +1354,11 @@ func (a *ahLoginChecker) evaluateSSHAccess(ident *sshca.Identity, ca types.CertA
 		BpfEvents:             bpfEvents,
 		HostUsersInfo:         hostUsersDecision.Info,
 		Preconditions:         preconds,
-		DecisionContext: &decisionpb.SSHAccessPermitContext{
+		DecisionContext: decisionpb.SSHAccessPermitContext_builder{
 			HostUserCreationAllowedBy: hostUsersDecision.AllowedBy,
 			HostUserCreationDeniedBy:  hostUsersDecision.DeniedBy,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 // fetchAccessInfo fetches the services.AccessChecker (after role mapping)
diff --git a/lib/srv/authhandlers_test.go b/lib/srv/authhandlers_test.go
index 02d5f3cafdb..9f0202f48fc 100644
--- a/lib/srv/authhandlers_test.go
+++ b/lib/srv/authhandlers_test.go
@@ -97,13 +97,13 @@ type mockScopedRoleGetter struct {
 
 func (m mockScopedRoleGetter) GetScopedRole(ctx context.Context, req *scopedaccessv1.GetScopedRoleRequest) (*scopedaccessv1.GetScopedRoleResponse, error) {
 	for _, role := range m.scopedRoles {
-		if role.Metadata.Name == req.Name {
-			return &scopedaccessv1.GetScopedRoleResponse{
+		if role.GetMetadata().GetName() == req.GetName() {
+			return scopedaccessv1.GetScopedRoleResponse_builder{
 				Role: role,
-			}, nil
+			}.Build(), nil
 		}
 	}
-	return nil, trace.NotFound("scoped role %q not found", req.Name)
+	return nil, trace.NotFound("scoped role %q not found", req.GetName())
 }
 
 type mockLoginChecker struct {
@@ -301,28 +301,28 @@ func TestRBAC(t *testing.T) {
 	_, err = server.auth.CreateRole(ctx, nodeAccessRole)
 	require.NoError(t, err)
 
-	scopedRole := &scopedaccessv1.ScopedRole{
+	scopedRole := scopedaccessv1.ScopedRole_builder{
 		Kind:     scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{Name: "test"},
+		Metadata: headerv1.Metadata_builder{Name: "test"}.Build(),
 		Scope:    nodeScope,
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{nodeScope},
-			Ssh: &scopedaccessv1.ScopedRoleSSH{
+			Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 				Logins: []string{"testuser"},
 				Labels: []*labelv1.Label{
-					{Name: "test", Values: []string{"node"}},
+					labelv1.Label_builder{Name: "test", Values: []string{"node"}}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 		Version: types.V1,
-	}
-	scopePin := &scopesv1.Pin{
+	}.Build()
+	scopePin := scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_USER,
 		Scope: "/test",
 		AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
-			nodeScope: {nodeScope: {scopedRole.Metadata.Name}},
+			nodeScope: {nodeScope: {scopedRole.GetMetadata().GetName()}},
 		}),
-	}
+	}.Build()
 
 	accessPoint := mockScopedRoleReaderGetter{
 		AccessPoint: mockCAandAuthPrefGetter{
@@ -405,120 +405,120 @@ func TestScopedRBAC(t *testing.T) {
 	serverV2.Scope = "/staging/west"
 
 	scopedRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-west-red",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "team",
 							Values: []string{"red"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-west-blue",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "team",
 							Values: []string{"blue"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-east-red",
-			},
+			}.Build(),
 			Scope: "/staging/east",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/east"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "team",
 							Values: []string{"red"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "prod-west-red",
-			},
+			}.Build(),
 			Scope: "/prod/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/prod/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "team",
 							Values: []string{"red"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-west-no-labels",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "staging-west-wrong-login",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"wronguser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "team",
 							Values: []string{"red"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	pack := newScopedAccessAuthzPack(t, serverV2, scopedRoles, types.DefaultClusterNetworkingConfig())
@@ -530,79 +530,79 @@ func TestScopedRBAC(t *testing.T) {
 	}{
 		{
 			name: "basic allow",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"staging-west-red"}},
 				}),
-			},
+			}.Build(),
 			allowed: true,
 		},
 		{
 			name: "too narrow scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging/west/narrow",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"staging-west-red"}},
 				}),
-			},
+			}.Build(),
 			allowed: false,
 		},
 		{
 			name: "label mismatch",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"staging-west-blue"}},
 				}),
-			},
+			}.Build(),
 			allowed: false,
 		},
 		{
 			name: "scope permission mismatch",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/east": {"/staging/east": {"staging-east-red"}},
 				}),
-			},
+			}.Build(),
 			allowed: false,
 		},
 		{
 			name: "orthogonal scope",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/prod",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/prod/west": {"/prod/west": {"prod-west-red"}},
 				}),
-			},
+			}.Build(),
 			allowed: false,
 		},
 		{
 			name: "no labels",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"staging-west-no-labels"}},
 				}),
-			},
+			}.Build(),
 			allowed: false,
 		},
 		{
 			name: "wrong login",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"staging-west-wrong-login"}},
 				}),
-			},
+			}.Build(),
 			allowed: false,
 		},
 	}
@@ -761,7 +761,7 @@ func TestCheckAgentForward(t *testing.T) {
 		{
 			name:          "access permit allows agent forwarding",
 			component:     teleport.ComponentNode,
-			accessPermit:  &decisionpb.SSHAccessPermit{ForwardAgent: true},
+			accessPermit:  decisionpb.SSHAccessPermit_builder{ForwardAgent: true}.Build(),
 			expectAllowed: true,
 		},
 		{
@@ -1024,9 +1024,9 @@ func TestRBACJoinMFA(t *testing.T) {
 			permit, err := ah.evaluateSSHAccess(ident, userCA, clusterName, node, teleport.SSHSessionJoinPrincipal)
 			tt.testError(t, err)
 			if err == nil && tt.expectPinSourceIP {
-				require.Contains(t, permit.Preconditions, &decisionpb.Precondition{
+				require.Contains(t, permit.GetPreconditions(), decisionpb.Precondition_builder{
 					Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP,
-				})
+				}.Build())
 			}
 		})
 	}
@@ -1260,24 +1260,24 @@ func TestVerifiedPublicKeyCallback(t *testing.T) {
 	require.NoError(t, err)
 
 	precondsPermitRaw, err := protojson.Marshal(
-		&decisionpb.SSHAccessPermit{
+		decisionpb.SSHAccessPermit_builder{
 			Preconditions: []*decisionpb.Precondition{
-				{
+				decisionpb.Precondition_builder{
 					Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA,
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 
 	ipPinningPrecondPermitRaw, err := protojson.Marshal(
-		&decisionpb.SSHAccessPermit{
+		decisionpb.SSHAccessPermit_builder{
 			Preconditions: []*decisionpb.Precondition{
-				{
+				decisionpb.Precondition_builder{
 					Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP,
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 
@@ -1376,13 +1376,13 @@ func TestVerifiedPublicKeyCallback(t *testing.T) {
 		ah := &AuthHandlers{}
 
 		unsupportedPermitRaw, err := protojson.Marshal(
-			&decisionpb.SSHAccessPermit{
+			decisionpb.SSHAccessPermit_builder{
 				Preconditions: []*decisionpb.Precondition{
-					{
+					decisionpb.Precondition_builder{
 						Kind: decisionpb.PreconditionKind(999),
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 
@@ -1776,194 +1776,194 @@ func TestScopedClientIdleTimeout(t *testing.T) {
 	// set up various scoped roles with different scoping, labels, and logins. Note that this test relies on
 	// the each role, and the above cnc, using unique timeout values so that we can tell which policy "won".
 	scopedRoles := []*scopedaccessv1.ScopedRole{
-		{
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "no-timeout",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "10m-timeout",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "10m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "1h-timeout",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "1h",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "25m-timeout",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "25m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "22m-timeout-general",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "22m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "15m-timeout-specific",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "15m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "12m-timeout-team-blue",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "team",
 							Values: []string{"blue"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "12m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "16m-timeout",
-			},
+			}.Build(),
 			Scope: "/staging/west",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"testuser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "16m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
-		{
+		}.Build(),
+		scopedaccessv1.ScopedRole_builder{
 			Kind: scopedaccess.KindScopedRole,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "18m-timeout-wrong-login",
-			},
+			}.Build(),
 			Scope: "/staging",
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{"/staging/west"},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{"wronguser"},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "env",
 							Values: []string{"test"},
-						},
+						}.Build(),
 					},
 					ClientIdleTimeout: "18m",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			Version: types.V1,
-		},
+		}.Build(),
 	}
 
 	pack := newScopedAccessAuthzPack(t, serverV2, scopedRoles, netConfig)
@@ -1976,52 +1976,52 @@ func TestScopedClientIdleTimeout(t *testing.T) {
 	}{
 		{
 			name: "no role timeout uses global default",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"no-timeout"}},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 30 * time.Minute, // global default from cnc
 		},
 		{
 			name: "role timeout more restrictive than global",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"10m-timeout"}},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 10 * time.Minute, // role timeout from the only applicable role
 		},
 		{
 			name: "role timeout less restrictive than global",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging/west": {"/staging/west": {"1h-timeout"}},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 30 * time.Minute, // global default due to being more restrictive than role timeout
 		},
 		{
 			name: "winning role determines timeout (single-role evaluation)",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging":      {"/staging/west": {"25m-timeout"}},
 					"/staging/west": {"/staging/west": {"10m-timeout"}},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 25 * time.Minute, // role assigned *from* a more ancestral/authoritative scope of origin wins
 		},
 		{
 			name: "more specific scope of effect wins (same origin)",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -2030,31 +2030,31 @@ func TestScopedClientIdleTimeout(t *testing.T) {
 						"/staging/west": {"15m-timeout-specific"},
 					},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 15 * time.Minute, // role assigned *to* a more specific scope of effect wins
 		},
 		{
 			name: "label selector mismatch causes fallback to next role",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging":      {"/staging/west": {"12m-timeout-team-blue"}},
 					"/staging/west": {"/staging/west": {"16m-timeout"}},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 16 * time.Minute, // role with child scope of origin wins due to label selector mismatch
 		},
 		{
 			name: "login mismatch causes fallback to next role",
-			pin: &scopesv1.Pin{
+			pin: scopesv1.Pin_builder{
 				Kind:  scopesv1.PinKind_PIN_KIND_USER,
 				Scope: "/staging",
 				AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 					"/staging":      {"/staging/west": {"18m-timeout-wrong-login"}},
 					"/staging/west": {"/staging/west": {"10m-timeout"}},
 				}),
-			},
+			}.Build(),
 			expectTimeout: 10 * time.Minute, // role with child scope of origin wins due to login mismatch
 		},
 	}
@@ -2072,7 +2072,7 @@ func TestScopedClientIdleTimeout(t *testing.T) {
 			require.NoError(t, err)
 			require.NotNil(t, permit)
 
-			actualTimeout := permit.ClientIdleTimeout.AsDuration()
+			actualTimeout := permit.GetClientIdleTimeout().AsDuration()
 			require.Equal(t, tt.expectTimeout, actualTimeout,
 				"ClientIdleTimeout should be %v but got %v", tt.expectTimeout, actualTimeout)
 		})
@@ -2096,13 +2096,13 @@ func newScopedSSHPermitTestPack(t *testing.T, roles []*scopedaccessv1.ScopedRole
 
 	// add standard logins and labels to each role so they match the test node
 	for _, role := range roles {
-		if role.Spec.Ssh.Logins == nil {
-			role.Spec.Ssh.Logins = []string{"testuser"}
+		if role.GetSpec().GetSsh().GetLogins() == nil {
+			role.GetSpec().GetSsh().SetLogins([]string{"testuser"})
 		}
-		if role.Spec.Ssh.Labels == nil {
-			role.Spec.Ssh.Labels = []*labelv1.Label{
-				{Name: "env", Values: []string{"test"}},
-			}
+		if role.GetSpec().GetSsh().GetLabels() == nil {
+			role.GetSpec().GetSsh().SetLabels([]*labelv1.Label{
+				labelv1.Label_builder{Name: "env", Values: []string{"test"}}.Build(),
+			})
 		}
 	}
 
@@ -2110,26 +2110,26 @@ func newScopedSSHPermitTestPack(t *testing.T, roles []*scopedaccessv1.ScopedRole
 }
 
 func pinForRole(roleName string) *scopesv1.Pin {
-	return &scopesv1.Pin{
+	return scopesv1.Pin_builder{
 		Kind:  scopesv1.PinKind_PIN_KIND_USER,
 		Scope: "/staging",
 		AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 			"/staging/west": {"/staging/west": {roleName}},
 		}),
-	}
+	}.Build()
 }
 
 func baseScopedRoleForAuthz(name string) *scopedaccessv1.ScopedRole {
-	return &scopedaccessv1.ScopedRole{
+	return scopedaccessv1.ScopedRole_builder{
 		Kind:     scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{Name: name},
+		Metadata: headerv1.Metadata_builder{Name: name}.Build(),
 		Scope:    "/staging/west",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/staging/west"},
 			Ssh:              &scopedaccessv1.ScopedRoleSSH{},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 }
 
 func TestScopedX11Forwarding(t *testing.T) {
@@ -2137,10 +2137,10 @@ func TestScopedX11Forwarding(t *testing.T) {
 	const x11disabled = "x11-disabled"
 	const x11unset = "x11-unset"
 	enabled := baseScopedRoleForAuthz(x11enabled)
-	enabled.Spec.Ssh.PermitX11Forwarding = proto.Bool(true)
+	enabled.GetSpec().GetSsh().SetPermitX11Forwarding(true)
 
 	disabled := baseScopedRoleForAuthz(x11disabled)
-	disabled.Spec.Ssh.PermitX11Forwarding = proto.Bool(false)
+	disabled.GetSpec().GetSsh().SetPermitX11Forwarding(false)
 
 	unset := baseScopedRoleForAuthz(x11unset)
 
@@ -2159,7 +2159,7 @@ func TestScopedX11Forwarding(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
-			require.Equal(t, tt.expect, permit.X11Forwarding)
+			require.Equal(t, tt.expect, permit.GetX11Forwarding())
 		})
 	}
 }
@@ -2170,10 +2170,10 @@ func TestScopedForwardAgent(t *testing.T) {
 	const agentUnset = "agent-unset"
 
 	enabled := baseScopedRoleForAuthz(agentEnabled)
-	enabled.Spec.Ssh.ForwardAgent = proto.Bool(true)
+	enabled.GetSpec().GetSsh().SetForwardAgent(true)
 
 	disabled := baseScopedRoleForAuthz(agentDisabled)
-	disabled.Spec.Ssh.ForwardAgent = proto.Bool(false)
+	disabled.GetSpec().GetSsh().SetForwardAgent(false)
 
 	unset := baseScopedRoleForAuthz(agentUnset)
 
@@ -2192,7 +2192,7 @@ func TestScopedForwardAgent(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
-			require.Equal(t, tt.expect, permit.ForwardAgent)
+			require.Equal(t, tt.expect, permit.GetForwardAgent())
 		})
 	}
 }
@@ -2203,10 +2203,10 @@ func TestScopedSSHFileCopy(t *testing.T) {
 	const copyUnset = "copy-unset"
 
 	enabled := baseScopedRoleForAuthz(copyEnabled)
-	enabled.Spec.Ssh.FileCopy = proto.Bool(true)
+	enabled.GetSpec().GetSsh().SetFileCopy(true)
 
 	disabled := baseScopedRoleForAuthz(copyDisabled)
-	disabled.Spec.Ssh.FileCopy = proto.Bool(false)
+	disabled.GetSpec().GetSsh().SetFileCopy(false)
 
 	unset := baseScopedRoleForAuthz(copyUnset)
 
@@ -2225,7 +2225,7 @@ func TestScopedSSHFileCopy(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
-			require.Equal(t, tt.expect, permit.SshFileCopy)
+			require.Equal(t, tt.expect, permit.GetSshFileCopy())
 		})
 	}
 }
@@ -2237,22 +2237,22 @@ func TestScopedSSHPortForwarding(t *testing.T) {
 	const pfUnset = "pf-unset"
 
 	bothOn := baseScopedRoleForAuthz(pfBothOn)
-	bothOn.Spec.Ssh.PortForwarding = &scopedaccessv1.SSHPortForwarding{
-		Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: proto.Bool(true)},
-		Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: proto.Bool(true)},
-	}
+	bothOn.GetSpec().GetSsh().SetPortForwarding(scopedaccessv1.SSHPortForwarding_builder{
+		Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: proto.Bool(true)}.Build(),
+		Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: proto.Bool(true)}.Build(),
+	}.Build())
 
 	bothOff := baseScopedRoleForAuthz(pfBothOff)
-	bothOff.Spec.Ssh.PortForwarding = &scopedaccessv1.SSHPortForwarding{
-		Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: proto.Bool(false)},
-		Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: proto.Bool(false)},
-	}
+	bothOff.GetSpec().GetSsh().SetPortForwarding(scopedaccessv1.SSHPortForwarding_builder{
+		Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: proto.Bool(false)}.Build(),
+		Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: proto.Bool(false)}.Build(),
+	}.Build())
 
 	localOnly := baseScopedRoleForAuthz(pfLocalOnly)
-	localOnly.Spec.Ssh.PortForwarding = &scopedaccessv1.SSHPortForwarding{
-		Local:  &scopedaccessv1.SSHLocalPortForwarding{Enabled: proto.Bool(true)},
-		Remote: &scopedaccessv1.SSHRemotePortForwarding{Enabled: proto.Bool(false)},
-	}
+	localOnly.GetSpec().GetSsh().SetPortForwarding(scopedaccessv1.SSHPortForwarding_builder{
+		Local:  scopedaccessv1.SSHLocalPortForwarding_builder{Enabled: proto.Bool(true)}.Build(),
+		Remote: scopedaccessv1.SSHRemotePortForwarding_builder{Enabled: proto.Bool(false)}.Build(),
+	}.Build())
 
 	unset := baseScopedRoleForAuthz(pfUnset)
 	pack := newScopedSSHPermitTestPack(t, []*scopedaccessv1.ScopedRole{bothOn, bothOff, localOnly, unset})
@@ -2271,7 +2271,7 @@ func TestScopedSSHPortForwarding(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
-			require.Equal(t, tt.expect, permit.PortForwardMode)
+			require.Equal(t, tt.expect, permit.GetPortForwardMode())
 		})
 	}
 }
@@ -2282,10 +2282,10 @@ func TestScopedMaxSessions(t *testing.T) {
 	const sessionsUnset = "sessions-unset"
 
 	five := baseScopedRoleForAuthz(sessions5)
-	five.Spec.Ssh.MaxSessions = proto.Int64(5)
+	five.GetSpec().GetSsh().SetMaxSessions(5)
 
 	one := baseScopedRoleForAuthz(sessions1)
-	one.Spec.Ssh.MaxSessions = proto.Int64(1)
+	one.GetSpec().GetSsh().SetMaxSessions(1)
 
 	unset := baseScopedRoleForAuthz(sessionsUnset)
 
@@ -2304,7 +2304,7 @@ func TestScopedMaxSessions(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
-			require.Equal(t, tt.expect, permit.MaxSessions)
+			require.Equal(t, tt.expect, permit.GetMaxSessions())
 		})
 	}
 }
@@ -2315,16 +2315,16 @@ func TestScopedHostUserCreation(t *testing.T) {
 	const hostUserUnset = "host-user-unset"
 
 	keep := baseScopedRoleForAuthz(hostUserKeep)
-	keep.Spec.Ssh.HostUserCreation = &scopedaccessv1.CreateHostUser{
+	keep.GetSpec().GetSsh().SetHostUserCreation(scopedaccessv1.CreateHostUser_builder{
 		Mode:   "keep",
 		Groups: []string{"wheel"},
 		Shell:  "/bin/bash",
-	}
+	}.Build())
 
 	off := baseScopedRoleForAuthz(hostUserOff)
-	off.Spec.Ssh.HostUserCreation = &scopedaccessv1.CreateHostUser{
+	off.GetSpec().GetSsh().SetHostUserCreation(scopedaccessv1.CreateHostUser_builder{
 		Mode: "off",
-	}
+	}.Build())
 
 	unset := baseScopedRoleForAuthz(hostUserUnset)
 
@@ -2344,9 +2344,9 @@ func TestScopedHostUserCreation(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
 			if tt.expectNil {
-				require.Nil(t, permit.HostUsersInfo)
+				require.Nil(t, permit.GetHostUsersInfo())
 			} else {
-				require.NotNil(t, permit.HostUsersInfo)
+				require.NotNil(t, permit.GetHostUsersInfo())
 			}
 		})
 	}
@@ -2358,7 +2358,7 @@ func TestHostSudoers(t *testing.T) {
 
 	present := baseScopedRoleForAuthz(sudoersPresent)
 	expectedSudoers := []string{"ALL=(ALL) NOPASSWD:ALL"}
-	present.Spec.Ssh.HostSudoers = expectedSudoers
+	present.GetSpec().GetSsh().SetHostSudoers(expectedSudoers)
 	unset := baseScopedRoleForAuthz(sudoersUnset)
 
 	pack := newScopedSSHPermitTestPack(t, []*scopedaccessv1.ScopedRole{present, unset})
@@ -2375,7 +2375,7 @@ func TestHostSudoers(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			permit, err := pack.UserKeyAuthFromPin(t, tt.pin)
 			require.NoError(t, err)
-			require.Equal(t, tt.expect, permit.HostSudoers)
+			require.Equal(t, tt.expect, permit.GetHostSudoers())
 		})
 	}
 }
diff --git a/lib/srv/ctx.go b/lib/srv/ctx.go
index b41c391a914..84c5b8fe189 100644
--- a/lib/srv/ctx.go
+++ b/lib/srv/ctx.go
@@ -465,10 +465,10 @@ func NewServerContext(ctx context.Context, parent *sshutils.ConnectionContext, s
 	)
 	switch {
 	case identityContext.AccessPermit != nil:
-		clientIdleTimeout = identityContext.AccessPermit.ClientIdleTimeout.AsDuration()
-		disconnectExpiredCert = timestampToGoTime(identityContext.AccessPermit.DisconnectExpiredCert)
-		lockTargets = decision.LockTargetsFromProto(identityContext.AccessPermit.LockTargets)
-		lockingMode = constants.LockingMode(identityContext.AccessPermit.LockingMode)
+		clientIdleTimeout = identityContext.AccessPermit.GetClientIdleTimeout().AsDuration()
+		disconnectExpiredCert = timestampToGoTime(identityContext.AccessPermit.GetDisconnectExpiredCert())
+		lockTargets = decision.LockTargetsFromProto(identityContext.AccessPermit.GetLockTargets())
+		lockingMode = constants.LockingMode(identityContext.AccessPermit.GetLockingMode())
 
 	case identityContext.ProxyingPermit != nil:
 		clientIdleTimeout = identityContext.ProxyingPermit.ClientIdleTimeout
@@ -727,7 +727,7 @@ func (c *ServerContext) CheckFileCopyingAllowed() error {
 	}
 
 	// check if ssh access permit is defined and authorizes file copying
-	if permit := c.Identity.AccessPermit; permit != nil && permit.SshFileCopy {
+	if permit := c.Identity.AccessPermit; permit != nil && permit.GetSshFileCopy() {
 		return nil
 	}
 
@@ -1026,7 +1026,7 @@ func getPAMConfig(c *ServerContext) (*reexec.PAMConfig, error) {
 	environment := make(map[string]string)
 	environment["TELEPORT_USERNAME"] = c.Identity.TeleportUser
 	environment["TELEPORT_LOGIN"] = c.Identity.Login
-	environment["TELEPORT_ROLES"] = strings.Join(c.Identity.AccessPermit.MappedRoles, " ")
+	environment["TELEPORT_ROLES"] = strings.Join(c.Identity.AccessPermit.GetMappedRoles(), " ")
 	if localPAMConfig.Environment != nil {
 		for key, value := range localPAMConfig.Environment {
 			expr, err := parse.NewTraitsTemplateExpression(value)
@@ -1099,7 +1099,7 @@ func (c *ServerContext) ExecCommand() (*reexec.ExecCommand, error) {
 	var mappedRoles []string
 	switch {
 	case c.Identity.AccessPermit != nil:
-		mappedRoles = c.Identity.AccessPermit.MappedRoles
+		mappedRoles = c.Identity.AccessPermit.GetMappedRoles()
 	case c.Identity.ProxyingPermit != nil:
 		mappedRoles = c.Identity.ProxyingPermit.MappedRoles
 	default:
diff --git a/lib/srv/ctx_test.go b/lib/srv/ctx_test.go
index b20c022329b..6f825f4db5c 100644
--- a/lib/srv/ctx_test.go
+++ b/lib/srv/ctx_test.go
@@ -51,33 +51,33 @@ func TestCheckSFTPAllowed(t *testing.T) {
 		{
 			name:                 "node disallowed",
 			nodeAllowFileCopying: false,
-			permit: &decisionpb.SSHAccessPermit{
+			permit: decisionpb.SSHAccessPermit_builder{
 				SshFileCopy: true,
-			},
+			}.Build(),
 			expectedErr: ErrNodeFileCopyingNotPermitted,
 		},
 		{
 			name:                 "node allowed",
 			nodeAllowFileCopying: true,
-			permit: &decisionpb.SSHAccessPermit{
+			permit: decisionpb.SSHAccessPermit_builder{
 				SshFileCopy: true,
-			},
+			}.Build(),
 			expectedErr: nil,
 		},
 		{
 			name:                 "role disallowed",
 			nodeAllowFileCopying: true,
-			permit: &decisionpb.SSHAccessPermit{
+			permit: decisionpb.SSHAccessPermit_builder{
 				SshFileCopy: false,
-			},
+			}.Build(),
 			expectedErr: errRoleFileCopyingNotPermitted,
 		},
 		{
 			name:                 "role allowed",
 			nodeAllowFileCopying: true,
-			permit: &decisionpb.SSHAccessPermit{
+			permit: decisionpb.SSHAccessPermit_builder{
 				SshFileCopy: true,
-			},
+			}.Build(),
 			expectedErr: nil,
 		},
 		{
@@ -99,9 +99,9 @@ func TestCheckSFTPAllowed(t *testing.T) {
 		{
 			name:                 "moderated sessions enforced",
 			nodeAllowFileCopying: true,
-			permit: &decisionpb.SSHAccessPermit{
+			permit: decisionpb.SSHAccessPermit_builder{
 				SshFileCopy: true,
-			},
+			}.Build(),
 			sessionPolicies: []*types.SessionRequirePolicy{
 				{
 					Name:   "test",
@@ -229,7 +229,7 @@ func TestIdentityContext_GetUserMetadata(t *testing.T) {
 				TeleportUser: "alpaca",
 				Login:        "alpaca1",
 				UnmappedIdentity: &sshca.Identity{
-					ScopePin: &scopesv1.Pin{
+					ScopePin: scopesv1.Pin_builder{
 						Kind:  scopesv1.PinKind_PIN_KIND_USER,
 						Scope: "/staging",
 						AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -239,7 +239,7 @@ func TestIdentityContext_GetUserMetadata(t *testing.T) {
 								"/staging/green": {"staging-access"},
 							},
 						}),
-					},
+					}.Build(),
 				},
 			},
 			want: apievents.UserMetadata{
@@ -264,7 +264,7 @@ func TestIdentityContext_GetUserMetadata(t *testing.T) {
 				BotName:       "alpaca",
 				BotInstanceID: "123-123-123",
 				UnmappedIdentity: &sshca.Identity{
-					ScopePin: &scopesv1.Pin{
+					ScopePin: scopesv1.Pin_builder{
 						Kind:  scopesv1.PinKind_PIN_KIND_USER,
 						Scope: "/staging",
 						AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -274,7 +274,7 @@ func TestIdentityContext_GetUserMetadata(t *testing.T) {
 								"/staging/green": {"staging-access"},
 							},
 						}),
-					},
+					}.Build(),
 				},
 			},
 			want: apievents.UserMetadata{
diff --git a/lib/srv/db/access_test.go b/lib/srv/db/access_test.go
index a040c4f4804..870603886ae 100644
--- a/lib/srv/db/access_test.go
+++ b/lib/srv/db/access_test.go
@@ -392,7 +392,7 @@ func TestMySQLServerVersionUpdateOnConnection(t *testing.T) {
 	// update the server version before we connect
 	hcc, err := testCtx.authServer.GetHealthCheckConfig(ctx, teleport.VirtualDefaultHealthCheckConfigDBName)
 	require.NoError(t, err)
-	hcc.Spec.Match.Disabled = true
+	hcc.GetSpec().GetMatch().SetDisabled(true)
 	_, err = testCtx.authServer.UpsertHealthCheckConfig(ctx, hcc)
 	require.NoError(t, err)
 	testCtx.server = testCtx.setupDatabaseServer(ctx, t, agentParams{
@@ -2593,12 +2593,12 @@ func (c *testContext) setupDatabaseServer(ctx context.Context, t testing.TB, p a
 
 	inventoryHandle, err := inventory.NewDownstreamHandle(clt.InventoryControlStream,
 		func(_ context.Context) (*proto.UpstreamInventoryHello, error) {
-			return &proto.UpstreamInventoryHello{
+			return proto.UpstreamInventoryHello_builder{
 				ServerID: p.HostID,
 				Version:  teleport.Version,
 				Services: types.SystemRoles{types.RoleDatabase}.StringSlice(),
 				Hostname: "test",
-			}, nil
+			}.Build(), nil
 		})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, inventoryHandle.Close()) })
diff --git a/lib/srv/db/autousers_test.go b/lib/srv/db/autousers_test.go
index 86e66fbe126..97fb254961c 100644
--- a/lib/srv/db/autousers_test.go
+++ b/lib/srv/db/autousers_test.go
@@ -101,24 +101,24 @@ func TestAutoUsersPostgres(t *testing.T) {
 					},
 				},
 			},
-			importRuleSpec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+			importRuleSpec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 				Priority:       0,
 				DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 				Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{
-					{
+					dbobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
 						// select three tables out of five in the public schema.
 						// see handleSchemaInfo() for the effective schema.
-						Match: &dbobjectimportrulev1.DatabaseObjectImportMatch{
+						Match: dbobjectimportrulev1.DatabaseObjectImportMatch_builder{
 							TableNames: []string{"orders", "departments", "projects"},
-						},
+						}.Build(),
 						// select public schema, skipping the hr schema.
-						Scope: &dbobjectimportrulev1.DatabaseObjectImportScope{
+						Scope: dbobjectimportrulev1.DatabaseObjectImportScope_builder{
 							SchemaNames: []string{"public"},
-						},
+						}.Build(),
 						AddLabels: map[string]string{"can_select": "true"},
-					},
+					}.Build(),
 				},
-			},
+			}.Build(),
 			expectedPermissions: postgres.Permissions{
 				Tables: []postgres.TablePermission{
 					{Privilege: "SELECT", Schema: "public", Table: "orders"},
diff --git a/lib/srv/db/common/databaseobject/databaseobject.go b/lib/srv/db/common/databaseobject/databaseobject.go
index a811c648d1d..9f9356b4af5 100644
--- a/lib/srv/db/common/databaseobject/databaseobject.go
+++ b/lib/srv/db/common/databaseobject/databaseobject.go
@@ -34,16 +34,16 @@ func NewDatabaseObject(name string, spec *dbobjectv1.DatabaseObjectSpec) (*dbobj
 
 // NewDatabaseObjectWithLabels creates a new dbobjectv1.DatabaseObject with specified labels.
 func NewDatabaseObjectWithLabels(name string, labels map[string]string, spec *dbobjectv1.DatabaseObjectSpec) (*dbobjectv1.DatabaseObject, error) {
-	databaseObject := &dbobjectv1.DatabaseObject{
+	databaseObject := dbobjectv1.DatabaseObject_builder{
 		Kind:    types.KindDatabaseObject,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:      name,
 			Namespace: defaults.Namespace,
 			Labels:    labels,
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 
 	err := ValidateDatabaseObject(databaseObject)
 	if err != nil {
@@ -57,22 +57,22 @@ func ValidateDatabaseObject(obj *dbobjectv1.DatabaseObject) error {
 	if obj == nil {
 		return trace.BadParameter("database object must be non-nil")
 	}
-	if obj.Metadata == nil {
+	if !obj.HasMetadata() {
 		return trace.BadParameter("metadata: must be non-nil")
 	}
-	if obj.Metadata.Name == "" {
+	if obj.GetMetadata().GetName() == "" {
 		return trace.BadParameter("metadata.name: must be non-empty")
 	}
-	if obj.Kind != types.KindDatabaseObject {
-		return trace.BadParameter("invalid kind %v, expected %v", obj.Kind, types.KindDatabaseObject)
+	if obj.GetKind() != types.KindDatabaseObject {
+		return trace.BadParameter("invalid kind %v, expected %v", obj.GetKind(), types.KindDatabaseObject)
 	}
-	if obj.Spec == nil {
+	if !obj.HasSpec() {
 		return trace.BadParameter("spec: must be non-empty")
 	}
-	if obj.Spec.Name == "" {
+	if obj.GetSpec().GetName() == "" {
 		return trace.BadParameter("spec.name: must be non-empty")
 	}
-	if obj.Spec.Protocol == "" {
+	if obj.GetSpec().GetProtocol() == "" {
 		return trace.BadParameter("spec.protocol: must be non-empty")
 	}
 	return nil
diff --git a/lib/srv/db/common/databaseobject/databaseobject_test.go b/lib/srv/db/common/databaseobject/databaseobject_test.go
index 7c831a6fde8..d727a81fc21 100644
--- a/lib/srv/db/common/databaseobject/databaseobject_test.go
+++ b/lib/srv/db/common/databaseobject/databaseobject_test.go
@@ -39,31 +39,31 @@ func TestNewDatabaseObject(t *testing.T) {
 	}{
 		{
 			name: "valid object",
-			spec: &dbobjectv1.DatabaseObjectSpec{
+			spec: dbobjectv1.DatabaseObjectSpec_builder{
 				Protocol:            "postgres",
 				DatabaseServiceName: "test",
 				ObjectKind:          types.KindDatabaseObject,
 				Database:            "test",
 				Schema:              "test",
 				Name:                "test",
-			},
+			}.Build(),
 			expectedError: nil,
-			expectedObj: &dbobjectv1.DatabaseObject{
+			expectedObj: dbobjectv1.DatabaseObject_builder{
 				Kind:    types.KindDatabaseObject,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "valid object",
 					Namespace: defaults.Namespace,
-				},
-				Spec: &dbobjectv1.DatabaseObjectSpec{
+				}.Build(),
+				Spec: dbobjectv1.DatabaseObjectSpec_builder{
 					Protocol:            "postgres",
 					DatabaseServiceName: "test",
 					ObjectKind:          types.KindDatabaseObject,
 					Database:            "test",
 					Schema:              "test",
 					Name:                "test",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:          "missing name",
@@ -89,11 +89,11 @@ func TestValidateDatabaseObject(t *testing.T) {
 	}{
 		{
 			name: "valid object",
-			databaseObject: &dbobjectv1.DatabaseObject{
+			databaseObject: dbobjectv1.DatabaseObject_builder{
 				Kind:     types.KindDatabaseObject,
-				Metadata: &headerv1.Metadata{Name: "test", Namespace: defaults.Namespace},
-				Spec:     &dbobjectv1.DatabaseObjectSpec{Name: "test", Protocol: "test"},
-			},
+				Metadata: headerv1.Metadata_builder{Name: "test", Namespace: defaults.Namespace}.Build(),
+				Spec:     dbobjectv1.DatabaseObjectSpec_builder{Name: "test", Protocol: "test"}.Build(),
+			}.Build(),
 			expectedError: nil,
 		},
 		{
@@ -103,42 +103,42 @@ func TestValidateDatabaseObject(t *testing.T) {
 		},
 		{
 			name:           "nil metadata",
-			databaseObject: &dbobjectv1.DatabaseObject{Metadata: nil},
+			databaseObject: dbobjectv1.DatabaseObject_builder{Metadata: nil}.Build(),
 			expectedError:  trace.BadParameter("metadata: must be non-nil"),
 		},
 		{
 			name: "invalid kind",
-			databaseObject: &dbobjectv1.DatabaseObject{
+			databaseObject: dbobjectv1.DatabaseObject_builder{
 				Kind:     "InvalidKind",
-				Metadata: &headerv1.Metadata{Name: "test", Namespace: defaults.Namespace},
-				Spec:     &dbobjectv1.DatabaseObjectSpec{Name: "test"},
-			},
+				Metadata: headerv1.Metadata_builder{Name: "test", Namespace: defaults.Namespace}.Build(),
+				Spec:     dbobjectv1.DatabaseObjectSpec_builder{Name: "test"}.Build(),
+			}.Build(),
 			expectedError: trace.BadParameter("invalid kind InvalidKind, expected db_object"),
 		},
 		{
 			name: "missing spec",
-			databaseObject: &dbobjectv1.DatabaseObject{
+			databaseObject: dbobjectv1.DatabaseObject_builder{
 				Kind:     types.KindDatabaseObject,
-				Metadata: &headerv1.Metadata{Name: "test", Namespace: defaults.Namespace},
+				Metadata: headerv1.Metadata_builder{Name: "test", Namespace: defaults.Namespace}.Build(),
 				Spec:     nil,
-			},
+			}.Build(),
 			expectedError: trace.BadParameter("spec: must be non-empty"),
 		},
 		{
 			name: "missing object name",
-			databaseObject: &dbobjectv1.DatabaseObject{
+			databaseObject: dbobjectv1.DatabaseObject_builder{
 				Kind:     types.KindDatabaseObject,
-				Metadata: &headerv1.Metadata{Name: "", Namespace: defaults.Namespace},
-			},
+				Metadata: headerv1.Metadata_builder{Name: "", Namespace: defaults.Namespace}.Build(),
+			}.Build(),
 			expectedError: trace.BadParameter("metadata.name: must be non-empty"),
 		},
 		{
 			name: "missing name",
-			databaseObject: &dbobjectv1.DatabaseObject{
+			databaseObject: dbobjectv1.DatabaseObject_builder{
 				Kind:     types.KindDatabaseObject,
-				Metadata: &headerv1.Metadata{Name: "test", Namespace: defaults.Namespace},
-				Spec:     &dbobjectv1.DatabaseObjectSpec{Name: ""},
-			},
+				Metadata: headerv1.Metadata_builder{Name: "test", Namespace: defaults.Namespace}.Build(),
+				Spec:     dbobjectv1.DatabaseObjectSpec_builder{Name: ""}.Build(),
+			}.Build(),
 			expectedError: trace.BadParameter("spec.name: must be non-empty"),
 		},
 	}
diff --git a/lib/srv/db/common/databaseobjectimportrule/apply.go b/lib/srv/db/common/databaseobjectimportrule/apply.go
index 8f6856d4fa2..9d8aa50564b 100644
--- a/lib/srv/db/common/databaseobjectimportrule/apply.go
+++ b/lib/srv/db/common/databaseobjectimportrule/apply.go
@@ -45,13 +45,13 @@ import (
 func ApplyDatabaseObjectImportRules(ctx context.Context, logger *slog.Logger, rules []*dbobjectimportrulev1.DatabaseObjectImportRule, database types.Database, objs []*dbobjectv1.DatabaseObject) ([]*dbobjectv1.DatabaseObject, int) {
 	// sort: rules with higher priorities are applied last.
 	sort.Slice(rules, func(i, j int) bool {
-		return rules[i].Spec.Priority < rules[j].Spec.Priority
+		return rules[i].GetSpec().GetPriority() < rules[j].GetSpec().GetPriority()
 	})
 
 	// get mappings from rules matching database labels
 	var mappings []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping
 	for _, rule := range filterRulesForDatabase(rules, database) {
-		mappings = append(mappings, rule.Spec.Mappings...)
+		mappings = append(mappings, rule.GetSpec().GetMappings()...)
 	}
 
 	var objects []*dbobjectv1.DatabaseObject
@@ -65,15 +65,15 @@ func ApplyDatabaseObjectImportRules(ctx context.Context, logger *slog.Logger, ru
 	for _, obj := range objs {
 		// prepare object clone
 		objClone := utils.CloneProtoMsg(obj)
-		if objClone.Metadata.Labels == nil {
-			objClone.Metadata.Labels = map[string]string{}
+		if objClone.GetMetadata().GetLabels() == nil {
+			objClone.GetMetadata().SetLabels(map[string]string{})
 		}
 
 		// apply each mapping in order.
 		matched := false
 		hadError := false
 		for _, mapping := range mappings {
-			match, err := applyMappingToObject(mapping, objClone.GetSpec(), objClone.Metadata.Labels)
+			match, err := applyMappingToObject(mapping, objClone.GetSpec(), objClone.GetMetadata().GetLabels())
 			if err != nil {
 				logger.DebugContext(ctx, "failed to apply label due to template error", "name", obj.GetMetadata().GetName(), "error", err)
 				errCount++
@@ -101,7 +101,7 @@ func CalculateDatabaseNameFilter(rules []*dbobjectimportrulev1.DatabaseObjectImp
 	var patterns []string
 	for _, rule := range filterRulesForDatabase(rules, database) {
 		spec := rule.GetSpec()
-		for _, mapping := range spec.Mappings {
+		for _, mapping := range spec.GetMappings() {
 			names := mapping.GetScope().GetDatabaseNames()
 			// empty list of database names means "any database name".
 			if len(names) == 0 {
@@ -122,7 +122,7 @@ func filterRulesForDatabase(rules []*dbobjectimportrulev1.DatabaseObjectImportRu
 	var out []*dbobjectimportrulev1.DatabaseObjectImportRule
 	for _, rule := range rules {
 		dbLabels := make(types.Labels)
-		mapLabel := label.ToMap(rule.Spec.GetDatabaseLabels())
+		mapLabel := label.ToMap(rule.GetSpec().GetDatabaseLabels())
 		for k, v := range mapLabel {
 			dbLabels[k] = v
 		}
@@ -257,7 +257,7 @@ func applyMappingToObject(mapping *dbobjectimportrulev1.DatabaseObjectImportRule
 		return false, nil
 	}
 
-	for key, value := range mapping.AddLabels {
+	for key, value := range mapping.GetAddLabels() {
 		out, err := evalTemplate(value, spec)
 		if err != nil {
 			return false, trace.Wrap(err)
diff --git a/lib/srv/db/common/databaseobjectimportrule/apply_test.go b/lib/srv/db/common/databaseobjectimportrule/apply_test.go
index 7f4096bb908..90731c4c06a 100644
--- a/lib/srv/db/common/databaseobjectimportrule/apply_test.go
+++ b/lib/srv/db/common/databaseobjectimportrule/apply_test.go
@@ -51,7 +51,7 @@ type option func(db *dbobjectv1.DatabaseObject) error
 
 func mkDatabaseObject(t *testing.T, name string, spec *dbobjectv1.DatabaseObjectSpec, options ...option) *dbobjectv1.DatabaseObject {
 	t.Helper()
-	spec.Name = name
+	spec.SetName(name)
 	out, err := databaseobject.NewDatabaseObject(name, spec)
 	require.NoError(t, err)
 	for _, opt := range options {
@@ -69,15 +69,15 @@ func mkImportRule(t *testing.T, name string, spec *databaseobjectimportrulev1.Da
 }
 
 func mkImportRuleNoValidation(name string, spec *databaseobjectimportrulev1.DatabaseObjectImportRuleSpec) *databaseobjectimportrulev1.DatabaseObjectImportRule {
-	out := &databaseobjectimportrulev1.DatabaseObjectImportRule{
+	out := databaseobjectimportrulev1.DatabaseObjectImportRule_builder{
 		Kind:    types.KindDatabaseObjectImportRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:      name,
 			Namespace: defaults.Namespace,
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 	return out
 }
 
@@ -100,48 +100,48 @@ func TestApplyDatabaseObjectImportRules(t *testing.T) {
 		{
 			name: "database labels are matched by the rules",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRule(t, "foo", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "foo", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"dev"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 								TableNames: []string{"*"},
-							},
+							}.Build(),
 							AddLabels: map[string]string{
 								"dev_access":    "rw",
 								"flag_from_dev": "dummy",
 							},
-						},
+						}.Build(),
 					},
-				}),
-				mkImportRule(t, "bar", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build()),
+				mkImportRule(t, "bar", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       20,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 								TableNames: []string{"*"},
-							},
+							}.Build(),
 							AddLabels: map[string]string{
 								"dev_access":     "ro",
 								"flag_from_prod": "dummy",
 							},
-						},
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			database: mkDatabase(t, "dummy", map[string]string{"env": "prod"}),
 			objs: []*dbobjectv1.DatabaseObject{
-				mkDatabaseObject(t, "foo", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}),
+				mkDatabaseObject(t, "foo", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build()),
 			},
 			want: []*dbobjectv1.DatabaseObject{
-				mkDatabaseObject(t, "foo", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"},
+				mkDatabaseObject(t, "foo", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build(),
 					func(db *dbobjectv1.DatabaseObject) error {
-						db.Metadata.Labels = map[string]string{
+						db.GetMetadata().SetLabels(map[string]string{
 							"dev_access":     "ro",
 							"flag_from_prod": "dummy",
-						}
+						})
 						return nil
 					}),
 			},
@@ -149,49 +149,49 @@ func TestApplyDatabaseObjectImportRules(t *testing.T) {
 		{
 			name: "rule priorities are applied",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRule(t, "foo", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "foo", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 								TableNames: []string{"*"},
-							},
+							}.Build(),
 							AddLabels: map[string]string{
 								"dev_access":    "rw",
 								"flag_from_dev": "dummy",
 							},
-						},
+						}.Build(),
 					},
-				}),
+				}.Build()),
 
-				mkImportRule(t, "bar", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "bar", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       20,
 					DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 								TableNames: []string{"*"},
-							},
+							}.Build(),
 							AddLabels: map[string]string{
 								"dev_access":     "ro",
 								"flag_from_prod": "dummy",
 							},
-						},
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			database: mkDatabase(t, "dummy", map[string]string{}),
 			objs: []*dbobjectv1.DatabaseObject{
-				mkDatabaseObject(t, "foo", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}),
+				mkDatabaseObject(t, "foo", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build()),
 			},
 			want: []*dbobjectv1.DatabaseObject{
-				mkDatabaseObject(t, "foo", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}, func(db *dbobjectv1.DatabaseObject) error {
-					db.Metadata.Labels = map[string]string{
+				mkDatabaseObject(t, "foo", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build(), func(db *dbobjectv1.DatabaseObject) error {
+					db.GetMetadata().SetLabels(map[string]string{
 						"dev_access":     "ro",
 						"flag_from_dev":  "dummy",
 						"flag_from_prod": "dummy",
-					}
+					})
 					return nil
 				}),
 			},
@@ -199,55 +199,55 @@ func TestApplyDatabaseObjectImportRules(t *testing.T) {
 		{
 			name: "errors are counted",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRule(t, "foo", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "foo", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 								TableNames: []string{"*"},
-							},
+							}.Build(),
 							AddLabels: map[string]string{
 								"dev_access":    "rw",
 								"flag_from_dev": "dummy",
 							},
-						},
+						}.Build(),
 					},
-				}),
+				}.Build()),
 
-				mkImportRuleNoValidation("bar", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRuleNoValidation("bar", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       20,
 					DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 								TableNames: []string{"*"},
-							},
+							}.Build(),
 							AddLabels: map[string]string{
 								"dev_access":     "ro",
 								"flag_from_prod": "dummy",
 							},
-						},
-						{
-							Match:     &databaseobjectimportrulev1.DatabaseObjectImportMatch{TableNames: []string{"bar", "baz"}},
+						}.Build(),
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Match:     databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{TableNames: []string{"bar", "baz"}}.Build(),
 							AddLabels: map[string]string{"error label": "{{foo()}}"},
-						},
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			database: mkDatabase(t, "dummy", map[string]string{}),
 			objs: []*dbobjectv1.DatabaseObject{
-				mkDatabaseObject(t, "foo", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}),
-				mkDatabaseObject(t, "bar", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}),
-				mkDatabaseObject(t, "baz", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}),
+				mkDatabaseObject(t, "foo", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build()),
+				mkDatabaseObject(t, "bar", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build()),
+				mkDatabaseObject(t, "baz", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build()),
 			},
 			want: []*dbobjectv1.DatabaseObject{
-				mkDatabaseObject(t, "foo", &dbobjectv1.DatabaseObjectSpec{ObjectKind: ObjectKindTable, Protocol: "postgres"}, func(db *dbobjectv1.DatabaseObject) error {
-					db.Metadata.Labels = map[string]string{
+				mkDatabaseObject(t, "foo", dbobjectv1.DatabaseObjectSpec_builder{ObjectKind: ObjectKindTable, Protocol: "postgres"}.Build(), func(db *dbobjectv1.DatabaseObject) error {
+					db.GetMetadata().SetLabels(map[string]string{
 						"dev_access":     "ro",
 						"flag_from_dev":  "dummy",
 						"flag_from_prod": "dummy",
-					}
+					})
 					return nil
 				}),
 			},
@@ -329,75 +329,75 @@ func TestDatabaseObjectImportMatch(t *testing.T) {
 		},
 		{
 			name: "match table name",
-			match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 				TableNames: []string{"object1", "object2"},
-			},
-			spec: &dbobjectv1.DatabaseObjectSpec{
+			}.Build(),
+			spec: dbobjectv1.DatabaseObjectSpec_builder{
 				Database:            "db1",
 				DatabaseServiceName: "service1",
 				Protocol:            "postgres",
 				ObjectKind:          ObjectKindTable,
 				Name:                "object1",
 				Schema:              "schema1",
-			},
+			}.Build(),
 			wantMatch: true,
 		},
 		{
 			name: "glob",
-			match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 				TableNames: []string{"*"},
-			},
-			spec: &dbobjectv1.DatabaseObjectSpec{
+			}.Build(),
+			spec: dbobjectv1.DatabaseObjectSpec_builder{
 				Database:            "db1",
 				DatabaseServiceName: "service1",
 				Protocol:            "postgres",
 				ObjectKind:          ObjectKindTable,
 				Name:                "object1",
 				Schema:              "schema1",
-			},
+			}.Build(),
 			wantMatch: true,
 		},
 		{
 			name: "mismatch",
-			match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 				ViewNames: []string{"object1", "object2"},
-			},
-			spec: &dbobjectv1.DatabaseObjectSpec{
+			}.Build(),
+			spec: dbobjectv1.DatabaseObjectSpec_builder{
 				Database:            "db3",
 				DatabaseServiceName: "service3",
 				Protocol:            "postgres",
 				ObjectKind:          ObjectKindView,
 				Name:                "object3",
 				Schema:              "schema3",
-			},
+			}.Build(),
 			wantMatch: false,
 		},
 		{
 			name: "empty name matches no objects",
-			match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 				TableNames: []string{""},
-			},
-			spec: &dbobjectv1.DatabaseObjectSpec{
+			}.Build(),
+			spec: dbobjectv1.DatabaseObjectSpec_builder{
 				Database:            "db1",
 				DatabaseServiceName: "service1",
 				Protocol:            "postgres",
 				ObjectKind:          ObjectKindTable,
 				Name:                "object1",
 				Schema:              "schema1",
-			},
+			}.Build(),
 			wantMatch: false,
 		},
 		{
 			name:  "empty clause matches no objects",
 			match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{},
-			spec: &dbobjectv1.DatabaseObjectSpec{
+			spec: dbobjectv1.DatabaseObjectSpec_builder{
 				Database:            "db1",
 				DatabaseServiceName: "service1",
 				Protocol:            "postgres",
 				ObjectKind:          ObjectKindTable,
 				Name:                "object1",
 				Schema:              "schema1",
-			},
+			}.Build(),
 			wantMatch: false,
 		},
 	}
@@ -411,7 +411,7 @@ func TestDatabaseObjectImportMatch(t *testing.T) {
 }
 
 func Test_databaseObjectScopeMatch(t *testing.T) {
-	spec := &dbobjectv1.DatabaseObjectSpec{
+	spec := dbobjectv1.DatabaseObjectSpec_builder{
 		Database: "foo",
 		Schema:   "public",
 
@@ -419,7 +419,7 @@ func Test_databaseObjectScopeMatch(t *testing.T) {
 		Protocol:            "postgres",
 		ObjectKind:          ObjectKindTable,
 		Name:                "object1",
-	}
+	}.Build()
 
 	tests := []struct {
 		name  string
@@ -428,54 +428,54 @@ func Test_databaseObjectScopeMatch(t *testing.T) {
 	}{
 		{
 			name: "empty db name and schema",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				DatabaseNames: nil,
 				SchemaNames:   nil,
-			},
+			}.Build(),
 			want: true,
 		},
 		{
 			name: "just db name",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				DatabaseNames: []string{"foo", "bar", "baz"},
-			},
+			}.Build(),
 			want: true,
 		},
 		{
 			name: "db name glob match",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				DatabaseNames: []string{"f*o"},
-			},
+			}.Build(),
 			want: true,
 		},
 		{
 			name: "just schema",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				SchemaNames: []string{"public", "private"},
-			},
+			}.Build(),
 			want: true,
 		},
 		{
 			name: "schema name glob match",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				SchemaNames: []string{"pub*"},
-			},
+			}.Build(),
 			want: true,
 		},
 		{
 			name: "match db name and schema",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				DatabaseNames: []string{"foo", "bar", "baz"},
 				SchemaNames:   []string{"public", "private"},
-			},
+			}.Build(),
 			want: true,
 		},
 		{
 			name: "mismatch db name and schema",
-			scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+			scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 				DatabaseNames: []string{"dummy"},
 				SchemaNames:   []string{"dummy"},
-			},
+			}.Build(),
 			want: false,
 		},
 	}
@@ -487,14 +487,14 @@ func Test_databaseObjectScopeMatch(t *testing.T) {
 }
 
 func Test_applyMappingToObject(t *testing.T) {
-	spec := &dbobjectv1.DatabaseObjectSpec{
+	spec := dbobjectv1.DatabaseObjectSpec_builder{
 		Database:            "db3",
 		DatabaseServiceName: "service3",
 		Protocol:            "postgres",
 		ObjectKind:          ObjectKindTable,
 		Name:                "object3",
 		Schema:              "schema3",
-	}
+	}.Build()
 
 	tests := []struct {
 		name       string
@@ -506,10 +506,10 @@ func Test_applyMappingToObject(t *testing.T) {
 	}{
 		{
 			name: "simple templates",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label":           "rw",
 					"protocol":              "{{obj.protocol}}",
@@ -519,7 +519,7 @@ func Test_applyMappingToObject(t *testing.T) {
 					"schema":                "{{obj.schema}}",
 					"name":                  "{{obj.name}}",
 				},
-			},
+			}.Build(),
 			labels: map[string]string{},
 			wantLabels: map[string]string{
 				"plain_label":           "rw",
@@ -534,15 +534,15 @@ func Test_applyMappingToObject(t *testing.T) {
 		},
 		{
 			name: "add prefix",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label": "rw",
 					"tag":         "db-{{obj.object_kind}}",
 				},
-			},
+			}.Build(),
 			labels: map[string]string{},
 			wantLabels: map[string]string{
 				"plain_label": "rw",
@@ -552,15 +552,15 @@ func Test_applyMappingToObject(t *testing.T) {
 		},
 		{
 			name: "spaces are trimmed prefix",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label": "rw",
 					"tag":         "  db-{{   obj.object_kind }}-bar  ",
 				},
-			},
+			}.Build(),
 			labels: map[string]string{},
 			wantLabels: map[string]string{
 				"plain_label": "rw",
@@ -570,57 +570,57 @@ func Test_applyMappingToObject(t *testing.T) {
 		},
 		{
 			name: "invalid object is rejected",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label": "rw",
 					"tag":         "db-{{obj.invalid}}",
 				},
-			},
+			}.Build(),
 			labels:    map[string]string{},
 			wantError: true,
 		},
 		{
 			name: "invalid namespace is rejected",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label": "rw",
 					"tag":         "db-{{wrong.object_kind}}",
 				},
-			},
+			}.Build(),
 			labels:    map[string]string{},
 			wantError: true,
 		},
 		{
 			name: "empty template is rejected",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label": "rw",
 					"tag":         "db-{{}}",
 				},
-			},
+			}.Build(),
 			labels:    map[string]string{},
 			wantError: true,
 		},
 		{
 			name: "multi template is rejected",
-			mapping: &databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-				Match: &databaseobjectimportrulev1.DatabaseObjectImportMatch{
+			mapping: databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: databaseobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"plain_label": "rw",
 					"tag":         "db-{{obj.object_kind obj.object_kind}}",
 				},
-			},
+			}.Build(),
 			labels:    map[string]string{},
 			wantError: true,
 		},
@@ -719,43 +719,43 @@ func TestFilterRulesForDatabase(t *testing.T) {
 		{
 			name: "all matching",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRuleNoValidation("rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRuleNoValidation("rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
-				}),
-				mkImportRuleNoValidation("rule2", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build()),
+				mkImportRuleNoValidation("rule2", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       20,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
-				}),
+				}.Build()),
 			},
 			want: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRuleNoValidation("rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRuleNoValidation("rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
-				}),
-				mkImportRuleNoValidation("rule2", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build()),
+				mkImportRuleNoValidation("rule2", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       20,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
-				}),
+				}.Build()),
 			},
 		},
 		{
 			name: "one matching",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRuleNoValidation("rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRuleNoValidation("rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
-				}),
-				mkImportRuleNoValidation("rule2", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build()),
+				mkImportRuleNoValidation("rule2", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       20,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"dev"}}),
-				}),
+				}.Build()),
 			},
 			want: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRuleNoValidation("rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRuleNoValidation("rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Priority:       10,
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"prod"}}),
-				}),
+				}.Build()),
 			},
 		},
 		{
@@ -784,17 +784,17 @@ func TestCalculateDatabaseNameFilter(t *testing.T) {
 		{
 			name: "accept any database",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRule(t, "rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 								// empty list => match any database name.
 								DatabaseNames: []string{},
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			database: mkDatabase(t, "testdb", map[string]string{"env": "prod"}),
 			dbNames:  map[string]bool{"random-name-" + uuid.New().String(): true},
@@ -802,16 +802,16 @@ func TestCalculateDatabaseNameFilter(t *testing.T) {
 		{
 			name: "match specific database name",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRule(t, "rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 								DatabaseNames: []string{"testdb", "devdb"},
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			database: mkDatabase(t, "testdb", map[string]string{"env": "prod"}),
 			dbNames:  map[string]bool{"testdb": true, "devdb": true, "baddb": false},
@@ -819,16 +819,16 @@ func TestCalculateDatabaseNameFilter(t *testing.T) {
 		{
 			name: "no matching rules",
 			rules: []*databaseobjectimportrulev1.DatabaseObjectImportRule{
-				mkImportRule(t, "rule1", &databaseobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				mkImportRule(t, "rule1", databaseobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"env": {"dev"}}), // env:dev does not match env:prod below.
 					Mappings: []*databaseobjectimportrulev1.DatabaseObjectImportRuleMapping{
-						{
-							Scope: &databaseobjectimportrulev1.DatabaseObjectImportScope{
+						databaseobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+							Scope: databaseobjectimportrulev1.DatabaseObjectImportScope_builder{
 								DatabaseNames: []string{"devdb"},
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			database: mkDatabase(t, "testdb", map[string]string{"env": "prod"}),
 			dbNames:  map[string]bool{"testdb": false},
diff --git a/lib/srv/db/common/databaseobjectimportrule/create.go b/lib/srv/db/common/databaseobjectimportrule/create.go
index 74bad9773ef..56c7e390bd3 100644
--- a/lib/srv/db/common/databaseobjectimportrule/create.go
+++ b/lib/srv/db/common/databaseobjectimportrule/create.go
@@ -36,16 +36,16 @@ func NewDatabaseObjectImportRule(name string, spec *dbobjectimportrulev1.Databas
 
 // NewDatabaseObjectImportRuleWithLabels creates a new dbobjectimportrulev1.DatabaseObjectImportRule with specified labels.
 func NewDatabaseObjectImportRuleWithLabels(name string, labels map[string]string, spec *dbobjectimportrulev1.DatabaseObjectImportRuleSpec) (*dbobjectimportrulev1.DatabaseObjectImportRule, error) {
-	out := &dbobjectimportrulev1.DatabaseObjectImportRule{
+	out := dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 		Kind:    types.KindDatabaseObjectImportRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:      name,
 			Namespace: defaults.Namespace,
 			Labels:    labels,
-		},
+		}.Build(),
 		Spec: spec,
-	}
+	}.Build()
 
 	err := ValidateDatabaseObjectImportRule(out)
 	if err != nil {
@@ -59,26 +59,26 @@ func ValidateDatabaseObjectImportRule(rule *dbobjectimportrulev1.DatabaseObjectI
 	if rule == nil {
 		return trace.BadParameter("database object import rule must be non-nil")
 	}
-	if rule.Metadata == nil {
+	if !rule.HasMetadata() {
 		return trace.BadParameter("metadata: must be non-nil")
 	}
-	if rule.Metadata.Name == "" {
+	if rule.GetMetadata().GetName() == "" {
 		return trace.BadParameter("metadata.name: must be non-empty")
 	}
-	if rule.Kind != types.KindDatabaseObjectImportRule {
-		return trace.BadParameter("invalid kind %v, expected %v", rule.Kind, types.KindDatabaseObjectImportRule)
+	if rule.GetKind() != types.KindDatabaseObjectImportRule {
+		return trace.BadParameter("invalid kind %v, expected %v", rule.GetKind(), types.KindDatabaseObjectImportRule)
 	}
-	if rule.Spec == nil {
+	if !rule.HasSpec() {
 		return trace.BadParameter("missing spec")
 	}
-	if len(rule.Spec.DatabaseLabels) == 0 {
+	if len(rule.GetSpec().GetDatabaseLabels()) == 0 {
 		return trace.BadParameter("missing database_labels")
 	}
-	if len(rule.Spec.Mappings) == 0 {
+	if len(rule.GetSpec().GetMappings()) == 0 {
 		return trace.BadParameter("missing mappings")
 	}
-	for _, mapping := range rule.Spec.Mappings {
-		for key, template := range mapping.AddLabels {
+	for _, mapping := range rule.GetSpec().GetMappings() {
+		for key, template := range mapping.GetAddLabels() {
 			if strings.TrimSpace(key) == "" {
 				return trace.BadParameter("invalid mapping: label name is empty or whitespace")
 			}
diff --git a/lib/srv/db/common/databaseobjectimportrule/create_test.go b/lib/srv/db/common/databaseobjectimportrule/create_test.go
index 50ec8417936..ea8659d308d 100644
--- a/lib/srv/db/common/databaseobjectimportrule/create_test.go
+++ b/lib/srv/db/common/databaseobjectimportrule/create_test.go
@@ -39,10 +39,10 @@ func TestNewDatabaseObjectImportRule(t *testing.T) {
 	}{
 		{
 			name: "valid rule",
-			spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+			spec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 				DatabaseLabels: label.FromMap(map[string][]string{"key": {"value"}}),
 				Mappings:       []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{{}},
-			},
+			}.Build(),
 			expectedError: nil,
 		},
 		{
@@ -68,18 +68,18 @@ func TestValidateDatabaseObjectImportRule(t *testing.T) {
 	}{
 		{
 			name: "valid rule",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
-				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build(),
+				Spec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"key": {"value"}}),
 					Mappings:       []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{{}},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedError: nil,
 		},
 		{
@@ -89,117 +89,117 @@ func TestValidateDatabaseObjectImportRule(t *testing.T) {
 		},
 		{
 			name: "missing metadata",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:     types.KindDatabaseObjectImportRule,
 				Version:  types.V1,
 				Metadata: nil,
 				Spec:     &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{},
-			},
+			}.Build(),
 			expectedError: trace.BadParameter("metadata: must be non-nil"),
 		},
 		{
 			name: "missing name",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "",
 					Namespace: defaults.Namespace,
-				},
+				}.Build(),
 				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{},
-			},
+			}.Build(),
 			expectedError: trace.BadParameter("metadata.name: must be non-empty"),
 		},
 		{
 			name: "invalid kind",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    "InvalidKind",
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
+				}.Build(),
 				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{},
-			},
+			}.Build(),
 			expectedError: trace.BadParameter("invalid kind InvalidKind, expected db_object_import_rule"),
 		},
 		{
 			name: "missing spec",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
+				}.Build(),
 				Spec: nil,
-			},
+			}.Build(),
 			expectedError: trace.BadParameter("missing spec"),
 		},
 		{
 			name: "missing database_labels",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
-				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build(),
+				Spec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{{}},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedError: trace.BadParameter("missing database_labels"),
 		},
 		{
 			name: "missing mappings",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
-				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build(),
+				Spec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"key": {"value"}}),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedError: trace.BadParameter("missing mappings"),
 		},
 		{
 			name: "invalid mapping key",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
-				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build(),
+				Spec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"key": {"value"}}),
-					Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{{
+					Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{dbobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
 						AddLabels: map[string]string{"    ": "dummy"},
-					}},
-				},
-			},
+					}.Build()},
+				}.Build(),
+			}.Build(),
 			expectedError: trace.BadParameter("invalid mapping: label name is empty or whitespace"),
 		},
 		{
 			name: "invalid template in mapping",
-			rule: &dbobjectimportrulev1.DatabaseObjectImportRule{
+			rule: dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 				Kind:    types.KindDatabaseObjectImportRule,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:      "test",
 					Namespace: defaults.Namespace,
-				},
-				Spec: &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+				}.Build(),
+				Spec: dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 					DatabaseLabels: label.FromMap(map[string][]string{"key": {"value"}}),
-					Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{{
+					Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{dbobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
 						AddLabels: map[string]string{"dummy": "  {{  "},
-					}},
-				},
-			},
+					}.Build()},
+				}.Build(),
+			}.Build(),
 			expectedError: trace.Wrap(trace.BadParameter("\"  {{  \" is using template brackets '{{' or '}}', however expression does not parse, make sure the format is {{expression}}"), "mapping value failed to parse as template"),
 		},
 	}
diff --git a/lib/srv/db/common/databaseobjectimportrule/preset.go b/lib/srv/db/common/databaseobjectimportrule/preset.go
index dce199a2c9a..04db98c4542 100644
--- a/lib/srv/db/common/databaseobjectimportrule/preset.go
+++ b/lib/srv/db/common/databaseobjectimportrule/preset.go
@@ -27,16 +27,16 @@ import (
 // NewPresetImportAllObjectsRule creates new "import_all_objects" database object import rule, which applies `kind: <object kind>` label to all database objects.
 // This is a convenience rule and users are free to modify it to suit their needs.
 func NewPresetImportAllObjectsRule() *dbobjectimportrulev1pb.DatabaseObjectImportRule {
-	rule, err := NewDatabaseObjectImportRule("import_all_objects", &dbobjectimportrulev1pb.DatabaseObjectImportRuleSpec{
+	rule, err := NewDatabaseObjectImportRule("import_all_objects", dbobjectimportrulev1pb.DatabaseObjectImportRuleSpec_builder{
 		Priority:       0,
 		DatabaseLabels: label.FromMap(map[string][]string{"*": {"*"}}),
 		Mappings: []*dbobjectimportrulev1pb.DatabaseObjectImportRuleMapping{
-			{
-				Match: &dbobjectimportrulev1pb.DatabaseObjectImportMatch{
+			dbobjectimportrulev1pb.DatabaseObjectImportRuleMapping_builder{
+				Match: dbobjectimportrulev1pb.DatabaseObjectImportMatch_builder{
 					TableNames:     []string{"*"},
 					ViewNames:      []string{"*"},
 					ProcedureNames: []string{"*"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"protocol":              "{{obj.protocol}}",
 					"database_service_name": "{{obj.database_service_name}}",
@@ -45,9 +45,9 @@ func NewPresetImportAllObjectsRule() *dbobjectimportrulev1pb.DatabaseObjectImpor
 					"schema":                "{{obj.schema}}",
 					"name":                  "{{obj.name}}",
 				},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 
 	if err != nil {
 		slog.WarnContext(context.Background(), "failed to create import_all_objects database object import rule", "error", err)
diff --git a/lib/srv/db/common/permissions/calculation.go b/lib/srv/db/common/permissions/calculation.go
index 89fcbfaacd5..2fda97f323a 100644
--- a/lib/srv/db/common/permissions/calculation.go
+++ b/lib/srv/db/common/permissions/calculation.go
@@ -40,7 +40,7 @@ type GetDatabasePermissions interface {
 }
 
 func databasePermissionMatch(perm types.DatabasePermission, obj *dbobjectv1.DatabaseObject) bool {
-	ok, _, _ := services.MatchLabels(perm.Match, obj.Metadata.Labels)
+	ok, _, _ := services.MatchLabels(perm.Match, obj.GetMetadata().GetLabels())
 	return ok
 }
 
@@ -49,7 +49,7 @@ func CountObjectKinds(objs []*dbobjectv1.DatabaseObject) (string, map[string]int
 	var fragments []string
 
 	counts := utils.CountBy(objs, func(obj *dbobjectv1.DatabaseObject) string {
-		return obj.GetSpec().ObjectKind
+		return obj.GetSpec().GetObjectKind()
 	})
 	kinds := slices.Sorted(maps.Keys(counts))
 	for _, kind := range kinds {
diff --git a/lib/srv/db/common/permissions/calculation_test.go b/lib/srv/db/common/permissions/calculation_test.go
index 4ebe505fcce..fc6c226eedb 100644
--- a/lib/srv/db/common/permissions/calculation_test.go
+++ b/lib/srv/db/common/permissions/calculation_test.go
@@ -41,14 +41,14 @@ func (m mockGetter) GetDatabasePermissions(_ types.Database) (allow types.Databa
 
 func TestCalculatePermissions(t *testing.T) {
 	mkDatabaseObject := func(name string, labels map[string]string) *dbobjectv1.DatabaseObject {
-		out, err := databaseobject.NewDatabaseObjectWithLabels(name, maps.Clone(labels), &dbobjectv1.DatabaseObjectSpec{
+		out, err := databaseobject.NewDatabaseObjectWithLabels(name, maps.Clone(labels), dbobjectv1.DatabaseObjectSpec_builder{
 			Protocol:            types.DatabaseProtocolPostgreSQL,
 			DatabaseServiceName: "dummy",
 			ObjectKind:          databaseobjectimportrule.ObjectKindTable,
 			Database:            "dummy",
 			Schema:              "public",
 			Name:                name,
-		})
+		}.Build())
 
 		require.NoError(t, err)
 		return out
@@ -174,14 +174,14 @@ func TestCalculatePermissions(t *testing.T) {
 
 func TestDatabasePermissionMatch(t *testing.T) {
 	mkDatabaseObject := func(labels map[string]string) *dbobjectv1.DatabaseObject {
-		out, err := databaseobject.NewDatabaseObjectWithLabels("foo", maps.Clone(labels), &dbobjectv1.DatabaseObjectSpec{
+		out, err := databaseobject.NewDatabaseObjectWithLabels("foo", maps.Clone(labels), dbobjectv1.DatabaseObjectSpec_builder{
 			Protocol:            types.DatabaseProtocolPostgreSQL,
 			DatabaseServiceName: "dummy",
 			ObjectKind:          databaseobjectimportrule.ObjectKindTable,
 			Database:            "dummy",
 			Schema:              "public",
 			Name:                "foo",
-		})
+		}.Build())
 
 		require.NoError(t, err)
 		return out
diff --git a/lib/srv/db/objects/importer.go b/lib/srv/db/objects/importer.go
index 818c8f5b386..d377be156e4 100644
--- a/lib/srv/db/objects/importer.go
+++ b/lib/srv/db/objects/importer.go
@@ -110,7 +110,7 @@ func (i *singleDatabaseImporter) scan(ctx context.Context) {
 	}
 
 	objectsNewMap := utils.FromSlice(objectsNew, func(object *dbobjectv1.DatabaseObject) string {
-		return object.GetMetadata().Name
+		return object.GetMetadata().GetName()
 	})
 
 	i.deleteObjects(ctx, calculateDeleted(ctx, i.cfg, i.objects, objectsNewMap))
@@ -199,7 +199,7 @@ func (i *singleDatabaseImporter) updateObjects(ctx context.Context, updated map[
 	for key, objNew := range updated {
 		i.objects[key] = objNew
 		clone := proto.Clone(objNew.obj).(*dbobjectv1.DatabaseObject)
-		clone.Metadata.Expires = timestamppb.New(objNew.expiry)
+		clone.GetMetadata().SetExpires(timestamppb.New(objNew.expiry))
 		_, err := i.cfg.DatabaseObjectClient.UpsertDatabaseObject(ctx, clone)
 		if err != nil {
 			errs = append(errs, err)
diff --git a/lib/srv/db/objects/importer_test.go b/lib/srv/db/objects/importer_test.go
index e0f4bed06c1..2b94b5f5d63 100644
--- a/lib/srv/db/objects/importer_test.go
+++ b/lib/srv/db/objects/importer_test.go
@@ -87,14 +87,14 @@ func TestCalculateUpdates(t *testing.T) {
 	clock := clockwork.NewFakeClock()
 
 	mkObjectLabel := func(name string, label string) *dbobjectv1.DatabaseObject {
-		out, err := databaseobject.NewDatabaseObjectWithLabels(name, map[string]string{"custom": label}, &dbobjectv1.DatabaseObjectSpec{
+		out, err := databaseobject.NewDatabaseObjectWithLabels(name, map[string]string{"custom": label}, dbobjectv1.DatabaseObjectSpec_builder{
 			Protocol:            types.DatabaseProtocolPostgreSQL,
 			DatabaseServiceName: "dummy",
 			ObjectKind:          databaseobjectimportrule.ObjectKindTable,
 			Database:            "dummy",
 			Schema:              "public",
 			Name:                name,
-		})
+		}.Build())
 
 		require.NoError(t, err)
 		return out
@@ -172,15 +172,15 @@ func TestCalculateUpdates(t *testing.T) {
 			}
 
 			freshObjects := utils.FromSlice(tt.objsNew, func(object *dbobjectv1.DatabaseObject) string {
-				return object.GetMetadata().Name
+				return object.GetMetadata().GetName()
 			})
 
 			initialState := utils.FromSlice(tt.objects, func(object *objWithExpiry) string {
-				return object.obj.GetMetadata().Name
+				return object.obj.GetMetadata().GetName()
 			})
 
 			expectedState := utils.FromSlice(tt.expected, func(object *objWithExpiry) string {
-				return object.obj.GetMetadata().Name
+				return object.obj.GetMetadata().GetName()
 			})
 
 			result := calculateUpdates(context.Background(), cfg, initialState, freshObjects)
diff --git a/lib/srv/db/postgres/schema.go b/lib/srv/db/postgres/schema.go
index b65cee7860d..f0da82dc9ad 100644
--- a/lib/srv/db/postgres/schema.go
+++ b/lib/srv/db/postgres/schema.go
@@ -62,14 +62,14 @@ func fetchDatabaseObjects(ctx context.Context, database types.Database, database
 				table,
 			}, "::")
 
-			obj, err := databaseobject.NewDatabaseObject(name, &dbobjectv1.DatabaseObjectSpec{
+			obj, err := databaseobject.NewDatabaseObject(name, dbobjectv1.DatabaseObjectSpec_builder{
 				ObjectKind:          databaseobjectimportrule.ObjectKindTable,
 				DatabaseServiceName: database.GetName(),
 				Protocol:            database.GetProtocol(),
 				Database:            databaseName,
 				Schema:              schemaName,
 				Name:                table,
-			})
+			}.Build())
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
diff --git a/lib/srv/db/postgres/users.go b/lib/srv/db/postgres/users.go
index d530cbc67bc..a0dec41d8a0 100644
--- a/lib/srv/db/postgres/users.go
+++ b/lib/srv/db/postgres/users.go
@@ -154,15 +154,15 @@ func convertPermissions(perms permissions.PermissionSet) (*Permissions, error) {
 	var errors []error
 	for permission, objects := range perms {
 		for _, obj := range objects {
-			if err := checkPgPermission(obj.GetSpec().ObjectKind, permission); err != nil {
+			if err := checkPgPermission(obj.GetSpec().GetObjectKind(), permission); err != nil {
 				errors = append(errors, err)
 				continue
 			}
-			if obj.GetSpec().ObjectKind == databaseobjectimportrule.ObjectKindTable {
+			if obj.GetSpec().GetObjectKind() == databaseobjectimportrule.ObjectKindTable {
 				out.Tables = append(out.Tables, TablePermission{
 					Privilege: permission,
-					Schema:    obj.GetSpec().Schema,
-					Table:     obj.GetSpec().Name,
+					Schema:    obj.GetSpec().GetSchema(),
+					Table:     obj.GetSpec().GetName(),
 				})
 			}
 		}
diff --git a/lib/srv/db/postgres/users_test.go b/lib/srv/db/postgres/users_test.go
index 59c3b24beab..547c25a7be4 100644
--- a/lib/srv/db/postgres/users_test.go
+++ b/lib/srv/db/postgres/users_test.go
@@ -149,12 +149,12 @@ func TestCheckPgPermission(t *testing.T) {
 
 func TestConvertPermissions(t *testing.T) {
 	mkObject := func(name, schema, kind string) *dbobjectv1.DatabaseObject {
-		obj, err := databaseobject.NewDatabaseObject(name, &dbobjectv1.DatabaseObjectSpec{
+		obj, err := databaseobject.NewDatabaseObject(name, dbobjectv1.DatabaseObjectSpec_builder{
 			ObjectKind: kind,
 			Schema:     schema,
 			Name:       name,
 			Protocol:   "postgres",
-		})
+		}.Build())
 		require.NoError(t, err)
 		return obj
 	}
diff --git a/lib/srv/db/server.go b/lib/srv/db/server.go
index 80410bcb069..581adbcd03b 100644
--- a/lib/srv/db/server.go
+++ b/lib/srv/db/server.go
@@ -843,10 +843,10 @@ func (s *Server) sendUpstreamInventoryStopHeartbeat(ctx context.Context, name st
 		// get latest sender
 		case sender := <-s.cfg.InventoryHandle.Sender():
 			if sender.Hello().GetCapabilities().GetDatabaseHeartbeatGracefulStop() {
-				err := sender.Send(ctx, &proto.UpstreamInventoryStopHeartbeat{
+				err := sender.Send(ctx, proto.UpstreamInventoryStopHeartbeat_builder{
 					Kind: proto.StopHeartbeatKind_STOP_HEARTBEAT_KIND_DATABASE_SERVER,
 					Name: name,
-				})
+				}.Build())
 				return trace.Wrap(err)
 			}
 			return trace.BadParameter("upstream inventory controller does not support database heartbeat graceful stop")
@@ -1060,8 +1060,8 @@ func (s *Server) close(ctx context.Context) error {
 		// Manual deletion per database is only required if the auth server
 		// doesn't support actively cleaning up database resources when the
 		// inventory control stream is terminated during shutdown.
-		if capabilities := sender.Hello().Capabilities; capabilities != nil {
-			shouldDeleteDBs = shouldDeleteDBs && !capabilities.DatabaseCleanup
+		if capabilities := sender.Hello().GetCapabilities(); capabilities != nil {
+			shouldDeleteDBs = shouldDeleteDBs && !capabilities.GetDatabaseCleanup()
 		}
 	}
 	g, gctx := errgroup.WithContext(ctx)
diff --git a/lib/srv/db/server_test.go b/lib/srv/db/server_test.go
index 6fb0327e169..91c2004822d 100644
--- a/lib/srv/db/server_test.go
+++ b/lib/srv/db/server_test.go
@@ -763,18 +763,18 @@ func TestHealthCheck(t *testing.T) {
 func newHealthCheckConfig(t *testing.T, name string) *healthcheckconfigv1.HealthCheckConfig {
 	t.Helper()
 	out, err := healthcheckconfig.NewHealthCheckConfig(name,
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
-				DbLabels: []*labelv1.Label{{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
+				DbLabels: []*labelv1.Label{labelv1.Label_builder{
 					Name:   types.Wildcard,
 					Values: []string{types.Wildcard},
-				}},
-			},
+				}.Build()},
+			}.Build(),
 			Interval:           durationpb.New(apidefaults.HealthCheckInterval),
 			Timeout:            durationpb.New(apidefaults.HealthCheckTimeout),
 			HealthyThreshold:   1,
 			UnhealthyThreshold: 1,
-		},
+		}.Build(),
 	)
 	require.NoError(t, err)
 	return out
diff --git a/lib/srv/desktop/audit.go b/lib/srv/desktop/audit.go
index b6e0d0da14b..76bd2d40c6b 100644
--- a/lib/srv/desktop/audit.go
+++ b/lib/srv/desktop/audit.go
@@ -275,8 +275,8 @@ func (d *desktopSessionAuditor) makeSharedDirectoryStart(m *tdpb.SharedDirectory
 // an error.
 func (d *desktopSessionAuditor) onSharedDirectoryReadRequest(completion completionID, directory directoryID, m *tdpbv1.SharedDirectoryRequest_Read) *events.DesktopSharedDirectoryRead {
 	did := directory
-	path := m.Path
-	offset := m.Offset
+	path := m.GetPath()
+	offset := m.GetOffset()
 
 	err := d.auditCache.SetReadRequestInfo(completion, readRequestInfo{
 		directoryID: did,
@@ -312,7 +312,7 @@ func (d *desktopSessionAuditor) onSharedDirectoryReadRequest(completion completi
 		DirectoryName: string(name),
 		DirectoryID:   uint32(did),
 		Path:          path,
-		Length:        m.Length,
+		Length:        m.GetLength(),
 		Offset:        offset,
 		DesktopName:   d.desktop.GetName(),
 	}
@@ -365,7 +365,7 @@ func (d *desktopSessionAuditor) makeSharedDirectoryReadResponse(completion compl
 		DirectoryName:      string(name),
 		DirectoryID:        uint32(did),
 		Path:               path,
-		Length:             uint32(len(m.Data)),
+		Length:             uint32(len(m.GetData())),
 		Offset:             offset,
 		DesktopName:        d.desktop.GetName(),
 	}
@@ -377,8 +377,8 @@ func (d *desktopSessionAuditor) makeSharedDirectoryReadResponse(completion compl
 // an error.
 func (d *desktopSessionAuditor) onSharedDirectoryWriteRequest(completion completionID, directory directoryID, m *tdpbv1.SharedDirectoryRequest_Write) *events.DesktopSharedDirectoryWrite {
 	did := directory
-	path := m.Path
-	offset := m.Offset
+	path := m.GetPath()
+	offset := m.GetOffset()
 
 	err := d.auditCache.SetWriteRequestInfo(
 		completion,
@@ -417,7 +417,7 @@ func (d *desktopSessionAuditor) onSharedDirectoryWriteRequest(completion complet
 		DirectoryName: string(name),
 		DirectoryID:   uint32(did),
 		Path:          path,
-		Length:        uint32(len(m.Data)),
+		Length:        uint32(len(m.GetData())),
 		Offset:        offset,
 	}
 }
@@ -468,7 +468,7 @@ func (d *desktopSessionAuditor) makeSharedDirectoryWriteResponse(completion comp
 		DirectoryName:      string(name),
 		DirectoryID:        uint32(did),
 		Path:               path,
-		Length:             m.BytesWritten,
+		Length:             m.GetBytesWritten(),
 		Offset:             offset,
 		DesktopName:        d.desktop.GetName(),
 	}
diff --git a/lib/srv/desktop/audit_test.go b/lib/srv/desktop/audit_test.go
index 804a32eb83f..20a44f864f0 100644
--- a/lib/srv/desktop/audit_test.go
+++ b/lib/srv/desktop/audit_test.go
@@ -420,17 +420,17 @@ func TestDesktopSharedDirectoryReadEvent(t *testing.T) {
 
 			if test.sendsReq {
 				// SharedDirectoryReadRequest initializes the readRequestCache.
-				audit.onSharedDirectoryReadRequest(testCompletionID, testDirectoryID, &tdpbv1.SharedDirectoryRequest_Read{
+				audit.onSharedDirectoryReadRequest(testCompletionID, testDirectoryID, tdpbv1.SharedDirectoryRequest_Read_builder{
 					Path:   testFilePath,
 					Offset: testOffset,
 					Length: testLength,
-				})
+				}.Build())
 			}
 
 			// SharedDirectoryReadResponse causes the event to be emitted.
-			readEvent := audit.makeSharedDirectoryReadResponse(testCompletionID, test.errCode, &tdpbv1.SharedDirectoryResponse_Read{
+			readEvent := audit.makeSharedDirectoryReadResponse(testCompletionID, test.errCode, tdpbv1.SharedDirectoryResponse_Read_builder{
 				Data: make([]byte, testLength), // slice contents are irrelevant in this context
-			})
+			}.Build())
 
 			baseEvent := &events.DesktopSharedDirectoryRead{
 				Metadata: events.Metadata{
@@ -565,17 +565,17 @@ func TestDesktopSharedDirectoryWriteEvent(t *testing.T) {
 
 			if test.sendsReq {
 				// SharedDirectoryWriteRequest initializes the writeRequestCache.
-				audit.onSharedDirectoryWriteRequest(testCompletionID, testDirectoryID, &tdpbv1.SharedDirectoryRequest_Write{
+				audit.onSharedDirectoryWriteRequest(testCompletionID, testDirectoryID, tdpbv1.SharedDirectoryRequest_Write_builder{
 					Path:   testFilePath,
 					Offset: testOffset,
 					Data:   make([]byte, testLength),
-				})
+				}.Build())
 			}
 
 			// SharedDirectoryWriteResponse causes the event to be emitted.
-			writeEvent := audit.makeSharedDirectoryWriteResponse(testCompletionID, test.errCode, &tdpbv1.SharedDirectoryResponse_Write{
+			writeEvent := audit.makeSharedDirectoryWriteResponse(testCompletionID, test.errCode, tdpbv1.SharedDirectoryResponse_Write_builder{
 				BytesWritten: testLength,
-			})
+			}.Build())
 
 			baseEvent := &events.DesktopSharedDirectoryWrite{
 				Metadata: events.Metadata{
@@ -686,11 +686,11 @@ func TestDesktopSharedDirectoryReadEventAuditCacheMax(t *testing.T) {
 	fillReadRequestCache(&audit.auditCache, testDirectoryID)
 
 	// SharedDirectoryReadRequest should cause a failed audit event.
-	readEvent := audit.onSharedDirectoryReadRequest(testCompletionID, testDirectoryID, &tdpbv1.SharedDirectoryRequest_Read{
+	readEvent := audit.onSharedDirectoryReadRequest(testCompletionID, testDirectoryID, tdpbv1.SharedDirectoryRequest_Read_builder{
 		Path:   testFilePath,
 		Offset: testOffset,
 		Length: testLength,
-	})
+	}.Build())
 	require.NotNil(t, readEvent)
 
 	expected := &events.DesktopSharedDirectoryRead{
@@ -740,11 +740,11 @@ func TestDesktopSharedDirectoryWriteEventAuditCacheMax(t *testing.T) {
 
 	fillReadRequestCache(&audit.auditCache, testDirectoryID)
 
-	writeEvent := audit.onSharedDirectoryWriteRequest(testCompletionID, testDirectoryID, &tdpbv1.SharedDirectoryRequest_Write{
+	writeEvent := audit.onSharedDirectoryWriteRequest(testCompletionID, testDirectoryID, tdpbv1.SharedDirectoryRequest_Write_builder{
 		Path:   testFilePath,
 		Offset: testOffset,
 		Data:   make([]byte, testLength),
-	})
+	}.Build())
 	require.NotNil(t, writeEvent, "audit event should have been generated")
 
 	expected := &events.DesktopSharedDirectoryWrite{
@@ -803,19 +803,19 @@ func TestAuditCacheLifecycle(t *testing.T) {
 	require.False(t, ok)
 
 	// A SharedDirectoryReadRequest should add a corresponding entry in the readRequestCache.
-	audit.onSharedDirectoryReadRequest(testCompletionID, testDirectoryID, &tdpbv1.SharedDirectoryRequest_Read{
+	audit.onSharedDirectoryReadRequest(testCompletionID, testDirectoryID, tdpbv1.SharedDirectoryRequest_Read_builder{
 		Path:   testFilePath,
 		Offset: testOffset,
 		Length: testLength,
-	})
+	}.Build())
 	require.Equal(t, 2, audit.auditCache.totalItems())
 
 	// A SharedDirectoryWriteRequest should add a corresponding entry in the writeRequestCache.
-	audit.onSharedDirectoryWriteRequest(testCompletionID, testDirectoryID, &tdpbv1.SharedDirectoryRequest_Write{
+	audit.onSharedDirectoryWriteRequest(testCompletionID, testDirectoryID, tdpbv1.SharedDirectoryRequest_Write_builder{
 		Path:   testFilePath,
 		Offset: testOffset,
 		Data:   make([]byte, testLength),
-	})
+	}.Build())
 	require.Equal(t, 3, audit.auditCache.totalItems())
 
 	// Check that the readRequestCache was properly filled out.
@@ -825,15 +825,15 @@ func TestAuditCacheLifecycle(t *testing.T) {
 	require.Contains(t, audit.auditCache.writeRequestCache, testCompletionID)
 
 	// SharedDirectoryReadResponse should cause the entry in the readRequestCache to be cleaned up.
-	audit.makeSharedDirectoryReadResponse(testCompletionID, legacy.ErrCodeNil, &tdpbv1.SharedDirectoryResponse_Read{
+	audit.makeSharedDirectoryReadResponse(testCompletionID, legacy.ErrCodeNil, tdpbv1.SharedDirectoryResponse_Read_builder{
 		Data: make([]byte, testLength), // slice contents are irrelevant in this context
-	})
+	}.Build())
 	require.Equal(t, 2, audit.auditCache.totalItems())
 
 	// SharedDirectoryWriteResponse should cause the entry in the writeRequestCache to be cleaned up.
-	audit.makeSharedDirectoryWriteResponse(testCompletionID, legacy.ErrCodeNil, &tdpbv1.SharedDirectoryResponse_Write{
+	audit.makeSharedDirectoryWriteResponse(testCompletionID, legacy.ErrCodeNil, tdpbv1.SharedDirectoryResponse_Write_builder{
 		BytesWritten: testLength,
-	})
+	}.Build())
 	require.Equal(t, 1, audit.auditCache.totalItems())
 
 	// Check that the readRequestCache was properly cleaned up.
diff --git a/lib/srv/desktop/rdpstate/rdpstate.go b/lib/srv/desktop/rdpstate/rdpstate.go
index 6008df065d8..c53ccb2e206 100644
--- a/lib/srv/desktop/rdpstate/rdpstate.go
+++ b/lib/srv/desktop/rdpstate/rdpstate.go
@@ -178,14 +178,14 @@ func (s *RDPState) processTDPMessage(data []byte) error {
 			return trace.Wrap(err, "decoding legacy ConnectionActivated")
 		}
 
-		return s.handleServerHello(&tdpbv1.ServerHello{
-			ActivationSpec: &tdpbv1.ConnectionActivated{
+		return s.handleServerHello(tdpbv1.ServerHello_builder{
+			ActivationSpec: tdpbv1.ConnectionActivated_builder{
 				IoChannelId:   uint32(ca.IOChannelID),
 				UserChannelId: uint32(ca.UserChannelID),
 				ScreenWidth:   uint32(ca.ScreenWidth),
 				ScreenHeight:  uint32(ca.ScreenHeight),
-			},
-		})
+			}.Build(),
+		}.Build())
 
 	case legacyTypeRDPFastPathPDU:
 		var dataLen uint32
@@ -202,7 +202,7 @@ func (s *RDPState) processTDPMessage(data []byte) error {
 			return trace.Wrap(err, "reading legacy RDPFastPathPDU data")
 		}
 
-		return s.handleFastPathPDU(&tdpbv1.FastPathPDU{Pdu: pdu})
+		return s.handleFastPathPDU(tdpbv1.FastPathPDU_builder{Pdu: pdu}.Build())
 
 	case legacyTypeMouseMove:
 		var mm struct{ X, Y uint32 }
@@ -210,7 +210,7 @@ func (s *RDPState) processTDPMessage(data []byte) error {
 			return trace.Wrap(err, "reading legacy MouseMove")
 		}
 
-		return s.handleMouseMove(&tdpbv1.MouseMove{X: mm.X, Y: mm.Y})
+		return s.handleMouseMove(tdpbv1.MouseMove_builder{X: mm.X, Y: mm.Y}.Build())
 	}
 
 	return nil
@@ -239,13 +239,13 @@ func (s *RDPState) processTDPBMessage(data []byte) error {
 		return trace.Wrap(err, "unmarshalling TDPB envelope")
 	}
 
-	switch m := env.Payload.(type) {
-	case *tdpbv1.Envelope_ServerHello:
-		return s.handleServerHello(m.ServerHello)
-	case *tdpbv1.Envelope_FastPathPdu:
-		return s.handleFastPathPDU(m.FastPathPdu)
-	case *tdpbv1.Envelope_MouseMove:
-		return s.handleMouseMove(m.MouseMove)
+	switch env.WhichPayload() {
+	case tdpbv1.Envelope_ServerHello_case:
+		return s.handleServerHello(env.GetServerHello())
+	case tdpbv1.Envelope_FastPathPdu_case:
+		return s.handleFastPathPDU(env.GetFastPathPdu())
+	case tdpbv1.Envelope_MouseMove_case:
+		return s.handleMouseMove(env.GetMouseMove())
 	}
 
 	return nil
@@ -312,12 +312,12 @@ func (s *RDPState) handleFastPathPDU(msg *tdpbv1.FastPathPDU) error {
 }
 
 func (s *RDPState) handleMouseMove(msg *tdpbv1.MouseMove) error {
-	if msg.X > math.MaxUint16 || msg.Y > math.MaxUint16 {
-		return trace.BadParameter("mouse coordinates out of range: (%d, %d)", msg.X, msg.Y)
+	if msg.GetX() > math.MaxUint16 || msg.GetY() > math.MaxUint16 {
+		return trace.BadParameter("mouse coordinates out of range: (%d, %d)", msg.GetX(), msg.GetY())
 	}
 
-	s.mouseX = uint16(msg.X)
-	s.mouseY = uint16(msg.Y)
+	s.mouseX = uint16(msg.GetX())
+	s.mouseY = uint16(msg.GetY())
 	s.hasMouse = true
 
 	return nil
diff --git a/lib/srv/desktop/rdpstate/rdpstate_test.go b/lib/srv/desktop/rdpstate/rdpstate_test.go
index f87d5f09e31..f66f43df451 100644
--- a/lib/srv/desktop/rdpstate/rdpstate_test.go
+++ b/lib/srv/desktop/rdpstate/rdpstate_test.go
@@ -161,9 +161,9 @@ func TestUnknownMessage_Ignored(t *testing.T) {
 	s := New()
 
 	// Encode a SyncKeys message (not handled by RDPState) as a TDPB envelope.
-	body, err := proto.Marshal(&tdpbv1.Envelope{
-		Payload: &tdpbv1.Envelope_SyncKeys{SyncKeys: &tdpbv1.SyncKeys{}},
-	})
+	body, err := proto.Marshal(tdpbv1.Envelope_builder{
+		SyncKeys: &tdpbv1.SyncKeys{},
+	}.Build())
 	require.NoError(t, err)
 	data := make([]byte, 4+len(body))
 	binary.BigEndian.PutUint32(data[:4], uint32(len(body)))
diff --git a/lib/srv/desktop/rdpstate/rdpstatetest/events.go b/lib/srv/desktop/rdpstate/rdpstatetest/events.go
index 6fc4a7f2f5c..5ef7283ca18 100644
--- a/lib/srv/desktop/rdpstate/rdpstatetest/events.go
+++ b/lib/srv/desktop/rdpstate/rdpstatetest/events.go
@@ -41,10 +41,10 @@ func LegacyEvent(data []byte) *apievents.DesktopRecording {
 // dimensions.
 func EncodeTDPBServerHello(width, height uint32) (*apievents.DesktopRecording, error) {
 	data, err := (&tdpb.ServerHello{
-		ActivationSpec: &tdpbv1.ConnectionActivated{
+		ActivationSpec: tdpbv1.ConnectionActivated_builder{
 			ScreenWidth:  width,
 			ScreenHeight: height,
-		},
+		}.Build(),
 	}).Encode()
 	if err != nil {
 		return nil, err
@@ -89,12 +89,12 @@ func LegacyMouseMove(x, y uint32) (*apievents.DesktopRecording, error) {
 // given screen dimensions and channel IDs.
 func EncodeTDPBServerHelloWithChannels(width, height, ioChannelID, userChannelID uint32) (*apievents.DesktopRecording, error) {
 	data, err := (&tdpb.ServerHello{
-		ActivationSpec: &tdpbv1.ConnectionActivated{
+		ActivationSpec: tdpbv1.ConnectionActivated_builder{
 			ScreenWidth:   width,
 			ScreenHeight:  height,
 			IoChannelId:   ioChannelID,
 			UserChannelId: userChannelID,
-		},
+		}.Build(),
 	}).Encode()
 	if err != nil {
 		return nil, err
diff --git a/lib/srv/desktop/tdp/protocol/tdpb/tdpb.go b/lib/srv/desktop/tdp/protocol/tdpb/tdpb.go
index 170583c1a03..48ab03e88b8 100644
--- a/lib/srv/desktop/tdp/protocol/tdpb/tdpb.go
+++ b/lib/srv/desktop/tdp/protocol/tdpb/tdpb.go
@@ -544,49 +544,49 @@ type validatableMessage interface {
 // All top-level messages inside the envelope must implement
 // a 'validate' method.
 func messageFromEnvelope(e *tdpbv1.Envelope) validatableMessage {
-	switch m := e.Payload.(type) {
-	case *tdpbv1.Envelope_ClientHello:
-		return (*ClientHello)(m.ClientHello)
-	case *tdpbv1.Envelope_ServerHello:
-		return (*ServerHello)(m.ServerHello)
-	case *tdpbv1.Envelope_PngFrame:
-		return (*PNGFrame)(m.PngFrame)
-	case *tdpbv1.Envelope_FastPathPdu:
-		return (*FastPathPDU)(m.FastPathPdu)
-	case *tdpbv1.Envelope_RdpResponsePdu:
-		return (*RDPResponsePDU)(m.RdpResponsePdu)
-	case *tdpbv1.Envelope_SyncKeys:
-		return (*SyncKeys)(m.SyncKeys)
-	case *tdpbv1.Envelope_MouseMove:
-		return (*MouseMove)(m.MouseMove)
-	case *tdpbv1.Envelope_MouseButton:
-		return (*MouseButton)(m.MouseButton)
-	case *tdpbv1.Envelope_KeyboardButton:
-		return (*KeyboardButton)(m.KeyboardButton)
-	case *tdpbv1.Envelope_ClientScreenSpec:
-		return (*ClientScreenSpec)(m.ClientScreenSpec)
-	case *tdpbv1.Envelope_Alert:
-		return (*Alert)(m.Alert)
-	case *tdpbv1.Envelope_MouseWheel:
-		return (*MouseWheel)(m.MouseWheel)
-	case *tdpbv1.Envelope_ClipboardData:
-		return (*ClipboardData)(m.ClipboardData)
-	case *tdpbv1.Envelope_Mfa:
-		return (*MFA)(m.Mfa)
-	case *tdpbv1.Envelope_SharedDirectoryAnnounce:
-		return (*SharedDirectoryAnnounce)(m.SharedDirectoryAnnounce)
-	case *tdpbv1.Envelope_SharedDirectoryAcknowledge:
-		return (*SharedDirectoryAcknowledge)(m.SharedDirectoryAcknowledge)
-	case *tdpbv1.Envelope_SharedDirectoryRequest:
-		return (*SharedDirectoryRequest)(m.SharedDirectoryRequest)
-	case *tdpbv1.Envelope_SharedDirectoryResponse:
-		return (*SharedDirectoryResponse)(m.SharedDirectoryResponse)
-	case *tdpbv1.Envelope_LatencyStats:
-		return (*LatencyStats)(m.LatencyStats)
-	case *tdpbv1.Envelope_Ping:
-		return (*Ping)(m.Ping)
-	case *tdpbv1.Envelope_SharedDirectoryRemove:
-		return (*SharedDirectoryRemove)(m.SharedDirectoryRemove)
+	switch e.WhichPayload() {
+	case tdpbv1.Envelope_ClientHello_case:
+		return (*ClientHello)(e.GetClientHello())
+	case tdpbv1.Envelope_ServerHello_case:
+		return (*ServerHello)(e.GetServerHello())
+	case tdpbv1.Envelope_PngFrame_case:
+		return (*PNGFrame)(e.GetPngFrame())
+	case tdpbv1.Envelope_FastPathPdu_case:
+		return (*FastPathPDU)(e.GetFastPathPdu())
+	case tdpbv1.Envelope_RdpResponsePdu_case:
+		return (*RDPResponsePDU)(e.GetRdpResponsePdu())
+	case tdpbv1.Envelope_SyncKeys_case:
+		return (*SyncKeys)(e.GetSyncKeys())
+	case tdpbv1.Envelope_MouseMove_case:
+		return (*MouseMove)(e.GetMouseMove())
+	case tdpbv1.Envelope_MouseButton_case:
+		return (*MouseButton)(e.GetMouseButton())
+	case tdpbv1.Envelope_KeyboardButton_case:
+		return (*KeyboardButton)(e.GetKeyboardButton())
+	case tdpbv1.Envelope_ClientScreenSpec_case:
+		return (*ClientScreenSpec)(e.GetClientScreenSpec())
+	case tdpbv1.Envelope_Alert_case:
+		return (*Alert)(e.GetAlert())
+	case tdpbv1.Envelope_MouseWheel_case:
+		return (*MouseWheel)(e.GetMouseWheel())
+	case tdpbv1.Envelope_ClipboardData_case:
+		return (*ClipboardData)(e.GetClipboardData())
+	case tdpbv1.Envelope_Mfa_case:
+		return (*MFA)(e.GetMfa())
+	case tdpbv1.Envelope_SharedDirectoryAnnounce_case:
+		return (*SharedDirectoryAnnounce)(e.GetSharedDirectoryAnnounce())
+	case tdpbv1.Envelope_SharedDirectoryAcknowledge_case:
+		return (*SharedDirectoryAcknowledge)(e.GetSharedDirectoryAcknowledge())
+	case tdpbv1.Envelope_SharedDirectoryRequest_case:
+		return (*SharedDirectoryRequest)(e.GetSharedDirectoryRequest())
+	case tdpbv1.Envelope_SharedDirectoryResponse_case:
+		return (*SharedDirectoryResponse)(e.GetSharedDirectoryResponse())
+	case tdpbv1.Envelope_LatencyStats_case:
+		return (*LatencyStats)(e.GetLatencyStats())
+	case tdpbv1.Envelope_Ping_case:
+		return (*Ping)(e.GetPing())
+	case tdpbv1.Envelope_SharedDirectoryRemove_case:
+		return (*SharedDirectoryRemove)(e.GetSharedDirectoryRemove())
 	default:
 		return nil
 	}
diff --git a/lib/srv/desktop/tdp/protocol/tdpb/tdpb_test.go b/lib/srv/desktop/tdp/protocol/tdpb/tdpb_test.go
index ac48e08524d..4b5cfe63862 100644
--- a/lib/srv/desktop/tdp/protocol/tdpb/tdpb_test.go
+++ b/lib/srv/desktop/tdp/protocol/tdpb/tdpb_test.go
@@ -40,12 +40,12 @@ import (
 
 func TestEncodeDecode(t *testing.T) {
 	png := &PNGFrame{
-		Coordinates: &tdpbv1.Rectangle{
+		Coordinates: tdpbv1.Rectangle_builder{
 			Top:    1,
 			Bottom: 2,
 			Left:   3,
 			Right:  4,
-		},
+		}.Build(),
 		Data: []byte{0xDE, 0xCA, 0xFB, 0xAD},
 	}
 	data, err := png.Encode()
@@ -98,7 +98,7 @@ func TestHandleUnknownMessageTypes(t *testing.T) {
 	data, err := proto.Marshal(&tdpbv1.Envelope{})
 	require.NoError(t, err)
 
-	innerData, err := proto.Marshal(&tdpbv1.Rectangle{Top: 10, Bottom: 100, Left: 1234, Right: 4321})
+	innerData, err := proto.Marshal(tdpbv1.Rectangle_builder{Top: 10, Bottom: 100, Left: 1234, Right: 4321}.Build())
 	require.NoError(t, err)
 
 	// Append an unknown field number, 1000
@@ -165,10 +165,10 @@ func TestSendRecv(t *testing.T) {
 		Pdu: []byte{0xDE, 0xCA, 0xFB, 0xAD},
 	}
 	helloMsg := &ClientHello{
-		ScreenSpec: &tdpbv1.ClientScreenSpec{
+		ScreenSpec: tdpbv1.ClientScreenSpec_builder{
 			Width:  1920,
 			Height: 1080,
-		},
+		}.Build(),
 		KeyboardLayout: 1,
 	}
 
@@ -246,9 +246,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "create request path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Create_{
-					Create: &tdpbv1.SharedDirectoryRequest_Create{
+					Create: tdpbv1.SharedDirectoryRequest_Create_builder{
 						Path: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -259,9 +259,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "delete request path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Delete_{
-					Delete: &tdpbv1.SharedDirectoryRequest_Delete{
+					Delete: tdpbv1.SharedDirectoryRequest_Delete_builder{
 						Path: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -272,9 +272,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "truncate request path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Truncate_{
-					Truncate: &tdpbv1.SharedDirectoryRequest_Truncate{
+					Truncate: tdpbv1.SharedDirectoryRequest_Truncate_builder{
 						Path: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -285,9 +285,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "write request too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Write_{
-					Write: &tdpbv1.SharedDirectoryRequest_Write{
+					Write: tdpbv1.SharedDirectoryRequest_Write_builder{
 						Data: excessiveReadWriteData,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -298,9 +298,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "read request too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Read_{
-					Read: &tdpbv1.SharedDirectoryRequest_Read{
+					Read: tdpbv1.SharedDirectoryRequest_Read_builder{
 						Length: tdp.MaxFileReadWriteLength + 1,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -311,10 +311,10 @@ func TestMessageValidation(t *testing.T) {
 			name: "read request path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Read_{
-					Read: &tdpbv1.SharedDirectoryRequest_Read{
+					Read: tdpbv1.SharedDirectoryRequest_Read_builder{
 						Length: tdp.MaxFileReadWriteLength,
 						Path:   excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -325,9 +325,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "write path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Write_{
-					Write: &tdpbv1.SharedDirectoryRequest_Write{
+					Write: tdpbv1.SharedDirectoryRequest_Write_builder{
 						Path: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -338,9 +338,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "info request path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Info_{
-					Info: &tdpbv1.SharedDirectoryRequest_Info{
+					Info: tdpbv1.SharedDirectoryRequest_Info_builder{
 						Path: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -351,9 +351,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "list request path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_List_{
-					List: &tdpbv1.SharedDirectoryRequest_List{
+					List: tdpbv1.SharedDirectoryRequest_List_builder{
 						Path: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -364,9 +364,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "move original path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Move_{
-					Move: &tdpbv1.SharedDirectoryRequest_Move{
+					Move: tdpbv1.SharedDirectoryRequest_Move_builder{
 						OriginalPath: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -377,9 +377,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "move new path too large",
 			message: &SharedDirectoryRequest{
 				Operation: &tdpbv1.SharedDirectoryRequest_Move_{
-					Move: &tdpbv1.SharedDirectoryRequest_Move{
+					Move: tdpbv1.SharedDirectoryRequest_Move_builder{
 						NewPath: excessivePath,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -390,9 +390,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "read response too large",
 			message: &SharedDirectoryResponse{
 				Operation: &tdpbv1.SharedDirectoryResponse_Read_{
-					Read: &tdpbv1.SharedDirectoryResponse_Read{
+					Read: tdpbv1.SharedDirectoryResponse_Read_builder{
 						Data: excessiveReadWriteData,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -403,9 +403,9 @@ func TestMessageValidation(t *testing.T) {
 			name: "write response too large",
 			message: &SharedDirectoryResponse{
 				Operation: &tdpbv1.SharedDirectoryResponse_Write_{
-					Write: &tdpbv1.SharedDirectoryResponse_Write{
+					Write: tdpbv1.SharedDirectoryResponse_Write_builder{
 						BytesWritten: tdp.MaxFileReadWriteLength + 1,
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -416,11 +416,11 @@ func TestMessageValidation(t *testing.T) {
 			name: "info response path too large",
 			message: &SharedDirectoryResponse{
 				Operation: &tdpbv1.SharedDirectoryResponse_Info_{
-					Info: &tdpbv1.SharedDirectoryResponse_Info{
-						Fso: &tdpbv1.FileSystemObject{
+					Info: tdpbv1.SharedDirectoryResponse_Info_builder{
+						Fso: tdpbv1.FileSystemObject_builder{
 							Path: excessivePath,
-						},
-					},
+						}.Build(),
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -431,11 +431,11 @@ func TestMessageValidation(t *testing.T) {
 			name: "create response path too large",
 			message: &SharedDirectoryResponse{
 				Operation: &tdpbv1.SharedDirectoryResponse_Create_{
-					Create: &tdpbv1.SharedDirectoryResponse_Create{
-						Fso: &tdpbv1.FileSystemObject{
+					Create: tdpbv1.SharedDirectoryResponse_Create_builder{
+						Fso: tdpbv1.FileSystemObject_builder{
 							Path: excessivePath,
-						},
-					},
+						}.Build(),
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
@@ -446,13 +446,13 @@ func TestMessageValidation(t *testing.T) {
 			name: "list response path too large",
 			message: &SharedDirectoryResponse{
 				Operation: &tdpbv1.SharedDirectoryResponse_List_{
-					List: &tdpbv1.SharedDirectoryResponse_List{
+					List: tdpbv1.SharedDirectoryResponse_List_builder{
 						FsoList: []*tdpbv1.FileSystemObject{
-							{
+							tdpbv1.FileSystemObject_builder{
 								Path: excessivePath,
-							},
+							}.Build(),
 						},
-					},
+					}.Build(),
 				},
 			},
 			expect: func(t *testing.T, e error) {
diff --git a/lib/srv/desktop/tdp/protocol/tdpb/translate.go b/lib/srv/desktop/tdp/protocol/tdpb/translate.go
index 4c6970e6c6d..4529be9cfa6 100644
--- a/lib/srv/desktop/tdp/protocol/tdpb/translate.go
+++ b/lib/srv/desktop/tdp/protocol/tdpb/translate.go
@@ -34,26 +34,26 @@ import (
 
 func translateFSO(fso *tdpbv1.FileSystemObject) legacy.FileSystemObject {
 	isEmpty := uint8(0)
-	if fso.IsEmpty {
+	if fso.GetIsEmpty() {
 		isEmpty = 1
 	}
 	return legacy.FileSystemObject{
-		LastModified: fso.LastModified,
-		Size:         fso.Size,
-		FileType:     fso.FileType,
+		LastModified: fso.GetLastModified(),
+		Size:         fso.GetSize(),
+		FileType:     fso.GetFileType(),
 		IsEmpty:      isEmpty,
-		Path:         fso.Path,
+		Path:         fso.GetPath(),
 	}
 }
 
 func translateFSOToModern(fso legacy.FileSystemObject) *tdpbv1.FileSystemObject {
-	return &tdpbv1.FileSystemObject{
+	return tdpbv1.FileSystemObject_builder{
 		LastModified: fso.LastModified,
 		Size:         fso.Size,
 		FileType:     fso.FileType,
 		IsEmpty:      fso.IsEmpty == 1,
 		Path:         fso.Path,
-	}
+	}.Build()
 }
 
 func toButtonState(b bool) legacy.ButtonState {
@@ -161,57 +161,57 @@ func TranslateToLegacy(msg tdp.Message) ([]tdp.Message, error) {
 			return []tdp.Message{legacy.SharedDirectoryInfoRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				Path:         op.Info.Path,
+				Path:         op.Info.GetPath(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_Create_:
 			return []tdp.Message{legacy.SharedDirectoryCreateRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				FileType:     op.Create.FileType,
-				Path:         op.Create.Path,
+				FileType:     op.Create.GetFileType(),
+				Path:         op.Create.GetPath(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_Delete_:
 			return []tdp.Message{legacy.SharedDirectoryDeleteRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				Path:         op.Delete.Path,
+				Path:         op.Delete.GetPath(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_List_:
 			return []tdp.Message{legacy.SharedDirectoryListRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				Path:         op.List.Path,
+				Path:         op.List.GetPath(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_Read_:
 			return []tdp.Message{legacy.SharedDirectoryReadRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				Path:         op.Read.Path,
-				Offset:       op.Read.Offset,
-				Length:       op.Read.Length,
+				Path:         op.Read.GetPath(),
+				Offset:       op.Read.GetOffset(),
+				Length:       op.Read.GetLength(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_Write_:
 			return []tdp.Message{legacy.SharedDirectoryWriteRequest{
 				CompletionID:    m.CompletionId,
 				DirectoryID:     m.DirectoryId,
-				Path:            op.Write.Path,
-				Offset:          op.Write.Offset,
-				WriteDataLength: uint32(len(op.Write.Data)),
-				WriteData:       op.Write.Data,
+				Path:            op.Write.GetPath(),
+				Offset:          op.Write.GetOffset(),
+				WriteDataLength: uint32(len(op.Write.GetData())),
+				WriteData:       op.Write.GetData(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_Move_:
 			return []tdp.Message{legacy.SharedDirectoryMoveRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				NewPath:      op.Move.NewPath,
-				OriginalPath: op.Move.OriginalPath,
+				NewPath:      op.Move.GetNewPath(),
+				OriginalPath: op.Move.GetOriginalPath(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryRequest_Truncate_:
 			return []tdp.Message{legacy.SharedDirectoryTruncateRequest{
 				CompletionID: m.CompletionId,
 				DirectoryID:  m.DirectoryId,
-				Path:         op.Truncate.Path,
-				EndOfFile:    clampUint64ToUint32(op.Truncate.Size),
+				Path:         op.Truncate.GetPath(),
+				EndOfFile:    clampUint64ToUint32(op.Truncate.GetSize()),
 			}}, nil
 		default:
 			return nil, trace.BadParameter("Unknown shared directory operation")
@@ -222,13 +222,13 @@ func TranslateToLegacy(msg tdp.Message) ([]tdp.Message, error) {
 			return []tdp.Message{legacy.SharedDirectoryInfoResponse{
 				CompletionID: m.CompletionId,
 				ErrCode:      m.ErrorCode,
-				Fso:          translateFSO(op.Info.Fso),
+				Fso:          translateFSO(op.Info.GetFso()),
 			}}, nil
 		case *tdpbv1.SharedDirectoryResponse_Create_:
 			return []tdp.Message{legacy.SharedDirectoryCreateResponse{
 				CompletionID: m.CompletionId,
 				ErrCode:      m.ErrorCode,
-				Fso:          translateFSO(op.Create.Fso),
+				Fso:          translateFSO(op.Create.GetFso()),
 			}}, nil
 		case *tdpbv1.SharedDirectoryResponse_Delete_:
 			return []tdp.Message{legacy.SharedDirectoryDeleteResponse{
@@ -239,20 +239,20 @@ func TranslateToLegacy(msg tdp.Message) ([]tdp.Message, error) {
 			return []tdp.Message{legacy.SharedDirectoryListResponse{
 				CompletionID: m.CompletionId,
 				ErrCode:      m.ErrorCode,
-				FsoList:      slices.Map(op.List.FsoList, translateFSO),
+				FsoList:      slices.Map(op.List.GetFsoList(), translateFSO),
 			}}, nil
 		case *tdpbv1.SharedDirectoryResponse_Read_:
 			return []tdp.Message{legacy.SharedDirectoryReadResponse{
 				CompletionID:   m.CompletionId,
 				ErrCode:        m.ErrorCode,
-				ReadData:       op.Read.Data,
-				ReadDataLength: uint32(len(op.Read.Data)),
+				ReadData:       op.Read.GetData(),
+				ReadDataLength: uint32(len(op.Read.GetData())),
 			}}, nil
 		case *tdpbv1.SharedDirectoryResponse_Write_:
 			return []tdp.Message{legacy.SharedDirectoryWriteResponse{
 				CompletionID: m.CompletionId,
 				ErrCode:      m.ErrorCode,
-				BytesWritten: op.Write.BytesWritten,
+				BytesWritten: op.Write.GetBytesWritten(),
 			}}, nil
 		case *tdpbv1.SharedDirectoryResponse_Move_:
 			return []tdp.Message{legacy.SharedDirectoryMoveResponse{
@@ -280,10 +280,10 @@ func TranslateToLegacy(msg tdp.Message) ([]tdp.Message, error) {
 		return []tdp.Message{legacy.Ping{UUID: id}}, nil
 	case *ServerHello:
 		return []tdp.Message{legacy.ConnectionActivated{
-			IOChannelID:   uint16(m.ActivationSpec.IoChannelId),
-			UserChannelID: uint16(m.ActivationSpec.UserChannelId),
-			ScreenWidth:   uint16(m.ActivationSpec.ScreenWidth),
-			ScreenHeight:  uint16(m.ActivationSpec.ScreenHeight),
+			IOChannelID:   uint16(m.ActivationSpec.GetIoChannelId()),
+			UserChannelID: uint16(m.ActivationSpec.GetUserChannelId()),
+			ScreenWidth:   uint16(m.ActivationSpec.GetScreenWidth()),
+			ScreenHeight:  uint16(m.ActivationSpec.GetScreenHeight()),
 		}}, nil
 	default:
 		return nil, trace.Errorf("Could not translate to TDP. Encountered unexpected message type %T", m)
@@ -300,12 +300,12 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 		}}, nil
 	case legacy.PNG2Frame:
 		return []tdp.Message{&PNGFrame{
-			Coordinates: &tdpbv1.Rectangle{
+			Coordinates: tdpbv1.Rectangle_builder{
 				Top:    m.Top(),
 				Left:   m.Left(),
 				Bottom: m.Bottom(),
 				Right:  m.Right(),
-			},
+			}.Build(),
 			Data: m.Data(),
 		}}, nil
 	case legacy.PNGFrame:
@@ -314,12 +314,12 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			return nil, trace.Errorf("Erroring converting TDP PNGFrame to TDPB - dropping message!: %w", err)
 		}
 		return []tdp.Message{&PNGFrame{
-			Coordinates: &tdpbv1.Rectangle{
+			Coordinates: tdpbv1.Rectangle_builder{
 				Top:    uint32(m.Img.Bounds().Min.Y),
 				Left:   uint32(m.Img.Bounds().Min.X),
 				Bottom: uint32(m.Img.Bounds().Max.Y),
 				Right:  uint32(m.Img.Bounds().Max.X),
-			},
+			}.Build(),
 			Data: buf.Bytes(),
 		}}, nil
 	case legacy.MouseMove:
@@ -377,12 +377,12 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 		// Legacy TDP servers send this message once at the start
 		// of the connection.
 		return []tdp.Message{&ServerHello{
-			ActivationSpec: &tdpbv1.ConnectionActivated{
+			ActivationSpec: tdpbv1.ConnectionActivated_builder{
 				IoChannelId:   uint32(m.IOChannelID),
 				UserChannelId: uint32(m.UserChannelID),
 				ScreenWidth:   uint32(m.ScreenWidth),
 				ScreenHeight:  uint32(m.ScreenHeight),
-			},
+			}.Build(),
 			// Assume all legacy TDP servers support clipboard sharing
 			ClipboardEnabled: true,
 			// No data to map, default to false
@@ -419,9 +419,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			DirectoryId:  m.DirectoryID,
 			CompletionId: m.CompletionID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Info_{
-				Info: &tdpbv1.SharedDirectoryRequest_Info{
+				Info: tdpbv1.SharedDirectoryRequest_Info_builder{
 					Path: m.Path,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryInfoResponse:
@@ -429,9 +429,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			ErrorCode:    m.ErrCode,
 			CompletionId: m.CompletionID,
 			Operation: &tdpbv1.SharedDirectoryResponse_Info_{
-				Info: &tdpbv1.SharedDirectoryResponse_Info{
+				Info: tdpbv1.SharedDirectoryResponse_Info_builder{
 					Fso: translateFSOToModern(m.Fso),
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryCreateRequest:
@@ -439,10 +439,10 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			DirectoryId:  m.DirectoryID,
 			CompletionId: m.CompletionID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Create_{
-				Create: &tdpbv1.SharedDirectoryRequest_Create{
+				Create: tdpbv1.SharedDirectoryRequest_Create_builder{
 					Path:     m.Path,
 					FileType: m.FileType,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryCreateResponse:
@@ -450,9 +450,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			ErrorCode:    m.ErrCode,
 			CompletionId: m.CompletionID,
 			Operation: &tdpbv1.SharedDirectoryResponse_Create_{
-				Create: &tdpbv1.SharedDirectoryResponse_Create{
+				Create: tdpbv1.SharedDirectoryResponse_Create_builder{
 					Fso: translateFSOToModern(m.Fso),
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryDeleteRequest:
@@ -460,9 +460,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			DirectoryId:  m.DirectoryID,
 			CompletionId: m.CompletionID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Delete_{
-				Delete: &tdpbv1.SharedDirectoryRequest_Delete{
+				Delete: tdpbv1.SharedDirectoryRequest_Delete_builder{
 					Path: m.Path,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryDeleteResponse:
@@ -476,11 +476,11 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			DirectoryId:  m.DirectoryID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Read_{
-				Read: &tdpbv1.SharedDirectoryRequest_Read{
+				Read: tdpbv1.SharedDirectoryRequest_Read_builder{
 					Path:   m.Path,
 					Offset: m.Offset,
 					Length: m.Length,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryReadResponse:
@@ -488,9 +488,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			ErrorCode:    m.ErrCode,
 			Operation: &tdpbv1.SharedDirectoryResponse_Read_{
-				Read: &tdpbv1.SharedDirectoryResponse_Read{
+				Read: tdpbv1.SharedDirectoryResponse_Read_builder{
 					Data: m.ReadData,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryWriteRequest:
@@ -498,11 +498,11 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			DirectoryId:  m.DirectoryID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Write_{
-				Write: &tdpbv1.SharedDirectoryRequest_Write{
+				Write: tdpbv1.SharedDirectoryRequest_Write_builder{
 					Path:   m.Path,
 					Offset: m.Offset,
 					Data:   m.WriteData,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryWriteResponse:
@@ -510,9 +510,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			ErrorCode:    m.ErrCode,
 			Operation: &tdpbv1.SharedDirectoryResponse_Write_{
-				Write: &tdpbv1.SharedDirectoryResponse_Write{
+				Write: tdpbv1.SharedDirectoryResponse_Write_builder{
 					BytesWritten: m.BytesWritten,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryMoveRequest:
@@ -520,10 +520,10 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			DirectoryId:  m.DirectoryID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Move_{
-				Move: &tdpbv1.SharedDirectoryRequest_Move{
+				Move: tdpbv1.SharedDirectoryRequest_Move_builder{
 					OriginalPath: m.OriginalPath,
 					NewPath:      m.NewPath,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryMoveResponse:
@@ -537,9 +537,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			DirectoryId:  m.DirectoryID,
 			Operation: &tdpbv1.SharedDirectoryRequest_List_{
-				List: &tdpbv1.SharedDirectoryRequest_List{
+				List: tdpbv1.SharedDirectoryRequest_List_builder{
 					Path: m.Path,
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryListResponse:
@@ -547,9 +547,9 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			CompletionId: m.CompletionID,
 			ErrorCode:    m.ErrCode,
 			Operation: &tdpbv1.SharedDirectoryResponse_List_{
-				List: &tdpbv1.SharedDirectoryResponse_List{
+				List: tdpbv1.SharedDirectoryResponse_List_builder{
 					FsoList: slices.Map(m.FsoList, translateFSOToModern),
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryTruncateRequest:
@@ -557,10 +557,10 @@ func TranslateToModern(msg tdp.Message) ([]tdp.Message, error) {
 			DirectoryId:  m.DirectoryID,
 			CompletionId: m.CompletionID,
 			Operation: &tdpbv1.SharedDirectoryRequest_Truncate_{
-				Truncate: &tdpbv1.SharedDirectoryRequest_Truncate{
+				Truncate: tdpbv1.SharedDirectoryRequest_Truncate_builder{
 					Path: m.Path,
 					Size: uint64(m.EndOfFile),
-				},
+				}.Build(),
 			},
 		}}, nil
 	case legacy.SharedDirectoryTruncateResponse:
diff --git a/lib/srv/desktop/windows_server_test.go b/lib/srv/desktop/windows_server_test.go
index 6cff54bf560..fe8df04bd59 100644
--- a/lib/srv/desktop/windows_server_test.go
+++ b/lib/srv/desktop/windows_server_test.go
@@ -723,13 +723,13 @@ func TestCRLUpdateSchedule(t *testing.T) {
 		// If targeting the Windows CA, without modifications, this should trigger
 		// a CRL update.
 		caOverride := env.NewOverrideForCA(t, ca, externalCA)
-		caOverride.Status = &subcav1.CertAuthorityOverrideStatus{
+		caOverride.SetStatus(subcav1.CertAuthorityOverrideStatus_builder{
 			PublicKeyHashToCrl: make(map[string]*subcav1.CertificateRevocationList),
-		}
-		for _, co := range caOverride.Spec.CertificateOverrides {
-			caOverride.Status.PublicKeyHashToCrl[co.PublicKey] = &subcav1.CertificateRevocationList{
+		}.Build())
+		for _, co := range caOverride.GetSpec().GetCertificateOverrides() {
+			caOverride.GetStatus().GetPublicKeyHashToCrl()[co.GetPublicKey()] = subcav1.CertificateRevocationList_builder{
 				Pem: "<insert PEM here>",
-			}
+			}.Build()
 		}
 
 		if modifyOverride != nil {
@@ -768,8 +768,8 @@ func TestCRLUpdateSchedule(t *testing.T) {
 		// Create an empty Windows CA override.
 		// It should not trigger a CRL update, as the resource itself lacks CRLs.
 		upsertOverrideForCA(t, caID, func(caOverride *subcav1.CertAuthorityOverride) {
-			caOverride.Spec.CertificateOverrides = nil
-			caOverride.Status = nil
+			caOverride.GetSpec().SetCertificateOverrides(nil)
+			caOverride.ClearStatus()
 		})
 		waitForEvent(t)
 
diff --git a/lib/srv/discovery/access_graph_aws.go b/lib/srv/discovery/access_graph_aws.go
index c2c0fcfd78b..d91a689853f 100644
--- a/lib/srv/discovery/access_graph_aws.go
+++ b/lib/srv/discovery/access_graph_aws.go
@@ -147,8 +147,8 @@ func (s *Server) reconcileAccessGraph(
 			continue
 		}
 		for _, cluster := range result.EKSClusters {
-			clusterTags := make(map[string]string, len(cluster.Tags))
-			for _, tag := range cluster.Tags {
+			clusterTags := make(map[string]string, len(cluster.GetTags()))
+			for _, tag := range cluster.GetTags() {
 				clusterTags[tag.GetKey()] = tag.GetValue().GetValue()
 			}
 			match, _, _ := services.MatchLabels(fetcher.EKSAuditLogs.Tags, clusterTags)
@@ -246,16 +246,14 @@ func pushUpsertInBatches(
 	client accessgraphv1alpha.AccessGraphService_AWSEventsStreamClient,
 	upsert *accessgraphv1alpha.AWSResourceList,
 ) error {
-	for i := 0; i < len(upsert.Resources); i += batchSize {
-		end := min(i+batchSize, len(upsert.Resources))
+	for i := 0; i < len(upsert.GetResources()); i += batchSize {
+		end := min(i+batchSize, len(upsert.GetResources()))
 		err := client.Send(
-			&accessgraphv1alpha.AWSEventsStreamRequest{
-				Operation: &accessgraphv1alpha.AWSEventsStreamRequest_Upsert{
-					Upsert: &accessgraphv1alpha.AWSResourceList{
-						Resources: upsert.Resources[i:end],
-					},
-				},
-			},
+			accessgraphv1alpha.AWSEventsStreamRequest_builder{
+				Upsert: accessgraphv1alpha.AWSResourceList_builder{
+					Resources: upsert.GetResources()[i:end],
+				}.Build(),
+			}.Build(),
 		)
 		if err != nil {
 			return trace.Wrap(err)
@@ -268,16 +266,14 @@ func pushDeleteInBatches(
 	client accessgraphv1alpha.AccessGraphService_AWSEventsStreamClient,
 	toDel *accessgraphv1alpha.AWSResourceList,
 ) error {
-	for i := 0; i < len(toDel.Resources); i += batchSize {
-		end := min(i+batchSize, len(toDel.Resources))
+	for i := 0; i < len(toDel.GetResources()); i += batchSize {
+		end := min(i+batchSize, len(toDel.GetResources()))
 		err := client.Send(
-			&accessgraphv1alpha.AWSEventsStreamRequest{
-				Operation: &accessgraphv1alpha.AWSEventsStreamRequest_Delete{
-					Delete: &accessgraphv1alpha.AWSResourceList{
-						Resources: toDel.Resources[i:end],
-					},
-				},
-			},
+			accessgraphv1alpha.AWSEventsStreamRequest_builder{
+				Delete: accessgraphv1alpha.AWSResourceList_builder{
+					Resources: toDel.GetResources()[i:end],
+				}.Build(),
+			}.Build(),
 		)
 		if err != nil {
 			return trace.Wrap(err)
@@ -720,11 +716,9 @@ func (s *Server) startCloudtrailPoller(ctx context.Context, reloadCh <-chan stru
 		return trace.Wrap(err)
 	}
 	err = stream.Send(
-		&accessgraphv1alpha.AWSCloudTrailStreamRequest{
-			Action: &accessgraphv1alpha.AWSCloudTrailStreamRequest_Config{
-				Config: &accessgraphv1alpha.AWSCloudTrailConfig{},
-			},
-		},
+		accessgraphv1alpha.AWSCloudTrailStreamRequest_builder{
+			Config: &accessgraphv1alpha.AWSCloudTrailConfig{},
+		}.Build(),
 	)
 	if err != nil {
 		err = consumeTillErr(stream)
@@ -844,14 +838,12 @@ func (s *Server) startCloudtrailPoller(ctx context.Context, reloadCh <-chan stru
 			continue
 		case file := <-filePayload:
 			err := stream.Send(
-				&accessgraphv1alpha.AWSCloudTrailStreamRequest{
-					Action: &accessgraphv1alpha.AWSCloudTrailStreamRequest_EventsFile{
-						EventsFile: &accessgraphv1alpha.AWSCloudTrailEventsFile{
-							Payload:      file.payload,
-							AwsAccountId: file.accountID,
-						},
-					},
-				},
+				accessgraphv1alpha.AWSCloudTrailStreamRequest_builder{
+					EventsFile: accessgraphv1alpha.AWSCloudTrailEventsFile_builder{
+						Payload:      file.payload,
+						AwsAccountId: file.accountID,
+					}.Build(),
+				}.Build(),
 			)
 			if err != nil {
 				err = consumeTillErr(stream)
diff --git a/lib/srv/discovery/access_graph_azure.go b/lib/srv/discovery/access_graph_azure.go
index a82139fc3f4..b120d9fab2b 100644
--- a/lib/srv/discovery/access_graph_azure.go
+++ b/lib/srv/discovery/access_graph_azure.go
@@ -135,16 +135,14 @@ func azurePushUpsertInBatches(
 	client accessgraphv1alpha.AccessGraphService_AzureEventsStreamClient,
 	upsert *accessgraphv1alpha.AzureResourceList,
 ) error {
-	for i := 0; i < len(upsert.Resources); i += batchSize {
-		end := min(i+batchSize, len(upsert.Resources))
+	for i := 0; i < len(upsert.GetResources()); i += batchSize {
+		end := min(i+batchSize, len(upsert.GetResources()))
 		err := client.Send(
-			&accessgraphv1alpha.AzureEventsStreamRequest{
-				Operation: &accessgraphv1alpha.AzureEventsStreamRequest_Upsert{
-					Upsert: &accessgraphv1alpha.AzureResourceList{
-						Resources: upsert.Resources[i:end],
-					},
-				},
-			},
+			accessgraphv1alpha.AzureEventsStreamRequest_builder{
+				Upsert: accessgraphv1alpha.AzureResourceList_builder{
+					Resources: upsert.GetResources()[i:end],
+				}.Build(),
+			}.Build(),
 		)
 		if err != nil {
 			return trace.Wrap(err)
@@ -158,16 +156,14 @@ func azurePushDeleteInBatches(
 	client accessgraphv1alpha.AccessGraphService_AzureEventsStreamClient,
 	toDel *accessgraphv1alpha.AzureResourceList,
 ) error {
-	for i := 0; i < len(toDel.Resources); i += batchSize {
-		end := min(i+batchSize, len(toDel.Resources))
+	for i := 0; i < len(toDel.GetResources()); i += batchSize {
+		end := min(i+batchSize, len(toDel.GetResources()))
 		err := client.Send(
-			&accessgraphv1alpha.AzureEventsStreamRequest{
-				Operation: &accessgraphv1alpha.AzureEventsStreamRequest_Delete{
-					Delete: &accessgraphv1alpha.AzureResourceList{
-						Resources: toDel.Resources[i:end],
-					},
-				},
-			},
+			accessgraphv1alpha.AzureEventsStreamRequest_builder{
+				Delete: accessgraphv1alpha.AzureResourceList_builder{
+					Resources: toDel.GetResources()[i:end],
+				}.Build(),
+			}.Build(),
 		)
 		if err != nil {
 			return trace.Wrap(err)
diff --git a/lib/srv/discovery/access_graph_test.go b/lib/srv/discovery/access_graph_test.go
index 313c8be6ef4..919103c3f33 100644
--- a/lib/srv/discovery/access_graph_test.go
+++ b/lib/srv/discovery/access_graph_test.go
@@ -42,11 +42,11 @@ func TestServer_updateDiscoveryConfigStatus(t *testing.T) {
 	baseServerStatusFn := func() map[string]*discoveryconfig.DiscoveryStatusServer {
 		return map[string]*discoveryconfig.DiscoveryStatusServer{
 			"server-id": {
-				DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+				DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 					IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{},
 					LastUpdate:           timestamppb.New(clock.Now()),
 					PollInterval:         durationpb.New(time.Minute),
-				},
+				}.Build(),
 			},
 		}
 	}
diff --git a/lib/srv/discovery/database_watcher.go b/lib/srv/discovery/database_watcher.go
index 8a5ac4ae4b9..17c177385ad 100644
--- a/lib/srv/discovery/database_watcher.go
+++ b/lib/srv/discovery/database_watcher.go
@@ -166,14 +166,14 @@ func (s *Server) collectRDSIssuesAsUserTasks(db types.Database, integration, dis
 			accountID:   db.GetAWS().AccountID,
 			region:      db.GetAWS().Region,
 		},
-		&usertasksv1.DiscoverRDSDatabase{
+		usertasksv1.DiscoverRDSDatabase_builder{
 			DiscoveryConfig: discoveryConfigName,
 			DiscoveryGroup:  s.DiscoveryGroup,
 			SyncTime:        timestamppb.New(s.clock.Now()),
 			Name:            databaseIdentifier,
 			IsCluster:       isCluster,
 			Engine:          engine,
-		},
+		}.Build(),
 	)
 }
 
diff --git a/lib/srv/discovery/discovery.go b/lib/srv/discovery/discovery.go
index 8c49196b354..ce0012a778a 100644
--- a/lib/srv/discovery/discovery.go
+++ b/lib/srv/discovery/discovery.go
@@ -1342,13 +1342,13 @@ func (s *Server) handleEC2RemoteInstallation(instances *server.EC2Instances) err
 					ssmDocument:     req.DocumentName,
 					installerScript: req.InstallerScriptName(),
 				},
-				&usertasksv1.DiscoverEC2Instance{
+				usertasksv1.DiscoverEC2Instance_builder{
 					DiscoveryConfig: instances.DiscoveryConfigName,
 					DiscoveryGroup:  s.DiscoveryGroup,
 					InstanceId:      instance.InstanceID,
 					Name:            instance.InstanceName,
 					SyncTime:        timestamppb.New(s.clock.Now()),
-				},
+				}.Build(),
 			)
 		}
 		return trace.Wrap(err)
@@ -1729,14 +1729,14 @@ func (s *Server) installAzureServers(instances *server.AzureInstances, vmTasks *
 				resourceGroup:  instances.ResourceGroup,
 				region:         instances.Region,
 			},
-			&usertasksv1.DiscoverAzureVMInstance{
+			usertasksv1.DiscoverAzureVMInstance_builder{
 				VmId:            vm.VMID,
 				ResourceId:      vm.ID,
 				Name:            vm.Name,
 				DiscoveryConfig: instances.DiscoveryConfigName,
 				DiscoveryGroup:  s.DiscoveryGroup,
 				SyncTime:        timestamppb.New(s.clock.Now()),
-			},
+			}.Build(),
 		)
 	}
 
diff --git a/lib/srv/discovery/discovery_eks_test.go b/lib/srv/discovery/discovery_eks_test.go
index e8e1877f142..dbc76b00924 100644
--- a/lib/srv/discovery/discovery_eks_test.go
+++ b/lib/srv/discovery/discovery_eks_test.go
@@ -134,20 +134,20 @@ func TestDiscoveryServerEKS(t *testing.T) {
 				},
 			},
 			eksEnroller: &mockEKSClusterEnroller{
-				resp: &integrationpb.EnrollEKSClustersResponse{
+				resp: integrationpb.EnrollEKSClustersResponse_builder{
 					Results: []*integrationpb.EnrollEKSClusterResult{
-						{
+						integrationpb.EnrollEKSClusterResult_builder{
 							EksClusterName: "cluster01",
 							Error:          "access endpoint is not reachable",
 							IssueType:      "eks-cluster-unreachable",
-						},
-						{
+						}.Build(),
+						integrationpb.EnrollEKSClusterResult_builder{
 							EksClusterName: "cluster02",
 							Error:          "access endpoint is not reachable",
 							IssueType:      "eks-cluster-unreachable",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				err: nil,
 			},
 			emitter:                &mockEmitter{},
@@ -158,26 +158,26 @@ func TestDiscoveryServerEKS(t *testing.T) {
 				require.NotEmpty(t, existingTasks)
 				existingTask := existingTasks[0]
 
-				require.Equal(t, "OPEN", existingTask.GetSpec().State)
-				require.Equal(t, integrationName, existingTask.GetSpec().Integration)
-				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().IssueType)
+				require.Equal(t, "OPEN", existingTask.GetSpec().GetState())
+				require.Equal(t, integrationName, existingTask.GetSpec().GetIntegration())
+				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().GetIssueType())
 				require.Equal(t, "123456789012", existingTask.GetSpec().GetDiscoverEks().GetAccountId())
 				require.Equal(t, "us-west-2", existingTask.GetSpec().GetDiscoverEks().GetRegion())
 
-				taskClusters := existingTask.GetSpec().GetDiscoverEks().Clusters
+				taskClusters := existingTask.GetSpec().GetDiscoverEks().GetClusters()
 				require.Contains(t, taskClusters, "cluster01")
 				taskCluster := taskClusters["cluster01"]
 
-				require.Equal(t, "cluster01", taskCluster.Name)
-				require.Equal(t, discoveryConfigForUserTaskEKSTest.GetName(), taskCluster.DiscoveryConfig)
-				require.Equal(t, defaultDiscoveryGroup, taskCluster.DiscoveryGroup)
+				require.Equal(t, "cluster01", taskCluster.GetName())
+				require.Equal(t, discoveryConfigForUserTaskEKSTest.GetName(), taskCluster.GetDiscoveryConfig())
+				require.Equal(t, defaultDiscoveryGroup, taskCluster.GetDiscoveryGroup())
 
 				require.Contains(t, taskClusters, "cluster02")
 				taskCluster2 := taskClusters["cluster02"]
 
-				require.Equal(t, "cluster02", taskCluster2.Name)
-				require.Equal(t, discoveryConfigForUserTaskEKSTest.GetName(), taskCluster2.DiscoveryConfig)
-				require.Equal(t, defaultDiscoveryGroup, taskCluster2.DiscoveryGroup)
+				require.Equal(t, "cluster02", taskCluster2.GetName())
+				require.Equal(t, discoveryConfigForUserTaskEKSTest.GetName(), taskCluster2.GetDiscoveryConfig())
+				require.Equal(t, defaultDiscoveryGroup, taskCluster2.GetDiscoveryGroup())
 			},
 		},
 		{
@@ -201,20 +201,20 @@ func TestDiscoveryServerEKS(t *testing.T) {
 				},
 			},
 			eksEnroller: &mockEKSClusterEnroller{
-				resp: &integrationpb.EnrollEKSClustersResponse{
+				resp: integrationpb.EnrollEKSClustersResponse_builder{
 					Results: []*integrationpb.EnrollEKSClusterResult{
-						{
+						integrationpb.EnrollEKSClusterResult_builder{
 							EksClusterName: "cluster01",
 							Error:          "access endpoint is not reachable",
 							IssueType:      "eks-cluster-unreachable",
-						},
-						{
+						}.Build(),
+						integrationpb.EnrollEKSClusterResult_builder{
 							EksClusterName: "cluster02",
 							Error:          "access endpoint is not reachable",
 							IssueType:      "eks-cluster-unreachable",
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 				err: nil,
 			},
 			emitter:                &mockEmitter{},
@@ -224,23 +224,23 @@ func TestDiscoveryServerEKS(t *testing.T) {
 			userTasksDiscoverCheck: func(t *testing.T, existingTasks []*usertasksv1.UserTask) {
 				require.Len(t, existingTasks, 2)
 				existingTask := existingTasks[0]
-				if existingTask.Spec.DiscoverEks.AppAutoDiscover == false {
+				if existingTask.GetSpec().GetDiscoverEks().GetAppAutoDiscover() == false {
 					existingTask = existingTasks[1]
 				}
 
-				require.Equal(t, "OPEN", existingTask.GetSpec().State)
-				require.Equal(t, integrationName, existingTask.GetSpec().Integration)
-				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().IssueType)
+				require.Equal(t, "OPEN", existingTask.GetSpec().GetState())
+				require.Equal(t, integrationName, existingTask.GetSpec().GetIntegration())
+				require.Equal(t, "eks-cluster-unreachable", existingTask.GetSpec().GetIssueType())
 				require.Equal(t, "123456789012", existingTask.GetSpec().GetDiscoverEks().GetAccountId())
 				require.Equal(t, "us-west-2", existingTask.GetSpec().GetDiscoverEks().GetRegion())
 
-				taskClusters := existingTask.GetSpec().GetDiscoverEks().Clusters
+				taskClusters := existingTask.GetSpec().GetDiscoverEks().GetClusters()
 				require.Contains(t, taskClusters, "cluster01")
 				taskCluster := taskClusters["cluster01"]
 
-				require.Equal(t, "cluster01", taskCluster.Name)
-				require.Equal(t, discoveryConfigWithAndWithoutAppDiscovery.GetName(), taskCluster.DiscoveryConfig)
-				require.Equal(t, defaultDiscoveryGroup, taskCluster.DiscoveryGroup)
+				require.Equal(t, "cluster01", taskCluster.GetName())
+				require.Equal(t, discoveryConfigWithAndWithoutAppDiscovery.GetName(), taskCluster.GetDiscoveryConfig())
+				require.Equal(t, defaultDiscoveryGroup, taskCluster.GetDiscoveryGroup())
 			},
 		},
 	} {
@@ -488,14 +488,14 @@ type mockEKSClusterEnroller struct {
 }
 
 func (m *mockEKSClusterEnroller) EnrollEKSClusters(ctx context.Context, req *integrationpb.EnrollEKSClustersRequest, opt ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error) {
-	ret := &integrationpb.EnrollEKSClustersResponse{
+	ret := integrationpb.EnrollEKSClustersResponse_builder{
 		Results: []*integrationpb.EnrollEKSClusterResult{},
-	}
+	}.Build()
 	// Filter out non-requested clusters.
-	for _, clusterName := range req.EksClusterNames {
-		for _, mockClusterResult := range m.resp.Results {
-			if clusterName == mockClusterResult.EksClusterName {
-				ret.Results = append(ret.Results, mockClusterResult)
+	for _, clusterName := range req.GetEksClusterNames() {
+		for _, mockClusterResult := range m.resp.GetResults() {
+			if clusterName == mockClusterResult.GetEksClusterName() {
+				ret.SetResults(append(ret.GetResults(), mockClusterResult))
 			}
 		}
 	}
diff --git a/lib/srv/discovery/discovery_test.go b/lib/srv/discovery/discovery_test.go
index cbf91ce4a06..0f8dcfd6ffa 100644
--- a/lib/srv/discovery/discovery_test.go
+++ b/lib/srv/discovery/discovery_test.go
@@ -702,13 +702,13 @@ func TestDiscoveryServer(t *testing.T) {
 				LastSyncTime:        time.Now().UTC(),
 				IntegrationDiscoveredResources: map[string]*discoveryconfig.IntegrationDiscoveredSummary{
 					"my-integration": {
-						IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-							AwsEc2: &discoveryconfigv1.ResourcesDiscoveredSummary{
+						IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+							AwsEc2: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 								Found:    1,
 								Enrolled: 0,
 								Failed:   0,
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
 				},
 			},
@@ -729,13 +729,13 @@ func TestDiscoveryServer(t *testing.T) {
 				LastSyncTime:        time.Now().UTC(),
 				IntegrationDiscoveredResources: map[string]*discoveryconfig.IntegrationDiscoveredSummary{
 					"my-integration": {
-						IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-							AwsEc2: &discoveryconfigv1.ResourcesDiscoveredSummary{
+						IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+							AwsEc2: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 								Found:    0,
 								Enrolled: 0,
 								Failed:   0,
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
 				},
 			},
@@ -793,19 +793,19 @@ func TestDiscoveryServer(t *testing.T) {
 				existingTasks := fetchAllUserTasks(t, userTasksClt, atLeastOneUserTask, 0)
 				existingTask := existingTasks[0]
 
-				require.Equal(t, "OPEN", existingTask.GetSpec().State)
-				require.Equal(t, "my-integration", existingTask.GetSpec().Integration)
-				require.Equal(t, "ec2-ssm-invocation-failure", existingTask.GetSpec().IssueType)
+				require.Equal(t, "OPEN", existingTask.GetSpec().GetState())
+				require.Equal(t, "my-integration", existingTask.GetSpec().GetIntegration())
+				require.Equal(t, "ec2-ssm-invocation-failure", existingTask.GetSpec().GetIssueType())
 				require.Equal(t, "owner", existingTask.GetSpec().GetDiscoverEc2().GetAccountId())
 				require.Equal(t, "eu-west-2", existingTask.GetSpec().GetDiscoverEc2().GetRegion())
 
-				taskInstances := existingTask.GetSpec().GetDiscoverEc2().Instances
+				taskInstances := existingTask.GetSpec().GetDiscoverEc2().GetInstances()
 				require.Contains(t, taskInstances, "instance-id-1")
 				taskInstance := taskInstances["instance-id-1"]
 
-				require.Equal(t, "instance-id-1", taskInstance.InstanceId)
-				require.Equal(t, discoveryConfigForUserTaskEC2TestName, taskInstance.DiscoveryConfig)
-				require.Equal(t, defaultDiscoveryGroup, taskInstance.DiscoveryGroup)
+				require.Equal(t, "instance-id-1", taskInstance.GetInstanceId())
+				require.Equal(t, discoveryConfigForUserTaskEC2TestName, taskInstance.GetDiscoveryConfig())
+				require.Equal(t, defaultDiscoveryGroup, taskInstance.GetDiscoveryGroup())
 			},
 		},
 	}
@@ -981,8 +981,8 @@ func TestDiscoveryServer(t *testing.T) {
 
 func requireSyncTimesSet(t *testing.T, summary *discoveryconfigv1.ResourcesDiscoveredSummary) {
 	require.NotNil(t, summary)
-	require.True(t, summary.SyncStart.AsTime().After(time.Unix(0, 0)))
-	require.True(t, summary.SyncEnd.AsTime().After(time.Unix(0, 0)))
+	require.True(t, summary.GetSyncStart().AsTime().After(time.Unix(0, 0)))
+	require.True(t, summary.GetSyncEnd().AsTime().After(time.Unix(0, 0)))
 }
 
 func fetchAllUserTasks(t *testing.T, userTasksClt services.UserTasks, minUserTasks, minUserTaskResources int) []*usertasksv1.UserTask {
@@ -2695,9 +2695,9 @@ func TestDiscoveryDatabase(t *testing.T) {
 			},
 			wantEvents: 1,
 			discoveryConfigStatusCheck: func(t *testing.T, s discoveryconfig.Status) {
-				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsRds.Enrolled)
-				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsRds.Found)
-				require.Zero(t, s.IntegrationDiscoveredResources[integrationName].AwsRds.Failed)
+				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsRds.GetEnrolled())
+				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsRds.GetFound())
+				require.Zero(t, s.IntegrationDiscoveredResources[integrationName].AwsRds.GetFailed())
 			},
 			discoveryConfigStatusExpectedResources: 1,
 		},
@@ -2729,8 +2729,8 @@ func TestDiscoveryDatabase(t *testing.T) {
 			expectDatabases: []types.Database{},
 			wantEvents:      0,
 			discoveryConfigStatusCheck: func(t *testing.T, s discoveryconfig.Status) {
-				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsEks.Found)
-				require.Zero(t, s.IntegrationDiscoveredResources[integrationName].AwsEks.Enrolled)
+				require.Equal(t, uint64(1), s.IntegrationDiscoveredResources[integrationName].AwsEks.GetFound())
+				require.Zero(t, s.IntegrationDiscoveredResources[integrationName].AwsEks.GetEnrolled())
 			},
 			discoveryConfigStatusExpectedResources: 1,
 		},
@@ -2792,11 +2792,11 @@ func TestDiscoveryDatabase(t *testing.T) {
 
 				require.Contains(t, gotUserTask.GetSpec().GetDiscoverRds().GetDatabases(), "aws-rds")
 				gotDatabase := gotUserTask.GetSpec().GetDiscoverRds().GetDatabases()["aws-rds"]
-				require.Equal(t, "my-discovery-config", gotDatabase.DiscoveryConfig)
-				require.Equal(t, "main", gotDatabase.DiscoveryGroup)
-				require.Equal(t, "postgres", gotDatabase.Engine)
-				require.Equal(t, "aws-rds", gotDatabase.Name)
-				require.False(t, gotDatabase.IsCluster)
+				require.Equal(t, "my-discovery-config", gotDatabase.GetDiscoveryConfig())
+				require.Equal(t, "main", gotDatabase.GetDiscoveryGroup())
+				require.Equal(t, "postgres", gotDatabase.GetEngine())
+				require.Equal(t, "aws-rds", gotDatabase.GetName())
+				require.False(t, gotDatabase.GetIsCluster())
 			},
 		},
 	}
@@ -3487,34 +3487,34 @@ func TestAzureVMDiscovery(t *testing.T) {
 				require.NoError(t, err)
 				require.Len(t, tasks, 1)
 
-				expectedTask := &usertasksv1.UserTask{
+				expectedTask := usertasksv1.UserTask_builder{
 					Kind:    types.KindUserTask,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "d09fef6d-2454-5bdd-80c7-db7edddf2a2e", // stable hash
-					},
-					Spec: &usertasksv1.UserTaskSpec{
+					}.Build(),
+					Spec: usertasksv1.UserTaskSpec_builder{
 						Integration: dummyIntegration,
 						TaskType:    usertasks.TaskTypeDiscoverAzureVM,
 						IssueType:   usertasks.AutoDiscoverAzureVMIssueMissingRunCommandsPermission,
 						State:       usertasks.TaskStateOpen,
-						DiscoverAzureVm: &usertasksv1.DiscoverAzureVM{
+						DiscoverAzureVm: usertasksv1.DiscoverAzureVM_builder{
 							Instances: map[string]*usertasksv1.DiscoverAzureVMInstance{
-								"bad-api0-vmid": {
+								"bad-api0-vmid": usertasksv1.DiscoverAzureVMInstance_builder{
 									ResourceId:      "/subscriptions/testsub/resourceGroups/testrg/providers/Microsoft.Compute/virtualMachines/bad-api0",
 									VmId:            "bad-api0-vmid",
 									Name:            "bad-api0",
 									DiscoveryConfig: defaultDiscoveryConfig().GetName(),
 									DiscoveryGroup:  defaultDiscoveryGroup,
-								},
+								}.Build(),
 							},
 							SubscriptionId: "testsub",
 							ResourceGroup:  "testrg",
 							Region:         "westcentralus",
-						},
-					},
+						}.Build(),
+					}.Build(),
 					Status: nil,
-				}
+				}.Build()
 
 				require.Empty(t, cmp.Diff(expectedTask, tasks[0],
 					protocmp.Transform(),
diff --git a/lib/srv/discovery/eks_audit_log_fetcher.go b/lib/srv/discovery/eks_audit_log_fetcher.go
index 83a8f778d6a..636a0ca5c54 100644
--- a/lib/srv/discovery/eks_audit_log_fetcher.go
+++ b/lib/srv/discovery/eks_audit_log_fetcher.go
@@ -73,7 +73,7 @@ func newEKSAuditLogFetcher(
 // audit logs for the configured cluster. It feeds the logs retrieved to the
 // configured grpc stream, running until the given context is canceled.
 func (f *eksAuditLogFetcher) Run(ctx context.Context) error {
-	f.log = f.log.With("cluster", f.cluster.Arn)
+	f.log = f.log.With("cluster", f.cluster.GetArn())
 
 	cursor := initialCursor(f.cluster)
 	if err := f.sendTAGKubeAuditLogNewStream(ctx, cursor); err != nil {
@@ -148,11 +148,9 @@ func (f *eksAuditLogFetcher) fetchLogs(ctx context.Context, cursor *accessgraphv
 
 func (f *eksAuditLogFetcher) sendTAGKubeAuditLogNewStream(ctx context.Context, cursor *accessgraphv1alpha.KubeAuditLogCursor) error {
 	err := f.stream.Send(
-		&accessgraphv1alpha.KubeAuditLogStreamRequest{
-			Action: &accessgraphv1alpha.KubeAuditLogStreamRequest_NewStream{
-				NewStream: &accessgraphv1alpha.KubeAuditLogNewStream{Initial: cursor},
-			},
-		},
+		accessgraphv1alpha.KubeAuditLogStreamRequest_builder{
+			NewStream: accessgraphv1alpha.KubeAuditLogNewStream_builder{Initial: cursor}.Build(),
+		}.Build(),
 	)
 	if err != nil {
 		err = consumeTillErr(f.stream)
@@ -174,16 +172,14 @@ func (f *eksAuditLogFetcher) receiveTAGKubeAuditLogResume(ctx context.Context) (
 	}
 
 	f.log.InfoContext(ctx, "KubeAuditLogResumeState received", "state", state)
-	return state.Cursor, nil
+	return state.GetCursor(), nil
 }
 
 func (f *eksAuditLogFetcher) sendTAGKubeAuditLogEvents(ctx context.Context, events []*structpb.Struct, cursor *accessgraphv1alpha.KubeAuditLogCursor) error {
 	err := f.stream.Send(
-		&accessgraphv1alpha.KubeAuditLogStreamRequest{
-			Action: &accessgraphv1alpha.KubeAuditLogStreamRequest_Events{
-				Events: &accessgraphv1alpha.KubeAuditLogEvents{Events: events, Cursor: cursor},
-			},
-		},
+		accessgraphv1alpha.KubeAuditLogStreamRequest_builder{
+			Events: accessgraphv1alpha.KubeAuditLogEvents_builder{Events: events, Cursor: cursor}.Build(),
+		}.Build(),
 	)
 	if err != nil {
 		err = consumeTillErr(f.stream)
@@ -194,21 +190,21 @@ func (f *eksAuditLogFetcher) sendTAGKubeAuditLogEvents(ctx context.Context, even
 }
 
 func cursorFromEvent(cluster *accessgraphv1alpha.AWSEKSClusterV1, event cwltypes.FilteredLogEvent) *accessgraphv1alpha.KubeAuditLogCursor {
-	return &accessgraphv1alpha.KubeAuditLogCursor{
+	return accessgraphv1alpha.KubeAuditLogCursor_builder{
 		LogSource:     accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS,
-		ClusterId:     cluster.Arn,
+		ClusterId:     cluster.GetArn(),
 		EventId:       *event.EventId,
 		LastEventTime: timestamppb.New(time.UnixMilli(*event.Timestamp)),
-	}
+	}.Build()
 }
 
 // initialCursor returns a cursor for a EKS cluster that we have not previously
 // retrieved logs from, so there is no resume state. The cursor is set to
 // have logs retrieved back a standard amount of time.
 func initialCursor(cluster *accessgraphv1alpha.AWSEKSClusterV1) *accessgraphv1alpha.KubeAuditLogCursor {
-	return &accessgraphv1alpha.KubeAuditLogCursor{
+	return accessgraphv1alpha.KubeAuditLogCursor_builder{
 		LogSource:     accessgraphv1alpha.KubeAuditLogCursor_KUBE_AUDIT_LOG_SOURCE_EKS,
-		ClusterId:     cluster.Arn,
+		ClusterId:     cluster.GetArn(),
 		LastEventTime: timestamppb.New(time.Now().UTC().Add(-initialLogBacklog)),
-	}
+	}.Build()
 }
diff --git a/lib/srv/discovery/eks_audit_log_fetcher_test.go b/lib/srv/discovery/eks_audit_log_fetcher_test.go
index bbf792daf4f..2b695433abe 100644
--- a/lib/srv/discovery/eks_audit_log_fetcher_test.go
+++ b/lib/srv/discovery/eks_audit_log_fetcher_test.go
@@ -49,14 +49,14 @@ func (f *eksAuditLogFetcherFixture) Start(t *testing.T) {
 	t.Helper()
 
 	f.ctx, f.cancel = context.WithCancel(t.Context())
-	tester := grpctest.NewGRPCTester[kalsRequest, kalsResponse](f.ctx)
+	tester := grpctest.NewGRPCTester[accessgraphv1alpha.KubeAuditLogStreamRequest, accessgraphv1alpha.KubeAuditLogStreamResponse](f.ctx)
 	f.server = tester.NewServerStream()
 	logger := slog.New(slog.DiscardHandler)
 	f.fakeLogFetcher = newFakeCloudWatchLogFetcher()
-	f.cluster = &accessgraphv1alpha.AWSEKSClusterV1{
+	f.cluster = accessgraphv1alpha.AWSEKSClusterV1_builder{
 		Name: "cluster-name",
 		Arn:  "cluster-arn",
-	}
+	}.Build()
 	logFetcher := newEKSAuditLogFetcher(f.fakeLogFetcher, f.cluster, tester.NewClientStream(), logger)
 	go func() { f.fetcherErr = logFetcher.Run(f.ctx) }()
 }
@@ -193,14 +193,12 @@ func TestEKSAuditLogFetcher_ContinueOnError(t *testing.T) {
 	})
 }
 
-func newKubeAuditLogResponseResumeState(cursor *accessgraphv1alpha.KubeAuditLogCursor) *kalsResponse {
-	return &kalsResponse{
-		State: &accessgraphv1alpha.KubeAuditLogStreamResponse_ResumeState{
-			ResumeState: &accessgraphv1alpha.KubeAuditLogResumeState{
-				Cursor: cursor,
-			},
-		},
-	}
+func newKubeAuditLogResponseResumeState(cursor *accessgraphv1alpha.KubeAuditLogCursor) *accessgraphv1alpha.KubeAuditLogStreamResponse {
+	return accessgraphv1alpha.KubeAuditLogStreamResponse_builder{
+		ResumeState: accessgraphv1alpha.KubeAuditLogResumeState_builder{
+			Cursor: cursor,
+		}.Build(),
+	}.Build()
 }
 
 func makeEvent(t time.Time, id int, msg string) cwltypes.FilteredLogEvent {
diff --git a/lib/srv/discovery/eks_audit_log_watcher.go b/lib/srv/discovery/eks_audit_log_watcher.go
index 87c3a7db536..e955613238b 100644
--- a/lib/srv/discovery/eks_audit_log_watcher.go
+++ b/lib/srv/discovery/eks_audit_log_watcher.go
@@ -212,7 +212,7 @@ func (w *eksAuditLogWatcher) reconcile(ctx context.Context, clusters []eksAuditL
 	// the existing clusters we are fetching audit logs for.
 	discoveredClusters := make(map[string]eksAuditLogCluster)
 	for _, discovered := range clusters {
-		discoveredClusters[discovered.cluster.Arn] = discovered
+		discoveredClusters[discovered.cluster.GetArn()] = discovered
 	}
 	// Stop any fetchers for clusters we are running a fetcher for that discovery did not return.
 	for arn, fetcherCancel := range mapDifference(w.fetchers, discoveredClusters) {
diff --git a/lib/srv/discovery/eks_audit_log_watcher_test.go b/lib/srv/discovery/eks_audit_log_watcher_test.go
index 5d592d8c7bd..5c94c606c3c 100644
--- a/lib/srv/discovery/eks_audit_log_watcher_test.go
+++ b/lib/srv/discovery/eks_audit_log_watcher_test.go
@@ -35,10 +35,8 @@ import (
 )
 
 type (
-	kalsRequest  = accessgraphv1alpha.KubeAuditLogStreamRequest
-	kalsResponse = accessgraphv1alpha.KubeAuditLogStreamResponse
-	kalsClient   = grpc.BidiStreamingClient[kalsRequest, kalsResponse]
-	kalsServer   = grpc.BidiStreamingServer[kalsRequest, kalsResponse]
+	kalsClient = grpc.BidiStreamingClient[accessgraphv1alpha.KubeAuditLogStreamRequest, accessgraphv1alpha.KubeAuditLogStreamResponse]
+	kalsServer = grpc.BidiStreamingServer[accessgraphv1alpha.KubeAuditLogStreamRequest, accessgraphv1alpha.KubeAuditLogStreamResponse]
 )
 
 func TestEKSAuditLogWatcher_Init(t *testing.T) {
@@ -86,7 +84,7 @@ func TestEKSAuditLogWatcher_Reconcile(t *testing.T) {
 		require.NoError(t, err)
 
 		// Send a single cluster1 to the watcher to reconcile
-		cluster1 := &accessgraphv1alpha.AWSEKSClusterV1{Arn: "test-arn"}
+		cluster1 := accessgraphv1alpha.AWSEKSClusterV1_builder{Arn: "test-arn"}.Build()
 		fetcher1 := &aws_sync.Fetcher{}
 		watcher.Reconcile(ctx, []eksAuditLogCluster{{fetcher1, cluster1}})
 		synctest.Wait()
@@ -101,7 +99,7 @@ func TestEKSAuditLogWatcher_Reconcile(t *testing.T) {
 		require.Equal(t, 1, fetcherTracker.newCount)
 
 		// Add another cluster
-		cluster2 := &accessgraphv1alpha.AWSEKSClusterV1{Arn: "test-arn2"}
+		cluster2 := accessgraphv1alpha.AWSEKSClusterV1_builder{Arn: "test-arn2"}.Build()
 		fetcher2 := &aws_sync.Fetcher{}
 		watcher.Reconcile(ctx, []eksAuditLogCluster{{fetcher1, cluster1}, {fetcher2, cluster2}})
 		synctest.Wait()
@@ -166,7 +164,7 @@ func TestEKSAuditLogWatcher_ReconcileWhileDisabled(t *testing.T) {
 		require.NotNil(t, clientStream.sentReqs[0].GetConfig())
 
 		// Send a single cluster1 to the watcher to reconcile
-		cluster1 := &accessgraphv1alpha.AWSEKSClusterV1{Arn: "test-arn"}
+		cluster1 := accessgraphv1alpha.AWSEKSClusterV1_builder{Arn: "test-arn"}.Build()
 		fetcher1 := &aws_sync.Fetcher{}
 		watcher.Reconcile(ctx, []eksAuditLogCluster{{fetcher1, cluster1}})
 		synctest.Wait()
@@ -210,12 +208,12 @@ func (fft *fakeFetcherTracker) newFetcher(
 		cleanup: func() {
 			fft.mu.Lock()
 			defer fft.mu.Unlock()
-			delete(fft.fetchers, cluster.Arn)
+			delete(fft.fetchers, cluster.GetArn())
 		},
 	}
 	fft.mu.Lock()
 	defer fft.mu.Unlock()
-	fft.fetchers[cluster.Arn] = f
+	fft.fetchers[cluster.GetArn()] = f
 	fft.newCount++
 	return f
 }
@@ -236,8 +234,8 @@ func (f *fakeEksAuditLogFetcher) Run(ctx context.Context) error {
 	return ctx.Err()
 }
 
-func newKubeAuditLogResponseConfig(cfg *accessgraphv1alpha.KubeAuditLogConfig) *kalsResponse {
-	return &kalsResponse{
+func newKubeAuditLogResponseConfig(cfg *accessgraphv1alpha.KubeAuditLogConfig) *accessgraphv1alpha.KubeAuditLogStreamResponse {
+	return &accessgraphv1alpha.KubeAuditLogStreamResponse{
 		State: &accessgraphv1alpha.KubeAuditLogStreamResponse_Config{
 			Config: cfg,
 		},
@@ -245,7 +243,7 @@ func newKubeAuditLogResponseConfig(cfg *accessgraphv1alpha.KubeAuditLogConfig) *
 }
 
 func newFakeKubeAuditLogClient(ctx context.Context) *fakeKubeAuditLogClient {
-	tester := grpctest.NewGRPCTester[kalsRequest, kalsResponse](ctx)
+	tester := grpctest.NewGRPCTester[accessgraphv1alpha.KubeAuditLogStreamRequest, accessgraphv1alpha.KubeAuditLogStreamResponse](ctx)
 	return &fakeKubeAuditLogClient{
 		clientStream: tester.NewClientStream(),
 		serverStream: tester.NewServerStream(),
@@ -274,15 +272,15 @@ func (c *fakeKubeAuditLogClient) KubeAuditLogStream(ctx context.Context, opts ..
 // implemented. For now if those methods are called, it will panic.
 type failingKubeAuditLogStream struct {
 	grpc.ClientStream
-	sentReqs []*kalsRequest
+	sentReqs []*accessgraphv1alpha.KubeAuditLogStreamRequest
 	recvErr  error
 }
 
-func (s *failingKubeAuditLogStream) Send(req *kalsRequest) error {
+func (s *failingKubeAuditLogStream) Send(req *accessgraphv1alpha.KubeAuditLogStreamRequest) error {
 	s.sentReqs = append(s.sentReqs, req)
 	return nil
 }
 
-func (s *failingKubeAuditLogStream) Recv() (*kalsResponse, error) {
+func (s *failingKubeAuditLogStream) Recv() (*accessgraphv1alpha.KubeAuditLogStreamResponse, error) {
 	return nil, s.recvErr
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/ec2.go b/lib/srv/discovery/fetchers/aws-sync/ec2.go
index afc12249ec9..78e73f2a814 100644
--- a/lib/srv/discovery/fetchers/aws-sync/ec2.go
+++ b/lib/srv/discovery/fetchers/aws-sync/ec2.go
@@ -84,7 +84,7 @@ func (a *Fetcher) fetchAWSEC2Instances(ctx context.Context) ([]*accessgraphv1alp
 			prevIterationEc2 := sliceFilter(
 				existing,
 				func(h *accessgraphv1alpha.AWSInstanceV1) bool {
-					return h.Region == region && h.AccountId == a.AccountID
+					return h.GetRegion() == region && h.GetAccountId() == a.AccountID
 				},
 			)
 			ec2Client, err := a.GetEC2Client(ctx, region, a.getAWSOptions()...)
@@ -123,17 +123,17 @@ func (a *Fetcher) fetchAWSEC2Instances(ctx context.Context) ([]*accessgraphv1alp
 func awsInstanceToProtoInstance(instance ec2types.Instance, region string, accountID string) *accessgraphv1alpha.AWSInstanceV1 {
 	var tags []*accessgraphv1alpha.AWSTag
 	for _, tag := range instance.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(tag.Key),
 			Value: strPtrToWrapper(tag.Value),
-		})
+		}.Build())
 	}
 
 	var instanceProfileMetadata *wrapperspb.StringValue
 	if instance.IamInstanceProfile != nil {
 		instanceProfileMetadata = strPtrToWrapper(instance.IamInstanceProfile.Arn)
 	}
-	return &accessgraphv1alpha.AWSInstanceV1{
+	return accessgraphv1alpha.AWSInstanceV1_builder{
 		InstanceId:            aws.ToString(instance.InstanceId),
 		Region:                region,
 		PublicDnsName:         aws.ToString(instance.PublicDnsName),
@@ -142,7 +142,7 @@ func awsInstanceToProtoInstance(instance ec2types.Instance, region string, accou
 		AccountId:             accountID,
 		Tags:                  tags,
 		LaunchTime:            awsTimeToProtoTime(instance.LaunchTime),
-	}
+	}.Build()
 }
 
 // fetchInstanceProfiles fetches instance profiles from all regions and returns them
@@ -187,13 +187,13 @@ func (a *Fetcher) fetchInstanceProfiles(ctx context.Context) ([]*accessgraphv1al
 func awsInstanceProfileToProtoInstanceProfile(profile iamtypes.InstanceProfile, accountID string) *accessgraphv1alpha.AWSInstanceProfileV1 {
 	tags := make([]*accessgraphv1alpha.AWSTag, 0, len(profile.Tags))
 	for _, tag := range profile.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(tag.Key),
 			Value: strPtrToWrapper(tag.Value),
-		})
+		}.Build())
 	}
 
-	out := &accessgraphv1alpha.AWSInstanceProfileV1{
+	out := accessgraphv1alpha.AWSInstanceProfileV1_builder{
 		InstanceProfileId:   aws.ToString(profile.InstanceProfileId),
 		InstanceProfileName: aws.ToString(profile.InstanceProfileName),
 		Arn:                 aws.ToString(profile.Arn),
@@ -201,9 +201,9 @@ func awsInstanceProfileToProtoInstanceProfile(profile iamtypes.InstanceProfile,
 		AccountId:           accountID,
 		Tags:                tags,
 		CreatedAt:           awsTimeToProtoTime(profile.CreateDate),
-	}
+	}.Build()
 	for _, role := range profile.Roles {
-		out.Roles = append(out.Roles, awsRoleToProtoRole(role, accountID))
+		out.SetRoles(append(out.GetRoles(), awsRoleToProtoRole(role, accountID)))
 	}
 	return out
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/ec2_test.go b/lib/srv/discovery/fetchers/aws-sync/ec2_test.go
index 48b26d7d0ed..478b8d0481d 100644
--- a/lib/srv/discovery/fetchers/aws-sync/ec2_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/ec2_test.go
@@ -109,15 +109,15 @@ func TestFetchAWSEC2InstancesMultipleRegions(t *testing.T) {
 	// Verify each region's instances are present with correct region/account metadata.
 	byID := make(map[string]*accessgraphv1alpha.AWSInstanceV1, len(instances))
 	for _, inst := range instances {
-		byID[inst.InstanceId] = inst
+		byID[inst.GetInstanceId()] = inst
 	}
 	for region, regionInstances := range instancesByRegion {
 		for _, ec2inst := range regionInstances {
 			id := aws.ToString(ec2inst.InstanceId)
 			got, ok := byID[id]
 			require.True(t, ok, "expected instance %s to be present", id)
-			require.Equal(t, region, got.Region)
-			require.Equal(t, accountID, got.AccountId)
+			require.Equal(t, region, got.GetRegion())
+			require.Equal(t, accountID, got.GetAccountId())
 		}
 	}
 }
@@ -131,7 +131,7 @@ func TestFetchAWSEC2InstancesClientError(t *testing.T) {
 	regions := []string{"us-east-1", "us-west-2"}
 
 	existingInstances := []*accessgraphv1alpha.AWSInstanceV1{
-		{InstanceId: "i-existing", Region: "us-east-1", AccountId: accountID},
+		accessgraphv1alpha.AWSInstanceV1_builder{InstanceId: "i-existing", Region: "us-east-1", AccountId: accountID}.Build(),
 	}
 
 	getEC2Client := func(_ context.Context, region string, _ ...awsconfig.OptionsFn) (ec2.DescribeInstancesAPIClient, error) {
@@ -167,7 +167,7 @@ func TestFetchAWSEC2InstancesClientError(t *testing.T) {
 
 	byID := make(map[string]*accessgraphv1alpha.AWSInstanceV1, len(instances))
 	for _, inst := range instances {
-		byID[inst.InstanceId] = inst
+		byID[inst.GetInstanceId()] = inst
 	}
 	require.Contains(t, byID, "i-existing")
 	require.Contains(t, byID, "i-us-west-2a")
@@ -180,7 +180,7 @@ func TestFetchInstanceProfilesErrorReturnsExisting(t *testing.T) {
 	const accountID = "123456789012"
 
 	existingProfiles := []*accessgraphv1alpha.AWSInstanceProfileV1{
-		{InstanceProfileId: "profile-existing", AccountId: accountID},
+		accessgraphv1alpha.AWSInstanceProfileV1_builder{InstanceProfileId: "profile-existing", AccountId: accountID}.Build(),
 	}
 
 	a := &Fetcher{
@@ -243,7 +243,7 @@ func TestFetchInstanceProfilesSuccess(t *testing.T) {
 
 	byID := make(map[string]*accessgraphv1alpha.AWSInstanceProfileV1, len(profiles))
 	for _, p := range profiles {
-		byID[p.InstanceProfileId] = p
+		byID[p.GetInstanceProfileId()] = p
 	}
 	require.Contains(t, byID, "AIPA1")
 	require.Contains(t, byID, "AIPA2")
diff --git a/lib/srv/discovery/fetchers/aws-sync/eks.go b/lib/srv/discovery/fetchers/aws-sync/eks.go
index 0af4b113bcd..17b70e5a629 100644
--- a/lib/srv/discovery/fetchers/aws-sync/eks.go
+++ b/lib/srv/discovery/fetchers/aws-sync/eks.go
@@ -113,13 +113,13 @@ func (a *Fetcher) fetchAWSSEKSClusters(ctx context.Context) (fetchAWSEKSClusters
 				out, err := p.NextPage(ctx)
 				if err != nil {
 					oldEKSClusters := sliceFilter(existing.EKSClusters, func(cluster *accessgraphv1alpha.AWSEKSClusterV1) bool {
-						return cluster.Region == region && cluster.AccountId == a.AccountID
+						return cluster.GetRegion() == region && cluster.GetAccountId() == a.AccountID
 					})
 					oldAccessEntries := sliceFilter(existing.AccessEntries, func(ae *accessgraphv1alpha.AWSEKSClusterAccessEntryV1) bool {
-						return ae.Cluster.Region == region && ae.AccountId == a.AccountID
+						return ae.GetCluster().GetRegion() == region && ae.GetAccountId() == a.AccountID
 					})
 					oldAssociatedPolicies := sliceFilter(existing.AssociatedAccessPolicies, func(ap *accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1) bool {
-						return ap.Cluster.Region == region && ap.AccountId == a.AccountID
+						return ap.GetCluster().GetRegion() == region && ap.GetAccountId() == a.AccountID
 					})
 					hostsMu.Lock()
 					output.clusters = append(output.clusters, oldEKSClusters...)
@@ -133,13 +133,13 @@ func (a *Fetcher) fetchAWSSEKSClusters(ctx context.Context) (fetchAWSEKSClusters
 
 			for _, cluster := range eksClusterNames {
 				oldCluster := sliceFilterPickFirst(existing.EKSClusters, func(c *accessgraphv1alpha.AWSEKSClusterV1) bool {
-					return c.Name == cluster && c.AccountId == a.AccountID && c.Region == region
+					return c.GetName() == cluster && c.GetAccountId() == a.AccountID && c.GetRegion() == region
 				})
 				oldAccessEntries := sliceFilter(existing.AccessEntries, func(ae *accessgraphv1alpha.AWSEKSClusterAccessEntryV1) bool {
-					return ae.Cluster.Name == cluster && ae.AccountId == a.AccountID && ae.Cluster.Region == region
+					return ae.GetCluster().GetName() == cluster && ae.GetAccountId() == a.AccountID && ae.GetCluster().GetRegion() == region
 				})
 				oldAssociatedPolicies := sliceFilter(existing.AssociatedAccessPolicies, func(ap *accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1) bool {
-					return ap.Cluster.Name == cluster && ap.AccountId == a.AccountID && ap.Cluster.Region == region
+					return ap.GetCluster().GetName() == cluster && ap.GetAccountId() == a.AccountID && ap.GetCluster().GetRegion() == region
 				})
 				// DescribeClusterWithContext retrieves the cluster details.
 				cluster, err := eksClient.DescribeCluster(ctx, &eks.DescribeClusterInput{
@@ -169,7 +169,7 @@ func (a *Fetcher) fetchAWSSEKSClusters(ctx context.Context) (fetchAWSEKSClusters
 				for _, accessEntry := range accessEntries {
 					accessEntryARNs = append(
 						accessEntryARNs,
-						accessEntry.PrincipalArn,
+						accessEntry.GetPrincipalArn(),
 					)
 				}
 
@@ -192,13 +192,13 @@ func (a *Fetcher) fetchAWSSEKSClusters(ctx context.Context) (fetchAWSEKSClusters
 func awsEKSClusterToProtoCluster(cluster *ekstypes.Cluster, region, accountID string) *accessgraphv1alpha.AWSEKSClusterV1 {
 	var tags []*accessgraphv1alpha.AWSTag
 	for k, v := range cluster.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   k,
 			Value: wrapperspb.String(v),
-		})
+		}.Build())
 	}
 
-	return &accessgraphv1alpha.AWSEKSClusterV1{
+	return accessgraphv1alpha.AWSEKSClusterV1_builder{
 		Name:      aws.ToString(cluster.Name),
 		Arn:       aws.ToString(cluster.Arn),
 		CreatedAt: awsTimeToProtoTime(cluster.CreatedAt),
@@ -206,7 +206,7 @@ func awsEKSClusterToProtoCluster(cluster *ekstypes.Cluster, region, accountID st
 		Region:    region,
 		AccountId: accountID,
 		Tags:      tags,
-	}
+	}.Build()
 }
 
 // fetchAccessEntries fetches the access entries for the given cluster.
@@ -214,7 +214,7 @@ func (a *Fetcher) fetchAccessEntries(ctx context.Context, eksClient EKSClient, c
 	var accessEntries []string
 
 	for p := eks.NewListAccessEntriesPaginator(eksClient,
-		&eks.ListAccessEntriesInput{ClusterName: aws.String(cluster.Name)},
+		&eks.ListAccessEntriesInput{ClusterName: aws.String(cluster.GetName())},
 	); p.HasMorePages(); {
 		out, err := p.NextPage(ctx)
 		if err != nil {
@@ -230,7 +230,7 @@ func (a *Fetcher) fetchAccessEntries(ctx context.Context, eksClient EKSClient, c
 			ctx,
 			&eks.DescribeAccessEntryInput{
 				PrincipalArn: aws.String(accessEntry),
-				ClusterName:  aws.String(cluster.Name),
+				ClusterName:  aws.String(cluster.GetName()),
 			},
 		)
 		if err != nil {
@@ -252,13 +252,13 @@ func (a *Fetcher) fetchAccessEntries(ctx context.Context, eksClient EKSClient, c
 func awsAccessEntryToProtoAccessEntry(accessEntry *ekstypes.AccessEntry, cluster *accessgraphv1alpha.AWSEKSClusterV1, accountID string) *accessgraphv1alpha.AWSEKSClusterAccessEntryV1 {
 	tags := make([]*accessgraphv1alpha.AWSTag, 0, len(accessEntry.Tags))
 	for k, v := range accessEntry.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   k,
 			Value: wrapperspb.String(v),
-		})
+		}.Build())
 	}
 
-	return &accessgraphv1alpha.AWSEKSClusterAccessEntryV1{
+	return accessgraphv1alpha.AWSEKSClusterAccessEntryV1_builder{
 		Cluster:          cluster,
 		AccessEntryArn:   aws.ToString(accessEntry.AccessEntryArn),
 		CreatedAt:        awsTimeToProtoTime(accessEntry.CreatedAt),
@@ -269,7 +269,7 @@ func awsAccessEntryToProtoAccessEntry(accessEntry *ekstypes.AccessEntry, cluster
 		Type:             aws.ToString(accessEntry.Type),
 		Tags:             tags,
 		AccountId:        accountID,
-	}
+	}.Build()
 }
 
 // fetchAccessEntries fetches the access entries for the given cluster.
@@ -280,7 +280,7 @@ func (a *Fetcher) fetchAssociatedPolicies(ctx context.Context, eksClient EKSClie
 	for _, arn := range arns {
 		for p := eks.NewListAssociatedAccessPoliciesPaginator(eksClient,
 			&eks.ListAssociatedAccessPoliciesInput{
-				ClusterName:  aws.String(cluster.Name),
+				ClusterName:  aws.String(cluster.GetName()),
 				PrincipalArn: aws.String(arn),
 			},
 		); p.HasMorePages(); {
@@ -304,13 +304,13 @@ func (a *Fetcher) fetchAssociatedPolicies(ctx context.Context, eksClient EKSClie
 func awsAssociatedAccessPolicy(policy ekstypes.AssociatedAccessPolicy, cluster *accessgraphv1alpha.AWSEKSClusterV1, principalARN, accountID string) *accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1 {
 	var accessScope *accessgraphv1alpha.AWSEKSAccessScopeV1
 	if policy.AccessScope != nil {
-		accessScope = &accessgraphv1alpha.AWSEKSAccessScopeV1{
+		accessScope = accessgraphv1alpha.AWSEKSAccessScopeV1_builder{
 			Namespaces: policy.AccessScope.Namespaces,
 			Type:       string(policy.AccessScope.Type),
-		}
+		}.Build()
 	}
 
-	return &accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1{
+	return accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1_builder{
 		Cluster:      cluster,
 		AssociatedAt: awsTimeToProtoTime(policy.AssociatedAt),
 		ModifiedAt:   awsTimeToProtoTime(policy.ModifiedAt),
@@ -318,5 +318,5 @@ func awsAssociatedAccessPolicy(policy ekstypes.AssociatedAccessPolicy, cluster *
 		PolicyArn:    aws.ToString(policy.PolicyArn),
 		Scope:        accessScope,
 		AccountId:    accountID,
-	}
+	}.Build()
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/eks_test.go b/lib/srv/discovery/fetchers/aws-sync/eks_test.go
index c0ceeacdb9a..477e442a9f7 100644
--- a/lib/srv/discovery/fetchers/aws-sync/eks_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/eks_test.go
@@ -110,24 +110,24 @@ func TestPollAWSEKSClusters(t *testing.T) {
 		accountID = "12345678"
 	)
 	regions := []string{"eu-west-1"}
-	cluster := &accessgraphv1alpha.AWSEKSClusterV1{
+	cluster := accessgraphv1alpha.AWSEKSClusterV1_builder{
 		Name:      "cluster1",
 		Arn:       "arn:us-west1:eks:cluster1",
 		CreatedAt: timestamppb.New(date),
 		Status:    "ACTIVE",
 		Tags: []*accessgraphv1alpha.AWSTag{
-			{
+			accessgraphv1alpha.AWSTag_builder{
 				Key:   "tag1",
 				Value: wrapperspb.String(""),
-			},
-			{
+			}.Build(),
+			accessgraphv1alpha.AWSTag_builder{
 				Key:   "tag2",
 				Value: wrapperspb.String("val2"),
-			},
+			}.Build(),
 		},
 		Region:    "eu-west-1",
 		AccountId: "12345678",
-	}
+	}.Build()
 	tests := []struct {
 		name string
 		want *Resources
@@ -139,7 +139,7 @@ func TestPollAWSEKSClusters(t *testing.T) {
 					cluster,
 				},
 				AccessEntries: []*accessgraphv1alpha.AWSEKSClusterAccessEntryV1{
-					{
+					accessgraphv1alpha.AWSEKSClusterAccessEntryV1_builder{
 						Cluster:          cluster,
 						AccessEntryArn:   "arn:iam:access_entry",
 						CreatedAt:        timestamppb.New(date),
@@ -147,29 +147,29 @@ func TestPollAWSEKSClusters(t *testing.T) {
 						ModifiedAt:       timestamppb.New(date),
 						PrincipalArn:     "arn:iam:teleport",
 						Tags: []*accessgraphv1alpha.AWSTag{
-							{
+							accessgraphv1alpha.AWSTag_builder{
 								Key:   "t1",
 								Value: wrapperspb.String("t2"),
-							},
+							}.Build(),
 						},
 						Type:      "cluster",
 						Username:  "teleport",
 						AccountId: "12345678",
-					},
+					}.Build(),
 				},
 				AssociatedAccessPolicies: []*accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1{
-					{
+					accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1_builder{
 						Cluster:      cluster,
 						PrincipalArn: principalARN,
-						Scope: &accessgraphv1alpha.AWSEKSAccessScopeV1{
+						Scope: accessgraphv1alpha.AWSEKSAccessScopeV1_builder{
 							Type:       string(ekstypes.AccessScopeTypeCluster),
 							Namespaces: []string{"ns1"},
-						},
+						}.Build(),
 						AssociatedAt: timestamppb.New(date),
 						ModifiedAt:   timestamppb.New(date),
 						PolicyArn:    "policy_arn",
 						AccountId:    "12345678",
-					},
+					}.Build(),
 				},
 			},
 		},
@@ -216,7 +216,7 @@ func TestPollAWSEKSClusters(t *testing.T) {
 				// Tags originate from a map so we must sort them before comparing.
 				protocmp.SortRepeated(
 					func(a, b *accessgraphv1alpha.AWSTag) bool {
-						return a.Key < b.Key
+						return a.GetKey() < b.GetKey()
 					},
 				),
 			))
diff --git a/lib/srv/discovery/fetchers/aws-sync/groups.go b/lib/srv/discovery/fetchers/aws-sync/groups.go
index 562b7ddfd5a..db7843bd346 100644
--- a/lib/srv/discovery/fetchers/aws-sync/groups.go
+++ b/lib/srv/discovery/fetchers/aws-sync/groups.go
@@ -56,17 +56,17 @@ func (a *Fetcher) pollAWSGroups(ctx context.Context, result *Resources, collectE
 				groupInlinePolicies, err := a.fetchGroupInlinePolicies(ctx, group)
 				if err != nil {
 					groupInlinePolicies = sliceFilter(existing.GroupInlinePolicies, func(inline *accessgraphv1alpha.AWSGroupInlinePolicyV1) bool {
-						return inline.Group.Name == group.Name && inline.Group.AccountId == group.AccountId
+						return inline.GetGroup().GetName() == group.GetName() && inline.GetGroup().GetAccountId() == group.GetAccountId()
 					})
-					collectErr(trace.Wrap(err, "failed to fetch group %q inline policies", group.Name))
+					collectErr(trace.Wrap(err, "failed to fetch group %q inline policies", group.GetName()))
 				}
 
 				groupAttachedPolicies, err := a.fetchGroupAttachedPolicies(ctx, group)
 				if err != nil {
 					groupAttachedPolicies = sliceFilterPickFirst(existing.GroupAttachedPolicies, func(inline *accessgraphv1alpha.AWSGroupAttachedPolicies) bool {
-						return inline.Group.Name == group.Name && inline.Group.AccountId == group.AccountId
+						return inline.GetGroup().GetName() == group.GetName() && inline.GetGroup().GetAccountId() == group.GetAccountId()
 					})
-					collectErr(trace.Wrap(err, "failed to fetch group %q attached policies", group.Name))
+					collectErr(trace.Wrap(err, "failed to fetch group %q attached policies", group.GetName()))
 				}
 
 				groupsMu.Lock()
@@ -123,14 +123,14 @@ func (a *Fetcher) fetchGroups(ctx context.Context) ([]*accessgraphv1alpha.AWSGro
 
 // awsGroupToProtoGroup converts an AWS IAM group to a proto group.
 func awsGroupToProtoGroup(group iamtypes.Group, accountID string) *accessgraphv1alpha.AWSGroupV1 {
-	return &accessgraphv1alpha.AWSGroupV1{
+	return accessgraphv1alpha.AWSGroupV1_builder{
 		Name:      aws.ToString(group.GroupName),
 		Arn:       aws.ToString(group.Arn),
 		Path:      aws.ToString(group.Path),
 		GroupId:   aws.ToString(group.GroupId),
 		CreatedAt: awsTimeToProtoTime(group.CreateDate),
 		AccountId: accountID,
-	}
+	}.Build()
 }
 
 // fetchGroupInlinePolicies fetches inline policies for a group and returns them
@@ -150,7 +150,7 @@ func (a *Fetcher) fetchGroupInlinePolicies(ctx context.Context, group *accessgra
 	pager := iam.NewListGroupPoliciesPaginator(
 		iamClient,
 		&iam.ListGroupPoliciesInput{
-			GroupName: aws.String(group.Name),
+			GroupName: aws.String(group.GetName()),
 			MaxItems:  aws.Int32(pageSize),
 		},
 		func(opts *iam.ListGroupPoliciesPaginatorOptions) {
@@ -170,11 +170,11 @@ func (a *Fetcher) fetchGroupInlinePolicies(ctx context.Context, group *accessgra
 		}
 		for _, policyName := range page.PolicyNames {
 			policy, err := iamClient.GetGroupPolicy(ctx, &iam.GetGroupPolicyInput{
-				GroupName:  aws.String(group.Name),
+				GroupName:  aws.String(group.GetName()),
 				PolicyName: aws.String(policyName),
 			})
 			if err != nil {
-				errCollect(trace.Wrap(err, "failed to fetch group %q inline policy %q", group.Name, policyName))
+				errCollect(trace.Wrap(err, "failed to fetch group %q inline policy %q", group.GetName(), policyName))
 				continue
 			}
 			policies = append(policies, awsGroupPolicyToProtoGroupPolicy(policy, a.AccountID, group))
@@ -184,12 +184,12 @@ func (a *Fetcher) fetchGroupInlinePolicies(ctx context.Context, group *accessgra
 }
 
 func awsGroupPolicyToProtoGroupPolicy(policy *iam.GetGroupPolicyOutput, accountID string, group *accessgraphv1alpha.AWSGroupV1) *accessgraphv1alpha.AWSGroupInlinePolicyV1 {
-	return &accessgraphv1alpha.AWSGroupInlinePolicyV1{
+	return accessgraphv1alpha.AWSGroupInlinePolicyV1_builder{
 		PolicyName:     aws.ToString(policy.PolicyName),
 		PolicyDocument: []byte(aws.ToString(policy.PolicyDocument)),
 		Group:          group,
 		AccountId:      accountID,
-	}
+	}.Build()
 }
 
 // fetchGroupAttachedPolicies fetches attached policies for a group.
@@ -206,7 +206,7 @@ func (a *Fetcher) fetchGroupAttachedPolicies(ctx context.Context, group *accessg
 	pager := iam.NewListAttachedGroupPoliciesPaginator(
 		iamClient,
 		&iam.ListAttachedGroupPoliciesInput{
-			GroupName: aws.String(group.Name),
+			GroupName: aws.String(group.GetName()),
 			MaxItems:  aws.Int32(pageSize),
 		},
 		func(opts *iam.ListAttachedGroupPoliciesPaginatorOptions) {
@@ -214,23 +214,23 @@ func (a *Fetcher) fetchGroupAttachedPolicies(ctx context.Context, group *accessg
 		},
 	)
 
-	rsp := &accessgraphv1alpha.AWSGroupAttachedPolicies{
+	rsp := accessgraphv1alpha.AWSGroupAttachedPolicies_builder{
 		Group:     group,
 		AccountId: a.AccountID,
-	}
+	}.Build()
 	for pager.HasMorePages() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return rsp, trace.Wrap(err)
 		}
 		for _, policy := range page.AttachedPolicies {
-			rsp.Policies = append(
-				rsp.Policies,
-				&accessgraphv1alpha.AttachedPolicyV1{
+			rsp.SetPolicies(append(
+				rsp.GetPolicies(),
+				accessgraphv1alpha.AttachedPolicyV1_builder{
 					Arn:        aws.ToString(policy.PolicyArn),
 					PolicyName: aws.ToString(policy.PolicyName),
-				},
-			)
+				}.Build(),
+			))
 		}
 	}
 	return rsp, trace.Wrap(err)
diff --git a/lib/srv/discovery/fetchers/aws-sync/iam_test.go b/lib/srv/discovery/fetchers/aws-sync/iam_test.go
index 01185a153e2..89e989cadc8 100644
--- a/lib/srv/discovery/fetchers/aws-sync/iam_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/iam_test.go
@@ -85,26 +85,26 @@ func TestAWSIAMPollSAMLProviders(t *testing.T) {
 		lastResult: &Resources{},
 	}
 	expected := []*accessgraphv1alpha.AWSSAMLProviderV1{
-		{
+		accessgraphv1alpha.AWSSAMLProviderV1_builder{
 			Arn:        "arn:aws:iam::1234678:saml-provider/provider1",
 			CreatedAt:  timestamppb.New(timestamp1),
 			ValidUntil: timestamppb.New(timestamp2),
 			Tags: []*accessgraphv1alpha.AWSTag{
-				{Key: "key1", Value: &wrapperspb.StringValue{Value: "value1"}},
-				{Key: "key2", Value: &wrapperspb.StringValue{Value: "value2"}},
+				accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: &wrapperspb.StringValue{Value: "value1"}}.Build(),
+				accessgraphv1alpha.AWSTag_builder{Key: "key2", Value: &wrapperspb.StringValue{Value: "value2"}}.Build(),
 			},
 			AccountId:           accountID,
 			EntityId:            "provider1",
 			SsoUrls:             []string{"https://posturl.example.com", "https://redirecturl.example.com"},
 			SigningCertificates: []string{"cert1", "cert2"},
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AWSSAMLProviderV1_builder{
 			Arn:       "arn:aws:iam::1234678:saml-provider/provider2",
 			CreatedAt: timestamppb.New(timestamp2),
 			AccountId: accountID,
 			EntityId:  "provider2",
 			SsoUrls:   []string{"https://posturl.teleport.local", "https://redirecturl.teleport.local"},
-		},
+		}.Build(),
 	}
 	result := &Resources{}
 	execFunc := a.pollAWSSAMLProviders(context.Background(), result, collectErr)
@@ -237,24 +237,24 @@ func TestAWSIAMPollOIDCProviders(t *testing.T) {
 		lastResult: &Resources{},
 	}
 	expected := []*accessgraphv1alpha.AWSOIDCProviderV1{
-		{
+		accessgraphv1alpha.AWSOIDCProviderV1_builder{
 			Arn:       "arn:aws:iam::1234678:oidc-provider/provider1",
 			CreatedAt: timestamppb.New(timestamp1),
 			Tags: []*accessgraphv1alpha.AWSTag{
-				{Key: "key1", Value: &wrapperspb.StringValue{Value: "value1"}},
-				{Key: "key2", Value: &wrapperspb.StringValue{Value: "value2"}},
+				accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: &wrapperspb.StringValue{Value: "value1"}}.Build(),
+				accessgraphv1alpha.AWSTag_builder{Key: "key2", Value: &wrapperspb.StringValue{Value: "value2"}}.Build(),
 			},
 			AccountId:   accountID,
 			ClientIds:   []string{"audience1", "audience2"},
 			Thumbprints: []string{"thumb1", "thumb2"},
 			Url:         "https://example.com",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AWSOIDCProviderV1_builder{
 			Arn:       "arn:aws:iam::1234678:oidc-provider/provider2",
 			CreatedAt: timestamppb.New(timestamp2),
 			AccountId: accountID,
 			Url:       "https://teleport.local",
-		},
+		}.Build(),
 	}
 	result := &Resources{}
 	execFunc := a.pollAWSOIDCProviders(context.Background(), result, collectErr)
diff --git a/lib/srv/discovery/fetchers/aws-sync/idp.go b/lib/srv/discovery/fetchers/aws-sync/idp.go
index be9d4516a09..55ccc1bbc7f 100644
--- a/lib/srv/discovery/fetchers/aws-sync/idp.go
+++ b/lib/srv/discovery/fetchers/aws-sync/idp.go
@@ -59,7 +59,7 @@ func (a *Fetcher) pollAWSSAMLProviders(ctx context.Context, result *Resources, c
 			if err != nil {
 				collectErr(trace.Wrap(err, "failed to get info for SAML provider %s", arn))
 				provider = sliceFilterPickFirst(existing.SAMLProviders, func(p *accessgraphv1alpha.AWSSAMLProviderV1) bool {
-					return p.Arn == arn
+					return p.GetArn() == arn
 				})
 			}
 			if provider != nil {
@@ -88,10 +88,10 @@ func (a *Fetcher) fetchAWSSAMLProvider(ctx context.Context, client iamClient, ar
 func awsSAMLProviderOutputToProto(arn string, accountID string, provider *iam.GetSAMLProviderOutput) (*accessgraphv1alpha.AWSSAMLProviderV1, error) {
 	var tags []*accessgraphv1alpha.AWSTag
 	for _, v := range provider.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(v.Key),
 			Value: strPtrToWrapper(v.Value),
-		})
+		}.Build())
 	}
 
 	var metadata samltypes.EntityDescriptor
@@ -118,7 +118,7 @@ func awsSAMLProviderOutputToProto(arn string, accountID string, provider *iam.Ge
 		}
 	}
 
-	return &accessgraphv1alpha.AWSSAMLProviderV1{
+	return accessgraphv1alpha.AWSSAMLProviderV1_builder{
 		Arn:                 arn,
 		CreatedAt:           awsTimeToProtoTime(provider.CreateDate),
 		ValidUntil:          awsTimeToProtoTime(provider.ValidUntil),
@@ -127,7 +127,7 @@ func awsSAMLProviderOutputToProto(arn string, accountID string, provider *iam.Ge
 		EntityId:            metadata.EntityID,
 		SsoUrls:             ssoURLs,
 		SigningCertificates: signingCerts,
-	}, nil
+	}.Build(), nil
 }
 
 func (a *Fetcher) pollAWSOIDCProviders(ctx context.Context, result *Resources, collectErr func(error)) func() error {
@@ -159,7 +159,7 @@ func (a *Fetcher) pollAWSOIDCProviders(ctx context.Context, result *Resources, c
 			if err != nil {
 				collectErr(trace.Wrap(err, "failed to get info for OIDC provider %s", arn))
 				provider = sliceFilterPickFirst(existing.OIDCProviders, func(p *accessgraphv1alpha.AWSOIDCProviderV1) bool {
-					return p.Arn == arn
+					return p.GetArn() == arn
 				})
 			}
 			if provider != nil {
@@ -188,13 +188,13 @@ func (a *Fetcher) fetchAWSOIDCProvider(ctx context.Context, client iamClient, ar
 func awsOIDCProviderOutputToProto(arn string, accountID string, provider *iam.GetOpenIDConnectProviderOutput) (*accessgraphv1alpha.AWSOIDCProviderV1, error) {
 	var tags []*accessgraphv1alpha.AWSTag
 	for _, v := range provider.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(v.Key),
 			Value: strPtrToWrapper(v.Value),
-		})
+		}.Build())
 	}
 
-	return &accessgraphv1alpha.AWSOIDCProviderV1{
+	return accessgraphv1alpha.AWSOIDCProviderV1_builder{
 		Arn:         arn,
 		CreatedAt:   awsTimeToProtoTime(provider.CreateDate),
 		Tags:        tags,
@@ -202,5 +202,5 @@ func awsOIDCProviderOutputToProto(arn string, accountID string, provider *iam.Ge
 		ClientIds:   provider.ClientIDList,
 		Thumbprints: provider.ThumbprintList,
 		Url:         aws.ToString(provider.Url),
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/kms.go b/lib/srv/discovery/fetchers/aws-sync/kms.go
index fe054e7e670..935285f1a61 100644
--- a/lib/srv/discovery/fetchers/aws-sync/kms.go
+++ b/lib/srv/discovery/fetchers/aws-sync/kms.go
@@ -176,24 +176,24 @@ func isAccessDeniedException(err error) bool {
 // library to the Teleport protobuf representation.
 func awsToProtoKMSKey(output *kms.DescribeKeyOutput, accountID, region, keyID string) *pb.AWSKMSKeyV1 {
 	if output == nil {
-		return &pb.AWSKMSKeyV1{
+		return pb.AWSKMSKeyV1_builder{
 			Arn:       fmt.Sprintf("arn:aws:kms:%s:%s:key/%s", region, accountID, keyID),
 			Region:    region,
 			AccountId: accountID,
-		}
+		}.Build()
 	}
 	var multiRegionType string
 	if cfg := output.KeyMetadata.MultiRegionConfiguration; cfg != nil {
 		multiRegionType = string(cfg.MultiRegionKeyType)
 	}
-	return &pb.AWSKMSKeyV1{
+	return pb.AWSKMSKeyV1_builder{
 		Arn:                aws.ToString(output.KeyMetadata.Arn),
 		CreatedAt:          awsTimeToProtoTime(output.KeyMetadata.CreationDate),
 		Region:             region,
 		AccountId:          accountID,
 		HsmClusterId:       aws.ToString(output.KeyMetadata.CloudHsmClusterId),
 		MultiRegionKeyType: multiRegionType,
-	}
+	}.Build()
 }
 
 // getKMSTags fetches tags for a KMS key. Potentially access rights to tags differ
@@ -209,10 +209,10 @@ func getKMSTags(ctx context.Context, client kmsClient, keyID string) ([]*pb.AWST
 			return nil, trace.Wrap(err, "failed to list tags for key %s", keyID)
 		}
 		for _, t := range page.Tags {
-			tag := &pb.AWSTag{
+			tag := pb.AWSTag_builder{
 				Key:   aws.ToString(t.TagKey),
 				Value: strPtrToWrapper(t.TagValue),
-			}
+			}.Build()
 			tags = append(tags, tag)
 		}
 	}
diff --git a/lib/srv/discovery/fetchers/aws-sync/kms_test.go b/lib/srv/discovery/fetchers/aws-sync/kms_test.go
index 1ce00ee9012..9e9db8c8e57 100644
--- a/lib/srv/discovery/fetchers/aws-sync/kms_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/kms_test.go
@@ -162,7 +162,7 @@ func TestPollAWSKMS(t *testing.T) {
 
 func requireResourceEqual(t *testing.T, want, got *Resources) {
 	tagCmp := func(a, b *pb.AWSTag) bool {
-		return a.Key < b.Key
+		return a.GetKey() < b.GetKey()
 	}
 	opts := []cmp.Option{
 		protocmp.Transform(),
@@ -207,10 +207,10 @@ func kmsMockToProto(c *mocks.KMSClient, accountID, region string) (*Resources, e
 		}
 		var tags []*pb.AWSTag
 		for key, val := range k.Tags {
-			tag := &pb.AWSTag{Key: key, Value: wrapperspb.String(val)}
+			tag := pb.AWSTag_builder{Key: key, Value: wrapperspb.String(val)}.Build()
 			tags = append(tags, tag)
 		}
-		key := &pb.AWSKMSKeyV1{
+		key := pb.AWSKMSKeyV1_builder{
 			Arn:                k.ARN,
 			CreatedAt:          timestamppb.New(k.CreationDate),
 			AccountId:          accountID,
@@ -220,10 +220,10 @@ func kmsMockToProto(c *mocks.KMSClient, accountID, region string) (*Resources, e
 			Aliases:            k.Aliases,
 			Tags:               tags,
 			MultiRegionKeyType: string(k.MultiType),
-		}
+		}.Build()
 		if k.DescribeKeyErr != nil {
-			key.Arn = fmt.Sprintf("arn:aws:kms:%s:%s:key/%s", region, accountID, keyID)
-			key.CreatedAt = nil
+			key.SetArn(fmt.Sprintf("arn:aws:kms:%s:%s:key/%s", region, accountID, keyID))
+			key.ClearCreatedAt()
 		}
 		keys = append(keys, key)
 		errs = append(errs, k.DescribeKeyErr, k.TagsErr, k.AliasesErr, k.PolicyErr)
diff --git a/lib/srv/discovery/fetchers/aws-sync/policies.go b/lib/srv/discovery/fetchers/aws-sync/policies.go
index 9071b57e268..31aca7a2704 100644
--- a/lib/srv/discovery/fetchers/aws-sync/policies.go
+++ b/lib/srv/discovery/fetchers/aws-sync/policies.go
@@ -94,7 +94,7 @@ func (a *Fetcher) fetchPolicies(ctx context.Context) ([]*accessgraphv1alpha.AWSP
 		eGroup.Go(func() error {
 			for _, policy := range page.Policies {
 				oldPolicy := sliceFilterPickFirst(existing.Policies, func(p *accessgraphv1alpha.AWSPolicyV1) bool {
-					return p.Arn == aws.ToString(policy.Arn) && p.AccountId == a.AccountID
+					return p.GetArn() == aws.ToString(policy.Arn) && p.GetAccountId() == a.AccountID
 				})
 				out, err := iamClient.GetPolicyVersion(ctx, &iam.GetPolicyVersionInput{
 					PolicyArn: policy.Arn,
@@ -123,12 +123,12 @@ func (a *Fetcher) fetchPolicies(ctx context.Context) ([]*accessgraphv1alpha.AWSP
 func awsPolicyToProtoPolicy(policy iamtypes.Policy, policyDoc []byte, accountID string) *accessgraphv1alpha.AWSPolicyV1 {
 	tags := make([]*accessgraphv1alpha.AWSTag, 0, len(policy.Tags))
 	for _, tag := range policy.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(tag.Key),
 			Value: strPtrToWrapper(tag.Value),
-		})
+		}.Build())
 	}
-	return &accessgraphv1alpha.AWSPolicyV1{
+	return accessgraphv1alpha.AWSPolicyV1_builder{
 		PolicyName:       aws.ToString(policy.PolicyName),
 		Arn:              aws.ToString(policy.Arn),
 		CreatedAt:        awsTimeToProtoTime(policy.CreateDate),
@@ -141,5 +141,5 @@ func awsPolicyToProtoPolicy(policy iamtypes.Policy, policyDoc []byte, accountID
 		Tags:             tags,
 		PolicyDocument:   policyDoc,
 		AccountId:        accountID,
-	}
+	}.Build()
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/rds.go b/lib/srv/discovery/fetchers/aws-sync/rds.go
index 3b34b141ec6..75d8d97bb4a 100644
--- a/lib/srv/discovery/fetchers/aws-sync/rds.go
+++ b/lib/srv/discovery/fetchers/aws-sync/rds.go
@@ -100,13 +100,13 @@ func (a *Fetcher) fetchAWSRDSDatabases(ctx context.Context) (
 func awsRDSInstanceToRDS(instance *rdstypes.DBInstance, region, accountID string) *accessgraphv1alpha.AWSRDSDatabaseV1 {
 	var tags []*accessgraphv1alpha.AWSTag
 	for _, v := range instance.TagList {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(v.Key),
 			Value: strPtrToWrapper(v.Value),
-		})
+		}.Build())
 	}
 
-	return &accessgraphv1alpha.AWSRDSDatabaseV1{
+	return accessgraphv1alpha.AWSRDSDatabaseV1_builder{
 		Name:      aws.ToString(instance.DBInstanceIdentifier),
 		Arn:       aws.ToString(instance.DBInstanceArn),
 		CreatedAt: awsTimeToProtoTime(instance.InstanceCreateTime),
@@ -114,13 +114,13 @@ func awsRDSInstanceToRDS(instance *rdstypes.DBInstance, region, accountID string
 		Region:    region,
 		AccountId: accountID,
 		Tags:      tags,
-		EngineDetails: &accessgraphv1alpha.AWSRDSEngineV1{
+		EngineDetails: accessgraphv1alpha.AWSRDSEngineV1_builder{
 			Engine:  aws.ToString(instance.Engine),
 			Version: aws.ToString(instance.EngineVersion),
-		},
+		}.Build(),
 		IsCluster:  false,
 		ResourceId: aws.ToString(instance.DbiResourceId),
-	}
+	}.Build()
 }
 
 // awsRDSInstanceToRDS converts an rdstypes.DBCluster to accessgraphv1alpha.AWSRDSDatabaseV1
@@ -128,13 +128,13 @@ func awsRDSInstanceToRDS(instance *rdstypes.DBInstance, region, accountID string
 func awsRDSClusterToRDS(instance *rdstypes.DBCluster, region, accountID string) *accessgraphv1alpha.AWSRDSDatabaseV1 {
 	var tags []*accessgraphv1alpha.AWSTag
 	for _, v := range instance.TagList {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(v.Key),
 			Value: strPtrToWrapper(v.Value),
-		})
+		}.Build())
 	}
 
-	return &accessgraphv1alpha.AWSRDSDatabaseV1{
+	return accessgraphv1alpha.AWSRDSDatabaseV1_builder{
 		Name:      aws.ToString(instance.DBClusterIdentifier),
 		Arn:       aws.ToString(instance.DBClusterArn),
 		CreatedAt: awsTimeToProtoTime(instance.ClusterCreateTime),
@@ -142,13 +142,13 @@ func awsRDSClusterToRDS(instance *rdstypes.DBCluster, region, accountID string)
 		Region:    region,
 		AccountId: accountID,
 		Tags:      tags,
-		EngineDetails: &accessgraphv1alpha.AWSRDSEngineV1{
+		EngineDetails: accessgraphv1alpha.AWSRDSEngineV1_builder{
 			Engine:  aws.ToString(instance.Engine),
 			Version: aws.ToString(instance.EngineVersion),
-		},
+		}.Build(),
 		IsCluster:  true,
 		ResourceId: aws.ToString(instance.DbClusterResourceId),
-	}
+	}.Build()
 }
 
 func (a *Fetcher) collectDBInstances(ctx context.Context,
@@ -167,7 +167,7 @@ func (a *Fetcher) collectDBInstances(ctx context.Context,
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			old := sliceFilter(a.lastResult.RDSDatabases, func(db *accessgraphv1alpha.AWSRDSDatabaseV1) bool {
-				return !db.IsCluster && db.Region == region && db.AccountId == a.AccountID
+				return !db.GetIsCluster() && db.GetRegion() == region && db.GetAccountId() == a.AccountID
 			})
 			collectDBs(old, trace.Wrap(err))
 			return
@@ -201,7 +201,7 @@ func (a *Fetcher) collectDBClusters(
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			old := sliceFilter(a.lastResult.RDSDatabases, func(db *accessgraphv1alpha.AWSRDSDatabaseV1) bool {
-				return db.IsCluster && db.Region == region && db.AccountId == a.AccountID
+				return db.GetIsCluster() && db.GetRegion() == region && db.GetAccountId() == a.AccountID
 			})
 			collectDBs(old, trace.Wrap(err))
 			return
diff --git a/lib/srv/discovery/fetchers/aws-sync/rds_test.go b/lib/srv/discovery/fetchers/aws-sync/rds_test.go
index 6211212c6f0..275b703065c 100644
--- a/lib/srv/discovery/fetchers/aws-sync/rds_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/rds_test.go
@@ -59,46 +59,46 @@ func TestPollAWSRDS(t *testing.T) {
 
 	resourcesFixture := Resources{
 		RDSDatabases: []*accessgraphv1alpha.AWSRDSDatabaseV1{
-			{
+			accessgraphv1alpha.AWSRDSDatabaseV1_builder{
 				Arn:    "arn:us-west1:rds:instance1",
 				Status: string(rdstypes.DBProxyStatusAvailable),
 				Name:   "db1",
-				EngineDetails: &accessgraphv1alpha.AWSRDSEngineV1{
+				EngineDetails: accessgraphv1alpha.AWSRDSEngineV1_builder{
 					Engine:  string(rdstypes.EngineFamilyMysql),
 					Version: "v1.1",
-				},
+				}.Build(),
 				CreatedAt: timestamppb.New(date),
 				Tags: []*accessgraphv1alpha.AWSTag{
-					{
+					accessgraphv1alpha.AWSTag_builder{
 						Key:   "tag",
 						Value: wrapperspb.String("val"),
-					},
+					}.Build(),
 				},
 				Region:     "eu-west-1",
 				IsCluster:  false,
 				AccountId:  "12345678",
 				ResourceId: "db1",
-			},
-			{
+			}.Build(),
+			accessgraphv1alpha.AWSRDSDatabaseV1_builder{
 				Arn:    "arn:us-west1:rds:cluster1",
 				Status: string(rdstypes.DBProxyStatusAvailable),
 				Name:   "cluster1",
-				EngineDetails: &accessgraphv1alpha.AWSRDSEngineV1{
+				EngineDetails: accessgraphv1alpha.AWSRDSEngineV1_builder{
 					Engine:  string(rdstypes.EngineFamilyMysql),
 					Version: "v1.1",
-				},
+				}.Build(),
 				CreatedAt: timestamppb.New(date),
 				Tags: []*accessgraphv1alpha.AWSTag{
-					{
+					accessgraphv1alpha.AWSTag_builder{
 						Key:   "tag",
 						Value: wrapperspb.String("val"),
-					},
+					}.Build(),
 				},
 				Region:     "eu-west-1",
 				IsCluster:  true,
 				AccountId:  "12345678",
 				ResourceId: "cluster1",
-			},
+			}.Build(),
 		},
 	}
 
@@ -169,7 +169,7 @@ func TestPollAWSRDS(t *testing.T) {
 				// tags originate from a map so we must sort them before comparing.
 				protocmp.SortRepeated(
 					func(a, b *accessgraphv1alpha.AWSTag) bool {
-						return a.Key < b.Key
+						return a.GetKey() < b.GetKey()
 					},
 				),
 			),
diff --git a/lib/srv/discovery/fetchers/aws-sync/reconcile.go b/lib/srv/discovery/fetchers/aws-sync/reconcile.go
index 7ab3774e94b..d2148889a76 100644
--- a/lib/srv/discovery/fetchers/aws-sync/reconcile.go
+++ b/lib/srv/discovery/fetchers/aws-sync/reconcile.go
@@ -27,9 +27,9 @@ import (
 )
 
 func newResourceList() *accessgraphv1alpha.AWSResourceList {
-	return &accessgraphv1alpha.AWSResourceList{
+	return accessgraphv1alpha.AWSResourceList_builder{
 		Resources: make([]*accessgraphv1alpha.AWSResource, 0),
-	}
+	}.Build()
 }
 
 // ReconcileResults reconciles two Resources objects and returns the operations
@@ -62,8 +62,8 @@ func ReconcileResults(old *Resources, new *Resources) (upsert, delete *accessgra
 		reconcile(old.KMSKeys, new.KMSKeys, kmsKeyKey, kmsKeyWrap),
 	}
 	for _, res := range reconciledResources {
-		upsert.Resources = append(upsert.Resources, res.upsert.Resources...)
-		delete.Resources = append(delete.Resources, res.delete.Resources...)
+		upsert.SetResources(append(upsert.GetResources(), res.upsert.GetResources()...))
+		delete.SetResources(append(delete.GetResources(), res.delete.GetResources()...))
 	}
 	return upsert, delete
 }
@@ -99,7 +99,7 @@ func reconcile[T proto.Message](
 	// Delete all old items if there are no new items
 	if len(newItems) == 0 {
 		for _, item := range oldItems {
-			deleteRes.Resources = append(deleteRes.Resources, wrapFn(item))
+			deleteRes.SetResources(append(deleteRes.GetResources(), wrapFn(item)))
 		}
 		return &reconcilePair{upsertRes, deleteRes}
 	}
@@ -107,7 +107,7 @@ func reconcile[T proto.Message](
 	// Create all new items if there are no old items
 	if len(oldItems) == 0 {
 		for _, item := range newItems {
-			upsertRes.Resources = append(upsertRes.Resources, wrapFn(item))
+			upsertRes.SetResources(append(upsertRes.GetResources(), wrapFn(item)))
 		}
 		return &reconcilePair{upsertRes, deleteRes}
 	}
@@ -125,21 +125,21 @@ func reconcile[T proto.Message](
 	// Append new or modified items to the upsert list
 	for _, item := range newItems {
 		if oldItem, ok := oldMap[keyFn(item)]; !ok || !proto.Equal(oldItem, item) {
-			upsertRes.Resources = append(upsertRes.Resources, wrapFn(item))
+			upsertRes.SetResources(append(upsertRes.GetResources(), wrapFn(item)))
 		}
 	}
 
 	// Append removed items to the delete list
 	for _, item := range oldItems {
 		if _, ok := newMap[keyFn(item)]; !ok {
-			deleteRes.Resources = append(deleteRes.Resources, wrapFn(item))
+			deleteRes.SetResources(append(deleteRes.GetResources(), wrapFn(item)))
 		}
 	}
 	return &reconcilePair{upsertRes, deleteRes}
 }
 
 func instanceKey(instance *accessgraphv1alpha.AWSInstanceV1) string {
-	return fmt.Sprintf("%s;%s", instance.InstanceId, instance.Region)
+	return fmt.Sprintf("%s;%s", instance.GetInstanceId(), instance.GetRegion())
 }
 
 func instanceWrap(instance *accessgraphv1alpha.AWSInstanceV1) *accessgraphv1alpha.AWSResource {
@@ -147,7 +147,7 @@ func instanceWrap(instance *accessgraphv1alpha.AWSInstanceV1) *accessgraphv1alph
 }
 
 func usersKey(user *accessgraphv1alpha.AWSUserV1) string {
-	return fmt.Sprintf("%s;%s", user.AccountId, user.Arn)
+	return fmt.Sprintf("%s;%s", user.GetAccountId(), user.GetArn())
 }
 
 func usersWrap(user *accessgraphv1alpha.AWSUserV1) *accessgraphv1alpha.AWSResource {
@@ -155,7 +155,7 @@ func usersWrap(user *accessgraphv1alpha.AWSUserV1) *accessgraphv1alpha.AWSResour
 }
 
 func userInlinePolKey(policy *accessgraphv1alpha.AWSUserInlinePolicyV1) string {
-	return fmt.Sprintf("%s;%s;%s", policy.AccountId, policy.GetUser().GetUserName(), policy.PolicyName)
+	return fmt.Sprintf("%s;%s;%s", policy.GetAccountId(), policy.GetUser().GetUserName(), policy.GetPolicyName())
 }
 
 func userInlinePolWrap(policy *accessgraphv1alpha.AWSUserInlinePolicyV1) *accessgraphv1alpha.AWSResource {
@@ -163,7 +163,7 @@ func userInlinePolWrap(policy *accessgraphv1alpha.AWSUserInlinePolicyV1) *access
 }
 
 func userAttchPolKey(policy *accessgraphv1alpha.AWSUserAttachedPolicies) string {
-	return fmt.Sprintf("%s;%s", policy.AccountId, policy.User.Arn)
+	return fmt.Sprintf("%s;%s", policy.GetAccountId(), policy.GetUser().GetArn())
 }
 
 func userAttchPolWrap(policy *accessgraphv1alpha.AWSUserAttachedPolicies) *accessgraphv1alpha.AWSResource {
@@ -171,7 +171,7 @@ func userAttchPolWrap(policy *accessgraphv1alpha.AWSUserAttachedPolicies) *acces
 }
 
 func userGroupKey(group *accessgraphv1alpha.AWSUserGroupsV1) string {
-	return fmt.Sprintf("%s;%s", group.User.AccountId, group.User.Arn)
+	return fmt.Sprintf("%s;%s", group.GetUser().GetAccountId(), group.GetUser().GetArn())
 }
 
 func userGroupWrap(group *accessgraphv1alpha.AWSUserGroupsV1) *accessgraphv1alpha.AWSResource {
@@ -179,7 +179,7 @@ func userGroupWrap(group *accessgraphv1alpha.AWSUserGroupsV1) *accessgraphv1alph
 }
 
 func groupKey(group *accessgraphv1alpha.AWSGroupV1) string {
-	return fmt.Sprintf("%s;%s", group.AccountId, group.Arn)
+	return fmt.Sprintf("%s;%s", group.GetAccountId(), group.GetArn())
 }
 
 func groupWrap(group *accessgraphv1alpha.AWSGroupV1) *accessgraphv1alpha.AWSResource {
@@ -187,7 +187,7 @@ func groupWrap(group *accessgraphv1alpha.AWSGroupV1) *accessgraphv1alpha.AWSReso
 }
 
 func grpInlinePolKey(policy *accessgraphv1alpha.AWSGroupInlinePolicyV1) string {
-	return fmt.Sprintf("%s;%s;%s", policy.Group.Name, policy.PolicyName, policy.AccountId)
+	return fmt.Sprintf("%s;%s;%s", policy.GetGroup().GetName(), policy.GetPolicyName(), policy.GetAccountId())
 }
 
 func grpInlinePolWrap(policy *accessgraphv1alpha.AWSGroupInlinePolicyV1) *accessgraphv1alpha.AWSResource {
@@ -195,7 +195,7 @@ func grpInlinePolWrap(policy *accessgraphv1alpha.AWSGroupInlinePolicyV1) *access
 }
 
 func grpAttchPolKey(policy *accessgraphv1alpha.AWSGroupAttachedPolicies) string {
-	return fmt.Sprintf("%s;%s", policy.Group.GetAccountId(), policy.Group.Arn)
+	return fmt.Sprintf("%s;%s", policy.GetGroup().GetAccountId(), policy.GetGroup().GetArn())
 }
 
 func grpAttchPolWrap(policy *accessgraphv1alpha.AWSGroupAttachedPolicies) *accessgraphv1alpha.AWSResource {
@@ -203,7 +203,7 @@ func grpAttchPolWrap(policy *accessgraphv1alpha.AWSGroupAttachedPolicies) *acces
 }
 
 func policyKey(policy *accessgraphv1alpha.AWSPolicyV1) string {
-	return fmt.Sprintf("%s;%s", policy.AccountId, policy.Arn)
+	return fmt.Sprintf("%s;%s", policy.GetAccountId(), policy.GetArn())
 }
 
 func policyWrap(policy *accessgraphv1alpha.AWSPolicyV1) *accessgraphv1alpha.AWSResource {
@@ -211,7 +211,7 @@ func policyWrap(policy *accessgraphv1alpha.AWSPolicyV1) *accessgraphv1alpha.AWSR
 }
 
 func s3bucketKey(s3 *accessgraphv1alpha.AWSS3BucketV1) string {
-	return fmt.Sprintf("%s;%s", s3.AccountId, s3.Name)
+	return fmt.Sprintf("%s;%s", s3.GetAccountId(), s3.GetName())
 }
 
 func s3bucketWrap(s3 *accessgraphv1alpha.AWSS3BucketV1) *accessgraphv1alpha.AWSResource {
@@ -219,7 +219,7 @@ func s3bucketWrap(s3 *accessgraphv1alpha.AWSS3BucketV1) *accessgraphv1alpha.AWSR
 }
 
 func roleKey(role *accessgraphv1alpha.AWSRoleV1) string {
-	return fmt.Sprintf("%s;%s", role.AccountId, role.Arn)
+	return fmt.Sprintf("%s;%s", role.GetAccountId(), role.GetArn())
 }
 
 func roleWrap(role *accessgraphv1alpha.AWSRoleV1) *accessgraphv1alpha.AWSResource {
@@ -227,7 +227,7 @@ func roleWrap(role *accessgraphv1alpha.AWSRoleV1) *accessgraphv1alpha.AWSResourc
 }
 
 func roleInlinePolKey(policy *accessgraphv1alpha.AWSRoleInlinePolicyV1) string {
-	return fmt.Sprintf("%s;%s;%s", policy.AccountId, policy.GetAwsRole().Arn, policy.PolicyName)
+	return fmt.Sprintf("%s;%s;%s", policy.GetAccountId(), policy.GetAwsRole().GetArn(), policy.GetPolicyName())
 }
 
 func roleInlinePolWrap(policy *accessgraphv1alpha.AWSRoleInlinePolicyV1) *accessgraphv1alpha.AWSResource {
@@ -235,7 +235,7 @@ func roleInlinePolWrap(policy *accessgraphv1alpha.AWSRoleInlinePolicyV1) *access
 }
 
 func roleAttchPolKey(policy *accessgraphv1alpha.AWSRoleAttachedPolicies) string {
-	return fmt.Sprintf("%s;%s", policy.GetAwsRole().GetArn(), policy.AccountId)
+	return fmt.Sprintf("%s;%s", policy.GetAwsRole().GetArn(), policy.GetAccountId())
 }
 
 func roleAttchPolWrap(policy *accessgraphv1alpha.AWSRoleAttachedPolicies) *accessgraphv1alpha.AWSResource {
@@ -243,7 +243,7 @@ func roleAttchPolWrap(policy *accessgraphv1alpha.AWSRoleAttachedPolicies) *acces
 }
 
 func instanceProfKey(profile *accessgraphv1alpha.AWSInstanceProfileV1) string {
-	return fmt.Sprintf("%s;%s", profile.AccountId, profile.InstanceProfileId)
+	return fmt.Sprintf("%s;%s", profile.GetAccountId(), profile.GetInstanceProfileId())
 }
 
 func instanceProfWrap(profile *accessgraphv1alpha.AWSInstanceProfileV1) *accessgraphv1alpha.AWSResource {
@@ -251,7 +251,7 @@ func instanceProfWrap(profile *accessgraphv1alpha.AWSInstanceProfileV1) *accessg
 }
 
 func eksClusterKey(cluster *accessgraphv1alpha.AWSEKSClusterV1) string {
-	return fmt.Sprintf("%s;%s", cluster.AccountId, cluster.Arn)
+	return fmt.Sprintf("%s;%s", cluster.GetAccountId(), cluster.GetArn())
 }
 
 func eksClusterWrap(cluster *accessgraphv1alpha.AWSEKSClusterV1) *accessgraphv1alpha.AWSResource {
@@ -259,7 +259,7 @@ func eksClusterWrap(cluster *accessgraphv1alpha.AWSEKSClusterV1) *accessgraphv1a
 }
 
 func assocAccPolKey(policy *accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1) string {
-	return fmt.Sprintf("%s;%s;%s;%s", policy.AccountId, policy.Cluster.Arn, policy.PrincipalArn, policy.PolicyArn)
+	return fmt.Sprintf("%s;%s;%s;%s", policy.GetAccountId(), policy.GetCluster().GetArn(), policy.GetPrincipalArn(), policy.GetPolicyArn())
 }
 
 func assocAccPolWrap(policy *accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1) *accessgraphv1alpha.AWSResource {
@@ -267,7 +267,7 @@ func assocAccPolWrap(policy *accessgraphv1alpha.AWSEKSAssociatedAccessPolicyV1)
 }
 
 func accessEntryKey(entry *accessgraphv1alpha.AWSEKSClusterAccessEntryV1) string {
-	return fmt.Sprintf("%s;%s;%s;%s", entry.AccountId, entry.Cluster.Arn, entry.PrincipalArn, entry.AccessEntryArn)
+	return fmt.Sprintf("%s;%s;%s;%s", entry.GetAccountId(), entry.GetCluster().GetArn(), entry.GetPrincipalArn(), entry.GetAccessEntryArn())
 }
 
 func accessEntryWrap(entry *accessgraphv1alpha.AWSEKSClusterAccessEntryV1) *accessgraphv1alpha.AWSResource {
@@ -275,7 +275,7 @@ func accessEntryWrap(entry *accessgraphv1alpha.AWSEKSClusterAccessEntryV1) *acce
 }
 
 func rdsDbKey(db *accessgraphv1alpha.AWSRDSDatabaseV1) string {
-	return fmt.Sprintf("%s;%s", db.AccountId, db.Arn)
+	return fmt.Sprintf("%s;%s", db.GetAccountId(), db.GetArn())
 }
 
 func rdsDbWrap(db *accessgraphv1alpha.AWSRDSDatabaseV1) *accessgraphv1alpha.AWSResource {
@@ -283,7 +283,7 @@ func rdsDbWrap(db *accessgraphv1alpha.AWSRDSDatabaseV1) *accessgraphv1alpha.AWSR
 }
 
 func samlProvKey(provider *accessgraphv1alpha.AWSSAMLProviderV1) string {
-	return fmt.Sprintf("%s;%s", provider.AccountId, provider.Arn)
+	return fmt.Sprintf("%s;%s", provider.GetAccountId(), provider.GetArn())
 }
 
 func samlProvWrap(provider *accessgraphv1alpha.AWSSAMLProviderV1) *accessgraphv1alpha.AWSResource {
@@ -291,7 +291,7 @@ func samlProvWrap(provider *accessgraphv1alpha.AWSSAMLProviderV1) *accessgraphv1
 }
 
 func oidcProvKey(provider *accessgraphv1alpha.AWSOIDCProviderV1) string {
-	return fmt.Sprintf("%s;%s", provider.AccountId, provider.Arn)
+	return fmt.Sprintf("%s;%s", provider.GetAccountId(), provider.GetArn())
 }
 
 func oidcProvWrap(provider *accessgraphv1alpha.AWSOIDCProviderV1) *accessgraphv1alpha.AWSResource {
@@ -299,7 +299,7 @@ func oidcProvWrap(provider *accessgraphv1alpha.AWSOIDCProviderV1) *accessgraphv1
 }
 
 func kmsKeyKey(key *accessgraphv1alpha.AWSKMSKeyV1) string {
-	return fmt.Sprintf("%s;%s", key.AccountId, key.Arn)
+	return fmt.Sprintf("%s;%s", key.GetAccountId(), key.GetArn())
 }
 
 func kmsKeyWrap(key *accessgraphv1alpha.AWSKMSKeyV1) *accessgraphv1alpha.AWSResource {
diff --git a/lib/srv/discovery/fetchers/aws-sync/reconcile_test.go b/lib/srv/discovery/fetchers/aws-sync/reconcile_test.go
index deec808acd5..8d13eafce3e 100644
--- a/lib/srv/discovery/fetchers/aws-sync/reconcile_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/reconcile_test.go
@@ -81,79 +81,79 @@ func TestReconcileResults(t *testing.T) {
 		},
 	}
 
-	require.ElementsMatch(t, wantDelete, delete.Resources)
-	require.ElementsMatch(t, wantUpsert, upsert.Resources)
+	require.ElementsMatch(t, wantDelete, delete.GetResources())
+	require.ElementsMatch(t, wantUpsert, upsert.GetResources())
 }
 
 func generateUsers() (old, new []*accessgraphv1alpha.AWSUserV1) {
-	userA := &accessgraphv1alpha.AWSUserV1{
+	userA := accessgraphv1alpha.AWSUserV1_builder{
 		UserName: "userA",
 		Arn:      "arn:userA",
-		Tags:     []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
-	userBOld := &accessgraphv1alpha.AWSUserV1{
+		Tags:     []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
+	userBOld := accessgraphv1alpha.AWSUserV1_builder{
 		UserName: "userB",
 		Arn:      "arn:userB",
-		Tags:     []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
-	userBNew := &accessgraphv1alpha.AWSUserV1{
+		Tags:     []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
+	userBNew := accessgraphv1alpha.AWSUserV1_builder{
 		UserName: "userB",
 		Arn:      "arn:userB",
-		Tags:     []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value2")}},
-	}
-	userC := &accessgraphv1alpha.AWSUserV1{
+		Tags:     []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value2")}.Build()},
+	}.Build()
+	userC := accessgraphv1alpha.AWSUserV1_builder{
 		UserName: "userC",
 		Arn:      "arn:userC",
-		Tags:     []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
+		Tags:     []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
 	old = []*accessgraphv1alpha.AWSUserV1{userA, userBOld}
 	new = []*accessgraphv1alpha.AWSUserV1{userA, userC, userBNew}
 	return
 }
 
 func generateRoles() (old, new []*accessgraphv1alpha.AWSRoleV1) {
-	roleA := &accessgraphv1alpha.AWSRoleV1{
+	roleA := accessgraphv1alpha.AWSRoleV1_builder{
 		Name: "roleA",
 		Arn:  "arn:roleA",
-		Tags: []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
-	roleBOld := &accessgraphv1alpha.AWSRoleV1{
+		Tags: []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
+	roleBOld := accessgraphv1alpha.AWSRoleV1_builder{
 		Name: "roleB",
 		Arn:  "arn:roleB",
-		Tags: []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
-	roleBNew := &accessgraphv1alpha.AWSRoleV1{
+		Tags: []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
+	roleBNew := accessgraphv1alpha.AWSRoleV1_builder{
 		Name: "roleB",
 		Arn:  "arn:roleB",
-		Tags: []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value2")}},
-	}
-	roleC := &accessgraphv1alpha.AWSRoleV1{
+		Tags: []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value2")}.Build()},
+	}.Build()
+	roleC := accessgraphv1alpha.AWSRoleV1_builder{
 		Name: "roleC",
 		Arn:  "arn:roleC",
-		Tags: []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
+		Tags: []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
 	old = []*accessgraphv1alpha.AWSRoleV1{roleA, roleBOld}
 	new = []*accessgraphv1alpha.AWSRoleV1{roleC, roleBNew}
 	return
 }
 
 func generateEC2() (old, new []*accessgraphv1alpha.AWSInstanceV1) {
-	instanceA := &accessgraphv1alpha.AWSInstanceV1{
+	instanceA := accessgraphv1alpha.AWSInstanceV1_builder{
 		InstanceId: "instanceA",
-		Tags:       []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
-	instanceBOld := &accessgraphv1alpha.AWSInstanceV1{
+		Tags:       []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
+	instanceBOld := accessgraphv1alpha.AWSInstanceV1_builder{
 		InstanceId: "instanceB",
-		Tags:       []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
-	instanceBNew := &accessgraphv1alpha.AWSInstanceV1{
+		Tags:       []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
+	instanceBNew := accessgraphv1alpha.AWSInstanceV1_builder{
 		InstanceId: "instanceB",
-		Tags:       []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value2")}},
-	}
-	instanceC := &accessgraphv1alpha.AWSInstanceV1{
+		Tags:       []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value2")}.Build()},
+	}.Build()
+	instanceC := accessgraphv1alpha.AWSInstanceV1_builder{
 		InstanceId: "instanceC",
-		Tags:       []*accessgraphv1alpha.AWSTag{{Key: "key1", Value: wrapperspb.String("value1")}},
-	}
+		Tags:       []*accessgraphv1alpha.AWSTag{accessgraphv1alpha.AWSTag_builder{Key: "key1", Value: wrapperspb.String("value1")}.Build()},
+	}.Build()
 	old = []*accessgraphv1alpha.AWSInstanceV1{instanceA, instanceBOld, instanceC}
 	new = []*accessgraphv1alpha.AWSInstanceV1{instanceA, instanceC, instanceBNew}
 	return
diff --git a/lib/srv/discovery/fetchers/aws-sync/roles.go b/lib/srv/discovery/fetchers/aws-sync/roles.go
index d2e77958b0d..7d5bd28dd5a 100644
--- a/lib/srv/discovery/fetchers/aws-sync/roles.go
+++ b/lib/srv/discovery/fetchers/aws-sync/roles.go
@@ -59,12 +59,12 @@ func (a *Fetcher) pollAWSRoles(ctx context.Context, result *Resources, collectEr
 			eG.Go(func() error {
 				roleInlinePolicies, err := a.fetchRoleInlinePolicies(ctx, role)
 				if err != nil {
-					collectErr(trace.Wrap(err, "failed to fetch role %q inline policies", role.Name))
+					collectErr(trace.Wrap(err, "failed to fetch role %q inline policies", role.GetName()))
 				}
 
 				roleAttachedPolicies, err := a.fetchRoleAttachedPolicies(ctx, role)
 				if err != nil {
-					collectErr(trace.Wrap(err, "failed to fetch role %q attached policies", role.Name))
+					collectErr(trace.Wrap(err, "failed to fetch role %q attached policies", role.GetName()))
 				}
 
 				roleMu.Lock()
@@ -133,7 +133,7 @@ func (a *Fetcher) fetchRoleInlinePolicies(ctx context.Context, role *accessgraph
 	pager := iam.NewListRolePoliciesPaginator(
 		iamClient,
 		&iam.ListRolePoliciesInput{
-			RoleName: aws.String(role.Name),
+			RoleName: aws.String(role.GetName()),
 			MaxItems: aws.Int32(pageSize),
 		},
 		func(opts *iam.ListRolePoliciesPaginatorOptions) {
@@ -153,11 +153,11 @@ func (a *Fetcher) fetchRoleInlinePolicies(ctx context.Context, role *accessgraph
 		}
 		for _, policyName := range page.PolicyNames {
 			policy, err := iamClient.GetRolePolicy(ctx, &iam.GetRolePolicyInput{
-				RoleName:   aws.String(role.Name),
+				RoleName:   aws.String(role.GetName()),
 				PolicyName: aws.String(policyName),
 			})
 			if err != nil {
-				errCollect(trace.Wrap(err, "failed to fetch user %q inline policy %q", role.Name, policyName))
+				errCollect(trace.Wrap(err, "failed to fetch user %q inline policy %q", role.GetName(), policyName))
 				continue
 			}
 
@@ -182,7 +182,7 @@ func (a *Fetcher) fetchRoleAttachedPolicies(ctx context.Context, role *accessgra
 	pager := iam.NewListAttachedRolePoliciesPaginator(
 		iamClient,
 		&iam.ListAttachedRolePoliciesInput{
-			RoleName: aws.String(role.Name),
+			RoleName: aws.String(role.GetName()),
 			MaxItems: aws.Int32(pageSize),
 		},
 		func(opts *iam.ListAttachedRolePoliciesPaginatorOptions) {
@@ -190,23 +190,23 @@ func (a *Fetcher) fetchRoleAttachedPolicies(ctx context.Context, role *accessgra
 		},
 	)
 
-	rsp := &accessgraphv1alpha.AWSRoleAttachedPolicies{
+	rsp := accessgraphv1alpha.AWSRoleAttachedPolicies_builder{
 		AwsRole:   role,
 		AccountId: a.AccountID,
-	}
+	}.Build()
 	for pager.HasMorePages() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return rsp, trace.Wrap(err)
 		}
 		for _, policy := range page.AttachedPolicies {
-			rsp.Policies = append(
-				rsp.Policies,
-				&accessgraphv1alpha.AttachedPolicyV1{
+			rsp.SetPolicies(append(
+				rsp.GetPolicies(),
+				accessgraphv1alpha.AttachedPolicyV1_builder{
 					Arn:        aws.ToString(policy.PolicyArn),
 					PolicyName: aws.ToString(policy.PolicyName),
-				},
-			)
+				}.Build(),
+			))
 		}
 	}
 	return rsp, trace.Wrap(err)
@@ -216,30 +216,30 @@ func (a *Fetcher) fetchRoleAttachedPolicies(ctx context.Context, role *accessgra
 func awsRoleToProtoRole(role iamtypes.Role, accountID string) *accessgraphv1alpha.AWSRoleV1 {
 	tags := make([]*accessgraphv1alpha.AWSTag, 0, len(role.Tags))
 	for _, tag := range role.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(tag.Key),
 			Value: strPtrToWrapper(tag.Value),
-		})
+		}.Build())
 	}
 
 	var permissionsBoundary *accessgraphv1alpha.RolePermissionsBoundaryV1
 
 	if role.PermissionsBoundary != nil {
-		permissionsBoundary = &accessgraphv1alpha.RolePermissionsBoundaryV1{
+		permissionsBoundary = accessgraphv1alpha.RolePermissionsBoundaryV1_builder{
 			PermissionsBoundaryArn:  aws.ToString(role.PermissionsBoundary.PermissionsBoundaryArn),
 			PermissionsBoundaryType: accessgraphv1alpha.RolePermissionsBoundaryType_ROLE_PERMISSIONS_BOUNDARY_TYPE_PERMISSIONS_BOUNDARY_POLICY,
-		}
+		}.Build()
 	}
 
 	var lastTimeUsed *accessgraphv1alpha.RoleLastUsedV1
 	if role.RoleLastUsed != nil {
-		lastTimeUsed = &accessgraphv1alpha.RoleLastUsedV1{
+		lastTimeUsed = accessgraphv1alpha.RoleLastUsedV1_builder{
 			LastUsedDate: awsTimeToProtoTime(role.RoleLastUsed.LastUsedDate),
 			Region:       aws.ToString(role.RoleLastUsed.Region),
-		}
+		}.Build()
 	}
 
-	return &accessgraphv1alpha.AWSRoleV1{
+	return accessgraphv1alpha.AWSRoleV1_builder{
 		Name:                     aws.ToString(role.RoleName),
 		Arn:                      aws.ToString(role.Arn),
 		AssumeRolePolicyDocument: strPtrToByteSlice(role.AssumeRolePolicyDocument),
@@ -252,14 +252,14 @@ func awsRoleToProtoRole(role iamtypes.Role, accountID string) *accessgraphv1alph
 		RoleLastUsed:             lastTimeUsed,
 		Tags:                     tags,
 		PermissionsBoundary:      permissionsBoundary,
-	}
+	}.Build()
 }
 
 func awsRolePolicyToProtoUserPolicy(policy *iam.GetRolePolicyOutput, role *accessgraphv1alpha.AWSRoleV1, accountID string) *accessgraphv1alpha.AWSRoleInlinePolicyV1 {
-	return &accessgraphv1alpha.AWSRoleInlinePolicyV1{
+	return accessgraphv1alpha.AWSRoleInlinePolicyV1_builder{
 		PolicyName:     aws.ToString(policy.PolicyName),
 		PolicyDocument: []byte(aws.ToString(policy.PolicyDocument)),
 		AwsRole:        role,
 		AccountId:      accountID,
-	}
+	}.Build()
 }
diff --git a/lib/srv/discovery/fetchers/aws-sync/s3.go b/lib/srv/discovery/fetchers/aws-sync/s3.go
index 54fd95d3cc3..486007688a2 100644
--- a/lib/srv/discovery/fetchers/aws-sync/s3.go
+++ b/lib/srv/discovery/fetchers/aws-sync/s3.go
@@ -93,7 +93,7 @@ func (a *Fetcher) fetchS3Buckets(ctx context.Context) ([]*accessgraphv1alpha.AWS
 			var failedReqs failedRequests
 			var errs []error
 			existingBucket := sliceFilterPickFirst(existing.S3Buckets, func(b *accessgraphv1alpha.AWSS3BucketV1) bool {
-				return b.Name == aws.ToString(bucket.Name) && b.AccountId == a.AccountID
+				return b.GetName() == aws.ToString(bucket.Name) && b.GetAccountId() == a.AccountID
 			},
 			)
 			bucketRegion, err := getBucketRegion(bucket.Name)
@@ -130,25 +130,25 @@ func awsS3Bucket(name string,
 	tags *s3.GetBucketTaggingOutput,
 	accountID string,
 ) *accessgraphv1alpha.AWSS3BucketV1 {
-	s3 := &accessgraphv1alpha.AWSS3BucketV1{
+	s3 := accessgraphv1alpha.AWSS3BucketV1_builder{
 		Name:      name,
 		AccountId: accountID,
-	}
+	}.Build()
 	if policy != nil {
-		s3.PolicyDocument = []byte(aws.ToString(policy.Policy))
+		s3.SetPolicyDocument([]byte(aws.ToString(policy.Policy)))
 	}
 	if policyStatus != nil && policyStatus.PolicyStatus != nil {
-		s3.IsPublic = aws.ToBool(policyStatus.PolicyStatus.IsPublic)
+		s3.SetIsPublic(aws.ToBool(policyStatus.PolicyStatus.IsPublic))
 	}
 	if acls != nil {
-		s3.Acls = awsACLsToProtoACLs(acls.Grants)
+		s3.SetAcls(awsACLsToProtoACLs(acls.Grants))
 	}
 	if tags != nil {
 		for _, tag := range tags.TagSet {
-			s3.Tags = append(s3.Tags, &accessgraphv1alpha.AWSTag{
+			s3.SetTags(append(s3.GetTags(), accessgraphv1alpha.AWSTag_builder{
 				Key:   aws.ToString(tag.Key),
 				Value: strPtrToWrapper(tag.Value),
-			})
+			}.Build()))
 		}
 	}
 	return s3
@@ -157,16 +157,16 @@ func awsS3Bucket(name string,
 func awsACLsToProtoACLs(grants []s3types.Grant) []*accessgraphv1alpha.AWSS3BucketACL {
 	var acls []*accessgraphv1alpha.AWSS3BucketACL
 	for _, grant := range grants {
-		acls = append(acls, &accessgraphv1alpha.AWSS3BucketACL{
-			Grantee: &accessgraphv1alpha.AWSS3BucketACLGrantee{
+		acls = append(acls, accessgraphv1alpha.AWSS3BucketACL_builder{
+			Grantee: accessgraphv1alpha.AWSS3BucketACLGrantee_builder{
 				Id:           aws.ToString(grant.Grantee.ID),
 				DisplayName:  aws.ToString(grant.Grantee.DisplayName),
 				Type:         string(grant.Grantee.Type),
 				Uri:          aws.ToString(grant.Grantee.URI),
 				EmailAddress: aws.ToString(grant.Grantee.EmailAddress),
-			},
+			}.Build(),
 			Permission: string(grant.Permission),
-		})
+		}.Build())
 	}
 	return acls
 }
@@ -188,16 +188,16 @@ func mergeS3Protos(existing, new *accessgraphv1alpha.AWSS3BucketV1, failedReqs f
 	}
 	clone := proto.Clone(new).(*accessgraphv1alpha.AWSS3BucketV1)
 	if failedReqs.policyFailed {
-		clone.PolicyDocument = existing.PolicyDocument
+		clone.SetPolicyDocument(existing.GetPolicyDocument())
 	}
 	if failedReqs.failedPolicyStatus {
-		clone.IsPublic = existing.IsPublic
+		clone.SetIsPublic(existing.GetIsPublic())
 	}
 	if failedReqs.failedAcls {
-		clone.Acls = existing.Acls
+		clone.SetAcls(existing.GetAcls())
 	}
 	if failedReqs.failedTags {
-		clone.Tags = existing.Tags
+		clone.SetTags(existing.GetTags())
 	}
 
 	return clone
diff --git a/lib/srv/discovery/fetchers/aws-sync/s3_test.go b/lib/srv/discovery/fetchers/aws-sync/s3_test.go
index a403e5b4583..6b1ae926208 100644
--- a/lib/srv/discovery/fetchers/aws-sync/s3_test.go
+++ b/lib/srv/discovery/fetchers/aws-sync/s3_test.go
@@ -40,7 +40,7 @@ import (
 func TestPollAWSS3(t *testing.T) {
 	sortSlice := func(buckets []*accessgraphv1alpha.AWSS3BucketV1) {
 		sort.Slice(buckets, func(i, j int) bool {
-			return buckets[i].Name < buckets[j].Name
+			return buckets[i].GetName() < buckets[j].GetName()
 		})
 	}
 
@@ -118,44 +118,44 @@ func TestPollAWSS3(t *testing.T) {
 			name: "poll s3",
 			want: &Resources{
 				S3Buckets: []*accessgraphv1alpha.AWSS3BucketV1{
-					{
+					accessgraphv1alpha.AWSS3BucketV1_builder{
 						Name:           bucketName,
 						AccountId:      accountID,
 						PolicyDocument: []byte("policy"),
 						IsPublic:       true,
 						Acls: []*accessgraphv1alpha.AWSS3BucketACL{
-							{
-								Grantee: &accessgraphv1alpha.AWSS3BucketACLGrantee{
+							accessgraphv1alpha.AWSS3BucketACL_builder{
+								Grantee: accessgraphv1alpha.AWSS3BucketACLGrantee_builder{
 									Id: "id",
-								},
+								}.Build(),
 								Permission: "READ",
-							},
+							}.Build(),
 						},
 						Tags: []*accessgraphv1alpha.AWSTag{
-							{
+							accessgraphv1alpha.AWSTag_builder{
 								Key:   "tag",
 								Value: strPtrToWrapper(aws.String("val")),
-							},
+							}.Build(),
 						},
-					},
-					{
+					}.Build(),
+					accessgraphv1alpha.AWSS3BucketV1_builder{
 						Name:           otherBucketName,
 						AccountId:      accountID,
 						PolicyDocument: []byte("otherPolicy"),
 						IsPublic:       false,
 						Acls: []*accessgraphv1alpha.AWSS3BucketACL{
-							{
-								Grantee: &accessgraphv1alpha.AWSS3BucketACLGrantee{
+							accessgraphv1alpha.AWSS3BucketACL_builder{
+								Grantee: accessgraphv1alpha.AWSS3BucketACLGrantee_builder{
 									Id: "id",
-								},
+								}.Build(),
 								Permission: "READ",
-							},
+							}.Build(),
 						},
-					},
-					{
+					}.Build(),
+					accessgraphv1alpha.AWSS3BucketV1_builder{
 						Name:      missingBucket,
 						AccountId: accountID,
-					},
+					}.Build(),
 				},
 			},
 		},
@@ -202,7 +202,7 @@ func TestPollAWSS3(t *testing.T) {
 				// tags originate from a map so we must sort them before comparing.
 				protocmp.SortRepeated(
 					func(a, b *accessgraphv1alpha.AWSTag) bool {
-						return a.Key < b.Key
+						return a.GetKey() < b.GetKey()
 					},
 				),
 			),
@@ -226,12 +226,12 @@ func s3Buckets(bucketNames ...string) []s3types.Bucket {
 
 // Helper function to create AWSS3BucketV1 for testing
 func createAWSS3Bucket(name, accountID string, policyDocument []byte, isPublic bool, lastSync time.Time) *accessgraphv1alpha.AWSS3BucketV1 {
-	return &accessgraphv1alpha.AWSS3BucketV1{
+	return accessgraphv1alpha.AWSS3BucketV1_builder{
 		Name:           name,
 		AccountId:      accountID,
 		PolicyDocument: policyDocument,
 		IsPublic:       isPublic,
-	}
+	}.Build()
 }
 
 func TestMergeS3Protos(t *testing.T) {
diff --git a/lib/srv/discovery/fetchers/aws-sync/users.go b/lib/srv/discovery/fetchers/aws-sync/users.go
index d9da1e9720e..6fcbb2adda5 100644
--- a/lib/srv/discovery/fetchers/aws-sync/users.go
+++ b/lib/srv/discovery/fetchers/aws-sync/users.go
@@ -56,19 +56,19 @@ func (a *Fetcher) pollAWSUsers(ctx context.Context, result, existing *Resources,
 			eG.Go(func() error {
 				userInlinePolicies, err := a.fetchUserInlinePolicies(ctx, user)
 				if err != nil {
-					collectErr(trace.Wrap(err, "failed to fetch user %q inline policies", user.UserName))
+					collectErr(trace.Wrap(err, "failed to fetch user %q inline policies", user.GetUserName()))
 					userInlinePolicies = sliceFilter(existing.UserInlinePolicies, func(inline *accessgraphv1alpha.AWSUserInlinePolicyV1) bool {
-						return inline.User.UserName == user.UserName && inline.AccountId == a.AccountID
+						return inline.GetUser().GetUserName() == user.GetUserName() && inline.GetAccountId() == a.AccountID
 					})
 				}
 
 				userAttachedPolicies, err := a.fetchUserAttachedPolicies(ctx, user)
 				if err != nil {
-					collectErr(trace.Wrap(err, "failed to fetch user %q attached policies", user.UserName))
+					collectErr(trace.Wrap(err, "failed to fetch user %q attached policies", user.GetUserName()))
 					userAttachedPolicies = sliceFilterPickFirst(
 						existing.UserAttachedPolicies,
 						func(attached *accessgraphv1alpha.AWSUserAttachedPolicies) bool {
-							return attached.User.UserName == user.UserName && attached.AccountId == a.AccountID
+							return attached.GetUser().GetUserName() == user.GetUserName() && attached.GetAccountId() == a.AccountID
 						},
 					)
 
@@ -76,9 +76,9 @@ func (a *Fetcher) pollAWSUsers(ctx context.Context, result, existing *Resources,
 
 				userGroups, err := a.fetchGroupsForUser(ctx, user)
 				if err != nil {
-					collectErr(trace.Wrap(err, "failed to fetch user %q groups", user.UserName))
+					collectErr(trace.Wrap(err, "failed to fetch user %q groups", user.GetUserName()))
 					userGroups = sliceFilterPickFirst(existing.UserGroups, func(groups *accessgraphv1alpha.AWSUserGroupsV1) bool {
-						return groups.User.UserName == user.UserName && groups.User.AccountId == a.AccountID
+						return groups.GetUser().GetUserName() == user.GetUserName() && groups.GetUser().GetAccountId() == a.AccountID
 					})
 				}
 
@@ -139,22 +139,22 @@ func (a *Fetcher) fetchUsers(ctx context.Context) ([]*accessgraphv1alpha.AWSUser
 func awsUserToProtoUser(user iamtypes.User, accountID string) *accessgraphv1alpha.AWSUserV1 {
 	tags := make([]*accessgraphv1alpha.AWSTag, 0, len(user.Tags))
 	for _, tag := range user.Tags {
-		tags = append(tags, &accessgraphv1alpha.AWSTag{
+		tags = append(tags, accessgraphv1alpha.AWSTag_builder{
 			Key:   aws.ToString(tag.Key),
 			Value: strPtrToWrapper(tag.Value),
-		})
+		}.Build())
 	}
 
 	var permissionsBoundary *accessgraphv1alpha.UsersPermissionsBoundaryV1
 
 	if user.PermissionsBoundary != nil {
-		permissionsBoundary = &accessgraphv1alpha.UsersPermissionsBoundaryV1{
+		permissionsBoundary = accessgraphv1alpha.UsersPermissionsBoundaryV1_builder{
 			PermissionsBoundaryArn:  aws.ToString(user.PermissionsBoundary.PermissionsBoundaryArn),
 			PermissionsBoundaryType: accessgraphv1alpha.UsersPermissionsBoundaryType_USERS_PERMISSIONS_BOUNDARY_TYPE_PERMISSIONS_BOUNDARY_POLICY,
-		}
+		}.Build()
 	}
 
-	return &accessgraphv1alpha.AWSUserV1{
+	return accessgraphv1alpha.AWSUserV1_builder{
 		UserName:            aws.ToString(user.UserName),
 		Arn:                 aws.ToString(user.Arn),
 		Path:                aws.ToString(user.Path),
@@ -164,7 +164,7 @@ func awsUserToProtoUser(user iamtypes.User, accountID string) *accessgraphv1alph
 		PasswordLastUsed:    awsTimeToProtoTime(user.PasswordLastUsed),
 		Tags:                tags,
 		PermissionsBoundary: permissionsBoundary,
-	}
+	}.Build()
 }
 
 func (a *Fetcher) fetchUserInlinePolicies(ctx context.Context, user *accessgraphv1alpha.AWSUserV1) ([]*accessgraphv1alpha.AWSUserInlinePolicyV1, error) {
@@ -180,7 +180,7 @@ func (a *Fetcher) fetchUserInlinePolicies(ctx context.Context, user *accessgraph
 	pager := iam.NewListUserPoliciesPaginator(
 		iamClient,
 		&iam.ListUserPoliciesInput{
-			UserName: aws.String(user.UserName),
+			UserName: aws.String(user.GetUserName()),
 			MaxItems: aws.Int32(pageSize),
 		},
 		func(opts *iam.ListUserPoliciesPaginatorOptions) {
@@ -200,11 +200,11 @@ func (a *Fetcher) fetchUserInlinePolicies(ctx context.Context, user *accessgraph
 		}
 		for _, policyName := range page.PolicyNames {
 			policy, err := iamClient.GetUserPolicy(ctx, &iam.GetUserPolicyInput{
-				UserName:   aws.String(user.UserName),
+				UserName:   aws.String(user.GetUserName()),
 				PolicyName: aws.String(policyName),
 			})
 			if err != nil {
-				errCollect(trace.Wrap(err, "failed to fetch user %q inline policy %q", user.UserName, policyName))
+				errCollect(trace.Wrap(err, "failed to fetch user %q inline policy %q", user.GetUserName(), policyName))
 				continue
 			}
 
@@ -215,12 +215,12 @@ func (a *Fetcher) fetchUserInlinePolicies(ctx context.Context, user *accessgraph
 }
 
 func awsUserPolicyToProtoUserPolicy(policy *iam.GetUserPolicyOutput, user *accessgraphv1alpha.AWSUserV1, accountID string) *accessgraphv1alpha.AWSUserInlinePolicyV1 {
-	return &accessgraphv1alpha.AWSUserInlinePolicyV1{
+	return accessgraphv1alpha.AWSUserInlinePolicyV1_builder{
 		PolicyName:     aws.ToString(policy.PolicyName),
 		PolicyDocument: []byte(aws.ToString(policy.PolicyDocument)),
 		User:           user,
 		AccountId:      accountID,
-	}
+	}.Build()
 }
 
 func (a *Fetcher) fetchUserAttachedPolicies(ctx context.Context, user *accessgraphv1alpha.AWSUserV1) (*accessgraphv1alpha.AWSUserAttachedPolicies, error) {
@@ -236,7 +236,7 @@ func (a *Fetcher) fetchUserAttachedPolicies(ctx context.Context, user *accessgra
 	pager := iam.NewListAttachedUserPoliciesPaginator(
 		iamClient,
 		&iam.ListAttachedUserPoliciesInput{
-			UserName: aws.String(user.UserName),
+			UserName: aws.String(user.GetUserName()),
 			MaxItems: aws.Int32(pageSize),
 		},
 		func(opts *iam.ListAttachedUserPoliciesPaginatorOptions) {
@@ -244,32 +244,32 @@ func (a *Fetcher) fetchUserAttachedPolicies(ctx context.Context, user *accessgra
 		},
 	)
 
-	rsp := &accessgraphv1alpha.AWSUserAttachedPolicies{
+	rsp := accessgraphv1alpha.AWSUserAttachedPolicies_builder{
 		User:      user,
 		AccountId: a.AccountID,
-	}
+	}.Build()
 	for pager.HasMorePages() {
 		page, err := pager.NextPage(ctx)
 		if err != nil {
 			return rsp, trace.Wrap(err)
 		}
 		for _, policy := range page.AttachedPolicies {
-			rsp.Policies = append(
-				rsp.Policies,
-				&accessgraphv1alpha.AttachedPolicyV1{
+			rsp.SetPolicies(append(
+				rsp.GetPolicies(),
+				accessgraphv1alpha.AttachedPolicyV1_builder{
 					Arn:        aws.ToString(policy.PolicyArn),
 					PolicyName: aws.ToString(policy.PolicyName),
-				},
-			)
+				}.Build(),
+			))
 		}
 	}
 	return rsp, trace.Wrap(err)
 }
 
 func (a *Fetcher) fetchGroupsForUser(ctx context.Context, user *accessgraphv1alpha.AWSUserV1) (*accessgraphv1alpha.AWSUserGroupsV1, error) {
-	userGroups := &accessgraphv1alpha.AWSUserGroupsV1{
+	userGroups := accessgraphv1alpha.AWSUserGroupsV1_builder{
 		User: user,
-	}
+	}.Build()
 
 	awsCfg, err := a.AWSConfigProvider.GetConfig(
 		ctx,
@@ -284,7 +284,7 @@ func (a *Fetcher) fetchGroupsForUser(ctx context.Context, user *accessgraphv1alp
 	pager := iam.NewListGroupsForUserPaginator(
 		iamClient,
 		&iam.ListGroupsForUserInput{
-			UserName: aws.String(user.UserName),
+			UserName: aws.String(user.GetUserName()),
 			MaxItems: aws.Int32(pageSize),
 		},
 		func(opts *iam.ListGroupsForUserPaginatorOptions) {
@@ -297,7 +297,7 @@ func (a *Fetcher) fetchGroupsForUser(ctx context.Context, user *accessgraphv1alp
 			return nil, trace.Wrap(err)
 		}
 		for _, group := range page.Groups {
-			userGroups.Groups = append(userGroups.Groups, awsGroupToProtoGroup(group, a.AccountID))
+			userGroups.SetGroups(append(userGroups.GetGroups(), awsGroupToProtoGroup(group, a.AccountID)))
 		}
 	}
 	return userGroups, nil
diff --git a/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go b/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go
index 10070675476..fffda7d316c 100644
--- a/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go
+++ b/lib/srv/discovery/fetchers/azuresync/azure-sync_test.go
@@ -314,26 +314,26 @@ func TestPoll(t *testing.T) {
 			require.Equal(t, tt.feats.RoleDefinitions == false || len(tt.roleDefs) == 0, len(resources.RoleDefinitions) == 0)
 			for idx, resource := range resources.RoleDefinitions {
 				roleDef := tt.roleDefs[idx]
-				require.Equal(t, *roleDef.ID, resource.Id)
-				require.Equal(t, fetcher.SubscriptionID, resource.SubscriptionId)
-				require.Equal(t, *roleDef.Properties.RoleName, resource.Name)
-				require.Len(t, roleDef.Properties.Permissions, len(resource.Permissions))
+				require.Equal(t, *roleDef.ID, resource.GetId())
+				require.Equal(t, fetcher.SubscriptionID, resource.GetSubscriptionId())
+				require.Equal(t, *roleDef.Properties.RoleName, resource.GetName())
+				require.Len(t, roleDef.Properties.Permissions, len(resource.GetPermissions()))
 			}
 			require.Equal(t, tt.feats.RoleAssignments == false || len(tt.roleAssigns) == 0, len(resources.RoleAssignments) == 0)
 			for idx, resource := range resources.RoleAssignments {
 				roleAssign := tt.roleAssigns[idx]
-				require.Equal(t, *roleAssign.ID, resource.Id)
-				require.Equal(t, fetcher.SubscriptionID, resource.SubscriptionId)
-				require.Equal(t, *roleAssign.Properties.PrincipalID, resource.PrincipalId)
-				require.Equal(t, *roleAssign.Properties.RoleDefinitionID, resource.RoleDefinitionId)
-				require.Equal(t, *roleAssign.Properties.Scope, resource.Scope)
+				require.Equal(t, *roleAssign.ID, resource.GetId())
+				require.Equal(t, fetcher.SubscriptionID, resource.GetSubscriptionId())
+				require.Equal(t, *roleAssign.Properties.PrincipalID, resource.GetPrincipalId())
+				require.Equal(t, *roleAssign.Properties.RoleDefinitionID, resource.GetRoleDefinitionId())
+				require.Equal(t, *roleAssign.Properties.Scope, resource.GetScope())
 			}
 			require.Equal(t, tt.feats.VirtualMachines == false || len(tt.vms) == 0, len(resources.VirtualMachines) == 0)
 			for idx, resource := range resources.VirtualMachines {
 				vm := tt.vms[idx]
-				require.Equal(t, vm.ID, resource.Id)
-				require.Equal(t, fetcher.SubscriptionID, resource.SubscriptionId)
-				require.Equal(t, vm.Name, resource.Name)
+				require.Equal(t, vm.ID, resource.GetId())
+				require.Equal(t, fetcher.SubscriptionID, resource.GetSubscriptionId())
+				require.Equal(t, vm.Name, resource.GetName())
 			}
 		})
 	}
diff --git a/lib/srv/discovery/fetchers/azuresync/memberships.go b/lib/srv/discovery/fetchers/azuresync/memberships.go
index f8420b78d15..2eaeeed8cdf 100644
--- a/lib/srv/discovery/fetchers/azuresync/memberships.go
+++ b/lib/srv/discovery/fetchers/azuresync/memberships.go
@@ -36,21 +36,21 @@ func expandMemberships(ctx context.Context, cli *msgraph.Client, principals []*a
 	// Map principals by ID
 	var principalsMap = make(map[string]*accessgraphv1alpha.AzurePrincipal)
 	for _, principal := range principals {
-		principalsMap[principal.Id] = principal
+		principalsMap[principal.GetId()] = principal
 	}
 	// Iterate through the Azure groups and add the group ID as a membership for its corresponding principal
 	eg, _ := errgroup.WithContext(ctx)
 	eg.SetLimit(parallelism)
 	errCh := make(chan error, len(principals))
 	for _, principal := range principals {
-		if principal.ObjectType != "group" {
+		if principal.GetObjectType() != "group" {
 			continue
 		}
 		group := principal
 		eg.Go(func() error {
-			err := cli.IterateGroupMembers(ctx, group.Id, func(member models.GroupMember) bool {
+			err := cli.IterateGroupMembers(ctx, group.GetId(), func(member models.GroupMember) bool {
 				if memberPrincipal, ok := principalsMap[*member.GetID()]; ok {
-					memberPrincipal.MemberOf = append(memberPrincipal.MemberOf, group.Id)
+					memberPrincipal.SetMemberOf(append(memberPrincipal.GetMemberOf(), group.GetId()))
 				}
 				return true
 			})
diff --git a/lib/srv/discovery/fetchers/azuresync/principals.go b/lib/srv/discovery/fetchers/azuresync/principals.go
index a6f0a3fd81c..34ad58bb4b9 100644
--- a/lib/srv/discovery/fetchers/azuresync/principals.go
+++ b/lib/srv/discovery/fetchers/azuresync/principals.go
@@ -75,12 +75,12 @@ func fetchPrincipals(ctx context.Context, subscriptionID string, cli *msgraph.Cl
 				trace.BadParameter("nil values on msgraph directory object: %v", res.dirObj))
 			continue
 		}
-		pbPrincipals = append(pbPrincipals, &accessgraphv1alpha.AzurePrincipal{
+		pbPrincipals = append(pbPrincipals, accessgraphv1alpha.AzurePrincipal_builder{
 			Id:             *res.dirObj.ID,
 			SubscriptionId: subscriptionID,
 			DisplayName:    *res.dirObj.DisplayName,
 			ObjectType:     res.metadata.objectType,
-		})
+		}.Build())
 	}
 	return pbPrincipals, trace.NewAggregate(fetchErrs...)
 }
diff --git a/lib/srv/discovery/fetchers/azuresync/reconcile.go b/lib/srv/discovery/fetchers/azuresync/reconcile.go
index a874f482158..8d09f410e5c 100644
--- a/lib/srv/discovery/fetchers/azuresync/reconcile.go
+++ b/lib/srv/discovery/fetchers/azuresync/reconcile.go
@@ -51,9 +51,9 @@ func MergeResources(results ...*Resources) *Resources {
 
 // newResourceList creates a new resource list message
 func newResourceList() *accessgraphv1alpha.AzureResourceList {
-	return &accessgraphv1alpha.AzureResourceList{
+	return accessgraphv1alpha.AzureResourceList_builder{
 		Resources: make([]*accessgraphv1alpha.AzureResource, 0),
-	}
+	}.Build()
 }
 
 // ReconcileResults compares previously and currently fetched results and determines which resources to upsert and
@@ -67,8 +67,8 @@ func ReconcileResults(old *Resources, new *Resources) (upsert, delete *accessgra
 		reconcile(old.VirtualMachines, new.VirtualMachines, azureVmKey, azureVmWrap),
 	}
 	for _, res := range reconciledResources {
-		upsert.Resources = append(upsert.Resources, res.upsert.Resources...)
-		delete.Resources = append(delete.Resources, res.delete.Resources...)
+		upsert.SetResources(append(upsert.GetResources(), res.upsert.GetResources()...))
+		delete.SetResources(append(delete.GetResources(), res.delete.GetResources()...))
 	}
 	return upsert, delete
 }
@@ -93,7 +93,7 @@ func reconcile[T proto.Message](
 	// Delete all old items if there are no new items
 	if len(newItems) == 0 {
 		for _, item := range oldItems {
-			deleteRes.Resources = append(deleteRes.Resources, wrapFn(item))
+			deleteRes.SetResources(append(deleteRes.GetResources(), wrapFn(item)))
 		}
 		return &reconcilePair{upsertRes, deleteRes}
 	}
@@ -101,7 +101,7 @@ func reconcile[T proto.Message](
 	// Create all new items if there are no old items
 	if len(oldItems) == 0 {
 		for _, item := range newItems {
-			upsertRes.Resources = append(upsertRes.Resources, wrapFn(item))
+			upsertRes.SetResources(append(upsertRes.GetResources(), wrapFn(item)))
 		}
 		return &reconcilePair{upsertRes, deleteRes}
 	}
@@ -119,21 +119,21 @@ func reconcile[T proto.Message](
 	// Append new or modified items to the upsert list
 	for _, item := range newItems {
 		if oldItem, ok := oldMap[keyFn(item)]; !ok || !proto.Equal(oldItem, item) {
-			upsertRes.Resources = append(upsertRes.Resources, wrapFn(item))
+			upsertRes.SetResources(append(upsertRes.GetResources(), wrapFn(item)))
 		}
 	}
 
 	// Append removed items to the delete list
 	for _, item := range oldItems {
 		if _, ok := newMap[keyFn(item)]; !ok {
-			deleteRes.Resources = append(deleteRes.Resources, wrapFn(item))
+			deleteRes.SetResources(append(deleteRes.GetResources(), wrapFn(item)))
 		}
 	}
 	return &reconcilePair{upsertRes, deleteRes}
 }
 
 func azurePrincipalsKey(user *accessgraphv1alpha.AzurePrincipal) string {
-	return fmt.Sprintf("%s:%s", user.SubscriptionId, user.Id)
+	return fmt.Sprintf("%s:%s", user.GetSubscriptionId(), user.GetId())
 }
 
 func azurePrincipalsWrap(principal *accessgraphv1alpha.AzurePrincipal) *accessgraphv1alpha.AzureResource {
@@ -141,7 +141,7 @@ func azurePrincipalsWrap(principal *accessgraphv1alpha.AzurePrincipal) *accessgr
 }
 
 func azureRoleAssignKey(roleAssign *accessgraphv1alpha.AzureRoleAssignment) string {
-	return fmt.Sprintf("%s:%s", roleAssign.SubscriptionId, roleAssign.Id)
+	return fmt.Sprintf("%s:%s", roleAssign.GetSubscriptionId(), roleAssign.GetId())
 }
 
 func azureRoleAssignWrap(roleAssign *accessgraphv1alpha.AzureRoleAssignment) *accessgraphv1alpha.AzureResource {
@@ -149,7 +149,7 @@ func azureRoleAssignWrap(roleAssign *accessgraphv1alpha.AzureRoleAssignment) *ac
 }
 
 func azureRoleDefKey(roleDef *accessgraphv1alpha.AzureRoleDefinition) string {
-	return fmt.Sprintf("%s:%s", roleDef.SubscriptionId, roleDef.Id)
+	return fmt.Sprintf("%s:%s", roleDef.GetSubscriptionId(), roleDef.GetId())
 }
 
 func azureRoleDefWrap(roleDef *accessgraphv1alpha.AzureRoleDefinition) *accessgraphv1alpha.AzureResource {
@@ -157,7 +157,7 @@ func azureRoleDefWrap(roleDef *accessgraphv1alpha.AzureRoleDefinition) *accessgr
 }
 
 func azureVmKey(vm *accessgraphv1alpha.AzureVirtualMachine) string {
-	return fmt.Sprintf("%s:%s", vm.SubscriptionId, vm.Id)
+	return fmt.Sprintf("%s:%s", vm.GetSubscriptionId(), vm.GetId())
 }
 
 func azureVmWrap(vm *accessgraphv1alpha.AzureVirtualMachine) *accessgraphv1alpha.AzureResource {
diff --git a/lib/srv/discovery/fetchers/azuresync/reconcile_test.go b/lib/srv/discovery/fetchers/azuresync/reconcile_test.go
index 3652c496321..a932d1f889a 100644
--- a/lib/srv/discovery/fetchers/azuresync/reconcile_test.go
+++ b/lib/srv/discovery/fetchers/azuresync/reconcile_test.go
@@ -97,8 +97,8 @@ func TestReconcileResults(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			upserts, deletes := ReconcileResults(tt.oldResults, tt.newResults)
-			require.ElementsMatch(t, upserts.Resources, tt.expectedUpserts.Resources)
-			require.ElementsMatch(t, deletes.Resources, tt.expectedDeletes.Resources)
+			require.ElementsMatch(t, upserts.GetResources(), tt.expectedUpserts.GetResources())
+			require.ElementsMatch(t, deletes.GetResources(), tt.expectedDeletes.GetResources())
 		})
 	}
 
@@ -110,88 +110,88 @@ func generateExpected(
 	roleAssigns []*accessgraphv1alpha.AzureRoleAssignment,
 	vms []*accessgraphv1alpha.AzureVirtualMachine,
 ) *accessgraphv1alpha.AzureResourceList {
-	resList := &accessgraphv1alpha.AzureResourceList{
+	resList := accessgraphv1alpha.AzureResourceList_builder{
 		Resources: make([]*accessgraphv1alpha.AzureResource, 0),
-	}
+	}.Build()
 	for _, principal := range principals {
-		resList.Resources = append(resList.Resources, azurePrincipalsWrap(principal))
+		resList.SetResources(append(resList.GetResources(), azurePrincipalsWrap(principal)))
 	}
 	for _, roleDef := range roleDefs {
-		resList.Resources = append(resList.Resources, azureRoleDefWrap(roleDef))
+		resList.SetResources(append(resList.GetResources(), azureRoleDefWrap(roleDef)))
 	}
 	for _, roleAssign := range roleAssigns {
-		resList.Resources = append(resList.Resources, azureRoleAssignWrap(roleAssign))
+		resList.SetResources(append(resList.GetResources(), azureRoleAssignWrap(roleAssign)))
 	}
 	for _, vm := range vms {
-		resList.Resources = append(resList.Resources, azureVmWrap(vm))
+		resList.SetResources(append(resList.GetResources(), azureVmWrap(vm)))
 	}
 	return resList
 }
 
 func generatePrincipals() []*accessgraphv1alpha.AzurePrincipal {
 	return []*accessgraphv1alpha.AzurePrincipal{
-		{
+		accessgraphv1alpha.AzurePrincipal_builder{
 			Id:          "/principals/foo",
 			DisplayName: "userFoo",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzurePrincipal_builder{
 			Id:          "/principals/bar",
 			DisplayName: "userBar",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzurePrincipal_builder{
 			Id:          "/principals/charles",
 			DisplayName: "userCharles",
-		},
+		}.Build(),
 	}
 }
 
 func generateRoleDefs() []*accessgraphv1alpha.AzureRoleDefinition {
 	return []*accessgraphv1alpha.AzureRoleDefinition{
-		{
+		accessgraphv1alpha.AzureRoleDefinition_builder{
 			Id:   "/roledefinitions/foo",
 			Name: "roleFoo",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzureRoleDefinition_builder{
 			Id:   "/roledefinitions/bar",
 			Name: "roleBar",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzureRoleDefinition_builder{
 			Id:   "/roledefinitions/charles",
 			Name: "roleCharles",
-		},
+		}.Build(),
 	}
 }
 
 func generateRoleAssigns() []*accessgraphv1alpha.AzureRoleAssignment {
 	return []*accessgraphv1alpha.AzureRoleAssignment{
-		{
+		accessgraphv1alpha.AzureRoleAssignment_builder{
 			Id:          "/roleassignments/foo",
 			PrincipalId: "userFoo",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzureRoleAssignment_builder{
 			Id:          "/roleassignments/bar",
 			PrincipalId: "userBar",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzureRoleAssignment_builder{
 			Id:          "/roleassignments/charles",
 			PrincipalId: "userCharles",
-		},
+		}.Build(),
 	}
 }
 
 func generateVms() []*accessgraphv1alpha.AzureVirtualMachine {
 	return []*accessgraphv1alpha.AzureVirtualMachine{
-		{
+		accessgraphv1alpha.AzureVirtualMachine_builder{
 			Id:   "/vms/foo",
 			Name: "userFoo",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzureVirtualMachine_builder{
 			Id:   "/vms/bar",
 			Name: "userBar",
-		},
-		{
+		}.Build(),
+		accessgraphv1alpha.AzureVirtualMachine_builder{
 			Id:   "/vms/charles",
 			Name: "userCharles",
-		},
+		}.Build(),
 	}
 }
diff --git a/lib/srv/discovery/fetchers/azuresync/roleassignments.go b/lib/srv/discovery/fetchers/azuresync/roleassignments.go
index 282b001ba7a..af1ee0c969a 100644
--- a/lib/srv/discovery/fetchers/azuresync/roleassignments.go
+++ b/lib/srv/discovery/fetchers/azuresync/roleassignments.go
@@ -53,13 +53,13 @@ func fetchRoleAssignments(ctx context.Context, subscriptionID string, cli RoleAs
 				trace.BadParameter("nil values on AzureRoleAssignment object: %v", roleAssign))
 			continue
 		}
-		pbRoleAssign := &accessgraphv1alpha.AzureRoleAssignment{
+		pbRoleAssign := accessgraphv1alpha.AzureRoleAssignment_builder{
 			Id:               *roleAssign.ID,
 			SubscriptionId:   subscriptionID,
 			PrincipalId:      *roleAssign.Properties.PrincipalID,
 			RoleDefinitionId: *roleAssign.Properties.RoleDefinitionID,
 			Scope:            *roleAssign.Properties.Scope,
-		}
+		}.Build()
 		pbRoleAssigns = append(pbRoleAssigns, pbRoleAssign)
 	}
 	return pbRoleAssigns, trace.NewAggregate(fetchErrs...)
diff --git a/lib/srv/discovery/fetchers/azuresync/roledefinitions.go b/lib/srv/discovery/fetchers/azuresync/roledefinitions.go
index 0b50fdde567..796a77599fd 100644
--- a/lib/srv/discovery/fetchers/azuresync/roledefinitions.go
+++ b/lib/srv/discovery/fetchers/azuresync/roledefinitions.go
@@ -64,12 +64,12 @@ func fetchRoleDefinitions(ctx context.Context, subscriptionID string, cli RoleDe
 			}
 			pbPerms = append(pbPerms, &pbPerm)
 		}
-		pbRoleDef := &accessgraphv1alpha.AzureRoleDefinition{
+		pbRoleDef := accessgraphv1alpha.AzureRoleDefinition_builder{
 			Id:             *roleDef.ID,
 			Name:           *roleDef.Properties.RoleName,
 			SubscriptionId: subscriptionID,
 			Permissions:    pbPerms,
-		}
+		}.Build()
 		pbRoleDefs = append(pbRoleDefs, pbRoleDef)
 	}
 	return pbRoleDefs, trace.NewAggregate(fetchErrs...)
diff --git a/lib/srv/discovery/kube_integration_watcher.go b/lib/srv/discovery/kube_integration_watcher.go
index b1d8cb7f772..d0cae495f10 100644
--- a/lib/srv/discovery/kube_integration_watcher.go
+++ b/lib/srv/discovery/kube_integration_watcher.go
@@ -285,13 +285,13 @@ func (s *Server) enrollEKSClusters(region, integration, discoveryConfigName stri
 			continue
 		}
 
-		rsp, err := s.AccessPoint.EnrollEKSClusters(ctx, &integrationv1.EnrollEKSClustersRequest{
+		rsp, err := s.AccessPoint.EnrollEKSClusters(ctx, integrationv1.EnrollEKSClustersRequest_builder{
 			Integration:        integration,
 			Region:             region,
 			EksClusterNames:    clusterNames,
 			EnableAppDiscovery: kubeAppDiscovery,
 			AgentVersion:       agentVersion.String(),
-		})
+		}.Build())
 		if err != nil {
 			s.awsEKSResourcesStatus.incrementFailed(awsResourceGroup{
 				discoveryConfigName: discoveryConfigName,
@@ -301,41 +301,41 @@ func (s *Server) enrollEKSClusters(region, integration, discoveryConfigName stri
 			continue
 		}
 
-		for _, r := range rsp.Results {
-			if r.Error != "" {
+		for _, r := range rsp.GetResults() {
+			if r.GetError() != "" {
 				s.awsEKSResourcesStatus.incrementFailed(awsResourceGroup{
 					discoveryConfigName: discoveryConfigName,
 					integration:         integration,
 				}, 1)
-				if !strings.Contains(r.Error, "teleport-kube-agent is already installed on the cluster") {
-					s.Log.ErrorContext(ctx, "Failed to enroll EKS cluster", "cluster_name", r.EksClusterName, "issue_type", r.IssueType, "error", r.Error)
+				if !strings.Contains(r.GetError(), "teleport-kube-agent is already installed on the cluster") {
+					s.Log.ErrorContext(ctx, "Failed to enroll EKS cluster", "cluster_name", r.GetEksClusterName(), "issue_type", r.GetIssueType(), "error", r.GetError())
 				} else {
-					s.Log.DebugContext(ctx, "EKS cluster already has installed kube agent", "cluster_name", r.EksClusterName)
+					s.Log.DebugContext(ctx, "EKS cluster already has installed kube agent", "cluster_name", r.GetEksClusterName())
 				}
 
-				cluster, ok := clustersByName[r.EksClusterName]
+				cluster, ok := clustersByName[r.GetEksClusterName()]
 				if !ok {
-					s.Log.WarnContext(ctx, "Received an EnrollEKSCluster result for a cluster which was not part of the requested clusters", "cluster_name", r.EksClusterName, "clusters_install_request", clusterNames)
+					s.Log.WarnContext(ctx, "Received an EnrollEKSCluster result for a cluster which was not part of the requested clusters", "cluster_name", r.GetEksClusterName(), "clusters_install_request", clusterNames)
 					continue
 				}
 				s.awsEKSTasks.addFailedEnrollment(
 					awsEKSTaskKey{
 						integration:     integration,
-						issueType:       r.IssueType,
+						issueType:       r.GetIssueType(),
 						accountID:       cluster.GetAWSConfig().AccountID,
 						region:          cluster.GetAWSConfig().Region,
 						appAutoDiscover: kubeAppDiscovery,
 					},
-					&usertasksv1.DiscoverEKSCluster{
+					usertasksv1.DiscoverEKSCluster_builder{
 						DiscoveryConfig: discoveryConfigName,
 						DiscoveryGroup:  s.DiscoveryGroup,
 						SyncTime:        timestamppb.New(s.clock.Now()),
 						Name:            cluster.GetAWSConfig().Name,
-					},
+					}.Build(),
 				)
 				s.upsertTasksForAWSEKSFailedEnrollments()
 			} else {
-				s.Log.InfoContext(ctx, "Successfully enrolled EKS cluster", "cluster_name", r.EksClusterName)
+				s.Log.InfoContext(ctx, "Successfully enrolled EKS cluster", "cluster_name", r.GetEksClusterName())
 			}
 		}
 	}
diff --git a/lib/srv/discovery/kube_integration_watcher_test.go b/lib/srv/discovery/kube_integration_watcher_test.go
index e2eb7e95681..2119eef27bb 100644
--- a/lib/srv/discovery/kube_integration_watcher_test.go
+++ b/lib/srv/discovery/kube_integration_watcher_test.go
@@ -240,13 +240,13 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 	}
 	clusterUpserter := func(ctx context.Context, authServer *auth.Server, request *integrationpb.EnrollEKSClustersRequest) (*integrationpb.EnrollEKSClustersResponse, error) {
 		response := &integrationpb.EnrollEKSClustersResponse{}
-		for _, c := range request.EksClusterNames {
+		for _, c := range request.GetEksClusterNames() {
 			eksCluster := clusterFinder(c)
 			if eksCluster == nil {
-				response.Results = append(response.Results, &integrationpb.EnrollEKSClusterResult{
+				response.SetResults(append(response.GetResults(), integrationpb.EnrollEKSClusterResult_builder{
 					EksClusterName: c,
 					Error:          "not found",
-				})
+				}.Build()))
 				continue
 			}
 
@@ -258,10 +258,10 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 			}
 			assert.NoError(t, err)
 
-			response.Results = append(response.Results, &integrationpb.EnrollEKSClusterResult{
+			response.SetResults(append(response.GetResults(), integrationpb.EnrollEKSClusterResult_builder{
 				EksClusterName: c,
 				ResourceId:     "resourceID",
-			})
+			}.Build()))
 		}
 		return response, nil
 	}
@@ -313,7 +313,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 				return &accessPointWrapper{
 					DiscoveryAccessPoint: getDiscoveryAccessPoint(authServer, authClient),
 					enrollEKSClusters: func(ctx context.Context, request *integrationpb.EnrollEKSClustersRequest, _ ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error) {
-						assert.Len(t, request.EksClusterNames, 1)
+						assert.Len(t, request.GetEksClusterNames(), 1)
 
 						response, err := clusterUpserter(ctx, authServer, request)
 						assert.NoError(t, err)
@@ -344,7 +344,7 @@ func TestDiscoveryKubeIntegrationEKS(t *testing.T) {
 				return &accessPointWrapper{
 					DiscoveryAccessPoint: getDiscoveryAccessPoint(authServer, authClient),
 					enrollEKSClusters: func(ctx context.Context, request *integrationpb.EnrollEKSClustersRequest, _ ...grpc.CallOption) (*integrationpb.EnrollEKSClustersResponse, error) {
-						assert.Len(t, request.EksClusterNames, 2)
+						assert.Len(t, request.GetEksClusterNames(), 2)
 
 						response, err := clusterUpserter(ctx, authServer, request)
 						assert.NoError(t, err)
diff --git a/lib/srv/discovery/status.go b/lib/srv/discovery/status.go
index 09c5c0c152b..331fe3018e5 100644
--- a/lib/srv/discovery/status.go
+++ b/lib/srv/discovery/status.go
@@ -298,13 +298,13 @@ func (ars *awsResourcesStatus) mergeIntoGlobalStatus(discoveryConfigName string,
 			syncStart = timestamppb.New(*groupResult.syncStart)
 		}
 
-		resourcesSummary := &discoveryconfigv1.ResourcesDiscoveredSummary{
+		resourcesSummary := discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 			Found:     uint64(groupResult.found),
 			Enrolled:  uint64(groupResult.enrolled),
 			Failed:    uint64(groupResult.failed),
 			SyncStart: syncStart,
 			SyncEnd:   syncEnd,
-		}
+		}.Build()
 
 		integrationDiscoveredSummaryUpdate(existingIntegrationResources, ars.resourceType, resourcesSummary)
 
@@ -407,14 +407,14 @@ func (s *Server) ReportEC2SSMInstallationResult(ctx context.Context, result *ser
 			ssmDocument:     result.SSMDocumentName,
 			installerScript: result.InstallerScript,
 		},
-		&usertasksv1.DiscoverEC2Instance{
+		usertasksv1.DiscoverEC2Instance_builder{
 			InvocationUrl:   result.SSMRunEvent.InvocationURL,
 			DiscoveryConfig: result.DiscoveryConfigName,
 			DiscoveryGroup:  s.DiscoveryGroup,
 			SyncTime:        timestamppb.New(s.clock.Now()),
 			InstanceId:      result.SSMRunEvent.InstanceID,
 			Name:            result.InstanceName,
-		},
+		}.Build(),
 	)
 
 	return nil
@@ -468,15 +468,15 @@ func (d *awsEC2Tasks) addFailedEnrollment(g awsEC2TaskKey, instance *usertasksv1
 		d.instancesIssues = make(map[awsEC2TaskKey]*usertasksv1.DiscoverEC2)
 	}
 	if _, ok := d.instancesIssues[g]; !ok {
-		d.instancesIssues[g] = &usertasksv1.DiscoverEC2{
+		d.instancesIssues[g] = usertasksv1.DiscoverEC2_builder{
 			Instances:       make(map[string]*usertasksv1.DiscoverEC2Instance),
 			AccountId:       g.accountID,
 			Region:          g.region,
 			SsmDocument:     g.ssmDocument,
 			InstallerScript: g.installerScript,
-		}
+		}.Build()
 	}
-	d.instancesIssues[g].Instances[instance.InstanceId] = instance
+	d.instancesIssues[g].GetInstances()[instance.GetInstanceId()] = instance
 
 	if d.issuesSyncQueue == nil {
 		d.issuesSyncQueue = make(map[awsEC2TaskKey]struct{})
@@ -533,14 +533,14 @@ func (d *awsEKSTasks) addFailedEnrollment(g awsEKSTaskKey, cluster *usertasksv1.
 		d.clusterIssues = make(map[awsEKSTaskKey]*usertasksv1.DiscoverEKS)
 	}
 	if _, ok := d.clusterIssues[g]; !ok {
-		d.clusterIssues[g] = &usertasksv1.DiscoverEKS{
+		d.clusterIssues[g] = usertasksv1.DiscoverEKS_builder{
 			Clusters:        make(map[string]*usertasksv1.DiscoverEKSCluster),
 			AccountId:       g.accountID,
 			Region:          g.region,
 			AppAutoDiscover: g.appAutoDiscover,
-		}
+		}.Build()
 	}
-	d.clusterIssues[g].Clusters[cluster.Name] = cluster
+	d.clusterIssues[g].GetClusters()[cluster.GetName()] = cluster
 
 	if d.issuesSyncQueue == nil {
 		d.issuesSyncQueue = make(map[awsEKSTaskKey]struct{})
@@ -596,13 +596,13 @@ func (d *awsRDSTasks) addFailedEnrollment(g awsRDSTaskKey, database *usertasksv1
 		d.databaseIssues = make(map[awsRDSTaskKey]*usertasksv1.DiscoverRDS)
 	}
 	if _, ok := d.databaseIssues[g]; !ok {
-		d.databaseIssues[g] = &usertasksv1.DiscoverRDS{
+		d.databaseIssues[g] = usertasksv1.DiscoverRDS_builder{
 			Databases: make(map[string]*usertasksv1.DiscoverRDSDatabase),
 			AccountId: g.accountID,
 			Region:    g.region,
-		}
+		}.Build()
 	}
-	d.databaseIssues[g].Databases[database.Name] = database
+	d.databaseIssues[g].GetDatabases()[database.GetName()] = database
 
 	if d.issuesSyncQueue == nil {
 		d.issuesSyncQueue = make(map[awsRDSTaskKey]struct{})
@@ -667,7 +667,7 @@ func (s *taskUpdater) acquireSemaphoreForUserTask(userTaskName string) (releaseF
 //
 // All of this flow is protected by a lock to ensure there's no race between this and other DiscoveryServices.
 func (s *taskUpdater) mergeUpsertDiscoverEC2Task(taskGroup awsEC2TaskKey, failedInstances *usertasksv1.DiscoverEC2) error {
-	if len(failedInstances.Instances) == 0 {
+	if len(failedInstances.GetInstances()) == 0 {
 		return nil
 	}
 
@@ -693,7 +693,7 @@ func (s *taskUpdater) mergeUpsertDiscoverEC2Task(taskGroup awsEC2TaskKey, failed
 	case err != nil:
 		return trace.Wrap(err)
 	default:
-		mergeExistingInstances(s, currentUserTask.Spec.DiscoverEc2.Instances, failedInstances.Instances)
+		mergeExistingInstances(s, currentUserTask.GetSpec().GetDiscoverEc2().GetInstances(), failedInstances.GetInstances())
 	}
 
 	// If the DiscoveryService is stopped, or the issue does not happen again
@@ -701,13 +701,13 @@ func (s *taskUpdater) mergeUpsertDiscoverEC2Task(taskGroup awsEC2TaskKey, failed
 	taskExpiration := s.clock.Now().Add(2 * s.PollInterval)
 
 	task, err := usertasks.NewDiscoverEC2UserTask(
-		&usertasksv1.UserTaskSpec{
+		usertasksv1.UserTaskSpec_builder{
 			Integration: taskGroup.integration,
 			TaskType:    usertasks.TaskTypeDiscoverEC2,
 			IssueType:   taskGroup.issueType,
 			State:       usertasks.TaskStateOpen,
 			DiscoverEc2: failedInstances,
-		},
+		}.Build(),
 		usertasks.WithExpiration(taskExpiration),
 	)
 	if err != nil {
@@ -764,7 +764,7 @@ func (s *Server) upsertTasksForAWSEKSFailedEnrollments() {
 //
 // All of this flow is protected by a lock to ensure there's no race between this and other DiscoveryServices.
 func (s *taskUpdater) mergeUpsertDiscoverEKSTask(taskGroup awsEKSTaskKey, failedClusters *usertasksv1.DiscoverEKS) error {
-	if len(failedClusters.Clusters) == 0 {
+	if len(failedClusters.GetClusters()) == 0 {
 		return nil
 	}
 
@@ -789,7 +789,7 @@ func (s *taskUpdater) mergeUpsertDiscoverEKSTask(taskGroup awsEKSTaskKey, failed
 	case err != nil:
 		return trace.Wrap(err)
 	default:
-		mergeExistingInstances(s, currentUserTask.Spec.DiscoverEks.Clusters, failedClusters.Clusters)
+		mergeExistingInstances(s, currentUserTask.GetSpec().GetDiscoverEks().GetClusters(), failedClusters.GetClusters())
 	}
 
 	// If the DiscoveryService is stopped, or the issue does not happen again
@@ -797,13 +797,13 @@ func (s *taskUpdater) mergeUpsertDiscoverEKSTask(taskGroup awsEKSTaskKey, failed
 	taskExpiration := s.clock.Now().Add(2 * s.PollInterval)
 
 	task, err := usertasks.NewDiscoverEKSUserTask(
-		&usertasksv1.UserTaskSpec{
+		usertasksv1.UserTaskSpec_builder{
 			Integration: taskGroup.integration,
 			TaskType:    usertasks.TaskTypeDiscoverEKS,
 			IssueType:   taskGroup.issueType,
 			State:       usertasks.TaskStateOpen,
 			DiscoverEks: failedClusters,
-		},
+		}.Build(),
 		usertasks.WithExpiration(taskExpiration),
 	)
 	if err != nil {
@@ -841,7 +841,7 @@ func (s *Server) upsertTasksForAWSRDSFailedEnrollments() {
 //
 // All of this flow is protected by a lock to ensure there's no race between this and other DiscoveryServices.
 func (s *taskUpdater) mergeUpsertDiscoverRDSTask(taskGroup awsRDSTaskKey, failedDatabases *usertasksv1.DiscoverRDS) error {
-	if len(failedDatabases.Databases) == 0 {
+	if len(failedDatabases.GetDatabases()) == 0 {
 		return nil
 	}
 
@@ -865,7 +865,7 @@ func (s *taskUpdater) mergeUpsertDiscoverRDSTask(taskGroup awsRDSTaskKey, failed
 	case err != nil:
 		return trace.Wrap(err)
 	default:
-		mergeExistingInstances(s, currentUserTask.Spec.DiscoverRds.Databases, failedDatabases.Databases)
+		mergeExistingInstances(s, currentUserTask.GetSpec().GetDiscoverRds().GetDatabases(), failedDatabases.GetDatabases())
 	}
 
 	// If the DiscoveryService is stopped, or the issue does not happen again
@@ -873,13 +873,13 @@ func (s *taskUpdater) mergeUpsertDiscoverRDSTask(taskGroup awsRDSTaskKey, failed
 	taskExpiration := s.clock.Now().Add(2 * s.PollInterval)
 
 	task, err := usertasks.NewDiscoverRDSUserTask(
-		&usertasksv1.UserTaskSpec{
+		usertasksv1.UserTaskSpec_builder{
 			Integration: taskGroup.integration,
 			TaskType:    usertasks.TaskTypeDiscoverRDS,
 			IssueType:   taskGroup.issueType,
 			State:       usertasks.TaskStateOpen,
 			DiscoverRds: failedDatabases,
-		},
+		}.Build(),
 		usertasks.WithExpiration(taskExpiration),
 	)
 	if err != nil {
@@ -955,16 +955,16 @@ func (t *azureVMTasks) addFailedEnrollment(tg usertasks.TaskGroup, key azureVMTa
 
 	data := tgMap[key]
 	if data == nil {
-		data = &usertasksv1.DiscoverAzureVM{
+		data = usertasksv1.DiscoverAzureVM_builder{
 			Instances:      make(map[string]*usertasksv1.DiscoverAzureVMInstance),
 			SubscriptionId: key.subscriptionID,
 			ResourceGroup:  key.resourceGroup,
 			Region:         key.region,
-		}
+		}.Build()
 		tgMap[key] = data
 	}
 
-	data.Instances[vm.VmId] = vm
+	data.GetInstances()[vm.GetVmId()] = vm
 }
 
 // upsertAll upserts all collected Azure VM user tasks to the backend.
@@ -1044,7 +1044,7 @@ func (s *taskUpdater) mergeUpsertUserTask(newTask *usertasksv1.UserTask, mergeUs
 		return trace.Wrap(err)
 	}
 
-	if oldTask != nil && oldTask.Spec != nil {
+	if oldTask != nil && oldTask.HasSpec() {
 		mergeUserTasks(oldTask.GetSpec(), newTask.GetSpec())
 	}
 
@@ -1053,22 +1053,22 @@ func (s *taskUpdater) mergeUpsertUserTask(newTask *usertasksv1.UserTask, mergeUs
 		return trace.Wrap(err)
 	}
 
-	s.Log.InfoContext(s.ctx, "Upserted user task", "task", taskName, "issue_type", newTask.GetSpec().IssueType, "integration", newTask.GetSpec().Integration)
+	s.Log.InfoContext(s.ctx, "Upserted user task", "task", taskName, "issue_type", newTask.GetSpec().GetIssueType(), "integration", newTask.GetSpec().GetIntegration())
 
 	return nil
 }
 
 func (s *taskUpdater) mergeAzure(oldSpec *usertasksv1.UserTaskSpec, newSpec *usertasksv1.UserTaskSpec) {
-	if oldSpec == nil || oldSpec.DiscoverAzureVm == nil {
+	if oldSpec == nil || !oldSpec.HasDiscoverAzureVm() {
 		return
 	}
-	if newSpec.DiscoverAzureVm == nil {
-		newSpec.DiscoverAzureVm = &usertasksv1.DiscoverAzureVM{}
+	if !newSpec.HasDiscoverAzureVm() {
+		newSpec.SetDiscoverAzureVm(&usertasksv1.DiscoverAzureVM{})
 	}
-	if newSpec.DiscoverAzureVm.Instances == nil {
-		newSpec.DiscoverAzureVm.Instances = make(map[string]*usertasksv1.DiscoverAzureVMInstance)
+	if newSpec.GetDiscoverAzureVm().GetInstances() == nil {
+		newSpec.GetDiscoverAzureVm().SetInstances(make(map[string]*usertasksv1.DiscoverAzureVMInstance))
 	}
-	mergeExistingInstances(s, oldSpec.DiscoverAzureVm.Instances, newSpec.DiscoverAzureVm.Instances)
+	mergeExistingInstances(s, oldSpec.GetDiscoverAzureVm().GetInstances(), newSpec.GetDiscoverAzureVm().GetInstances())
 }
 
 type statusType int
@@ -1152,13 +1152,13 @@ func (s *resourceStatusMap) mergeIntoGlobalStatus(discoveryConfigName string, ex
 			syncEnd = timestamppb.New(*s.syncEnd)
 		}
 
-		resourcesSummary := &discoveryconfigv1.ResourcesDiscoveredSummary{
+		resourcesSummary := discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 			Found:     uint64(results[statusFound]),
 			Enrolled:  uint64(results[statusEnrolled]),
 			Failed:    uint64(results[statusFailed]),
 			SyncStart: syncStart,
 			SyncEnd:   syncEnd,
-		}
+		}.Build()
 
 		integrationDiscoveredSummaryUpdate(summary, s.resourceType, resourcesSummary)
 
diff --git a/lib/srv/discovery/status_test.go b/lib/srv/discovery/status_test.go
index ea0bde5b08e..e5eeb6f56a5 100644
--- a/lib/srv/discovery/status_test.go
+++ b/lib/srv/discovery/status_test.go
@@ -181,20 +181,20 @@ func TestMergeUpsertUserTask(t *testing.T) {
 				IssueType:   usertasks.AutoDiscoverAzureVMIssueEnrollmentError,
 			},
 			clock.Now().Add(20*time.Minute),
-			&usertasksv1.DiscoverAzureVM{
+			usertasksv1.DiscoverAzureVM_builder{
 				Instances: map[string]*usertasksv1.DiscoverAzureVMInstance{
-					tag: {
+					tag: usertasksv1.DiscoverAzureVMInstance_builder{
 						VmId:            tag,
 						DiscoveryConfig: tag,
 						DiscoveryGroup:  tag,
 						SyncTime:        syncTime,
-					},
+					}.Build(),
 				},
 				// these feed into task name, in addition to the task group above.
 				SubscriptionId: "sub-123",
 				ResourceGroup:  "rg-123",
 				Region:         "westus",
-			},
+			}.Build(),
 		)
 		require.NoError(t, err)
 		return ut
@@ -236,7 +236,7 @@ func TestMergeUpsertUserTask(t *testing.T) {
 			upsertedTask, err := ap.GetUserTask(s.ctx, tt.newTask.GetMetadata().GetName())
 			require.NoError(t, err)
 			require.NotNil(t, upsertedTask)
-			require.Empty(t, cmp.Diff(tt.newTask.Spec, upsertedTask.Spec, protocmp.Transform()))
+			require.Empty(t, cmp.Diff(tt.newTask.GetSpec(), upsertedTask.GetSpec(), protocmp.Transform()))
 		})
 	}
 }
@@ -322,23 +322,23 @@ func TestAzureVMTasks_AddFailedEnrollment(t *testing.T) {
 	syncTime := timestamppb.New(time.Now())
 
 	vm := func(tag string) *usertasksv1.DiscoverAzureVMInstance {
-		return &usertasksv1.DiscoverAzureVMInstance{
+		return usertasksv1.DiscoverAzureVMInstance_builder{
 			VmId:            tag,
 			DiscoveryConfig: "dc-01",
 			DiscoveryGroup:  "group-1",
 			SyncTime:        syncTime,
-		}
+		}.Build()
 	}
 
 	azureData := func(key azureVMTaskKey, instances ...string) *usertasksv1.DiscoverAzureVM {
-		data := &usertasksv1.DiscoverAzureVM{
+		data := usertasksv1.DiscoverAzureVM_builder{
 			SubscriptionId: key.subscriptionID,
 			ResourceGroup:  key.resourceGroup,
 			Region:         key.region,
 			Instances:      make(map[string]*usertasksv1.DiscoverAzureVMInstance),
-		}
+		}.Build()
 		for _, instance := range instances {
-			data.Instances[instance] = vm(instance)
+			data.GetInstances()[instance] = vm(instance)
 		}
 		return data
 	}
@@ -430,19 +430,19 @@ func TestAzureVMTasks_UpsertAll(t *testing.T) {
 	var testAzureKeyAlt = azureVMTaskKey{subscriptionID: "sub-2", resourceGroup: "rg-2", region: "eastus"}
 
 	azureData := func(key azureVMTaskKey, instances ...string) *usertasksv1.DiscoverAzureVM {
-		data := &usertasksv1.DiscoverAzureVM{
+		data := usertasksv1.DiscoverAzureVM_builder{
 			SubscriptionId: key.subscriptionID,
 			ResourceGroup:  key.resourceGroup,
 			Region:         key.region,
 			Instances:      make(map[string]*usertasksv1.DiscoverAzureVMInstance),
-		}
+		}.Build()
 		for _, instance := range instances {
-			data.Instances[instance] = &usertasksv1.DiscoverAzureVMInstance{
+			data.GetInstances()[instance] = usertasksv1.DiscoverAzureVMInstance_builder{
 				VmId:            instance,
 				DiscoveryConfig: "dc-01",
 				DiscoveryGroup:  "group-1",
 				SyncTime:        timestamppb.New(time.Now()),
-			}
+			}.Build()
 		}
 		return data
 	}
diff --git a/lib/srv/discovery/status_updater.go b/lib/srv/discovery/status_updater.go
index 9273a340aec..57d8a1c5098 100644
--- a/lib/srv/discovery/status_updater.go
+++ b/lib/srv/discovery/status_updater.go
@@ -146,21 +146,21 @@ func (s *discoveryConfigStatusUpdater) updateServerStatus(status discoveryconfig
 	for integration, currentDiscoverSummary := range status.IntegrationDiscoveredResources {
 		previousSummary := existingDiscoverSummary(s.serverID, integration, existingServerStatuses)
 
-		integrationSummaries[integration] = &discoveryconfigv1.DiscoverSummary{
+		integrationSummaries[integration] = discoveryconfigv1.DiscoverSummary_builder{
 			AwsEc2:   mergeResourceSummary(currentDiscoverSummary.GetAwsEc2(), previousSummary.GetAwsEc2()),
 			AwsRds:   mergeResourceSummary(currentDiscoverSummary.GetAwsRds(), previousSummary.GetAwsRds()),
 			AwsEks:   mergeResourceSummary(currentDiscoverSummary.GetAwsEks(), previousSummary.GetAwsEks()),
 			AzureVms: mergeResourceSummary(currentDiscoverSummary.GetAzureVms(), previousSummary.GetAzureVms()),
-		}
+		}.Build()
 	}
 
 	status.ServerStatus = map[string]*discoveryconfig.DiscoveryStatusServer{
 		s.serverID: {
-			DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+			DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 				IntegrationSummaries: integrationSummaries,
 				LastUpdate:           timestamppb.New(s.clock.Now()),
 				PollInterval:         durationpb.New(s.pollInterval),
-			},
+			}.Build(),
 		},
 	}
 
@@ -197,16 +197,16 @@ func mergeResourceSummary(summary *discoveryconfigv1.ResourcesDiscoveredSummary,
 	}
 
 	if summary.GetSyncEnd() != nil {
-		return &discoveryconfigv1.ResourceSummary{
+		return discoveryconfigv1.ResourceSummary_builder{
 			Previous: summary,
 			Current:  nil,
-		}
+		}.Build()
 	}
 
-	return &discoveryconfigv1.ResourceSummary{
+	return discoveryconfigv1.ResourceSummary_builder{
 		Previous: existingSummary.GetPrevious(),
 		Current:  summary,
-	}
+	}.Build()
 }
 
 func existingServerStatuses(existingDiscoveryConfig *discoveryconfig.DiscoveryConfig) map[string]*discoveryconfig.DiscoveryStatusServer {
@@ -228,5 +228,5 @@ func existingDiscoverSummary(serverID, integration string, existingServerIterati
 	if existingServerStatus.DiscoveryStatusServer == nil {
 		return nil
 	}
-	return existingServerStatus.DiscoveryStatusServer.IntegrationSummaries[integration]
+	return existingServerStatus.DiscoveryStatusServer.GetIntegrationSummaries()[integration]
 }
diff --git a/lib/srv/discovery/status_updater_test.go b/lib/srv/discovery/status_updater_test.go
index db0ebbc4885..8a88ad459f6 100644
--- a/lib/srv/discovery/status_updater_test.go
+++ b/lib/srv/discovery/status_updater_test.go
@@ -40,62 +40,62 @@ import (
 
 func integrationDiscoveredSummaryFinished(found uint64, syncEnd *timestamppb.Timestamp) *discoveryconfig.IntegrationDiscoveredSummary {
 	return &discoveryconfig.IntegrationDiscoveredSummary{
-		IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-			AwsEc2: &discoveryconfigv1.ResourcesDiscoveredSummary{
+		IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+			AwsEc2: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 				Found:   found,
 				SyncEnd: syncEnd,
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 }
 
 func integrationDiscoveredSummaryWithFound(found uint64) *discoveryconfig.IntegrationDiscoveredSummary {
 	return &discoveryconfig.IntegrationDiscoveredSummary{
-		IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-			AwsEc2: &discoveryconfigv1.ResourcesDiscoveredSummary{
+		IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+			AwsEc2: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 				Found: found,
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 }
 
 func discoveryStatusServerWithCurrent(found uint64, lastUpdate *timestamppb.Timestamp) *discoveryconfigv1.DiscoveryStatusServer {
-	return &discoveryconfigv1.DiscoveryStatusServer{
+	return discoveryconfigv1.DiscoveryStatusServer_builder{
 		IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-			"my-integration": {
-				AwsEc2: &discoveryconfigv1.ResourceSummary{
-					Current: &discoveryconfigv1.ResourcesDiscoveredSummary{
+			"my-integration": discoveryconfigv1.DiscoverSummary_builder{
+				AwsEc2: discoveryconfigv1.ResourceSummary_builder{
+					Current: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 						Found: found,
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		LastUpdate:   lastUpdate,
 		PollInterval: durationpb.New(5 * time.Minute),
-	}
+	}.Build()
 }
 
 func discoveryStatusServerFinished(previous uint64, syncEnd *timestamppb.Timestamp) *discoveryconfigv1.DiscoveryStatusServer {
-	return &discoveryconfigv1.DiscoveryStatusServer{
+	return discoveryconfigv1.DiscoveryStatusServer_builder{
 		IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-			"my-integration": {
-				AwsEc2: &discoveryconfigv1.ResourceSummary{
-					Previous: &discoveryconfigv1.ResourcesDiscoveredSummary{
+			"my-integration": discoveryconfigv1.DiscoverSummary_builder{
+				AwsEc2: discoveryconfigv1.ResourceSummary_builder{
+					Previous: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 						Found:   previous,
 						SyncEnd: syncEnd,
-					},
-				},
-			},
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		LastUpdate:   syncEnd,
 		PollInterval: durationpb.New(5 * time.Minute),
-	}
+	}.Build()
 }
 
 func staleDiscoveryStatusServer(lastUpdate *timestamppb.Timestamp) *discoveryconfigv1.DiscoveryStatusServer {
 	ret := discoveryStatusServerFinished(5, lastUpdate)
-	ret.PollInterval = durationpb.New(1 * time.Minute)
-	ret.LastUpdate = timestamppb.New(lastUpdate.AsTime().Add(-20 * time.Hour))
+	ret.SetPollInterval(durationpb.New(1 * time.Minute))
+	ret.SetLastUpdate(timestamppb.New(lastUpdate.AsTime().Add(-20 * time.Hour)))
 	return ret
 }
 
diff --git a/lib/srv/exec.go b/lib/srv/exec.go
index 05e7ac17f5c..826fc43ebc1 100644
--- a/lib/srv/exec.go
+++ b/lib/srv/exec.go
@@ -204,7 +204,7 @@ func (e *localExec) Start(ctx context.Context, channel ssh.Channel) error {
 		defer stderrR.Close()
 
 		childErr, err := reexecutils.ReadChildErrorWithContext(stderrR, &reexecutils.ErrorContext{
-			DecisionContext: e.Ctx.Identity.AccessPermit.DecisionContext,
+			DecisionContext: e.Ctx.Identity.AccessPermit.GetDecisionContext(),
 			Login:           e.Ctx.Identity.Login,
 		})
 		if err != nil {
diff --git a/lib/srv/git/github.go b/lib/srv/git/github.go
index 6a1fd1a8b2f..897aa21953b 100644
--- a/lib/srv/git/github.go
+++ b/lib/srv/git/github.go
@@ -245,18 +245,18 @@ func MakeGitHubSigner(ctx context.Context, config GitHubSignerConfig) (ssh.Signe
 	if err != nil {
 		return nil, trace.Wrap(err, "generating SSH key")
 	}
-	resp, err := config.GitHubUserCertGenerator.GenerateGitHubUserCert(ctx, &integrationv1.GenerateGitHubUserCertRequest{
+	resp, err := config.GitHubUserCertGenerator.GenerateGitHubUserCert(ctx, integrationv1.GenerateGitHubUserCertRequest_builder{
 		Integration: config.Server.GetGitHub().Integration,
 		PublicKey:   sshKey.MarshalSSHPublicKey(),
 		UserId:      config.GitHubUserID,
 		KeyId:       config.TeleportUser,
 		Ttl:         durationpb.New(config.certTTL()),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	signer, err := sshutils.NewSigner(sshKey.PrivateKeyPEM(), resp.AuthorizedKey)
+	signer, err := sshutils.NewSigner(sshKey.PrivateKeyPEM(), resp.GetAuthorizedKey())
 	return signer, trace.Wrap(err)
 }
 
diff --git a/lib/srv/git/github_test.go b/lib/srv/git/github_test.go
index de4c5ec0dc4..8b3260e0652 100644
--- a/lib/srv/git/github_test.go
+++ b/lib/srv/git/github_test.go
@@ -53,32 +53,32 @@ type fakeGitHubUserCertGenerator struct {
 }
 
 func (f fakeGitHubUserCertGenerator) GenerateGitHubUserCert(_ context.Context, input *integrationv1.GenerateGitHubUserCertRequest, _ ...grpc.CallOption) (*integrationv1.GenerateGitHubUserCertResponse, error) {
-	if f.checkTTL != 0 && f.checkTTL != input.Ttl.AsDuration() {
-		return nil, trace.CompareFailed("expect ttl %v but got %v", f.checkTTL, input.Ttl.AsDuration())
+	if f.checkTTL != 0 && f.checkTTL != input.GetTtl().AsDuration() {
+		return nil, trace.CompareFailed("expect ttl %v but got %v", f.checkTTL, input.GetTtl().AsDuration())
 	}
 
 	caSigner, err := apisshutils.MakeTestSSHCA()
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	pubKey, _, _, _, err := ssh.ParseAuthorizedKey(input.PublicKey)
+	pubKey, _, _, _, err := ssh.ParseAuthorizedKey(input.GetPublicKey())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	cert := &ssh.Certificate{
 		// we have to use key id to identify teleport user
-		KeyId:       input.KeyId,
+		KeyId:       input.GetKeyId(),
 		Key:         pubKey,
 		ValidAfter:  uint64(f.clock.Now().Add(-time.Minute).Unix()),
-		ValidBefore: uint64(f.clock.Now().Add(input.Ttl.AsDuration()).Unix()),
+		ValidBefore: uint64(f.clock.Now().Add(input.GetTtl().AsDuration()).Unix()),
 		CertType:    ssh.UserCert,
 	}
 	if err := cert.SignCert(rand.Reader, caSigner); err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &integrationv1.GenerateGitHubUserCertResponse{
+	return integrationv1.GenerateGitHubUserCertResponse_builder{
 		AuthorizedKey: ssh.MarshalAuthorizedKey(cert),
-	}, nil
+	}.Build(), nil
 }
 
 func TestMakeGitHubSigner(t *testing.T) {
diff --git a/lib/srv/heartbeatv2.go b/lib/srv/heartbeatv2.go
index 80a403ab868..4649dbc0871 100644
--- a/lib/srv/heartbeatv2.go
+++ b/lib/srv/heartbeatv2.go
@@ -622,7 +622,7 @@ func (h *sshServerHeartbeatV2) Announce(ctx context.Context, sender inventory.Do
 		return false
 	}
 
-	if err := sender.Send(ctx, &proto.InventoryHeartbeat{SSHServer: apiutils.CloneProtoMsg(server)}); err != nil {
+	if err := sender.Send(ctx, proto.InventoryHeartbeat_builder{SSHServer: apiutils.CloneProtoMsg(server)}.Build()); err != nil {
 		slog.WarnContext(ctx, "Failed to perform inventory heartbeat for ssh server", "error", err)
 		return false
 	}
@@ -680,9 +680,9 @@ func (h *appServerHeartbeatV2) Announce(ctx context.Context, sender inventory.Do
 	// control stream. If the Auth server capabilities indicate as such, then use the fallback mechanism.
 	hello := sender.Hello()
 	switch {
-	case hello.Capabilities == nil:
+	case !hello.HasCapabilities():
 		return h.FallbackAnnounce(ctx)
-	case hello.Capabilities != nil && !hello.Capabilities.AppHeartbeats:
+	case hello.HasCapabilities() && !hello.GetCapabilities().GetAppHeartbeats():
 		return h.FallbackAnnounce(ctx)
 	}
 
@@ -692,7 +692,7 @@ func (h *appServerHeartbeatV2) Announce(ctx context.Context, sender inventory.Do
 		return false
 	}
 
-	if err := sender.Send(ctx, &proto.InventoryHeartbeat{AppServer: apiutils.CloneProtoMsg(server)}); err != nil {
+	if err := sender.Send(ctx, proto.InventoryHeartbeat_builder{AppServer: apiutils.CloneProtoMsg(server)}.Build()); err != nil {
 		if !errors.Is(err, context.Canceled) && status.Code(err) != codes.Canceled {
 			slog.WarnContext(ctx, "Failed to perform inventory heartbeat for app server", "error", err)
 		}
@@ -752,9 +752,9 @@ func (h *dbServerHeartbeatV2) Announce(ctx context.Context, sender inventory.Dow
 	// control stream. If the Auth server capabilities indicate as such, then use the fallback mechanism.
 	hello := sender.Hello()
 	switch {
-	case hello.Capabilities == nil:
+	case !hello.HasCapabilities():
 		return h.FallbackAnnounce(ctx)
-	case hello.Capabilities != nil && !hello.Capabilities.DatabaseHeartbeats:
+	case hello.HasCapabilities() && !hello.GetCapabilities().GetDatabaseHeartbeats():
 		return h.FallbackAnnounce(ctx)
 	}
 
@@ -763,7 +763,7 @@ func (h *dbServerHeartbeatV2) Announce(ctx context.Context, sender inventory.Dow
 		slog.WarnContext(ctx, "Failed to perform inventory heartbeat for database server", "error", err)
 		return false
 	}
-	if err := sender.Send(ctx, &proto.InventoryHeartbeat{DatabaseServer: apiutils.CloneProtoMsg(server)}); err != nil {
+	if err := sender.Send(ctx, proto.InventoryHeartbeat_builder{DatabaseServer: apiutils.CloneProtoMsg(server)}.Build()); err != nil {
 		if !errors.Is(err, context.Canceled) && status.Code(err) != codes.Canceled {
 			slog.WarnContext(ctx, "Failed to perform inventory heartbeat for database server", "error", err)
 		}
@@ -824,9 +824,9 @@ func (h *kubeServerHeartbeatV2) Announce(ctx context.Context, sender inventory.D
 	// control stream. If the Auth server capabilities indicate as such, then use the fallback mechanism.
 	hello := sender.Hello()
 	switch {
-	case hello.Capabilities == nil:
+	case !hello.HasCapabilities():
 		return h.FallbackAnnounce(ctx)
-	case hello.Capabilities != nil && !hello.Capabilities.KubernetesHeartbeats:
+	case hello.HasCapabilities() && !hello.GetCapabilities().GetKubernetesHeartbeats():
 		return h.FallbackAnnounce(ctx)
 	}
 
@@ -835,7 +835,7 @@ func (h *kubeServerHeartbeatV2) Announce(ctx context.Context, sender inventory.D
 		slog.WarnContext(ctx, "Failed to perform inventory heartbeat for kubernetes server", "error", err)
 		return false
 	}
-	if err := sender.Send(ctx, &proto.InventoryHeartbeat{KubernetesServer: apiutils.CloneProtoMsg(server)}); err != nil {
+	if err := sender.Send(ctx, proto.InventoryHeartbeat_builder{KubernetesServer: apiutils.CloneProtoMsg(server)}.Build()); err != nil {
 		if !errors.Is(err, context.Canceled) && status.Code(err) != codes.Canceled {
 			slog.WarnContext(ctx, "Failed to perform inventory heartbeat for kubernetes server", "error", err)
 		}
@@ -896,7 +896,7 @@ func (h *relayServerHeartbeatV2) Announce(ctx context.Context, sender inventory.
 		return false
 	}
 
-	if err := sender.Send(ctx, &proto.InventoryHeartbeat{RelayServer: gproto.CloneOf(server)}); err != nil {
+	if err := sender.Send(ctx, proto.InventoryHeartbeat_builder{RelayServer: gproto.CloneOf(server)}.Build()); err != nil {
 		if !errors.Is(err, context.Canceled) && status.Code(err) != codes.Canceled {
 			h.log.WarnContext(ctx, "Failed to perform Relay service announce", "error", err)
 		}
diff --git a/lib/srv/heartbeatv2_test.go b/lib/srv/heartbeatv2_test.go
index eccbf6b3068..53ccbfb00b2 100644
--- a/lib/srv/heartbeatv2_test.go
+++ b/lib/srv/heartbeatv2_test.go
@@ -119,10 +119,10 @@ func (h *fakeHeartbeatDriver) newStream(ctx context.Context, t *testing.T) clien
 
 	require.IsType(t, *new(*proto.UpstreamInventoryHello), msg)
 
-	err := upstream.Send(ctx, &proto.DownstreamInventoryHello{
+	err := upstream.Send(ctx, proto.DownstreamInventoryHello_builder{
 		ServerID: "test-auth",
 		Version:  teleport.Version,
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	return upstream
@@ -132,11 +132,11 @@ func newFakeHeartbeatDriver(t *testing.T) *fakeHeartbeatDriver {
 	// streamC is used to pass a fake control stream to the downstream handle's create func.
 	streamC := make(chan client.DownstreamInventoryControlStream)
 
-	hello := &proto.UpstreamInventoryHello{
+	hello := proto.UpstreamInventoryHello_builder{
 		ServerID: "test-node",
 		Version:  teleport.Version,
 		Services: types.SystemRoles{types.RoleNode}.StringSlice(),
-	}
+	}.Build()
 
 	handle, err := inventory.NewDownstreamHandle(func(ctx context.Context) (client.DownstreamInventoryControlStream, error) {
 		// we're emulating an inventory.DownstreamCreateFunc here, but those are typically
diff --git a/lib/srv/keyboard_auth_test.go b/lib/srv/keyboard_auth_test.go
index ed12f8cdb2e..7580fad1fcb 100644
--- a/lib/srv/keyboard_auth_test.go
+++ b/lib/srv/keyboard_auth_test.go
@@ -43,9 +43,9 @@ func TestKeyboardInteractiveAuth_PreCondInBandMFA_Success(t *testing.T) {
 	h, id := setupKeyboardInteractiveAuthTestWithVerifier(t, &mockMFAServiceClient{})
 
 	preconds := []*decisionpb.Precondition{
-		{
+		decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA,
-		},
+		}.Build(),
 	}
 
 	inPerms := &ssh.Permissions{
@@ -62,13 +62,11 @@ func TestKeyboardInteractiveAuth_PreCondInBandMFA_Success(t *testing.T) {
 	require.NotNil(t, sshErr.Next)
 	require.NotNil(t, sshErr.Next.KeyboardInteractiveCallback)
 
-	resp := &sshpb.MFAPromptResponse{
-		Response: &sshpb.MFAPromptResponse_Reference{
-			Reference: &sshpb.MFAPromptResponseReference{
-				ChallengeName: "test-challenge-name",
-			},
-		},
-	}
+	resp := sshpb.MFAPromptResponse_builder{
+		Reference: sshpb.MFAPromptResponseReference_builder{
+			ChallengeName: "test-challenge-name",
+		}.Build(),
+	}.Build()
 	respJSON, err := protojson.Marshal(resp)
 	require.NoError(t, err)
 
@@ -102,9 +100,9 @@ func TestKeyboardInteractiveAuth_PreCondInBandMFA_UsesRouteToCluster(t *testing.
 	id.RouteToCluster = "root-cluster"
 
 	preconds := []*decisionpb.Precondition{
-		{
+		decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA,
-		},
+		}.Build(),
 	}
 
 	inPerms := &ssh.Permissions{}
@@ -116,13 +114,11 @@ func TestKeyboardInteractiveAuth_PreCondInBandMFA_UsesRouteToCluster(t *testing.
 	require.ErrorAs(t, err, &sshErr)
 	require.NotNil(t, sshErr.Next.KeyboardInteractiveCallback)
 
-	resp := &sshpb.MFAPromptResponse{
-		Response: &sshpb.MFAPromptResponse_Reference{
-			Reference: &sshpb.MFAPromptResponseReference{
-				ChallengeName: "test-challenge-name",
-			},
-		},
-	}
+	resp := sshpb.MFAPromptResponse_builder{
+		Reference: sshpb.MFAPromptResponseReference_builder{
+			ChallengeName: "test-challenge-name",
+		}.Build(),
+	}.Build()
 	respJSON, err := protojson.Marshal(resp)
 	require.NoError(t, err)
 
@@ -149,9 +145,9 @@ func TestKeyboardInteractiveAuth_PreCondInBandMFA_EmptySessionID(t *testing.T) {
 	h, id := setupKeyboardInteractiveAuthTestWithVerifier(t, &mockMFAServiceClient{})
 
 	preconds := []*decisionpb.Precondition{
-		{
+		decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA,
-		},
+		}.Build(),
 	}
 
 	outPerms, err := h.KeyboardInteractiveAuth(t.Context(), preconds, id, &ssh.Permissions{})
@@ -178,9 +174,9 @@ func TestKeyboardInteractiveAuth_EmptyClusterName(t *testing.T) {
 	id.RouteToCluster = ""
 
 	preconds := []*decisionpb.Precondition{
-		{
+		decisionpb.Precondition_builder{
 			Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_IN_BAND_MFA,
-		},
+		}.Build(),
 	}
 
 	outPerms, err := h.KeyboardInteractiveAuth(t.Context(), preconds, id, &ssh.Permissions{})
diff --git a/lib/srv/regular/sftp.go b/lib/srv/regular/sftp.go
index ec79b3cc247..def12f7db0b 100644
--- a/lib/srv/regular/sftp.go
+++ b/lib/srv/regular/sftp.go
@@ -140,7 +140,7 @@ func (s *sftpSubsys) Start(ctx context.Context,
 		defer stderrR.Close()
 
 		childErr, err := reexecutils.ReadChildErrorWithContext(stderrR, &reexecutils.ErrorContext{
-			DecisionContext: s.serverCtx.Identity.AccessPermit.DecisionContext,
+			DecisionContext: s.serverCtx.Identity.AccessPermit.GetDecisionContext(),
 			Login:           s.serverCtx.Identity.Login,
 		})
 		if err != nil {
diff --git a/lib/srv/regular/sshserver.go b/lib/srv/regular/sshserver.go
index 1a42416783d..22d0a58ef36 100644
--- a/lib/srv/regular/sshserver.go
+++ b/lib/srv/regular/sshserver.go
@@ -1369,7 +1369,7 @@ func (s *Server) startNetworkingProcess(ctx context.Context, scx *srv.ServerCont
 		// If the networking process failed with an error message from stderr, prefer
 		// that over the other error.
 		childErr = reexecutils.ChildErrorWithContext(childErr, &reexecutils.ErrorContext{
-			DecisionContext: scx.Identity.AccessPermit.DecisionContext,
+			DecisionContext: scx.Identity.AccessPermit.GetDecisionContext(),
 			Login:           scx.Identity.Login,
 		})
 		return nil, errors.New(strings.TrimRight(childErr, "\n"))
@@ -1499,9 +1499,9 @@ func (s *Server) obtainFallbackUID(ctx context.Context, username string) (uid in
 		return 0, false, nil
 	}
 
-	resp, err := s.stableUnixUsers.ObtainUIDForUsername(ctx, &stableunixusersv1.ObtainUIDForUsernameRequest{
+	resp, err := s.stableUnixUsers.ObtainUIDForUsername(ctx, stableunixusersv1.ObtainUIDForUsernameRequest_builder{
 		Username: username,
-	})
+	}.Build())
 	if err != nil {
 		return 0, false, trace.Wrap(err)
 	}
@@ -1569,7 +1569,7 @@ func (s *Server) HandleNewChan(ctx context.Context, ccx *sshutils.ConnectionCont
 	// commands on a server, subsystem requests, and agent forwarding.
 	case teleport.ChanSession:
 		var decr func()
-		if max := identityContext.AccessPermit.MaxSessions; max != 0 {
+		if max := identityContext.AccessPermit.GetMaxSessions(); max != 0 {
 			d, ok := ccx.IncrSessions(max)
 			if !ok {
 				// user has exceeded their max concurrent ssh sessions.
diff --git a/lib/srv/regular/sshserver_test.go b/lib/srv/regular/sshserver_test.go
index 1eb7efebbb5..89d2eb3c196 100644
--- a/lib/srv/regular/sshserver_test.go
+++ b/lib/srv/regular/sshserver_test.go
@@ -3637,17 +3637,17 @@ func TestHostUserCreationProxy(t *testing.T) {
 	require.NoError(t, err)
 
 	_, err = reg.WriteSudoersFile(srv.IdentityContext{
-		AccessPermit: &decisionpb.SSHAccessPermit{
+		AccessPermit: decisionpb.SSHAccessPermit_builder{
 			HostSudoers: []string{"test1", "test2", "test3"},
-		},
+		}.Build(),
 	})
 	assert.NoError(t, err)
 	assert.Equal(t, 0, sudoers.writeAttempts)
 
 	_, _, err = reg.UpsertHostUser(srv.IdentityContext{
-		AccessPermit: &decisionpb.SSHAccessPermit{
+		AccessPermit: decisionpb.SSHAccessPermit_builder{
 			HostSudoers: []string{"test1", "test2", "test3"},
-		},
+		}.Build(),
 	}, srv.ObtainFallbackUIDFunc(nil))
 	assert.NoError(t, err)
 	assert.Empty(t, usersBackend.calls, 0)
@@ -3756,7 +3756,7 @@ func (f obtainUIDForUsernameFunc) ObtainUIDForUsername(ctx context.Context, in *
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &stableunixusersv1.ObtainUIDForUsernameResponse{Uid: uid}, nil
+	return stableunixusersv1.ObtainUIDForUsernameResponse_builder{Uid: uid}.Build(), nil
 }
 
 func (f obtainUIDForUsernameFunc) ListStableUNIXUsers(ctx context.Context, in *stableunixusersv1.ListStableUNIXUsersRequest, opts ...grpc.CallOption) (*stableunixusersv1.ListStableUNIXUsersResponse, error) {
diff --git a/lib/srv/sess.go b/lib/srv/sess.go
index 6e93fbfe1aa..c82faa46bf6 100644
--- a/lib/srv/sess.go
+++ b/lib/srv/sess.go
@@ -257,12 +257,12 @@ func (s *SessionRegistry) WriteSudoersFile(identityContext IdentityContext) (io.
 		return nil, nil
 	}
 
-	if len(identityContext.AccessPermit.HostSudoers) == 0 {
+	if len(identityContext.AccessPermit.GetHostSudoers()) == 0 {
 		// not an error, sudoers may not be configured.
 		return nil, nil
 	}
 
-	if err := sudoWriter.WriteSudoers(identityContext.Login, identityContext.AccessPermit.HostSudoers); err != nil {
+	if err := sudoWriter.WriteSudoers(identityContext.Login, identityContext.AccessPermit.GetHostSudoers()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -300,12 +300,12 @@ func (s *SessionRegistry) UpsertHostUser(identityContext IdentityContext, obtain
 	}
 
 	log.DebugContext(ctx, "Checking if user provisioning is allowed")
-	ui := identityContext.AccessPermit.HostUsersInfo
+	ui := identityContext.AccessPermit.GetHostUsersInfo()
 	if ui == nil {
 		return false, nil, trace.Wrap(errHostUserCreationNotAuthorized)
 	}
 
-	if obtainFallbackUID != nil && ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_KEEP && ui.Uid == "" {
+	if obtainFallbackUID != nil && ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_KEEP && ui.GetUid() == "" {
 		if err := s.users.UserExists(identityContext.Login); err != nil {
 			if !trace.IsNotFound(err) {
 				return false, nil, trace.Wrap(err)
@@ -319,9 +319,9 @@ func (s *SessionRegistry) UpsertHostUser(identityContext IdentityContext, obtain
 			}
 			if ok {
 				log.DebugContext(ctx, "Obtained UID from control plane", "uid", fallbackUID)
-				ui.Uid = strconv.Itoa(int(fallbackUID))
-				if ui.Gid == "" {
-					ui.Gid = ui.Uid
+				ui.SetUid(strconv.Itoa(int(fallbackUID)))
+				if ui.GetGid() == "" {
+					ui.SetGid(ui.GetUid())
 				}
 			} else {
 				log.DebugContext(ctx, "No UID configured in the cluster")
@@ -818,7 +818,7 @@ func newSession(ctx context.Context, r *SessionRegistry, scx *ServerContext, ch
 	var sessionRecordingMode constants.SessionRecordingMode
 	switch {
 	case scx.Identity.AccessPermit != nil:
-		sessionRecordingMode = constants.SessionRecordingMode(scx.Identity.AccessPermit.SessionRecordingMode)
+		sessionRecordingMode = constants.SessionRecordingMode(scx.Identity.AccessPermit.GetSessionRecordingMode())
 	case scx.Identity.ProxyingPermit != nil:
 		sessionRecordingMode = scx.Identity.ProxyingPermit.SessionRecordingMode
 	default:
@@ -1585,7 +1585,7 @@ func newRecorder(s *session, ctx *ServerContext, sessType sessionType) (events.S
 	var sessionRecordingMode constants.SessionRecordingMode
 	switch {
 	case ctx.Identity.AccessPermit != nil:
-		sessionRecordingMode = constants.SessionRecordingMode(ctx.Identity.AccessPermit.SessionRecordingMode)
+		sessionRecordingMode = constants.SessionRecordingMode(ctx.Identity.AccessPermit.GetSessionRecordingMode())
 	case ctx.Identity.ProxyingPermit != nil:
 		sessionRecordingMode = ctx.Identity.ProxyingPermit.SessionRecordingMode
 	default:
@@ -2427,8 +2427,8 @@ func (s *session) onWriteErrorCallback(sessionRecordingMode constants.SessionRec
 }
 
 func eventsMapFromSSHAccessPermit(permit *decisionpb.SSHAccessPermit) map[string]struct{} {
-	eventsMap := make(map[string]struct{}, len(permit.BpfEvents))
-	for _, event := range permit.BpfEvents {
+	eventsMap := make(map[string]struct{}, len(permit.GetBpfEvents()))
+	for _, event := range permit.GetBpfEvents() {
 		eventsMap[event] = struct{}{}
 	}
 
diff --git a/lib/srv/sess_test.go b/lib/srv/sess_test.go
index a44033cb718..d8be62a0387 100644
--- a/lib/srv/sess_test.go
+++ b/lib/srv/sess_test.go
@@ -272,9 +272,9 @@ func TestSession_newRecorder(t *testing.T) {
 					component: teleport.ComponentNode,
 				},
 				Identity: IdentityContext{
-					AccessPermit: &decisionpb.SSHAccessPermit{
+					AccessPermit: decisionpb.SSHAccessPermit_builder{
 						SessionRecordingMode: string(constants.SessionRecordingModeStrict),
-					},
+					}.Build(),
 				},
 			},
 			errAssertion: require.Error,
@@ -290,9 +290,9 @@ func TestSession_newRecorder(t *testing.T) {
 					datadir:   t.TempDir(),
 				},
 				Identity: IdentityContext{
-					AccessPermit: &decisionpb.SSHAccessPermit{
+					AccessPermit: decisionpb.SSHAccessPermit_builder{
 						SessionRecordingMode: string(constants.SessionRecordingModeBestEffort),
-					},
+					}.Build(),
 				},
 			},
 			errAssertion: require.NoError,
@@ -454,9 +454,9 @@ func TestSessionRegistrySetupFailureCleanup(t *testing.T) {
 			t.Cleanup(func() { reg.Close() })
 
 			// Use strict recording mode so that recorder errors aren't ignored.
-			accessPermit := &decisionpb.SSHAccessPermit{
+			accessPermit := decisionpb.SSHAccessPermit_builder{
 				SessionRecordingMode: string(constants.SessionRecordingModeStrict),
-			}
+			}.Build()
 
 			scx := newTestServerContext(t, reg.Srv, tt.sessionRoles, accessPermit)
 			t.Cleanup(func() { require.NoError(t, scx.Close()) })
@@ -1043,9 +1043,9 @@ func TestSessionRecordingModes(t *testing.T) {
 			require.NoError(t, err)
 			t.Cleanup(func() { reg.Close() })
 
-			sess, sessCh := testOpenSession(t, reg, nil, &decisionpb.SSHAccessPermit{
+			sess, sessCh := testOpenSession(t, reg, nil, decisionpb.SSHAccessPermit_builder{
 				SessionRecordingMode: string(tt.sessionRecordingMode),
-			})
+			}.Build())
 
 			// Write to the session as a synchronization barrier.
 			_, err = sessCh.Write([]byte("hello"))
@@ -1684,11 +1684,11 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
-					HostUsersInfo: &decisionpb.HostUsersInfo{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
+					HostUsersInfo: decisionpb.HostUsersInfo_builder{
 						Groups: []string{"foo", "bar"},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{users: map[string]fakeUser{
 				username: {},
@@ -1705,11 +1705,11 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
-					HostUsersInfo: &decisionpb.HostUsersInfo{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
+					HostUsersInfo: decisionpb.HostUsersInfo_builder{
 						Groups: []string{"foo", "bar"},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{},
 
@@ -1723,9 +1723,9 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					HostUsersInfo: nil,
-				},
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{
 				users: map[string]fakeUser{
@@ -1744,9 +1744,9 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					HostUsersInfo: nil,
-				},
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{},
 
@@ -1768,11 +1768,11 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
-					HostUsersInfo: &decisionpb.HostUsersInfo{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
+					HostUsersInfo: decisionpb.HostUsersInfo_builder{
 						Mode: decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{},
 			obtainFallbackUID: func(ctx context.Context, username string) (uid int32, ok bool, _ error) {
@@ -1789,11 +1789,11 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
-					HostUsersInfo: &decisionpb.HostUsersInfo{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
+					HostUsersInfo: decisionpb.HostUsersInfo_builder{
 						Mode: decisionpb.HostUserMode_HOST_USER_MODE_DROP,
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{},
 			obtainFallbackUID: func(ctx context.Context, username string) (uid int32, ok bool, _ error) {
@@ -1810,11 +1810,11 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
-					HostUsersInfo: &decisionpb.HostUsersInfo{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
+					HostUsersInfo: decisionpb.HostUsersInfo_builder{
 						Mode: decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{
 				users: map[string]fakeUser{
@@ -1835,12 +1835,12 @@ func TestUpsertHostUser(t *testing.T) {
 			createHostUser: true,
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
-					HostUsersInfo: &decisionpb.HostUsersInfo{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
+					HostUsersInfo: decisionpb.HostUsersInfo_builder{
 						Mode: decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 						Gid:  "set",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			hostUsers: &fakeHostUsersBackend{},
 			obtainFallbackUID: func(ctx context.Context, username string) (uid int32, ok bool, _ error) {
@@ -1908,9 +1908,9 @@ func TestWriteSudoersFile(t *testing.T) {
 			name: "should write sudoers with permission",
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					HostSudoers: []string{"foo", "bar"},
-				},
+				}.Build(),
 			},
 			hostSudoers: &fakeSudoersBackend{},
 
@@ -1922,9 +1922,9 @@ func TestWriteSudoersFile(t *testing.T) {
 			name: "should do nothing if no sudoers defined",
 			identityContext: IdentityContext{
 				Login: username,
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					HostSudoers: nil,
-				},
+				}.Build(),
 			},
 			hostSudoers: &fakeSudoersBackend{},
 
@@ -1934,9 +1934,9 @@ func TestWriteSudoersFile(t *testing.T) {
 			name: "should do nothing for session join principal",
 			identityContext: IdentityContext{
 				Login: teleport.SSHSessionJoinPrincipal,
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					HostSudoers: []string{"foo", "bar"}, // should not be written
-				},
+				}.Build(),
 			},
 			hostSudoers: &fakeSudoersBackend{},
 
@@ -2020,9 +2020,9 @@ func (f *fakeHostUsersBackend) UpsertUser(name string, hostRoleInfo *decisionpb.
 	}
 
 	f.users[name] = fakeUser{
-		groups: hostRoleInfo.Groups,
-		uid:    hostRoleInfo.Uid,
-		gid:    hostRoleInfo.Gid,
+		groups: hostRoleInfo.GetGroups(),
+		uid:    hostRoleInfo.GetUid(),
+		gid:    hostRoleInfo.GetGid(),
 	}
 	return nil, nil
 }
diff --git a/lib/srv/session_control.go b/lib/srv/session_control.go
index 66bb3f13086..ffd110d737a 100644
--- a/lib/srv/session_control.go
+++ b/lib/srv/session_control.go
@@ -258,12 +258,12 @@ func (s *SessionController) AcquireSessionContext(ctx context.Context, identity
 	var pinSourceIP bool
 	switch {
 	case identity.AccessPermit != nil:
-		lockingMode = constants.LockingMode(identity.AccessPermit.LockingMode)
-		lockTargets = decision.LockTargetsFromProto(identity.AccessPermit.LockTargets)
-		requiredPolicy = keys.PrivateKeyPolicy(identity.AccessPermit.PrivateKeyPolicy)
-		maxConnections = identity.AccessPermit.MaxConnections
-		pinSourceIP = slices.ContainsFunc(identity.AccessPermit.Preconditions, func(p *decisionpb.Precondition) bool {
-			return p.Kind == decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP
+		lockingMode = constants.LockingMode(identity.AccessPermit.GetLockingMode())
+		lockTargets = decision.LockTargetsFromProto(identity.AccessPermit.GetLockTargets())
+		requiredPolicy = keys.PrivateKeyPolicy(identity.AccessPermit.GetPrivateKeyPolicy())
+		maxConnections = identity.AccessPermit.GetMaxConnections()
+		pinSourceIP = slices.ContainsFunc(identity.AccessPermit.GetPreconditions(), func(p *decisionpb.Precondition) bool {
+			return p.GetKind() == decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP
 		})
 	case identity.ProxyingPermit != nil:
 		lockingMode = identity.ProxyingPermit.LockingMode
diff --git a/lib/srv/session_control_test.go b/lib/srv/session_control_test.go
index 1e706ff212e..453b12cd0d6 100644
--- a/lib/srv/session_control_test.go
+++ b/lib/srv/session_control_test.go
@@ -116,9 +116,9 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 		},
 		TeleportUser: "alpaca",
 		Login:        "alpaca",
-		AccessPermit: &decisionpb.SSHAccessPermit{
+		AccessPermit: decisionpb.SSHAccessPermit_builder{
 			PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
-		},
+		}.Build(),
 	}
 
 	cfgWithDeviceMode := func(mode string) SessionControllerConfig {
@@ -183,10 +183,10 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
 					MaxConnections:   1,
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.NoError(t, err)
@@ -231,10 +231,10 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
 					MaxConnections:   1,
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.NoError(t, err)
@@ -269,10 +269,10 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
 					MaxConnections:   1,
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.ErrorIs(t, err, trace.AccessDenied("lock in force"))
@@ -312,10 +312,10 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyHardwareKey),
 					MaxConnections:   1,
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.Error(t, err)
@@ -356,10 +356,10 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
 					MaxConnections:   1,
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.Error(t, err)
@@ -408,10 +408,10 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
 					MaxConnections:   0,
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.NoError(t, err)
@@ -482,15 +482,15 @@ func TestSessionController_AcquireSessionContext(t *testing.T) {
 				},
 				TeleportUser: "alpaca",
 				Login:        "alpaca",
-				AccessPermit: &decisionpb.SSHAccessPermit{
+				AccessPermit: decisionpb.SSHAccessPermit_builder{
 					MaxConnections:   1,
 					PrivateKeyPolicy: string(keys.PrivateKeyPolicyNone),
 					Preconditions: []*decisionpb.Precondition{
-						{
+						decisionpb.Precondition_builder{
 							Kind: decisionpb.PreconditionKind_PRECONDITION_KIND_PIN_SOURCE_IP,
-						},
+						}.Build(),
 					},
-				},
+				}.Build(),
 			},
 			assertion: func(t *testing.T, ctx context.Context, err error, emitter *eventstest.MockRecorderEmitter) {
 				require.ErrorIs(t, err, authz.ErrIPPinningMismatch)
diff --git a/lib/srv/ssh/mfa.go b/lib/srv/ssh/mfa.go
index 093b617621a..2850ca339fc 100644
--- a/lib/srv/ssh/mfa.go
+++ b/lib/srv/ssh/mfa.go
@@ -79,13 +79,11 @@ const MFAPromptMessage = "Multi-factor authentication (MFA) is required. Complet
 
 // MarshalPrompt returns a JSON-marshaled MFA prompt and an echo flag set to false.
 func (pv *MFAPromptVerifier) MarshalPrompt() (string, bool, error) {
-	prompt := &sshpb.AuthPrompt{
-		Prompt: &sshpb.AuthPrompt_MfaPrompt{
-			MfaPrompt: &sshpb.MFAPrompt{
-				Message: MFAPromptMessage,
-			},
-		},
-	}
+	prompt := sshpb.AuthPrompt_builder{
+		MfaPrompt: sshpb.MFAPrompt_builder{
+			Message: MFAPromptMessage,
+		}.Build(),
+	}.Build()
 
 	json, err := protojson.Marshal(prompt)
 	if err != nil {
@@ -103,9 +101,9 @@ func (pv *MFAPromptVerifier) VerifyAnswer(ctx context.Context, answer string) er
 		return trace.Wrap(err)
 	}
 
-	switch resp := mfaPromptResp.GetResponse().(type) {
-	case *sshpb.MFAPromptResponse_Reference:
-		challengeName := resp.Reference.GetChallengeName()
+	switch resp := mfaPromptResp.WhichResponse(); resp {
+	case sshpb.MFAPromptResponse_Reference_case:
+		challengeName := mfaPromptResp.GetReference().GetChallengeName()
 		if challengeName == "" {
 			return trace.BadParameter("missing ChallengeName in MFAPromptResponseReference")
 		}
@@ -122,10 +120,10 @@ func (pv *MFAPromptVerifier) VerifyAnswer(ctx context.Context, answer string) er
 		_, err := pv.verifier.VerifyValidatedMFAChallenge(ctx, req)
 		return trace.Wrap(err)
 
-	case nil:
+	case 0:
 		return trace.BadParameter("missing Response in MFAPromptResponse")
 
 	default:
-		return trace.BadParameter("unsupported MFAPromptResponse Response type: %T", resp)
+		return trace.BadParameter("unsupported MFAPromptResponse Response type: %v", resp)
 	}
 }
diff --git a/lib/srv/ssh/mfa_test.go b/lib/srv/ssh/mfa_test.go
index bd8eacfe66f..57d6a7c973b 100644
--- a/lib/srv/ssh/mfa_test.go
+++ b/lib/srv/ssh/mfa_test.go
@@ -131,13 +131,11 @@ func TestMFAPromptVerifier_VerifyAnswer_Success(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	resp := &sshpb.MFAPromptResponse{
-		Response: &sshpb.MFAPromptResponse_Reference{
-			Reference: &sshpb.MFAPromptResponseReference{
-				ChallengeName: challengeName,
-			},
-		},
-	}
+	resp := sshpb.MFAPromptResponse_builder{
+		Reference: sshpb.MFAPromptResponseReference_builder{
+			ChallengeName: challengeName,
+		}.Build(),
+	}.Build()
 	respJSON, err := protojson.Marshal(resp)
 	require.NoError(t, err)
 
@@ -191,13 +189,11 @@ func TestMFAPromptVerifier_VerifyAnswer_EmptyChallengeName(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	resp := &sshpb.MFAPromptResponse{
-		Response: &sshpb.MFAPromptResponse_Reference{
-			Reference: &sshpb.MFAPromptResponseReference{
-				ChallengeName: "",
-			},
-		},
-	}
+	resp := sshpb.MFAPromptResponse_builder{
+		Reference: sshpb.MFAPromptResponseReference_builder{
+			ChallengeName: "",
+		}.Build(),
+	}.Build()
 	respJSON, err := protojson.Marshal(resp)
 	require.NoError(t, err)
 
diff --git a/lib/srv/statichostuser_test.go b/lib/srv/statichostuser_test.go
index 66690d45a92..7c90576a202 100644
--- a/lib/srv/statichostuser_test.go
+++ b/lib/srv/statichostuser_test.go
@@ -141,23 +141,23 @@ func TestStaticHostUserHandler(t *testing.T) {
 	makeStaticHostUser := func(name string, labels map[string]string, groups []string) *userprovisioningv2.StaticHostUser {
 		nodeLabels := make([]*labelv1.Label, 0, len(labels))
 		for k, v := range labels {
-			nodeLabels = append(nodeLabels, &labelv1.Label{
+			nodeLabels = append(nodeLabels, labelv1.Label_builder{
 				Name:   k,
 				Values: []string{v},
-			})
+			}.Build())
 		}
-		return userprovisioning.NewStaticHostUser(name, &userprovisioningv2.StaticHostUserSpec{
+		return userprovisioning.NewStaticHostUser(name, userprovisioningv2.StaticHostUserSpec_builder{
 			Matchers: []*userprovisioningv2.Matcher{
-				{
+				userprovisioningv2.Matcher_builder{
 					NodeLabels:   nodeLabels,
 					Groups:       groups,
 					Uid:          1234,
 					Gid:          5678,
 					Sudoers:      []string{"abcd1234"},
 					DefaultShell: "/bin/bash",
-				},
+				}.Build(),
 			},
-		})
+		}.Build())
 	}
 
 	tests := []struct {
@@ -187,20 +187,20 @@ func TestStaticHostUserHandler(t *testing.T) {
 			},
 			assert: assert.NoError,
 			wantUsers: map[string]*decisionpb.HostUsersInfo{
-				"test-1": {
+				"test-1": decisionpb.HostUsersInfo_builder{
 					Groups: []string{"foo", "bar"},
 					Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 					Uid:    "1234",
 					Gid:    "5678",
 					Shell:  "/bin/bash",
-				},
-				"test-2": {
+				}.Build(),
+				"test-2": decisionpb.HostUsersInfo_builder{
 					Groups: []string{"baz", "quux"},
 					Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 					Uid:    "1234",
 					Gid:    "5678",
 					Shell:  "/bin/bash",
-				},
+				}.Build(),
 			},
 			wantSudoers: map[string][]string{
 				"test-1": {"abcd1234"},
@@ -228,23 +228,23 @@ func TestStaticHostUserHandler(t *testing.T) {
 		{
 			name: "ignore multiple matches",
 			existingUsers: []*userprovisioningv2.StaticHostUser{
-				userprovisioning.NewStaticHostUser("test", &userprovisioningv2.StaticHostUserSpec{
+				userprovisioning.NewStaticHostUser("test", userprovisioningv2.StaticHostUserSpec_builder{
 					Matchers: []*userprovisioningv2.Matcher{
-						{
+						userprovisioningv2.Matcher_builder{
 							NodeLabels: []*labelv1.Label{
-								{
+								labelv1.Label_builder{
 									Name:   "foo",
 									Values: []string{"bar"},
-								},
+								}.Build(),
 							},
 							Groups: []string{"foo", "bar"},
-						},
-						{
+						}.Build(),
+						userprovisioningv2.Matcher_builder{
 							NodeLabelsExpression: "labels.foo == 'bar'",
 							Groups:               []string{"baz", "quux"},
-						},
+						}.Build(),
 					},
-				}),
+				}.Build()),
 			},
 			events: []types.Event{
 				{
@@ -280,13 +280,13 @@ func TestStaticHostUserHandler(t *testing.T) {
 			},
 			assert: assert.NoError,
 			wantUsers: map[string]*decisionpb.HostUsersInfo{
-				"test": {
+				"test": decisionpb.HostUsersInfo_builder{
 					Groups: []string{"bar"},
 					Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 					Uid:    "1234",
 					Gid:    "5678",
 					Shell:  "/bin/bash",
-				},
+				}.Build(),
 			},
 			wantSudoers: map[string][]string{
 				"test": {"abcd1234"},
diff --git a/lib/srv/statichostusers.go b/lib/srv/statichostusers.go
index 65fa6ba4011..6abf9c7b53c 100644
--- a/lib/srv/statichostusers.go
+++ b/lib/srv/statichostusers.go
@@ -169,7 +169,7 @@ func (s *StaticHostUserHandler) run(ctx context.Context) error {
 		for _, hostUser := range users {
 			if err := s.handleNewHostUser(ctx, hostUser); err != nil {
 				// Log the error so we don't stop the handler.
-				slog.WarnContext(ctx, "Error handling static host user.", "error", err, "login", hostUser.GetMetadata().Name)
+				slog.WarnContext(ctx, "Error handling static host user.", "error", err, "login", hostUser.GetMetadata().GetName())
 			}
 		}
 		if nextKey == "" {
@@ -194,7 +194,7 @@ func (s *StaticHostUserHandler) run(ctx context.Context) error {
 
 			if err := s.handleNewHostUser(ctx, hostUser); err != nil {
 				// Log the error so we don't stop the handler.
-				slog.WarnContext(ctx, "Error handling static host user.", "error", err, "login", hostUser.GetMetadata().Name)
+				slog.WarnContext(ctx, "Error handling static host user.", "error", err, "login", hostUser.GetMetadata().GetName())
 				continue
 			}
 		case <-watcher.Done():
@@ -210,19 +210,19 @@ func (s *StaticHostUserHandler) run(ctx context.Context) error {
 
 func (s *StaticHostUserHandler) handleNewHostUser(ctx context.Context, hostUser *userprovisioningv2.StaticHostUser) error {
 	var createUser *userprovisioningv2.Matcher
-	login := hostUser.GetMetadata().Name
+	login := hostUser.GetMetadata().GetName()
 	server := s.server.GetInfo()
-	for _, matcher := range hostUser.Spec.Matchers {
+	for _, matcher := range hostUser.GetSpec().GetMatchers() {
 		// Check if this host user applies to this node.
 		nodeLabels := make(types.Labels)
-		for k, v := range label.ToMap(matcher.NodeLabels) {
+		for k, v := range label.ToMap(matcher.GetNodeLabels()) {
 			nodeLabels[k] = apiutils.Strings(v)
 		}
 		matched, _, err := services.CheckLabelsMatch(
 			types.Allow,
 			types.LabelMatchers{
 				Labels:     nodeLabels,
-				Expression: matcher.NodeLabelsExpression,
+				Expression: matcher.GetNodeLabelsExpression(),
 			},
 			"",  // username
 			nil, // userTraits
@@ -240,8 +240,8 @@ func (s *StaticHostUserHandler) handleNewHostUser(ctx context.Context, hostUser
 		if createUser != nil {
 			const msg = "Multiple matchers matched this node. Please update resource to ensure that each node is matched only once."
 			slog.WarnContext(ctx, msg, slog.String("login", login),
-				slog.Group("first_match", "labels", createUser.NodeLabels, "expression", createUser.NodeLabelsExpression),
-				slog.Group("second_match", "labels", matcher.NodeLabels, "expression", matcher.NodeLabelsExpression),
+				slog.Group("first_match", "labels", createUser.GetNodeLabels(), "expression", createUser.GetNodeLabelsExpression()),
+				slog.Group("second_match", "labels", matcher.GetNodeLabels(), "expression", matcher.GetNodeLabelsExpression()),
 			)
 			return trace.BadParameter("%s", msg)
 		}
@@ -254,21 +254,21 @@ func (s *StaticHostUserHandler) handleNewHostUser(ctx context.Context, hostUser
 
 	slog.DebugContext(ctx, "Attempt to update matched static host user.", "login", login)
 	ui := decisionpb.HostUsersInfo{
-		Groups: createUser.Groups,
+		Groups: createUser.GetGroups(),
 		Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
-		Shell:  createUser.DefaultShell,
+		Shell:  createUser.GetDefaultShell(),
 	}
-	if createUser.Uid != 0 {
-		ui.Uid = strconv.Itoa(int(createUser.Uid))
+	if createUser.GetUid() != 0 {
+		ui.SetUid(strconv.Itoa(int(createUser.GetUid())))
 	}
-	if createUser.Gid != 0 {
-		ui.Gid = strconv.Itoa(int(createUser.Gid))
+	if createUser.GetGid() != 0 {
+		ui.SetGid(strconv.Itoa(int(createUser.GetGid())))
 	}
-	if _, err := s.users.UpsertUser(login, &ui, TakeOwnershipIfUserExists(createUser.TakeOwnershipIfUserExists)); err != nil {
+	if _, err := s.users.UpsertUser(login, &ui, TakeOwnershipIfUserExists(createUser.GetTakeOwnershipIfUserExists())); err != nil {
 		return trace.Wrap(err)
 	}
-	if s.sudoers != nil && len(createUser.Sudoers) != 0 {
-		if err := s.sudoers.WriteSudoers(login, createUser.Sudoers); err != nil {
+	if s.sudoers != nil && len(createUser.GetSudoers()) != 0 {
+		if err := s.sudoers.WriteSudoers(login, createUser.GetSudoers()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
diff --git a/lib/srv/term.go b/lib/srv/term.go
index 4a89ab4be56..4da82245e89 100644
--- a/lib/srv/term.go
+++ b/lib/srv/term.go
@@ -244,7 +244,7 @@ func (t *terminal) Run(ctx context.Context, errorWriter io.Writer) error {
 		defer stderrR.Close()
 
 		childErr, err := reexecutils.ReadChildErrorWithContext(stderrR, &reexecutils.ErrorContext{
-			DecisionContext: t.serverContext.Identity.AccessPermit.DecisionContext,
+			DecisionContext: t.serverContext.Identity.AccessPermit.GetDecisionContext(),
 			Login:           t.serverContext.Identity.Login,
 		})
 		if err != nil {
diff --git a/lib/srv/transport/transportv1/transport.go b/lib/srv/transport/transportv1/transport.go
index 05de81bf470..06d1848339f 100644
--- a/lib/srv/transport/transportv1/transport.go
+++ b/lib/srv/transport/transportv1/transport.go
@@ -144,7 +144,7 @@ func NewService(cfg ServerConfig) (*Service, error) {
 
 // GetClusterDetails returns the cluster details as seen by this service to the client.
 func (s *Service) GetClusterDetails(context.Context, *transportv1pb.GetClusterDetailsRequest) (*transportv1pb.GetClusterDetailsResponse, error) {
-	return &transportv1pb.GetClusterDetailsResponse{Details: &transportv1pb.ClusterDetails{FipsEnabled: s.cfg.FIPS}}, nil
+	return transportv1pb.GetClusterDetailsResponse_builder{Details: transportv1pb.ClusterDetails_builder{FipsEnabled: s.cfg.FIPS}.Build()}.Build(), nil
 }
 
 // ProxyCluster establishes a connection to a cluster and proxies the connection
@@ -167,16 +167,16 @@ func (s *Service) ProxyCluster(stream transportv1pb.TransportService_ProxyCluste
 		return trace.Wrap(err, "could get not client destination address; listener address %q, client source address %q", s.cfg.LocalAddr.String(), p.Addr.String())
 	}
 
-	conn, err := s.cfg.Dialer.DialSite(ctx, req.Cluster, p.Addr, clientDst)
+	conn, err := s.cfg.Dialer.DialSite(ctx, req.GetCluster(), p.Addr, clientDst)
 	if err != nil {
-		return trace.Wrap(err, "failed dialing cluster %q", req.Cluster)
+		return trace.Wrap(err, "failed dialing cluster %q", req.GetCluster())
 	}
 
 	// A client may provide a frame with the first message. Since the message is
 	// already consumed it won't be copying during the proxying below. In order for
 	// the contents to be copied to the connection it needs to be manually written.
-	if req.Frame != nil {
-		if _, err := conn.Write(req.Frame.Payload); err != nil {
+	if req.HasFrame() {
+		if _, err := conn.Write(req.GetFrame().GetPayload()); err != nil {
 			return trace.Wrap(err, "failed writing payload from first frame")
 		}
 	}
@@ -201,15 +201,15 @@ func (c clusterStream) Recv() ([]byte, error) {
 		return nil, trace.Wrap(err)
 	}
 
-	if req.Frame == nil {
+	if !req.HasFrame() {
 		return nil, trace.BadParameter("received invalid frame")
 	}
 
-	return req.Frame.Payload, nil
+	return req.GetFrame().GetPayload(), nil
 }
 
 func (c clusterStream) Send(frame []byte) error {
-	return trace.Wrap(c.stream.Send(&transportv1pb.ProxyClusterResponse{Frame: &transportv1pb.Frame{Payload: frame}}))
+	return trace.Wrap(c.stream.Send(transportv1pb.ProxyClusterResponse_builder{Frame: transportv1pb.Frame_builder{Payload: frame}.Build()}.Build()))
 }
 
 // ProxySSH establishes a connection to a host and proxies both the SSH and SSH
@@ -235,11 +235,11 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 	}
 
 	// validate the target
-	if req.DialTarget == nil {
+	if !req.HasDialTarget() {
 		return trace.BadParameter("first frame must contain a dial target")
 	}
 
-	host, port, err := net.SplitHostPort(req.DialTarget.HostPort)
+	host, port, err := net.SplitHostPort(req.GetDialTarget().GetHostPort())
 	if err != nil {
 		return trace.BadParameter("dial target contains an invalid hostport")
 	}
@@ -265,9 +265,9 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 			// clients.
 			switch frame := req.Frame.(type) {
 			case *transportv1pb.ProxySSHRequest_Ssh:
-				sshStream.incomingC <- frame.Ssh.Payload
+				sshStream.incomingC <- frame.Ssh.GetPayload()
 			case *transportv1pb.ProxySSHRequest_Agent:
-				agentStream.incomingC <- frame.Agent.Payload
+				agentStream.incomingC <- frame.Agent.GetPayload()
 			default:
 				s.cfg.Logger.ErrorContext(ctx, "received unexpected ssh frame", "frame", logutils.TypeAttr(frame))
 				continue
@@ -293,9 +293,9 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 		return trace.Wrap(err, "retrieving destination address; listener address %q, client source address %q", s.cfg.LocalAddr.String(), p.Addr.String())
 	}
 
-	signer, err := s.cfg.SignerFn(ctx, authzContext, req.DialTarget.Cluster)
+	signer, err := s.cfg.SignerFn(ctx, authzContext, req.GetDialTarget().GetCluster())
 	if err != nil {
-		return trace.Wrap(err, "setting up SSH credentials for cluster %q", req.DialTarget.Cluster)
+		return trace.Wrap(err, "setting up SSH credentials for cluster %q", req.GetDialTarget().GetCluster())
 	}
 
 	checkAccessToRemoteCluster := func(types.RemoteCluster) error {
@@ -311,7 +311,7 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 		scopePin = pin
 	}
 
-	hostConn, err := s.cfg.Dialer.DialHost(ctx, scopePin, p.Addr, clientDst, host, port, req.DialTarget.Cluster, checkAccessToRemoteCluster, s.cfg.agentGetterFn(agentStreamRW), signer)
+	hostConn, err := s.cfg.Dialer.DialHost(ctx, scopePin, p.Addr, clientDst, host, port, req.GetDialTarget().GetCluster(), checkAccessToRemoteCluster, s.cfg.agentGetterFn(agentStreamRW), signer)
 	if err != nil {
 		// Return ambiguous errors unadorned so that clients can detect them easily.
 		if errors.Is(err, teleport.ErrNodeIsAmbiguous) {
@@ -326,7 +326,7 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 		hostConn.Close()
 	}()
 
-	targetAddr, err := utils.ParseAddr(req.DialTarget.HostPort)
+	targetAddr, err := utils.ParseAddr(req.GetDialTarget().GetHostPort())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -348,9 +348,9 @@ func (s *Service) ProxySSH(stream transportv1pb.TransportService_ProxySSHServer)
 
 	// send back the cluster details to alert the other side that
 	// the connection has been established
-	if err := stream.Send(&transportv1pb.ProxySSHResponse{
-		Details: &transportv1pb.ClusterDetails{FipsEnabled: s.cfg.FIPS},
-	}); err != nil {
+	if err := stream.Send(transportv1pb.ProxySSHResponse_builder{
+		Details: transportv1pb.ClusterDetails_builder{FipsEnabled: s.cfg.FIPS}.Build(),
+	}.Build()); err != nil {
 		return trace.Wrap(err, "failed sending cluster details ")
 	}
 
@@ -412,7 +412,7 @@ func newSSHStreams(stream transportv1pb.TransportService_ProxySSHServer) (ssh *s
 		incomingC: make(chan []byte, 10),
 		stream:    stream,
 		responseFn: func(payload []byte) *transportv1pb.ProxySSHResponse {
-			return &transportv1pb.ProxySSHResponse{Frame: &transportv1pb.ProxySSHResponse_Ssh{Ssh: &transportv1pb.Frame{Payload: payload}}}
+			return transportv1pb.ProxySSHResponse_builder{Ssh: transportv1pb.Frame_builder{Payload: payload}.Build()}.Build()
 		},
 		wLock: mu,
 	}
@@ -421,7 +421,7 @@ func newSSHStreams(stream transportv1pb.TransportService_ProxySSHServer) (ssh *s
 		incomingC: make(chan []byte, 10),
 		stream:    stream,
 		responseFn: func(payload []byte) *transportv1pb.ProxySSHResponse {
-			return &transportv1pb.ProxySSHResponse{Frame: &transportv1pb.ProxySSHResponse_Agent{Agent: &transportv1pb.Frame{Payload: payload}}}
+			return transportv1pb.ProxySSHResponse_builder{Agent: transportv1pb.Frame_builder{Payload: payload}.Build()}.Build()
 		},
 		wLock: mu,
 	}
@@ -509,7 +509,7 @@ type windowsDesktopStream struct {
 }
 
 func (s windowsDesktopStream) Send(p []byte) error {
-	return trace.Wrap(s.stream.Send(&transportv1pb.ProxyWindowsDesktopSessionResponse{Data: p}))
+	return trace.Wrap(s.stream.Send(transportv1pb.ProxyWindowsDesktopSessionResponse_builder{Data: p}.Build()))
 }
 
 func (s windowsDesktopStream) Recv() ([]byte, error) {
diff --git a/lib/srv/transport/transportv1/transport_test.go b/lib/srv/transport/transportv1/transport_test.go
index c074a89f168..d9eb411fc23 100644
--- a/lib/srv/transport/transportv1/transport_test.go
+++ b/lib/srv/transport/transportv1/transport_test.go
@@ -287,7 +287,7 @@ func TestService_GetClusterDetails(t *testing.T) {
 
 			resp, err := srv.Client.GetClusterDetails(context.Background(), &transportv1pb.GetClusterDetailsRequest{})
 			require.NoError(t, err)
-			require.Equal(t, test.FIPS, resp.Details.FipsEnabled)
+			require.Equal(t, test.FIPS, resp.GetDetails().GetFipsEnabled())
 		})
 	}
 }
@@ -305,16 +305,16 @@ func TestService_ProxyCluster(t *testing.T) {
 		{
 			name: "transport established to cluster",
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyClusterClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxyClusterRequest{Cluster: cluster}))
+				require.NoError(t, stream.Send(transportv1pb.ProxyClusterRequest_builder{Cluster: cluster}.Build()))
 
 				msg := []byte("hello")
-				require.NoError(t, stream.Send(&transportv1pb.ProxyClusterRequest{Frame: &transportv1pb.Frame{Payload: msg}}))
+				require.NoError(t, stream.Send(transportv1pb.ProxyClusterRequest_builder{Frame: transportv1pb.Frame_builder{Payload: msg}.Build()}.Build()))
 
 				resp, err := stream.Recv()
 				require.NoError(t, err)
 				require.NotNil(t, resp)
-				require.NotNil(t, resp.Frame)
-				require.Equal(t, msg, resp.Frame.Payload)
+				require.NotNil(t, resp.GetFrame())
+				require.Equal(t, msg, resp.GetFrame().GetPayload())
 
 				require.NoError(t, stream.CloseSend())
 			},
@@ -322,11 +322,11 @@ func TestService_ProxyCluster(t *testing.T) {
 		{
 			name: "terminated connection ends stream",
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyClusterClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxyClusterRequest{Cluster: cluster}))
+				require.NoError(t, stream.Send(transportv1pb.ProxyClusterRequest_builder{Cluster: cluster}.Build()))
 
 				require.NoError(t, conn.Close())
 				msg := []byte("hello")
-				require.NoError(t, stream.Send(&transportv1pb.ProxyClusterRequest{Frame: &transportv1pb.Frame{Payload: msg}}))
+				require.NoError(t, stream.Send(transportv1pb.ProxyClusterRequest_builder{Frame: transportv1pb.Frame_builder{Payload: msg}.Build()}.Build()))
 
 				resp, err := stream.Recv()
 				require.Error(t, err)
@@ -339,7 +339,7 @@ func TestService_ProxyCluster(t *testing.T) {
 		{
 			name: "unknown cluster",
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyClusterClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxyClusterRequest{Cluster: uuid.NewString()}))
+				require.NoError(t, stream.Send(transportv1pb.ProxyClusterRequest_builder{Cluster: uuid.NewString()}.Build()))
 				resp, err := stream.Recv()
 				require.Error(t, err)
 				require.True(t, trace.IsNotFound(err))
@@ -408,10 +408,10 @@ func TestService_ProxySSH_Errors(t *testing.T) {
 				return fakeChecker{}, nil
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxySSHClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxySSHRequest{DialTarget: &transportv1pb.TargetHost{
+				require.NoError(t, stream.Send(transportv1pb.ProxySSHRequest_builder{DialTarget: transportv1pb.TargetHost_builder{
 					HostPort: "1234",
 					Cluster:  "test",
-				}}))
+				}.Build()}.Build()))
 
 				resp, err := stream.Recv()
 				require.True(t, trace.IsBadParameter(err))
@@ -424,10 +424,10 @@ func TestService_ProxySSH_Errors(t *testing.T) {
 				return nil, trace.AccessDenied("no access checker")
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxySSHClient, conn *echoConn) {
-				err := stream.Send(&transportv1pb.ProxySSHRequest{DialTarget: &transportv1pb.TargetHost{
+				err := stream.Send(transportv1pb.ProxySSHRequest_builder{DialTarget: transportv1pb.TargetHost_builder{
 					HostPort: "1234",
 					Cluster:  "test",
-				}})
+				}.Build()}.Build())
 				switch {
 				// The server will attempt to get the authz context prior to receiving the first
 				// message from the client which may terminate the stream and result in an EOF.
@@ -459,20 +459,20 @@ func TestService_ProxySSH_Errors(t *testing.T) {
 				return fakeChecker{}, nil
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxySSHClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxySSHRequest{DialTarget: &transportv1pb.TargetHost{
+				require.NoError(t, stream.Send(transportv1pb.ProxySSHRequest_builder{DialTarget: transportv1pb.TargetHost_builder{
 					HostPort: "test:0",
 					Cluster:  "test",
-				}}))
+				}.Build()}.Build()))
 
 				// get cluster details
 				resp, err := stream.Recv()
 				require.NoError(t, err)
-				require.NotNil(t, resp.Details)
+				require.NotNil(t, resp.GetDetails())
 				require.Nil(t, resp.Frame)
 
 				require.NoError(t, conn.Close())
 				msg := []byte("hello")
-				require.NoError(t, stream.Send(&transportv1pb.ProxySSHRequest{Frame: &transportv1pb.ProxySSHRequest_Ssh{Ssh: &transportv1pb.Frame{Payload: msg}}}))
+				require.NoError(t, stream.Send(transportv1pb.ProxySSHRequest_builder{Ssh: transportv1pb.Frame_builder{Payload: msg}.Build()}.Build()))
 
 				resp, err = stream.Recv()
 				require.Error(t, err)
@@ -488,10 +488,10 @@ func TestService_ProxySSH_Errors(t *testing.T) {
 				return fakeChecker{}, nil
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxySSHClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxySSHRequest{DialTarget: &transportv1pb.TargetHost{
+				require.NoError(t, stream.Send(transportv1pb.ProxySSHRequest_builder{DialTarget: transportv1pb.TargetHost_builder{
 					HostPort: "test:100",
 					Cluster:  "test",
-				}}))
+				}.Build()}.Build()))
 				resp, err := stream.Recv()
 				require.Error(t, err)
 				require.True(t, trace.IsNotFound(err))
@@ -603,28 +603,28 @@ func TestService_ProxySSH(t *testing.T) {
 	// each connection will be to the same server. this test
 	// solely cares that a connection is made and protocols are
 	// multiplexed, not that we are dialing our target.
-	require.NoError(t, stream.Send(&transportv1pb.ProxySSHRequest{
-		DialTarget: &transportv1pb.TargetHost{
+	require.NoError(t, stream.Send(transportv1pb.ProxySSHRequest_builder{
+		DialTarget: transportv1pb.TargetHost_builder{
 			HostPort: "test:0",
 			Cluster:  "test",
-		},
-	}))
+		}.Build(),
+	}.Build()))
 
 	// wait for the response indicating that the connection
 	// was established
 	resp, err := stream.Recv()
 	require.NoError(t, err)
-	require.NotNil(t, resp.Details)
+	require.NotNil(t, resp.GetDetails())
 	require.Nil(t, resp.Frame)
 
 	// create a stream for agent protocol
 	agentStream := newClientStream(stream, func(payload []byte) *transportv1pb.ProxySSHRequest {
-		return &transportv1pb.ProxySSHRequest{Frame: &transportv1pb.ProxySSHRequest_Agent{Agent: &transportv1pb.Frame{Payload: payload}}}
+		return transportv1pb.ProxySSHRequest_builder{Agent: transportv1pb.Frame_builder{Payload: payload}.Build()}.Build()
 	})
 
 	// create a stream for ssh protocol
 	sshStream := newClientStream(stream, func(payload []byte) *transportv1pb.ProxySSHRequest {
-		return &transportv1pb.ProxySSHRequest{Frame: &transportv1pb.ProxySSHRequest_Ssh{Ssh: &transportv1pb.Frame{Payload: payload}}}
+		return transportv1pb.ProxySSHRequest_builder{Ssh: transportv1pb.Frame_builder{Payload: payload}.Build()}.Build()
 	})
 
 	// multiplex the frames to the correct handlers
@@ -639,11 +639,11 @@ func TestService_ProxySSH(t *testing.T) {
 				return
 			}
 
-			switch frame := req.Frame.(type) {
-			case *transportv1pb.ProxySSHResponse_Ssh:
-				sshStream.incomingC <- frame.Ssh.Payload
-			case *transportv1pb.ProxySSHResponse_Agent:
-				agentStream.incomingC <- frame.Agent.Payload
+			switch req.WhichFrame() {
+			case transportv1pb.ProxySSHResponse_Ssh_case:
+				sshStream.incomingC <- req.GetSsh().GetPayload()
+			case transportv1pb.ProxySSHResponse_Agent_case:
+				agentStream.incomingC <- req.GetAgent().GetPayload()
 			default:
 				continue
 			}
@@ -716,10 +716,10 @@ func TestService_ProxyWindowsDesktopSession(t *testing.T) {
 				return nil, trace.AccessDenied("no access checker")
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyWindowsDesktopSessionClient, conn *echoConn) {
-				err := stream.Send(&transportv1pb.ProxyWindowsDesktopSessionRequest{DialTarget: &transportv1pb.TargetWindowsDesktop{
+				err := stream.Send(transportv1pb.ProxyWindowsDesktopSessionRequest_builder{DialTarget: transportv1pb.TargetWindowsDesktop_builder{
 					DesktopName: "win_desktop",
 					Cluster:     "test",
-				}})
+				}.Build()}.Build())
 				switch {
 				// The server will attempt to get the authz context prior to receiving the first
 				// message from the client which may terminate the stream and result in an EOF.
@@ -751,14 +751,14 @@ func TestService_ProxyWindowsDesktopSession(t *testing.T) {
 				return fakeChecker{}, nil
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyWindowsDesktopSessionClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxyWindowsDesktopSessionRequest{DialTarget: &transportv1pb.TargetWindowsDesktop{
+				require.NoError(t, stream.Send(transportv1pb.ProxyWindowsDesktopSessionRequest_builder{DialTarget: transportv1pb.TargetWindowsDesktop_builder{
 					DesktopName: "win_desktop",
 					Cluster:     "test",
-				}}))
+				}.Build()}.Build()))
 
 				require.NoError(t, conn.Close())
 				msg := []byte("hello")
-				require.NoError(t, stream.Send(&transportv1pb.ProxyWindowsDesktopSessionRequest{Data: msg}))
+				require.NoError(t, stream.Send(transportv1pb.ProxyWindowsDesktopSessionRequest_builder{Data: msg}.Build()))
 
 				resp, err := stream.Recv()
 				require.Error(t, err)
@@ -774,10 +774,10 @@ func TestService_ProxyWindowsDesktopSession(t *testing.T) {
 				return fakeChecker{}, nil
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyWindowsDesktopSessionClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxyWindowsDesktopSessionRequest{DialTarget: &transportv1pb.TargetWindowsDesktop{
+				require.NoError(t, stream.Send(transportv1pb.ProxyWindowsDesktopSessionRequest_builder{DialTarget: transportv1pb.TargetWindowsDesktop_builder{
 					DesktopName: "nonexisting",
 					Cluster:     "test",
-				}}))
+				}.Build()}.Build()))
 				resp, err := stream.Recv()
 				require.Error(t, err)
 				require.True(t, trace.IsNotFound(err))
@@ -790,19 +790,19 @@ func TestService_ProxyWindowsDesktopSession(t *testing.T) {
 				return fakeChecker{}, nil
 			},
 			fn: func(t *testing.T, stream transportv1pb.TransportService_ProxyWindowsDesktopSessionClient, conn *echoConn) {
-				require.NoError(t, stream.Send(&transportv1pb.ProxyWindowsDesktopSessionRequest{DialTarget: &transportv1pb.TargetWindowsDesktop{
+				require.NoError(t, stream.Send(transportv1pb.ProxyWindowsDesktopSessionRequest_builder{DialTarget: transportv1pb.TargetWindowsDesktop_builder{
 					DesktopName: "win_desktop",
 					Cluster:     "test",
-				}}))
+				}.Build()}.Build()))
 
 				msg := []byte("hello")
-				err := stream.Send(&transportv1pb.ProxyWindowsDesktopSessionRequest{Data: msg})
+				err := stream.Send(transportv1pb.ProxyWindowsDesktopSessionRequest_builder{Data: msg}.Build())
 				require.NoError(t, err)
 
 				resp, err := stream.Recv()
 				require.NoError(t, err)
 				// The mocked server implementation echoes the message.
-				require.Equal(t, msg, resp.Data)
+				require.Equal(t, msg, resp.GetData())
 			},
 		},
 	}
diff --git a/lib/srv/usermgmt.go b/lib/srv/usermgmt.go
index f9a29f295bd..4fa244d4578 100644
--- a/lib/srv/usermgmt.go
+++ b/lib/srv/usermgmt.go
@@ -295,12 +295,12 @@ func (u *HostUserManagement) updateUser(hostUser HostUser, ui *decisionpb.HostUs
 	ctx := u.ctx
 	log := u.log.With(
 		"host_username", hostUser.Name,
-		"mode", ui.Mode,
+		"mode", ui.GetMode(),
 		"uid", hostUser.UID,
 		"gid", hostUser.GID,
 	)
 
-	if ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_KEEP {
+	if ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_KEEP {
 		_, hasKeepGroup := hostUser.Groups[apiconstants.TeleportKeepGroup]
 		if !hasKeepGroup {
 			home, err := u.backend.GetDefaultHomeDirectory(hostUser.Name)
@@ -317,7 +317,7 @@ func (u *HostUserManagement) updateUser(hostUser HostUser, ui *decisionpb.HostUs
 	}
 
 	return trace.Wrap(u.doWithUserLock(func(_ types.SemaphoreLease) error {
-		return trace.Wrap(u.backend.UpdateUser(hostUser.Name, ui.Groups, ui.Shell))
+		return trace.Wrap(u.backend.UpdateUser(hostUser.Name, ui.GetGroups(), ui.GetShell()))
 	}))
 }
 
@@ -350,21 +350,21 @@ func (u *HostUserManagement) resolveGID(username string, groups []string, gid st
 func (u *HostUserManagement) createUser(name string, ui *decisionpb.HostUsersInfo) error {
 	log := u.log.With(
 		"host_username", name,
-		"mode", ui.Mode,
-		"uid", ui.Uid,
-		"shell", ui.Shell,
+		"mode", ui.GetMode(),
+		"uid", ui.GetUid(),
+		"shell", ui.GetShell(),
 	)
 
-	log.DebugContext(u.ctx, "Attempting to create host user", "gid", ui.Gid)
+	log.DebugContext(u.ctx, "Attempting to create host user", "gid", ui.GetGid())
 
 	var err error
 	userOpts := host.UserOpts{
-		UID:   ui.Uid,
-		GID:   ui.Gid,
-		Shell: ui.Shell,
+		UID:   ui.GetUid(),
+		GID:   ui.GetGid(),
+		Shell: ui.GetShell(),
 	}
 
-	switch ui.Mode {
+	switch ui.GetMode() {
 	case decisionpb.HostUserMode_HOST_USER_MODE_KEEP, decisionpb.HostUserMode_HOST_USER_MODE_STATIC:
 		userOpts.Home, err = u.backend.GetDefaultHomeDirectory(name)
 		if err != nil {
@@ -373,19 +373,19 @@ func (u *HostUserManagement) createUser(name string, ui *decisionpb.HostUsersInf
 	}
 
 	err = u.doWithUserLock(func(_ types.SemaphoreLease) error {
-		if ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_DROP {
+		if ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_DROP {
 			if err := u.storage.UpsertHostUserInteractionTime(u.ctx, name, time.Now()); err != nil {
 				return trace.Wrap(err)
 			}
 		}
 
-		userOpts.GID, err = u.resolveGID(name, ui.Groups, ui.Gid)
+		userOpts.GID, err = u.resolveGID(name, ui.GetGroups(), ui.GetGid())
 		if err != nil {
 			return trace.Wrap(err)
 		}
 
 		log.InfoContext(u.ctx, "Creating host user", "gid", userOpts.GID)
-		err = u.backend.CreateUser(name, ui.Groups, userOpts)
+		err = u.backend.CreateUser(name, ui.GetGroups(), userOpts)
 		if err != nil && !trace.IsAlreadyExists(err) {
 			return trace.WrapWithMessage(err, "error while creating user")
 		}
@@ -438,9 +438,9 @@ type HostUser struct {
 func (u *HostUserManagement) UpsertUser(name string, ui *decisionpb.HostUsersInfo, opts ...UpsertHostUserOption) (io.Closer, error) {
 	log := u.log.With(
 		"host_username", name,
-		"mode", ui.Mode,
-		"uid", ui.Uid,
-		"gid", ui.Gid,
+		"mode", ui.GetMode(),
+		"uid", ui.GetUid(),
+		"gid", ui.GetGid(),
 	)
 
 	var options upsertHostUserOptions
@@ -477,10 +477,10 @@ func (u *HostUserManagement) UpsertUser(name string, ui *decisionpb.HostUsersInf
 	}
 
 	ui = apiutils.CloneProtoMsg(ui)
-	ui.Groups = groups
+	ui.SetGroups(groups)
 
 	var closer io.Closer
-	if ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_DROP {
+	if ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_DROP {
 		closer = &userCloser{
 			username: name,
 			users:    u,
@@ -498,14 +498,14 @@ func (u *HostUserManagement) UpsertUser(name string, ui *decisionpb.HostUsersInf
 	}
 
 	// nothing to update
-	if groups == nil && ui.Shell == "" {
+	if groups == nil && ui.GetShell() == "" {
 		return closer, nil
 	}
 
 	if groups == nil {
 		// only bother checking the user's current shell if we aren't already
 		// updating their groups
-		usingShell, err := u.backend.IsUsingShell(name, ui.Shell)
+		usingShell, err := u.backend.IsUsingShell(name, ui.GetShell())
 		if err != nil {
 			log.WarnContext(u.ctx, "Failed to check user's default shell", "error", err)
 		}
@@ -741,8 +741,8 @@ func (u *HostUserManagement) getHostUser(username string) (*HostUser, error) {
 
 func ResolveGroups(logger *slog.Logger, hostUser *HostUser, ui *decisionpb.HostUsersInfo, takeOwnership bool) ([]string, error) {
 	// converting to a map since we need deduplication and arbitrary lookups
-	groups := make(map[string]struct{}, len(ui.Groups))
-	for _, group := range ui.Groups {
+	groups := make(map[string]struct{}, len(ui.GetGroups()))
+	for _, group := range ui.GetGroups() {
 		groups[group] = struct{}{}
 	}
 
@@ -757,7 +757,7 @@ func ResolveGroups(logger *slog.Logger, hostUser *HostUser, ui *decisionpb.HostU
 
 	// if we assign a teleport group, it will always coincide with the mode we're currently in, so we can compute it right away
 	teleportGroup := ""
-	switch ui.Mode {
+	switch ui.GetMode() {
 	case decisionpb.HostUserMode_HOST_USER_MODE_DROP:
 		teleportGroup = apiconstants.TeleportDropGroup
 	case decisionpb.HostUserMode_HOST_USER_MODE_KEEP:
@@ -777,12 +777,12 @@ func ResolveGroups(logger *slog.Logger, hostUser *HostUser, ui *decisionpb.HostU
 		_, hasDropGroup := hostUser.Groups[apiconstants.TeleportDropGroup]
 		_, hasKeepGroup := hostUser.Groups[apiconstants.TeleportKeepGroup]
 
-		migrateStaticUser := takeOwnership && ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_STATIC
-		migrateKeepUser := hasExplicitKeepGroup && ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_KEEP
+		migrateStaticUser := takeOwnership && ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_STATIC
+		migrateKeepUser := hasExplicitKeepGroup && ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_KEEP
 
 		managedUser := hasKeepGroup || hasDropGroup
 		_, staticUser := hostUser.Groups[apiconstants.TeleportStaticGroup]
-		inStaticMode := ui.Mode == decisionpb.HostUserMode_HOST_USER_MODE_STATIC
+		inStaticMode := ui.GetMode() == decisionpb.HostUserMode_HOST_USER_MODE_STATIC
 
 		if (inStaticMode && managedUser) || (!inStaticMode && staticUser) {
 			return nil, trace.Wrap(errStaticConversion)
diff --git a/lib/srv/usermgmt_test.go b/lib/srv/usermgmt_test.go
index a7e50b3c25f..59a02fb1480 100644
--- a/lib/srv/usermgmt_test.go
+++ b/lib/srv/usermgmt_test.go
@@ -289,10 +289,10 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 		log:     logtest.NewLogger(),
 	}
 
-	closer, err := users.UpsertUser("bob", &decisionpb.HostUsersInfo{
+	closer, err := users.UpsertUser("bob", decisionpb.HostUsersInfo_builder{
 		Groups: []string{"hello", "sudo"},
 		Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
-	})
+	}.Build())
 	require.NoError(t, err)
 	require.NotEqual(t, nil, closer)
 
@@ -314,14 +314,14 @@ func TestUserMgmtSudoers_CreateTemporaryUser(t *testing.T) {
 		// test user already exists but teleport-service group has not yet
 		// been created
 		backend.CreateUser("testuser", nil, host.UserOpts{})
-		_, err := users.UpsertUser("testuser", &decisionpb.HostUsersInfo{
+		_, err := users.UpsertUser("testuser", decisionpb.HostUsersInfo_builder{
 			Mode: decisionpb.HostUserMode_HOST_USER_MODE_DROP,
-		})
+		}.Build())
 		require.ErrorIs(t, err, errUnmanagedUser)
 		backend.CreateGroup(apiconstants.TeleportDropGroup, "")
-		_, err = users.UpsertUser("testuser", &decisionpb.HostUsersInfo{
+		_, err = users.UpsertUser("testuser", decisionpb.HostUsersInfo_builder{
 			Mode: decisionpb.HostUserMode_HOST_USER_MODE_DROP,
-		})
+		}.Build())
 		require.ErrorIs(t, err, errUnmanagedUser)
 	})
 }
@@ -359,10 +359,10 @@ func TestUserMgmt_DeleteAllTeleportSystemUsers(t *testing.T) {
 			mgmt.CreateGroup(group, "")
 		}
 		if slices.Contains(user.groups, apiconstants.TeleportDropGroup) {
-			users.UpsertUser(user.user, &decisionpb.HostUsersInfo{
+			users.UpsertUser(user.user, decisionpb.HostUsersInfo_builder{
 				Groups: user.groups,
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
-			})
+			}.Build())
 		} else {
 			mgmt.CreateUser(user.user, user.groups, host.UserOpts{})
 		}
@@ -445,17 +445,17 @@ func Test_UpdateUserGroups_Keep(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Zero(t, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportKeepGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportDropGroup)
 
 	// Update user with new groups.
-	userinfo.Groups = slices.Clone(allGroups[2:])
+	userinfo.SetGroups(slices.Clone(allGroups[2:]))
 
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportKeepGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportDropGroup)
 
 	// Upsert again with same groups should not call UpdateUser.
@@ -463,25 +463,25 @@ func Test_UpdateUserGroups_Keep(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportKeepGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportDropGroup)
 
 	// Do not convert the managed user to static.
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_STATIC
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_STATIC)
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportKeepGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportKeepGroup), backend.users["alice"])
 
 	// Updates with INSECURE_DROP mode should convert the managed user
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_DROP
-	userinfo.Groups = slices.Clone(allGroups[:2])
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_DROP)
+	userinfo.SetGroups(slices.Clone(allGroups[:2]))
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
 	assert.Equal(t, 2, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportDropGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportKeepGroup)
 }
 
@@ -501,17 +501,17 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
 	assert.Zero(t, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportDropGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportKeepGroup)
 
 	// Update user with new groups.
-	userinfo.Groups = slices.Clone(allGroups[2:])
+	userinfo.SetGroups(slices.Clone(allGroups[2:]))
 
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportDropGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportKeepGroup)
 
 	// Upsert again with same groups should not call SetUserGroups.
@@ -519,26 +519,26 @@ func Test_UpdateUserGroups_Drop(t *testing.T) {
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportDropGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportDropGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportKeepGroup)
 
 	// Do not convert the managed user to static.
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_STATIC
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_STATIC)
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportDropGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportDropGroup), backend.users["alice"])
 
 	// Updates with KEEP mode should convert the ephemeral user
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_KEEP
-	userinfo.Groups = slices.Clone(allGroups[:2])
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_KEEP)
+	userinfo.SetGroups(slices.Clone(allGroups[:2]))
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 2, backend.updateUserCalls)
 	assert.Equal(t, 1, backend.createHomeDirectoryCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportKeepGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportDropGroup)
 }
 
@@ -557,25 +557,25 @@ func Test_UpdateUserGroups_Static(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Zero(t, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportStaticGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportStaticGroup), backend.users["alice"])
 
 	// Update user with new groups.
-	userinfo.Groups = slices.Clone(allGroups[2:])
+	userinfo.SetGroups(slices.Clone(allGroups[2:]))
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportStaticGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportStaticGroup), backend.users["alice"])
 
 	// Upsert again with same groups should not call SetUserGroups.
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Equal(t, 1, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportStaticGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportStaticGroup), backend.users["alice"])
 
 	// Do not convert to KEEP.
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_KEEP
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_KEEP)
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
@@ -583,7 +583,7 @@ func Test_UpdateUserGroups_Static(t *testing.T) {
 	assert.ElementsMatch(t, append(slices.Clone(allGroups[2:]), apiconstants.TeleportStaticGroup), backend.users["alice"])
 
 	// Do not convert to INSECURE_DROP.
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_DROP
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_DROP)
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errStaticConversion)
 	assert.Equal(t, nil, closer)
@@ -612,7 +612,7 @@ func Test_DontManageExistingUser(t *testing.T) {
 	assert.ElementsMatch(t, allGroups, backend.users["alice"])
 
 	// Update user in KEEP mode
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_KEEP
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_KEEP)
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
@@ -620,7 +620,7 @@ func Test_DontManageExistingUser(t *testing.T) {
 	assert.ElementsMatch(t, allGroups, backend.users["alice"])
 
 	// Update static user
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_STATIC
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_STATIC)
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
@@ -641,24 +641,24 @@ func Test_DontUpdateUnmanagedUsers(t *testing.T) {
 	}{
 		{
 			name: "keep",
-			userinfo: &decisionpb.HostUsersInfo{
+			userinfo: decisionpb.HostUsersInfo_builder{
 				Groups: allGroups[:2],
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
-			},
+			}.Build(),
 		},
 		{
 			name: "drop",
-			userinfo: &decisionpb.HostUsersInfo{
+			userinfo: decisionpb.HostUsersInfo_builder{
 				Groups: allGroups[:2],
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
-			},
+			}.Build(),
 		},
 		{
 			name: "static",
-			userinfo: &decisionpb.HostUsersInfo{
+			userinfo: decisionpb.HostUsersInfo_builder{
 				Groups: allGroups[:2],
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
-			},
+			}.Build(),
 		},
 	}
 	for _, tc := range tests {
@@ -698,7 +698,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	assert.NotContains(t, backend.users["alice-keep"], apiconstants.TeleportDropGroup)
 
 	// Take ownership of existing user when in STATIC mode
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_STATIC
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_STATIC)
 	closer, err = users.UpsertUser("alice-static", &userinfo, TakeOwnershipIfUserExists(true))
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
@@ -709,7 +709,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	assert.NotContains(t, backend.users["alice-static"], apiconstants.TeleportDropGroup)
 
 	// Don't take ownership of existing user when in DROP mode
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_DROP
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_DROP)
 	closer, err = users.UpsertUser("alice-drop", &userinfo)
 	assert.ErrorIs(t, err, errUnmanagedUser)
 	assert.Equal(t, nil, closer)
@@ -717,7 +717,7 @@ func Test_AllowExplicitlyManageExistingUsers(t *testing.T) {
 	assert.Empty(t, backend.users["alice-drop"])
 
 	// Don't assign teleport-keep to users created in DROP mode
-	userinfo.Mode = decisionpb.HostUserMode_HOST_USER_MODE_DROP
+	userinfo.SetMode(decisionpb.HostUserMode_HOST_USER_MODE_DROP)
 	closer, err = users.UpsertUser("bob", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
@@ -772,21 +772,21 @@ func TestCreateUserWithExistingPrimaryGroup(t *testing.T) {
 	assert.Zero(t, backend.updateUserCalls)
 
 	// create a user with primary group defined in userinfo.Groups, but not yet on the host
-	userinfo.Groups = []string{"fred"}
+	userinfo.SetGroups([]string{"fred"})
 	closer, err = users.UpsertUser("fred", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
 	assert.Zero(t, backend.updateUserCalls)
 
 	// create a user with primary group defined in userinfo.Groups that already exists on the host
-	userinfo.Groups = []string{"alice"}
+	userinfo.SetGroups([]string{"alice"})
 	closer, err = users.UpsertUser("alice", &userinfo)
 	assert.NoError(t, err)
 	assert.NotEqual(t, nil, closer)
 	assert.Zero(t, backend.updateUserCalls)
 
 	// create a user with primary group that already exists on the host but is not defined in userinfo.Groups
-	userinfo.Groups = []string{""}
+	userinfo.SetGroups([]string{""})
 	closer, err = users.UpsertUser("simon", &userinfo)
 	assert.True(t, trace.IsAlreadyExists(err))
 	assert.Contains(t, err.Error(), "conflicts with an existing group")
@@ -809,10 +809,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 			name: "create drop user",
 
 			hostUser: nil,
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"foo", "bar"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"foo", "bar", apiconstants.TeleportDropGroup},
 		},
@@ -820,10 +820,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 			name: "create keep user",
 
 			hostUser: nil,
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 				Groups: []string{"foo", "bar"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"foo", "bar", apiconstants.TeleportKeepGroup},
 		},
@@ -831,10 +831,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 			name: "create static user",
 
 			hostUser: nil,
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 				Groups: []string{"foo", "bar"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"foo", "bar", apiconstants.TeleportStaticGroup},
 		},
@@ -847,10 +847,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportDropGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", "qux", apiconstants.TeleportDropGroup},
 		},
@@ -864,10 +864,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportKeepGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", "qux", apiconstants.TeleportKeepGroup},
 		},
@@ -881,10 +881,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportStaticGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", "qux", apiconstants.TeleportStaticGroup},
 		},
@@ -898,10 +898,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportDropGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", "qux", apiconstants.TeleportKeepGroup},
 		},
@@ -915,10 +915,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportKeepGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", "qux", apiconstants.TeleportDropGroup},
 		},
@@ -932,10 +932,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportDropGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 			expectErr:    errStaticConversion,
@@ -950,10 +950,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportKeepGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 			expectErr:    errStaticConversion,
@@ -968,10 +968,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportStaticGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 			expectErr:    errStaticConversion,
@@ -985,10 +985,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportStaticGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 			expectErr:    errStaticConversion,
@@ -1002,10 +1002,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					"bar": {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"baz", "qux", apiconstants.TeleportDropGroup}, // similarly including TeleportDropGroup to ensure no-op
-			},
+			}.Build(),
 			takeOwnership: true, // this flag should be a no-op for DROP, so we include it to ensure that behavior
 
 			expectGroups: nil,
@@ -1019,10 +1019,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					"bar": {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 			expectErr:    errUnmanagedUser,
@@ -1035,10 +1035,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					"bar": {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 			expectErr:    errUnmanagedUser,
@@ -1051,10 +1051,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					"bar": {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_KEEP,
 				Groups: []string{"baz", "qux", apiconstants.TeleportKeepGroup},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", "qux", apiconstants.TeleportKeepGroup},
 		},
@@ -1066,10 +1066,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					"bar": {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_STATIC,
 				Groups: []string{"baz", "qux"},
-			},
+			}.Build(),
 
 			takeOwnership: true,
 
@@ -1085,10 +1085,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportDropGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"baz", apiconstants.TeleportStaticGroup, apiconstants.TeleportKeepGroup, apiconstants.TeleportDropGroup},
-			},
+			}.Build(),
 
 			expectGroups: []string{"baz", apiconstants.TeleportDropGroup},
 		},
@@ -1102,10 +1102,10 @@ func TestHostUsersResolveGroups(t *testing.T) {
 					apiconstants.TeleportDropGroup: {},
 				},
 			},
-			ui: &decisionpb.HostUsersInfo{
+			ui: decisionpb.HostUsersInfo_builder{
 				Mode:   decisionpb.HostUserMode_HOST_USER_MODE_DROP,
 				Groups: []string{"foo", "bar", apiconstants.TeleportDropGroup},
-			},
+			}.Build(),
 
 			expectGroups: nil,
 		},
@@ -1147,7 +1147,7 @@ func TestRegressionGroupErrorDoesNotPanic(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
 	assert.Zero(t, backend.updateUserCalls)
-	assert.ElementsMatch(t, append(userinfo.Groups, apiconstants.TeleportKeepGroup), backend.users["alice"])
+	assert.ElementsMatch(t, append(userinfo.GetGroups(), apiconstants.TeleportKeepGroup), backend.users["alice"])
 	assert.NotContains(t, backend.users["alice"], apiconstants.TeleportDropGroup)
 
 	backend.groupDatabaseErr = errors.New("could not find group")
@@ -1172,7 +1172,7 @@ func TestIsUserShell(t *testing.T) {
 	require.True(t, hasShell)
 
 	// shell defined, create with shell
-	userinfo.Shell = "/usr/bin/bash"
+	userinfo.SetShell("/usr/bin/bash")
 	closer, err = users.UpsertUser("bob", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
@@ -1190,7 +1190,7 @@ func TestIsUserShell(t *testing.T) {
 	require.Equal(t, 0, backend.updateUserCalls)
 
 	// shell defined and changed, update user
-	userinfo.Shell = "/usr/bin/zsh"
+	userinfo.SetShell("/usr/bin/zsh")
 	closer, err = users.UpsertUser("bob", &userinfo)
 	assert.NoError(t, err)
 	assert.Equal(t, nil, closer)
diff --git a/lib/sshca/identity.go b/lib/sshca/identity.go
index d318d138b3b..e3659cae98d 100644
--- a/lib/sshca/identity.go
+++ b/lib/sshca/identity.go
@@ -488,8 +488,8 @@ func DecodeIdentity(cert *ssh.Certificate) (*Identity, error) {
 		}
 		// Certs issued before PinKind was introduced will have UNSPECIFIED here.
 		// Pins decoded from the user OID are always user pins.
-		if pin.Kind == scopesv1.PinKind_PIN_KIND_UNSPECIFIED {
-			pin.Kind = scopesv1.PinKind_PIN_KIND_USER
+		if pin.GetKind() == scopesv1.PinKind_PIN_KIND_UNSPECIFIED {
+			pin.SetKind(scopesv1.PinKind_PIN_KIND_USER)
 		}
 		ident.ScopePin = pin
 	}
diff --git a/lib/sshca/identity_test.go b/lib/sshca/identity_test.go
index 0a13216da93..83886050bec 100644
--- a/lib/sshca/identity_test.go
+++ b/lib/sshca/identity_test.go
@@ -48,17 +48,17 @@ func TestIdentityConversion(t *testing.T) {
 		ClusterName: "some-cluster",
 		SystemRole:  types.RoleNode,
 		Username:    "user",
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/foo",
-			SystemRoles: &scopesv1.SystemRoles{
+			SystemRoles: scopesv1.SystemRoles_builder{
 				Primary:    "node",
 				Additional: []string{"proxy"},
-			},
+			}.Build(),
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/": {"/": {"role1", "role2"}},
 			}),
-		},
+		}.Build(),
 		Impersonator:            "impersonator",
 		Principals:              []string{"login1", "login2"},
 		PermitX11Forwarding:     true,
@@ -110,12 +110,12 @@ func TestIdentityConversion(t *testing.T) {
 		HeadlessAuthenticationID: "headless-auth-id",
 		DelegationSessionID:      "delegation-session-id",
 		AgentScope:               "/foo",
-		ImmutableLabelHash: joining.HashImmutableLabels(&joiningv1.ImmutableLabels{
+		ImmutableLabelHash: joining.HashImmutableLabels(joiningv1.ImmutableLabels_builder{
 			Ssh: map[string]string{
 				"one": "1",
 				"two": "2",
 			},
-		}),
+		}.Build()),
 	}
 
 	ignores := []string{
diff --git a/lib/sshutils/reexec/reexec.go b/lib/sshutils/reexec/reexec.go
index bd6464a74f4..061ac354d22 100644
--- a/lib/sshutils/reexec/reexec.go
+++ b/lib/sshutils/reexec/reexec.go
@@ -53,11 +53,11 @@ func ChildErrorWithContext(errMsg string, context *ErrorContext) string {
 	// If some roles allow host user creation while others deny it, this can be
 	// ambiguous to the end user and warrants clarification if it results in an
 	// unknown user error.
-	ambiguousHostUserDenial := len(context.DecisionContext.HostUserCreationDeniedBy) > 0 && len(context.DecisionContext.HostUserCreationAllowedBy) > 0
+	ambiguousHostUserDenial := len(context.DecisionContext.GetHostUserCreationDeniedBy()) > 0 && len(context.DecisionContext.GetHostUserCreationAllowedBy()) > 0
 	ambiguousHostUserError := func() string {
 		var deniedBy []string
-		for _, d := range context.DecisionContext.HostUserCreationDeniedBy {
-			deniedBy = append(deniedBy, fmt.Sprintf("%v: %q", d.Kind, d.Name))
+		for _, d := range context.DecisionContext.GetHostUserCreationDeniedBy() {
+			deniedBy = append(deniedBy, fmt.Sprintf("%v: %q", d.GetKind(), d.GetName()))
 		}
 		return fmt.Sprintf("%s: host user creation denied by the following resources: [%s]\n", strings.TrimRight(errMsg, ".\n"), strings.Join(deniedBy, ", "))
 	}
diff --git a/lib/sshutils/reexec/reexec_test.go b/lib/sshutils/reexec/reexec_test.go
index 27e823cef09..a33b7f0604c 100644
--- a/lib/sshutils/reexec/reexec_test.go
+++ b/lib/sshutils/reexec/reexec_test.go
@@ -68,14 +68,14 @@ func TestReadChildError(t *testing.T) {
 			childErrIn: "Failed to launch: user: unknown user teleport-test-user-does-not-exist-reexec.\n",
 			context: &ErrorContext{
 				Login: "teleport-test-user-does-not-exist-reexec",
-				DecisionContext: &decisionpb.SSHAccessPermitContext{
+				DecisionContext: decisionpb.SSHAccessPermitContext_builder{
 					HostUserCreationAllowedBy: []*decisionpb.Determinant{
-						{Kind: "role", Name: "allow-role"},
+						decisionpb.Determinant_builder{Kind: "role", Name: "allow-role"}.Build(),
 					},
 					HostUserCreationDeniedBy: []*decisionpb.Determinant{
-						{Kind: "role", Name: "deny-role"},
+						decisionpb.Determinant_builder{Kind: "role", Name: "deny-role"}.Build(),
 					},
-				},
+				}.Build(),
 			},
 			wantChildErr: "Failed to launch: user: unknown user teleport-test-user-does-not-exist-reexec: host user creation denied by the following resources: [role: \"deny-role\"]\n",
 		},
@@ -84,14 +84,14 @@ func TestReadChildError(t *testing.T) {
 			childErrIn: "Failed to launch: failed to open PAM context: pam_start failed.\n",
 			context: &ErrorContext{
 				Login: "teleport-test-user-does-not-exist-pam",
-				DecisionContext: &decisionpb.SSHAccessPermitContext{
+				DecisionContext: decisionpb.SSHAccessPermitContext_builder{
 					HostUserCreationAllowedBy: []*decisionpb.Determinant{
-						{Kind: "role", Name: "allow-role"},
+						decisionpb.Determinant_builder{Kind: "role", Name: "allow-role"}.Build(),
 					},
 					HostUserCreationDeniedBy: []*decisionpb.Determinant{
-						{Kind: "role", Name: "deny-role"},
+						decisionpb.Determinant_builder{Kind: "role", Name: "deny-role"}.Build(),
 					},
-				},
+				}.Build(),
 			},
 			wantChildErr: "Failed to launch: failed to open PAM context: pam_start failed: host user creation denied by the following resources: [role: \"deny-role\"]\n",
 		},
diff --git a/lib/subca/ca_override_resolver.go b/lib/subca/ca_override_resolver.go
index 40f76742c8d..693e7a4e5f6 100644
--- a/lib/subca/ca_override_resolver.go
+++ b/lib/subca/ca_override_resolver.go
@@ -227,11 +227,11 @@ func (c *CAOverrideResolver) calculateOverride(
 
 		var chain []Certificate
 		if !skipCAChain {
-			chain = make([]Certificate, 0, len(co.CertificateOverride.Chain)+1)
+			chain = make([]Certificate, 0, len(co.CertificateOverride.GetChain())+1)
 			chain = append(chain, Certificate{
-				PEM: []byte(co.CertificateOverride.Certificate),
+				PEM: []byte(co.CertificateOverride.GetCertificate()),
 			})
-			for _, pem := range co.CertificateOverride.Chain {
+			for _, pem := range co.CertificateOverride.GetChain() {
 				chain = append(chain, Certificate{
 					PEM: []byte(pem),
 				})
@@ -242,7 +242,7 @@ func (c *CAOverrideResolver) calculateOverride(
 			OverrideActive: true,
 			PublicKeyHash:  co.PublicKey,
 			CACertificate: Certificate{
-				PEM: []byte(co.CertificateOverride.Certificate),
+				PEM: []byte(co.CertificateOverride.GetCertificate()),
 			},
 			CAChain: chain,
 		}
diff --git a/lib/subca/ca_override_resolver_test.go b/lib/subca/ca_override_resolver_test.go
index 43cd7285a8a..0e2239d2799 100644
--- a/lib/subca/ca_override_resolver_test.go
+++ b/lib/subca/ca_override_resolver_test.go
@@ -205,21 +205,21 @@ func TestCAOverrideResolver_ApplyOverrides(t *testing.T) {
 		cert5, err := tlsutils.ParseCertificatePEM(ca1Cert5)
 		require.NoError(t, err)
 
-		ca1Override, err = subCA.CreateCertAuthorityOverride(t.Context(), &subcav1.CertAuthorityOverride{
+		ca1Override, err = subCA.CreateCertAuthorityOverride(t.Context(), subcav1.CertAuthorityOverride_builder{
 			Kind:    types.KindCertAuthorityOverride,
 			SubKind: string(ca1Type),
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: env.ClusterName,
-			},
-			Spec: &subcav1.CertAuthorityOverrideSpec{
+			}.Build(),
+			Spec: subcav1.CertAuthorityOverrideSpec_builder{
 				CertificateOverrides: []*subcav1.CertificateOverride{
 					env.NewDisabledCertificateOverride(t, cert2, nil),
 					env.NewDisabledCertificateOverride(t, cert4, nil),
 					env.NewDisabledCertificateOverride(t, cert5, nil),
 				},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -247,14 +247,14 @@ func TestCAOverrideResolver_ApplyOverrides(t *testing.T) {
 	// - (cert4 remains disabled)
 	var ca1Override2, ca1Override5 []byte
 	{
-		ca1Override.Spec.CertificateOverrides[0].Disabled = false
-		ca1Override.Spec.CertificateOverrides[2].Disabled = false
+		ca1Override.GetSpec().GetCertificateOverrides()[0].SetDisabled(false)
+		ca1Override.GetSpec().GetCertificateOverrides()[2].SetDisabled(false)
 		var err error
 		_, err = subCA.UpdateCertAuthorityOverride(t.Context(), ca1Override)
 		require.NoError(t, err)
 
-		ca1Override2 = []byte(ca1Override.Spec.CertificateOverrides[0].Certificate)
-		ca1Override5 = []byte(ca1Override.Spec.CertificateOverrides[2].Certificate)
+		ca1Override2 = []byte(ca1Override.GetSpec().GetCertificateOverrides()[0].GetCertificate())
+		ca1Override5 = []byte(ca1Override.GetSpec().GetCertificateOverrides()[2].GetCertificate())
 	}
 
 	// Fetch CA2 certificates.
@@ -442,15 +442,15 @@ func TestCAOverrideResolver_CalculateOverride(t *testing.T) {
 	}
 
 	// Prepare and test an "empty" CA override.
-	caOverride, err := subCA.CreateCertAuthorityOverride(t.Context(), &subcav1.CertAuthorityOverride{
+	caOverride, err := subCA.CreateCertAuthorityOverride(t.Context(), subcav1.CertAuthorityOverride_builder{
 		Kind:    types.KindCertAuthorityOverride,
 		SubKind: string(ca.GetType()),
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: ca.GetClusterName(),
-		},
+		}.Build(),
 		Spec: &subcav1.CertAuthorityOverrideSpec{},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	caID := types.CertAuthorityOverrideID{
@@ -479,16 +479,16 @@ func TestCAOverrideResolver_CalculateOverride(t *testing.T) {
 	//   - (o3 doesn't exist)
 	//   - o4: target caCert4, enabled, has chain
 	o1 := env.NewDisabledCertificateOverride(t, caCert1, nil)
-	o1.Disabled = false
+	o1.SetDisabled(false)
 	o2 := env.NewDisabledCertificateOverride(t, caCert2, nil)
 	o4 := env.NewDisabledCertificateOverride(t, caCert4, nil)
-	o4.Disabled = false
-	o4.Chain = caChain.LeafToRootPEMs()[:caChainLen-1] // skip root
-	caOverride.Spec.CertificateOverrides = []*subcav1.CertificateOverride{
+	o4.SetDisabled(false)
+	o4.SetChain(caChain.LeafToRootPEMs()[:caChainLen-1]) // skip root
+	caOverride.GetSpec().SetCertificateOverrides([]*subcav1.CertificateOverride{
 		o1,
 		o2,
 		o4,
-	}
+	})
 	_, err = subCA.UpdateCertAuthorityOverride(t.Context(), caOverride)
 	require.NoError(t, err)
 
@@ -522,10 +522,10 @@ func TestCAOverrideResolver_CalculateOverride(t *testing.T) {
 			want: &subca.CalculateOverrideResult{
 				// caCert1 is targeted by o1.
 				OverrideActive: true,
-				PublicKeyHash:  o1.PublicKey,
-				CACertificate:  subca.Certificate{PEM: []byte(o1.Certificate)},
+				PublicKeyHash:  o1.GetPublicKey(),
+				CACertificate:  subca.Certificate{PEM: []byte(o1.GetCertificate())},
 				CAChain: []subca.Certificate{
-					{PEM: []byte(o1.Certificate)},
+					{PEM: []byte(o1.GetCertificate())},
 				},
 			},
 		},
@@ -536,12 +536,12 @@ func TestCAOverrideResolver_CalculateOverride(t *testing.T) {
 			want: &subca.CalculateOverrideResult{
 				// caCert4 is targeted by o4.
 				OverrideActive: true,
-				PublicKeyHash:  o4.PublicKey,
-				CACertificate:  subca.Certificate{PEM: []byte(o4.Certificate)},
+				PublicKeyHash:  o4.GetPublicKey(),
+				CACertificate:  subca.Certificate{PEM: []byte(o4.GetCertificate())},
 				CAChain: []subca.Certificate{
-					{PEM: []byte(o4.Certificate)},
-					{PEM: []byte(o4.Chain[0])},
-					{PEM: []byte(o4.Chain[1])},
+					{PEM: []byte(o4.GetCertificate())},
+					{PEM: []byte(o4.GetChain()[0])},
+					{PEM: []byte(o4.GetChain()[1])},
 				},
 			},
 		},
diff --git a/lib/subca/dn.go b/lib/subca/dn.go
index 45d23c82111..147df97c437 100644
--- a/lib/subca/dn.go
+++ b/lib/subca/dn.go
@@ -37,9 +37,9 @@ func RDNSequenceToDistinguishedNameProto(rdns pkix.RDNSequence) (*subcav1.Distin
 	// Usually it's one item per nameset. OK if not.
 	estimatedLen := len(rdns)
 
-	dn := &subcav1.DistinguishedName{
+	dn := subcav1.DistinguishedName_builder{
 		Names: make([]*subcav1.AttributeTypeAndValue, 0, estimatedLen),
-	}
+	}.Build()
 	for i, nameSet := range rdns {
 		for j, atv := range nameSet {
 			oid := make([]int32, len(atv.Type))
@@ -64,10 +64,10 @@ func RDNSequenceToDistinguishedNameProto(rdns pkix.RDNSequence) (*subcav1.Distin
 					atv.Type, atv.Value, atv.Value,
 				)
 			}
-			dn.Names = append(dn.Names, &subcav1.AttributeTypeAndValue{
+			dn.SetNames(append(dn.GetNames(), subcav1.AttributeTypeAndValue_builder{
 				Oid:   oid,
 				Value: &val,
-			})
+			}.Build()))
 		}
 	}
 	return dn, nil
@@ -82,21 +82,21 @@ func RDNSequenceToDistinguishedNameProto(rdns pkix.RDNSequence) (*subcav1.Distin
 //
 // A nil or empty DistinguishedName is considered invalid.
 func DistinguishedNameProtoToRDNSequence(dn *subcav1.DistinguishedName) (pkix.RDNSequence, error) {
-	if dn == nil || len(dn.Names) == 0 {
+	if dn == nil || len(dn.GetNames()) == 0 {
 		return nil, trace.BadParameter("empty distinguished name")
 	}
 
-	rdns := make(pkix.RDNSequence, 0, len(dn.Names))
-	for i, atv := range dn.Names {
+	rdns := make(pkix.RDNSequence, 0, len(dn.GetNames()))
+	for i, atv := range dn.GetNames() {
 		switch {
 		case len(atv.GetOid()) == 0:
 			return nil, trace.BadParameter("names[%d]: empty OID", i)
-		case atv.Value == nil:
+		case !atv.HasValue():
 			return nil, trace.BadParameter("names[%d]: nil Value", i)
 		}
 
-		oid := make([]int, len(atv.Oid))
-		for j, x := range atv.Oid {
+		oid := make([]int, len(atv.GetOid()))
+		for j, x := range atv.GetOid() {
 			if x < 0 {
 				return nil, trace.BadParameter("names[%d]: OID component out of bounds: %d (must be >= 0)", i, x)
 			}
@@ -105,7 +105,7 @@ func DistinguishedNameProtoToRDNSequence(dn *subcav1.DistinguishedName) (pkix.RD
 		rdns = append(rdns, pkix.RelativeDistinguishedNameSET{
 			pkix.AttributeTypeAndValue{
 				Type:  oid,
-				Value: *atv.Value,
+				Value: atv.GetValue(),
 			},
 		})
 	}
diff --git a/lib/subca/dn_test.go b/lib/subca/dn_test.go
index 2bddee46417..41802c88fc5 100644
--- a/lib/subca/dn_test.go
+++ b/lib/subca/dn_test.go
@@ -74,11 +74,11 @@ func TestRDNSequenceToDistinguishedNameProto(t *testing.T) {
 		})
 		require.NoError(t, err)
 
-		want := &subcav1.DistinguishedName{
+		want := subcav1.DistinguishedName_builder{
 			Names: []*subcav1.AttributeTypeAndValue{
-				{Oid: []int32{99, 1, 2, int32(math.MaxInt32)}, Value: &val},
+				subcav1.AttributeTypeAndValue_builder{Oid: []int32{99, 1, 2, int32(math.MaxInt32)}, Value: &val}.Build(),
 			},
-		}
+		}.Build()
 		if diff := cmp.Diff(want, got, protocmp.Transform()); diff != "" {
 			t.Errorf("DistinguishedName mismatch (-want +got)\n%s", diff)
 		}
@@ -146,38 +146,38 @@ func TestDistinguishedNameProtoToRDNSequence(t *testing.T) {
 		},
 		{
 			name: "ATV nil",
-			dn: &subcav1.DistinguishedName{
+			dn: subcav1.DistinguishedName_builder{
 				Names: []*subcav1.AttributeTypeAndValue{
 					nil,
 				},
-			},
+			}.Build(),
 			wantErr: "empty OID",
 		},
 		{
 			name: "ATV.OID empty",
-			dn: &subcav1.DistinguishedName{
+			dn: subcav1.DistinguishedName_builder{
 				Names: []*subcav1.AttributeTypeAndValue{
-					{Oid: []int32{}, Value: &exampleValue},
+					subcav1.AttributeTypeAndValue_builder{Oid: []int32{}, Value: &exampleValue}.Build(),
 				},
-			},
+			}.Build(),
 			wantErr: "empty OID",
 		},
 		{
 			name: "ATV.OID negative",
-			dn: &subcav1.DistinguishedName{
+			dn: subcav1.DistinguishedName_builder{
 				Names: []*subcav1.AttributeTypeAndValue{
-					{Oid: []int32{1, 2, 3, -1}, Value: &exampleValue},
+					subcav1.AttributeTypeAndValue_builder{Oid: []int32{1, 2, 3, -1}, Value: &exampleValue}.Build(),
 				},
-			},
+			}.Build(),
 			wantErr: "OID component out of bounds",
 		},
 		{
 			name: "ATV.Value nil",
-			dn: &subcav1.DistinguishedName{
+			dn: subcav1.DistinguishedName_builder{
 				Names: []*subcav1.AttributeTypeAndValue{
-					{Oid: []int32{1, 2, 3, 4}},
+					subcav1.AttributeTypeAndValue_builder{Oid: []int32{1, 2, 3, 4}}.Build(),
 				},
-			},
+			}.Build(),
 			wantErr: "nil Value",
 		},
 	}
diff --git a/lib/subca/parsed.go b/lib/subca/parsed.go
index c98de92abc5..60c445aa93c 100644
--- a/lib/subca/parsed.go
+++ b/lib/subca/parsed.go
@@ -101,7 +101,7 @@ func ParseCAOverride(resource *subcav1.CertAuthorityOverride) (*ParsedCertAuthor
 		var chain []*x509.Certificate
 		if l := len(co.GetChain()); l > 0 {
 			chain = make([]*x509.Certificate, l)
-			for j, pem := range co.Chain {
+			for j, pem := range co.GetChain() {
 				cert, err := tlsutils.ParseCertificatePEM([]byte(pem))
 				if err != nil {
 					return nil, trace.Wrap(err, "spec.certificate_overrides[%d].chain[%d]", i, j)
@@ -123,7 +123,7 @@ func ParseCAOverride(resource *subcav1.CertAuthorityOverride) (*ParsedCertAuthor
 
 func parseCertificateAndPublicKey(co *subcav1.CertificateOverride) (_ *x509.Certificate, publicKeyHash string, _ error) {
 	if co.GetCertificate() != "" {
-		cert, err := tlsutils.ParseCertificatePEM([]byte(co.Certificate))
+		cert, err := tlsutils.ParseCertificatePEM([]byte(co.GetCertificate()))
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
@@ -147,22 +147,22 @@ func ValidateAndParseCAOverride(resource *subcav1.CertAuthorityOverride) (*Parse
 	switch {
 	case resource == nil:
 		return nil, trace.BadParameter("ca override required")
-	case resource.Kind != types.KindCertAuthorityOverride:
-		return nil, trace.BadParameter("invalid kind: %q", resource.Kind)
-	case !slices.Contains(allowedCAOverrideSubKinds, resource.SubKind):
-		return nil, trace.BadParameter("invalid or unsupported sub_kind/caType: %q", resource.SubKind)
-	case resource.Version != types.V1:
-		return nil, trace.BadParameter("invalid or unsupported version: %q", resource.Version)
-	case resource.Metadata == nil:
+	case resource.GetKind() != types.KindCertAuthorityOverride:
+		return nil, trace.BadParameter("invalid kind: %q", resource.GetKind())
+	case !slices.Contains(allowedCAOverrideSubKinds, resource.GetSubKind()):
+		return nil, trace.BadParameter("invalid or unsupported sub_kind/caType: %q", resource.GetSubKind())
+	case resource.GetVersion() != types.V1:
+		return nil, trace.BadParameter("invalid or unsupported version: %q", resource.GetVersion())
+	case !resource.HasMetadata():
 		return nil, trace.BadParameter("metadata required")
-	case resource.Metadata.Name == "":
+	case resource.GetMetadata().GetName() == "":
 		return nil, trace.BadParameter("metadata.name/clusterName required")
-	case resource.Spec == nil:
+	case !resource.HasSpec():
 		return nil, trace.BadParameter("spec required")
 	}
-	clusterName := resource.Metadata.Name
+	clusterName := resource.GetMetadata().GetName()
 
-	overrides := resource.Spec.CertificateOverrides
+	overrides := resource.GetSpec().GetCertificateOverrides()
 	parsedOverrides := make([]*ParsedCertificateOverride, len(overrides))
 	seenPublicKeys := make(map[string]struct{})
 	for i, co := range overrides {
@@ -203,9 +203,9 @@ func validateCertificateOverride(
 	// Certificate.
 	var cert *x509.Certificate
 	var wantPublicKey string
-	if co.Certificate != "" {
+	if co.GetCertificate() != "" {
 		var err error
-		cert, err = ParseCertificateOverrideCertificate(co.Certificate)
+		cert, err = ParseCertificateOverrideCertificate(co.GetCertificate())
 		if err != nil {
 			return nil, "certificate", err
 		}
@@ -216,11 +216,11 @@ func validateCertificateOverride(
 	}
 
 	// PublicKey.
-	if co.PublicKey != "" {
-		if !certificateOverridePublicKeyRE.MatchString(co.PublicKey) {
+	if co.GetPublicKey() != "" {
+		if !certificateOverridePublicKeyRE.MatchString(co.GetPublicKey()) {
 			return nil, "", errors.New("invalid public key")
 		}
-		if wantPublicKey != "" && !strings.EqualFold(co.PublicKey, wantPublicKey) {
+		if wantPublicKey != "" && !strings.EqualFold(co.GetPublicKey(), wantPublicKey) {
 			return nil, "public_key", fmt.Errorf("certificate public key mismatch (want %q)", wantPublicKey)
 		}
 	}
@@ -228,31 +228,31 @@ func validateCertificateOverride(
 	// Validate "required" fields now that we know both Certificate and PublicKey
 	// are valid.
 	switch {
-	case co.Disabled && co.PublicKey == "" && co.Certificate == "":
+	case co.GetDisabled() && co.GetPublicKey() == "" && co.GetCertificate() == "":
 		return nil, "", errors.New("certificate or public key required")
-	case co.Disabled:
+	case co.GetDisabled():
 		// OK, determined above to have either PublicKey or Certificate.
-	case co.Certificate == "":
+	case co.GetCertificate() == "":
 		return nil, "", errors.New("certificate required")
 	}
 
 	// Chain.
 	var chain []*x509.Certificate
-	if len(co.Chain) > 0 {
+	if len(co.GetChain()) > 0 {
 		if cert == nil {
 			return nil, "", errors.New("chain not allowed with an empty certificate")
 		}
 
 		// The exact number is arbitrary, the fact that a cap exists isn't.
 		const maxChainLength = 10
-		if len(co.Chain) > maxChainLength {
+		if len(co.GetChain()) > maxChainLength {
 			return nil, "chain", fmt.Errorf(
-				"certificate chain has too many entries (%d > %d)", len(co.Chain), maxChainLength)
+				"certificate chain has too many entries (%d > %d)", len(co.GetChain()), maxChainLength)
 		}
 
-		chain = make([]*x509.Certificate, len(co.Chain))
+		chain = make([]*x509.Certificate, len(co.GetChain()))
 		prev := cert
-		for i, chainPEM := range co.Chain {
+		for i, chainPEM := range co.GetChain() {
 			chainCert, err := ParseCertificateOverrideCertificate(chainPEM)
 			if err != nil {
 				return nil, fmt.Sprintf("chain[%d]", i), err
@@ -288,7 +288,7 @@ func validateCertificateOverride(
 	}
 
 	// Normalize public key to lowercase so it matches HashPublicKey.
-	publicKey := cmp.Or(wantPublicKey, co.PublicKey)
+	publicKey := cmp.Or(wantPublicKey, co.GetPublicKey())
 	publicKey = strings.ToLower(publicKey)
 
 	return &ParsedCertificateOverride{
diff --git a/lib/subca/parsed_test.go b/lib/subca/parsed_test.go
index f9e7cbac945..44dfc00685e 100644
--- a/lib/subca/parsed_test.go
+++ b/lib/subca/parsed_test.go
@@ -85,8 +85,8 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 	// Used for scenarios that test invalid certificate override certificates.
 	makeInvalidCertificateFn := func(modify func(template *x509.Certificate)) func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
 		return func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-			co := ca.Spec.CertificateOverrides[0]
-			cert, err := tlsca.ParseCertificatePEM([]byte(co.Certificate))
+			co := ca.GetSpec().GetCertificateOverrides()[0]
+			cert, err := tlsca.ParseCertificatePEM([]byte(co.GetCertificate()))
 			require.NoError(t, err, "ParseCertificatePEM: override certificate")
 
 			intCA, err := env.ExternalRoot.NewIntermediateCA(&subcaenv.CAParams{
@@ -101,8 +101,8 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 			})
 			require.NoError(t, err, "NewIntermediateCA")
 
-			co.Certificate = string(intCA.CertPEM)
-			ca.Spec.CertificateOverrides = []*subcav1.CertificateOverride{co}
+			co.SetCertificate(string(intCA.CertPEM))
+			ca.GetSpec().SetCertificateOverrides([]*subcav1.CertificateOverride{co})
 		}
 	}
 
@@ -127,102 +127,102 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 		{
 			name: "OK: Minimal CA override",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec = &subcav1.CertAuthorityOverrideSpec{}
+				ca.SetSpec(&subcav1.CertAuthorityOverrideSpec{})
 			},
 		},
 
 		{
 			name: "empty kind",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Kind = ""
+				ca.SetKind("")
 			},
 			wantErr: "kind",
 		},
 		{
 			name: "invalid kind",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Kind = types.KindCertAuthority // wrong type
+				ca.SetKind(types.KindCertAuthority) // wrong type
 			},
 			wantErr: "kind",
 		},
 		{
 			name: "empty sub_kind",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.SubKind = ""
+				ca.SetSubKind("")
 			},
 			wantErr: "sub_kind",
 		},
 		{
 			name: "invalid sub_kind",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.SubKind = string(types.DatabaseCA) // not allowed
+				ca.SetSubKind(string(types.DatabaseCA)) // not allowed
 			},
 			wantErr: "sub_kind",
 		},
 		{
 			name: "empty version",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Version = ""
+				ca.SetVersion("")
 			},
 			wantErr: "version",
 		},
 		{
 			name: "invalid version",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Version = types.V2
+				ca.SetVersion(types.V2)
 			},
 			wantErr: "version",
 		},
 		{
 			name: "nil metadata",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Metadata = nil
+				ca.ClearMetadata()
 			},
 			wantErr: "metadata required",
 		},
 		{
 			name: "empty name",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Metadata.Name = ""
+				ca.GetMetadata().SetName("")
 			},
 			wantErr: "name/clusterName required",
 		},
 		{
 			name: "nil spec",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec = nil
+				ca.ClearSpec()
 			},
 			wantErr: "spec required",
 		},
 		{
 			name: "nil certificate_override",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec.CertificateOverrides = append(ca.Spec.CertificateOverrides, nil)
+				ca.GetSpec().SetCertificateOverrides(append(ca.GetSpec().GetCertificateOverrides(), nil))
 			},
 			wantErr: "nil certificate override",
 		},
 		{
 			name: "certificate_override: empty certificate and public key (enabled)",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec.CertificateOverrides[0].Certificate = ""
-				ca.Spec.CertificateOverrides[0].PublicKey = ""
-				ca.Spec.CertificateOverrides[0].Disabled = false
+				ca.GetSpec().GetCertificateOverrides()[0].SetCertificate("")
+				ca.GetSpec().GetCertificateOverrides()[0].SetPublicKey("")
+				ca.GetSpec().GetCertificateOverrides()[0].SetDisabled(false)
 			},
 			wantErr: "certificate required",
 		},
 		{
 			name: "certificate_override: empty certificate and public key (disabled)",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec.CertificateOverrides[0].Certificate = ""
-				ca.Spec.CertificateOverrides[0].PublicKey = ""
-				ca.Spec.CertificateOverrides[0].Disabled = true
+				ca.GetSpec().GetCertificateOverrides()[0].SetCertificate("")
+				ca.GetSpec().GetCertificateOverrides()[0].SetPublicKey("")
+				ca.GetSpec().GetCertificateOverrides()[0].SetDisabled(true)
 			},
 			wantErr: "certificate or public key required",
 		},
 		{
 			name: "certificate_override: invalid certificate",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec.CertificateOverrides[0].Certificate = "ceci n'est pas a certificate"
+				ca.GetSpec().GetCertificateOverrides()[0].SetCertificate("ceci n'est pas a certificate")
 			},
 			wantErr:      "expected PEM",
 			wantParseErr: true,
@@ -230,7 +230,7 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 		{
 			name: "certificate_override: invalid public key",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				ca.Spec.CertificateOverrides[0].PublicKey = "not a valid key"
+				ca.GetSpec().GetCertificateOverrides()[0].SetPublicKey("not a valid key")
 			},
 			wantErr: "invalid public key",
 		},
@@ -238,31 +238,31 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 			name: "certificate_override: certificate and public key mismatch",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
 				// Doesn't match the Certificate field.
-				ca.Spec.CertificateOverrides[0].PublicKey = unrelatedPublicKey
+				ca.GetSpec().GetCertificateOverrides()[0].SetPublicKey(unrelatedPublicKey)
 			},
 			wantErr: "public key mismatch",
 		},
 		{
 			name: "certificate_override: chain without certificate",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.Chain = leafToRootChain
-				co.Certificate = ""
-				co.Disabled = true
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetChain(leafToRootChain)
+				co.SetCertificate("")
+				co.SetDisabled(true)
 			},
 			wantErr: "chain not allowed with an empty certificate",
 		},
 		{
 			name: "certificate_override: chain certificate invalid",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.PublicKey = ""
-				co.Chain = []string{
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetPublicKey("")
+				co.SetChain([]string{
 					leafToRootChain[0],
 					"ceci n'est pas a certificate",
 					leafToRootChain[1],
 					leafToRootChain[2],
-				}
+				})
 			},
 			wantErr:      "chain[1]: expected PEM",
 			wantParseErr: true,
@@ -270,49 +270,49 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 		{
 			name: "certificate_override: certificate included in chain",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.PublicKey = ""
-				co.Chain = append([]string{co.Certificate}, leafToRootChain...)
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetPublicKey("")
+				co.SetChain(append([]string{co.GetCertificate()}, leafToRootChain...))
 			},
 			wantErr: "override certificate should not be included",
 		},
 		{
 			name: "certificate_override: chain out of order",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.PublicKey = ""
-				co.Chain = caChain.RootToLeafPEMs() // reverse order
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetPublicKey("")
+				co.SetChain(caChain.RootToLeafPEMs()) // reverse order
 			},
 			wantErr: "chain out of order",
 		},
 		{
 			name: "certificate_override: chain signature invalid (forged CA)",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.Chain = append(
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetChain(append(
 					[]string{string(forgedExternalRoot.CertPEM)},
 					leafToRootChain[1:]...,
-				)
+				))
 			},
 			wantErr: "chain signature check failed",
 		},
 		{
 			name: "certificate_override: chain has too many entries",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.PublicKey = ""
-				co.Chain = slices.Repeat([]string{leafToRootChain[0]}, 20)
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetPublicKey("")
+				co.SetChain(slices.Repeat([]string{leafToRootChain[0]}, 20))
 			},
 			wantErr: "chain has too many entries",
 		},
 		{
 			name: "certificate_override: duplicate public key",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				ca.Spec.CertificateOverrides = append(
-					ca.Spec.CertificateOverrides,
-					&subcav1.CertificateOverride{PublicKey: co.PublicKey, Disabled: true},
-				)
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				ca.GetSpec().SetCertificateOverrides(append(
+					ca.GetSpec().GetCertificateOverrides(),
+					subcav1.CertificateOverride_builder{PublicKey: co.GetPublicKey(), Disabled: true}.Build(),
+				))
 			},
 			wantErr: "duplicate override",
 		},
@@ -320,29 +320,29 @@ func TestValidateAndParseCAOverride(t *testing.T) {
 		{
 			name: "OK: Enabled override",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.Disabled = false
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetDisabled(false)
 			},
 		},
 		{
 			name: "OK: Override without public key",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.PublicKey = ""
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetPublicKey("")
 			},
 		},
 		{
 			name: "OK: Disabled override with only public key",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.Certificate = ""
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetCertificate("")
 			},
 		},
 		{
 			name: "OK: Override with chain",
 			modify: func(t *testing.T, ca *subcav1.CertAuthorityOverride) {
-				co := ca.Spec.CertificateOverrides[0]
-				co.Chain = leafToRootChain
+				co := ca.GetSpec().GetCertificateOverrides()[0]
+				co.SetChain(leafToRootChain)
 			},
 		},
 
@@ -453,16 +453,16 @@ func TestValidateAndParseCAOverride_ParsedResource(t *testing.T) {
 	t.Parallel()
 
 	// Use a pre-made caOverride so we have predictable certificates/public keys.
-	caOverride := &subcav1.CertAuthorityOverride{
+	caOverride := subcav1.CertAuthorityOverride_builder{
 		Kind:    "cert_authority_override",
 		SubKind: "windows",
 		Version: "v1",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "zarquon",
-		},
-		Spec: &subcav1.CertAuthorityOverrideSpec{
+		}.Build(),
+		Spec: subcav1.CertAuthorityOverrideSpec_builder{
 			CertificateOverrides: []*subcav1.CertificateOverride{
-				{
+				subcav1.CertificateOverride_builder{
 					//PublicKey: "e96aa5dc0b1c238bb2201191f381f91d7f2d27eca890591de14998e5e15ce417",
 					Certificate: "-----BEGIN CERTIFICATE-----\nMIIBxzCCAWygAwIBAgIBBzAKBggqhkjOPQQDAjAxMSMwIQYDVQQDExpFWFRFUk5B\nTCBJTlRFUk1FRElBVEUgQ0EgMzEKMAgGA1UEBRMBMzAeFw0yNjA0MDcyMDM0MzRa\nFw0yNjA0MDcyMTM1MzRaMEMxEDAOBgNVBAoTB3phcnF1b24xIzAhBgNVBAMTGkVY\nVEVSTkFMIElOVEVSTUVESUFURSBDQSA3MQowCAYDVQQFEwE3MFkwEwYHKoZIzj0C\nAQYIKoZIzj0DAQcDQgAE5xcb9chZRNgg/K/AXhMQ9GMUu1wBvPo97L107e4iQ/Dp\nc+RG8ywYGHbqSXIcJP+ONOgbDaLYeSg0Y+89k1Bgg6NjMGEwDgYDVR0PAQH/BAQD\nAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHC7cgHrQtquasktOLXLZRt3\nQizJMB8GA1UdIwQYMBaAFKauhVOH7awfXqv4WkNmyzsP00ucMAoGCCqGSM49BAMC\nA0kAMEYCIQCLbjjjwvTxATYa5FQCtvE/sg0z5n6zLEPuDUapmZ2bswIhAM6mljTl\nldbZY/y+1kC52QRpOWCTNGLlEQwTY0JN966I\n-----END CERTIFICATE-----\n",
 					Chain: []string{
@@ -471,14 +471,14 @@ func TestValidateAndParseCAOverride_ParsedResource(t *testing.T) {
 						"-----BEGIN CERTIFICATE-----\nMIIBhjCCASygAwIBAgIBATAKBggqhkjOPQQDAjApMRswGQYDVQQDExJFWFRFUk5B\nTCBST09UIENBIDExCjAIBgNVBAUTATEwHhcNMjYwNDA3MjAzNDM0WhcNMjYwNDA3\nMjEzNTM0WjApMRswGQYDVQQDExJFWFRFUk5BTCBST09UIENBIDExCjAIBgNVBAUT\nATEwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARfTXGAS719qco6RuW/i9PIymfI\nRCGU6qKVEGDjHaFK6nlPod0vHxBL0GbcKNoiEVO+8VGyHYyIvqpGOtnBZCMWo0Uw\nQzAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBAjAdBgNVHQ4EFgQU\nrDLjZ4+mStwp8dfvxj/xB7VWxecwCgYIKoZIzj0EAwIDSAAwRQIhALlT/cKaQV8c\nPCfbWdb2RP3TZseQDLEyUkPeqVgvwKnDAiAWjntSrPBwRpaf7K1rB/PZs+4gXIJw\n3bRU1xKbDLGzkw==\n-----END CERTIFICATE-----\n",
 					},
 					Disabled: true,
-				},
-				{
+				}.Build(),
+				subcav1.CertificateOverride_builder{
 					PublicKey: "89B32EF334D6FA94E2A7D9B3CC122115A3A9ED19907A7F25D3FE71BBC734619D",
 					Disabled:  true,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	const publicKey0 = "e96aa5dc0b1c238bb2201191f381f91d7f2d27eca890591de14998e5e15ce417"
 	const chain0Key0 = "36b3cc3e289c286de54fa166ddc867058fe52f7bfc33ea04572c23b867fe2011"
 	const chain0Key1 = "8510a1fee7c494b6883a3d80ca8bee2d47535fb9b6b2650946c36845845adf40"
@@ -493,7 +493,7 @@ func TestValidateAndParseCAOverride_ParsedResource(t *testing.T) {
 
 	// Verify CertificateOverride #0.
 	co0 := parsed.CertificateOverrides[0]
-	assert.Same(t, caOverride.Spec.CertificateOverrides[0], co0.CertificateOverride, "CertificateOverride changed")
+	assert.Same(t, caOverride.GetSpec().GetCertificateOverrides()[0], co0.CertificateOverride, "CertificateOverride changed")
 	assert.Equal(t, publicKey0, co0.PublicKey, "PublicKey mismatch")
 	assert.NotNil(t, co0.Certificate, "Certificate expected")
 	assert.Equal(t, publicKey0, subca.HashCertificatePublicKey(co0.Certificate), "Certificate public key mismatch")
@@ -512,7 +512,7 @@ func TestValidateAndParseCAOverride_ParsedResource(t *testing.T) {
 
 	// Verify CertificateOverride #1.
 	co1 := parsed.CertificateOverrides[1]
-	assert.Same(t, caOverride.Spec.CertificateOverrides[1], co1.CertificateOverride, "CertificateOverride changed")
+	assert.Same(t, caOverride.GetSpec().GetCertificateOverrides()[1], co1.CertificateOverride, "CertificateOverride changed")
 	assert.Equal(t, publicKey1, co1.PublicKey, "PublicKey mismatch")
 	assert.Nil(t, co1.Certificate)
 	assert.Empty(t, co1.Chain)
diff --git a/lib/subca/testenv/env.go b/lib/subca/testenv/env.go
index b7f0e3db736..b5b11f33549 100644
--- a/lib/subca/testenv/env.go
+++ b/lib/subca/testenv/env.go
@@ -199,17 +199,17 @@ func (env *Env) NewOverrideForCA(
 		overrides = append(overrides, co)
 	}
 
-	return &subcav1.CertAuthorityOverride{
+	return subcav1.CertAuthorityOverride_builder{
 		Kind:    types.KindCertAuthorityOverride,
 		SubKind: string(ca.GetType()),
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: ca.GetName(),
-		},
-		Spec: &subcav1.CertAuthorityOverrideSpec{
+		}.Build(),
+		Spec: subcav1.CertAuthorityOverrideSpec_builder{
 			CertificateOverrides: overrides,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 // NewDisabledCertificateOverride creates a disabled CertificateOverride for the
@@ -240,11 +240,11 @@ func (env *Env) NewDisabledCertificateOverride(
 	})
 	require.NoError(t, err)
 
-	return &subcav1.CertificateOverride{
+	return subcav1.CertificateOverride_builder{
 		PublicKey:   subca.HashCertificatePublicKey(overrideCA.Cert),
 		Certificate: string(overrideCA.CertPEM),
 		Disabled:    true,
-	}
+	}.Build()
 }
 
 // MakeCAChain is a convenience wrapper over the standalone [MakeCAChain].
diff --git a/lib/tbot/identity/generator.go b/lib/tbot/identity/generator.go
index 9425a4c7ebc..abfdea86b26 100644
--- a/lib/tbot/identity/generator.go
+++ b/lib/tbot/identity/generator.go
@@ -408,47 +408,41 @@ func (g *Generator) botDefaultRoles(ctx context.Context) ([]string, error) {
 }
 
 func (g *Generator) generateDelegationCertificates(ctx context.Context, req proto.UserCertsRequest, o *generateOpts) (*proto.Certs, error) {
-	certReq := &delegationv1.GenerateCertsRequest{
+	certReq := delegationv1.GenerateCertsRequest_builder{
 		DelegationSessionId: o.delegationSessionID,
 		SshPublicKey:        req.SSHPublicKey,
 		TlsPublicKey:        req.TLSPublicKey,
 		Ttl:                 durationpb.New(o.ttl),
-	}
+	}.Build()
 	if req.GetRouteToCluster() != o.currentIdentity.ClusterName {
 		return nil, trace.BadParameter("delegation sessions cannot be used with leaf clusters")
 	}
 	switch {
 	case req.GetRouteToApp().Name != "":
 		route := req.GetRouteToApp()
-		certReq.Routing = &delegationv1.GenerateCertsRequest_RouteToApp{
-			RouteToApp: &delegationv1.RouteToApp{
-				Name:              route.GetName(),
-				PublicAddr:        route.GetPublicAddr(),
-				ClusterName:       route.GetClusterName(),
-				Uri:               route.GetURI(),
-				TargetPort:        route.GetTargetPort(),
-				AwsRoleArn:        route.GetAWSRoleARN(),
-				AzureIdentity:     route.GetAzureIdentity(),
-				GcpServiceAccount: route.GetGCPServiceAccount(),
-			},
-		}
+		certReq.SetRouteToApp(delegationv1.RouteToApp_builder{
+			Name:              route.GetName(),
+			PublicAddr:        route.GetPublicAddr(),
+			ClusterName:       route.GetClusterName(),
+			Uri:               route.GetURI(),
+			TargetPort:        route.GetTargetPort(),
+			AwsRoleArn:        route.GetAWSRoleARN(),
+			AzureIdentity:     route.GetAzureIdentity(),
+			GcpServiceAccount: route.GetGCPServiceAccount(),
+		}.Build())
 	case req.GetRouteToDatabase().ServiceName != "":
 		route := req.GetRouteToDatabase()
-		certReq.Routing = &delegationv1.GenerateCertsRequest_RouteToDatabase{
-			RouteToDatabase: &delegationv1.RouteToDatabase{
-				ServiceName: route.GetServiceName(),
-				Protocol:    route.GetProtocol(),
-				Username:    route.GetUsername(),
-				Database:    route.GetDatabase(),
-				Roles:       route.GetRoles(),
-			},
-		}
+		certReq.SetRouteToDatabase(delegationv1.RouteToDatabase_builder{
+			ServiceName: route.GetServiceName(),
+			Protocol:    route.GetProtocol(),
+			Username:    route.GetUsername(),
+			Database:    route.GetDatabase(),
+			Roles:       route.GetRoles(),
+		}.Build())
 	case req.GetKubernetesCluster() != "":
-		certReq.Routing = &delegationv1.GenerateCertsRequest_RouteToKubernetes{
-			RouteToKubernetes: &delegationv1.RouteToKubernetes{
-				ClusterName: req.GetKubernetesCluster(),
-			},
-		}
+		certReq.SetRouteToKubernetes(delegationv1.RouteToKubernetes_builder{
+			ClusterName: req.GetKubernetesCluster(),
+		}.Build())
 	}
 	certsRsp, err := g.client.DelegationSessionServiceClient().
 		GenerateCerts(ctx, certReq)
@@ -487,7 +481,7 @@ func (g *Generator) GenerateScoped(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	req.SshPublicKey = ssh.MarshalAuthorizedKey(sshPub)
+	req.SetSshPublicKey(ssh.MarshalAuthorizedKey(sshPub))
 
 	req.TlsPublicKey, err = keys.MarshalPublicKey(key.Public())
 	if err != nil {
@@ -525,10 +519,10 @@ func (g *Generator) GenerateScoped(
 
 	newIdentity, err := ReadIdentityFromStore(&LoadIdentityParams{
 		PrivateKeyBytes: privateKeyPEM,
-		PublicKeyBytes:  req.SshPublicKey,
+		PublicKeyBytes:  req.GetSshPublicKey(),
 	}, &proto.Certs{
-		SSH:        res.Certs.Ssh,
-		TLS:        res.Certs.Tls,
+		SSH:        res.GetCerts().GetSsh(),
+		TLS:        res.GetCerts().GetTls(),
 		TLSCACerts: tlsHostCAs,
 		SSHCACerts: g.botIdentity.Get().SSHCACertBytes,
 	})
diff --git a/lib/tbot/identity/identity.go b/lib/tbot/identity/identity.go
index 6415be5441f..597c9f72187 100644
--- a/lib/tbot/identity/identity.go
+++ b/lib/tbot/identity/identity.go
@@ -408,7 +408,7 @@ func (i *Identity) LogValue() slog.Value {
 
 	scopePin := ""
 	if tlsIdent.ScopePin != nil {
-		scopePin = tlsIdent.ScopePin.Scope
+		scopePin = tlsIdent.ScopePin.GetScope()
 	}
 
 	duration := cert.NotAfter.Sub(cert.NotBefore)
diff --git a/lib/tbot/internal/heartbeat/service.go b/lib/tbot/internal/heartbeat/service.go
index 936065c0f41..db195ccd882 100644
--- a/lib/tbot/internal/heartbeat/service.go
+++ b/lib/tbot/internal/heartbeat/service.go
@@ -217,7 +217,7 @@ func (s *Service) heartbeat(ctx context.Context, isOneShot, isStartup bool) erro
 	}
 
 	now := time.Now()
-	hb := &machineidv1pb.BotInstanceStatusHeartbeat{
+	hb := machineidv1pb.BotInstanceStatusHeartbeat_builder{
 		RecordedAt:   timestamppb.New(now),
 		Hostname:     hostName,
 		IsStartup:    isStartup,
@@ -228,7 +228,7 @@ func (s *Service) heartbeat(ctx context.Context, isOneShot, isStartup bool) erro
 		Architecture: runtime.GOARCH,
 		Os:           runtime.GOOS,
 		Kind:         s.cfg.BotKind,
-	}
+	}.Build()
 
 	status := s.cfg.StatusRegistry.OverallStatus()
 	serviceHealth := make([]*machineidv1pb.BotInstanceServiceHealth, 0, len(status.Services))
@@ -238,13 +238,13 @@ func (s *Service) heartbeat(ctx context.Context, isOneShot, isStartup bool) erro
 
 	// Sort the services by name to make tests deterministic.
 	sort.Slice(serviceHealth, func(a, b int) bool {
-		return serviceHealth[a].Service.Name < serviceHealth[b].Service.Name
+		return serviceHealth[a].GetService().GetName() < serviceHealth[b].GetService().GetName()
 	})
 
-	_, err = s.cfg.Client.SubmitHeartbeat(ctx, &machineidv1pb.SubmitHeartbeatRequest{
+	_, err = s.cfg.Client.SubmitHeartbeat(ctx, machineidv1pb.SubmitHeartbeatRequest_builder{
 		Heartbeat:     hb,
 		ServiceHealth: serviceHealth,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "submitting heartbeat")
 	}
@@ -254,29 +254,29 @@ func (s *Service) heartbeat(ctx context.Context, isOneShot, isStartup bool) erro
 }
 
 func statusToServiceHealth(name string, status *readyz.ServiceStatus) *machineidv1pb.BotInstanceServiceHealth {
-	health := &machineidv1pb.BotInstanceServiceHealth{
-		Service: &machineidv1pb.BotInstanceServiceIdentifier{
+	health := machineidv1pb.BotInstanceServiceHealth_builder{
+		Service: machineidv1pb.BotInstanceServiceIdentifier_builder{
 			Name: trimString(name, 64),
 			Type: status.ServiceType,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	switch status.Status {
 	case readyz.Initializing:
-		health.Status = machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING
+		health.SetStatus(machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_INITIALIZING)
 	case readyz.Healthy:
-		health.Status = machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY
+		health.SetStatus(machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY)
 	case readyz.Unhealthy:
-		health.Status = machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY
+		health.SetStatus(machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY)
 	}
 
 	if status.Reason != "" {
 		reason := trimString(status.Reason, 256)
-		health.Reason = &reason
+		health.SetReason(reason)
 	}
 
 	if status.UpdatedAt != nil {
-		health.UpdatedAt = timestamppb.New(*status.UpdatedAt)
+		health.SetUpdatedAt(timestamppb.New(*status.UpdatedAt))
 	}
 
 	return health
diff --git a/lib/tbot/internal/heartbeat/service_test.go b/lib/tbot/internal/heartbeat/service_test.go
index 505449ecd8e..c109d7bee63 100644
--- a/lib/tbot/internal/heartbeat/service_test.go
+++ b/lib/tbot/internal/heartbeat/service_test.go
@@ -106,8 +106,8 @@ func TestHeartbeatService(t *testing.T) {
 		svcA.ReportReason(readyz.Unhealthy, "no more bananas")
 		svcB.ReportReason(readyz.Unhealthy, strings.Repeat("b", 300))
 
-		want := &machineidv1pb.SubmitHeartbeatRequest{
-			Heartbeat: &machineidv1pb.BotInstanceStatusHeartbeat{
+		want := machineidv1pb.SubmitHeartbeatRequest_builder{
+			Heartbeat: machineidv1pb.BotInstanceStatusHeartbeat_builder{
 				Hostname:     hostName,
 				IsStartup:    true,
 				OneShot:      false,
@@ -117,37 +117,37 @@ func TestHeartbeatService(t *testing.T) {
 				Os:           runtime.GOOS,
 				JoinMethod:   string(types.JoinMethodGitHub),
 				Kind:         machineidv1pb.BotKind_BOT_KIND_TBOT,
-			},
+			}.Build(),
 			ServiceHealth: []*machineidv1pb.BotInstanceServiceHealth{
-				{
-					Service: &machineidv1pb.BotInstanceServiceIdentifier{
+				machineidv1pb.BotInstanceServiceHealth_builder{
+					Service: machineidv1pb.BotInstanceServiceIdentifier_builder{
 						Name: "a",
 						Type: "a",
-					},
+					}.Build(),
 					Reason:    ptr("no more bananas"),
 					Status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
 					UpdatedAt: timestamppb.New(time.Now()),
-				},
+				}.Build(),
 				// Check limits were applied on user-controlled or dynamic fields.
-				{
-					Service: &machineidv1pb.BotInstanceServiceIdentifier{
+				machineidv1pb.BotInstanceServiceHealth_builder{
+					Service: machineidv1pb.BotInstanceServiceIdentifier_builder{
 						Name: strings.Repeat("b", 64),
 						Type: "b",
-					},
+					}.Build(),
 					Reason:    ptr(strings.Repeat("b", 256)),
 					Status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_UNHEALTHY,
 					UpdatedAt: timestamppb.New(time.Now()),
-				},
-				{
-					Service: &machineidv1pb.BotInstanceServiceIdentifier{
+				}.Build(),
+				machineidv1pb.BotInstanceServiceHealth_builder{
+					Service: machineidv1pb.BotInstanceServiceIdentifier_builder{
 						Name: "heartbeat",
 						Type: "internal/heartbeat",
-					},
+					}.Build(),
 					Status:    machineidv1pb.BotInstanceHealthStatus_BOT_INSTANCE_HEALTH_STATUS_HEALTHY,
 					UpdatedAt: timestamppb.New(time.Now()),
-				},
+				}.Build(),
 			},
-		}
+		}.Build()
 
 		compare := func(t *testing.T, want, got *machineidv1pb.SubmitHeartbeatRequest) {
 			t.Helper()
@@ -173,8 +173,8 @@ func TestHeartbeatService(t *testing.T) {
 
 		select {
 		case got := <-fhs.ch:
-			want.Heartbeat.IsStartup = false
-			want.Heartbeat.Uptime = durationpb.New(time.Hour + time.Second)
+			want.GetHeartbeat().SetIsStartup(false)
+			want.GetHeartbeat().SetUptime(durationpb.New(time.Hour + time.Second))
 			compare(t, want, got)
 		default:
 			t.Fatal("no heartbeat received")
diff --git a/lib/tbot/internal/identity/service.go b/lib/tbot/internal/identity/service.go
index ca223dc19fe..172524a7adc 100644
--- a/lib/tbot/internal/identity/service.go
+++ b/lib/tbot/internal/identity/service.go
@@ -854,10 +854,10 @@ func botIdentityFromToken(
 // - Scoped, but tbot is not running in scoped mode.
 // - Unscoped, but tbot is running in scoped mode.
 func checkScopeCorrectness(tlsIdent *tlsca.Identity, scoped bool) (string, error) {
-	identScoped := tlsIdent.ScopePin != nil && tlsIdent.ScopePin.Scope != ""
+	identScoped := tlsIdent.ScopePin != nil && tlsIdent.ScopePin.GetScope() != ""
 	identScope := ""
 	if identScoped {
-		identScope = tlsIdent.ScopePin.Scope
+		identScope = tlsIdent.ScopePin.GetScope()
 	}
 	if identScoped && !scoped {
 		return identScope, trace.BadParameter(
diff --git a/lib/tbot/services/application/helpers_test.go b/lib/tbot/services/application/helpers_test.go
index 6ff86f79a38..7ef5f9b4f99 100644
--- a/lib/tbot/services/application/helpers_test.go
+++ b/lib/tbot/services/application/helpers_test.go
@@ -125,18 +125,18 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 	ctx := t.Context()
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -146,7 +146,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 	err = client.CreateToken(ctx, tok)
diff --git a/lib/tbot/services/awsra/helpers_test.go b/lib/tbot/services/awsra/helpers_test.go
index aebf7d7f2b7..af0f0586f9d 100644
--- a/lib/tbot/services/awsra/helpers_test.go
+++ b/lib/tbot/services/awsra/helpers_test.go
@@ -163,18 +163,18 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 	ctx := t.Context()
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -184,7 +184,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 	err = client.CreateToken(ctx, tok)
diff --git a/lib/tbot/services/awsra/service.go b/lib/tbot/services/awsra/service.go
index e960acdbf89..85983e3e705 100644
--- a/lib/tbot/services/awsra/service.go
+++ b/lib/tbot/services/awsra/service.go
@@ -239,8 +239,8 @@ func (s *Service) requestSVID(
 			received = append(received,
 				fmt.Sprintf(
 					"%s:%s",
-					cred.WorkloadIdentityName,
-					cred.SpiffeId,
+					cred.GetWorkloadIdentityName(),
+					cred.GetSpiffeId(),
 				),
 			)
 		}
diff --git a/lib/tbot/services/awsra/service_test.go b/lib/tbot/services/awsra/service_test.go
index 3151fabfb67..e86172f8cfb 100644
--- a/lib/tbot/services/awsra/service_test.go
+++ b/lib/tbot/services/awsra/service_test.go
@@ -294,25 +294,25 @@ func TestBotWorkloadIdentityAWSRA(t *testing.T) {
 			role, err = rootClient.UpsertRole(ctx, role)
 			require.NoError(t, err)
 
-			workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+			workloadIdentity := workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "foo-bar-bizz",
 					Labels: map[string]string{
 						"foo": "bar",
 					},
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/ra-test",
-					},
-				},
-			}
+					}.Build(),
+				}.Build(),
+			}.Build()
 			workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-				CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+				CreateWorkloadIdentity(ctx, workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
 					WorkloadIdentity: workloadIdentity,
-				})
+				}.Build())
 			require.NoError(t, err)
 
 			tmpDir := t.TempDir()
diff --git a/lib/tbot/services/beams/vnet_service.go b/lib/tbot/services/beams/vnet_service.go
index 9bc3c8316ef..b630c760d43 100644
--- a/lib/tbot/services/beams/vnet_service.go
+++ b/lib/tbot/services/beams/vnet_service.go
@@ -268,13 +268,13 @@ func (v *vnetApplicationService) getOSConfiguration(ctx context.Context) (*vnetO
 
 		return &vnetOSConfiguration{
 			pong: pong,
-			config: &vnetv1.TargetOSConfiguration{
+			config: vnetv1.TargetOSConfiguration_builder{
 				DnsZones: dnsZones,
 
 				// Note: we do not currently honor custom CIDR ranges, because cloud
 				// makes assumptions about the IPv4 address of the nameserver.
 				Ipv4CidrRanges: []string{typesvnet.DefaultIPv4CIDRRange},
-			},
+			}.Build(),
 		}, nil
 	}
 	return utils.FnCacheGet(ctx, v.cache, "", uncached)
@@ -304,7 +304,7 @@ func (v *vnetApplicationService) clusterAccess(osConfig *vnetOSConfiguration) (c
 		profile:  proxyAddr,
 		cluster:  osConfig.pong.GetClusterName(),
 		ipv4CIDR: cidrs[0],
-		dialOptions: &vnetv1.DialOptions{
+		dialOptions: vnetv1.DialOptions_builder{
 			WebProxyAddr: proxyAddr,
 			// ALPN Upgrade is not required in Teleport Cloud. We might need
 			// to reevaluate this if we support Beams on-premise (or not? we
@@ -312,7 +312,7 @@ func (v *vnetApplicationService) clusterAccess(osConfig *vnetOSConfiguration) (c
 			// configuration).
 			AlpnConnUpgradeRequired: false,
 			InsecureSkipVerify:      v.insecure,
-		},
+		}.Build(),
 	}, nil
 }
 
@@ -388,37 +388,33 @@ func (v *vnetApplicationService) ResolveFQDN(ctx context.Context, fqdn string) (
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	appInfo := &vnetv1.AppInfo{
-		AppKey: &vnetv1.AppKey{
+	appInfo := vnetv1.AppInfo_builder{
+		AppKey: vnetv1.AppKey_builder{
 			Profile: ca.profile,
 			Name:    app.GetName(),
-		},
+		}.Build(),
 		App:           app,
 		Ipv4CidrRange: ca.ipv4CIDR,
 		Cluster:       ca.cluster,
 		DialOptions:   ca.dialOptions,
-	}
+	}.Build()
 
 	switch {
 	case app.IsTCP():
-		return &vnetv1.ResolveFQDNResponse{
-			Match: &vnetv1.ResolveFQDNResponse_MatchedTcpApp{
-				MatchedTcpApp: &vnetv1.MatchedTCPApp{
-					AppInfo: appInfo,
-				},
-			},
-		}, nil
+		return vnetv1.ResolveFQDNResponse_builder{
+			MatchedTcpApp: vnetv1.MatchedTCPApp_builder{
+				AppInfo: appInfo,
+			}.Build(),
+		}.Build(), nil
 	case vnet.IsHTTPSTunnelApp(app):
 		// HTTP and LLM apps are tunneled via the HTTPS-in-mTLS ALPN protocol.
 		// Browser access via this tunnel is currently disabled on the web app
 		// handler, which should be fine for common use cases inside beams.
-		return &vnetv1.ResolveFQDNResponse{
-			Match: &vnetv1.ResolveFQDNResponse_MatchedHttpsTunnelApp{
-				MatchedHttpsTunnelApp: &vnetv1.MatchedHTTPSTunnelApp{
-					AppInfo: appInfo,
-				},
-			},
-		}, nil
+		return vnetv1.ResolveFQDNResponse_builder{
+			MatchedHttpsTunnelApp: vnetv1.MatchedHTTPSTunnelApp_builder{
+				AppInfo: appInfo,
+			}.Build(),
+		}.Build(), nil
 	default:
 		v.logger.DebugContext(ctx, "Application protocol not supported by VNet",
 			"fqdn", fqdn,
@@ -484,22 +480,20 @@ func (v *vnetApplicationService) resolveDatabaseFQDN(
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &vnetv1.ResolveFQDNResponse{
-		Match: &vnetv1.ResolveFQDNResponse_MatchedDatabase{
-			MatchedDatabase: &vnetv1.MatchedDatabase{
-				DatabaseInfo: &vnetv1.DatabaseInfo{
-					DatabaseKey: &vnetv1.DatabaseKey{
-						Profile: ca.profile,
-						Name:    dbResource.GetName(),
-					},
-					Cluster:       ca.cluster,
-					Protocol:      dbResource.GetProtocol(),
-					Ipv4CidrRange: ca.ipv4CIDR,
-					DialOptions:   ca.dialOptions,
-				},
-			},
-		},
-	}, nil
+	return vnetv1.ResolveFQDNResponse_builder{
+		MatchedDatabase: vnetv1.MatchedDatabase_builder{
+			DatabaseInfo: vnetv1.DatabaseInfo_builder{
+				DatabaseKey: vnetv1.DatabaseKey_builder{
+					Profile: ca.profile,
+					Name:    dbResource.GetName(),
+				}.Build(),
+				Cluster:       ca.cluster,
+				Protocol:      dbResource.GetProtocol(),
+				Ipv4CidrRange: ca.ipv4CIDR,
+				DialOptions:   ca.dialOptions,
+			}.Build(),
+		}.Build(),
+	}.Build(), nil
 }
 
 // GetDBCert issues a TLS certificate for the given database via tbot's
diff --git a/lib/tbot/services/beams/vnet_service_test.go b/lib/tbot/services/beams/vnet_service_test.go
index bb4cde08871..2e3001657cd 100644
--- a/lib/tbot/services/beams/vnet_service_test.go
+++ b/lib/tbot/services/beams/vnet_service_test.go
@@ -33,10 +33,11 @@ import (
 
 	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/gravitational/teleport"
-	proto "github.com/gravitational/teleport/api/client/proto"
+	clientproto "github.com/gravitational/teleport/api/client/proto"
 	delegationv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/delegation/v1"
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	machineidv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/machineid/v1"
@@ -123,18 +124,18 @@ func TestVNetService(t *testing.T) {
 
 	// Configure VNet to add a custom DNS zone.
 	_, err = rootClient.VnetConfigClient().
-		UpsertVnetConfig(t.Context(), &vnetv1.VnetConfig{
+		UpsertVnetConfig(t.Context(), vnetv1.VnetConfig_builder{
 			Kind:    types.KindVnetConfig,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: types.MetaNameVnetConfig,
-			},
-			Spec: &vnetv1.VnetConfigSpec{
+			}.Build(),
+			Spec: vnetv1.VnetConfigSpec_builder{
 				CustomDnsZones: []*vnetv1.CustomDNSZone{
-					{Suffix: "dunder-mifflin.com"},
+					vnetv1.CustomDNSZone_builder{Suffix: "dunder-mifflin.com"}.Build(),
 				},
-			},
-		})
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
 	// Create a user with access to all applications,
@@ -186,21 +187,21 @@ func TestVNetService(t *testing.T) {
 	// Create a delegation session for the user.
 	aliceClient := makeUserClient(t, process, rootClient, user.GetName())
 	session, err := aliceClient.DelegationSessionServiceClient().
-		CreateDelegationSession(t.Context(), &delegationv1.CreateDelegationSessionRequest{
-			Spec: &delegationv1.DelegationSessionSpec{
+		CreateDelegationSession(t.Context(), delegationv1.CreateDelegationSessionRequest_builder{
+			Spec: delegationv1.DelegationSessionSpec_builder{
 				User: user.GetName(),
 				Resources: []*delegationv1.DelegationResourceSpec{
-					{Kind: types.Wildcard, Name: types.Wildcard},
+					delegationv1.DelegationResourceSpec_builder{Kind: types.Wildcard, Name: types.Wildcard}.Build(),
 				},
 				AuthorizedUsers: []*delegationv1.DelegationUserSpec{
-					{
+					delegationv1.DelegationUserSpec_builder{
 						Kind:    types.KindBot,
-						Matcher: &delegationv1.DelegationUserSpec_BotName{BotName: "test-bot"},
-					},
+						BotName: proto.String("test-bot"),
+					}.Build(),
 				},
-			},
+			}.Build(),
 			Ttl: durationpb.New(5 * time.Minute),
-		})
+		}.Build())
 	require.NoError(t, err)
 
 	// Create a fake host network.
@@ -310,18 +311,18 @@ func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
 func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) onboarding.Config {
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(t.Context(), &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(t.Context(), machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -332,7 +333,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 
@@ -357,7 +358,7 @@ func makeUserClient(t *testing.T, process *service.TeleportProcess, rootClient *
 	tlsPublicKey, err := keys.MarshalPublicKey(tlsKey.Public())
 	require.NoError(t, err)
 
-	certs, err := rootClient.GenerateUserCerts(t.Context(), proto.UserCertsRequest{
+	certs, err := rootClient.GenerateUserCerts(t.Context(), clientproto.UserCertsRequest{
 		TLSPublicKey: tlsPublicKey,
 		Username:     username,
 		Expires:      time.Now().Add(time.Hour).UTC(),
diff --git a/lib/tbot/services/identity/helpers_test.go b/lib/tbot/services/identity/helpers_test.go
index e02b6c34f36..f029de57e54 100644
--- a/lib/tbot/services/identity/helpers_test.go
+++ b/lib/tbot/services/identity/helpers_test.go
@@ -140,18 +140,18 @@ func defaultTestServerOpts(log *slog.Logger) testenv.TestServerOptFunc {
 func makeBot(t *testing.T, client *authclient.Client, name string, roles ...string) onboarding.Config {
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(t.Context(), &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(t.Context(), machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -162,7 +162,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 
diff --git a/lib/tbot/services/k8s/helpers_test.go b/lib/tbot/services/k8s/helpers_test.go
index 750cf8c79b5..b9dcdf3561e 100644
--- a/lib/tbot/services/k8s/helpers_test.go
+++ b/lib/tbot/services/k8s/helpers_test.go
@@ -141,18 +141,18 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 	ctx := t.Context()
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -162,7 +162,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 	err = client.CreateToken(ctx, tok)
diff --git a/lib/tbot/services/ssh/host_output.go b/lib/tbot/services/ssh/host_output.go
index 04167983fdf..0e05f1b7866 100644
--- a/lib/tbot/services/ssh/host_output.go
+++ b/lib/tbot/services/ssh/host_output.go
@@ -154,7 +154,7 @@ func (s *HostOutputService) generate(ctx context.Context) error {
 	}
 	// For now, we'll reuse the bot's regular TTL, and hostID and nodeName are
 	// left unset.
-	res, err := impersonatedClient.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+	res, err := impersonatedClient.TrustClient().GenerateHostCert(ctx, trustpb.GenerateHostCertRequest_builder{
 		Key:         privKey.MarshalSSHPublicKey(),
 		HostId:      "",
 		NodeName:    "",
@@ -162,14 +162,14 @@ func (s *HostOutputService) generate(ctx context.Context) error {
 		ClusterName: clusterName,
 		Role:        string(types.RoleNode),
 		Ttl:         durationpb.New(cmp.Or(s.cfg.CredentialLifetime, s.defaultCredentialLifetime).TTL),
-	},
+	}.Build(),
 	)
 	if err != nil {
 		return trace.Wrap(err)
 	}
 	keyRing := &libclient.KeyRing{
 		SSHPrivateKey: privKey,
-		Cert:          res.SshCertificate,
+		Cert:          res.GetSshCertificate(),
 	}
 
 	cfg := identityfile.WriteConfig{
diff --git a/lib/tbot/services/workloadidentity/helpers_test.go b/lib/tbot/services/workloadidentity/helpers_test.go
index e8e7ba5fe0a..5644b2c9cdf 100644
--- a/lib/tbot/services/workloadidentity/helpers_test.go
+++ b/lib/tbot/services/workloadidentity/helpers_test.go
@@ -163,18 +163,18 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 	ctx := t.Context()
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -184,7 +184,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 	err = client.CreateToken(ctx, tok)
diff --git a/lib/tbot/services/workloadidentity/jwt_output.go b/lib/tbot/services/workloadidentity/jwt_output.go
index f639a42cdee..a63caaac4ca 100644
--- a/lib/tbot/services/workloadidentity/jwt_output.go
+++ b/lib/tbot/services/workloadidentity/jwt_output.go
@@ -222,8 +222,8 @@ func (s *JWTOutputService) requestJWTSVID(
 			received = append(received,
 				fmt.Sprintf(
 					"%s:%s",
-					cred.WorkloadIdentityName,
-					cred.SpiffeId,
+					cred.GetWorkloadIdentityName(),
+					cred.GetSpiffeId(),
 				),
 			)
 		}
diff --git a/lib/tbot/services/workloadidentity/jwt_output_test.go b/lib/tbot/services/workloadidentity/jwt_output_test.go
index cff91ddb239..e8534e4eb9a 100644
--- a/lib/tbot/services/workloadidentity/jwt_output_test.go
+++ b/lib/tbot/services/workloadidentity/jwt_output_test.go
@@ -71,25 +71,25 @@ func TestBotWorkloadIdentityJWT(t *testing.T) {
 	role, err = rootClient.UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+	workloadIdentity := workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "foo-bar-bizz",
 			Labels: map[string]string{
 				"foo": "bar",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/valid/{{ user.bot_name }}",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+		CreateWorkloadIdentity(ctx, workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
 			WorkloadIdentity: workloadIdentity,
-		})
+		}.Build())
 	require.NoError(t, err)
 
 	t.Run("By Name", func(t *testing.T) {
diff --git a/lib/tbot/services/workloadidentity/workload_api.go b/lib/tbot/services/workloadidentity/workload_api.go
index 0cf7ef3b8dd..ebeec6d7de8 100644
--- a/lib/tbot/services/workloadidentity/workload_api.go
+++ b/lib/tbot/services/workloadidentity/workload_api.go
@@ -537,12 +537,12 @@ func (s *WorkloadAPIService) fetchX509SVIDs(
 	for i, cred := range creds {
 		var svid bytes.Buffer
 		svid.Write(cred.GetX509Svid().GetCert())
-		for _, c := range cred.GetX509Svid().Chain {
+		for _, c := range cred.GetX509Svid().GetChain() {
 			svid.Write(c)
 		}
 		svids[i] = &workloadpb.X509SVID{
 			// Required. The SPIFFE ID of the SVID in this entry
-			SpiffeId: cred.SpiffeId,
+			SpiffeId: cred.GetSpiffeId(),
 			// Required. ASN.1 DER encoded certificate chain. MAY include
 			// intermediates, the leaf certificate (or SVID itself) MUST come first.
 			X509Svid: svid.Bytes(),
@@ -550,7 +550,7 @@ func (s *WorkloadAPIService) fetchX509SVIDs(
 			X509SvidKey: pkcs8PrivateKey,
 			// Required. ASN.1 DER encoded X.509 bundle for the trust domain.
 			Bundle: marshaledBundle,
-			Hint:   cred.Hint,
+			Hint:   cred.GetHint(),
 		}
 		// Log a message which correlates with the audit log entry and can
 		// provide additional metadata about the client.
@@ -558,13 +558,13 @@ func (s *WorkloadAPIService) fetchX509SVIDs(
 			"Issued Workload Identity Credential",
 			slog.Group("credential",
 				"type", "x509-svid",
-				"spiffe_id", cred.SpiffeId,
+				"spiffe_id", cred.GetSpiffeId(),
 				"serial_number", cred.GetX509Svid().GetSerialNumber(),
-				"hint", cred.Hint,
-				"expires_at", cred.ExpiresAt,
-				"ttl", cred.Ttl,
-				"workload_identity_name", cred.WorkloadIdentityName,
-				"workload_identity_revision", cred.WorkloadIdentityRevision,
+				"hint", cred.GetHint(),
+				"expires_at", cred.GetExpiresAt(),
+				"ttl", cred.GetTtl(),
+				"workload_identity_name", cred.GetWorkloadIdentityName(),
+				"workload_identity_revision", cred.GetWorkloadIdentityRevision(),
 			),
 		)
 	}
@@ -636,19 +636,19 @@ func (s *WorkloadAPIService) FetchJWTSVID(
 	svids := []*workloadpb.JWTSVID{}
 	for _, cred := range creds {
 		svids = append(svids, &workloadpb.JWTSVID{
-			SpiffeId: cred.SpiffeId,
+			SpiffeId: cred.GetSpiffeId(),
 			Svid:     cred.GetJwtSvid().GetJwt(),
-			Hint:     cred.Hint,
+			Hint:     cred.GetHint(),
 		})
 		log.InfoContext(ctx,
 			"Issued Workload Identity Credential",
 			slog.Group("credential",
 				"type", "jwt-svid",
-				"spiffe_id", cred.SpiffeId,
+				"spiffe_id", cred.GetSpiffeId(),
 				"jti", cred.GetJwtSvid().GetJti(),
-				"hint", cred.Hint,
-				"expires_at", cred.ExpiresAt,
-				"ttl", cred.Ttl,
+				"hint", cred.GetHint(),
+				"expires_at", cred.GetExpiresAt(),
+				"ttl", cred.GetTtl(),
 				"audiences", req.Audience,
 			),
 		)
diff --git a/lib/tbot/services/workloadidentity/workload_api_test.go b/lib/tbot/services/workloadidentity/workload_api_test.go
index 19fa40ebd33..c9b3ad6e0d8 100644
--- a/lib/tbot/services/workloadidentity/workload_api_test.go
+++ b/lib/tbot/services/workloadidentity/workload_api_test.go
@@ -85,25 +85,25 @@ func TestBotWorkloadIdentityAPI(t *testing.T) {
 	role, err = rootClient.UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+	workloadIdentity := workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "foo-bar-bizz",
 			Labels: map[string]string{
 				"foo": "bar",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/valid/{{ user.bot_name }}/{{ workload.unix.pid }}",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+		CreateWorkloadIdentity(ctx, workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
 			WorkloadIdentity: workloadIdentity,
-		})
+		}.Build())
 	require.NoError(t, err)
 
 	tmpDir := t.TempDir()
diff --git a/lib/tbot/services/workloadidentity/x509_output.go b/lib/tbot/services/workloadidentity/x509_output.go
index 4f165231fde..5c7ae657a5a 100644
--- a/lib/tbot/services/workloadidentity/x509_output.go
+++ b/lib/tbot/services/workloadidentity/x509_output.go
@@ -277,8 +277,8 @@ func (s *X509OutputService) requestSVID(
 			received = append(received,
 				fmt.Sprintf(
 					"%s:%s",
-					cred.WorkloadIdentityName,
-					cred.SpiffeId,
+					cred.GetWorkloadIdentityName(),
+					cred.GetSpiffeId(),
 				),
 			)
 		}
diff --git a/lib/tbot/services/workloadidentity/x509_output_test.go b/lib/tbot/services/workloadidentity/x509_output_test.go
index 0964cfba146..d9317f54629 100644
--- a/lib/tbot/services/workloadidentity/x509_output_test.go
+++ b/lib/tbot/services/workloadidentity/x509_output_test.go
@@ -83,25 +83,25 @@ func TestBotWorkloadIdentityX509(t *testing.T) {
 	role, err = rootClient.UpsertRole(ctx, role)
 	require.NoError(t, err)
 
-	workloadIdentity := &workloadidentityv1pb.WorkloadIdentity{
+	workloadIdentity := workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "foo-bar-bizz",
 			Labels: map[string]string{
 				"foo": "bar",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id: "/valid/{{ user.bot_name }}",
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 	workloadIdentity, err = rootClient.WorkloadIdentityResourceServiceClient().
-		CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+		CreateWorkloadIdentity(ctx, workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
 			WorkloadIdentity: workloadIdentity,
-		})
+		}.Build())
 	require.NoError(t, err)
 
 	checkCRL := func(t *testing.T, tmpDir string, bundle *x509bundle.Bundle) {
@@ -257,11 +257,9 @@ func TestX509OutputService_render_TrustDomains(t *testing.T) {
 	))
 	appClientBundle.AddX509Authority(cert)
 
-	x509Cred := &workloadidentityv1pb.Credential{
-		Credential: &workloadidentityv1pb.Credential_X509Svid{
-			X509Svid: &workloadidentityv1pb.X509SVIDCredential{Cert: cert.Raw},
-		},
-	}
+	x509Cred := workloadidentityv1pb.Credential_builder{
+		X509Svid: workloadidentityv1pb.X509SVIDCredential_builder{Cert: cert.Raw}.Build(),
+	}.Build()
 
 	newService := func(dest destination.Destination) *X509OutputService {
 		return &X509OutputService{
diff --git a/lib/tbot/tbot_test.go b/lib/tbot/tbot_test.go
index 144418d5d60..533fb11c858 100644
--- a/lib/tbot/tbot_test.go
+++ b/lib/tbot/tbot_test.go
@@ -153,18 +153,18 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 	ctx := t.Context()
 	t.Helper()
 
-	b, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	b, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: name,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: roles,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	tokenName, err := utils.CryptoRandomHex(defaults.TokenLenBytes)
@@ -174,7 +174,7 @@ func makeBot(t *testing.T, client *authclient.Client, name string, roles ...stri
 		time.Now().Add(10*time.Minute),
 		types.ProvisionTokenSpecV2{
 			Roles:   []types.SystemRole{types.RoleBot},
-			BotName: b.Metadata.Name,
+			BotName: b.GetMetadata().GetName(),
 		})
 	require.NoError(t, err)
 	err = client.CreateToken(ctx, tok)
@@ -442,7 +442,7 @@ func TestBot(t *testing.T) {
 		require.True(t, tlsIdent.Renewable)
 		require.False(t, tlsIdent.DisallowReissue)
 		require.Equal(t, uint64(1), tlsIdent.Generation)
-		require.ElementsMatch(t, []string{botResource.Status.RoleName}, tlsIdent.Groups)
+		require.ElementsMatch(t, []string{botResource.GetStatus().GetRoleName()}, tlsIdent.Groups)
 		// testenv cluster uses balanced-v1 suite, sanity check we generated an
 		// ECDSA key.
 		require.IsType(t, &ecdsa.PublicKey{}, botIdent.PrivateKey.Public())
@@ -451,28 +451,28 @@ func TestBot(t *testing.T) {
 	t.Run("output: identity", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, identityOutput.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, false,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), false,
 		)
 	})
 
 	t.Run("output: identity with role specified", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, identityOutputWithRoles.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, []string{mainRole}, botResource.Status.UserName, false,
+			t, tlsIdent, []string{mainRole}, botResource.GetStatus().GetUserName(), false,
 		)
 	})
 
 	t.Run("output: identity with allow reissue", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, identityOutputWithReissue.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, true,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), true,
 		)
 	})
 
 	t.Run("output: kubernetes", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, kubeOutput.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, false,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), false,
 		)
 		require.Equal(t, kubeClusterName, tlsIdent.KubernetesCluster)
 		require.Equal(t, kubeGroups, tlsIdent.KubernetesGroups)
@@ -482,7 +482,7 @@ func TestBot(t *testing.T) {
 	t.Run("output: kubernetes discovered name", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, kubeDiscoveredNameOutput.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, false,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), false,
 		)
 		require.Equal(t, kubeClusterName, tlsIdent.KubernetesCluster)
 		require.Equal(t, kubeGroups, tlsIdent.KubernetesGroups)
@@ -492,7 +492,7 @@ func TestBot(t *testing.T) {
 	t.Run("output: application", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, appOutput.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, false,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), false,
 		)
 		route := tlsIdent.RouteToApp
 		require.Equal(t, appName, route.Name)
@@ -503,7 +503,7 @@ func TestBot(t *testing.T) {
 	t.Run("output: database", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, dbOutput.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, false,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), false,
 		)
 		route := tlsIdent.RouteToDatabase
 		require.Equal(t, databaseServiceName, route.ServiceName)
@@ -521,7 +521,7 @@ func TestBot(t *testing.T) {
 	t.Run("output: database discovered name", func(t *testing.T) {
 		tlsIdent := tlsIdentFromDest(ctx, t, dbDiscoveredNameOutput.GetDestination())
 		requireValidOutputTLSIdent(
-			t, tlsIdent, defaultRoles, botResource.Status.UserName, false,
+			t, tlsIdent, defaultRoles, botResource.GetStatus().GetUserName(), false,
 		)
 		route := tlsIdent.RouteToDatabase
 		require.Equal(t, databaseServiceName, route.ServiceName)
@@ -1440,28 +1440,28 @@ func TestScopedBotSSH(t *testing.T) {
 
 	// Create a scoped role that grants SSH access.
 	scopedSvc := rootClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: scopedRoleName,
-			},
+			}.Build(),
 			Scope: scopeName,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{scopeName},
-				Ssh: &scopedaccessv1.ScopedRoleSSH{
+				Ssh: scopedaccessv1.ScopedRoleSSH_builder{
 					Logins: []string{currentUser.Username},
 					Labels: []*labelv1.Label{
-						{
+						labelv1.Label_builder{
 							Name:   "*",
 							Values: []string{"*"},
-						},
+						}.Build(),
 					},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	botOnboarding := createScopedBot(t, process, rootClient, botName, scopeName, scopedRoleName)
@@ -1473,8 +1473,8 @@ func TestScopedBotSSH(t *testing.T) {
 	nodeCfg.ScopesFeatures = scopes.Features{Enabled: true}
 	nodeCfg.Hostname = nodeHostname
 	nodeCfg.DataDir = t.TempDir()
-	nodeCfg.SetToken(nodeTokenResp.Token.Metadata.Name)
-	nodeCfg.SetTokenSecret(nodeTokenResp.Token.Status.Secret)
+	nodeCfg.SetToken(nodeTokenResp.GetToken().GetMetadata().GetName())
+	nodeCfg.SetTokenSecret(nodeTokenResp.GetToken().GetStatus().GetSecret())
 	nodeCfg.SetAuthServerAddress(process.Config.Auth.ListenAddr)
 	nodeCfg.Auth.Enabled = false
 	nodeCfg.Proxy.Enabled = false
@@ -1532,13 +1532,13 @@ func TestScopedBotSSH(t *testing.T) {
 	require.NoError(t, b.Run(ctx))
 
 	t.Run("identity certificates have scope pins", func(t *testing.T) {
-		expectedPin := &scopesv1.Pin{
+		expectedPin := scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: scopeName,
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				scopeName: {scopeName: {scopedRoleName}},
 			}),
-		}
+		}.Build()
 
 		// Check TLS certificate.
 		tlsIdent := tlsIdentFromDest(ctx, t, identityOutput.GetDestination())
@@ -1688,25 +1688,25 @@ func TestScopedBotKubernetes(t *testing.T) {
 
 	// Create a scoped role that grants kube access (all clusters, system:masters).
 	scopedSvc := rootClient.ScopedAccessServiceClient()
-	_, err = scopedSvc.CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
-		Role: &scopedaccessv1.ScopedRole{
+	_, err = scopedSvc.CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
+		Role: scopedaccessv1.ScopedRole_builder{
 			Kind:    scopedaccess.KindScopedRole,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: scopedRoleName,
-			},
+			}.Build(),
 			Scope: scopeName,
-			Spec: &scopedaccessv1.ScopedRoleSpec{
+			Spec: scopedaccessv1.ScopedRoleSpec_builder{
 				AssignableScopes: []string{scopeName},
-				Kube: &scopedaccessv1.ScopedRoleKube{
+				Kube: scopedaccessv1.ScopedRoleKube_builder{
 					Labels: []*labelv1.Label{
-						{Name: "*", Values: []string{"*"}},
+						labelv1.Label_builder{Name: "*", Values: []string{"*"}}.Build(),
 					},
 					Groups: []string{"system:masters"},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	botOnboarding := createScopedBot(t, process, rootClient, botName, scopeName, scopedRoleName)
@@ -1743,8 +1743,8 @@ func TestScopedBotKubernetes(t *testing.T) {
 	kubeNodeCfg := servicecfg.MakeDefaultConfig()
 	kubeNodeCfg.ScopesFeatures = scopes.Features{Enabled: true}
 	kubeNodeCfg.DataDir = t.TempDir()
-	kubeNodeCfg.SetToken(kubeTokenResp.Token.Metadata.Name)
-	kubeNodeCfg.SetTokenSecret(kubeTokenResp.Token.Status.Secret)
+	kubeNodeCfg.SetToken(kubeTokenResp.GetToken().GetMetadata().GetName())
+	kubeNodeCfg.SetTokenSecret(kubeTokenResp.GetToken().GetStatus().GetSecret())
 	kubeNodeCfg.SetAuthServerAddress(process.Config.Auth.ListenAddr)
 	kubeNodeCfg.Auth.Enabled = false
 	kubeNodeCfg.Proxy.Enabled = false
@@ -1804,13 +1804,13 @@ func TestScopedBotKubernetes(t *testing.T) {
 	require.NoError(t, b.Run(ctx))
 
 	t.Run("identity certificate has scope pins", func(t *testing.T) {
-		expectedPin := &scopesv1.Pin{
+		expectedPin := scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: scopeName,
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				scopeName: {scopeName: {scopedRoleName}},
 			}),
-		}
+		}.Build()
 
 		tlsIdent := tlsIdentFromDest(ctx, t, kubeOutput.GetDestination())
 		require.NotNil(t, tlsIdent.ScopePin, "TLS identity should have a scope pin")
@@ -1863,10 +1863,10 @@ func waitForSRACache(t *testing.T, authServer *auth.Server, resps ...*scopedacce
 	ctx := t.Context()
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		for _, resp := range resps {
-			_, err := authServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+			_, err := authServer.ScopedAccessCache.GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 				Name:    resp.GetAssignment().GetMetadata().GetName(),
 				SubKind: resp.GetAssignment().GetSubKind(),
-			})
+			}.Build())
 			require.NoError(t, err)
 		}
 	}, 10*time.Second, 100*time.Millisecond)
@@ -1886,13 +1886,13 @@ func createScopedBot(
 	t.Helper()
 	ctx := t.Context()
 
-	_, err := rootClient.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
-			Metadata: &headerv1.Metadata{Name: botName},
+	_, err := rootClient.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
+			Metadata: headerv1.Metadata_builder{Name: botName}.Build(),
 			Scope:    scopeName,
 			Spec:     &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	botKey, err := cryptosuites.GeneratePrivateKeyWithAlgorithm(cryptosuites.ECDSAP256)
@@ -1901,60 +1901,58 @@ func createScopedBot(
 	botKeyPath := filepath.Join(t.TempDir(), "bot_key.pem")
 	require.NoError(t, os.WriteFile(botKeyPath, botKey.PrivateKeyPEM(), 0600))
 
-	botTokenResp, err := process.GetAuthServer().ScopedTokenService.CreateScopedToken(ctx, &joiningv1.CreateScopedTokenRequest{
-		Token: &joiningv1.ScopedToken{
+	botTokenResp, err := process.GetAuthServer().ScopedTokenService.CreateScopedToken(ctx, joiningv1.CreateScopedTokenRequest_builder{
+		Token: joiningv1.ScopedToken_builder{
 			Kind:     types.KindScopedToken,
 			Version:  types.V1,
-			Metadata: &headerv1.Metadata{Name: botName + "-token"},
+			Metadata: headerv1.Metadata_builder{Name: botName + "-token"}.Build(),
 			Scope:    scopeName,
-			Spec: &joiningv1.ScopedTokenSpec{
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				Roles:      []string{types.RoleBot.String()},
 				JoinMethod: string(types.JoinMethodBoundKeypair),
 				UsageMode:  jointoken.TokenUsageModeBot,
 				BotName:    botName,
 				BotScope:   scopeName,
-				BoundKeypair: &joiningv1.BoundKeypairSpec{
-					Onboarding: &joiningv1.BoundKeypairSpec_OnboardingSpec{
+				BoundKeypair: joiningv1.BoundKeypairSpec_builder{
+					Onboarding: joiningv1.BoundKeypairSpec_OnboardingSpec_builder{
 						InitialPublicKey: botPublicKey,
-					},
-					Recovery: &joiningv1.BoundKeypairSpec_RecoverySpec{
+					}.Build(),
+					Recovery: joiningv1.BoundKeypairSpec_RecoverySpec_builder{
 						Limit: 10,
 						Mode:  "insecure",
-					},
-				},
-			},
-			Status: &joiningv1.ScopedTokenStatus{
-				Usage: &joiningv1.UsageStatus{
-					Status: &joiningv1.UsageStatus_BoundKeypair{
-						BoundKeypair: &joiningv1.BoundKeypairStatus{},
-					},
-				},
-			},
-		},
-	})
+					}.Build(),
+				}.Build(),
+			}.Build(),
+			Status: joiningv1.ScopedTokenStatus_builder{
+				Usage: joiningv1.UsageStatus_builder{
+					BoundKeypair: &joiningv1.BoundKeypairStatus{},
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	sraResp, err := rootClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
-		Assignment: &scopedaccessv1.ScopedRoleAssignment{
+	sraResp, err := rootClient.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
+		Assignment: scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:     scopedaccess.KindScopedRoleAssignment,
 			Version:  types.V1,
 			SubKind:  scopedaccess.SubKindDynamic,
-			Metadata: &headerv1.Metadata{Name: uuid.NewString()},
+			Metadata: headerv1.Metadata_builder{Name: uuid.NewString()}.Build(),
 			Scope:    scopeName,
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				BotName:  botName,
 				BotScope: scopeName,
 				Assignments: []*scopedaccessv1.Assignment{
-					{Role: scopedRoleName, Scope: scopeName},
+					scopedaccessv1.Assignment_builder{Role: scopedRoleName, Scope: scopeName}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	waitForSRACache(t, process.GetAuthServer(), sraResp)
 
 	return &onboarding.Config{
-		TokenValue: botTokenResp.Token.Metadata.Name,
+		TokenValue: botTokenResp.GetToken().GetMetadata().GetName(),
 		JoinMethod: types.JoinMethodBoundKeypair,
 		BoundKeypair: onboarding.BoundKeypairOnboardingConfig{
 			StaticPrivateKeyPath: botKeyPath,
@@ -1972,20 +1970,20 @@ func createScopedJoinToken(
 	role types.SystemRole,
 ) *joiningv1.CreateScopedTokenResponse {
 	t.Helper()
-	resp, err := process.GetAuthServer().ScopedTokenService.CreateScopedToken(t.Context(), &joiningv1.CreateScopedTokenRequest{
-		Token: &joiningv1.ScopedToken{
+	resp, err := process.GetAuthServer().ScopedTokenService.CreateScopedToken(t.Context(), joiningv1.CreateScopedTokenRequest_builder{
+		Token: joiningv1.ScopedToken_builder{
 			Kind:     types.KindScopedToken,
 			Version:  types.V1,
-			Metadata: &headerv1.Metadata{Name: name},
+			Metadata: headerv1.Metadata_builder{Name: name}.Build(),
 			Scope:    scopeName,
-			Spec: &joiningv1.ScopedTokenSpec{
+			Spec: joiningv1.ScopedTokenSpec_builder{
 				AssignedScope: scopeName,
 				Roles:         []string{role.String()},
 				JoinMethod:    string(types.JoinMethodToken),
 				UsageMode:     string(jointoken.TokenUsageModeUnlimited),
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return resp
 }
diff --git a/lib/tbot/workloadidentity/attrs/workload_attrs.go b/lib/tbot/workloadidentity/attrs/workload_attrs.go
index ef0793c8603..b593210a259 100644
--- a/lib/tbot/workloadidentity/attrs/workload_attrs.go
+++ b/lib/tbot/workloadidentity/attrs/workload_attrs.go
@@ -60,7 +60,7 @@ func (a *WorkloadAttrs) LogValue() slog.Value {
 	// TODO: we should find a better way to encode workload attributes in logs
 	// than prototext which, apart from anything, injects random whitespace.
 	clone := proto.Clone(a.WorkloadAttrs).(*workloadidentityv1.WorkloadAttrs)
-	clone.Sigstore = nil
+	clone.ClearSigstore()
 
 	output := clone.String()
 	if l := len(a.WorkloadAttrs.GetSigstore().GetPayloads()); l != 0 {
diff --git a/lib/tbot/workloadidentity/attrs/workload_attrs_test.go b/lib/tbot/workloadidentity/attrs/workload_attrs_test.go
index b86aa5c7d82..88dbf582652 100644
--- a/lib/tbot/workloadidentity/attrs/workload_attrs_test.go
+++ b/lib/tbot/workloadidentity/attrs/workload_attrs_test.go
@@ -27,17 +27,17 @@ import (
 )
 
 func TestWorkloadAttrs(t *testing.T) {
-	attrs := attrs.FromWorkloadAttrs(&workloadidentityv1.WorkloadAttrs{
-		Podman: &workloadidentityv1.WorkloadAttrsPodman{
+	attrs := attrs.FromWorkloadAttrs(workloadidentityv1.WorkloadAttrs_builder{
+		Podman: workloadidentityv1.WorkloadAttrsPodman_builder{
 			Attested: true,
-		},
-		Sigstore: &workloadidentityv1.WorkloadAttrsSigstore{
+		}.Build(),
+		Sigstore: workloadidentityv1.WorkloadAttrsSigstore_builder{
 			Payloads: []*workloadidentityv1.SigstoreVerificationPayload{
-				{Bundle: []byte(`BUNDLE`)},
-				{Bundle: []byte(`BUNDLE`)},
+				workloadidentityv1.SigstoreVerificationPayload_builder{Bundle: []byte(`BUNDLE`)}.Build(),
+				workloadidentityv1.SigstoreVerificationPayload_builder{Bundle: []byte(`BUNDLE`)}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 
 	output := attrs.LogValue().String()
 	require.Contains(t, output, "sigstore:{payloads:{count:2}}")
diff --git a/lib/tbot/workloadidentity/crl_cache.go b/lib/tbot/workloadidentity/crl_cache.go
index c8bcd22d509..8c418181ddf 100644
--- a/lib/tbot/workloadidentity/crl_cache.go
+++ b/lib/tbot/workloadidentity/crl_cache.go
@@ -236,7 +236,7 @@ func (m *CRLCache) watch(ctx context.Context) error {
 			return trace.Wrap(err, "receiving CRL stream data")
 		}
 		m.setCRLSet(ctx, &CRLSet{
-			LocalCRL: res.Crl,
+			LocalCRL: res.GetCrl(),
 		})
 	}
 }
@@ -320,6 +320,6 @@ func FetchCRLSet(
 	}
 
 	return &CRLSet{
-		LocalCRL: res.Crl,
+		LocalCRL: res.GetCrl(),
 	}, nil
 }
diff --git a/lib/tbot/workloadidentity/issue.go b/lib/tbot/workloadidentity/issue.go
index 8a877ca8b14..8a20c258f56 100644
--- a/lib/tbot/workloadidentity/issue.go
+++ b/lib/tbot/workloadidentity/issue.go
@@ -41,18 +41,18 @@ func WorkloadIdentityLogValue(credential *workloadidentityv1pb.Credential) slog.
 		slog.String("spiffe_id", credential.GetSpiffeId()),
 		slog.String("serial_number", credential.GetX509Svid().GetSerialNumber()),
 	}
-	switch v := credential.GetCredential().(type) {
-	case *workloadidentityv1pb.Credential_X509Svid:
+	switch credential.WhichCredential() {
+	case workloadidentityv1pb.Credential_X509Svid_case:
 		attrs = append(
 			attrs,
 			slog.String("type", "x509"),
-			slog.String("serial_number", v.X509Svid.GetSerialNumber()),
+			slog.String("serial_number", credential.GetX509Svid().GetSerialNumber()),
 		)
-	case *workloadidentityv1pb.Credential_JwtSvid:
+	case workloadidentityv1pb.Credential_JwtSvid_case:
 		attrs = append(
 			attrs,
 			slog.String("type", "jwt"),
-			slog.String("jti", v.JwtSvid.GetJti()),
+			slog.String("jti", credential.GetJwtSvid().GetJti()),
 		)
 	}
 	return slog.GroupValue(attrs...)
@@ -110,17 +110,15 @@ func IssueX509WorkloadIdentity(
 		// When using the "name" based selector, we either get a single WIC back,
 		// or an error. We don't need to worry about selecting the right one.
 		res, err := clt.WorkloadIdentityIssuanceClient().IssueWorkloadIdentity(ctx,
-			&workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: workloadIdentity.Name,
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey:          pubBytes,
-						UseIssuerOverrides: true,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey:          pubBytes,
+					UseIssuerOverrides: true,
+				}.Build(),
 				RequestedTtl:  durationpb.New(ttl),
 				WorkloadAttrs: attest.GetAttrs(),
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
@@ -128,9 +126,9 @@ func IssueX509WorkloadIdentity(
 		log.DebugContext(
 			ctx,
 			"Received X509 workload identity credential",
-			"credential", WorkloadIdentityLogValue(res.Credential),
+			"credential", WorkloadIdentityLogValue(res.GetCredential()),
 		)
-		return []*workloadidentityv1pb.Credential{res.Credential}, privateKey, nil
+		return []*workloadidentityv1pb.Credential{res.GetCredential()}, privateKey, nil
 	case len(workloadIdentity.Labels) > 0:
 		labelSelectors := labelsToSelectors(workloadIdentity.Labels)
 		log.DebugContext(
@@ -139,17 +137,15 @@ func IssueX509WorkloadIdentity(
 			"labels", labelSelectors,
 		)
 		res, err := clt.WorkloadIdentityIssuanceClient().IssueWorkloadIdentities(ctx,
-			&workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: labelSelectors,
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_X509SvidParams{
-					X509SvidParams: &workloadidentityv1pb.X509SVIDParams{
-						PublicKey:          pubBytes,
-						UseIssuerOverrides: true,
-					},
-				},
+				X509SvidParams: workloadidentityv1pb.X509SVIDParams_builder{
+					PublicKey:          pubBytes,
+					UseIssuerOverrides: true,
+				}.Build(),
 				RequestedTtl:  durationpb.New(ttl),
 				WorkloadAttrs: attest.GetAttrs(),
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, nil, trace.Wrap(err)
@@ -157,9 +153,9 @@ func IssueX509WorkloadIdentity(
 		log.DebugContext(
 			ctx,
 			"Received X509 workload identity credentials",
-			"credentials", WorkloadIdentitiesLogValue(res.Credentials),
+			"credentials", WorkloadIdentitiesLogValue(res.GetCredentials()),
 		)
-		return res.Credentials, privateKey, nil
+		return res.GetCredentials(), privateKey, nil
 	default:
 		return nil, nil, trace.BadParameter("no valid selector configured")
 	}
@@ -168,10 +164,10 @@ func IssueX509WorkloadIdentity(
 func labelsToSelectors(in map[string][]string) []*workloadidentityv1pb.LabelSelector {
 	selectors := make([]*workloadidentityv1pb.LabelSelector, 0, len(in))
 	for k, v := range in {
-		selectors = append(selectors, &workloadidentityv1pb.LabelSelector{
+		selectors = append(selectors, workloadidentityv1pb.LabelSelector_builder{
 			Key:    k,
 			Values: v,
-		})
+		}.Build())
 	}
 	return selectors
 }
@@ -207,16 +203,14 @@ func IssueJWTWorkloadIdentity(
 		// When using the "name" based selector, we either get a single WIC back,
 		// or an error. We don't need to worry about selecting the right one.
 		res, err := clt.WorkloadIdentityIssuanceClient().IssueWorkloadIdentity(ctx,
-			&workloadidentityv1pb.IssueWorkloadIdentityRequest{
+			workloadidentityv1pb.IssueWorkloadIdentityRequest_builder{
 				Name: workloadIdentity.Name,
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentityRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: audiences,
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: audiences,
+				}.Build(),
 				RequestedTtl:  durationpb.New(ttl),
 				WorkloadAttrs: attest.GetAttrs(),
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -224,9 +218,9 @@ func IssueJWTWorkloadIdentity(
 		log.DebugContext(
 			ctx,
 			"Received JWT workload identity credential",
-			"credential", WorkloadIdentityLogValue(res.Credential),
+			"credential", WorkloadIdentityLogValue(res.GetCredential()),
 		)
-		return []*workloadidentityv1pb.Credential{res.Credential}, nil
+		return []*workloadidentityv1pb.Credential{res.GetCredential()}, nil
 	case len(workloadIdentity.Labels) > 0:
 		labelSelectors := labelsToSelectors(workloadIdentity.Labels)
 		log.DebugContext(
@@ -235,16 +229,14 @@ func IssueJWTWorkloadIdentity(
 			"labels", labelSelectors,
 		)
 		res, err := clt.WorkloadIdentityIssuanceClient().IssueWorkloadIdentities(ctx,
-			&workloadidentityv1pb.IssueWorkloadIdentitiesRequest{
+			workloadidentityv1pb.IssueWorkloadIdentitiesRequest_builder{
 				LabelSelectors: labelSelectors,
-				Credential: &workloadidentityv1pb.IssueWorkloadIdentitiesRequest_JwtSvidParams{
-					JwtSvidParams: &workloadidentityv1pb.JWTSVIDParams{
-						Audiences: audiences,
-					},
-				},
+				JwtSvidParams: workloadidentityv1pb.JWTSVIDParams_builder{
+					Audiences: audiences,
+				}.Build(),
 				RequestedTtl:  durationpb.New(ttl),
 				WorkloadAttrs: attest.GetAttrs(),
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -252,9 +244,9 @@ func IssueJWTWorkloadIdentity(
 		log.DebugContext(
 			ctx,
 			"Received JWT workload identity credentials",
-			"credentials", WorkloadIdentitiesLogValue(res.Credentials),
+			"credentials", WorkloadIdentitiesLogValue(res.GetCredentials()),
 		)
-		return res.Credentials, nil
+		return res.GetCredentials(), nil
 	default:
 		return nil, trace.BadParameter("no valid selector configured")
 	}
diff --git a/lib/tbot/workloadidentity/trust_bundle_cache.go b/lib/tbot/workloadidentity/trust_bundle_cache.go
index 1d877d470d2..73fda3ff3a9 100644
--- a/lib/tbot/workloadidentity/trust_bundle_cache.go
+++ b/lib/tbot/workloadidentity/trust_bundle_cache.go
@@ -743,7 +743,7 @@ func (m *TrustBundleCache) processEvent(ctx context.Context, event types.Event)
 				return
 			}
 
-			if existingBundle, ok := bundleSet.Federated[federation.Metadata.Name]; ok && existingBundle.Equal(bundle) {
+			if existingBundle, ok := bundleSet.Federated[federation.GetMetadata().GetName()]; ok && existingBundle.Equal(bundle) {
 				log.DebugContext(
 					ctx,
 					"Event resulted in no change to federated trust bundle, ignoring",
@@ -755,7 +755,7 @@ func (m *TrustBundleCache) processEvent(ctx context.Context, event types.Event)
 				"Processed update for federated trust bundle",
 				"x509_authorities", len(bundle.X509Authorities()),
 			)
-			bundleSet.Federated[federation.Metadata.Name] = bundle
+			bundleSet.Federated[federation.GetMetadata().GetName()] = bundle
 			m.setBundleSet(bundleSet)
 		}
 	default:
@@ -783,11 +783,11 @@ func FetchInitialBundleSet(
 	bs := &BundleSet{
 		Federated: make(map[string]*spiffebundle.Bundle),
 	}
-	spiffeCA, err := trustClient.GetCertAuthority(ctx, &trustv1.GetCertAuthorityRequest{
+	spiffeCA, err := trustClient.GetCertAuthority(ctx, trustv1.GetCertAuthorityRequest_builder{
 		Type:       string(types.SPIFFECA),
 		Domain:     clusterName,
 		IncludeKey: false,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "fetching spiffe CA")
 	}
@@ -796,11 +796,11 @@ func FetchInitialBundleSet(
 		return nil, trace.Wrap(err, "converting SPIFFE CA to trust bundle")
 	}
 
-	appClientCA, err := trustClient.GetCertAuthority(ctx, &trustv1.GetCertAuthorityRequest{
+	appClientCA, err := trustClient.GetCertAuthority(ctx, trustv1.GetCertAuthorityRequest_builder{
 		Type:       string(types.AppClientCA),
 		Domain:     clusterName,
 		IncludeKey: false,
-	})
+	}.Build())
 	switch {
 	case types.IsUnsupportedAuthorityErr(err) || trace.IsNotFound(err):
 		log.InfoContext(ctx, "AppClient CA not found, it won't be included into the trust bundle if necessary")
@@ -826,12 +826,12 @@ func FetchInitialBundleSet(
 				log.WarnContext(
 					ctx,
 					"Failed to convert SPIFFEFederation to trust bundle, it may not be ready yet",
-					"trust_domain", federation.GetMetadata().Name,
+					"trust_domain", federation.GetMetadata().GetName(),
 					"error", err,
 				)
 				continue
 			}
-			bs.Federated[federation.Metadata.Name] = bundle
+			bs.Federated[federation.GetMetadata().GetName()] = bundle
 		}
 	}
 
@@ -845,18 +845,18 @@ func listAllSPIFFEFederations(
 	var spiffeFeds []*machineidv1pb.SPIFFEFederation
 	var token string
 	for {
-		res, err := client.ListSPIFFEFederations(ctx, &machineidv1pb.ListSPIFFEFederationsRequest{
+		res, err := client.ListSPIFFEFederations(ctx, machineidv1pb.ListSPIFFEFederationsRequest_builder{
 			PageSize:  100,
 			PageToken: token,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err, "listing SPIFFEFederations")
 		}
-		spiffeFeds = append(spiffeFeds, res.SpiffeFederations...)
-		if res.NextPageToken == "" {
+		spiffeFeds = append(spiffeFeds, res.GetSpiffeFederations()...)
+		if res.GetNextPageToken() == "" {
 			break
 		}
-		token = res.NextPageToken
+		token = res.GetNextPageToken()
 	}
 	return spiffeFeds, nil
 }
@@ -904,19 +904,19 @@ func convertCAToBundle(ca types.CertAuthority) (*spiffebundle.Bundle, error) {
 func convertSPIFFEFederationToBundle(
 	federation *machineidv1pb.SPIFFEFederation,
 ) (*spiffebundle.Bundle, error) {
-	if federation.Status == nil {
+	if !federation.HasStatus() {
 		return nil, trace.BadParameter("federation missing status")
 	}
-	if federation.Status.CurrentBundle == "" {
+	if federation.GetStatus().GetCurrentBundle() == "" {
 		return nil, trace.BadParameter("federation missing status.current_bundle")
 	}
 
-	td, err := spiffeid.TrustDomainFromString(federation.Metadata.Name)
+	td, err := spiffeid.TrustDomainFromString(federation.GetMetadata().GetName())
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing trust domain name")
 	}
 
-	bundle, err := spiffebundle.Parse(td, []byte(federation.Status.CurrentBundle))
+	bundle, err := spiffebundle.Parse(td, []byte(federation.GetStatus().GetCurrentBundle()))
 	if err != nil {
 		return nil, trace.Wrap(err, "parsing bundle")
 	}
diff --git a/lib/tbot/workloadidentity/trust_bundle_cache_test.go b/lib/tbot/workloadidentity/trust_bundle_cache_test.go
index b00eec66e43..5129db9e82d 100644
--- a/lib/tbot/workloadidentity/trust_bundle_cache_test.go
+++ b/lib/tbot/workloadidentity/trust_bundle_cache_test.go
@@ -619,14 +619,14 @@ func TestTrustBundleCache_Run(t *testing.T) {
 	require.NoError(t, err)
 	mockFederationClient := &mockFederationClient{
 		t: t,
-		spiffeFed: &machineidv1pb.SPIFFEFederation{
-			Metadata: &v1.Metadata{
+		spiffeFed: machineidv1pb.SPIFFEFederation_builder{
+			Metadata: v1.Metadata_builder{
 				Name: preInitFed.TrustDomain().Name(),
-			},
-			Status: &machineidv1pb.SPIFFEFederationStatus{
+			}.Build(),
+			Status: machineidv1pb.SPIFFEFederationStatus_builder{
 				CurrentBundle: string(marshaledPreInitFed),
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	cache, err := NewTrustBundleCache(TrustBundleCacheConfig{
@@ -699,15 +699,15 @@ func TestTrustBundleCache_Run(t *testing.T) {
 	require.NoError(t, err)
 	mockWatcher.events <- types.Event{
 		Type: types.OpPut,
-		Resource: types.Resource153ToLegacy(&machineidv1pb.SPIFFEFederation{
+		Resource: types.Resource153ToLegacy(machineidv1pb.SPIFFEFederation_builder{
 			Kind: types.KindSPIFFEFederation,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: preInitFed.TrustDomain().Name(),
-			},
-			Status: &machineidv1pb.SPIFFEFederationStatus{
+			}.Build(),
+			Status: machineidv1pb.SPIFFEFederationStatus_builder{
 				CurrentBundle: string(marshaledPreInitFed),
-			},
-		}),
+			}.Build(),
+		}.Build()),
 	}
 	// Check we receive a bundle with the updated federated bundle
 	select {
@@ -743,15 +743,15 @@ func TestTrustBundleCache_Run(t *testing.T) {
 	require.NoError(t, err)
 	mockWatcher.events <- types.Event{
 		Type: types.OpPut,
-		Resource: types.Resource153ToLegacy(&machineidv1pb.SPIFFEFederation{
+		Resource: types.Resource153ToLegacy(machineidv1pb.SPIFFEFederation_builder{
 			Kind: types.KindSPIFFEFederation,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: afterInitFed.TrustDomain().Name(),
-			},
-			Status: &machineidv1pb.SPIFFEFederationStatus{
+			}.Build(),
+			Status: machineidv1pb.SPIFFEFederationStatus_builder{
 				CurrentBundle: string(marshaledAfterInitFed),
-			},
-		}),
+			}.Build(),
+		}.Build()),
 	}
 	// Check we receive a bundle with the new federated bundle
 	gotBundleSet = waitUpdatedBundleSet(t, gotBundleSet, cache)
@@ -778,12 +778,12 @@ func TestTrustBundleCache_Run(t *testing.T) {
 	// Delete the newly added federated bundle
 	mockWatcher.events <- types.Event{
 		Type: types.OpDelete,
-		Resource: types.Resource153ToLegacy(&machineidv1pb.SPIFFEFederation{
+		Resource: types.Resource153ToLegacy(machineidv1pb.SPIFFEFederation_builder{
 			Kind: types.KindSPIFFEFederation,
-			Metadata: &v1.Metadata{
+			Metadata: v1.Metadata_builder{
 				Name: afterInitFed.TrustDomain().Name(),
-			},
-		}),
+			}.Build(),
+		}.Build()),
 	}
 	// Check we receive a bundle with the new federated bundle deleted
 	gotBundleSet = waitUpdatedBundleSet(t, gotBundleSet, cache)
@@ -956,14 +956,14 @@ func TestTrustBundleCache_Run_WithUnsupportedCAs(t *testing.T) {
 	require.NoError(t, err)
 	mockFederationClient := &mockFederationClient{
 		t: t,
-		spiffeFed: &machineidv1pb.SPIFFEFederation{
-			Metadata: &v1.Metadata{
+		spiffeFed: machineidv1pb.SPIFFEFederation_builder{
+			Metadata: v1.Metadata_builder{
 				Name: preInitFed.TrustDomain().Name(),
-			},
-			Status: &machineidv1pb.SPIFFEFederationStatus{
+			}.Build(),
+			Status: machineidv1pb.SPIFFEFederationStatus_builder{
 				CurrentBundle: string(marshaledPreInitFed),
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	cache, err := NewTrustBundleCache(TrustBundleCacheConfig{
@@ -1026,13 +1026,13 @@ func (m *mockTrustClient) GetCertAuthority(
 	in *trustv1.GetCertAuthorityRequest,
 	opts ...grpc.CallOption,
 ) (*types.CertAuthorityV2, error) {
-	if in.IncludeKey {
+	if in.GetIncludeKey() {
 		return nil, trace.BadParameter("unexpected include key")
 	}
-	if in.Domain != "example.com" {
+	if in.GetDomain() != "example.com" {
 		return nil, trace.BadParameter("unexpected domain")
 	}
-	switch in.Type {
+	switch in.GetType() {
 	case string(types.SPIFFECA):
 		return m.ca, nil
 	case string(types.AppClientCA):
@@ -1059,11 +1059,11 @@ func (m *mockFederationClient) ListSPIFFEFederations(
 	in *machineidv1pb.ListSPIFFEFederationsRequest,
 	opts ...grpc.CallOption,
 ) (*machineidv1pb.ListSPIFFEFederationsResponse, error) {
-	return &machineidv1pb.ListSPIFFEFederationsResponse{
+	return machineidv1pb.ListSPIFFEFederationsResponse_builder{
 		SpiffeFederations: []*machineidv1pb.SPIFFEFederation{
 			m.spiffeFed,
 		},
-	}, nil
+	}.Build(), nil
 }
 
 type mockEventsClient struct {
diff --git a/lib/tbot/workloadidentity/workloadattest/docker_unix.go b/lib/tbot/workloadidentity/workloadattest/docker_unix.go
index c3da4c0b4be..2fa287e80a5 100644
--- a/lib/tbot/workloadidentity/workloadattest/docker_unix.go
+++ b/lib/tbot/workloadidentity/workloadattest/docker_unix.go
@@ -69,13 +69,13 @@ func (a *DockerAttestor) Attest(ctx context.Context, pid int) (*workloadidentity
 		return nil, trace.Wrap(err, "inspecting container")
 	}
 
-	return &workloadidentityv1pb.WorkloadAttrsDocker{
+	return workloadidentityv1pb.WorkloadAttrsDocker_builder{
 		Attested: true,
-		Container: &workloadidentityv1pb.WorkloadAttrsDockerContainer{
+		Container: workloadidentityv1pb.WorkloadAttrsDockerContainer_builder{
 			Name:        res.Container.Name,
 			Image:       res.Container.Config.Image,
 			ImageDigest: res.Container.Image,
 			Labels:      res.Container.Config.Labels,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
diff --git a/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go b/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go
index 0f4ae802872..170d2eece2e 100644
--- a/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/docker_unix_test.go
@@ -97,14 +97,14 @@ func TestDockerAttestor(t *testing.T) {
 	attrs, err := attestor.Attest(context.Background(), 1234)
 	require.NoError(t, err)
 
-	expected := &workloadidentityv1.WorkloadAttrsDocker{
+	expected := workloadidentityv1.WorkloadAttrsDocker_builder{
 		Attested: true,
-		Container: &workloadidentityv1.WorkloadAttrsDockerContainer{
+		Container: workloadidentityv1.WorkloadAttrsDockerContainer_builder{
 			Name:        "web-server",
 			Image:       "nginx:latest",
 			ImageDigest: "sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782",
 			Labels:      map[string]string{"region": "eu"},
-		},
-	}
+		}.Build(),
+	}.Build()
 	require.Empty(t, cmp.Diff(expected, attrs, protocmp.Transform()))
 }
diff --git a/lib/tbot/workloadidentity/workloadattest/kubernetes_unix.go b/lib/tbot/workloadidentity/workloadattest/kubernetes_unix.go
index 85f25813c2d..673e8535a87 100644
--- a/lib/tbot/workloadidentity/workloadattest/kubernetes_unix.go
+++ b/lib/tbot/workloadidentity/workloadattest/kubernetes_unix.go
@@ -108,14 +108,14 @@ func (a *KubernetesAttestor) Attest(ctx context.Context, pid int) (*workloadiden
 
 	var ctr *workloadidentityv1pb.WorkloadAttrsKubernetesContainer
 	if containerStatus != nil {
-		ctr = &workloadidentityv1pb.WorkloadAttrsKubernetesContainer{
+		ctr = workloadidentityv1pb.WorkloadAttrsKubernetesContainer_builder{
 			Name:        containerStatus.Name,
 			Image:       containerStatus.Image,
 			ImageDigest: imageDigestRegex.FindString(containerStatus.ImageID),
-		}
+		}.Build()
 	}
 
-	att := &workloadidentityv1pb.WorkloadAttrsKubernetes{
+	att := workloadidentityv1pb.WorkloadAttrsKubernetes_builder{
 		Attested:       true,
 		Namespace:      pod.Namespace,
 		ServiceAccount: pod.Spec.ServiceAccountName,
@@ -123,7 +123,7 @@ func (a *KubernetesAttestor) Attest(ctx context.Context, pid int) (*workloadiden
 		PodUid:         string(pod.UID),
 		Labels:         pod.Labels,
 		Container:      ctr,
-	}
+	}.Build()
 	a.log.DebugContext(ctx, "Finished Kubernetes workload attestation", "attestation", att)
 	return att, nil
 }
diff --git a/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go b/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go
index 3edc32a5de1..c9fd35a3c02 100644
--- a/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/kubernetes_unix_test.go
@@ -146,7 +146,7 @@ func TestKubernetesAttestor_Attest(t *testing.T) {
 
 	att, err := attestor.Attest(ctx, mockPID)
 	assert.NoError(t, err)
-	assert.Empty(t, cmp.Diff(&workloadidentityv1pb.WorkloadAttrsKubernetes{
+	assert.Empty(t, cmp.Diff(workloadidentityv1pb.WorkloadAttrsKubernetes_builder{
 		Attested:       true,
 		ServiceAccount: "my-service-account",
 		Namespace:      "default",
@@ -155,10 +155,10 @@ func TestKubernetesAttestor_Attest(t *testing.T) {
 		Labels: map[string]string{
 			"my-label": "my-label-value",
 		},
-		Container: &workloadidentityv1pb.WorkloadAttrsKubernetesContainer{
+		Container: workloadidentityv1pb.WorkloadAttrsKubernetesContainer_builder{
 			Name:        "container-1",
 			Image:       "my.registry.io/my-app:v1",
 			ImageDigest: "sha256:84c998f7610b356a5eed24f801c01b273cf3e83f081f25c9b16aa8136c2cafb1",
-		},
-	}, att, protocmp.Transform()))
+		}.Build(),
+	}.Build(), att, protocmp.Transform()))
 }
diff --git a/lib/tbot/workloadidentity/workloadattest/podman_unix.go b/lib/tbot/workloadidentity/workloadattest/podman_unix.go
index 0cb57308df4..91446ba8b02 100644
--- a/lib/tbot/workloadidentity/workloadattest/podman_unix.go
+++ b/lib/tbot/workloadidentity/workloadattest/podman_unix.go
@@ -65,15 +65,15 @@ func (a *PodmanAttestor) Attest(ctx context.Context, pid int) (*workloadidentity
 		return nil, trace.Wrap(err, "inspecting container %q", ctr.ID)
 	}
 
-	attrs := &workloadidentityv1pb.WorkloadAttrsPodman{
+	attrs := workloadidentityv1pb.WorkloadAttrsPodman_builder{
 		Attested: true,
-		Container: &workloadidentityv1pb.WorkloadAttrsPodmanContainer{
+		Container: workloadidentityv1pb.WorkloadAttrsPodmanContainer_builder{
 			Name:        container.Name,
 			Image:       container.Config.Image,
 			Labels:      container.Config.Labels,
 			ImageDigest: container.ImageDigest,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	var pod *podman.Pod
 	if ctr.PodID != "" {
@@ -81,10 +81,10 @@ func (a *PodmanAttestor) Attest(ctx context.Context, pid int) (*workloadidentity
 		if err != nil {
 			return nil, trace.Wrap(err, "inspecting pod %q", ctr.PodID)
 		}
-		attrs.Pod = &workloadidentityv1pb.WorkloadAttrsPodmanPod{
+		attrs.SetPod(workloadidentityv1pb.WorkloadAttrsPodmanPod_builder{
 			Name:   pod.Name,
 			Labels: pod.Labels,
-		}
+		}.Build())
 	}
 
 	return attrs, nil
diff --git a/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go b/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go
index 629614da53e..79fa7ebea94 100644
--- a/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/podman_unix_test.go
@@ -86,18 +86,18 @@ func TestPodmanAttestor(t *testing.T) {
 	attrs, err := attestor.Attest(context.Background(), 1234)
 	require.NoError(t, err)
 
-	expected := &workloadidentityv1.WorkloadAttrsPodman{
+	expected := workloadidentityv1.WorkloadAttrsPodman_builder{
 		Attested: true,
-		Container: &workloadidentityv1.WorkloadAttrsPodmanContainer{
+		Container: workloadidentityv1.WorkloadAttrsPodmanContainer_builder{
 			Name:        "web-server",
 			Image:       "nginx:latest",
 			Labels:      map[string]string{"region": "eu"},
 			ImageDigest: "sha256:56fa17d2a7e7f168a043a2712e63aed1f8543aeafdcee47c58dcffe38ed51099",
-		},
-		Pod: &workloadidentityv1.WorkloadAttrsPodmanPod{
+		}.Build(),
+		Pod: workloadidentityv1.WorkloadAttrsPodmanPod_builder{
 			Name:   "billing-system",
 			Labels: map[string]string{"department": "marketing"},
-		},
-	}
+		}.Build(),
+	}.Build()
 	require.Empty(t, cmp.Diff(expected, attrs, protocmp.Transform()))
 }
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore.go b/lib/tbot/workloadidentity/workloadattest/sigstore.go
index ce4cd05fd65..f28865409ed 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore.go
@@ -181,9 +181,9 @@ func (a *SigstoreAttestor) Attest(ctx context.Context, ctr Container) (*workload
 		return nil, trace.Wrap(err, "discovering Sigstore payloads")
 	}
 
-	result := &workloadidentityv1.WorkloadAttrsSigstore{
+	result := workloadidentityv1.WorkloadAttrsSigstore_builder{
 		Payloads: payloads,
-	}
+	}.Build()
 	_ = a.cache.Add(ctr.GetImageDigest(), result)
 
 	a.failuresMu.Lock()
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_bundles.go b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_bundles.go
index 16b5ddac9dc..6786381e447 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_bundles.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_bundles.go
@@ -80,9 +80,9 @@ func (d *BundleDiscoveryMethod) Discover(ctx context.Context) ([]*workloadidenti
 			return nil, trace.Wrap(err, "marshaling bundle proto")
 		}
 
-		payloads = append(payloads, &workloadidentityv1.SigstoreVerificationPayload{
+		payloads = append(payloads, workloadidentityv1.SigstoreVerificationPayload_builder{
 			Bundle: bundleProto,
-		})
+		}.Build())
 		if len(payloads) == maxPayloads {
 			break
 		}
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_cosign_signatures.go b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_cosign_signatures.go
index e7f396daec0..826008175c9 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_cosign_signatures.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_cosign_signatures.go
@@ -115,10 +115,10 @@ func (d *CosignSignatureDiscoveryMethod) Discover(ctx context.Context) ([]*workl
 			return nil, trace.Wrap(err, "pulling simple signing layer")
 		}
 
-		payloads = append(payloads, &workloadidentityv1.SigstoreVerificationPayload{
+		payloads = append(payloads, workloadidentityv1.SigstoreVerificationPayload_builder{
 			Bundle:                bundleBytes,
 			SimpleSigningEnvelope: envelope,
-		})
+		}.Build())
 		if len(payloads) == maxPayloads {
 			break
 		}
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go
index e1785426641..17e69d15519 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore/discovery_test.go
@@ -58,7 +58,7 @@ func TestDiscovery_SimpleSigning(t *testing.T) {
 
 	t.Run("keyless signature", func(t *testing.T) {
 		var bundle bundlepb.Bundle
-		err = proto.Unmarshal(payloads[0].Bundle, &bundle)
+		err = proto.Unmarshal(payloads[0].GetBundle(), &bundle)
 		require.NoError(t, err)
 
 		assert.Equal(t, "application/vnd.dev.sigstore.bundle+json;version=0.1", bundle.MediaType)
@@ -104,14 +104,14 @@ func TestDiscovery_SimpleSigning(t *testing.T) {
 				} `json:"image"`
 			} `json:"critical"`
 		}
-		err = json.Unmarshal(payloads[0].SimpleSigningEnvelope, &envelope)
+		err = json.Unmarshal(payloads[0].GetSimpleSigningEnvelope(), &envelope)
 		require.NoError(t, err)
 		assert.Equal(t, "sha256:21c76c650023cac8d753af4cb591e6f7450c6e2b499b5751d4a21e26e2fc5012", envelope.Critical.Image.Digest)
 	})
 
 	t.Run("key-based signature", func(t *testing.T) {
 		var bundle bundlepb.Bundle
-		err = proto.Unmarshal(payloads[1].Bundle, &bundle)
+		err = proto.Unmarshal(payloads[1].GetBundle(), &bundle)
 		require.NoError(t, err)
 
 		// Public key.
@@ -136,7 +136,7 @@ func TestDiscovery_Attestations(t *testing.T) {
 	require.Len(t, payloads, 1)
 
 	var bundle bundlepb.Bundle
-	err = proto.Unmarshal(payloads[0].Bundle, &bundle)
+	err = proto.Unmarshal(payloads[0].GetBundle(), &bundle)
 	require.NoError(t, err)
 
 	var attestation struct {
diff --git a/lib/tbot/workloadidentity/workloadattest/sigstore_test.go b/lib/tbot/workloadidentity/workloadattest/sigstore_test.go
index 50edf26bcb7..444883d1eb9 100644
--- a/lib/tbot/workloadidentity/workloadattest/sigstore_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/sigstore_test.go
@@ -127,7 +127,7 @@ func TestSigstoreAttestor_Attest_WithCredentials(t *testing.T) {
 		imageDigest: "sha256:21c76c650023cac8d753af4cb591e6f7450c6e2b499b5751d4a21e26e2fc5012",
 	})
 	require.NoError(t, err)
-	require.Len(t, att.Payloads, 2)
+	require.Len(t, att.GetPayloads(), 2)
 }
 
 func TestSigstoreAttestor_Attest_Caching(t *testing.T) {
diff --git a/lib/tbot/workloadidentity/workloadattest/unix.go b/lib/tbot/workloadidentity/workloadattest/unix.go
index 3f70dca6312..4eecd2c5552 100644
--- a/lib/tbot/workloadidentity/workloadattest/unix.go
+++ b/lib/tbot/workloadidentity/workloadattest/unix.go
@@ -106,10 +106,10 @@ func (a *UnixAttestor) Attest(ctx context.Context, pid int) (*workloadidentityv1
 		return nil, trace.Wrap(err, "getting process")
 	}
 
-	att := &workloadidentityv1pb.WorkloadAttrsUnix{
+	att := workloadidentityv1pb.WorkloadAttrsUnix_builder{
 		Attested: true,
 		Pid:      int32(pid),
-	}
+	}.Build()
 	// On Linux:
 	// Real, effective, saved, and file system GIDs
 	// On Darwin:
@@ -125,10 +125,10 @@ func (a *UnixAttestor) Attest(ctx context.Context, pid int) (*workloadidentityv1
 		return nil, trace.BadParameter("no gids returned")
 	case 1:
 		// Only one GID - this is unusual but let's take it.
-		att.Gid = gids[0]
+		att.SetGid(gids[0])
 	default:
 		// Take the index 1 entry as this is effective
-		att.Gid = gids[1]
+		att.SetGid(gids[1])
 	}
 
 	// On Linux:
@@ -146,10 +146,10 @@ func (a *UnixAttestor) Attest(ctx context.Context, pid int) (*workloadidentityv1
 		return nil, trace.BadParameter("no uids returned")
 	case 1:
 		// Only one UID, we expect this on Darwin to be the Effective UID
-		att.Uid = uids[0]
+		att.SetUid(uids[0])
 	default:
 		// Take the index 1 entry as this is Effective UID on Linux
-		att.Uid = uids[1]
+		att.SetUid(uids[1])
 	}
 
 	path, err := a.os.ExePath(ctx, p)
@@ -159,11 +159,11 @@ func (a *UnixAttestor) Attest(ctx context.Context, pid int) (*workloadidentityv1
 	case err != nil:
 		a.log.ErrorContext(ctx, "Failed to find workload executable", "error", err)
 	default:
-		att.BinaryPath = &path
+		att.SetBinaryPath(path)
 	}
 
 	if hash := a.hashBinary(ctx, p); hash != "" {
-		att.BinaryHash = &hash
+		att.SetBinaryHash(hash)
 	}
 
 	return att, nil
diff --git a/lib/tbot/workloadidentity/workloadattest/unix_test.go b/lib/tbot/workloadidentity/workloadattest/unix_test.go
index 125ce526fbd..8176b9d7cbb 100644
--- a/lib/tbot/workloadidentity/workloadattest/unix_test.go
+++ b/lib/tbot/workloadidentity/workloadattest/unix_test.go
@@ -63,14 +63,14 @@ func TestUnixAttestor_Attest(t *testing.T) {
 	require.NoError(t, err)
 	require.Empty(t,
 		cmp.Diff(
-			&workloadidentityv1pb.WorkloadAttrsUnix{
+			workloadidentityv1pb.WorkloadAttrsUnix_builder{
 				Attested:   true,
 				Pid:        int32(pid),
 				Uid:        uint32(uid),
 				Gid:        uint32(gid),
 				BinaryPath: proto.String("/path/to/executable"),
 				BinaryHash: proto.String("b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"),
-			},
+			}.Build(),
 			att,
 			protocmp.Transform(),
 		),
diff --git a/lib/teleterm/apiserver/handler/handler.go b/lib/teleterm/apiserver/handler/handler.go
index 144f3b1d355..40099734b9b 100644
--- a/lib/teleterm/apiserver/handler/handler.go
+++ b/lib/teleterm/apiserver/handler/handler.go
@@ -67,10 +67,10 @@ type Handler struct {
 func makeAPILabels(uiLabels []ui.Label) []*api.Label {
 	apiLabels := make([]*api.Label, 0, len(uiLabels))
 	for _, uiLabel := range uiLabels {
-		apiLabels = append(apiLabels, &api.Label{
+		apiLabels = append(apiLabels, api.Label_builder{
 			Name:  uiLabel.Name,
 			Value: uiLabel.Value,
-		})
+		}.Build())
 	}
 	return apiLabels
 }
diff --git a/lib/teleterm/apiserver/handler/handler_access_requests.go b/lib/teleterm/apiserver/handler/handler_access_requests.go
index 234d597ed2e..e3a888b6c48 100644
--- a/lib/teleterm/apiserver/handler/handler_access_requests.go
+++ b/lib/teleterm/apiserver/handler/handler_access_requests.go
@@ -51,7 +51,7 @@ func (s *Handler) GetAccessRequests(ctx context.Context, req *api.GetAccessReque
 
 	response := &api.GetAccessRequestsResponse{}
 	for _, req := range requests {
-		response.Requests = append(response.Requests, newAPIAccessRequest(req))
+		response.SetRequests(append(response.GetRequests(), newAPIAccessRequest(req)))
 	}
 
 	return response, nil
@@ -65,7 +65,7 @@ func (s *Handler) GetAccessRequest(ctx context.Context, req *api.GetAccessReques
 	}
 
 	response := &api.GetAccessRequestResponse{}
-	response.Request = newAPIAccessRequest(*request)
+	response.SetRequest(newAPIAccessRequest(*request))
 
 	return response, nil
 }
@@ -77,9 +77,9 @@ func (s *Handler) CreateAccessRequest(ctx context.Context, req *api.CreateAccess
 		return nil, trace.Wrap(err)
 	}
 
-	createdRequest := &api.CreateAccessRequestResponse{
+	createdRequest := api.CreateAccessRequestResponse_builder{
 		Request: newAPIAccessRequest(*request),
-	}
+	}.Build()
 	return createdRequest, nil
 }
 
@@ -109,16 +109,16 @@ func (s *Handler) PromoteAccessRequest(ctx context.Context, req *api.PromoteAcce
 		return nil, trace.Wrap(err)
 	}
 
-	accessRequest, err := s.DaemonService.PromoteAccessRequest(ctx, clusterURI, &accesslistv1.AccessRequestPromoteRequest{
-		RequestId:      req.AccessRequestId,
-		AccessListName: req.AccessListId,
-		Reason:         req.Reason,
-	})
+	accessRequest, err := s.DaemonService.PromoteAccessRequest(ctx, clusterURI, accesslistv1.AccessRequestPromoteRequest_builder{
+		RequestId:      req.GetAccessRequestId(),
+		AccessListName: req.GetAccessListId(),
+		Reason:         req.GetReason(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.PromoteAccessRequestResponse{Request: newAPIAccessRequest(*accessRequest)}, nil
+	return api.PromoteAccessRequestResponse_builder{Request: newAPIAccessRequest(*accessRequest)}.Build(), nil
 }
 
 // GetSuggestedAccessLists returns suggested access lists for an access request.
@@ -128,7 +128,7 @@ func (s *Handler) GetSuggestedAccessLists(ctx context.Context, req *api.GetSugge
 		return nil, trace.Wrap(err)
 	}
 
-	accessLists, err := s.DaemonService.GetSuggestedAccessLists(ctx, rootClusterURI, req.AccessRequestId)
+	accessLists, err := s.DaemonService.GetSuggestedAccessLists(ctx, rootClusterURI, req.GetAccessRequestId())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -138,7 +138,7 @@ func (s *Handler) GetSuggestedAccessLists(ctx context.Context, req *api.GetSugge
 		accessListsProto = append(accessListsProto, accesslistv1conv.ToProto(accessList))
 	}
 
-	return &api.GetSuggestedAccessListsResponse{AccessLists: accessListsProto}, nil
+	return api.GetSuggestedAccessListsResponse_builder{AccessLists: accessListsProto}.Build(), nil
 }
 
 // ReviewAccessRequest creates a new AccessRequestReview for a given RequestId.
@@ -147,9 +147,9 @@ func (s *Handler) ReviewAccessRequest(ctx context.Context, req *api.ReviewAccess
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	response := &api.ReviewAccessRequestResponse{
+	response := api.ReviewAccessRequestResponse_builder{
 		Request: newAPIAccessRequest(*request),
-	}
+	}.Build()
 	return response, nil
 }
 
@@ -157,7 +157,7 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 	reviews := []*api.AccessRequestReview{}
 	requestReviews := req.GetReviews()
 	for _, rev := range requestReviews {
-		reviews = append(reviews, &api.AccessRequestReview{
+		reviews = append(reviews, api.AccessRequestReview_builder{
 			Author:                  rev.Author,
 			Roles:                   rev.Roles,
 			State:                   rev.ProposedState.String(),
@@ -165,7 +165,7 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 			Created:                 timestamppb.New(rev.Created),
 			PromotedAccessListTitle: rev.GetAccessListTitle(),
 			AssumeStartTime:         getProtoTimestamp(rev.AssumeStartTime),
-		})
+		}.Build())
 	}
 
 	thresholdNames := make([]string, 0, len(req.GetThresholds()))
@@ -180,17 +180,17 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 	for i, r := range requestedResourceIDs {
 		details := req.ResourceDetails[resourceIDToString(r)]
 
-		resources[i] = &api.Resource{
-			Id: &api.ResourceID{
+		resources[i] = api.Resource_builder{
+			Id: api.ResourceID_builder{
 				ClusterName:     r.ClusterName,
 				Kind:            r.Kind,
 				Name:            r.Name,
 				SubResourceName: r.SubResourceName,
-			},
+			}.Build(),
 			// If there are no details for this resource, the map lookup returns
 			// the default value which is empty details
 			Details: newAPIResourceDetails(details),
-		}
+		}.Build()
 	}
 
 	dryRunEnrichment := req.GetDryRunEnrichment()
@@ -198,7 +198,7 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 		dryRunEnrichment = &types.AccessRequestDryRunEnrichment{}
 	}
 
-	return &api.AccessRequest{
+	return api.AccessRequest_builder{
 		Id:                      req.GetName(),
 		State:                   req.GetState().String(),
 		ResolveReason:           req.GetResolveReason(),
@@ -218,7 +218,7 @@ func newAPIAccessRequest(req clusters.AccessRequest) *api.AccessRequest {
 		SessionTtl:              timestamppb.New(req.GetSessionTLL()),
 		ReasonMode:              string(dryRunEnrichment.ReasonMode),
 		ReasonPrompts:           dryRunEnrichment.ReasonPrompts,
-	}
+	}.Build()
 }
 
 // resourceIDToString marshals a ResourceID to a string.
@@ -230,8 +230,8 @@ func resourceIDToString(id types.ResourceID) string {
 }
 
 func newAPIResourceDetails(details clusters.ResourceDetails) *api.ResourceDetails {
-	return &api.ResourceDetails{
+	return api.ResourceDetails_builder{
 		Hostname:     details.Hostname,
 		FriendlyName: details.FriendlyName,
-	}
+	}.Build()
 }
diff --git a/lib/teleterm/apiserver/handler/handler_apps.go b/lib/teleterm/apiserver/handler/handler_apps.go
index d0b60bf8890..9f52f44bfcd 100644
--- a/lib/teleterm/apiserver/handler/handler_apps.go
+++ b/lib/teleterm/apiserver/handler/handler_apps.go
@@ -29,7 +29,7 @@ import (
 )
 
 func (h *Handler) GetApp(ctx context.Context, req *api.GetAppRequest) (*api.GetAppResponse, error) {
-	appURI, err := uri.Parse(req.AppUri)
+	appURI, err := uri.Parse(req.GetAppUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -53,9 +53,9 @@ func (h *Handler) GetApp(ctx context.Context, req *api.GetAppRequest) (*api.GetA
 		App: app,
 	}
 
-	return &api.GetAppResponse{
+	return api.GetAppResponse_builder{
 		App: newAPIApp(clustersApp),
-	}, nil
+	}.Build(), nil
 }
 
 func newAPIApp(clusterApp clusters.App) *api.App {
@@ -63,12 +63,12 @@ func newAPIApp(clusterApp clusters.App) *api.App {
 
 	awsRoles := []*api.AWSRole{}
 	for _, role := range clusterApp.AWSRoles {
-		awsRoles = append(awsRoles, &api.AWSRole{
+		awsRoles = append(awsRoles, api.AWSRole_builder{
 			Name:      role.Name,
 			Display:   role.Display,
 			Arn:       role.ARN,
 			AccountId: role.AccountID,
-		})
+		}.Build())
 	}
 
 	apiLabels := makeAPILabels(ui.MakeLabelsWithoutInternalPrefixes(app.GetAllLabels()))
@@ -76,10 +76,10 @@ func newAPIApp(clusterApp clusters.App) *api.App {
 
 	tcpPorts := make([]*api.PortRange, 0, len(app.GetTCPPorts()))
 	for _, portRange := range app.GetTCPPorts() {
-		tcpPorts = append(tcpPorts, &api.PortRange{Port: portRange.Port, EndPort: portRange.EndPort})
+		tcpPorts = append(tcpPorts, api.PortRange_builder{Port: portRange.Port, EndPort: portRange.EndPort}.Build())
 	}
 
-	return &api.App{
+	return api.App_builder{
 		Uri:            clusterApp.URI.String(),
 		EndpointUri:    app.GetURI(),
 		Name:           app.GetName(),
@@ -94,7 +94,7 @@ func newAPIApp(clusterApp clusters.App) *api.App {
 		TcpPorts:       tcpPorts,
 		SubKind:        app.GetSubKind(),
 		PermissionSets: permissionSets,
-	}
+	}.Build()
 }
 
 func newSAMLIdPServiceProviderAPIApp(clusterApp clusters.SAMLIdPServiceProvider) *api.App {
@@ -102,7 +102,7 @@ func newSAMLIdPServiceProviderAPIApp(clusterApp clusters.SAMLIdPServiceProvider)
 	apiLabels := makeAPILabels(ui.MakeLabelsWithoutInternalPrefixes(provider.GetAllLabels()))
 
 	// Keep in sync with lib/web/ui/app.go.
-	return &api.App{
+	return api.App_builder{
 		Uri:          clusterApp.URI.String(),
 		Name:         provider.GetName(),
 		Desc:         "SAML Application",
@@ -110,7 +110,7 @@ func newSAMLIdPServiceProviderAPIApp(clusterApp clusters.SAMLIdPServiceProvider)
 		FriendlyName: types.FriendlyName(provider),
 		SamlApp:      true,
 		Labels:       apiLabels,
-	}
+	}.Build()
 }
 
 func makeAPIPermissionSets(sets []*types.IdentityCenterPermissionSet) []*api.IdentityCenterPermissionSet {
@@ -119,11 +119,11 @@ func makeAPIPermissionSets(sets []*types.IdentityCenterPermissionSet) []*api.Ide
 	}
 	apiSets := make([]*api.IdentityCenterPermissionSet, len(sets))
 	for i, set := range sets {
-		apiSets[i] = &api.IdentityCenterPermissionSet{
+		apiSets[i] = api.IdentityCenterPermissionSet_builder{
 			Name:         set.Name,
 			Arn:          set.ARN,
 			AssignmentId: set.AssignmentID,
-		}
+		}.Build()
 	}
 	return apiSets
 }
diff --git a/lib/teleterm/apiserver/handler/handler_auth.go b/lib/teleterm/apiserver/handler/handler_auth.go
index eeb2a6fda22..5eea607c4d7 100644
--- a/lib/teleterm/apiserver/handler/handler_auth.go
+++ b/lib/teleterm/apiserver/handler/handler_auth.go
@@ -32,7 +32,7 @@ import (
 
 // Login logs in a user to a cluster
 func (s *Handler) Login(ctx context.Context, req *api.LoginRequest) (*api.EmptyResponse, error) {
-	cluster, _, err := s.DaemonService.ResolveCluster(req.ClusterUri)
+	cluster, _, err := s.DaemonService.ResolveCluster(req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -41,17 +41,17 @@ func (s *Handler) Login(ctx context.Context, req *api.LoginRequest) (*api.EmptyR
 		return nil, trace.BadParameter("cluster URI must be a root URI")
 	}
 
-	if req.Params == nil {
+	if !req.HasParams() {
 		return nil, trace.BadParameter("missing login parameters")
 	}
 
-	switch params := req.Params.(type) {
-	case *api.LoginRequest_Local:
-		if err := cluster.LocalLogin(ctx, params.Local.User, params.Local.Password, params.Local.Token); err != nil {
+	switch req.WhichParams() {
+	case api.LoginRequest_Local_case:
+		if err := cluster.LocalLogin(ctx, req.GetLocal().GetUser(), req.GetLocal().GetPassword(), req.GetLocal().GetToken()); err != nil {
 			return nil, trace.Wrap(err)
 		}
-	case *api.LoginRequest_Sso:
-		if err := cluster.SSOLogin(ctx, params.Sso.ProviderType, params.Sso.ProviderName); err != nil {
+	case api.LoginRequest_Sso_case:
+		if err := cluster.SSOLogin(ctx, req.GetSso().GetProviderType(), req.GetSso().GetProviderName()); err != nil {
 			return nil, trace.Wrap(err)
 		}
 	default:
@@ -116,7 +116,7 @@ func (s *Handler) Logout(ctx context.Context, req *api.LogoutRequest) (*api.Empt
 		return nil, trace.Wrap(err)
 	}
 
-	if err = s.DaemonService.ClusterLogout(ctx, clusterURI, req.RemoveProfile); err != nil {
+	if err = s.DaemonService.ClusterLogout(ctx, clusterURI, req.GetRemoveProfile()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -125,7 +125,7 @@ func (s *Handler) Logout(ctx context.Context, req *api.LogoutRequest) (*api.Empt
 
 // GetAuthSettings returns cluster auth preferences
 func (s *Handler) GetAuthSettings(ctx context.Context, req *api.GetAuthSettingsRequest) (*api.AuthSettings, error) {
-	cluster, _, err := s.DaemonService.ResolveCluster(req.ClusterUri)
+	cluster, _, err := s.DaemonService.ResolveCluster(req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -135,20 +135,20 @@ func (s *Handler) GetAuthSettings(ctx context.Context, req *api.GetAuthSettingsR
 		return nil, trace.Wrap(err)
 	}
 
-	result := &api.AuthSettings{
+	result := api.AuthSettings_builder{
 		LocalAuthEnabled:   preferences.LocalAuthEnabled,
 		AuthType:           preferences.AuthType,
 		AllowPasswordless:  preferences.AllowPasswordless,
 		LocalConnectorName: preferences.LocalConnectorName,
 		MessageOfTheDay:    preferences.MOTD,
-	}
+	}.Build()
 
 	for _, provider := range preferences.Providers {
-		result.AuthProviders = append(result.AuthProviders, &api.AuthProvider{
+		result.SetAuthProviders(append(result.GetAuthProviders(), api.AuthProvider_builder{
 			Type:        provider.Type,
 			Name:        provider.Name,
 			DisplayName: provider.DisplayName,
-		})
+		}.Build()))
 	}
 
 	versions := client.Versions{
@@ -162,17 +162,17 @@ func (s *Handler) GetAuthSettings(ctx context.Context, req *api.GetAuthSettingsR
 		return nil, trace.Wrap(err)
 	}
 
-	result.ClientVersionStatus = libclientVersionStatusToAPIVersionStatus(clientVersionStatus)
-	result.Versions = &api.Versions{
+	result.SetClientVersionStatus(libclientVersionStatusToAPIVersionStatus(clientVersionStatus))
+	result.SetVersions(api.Versions_builder{
 		MinClient: versions.MinClient,
 		Client:    versions.Client,
 		Server:    versions.Server,
-	}
+	}.Build())
 
 	if minClientWithoutPreRelease, err := utils.VersionWithoutPreRelease(versions.MinClient); err != nil {
 		log.DebugContext(ctx, "Could not strip pre-release suffix", "error", err)
 	} else {
-		result.Versions.MinClient = minClientWithoutPreRelease
+		result.GetVersions().SetMinClient(minClientWithoutPreRelease)
 	}
 
 	return result, nil
@@ -182,7 +182,7 @@ func (s *Handler) GetAuthSettings(ctx context.Context, req *api.GetAuthSettingsR
 // If the watcher is already running, it is restarted.
 func (s *Handler) StartHeadlessWatcher(_ context.Context, req *api.StartHeadlessWatcherRequest) (*api.StartHeadlessWatcherResponse, error) {
 	// Don't wait for the headless watcher to initialize
-	err := s.DaemonService.StartHeadlessWatcher(req.RootClusterUri, false /* waitInit */)
+	err := s.DaemonService.StartHeadlessWatcher(req.GetRootClusterUri(), false /* waitInit */)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/teleterm/apiserver/handler/handler_clusters.go b/lib/teleterm/apiserver/handler/handler_clusters.go
index 8d25d1a5c12..51cb5ad1b50 100644
--- a/lib/teleterm/apiserver/handler/handler_clusters.go
+++ b/lib/teleterm/apiserver/handler/handler_clusters.go
@@ -42,21 +42,21 @@ func (s *Handler) ListRootClusters(ctx context.Context, r *api.ListClustersReque
 		result = append(result, newAPIRootCluster(cluster))
 	}
 
-	return &api.ListClustersResponse{
+	return api.ListClustersResponse_builder{
 		Clusters: result,
-	}, nil
+	}.Build(), nil
 }
 
 // ListLeafClusters lists leaf clusters
 func (s *Handler) ListLeafClusters(ctx context.Context, req *api.ListLeafClustersRequest) (*api.ListClustersResponse, error) {
-	leaves, err := s.DaemonService.ListLeafClusters(ctx, req.ClusterUri)
+	leaves, err := s.DaemonService.ListLeafClusters(ctx, req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	response := &api.ListClustersResponse{}
 	for _, leaf := range leaves {
-		response.Clusters = append(response.Clusters, newAPILeafCluster(leaf))
+		response.SetClusters(append(response.GetClusters(), newAPILeafCluster(leaf)))
 	}
 
 	return response, nil
@@ -64,7 +64,7 @@ func (s *Handler) ListLeafClusters(ctx context.Context, req *api.ListLeafCluster
 
 // AddCluster creates a new cluster
 func (s *Handler) AddCluster(ctx context.Context, req *api.AddClusterRequest) (*api.Cluster, error) {
-	cluster, err := s.DaemonService.AddCluster(ctx, req.Name)
+	cluster, err := s.DaemonService.AddCluster(ctx, req.GetName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -74,7 +74,7 @@ func (s *Handler) AddCluster(ctx context.Context, req *api.AddClusterRequest) (*
 
 // GetCluster returns a cluster
 func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*api.Cluster, error) {
-	cluster, _, err := s.DaemonService.ResolveClusterWithDetails(ctx, req.ClusterUri)
+	cluster, _, err := s.DaemonService.ResolveClusterWithDetails(ctx, req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -86,7 +86,7 @@ func (s *Handler) GetCluster(ctx context.Context, req *api.GetClusterRequest) (*
 
 // ClearStaleClusterClients closes root and leaf cluster clients that use outdated TLS certificates.
 func (s *Handler) ClearStaleClusterClients(_ context.Context, req *api.ClearStaleClusterClientsRequest) (*api.ClearStaleClusterClientsResponse, error) {
-	parsed, err := uri.Parse(req.RootClusterUri)
+	parsed, err := uri.Parse(req.GetRootClusterUri())
 	if err != nil {
 		return &api.ClearStaleClusterClientsResponse{}, trace.Wrap(err)
 	}
@@ -98,23 +98,23 @@ func (s *Handler) ClearStaleClusterClients(_ context.Context, req *api.ClearStal
 func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
 	loggedInUser := cluster.GetLoggedInUser()
 
-	apiCluster := &api.Cluster{
+	apiCluster := api.Cluster_builder{
 		Uri:       cluster.URI.String(),
 		Name:      cluster.Name,
 		ProxyHost: cluster.GetProxyHost(),
 		Connected: cluster.Connected(),
-		LoggedInUser: &api.LoggedInUser{
+		LoggedInUser: api.LoggedInUser_builder{
 			Name:            loggedInUser.Name,
 			Roles:           loggedInUser.Roles,
 			ActiveRequests:  loggedInUser.ActiveRequests,
 			IsDeviceTrusted: cluster.HasDeviceTrustExtensions(),
 			ValidUntil:      timestamppb.New(loggedInUser.ValidUntil),
-		},
+		}.Build(),
 		SsoHost: cluster.SSOHost,
-	}
+	}.Build()
 
 	if cluster.GetProfileStatusError() != nil {
-		apiCluster.ProfileStatusError = cluster.GetProfileStatusError().Error()
+		apiCluster.SetProfileStatusError(cluster.GetProfileStatusError().Error())
 	}
 
 	return apiCluster
@@ -123,44 +123,44 @@ func newAPIRootCluster(cluster *clusters.Cluster) *api.Cluster {
 func newAPIRootClusterWithDetails(cluster *clusters.ClusterWithDetails) (*api.Cluster, error) {
 	apiCluster := newAPIRootCluster(cluster.Cluster)
 
-	apiCluster.Features = &api.Features{
+	apiCluster.SetFeatures(api.Features_builder{
 		AdvancedAccessWorkflows: cluster.Features.GetAdvancedAccessWorkflows(),
 		IsUsageBasedBilling:     cluster.Features.GetIsUsageBased(),
-	}
-	apiCluster.LoggedInUser.RequestableRoles = cluster.RequestableRoles
-	apiCluster.LoggedInUser.SuggestedReviewers = cluster.SuggestedReviewers
-	apiCluster.AuthClusterId = cluster.AuthClusterID
-	apiCluster.LoggedInUser.Acl = cluster.ACL
+	}.Build())
+	apiCluster.GetLoggedInUser().SetRequestableRoles(cluster.RequestableRoles)
+	apiCluster.GetLoggedInUser().SetSuggestedReviewers(cluster.SuggestedReviewers)
+	apiCluster.SetAuthClusterId(cluster.AuthClusterID)
+	apiCluster.GetLoggedInUser().SetAcl(cluster.ACL)
 	userType, err := clusters.UserTypeFromString(cluster.UserType)
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	apiCluster.LoggedInUser.UserType = userType
-	apiCluster.LoggedInUser.TrustedDeviceRequirement = cluster.TrustedDeviceRequirement
-	apiCluster.ProxyVersion = cluster.ProxyVersion
+	apiCluster.GetLoggedInUser().SetUserType(userType)
+	apiCluster.GetLoggedInUser().SetTrustedDeviceRequirement(cluster.TrustedDeviceRequirement)
+	apiCluster.SetProxyVersion(cluster.ProxyVersion)
 
 	switch cluster.ShowResources {
 	case constants.ShowResourcesaccessibleOnly:
-		apiCluster.ShowResources = api.ShowResources_SHOW_RESOURCES_ACCESSIBLE_ONLY
+		apiCluster.SetShowResources(api.ShowResources_SHOW_RESOURCES_ACCESSIBLE_ONLY)
 	case constants.ShowResourcesRequestable:
-		apiCluster.ShowResources = api.ShowResources_SHOW_RESOURCES_REQUESTABLE
+		apiCluster.SetShowResources(api.ShowResources_SHOW_RESOURCES_REQUESTABLE)
 	default:
 		// If the UI config for ShowResources is not set, the default is `requestable`.
-		apiCluster.ShowResources = api.ShowResources_SHOW_RESOURCES_REQUESTABLE
+		apiCluster.SetShowResources(api.ShowResources_SHOW_RESOURCES_REQUESTABLE)
 	}
 
 	return apiCluster, nil
 }
 
 func newAPILeafCluster(leaf clusters.LeafCluster) *api.Cluster {
-	return &api.Cluster{
+	return api.Cluster_builder{
 		Name:      leaf.Name,
 		Uri:       leaf.URI.String(),
 		Connected: leaf.Connected,
 		Leaf:      true,
-		LoggedInUser: &api.LoggedInUser{
+		LoggedInUser: api.LoggedInUser_builder{
 			Name:  leaf.LoggedInUser.Name,
 			Roles: leaf.LoggedInUser.Roles,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/teleterm/apiserver/handler/handler_connectmycomputer.go b/lib/teleterm/apiserver/handler/handler_connectmycomputer.go
index e5168fcdb43..6b9728a6dfd 100644
--- a/lib/teleterm/apiserver/handler/handler_connectmycomputer.go
+++ b/lib/teleterm/apiserver/handler/handler_connectmycomputer.go
@@ -39,9 +39,9 @@ func (s *Handler) CreateConnectMyComputerNodeToken(ctx context.Context, req *api
 		return nil, trace.Wrap(err)
 	}
 
-	response := &api.CreateConnectMyComputerNodeTokenResponse{
+	response := api.CreateConnectMyComputerNodeTokenResponse_builder{
 		Token: token,
-	}
+	}.Build()
 
 	return response, nil
 }
@@ -53,7 +53,7 @@ func (s *Handler) WaitForConnectMyComputerNodeJoin(ctx context.Context, req *api
 	timeoutCtx, close := context.WithTimeout(ctx, time.Minute)
 	defer close()
 
-	rootClusterURI, err := uri.Parse(req.RootClusterUri)
+	rootClusterURI, err := uri.Parse(req.GetRootClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -63,9 +63,9 @@ func (s *Handler) WaitForConnectMyComputerNodeJoin(ctx context.Context, req *api
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.WaitForConnectMyComputerNodeJoinResponse{
+	return api.WaitForConnectMyComputerNodeJoinResponse_builder{
 		Server: newAPIServer(server),
-	}, err
+	}.Build(), err
 }
 
 func (s *Handler) DeleteConnectMyComputerNode(ctx context.Context, req *api.DeleteConnectMyComputerNodeRequest) (*api.DeleteConnectMyComputerNodeResponse, error) {
diff --git a/lib/teleterm/apiserver/handler/handler_databases.go b/lib/teleterm/apiserver/handler/handler_databases.go
index c2b85186085..7262ef15417 100644
--- a/lib/teleterm/apiserver/handler/handler_databases.go
+++ b/lib/teleterm/apiserver/handler/handler_databases.go
@@ -35,12 +35,12 @@ func (s *Handler) ListDatabaseServers(ctx context.Context, req *api.ListDatabase
 		return nil, trace.Wrap(err)
 	}
 
-	response := &api.ListDatabaseServersResponse{
+	response := api.ListDatabaseServersResponse_builder{
 		NextKey: resp.NextKey,
-	}
+	}.Build()
 
 	for _, server := range resp.Servers {
-		response.Resources = append(response.Resources, newAPIDatabaseServer(server))
+		response.SetResources(append(response.GetResources(), newAPIDatabaseServer(server)))
 	}
 	return response, nil
 }
@@ -53,39 +53,39 @@ func newAPIDatabase(db clusters.Database) *api.Database {
 
 	var autoUserProvisioning *api.AutoUserProvisioning
 	if db.AutoUserProvisioning != nil {
-		autoUserProvisioning = &api.AutoUserProvisioning{
+		autoUserProvisioning = api.AutoUserProvisioning_builder{
 			DatabaseRoles: db.AutoUserProvisioning.DatabaseRoles,
-		}
+		}.Build()
 	}
 
-	return &api.Database{
+	return api.Database_builder{
 		Uri:      db.URI.String(),
 		Name:     db.GetName(),
 		Desc:     db.GetDescription(),
 		Protocol: db.GetProtocol(),
 		Type:     db.GetType(),
 		Labels:   apiLabels,
-		TargetHealth: &api.TargetHealth{
+		TargetHealth: api.TargetHealth_builder{
 			Status:  db.TargetHealth.Status,
 			Error:   db.TargetHealth.TransitionError,
 			Message: db.TargetHealth.Message,
-		},
+		}.Build(),
 		GcpProjectId:         gcpProjectID,
 		DatabaseUsers:        db.DatabaseUsers,
 		WildcardUserAllowed:  db.WildcardUserAllowed,
 		AutoUserProvisioning: autoUserProvisioning,
-	}
+	}.Build()
 }
 
 func newAPIDatabaseServer(dbServer clusters.DatabaseServer) *api.DatabaseServer {
-	return &api.DatabaseServer{
+	return api.DatabaseServer_builder{
 		Uri:      dbServer.URI.String(),
 		Hostname: dbServer.GetHostname(),
 		HostId:   dbServer.GetHostID(),
-		TargetHealth: &api.TargetHealth{
+		TargetHealth: api.TargetHealth_builder{
 			Status:  dbServer.GetTargetHealth().Status,
 			Error:   dbServer.GetTargetHealth().TransitionError,
 			Message: dbServer.GetTargetHealth().Message,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/teleterm/apiserver/handler/handler_databases_test.go b/lib/teleterm/apiserver/handler/handler_databases_test.go
index 265935f457a..5d28ec3ec35 100644
--- a/lib/teleterm/apiserver/handler/handler_databases_test.go
+++ b/lib/teleterm/apiserver/handler/handler_databases_test.go
@@ -58,21 +58,21 @@ func TestNewAPIDatabase_Fields(t *testing.T) {
 
 		apiDB := newAPIDatabase(testDatabase)
 
-		require.Equal(t, &api.Database{
+		require.Equal(t, api.Database_builder{
 			Uri:      "/clusters/test-cluster/dbs/test-db",
 			Name:     "test-db",
 			Desc:     "Test database",
 			Protocol: "postgres",
 			Type:     "self-hosted",
 			Labels: []*api.Label{
-				{Name: "env", Value: "test"},
-				{Name: "tier", Value: "backend"},
+				api.Label_builder{Name: "env", Value: "test"}.Build(),
+				api.Label_builder{Name: "tier", Value: "backend"}.Build(),
 			},
 			TargetHealth: &api.TargetHealth{},
-			AutoUserProvisioning: &api.AutoUserProvisioning{
+			AutoUserProvisioning: api.AutoUserProvisioning_builder{
 				DatabaseRoles: []string{"reader", "writer"},
-			},
+			}.Build(),
 			DatabaseUsers: []string{"alice", "bob"},
-		}, apiDB)
+		}.Build(), apiDB)
 	})
 }
diff --git a/lib/teleterm/apiserver/handler/handler_desktops.go b/lib/teleterm/apiserver/handler/handler_desktops.go
index f51ca5a2a85..419e290cd55 100644
--- a/lib/teleterm/apiserver/handler/handler_desktops.go
+++ b/lib/teleterm/apiserver/handler/handler_desktops.go
@@ -32,13 +32,13 @@ func newAPIWindowsDesktop(clusterDesktop clusters.WindowsDesktop) *api.WindowsDe
 	desktop := clusterDesktop.WindowsDesktop
 	apiLabels := makeAPILabels(ui.MakeLabelsWithoutInternalPrefixes(desktop.GetAllLabels()))
 
-	return &api.WindowsDesktop{
+	return api.WindowsDesktop_builder{
 		Uri:    clusterDesktop.URI.String(),
 		Name:   desktop.GetName(),
 		Addr:   desktop.GetAddr(),
 		Logins: clusterDesktop.Logins,
 		Labels: apiLabels,
-	}
+	}.Build()
 }
 
 // ConnectToDesktop establishes a desktop connection.
diff --git a/lib/teleterm/apiserver/handler/handler_device_trust.go b/lib/teleterm/apiserver/handler/handler_device_trust.go
index e6b23ca09da..9ec9c939781 100644
--- a/lib/teleterm/apiserver/handler/handler_device_trust.go
+++ b/lib/teleterm/apiserver/handler/handler_device_trust.go
@@ -27,11 +27,11 @@ import (
 
 func (s *Handler) AuthenticateWebDevice(ctx context.Context, req *api.AuthenticateWebDeviceRequest) (*api.AuthenticateWebDeviceResponse, error) {
 	switch {
-	case req.RootClusterUri == "":
+	case req.GetRootClusterUri() == "":
 		return nil, trace.BadParameter("root_cluster_uri required")
-	case req.DeviceWebToken.GetId() == "":
+	case req.GetDeviceWebToken().GetId() == "":
 		return nil, trace.BadParameter("device_web_token.id required")
-	case req.DeviceWebToken.GetToken() == "":
+	case req.GetDeviceWebToken().GetToken() == "":
 		return nil, trace.BadParameter("device_web_token.token required")
 	}
 
diff --git a/lib/teleterm/apiserver/handler/handler_gateways.go b/lib/teleterm/apiserver/handler/handler_gateways.go
index dbb0de52c93..dbdf5d93372 100644
--- a/lib/teleterm/apiserver/handler/handler_gateways.go
+++ b/lib/teleterm/apiserver/handler/handler_gateways.go
@@ -34,10 +34,10 @@ import (
 // CreateGateway creates a gateway
 func (s *Handler) CreateGateway(ctx context.Context, req *api.CreateGatewayRequest) (*api.Gateway, error) {
 	params := daemon.CreateGatewayParams{
-		TargetURI:             req.TargetUri,
-		TargetUser:            req.TargetUser,
-		TargetSubresourceName: req.TargetSubresourceName,
-		LocalPort:             req.LocalPort,
+		TargetURI:             req.GetTargetUri(),
+		TargetUser:            req.GetTargetUser(),
+		TargetSubresourceName: req.GetTargetSubresourceName(),
+		LocalPort:             req.GetLocalPort(),
 	}
 
 	gateway, err := s.DaemonService.CreateGateway(ctx, params)
@@ -67,14 +67,14 @@ func (s *Handler) ListGateways(ctx context.Context, req *api.ListGatewaysRequest
 		apiGws = append(apiGws, apiGateway)
 	}
 
-	return &api.ListGatewaysResponse{
+	return api.ListGatewaysResponse_builder{
 		Gateways: apiGws,
-	}, nil
+	}.Build(), nil
 }
 
 // RemoveGateway removes cluster gateway
 func (s *Handler) RemoveGateway(ctx context.Context, req *api.RemoveGatewayRequest) (*api.EmptyResponse, error) {
-	if err := s.DaemonService.RemoveGateway(req.GatewayUri); err != nil {
+	if err := s.DaemonService.RemoveGateway(req.GetGatewayUri()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -87,7 +87,7 @@ func (s *Handler) newAPIGateway(ctx context.Context, gateway gateway.Gateway) (*
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.Gateway{
+	return api.Gateway_builder{
 		Uri:                   gateway.URI().String(),
 		TargetUri:             gateway.TargetURI().String(),
 		TargetName:            gateway.TargetName(),
@@ -97,7 +97,7 @@ func (s *Handler) newAPIGateway(ctx context.Context, gateway gateway.Gateway) (*
 		LocalAddress:          gateway.LocalAddress(),
 		LocalPort:             gateway.LocalPort(),
 		GatewayCliCommand:     makeGatewayCLICommand(cmds),
-	}, nil
+	}.Build(), nil
 }
 
 func makeGatewayCLICommand(cmds cmd.Cmds) *api.GatewayCLICommand {
@@ -106,12 +106,12 @@ func makeGatewayCLICommand(cmds cmd.Cmds) *api.GatewayCLICommand {
 			strings.Join(cmds.Preview.Env, " "),
 			strings.Join(cmds.Preview.Args, " ")))
 
-	return &api.GatewayCLICommand{
+	return api.GatewayCLICommand_builder{
 		Path:    cmds.Exec.Path,
 		Args:    cmds.Exec.Args,
 		Env:     cmds.Exec.Env,
 		Preview: preview,
-	}
+	}.Build()
 }
 
 // SetGatewayTargetSubresourceName changes the TargetSubresourceName field of gateway.Gateway
@@ -119,7 +119,7 @@ func makeGatewayCLICommand(cmds cmd.Cmds) *api.GatewayCLICommand {
 //
 // In Connect this is used to update the db name of a db connection along with the CLI command.
 func (s *Handler) SetGatewayTargetSubresourceName(ctx context.Context, req *api.SetGatewayTargetSubresourceNameRequest) (*api.Gateway, error) {
-	gateway, err := s.DaemonService.SetGatewayTargetSubresourceName(ctx, req.GatewayUri, req.TargetSubresourceName)
+	gateway, err := s.DaemonService.SetGatewayTargetSubresourceName(ctx, req.GetGatewayUri(), req.GetTargetSubresourceName())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -134,7 +134,7 @@ func (s *Handler) SetGatewayTargetSubresourceName(ctx context.Context, req *api.
 
 // SetGatewayLocalPort restarts the gateway under the new port without fetching new certs.
 func (s *Handler) SetGatewayLocalPort(ctx context.Context, req *api.SetGatewayLocalPortRequest) (*api.Gateway, error) {
-	gateway, err := s.DaemonService.SetGatewayLocalPort(req.GatewayUri, req.LocalPort)
+	gateway, err := s.DaemonService.SetGatewayLocalPort(req.GetGatewayUri(), req.GetLocalPort())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/teleterm/apiserver/handler/handler_gateways_test.go b/lib/teleterm/apiserver/handler/handler_gateways_test.go
index bf93a1c5bed..ef93674f0f6 100644
--- a/lib/teleterm/apiserver/handler/handler_gateways_test.go
+++ b/lib/teleterm/apiserver/handler/handler_gateways_test.go
@@ -46,10 +46,10 @@ func Test_makeGatewayCLICommand(t *testing.T) {
 
 	gatewayCmd := makeGatewayCLICommand(cmd.Cmds{Exec: command, Preview: command})
 
-	require.Equal(t, &api.GatewayCLICommand{
+	require.Equal(t, api.GatewayCLICommand_builder{
 		Path:    absPath,
 		Args:    []string{"test-binary", "arg1", "arg2"},
 		Env:     []string{"FOO=bar"},
 		Preview: "FOO=bar test-binary arg1 arg2",
-	}, gatewayCmd)
+	}.Build(), gatewayCmd)
 }
diff --git a/lib/teleterm/apiserver/handler/handler_headless.go b/lib/teleterm/apiserver/handler/handler_headless.go
index a884474782e..91c7df13c27 100644
--- a/lib/teleterm/apiserver/handler/handler_headless.go
+++ b/lib/teleterm/apiserver/handler/handler_headless.go
@@ -28,7 +28,7 @@ import (
 
 // UpdateHeadlessAuthenticationState logs in a user to a cluster
 func (s *Handler) UpdateHeadlessAuthenticationState(ctx context.Context, req *api.UpdateHeadlessAuthenticationStateRequest) (*api.UpdateHeadlessAuthenticationStateResponse, error) {
-	if err := s.DaemonService.UpdateHeadlessAuthenticationState(ctx, req.RootClusterUri, req.HeadlessAuthenticationId, req.State); err != nil {
+	if err := s.DaemonService.UpdateHeadlessAuthenticationState(ctx, req.GetRootClusterUri(), req.GetHeadlessAuthenticationId(), req.GetState()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/teleterm/apiserver/handler/handler_kubes.go b/lib/teleterm/apiserver/handler/handler_kubes.go
index 6c7700d7844..e8c8de158b9 100644
--- a/lib/teleterm/apiserver/handler/handler_kubes.go
+++ b/lib/teleterm/apiserver/handler/handler_kubes.go
@@ -50,7 +50,7 @@ func (s *Handler) ListKubernetesResources(ctx context.Context, req *api.ListKube
 		if !ok {
 			return nil, trace.BadParameter("expected resource type %T, got %T", types.KubernetesResourceV1{}, resource)
 		}
-		response.Resources = append(response.Resources, newApiKubeResource(kubeResource, req.GetKubernetesCluster(), clusterURI))
+		response.SetResources(append(response.GetResources(), newApiKubeResource(kubeResource, req.GetKubernetesCluster(), clusterURI)))
 	}
 
 	return response, nil
@@ -62,11 +62,11 @@ func (s *Handler) ListKubernetesServers(ctx context.Context, req *api.ListKubern
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	response := &api.ListKubernetesServersResponse{
+	response := api.ListKubernetesServersResponse_builder{
 		NextPageToken: resp.NextKey,
-	}
+	}.Build()
 	for _, server := range resp.Servers {
-		response.Resources = append(response.Resources, newAPIKubeServer(server))
+		response.SetResources(append(response.GetResources(), newAPIKubeServer(server)))
 	}
 	return response, nil
 }
@@ -76,40 +76,40 @@ func newAPIKube(kube clusters.Kube) *api.Kube {
 		ui.MakeLabelsWithoutInternalPrefixes(kube.KubernetesCluster.GetAllLabels()),
 	)
 
-	return &api.Kube{
+	return api.Kube_builder{
 		Name:   kube.KubernetesCluster.GetName(),
 		Uri:    kube.URI.String(),
 		Labels: apiLabels,
-		TargetHealth: &api.TargetHealth{
+		TargetHealth: api.TargetHealth_builder{
 			Status:  kube.TargetHealth.Status,
 			Error:   kube.TargetHealth.TransitionError,
 			Message: kube.TargetHealth.Message,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func newApiKubeResource(resource *types.KubernetesResourceV1, kubeCluster string, resourceURI uri.ResourceURI) *api.KubeResource {
 	apiLabels := makeAPILabels(ui.MakeLabelsWithoutInternalPrefixes(resource.GetStaticLabels()))
 
-	return &api.KubeResource{
+	return api.KubeResource_builder{
 		Uri:       resourceURI.AppendKube(kubeCluster).AppendKubeResourceNamespace(resource.GetName()).String(),
 		Kind:      resource.GetKind(),
 		Name:      resource.GetName(),
 		Labels:    apiLabels,
 		Namespace: resource.Spec.Namespace,
 		Cluster:   kubeCluster,
-	}
+	}.Build()
 }
 
 func newAPIKubeServer(server clusters.KubeServer) *api.KubeServer {
-	return &api.KubeServer{
+	return api.KubeServer_builder{
 		Uri:      server.URI.String(),
 		Hostname: server.GetHostname(),
 		HostId:   server.GetHostID(),
-		TargetHealth: &api.TargetHealth{
+		TargetHealth: api.TargetHealth_builder{
 			Status:  server.GetTargetHealth().Status,
 			Error:   server.GetTargetHealth().TransitionError,
 			Message: server.GetTargetHealth().Message,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/lib/teleterm/apiserver/handler/handler_tshd_events.go b/lib/teleterm/apiserver/handler/handler_tshd_events.go
index 0c95dbda120..da49fbd008f 100644
--- a/lib/teleterm/apiserver/handler/handler_tshd_events.go
+++ b/lib/teleterm/apiserver/handler/handler_tshd_events.go
@@ -27,7 +27,7 @@ import (
 )
 
 func (h *Handler) UpdateTshdEventsServerAddress(ctx context.Context, req *api.UpdateTshdEventsServerAddressRequest) (*api.UpdateTshdEventsServerAddressResponse, error) {
-	if err := h.DaemonService.UpdateAndDialTshdEventsServerAddress(req.Address); err != nil {
+	if err := h.DaemonService.UpdateAndDialTshdEventsServerAddress(req.GetAddress()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/teleterm/apiserver/handler/handler_unified_resources.go b/lib/teleterm/apiserver/handler/handler_unified_resources.go
index e2dbb53cf2e..24c3a4be22c 100644
--- a/lib/teleterm/apiserver/handler/handler_unified_resources.go
+++ b/lib/teleterm/apiserver/handler/handler_unified_resources.go
@@ -40,8 +40,8 @@ func (s *Handler) ListUnifiedResources(ctx context.Context, req *api.ListUnified
 
 	sortBy := types.SortBy{}
 	if req.GetSortBy() != nil {
-		sortBy.IsDesc = req.GetSortBy().IsDesc
-		sortBy.Field = req.GetSortBy().Field
+		sortBy.IsDesc = req.GetSortBy().GetIsDesc()
+		sortBy.Field = req.GetSortBy().GetField()
 	}
 
 	daemonResponse, err := s.DaemonService.ListUnifiedResources(ctx, clusterURI, &proto.ListUnifiedResourcesRequest{
@@ -65,52 +65,52 @@ func (s *Handler) ListUnifiedResources(ctx context.Context, req *api.ListUnified
 
 	for _, resource := range daemonResponse.Resources {
 		if resource.Server != nil {
-			response.Resources = append(response.Resources, &api.PaginatedResource{
+			response.SetResources(append(response.GetResources(), &api.PaginatedResource{
 				Resource: &api.PaginatedResource_Server{
 					Server: newAPIServer(*resource.Server),
 				},
 				RequiresRequest: resource.RequiresRequest,
-			})
+			}))
 		}
 		if resource.Database != nil {
-			response.Resources = append(response.Resources, &api.PaginatedResource{
+			response.SetResources(append(response.GetResources(), &api.PaginatedResource{
 				Resource: &api.PaginatedResource_Database{
 					Database: newAPIDatabase(*resource.Database),
 				},
 				RequiresRequest: resource.RequiresRequest,
-			})
+			}))
 		}
 		if resource.Kube != nil {
-			response.Resources = append(response.Resources, &api.PaginatedResource{
+			response.SetResources(append(response.GetResources(), &api.PaginatedResource{
 				Resource: &api.PaginatedResource_Kube{
 					Kube: newAPIKube(*resource.Kube),
 				},
 				RequiresRequest: resource.RequiresRequest,
-			})
+			}))
 		}
 		if resource.App != nil {
-			response.Resources = append(response.Resources, &api.PaginatedResource{
+			response.SetResources(append(response.GetResources(), &api.PaginatedResource{
 				Resource: &api.PaginatedResource_App{
 					App: newAPIApp(*resource.App),
 				},
 				RequiresRequest: resource.RequiresRequest,
-			})
+			}))
 		}
 		if resource.SAMLIdPServiceProvider != nil {
-			response.Resources = append(response.Resources, &api.PaginatedResource{
+			response.SetResources(append(response.GetResources(), &api.PaginatedResource{
 				Resource: &api.PaginatedResource_App{
 					App: newSAMLIdPServiceProviderAPIApp(*resource.SAMLIdPServiceProvider),
 				},
 				RequiresRequest: resource.RequiresRequest,
-			})
+			}))
 		}
 		if resource.WindowsDesktop != nil {
-			response.Resources = append(response.Resources, &api.PaginatedResource{
+			response.SetResources(append(response.GetResources(), &api.PaginatedResource{
 				Resource: &api.PaginatedResource_WindowsDesktop{
 					WindowsDesktop: newAPIWindowsDesktop(*resource.WindowsDesktop),
 				},
 				RequiresRequest: resource.RequiresRequest,
-			})
+			}))
 		}
 	}
 
@@ -122,7 +122,7 @@ func newAPIServer(server clusters.Server) *api.Server {
 		ui.MakeLabelsWithoutInternalPrefixes(server.GetAllLabels()),
 	)
 
-	return &api.Server{
+	return api.Server_builder{
 		Uri:      server.URI.String(),
 		Tunnel:   server.GetUseTunnel(),
 		Name:     server.GetName(),
@@ -131,5 +131,5 @@ func newAPIServer(server clusters.Server) *api.Server {
 		SubKind:  server.GetSubKind(),
 		Labels:   apiLabels,
 		Logins:   server.Logins,
-	}
+	}.Build()
 }
diff --git a/lib/teleterm/apiserver/handler/handler_user_preferences.go b/lib/teleterm/apiserver/handler/handler_user_preferences.go
index 02c55440ed7..030fbd5abe7 100644
--- a/lib/teleterm/apiserver/handler/handler_user_preferences.go
+++ b/lib/teleterm/apiserver/handler/handler_user_preferences.go
@@ -36,7 +36,7 @@ func (s *Handler) GetUserPreferences(ctx context.Context, req *api.GetUserPrefer
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.GetUserPreferencesResponse{UserPreferences: preferences}, nil
+	return api.GetUserPreferencesResponse_builder{UserPreferences: preferences}.Build(), nil
 }
 
 func (s *Handler) UpdateUserPreferences(ctx context.Context, req *api.UpdateUserPreferencesRequest) (*api.UpdateUserPreferencesResponse, error) {
@@ -50,7 +50,7 @@ func (s *Handler) UpdateUserPreferences(ctx context.Context, req *api.UpdateUser
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.UpdateUserPreferencesResponse{
+	return api.UpdateUserPreferencesResponse_builder{
 		UserPreferences: updated,
-	}, nil
+	}.Build(), nil
 }
diff --git a/lib/teleterm/autoupdate/service.go b/lib/teleterm/autoupdate/service.go
index 9177419c5e8..e9dc7f691fe 100644
--- a/lib/teleterm/autoupdate/service.go
+++ b/lib/teleterm/autoupdate/service.go
@@ -104,31 +104,31 @@ func (s *Service) GetClusterVersions(ctx context.Context, _ *api.GetClusterVersi
 			ping, pingErr := s.pingCluster(groupCtx, cluster)
 			if pingErr != nil {
 				mu.Lock()
-				unreachableClusters = append(unreachableClusters, &api.UnreachableCluster{
+				unreachableClusters = append(unreachableClusters, api.UnreachableCluster_builder{
 					ClusterUri:   cluster.URI.String(),
 					ErrorMessage: pingErr.Error(),
-				})
+				}.Build())
 				mu.Unlock()
 				return nil
 			}
 
 			mu.Lock()
-			reachableClusters = append(reachableClusters, &api.ClusterVersionInfo{
+			reachableClusters = append(reachableClusters, api.ClusterVersionInfo_builder{
 				ClusterUri:      cluster.URI.String(),
 				ToolsAutoUpdate: ping.AutoUpdate.ToolsAutoUpdate,
 				ToolsVersion:    ping.AutoUpdate.ToolsVersion,
 				MinToolsVersion: ping.MinClientVersion,
-			})
+			}.Build())
 			mu.Unlock()
 			return nil
 		})
 	}
 
 	err = group.Wait()
-	return &api.GetClusterVersionsResponse{
+	return api.GetClusterVersionsResponse_builder{
 		ReachableClusters:   reachableClusters,
 		UnreachableClusters: unreachableClusters,
-	}, trace.Wrap(err)
+	}.Build(), trace.Wrap(err)
 }
 
 func (s *Service) pingCluster(ctx context.Context, cluster *clusters.Cluster) (*webclient.PingResponse, error) {
@@ -148,8 +148,8 @@ func (s *Service) GetConfig(_ context.Context, _ *api.GetConfigRequest) (*api.Ge
 		return nil, trace.Wrap(err)
 	}
 
-	toolsVersionValue := strings.TrimSpace(config.GetToolsVersion().Value)
-	toolsVersionSource := config.GetToolsVersion().Source
+	toolsVersionValue := strings.TrimSpace(config.GetToolsVersion().GetValue())
+	toolsVersionSource := config.GetToolsVersion().GetSource()
 	switch toolsVersionValue {
 	case "":
 		toolsVersionSource = api.ConfigSource_CONFIG_SOURCE_UNSPECIFIED
@@ -161,8 +161,8 @@ func (s *Service) GetConfig(_ context.Context, _ *api.GetConfigRequest) (*api.Ge
 		}
 	}
 
-	cdnBaseUrlValue := strings.TrimSpace(config.GetCdnBaseUrl().Value)
-	cdnBaseUrlSource := config.GetCdnBaseUrl().Source
+	cdnBaseUrlValue := strings.TrimSpace(config.GetCdnBaseUrl().GetValue())
+	cdnBaseUrlSource := config.GetCdnBaseUrl().GetSource()
 	if cdnBaseUrlValue == "" {
 		cdnBaseUrlSource = api.ConfigSource_CONFIG_SOURCE_UNSPECIFIED
 	} else {
@@ -177,10 +177,10 @@ func (s *Service) GetConfig(_ context.Context, _ *api.GetConfigRequest) (*api.Ge
 		cdnBaseUrlSource = api.ConfigSource_CONFIG_SOURCE_DEFAULT
 	}
 
-	return &api.GetConfigResponse{
-		ToolsVersion: &api.ConfigValue{Value: toolsVersionValue, Source: toolsVersionSource},
-		CdnBaseUrl:   &api.ConfigValue{Value: cdnBaseUrlValue, Source: cdnBaseUrlSource},
-	}, nil
+	return api.GetConfigResponse_builder{
+		ToolsVersion: api.ConfigValue_builder{Value: toolsVersionValue, Source: toolsVersionSource}.Build(),
+		CdnBaseUrl:   api.ConfigValue_builder{Value: cdnBaseUrlValue, Source: cdnBaseUrlSource}.Build(),
+	}.Build(), nil
 }
 
 func validateURL(raw string) error {
@@ -201,14 +201,14 @@ func readConfigFromEnvVars() (*api.GetConfigResponse, error) {
 	envBaseURL := os.Getenv(autoupdate.BaseURLEnvVar)
 	envTeleportToolsVersion := os.Getenv(forwardedTeleportToolsEnvVar)
 
-	return &api.GetConfigResponse{
-		CdnBaseUrl: &api.ConfigValue{
+	return api.GetConfigResponse_builder{
+		CdnBaseUrl: api.ConfigValue_builder{
 			Value:  envBaseURL,
 			Source: api.ConfigSource_CONFIG_SOURCE_ENV_VAR,
-		},
-		ToolsVersion: &api.ConfigValue{
+		}.Build(),
+		ToolsVersion: api.ConfigValue_builder{
 			Value:  envTeleportToolsVersion,
 			Source: api.ConfigSource_CONFIG_SOURCE_ENV_VAR,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
diff --git a/lib/teleterm/clusters/cluster.go b/lib/teleterm/clusters/cluster.go
index dee36e6963e..bd83917250c 100644
--- a/lib/teleterm/clusters/cluster.go
+++ b/lib/teleterm/clusters/cluster.go
@@ -198,7 +198,7 @@ func (c *Cluster) GetWithDetails(ctx context.Context, authClient authclient.Clie
 
 	roleSet := services.NewRoleSet(roles...)
 	userACL := services.NewUserACL(user, roleSet, *authPingResponse.ServerFeatures, false, false)
-	acl := &api.ACL{
+	acl := api.ACL_builder{
 		RecordedSessions:        convertToAPIResourceAccess(userACL.RecordedSessions),
 		ActiveSessions:          convertToAPIResourceAccess(userACL.ActiveSessions),
 		AuthConnectors:          convertToAPIResourceAccess(userACL.AuthConnectors),
@@ -215,7 +215,7 @@ func (c *Cluster) GetWithDetails(ctx context.Context, authClient authclient.Clie
 		ReviewRequests:          userACL.ReviewRequests,
 		DirectorySharingEnabled: userACL.DirectorySharing,
 		ClipboardSharingEnabled: userACL.Clipboard,
-	}
+	}.Build()
 
 	withDetails := &ClusterWithDetails{
 		Cluster:                  c,
@@ -234,14 +234,14 @@ func (c *Cluster) GetWithDetails(ctx context.Context, authClient authclient.Clie
 }
 
 func convertToAPIResourceAccess(access services.ResourceAccess) *api.ResourceAccess {
-	return &api.ResourceAccess{
+	return api.ResourceAccess_builder{
 		List:   access.List,
 		Read:   access.Read,
 		Edit:   access.Edit,
 		Create: access.Create,
 		Delete: access.Delete,
 		Use:    access.Use,
-	}
+	}.Build()
 }
 
 // GetRoles returns currently logged-in user roles
@@ -286,10 +286,10 @@ func (c *Cluster) GetRequestableRoles(ctx context.Context, req *api.GetRequestab
 	resourceIds := make([]types.ResourceID, 0, len(req.GetResourceIds()))
 	for _, r := range req.GetResourceIds() {
 		resourceIds = append(resourceIds, types.ResourceID{
-			ClusterName:     r.ClusterName,
-			Kind:            r.Kind,
-			Name:            r.Name,
-			SubResourceName: r.SubResourceName,
+			ClusterName:     r.GetClusterName(),
+			Kind:            r.GetKind(),
+			Name:            r.GetName(),
+			SubResourceName: r.GetSubResourceName(),
 		})
 	}
 
diff --git a/lib/teleterm/clusters/cluster_access_requests.go b/lib/teleterm/clusters/cluster_access_requests.go
index e8831d85229..5dc0969ecd4 100644
--- a/lib/teleterm/clusters/cluster_access_requests.go
+++ b/lib/teleterm/clusters/cluster_access_requests.go
@@ -113,38 +113,38 @@ func (c *Cluster) CreateAccessRequest(ctx context.Context, rootAuthClient authcl
 		request types.AccessRequest
 	)
 
-	resourceIDs := make([]types.ResourceID, 0, len(req.ResourceIds))
-	for _, resource := range req.ResourceIds {
+	resourceIDs := make([]types.ResourceID, 0, len(req.GetResourceIds()))
+	for _, resource := range req.GetResourceIds() {
 		resourceIDs = append(resourceIDs, types.ResourceID{
-			ClusterName:     resource.ClusterName,
-			Name:            resource.Name,
-			Kind:            resource.Kind,
-			SubResourceName: resource.SubResourceName,
+			ClusterName:     resource.GetClusterName(),
+			Name:            resource.GetName(),
+			Kind:            resource.GetKind(),
+			SubResourceName: resource.GetSubResourceName(),
 		})
 	}
 
 	// Role-based and Resource-based AccessRequests are mutually exclusive.
-	if len(req.ResourceIds) > 0 {
-		request, err = services.NewAccessRequestWithResources(c.status.Username, req.Roles, types.ResourceIDsToResourceAccessIDs(resourceIDs))
+	if len(req.GetResourceIds()) > 0 {
+		request, err = services.NewAccessRequestWithResources(c.status.Username, req.GetRoles(), types.ResourceIDsToResourceAccessIDs(resourceIDs))
 	} else {
-		request, err = services.NewAccessRequest(c.status.Username, req.Roles...)
+		request, err = services.NewAccessRequest(c.status.Username, req.GetRoles()...)
 	}
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	request.SetRequestReason(req.Reason)
-	request.SetSuggestedReviewers(req.SuggestedReviewers)
-	request.SetDryRun(req.DryRun)
+	request.SetRequestReason(req.GetReason())
+	request.SetSuggestedReviewers(req.GetSuggestedReviewers())
+	request.SetDryRun(req.GetDryRun())
 
-	if req.MaxDuration != nil {
-		request.SetMaxDuration(req.MaxDuration.AsTime())
+	if req.HasMaxDuration() {
+		request.SetMaxDuration(req.GetMaxDuration().AsTime())
 	}
-	if req.RequestTtl != nil {
-		request.SetExpiry(req.RequestTtl.AsTime())
+	if req.HasRequestTtl() {
+		request.SetExpiry(req.GetRequestTtl().AsTime())
 	}
 	if req.GetAssumeStartTime() != nil {
-		request.SetAssumeStartTime(req.AssumeStartTime.AsTime())
+		request.SetAssumeStartTime(req.GetAssumeStartTime().AsTime())
 	}
 
 	var reqOut types.AccessRequest
@@ -169,23 +169,23 @@ func (c *Cluster) ReviewAccessRequest(ctx context.Context, rootAuthClient authcl
 	)
 
 	var reviewState types.RequestState
-	if err := reviewState.Parse(req.State); err != nil {
+	if err := reviewState.Parse(req.GetState()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	err = AddMetadataToRetryableError(ctx, func() error {
 		var assumeStartTimePtr *time.Time
-		if req.AssumeStartTime != nil {
-			assumeStartTime := req.AssumeStartTime.AsTime()
+		if req.HasAssumeStartTime() {
+			assumeStartTime := req.GetAssumeStartTime().AsTime()
 			assumeStartTimePtr = &assumeStartTime
 		}
 
 		reviewSubmission := types.AccessReviewSubmission{
-			RequestID: req.AccessRequestId,
+			RequestID: req.GetAccessRequestId(),
 			Review: types.AccessReview{
-				Roles:           req.Roles,
+				Roles:           req.GetRoles(),
 				ProposedState:   reviewState,
-				Reason:          req.Reason,
+				Reason:          req.GetReason(),
 				Created:         time.Now(),
 				AssumeStartTime: assumeStartTimePtr,
 			},
@@ -207,7 +207,7 @@ func (c *Cluster) ReviewAccessRequest(ctx context.Context, rootAuthClient authcl
 
 func (c *Cluster) DeleteAccessRequest(ctx context.Context, rootAuthClient authclient.ClientI, req *api.DeleteAccessRequestRequest) error {
 	err := AddMetadataToRetryableError(ctx, func() error {
-		return rootAuthClient.DeleteAccessRequest(ctx, req.AccessRequestId)
+		return rootAuthClient.DeleteAccessRequest(ctx, req.GetAccessRequestId())
 	})
 	return trace.Wrap(err)
 }
@@ -215,14 +215,14 @@ func (c *Cluster) DeleteAccessRequest(ctx context.Context, rootAuthClient authcl
 func (c *Cluster) AssumeRole(ctx context.Context, rootClient *client.ClusterClient, req *api.AssumeRoleRequest) error {
 	err := AddMetadataToRetryableError(ctx, func() error {
 		params := client.ReissueParams{
-			AccessRequests:     req.AccessRequestIds,
-			DropAccessRequests: req.DropRequestIds,
+			AccessRequests:     req.GetAccessRequestIds(),
+			DropAccessRequests: req.GetDropRequestIds(),
 			RouteToCluster:     c.clusterClient.SiteName,
 		}
 
 		// keep existing access requests that aren't included in the droprequests
 		for _, reqID := range c.status.ActiveRequests {
-			if !slices.Contains(req.DropRequestIds, reqID) {
+			if !slices.Contains(req.GetDropRequestIds(), reqID) {
 				params.AccessRequests = append(params.AccessRequests, reqID)
 			}
 		}
diff --git a/lib/teleterm/clusters/cluster_auth.go b/lib/teleterm/clusters/cluster_auth.go
index fcbba714b00..3396d90d43d 100644
--- a/lib/teleterm/clusters/cluster_auth.go
+++ b/lib/teleterm/clusters/cluster_auth.go
@@ -246,9 +246,9 @@ func newPwdlessLoginPrompt(ctx context.Context, log *slog.Logger, stream api.Ter
 
 // PromptPIN prompts the user for a PIN.
 func (p *pwdlessLoginPrompt) PromptPIN() (string, error) {
-	if err := p.Stream.Send(&api.LoginPasswordlessResponse{
+	if err := p.Stream.Send(api.LoginPasswordlessResponse_builder{
 		Prompt: api.PasswordlessPrompt_PASSWORDLESS_PROMPT_PIN,
-	}); err != nil {
+	}.Build()); err != nil {
 		return "", trace.Wrap(err)
 	}
 
@@ -267,7 +267,7 @@ func (p *pwdlessLoginPrompt) PromptPIN() (string, error) {
 
 // PromptTouch prompts the user for a security key touch.
 func (p *pwdlessLoginPrompt) PromptTouch() (wancli.TouchAcknowledger, error) {
-	return p.ackTouch, trace.Wrap(p.Stream.Send(&api.LoginPasswordlessResponse{Prompt: api.PasswordlessPrompt_PASSWORDLESS_PROMPT_TAP}))
+	return p.ackTouch, trace.Wrap(p.Stream.Send(api.LoginPasswordlessResponse_builder{Prompt: api.PasswordlessPrompt_PASSWORDLESS_PROMPT_TAP}.Build()))
 }
 
 func (p *pwdlessLoginPrompt) ackTouch() error {
@@ -298,15 +298,15 @@ func (p *pwdlessLoginPrompt) PromptCredential(deviceCreds []*wancli.CredentialIn
 	// Convert to grpc message.
 	creds := make([]*api.CredentialInfo, len(deviceCreds))
 	for i, cred := range deviceCreds {
-		creds[i] = &api.CredentialInfo{
+		creds[i] = api.CredentialInfo_builder{
 			Username: cred.User.Name,
-		}
+		}.Build()
 	}
 
-	if err := p.Stream.Send(&api.LoginPasswordlessResponse{
+	if err := p.Stream.Send(api.LoginPasswordlessResponse_builder{
 		Prompt:      api.PasswordlessPrompt_PASSWORDLESS_PROMPT_CREDENTIAL,
 		Credentials: creds,
-	}); err != nil {
+	}.Build()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
diff --git a/lib/teleterm/clusters/cluster_auth_test.go b/lib/teleterm/clusters/cluster_auth_test.go
index 36165f053c1..6be377f9b6f 100644
--- a/lib/teleterm/clusters/cluster_auth_test.go
+++ b/lib/teleterm/clusters/cluster_auth_test.go
@@ -36,14 +36,12 @@ func TestPwdlessLoginPrompt_PromptPIN(t *testing.T) {
 
 	// Test valid pin.
 	stream.assertResp = func(res *api.LoginPasswordlessResponse) error {
-		require.Equal(t, api.PasswordlessPrompt_PASSWORDLESS_PROMPT_PIN, res.Prompt)
+		require.Equal(t, api.PasswordlessPrompt_PASSWORDLESS_PROMPT_PIN, res.GetPrompt())
 		return nil
 	}
 	stream.serverReq = func() (*api.LoginPasswordlessRequest, error) {
-		return &api.LoginPasswordlessRequest{Request: &api.LoginPasswordlessRequest_Pin{
-			Pin: &api.LoginPasswordlessRequest_LoginPasswordlessPINResponse{
-				Pin: "1234"},
-		}}, nil
+		return api.LoginPasswordlessRequest_builder{Pin: api.LoginPasswordlessRequest_LoginPasswordlessPINResponse_builder{
+			Pin: "1234"}.Build()}.Build(), nil
 	}
 
 	prompt := newPwdlessLoginPrompt(context.Background(), slog.Default(), stream)
@@ -53,10 +51,8 @@ func TestPwdlessLoginPrompt_PromptPIN(t *testing.T) {
 
 	// Test invalid pin.
 	stream.serverReq = func() (*api.LoginPasswordlessRequest, error) {
-		return &api.LoginPasswordlessRequest{Request: &api.LoginPasswordlessRequest_Pin{
-			Pin: &api.LoginPasswordlessRequest_LoginPasswordlessPINResponse{
-				Pin: ""},
-		}}, nil
+		return api.LoginPasswordlessRequest_builder{Pin: api.LoginPasswordlessRequest_LoginPasswordlessPINResponse_builder{
+			Pin: ""}.Build()}.Build(), nil
 	}
 
 	_, err = prompt.PromptPIN()
@@ -67,7 +63,7 @@ func TestPwdlessLoginPrompt_PromptTouch(t *testing.T) {
 	stream := &mockLoginPwdlessStream{}
 
 	stream.assertResp = func(res *api.LoginPasswordlessResponse) error {
-		require.Equal(t, api.PasswordlessPrompt_PASSWORDLESS_PROMPT_TAP, res.Prompt)
+		require.Equal(t, api.PasswordlessPrompt_PASSWORDLESS_PROMPT_TAP, res.GetPrompt())
 		return nil
 	}
 
@@ -88,23 +84,21 @@ func TestPwdlessLoginPrompt_PromptCredential(t *testing.T) {
 	}
 
 	expectedCredResponse := []*api.CredentialInfo{
-		{Username: "ape"},
-		{Username: "bar"},
-		{Username: "foo"},
-		{Username: "llama"},
+		api.CredentialInfo_builder{Username: "ape"}.Build(),
+		api.CredentialInfo_builder{Username: "bar"}.Build(),
+		api.CredentialInfo_builder{Username: "foo"}.Build(),
+		api.CredentialInfo_builder{Username: "llama"}.Build(),
 	}
 
 	// Test valid index.
 	stream.assertResp = func(res *api.LoginPasswordlessResponse) error {
-		require.Equal(t, api.PasswordlessPrompt_PASSWORDLESS_PROMPT_CREDENTIAL, res.Prompt)
+		require.Equal(t, api.PasswordlessPrompt_PASSWORDLESS_PROMPT_CREDENTIAL, res.GetPrompt())
 		require.Equal(t, expectedCredResponse, res.GetCredentials())
 		return nil
 	}
 	stream.serverReq = func() (*api.LoginPasswordlessRequest, error) {
-		return &api.LoginPasswordlessRequest{Request: &api.LoginPasswordlessRequest_Credential{
-			Credential: &api.LoginPasswordlessRequest_LoginPasswordlessCredentialResponse{
-				Index: 2},
-		}}, nil
+		return api.LoginPasswordlessRequest_builder{Credential: api.LoginPasswordlessRequest_LoginPasswordlessCredentialResponse_builder{
+			Index: 2}.Build()}.Build(), nil
 	}
 
 	prompt := newPwdlessLoginPrompt(context.Background(), slog.Default(), stream)
@@ -114,10 +108,8 @@ func TestPwdlessLoginPrompt_PromptCredential(t *testing.T) {
 
 	// Test invalid index.
 	stream.serverReq = func() (*api.LoginPasswordlessRequest, error) {
-		return &api.LoginPasswordlessRequest{Request: &api.LoginPasswordlessRequest_Credential{
-			Credential: &api.LoginPasswordlessRequest_LoginPasswordlessCredentialResponse{
-				Index: 4},
-		}}, nil
+		return api.LoginPasswordlessRequest_builder{Credential: api.LoginPasswordlessRequest_LoginPasswordlessCredentialResponse_builder{
+			Index: 4}.Build()}.Build(), nil
 	}
 	_, err = prompt.PromptCredential(unsortedCreds)
 	require.True(t, trace.IsBadParameter(err))
diff --git a/lib/teleterm/clusters/cluster_file_transfer.go b/lib/teleterm/clusters/cluster_file_transfer.go
index a6a88de075c..e09e9780c57 100644
--- a/lib/teleterm/clusters/cluster_file_transfer.go
+++ b/lib/teleterm/clusters/cluster_file_transfer.go
@@ -51,7 +51,7 @@ func (c *Cluster) TransferFile(ctx context.Context, clt *client.ClusterClient, r
 			nodeClient, err := c.clusterClient.ConnectToNode(ctx, clt, client.NodeDetails{
 				Addr:    addr,
 				Cluster: c.Name,
-			}, request.Login)
+			}, request.GetLogin())
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -125,7 +125,7 @@ func (p *fileTransferProgress) maybeUpdateProgress(bytes []byte) (int, error) {
 	percentage := uint32(p.sentSize * 100 / p.fileSize)
 
 	if p.shouldSendProgress(percentage) {
-		err := p.sendProgress(&api.FileTransferProgress{Percentage: percentage})
+		err := p.sendProgress(api.FileTransferProgress_builder{Percentage: percentage}.Build())
 		if err != nil {
 			return bytesLength, trace.Wrap(err)
 		}
diff --git a/lib/teleterm/clusters/cluster_resources.go b/lib/teleterm/clusters/cluster_resources.go
index b9eff3a05c4..f72d09e9918 100644
--- a/lib/teleterm/clusters/cluster_resources.go
+++ b/lib/teleterm/clusters/cluster_resources.go
@@ -42,10 +42,10 @@ func listResources[T types.ResourceWithLabels](ctx context.Context, params *api.
 
 	req := &proto.ListResourcesRequest{
 		ResourceType:        resourceKind,
-		Limit:               params.Limit,
-		StartKey:            params.StartKey,
-		PredicateExpression: params.PredicateExpression,
-		UseSearchAsRoles:    params.UseSearchAsRoles,
+		Limit:               params.GetLimit(),
+		StartKey:            params.GetStartKey(),
+		PredicateExpression: params.GetPredicateExpression(),
+		UseSearchAsRoles:    params.GetUseSearchAsRoles(),
 	}
 
 	err = AddMetadataToRetryableError(ctx, func() error {
diff --git a/lib/teleterm/daemon/daemon.go b/lib/teleterm/daemon/daemon.go
index 92c37737998..db6f9d810cd 100644
--- a/lib/teleterm/daemon/daemon.go
+++ b/lib/teleterm/daemon/daemon.go
@@ -425,15 +425,13 @@ func (s *Service) createGateway(ctx context.Context, params CreateGatewayParams)
 // reissueGatewayCerts tries to reissue gateway certs. It handles asking the user to relogin and
 // per-session MFA checks.
 func (s *Service) reissueGatewayCerts(ctx context.Context, g gateway.Gateway) (tls.Certificate, error) {
-	reloginReq := &api.ReloginRequest{
+	reloginReq := api.ReloginRequest_builder{
 		RootClusterUri: g.TargetURI().GetRootClusterURI().String(),
-		Reason: &api.ReloginRequest_GatewayCertExpired{
-			GatewayCertExpired: &api.GatewayCertExpired{
-				GatewayUri: g.URI().String(),
-				TargetUri:  g.TargetURI().String(),
-			},
-		},
-	}
+		GatewayCertExpired: api.GatewayCertExpired_builder{
+			GatewayUri: g.URI().String(),
+			TargetUri:  g.TargetURI().String(),
+		}.Build(),
+	}.Build()
 
 	var cert tls.Certificate
 
@@ -462,15 +460,13 @@ func (s *Service) reissueGatewayCerts(ctx context.Context, g gateway.Gateway) (t
 	// example, if you execute `tsh ssh` within Connect after your user cert expires or there are two
 	// gateways that subsequently go through this flow.
 	if err := s.RetryWithRelogin(ctx, reloginReq, reissueGatewayCerts); err != nil {
-		notifyErr := s.NotifyApp(ctx, &api.SendNotificationRequest{
-			Subject: &api.SendNotificationRequest_CannotProxyGatewayConnection{
-				CannotProxyGatewayConnection: &api.CannotProxyGatewayConnection{
-					GatewayUri: g.URI().String(),
-					TargetUri:  g.TargetURI().String(),
-					Error:      err.Error(),
-				},
-			},
-		})
+		notifyErr := s.NotifyApp(ctx, api.SendNotificationRequest_builder{
+			CannotProxyGatewayConnection: api.CannotProxyGatewayConnection_builder{
+				GatewayUri: g.URI().String(),
+				TargetUri:  g.TargetURI().String(),
+				Error:      err.Error(),
+			}.Build(),
+		}.Build())
 		if notifyErr != nil {
 			s.cfg.Logger.ErrorContext(ctx, "Failed to send a notification for an error encountered during gateway cert reissue", "error", notifyErr)
 		}
@@ -664,7 +660,7 @@ func (s *Service) SetGatewayLocalPort(gatewayURI, localPort string) (gateway.Gat
 }
 
 func (s *Service) GetRequestableRoles(ctx context.Context, req *api.GetRequestableRolesRequest) (*api.GetRequestableRolesResponse, error) {
-	cluster, _, err := s.ResolveCluster(req.ClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -679,10 +675,10 @@ func (s *Service) GetRequestableRoles(ctx context.Context, req *api.GetRequestab
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.GetRequestableRolesResponse{
+	return api.GetRequestableRolesResponse_builder{
 		Roles:           response.RequestableRoles,
 		ApplicableRoles: response.ApplicableRolesForResources,
-	}, nil
+	}.Build(), nil
 }
 
 // PromoteAccessRequest promotes an access request to an access list.
@@ -703,7 +699,7 @@ func (s *Service) PromoteAccessRequest(ctx context.Context, rootClusterURI uri.R
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		accessRequest := promoteResponse.AccessRequest
+		accessRequest := promoteResponse.GetAccessRequest()
 		response = &clusters.AccessRequest{
 			URI:           cluster.URI.AppendAccessRequest(accessRequest.GetName()),
 			AccessRequest: accessRequest,
@@ -738,7 +734,7 @@ func (s *Service) GetSuggestedAccessLists(ctx context.Context, rootClusterURI ur
 
 // GetAccessRequests returns all access requests with filtered input
 func (s *Service) GetAccessRequests(ctx context.Context, req *api.GetAccessRequestsRequest) ([]clusters.AccessRequest, error) {
-	cluster, _, err := s.ResolveCluster(req.ClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -758,11 +754,11 @@ func (s *Service) GetAccessRequests(ctx context.Context, req *api.GetAccessReque
 
 // GetAccessRequest returns AccessRequests filtered by ID
 func (s *Service) GetAccessRequest(ctx context.Context, req *api.GetAccessRequestRequest) (*clusters.AccessRequest, error) {
-	if req.AccessRequestId == "" {
+	if req.GetAccessRequestId() == "" {
 		return nil, trace.BadParameter("missing request id")
 	}
 
-	cluster, _, err := s.ResolveCluster(req.ClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -773,7 +769,7 @@ func (s *Service) GetAccessRequest(ctx context.Context, req *api.GetAccessReques
 	}
 
 	response, err := cluster.GetAccessRequest(ctx, proxyClient.CurrentCluster(), types.AccessRequestFilter{
-		ID: req.AccessRequestId,
+		ID: req.GetAccessRequestId(),
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
@@ -784,7 +780,7 @@ func (s *Service) GetAccessRequest(ctx context.Context, req *api.GetAccessReques
 
 // CreateAccessRequest creates an access request
 func (s *Service) CreateAccessRequest(ctx context.Context, req *api.CreateAccessRequestRequest) (*clusters.AccessRequest, error) {
-	cluster, _, err := s.ResolveCluster(req.RootClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetRootClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -803,7 +799,7 @@ func (s *Service) CreateAccessRequest(ctx context.Context, req *api.CreateAccess
 }
 
 func (s *Service) ReviewAccessRequest(ctx context.Context, req *api.ReviewAccessRequestRequest) (*clusters.AccessRequest, error) {
-	cluster, _, err := s.ResolveCluster(req.RootClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetRootClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -822,11 +818,11 @@ func (s *Service) ReviewAccessRequest(ctx context.Context, req *api.ReviewAccess
 }
 
 func (s *Service) DeleteAccessRequest(ctx context.Context, req *api.DeleteAccessRequestRequest) error {
-	if req.AccessRequestId == "" {
+	if req.GetAccessRequestId() == "" {
 		return trace.BadParameter("missing request id")
 	}
 
-	cluster, _, err := s.ResolveCluster(req.RootClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetRootClusterUri())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -840,7 +836,7 @@ func (s *Service) DeleteAccessRequest(ctx context.Context, req *api.DeleteAccess
 }
 
 func (s *Service) AssumeRole(ctx context.Context, req *api.AssumeRoleRequest) error {
-	cluster, _, err := s.ResolveCluster(req.RootClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetRootClusterUri())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -896,7 +892,7 @@ func (s *Service) ListKubernetesResources(ctx context.Context, clusterURI uri.Re
 			return trace.Wrap(err)
 		}
 
-		req := &kubeproto.ListKubernetesResourcesRequest{
+		req := kubeproto.ListKubernetesResourcesRequest_builder{
 			ResourceType:        req.GetResourceType(),
 			Limit:               req.GetLimit(),
 			StartKey:            req.GetNextKey(),
@@ -906,7 +902,7 @@ func (s *Service) ListKubernetesResources(ctx context.Context, clusterURI uri.Re
 			KubernetesCluster:   req.GetKubernetesCluster(),
 			KubernetesNamespace: req.GetKubernetesNamespace(),
 			TeleportCluster:     tc.SiteName,
-		}
+		}.Build()
 
 		resources, err = apiclient.GetKubernetesResourcesWithFilters(ctx, kubeServiceClient, req)
 		return trace.Wrap(err)
@@ -1038,7 +1034,7 @@ func (s *Service) TransferFile(ctx context.Context, request *api.FileTransferReq
 // teleport.dev/connect-my-computer/owner: <cluster user> and allows logging in to those nodes as
 // the current system user.
 func (s *Service) CreateConnectMyComputerRole(ctx context.Context, req *api.CreateConnectMyComputerRoleRequest) (*api.CreateConnectMyComputerRoleResponse, error) {
-	cluster, _, err := s.ResolveCluster(req.RootClusterUri)
+	cluster, _, err := s.ResolveCluster(req.GetRootClusterUri())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1054,7 +1050,7 @@ func (s *Service) CreateConnectMyComputerRole(ctx context.Context, req *api.Crea
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		response.CertsReloaded = result.CertsReloaded
+		response.SetCertsReloaded(result.CertsReloaded)
 		return nil
 	})
 
@@ -1110,7 +1106,7 @@ func (s *Service) GetConnectMyComputerNodeName(req *api.GetConnectMyComputerNode
 	}
 
 	uuid, err := s.cfg.ConnectMyComputerNodeName.Get(cluster)
-	return &api.GetConnectMyComputerNodeNameResponse{Name: uuid}, trace.Wrap(err)
+	return api.GetConnectMyComputerNodeNameResponse_builder{Name: uuid}.Build(), trace.Wrap(err)
 }
 
 // WaitForConnectMyComputerNodeJoin returns a response only after detecting that a Connect My
@@ -1237,19 +1233,19 @@ func (s *Service) AuthenticateWebDevice(ctx context.Context, rootClusterURI uri.
 	var confirmationToken *devicepb.DeviceConfirmationToken
 	err = clusters.AddMetadataToRetryableError(ctx, func() error {
 		ceremony := dtauthn.NewCeremony()
-		confirmationToken, err = ceremony.RunWeb(ctx, devicesClient, &devicepb.DeviceWebToken{
-			Id:    req.DeviceWebToken.Id,
-			Token: req.DeviceWebToken.Token,
-		})
+		confirmationToken, err = ceremony.RunWeb(ctx, devicesClient, devicepb.DeviceWebToken_builder{
+			Id:    req.GetDeviceWebToken().GetId(),
+			Token: req.GetDeviceWebToken().GetToken(),
+		}.Build())
 		return trace.Wrap(err)
 	})
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.AuthenticateWebDeviceResponse{
+	return api.AuthenticateWebDeviceResponse_builder{
 		ConfirmationToken: confirmationToken,
-	}, nil
+	}.Build(), nil
 }
 
 func (s *Service) shouldReuseGateway(targetURI uri.ResourceURI) (gateway.Gateway, bool) {
diff --git a/lib/teleterm/daemon/daemon_headless.go b/lib/teleterm/daemon/daemon_headless.go
index 2e28de1c3aa..b6f03084778 100644
--- a/lib/teleterm/daemon/daemon_headless.go
+++ b/lib/teleterm/daemon/daemon_headless.go
@@ -271,11 +271,11 @@ func (s *Service) startHeadlessWatcher(rootCluster *clusters.Cluster, waitInit b
 
 // sendPendingHeadlessAuthentication notifies the Electron App of a pending headless authentication.
 func (s *Service) sendPendingHeadlessAuthentication(ctx context.Context, ha *types.HeadlessAuthentication, rootClusterURI string) error {
-	req := &api.SendPendingHeadlessAuthenticationRequest{
+	req := api.SendPendingHeadlessAuthenticationRequest_builder{
 		RootClusterUri:                 rootClusterURI,
 		HeadlessAuthenticationId:       ha.GetName(),
 		HeadlessAuthenticationClientIp: ha.ClientIpAddress,
-	}
+	}.Build()
 
 	if err := s.headlessAuthSemaphore.Acquire(ctx); err != nil {
 		return trace.Wrap(err)
diff --git a/lib/teleterm/daemon/hardwarekeyprompt.go b/lib/teleterm/daemon/hardwarekeyprompt.go
index 4059725bcf9..f2ff841167e 100644
--- a/lib/teleterm/daemon/hardwarekeyprompt.go
+++ b/lib/teleterm/daemon/hardwarekeyprompt.go
@@ -65,10 +65,10 @@ func (h *hardwareKeyPrompter) Touch(ctx context.Context, keyInfo hardwarekey.Con
 		return trace.Wrap(err)
 	}
 
-	_, err = clt.PromptHardwareKeyTouch(ctx, &api.PromptHardwareKeyTouchRequest{
+	_, err = clt.PromptHardwareKeyTouch(ctx, api.PromptHardwareKeyTouchRequest_builder{
 		ProxyHostname: keyInfo.ProxyHost,
 		Command:       keyInfo.AgentKeyInfo.Command,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -87,16 +87,16 @@ func (h *hardwareKeyPrompter) AskPIN(ctx context.Context, requirement hardwareke
 		return "", trace.Wrap(err)
 	}
 
-	res, err := clt.PromptHardwareKeyPIN(ctx, &api.PromptHardwareKeyPINRequest{
+	res, err := clt.PromptHardwareKeyPIN(ctx, api.PromptHardwareKeyPINRequest_builder{
 		ProxyHostname: keyInfo.ProxyHost,
 		PinOptional:   requirement == hardwarekey.PINOptional,
 		Command:       keyInfo.AgentKeyInfo.Command,
-	})
+	}.Build())
 	if err != nil {
 		return "", trace.Wrap(err)
 	}
 
-	pin := res.Pin
+	pin := res.GetPin()
 	if pin == "" {
 		pin = hardwarekey.DefaultPIN
 	}
@@ -113,16 +113,16 @@ func (h *hardwareKeyPrompter) ChangePIN(ctx context.Context, keyInfo hardwarekey
 		return nil, trace.Wrap(err)
 	}
 
-	res, err := clt.PromptHardwareKeyPINChange(ctx, &api.PromptHardwareKeyPINChangeRequest{
+	res, err := clt.PromptHardwareKeyPINChange(ctx, api.PromptHardwareKeyPINChangeRequest_builder{
 		ProxyHostname: keyInfo.ProxyHost,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &hardwarekey.PINAndPUK{
-		PIN:        res.Pin,
-		PUK:        res.Puk,
-		PUKChanged: res.PukChanged,
+		PIN:        res.GetPin(),
+		PUK:        res.GetPuk(),
+		PUKChanged: res.GetPukChanged(),
 	}, nil
 }
 
@@ -133,12 +133,12 @@ func (h *hardwareKeyPrompter) ConfirmSlotOverwrite(ctx context.Context, message
 		return false, trace.Wrap(err)
 	}
 
-	res, err := clt.ConfirmHardwareKeySlotOverwrite(ctx, &api.ConfirmHardwareKeySlotOverwriteRequest{
+	res, err := clt.ConfirmHardwareKeySlotOverwrite(ctx, api.ConfirmHardwareKeySlotOverwriteRequest_builder{
 		ProxyHostname: keyInfo.ProxyHost,
 		Message:       message,
-	})
+	}.Build())
 	if err != nil {
 		return false, trace.Wrap(err)
 	}
-	return res.Confirmed, nil
+	return res.GetConfirmed(), nil
 }
diff --git a/lib/teleterm/daemon/mfaprompt.go b/lib/teleterm/daemon/mfaprompt.go
index cc691be9c34..e909dc9863c 100644
--- a/lib/teleterm/daemon/mfaprompt.go
+++ b/lib/teleterm/daemon/mfaprompt.go
@@ -111,12 +111,12 @@ func (p *mfaPrompt) promptApp(ctx context.Context, chal *proto.MFAAuthenticateCh
 
 	var ssoChallenge *api.SSOChallenge
 	if promptSSO {
-		ssoChallenge = &api.SSOChallenge{
+		ssoChallenge = api.SSOChallenge_builder{
 			ConnectorId:   chal.SSOChallenge.Device.ConnectorId,
 			ConnectorType: chal.SSOChallenge.Device.ConnectorType,
 			DisplayName:   chal.SSOChallenge.Device.DisplayName,
 			RedirectUrl:   chal.SSOChallenge.RedirectUrl,
-		}
+		}.Build()
 	}
 
 	var browserMfaChallenge *mfav1.BrowserMFAChallenge
@@ -126,7 +126,7 @@ func (p *mfaPrompt) promptApp(ctx context.Context, chal *proto.MFAAuthenticateCh
 		}
 	}
 
-	resp, err := p.promptAppMFA(ctx, &api.PromptMFARequest{
+	resp, err := p.promptAppMFA(ctx, api.PromptMFARequest_builder{
 		ClusterUri:    p.resourceURI.GetClusterURI().String(),
 		Reason:        p.cfg.PromptReason,
 		Totp:          promptOTP,
@@ -134,13 +134,13 @@ func (p *mfaPrompt) promptApp(ctx context.Context, chal *proto.MFAAuthenticateCh
 		Sso:           ssoChallenge,
 		Browser:       browserMfaChallenge,
 		PerSessionMfa: scope == mfav1.ChallengeScope_CHALLENGE_SCOPE_USER_SESSION,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trail.FromGRPC(err)
 	}
 	return &proto.MFAAuthenticateResponse{
 		Response: &proto.MFAAuthenticateResponse_TOTP{
-			TOTP: &proto.TOTPResponse{Code: resp.TotpCode},
+			TOTP: &proto.TOTPResponse{Code: resp.GetTotpCode()},
 		},
 	}, nil
 }
diff --git a/lib/teleterm/services/desktop/desktop.go b/lib/teleterm/services/desktop/desktop.go
index 105cb9e203a..89a79396226 100644
--- a/lib/teleterm/services/desktop/desktop.go
+++ b/lib/teleterm/services/desktop/desktop.go
@@ -199,12 +199,12 @@ func (s *Session) Start(ctx context.Context, stream grpc.BidiStreamingServer[api
 		// send the username, and clientScreenSpec messages.
 		for _, msg := range []tdp.Message{
 			legacy.ClientUsername{Username: s.login},
-			legacy.ClientScreenSpec{Width: hello.ScreenSpec.Width, Height: hello.ScreenSpec.Height},
+			legacy.ClientScreenSpec{Width: hello.ScreenSpec.GetWidth(), Height: hello.ScreenSpec.GetHeight()},
 			// For backwards compatibility with v17 Windows Desktop Servers, send a duplicate
 			// client screenspec message. This satisfies v18's requirement to receive exactly
 			// 3 handshake messages, while preventing v17 from receiving a keyboard message that
 			// it does not support. Teleport Connect doesn't support non-default keyboard layouts anyhow.
-			legacy.ClientScreenSpec{Width: hello.ScreenSpec.Width, Height: hello.ScreenSpec.Height},
+			legacy.ClientScreenSpec{Width: hello.ScreenSpec.GetWidth(), Height: hello.ScreenSpec.GetHeight()},
 		} {
 			err = tdpServerConn.WriteMessage(msg)
 			if err != nil {
@@ -254,7 +254,7 @@ type clientStream struct {
 }
 
 func (d clientStream) Send(p []byte) error {
-	return trace.Wrap(d.stream.Send(&api.ConnectToDesktopResponse{Data: p}))
+	return trace.Wrap(d.stream.Send(api.ConnectToDesktopResponse_builder{Data: p}.Build()))
 }
 
 func (d clientStream) Recv() ([]byte, error) {
@@ -355,15 +355,15 @@ func (d *fsRequestHandler) handleSharedDirectoryInfoRequest(completionID uint32,
 		return trace.Wrap(err)
 	}
 
-	info, err := dirAccess.Stat(r.Path)
+	info, err := dirAccess.Stat(r.GetPath())
 	if err == nil {
 		return trace.Wrap(sendToServer(&tdpb.SharedDirectoryResponse{
 			CompletionId: completionID,
 			ErrorCode:    uint32(SharedDirectoryErrCodeNil),
 			Operation: &tdpbv1.SharedDirectoryResponse_Info_{
-				Info: &tdpbv1.SharedDirectoryResponse_Info{
+				Info: tdpbv1.SharedDirectoryResponse_Info_builder{
 					Fso: toFso(info),
-				},
+				}.Build(),
 			},
 		}))
 	}
@@ -372,9 +372,9 @@ func (d *fsRequestHandler) handleSharedDirectoryInfoRequest(completionID uint32,
 			CompletionId: completionID,
 			ErrorCode:    uint32(SharedDirectoryErrCodeDoesNotExist),
 			Operation: &tdpbv1.SharedDirectoryResponse_Info_{
-				Info: &tdpbv1.SharedDirectoryResponse_Info{
+				Info: tdpbv1.SharedDirectoryResponse_Info_builder{
 					Fso: &tdpbv1.FileSystemObject{},
-				},
+				}.Build(),
 			},
 		}))
 	}
@@ -386,7 +386,7 @@ func (d *fsRequestHandler) handleSharedDirectoryListRequest(completionID uint32,
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	contents, err := dirAccess.ReadDir(r.Path)
+	contents, err := dirAccess.ReadDir(r.GetPath())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -395,9 +395,9 @@ func (d *fsRequestHandler) handleSharedDirectoryListRequest(completionID uint32,
 		CompletionId: completionID,
 		ErrorCode:    uint32(SharedDirectoryErrCodeNil),
 		Operation: &tdpbv1.SharedDirectoryResponse_List_{
-			List: &tdpbv1.SharedDirectoryResponse_List{
+			List: tdpbv1.SharedDirectoryResponse_List_builder{
 				FsoList: slices.Map(contents, toFso),
-			},
+			}.Build(),
 		},
 	})
 	return trace.Wrap(err)
@@ -406,7 +406,7 @@ func (d *fsRequestHandler) handleSharedDirectoryListRequest(completionID uint32,
 func (d *fsRequestHandler) handleSharedDirectoryReadRequest(completionID uint32, r *tdpbv1.SharedDirectoryRequest_Read, sendToServer func(message tdp.Message) error) error {
 	// Defense in depth: the protocol decoder already caps Length, but re-check here so
 	// the make([]byte, r.Length) below can't be driven into an unbounded allocation by a future caller.
-	if r.Length > tdp.MaxFileReadWriteLength {
+	if r.GetLength() > tdp.MaxFileReadWriteLength {
 		return tdp.FileReadWriteMaxLenErr
 	}
 
@@ -415,8 +415,8 @@ func (d *fsRequestHandler) handleSharedDirectoryReadRequest(completionID uint32,
 		return trace.Wrap(err)
 	}
 
-	buf := make([]byte, r.Length)
-	n, err := dirAccess.Read(r.Path, int64(r.Offset), buf)
+	buf := make([]byte, r.GetLength())
+	n, err := dirAccess.Read(r.GetPath(), int64(r.GetOffset()), buf)
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -425,9 +425,9 @@ func (d *fsRequestHandler) handleSharedDirectoryReadRequest(completionID uint32,
 		CompletionId: completionID,
 		ErrorCode:    uint32(SharedDirectoryErrCodeNil),
 		Operation: &tdpbv1.SharedDirectoryResponse_Read_{
-			Read: &tdpbv1.SharedDirectoryResponse_Read{
+			Read: tdpbv1.SharedDirectoryResponse_Read_builder{
 				Data: buf[:n],
-			},
+			}.Build(),
 		},
 	})
 	return trace.Wrap(err)
@@ -451,7 +451,7 @@ func (d *fsRequestHandler) handleSharedDirectoryWriteRequest(completionID uint32
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	bytesWritten, err := dirAccess.Write(r.Path, int64(r.Offset), r.Data)
+	bytesWritten, err := dirAccess.Write(r.GetPath(), int64(r.GetOffset()), r.GetData())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -460,9 +460,9 @@ func (d *fsRequestHandler) handleSharedDirectoryWriteRequest(completionID uint32
 		CompletionId: completionID,
 		ErrorCode:    uint32(SharedDirectoryErrCodeNil),
 		Operation: &tdpbv1.SharedDirectoryResponse_Write_{
-			Write: &tdpbv1.SharedDirectoryResponse_Write{
+			Write: tdpbv1.SharedDirectoryResponse_Write_builder{
 				BytesWritten: uint32(bytesWritten),
-			},
+			}.Build(),
 		},
 	})
 	return trace.Wrap(err)
@@ -473,7 +473,7 @@ func (d *fsRequestHandler) handleSharedDirectoryTruncateRequest(completionID uin
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = dirAccess.Truncate(r.Path, r.Size)
+	err = dirAccess.Truncate(r.GetPath(), r.GetSize())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -493,12 +493,12 @@ func (d *fsRequestHandler) handleSharedDirectoryCreateRequest(completionID uint3
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = dirAccess.Create(r.Path, FileType(r.FileType))
+	err = dirAccess.Create(r.GetPath(), FileType(r.GetFileType()))
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	info, err := dirAccess.Stat(r.Path)
+	info, err := dirAccess.Stat(r.GetPath())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -507,9 +507,9 @@ func (d *fsRequestHandler) handleSharedDirectoryCreateRequest(completionID uint3
 		CompletionId: completionID,
 		ErrorCode:    uint32(SharedDirectoryErrCodeNil),
 		Operation: &tdpbv1.SharedDirectoryResponse_Create_{
-			Create: &tdpbv1.SharedDirectoryResponse_Create{
+			Create: tdpbv1.SharedDirectoryResponse_Create_builder{
 				Fso: toFso(info),
-			},
+			}.Build(),
 		},
 	})
 	return trace.Wrap(err)
@@ -520,7 +520,7 @@ func (d *fsRequestHandler) handleSharedDirectoryDeleteRequest(completionID uint3
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	err = dirAccess.Delete(r.Path)
+	err = dirAccess.Delete(r.GetPath())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -536,11 +536,11 @@ func (d *fsRequestHandler) handleSharedDirectoryDeleteRequest(completionID uint3
 }
 
 func toFso(info *FileOrDirInfo) *tdpbv1.FileSystemObject {
-	return &tdpbv1.FileSystemObject{
+	return tdpbv1.FileSystemObject_builder{
 		LastModified: uint64(info.LastModified),
 		Size:         uint64(info.Size),
 		FileType:     uint32(info.FileType),
 		IsEmpty:      info.IsEmpty,
 		Path:         info.Path,
-	}
+	}.Build()
 }
diff --git a/lib/teleterm/services/userpreferences/userpreferences.go b/lib/teleterm/services/userpreferences/userpreferences.go
index 72abd6afa66..6e90da178db 100644
--- a/lib/teleterm/services/userpreferences/userpreferences.go
+++ b/lib/teleterm/services/userpreferences/userpreferences.go
@@ -55,10 +55,10 @@ func Get(ctx context.Context, rootClient Client, leafClient Client) (*api.UserPr
 		clusterPreferences = leafPreferencesResponse.GetPreferences().GetClusterPreferences()
 	}
 
-	return &api.UserPreferences{
+	return api.UserPreferences_builder{
 		UnifiedResourcePreferences: rootPreferences.GetUnifiedResourcePreferences(),
 		ClusterPreferences:         clusterPreferences,
-	}, nil
+	}.Build(), nil
 }
 
 // Update updates the preferences for a given user.
@@ -120,39 +120,39 @@ func Update(ctx context.Context, rootClient Client, leafClient Client, newPrefer
 	hasRootUpdate := false
 	// Unified resource preferences. Only updated in the root cluster.
 	if newPreferences.GetUnifiedResourcePreferences() != nil {
-		rootPreferences.UnifiedResourcePreferences = updateUnifiedResourcePreferences(
+		rootPreferences.SetUnifiedResourcePreferences(updateUnifiedResourcePreferences(
 			rootPreferences.GetUnifiedResourcePreferences(),
 			newPreferences.GetUnifiedResourcePreferences(),
-		)
+		))
 		hasRootUpdate = true
 	}
 
 	// Cluster preferences. Updated in the root cluster if set.
 	if newPreferences.GetClusterPreferences() != nil && leafPreferences == nil {
-		rootPreferences.ClusterPreferences = updateClusterPreferences(
+		rootPreferences.SetClusterPreferences(updateClusterPreferences(
 			rootPreferences.GetClusterPreferences(),
 			newPreferences.GetClusterPreferences(),
-		)
+		))
 		hasRootUpdate = true
 	}
 
 	if hasRootUpdate {
 		upsertGroup.Go(func() error {
-			err := rootClient.UpsertUserPreferences(ctx, &userpreferencesv1.UpsertUserPreferencesRequest{
+			err := rootClient.UpsertUserPreferences(ctx, userpreferencesv1.UpsertUserPreferencesRequest_builder{
 				Preferences: rootPreferences,
-			})
+			}.Build())
 			return trace.Wrap(err)
 		})
 	}
 
 	// Cluster preferences. Updated in the leaf cluster if set.
 	if newPreferences.GetClusterPreferences() != nil && leafPreferences != nil {
-		leafPreferences.ClusterPreferences = updateClusterPreferences(leafPreferences.GetClusterPreferences(), newPreferences.GetClusterPreferences())
+		leafPreferences.SetClusterPreferences(updateClusterPreferences(leafPreferences.GetClusterPreferences(), newPreferences.GetClusterPreferences()))
 
 		upsertGroup.Go(func() error {
-			err := leafClient.UpsertUserPreferences(ctx, &userpreferencesv1.UpsertUserPreferencesRequest{
+			err := leafClient.UpsertUserPreferences(ctx, userpreferencesv1.UpsertUserPreferencesRequest_builder{
 				Preferences: leafPreferences,
-			})
+			}.Build())
 			return trace.Wrap(err)
 		})
 	}
@@ -161,12 +161,12 @@ func Update(ctx context.Context, rootClient Client, leafClient Client, newPrefer
 		return nil, trace.Wrap(err)
 	}
 
-	updatedPreferences := &api.UserPreferences{
+	updatedPreferences := api.UserPreferences_builder{
 		ClusterPreferences:         rootPreferences.GetClusterPreferences(),
 		UnifiedResourcePreferences: rootPreferences.GetUnifiedResourcePreferences(),
-	}
+	}.Build()
 	if leafPreferences != nil {
-		updatedPreferences.ClusterPreferences = leafPreferences.GetClusterPreferences()
+		updatedPreferences.SetClusterPreferences(leafPreferences.GetClusterPreferences())
 	}
 
 	return updatedPreferences, nil
@@ -184,10 +184,10 @@ func updateUnifiedResourcePreferences(oldPreferences *userpreferencesv1.UnifiedR
 		oldPreferences = &userpreferencesv1.UnifiedResourcePreferences{}
 	}
 
-	oldPreferences.DefaultTab = newPreferences.GetDefaultTab()
-	oldPreferences.ViewMode = newPreferences.GetViewMode()
-	oldPreferences.LabelsViewMode = newPreferences.GetLabelsViewMode()
-	oldPreferences.AvailableResourceMode = newPreferences.GetAvailableResourceMode()
+	oldPreferences.SetDefaultTab(newPreferences.GetDefaultTab())
+	oldPreferences.SetViewMode(newPreferences.GetViewMode())
+	oldPreferences.SetLabelsViewMode(newPreferences.GetLabelsViewMode())
+	oldPreferences.SetAvailableResourceMode(newPreferences.GetAvailableResourceMode())
 
 	return oldPreferences
 }
@@ -203,10 +203,10 @@ func updateClusterPreferences(oldPreferences *userpreferencesv1.ClusterUserPrefe
 		oldPreferences = &userpreferencesv1.ClusterUserPreferences{}
 	}
 	if oldPreferences.GetPinnedResources() == nil {
-		oldPreferences.PinnedResources = &userpreferencesv1.PinnedResourcesUserPreferences{}
+		oldPreferences.SetPinnedResources(&userpreferencesv1.PinnedResourcesUserPreferences{})
 	}
 
-	oldPreferences.PinnedResources.ResourceIds = newPreferences.GetPinnedResources().GetResourceIds()
+	oldPreferences.GetPinnedResources().SetResourceIds(newPreferences.GetPinnedResources().GetResourceIds())
 
 	return oldPreferences
 }
diff --git a/lib/teleterm/services/userpreferences/userpreferences_test.go b/lib/teleterm/services/userpreferences/userpreferences_test.go
index 704e9294a08..03bb101aee4 100644
--- a/lib/teleterm/services/userpreferences/userpreferences_test.go
+++ b/lib/teleterm/services/userpreferences/userpreferences_test.go
@@ -26,30 +26,30 @@ import (
 	api "github.com/gravitational/teleport/gen/proto/go/teleport/lib/teleterm/v1"
 )
 
-var rootPreferencesMock = &userpreferencesv1.UserPreferences{
+var rootPreferencesMock = userpreferencesv1.UserPreferences_builder{
 	Onboard: nil,
 	Theme:   userpreferencesv1.Theme_THEME_LIGHT,
-	ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-		PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+	ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+		PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 			ResourceIds: []string{"abc", "def"},
-		},
-	},
-	UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+		}.Build(),
+	}.Build(),
+	UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 		DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_ALL,
 		ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_CARD,
 		LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_COLLAPSED,
 		AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_NONE,
-	},
-}
+	}.Build(),
+}.Build()
 
-var leafPreferencesMock = &userpreferencesv1.UserPreferences{
+var leafPreferencesMock = userpreferencesv1.UserPreferences_builder{
 	Onboard: nil,
-	ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-		PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+	ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+		PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 			ResourceIds: []string{"ghi", "jkl"},
-		},
-	},
-}
+		}.Build(),
+	}.Build(),
+}.Build()
 
 func TestUserPreferencesGet(t *testing.T) {
 	mockedRootClient := &mockClient{preferences: rootPreferencesMock}
@@ -64,82 +64,82 @@ func TestUserPreferencesGet(t *testing.T) {
 func TestUserPreferencesUpdateForRoot(t *testing.T) {
 	mockedClient := &mockClient{preferences: rootPreferencesMock}
 
-	newPreferences := &api.UserPreferences{
-		ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-			PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+	newPreferences := api.UserPreferences_builder{
+		ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+			PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 				ResourceIds: []string{"foo", "bar"},
-			},
-		},
+			}.Build(),
+		}.Build(),
 		UnifiedResourcePreferences: nil,
-	}
+	}.Build()
 
 	updatedPreferences, err := Update(t.Context(), mockedClient, nil, newPreferences)
 	require.NoError(t, err)
 	// ClusterPreferences field has been updated with the new value.
-	require.Equal(t, newPreferences.ClusterPreferences, mockedClient.upsertCalledWith.ClusterPreferences)
-	require.Equal(t, newPreferences.ClusterPreferences, updatedPreferences.ClusterPreferences)
+	require.Equal(t, newPreferences.GetClusterPreferences(), mockedClient.upsertCalledWith.GetClusterPreferences())
+	require.Equal(t, newPreferences.GetClusterPreferences(), updatedPreferences.GetClusterPreferences())
 	// UnifiedResourcePreferences field has not changed because it was nil in the new value.
-	require.Equal(t, rootPreferencesMock.UnifiedResourcePreferences, mockedClient.upsertCalledWith.UnifiedResourcePreferences)
-	require.Equal(t, rootPreferencesMock.UnifiedResourcePreferences, updatedPreferences.UnifiedResourcePreferences)
+	require.Equal(t, rootPreferencesMock.GetUnifiedResourcePreferences(), mockedClient.upsertCalledWith.GetUnifiedResourcePreferences())
+	require.Equal(t, rootPreferencesMock.GetUnifiedResourcePreferences(), updatedPreferences.GetUnifiedResourcePreferences())
 	// Other user preferences have not been touched.
-	require.Equal(t, rootPreferencesMock.Theme, mockedClient.upsertCalledWith.Theme)
+	require.Equal(t, rootPreferencesMock.GetTheme(), mockedClient.upsertCalledWith.GetTheme())
 }
 
 func TestUserPreferencesUpdateForRootWithNoExistingPinnedResources(t *testing.T) {
-	rootPreferences := &userpreferencesv1.UserPreferences{
+	rootPreferences := userpreferencesv1.UserPreferences_builder{
 		Theme: userpreferencesv1.Theme_THEME_LIGHT,
-		ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
+		ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
 			PinnedResources: nil,
-		},
-		UnifiedResourcePreferences: rootPreferencesMock.UnifiedResourcePreferences,
-	}
+		}.Build(),
+		UnifiedResourcePreferences: rootPreferencesMock.GetUnifiedResourcePreferences(),
+	}.Build()
 	mockedClient := &mockClient{preferences: rootPreferences}
 
-	newPreferences := &api.UserPreferences{
-		ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-			PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+	newPreferences := api.UserPreferences_builder{
+		ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+			PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 				ResourceIds: []string{"foo", "bar"},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	updatedPreferences, err := Update(t.Context(), mockedClient, nil, newPreferences)
 	require.NoError(t, err)
 
-	require.Equal(t, newPreferences.ClusterPreferences, mockedClient.upsertCalledWith.ClusterPreferences)
-	require.Equal(t, newPreferences.ClusterPreferences, updatedPreferences.ClusterPreferences)
-	require.Equal(t, rootPreferencesMock.UnifiedResourcePreferences, mockedClient.upsertCalledWith.UnifiedResourcePreferences)
-	require.Equal(t, userpreferencesv1.Theme_THEME_LIGHT, mockedClient.upsertCalledWith.Theme)
+	require.Equal(t, newPreferences.GetClusterPreferences(), mockedClient.upsertCalledWith.GetClusterPreferences())
+	require.Equal(t, newPreferences.GetClusterPreferences(), updatedPreferences.GetClusterPreferences())
+	require.Equal(t, rootPreferencesMock.GetUnifiedResourcePreferences(), mockedClient.upsertCalledWith.GetUnifiedResourcePreferences())
+	require.Equal(t, userpreferencesv1.Theme_THEME_LIGHT, mockedClient.upsertCalledWith.GetTheme())
 }
 
 func TestUserPreferencesUpdateForRootAndLeaf(t *testing.T) {
 	mockedRootClient := &mockClient{preferences: rootPreferencesMock}
 	mockedLeafClient := &mockClient{preferences: leafPreferencesMock}
 
-	newPreferences := &api.UserPreferences{
-		ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-			PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+	newPreferences := api.UserPreferences_builder{
+		ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+			PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 				ResourceIds: []string{"foo", "bar"},
-			},
-		},
-		UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+			}.Build(),
+		}.Build(),
+		UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 			DefaultTab:            userpreferencesv1.DefaultTab_DEFAULT_TAB_PINNED,
 			ViewMode:              userpreferencesv1.ViewMode_VIEW_MODE_LIST,
 			LabelsViewMode:        userpreferencesv1.LabelsViewMode_LABELS_VIEW_MODE_EXPANDED,
 			AvailableResourceMode: userpreferencesv1.AvailableResourceMode_AVAILABLE_RESOURCE_MODE_REQUESTABLE,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	updatedPreferences, err := Update(t.Context(), mockedRootClient, mockedLeafClient, newPreferences)
 	require.NoError(t, err)
 	// ClusterPreferences field has been updated with the leaf cluster value.
-	require.Equal(t, updatedPreferences.ClusterPreferences, mockedLeafClient.upsertCalledWith.ClusterPreferences)
-	require.Equal(t, newPreferences.ClusterPreferences, updatedPreferences.ClusterPreferences)
+	require.Equal(t, updatedPreferences.GetClusterPreferences(), mockedLeafClient.upsertCalledWith.GetClusterPreferences())
+	require.Equal(t, newPreferences.GetClusterPreferences(), updatedPreferences.GetClusterPreferences())
 	// UnifiedResourcePreferences field has been updated with the root cluster value.
-	require.Equal(t, updatedPreferences.UnifiedResourcePreferences, mockedRootClient.upsertCalledWith.UnifiedResourcePreferences)
-	require.Equal(t, newPreferences.UnifiedResourcePreferences, updatedPreferences.UnifiedResourcePreferences)
+	require.Equal(t, updatedPreferences.GetUnifiedResourcePreferences(), mockedRootClient.upsertCalledWith.GetUnifiedResourcePreferences())
+	require.Equal(t, newPreferences.GetUnifiedResourcePreferences(), updatedPreferences.GetUnifiedResourcePreferences())
 	// Other user preferences have not been touched.
-	require.Equal(t, rootPreferencesMock.Theme, mockedRootClient.upsertCalledWith.Theme)
+	require.Equal(t, rootPreferencesMock.GetTheme(), mockedRootClient.upsertCalledWith.GetTheme())
 }
 
 func TestNilUserPreferencesUpdate(t *testing.T) {
@@ -150,12 +150,12 @@ func TestNilUserPreferencesUpdate(t *testing.T) {
 	}{
 		{
 			name:                       "root",
-			expectedClusterPreferences: rootPreferencesMock.ClusterPreferences,
+			expectedClusterPreferences: rootPreferencesMock.GetClusterPreferences(),
 		},
 		{
 			name:                       "leaf",
 			leafPreferences:            leafPreferencesMock,
-			expectedClusterPreferences: leafPreferencesMock.ClusterPreferences,
+			expectedClusterPreferences: leafPreferencesMock.GetClusterPreferences(),
 		},
 	}
 
@@ -178,8 +178,8 @@ func TestNilUserPreferencesUpdate(t *testing.T) {
 			if mockedLeafClient != nil {
 				require.Nil(t, mockedLeafClient.upsertCalledWith)
 			}
-			require.Equal(t, rootPreferencesMock.UnifiedResourcePreferences, updatedPreferences.UnifiedResourcePreferences)
-			require.Equal(t, tt.expectedClusterPreferences, updatedPreferences.ClusterPreferences)
+			require.Equal(t, rootPreferencesMock.GetUnifiedResourcePreferences(), updatedPreferences.GetUnifiedResourcePreferences())
+			require.Equal(t, tt.expectedClusterPreferences, updatedPreferences.GetClusterPreferences())
 		})
 	}
 }
@@ -190,12 +190,12 @@ type mockClient struct {
 }
 
 func (m *mockClient) GetUserPreferences(ctx context.Context, req *userpreferencesv1.GetUserPreferencesRequest) (*userpreferencesv1.GetUserPreferencesResponse, error) {
-	return &userpreferencesv1.GetUserPreferencesResponse{
+	return userpreferencesv1.GetUserPreferencesResponse_builder{
 		Preferences: m.preferences,
-	}, nil
+	}.Build(), nil
 }
 
 func (m *mockClient) UpsertUserPreferences(ctx context.Context, req *userpreferencesv1.UpsertUserPreferencesRequest) error {
-	m.upsertCalledWith = req.Preferences
+	m.upsertCalledWith = req.GetPreferences()
 	return nil
 }
diff --git a/lib/teleterm/vnet/service.go b/lib/teleterm/vnet/service.go
index 12fe6b0c639..8b13776a4cc 100644
--- a/lib/teleterm/vnet/service.go
+++ b/lib/teleterm/vnet/service.go
@@ -247,12 +247,12 @@ func (s *Service) GetServiceInfo(ctx context.Context, _ *api.GetServiceInfoReque
 		return nil, trace.Wrap(err, "checking SSH configuration")
 	}
 
-	return &api.GetServiceInfoResponse{
+	return api.GetServiceInfoResponse_builder{
 		AppDnsZones:       unifiedClusterConfig.AppDNSZones(),
 		Clusters:          unifiedClusterConfig.ClusterNames,
 		SshConfigured:     sshConfigured,
 		VnetSshConfigPath: sshConfigChecker.VNetSSHConfigPath,
-	}, nil
+	}.Build(), nil
 }
 
 // RunDiagnostics runs a set of heuristics to determine if VNet actually works
@@ -265,21 +265,21 @@ func (s *Service) RunDiagnostics(ctx context.Context, req *api.RunDiagnosticsReq
 		return nil, trace.CompareFailed("VNet is not running")
 	}
 
-	if s.networkStackInfo.InterfaceName == "" {
+	if s.networkStackInfo.GetInterfaceName() == "" {
 		return nil, trace.BadParameter("no interface name, this is a bug")
 	}
 
-	if s.networkStackInfo.Ipv6Prefix == "" {
+	if s.networkStackInfo.GetIpv6Prefix() == "" {
 		return nil, trace.BadParameter("no IPv6 prefix, this is a bug")
 	}
 
 	nsa := &diagv1.NetworkStackAttempt{}
 	if ns, err := s.getNetworkStack(ctx); err != nil {
-		nsa.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR
-		nsa.Error = err.Error()
+		nsa.SetStatus(diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR)
+		nsa.SetError(err.Error())
 	} else {
-		nsa.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK
-		nsa.NetworkStack = ns
+		nsa.SetStatus(diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK)
+		nsa.SetNetworkStack(ns)
 	}
 
 	diagChecks, err := s.platformDiagChecks(ctx)
@@ -296,9 +296,9 @@ func (s *Service) RunDiagnostics(ctx context.Context, req *api.RunDiagnosticsReq
 		return nil, trace.Wrap(err)
 	}
 
-	return &api.RunDiagnosticsResponse{
+	return api.RunDiagnosticsResponse_builder{
 		Report: report,
-	}, nil
+	}.Build(), nil
 }
 
 func (s *Service) getNetworkStack(ctx context.Context) (*diagv1.NetworkStack, error) {
@@ -306,12 +306,12 @@ func (s *Service) getNetworkStack(ctx context.Context) (*diagv1.NetworkStack, er
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &diagv1.NetworkStack{
-		InterfaceName:  s.networkStackInfo.InterfaceName,
-		Ipv6Prefix:     s.networkStackInfo.Ipv6Prefix,
+	return diagv1.NetworkStack_builder{
+		InterfaceName:  s.networkStackInfo.GetInterfaceName(),
+		Ipv6Prefix:     s.networkStackInfo.GetIpv6Prefix(),
 		Ipv4CidrRanges: unifiedClusterConfig.IPv4CidrRanges,
 		DnsZones:       unifiedClusterConfig.AllDNSZones(),
-	}, nil
+	}.Build(), nil
 }
 
 // AutoConfigureSSH automatically configures OpenSSH-compatible clients for
@@ -367,7 +367,7 @@ func (s *Service) isUsageReportingEnabled(ctx context.Context) (bool, error) {
 		return false, trace.Wrap(err)
 	}
 
-	return resp.UsageReportingSettings.Enabled, nil
+	return resp.GetUsageReportingSettings().GetEnabled(), nil
 }
 
 func (s *Service) reportUnexpectedShutdown(ctx context.Context, shutdownErr error) error {
@@ -381,9 +381,9 @@ func (s *Service) reportUnexpectedShutdown(ctx context.Context, shutdownErr erro
 		shutdownErrorMsg = shutdownErr.Error()
 	}
 
-	_, err = tshdEventsClient.ReportUnexpectedVnetShutdown(ctx, &apiteleterm.ReportUnexpectedVnetShutdownRequest{
+	_, err = tshdEventsClient.ReportUnexpectedVnetShutdown(ctx, apiteleterm.ReportUnexpectedVnetShutdownRequest_builder{
 		Error: shutdownErrorMsg,
-	})
+	}.Build())
 	return trace.Wrap(err, "sending shutdown report")
 }
 
@@ -422,15 +422,13 @@ func (p *clientApplication) ReissueAppCert(ctx context.Context, appInfo *vnetv1.
 		TargetPort:  routeToApp.TargetPort,
 	}
 
-	reloginReq := &apiteleterm.ReloginRequest{
+	reloginReq := apiteleterm.ReloginRequest_builder{
 		RootClusterUri: clusterURI.GetRootClusterURI().String(),
-		Reason: &apiteleterm.ReloginRequest_VnetCertExpired{
-			VnetCertExpired: &apiteleterm.VnetCertExpired{
-				TargetUri:  appURI.String(),
-				RouteToApp: &apiteletermRouteToApp,
-			},
-		},
-	}
+		VnetCertExpired: apiteleterm.VnetCertExpired_builder{
+			TargetUri:  appURI.String(),
+			RouteToApp: &apiteletermRouteToApp,
+		}.Build(),
+	}.Build()
 
 	var cert tls.Certificate
 
@@ -450,19 +448,15 @@ func (p *clientApplication) ReissueAppCert(ctx context.Context, appInfo *vnetv1.
 	}
 
 	if err := p.daemonService.RetryWithRelogin(ctx, reloginReq, reissueCert); err != nil {
-		notifyErr := p.daemonService.NotifyApp(ctx, &apiteleterm.SendNotificationRequest{
-			Subject: &apiteleterm.SendNotificationRequest_CannotProxyVnetConnection{
-				CannotProxyVnetConnection: &apiteleterm.CannotProxyVnetConnection{
-					TargetUri:  appURI.String(),
-					RouteToApp: &apiteletermRouteToApp,
-					Reason: &apiteleterm.CannotProxyVnetConnection_CertReissueError{
-						CertReissueError: &apiteleterm.CertReissueError{
-							Error: err.Error(),
-						},
-					},
-				},
-			},
-		})
+		notifyErr := p.daemonService.NotifyApp(ctx, apiteleterm.SendNotificationRequest_builder{
+			CannotProxyVnetConnection: apiteleterm.CannotProxyVnetConnection_builder{
+				TargetUri:  appURI.String(),
+				RouteToApp: &apiteletermRouteToApp,
+				CertReissueError: apiteleterm.CertReissueError_builder{
+					Error: err.Error(),
+				}.Build(),
+			}.Build(),
+		}.Build())
 		if notifyErr != nil {
 			log.ErrorContext(ctx, "Failed to send a notification for an error encountered during VNet cert reissue",
 				"cert_reissue_error", err, "notify_error", notifyErr)
@@ -530,11 +524,11 @@ func (p *clientApplication) GetDialOptions(ctx context.Context, profileName stri
 		return nil, trace.Wrap(err, "resolving cluster by URI")
 	}
 
-	dialOpts := &vnetv1.DialOptions{
+	dialOpts := vnetv1.DialOptions_builder{
 		WebProxyAddr:            cluster.GetProxyHost(),
 		AlpnConnUpgradeRequired: tc.TLSRoutingConnUpgradeRequired,
 		InsecureSkipVerify:      p.insecureSkipVerify,
-	}
+	}.Build()
 	dialOpts.RootClusterCaCertPool, err = tc.RootClusterCACertPoolPEM(ctx)
 	if err != nil {
 		return nil, trace.Wrap(err, "loading root cluster CA cert pool")
@@ -604,22 +598,20 @@ func (p *clientApplication) OnInvalidLocalPort(ctx context.Context, appInfo *vne
 	if len(tcpPorts) <= 10 {
 		apiTCPPorts := make([]*apiteleterm.PortRange, 0, len(tcpPorts))
 		for _, portRange := range tcpPorts {
-			apiTCPPorts = append(apiTCPPorts, &apiteleterm.PortRange{Port: portRange.Port, EndPort: portRange.EndPort})
+			apiTCPPorts = append(apiTCPPorts, apiteleterm.PortRange_builder{Port: portRange.Port, EndPort: portRange.EndPort}.Build())
 		}
-		invalidLocalPort.TcpPorts = apiTCPPorts
+		invalidLocalPort.SetTcpPorts(apiTCPPorts)
 	}
 
-	err := p.daemonService.NotifyApp(ctx, &apiteleterm.SendNotificationRequest{
-		Subject: &apiteleterm.SendNotificationRequest_CannotProxyVnetConnection{
-			CannotProxyVnetConnection: &apiteleterm.CannotProxyVnetConnection{
-				TargetUri:  appURI.String(),
-				RouteToApp: &apiteletermRouteToApp,
-				Reason: &apiteleterm.CannotProxyVnetConnection_InvalidLocalPort{
-					InvalidLocalPort: invalidLocalPort,
-				},
+	err := p.daemonService.NotifyApp(ctx, apiteleterm.SendNotificationRequest_builder{
+		CannotProxyVnetConnection: &apiteleterm.CannotProxyVnetConnection{
+			TargetUri:  appURI.String(),
+			RouteToApp: &apiteletermRouteToApp,
+			Reason: &apiteleterm.CannotProxyVnetConnection_InvalidLocalPort{
+				InvalidLocalPort: invalidLocalPort,
 			},
 		},
-	})
+	}.Build())
 	if err != nil {
 		log.ErrorContext(ctx, "Could not notify the Electron app about invalid local port",
 			"notify_error", err,
@@ -725,7 +717,7 @@ func (r *daemonUsageReporter) ReportSSHSession(profileName, rootClusterName stri
 	}
 
 	log.DebugContext(context.Background(), "Reporting SSH usage event", "profile", profileName, "root_cluster", rootClusterName)
-	if err := r.cfg.EventConsumer.ReportUsageEvent(&apiteleterm.ReportUsageEventRequest{
+	if err := r.cfg.EventConsumer.ReportUsageEvent(apiteleterm.ReportUsageEventRequest_builder{
 		AuthClusterId: clusterID,
 		PrehogReq: &prehogv1alpha.SubmitConnectEventRequest{
 			DistinctId: r.cfg.InstallationID,
@@ -740,7 +732,7 @@ func (r *daemonUsageReporter) ReportSSHSession(profileName, rootClusterName stri
 				},
 			},
 		},
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err, "adding SSH usage event to queue")
 	}
 	return nil
@@ -789,7 +781,7 @@ func (r *daemonUsageReporter) ReportApp(appURI uri.ResourceURI) error {
 
 	log.DebugContext(ctx, "Reporting app usage event", "app", appURI.String())
 
-	if err := r.cfg.EventConsumer.ReportUsageEvent(&apiteleterm.ReportUsageEventRequest{
+	if err := r.cfg.EventConsumer.ReportUsageEvent(apiteleterm.ReportUsageEventRequest_builder{
 		AuthClusterId: clusterID,
 		PrehogReq: &prehogv1alpha.SubmitConnectEventRequest{
 			DistinctId: r.cfg.InstallationID,
@@ -804,7 +796,7 @@ func (r *daemonUsageReporter) ReportApp(appURI uri.ResourceURI) error {
 				},
 			},
 		},
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err, "adding app usage event to queue")
 	}
 
diff --git a/lib/teleterm/vnet/service_darwin.go b/lib/teleterm/vnet/service_darwin.go
index 221350086ac..2d08f21f557 100644
--- a/lib/teleterm/vnet/service_darwin.go
+++ b/lib/teleterm/vnet/service_darwin.go
@@ -26,7 +26,7 @@ import (
 
 func (s *Service) platformDiagChecks(ctx context.Context) ([]diag.DiagCheck, error) {
 	routeConflictDiag, err := diag.NewRouteConflictDiag(&diag.RouteConflictConfig{
-		VnetIfaceName: s.networkStackInfo.InterfaceName,
+		VnetIfaceName: s.networkStackInfo.GetInterfaceName(),
 		Routing:       &diag.DarwinRouting{},
 		Interfaces:    &diag.NetInterfaces{},
 	})
diff --git a/lib/tfgen/internal/reflect_modern_test.go b/lib/tfgen/internal/reflect_modern_test.go
index 7a17312bf95..b404e247a35 100644
--- a/lib/tfgen/internal/reflect_modern_test.go
+++ b/lib/tfgen/internal/reflect_modern_test.go
@@ -36,26 +36,26 @@ import (
 func TestReflectModern(t *testing.T) {
 	now := time.Now().UTC()
 
-	input := &machineidv1.Bot{
+	input := machineidv1.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        "my-bot",
 			Description: "hello",
 			Expires:     timestamppb.New(now),
 			Labels:      map[string]string{"foo": "bar"},
-		},
-		Spec: &machineidv1.BotSpec{
+		}.Build(),
+		Spec: machineidv1.BotSpec_builder{
 			Roles: []string{"foo"},
 			Traits: []*machineidv1.Trait{
-				{
+				machineidv1.Trait_builder{
 					Name:   "logins",
 					Values: []string{"root", "ubuntu"},
-				},
+				}.Build(),
 			},
 			MaxSessionTtl: durationpb.New(1 * time.Hour),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	expected := &internal.Message{
 		Attributes: []internal.Attribute{
diff --git a/lib/tfgen/tfgen_test.go b/lib/tfgen/tfgen_test.go
index b5aee143e67..879c8952989 100644
--- a/lib/tfgen/tfgen_test.go
+++ b/lib/tfgen/tfgen_test.go
@@ -71,22 +71,22 @@ func TestGenerate_Bot(t *testing.T) {
 	t.Parallel()
 
 	goldenTest(t,
-		&machineidv1.Bot{
+		machineidv1.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "gha-gravitational-teleport",
-			},
-			Spec: &machineidv1.BotSpec{
+			}.Build(),
+			Spec: machineidv1.BotSpec_builder{
 				Roles: []string{"gravitational-teleport-kube-access"},
 				Traits: []*machineidv1.Trait{
-					{
+					machineidv1.Trait_builder{
 						Name:   "kubernetes_groups",
 						Values: []string{"system:masters", "viewers"},
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 		tfgen.WithFieldTransform("spec.traits", transform.BotTraits),
 	)
 }
@@ -123,45 +123,45 @@ func TestGenerate_AccessMonitoringRule(t *testing.T) {
 	t.Parallel()
 
 	goldenTest(t,
-		&accessmonitoringrulesv1.AccessMonitoringRule{
+		accessmonitoringrulesv1.AccessMonitoringRule_builder{
 			Kind:    types.KindAccessMonitoringRule,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "monitoring-rule",
-			},
-			Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+			}.Build(),
+			Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 				Subjects:     []string{"access_request"},
 				Condition:    `access_request.spec.roles.contains("your_role_name")`,
 				DesiredState: types.AccessMonitoringRuleStateReviewed,
-				Notification: &accessmonitoringrulesv1.Notification{
+				Notification: accessmonitoringrulesv1.Notification_builder{
 					Name:       "slack",
 					Recipients: []string{"#your-slack-channel"},
-				},
-				AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+				}.Build(),
+				AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 					Integration: "builtin",
 					Decision:    "APPROVED",
-				},
+				}.Build(),
 				Schedules: map[string]*accessmonitoringrulesv1.Schedule{
-					"default": {
-						Time: &accessmonitoringrulesv1.TimeSchedule{
+					"default": accessmonitoringrulesv1.Schedule_builder{
+						Time: accessmonitoringrulesv1.TimeSchedule_builder{
 							Timezone: "America/Los_Angeles",
 							Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-								{
+								accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 									Weekday: "Monday",
 									Start:   "00:00",
 									End:     "23:59",
-								},
-								{
+								}.Build(),
+								accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 									Weekday: "Tuesday",
 									Start:   "00:00",
 									End:     "23:59",
-								},
+								}.Build(),
 							},
-						},
-					},
+						}.Build(),
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 }
 
diff --git a/lib/tlsca/ca.go b/lib/tlsca/ca.go
index 84419139556..91e6da94cc8 100644
--- a/lib/tlsca/ca.go
+++ b/lib/tlsca/ca.go
@@ -1413,8 +1413,8 @@ func FromSubject(subject pkix.Name, expires time.Time) (*Identity, error) {
 				}
 				// Certs issued before PinKind was introduced will have UNSPECIFIED here.
 				// Pins decoded from the user OID are always user pins.
-				if pin.Kind == scopesv1.PinKind_PIN_KIND_UNSPECIFIED {
-					pin.Kind = scopesv1.PinKind_PIN_KIND_USER
+				if pin.GetKind() == scopesv1.PinKind_PIN_KIND_UNSPECIFIED {
+					pin.SetKind(scopesv1.PinKind_PIN_KIND_USER)
 				}
 				id.ScopePin = pin
 			}
diff --git a/lib/tlsca/ca_test.go b/lib/tlsca/ca_test.go
index e11324d666d..01c887bdf4c 100644
--- a/lib/tlsca/ca_test.go
+++ b/lib/tlsca/ca_test.go
@@ -133,13 +133,13 @@ func TestScopePin(t *testing.T) {
 
 	identity := Identity{
 		Username: "alice@example.com",
-		ScopePin: &scopesv1.Pin{
+		ScopePin: scopesv1.Pin_builder{
 			Kind:  scopesv1.PinKind_PIN_KIND_USER,
 			Scope: "/foo",
 			AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
 				"/": {"/": {"r1"}, "/foo": {"r2"}},
 			}),
-		},
+		}.Build(),
 	}
 
 	subj, err := identity.Subject()
@@ -221,17 +221,17 @@ func TestJoinAttributes(t *testing.T) {
 		BotInstanceID: "1234-5678",
 		BotInternal:   true,
 		Expires:       expires,
-		JoinAttributes: &workloadidentityv1pb.JoinAttrs{
-			Kubernetes: &workloadidentityv1pb.JoinAttrsKubernetes{
-				ServiceAccount: &workloadidentityv1pb.JoinAttrsKubernetesServiceAccount{
+		JoinAttributes: workloadidentityv1pb.JoinAttrs_builder{
+			Kubernetes: workloadidentityv1pb.JoinAttrsKubernetes_builder{
+				ServiceAccount: workloadidentityv1pb.JoinAttrsKubernetesServiceAccount_builder{
 					Namespace: "default",
 					Name:      "foo",
-				},
-				Pod: &workloadidentityv1pb.JoinAttrsKubernetesPod{
+				}.Build(),
+				Pod: workloadidentityv1pb.JoinAttrsKubernetesPod_builder{
 					Name: "bar",
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	}
 
 	subj, err := identity.Subject()
@@ -767,7 +767,7 @@ func TestIdentity_GetUserMetadata(t *testing.T) {
 			name: "pinned user identity",
 			identity: Identity{
 				Username: "alpaca",
-				ScopePin: &scopesv1.Pin{
+				ScopePin: scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_USER,
 					Scope: "/staging",
 					AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -777,7 +777,7 @@ func TestIdentity_GetUserMetadata(t *testing.T) {
 							"/staging/green": {"staging-access"},
 						},
 					}),
-				},
+				}.Build(),
 			},
 			want: apievents.UserMetadata{
 				User:     "alpaca",
@@ -798,7 +798,7 @@ func TestIdentity_GetUserMetadata(t *testing.T) {
 				Username:      "bot-alpaca",
 				BotName:       "alpaca",
 				BotInstanceID: "123-123",
-				ScopePin: &scopesv1.Pin{
+				ScopePin: scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_USER,
 					Scope: "/staging",
 					AssignmentTree: pinning.AssignmentTreeFromMap(map[string]map[string][]string{
@@ -808,7 +808,7 @@ func TestIdentity_GetUserMetadata(t *testing.T) {
 							"/staging/green": {"staging-access"},
 						},
 					}),
-				},
+				}.Build(),
 			},
 			want: apievents.UserMetadata{
 				User:          "bot-alpaca",
@@ -829,16 +829,16 @@ func TestIdentity_GetUserMetadata(t *testing.T) {
 			name: "pinned system identity",
 			identity: Identity{
 				Username: "system.teleport.name",
-				ScopePin: &scopesv1.Pin{
+				ScopePin: scopesv1.Pin_builder{
 					Kind:  scopesv1.PinKind_PIN_KIND_AGENT,
 					Scope: "/staging",
-					SystemRoles: &scopesv1.SystemRoles{
+					SystemRoles: scopesv1.SystemRoles_builder{
 						Primary: types.RoleInstance.String(),
 						Additional: []string{
 							types.RoleNode.String(), types.RoleKube.String(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			want: apievents.UserMetadata{
 				User:     "system.teleport.name",
diff --git a/lib/tpm/validate.go b/lib/tpm/validate.go
index 7f40a33e46a..22e0e23bd63 100644
--- a/lib/tpm/validate.go
+++ b/lib/tpm/validate.go
@@ -68,11 +68,11 @@ type ValidatedTPM struct {
 // This is used for auditing and for evaluation of WorkloadIdentity rules and
 // templating.
 func (c *ValidatedTPM) JoinAttrs() *workloadidentityv1pb.JoinAttrsTPM {
-	attrs := &workloadidentityv1pb.JoinAttrsTPM{
+	attrs := workloadidentityv1pb.JoinAttrsTPM_builder{
 		EkPubHash:      c.EKPubHash,
 		EkCertSerial:   c.EKCertSerial,
 		EkCertVerified: c.EKCertVerified,
-	}
+	}.Build()
 
 	return attrs
 }
diff --git a/lib/usagereporter/daemon/usagereporter.go b/lib/usagereporter/daemon/usagereporter.go
index dfbfc4caf12..16d10bdac4f 100644
--- a/lib/usagereporter/daemon/usagereporter.go
+++ b/lib/usagereporter/daemon/usagereporter.go
@@ -123,7 +123,7 @@ func newPrehogSubmitter(ctx context.Context, prehogEndpoint string) (SubmitFunc,
 }
 
 func GetAnonymizedPrehogEvent(req *teletermv1.ReportUsageEventRequest) (*prehogv1a.SubmitConnectEventRequest, error) {
-	prehogEvent := req.PrehogReq
+	prehogEvent := req.GetPrehogReq()
 
 	// non-anonymized
 	switch prehogEvent.GetEvent().(type) {
diff --git a/lib/usertasks/urls.go b/lib/usertasks/urls.go
index 3e85991a950..f3d39521e74 100644
--- a/lib/usertasks/urls.go
+++ b/lib/usertasks/urls.go
@@ -74,13 +74,13 @@ func withEKSClusterIssueURL(metadata *usertasksv1.UserTask, cluster *usertasksv1
 		Path:     path.Join("eks", "home"),
 		Fragment: "/clusters/" + cluster.GetName(),
 		RawQuery: url.Values{
-			"region": []string{metadata.Spec.DiscoverEks.GetRegion()},
+			"region": []string{metadata.GetSpec().GetDiscoverEks().GetRegion()},
 		}.Encode(),
 	}
 
 	ret.ResourceURL = clusterBaseURL.String()
 
-	switch metadata.Spec.IssueType {
+	switch metadata.GetSpec().GetIssueType() {
 	case usertasksapi.AutoDiscoverEKSIssueAgentNotConnecting:
 		clusterBaseURL.Fragment = clusterBaseURL.Fragment + "/statefulsets/teleport-kube-agent?namespace=teleport-agent"
 		ret.OpenTeleportAgentURL = clusterBaseURL.String()
@@ -109,7 +109,7 @@ func withEKSClusterIssueURL(metadata *usertasksv1.UserTask, cluster *usertasksv1
 // - ManageEndpointAccessURL: links to the Manage Endpoint Access screen in the Amazon EKS Web Console, for the current EKS Cluster.
 // - ManageClusterURL: links to the EKS Cluster.
 func EKSClustersWithURLs(ut *usertasksv1.UserTask) *UserTaskDiscoverEKSWithURLs {
-	clusters := ut.Spec.GetDiscoverEks().GetClusters()
+	clusters := ut.GetSpec().GetDiscoverEks().GetClusters()
 	clustersWithURLs := make(map[string]*DiscoverEKSClusterWithURLs, len(clusters))
 
 	for clusterName, cluster := range clusters {
@@ -117,7 +117,7 @@ func EKSClustersWithURLs(ut *usertasksv1.UserTask) *UserTaskDiscoverEKSWithURLs
 	}
 
 	return &UserTaskDiscoverEKSWithURLs{
-		DiscoverEKS: ut.Spec.GetDiscoverEks(),
+		DiscoverEKS: ut.GetSpec().GetDiscoverEks(),
 		Clusters:    clustersWithURLs,
 	}
 }
@@ -149,7 +149,7 @@ func withEC2InstanceIssueURL(metadata *usertasksv1.UserTask, instance *usertasks
 		Path:     path.Join("ec2", "home"),
 		Fragment: "InstanceDetails:instanceId=" + instance.GetInstanceId(),
 		RawQuery: url.Values{
-			"region": []string{metadata.Spec.DiscoverEc2.GetRegion()},
+			"region": []string{metadata.GetSpec().GetDiscoverEc2().GetRegion()},
 		}.Encode(),
 	}
 	ret.ResourceURL = instanceBaseURL.String()
@@ -161,7 +161,7 @@ func withEC2InstanceIssueURL(metadata *usertasksv1.UserTask, instance *usertasks
 // Currently, the following URLs will be added:
 // - ResourceURL: a link to open the instance in Amazon Web Console.
 func EC2InstancesWithURLs(ut *usertasksv1.UserTask) *UserTaskDiscoverEC2WithURLs {
-	instances := ut.Spec.GetDiscoverEc2().GetInstances()
+	instances := ut.GetSpec().GetDiscoverEc2().GetInstances()
 	instancesWithURLs := make(map[string]*DiscoverEC2InstanceWithURLs, len(instances))
 
 	for instanceID, instance := range instances {
@@ -169,7 +169,7 @@ func EC2InstancesWithURLs(ut *usertasksv1.UserTask) *UserTaskDiscoverEC2WithURLs
 	}
 
 	return &UserTaskDiscoverEC2WithURLs{
-		DiscoverEC2: ut.Spec.GetDiscoverEc2(),
+		DiscoverEC2: ut.GetSpec().GetDiscoverEc2(),
 		Instances:   instancesWithURLs,
 	}
 }
@@ -277,7 +277,7 @@ func withAzureVMInstanceIssueURL(instance *usertasksv1.DiscoverAzureVMInstance)
 
 // AzureVMInstancesWithURLs takes a UserTask and enriches the instance list with Azure Portal URLs.
 func AzureVMInstancesWithURLs(ut *usertasksv1.UserTask) *UserTaskDiscoverAzureVMWithURLs {
-	instances := ut.Spec.GetDiscoverAzureVm().GetInstances()
+	instances := ut.GetSpec().GetDiscoverAzureVm().GetInstances()
 	instancesWithURLs := make(map[string]*DiscoverAzureVMInstanceWithURLs, len(instances))
 
 	for instanceID, instance := range instances {
@@ -285,7 +285,7 @@ func AzureVMInstancesWithURLs(ut *usertasksv1.UserTask) *UserTaskDiscoverAzureVM
 	}
 
 	return &UserTaskDiscoverAzureVMWithURLs{
-		DiscoverAzureVM: ut.Spec.GetDiscoverAzureVm(),
+		DiscoverAzureVM: ut.GetSpec().GetDiscoverAzureVm(),
 		Instances:       instancesWithURLs,
 	}
 }
diff --git a/lib/usertasks/urls_test.go b/lib/usertasks/urls_test.go
index 5d23c112244..eaed8091b49 100644
--- a/lib/usertasks/urls_test.go
+++ b/lib/usertasks/urls_test.go
@@ -29,13 +29,13 @@ import (
 
 func TestEKSURLs(t *testing.T) {
 	clusterName := "my-cluster"
-	dummyCluster := &usertasksv1.DiscoverEKSCluster{Name: clusterName}
-	baseClusterData := &usertasksv1.DiscoverEKS{
+	dummyCluster := usertasksv1.DiscoverEKSCluster_builder{Name: clusterName}.Build()
+	baseClusterData := usertasksv1.DiscoverEKS_builder{
 		Region: "us-east-1",
 		Clusters: map[string]*usertasksv1.DiscoverEKSCluster{
 			clusterName: dummyCluster,
 		},
-	}
+	}.Build()
 
 	for _, tt := range []struct {
 		name                      string
@@ -94,12 +94,12 @@ func TestEKSURLs(t *testing.T) {
 				},
 			}
 
-			got := EKSClustersWithURLs(&usertasksv1.UserTask{
-				Spec: &usertasksv1.UserTaskSpec{
+			got := EKSClustersWithURLs(usertasksv1.UserTask_builder{
+				Spec: usertasksv1.UserTaskSpec_builder{
 					IssueType:   tt.issueType,
 					DiscoverEks: baseClusterData,
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.Equal(t, expected, got)
 		})
 	}
@@ -107,13 +107,13 @@ func TestEKSURLs(t *testing.T) {
 
 func TestEC2URLs(t *testing.T) {
 	instanceID := "i-12345678"
-	dummyInstance := &usertasksv1.DiscoverEC2Instance{InstanceId: instanceID}
-	baseInstancesData := &usertasksv1.DiscoverEC2{
+	dummyInstance := usertasksv1.DiscoverEC2Instance_builder{InstanceId: instanceID}.Build()
+	baseInstancesData := usertasksv1.DiscoverEC2_builder{
 		Region: "us-east-1",
 		Instances: map[string]*usertasksv1.DiscoverEC2Instance{
 			instanceID: dummyInstance,
 		},
-	}
+	}.Build()
 
 	for _, tt := range []struct {
 		name                       string
@@ -139,12 +139,12 @@ func TestEC2URLs(t *testing.T) {
 				},
 			}
 
-			got := EC2InstancesWithURLs(&usertasksv1.UserTask{
-				Spec: &usertasksv1.UserTaskSpec{
+			got := EC2InstancesWithURLs(usertasksv1.UserTask_builder{
+				Spec: usertasksv1.UserTaskSpec_builder{
 					IssueType:   tt.issueType,
 					DiscoverEc2: baseInstancesData,
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.Equal(t, expected, got)
 		})
 	}
@@ -152,13 +152,13 @@ func TestEC2URLs(t *testing.T) {
 
 func TestRDSURLs(t *testing.T) {
 	databaseName := "my-database"
-	dummyDatabase := &usertasksv1.DiscoverRDSDatabase{Name: databaseName}
-	baseDatabaseData := &usertasksv1.DiscoverRDS{
+	dummyDatabase := usertasksv1.DiscoverRDSDatabase_builder{Name: databaseName}.Build()
+	baseDatabaseData := usertasksv1.DiscoverRDS_builder{
 		Region: "us-east-1",
 		Databases: map[string]*usertasksv1.DiscoverRDSDatabase{
 			databaseName: dummyDatabase,
 		},
-	}
+	}.Build()
 
 	for _, tt := range []struct {
 		name                       string
@@ -185,12 +185,12 @@ func TestRDSURLs(t *testing.T) {
 				},
 			}
 
-			got := RDSDatabasesWithURLs(&usertasksv1.UserTask{
-				Spec: &usertasksv1.UserTaskSpec{
+			got := RDSDatabasesWithURLs(usertasksv1.UserTask_builder{
+				Spec: usertasksv1.UserTaskSpec_builder{
 					IssueType:   tt.issueType,
 					DiscoverRds: baseDatabaseData,
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.Equal(t, expected, got)
 		})
 	}
@@ -198,15 +198,15 @@ func TestRDSURLs(t *testing.T) {
 
 func TestAzureVMURLs(t *testing.T) {
 	resourceID := "/subscriptions/sub-1/resourceGroups/rg-1/providers/Microsoft.Compute/virtualMachines/my-vm"
-	dummyVM := &usertasksv1.DiscoverAzureVMInstance{
+	dummyVM := usertasksv1.DiscoverAzureVMInstance_builder{
 		VmId:       "my-vm",
 		ResourceId: resourceID,
-	}
-	baseVMData := &usertasksv1.DiscoverAzureVM{
+	}.Build()
+	baseVMData := usertasksv1.DiscoverAzureVM_builder{
 		Instances: map[string]*usertasksv1.DiscoverAzureVMInstance{
 			resourceID: dummyVM,
 		},
-	}
+	}.Build()
 
 	for _, tt := range []struct {
 		name              string
@@ -231,12 +231,12 @@ func TestAzureVMURLs(t *testing.T) {
 				},
 			}
 
-			got := AzureVMInstancesWithURLs(&usertasksv1.UserTask{
-				Spec: &usertasksv1.UserTaskSpec{
+			got := AzureVMInstancesWithURLs(usertasksv1.UserTask_builder{
+				Spec: usertasksv1.UserTaskSpec_builder{
 					IssueType:       tt.issueType,
 					DiscoverAzureVm: baseVMData,
-				},
-			})
+				}.Build(),
+			}.Build())
 			require.Equal(t, expected, got)
 		})
 	}
diff --git a/lib/utils/grpc/proxy_test.go b/lib/utils/grpc/proxy_test.go
index 971a4fd0a5c..f8e7e4a0989 100644
--- a/lib/utils/grpc/proxy_test.go
+++ b/lib/utils/grpc/proxy_test.go
@@ -64,7 +64,7 @@ func TestProxyBidiStream(t *testing.T) {
 	require.NoError(t, err)
 
 	// Send a message.
-	err = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte("hello")})
+	err = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte("hello")}.Build())
 	require.NoError(t, err)
 
 	// Receive the server's response.
@@ -128,7 +128,7 @@ func TestProxyBidiStream_PropagatesServerErrorAfterClientEOF(t *testing.T) {
 	stream, err := client.ConnectToDesktop(ctx)
 	require.NoError(t, err)
 
-	err = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte("hello")})
+	err = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte("hello")}.Build())
 	require.NoError(t, err)
 	_, err = stream.Recv()
 	require.NoError(t, err)
@@ -162,7 +162,7 @@ func TestProxyBidiStream_ReturnsEOFWhenServerReturnsEarly(t *testing.T) {
 	stream, err := client.ConnectToDesktop(ctx)
 	require.NoError(t, err)
 
-	err = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte("hello")})
+	err = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte("hello")}.Build())
 	require.NoError(t, err)
 
 	// Drain the first response the server sent before returning.
@@ -176,7 +176,7 @@ func TestProxyBidiStream_ReturnsEOFWhenServerReturnsEarly(t *testing.T) {
 	//
 	// At this point, the Send returns either nil if the trailer wasn't propagated
 	// to the client yet or io.EOF if it was, so we skip asserting on err here.
-	_ = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte("more")})
+	_ = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte("more")}.Build())
 
 	// Server has returned nil. The client must see clean io.EOF, not a
 	// proxy-reshaped error and not a hang (which would surface as a
@@ -205,7 +205,7 @@ func TestProxyBidiStream_SurfacesClientRecvError(t *testing.T) {
 	require.NoError(t, err)
 
 	// Send a message larger than the proxy's MaxRecvMsgSize.
-	err = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte(strings.Repeat("x", 256))})
+	err = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte(strings.Repeat("x", 256))}.Build())
 	require.NoError(t, err)
 
 	_, err = stream.Recv()
@@ -238,7 +238,7 @@ func TestProxyBidiStream_SurfacesServerSendError(t *testing.T) {
 	// default 4MB), then tries to forward it to the fake server whose upstream
 	// connection caps sends at 64 bytes, triggering a local ResourceExhausted on
 	// the proxy's server.Send.
-	err = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte(strings.Repeat("x", 256))})
+	err = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte(strings.Repeat("x", 256))}.Build())
 	require.NoError(t, err)
 
 	_, err = stream.Recv()
@@ -267,7 +267,7 @@ func TestProxyBidiStream_ForwardsMetadata(t *testing.T) {
 	stream, err := client.ConnectToDesktop(ctx)
 	require.NoError(t, err)
 
-	err = stream.Send(&teletermv1.ConnectToDesktopRequest{Data: []byte("hello")})
+	err = stream.Send(teletermv1.ConnectToDesktopRequest_builder{Data: []byte("hello")}.Build())
 	require.NoError(t, err)
 
 	// Receive the server's first response; by this point the server has already
@@ -366,7 +366,7 @@ func (f *fakeServerSvc) ConnectToDesktop(stream teletermv1.TerminalService_Conne
 		if len(req.GetData()) == 0 {
 			return trace.BadParameter("empty data")
 		}
-		if err := stream.Send(&teletermv1.ConnectToDesktopResponse{Data: []byte("ack")}); err != nil {
+		if err := stream.Send(teletermv1.ConnectToDesktopResponse_builder{Data: []byte("ack")}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 		if f.returnAfterFirstResponse {
diff --git a/lib/vnet/admin_process_unix.go b/lib/vnet/admin_process_unix.go
index dad4b92f8e7..9c5e8127cf5 100644
--- a/lib/vnet/admin_process_unix.go
+++ b/lib/vnet/admin_process_unix.go
@@ -47,10 +47,10 @@ func runUnixAdminProcess(ctx context.Context, clt *clientApplicationServiceClien
 		return trace.Wrap(err, "creating network stack")
 	}
 
-	if err := clt.ReportNetworkStackInfo(ctx, &vnetv1.NetworkStackInfo{
+	if err := clt.ReportNetworkStackInfo(ctx, vnetv1.NetworkStackInfo_builder{
 		InterfaceName: tunName,
 		Ipv6Prefix:    networkStackConfig.ipv6Prefix.String(),
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err, "reporting network stack info to client application")
 	}
 
diff --git a/lib/vnet/app_provider.go b/lib/vnet/app_provider.go
index b1631083461..e970351003c 100644
--- a/lib/vnet/app_provider.go
+++ b/lib/vnet/app_provider.go
@@ -57,11 +57,11 @@ func (p *appProvider) ReissueAppCert(ctx context.Context, appInfo *vnetv1.AppInf
 
 func (p *appProvider) newAppCertSigner(cert []byte, appKey *vnetv1.AppKey, targetPort uint16) (*rpcSigner, error) {
 	return newRPCCertSigner(cert, func(req *vnetv1.SignRequest) ([]byte, error) {
-		return p.clt.SignForApp(context.TODO(), &vnetv1.SignForAppRequest{
+		return p.clt.SignForApp(context.TODO(), vnetv1.SignForAppRequest_builder{
 			AppKey:     appKey,
 			TargetPort: uint32(targetPort),
 			Sign:       req,
-		})
+		}.Build())
 	})
 }
 
diff --git a/lib/vnet/client_application_service.go b/lib/vnet/client_application_service.go
index 96858cdbb6f..a737bb44c5f 100644
--- a/lib/vnet/client_application_service.go
+++ b/lib/vnet/client_application_service.go
@@ -103,17 +103,17 @@ func newClientApplicationService(cfg *clientApplicationServiceConfig) (*clientAp
 // AuthenticateProcess implements [vnetv1.ClientApplicationServiceServer.AuthenticateProcess].
 func (s *clientApplicationService) AuthenticateProcess(ctx context.Context, req *vnetv1.AuthenticateProcessRequest) (*vnetv1.AuthenticateProcessResponse, error) {
 	log.DebugContext(ctx, "Received AuthenticateProcess request from admin process")
-	if req.Version != api.Version {
+	if req.GetVersion() != api.Version {
 		return nil, trace.BadParameter("version mismatch, user process version is %s, admin process version is %s",
-			api.Version, req.Version)
+			api.Version, req.GetVersion())
 	}
 	if err := platformAuthenticateProcess(ctx, req); err != nil {
 		log.ErrorContext(ctx, "Failed to authenticate process", "error", err)
 		return nil, trace.Wrap(err, "authenticating process")
 	}
-	return &vnetv1.AuthenticateProcessResponse{
+	return vnetv1.AuthenticateProcessResponse_builder{
 		Version: api.Version,
-	}, nil
+	}.Build(), nil
 }
 
 // ReportNetworkStackInfo implements [vnetv1.ClientApplicationServiceServer.ReportNetworkStackInfo].
@@ -154,9 +154,9 @@ func (s *clientApplicationService) ReissueAppCert(ctx context.Context, req *vnet
 		return nil, trace.Wrap(err, "reissuing app certificate")
 	}
 	s.setSignerForApp(appKey, uint16(req.GetTargetPort()), cert.PrivateKey.(crypto.Signer))
-	return &vnetv1.ReissueAppCertResponse{
+	return vnetv1.ReissueAppCertResponse_builder{
 		Cert: cert.Certificate[0],
-	}, nil
+	}.Build(), nil
 }
 
 // SignForApp implements [vnetv1.ClientApplicationServiceServer.SignForApp].
@@ -167,7 +167,7 @@ func (s *clientApplicationService) SignForApp(ctx context.Context, req *vnetv1.S
 	log.DebugContext(ctx, "Got SignForApp request",
 		"app", req.GetAppKey(),
 		"hash", signReq.GetHash(),
-		"is_rsa_pss", signReq.PssSaltLength != nil,
+		"is_rsa_pss", signReq.HasPssSaltLength(),
 		"pss_salt_len", signReq.GetPssSaltLength(),
 		"digest_len", len(signReq.GetDigest()),
 	)
@@ -185,9 +185,9 @@ func (s *clientApplicationService) SignForApp(ctx context.Context, req *vnetv1.S
 	if err != nil {
 		return nil, trace.Wrap(err, "signing for app %v", appKey)
 	}
-	return &vnetv1.SignForAppResponse{
+	return vnetv1.SignForAppResponse_builder{
 		Signature: signature,
-	}, nil
+	}.Build(), nil
 }
 
 func sign(signer crypto.Signer, signReq *vnetv1.SignRequest) ([]byte, error) {
@@ -201,10 +201,10 @@ func sign(signer crypto.Signer, signReq *vnetv1.SignRequest) ([]byte, error) {
 		return nil, trace.BadParameter("unsupported hash %v", signReq.GetHash())
 	}
 	opts := crypto.SignerOpts(hash)
-	if signReq.PssSaltLength != nil {
+	if signReq.HasPssSaltLength() {
 		opts = &rsa.PSSOptions{
 			Hash:       hash,
-			SaltLength: int(*signReq.PssSaltLength),
+			SaltLength: int(signReq.GetPssSaltLength()),
 		}
 	}
 	signature, err := signer.Sign(rand.Reader, signReq.GetDigest(), opts)
@@ -264,12 +264,12 @@ func (s *clientApplicationService) GetTargetOSConfiguration(ctx context.Context,
 	if err != nil {
 		return nil, trace.Wrap(err, "getting target OS configuration")
 	}
-	return &vnetv1.GetTargetOSConfigurationResponse{
-		TargetOsConfiguration: &vnetv1.TargetOSConfiguration{
+	return vnetv1.GetTargetOSConfigurationResponse_builder{
+		TargetOsConfiguration: vnetv1.TargetOSConfiguration_builder{
 			DnsZones:       unifiedClusterConfig.AllDNSZones(),
 			Ipv4CidrRanges: unifiedClusterConfig.IPv4CidrRanges,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 // UserTLSCert returns the user TLS certificate for a specific profile.
@@ -285,10 +285,10 @@ func (s *clientApplicationService) UserTLSCert(ctx context.Context, req *vnetv1.
 	if err != nil {
 		return nil, trace.Wrap(err, "getting TLS dial options")
 	}
-	return &vnetv1.UserTLSCertResponse{
+	return vnetv1.UserTLSCertResponse_builder{
 		Cert:        tlsCert.Certificate[0],
 		DialOptions: dialOpts,
-	}, nil
+	}.Build(), nil
 }
 
 // SignForUserTLS signs a digest with the user TLS private key.
@@ -305,9 +305,9 @@ func (s *clientApplicationService) SignForUserTLS(ctx context.Context, req *vnet
 	if err != nil {
 		return nil, trace.Wrap(err, "signing for user TLS certificate")
 	}
-	return &vnetv1.SignForUserTLSResponse{
+	return vnetv1.SignForUserTLSResponse_builder{
 		Signature: signature,
-	}, nil
+	}.Build(), nil
 }
 
 // SessionSSHConfig returns user SSH configuration values for an SSH session.
@@ -402,11 +402,11 @@ func (s *clientApplicationService) SessionSSHConfig(ctx context.Context, req *vn
 		s.cfg.clientApplication.OnNewSSHSession(ctx, req.GetProfile(), req.GetRootCluster())
 	}
 
-	return &vnetv1.SessionSSHConfigResponse{
+	return vnetv1.SessionSSHConfigResponse_builder{
 		SessionId:  sessionID,
 		Cert:       sshCert.Marshal(),
 		TrustedCas: trustedCAs,
-	}, nil
+	}.Build(), nil
 }
 
 // SignForSSHSession signs a digest with the SSH private key associated with the
@@ -420,9 +420,9 @@ func (s *clientApplicationService) SignForSSHSession(ctx context.Context, req *v
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &vnetv1.SignForSSHSessionResponse{
+	return vnetv1.SignForSSHSessionResponse_builder{
 		Signature: signature,
-	}, nil
+	}.Build(), nil
 }
 
 func (s *clientApplicationService) setSignerForSSHSession(signer crypto.Signer) string {
@@ -452,9 +452,9 @@ func (s *clientApplicationService) ExchangeSSHKeys(ctx context.Context, req *vne
 	if err != nil {
 		return nil, trace.Wrap(err, "writing SSH keys")
 	}
-	return &vnetv1.ExchangeSSHKeysResponse{
+	return vnetv1.ExchangeSSHKeysResponse_builder{
 		UserPublicKey: userPublicKey.Marshal(),
-	}, nil
+	}.Build(), nil
 }
 
 // PerformSessionMFACeremony implements [vnetv1.ClientApplicationServiceServer.PerformSessionMFACeremony]. It performs
@@ -481,9 +481,9 @@ func (s *clientApplicationService) PerformSessionMFACeremony(
 		return nil, trace.Wrap(err)
 	}
 
-	return &vnetv1.PerformSessionMFACeremonyResponse{
+	return vnetv1.PerformSessionMFACeremonyResponse_builder{
 		ChallengeName: challengeName,
-	}, nil
+	}.Build(), nil
 }
 
 // checkAppKey checks that at least the app profile and name are set, which are
@@ -562,9 +562,9 @@ func (s *clientApplicationService) ReissueDBCert(ctx context.Context, req *vnetv
 		return nil, trace.Wrap(err, "reissuing database certificate")
 	}
 	s.setSignerForDB(dbKey, cert.PrivateKey.(crypto.Signer))
-	return &vnetv1.ReissueDBCertResponse{
+	return vnetv1.ReissueDBCertResponse_builder{
 		Cert: cert.Certificate[0],
-	}, nil
+	}.Build(), nil
 }
 
 // SignForDB implements [vnetv1.ClientApplicationServiceServer.SignForDB].
@@ -575,7 +575,7 @@ func (s *clientApplicationService) SignForDB(ctx context.Context, req *vnetv1.Si
 	log.DebugContext(ctx, "Got SignForDB request",
 		"db", req.GetDatabaseKey(),
 		"hash", signReq.GetHash(),
-		"is_rsa_pss", signReq.PssSaltLength != nil,
+		"is_rsa_pss", signReq.HasPssSaltLength(),
 		"pss_salt_len", signReq.GetPssSaltLength(),
 		"digest_len", len(signReq.GetDigest()),
 	)
@@ -593,9 +593,9 @@ func (s *clientApplicationService) SignForDB(ctx context.Context, req *vnetv1.Si
 	if err != nil {
 		return nil, trace.Wrap(err, "signing for database %v", dbKey)
 	}
-	return &vnetv1.SignForDBResponse{
+	return vnetv1.SignForDBResponse_builder{
 		Signature: signature,
-	}, nil
+	}.Build(), nil
 }
 
 // OnNewDBConnection gets called whenever a new database connection is about to
diff --git a/lib/vnet/client_application_service_client.go b/lib/vnet/client_application_service_client.go
index afc3f74f0fc..1a4c512837e 100644
--- a/lib/vnet/client_application_service_client.go
+++ b/lib/vnet/client_application_service_client.go
@@ -68,24 +68,24 @@ func (c *clientApplicationServiceClient) close() error {
 
 // Authenticate process authenticates the client application process.
 func (c *clientApplicationServiceClient) AuthenticateProcess(ctx context.Context, pipePath string) error {
-	resp, err := c.clt.AuthenticateProcess(ctx, &vnetv1.AuthenticateProcessRequest{
+	resp, err := c.clt.AuthenticateProcess(ctx, vnetv1.AuthenticateProcessRequest_builder{
 		Version:  api.Version,
 		PipePath: pipePath,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "calling AuthenticateProcess rpc")
 	}
-	if resp.Version != api.Version {
+	if resp.GetVersion() != api.Version {
 		return trace.BadParameter("version mismatch, user process version is %s, admin process version is %s",
-			resp.Version, api.Version)
+			resp.GetVersion(), api.Version)
 	}
 	return nil
 }
 
 func (c *clientApplicationServiceClient) ReportNetworkStackInfo(ctx context.Context, nsi *vnetv1.NetworkStackInfo) error {
-	if _, err := c.clt.ReportNetworkStackInfo(ctx, &vnetv1.ReportNetworkStackInfoRequest{
+	if _, err := c.clt.ReportNetworkStackInfo(ctx, vnetv1.ReportNetworkStackInfoRequest_builder{
 		NetworkStackInfo: nsi,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err, "calling ReportNetworkStackInfo rpc")
 	}
 	return nil
@@ -101,9 +101,9 @@ func (c *clientApplicationServiceClient) Ping(ctx context.Context) error {
 
 // ResolveFQDN resolves a query for a fully-qualified domain name to a target.
 func (c *clientApplicationServiceClient) ResolveFQDN(ctx context.Context, fqdn string) (*vnetv1.ResolveFQDNResponse, error) {
-	resp, err := c.clt.ResolveFQDN(ctx, &vnetv1.ResolveFQDNRequest{
+	resp, err := c.clt.ResolveFQDN(ctx, vnetv1.ResolveFQDNRequest_builder{
 		Fqdn: fqdn,
-	})
+	}.Build())
 	// Convert NotFound errors to errNoTCPHandler, which is what the network
 	// stack is looking for.
 	if trace.IsNotFound(err) {
@@ -117,10 +117,10 @@ func (c *clientApplicationServiceClient) ResolveFQDN(ctx context.Context, fqdn s
 
 // ReissueAppCert issues a new certificate for the requested app.
 func (c *clientApplicationServiceClient) ReissueAppCert(ctx context.Context, appInfo *vnetv1.AppInfo, targetPort uint16) ([]byte, error) {
-	resp, err := c.clt.ReissueAppCert(ctx, &vnetv1.ReissueAppCertRequest{
+	resp, err := c.clt.ReissueAppCert(ctx, vnetv1.ReissueAppCertRequest_builder{
 		AppInfo:    appInfo,
 		TargetPort: uint32(targetPort),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "calling ReissueAppCert rpc")
 	}
@@ -139,9 +139,9 @@ func (c *clientApplicationServiceClient) SignForApp(ctx context.Context, req *vn
 
 // OnNewAppConnection reports a new TCP connection to the target app.
 func (c *clientApplicationServiceClient) OnNewAppConnection(ctx context.Context, appKey *vnetv1.AppKey) error {
-	_, err := c.clt.OnNewAppConnection(ctx, &vnetv1.OnNewAppConnectionRequest{
+	_, err := c.clt.OnNewAppConnection(ctx, vnetv1.OnNewAppConnectionRequest_builder{
 		AppKey: appKey,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "calling OnNewAppConnection rpc")
 	}
@@ -151,10 +151,10 @@ func (c *clientApplicationServiceClient) OnNewAppConnection(ctx context.Context,
 // OnInvalidLocalPort reports a failed connection to an invalid local port for
 // the target app.
 func (c *clientApplicationServiceClient) OnInvalidLocalPort(ctx context.Context, appInfo *vnetv1.AppInfo, targetPort uint16) error {
-	_, err := c.clt.OnInvalidLocalPort(ctx, &vnetv1.OnInvalidLocalPortRequest{
+	_, err := c.clt.OnInvalidLocalPort(ctx, vnetv1.OnInvalidLocalPortRequest_builder{
 		AppInfo:    appInfo,
 		TargetPort: uint32(targetPort),
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "calling OnInvalidLocalPort rpc")
 	}
@@ -175,9 +175,9 @@ func (c *clientApplicationServiceClient) GetTargetOSConfiguration(ctx context.Co
 
 // UserTLSCert returns the user TLS certificate for the given profile.
 func (c *clientApplicationServiceClient) UserTLSCert(ctx context.Context, profileName string) (*vnetv1.UserTLSCertResponse, error) {
-	resp, err := c.clt.UserTLSCert(ctx, &vnetv1.UserTLSCertRequest{
+	resp, err := c.clt.UserTLSCert(ctx, vnetv1.UserTLSCertRequest_builder{
 		Profile: profileName,
-	})
+	}.Build())
 	return resp, trace.Wrap(err, "calling UserTLSCert rpc")
 }
 
@@ -198,27 +198,24 @@ func (c *clientApplicationServiceClient) SessionSSHConfig(
 	user string,
 	mode vnetv1.SessionSSHConfigCredentialMode,
 ) (*vnetv1.SessionSSHConfigResponse, error) {
-	resp, err := c.clt.SessionSSHConfig(
-		ctx,
-		&vnetv1.SessionSSHConfigRequest{
-			Profile:        target.profile,
-			RootCluster:    target.rootCluster,
-			LeafCluster:    target.leafCluster,
-			Address:        target.addr,
-			User:           user,
-			CredentialMode: mode,
-		},
-	)
+	resp, err := c.clt.SessionSSHConfig(ctx, vnetv1.SessionSSHConfigRequest_builder{
+		Profile:        target.profile,
+		RootCluster:    target.rootCluster,
+		LeafCluster:    target.leafCluster,
+		Address:        target.addr,
+		User:           user,
+		CredentialMode: mode,
+	}.Build())
 	return resp, trace.Wrap(err, "calling SessionSSHConfig rpc")
 }
 
 // SignForSSHSession signs a digest with the SSH private key associated with the
 // session from a previous call to SessionSSHConfig.
 func (c *clientApplicationServiceClient) SignForSSHSession(ctx context.Context, sessionID string, sign *vnetv1.SignRequest) ([]byte, error) {
-	resp, err := c.clt.SignForSSHSession(ctx, &vnetv1.SignForSSHSessionRequest{
+	resp, err := c.clt.SignForSSHSession(ctx, vnetv1.SignForSSHSessionRequest_builder{
 		SessionId: sessionID,
 		Sign:      sign,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "calling SignForSSHSession rpc")
 	}
@@ -230,9 +227,9 @@ func (c *clientApplicationServiceClient) SignForSSHSession(ctx context.Context,
 // public key that should be trusted for incoming connections from third-party
 // SSH clients.
 func (c *clientApplicationServiceClient) ExchangeSSHKeys(ctx context.Context, hostPublicKey ssh.PublicKey) (ssh.PublicKey, error) {
-	resp, err := c.clt.ExchangeSSHKeys(ctx, &vnetv1.ExchangeSSHKeysRequest{
+	resp, err := c.clt.ExchangeSSHKeys(ctx, vnetv1.ExchangeSSHKeysRequest_builder{
 		HostPublicKey: hostPublicKey.Marshal(),
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "calling ExchangeSSHKeys rpc")
 	}
@@ -252,11 +249,11 @@ func (c *clientApplicationServiceClient) PerformSessionMFACeremony(
 ) (string, error) {
 	resp, err := c.clt.PerformSessionMFACeremony(
 		ctx,
-		&vnetv1.PerformSessionMFACeremonyRequest{
+		vnetv1.PerformSessionMFACeremonyRequest_builder{
 			Profile:      profile,
 			LeafCluster:  leafCluster,
 			SshSessionId: sessionID,
-		},
+		}.Build(),
 	)
 	if err != nil {
 		return "", trace.Wrap(err, "calling PerformSessionMFACeremony rpc")
@@ -267,9 +264,9 @@ func (c *clientApplicationServiceClient) PerformSessionMFACeremony(
 
 // ReissueDBCert issues a new certificate for the requested database.
 func (c *clientApplicationServiceClient) ReissueDBCert(ctx context.Context, dbInfo *vnetv1.DatabaseInfo) ([]byte, error) {
-	resp, err := c.clt.ReissueDBCert(ctx, &vnetv1.ReissueDBCertRequest{
+	resp, err := c.clt.ReissueDBCert(ctx, vnetv1.ReissueDBCertRequest_builder{
 		DatabaseInfo: dbInfo,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "calling ReissueDBCert rpc")
 	}
@@ -287,9 +284,9 @@ func (c *clientApplicationServiceClient) SignForDB(ctx context.Context, req *vne
 
 // OnNewDBConnection reports a new database connection for observability.
 func (c *clientApplicationServiceClient) OnNewDBConnection(ctx context.Context, dbKey *vnetv1.DatabaseKey) error {
-	_, err := c.clt.OnNewDBConnection(ctx, &vnetv1.OnNewDBConnectionRequest{
+	_, err := c.clt.OnNewDBConnection(ctx, vnetv1.OnNewDBConnectionRequest_builder{
 		DatabaseKey: dbKey,
-	})
+	}.Build())
 	return trace.Wrap(err, "calling OnNewDBConnection rpc")
 }
 
@@ -323,20 +320,20 @@ func (s *rpcSigner) Public() crypto.PublicKey {
 
 // Sign implements [crypto.Signer.Sign] and issues a signature over digest.
 func (s *rpcSigner) Sign(_ io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
-	req := &vnetv1.SignRequest{
+	req := vnetv1.SignRequest_builder{
 		Digest: digest,
-	}
+	}.Build()
 	switch opts.HashFunc() {
 	case 0:
-		req.Hash = vnetv1.Hash_HASH_NONE
+		req.SetHash(vnetv1.Hash_HASH_NONE)
 	case crypto.SHA256:
-		req.Hash = vnetv1.Hash_HASH_SHA256
+		req.SetHash(vnetv1.Hash_HASH_SHA256)
 	default:
 		return nil, trace.BadParameter("unsupported signature hash func %v", opts.HashFunc())
 	}
 	if pssOpts, ok := opts.(*rsa.PSSOptions); ok {
 		saltLen := int32(pssOpts.SaltLength)
-		req.PssSaltLength = &saltLen
+		req.SetPssSaltLength(saltLen)
 	}
 	return s.sendRequest(req)
 }
diff --git a/lib/vnet/db_provider.go b/lib/vnet/db_provider.go
index 44c990beda8..438ef9a2f91 100644
--- a/lib/vnet/db_provider.go
+++ b/lib/vnet/db_provider.go
@@ -58,10 +58,10 @@ func (p *dbProvider) ReissueDBCert(ctx context.Context, dbInfo *vnetv1.DatabaseI
 
 func (p *dbProvider) newDBCertSigner(cert []byte, dbInfo *vnetv1.DatabaseInfo) (*rpcSigner, error) {
 	return newRPCCertSigner(cert, func(req *vnetv1.SignRequest) ([]byte, error) {
-		return p.clt.SignForDB(context.TODO(), &vnetv1.SignForDBRequest{
+		return p.clt.SignForDB(context.TODO(), vnetv1.SignForDBRequest_builder{
 			DatabaseKey: dbInfo.GetDatabaseKey(),
 			Sign:        req,
-		})
+		}.Build())
 	})
 }
 
diff --git a/lib/vnet/diag/diag.go b/lib/vnet/diag/diag.go
index 557389a8a0c..a3025918040 100644
--- a/lib/vnet/diag/diag.go
+++ b/lib/vnet/diag/diag.go
@@ -81,13 +81,13 @@ func GenerateReport(ctx context.Context, rp ReportPrerequisites) (*diagv1.Report
 	}
 
 	report := &diagv1.Report{}
-	report.CreatedAt = timestamppb.New(rp.Clock.Now().UTC())
-	report.NetworkStackAttempt = rp.NetworkStackAttempt
+	report.SetCreatedAt(timestamppb.New(rp.Clock.Now().UTC()))
+	report.SetNetworkStackAttempt(rp.NetworkStackAttempt)
 
 	for _, diagCheck := range rp.DiagChecks {
 		checkAttempt := runCheck(ctx, diagCheck, rp.SkipCommands)
 
-		report.Checks = append(report.Checks, checkAttempt)
+		report.SetChecks(append(report.GetChecks(), checkAttempt))
 	}
 
 	return report, nil
@@ -98,19 +98,19 @@ func runCheck(ctx context.Context, diagCheck DiagCheck, skipCommands bool) *diag
 
 	report, err := diagCheck.Run(ctx)
 	if err != nil {
-		attempt.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR
-		attempt.Error = err.Error()
+		attempt.SetStatus(diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR)
+		attempt.SetError(err.Error())
 		// In case of an error, CheckReport needs to be set to an empty value. Otherwise it'd be
 		// impossible to identify the type of a failed check.
-		attempt.CheckReport = diagCheck.EmptyCheckReport()
+		attempt.SetCheckReport(diagCheck.EmptyCheckReport())
 	} else {
-		attempt.Status = diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK
-		attempt.CheckReport = report
+		attempt.SetStatus(diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK)
+		attempt.SetCheckReport(report)
 	}
 
 	if !skipCommands {
 		for _, cmd := range diagCheck.Commands(ctx) {
-			attempt.Commands = append(attempt.Commands, runCommand(cmd))
+			attempt.SetCommands(append(attempt.GetCommands(), runCommand(cmd)))
 		}
 	}
 
@@ -131,25 +131,25 @@ func runCommand(cmd *exec.Cmd) *diagv1.CommandAttempt {
 			}
 		}
 
-		return &diagv1.CommandAttempt{
+		return diagv1.CommandAttempt_builder{
 			Status:  diagv1.CommandAttemptStatus_COMMAND_ATTEMPT_STATUS_ERROR,
 			Error:   errMessage,
 			Command: command,
-		}
+		}.Build()
 	}
 
 	// A protobuf string must contain valid UTF-8 or 7-bit ASCII text .
 	if !utf8.Valid(output) {
-		return &diagv1.CommandAttempt{
+		return diagv1.CommandAttempt_builder{
 			Status:  diagv1.CommandAttemptStatus_COMMAND_ATTEMPT_STATUS_ERROR,
 			Error:   "command output contains text that is not UTF-8 encoded",
 			Command: command,
-		}
+		}.Build()
 	}
 
-	return &diagv1.CommandAttempt{
+	return diagv1.CommandAttempt_builder{
 		Status:  diagv1.CommandAttemptStatus_COMMAND_ATTEMPT_STATUS_OK,
 		Command: command,
 		Output:  string(output),
-	}
+	}.Build()
 }
diff --git a/lib/vnet/diag/diag_test.go b/lib/vnet/diag/diag_test.go
index aca92b53905..da519165cf9 100644
--- a/lib/vnet/diag/diag_test.go
+++ b/lib/vnet/diag/diag_test.go
@@ -38,15 +38,15 @@ func TestGenerateReport_FailedCheck(t *testing.T) {
 	})
 
 	require.NoError(t, err)
-	require.Len(t, report.Checks, 1)
-	checkAttempt := report.Checks[0]
-	require.Equal(t, diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR, checkAttempt.Status)
+	require.Len(t, report.GetChecks(), 1)
+	checkAttempt := report.GetChecks()[0]
+	require.Equal(t, diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_ERROR, checkAttempt.GetStatus())
 
 	// Verify that commands are still included even if the check itself failed.
-	require.Len(t, checkAttempt.Commands, 1)
+	require.Len(t, checkAttempt.GetCommands(), 1)
 	// Verify that CheckReport is not empty, as otherwise it'd be impossible to tell the kind of the
 	// check that failed.
-	require.NotNil(t, checkAttempt.CheckReport)
+	require.NotNil(t, checkAttempt.GetCheckReport())
 }
 
 func TestGenerateReport_SkipCommands(t *testing.T) {
@@ -60,10 +60,10 @@ func TestGenerateReport_SkipCommands(t *testing.T) {
 	})
 
 	require.NoError(t, err)
-	require.Len(t, report.Checks, 1)
-	checkAttempt := report.Checks[0]
-	require.Equal(t, diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK, checkAttempt.Status)
-	require.Empty(t, checkAttempt.Commands)
+	require.Len(t, report.GetChecks(), 1)
+	checkAttempt := report.GetChecks()[0]
+	require.Equal(t, diagv1.CheckAttemptStatus_CHECK_ATTEMPT_STATUS_OK, checkAttempt.GetStatus())
+	require.Empty(t, checkAttempt.GetCommands())
 }
 
 type FakeDiagCheck struct {
@@ -75,13 +75,11 @@ func (f *FakeDiagCheck) Run(ctx context.Context) (*diagv1.CheckReport, error) {
 		return nil, trace.Errorf("something went wrong")
 	}
 
-	return &diagv1.CheckReport{
-		Report: &diagv1.CheckReport_RouteConflictReport{
-			RouteConflictReport: &diagv1.RouteConflictReport{
-				RouteConflicts: []*diagv1.RouteConflict{},
-			},
-		},
-	}, nil
+	return diagv1.CheckReport_builder{
+		RouteConflictReport: diagv1.RouteConflictReport_builder{
+			RouteConflicts: []*diagv1.RouteConflict{},
+		}.Build(),
+	}.Build(), nil
 }
 
 func (f *FakeDiagCheck) Commands(ctx context.Context) []*exec.Cmd {
diff --git a/lib/vnet/diag/routeconflict.go b/lib/vnet/diag/routeconflict.go
index d8d79b1104b..92a73dd19ef 100644
--- a/lib/vnet/diag/routeconflict.go
+++ b/lib/vnet/diag/routeconflict.go
@@ -133,14 +133,12 @@ func (c *RouteConflictDiag) Run(ctx context.Context) (*diagv1.CheckReport, error
 			status = diagv1.CheckReportStatus_CHECK_REPORT_STATUS_ISSUES_FOUND
 		}
 
-		return &diagv1.CheckReport{
+		return diagv1.CheckReport_builder{
 			Status: status,
-			Report: &diagv1.CheckReport_RouteConflictReport{
-				RouteConflictReport: &diagv1.RouteConflictReport{
-					RouteConflicts: rcs,
-				},
-			},
-		}, nil
+			RouteConflictReport: diagv1.RouteConflictReport_builder{
+				RouteConflicts: rcs,
+			}.Build(),
+		}.Build(), nil
 	}
 }
 
@@ -217,12 +215,12 @@ func (c *RouteConflictDiag) run(ctx context.Context) ([]*diagv1.RouteConflict, e
 				return nil, trace.Wrap(err)
 			}
 
-			rcs = append(rcs, &diagv1.RouteConflict{
+			rcs = append(rcs, diagv1.RouteConflict_builder{
 				Dest:          rd.String(),
 				VnetDest:      vnetDest.String(),
 				InterfaceName: iface.Name,
 				InterfaceApp:  ifaceNetworkExtDesc,
-			})
+			}.Build())
 			break
 		}
 	}
diff --git a/lib/vnet/diag/routeconflict_test.go b/lib/vnet/diag/routeconflict_test.go
index 57fd87ce8b4..889955a30cb 100644
--- a/lib/vnet/diag/routeconflict_test.go
+++ b/lib/vnet/diag/routeconflict_test.go
@@ -38,10 +38,10 @@ func TestRouteConflictDiag(t *testing.T) {
 	singleRouteConflict := func(t *testing.T, dests []RouteDest, rcs []*diagv1.RouteConflict) {
 		require.Len(t, rcs, 1)
 		rc := rcs[0]
-		require.Equal(t, dests[0].String(), rc.Dest)
-		require.Equal(t, dests[1].String(), rc.VnetDest)
-		require.Equal(t, quuxIface, rc.InterfaceName)
-		require.Equal(t, "foobar", rc.InterfaceApp)
+		require.Equal(t, dests[0].String(), rc.GetDest())
+		require.Equal(t, dests[1].String(), rc.GetVnetDest())
+		require.Equal(t, quuxIface, rc.GetInterfaceName())
+		require.Equal(t, "foobar", rc.GetInterfaceApp())
 	}
 
 	tests := map[string]struct {
@@ -94,16 +94,16 @@ func TestRouteConflictDiag(t *testing.T) {
 				require.Len(t, rcs, 2)
 
 				rc1 := rcs[0]
-				require.Equal(t, "1.2.3.4", rc1.Dest)
-				require.Equal(t, "0.0.0.0/1", rc1.VnetDest)
-				require.Equal(t, quuxIface, rc1.InterfaceName)
-				require.Equal(t, "foobar", rc1.InterfaceApp)
+				require.Equal(t, "1.2.3.4", rc1.GetDest())
+				require.Equal(t, "0.0.0.0/1", rc1.GetVnetDest())
+				require.Equal(t, quuxIface, rc1.GetInterfaceName())
+				require.Equal(t, "foobar", rc1.GetInterfaceApp())
 
 				rc2 := rcs[1]
-				require.Equal(t, "1.2.3.0/24", rc2.Dest)
-				require.Equal(t, "0.0.0.0/1", rc2.VnetDest)
-				require.Equal(t, quuxIface, rc2.InterfaceName)
-				require.Equal(t, "foobar", rc2.InterfaceApp)
+				require.Equal(t, "1.2.3.0/24", rc2.GetDest())
+				require.Equal(t, "0.0.0.0/1", rc2.GetVnetDest())
+				require.Equal(t, quuxIface, rc2.GetInterfaceName())
+				require.Equal(t, "foobar", rc2.GetInterfaceApp())
 			},
 		},
 		"default dests are ignored": {
@@ -135,7 +135,7 @@ func TestRouteConflictDiag(t *testing.T) {
 			require.NoError(t, err)
 			report, err := routeConflictDiag.Run(context.Background())
 			require.NoError(t, err)
-			rcs := report.GetRouteConflictReport().RouteConflicts
+			rcs := report.GetRouteConflictReport().GetRouteConflicts()
 
 			test.checkResult(t, test.dests, rcs)
 			require.Equal(t, 1, routing.getRouteDestinationsCallCount, "Unexpected number of calls to Routing.GetRouteDestinations")
@@ -204,7 +204,7 @@ func TestRouteConflictDiag_RetriesOnNoVnetRouteDestinations(t *testing.T) {
 	require.NoError(t, err)
 	report, err := routeConflictDiag.Run(context.Background())
 	require.NoError(t, err)
-	require.Empty(t, report.GetRouteConflictReport().RouteConflicts)
+	require.Empty(t, report.GetRouteConflictReport().GetRouteConflicts())
 
 	require.Equal(t, 3, routing.getRouteDestinationsCallCount, "Unexpected number of calls to Routing.GetRouteDestinations")
 }
diff --git a/lib/vnet/diag/ssh.go b/lib/vnet/diag/ssh.go
index c0708aa650b..7bd58790d2d 100644
--- a/lib/vnet/diag/ssh.go
+++ b/lib/vnet/diag/ssh.go
@@ -99,23 +99,23 @@ func (d *SSHDiag) run(ctx context.Context) (*diagv1.SSHConfigurationReport, erro
 	userOpenSSHConfigContents, included, err := d.sshConfigChecker.OpenSSHConfigIncludesVNetSSHConfig()
 	if err != nil {
 		if trace.IsNotFound(err) {
-			return &diagv1.SSHConfigurationReport{
+			return diagv1.SSHConfigurationReport_builder{
 				UserOpensshConfigPath: d.sshConfigChecker.UserOpenSSHConfigPath,
 				VnetSshConfigPath:     d.sshConfigChecker.VNetSSHConfigPath,
-			}, nil
+			}.Build(), nil
 		}
 		return nil, trace.Wrap(err)
 	}
 	if !utf8.Valid(userOpenSSHConfigContents) {
 		return nil, trace.Errorf("%s is not valid UTF-8", d.sshConfigChecker.UserOpenSSHConfigPath)
 	}
-	return &diagv1.SSHConfigurationReport{
+	return diagv1.SSHConfigurationReport_builder{
 		UserOpensshConfigPath:                  d.sshConfigChecker.UserOpenSSHConfigPath,
 		VnetSshConfigPath:                      d.sshConfigChecker.VNetSSHConfigPath,
 		UserOpensshConfigIncludesVnetSshConfig: included,
 		UserOpensshConfigExists:                true,
 		UserOpensshConfigContents:              string(userOpenSSHConfigContents),
-	}, nil
+	}.Build(), nil
 }
 
 // SSHConfigChecker checks the state of the user's SSH configuration.
diff --git a/lib/vnet/diag/ssh_test.go b/lib/vnet/diag/ssh_test.go
index a152f38c1ac..d2f5d6eab2c 100644
--- a/lib/vnet/diag/ssh_test.go
+++ b/lib/vnet/diag/ssh_test.go
@@ -211,18 +211,16 @@ func TestSSHDiag(t *testing.T) {
 				require.NoError(t, os.WriteFile(userOpenSSHConfigPath, []byte(tc.input), 0o600))
 			}
 
-			expectReport := &diagv1.CheckReport{
+			expectReport := diagv1.CheckReport_builder{
 				Status: diagv1.CheckReportStatus_CHECK_REPORT_STATUS_OK,
-				Report: &diagv1.CheckReport_SshConfigurationReport{
-					SshConfigurationReport: &diagv1.SSHConfigurationReport{
-						UserOpensshConfigPath:                  userOpenSSHConfigPath,
-						VnetSshConfigPath:                      keypaths.VNetSSHConfigPath(tc.profilePath),
-						UserOpensshConfigIncludesVnetSshConfig: tc.expect,
-						UserOpensshConfigExists:                len(tc.input) > 0,
-						UserOpensshConfigContents:              tc.input,
-					},
-				},
-			}
+				SshConfigurationReport: diagv1.SSHConfigurationReport_builder{
+					UserOpensshConfigPath:                  userOpenSSHConfigPath,
+					VnetSshConfigPath:                      keypaths.VNetSSHConfigPath(tc.profilePath),
+					UserOpensshConfigIncludesVnetSshConfig: tc.expect,
+					UserOpensshConfigExists:                len(tc.input) > 0,
+					UserOpensshConfigContents:              tc.input,
+				}.Build(),
+			}.Build()
 
 			report, err := diag.Run(t.Context())
 			require.NoError(t, err)
diff --git a/lib/vnet/embedded.go b/lib/vnet/embedded.go
index 49509a0817f..9ac1b8103d5 100644
--- a/lib/vnet/embedded.go
+++ b/lib/vnet/embedded.go
@@ -212,7 +212,7 @@ func (vnet *EmbeddedVNet) Run(ctx context.Context) error {
 type embeddedApplicationServiceClient struct{ service EmbeddedApplicationService }
 
 func (e *embeddedApplicationServiceClient) AuthenticateProcess(_ context.Context, req *vnetv1.AuthenticateProcessRequest, _ ...grpc.CallOption) (*vnetv1.AuthenticateProcessResponse, error) {
-	return &vnetv1.AuthenticateProcessResponse{Version: req.GetVersion()}, nil
+	return vnetv1.AuthenticateProcessResponse_builder{Version: req.GetVersion()}.Build(), nil
 }
 
 func (e *embeddedApplicationServiceClient) ReportNetworkStackInfo(context.Context, *vnetv1.ReportNetworkStackInfoRequest, ...grpc.CallOption) (*vnetv1.ReportNetworkStackInfoResponse, error) {
@@ -232,7 +232,7 @@ func (e *embeddedApplicationServiceClient) ReissueAppCert(ctx context.Context, r
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &vnetv1.ReissueAppCertResponse{Cert: cert.Certificate[0]}, nil
+	return vnetv1.ReissueAppCertResponse_builder{Cert: cert.Certificate[0]}.Build(), nil
 }
 
 func (e *embeddedApplicationServiceClient) SignForApp(ctx context.Context, req *vnetv1.SignForAppRequest, _ ...grpc.CallOption) (*vnetv1.SignForAppResponse, error) {
@@ -244,9 +244,9 @@ func (e *embeddedApplicationServiceClient) SignForApp(ctx context.Context, req *
 	if err != nil {
 		return nil, trace.Wrap(err, "signing for app %v", req.GetAppKey())
 	}
-	return &vnetv1.SignForAppResponse{
+	return vnetv1.SignForAppResponse_builder{
 		Signature: sig,
-	}, nil
+	}.Build(), nil
 }
 
 func (*embeddedApplicationServiceClient) OnNewAppConnection(context.Context, *vnetv1.OnNewAppConnectionRequest, ...grpc.CallOption) (*vnetv1.OnNewAppConnectionResponse, error) {
@@ -262,7 +262,7 @@ func (e *embeddedApplicationServiceClient) GetTargetOSConfiguration(ctx context.
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &vnetv1.GetTargetOSConfigurationResponse{TargetOsConfiguration: cfg}, nil
+	return vnetv1.GetTargetOSConfigurationResponse_builder{TargetOsConfiguration: cfg}.Build(), nil
 }
 
 func (e *embeddedApplicationServiceClient) UserTLSCert(ctx context.Context, req *vnetv1.UserTLSCertRequest, _ ...grpc.CallOption) (*vnetv1.UserTLSCertResponse, error) {
@@ -292,9 +292,9 @@ func (*embeddedApplicationServiceClient) ExchangeSSHKeys(context.Context, *vnetv
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &vnetv1.ExchangeSSHKeysResponse{
+	return vnetv1.ExchangeSSHKeysResponse_builder{
 		UserPublicKey: signer.PublicKey().Marshal(),
-	}, nil
+	}.Build(), nil
 }
 
 func (*embeddedApplicationServiceClient) PerformSessionMFACeremony(context.Context, *vnetv1.PerformSessionMFACeremonyRequest, ...grpc.CallOption) (*vnetv1.PerformSessionMFACeremonyResponse, error) {
@@ -306,7 +306,7 @@ func (e *embeddedApplicationServiceClient) ReissueDBCert(ctx context.Context, re
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &vnetv1.ReissueDBCertResponse{Cert: cert.Certificate[0]}, nil
+	return vnetv1.ReissueDBCertResponse_builder{Cert: cert.Certificate[0]}.Build(), nil
 }
 
 func (e *embeddedApplicationServiceClient) SignForDB(ctx context.Context, req *vnetv1.SignForDBRequest, _ ...grpc.CallOption) (*vnetv1.SignForDBResponse, error) {
@@ -318,7 +318,7 @@ func (e *embeddedApplicationServiceClient) SignForDB(ctx context.Context, req *v
 	if err != nil {
 		return nil, trace.Wrap(err, "signing for db %v", req.GetDatabaseKey())
 	}
-	return &vnetv1.SignForDBResponse{Signature: sig}, nil
+	return vnetv1.SignForDBResponse_builder{Signature: sig}.Build(), nil
 }
 
 func (*embeddedApplicationServiceClient) OnNewDBConnection(context.Context, *vnetv1.OnNewDBConnectionRequest, ...grpc.CallOption) (*vnetv1.OnNewDBConnectionResponse, error) {
diff --git a/lib/vnet/embedded_test.go b/lib/vnet/embedded_test.go
index 51e57f8ad26..f4cfd8c3eb3 100644
--- a/lib/vnet/embedded_test.go
+++ b/lib/vnet/embedded_test.go
@@ -48,7 +48,7 @@ func TestEmbeddedVNet(t *testing.T) {
 		tlsCA: tlsCA,
 		clock: clockwork.NewRealClock(),
 	})
-	proxyDialOpts.InsecureSkipVerify = true
+	proxyDialOpts.SetInsecureSkipVerify(true)
 
 	clientCert, err := newClientCert(ctx,
 		tlsCA,
@@ -112,31 +112,29 @@ type testEmbeddedApplicationService struct {
 }
 
 func (s *testEmbeddedApplicationService) ResolveFQDN(ctx context.Context, fqdn string) (*vnetv1.ResolveFQDNResponse, error) {
-	return &vnetv1.ResolveFQDNResponse{
-		Match: &vnetv1.ResolveFQDNResponse_MatchedTcpApp{
-			MatchedTcpApp: &vnetv1.MatchedTCPApp{
-				AppInfo: &vnetv1.AppInfo{
-					AppKey: &vnetv1.AppKey{
-						Name: "echo-server",
+	return vnetv1.ResolveFQDNResponse_builder{
+		MatchedTcpApp: vnetv1.MatchedTCPApp_builder{
+			AppInfo: vnetv1.AppInfo_builder{
+				AppKey: vnetv1.AppKey_builder{
+					Name: "echo-server",
+				}.Build(),
+				App: &types.AppV3{
+					Spec: types.AppSpecV3{
+						URI: "tcp://this-address-does-not-matter:1234",
 					},
-					App: &types.AppV3{
-						Spec: types.AppSpecV3{
-							URI: "tcp://this-address-does-not-matter:1234",
-						},
-					},
-					Ipv4CidrRange: vnet.DefaultIPv4CIDRRange,
-					DialOptions:   s.dialOpts,
 				},
-			},
-		},
-	}, nil
+				Ipv4CidrRange: vnet.DefaultIPv4CIDRRange,
+				DialOptions:   s.dialOpts,
+			}.Build(),
+		}.Build(),
+	}.Build(), nil
 }
 
 func (s *testEmbeddedApplicationService) GetTargetOSConfiguration(ctx context.Context) (*vnetv1.TargetOSConfiguration, error) {
-	return &vnetv1.TargetOSConfiguration{
+	return vnetv1.TargetOSConfiguration_builder{
 		DnsZones:       []string{"dunder-mifflin.com"},
 		Ipv4CidrRanges: []string{vnet.DefaultIPv4CIDRRange},
-	}, nil
+	}.Build(), nil
 }
 
 func (s *testEmbeddedApplicationService) GetAppCert(context.Context, *vnetv1.AppInfo, uint16) (*tls.Certificate, error) {
diff --git a/lib/vnet/escalate_nodaemon_darwin.go b/lib/vnet/escalate_nodaemon_darwin.go
index 80e9cfb4375..228832f6c28 100644
--- a/lib/vnet/escalate_nodaemon_darwin.go
+++ b/lib/vnet/escalate_nodaemon_darwin.go
@@ -46,12 +46,12 @@ on run argv
   set subCommand to item 2 of argv
   set addr to item 3 of argv
   set credPath to item 4 of argv
-  do shell script quoted form of executableName & `+
-		`" " & quoted form of subCommand & `+
-		`" -d --addr " & quoted form of addr & `+
-		`" --cred-path " & quoted form of credPath & `+
-		`" >/var/log/vnet.log 2>&1" `+
-		`with prompt "Teleport VNet wants to set up a virtual network device." `+
+  do shell script quoted form of executableName & ` +
+		`" " & quoted form of subCommand & ` +
+		`" -d --addr " & quoted form of addr & ` +
+		`" --cred-path " & quoted form of credPath & ` +
+		`" >/var/log/vnet.log 2>&1" ` +
+		`with prompt "Teleport VNet wants to set up a virtual network device." ` +
 		`with administrator privileges
 end run
 `
diff --git a/lib/vnet/fqdn_resolver.go b/lib/vnet/fqdn_resolver.go
index 3e3af1d6a97..b44b07cb499 100644
--- a/lib/vnet/fqdn_resolver.go
+++ b/lib/vnet/fqdn_resolver.go
@@ -339,13 +339,11 @@ func (r *fqdnResolver) resolveAppInfoForCluster(
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return &vnetv1.ResolveFQDNResponse{
-			Match: &vnetv1.ResolveFQDNResponse_MatchedTcpApp{
-				MatchedTcpApp: &vnetv1.MatchedTCPApp{
-					AppInfo: appInfo,
-				},
-			},
-		}, nil
+		return vnetv1.ResolveFQDNResponse_builder{
+			MatchedTcpApp: vnetv1.MatchedTCPApp_builder{
+				AppInfo: appInfo,
+			}.Build(),
+		}.Build(), nil
 
 	case r.shouldUseAppHTTPSTunnel(app):
 		log.InfoContext(ctx, "Query matched an HTTPS tunnel app", "protocol", app.GetProtocol())
@@ -353,21 +351,17 @@ func (r *fqdnResolver) resolveAppInfoForCluster(
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return &vnetv1.ResolveFQDNResponse{
-			Match: &vnetv1.ResolveFQDNResponse_MatchedHttpsTunnelApp{
-				MatchedHttpsTunnelApp: &vnetv1.MatchedHTTPSTunnelApp{
-					AppInfo: appInfo,
-				},
-			},
-		}, nil
+		return vnetv1.ResolveFQDNResponse_builder{
+			MatchedHttpsTunnelApp: vnetv1.MatchedHTTPSTunnelApp_builder{
+				AppInfo: appInfo,
+			}.Build(),
+		}.Build(), nil
 
 	default:
 		log.InfoContext(ctx, "Query matched a web app")
-		return &vnetv1.ResolveFQDNResponse{
-			Match: &vnetv1.ResolveFQDNResponse_MatchedWebApp{
-				MatchedWebApp: &vnetv1.MatchedWebApp{},
-			},
-		}, nil
+		return vnetv1.ResolveFQDNResponse_builder{
+			MatchedWebApp: &vnetv1.MatchedWebApp{},
+		}.Build(), nil
 	}
 }
 
@@ -382,17 +376,17 @@ func (r *fqdnResolver) makeAppInfo(ctx context.Context, candidate clusterResolut
 		log.ErrorContext(ctx, "Failed to get cluster dial options", "error", err)
 		return nil, trace.Wrap(err, "getting dial options for matching app")
 	}
-	return &vnetv1.AppInfo{
-		AppKey: &vnetv1.AppKey{
+	return vnetv1.AppInfo_builder{
+		AppKey: vnetv1.AppKey_builder{
 			Profile:     candidate.profileName,
 			LeafCluster: candidate.leafClusterName,
 			Name:        app.GetName(),
-		},
+		}.Build(),
 		Cluster:       candidate.clusterName,
 		App:           app,
 		Ipv4CidrRange: clusterConfig.IPv4CIDRRange,
 		DialOptions:   dialOpts,
-	}, nil
+	}.Build(), nil
 }
 
 func (r *fqdnResolver) resolveDBInfoForCluster(
@@ -446,24 +440,22 @@ func (r *fqdnResolver) resolveDBInfoForCluster(
 	}
 
 	log.InfoContext(ctx, "Query matched a database", "db_name", dbName, "protocol", protocol)
-	dbInfo := &vnetv1.DatabaseInfo{
-		DatabaseKey: &vnetv1.DatabaseKey{
+	dbInfo := vnetv1.DatabaseInfo_builder{
+		DatabaseKey: vnetv1.DatabaseKey_builder{
 			Profile:     candidate.profileName,
 			LeafCluster: candidate.leafClusterName,
 			Name:        dbName,
-		},
+		}.Build(),
 		Cluster:       candidate.clusterName,
 		Protocol:      protocol,
 		Ipv4CidrRange: clusterConfig.IPv4CIDRRange,
 		DialOptions:   dialOpts,
-	}
-	return &vnetv1.ResolveFQDNResponse{
-		Match: &vnetv1.ResolveFQDNResponse_MatchedDatabase{
-			MatchedDatabase: &vnetv1.MatchedDatabase{
-				DatabaseInfo: dbInfo,
-			},
-		},
-	}, nil
+	}.Build()
+	return vnetv1.ResolveFQDNResponse_builder{
+		MatchedDatabase: vnetv1.MatchedDatabase_builder{
+			DatabaseInfo: dbInfo,
+		}.Build(),
+	}.Build(), nil
 }
 
 // VNet SSH handles SSH hostnames matching "<hostname>.<cluster_name>.", where
@@ -492,17 +484,15 @@ func (r *fqdnResolver) resolveClusterMatch(ctx context.Context, log *slog.Logger
 
 		log.InfoContext(ctx, "Query matched a cluster subdomain and may later resolve to an app or SSH node",
 			"cluster_name", matchedCluster.clusterName)
-		return &vnetv1.ResolveFQDNResponse{
-			Match: &vnetv1.ResolveFQDNResponse_MatchedCluster{
-				MatchedCluster: &vnetv1.MatchedCluster{
-					WebProxyAddr:  rootDialOpts.GetWebProxyAddr(),
-					Ipv4CidrRange: clusterConfig.IPv4CIDRRange,
-					Profile:       matchedCluster.profileName,
-					RootCluster:   matchedCluster.rootClusterName,
-					LeafCluster:   matchedCluster.leafClusterName,
-				},
-			},
-		}, nil
+		return vnetv1.ResolveFQDNResponse_builder{
+			MatchedCluster: vnetv1.MatchedCluster_builder{
+				WebProxyAddr:  rootDialOpts.GetWebProxyAddr(),
+				Ipv4CidrRange: clusterConfig.IPv4CIDRRange,
+				Profile:       matchedCluster.profileName,
+				RootCluster:   matchedCluster.rootClusterName,
+				LeafCluster:   matchedCluster.leafClusterName,
+			}.Build(),
+		}.Build(), nil
 	}
 	return nil, errNoMatch
 }
diff --git a/lib/vnet/osconfig_provider.go b/lib/vnet/osconfig_provider.go
index 64975a762d1..f7b6a0f48fb 100644
--- a/lib/vnet/osconfig_provider.go
+++ b/lib/vnet/osconfig_provider.go
@@ -66,12 +66,12 @@ func (p *osConfigProvider) targetOSConfig(ctx context.Context) (*osConfig, error
 	if err != nil {
 		return nil, trace.Wrap(err, "getting target OS configuration from client application")
 	}
-	if p.tunIPv4 == "" && len(targetOSConfig.Ipv4CidrRanges) > 0 {
+	if p.tunIPv4 == "" && len(targetOSConfig.GetIpv4CidrRanges()) > 0 {
 		// Choose an IPv4 address for the TUN interface and the IPv4 DNS server
 		// from the CIDR range of one arbitrary currently logged-in cluster.
 		// We currently only assign one V4 address to the interface and only
 		// advertise DNS on one V4 address.
-		if err := p.setV4IPsFromFirstCIDR(targetOSConfig.Ipv4CidrRanges[0]); err != nil {
+		if err := p.setV4IPsFromFirstCIDR(targetOSConfig.GetIpv4CidrRanges()[0]); err != nil {
 			return nil, trace.Wrap(err, "setting TUN IPv4 address")
 		}
 	}
diff --git a/lib/vnet/osconfig_provider_test.go b/lib/vnet/osconfig_provider_test.go
index e368524ee46..6889e6ca891 100644
--- a/lib/vnet/osconfig_provider_test.go
+++ b/lib/vnet/osconfig_provider_test.go
@@ -95,10 +95,10 @@ func TestOSConfigProvider(t *testing.T) {
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
 			targetOSConfigGetter := &fakeTargetOSConfigGetter{
-				targetOSConfig: &vnetv1.TargetOSConfiguration{
+				targetOSConfig: vnetv1.TargetOSConfiguration_builder{
 					DnsZones:       tc.dnsZones,
 					Ipv4CidrRanges: tc.ipv4CIDRRanges,
-				},
+				}.Build(),
 				err: tc.getTargetOSConfigErr,
 			}
 			// Keep track of new DNS addresses the osConfigProvider tried to add.
diff --git a/lib/vnet/ssh_provider.go b/lib/vnet/ssh_provider.go
index 2ad7dc5198b..1d4d361ac10 100644
--- a/lib/vnet/ssh_provider.go
+++ b/lib/vnet/ssh_provider.go
@@ -153,10 +153,10 @@ func (p *sshProvider) userTLSConfig(
 	signer := &rpcSigner{
 		pub: parsedCert.PublicKey,
 		sendRequest: func(req *vnetv1.SignRequest) ([]byte, error) {
-			return p.cfg.clt.SignForUserTLS(ctx, &vnetv1.SignForUserTLSRequest{
+			return p.cfg.clt.SignForUserTLS(ctx, vnetv1.SignForUserTLSRequest_builder{
 				Profile: profile,
 				Sign:    req,
-			})
+			}.Build())
 		},
 	}
 	tlsCert := tls.Certificate{
diff --git a/lib/vnet/vnet_test.go b/lib/vnet/vnet_test.go
index 90bea3bf33f..f057956922f 100644
--- a/lib/vnet/vnet_test.go
+++ b/lib/vnet/vnet_test.go
@@ -482,20 +482,20 @@ func (p *fakeClientApp) GetVnetConfig(ctx context.Context, profileName, leafClus
 		if rootCluster.cidrRange == "" {
 			return nil, trace.NotFound("vnet_config not found")
 		}
-		cfg := &vnet.VnetConfig{
+		cfg := vnet.VnetConfig_builder{
 			Kind:    types.KindVnetConfig,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "vnet-config",
-			},
-			Spec: &vnet.VnetConfigSpec{
+			}.Build(),
+			Spec: vnet.VnetConfigSpec_builder{
 				Ipv4CidrRange: rootCluster.cidrRange,
-			},
-		}
+			}.Build(),
+		}.Build()
 		for _, zone := range rootCluster.customDNSZones {
-			cfg.Spec.CustomDnsZones = append(cfg.Spec.CustomDnsZones,
-				&vnet.CustomDNSZone{Suffix: zone},
-			)
+			cfg.GetSpec().SetCustomDnsZones(append(cfg.GetSpec().GetCustomDnsZones(),
+				vnet.CustomDNSZone_builder{Suffix: zone}.Build(),
+			))
 		}
 		return cfg, nil
 	}
@@ -506,20 +506,20 @@ func (p *fakeClientApp) GetVnetConfig(ctx context.Context, profileName, leafClus
 	if leafCluster.cidrRange == "" {
 		return nil, trace.NotFound("vnet_config not found")
 	}
-	cfg := &vnet.VnetConfig{
+	cfg := vnet.VnetConfig_builder{
 		Kind:    types.KindVnetConfig,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "vnet-config",
-		},
-		Spec: &vnet.VnetConfigSpec{
+		}.Build(),
+		Spec: vnet.VnetConfigSpec_builder{
 			Ipv4CidrRange: leafCluster.cidrRange,
-		},
-	}
+		}.Build(),
+	}.Build()
 	for _, zone := range leafCluster.customDNSZones {
-		cfg.Spec.CustomDnsZones = append(cfg.Spec.CustomDnsZones,
-			&vnet.CustomDNSZone{Suffix: zone},
-		)
+		cfg.GetSpec().SetCustomDnsZones(append(cfg.GetSpec().GetCustomDnsZones(),
+			vnet.CustomDNSZone_builder{Suffix: zone}.Build(),
+		))
 	}
 	return cfg, nil
 }
@@ -788,15 +788,15 @@ func (c *fakeAuthClient) Ping(ctx context.Context) (proto.PingResponse, error) {
 }
 
 func (c *fakeAuthClient) GetVnetConfig(ctx context.Context) (*vnet.VnetConfig, error) {
-	vnetConfig := &vnet.VnetConfig{
-		Spec: &vnet.VnetConfigSpec{
+	vnetConfig := vnet.VnetConfig_builder{
+		Spec: vnet.VnetConfigSpec_builder{
 			Ipv4CidrRange: c.clusterSpec.cidrRange,
-		},
-	}
+		}.Build(),
+	}.Build()
 	for _, zone := range c.clusterSpec.customDNSZones {
-		vnetConfig.Spec.CustomDnsZones = append(vnetConfig.Spec.CustomDnsZones, &vnet.CustomDNSZone{
+		vnetConfig.GetSpec().SetCustomDnsZones(append(vnetConfig.GetSpec().GetCustomDnsZones(), vnet.CustomDNSZone_builder{
 			Suffix: zone,
-		})
+		}.Build()))
 	}
 	return vnetConfig, nil
 }
@@ -2287,11 +2287,11 @@ func mustStartFakeWebProxy(
 
 	caPEM, err := tlsca.MarshalCertificatePEM(caX509)
 	require.NoError(t, err)
-	dialOpts := &vnetv1.DialOptions{
+	dialOpts := vnetv1.DialOptions_builder{
 		WebProxyAddr:          listener.Addr().String(),
 		RootClusterCaCertPool: caPEM,
 		Sni:                   proxyCN,
-	}
+	}.Build()
 	return dialOpts
 }
 
diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index 32d33b52eaf..571c885cdb7 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -2040,7 +2040,7 @@ func (h *Handler) getWebConfig(w http.ResponseWriter, r *http.Request, p httprou
 			&summarizerv1.IsEnabledRequest{},
 		)
 		if err == nil {
-			sessionSummarizerEnabled = isEnabledRes.Enabled
+			sessionSummarizerEnabled = isEnabledRes.GetEnabled()
 		}
 	})
 
@@ -3704,25 +3704,25 @@ func (h *Handler) notificationsGet(w http.ResponseWriter, r *http.Request, p htt
 	}
 	startKey := values.Get("startKey")
 
-	response, err := clt.NotificationServiceClient().ListNotifications(r.Context(), &notificationsv1.ListNotificationsRequest{
+	response, err := clt.NotificationServiceClient().ListNotifications(r.Context(), notificationsv1.ListNotificationsRequest_builder{
 		PageSize:  limit,
 		PageToken: startKey,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	var uiNotifications []ui.Notification
 
-	for _, notification := range response.Notifications {
+	for _, notification := range response.GetNotifications() {
 		uiNotif := ui.MakeNotification(notification)
 		uiNotifications = append(uiNotifications, uiNotif)
 	}
 
 	return GetNotificationsResponse{
 		Notifications:            uiNotifications,
-		NextKey:                  response.NextPageToken,
-		UserLastSeenNotification: response.UserLastSeenNotificationTimestamp.AsTime().Format(iso8601MilliFormat),
+		NextKey:                  response.GetNextPageToken(),
+		UserLastSeenNotification: response.GetUserLastSeenNotificationTimestamp().AsTime().Format(iso8601MilliFormat),
 	}, nil
 }
 
@@ -3749,19 +3749,19 @@ func (h *Handler) notificationsUpsertLastSeenTimestamp(w http.ResponseWriter, r
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := clt.NotificationServiceClient().UpsertUserLastSeenNotification(r.Context(), &notificationsv1.UpsertUserLastSeenNotificationRequest{
+	resp, err := clt.NotificationServiceClient().UpsertUserLastSeenNotification(r.Context(), notificationsv1.UpsertUserLastSeenNotificationRequest_builder{
 		Username: sctx.GetUser(),
-		UserLastSeenNotification: &notificationsv1.UserLastSeenNotification{
-			Status: &notificationsv1.UserLastSeenNotificationStatus{
+		UserLastSeenNotification: notificationsv1.UserLastSeenNotification_builder{
+			Status: notificationsv1.UserLastSeenNotificationStatus_builder{
 				LastSeenTime: timestamppb.New(lastSeenTime),
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	return &UpsertUserLastSeenNotificationRequest{
-		Time: resp.Status.LastSeenTime.AsTime().Format(iso8601MilliFormat),
+		Time: resp.GetStatus().GetLastSeenTime().AsTime().Format(iso8601MilliFormat),
 	}, nil
 }
 
@@ -3781,17 +3781,17 @@ func (h *Handler) notificationsUpsertNotificationState(w http.ResponseWriter, r
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := clt.NotificationServiceClient().UpsertUserNotificationState(r.Context(), &notificationsv1.UpsertUserNotificationStateRequest{
+	resp, err := clt.NotificationServiceClient().UpsertUserNotificationState(r.Context(), notificationsv1.UpsertUserNotificationStateRequest_builder{
 		Username: sctx.GetUser(),
-		UserNotificationState: &notificationsv1.UserNotificationState{
-			Spec: &notificationsv1.UserNotificationStateSpec{
+		UserNotificationState: notificationsv1.UserNotificationState_builder{
+			Spec: notificationsv1.UserNotificationStateSpec_builder{
 				NotificationId: req.NotificationId,
-			},
-			Status: &notificationsv1.UserNotificationStateStatus{
+			}.Build(),
+			Status: notificationsv1.UserNotificationStateStatus_builder{
 				NotificationState: req.NotificationState,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/apiserver_login_test.go b/lib/web/apiserver_login_test.go
index 0631a6fc02c..b3645fb908a 100644
--- a/lib/web/apiserver_login_test.go
+++ b/lib/web/apiserver_login_test.go
@@ -555,10 +555,10 @@ func TestAuthenticate_deviceWebToken(t *testing.T) {
 		Token: "this is an opaque token Token",
 	}
 	authServer.SetCreateDeviceWebTokenFunc(func(context.Context, *devicepb.DeviceWebToken) (*devicepb.DeviceWebToken, error) {
-		return &devicepb.DeviceWebToken{
+		return devicepb.DeviceWebToken_builder{
 			Id:    wantToken.Id,
 			Token: wantToken.Token,
-		}, nil
+		}.Build(), nil
 	})
 
 	ctx := context.Background()
diff --git a/lib/web/apiserver_ping_test.go b/lib/web/apiserver_ping_test.go
index 862abad2a1c..a44814743c9 100644
--- a/lib/web/apiserver_ping_test.go
+++ b/lib/web/apiserver_ping_test.go
@@ -354,11 +354,11 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "enable tools auto update",
-			config: &autoupdatev1pb.AutoUpdateConfigSpec{
-				Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+			config: autoupdatev1pb.AutoUpdateConfigSpec_builder{
+				Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 					Mode: autoupdate.ToolsUpdateModeEnabled,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsAutoUpdate:          true,
 				ToolsVersion:             api.Version,
@@ -370,18 +370,18 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "enable agent auto update, immediate schedule",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Metadata: &headerv1.Metadata{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAutoUpdateAgentRollout,
-				},
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+				}.Build(),
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
 					Schedule:       autoupdate.AgentsScheduleImmediate,
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
 				ToolsAutoUpdate:          false,
@@ -393,18 +393,18 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "agent rollout present but AU mode is disabled",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Metadata: &headerv1.Metadata{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAutoUpdateAgentRollout,
-				},
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+				}.Build(),
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeDisabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
 					Schedule:       autoupdate.AgentsScheduleImmediate,
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
 				ToolsAutoUpdate:          false,
@@ -429,11 +429,11 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "set tools auto update version",
-			version: &autoupdatev1pb.AutoUpdateVersionSpec{
-				Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+			version: autoupdatev1pb.AutoUpdateVersionSpec_builder{
+				Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 					TargetVersion: "1.2.3",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             "1.2.3",
 				ToolsAutoUpdate:          false,
@@ -445,16 +445,16 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "enable tools auto update and set version",
-			config: &autoupdatev1pb.AutoUpdateConfigSpec{
-				Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+			config: autoupdatev1pb.AutoUpdateConfigSpec_builder{
+				Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 					Mode: autoupdate.ToolsUpdateModeEnabled,
-				},
-			},
-			version: &autoupdatev1pb.AutoUpdateVersionSpec{
-				Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+				}.Build(),
+			}.Build(),
+			version: autoupdatev1pb.AutoUpdateVersionSpec_builder{
+				Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 					TargetVersion: "1.2.3",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsAutoUpdate:          true,
 				ToolsVersion:             "1.2.3",
@@ -465,16 +465,16 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "modify auto update config and version",
-			config: &autoupdatev1pb.AutoUpdateConfigSpec{
-				Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+			config: autoupdatev1pb.AutoUpdateConfigSpec_builder{
+				Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 					Mode: autoupdate.ToolsUpdateModeDisabled,
-				},
-			},
-			version: &autoupdatev1pb.AutoUpdateVersionSpec{
-				Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+				}.Build(),
+			}.Build(),
+			version: autoupdatev1pb.AutoUpdateVersionSpec_builder{
+				Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 					TargetVersion: "3.2.1",
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsAutoUpdate:          false,
 				ToolsVersion:             "3.2.1",
@@ -486,32 +486,32 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "group must be updated",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Metadata: &headerv1.Metadata{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAutoUpdateAgentRollout,
-				},
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+				}.Build(),
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
-				},
-				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       testGroup,
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 							ConfigDays: []string{"*"},
-						},
-						{
+						}.Build(),
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       "unstarted",
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 							ConfigDays: []string{"*"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
 				ToolsAutoUpdate:          false,
@@ -523,32 +523,32 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "group must not be updated",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Metadata: &headerv1.Metadata{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAutoUpdateAgentRollout,
-				},
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+				}.Build(),
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
-				},
-				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       "done",
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 							ConfigDays: []string{"*"},
-						},
-						{
+						}.Build(),
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       testGroup,
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 							ConfigDays: []string{"*"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
 				ToolsAutoUpdate:          false,
@@ -560,40 +560,40 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "canary must be updated",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Metadata: &headerv1.Metadata{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAutoUpdateAgentRollout,
-				},
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+				}.Build(),
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
-				},
-				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       testGroup,
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 							ConfigDays: []string{"*"},
 							Canaries: []*autoupdatev1pb.Canary{
-								{
+								autoupdatev1pb.Canary_builder{
 									UpdaterId: testUpdaterID,
 									HostId:    uuid.NewString(),
 									Hostname:  "test-host",
 									Success:   false,
-								},
+								}.Build(),
 							},
-						},
-						{
+						}.Build(),
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       "unstarted",
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 							ConfigDays: []string{"*"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
 				ToolsAutoUpdate:          false,
@@ -605,40 +605,40 @@ func TestPing_autoUpdateResources(t *testing.T) {
 		},
 		{
 			name: "canary must not be updated",
-			rollout: &autoupdatev1pb.AutoUpdateAgentRollout{
-				Metadata: &headerv1.Metadata{
+			rollout: autoupdatev1pb.AutoUpdateAgentRollout_builder{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAutoUpdateAgentRollout,
-				},
-				Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+				}.Build(),
+				Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
-				},
-				Status: &autoupdatev1pb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatev1pb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:  testGroup,
 							State: autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
 							Canaries: []*autoupdatev1pb.Canary{
-								{
+								autoupdatev1pb.Canary_builder{
 									UpdaterId: uuid.NewString(),
 									HostId:    uuid.NewString(),
 									Hostname:  "test-host",
 									Success:   false,
-								},
+								}.Build(),
 							},
 							ConfigDays: []string{"*"},
-						},
-						{
+						}.Build(),
+						autoupdatev1pb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:       "unstarted",
 							State:      autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 							ConfigDays: []string{"*"},
-						},
+						}.Build(),
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expected: webclient.AutoUpdateSettings{
 				ToolsVersion:             api.Version,
 				ToolsAutoUpdate:          false,
diff --git a/lib/web/apiserver_test.go b/lib/web/apiserver_test.go
index 2c50b4e5027..02fd9f92ae0 100644
--- a/lib/web/apiserver_test.go
+++ b/lib/web/apiserver_test.go
@@ -10127,12 +10127,12 @@ func startKubeWithoutCleanup(ctx context.Context, t *testing.T, cfg startKubeOpt
 
 	inventoryHandle, err := inventory.NewDownstreamHandle(client.InventoryControlStream,
 		func(ctx context.Context) (*authproto.UpstreamInventoryHello, error) {
-			return &authproto.UpstreamInventoryHello{
+			return authproto.UpstreamInventoryHello_builder{
 				ServerID: hostID,
 				Version:  teleport.Version,
 				Services: types.SystemRoles{role}.StringSlice(),
 				Hostname: "test",
-			}, nil
+			}.Build(), nil
 		})
 	require.NoError(t, err)
 	t.Cleanup(func() { require.NoError(t, inventoryHandle.Close()) })
@@ -10640,7 +10640,7 @@ func (s *fakeKubeService) ListKubernetesResources(ctx context.Context, req *kube
 	// NOTE: Here we are using the Teleport kinds.
 	case types.KindKubePod:
 		{
-			return &kubeproto.ListKubernetesResourcesResponse{
+			return kubeproto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind: "pods",
@@ -10668,11 +10668,11 @@ func (s *fakeKubeService) ListKubernetesResources(ctx context.Context, req *kube
 					},
 				},
 				TotalCount: 2,
-			}, nil
+			}.Build(), nil
 		}
 	case types.KindKubeNamespace:
 		{
-			return &kubeproto.ListKubernetesResourcesResponse{
+			return kubeproto.ListKubernetesResourcesResponse_builder{
 				Resources: []*types.KubernetesResourceV1{
 					{
 						Kind: "namespaces",
@@ -10685,7 +10685,7 @@ func (s *fakeKubeService) ListKubernetesResources(ctx context.Context, req *kube
 					},
 				},
 				TotalCount: 1,
-			}, nil
+			}.Build(), nil
 		}
 	default:
 		return nil, trace.BadParameter("kubernetes resource kind %q is not mocked", req.GetResourceType())
diff --git a/lib/web/desktop.go b/lib/web/desktop.go
index e76d9b1ba31..d35b99e8d0d 100644
--- a/lib/web/desktop.go
+++ b/lib/web/desktop.go
@@ -215,10 +215,10 @@ func (t *tdpHandshaker) forwardTDP(w io.Writer, username string, forwardKeyboard
 func (t *tdpHandshaker) forwardTDPB(w io.Writer, username string, _ bool) error {
 	// Convert to Client Hello
 	hello := &tdpb.ClientHello{
-		ScreenSpec: &tdpbv1.ClientScreenSpec{
+		ScreenSpec: tdpbv1.ClientScreenSpec_builder{
 			Height: t.screenSpec.Height,
 			Width:  t.screenSpec.Width,
-		},
+		}.Build(),
 		Username: username,
 	}
 	if t.keyboardLayout != nil {
@@ -300,8 +300,8 @@ func (t *tdpbHandshaker) forwardTDP(w io.Writer, username string, forwardKeyboar
 	messages = append(messages, legacy.ClientUsername{Username: username})
 
 	screenSpec := legacy.ClientScreenSpec{
-		Height: t.hello.ScreenSpec.Height,
-		Width:  t.hello.ScreenSpec.Width,
+		Height: t.hello.ScreenSpec.GetHeight(),
+		Width:  t.hello.ScreenSpec.GetWidth(),
 	}
 	messages = append(messages, screenSpec)
 
diff --git a/lib/web/desktop_test.go b/lib/web/desktop_test.go
index f75b2b2be97..12d881ef385 100644
--- a/lib/web/desktop_test.go
+++ b/lib/web/desktop_test.go
@@ -329,8 +329,8 @@ func TestHandshaker(t *testing.T) {
 		require.IsType(t, &tdpb.ClientHello{}, msg)
 		// Make sure everything got translated correctly.
 		assert.Equal(t, "bob", msg.(*tdpb.ClientHello).Username)
-		assert.Equal(t, uint32(1), msg.(*tdpb.ClientHello).ScreenSpec.Width)
-		assert.Equal(t, uint32(2), msg.(*tdpb.ClientHello).ScreenSpec.Height)
+		assert.Equal(t, uint32(1), msg.(*tdpb.ClientHello).ScreenSpec.GetWidth())
+		assert.Equal(t, uint32(2), msg.(*tdpb.ClientHello).ScreenSpec.GetHeight())
 	})
 
 	t.Run("tdpb-client", func(t *testing.T) {
@@ -348,10 +348,10 @@ func TestHandshaker(t *testing.T) {
 
 		// Send Client Hello plus a random message to be withheld
 		hello := &tdpb.ClientHello{
-			ScreenSpec: &tdpbv1.ClientScreenSpec{
+			ScreenSpec: tdpbv1.ClientScreenSpec_builder{
 				Width:  1,
 				Height: 2,
-			},
+			}.Build(),
 			KeyboardLayout: 12,
 		}
 		require.NoError(t, tdp.EncodeTo(&clientConn, hello))
@@ -366,8 +366,8 @@ func TestHandshaker(t *testing.T) {
 		// Should get the Client Hello back
 		require.IsType(t, &tdpb.ClientHello{}, msg)
 		assert.Equal(t, "bob", msg.(*tdpb.ClientHello).Username)
-		assert.Equal(t, uint32(1), msg.(*tdpb.ClientHello).ScreenSpec.Width)
-		assert.Equal(t, uint32(2), msg.(*tdpb.ClientHello).ScreenSpec.Height)
+		assert.Equal(t, uint32(1), msg.(*tdpb.ClientHello).ScreenSpec.GetWidth())
+		assert.Equal(t, uint32(2), msg.(*tdpb.ClientHello).ScreenSpec.GetHeight())
 		assert.Equal(t, uint32(12), msg.(*tdpb.ClientHello).KeyboardLayout)
 
 		// Should be empty
@@ -401,10 +401,10 @@ func TestHandshaker(t *testing.T) {
 	t.Run("withheld-tdpb-messages-are-translated", func(t *testing.T) {
 		tdpbHandshaker := tdpbHandshaker{
 			hello: &tdpb.ClientHello{
-				ScreenSpec: &tdpbv1.ClientScreenSpec{
+				ScreenSpec: tdpbv1.ClientScreenSpec_builder{
 					Width:  10,
 					Height: 10,
-				},
+				}.Build(),
 				KeyboardLayout: 1,
 			},
 			withheld: []tdp.Message{&tdpb.MouseMove{X: 1, Y: 2}},
diff --git a/lib/web/device_trust.go b/lib/web/device_trust.go
index 02f25c5ebf1..784165100e5 100644
--- a/lib/web/device_trust.go
+++ b/lib/web/device_trust.go
@@ -45,14 +45,14 @@ func (h *Handler) deviceWebConfirm(w http.ResponseWriter, r *http.Request, _ htt
 
 	// Read input parameters.
 	confirmToken := &devicepb.DeviceConfirmationToken{}
-	confirmToken.Id = query.Get("id")
-	confirmToken.Token = query.Get("token")
+	confirmToken.SetId(query.Get("id"))
+	confirmToken.SetToken(query.Get("token"))
 	unsafeRedirectURI := query.Get("redirect_uri")
 
 	switch {
-	case confirmToken.Id == "":
+	case confirmToken.GetId() == "":
 		return nil, trace.BadParameter("parameter id required")
-	case confirmToken.Token == "":
+	case confirmToken.GetToken() == "":
 		return nil, trace.BadParameter("parameter token required")
 	}
 
@@ -60,10 +60,10 @@ func (h *Handler) deviceWebConfirm(w http.ResponseWriter, r *http.Request, _ htt
 	devicesClient := h.GetProxyClient().DevicesClient()
 	ctx := r.Context()
 
-	_, err := devicesClient.ConfirmDeviceWebAuthentication(ctx, &devicepb.ConfirmDeviceWebAuthenticationRequest{
+	_, err := devicesClient.ConfirmDeviceWebAuthentication(ctx, devicepb.ConfirmDeviceWebAuthenticationRequest_builder{
 		ConfirmationToken:   confirmToken,
 		CurrentWebSessionId: sessionCtx.GetSessionID(),
-	})
+	}.Build())
 	switch {
 	case err != nil:
 		h.logger.WarnContext(ctx, "Device web authentication confirm failed",
diff --git a/lib/web/device_trust_test.go b/lib/web/device_trust_test.go
index b3ca8eeb8a9..804b0332b10 100644
--- a/lib/web/device_trust_test.go
+++ b/lib/web/device_trust_test.go
@@ -201,18 +201,18 @@ func TestHandler_DeviceWebConfirm(t *testing.T) {
 
 			got := fakeDevices.resetConfirmRequests()
 			want := []*devicepb.ConfirmDeviceWebAuthenticationRequest{
-				{
-					ConfirmationToken: &devicepb.DeviceConfirmationToken{
+				devicepb.ConfirmDeviceWebAuthenticationRequest_builder{
+					ConfirmationToken: devicepb.DeviceConfirmationToken_builder{
 						Id:    "my-token-id",
 						Token: "my-token-token",
-					},
-				},
+					}.Build(),
+				}.Build(),
 			}
 
 			if len(got) > 0 {
-				webSessionID := got[0].CurrentWebSessionId
+				webSessionID := got[0].GetCurrentWebSessionId()
 				assert.NotEmpty(t, webSessionID, "ConfirmDeviceWebAuthentication called with empty WebSessionID")
-				want[0].CurrentWebSessionId = webSessionID
+				want[0].SetCurrentWebSessionId(webSessionID)
 			}
 
 			if diff := cmp.Diff(want, got, protocmp.Transform()); diff != "" {
diff --git a/lib/web/integrations.go b/lib/web/integrations.go
index d9324dcf964..07b08ed1ea9 100644
--- a/lib/web/integrations.go
+++ b/lib/web/integrations.go
@@ -250,10 +250,10 @@ func (h *Handler) integrationsDelete(w http.ResponseWriter, r *http.Request, p h
 	}
 
 	deleteAssociatedResources, _ := apiutils.ParseBool(r.URL.Query().Get("associatedresources"))
-	if _, err := clt.IntegrationsClient().DeleteIntegration(r.Context(), &integrationv1.DeleteIntegrationRequest{
+	if _, err := clt.IntegrationsClient().DeleteIntegration(r.Context(), integrationv1.DeleteIntegrationRequest_builder{
 		Name:                      integrationName,
 		DeleteAssociatedResources: deleteAssociatedResources,
-	}); err != nil {
+	}.Build()); err != nil {
 		return nil, trace.Wrap(err)
 	}
 
@@ -346,10 +346,10 @@ func collectIntegrationStats(ctx context.Context, req collectIntegrationStatsReq
 		}
 	}
 
-	tasks := allUserTasks(ctx, req.userTasksClient, &usertasksv1.ListUserTasksFilters{
+	tasks := allUserTasks(ctx, req.userTasksClient, usertasksv1.ListUserTasksFilters_builder{
 		Integration: req.integration.GetName(),
 		TaskState:   usertasks.TaskStateOpen,
-	})
+	}.Build())
 	for task, err := range tasks {
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -471,10 +471,10 @@ func buildBriefSummaries(ctx context.Context, igs []types.Integration, uclt user
 	}
 
 	for name := range summaries {
-		tasks := allUserTasks(ctx, uclt, &usertasksv1.ListUserTasksFilters{
+		tasks := allUserTasks(ctx, uclt, usertasksv1.ListUserTasksFilters_builder{
 			Integration: name,
 			TaskState:   usertasks.TaskStateOpen,
-		})
+		}.Build())
 		for task, err := range tasks {
 			if err != nil {
 				return nil, trace.Wrap(err)
@@ -509,9 +509,9 @@ func addResourceCounts(rc *ui.ResourcesCount, dr *discoveryconfigv1.ResourcesDis
 	if rc == nil || dr == nil {
 		return
 	}
-	rc.Found += int(dr.Found)
-	rc.Enrolled += int(dr.Enrolled)
-	rc.Failed += int(dr.Failed)
+	rc.Found += int(dr.GetFound())
+	rc.Enrolled += int(dr.GetEnrolled())
+	rc.Failed += int(dr.GetFailed())
 }
 
 func allUserTasks(
@@ -906,10 +906,10 @@ func (h *Handler) integrationsMsTeamsAppZipGet(w http.ResponseWriter, r *http.Re
 		return nil, trace.Wrap(err)
 	}
 
-	plugin, err := clt.PluginsClient().GetPlugin(r.Context(), &pluginspb.GetPluginRequest{
+	plugin, err := clt.PluginsClient().GetPlugin(r.Context(), pluginspb.GetPluginRequest_builder{
 		Name:        p.ByName("plugin"),
 		WithSecrets: false,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -942,13 +942,13 @@ func (h *Handler) integrationsExportCA(_ http.ResponseWriter, r *http.Request, p
 		return nil, trace.Wrap(err)
 	}
 
-	resp, err := clt.IntegrationsClient().ExportIntegrationCertAuthorities(r.Context(), &integrationv1.ExportIntegrationCertAuthoritiesRequest{
+	resp, err := clt.IntegrationsClient().ExportIntegrationCertAuthorities(r.Context(), integrationv1.ExportIntegrationCertAuthoritiesRequest_builder{
 		Integration: integrationName,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	uiCAKeySet, err := ui.MakeCAKeySet(resp.CertAuthorities)
+	uiCAKeySet, err := ui.MakeCAKeySet(resp.GetCertAuthorities())
 	return uiCAKeySet, trace.Wrap(err)
 }
diff --git a/lib/web/integrations_awsoidc.go b/lib/web/integrations_awsoidc.go
index 534fd14ef7a..0e6d95b1ee3 100644
--- a/lib/web/integrations_awsoidc.go
+++ b/lib/web/integrations_awsoidc.go
@@ -83,14 +83,14 @@ func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p
 		return nil, trace.Wrap(err)
 	}
 
-	listDatabasesResp, err := clt.IntegrationAWSOIDCClient().ListDatabases(ctx, &integrationv1.ListDatabasesRequest{
+	listDatabasesResp, err := clt.IntegrationAWSOIDCClient().ListDatabases(ctx, integrationv1.ListDatabasesRequest_builder{
 		Integration: integrationName,
 		Region:      req.Region,
 		RdsType:     req.RDSType,
 		Engines:     req.Engines,
 		NextToken:   req.NextToken,
 		VpcId:       req.VPCID,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -101,8 +101,8 @@ func (h *Handler) awsOIDCListDatabases(w http.ResponseWriter, r *http.Request, p
 	}
 
 	return ui.AWSOIDCListDatabasesResponse{
-		NextToken: listDatabasesResp.NextToken,
-		Databases: ui.MakeDatabases(listDatabasesResp.Databases, accessChecker, h.cfg.DatabaseREPLRegistry),
+		NextToken: listDatabasesResp.GetNextToken(),
+		Databases: ui.MakeDatabases(listDatabasesResp.GetDatabases(), accessChecker, h.cfg.DatabaseREPLRegistry),
 	}, nil
 }
 
@@ -176,7 +176,7 @@ func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p
 		}
 	}
 
-	deployServiceResp, err := clt.IntegrationAWSOIDCClient().DeployService(ctx, &integrationv1.DeployServiceRequest{
+	deployServiceResp, err := clt.IntegrationAWSOIDCClient().DeployService(ctx, integrationv1.DeployServiceRequest_builder{
 		DeploymentJoinTokenName: iamTokenName,
 		DeploymentMode:          req.DeploymentMode,
 		TeleportConfigString:    teleportConfigString,
@@ -186,16 +186,16 @@ func (h *Handler) awsOIDCDeployService(w http.ResponseWriter, r *http.Request, p
 		SubnetIds:               req.SubnetIDs,
 		TaskRoleArn:             req.TaskRoleARN,
 		TeleportVersion:         teleportVersionTag,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return ui.AWSOIDCDeployServiceResponse{
-		ClusterARN:          deployServiceResp.ClusterArn,
-		ServiceARN:          deployServiceResp.ServiceArn,
-		TaskDefinitionARN:   deployServiceResp.TaskDefinitionArn,
-		ServiceDashboardURL: deployServiceResp.ServiceDashboardUrl,
+		ClusterARN:          deployServiceResp.GetClusterArn(),
+		ServiceARN:          deployServiceResp.GetServiceArn(),
+		TaskDefinitionARN:   deployServiceResp.GetTaskDefinitionArn(),
+		ServiceDashboardURL: deployServiceResp.GetServiceDashboardUrl(),
 	}, nil
 }
 
@@ -249,29 +249,29 @@ func (h *Handler) awsOIDCDeployDatabaseServices(w http.ResponseWriter, r *http.R
 			return nil, trace.Wrap(err)
 		}
 
-		deployments = append(deployments, &integrationv1.DeployDatabaseServiceDeployment{
+		deployments = append(deployments, integrationv1.DeployDatabaseServiceDeployment_builder{
 			VpcId:                d.VPCID,
 			SubnetIds:            d.SubnetIDs,
 			SecurityGroups:       d.SecurityGroups,
 			TeleportConfigString: teleportConfigString,
-		})
+		}.Build())
 	}
 
-	deployServiceResp, err := clt.IntegrationAWSOIDCClient().DeployDatabaseService(ctx, &integrationv1.DeployDatabaseServiceRequest{
+	deployServiceResp, err := clt.IntegrationAWSOIDCClient().DeployDatabaseService(ctx, integrationv1.DeployDatabaseServiceRequest_builder{
 		Integration:             integrationName,
 		Region:                  req.Region,
 		TaskRoleArn:             req.TaskRoleARN,
 		Deployments:             deployments,
 		TeleportVersion:         teleportVersionTag,
 		DeploymentJoinTokenName: deployserviceconfig.DefaultTeleportIAMTokenName,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return ui.AWSOIDCDeployDatabaseServiceResponse{
-		ClusterARN:          deployServiceResp.ClusterArn,
-		ClusterDashboardURL: deployServiceResp.ClusterDashboardUrl,
+		ClusterARN:          deployServiceResp.GetClusterArn(),
+		ClusterDashboardURL: deployServiceResp.GetClusterDashboardUrl(),
 	}, nil
 }
 
@@ -478,44 +478,44 @@ func listDeployedDatabaseServices(ctx context.Context,
 	for _, region := range regions {
 		var nextToken string
 		for {
-			resp, err := awsOIDCClient.ListDeployedDatabaseServices(ctx, &integrationv1.ListDeployedDatabaseServicesRequest{
+			resp, err := awsOIDCClient.ListDeployedDatabaseServices(ctx, integrationv1.ListDeployedDatabaseServicesRequest_builder{
 				Integration: integrationName,
 				Region:      region,
 				NextToken:   nextToken,
-			})
+			}.Build())
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
 
-			for _, deployedDatabaseService := range resp.DeployedDatabaseServices {
+			for _, deployedDatabaseService := range resp.GetDeployedDatabaseServices() {
 				matchingLabels, err := matchingLabelsFromDeployedService(deployedDatabaseService)
 				if err != nil {
 					logger.WarnContext(ctx, "Failed to obtain teleport config string from ECS Service",
-						"ecs_service", deployedDatabaseService.ServiceDashboardUrl,
+						"ecs_service", deployedDatabaseService.GetServiceDashboardUrl(),
 						"error", err,
 					)
 				}
 				validTeleportConfigFound := err == nil
 
 				services = append(services, ui.AWSOIDCDeployedDatabaseService{
-					Name:                deployedDatabaseService.Name,
-					DashboardURL:        deployedDatabaseService.ServiceDashboardUrl,
+					Name:                deployedDatabaseService.GetName(),
+					DashboardURL:        deployedDatabaseService.GetServiceDashboardUrl(),
 					MatchingLabels:      matchingLabels,
 					ValidTeleportConfig: validTeleportConfigFound,
 				})
 			}
 
-			if resp.NextToken == "" {
+			if resp.GetNextToken() == "" {
 				break
 			}
-			nextToken = resp.NextToken
+			nextToken = resp.GetNextToken()
 		}
 	}
 	return services, nil
 }
 
 func matchingLabelsFromDeployedService(deployedDatabaseService *integrationv1.DeployedDatabaseService) ([]libui.Label, error) {
-	commandArgs := deployedDatabaseService.ContainerCommand
+	commandArgs := deployedDatabaseService.GetContainerCommand()
 	// This command is what starts the teleport agent in the ECS Service Fargate container.
 	// See deployservice.go/upsertTask for details.
 	// It is expected to have at least 3 values, even if dumb-init is removed in the future.
@@ -814,24 +814,24 @@ func (h *Handler) awsOIDCEnrollEKSClusters(w http.ResponseWriter, r *http.Reques
 		extraLabels[label.Name] = label.Value
 	}
 
-	response, err := clt.IntegrationAWSOIDCClient().EnrollEKSClusters(ctx, &integrationv1.EnrollEKSClustersRequest{
+	response, err := clt.IntegrationAWSOIDCClient().EnrollEKSClusters(ctx, integrationv1.EnrollEKSClustersRequest_builder{
 		Integration:        integrationName,
 		Region:             req.Region,
 		EksClusterNames:    req.ClusterNames,
 		EnableAppDiscovery: req.EnableAppDiscovery,
 		AgentVersion:       agentVersion.String(),
 		ExtraLabels:        extraLabels,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	var data []ui.EKSClusterEnrollmentResult
-	for _, result := range response.Results {
+	for _, result := range response.GetResults() {
 		data = append(data, ui.EKSClusterEnrollmentResult{
-			ClusterName: result.EksClusterName,
-			Error:       result.Error,
-			ResourceId:  result.ResourceId,
+			ClusterName: result.GetEksClusterName(),
+			Error:       result.GetError(),
+			ResourceId:  result.GetResourceId(),
 		},
 		)
 	}
@@ -860,18 +860,18 @@ func (h *Handler) awsOIDCListEKSClusters(w http.ResponseWriter, r *http.Request,
 		return nil, trace.Wrap(err)
 	}
 
-	listResp, err := clt.IntegrationAWSOIDCClient().ListEKSClusters(ctx, &integrationv1.ListEKSClustersRequest{
+	listResp, err := clt.IntegrationAWSOIDCClient().ListEKSClusters(ctx, integrationv1.ListEKSClustersRequest_builder{
 		Integration: integrationName,
 		Region:      req.Region,
 		NextToken:   req.NextToken,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return ui.AWSOIDCListEKSClustersResponse{
-		NextToken: listResp.NextToken,
-		Clusters:  ui.MakeEKSClusters(listResp.Clusters),
+		NextToken: listResp.GetNextToken(),
+		Clusters:  ui.MakeEKSClusters(listResp.GetClusters()),
 	}, nil
 }
 
@@ -894,29 +894,29 @@ func (h *Handler) awsOIDCListSecurityGroups(w http.ResponseWriter, r *http.Reque
 		return nil, trace.Wrap(err)
 	}
 
-	listResp, err := clt.IntegrationAWSOIDCClient().ListSecurityGroups(ctx, &integrationv1.ListSecurityGroupsRequest{
+	listResp, err := clt.IntegrationAWSOIDCClient().ListSecurityGroups(ctx, integrationv1.ListSecurityGroupsRequest_builder{
 		Integration: integrationName,
 		Region:      req.Region,
 		VpcId:       req.VPCID,
 		NextToken:   req.NextToken,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	sgs := make([]awsoidc.SecurityGroup, 0, len(listResp.SecurityGroups))
-	for _, sg := range listResp.SecurityGroups {
+	sgs := make([]awsoidc.SecurityGroup, 0, len(listResp.GetSecurityGroups()))
+	for _, sg := range listResp.GetSecurityGroups() {
 		sgs = append(sgs, awsoidc.SecurityGroup{
-			Name:          sg.Name,
-			ID:            sg.Id,
-			Description:   sg.Description,
-			InboundRules:  awsOIDCSecurityGroupsRulesConverter(sg.InboundRules),
-			OutboundRules: awsOIDCSecurityGroupsRulesConverter(sg.OutboundRules),
+			Name:          sg.GetName(),
+			ID:            sg.GetId(),
+			Description:   sg.GetDescription(),
+			InboundRules:  awsOIDCSecurityGroupsRulesConverter(sg.GetInboundRules()),
+			OutboundRules: awsOIDCSecurityGroupsRulesConverter(sg.GetOutboundRules()),
 		})
 	}
 
 	return ui.AWSOIDCListSecurityGroupsResponse{
-		NextToken:      listResp.NextToken,
+		NextToken:      listResp.GetNextToken(),
 		SecurityGroups: sgs,
 	}, nil
 }
@@ -925,30 +925,30 @@ func awsOIDCSecurityGroupsRulesConverter(inRules []*integrationv1.SecurityGroupR
 	out := make([]awsoidc.SecurityGroupRule, 0, len(inRules))
 	for _, r := range inRules {
 		var cidrs []awsoidc.CIDR
-		if len(r.Cidrs) > 0 {
-			cidrs = make([]awsoidc.CIDR, 0, len(r.Cidrs))
+		if len(r.GetCidrs()) > 0 {
+			cidrs = make([]awsoidc.CIDR, 0, len(r.GetCidrs()))
 		}
-		for _, cidr := range r.Cidrs {
+		for _, cidr := range r.GetCidrs() {
 			cidrs = append(cidrs, awsoidc.CIDR{
-				CIDR:        cidr.Cidr,
-				Description: cidr.Description,
+				CIDR:        cidr.GetCidr(),
+				Description: cidr.GetDescription(),
 			})
 		}
 
 		var groupIDs []awsoidc.GroupIDRule
-		if len(r.GroupIds) > 0 {
-			groupIDs = make([]awsoidc.GroupIDRule, 0, len(r.GroupIds))
+		if len(r.GetGroupIds()) > 0 {
+			groupIDs = make([]awsoidc.GroupIDRule, 0, len(r.GetGroupIds()))
 		}
-		for _, group := range r.GroupIds {
+		for _, group := range r.GetGroupIds() {
 			groupIDs = append(groupIDs, awsoidc.GroupIDRule{
-				GroupId:     group.GroupId,
-				Description: group.Description,
+				GroupId:     group.GetGroupId(),
+				Description: group.GetDescription(),
 			})
 		}
 		out = append(out, awsoidc.SecurityGroupRule{
-			IPProtocol: r.IpProtocol,
-			FromPort:   int(r.FromPort),
-			ToPort:     int(r.ToPort),
+			IPProtocol: r.GetIpProtocol(),
+			FromPort:   int(r.GetFromPort()),
+			ToPort:     int(r.GetToPort()),
 			CIDRs:      cidrs,
 			Groups:     groupIDs,
 		})
@@ -1004,19 +1004,19 @@ func awsOIDCListAllDatabases(ctx context.Context, clt authclient.ClientI, integr
 
 	// Get all rds instances.
 	for {
-		resp, err := clt.IntegrationAWSOIDCClient().ListDatabases(ctx, &integrationv1.ListDatabasesRequest{
+		resp, err := clt.IntegrationAWSOIDCClient().ListDatabases(ctx, integrationv1.ListDatabasesRequest_builder{
 			Integration: integration,
 			Region:      region,
 			RdsType:     services.RDSDescribeTypeInstance,
 			Engines:     []string{services.RDSEngineMySQL, services.RDSEngineMariaDB, services.RDSEnginePostgres},
 			NextToken:   nextToken,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		fetchedRDSs = append(fetchedRDSs, resp.Databases...)
-		nextToken = resp.NextToken
+		fetchedRDSs = append(fetchedRDSs, resp.GetDatabases()...)
+		nextToken = resp.GetNextToken()
 
 		if len(nextToken) == 0 {
 			break
@@ -1026,19 +1026,19 @@ func awsOIDCListAllDatabases(ctx context.Context, clt authclient.ClientI, integr
 	// Get all rds clusters.
 	nextToken = ""
 	for {
-		resp, err := clt.IntegrationAWSOIDCClient().ListDatabases(ctx, &integrationv1.ListDatabasesRequest{
+		resp, err := clt.IntegrationAWSOIDCClient().ListDatabases(ctx, integrationv1.ListDatabasesRequest_builder{
 			Integration: integration,
 			Region:      region,
 			RdsType:     services.RDSDescribeTypeCluster,
 			Engines:     []string{services.RDSEngineAuroraMySQL, services.RDSEngineAuroraPostgres},
 			NextToken:   nextToken,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		fetchedRDSs = append(fetchedRDSs, resp.Databases...)
-		nextToken = resp.NextToken
+		fetchedRDSs = append(fetchedRDSs, resp.GetDatabases()...)
+		nextToken = resp.GetNextToken()
 
 		if len(nextToken) == 0 {
 			break
@@ -1469,27 +1469,27 @@ func (h *Handler) awsOIDCListSubnets(w http.ResponseWriter, r *http.Request, p h
 		return nil, trace.Wrap(err)
 	}
 
-	listResp, err := clt.IntegrationAWSOIDCClient().ListSubnets(ctx, &integrationv1.ListSubnetsRequest{
+	listResp, err := clt.IntegrationAWSOIDCClient().ListSubnets(ctx, integrationv1.ListSubnetsRequest_builder{
 		Integration: integrationName,
 		Region:      req.Region,
 		VpcId:       req.VPCID,
 		NextToken:   req.NextToken,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	subnets := make([]awsoidc.Subnet, 0, len(listResp.Subnets))
-	for _, s := range listResp.Subnets {
+	subnets := make([]awsoidc.Subnet, 0, len(listResp.GetSubnets()))
+	for _, s := range listResp.GetSubnets() {
 		subnets = append(subnets, awsoidc.Subnet{
-			Name:             s.Name,
-			ID:               s.Id,
-			AvailabilityZone: s.AvailabilityZone,
+			Name:             s.GetName(),
+			ID:               s.GetId(),
+			AvailabilityZone: s.GetAvailabilityZone(),
 		})
 	}
 
 	return ui.AWSOIDCListSubnetsResponse{
-		NextToken: listResp.NextToken,
+		NextToken: listResp.GetNextToken(),
 		Subnets:   subnets,
 	}, nil
 }
@@ -1515,11 +1515,11 @@ func (h *Handler) awsOIDCListDatabaseVPCs(w http.ResponseWriter, r *http.Request
 		return nil, trace.Wrap(err)
 	}
 
-	listResp, err := clt.IntegrationAWSOIDCClient().ListVPCs(ctx, &integrationv1.ListVPCsRequest{
+	listResp, err := clt.IntegrationAWSOIDCClient().ListVPCs(ctx, integrationv1.ListVPCsRequest_builder{
 		Integration: integrationName,
 		Region:      req.Region,
 		NextToken:   req.NextToken,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -1534,19 +1534,19 @@ func (h *Handler) awsOIDCListDatabaseVPCs(w http.ResponseWriter, r *http.Request
 		return nil, trace.Wrap(err)
 	}
 
-	vpcs := make([]ui.DatabaseEnrollmentVPC, 0, len(listResp.Vpcs))
-	for _, vpc := range listResp.Vpcs {
+	vpcs := make([]ui.DatabaseEnrollmentVPC, 0, len(listResp.GetVpcs()))
+	for _, vpc := range listResp.GetVpcs() {
 		vpcs = append(vpcs, ui.DatabaseEnrollmentVPC{
 			VPC: awsoidc.VPC{
-				Name: vpc.Name,
-				ID:   vpc.Id,
+				Name: vpc.GetName(),
+				ID:   vpc.GetId(),
 			},
-			ECSServiceDashboardURL: serviceURLByVPC[vpc.Id],
+			ECSServiceDashboardURL: serviceURLByVPC[vpc.GetId()],
 		})
 	}
 
 	return ui.AWSOIDCDatabaseVPCsResponse{
-		NextToken: listResp.NextToken,
+		NextToken: listResp.GetNextToken(),
 		VPCs:      vpcs,
 	}, nil
 }
@@ -1646,17 +1646,17 @@ func (h *Handler) awsOIDCPing(w http.ResponseWriter, r *http.Request, p httprout
 		integrationName = ""
 	}
 
-	pingResp, err := clt.IntegrationAWSOIDCClient().Ping(ctx, &integrationv1.PingRequest{
+	pingResp, err := clt.IntegrationAWSOIDCClient().Ping(ctx, integrationv1.PingRequest_builder{
 		Integration: integrationName,
 		RoleArn:     req.RoleARN,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
 	return ui.AWSOIDCPingResponse{
-		AccountID: pingResp.AccountId,
-		ARN:       pingResp.Arn,
-		UserID:    pingResp.UserId,
+		AccountID: pingResp.GetAccountId(),
+		ARN:       pingResp.GetArn(),
+		UserID:    pingResp.GetUserId(),
 	}, nil
 }
diff --git a/lib/web/integrations_awsoidc_test.go b/lib/web/integrations_awsoidc_test.go
index cf9e2d126c8..a1ce3e54393 100644
--- a/lib/web/integrations_awsoidc_test.go
+++ b/lib/web/integrations_awsoidc_test.go
@@ -1061,15 +1061,15 @@ func TestAWSOIDCSecurityGroupsRulesConverter(t *testing.T) {
 	}{
 		{
 			name: "valid",
-			in: []*integrationv1.SecurityGroupRule{{
+			in: []*integrationv1.SecurityGroupRule{integrationv1.SecurityGroupRule_builder{
 				IpProtocol: "tcp",
 				FromPort:   8080,
 				ToPort:     8081,
-				Cidrs: []*integrationv1.SecurityGroupRuleCIDR{{
+				Cidrs: []*integrationv1.SecurityGroupRuleCIDR{integrationv1.SecurityGroupRuleCIDR_builder{
 					Cidr:        "10.10.10.0/24",
 					Description: "cidr x",
-				}},
-			}},
+				}.Build()},
+			}.Build()},
 			expected: []awsoidc.SecurityGroupRule{{
 				IPProtocol: "tcp",
 				FromPort:   8080,
@@ -1294,11 +1294,11 @@ func (m *mockDeployedDatabaseServices) ListDeployedDatabaseServices(ctx context.
 	}
 	const pageSize = 10
 	ret := &integrationv1.ListDeployedDatabaseServicesResponse{}
-	if in.Integration != m.integration {
+	if in.GetIntegration() != m.integration {
 		return ret, nil
 	}
 
-	services := m.servicesPerRegion[in.Region]
+	services := m.servicesPerRegion[in.GetRegion()]
 	if len(services) == 0 {
 		return ret, nil
 	}
@@ -1306,8 +1306,8 @@ func (m *mockDeployedDatabaseServices) ListDeployedDatabaseServices(ctx context.
 	requestedPage := 1
 	totalResources := len(services)
 
-	if in.NextToken != "" {
-		currentMarker, err := strconv.Atoi(in.NextToken)
+	if in.GetNextToken() != "" {
+		currentMarker, err := strconv.Atoi(in.GetNextToken())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -1317,9 +1317,9 @@ func (m *mockDeployedDatabaseServices) ListDeployedDatabaseServices(ctx context.
 	sliceStart := pageSize * (requestedPage - 1)
 	sliceEnd := min(pageSize*requestedPage, totalResources)
 
-	ret.DeployedDatabaseServices = services[sliceStart:sliceEnd]
+	ret.SetDeployedDatabaseServices(services[sliceStart:sliceEnd])
 	if sliceEnd < totalResources {
-		ret.NextToken = strconv.Itoa(requestedPage + 1)
+		ret.SetNextToken(strconv.Itoa(requestedPage + 1))
 	}
 
 	return ret, nil
@@ -1521,12 +1521,12 @@ func buildCommandDeployedDatabaseService(t *testing.T, valid bool, matchingLabel
 func dummyDeployedDatabaseServices(count int, command []string) []*integrationv1.DeployedDatabaseService {
 	var ret []*integrationv1.DeployedDatabaseService
 	for i := range count {
-		ret = append(ret, &integrationv1.DeployedDatabaseService{
+		ret = append(ret, integrationv1.DeployedDatabaseService_builder{
 			Name:                fmt.Sprintf("database-service-vpc-%d", i),
 			ServiceDashboardUrl: "url",
 			ContainerEntryPoint: []string{"teleport"},
 			ContainerCommand:    command,
-		})
+		}.Build())
 	}
 	return ret
 }
diff --git a/lib/web/integrations_awsra.go b/lib/web/integrations_awsra.go
index 60b064ba877..ff118e7f6ea 100644
--- a/lib/web/integrations_awsra.go
+++ b/lib/web/integrations_awsra.go
@@ -211,18 +211,14 @@ func (h *Handler) awsRolesAnywherePing(w http.ResponseWriter, r *http.Request, p
 			return nil, trace.BadParameter("sync role and sync profile ARNs must be provided when trust anchor ARN is provided")
 		}
 
-		pingRequest.Mode = &integrationv1.AWSRolesAnywherePingRequest_Custom{
-			Custom: &integrationv1.AWSRolesAnywherePingRequestWithoutIntegration{
-				TrustAnchorArn: req.TrustAnchorARN,
-				RoleArn:        req.SyncRoleARN,
-				ProfileArn:     req.SyncProfileARN,
-			},
-		}
+		pingRequest.SetCustom(integrationv1.AWSRolesAnywherePingRequestWithoutIntegration_builder{
+			TrustAnchorArn: req.TrustAnchorARN,
+			RoleArn:        req.SyncRoleARN,
+			ProfileArn:     req.SyncProfileARN,
+		}.Build())
 
 	default:
-		pingRequest.Mode = &integrationv1.AWSRolesAnywherePingRequest_Integration{
-			Integration: integrationName,
-		}
+		pingRequest.SetIntegration(integrationName)
 	}
 
 	pingResp, err := clt.IntegrationAWSRolesAnywhereClient().AWSRolesAnywherePing(ctx, pingRequest)
@@ -260,18 +256,18 @@ func (h *Handler) awsRolesAnywhereListProfiles(w http.ResponseWriter, r *http.Re
 	allProfiles := &integrationv1.ListRolesAnywhereProfilesResponse{}
 	var startKey string
 	for {
-		listResp, err := clt.IntegrationAWSRolesAnywhereClient().ListRolesAnywhereProfiles(ctx, &integrationv1.ListRolesAnywhereProfilesRequest{
+		listResp, err := clt.IntegrationAWSRolesAnywhereClient().ListRolesAnywhereProfiles(ctx, integrationv1.ListRolesAnywhereProfilesRequest_builder{
 			Integration:        integrationName,
 			NextPageToken:      startKey,
 			ProfileNameFilters: req.Filters,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		allProfiles.Profiles = append(allProfiles.Profiles, listResp.Profiles...)
+		allProfiles.SetProfiles(append(allProfiles.GetProfiles(), listResp.GetProfiles()...))
 
-		startKey = listResp.NextPageToken
+		startKey = listResp.GetNextPageToken()
 		if startKey == "" {
 			break
 		}
diff --git a/lib/web/integrations_test.go b/lib/web/integrations_test.go
index 7e19d900ca0..8a3a5f92a1a 100644
--- a/lib/web/integrations_test.go
+++ b/lib/web/integrations_test.go
@@ -312,14 +312,14 @@ func TestCollectIntegrationStats(t *testing.T) {
 		var userTasksList []*usertasksv1.UserTask
 		ec2UserTasks := 10
 		for range ec2UserTasks {
-			userTasksList = append(userTasksList, &usertasksv1.UserTask{Spec: &usertasksv1.UserTaskSpec{State: usertasks.TaskStateOpen, TaskType: usertasks.TaskTypeDiscoverEC2}})
+			userTasksList = append(userTasksList, usertasksv1.UserTask_builder{Spec: usertasksv1.UserTaskSpec_builder{State: usertasks.TaskStateOpen, TaskType: usertasks.TaskTypeDiscoverEC2}.Build()}.Build())
 		}
 		rdsUserTasks := 20
 		for range rdsUserTasks {
-			userTasksList = append(userTasksList, &usertasksv1.UserTask{Spec: &usertasksv1.UserTaskSpec{State: usertasks.TaskStateOpen, TaskType: usertasks.TaskTypeDiscoverRDS}})
+			userTasksList = append(userTasksList, usertasksv1.UserTask_builder{Spec: usertasksv1.UserTaskSpec_builder{State: usertasks.TaskStateOpen, TaskType: usertasks.TaskTypeDiscoverRDS}.Build()}.Build())
 		}
 		for range 100 {
-			userTasksList = append(userTasksList, &usertasksv1.UserTask{Spec: &usertasksv1.UserTaskSpec{State: usertasks.TaskStateResolved, TaskType: usertasks.TaskTypeDiscoverEC2}})
+			userTasksList = append(userTasksList, usertasksv1.UserTask_builder{Spec: usertasksv1.UserTaskSpec_builder{State: usertasks.TaskStateResolved, TaskType: usertasks.TaskTypeDiscoverEC2}.Build()}.Build())
 		}
 
 		var openUserTasksList []*usertasksv1.UserTask
@@ -376,15 +376,15 @@ func TestCollectIntegrationStats(t *testing.T) {
 				DiscoveredResources: 2,
 				ServerStatus: map[string]*discoveryconfig.DiscoveryStatusServer{
 					"server-1": {
-						DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+						DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 							IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-								integrationName: {
-									AwsEc2: &discoveryconfigv1.ResourceSummary{
-										Previous: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 2, Enrolled: 1, Failed: 1, SyncStart: syncEnd, SyncEnd: syncEnd},
-									},
-								},
+								integrationName: discoveryconfigv1.DiscoverSummary_builder{
+									AwsEc2: discoveryconfigv1.ResourceSummary_builder{
+										Previous: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 2, Enrolled: 1, Failed: 1, SyncStart: syncEnd, SyncEnd: syncEnd}.Build(),
+									}.Build(),
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 				},
 			},
@@ -400,15 +400,15 @@ func TestCollectIntegrationStats(t *testing.T) {
 				DiscoveredResources: 2,
 				ServerStatus: map[string]*discoveryconfig.DiscoveryStatusServer{
 					"server-1": {
-						DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+						DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 							IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-								integrationName: {
-									AwsRds: &discoveryconfigv1.ResourceSummary{
-										Previous: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 2, Enrolled: 1, Failed: 1, SyncStart: syncEnd, SyncEnd: syncEnd},
-									},
-								},
+								integrationName: discoveryconfigv1.DiscoverSummary_builder{
+									AwsRds: discoveryconfigv1.ResourceSummary_builder{
+										Previous: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 2, Enrolled: 1, Failed: 1, SyncStart: syncEnd, SyncEnd: syncEnd}.Build(),
+									}.Build(),
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 				},
 			},
@@ -424,15 +424,15 @@ func TestCollectIntegrationStats(t *testing.T) {
 				DiscoveredResources: 2,
 				ServerStatus: map[string]*discoveryconfig.DiscoveryStatusServer{
 					"server-1": {
-						DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+						DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 							IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-								integrationName: {
-									AwsEks: &discoveryconfigv1.ResourceSummary{
-										Previous: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 4, Enrolled: 0, Failed: 0, SyncStart: syncEnd, SyncEnd: syncEnd},
-									},
-								},
+								integrationName: discoveryconfigv1.DiscoverSummary_builder{
+									AwsEks: discoveryconfigv1.ResourceSummary_builder{
+										Previous: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 4, Enrolled: 0, Failed: 0, SyncStart: syncEnd, SyncEnd: syncEnd}.Build(),
+									}.Build(),
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 				},
 			},
@@ -508,15 +508,15 @@ func TestCollectIntegrationStats(t *testing.T) {
 				DiscoveredResources: 2,
 				ServerStatus: map[string]*discoveryconfig.DiscoveryStatusServer{
 					"server-1": {
-						DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+						DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 							IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-								integrationName: {
-									AwsRds: &discoveryconfigv1.ResourceSummary{
-										Previous: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 2, Enrolled: 1, Failed: 1, SyncStart: syncEnd, SyncEnd: syncEnd},
-									},
-								},
+								integrationName: discoveryconfigv1.DiscoverSummary_builder{
+									AwsRds: discoveryconfigv1.ResourceSummary_builder{
+										Previous: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 2, Enrolled: 1, Failed: 1, SyncStart: syncEnd, SyncEnd: syncEnd}.Build(),
+									}.Build(),
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 				},
 			},
@@ -723,21 +723,21 @@ func TestCollectIntegrationStats(t *testing.T) {
 				LastSyncTime: syncTime,
 				ServerStatus: map[string]*discoveryconfig.DiscoveryStatusServer{
 					"server-1": {
-						DiscoveryStatusServer: &discoveryconfigv1.DiscoveryStatusServer{
+						DiscoveryStatusServer: discoveryconfigv1.DiscoveryStatusServer_builder{
 							IntegrationSummaries: map[string]*discoveryconfigv1.DiscoverSummary{
-								integrationName: {
-									AzureVms: &discoveryconfigv1.ResourceSummary{
-										Previous: &discoveryconfigv1.ResourcesDiscoveredSummary{
+								integrationName: discoveryconfigv1.DiscoverSummary_builder{
+									AzureVms: discoveryconfigv1.ResourceSummary_builder{
+										Previous: discoveryconfigv1.ResourcesDiscoveredSummary_builder{
 											Found:     5,
 											Enrolled:  3,
 											Failed:    1,
 											SyncStart: syncEnd,
 											SyncEnd:   syncEnd,
-										},
-									},
-								},
+										}.Build(),
+									}.Build(),
+								}.Build(),
 							},
-						},
+						}.Build(),
 					},
 				},
 			},
@@ -745,7 +745,7 @@ func TestCollectIntegrationStats(t *testing.T) {
 
 		var userTasksList []*usertasksv1.UserTask
 		for range 10 {
-			userTasksList = append(userTasksList, &usertasksv1.UserTask{Spec: &usertasksv1.UserTaskSpec{State: usertasks.TaskStateOpen, TaskType: usertasks.TaskTypeDiscoverAzureVM}})
+			userTasksList = append(userTasksList, usertasksv1.UserTask_builder{Spec: usertasksv1.UserTaskSpec_builder{State: usertasks.TaskStateOpen, TaskType: usertasks.TaskTypeDiscoverAzureVM}.Build()}.Build())
 		}
 
 		clt := &mockRelevantAWSRegionsClient{
@@ -1296,31 +1296,31 @@ func TestBuildBriefSummaries(t *testing.T) {
 	mockGithubInt := newMockGitHubIntegration(t, "gh")
 
 	mockUserTasks := []*usertasksv1.UserTask{
-		{
-			Spec: &usertasksv1.UserTaskSpec{
+		usertasksv1.UserTask_builder{
+			Spec: usertasksv1.UserTaskSpec_builder{
 				Integration: mockAwsInt.GetName(),
 				TaskType:    usertasks.TaskTypeDiscoverEC2,
 				State:       usertasks.TaskStateOpen,
-			},
-		},
-		{
-			Spec: &usertasksv1.UserTaskSpec{
+			}.Build(),
+		}.Build(),
+		usertasksv1.UserTask_builder{
+			Spec: usertasksv1.UserTaskSpec_builder{
 				Integration: mockAwsInt.GetName(),
 				TaskType:    usertasks.TaskTypeDiscoverEKS,
 				State:       usertasks.TaskStateOpen,
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 
 	mockDC1 := &discoveryconfig.DiscoveryConfig{
 		Status: discoveryconfig.Status{
 			IntegrationDiscoveredResources: map[string]*discoveryconfig.IntegrationDiscoveredSummary{
 				mockAwsInt.GetName(): {
-					IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-						AwsEc2: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 2, Enrolled: 1, Failed: 0},
-						AwsEks: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 3, Enrolled: 0, Failed: 1},
-						AwsRds: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 5, Enrolled: 2, Failed: 2},
-					},
+					IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+						AwsEc2: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 2, Enrolled: 1, Failed: 0}.Build(),
+						AwsEks: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 3, Enrolled: 0, Failed: 1}.Build(),
+						AwsRds: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 5, Enrolled: 2, Failed: 2}.Build(),
+					}.Build(),
 				},
 			},
 		},
@@ -1329,9 +1329,9 @@ func TestBuildBriefSummaries(t *testing.T) {
 		Status: discoveryconfig.Status{
 			IntegrationDiscoveredResources: map[string]*discoveryconfig.IntegrationDiscoveredSummary{
 				mockAwsInt.GetName(): {
-					IntegrationDiscoveredSummary: &discoveryconfigv1.IntegrationDiscoveredSummary{
-						AzureVms: &discoveryconfigv1.ResourcesDiscoveredSummary{Found: 2, Enrolled: 1, Failed: 0},
-					},
+					IntegrationDiscoveredSummary: discoveryconfigv1.IntegrationDiscoveredSummary_builder{
+						AzureVms: discoveryconfigv1.ResourcesDiscoveredSummary_builder{Found: 2, Enrolled: 1, Failed: 0}.Build(),
+					}.Build(),
 				},
 			},
 		},
diff --git a/lib/web/inventory.go b/lib/web/inventory.go
index e2e5d142ea8..ca49a41535b 100644
--- a/lib/web/inventory.go
+++ b/lib/web/inventory.go
@@ -96,13 +96,13 @@ func (h *Handler) clusterUnifiedInstancesGet(w http.ResponseWriter, r *http.Requ
 		upgraders = strings.Split(upgradersParam, ",")
 	}
 
-	filter := &inventoryv1.ListUnifiedInstancesFilter{
+	filter := inventoryv1.ListUnifiedInstancesFilter_builder{
 		Search:              values.Get("search"),
 		PredicateExpression: values.Get("query"),
 		Services:            splitQuery(values.Get("services")),
 		Upgraders:           upgraders,
 		UpdaterGroups:       splitQuery(values.Get("updaterGroups")),
-	}
+	}.Build()
 
 	var hasInstance, hasBotInstance bool
 	for t := range strings.SplitSeq(values.Get("types"), ",") {
@@ -118,30 +118,30 @@ func (h *Handler) clusterUnifiedInstancesGet(w http.ResponseWriter, r *http.Requ
 		}
 	}
 	if hasInstance {
-		filter.InstanceTypes = append(filter.InstanceTypes, inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE)
+		filter.SetInstanceTypes(append(filter.GetInstanceTypes(), inventoryv1.InstanceType_INSTANCE_TYPE_INSTANCE))
 	}
 	if hasBotInstance {
-		filter.InstanceTypes = append(filter.InstanceTypes, inventoryv1.InstanceType_INSTANCE_TYPE_BOT_INSTANCE)
+		filter.SetInstanceTypes(append(filter.GetInstanceTypes(), inventoryv1.InstanceType_INSTANCE_TYPE_BOT_INSTANCE))
 	}
 
-	resp, err := clt.ListUnifiedInstances(r.Context(), &inventoryv1.ListUnifiedInstancesRequest{
+	resp, err := clt.ListUnifiedInstances(r.Context(), inventoryv1.ListUnifiedInstancesRequest_builder{
 		PageSize:  limit,
 		PageToken: startKey,
 		Sort:      sort,
 		Order:     order,
 		Filter:    filter,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	uiInstances := make([]ui.UnifiedInstance, 0, len(resp.Items))
-	for _, item := range resp.Items {
+	uiInstances := make([]ui.UnifiedInstance, 0, len(resp.GetItems()))
+	for _, item := range resp.GetItems() {
 		uiInstances = append(uiInstances, ui.MakeUnifiedInstance(item))
 	}
 
 	return &listUnifiedInstancesResponse{
 		Instances: uiInstances,
-		StartKey:  resp.NextPageToken,
+		StartKey:  resp.GetNextPageToken(),
 	}, nil
 }
diff --git a/lib/web/inventory_test.go b/lib/web/inventory_test.go
index 32837902818..df4e5f46375 100644
--- a/lib/web/inventory_test.go
+++ b/lib/web/inventory_test.go
@@ -112,51 +112,51 @@ func TestListUnifiedInstances(t *testing.T) {
 
 	// Create mock bot instances
 	bots := []*machineidv1.BotInstance{
-		{
-			Metadata: &headerv1.Metadata{Name: "bot-1"},
-			Spec: &machineidv1.BotInstanceSpec{
+		machineidv1.BotInstance_builder{
+			Metadata: headerv1.Metadata_builder{Name: "bot-1"}.Build(),
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-1",
 				InstanceId: "bot-1",
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						RecordedAt: timestamppb.Now(),
 						Version:    "18.7.0",
-					},
+					}.Build(),
 				},
-			},
-		},
-		{
-			Metadata: &headerv1.Metadata{Name: "bot-2"},
-			Spec: &machineidv1.BotInstanceSpec{
+			}.Build(),
+		}.Build(),
+		machineidv1.BotInstance_builder{
+			Metadata: headerv1.Metadata_builder{Name: "bot-2"}.Build(),
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-2",
 				InstanceId: "bot-2",
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						RecordedAt: timestamppb.Now(),
 						Version:    "18.8.0",
-					},
+					}.Build(),
 				},
-			},
-		},
-		{
-			Metadata: &headerv1.Metadata{Name: "bot-3"},
-			Spec: &machineidv1.BotInstanceSpec{
+			}.Build(),
+		}.Build(),
+		machineidv1.BotInstance_builder{
+			Metadata: headerv1.Metadata_builder{Name: "bot-3"}.Build(),
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-3",
 				InstanceId: "bot-3",
-			},
-			Status: &machineidv1.BotInstanceStatus{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
 				LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-					{
+					machineidv1.BotInstanceStatusHeartbeat_builder{
 						RecordedAt: timestamppb.Now(),
 						Version:    "18.9.0",
-					},
+					}.Build(),
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}
 	for _, bot := range bots {
 		_, err := env.server.Auth().BotInstance.CreateBotInstance(ctx, bot)
diff --git a/lib/web/join_tokens_test.go b/lib/web/join_tokens_test.go
index 60fc91301d9..cf9cbf64259 100644
--- a/lib/web/join_tokens_test.go
+++ b/lib/web/join_tokens_test.go
@@ -2115,14 +2115,14 @@ func TestJoinScript(t *testing.T) {
 		})
 	})
 	t.Run("using teleport-update", func(t *testing.T) {
-		testRollout := &autoupdatev1pb.AutoUpdateAgentRollout{Spec: &autoupdatev1pb.AutoUpdateAgentRolloutSpec{
+		testRollout := autoupdatev1pb.AutoUpdateAgentRollout_builder{Spec: autoupdatev1pb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:              "1.2.2",
 			TargetVersion:             "1.2.3",
 			Schedule:                  autoupdate.AgentsScheduleImmediate,
 			AutoupdateMode:            autoupdate.AgentsUpdateModeEnabled,
 			Strategy:                  autoupdate.AgentsStrategyTimeBased,
 			MaintenanceWindowDuration: durationpb.New(1 * time.Hour),
-		}}
+		}.Build()}.Build()
 		t.Run("rollout exists and autoupdates are on", func(t *testing.T) {
 			currentStableCloudVersion := "1.1.1"
 			config := autoupdateTestHandlerConfig{
@@ -2140,7 +2140,7 @@ func TestJoinScript(t *testing.T) {
 
 			// list of packages must include the updater
 			require.Contains(t, script, "UPDATER_STYLE='binary'")
-			require.Contains(t, script, fmt.Sprintf("TELEPORT_VERSION='%s'", testRollout.Spec.TargetVersion))
+			require.Contains(t, script, fmt.Sprintf("TELEPORT_VERSION='%s'", testRollout.GetSpec().GetTargetVersion()))
 		})
 		t.Run("rollout exists and autoupdates are off", func(t *testing.T) {
 			h := newAutoupdateTestHandler(t, autoupdateTestHandlerConfig{
@@ -2150,7 +2150,7 @@ func TestJoinScript(t *testing.T) {
 			script, err := h.getJoinScript(context.Background(), scriptSettings{token: validToken})
 			require.NoError(t, err)
 			require.Contains(t, script, "UPDATER_STYLE='binary'")
-			require.Contains(t, script, fmt.Sprintf("TELEPORT_VERSION='%s'", testRollout.Spec.TargetVersion))
+			require.Contains(t, script, fmt.Sprintf("TELEPORT_VERSION='%s'", testRollout.GetSpec().GetTargetVersion()))
 		})
 	})
 }
diff --git a/lib/web/machineid.go b/lib/web/machineid.go
index 633e6ebfc57..4494dc671be 100644
--- a/lib/web/machineid.go
+++ b/lib/web/machineid.go
@@ -75,16 +75,16 @@ func (h *Handler) listBots(w http.ResponseWriter, r *http.Request, p httprouter.
 
 	var items []*machineidv1.Bot
 	for pageToken := ""; ; {
-		bots, err := clt.BotServiceClient().ListBots(r.Context(), &machineidv1.ListBotsRequest{
+		bots, err := clt.BotServiceClient().ListBots(r.Context(), machineidv1.ListBotsRequest_builder{
 			PageSize:  int32(1000),
 			PageToken: pageToken,
-		})
+		}.Build())
 		// todo (michellescripts) consider returning partial results
 		if err != nil {
 			return nil, trace.Wrap(err, "error getting bots")
 		}
-		items = append(items, bots.Bots...)
-		pageToken = bots.NextPageToken
+		items = append(items, bots.GetBots()...)
+		pageToken = bots.GetNextPageToken()
 		if pageToken == "" {
 			break
 		}
@@ -106,22 +106,22 @@ func (h *Handler) createBot(w http.ResponseWriter, r *http.Request, p httprouter
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	_, err = clt.BotServiceClient().CreateBot(r.Context(), &machineidv1.CreateBotRequest{
-		Bot: &machineidv1.Bot{
+	_, err = clt.BotServiceClient().CreateBot(r.Context(), machineidv1.CreateBotRequest_builder{
+		Bot: machineidv1.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: req.BotName,
 				Labels: map[string]string{
 					webUIFlowLabelKey: webUIFlowBotGitHubActionsSSH,
 				},
-			},
-			Spec: &machineidv1.BotSpec{
+			}.Build(),
+			Spec: machineidv1.BotSpec_builder{
 				Roles:  req.Roles,
 				Traits: req.Traits,
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "error creating bot")
 	}
@@ -140,7 +140,7 @@ func (h *Handler) deleteBot(_ http.ResponseWriter, r *http.Request, params httpr
 		return nil, trace.BadParameter("missing bot name")
 	}
 
-	_, err = clt.BotServiceClient().DeleteBot(r.Context(), &machineidv1.DeleteBotRequest{BotName: name})
+	_, err = clt.BotServiceClient().DeleteBot(r.Context(), machineidv1.DeleteBotRequest_builder{BotName: name}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "error deleting bot")
 	}
@@ -215,9 +215,9 @@ func (h *Handler) getBot(w http.ResponseWriter, r *http.Request, p httprouter.Pa
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	bot, err := clt.BotServiceClient().GetBot(r.Context(), &machineidv1.GetBotRequest{
+	bot, err := clt.BotServiceClient().GetBot(r.Context(), machineidv1.GetBotRequest_builder{
 		BotName: botName,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "error querying bot")
 	}
@@ -313,7 +313,7 @@ func updateBot(ctx context.Context, botName string, request updateBotRequestV3,
 	if request.Roles != nil {
 		mask.Append(&machineidv1.Bot{}, "spec.roles")
 
-		spec.Roles = request.Roles
+		spec.SetRoles(request.Roles)
 	}
 
 	if request.Traits != nil {
@@ -321,13 +321,13 @@ func updateBot(ctx context.Context, botName string, request updateBotRequestV3,
 
 		traits := make([]*machineidv1.Trait, len(request.Traits))
 		for i, trait := range request.Traits {
-			traits[i] = &machineidv1.Trait{
+			traits[i] = machineidv1.Trait_builder{
 				Name:   trait.Name,
 				Values: trait.Values,
-			}
+			}.Build()
 		}
 
-		spec.Traits = traits
+		spec.SetTraits(traits)
 	}
 
 	if request.MaxSessionTtl != "" {
@@ -338,24 +338,24 @@ func updateBot(ctx context.Context, botName string, request updateBotRequestV3,
 			return nil, trace.Wrap(err)
 		}
 
-		spec.MaxSessionTtl = durationpb.New(ttl)
+		spec.SetMaxSessionTtl(durationpb.New(ttl))
 	}
 
 	if request.Description != nil {
 		mask.Append(&machineidv1.Bot{}, "metadata.description")
 
-		metadata.Description = *request.Description
+		metadata.SetDescription(*request.Description)
 	}
 
-	updated, err := clt.BotServiceClient().UpdateBot(ctx, &machineidv1.UpdateBotRequest{
+	updated, err := clt.BotServiceClient().UpdateBot(ctx, machineidv1.UpdateBotRequest_builder{
 		UpdateMask: mask,
-		Bot: &machineidv1.Bot{
+		Bot: machineidv1.Bot_builder{
 			Kind:     types.KindBot,
 			Version:  types.V1,
 			Metadata: &metadata,
 			Spec:     &spec,
-		},
-	})
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "unable to find existing bot")
 	}
@@ -378,10 +378,10 @@ func (h *Handler) getBotInstance(w http.ResponseWriter, r *http.Request, p httpr
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	instance, err := clt.BotInstanceServiceClient().GetBotInstance(r.Context(), &machineidv1.GetBotInstanceRequest{
+	instance, err := clt.BotInstanceServiceClient().GetBotInstance(r.Context(), machineidv1.GetBotInstanceRequest_builder{
 		InstanceId: instanceId,
 		BotName:    botName,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err, "error querying bot instance")
 	}
@@ -425,31 +425,31 @@ func (h *Handler) listBotInstances(_ http.ResponseWriter, r *http.Request, _ htt
 	}
 
 	//nolint:staticcheck // SA1019. Kept for backward compatibility.
-	instances, err := clt.BotInstanceServiceClient().ListBotInstances(r.Context(), &machineidv1.ListBotInstancesRequest{
+	instances, err := clt.BotInstanceServiceClient().ListBotInstances(r.Context(), machineidv1.ListBotInstancesRequest_builder{
 		FilterBotName:    r.URL.Query().Get("bot_name"),
 		PageSize:         int32(pageSize),
 		PageToken:        r.URL.Query().Get("page_token"),
 		FilterSearchTerm: r.URL.Query().Get("search"),
 		Sort:             sort,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 
-	uiInstances := tslices.Map(instances.BotInstances, func(instance *machineidv1.BotInstance) BotInstance {
+	uiInstances := tslices.Map(instances.GetBotInstances(), func(instance *machineidv1.BotInstance) BotInstance {
 		heartbeat := services.GetBotInstanceLatestHeartbeat(instance)
 
 		uiInstance := BotInstance{
-			InstanceId: instance.Spec.InstanceId,
-			BotName:    instance.Spec.BotName,
+			InstanceId: instance.GetSpec().GetInstanceId(),
+			BotName:    instance.GetSpec().GetBotName(),
 		}
 
 		if heartbeat != nil {
-			uiInstance.JoinMethodLatest = heartbeat.JoinMethod
-			uiInstance.HostNameLatest = heartbeat.Hostname
-			uiInstance.VersionLatest = heartbeat.Version
-			uiInstance.ActiveAtLatest = heartbeat.RecordedAt.AsTime().Format(time.RFC3339)
-			uiInstance.OSLatest = heartbeat.Os
+			uiInstance.JoinMethodLatest = heartbeat.GetJoinMethod()
+			uiInstance.HostNameLatest = heartbeat.GetHostname()
+			uiInstance.VersionLatest = heartbeat.GetVersion()
+			uiInstance.ActiveAtLatest = heartbeat.GetRecordedAt().AsTime().Format(time.RFC3339)
+			uiInstance.OSLatest = heartbeat.GetOs()
 		}
 
 		return uiInstance
@@ -457,7 +457,7 @@ func (h *Handler) listBotInstances(_ http.ResponseWriter, r *http.Request, _ htt
 
 	return ListBotInstancesResponse{
 		BotInstances:  uiInstances,
-		NextPageToken: instances.NextPageToken,
+		NextPageToken: instances.GetNextPageToken(),
 	}, nil
 }
 
@@ -468,27 +468,27 @@ func (h *Handler) listBotInstancesV2(_ http.ResponseWriter, r *http.Request, _ h
 		return nil, trace.Wrap(err)
 	}
 
-	request := &machineidv1.ListBotInstancesV2Request{
+	request := machineidv1.ListBotInstancesV2Request_builder{
 		PageToken: r.URL.Query().Get("page_token"),
 		SortField: r.URL.Query().Get("sort_field"),
-		Filter: &machineidv1.ListBotInstancesV2Request_Filters{
+		Filter: machineidv1.ListBotInstancesV2Request_Filters_builder{
 			BotName:    r.URL.Query().Get("bot_name"),
 			SearchTerm: r.URL.Query().Get("search"),
 			Query:      r.URL.Query().Get("query"),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	if r.URL.Query().Has("page_size") {
 		pageSize, err := strconv.ParseInt(r.URL.Query().Get("page_size"), 10, 32)
 		if err != nil {
 			return nil, trace.BadParameter("invalid page size")
 		}
-		request.PageSize = int32(pageSize)
+		request.SetPageSize(int32(pageSize))
 	}
 
 	if r.URL.Query().Has("sort_dir") {
 		sortDir := r.URL.Query().Get("sort_dir")
-		request.SortDesc = strings.ToLower(sortDir) == "desc"
+		request.SetSortDesc(strings.ToLower(sortDir) == "desc")
 	}
 
 	instances, err := clt.BotInstanceServiceClient().ListBotInstancesV2(r.Context(), request)
@@ -496,7 +496,7 @@ func (h *Handler) listBotInstancesV2(_ http.ResponseWriter, r *http.Request, _ h
 		return nil, trace.Wrap(err)
 	}
 
-	uiInstances := tslices.Map(instances.BotInstances, func(instance *machineidv1.BotInstance) BotInstance {
+	uiInstances := tslices.Map(instances.GetBotInstances(), func(instance *machineidv1.BotInstance) BotInstance {
 		heartbeat := services.GetBotInstanceLatestHeartbeat(instance)
 		authentication := services.GetBotInstanceLatestAuthentication(instance)
 
@@ -524,7 +524,7 @@ func (h *Handler) listBotInstancesV2(_ http.ResponseWriter, r *http.Request, _ h
 
 	return ListBotInstancesResponse{
 		BotInstances:  uiInstances,
-		NextPageToken: instances.NextPageToken,
+		NextPageToken: instances.GetNextPageToken(),
 	}, nil
 }
 
@@ -629,25 +629,25 @@ func (h *Handler) botInstanceMetrics(_ http.ResponseWriter, r *http.Request, _ h
 			switch {
 			case targetVersion.Equal(*version):
 				// Bot is up to date.
-				rsp.UpgradeStatuses.UpToDate.Count += int(versionMetrics.Count)
+				rsp.UpgradeStatuses.UpToDate.Count += int(versionMetrics.GetCount())
 
 			case targetVersion.LessThan(*version):
 				// Bot is running a newer version, we don't support this.
-				rsp.UpgradeStatuses.Unsupported.Count += int(versionMetrics.Count)
+				rsp.UpgradeStatuses.Unsupported.Count += int(versionMetrics.GetCount())
 
 			case targetVersion.Major == version.Major:
 				// Bot is running the right major version, but there's a minor
 				// or patch update available
-				rsp.UpgradeStatuses.PatchAvailable.Count += int(versionMetrics.Count)
+				rsp.UpgradeStatuses.PatchAvailable.Count += int(versionMetrics.GetCount())
 
 			case version.Major == targetVersion.Major-1:
 				// Bot is running the previous major version and should upgrade.
-				rsp.UpgradeStatuses.RequiresUpgrade.Count += int(versionMetrics.Count)
+				rsp.UpgradeStatuses.RequiresUpgrade.Count += int(versionMetrics.GetCount())
 
 			case version.Major < targetVersion.Major-1:
 				// Bot is running a version that is too old. In this case, the
 				// connection would be terminated so we shouldn't really see it.
-				rsp.UpgradeStatuses.Unsupported.Count += int(versionMetrics.Count)
+				rsp.UpgradeStatuses.Unsupported.Count += int(versionMetrics.GetCount())
 
 			default:
 				// The branches of this switch should be exhaustive, but just in case!
diff --git a/lib/web/machineid_test.go b/lib/web/machineid_test.go
index 0644cd0449e..665f684e563 100644
--- a/lib/web/machineid_test.go
+++ b/lib/web/machineid_test.go
@@ -80,7 +80,7 @@ func TestListBots(t *testing.T) {
 	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code getting connectors")
 
 	assert.Len(t, bots.Items, created)
-	assert.Equal(t, []string{"test-role"}, bots.Items[0].Spec.Roles)
+	assert.Equal(t, []string{"test-role"}, bots.Items[0].GetSpec().GetRoles())
 }
 
 func TestListBots_UnauthenticatedError(t *testing.T) {
@@ -164,11 +164,11 @@ func TestCreateBot(t *testing.T) {
 
 	i = slices.IndexFunc(bots.Items, func(bot *machineidv1.Bot) bool {
 		// bot name is not prefixed in BotList
-		return bot.Metadata.Name == "test-bot"
+		return bot.GetMetadata().GetName() == "test-bot"
 	})
 	require.NotEqual(t, -1, i)
 	// the bot resource returned from ListBots should only contain the roles attached to the bot via the create/edit request (not created roles)
-	require.Equal(t, []string{"bot-role-0", "bot-role-1"}, bots.Items[i].Spec.GetRoles())
+	require.Equal(t, []string{"bot-role-0", "bot-role-1"}, bots.Items[i].GetSpec().GetRoles())
 
 	// Make sure an unauthenticated client can't create bots
 	publicClt := s.client(t)
@@ -319,7 +319,7 @@ func TestGetBotByName(t *testing.T) {
 	var bot machineidv1.Bot
 	require.NoError(t, json.Unmarshal(response.Bytes(), &bot), "invalid response received")
 	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code getting connectors")
-	assert.Equal(t, botName, bot.Metadata.Name)
+	assert.Equal(t, botName, bot.GetMetadata().GetName())
 
 	// query an unexisting bot
 	_, err = pack.clt.Get(ctx, fmt.Sprintf("%s/%s", endpoint, "invalid-bot"), nil)
@@ -356,8 +356,8 @@ func TestEditBot(t *testing.T) {
 	var bot machineidv1.Bot
 	require.NoError(t, json.Unmarshal(response.Bytes(), &bot), "invalid response received")
 	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code getting connectors")
-	assert.Equal(t, botName, bot.Metadata.Name)
-	assert.Equal(t, []string{"new-new-role"}, bot.Spec.Roles)
+	assert.Equal(t, botName, bot.GetMetadata().GetName())
+	assert.Equal(t, []string{"new-new-role"}, bot.GetSpec().GetRoles())
 }
 
 func TestEditBotRoles(t *testing.T) {
@@ -389,10 +389,10 @@ func TestEditBotRoles(t *testing.T) {
 		BotName: botName,
 		Roles:   []string{"test-role"},
 		Traits: []*machineidv1.Trait{
-			{
+			machineidv1.Trait_builder{
 				Name:   "test-trait-1",
 				Values: []string{"value-1"},
-			},
+			}.Build(),
 		},
 	})
 	require.NoError(t, err)
@@ -408,11 +408,11 @@ func TestEditBotRoles(t *testing.T) {
 	assert.Equal(t, botName, bot.GetMetadata().GetName())
 	assert.Equal(t, []string{"new-new-role"}, bot.GetSpec().GetRoles())
 	assert.Equal(t, []*machineidv1.Trait{
-		{
+		machineidv1.Trait_builder{
 			Name:   "test-trait-1",
 			Values: []string{"value-1"},
-		},
-	}, bot.GetSpec().Traits)
+		}.Build(),
+	}, bot.GetSpec().GetTraits())
 	assert.Equal(t, int64((12*time.Hour)/time.Second), bot.GetSpec().GetMaxSessionTtl().GetSeconds())
 }
 
@@ -445,10 +445,10 @@ func TestEditBotTraits(t *testing.T) {
 		BotName: botName,
 		Roles:   []string{"test-role"},
 		Traits: []*machineidv1.Trait{
-			{
+			machineidv1.Trait_builder{
 				Name:   "test-trait-1",
 				Values: []string{"value-1", "value-2"},
-			},
+			}.Build(),
 		},
 	})
 	require.NoError(t, err)
@@ -472,8 +472,8 @@ func TestEditBotTraits(t *testing.T) {
 	assert.Equal(t, http.StatusOK, response.Code(), "unexpected status code updating bot")
 	assert.Equal(t, botName, bot.GetMetadata().GetName())
 	assert.Equal(t, []string{"test-role"}, bot.GetSpec().GetRoles())
-	assert.Len(t, bot.GetSpec().Traits, 2)
-	for _, trait := range bot.GetSpec().Traits {
+	assert.Len(t, bot.GetSpec().GetTraits(), 2)
+	for _, trait := range bot.GetSpec().GetTraits() {
 		// Avoid ordering race - traits are stored in a map
 		switch trait.GetName() {
 		case "test-trait-1":
@@ -514,10 +514,10 @@ func TestEditBotMaxSessionTTL(t *testing.T) {
 		BotName: botName,
 		Roles:   []string{"test-role"},
 		Traits: []*machineidv1.Trait{
-			{
+			machineidv1.Trait_builder{
 				Name:   "test-trait-1",
 				Values: []string{"value-1"},
-			},
+			}.Build(),
 		},
 	})
 	require.NoError(t, err)
@@ -540,11 +540,11 @@ func TestEditBotMaxSessionTTL(t *testing.T) {
 	assert.Equal(t, botName, updatedBot.GetMetadata().GetName())
 	assert.Equal(t, []string{"test-role"}, updatedBot.GetSpec().GetRoles())
 	assert.Equal(t, []*machineidv1.Trait{
-		{
+		machineidv1.Trait_builder{
 			Name:   "test-trait-1",
 			Values: []string{"value-1"},
-		},
-	}, updatedBot.GetSpec().Traits)
+		}.Build(),
+	}, updatedBot.GetSpec().GetTraits())
 	assert.Equal(t, int64((1*time.Hour+2*time.Minute+3*time.Second)/time.Second), updatedBot.GetSpec().GetMaxSessionTtl().GetSeconds())
 }
 
@@ -577,10 +577,10 @@ func TestEditBotDescription(t *testing.T) {
 		BotName: botName,
 		Roles:   []string{"test-role"},
 		Traits: []*machineidv1.Trait{
-			{
+			machineidv1.Trait_builder{
 				Name:   "test-trait-1",
 				Values: []string{"value-1"},
-			},
+			}.Build(),
 		},
 	})
 	require.NoError(t, err)
@@ -604,11 +604,11 @@ func TestEditBotDescription(t *testing.T) {
 	assert.Equal(t, botName, updatedBot.GetMetadata().GetName())
 	assert.Equal(t, []string{"test-role"}, updatedBot.GetSpec().GetRoles())
 	assert.Equal(t, []*machineidv1.Trait{
-		{
+		machineidv1.Trait_builder{
 			Name:   "test-trait-1",
 			Values: []string{"value-1"},
-		},
-	}, updatedBot.GetSpec().Traits)
+		}.Build(),
+	}, updatedBot.GetSpec().GetTraits())
 	assert.Equal(t, int64((12*time.Hour)/time.Second), updatedBot.GetSpec().GetMaxSessionTtl().GetSeconds())
 	assert.Equal(t, description, updatedBot.GetMetadata().GetDescription())
 }
@@ -640,28 +640,28 @@ func TestListBotInstances(t *testing.T) {
 	}
 	instanceID := uuid.New().String()
 
-	_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+	_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    "test-bot",
 			InstanceId: instanceID,
-		},
-		Status: &machineidv1.BotInstanceStatus{
+		}.Build(),
+		Status: machineidv1.BotInstanceStatus_builder{
 			LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{
-				{
+				machineidv1.BotInstanceStatusHeartbeat_builder{
 					RecordedAt: &timestamppb.Timestamp{
 						Seconds: 2,
 						Nanos:   0,
 					},
-				},
-				{
+				}.Build(),
+				machineidv1.BotInstanceStatusHeartbeat_builder{
 					RecordedAt: &timestamppb.Timestamp{
 						Seconds: 1,
 						Nanos:   0,
 					},
-				},
-				{
+				}.Build(),
+				machineidv1.BotInstanceStatusHeartbeat_builder{
 					RecordedAt: &timestamppb.Timestamp{
 						Seconds: 3,
 						Nanos:   0,
@@ -670,31 +670,31 @@ func TestListBotInstances(t *testing.T) {
 					Hostname:   "test-hostname",
 					JoinMethod: "test-join-method",
 					Os:         "linux",
-				},
+				}.Build(),
 			},
 			LatestAuthentications: []*machineidv1.BotInstanceStatusAuthentication{
-				{
+				machineidv1.BotInstanceStatusAuthentication_builder{
 					AuthenticatedAt: &timestamppb.Timestamp{
 						Seconds: 2,
 						Nanos:   0,
 					},
-				},
-				{
+				}.Build(),
+				machineidv1.BotInstanceStatusAuthentication_builder{
 					AuthenticatedAt: &timestamppb.Timestamp{
 						Seconds: 1,
 						Nanos:   0,
 					},
-				},
-				{
+				}.Build(),
+				machineidv1.BotInstanceStatusAuthentication_builder{
 					AuthenticatedAt: &timestamppb.Timestamp{
 						Seconds: 2,
 						Nanos:   0,
 					},
 					JoinMethod: "test-join-method",
-				},
+				}.Build(),
 			},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	for _, endpoint := range endpoints {
@@ -752,15 +752,15 @@ func TestListBotInstancesWithInitialHeartbeat(t *testing.T) {
 
 	instanceID := uuid.New().String()
 
-	_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+	_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    "test-bot",
 			InstanceId: instanceID,
-		},
-		Status: &machineidv1.BotInstanceStatus{
-			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+		}.Build(),
+		Status: machineidv1.BotInstanceStatus_builder{
+			InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				RecordedAt: &timestamppb.Timestamp{
 					Seconds: 3,
 					Nanos:   0,
@@ -768,13 +768,13 @@ func TestListBotInstancesWithInitialHeartbeat(t *testing.T) {
 				Version:    "1.0.0",
 				Hostname:   "test-hostname",
 				JoinMethod: "test-join-method",
-			},
+			}.Build(),
 			LatestHeartbeats: []*machineidv1.BotInstanceStatusHeartbeat{},
-			InitialAuthentication: &machineidv1.BotInstanceStatusAuthentication{
+			InitialAuthentication: machineidv1.BotInstanceStatusAuthentication_builder{
 				JoinMethod: "test-join-method",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	for _, endpoint := range endpoints {
@@ -857,15 +857,15 @@ func TestListBotInstancesPaging(t *testing.T) {
 			for _, tc := range tcs {
 				t.Run(tc.name, func(t *testing.T) {
 					for n := range tc.numInstances {
-						_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+						_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 							Kind:    types.KindBotInstance,
 							Version: types.V1,
-							Spec: &machineidv1.BotInstanceSpec{
+							Spec: machineidv1.BotInstanceSpec_builder{
 								BotName:    "bot-1",
 								InstanceId: "instance-" + strconv.Itoa(n),
-							},
+							}.Build(),
 							Status: &machineidv1.BotInstanceStatus{},
-						})
+						}.Build())
 						require.NoError(t, err)
 					}
 
@@ -910,21 +910,21 @@ func TestListBotInstancesSorting(t *testing.T) {
 
 	for i := range 10 {
 		now := time.Now()
-		_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:    types.KindBotInstance,
 			Version: types.V1,
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "bot-1",
 				InstanceId: uuid.New().String(),
-			},
-			Status: &machineidv1.BotInstanceStatus{
-				InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			}.Build(),
+			Status: machineidv1.BotInstanceStatus_builder{
+				InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 					RecordedAt: &timestamppb.Timestamp{
 						Seconds: now.Unix() + int64(i),
 					},
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err, "failed to create BotInstance index:%d", i)
 	}
 
@@ -976,15 +976,15 @@ func TestListBotInstancesWithBotFilter(t *testing.T) {
 	for n < 5 {
 		n += 1
 		botName := "bot-" + strconv.Itoa(n%2)
-		_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+		_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 			Kind:    types.KindBotInstance,
 			Version: types.V1,
-			Spec: &machineidv1.BotInstanceSpec{
+			Spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    botName,
 				InstanceId: uuid.New().String(),
-			},
+			}.Build(),
 			Status: &machineidv1.BotInstanceStatus{},
-		})
+		}.Build())
 		require.NoError(t, err)
 	}
 
@@ -1039,10 +1039,10 @@ func TestListBotInstancesWithSearchTermFilter(t *testing.T) {
 		{
 			name:       "match on bot name",
 			searchTerm: "nick",
-			spec: &machineidv1.BotInstanceSpec{
+			spec: machineidv1.BotInstanceSpec_builder{
 				BotName:    "this-is-nicks-test-bot",
 				InstanceId: "00000000-0000-0000-0000-000000000000",
-			},
+			}.Build(),
 		},
 		{
 			name:       "match on instance id",
@@ -1051,30 +1051,30 @@ func TestListBotInstancesWithSearchTermFilter(t *testing.T) {
 		{
 			name:       "match on join method",
 			searchTerm: "uber",
-			heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				JoinMethod: "kubernetes",
-			},
+			}.Build(),
 		},
 		{
 			name:       "match on version",
 			searchTerm: "1.0.0",
-			heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				Version: "1.0.0-dev-a2g3hd",
-			},
+			}.Build(),
 		},
 		{
 			name:       "match on version (with v)",
 			searchTerm: "v1.0.0",
-			heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				Version: "1.0.0-dev-a2g3hd",
-			},
+			}.Build(),
 		},
 		{
 			name:       "match on hostname",
 			searchTerm: "tel-123",
-			heartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+			heartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				Hostname: "svr-eu-tel-123-a",
-			},
+			}.Build(),
 		},
 	}
 
@@ -1084,37 +1084,37 @@ func TestListBotInstancesWithSearchTermFilter(t *testing.T) {
 				t.Run(tc.name, func(t *testing.T) {
 					spec := tc.spec
 					if spec == nil {
-						spec = &machineidv1.BotInstanceSpec{
+						spec = machineidv1.BotInstanceSpec_builder{
 							BotName:    "test-bot",
 							InstanceId: "00000000-0000-0000-0000-000000000000",
-						}
+						}.Build()
 					}
 
-					_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+					_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 						Kind:    types.KindBotInstance,
 						Version: types.V1,
 						Spec:    spec,
-						Status: &machineidv1.BotInstanceStatus{
+						Status: machineidv1.BotInstanceStatus_builder{
 							InitialHeartbeat: tc.heartbeat,
-						},
-					})
+						}.Build(),
+					}.Build())
 					require.NoError(t, err)
 
-					_, err = env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+					_, err = env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 						Kind:    types.KindBotInstance,
 						Version: types.V1,
-						Spec: &machineidv1.BotInstanceSpec{
+						Spec: machineidv1.BotInstanceSpec_builder{
 							BotName:    "bot-gone",
 							InstanceId: uuid.New().String(),
-						},
-						Status: &machineidv1.BotInstanceStatus{
-							InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+						}.Build(),
+						Status: machineidv1.BotInstanceStatus_builder{
+							InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 								Version:    "1.1.1-prod",
 								Hostname:   "test-hostname",
 								JoinMethod: "test-join-method",
-							},
-						},
-					})
+							}.Build(),
+						}.Build(),
+					}.Build())
 					require.NoError(t, err)
 
 					response, err := pack.clt.Get(ctx, endpoint, url.Values{
@@ -1130,7 +1130,7 @@ func TestListBotInstancesWithSearchTermFilter(t *testing.T) {
 					assert.Equal(t, "00000000-0000-0000-0000-000000000000", instances.BotInstances[0].InstanceId)
 
 					// remove before next test
-					err = env.server.Auth().DeleteBotInstance(ctx, spec.BotName, spec.InstanceId)
+					err = env.server.Auth().DeleteBotInstance(ctx, spec.GetBotName(), spec.GetInstanceId())
 					require.NoError(t, err)
 				})
 			}
@@ -1155,34 +1155,34 @@ func TestListBotInstancesWithQueryFilter(t *testing.T) {
 		"bot-instance",
 	)
 
-	_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+	_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    "test-bot-1",
 			InstanceId: "00000000-0000-0000-0000-000000000000",
-		},
-		Status: &machineidv1.BotInstanceStatus{
-			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+		}.Build(),
+		Status: machineidv1.BotInstanceStatus_builder{
+			InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				Hostname: "svr-eu-tel-123-a",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	_, err = env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+	_, err = env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    "test-bot-2",
 			InstanceId: uuid.New().String(),
-		},
-		Status: &machineidv1.BotInstanceStatus{
-			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+		}.Build(),
+		Status: machineidv1.BotInstanceStatus_builder{
+			InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				Hostname: "test-hostname",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	response, err := pack.clt.Get(ctx, endpoint, url.Values{
@@ -1208,22 +1208,22 @@ func TestGetBotInstance(t *testing.T) {
 	botName := "test-bot"
 	instanceID := uuid.New().String()
 
-	_, err := env.server.Auth().CreateBotInstance(ctx, &machineidv1.BotInstance{
+	_, err := env.server.Auth().CreateBotInstance(ctx, machineidv1.BotInstance_builder{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    botName,
 			InstanceId: instanceID,
-		},
-		Status: &machineidv1.BotInstanceStatus{
-			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+		}.Build(),
+		Status: machineidv1.BotInstanceStatus_builder{
+			InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				RecordedAt: &timestamppb.Timestamp{
 					Seconds: 1,
 					Nanos:   0,
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	endpoint := pack.clt.Endpoint(
@@ -1246,20 +1246,20 @@ func TestGetBotInstance(t *testing.T) {
 	require.Empty(t, cmp.Diff(resp.BotInstance, machineidv1.BotInstance{
 		Kind:    types.KindBotInstance,
 		Version: types.V1,
-		Spec: &machineidv1.BotInstanceSpec{
+		Spec: machineidv1.BotInstanceSpec_builder{
 			BotName:    botName,
 			InstanceId: instanceID,
-		},
-		Status: &machineidv1.BotInstanceStatus{
-			InitialHeartbeat: &machineidv1.BotInstanceStatusHeartbeat{
+		}.Build(),
+		Status: machineidv1.BotInstanceStatus_builder{
+			InitialHeartbeat: machineidv1.BotInstanceStatusHeartbeat_builder{
 				RecordedAt: &timestamppb.Timestamp{
 					Seconds: 1,
 					Nanos:   0,
 				},
-			},
-		},
+			}.Build(),
+		}.Build(),
 	}, protocmp.Transform(), protocmp.IgnoreFields(&machineidv1.BotInstance{}, "metadata")))
-	assert.YAMLEq(t, fmt.Sprintf("kind: bot_instance\nmetadata:\n  name: %[1]s\n  revision: %[2]s\nspec:\n  bot_name: test-bot\n  instance_id: %[1]s\nstatus:\n  initial_heartbeat:\n    recorded_at: \"1970-01-01T00:00:01Z\"\nversion: v1\n", instanceID, resp.BotInstance.Metadata.Revision), resp.YAML)
+	assert.YAMLEq(t, fmt.Sprintf("kind: bot_instance\nmetadata:\n  name: %[1]s\n  revision: %[2]s\nspec:\n  bot_name: test-bot\n  instance_id: %[1]s\nstatus:\n  initial_heartbeat:\n    recorded_at: \"1970-01-01T00:00:01Z\"\nversion: v1\n", instanceID, resp.BotInstance.GetMetadata().GetRevision()), resp.YAML)
 }
 
 func TestBotInstanceMetrics_NotFound(t *testing.T) {
@@ -1289,35 +1289,35 @@ func TestBotInstanceMetrics_Success(t *testing.T) {
 	const targetVersion = "19.1.1"
 
 	_, err := env.server.Auth().
-		CreateAutoUpdateVersion(ctx, &autoupdate.AutoUpdateVersion{
+		CreateAutoUpdateVersion(ctx, autoupdate.AutoUpdateVersion_builder{
 			Kind:    types.KindAutoUpdateVersion,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: types.MetaNameAutoUpdateVersion,
-			},
-			Spec: &autoupdate.AutoUpdateVersionSpec{
-				Tools: &autoupdate.AutoUpdateVersionSpecTools{
+			}.Build(),
+			Spec: autoupdate.AutoUpdateVersionSpec_builder{
+				Tools: autoupdate.AutoUpdateVersionSpecTools_builder{
 					TargetVersion: targetVersion,
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 	require.NoError(t, err)
 
-	report, err := update.NewAutoUpdateBotInstanceReport(&autoupdate.AutoUpdateBotInstanceReportSpec{
+	report, err := update.NewAutoUpdateBotInstanceReport(autoupdate.AutoUpdateBotInstanceReportSpec_builder{
 		Timestamp: timestamppb.New(env.clock.Now()),
 		Groups: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroup{
-			"prod": {
+			"prod": autoupdate.AutoUpdateBotInstanceReportSpecGroup_builder{
 				Versions: map[string]*autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion{
-					"19.1.1":     {Count: 1},      // Up to date
-					"19.2.0":     {Count: 10},     // Unsupported (too new)
-					"19.1.0":     {Count: 100},    // Patch available
-					"19.0.0-rc1": {Count: 1000},   // Patch available
-					"18.0.0":     {Count: 10000},  // Requires upgrade
-					"17.0.0":     {Count: 100000}, // Unsupported (too old)
+					"19.1.1":     autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1}.Build(),      // Up to date
+					"19.2.0":     autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 10}.Build(),     // Unsupported (too new)
+					"19.1.0":     autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 100}.Build(),    // Patch available
+					"19.0.0-rc1": autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 1000}.Build(),   // Patch available
+					"18.0.0":     autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 10000}.Build(),  // Requires upgrade
+					"17.0.0":     autoupdate.AutoUpdateBotInstanceReportSpecGroupVersion_builder{Count: 100000}.Build(), // Unsupported (too old)
 				},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 
 	_, err = env.server.Auth().UpsertAutoUpdateBotInstanceReport(ctx, report)
diff --git a/lib/web/managed_updates.go b/lib/web/managed_updates.go
index 3dca069423f..9b663c30853 100644
--- a/lib/web/managed_updates.go
+++ b/lib/web/managed_updates.go
@@ -301,10 +301,10 @@ func (h *Handler) startGroupUpdate(w http.ResponseWriter, r *http.Request, param
 	}
 
 	client := getAutoUpdateServiceClient(sctx)
-	rollout, err := client.TriggerAutoUpdateAgentGroup(ctx, &autoupdatepb.TriggerAutoUpdateAgentGroupRequest{
+	rollout, err := client.TriggerAutoUpdateAgentGroup(ctx, autoupdatepb.TriggerAutoUpdateAgentGroupRequest_builder{
 		Groups:       []string{groupName},
 		DesiredState: state,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -327,9 +327,9 @@ func (h *Handler) markGroupDone(w http.ResponseWriter, r *http.Request, params h
 	}
 
 	client := getAutoUpdateServiceClient(sctx)
-	rollout, err := client.ForceAutoUpdateAgentGroup(ctx, &autoupdatepb.ForceAutoUpdateAgentGroupRequest{
+	rollout, err := client.ForceAutoUpdateAgentGroup(ctx, autoupdatepb.ForceAutoUpdateAgentGroupRequest_builder{
 		Groups: []string{groupName},
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
@@ -352,10 +352,10 @@ func (h *Handler) rollbackGroup(w http.ResponseWriter, r *http.Request, params h
 	}
 
 	auClient := getAutoUpdateServiceClient(sctx)
-	rollout, err := auClient.RollbackAutoUpdateAgentGroup(ctx, &autoupdatepb.RollbackAutoUpdateAgentGroupRequest{
+	rollout, err := auClient.RollbackAutoUpdateAgentGroup(ctx, autoupdatepb.RollbackAutoUpdateAgentGroupRequest_builder{
 		Groups:           []string{groupName},
 		AllStartedGroups: false,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
diff --git a/lib/web/managed_updates_test.go b/lib/web/managed_updates_test.go
index 932e46cc334..57a1ad8e251 100644
--- a/lib/web/managed_updates_test.go
+++ b/lib/web/managed_updates_test.go
@@ -61,69 +61,69 @@ func TestGetManagedUpdatesDetails(t *testing.T) {
 	pack := proxy.authPack(t, "testuser", []types.Role{role})
 
 	// Create an auto update config
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatepb.AutoUpdateConfigSpec{
-		Tools: &autoupdatepb.AutoUpdateConfigSpecTools{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatepb.AutoUpdateConfigSpec_builder{
+		Tools: autoupdatepb.AutoUpdateConfigSpecTools_builder{
 			Mode: autoupdate.ToolsUpdateModeEnabled,
-		},
-		Agents: &autoupdatepb.AutoUpdateConfigSpecAgents{
+		}.Build(),
+		Agents: autoupdatepb.AutoUpdateConfigSpecAgents_builder{
 			Mode:                      autoupdate.AgentsUpdateModeEnabled,
 			Strategy:                  autoupdate.AgentsStrategyTimeBased,
 			MaintenanceWindowDuration: durationpb.New(time.Hour),
-			Schedules: &autoupdatepb.AgentAutoUpdateSchedules{
+			Schedules: autoupdatepb.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdatepb.AgentAutoUpdateGroup{
-					{Name: "all", Days: []string{"Mon", "Tue", "Wed"}, StartHour: 14},
+					autoupdatepb.AgentAutoUpdateGroup_builder{Name: "all", Days: []string{"Mon", "Tue", "Wed"}, StartHour: 14}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 
 	// Create AutoUpdateVersion
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatepb.AutoUpdateVersionSpec{
-		Tools: &autoupdatepb.AutoUpdateVersionSpecTools{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatepb.AutoUpdateVersionSpec_builder{
+		Tools: autoupdatepb.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "18.2.0",
-		},
-		Agents: &autoupdatepb.AutoUpdateVersionSpecAgents{
+		}.Build(),
+		Agents: autoupdatepb.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "18.1.0",
 			TargetVersion: "18.2.0",
 			Schedule:      autoupdate.AgentsScheduleRegular,
 			Mode:          autoupdate.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 
 	// Create AutoUpdateAgentRollout
-	rollout := &autoupdatepb.AutoUpdateAgentRollout{
+	rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
 		Kind:    types.KindAutoUpdateAgentRollout,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateAgentRollout,
-		},
-		Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+		}.Build(),
+		Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:   "18.1.0",
 			TargetVersion:  "18.2.0",
 			Schedule:       autoupdate.AgentsScheduleRegular,
 			AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 			Strategy:       autoupdate.AgentsStrategyTimeBased,
-		},
-		Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+		}.Build(),
+		Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 			State: autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 			Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "all",
 					State:           autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					PresentCount:    100,
 					UpToDateCount:   75,
 					ConfigDays:      []string{"Mon", "Tue", "Wed"},
 					ConfigStartHour: 14,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, rollout)
 	require.NoError(t, err)
 
@@ -185,91 +185,91 @@ func TestGetOrphanedAgentCounts(t *testing.T) {
 	pack := proxy.authPack(t, "testuser", []types.Role{role})
 
 	// Create AutoUpdateConfig with "prod" as the only group
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatepb.AutoUpdateConfigSpec{
-		Agents: &autoupdatepb.AutoUpdateConfigSpecAgents{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatepb.AutoUpdateConfigSpec_builder{
+		Agents: autoupdatepb.AutoUpdateConfigSpecAgents_builder{
 			Mode:                      autoupdate.AgentsUpdateModeEnabled,
 			Strategy:                  autoupdate.AgentsStrategyTimeBased,
 			MaintenanceWindowDuration: durationpb.New(time.Hour),
-			Schedules: &autoupdatepb.AgentAutoUpdateSchedules{
+			Schedules: autoupdatepb.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdatepb.AgentAutoUpdateGroup{
-					{Name: "prod", Days: []string{"*"}, StartHour: 10},
+					autoupdatepb.AgentAutoUpdateGroup_builder{Name: "prod", Days: []string{"*"}, StartHour: 10}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 
 	// Create AutoUpdateVersion
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatepb.AutoUpdateVersionSpec{
-		Agents: &autoupdatepb.AutoUpdateVersionSpecAgents{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatepb.AutoUpdateVersionSpec_builder{
+		Agents: autoupdatepb.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "18.1.0",
 			TargetVersion: "18.2.0",
 			Schedule:      autoupdate.AgentsScheduleRegular,
 			Mode:          autoupdate.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 
 	// Create the AutoUpdateAgentRollout
-	rollout := &autoupdatepb.AutoUpdateAgentRollout{
+	rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
 		Kind:    types.KindAutoUpdateAgentRollout,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateAgentRollout,
-		},
-		Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+		}.Build(),
+		Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:   "18.1.0",
 			TargetVersion:  "18.2.0",
 			Schedule:       autoupdate.AgentsScheduleRegular,
 			AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 			Strategy:       autoupdate.AgentsStrategyTimeBased,
-		},
-		Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+		}.Build(),
+		Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 			State: autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 			Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "prod",
 					State:           autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 					PresentCount:    50,
 					UpToDateCount:   25,
 					ConfigDays:      []string{"*"},
 					ConfigStartHour: 10,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, rollout)
 	require.NoError(t, err)
 
 	// Create AutoUpdateAgentReport with some agents in "prod" (valid) and some in "invalidgroup" (orphaned)
-	report := &autoupdatepb.AutoUpdateAgentReport{
+	report := autoupdatepb.AutoUpdateAgentReport_builder{
 		Kind:    types.KindAutoUpdateAgentReport,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-auth-server",
-		},
-		Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+		}.Build(),
+		Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 			Timestamp: timestamppb.Now(),
 			Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-				"prod": {
+				"prod": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 					Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-						"18.1.0": {Count: 30},
-						"18.2.0": {Count: 20},
+						"18.1.0": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 30}.Build(),
+						"18.2.0": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 20}.Build(),
 					},
-				},
-				"invalidgroup": {
+				}.Build(),
+				"invalidgroup": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 					Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-						"18.1.0": {Count: 5},
-						"18.2.0": {Count: 3},
+						"18.1.0": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 5}.Build(),
+						"18.2.0": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 3}.Build(),
 					},
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = env.server.Auth().UpsertAutoUpdateAgentReport(ctx, report)
 	require.NoError(t, err)
 
@@ -315,68 +315,68 @@ func TestStartGroupUpdate(t *testing.T) {
 
 	pack := proxy.authPack(t, "testuser", []types.Role{role})
 
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatepb.AutoUpdateConfigSpec{
-		Agents: &autoupdatepb.AutoUpdateConfigSpecAgents{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatepb.AutoUpdateConfigSpec_builder{
+		Agents: autoupdatepb.AutoUpdateConfigSpecAgents_builder{
 			Mode:     autoupdate.AgentsUpdateModeEnabled,
 			Strategy: autoupdate.AgentsStrategyHaltOnError,
-			Schedules: &autoupdatepb.AgentAutoUpdateSchedules{
+			Schedules: autoupdatepb.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdatepb.AgentAutoUpdateGroup{
-					{Name: "dev", Days: []string{"*"}, StartHour: 10, WaitHours: 0},
-					{Name: "staging", Days: []string{"*"}, StartHour: 10, WaitHours: 24},
+					autoupdatepb.AgentAutoUpdateGroup_builder{Name: "dev", Days: []string{"*"}, StartHour: 10, WaitHours: 0}.Build(),
+					autoupdatepb.AgentAutoUpdateGroup_builder{Name: "staging", Days: []string{"*"}, StartHour: 10, WaitHours: 24}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatepb.AutoUpdateVersionSpec{
-		Agents: &autoupdatepb.AutoUpdateVersionSpecAgents{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatepb.AutoUpdateVersionSpec_builder{
+		Agents: autoupdatepb.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "18.0.0",
 			TargetVersion: "18.1.0",
 			Schedule:      autoupdate.AgentsScheduleRegular,
 			Mode:          autoupdate.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 
-	rollout := &autoupdatepb.AutoUpdateAgentRollout{
+	rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
 		Kind:    types.KindAutoUpdateAgentRollout,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateAgentRollout,
-		},
-		Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+		}.Build(),
+		Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:   "18.0.0",
 			TargetVersion:  "18.1.0",
 			Schedule:       autoupdate.AgentsScheduleRegular,
 			AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 			Strategy:       autoupdate.AgentsStrategyHaltOnError,
-		},
-		Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+		}.Build(),
+		Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 			State: autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 			Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "dev",
 					State:           autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					ConfigDays:      []string{"*"},
 					ConfigStartHour: 10,
 					ConfigWaitHours: 0,
 					CanaryCount:     1,
-				},
-				{
+				}.Build(),
+				autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "staging",
 					State:           autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					ConfigDays:      []string{"*"},
 					ConfigStartHour: 10,
 					ConfigWaitHours: 24,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, rollout)
 	require.NoError(t, err)
 
@@ -430,59 +430,59 @@ func TestMarkGroupDone(t *testing.T) {
 
 	pack := proxy.authPack(t, "testuser", []types.Role{role})
 
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatepb.AutoUpdateConfigSpec{
-		Agents: &autoupdatepb.AutoUpdateConfigSpecAgents{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatepb.AutoUpdateConfigSpec_builder{
+		Agents: autoupdatepb.AutoUpdateConfigSpecAgents_builder{
 			Mode:     autoupdate.AgentsUpdateModeEnabled,
 			Strategy: autoupdate.AgentsStrategyHaltOnError,
-			Schedules: &autoupdatepb.AgentAutoUpdateSchedules{
+			Schedules: autoupdatepb.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdatepb.AgentAutoUpdateGroup{
-					{Name: "dev", Days: []string{"*"}, StartHour: 10, WaitHours: 0},
+					autoupdatepb.AgentAutoUpdateGroup_builder{Name: "dev", Days: []string{"*"}, StartHour: 10, WaitHours: 0}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatepb.AutoUpdateVersionSpec{
-		Agents: &autoupdatepb.AutoUpdateVersionSpecAgents{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatepb.AutoUpdateVersionSpec_builder{
+		Agents: autoupdatepb.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "18.0.0",
 			TargetVersion: "18.1.0",
 			Schedule:      autoupdate.AgentsScheduleRegular,
 			Mode:          autoupdate.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 
-	rollout := &autoupdatepb.AutoUpdateAgentRollout{
+	rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
 		Kind:    types.KindAutoUpdateAgentRollout,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateAgentRollout,
-		},
-		Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+		}.Build(),
+		Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:   "18.0.0",
 			TargetVersion:  "18.1.0",
 			Schedule:       autoupdate.AgentsScheduleRegular,
 			AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 			Strategy:       autoupdate.AgentsStrategyHaltOnError,
-		},
-		Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+		}.Build(),
+		Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 			State: autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 			Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "dev",
 					State:           autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					ConfigDays:      []string{"*"},
 					ConfigStartHour: 10,
 					ConfigWaitHours: 0,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, rollout)
 	require.NoError(t, err)
 
@@ -536,59 +536,59 @@ func TestRollbackGroup(t *testing.T) {
 
 	pack := proxy.authPack(t, "testuser", []types.Role{role})
 
-	config, err := autoupdate.NewAutoUpdateConfig(&autoupdatepb.AutoUpdateConfigSpec{
-		Agents: &autoupdatepb.AutoUpdateConfigSpecAgents{
+	config, err := autoupdate.NewAutoUpdateConfig(autoupdatepb.AutoUpdateConfigSpec_builder{
+		Agents: autoupdatepb.AutoUpdateConfigSpecAgents_builder{
 			Mode:     autoupdate.AgentsUpdateModeEnabled,
 			Strategy: autoupdate.AgentsStrategyHaltOnError,
-			Schedules: &autoupdatepb.AgentAutoUpdateSchedules{
+			Schedules: autoupdatepb.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdatepb.AgentAutoUpdateGroup{
-					{Name: "prod", Days: []string{"*"}, StartHour: 10, WaitHours: 0},
+					autoupdatepb.AgentAutoUpdateGroup_builder{Name: "prod", Days: []string{"*"}, StartHour: 10, WaitHours: 0}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateConfig(ctx, config)
 	require.NoError(t, err)
 
-	version, err := autoupdate.NewAutoUpdateVersion(&autoupdatepb.AutoUpdateVersionSpec{
-		Agents: &autoupdatepb.AutoUpdateVersionSpecAgents{
+	version, err := autoupdate.NewAutoUpdateVersion(autoupdatepb.AutoUpdateVersionSpec_builder{
+		Agents: autoupdatepb.AutoUpdateVersionSpecAgents_builder{
 			StartVersion:  "18.0.0",
 			TargetVersion: "18.1.0",
 			Schedule:      autoupdate.AgentsScheduleRegular,
 			Mode:          autoupdate.AgentsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	_, err = env.server.Auth().UpsertAutoUpdateVersion(ctx, version)
 	require.NoError(t, err)
 
-	rollout := &autoupdatepb.AutoUpdateAgentRollout{
+	rollout := autoupdatepb.AutoUpdateAgentRollout_builder{
 		Kind:    types.KindAutoUpdateAgentRollout,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: types.MetaNameAutoUpdateAgentRollout,
-		},
-		Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+		}.Build(),
+		Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 			StartVersion:   "18.0.0",
 			TargetVersion:  "18.1.0",
 			Schedule:       autoupdate.AgentsScheduleRegular,
 			AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 			Strategy:       autoupdate.AgentsStrategyHaltOnError,
-		},
-		Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+		}.Build(),
+		Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 			State: autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 			Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-				{
+				autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 					Name:            "prod",
 					State:           autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 					ConfigDays:      []string{"*"},
 					ConfigStartHour: 10,
 					ConfigWaitHours: 0,
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 	_, err = env.server.Auth().UpsertAutoUpdateAgentRollout(ctx, rollout)
 	require.NoError(t, err)
 
diff --git a/lib/web/mwi_wizards.go b/lib/web/mwi_wizards.go
index a1c7fcdbb81..af7afc8ceab 100644
--- a/lib/web/mwi_wizards.go
+++ b/lib/web/mwi_wizards.go
@@ -100,16 +100,16 @@ func (h *Handler) machineIDWizardGenerateIaC(_ http.ResponseWriter, r *http.Requ
 	}
 
 	// Bot resource.
-	bot := &machineidv1.Bot{
+	bot := machineidv1.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: namePrefix,
-		},
-		Spec: &machineidv1.BotSpec{
+		}.Build(),
+		Spec: machineidv1.BotSpec_builder{
 			Roles: []string{role.GetName()},
-		},
-	}
+		}.Build(),
+	}.Build()
 	botOpts := []tfgen.GenerateOpt{
 		tfgen.WithFieldTransform("spec.traits", transform.BotTraits),
 	}
diff --git a/lib/web/notifications_test.go b/lib/web/notifications_test.go
index 0ddf48dd9a2..d4fa9bf96c3 100644
--- a/lib/web/notifications_test.go
+++ b/lib/web/notifications_test.go
@@ -27,6 +27,7 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	headerv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/header/v1"
 	notificationsv1 "github.com/gravitational/teleport/api/gen/proto/go/teleport/notifications/v1"
@@ -76,34 +77,28 @@ func TestNotifications(t *testing.T) {
 		},
 		{
 			// Matcher matches by the role "auditors"
-			globalNotification: newGlobalNotification(t, "auditor-3", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByRoles{
-					ByRoles: &notificationsv1.ByRoles{
-						Roles: []string{"auditors"},
-					},
-				},
-			}),
+			globalNotification: newGlobalNotification(t, "auditor-3", notificationsv1.GlobalNotificationSpec_builder{
+				ByRoles: notificationsv1.ByRoles_builder{
+					Roles: []string{"auditors"},
+				}.Build(),
+			}.Build()),
 		},
 		{
 			// This should not be returned in the list since it's not for this user.
-			globalNotification: newGlobalNotification(t, "manager-1", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByRoles{
-					ByRoles: &notificationsv1.ByRoles{
-						Roles: []string{"managers"},
-					},
-				},
-			}),
+			globalNotification: newGlobalNotification(t, "manager-1", notificationsv1.GlobalNotificationSpec_builder{
+				ByRoles: notificationsv1.ByRoles_builder{
+					Roles: []string{"managers"},
+				}.Build(),
+			}.Build()),
 		},
 		{
 			userNotification: newUserNotification(t, username, "auditor-4"),
 		},
 		{
 			// Matcher matches all.
-			globalNotification: newGlobalNotification(t, "auditor-5", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_All{
-					All: true,
-				},
-			}),
+			globalNotification: newGlobalNotification(t, "auditor-5", notificationsv1.GlobalNotificationSpec_builder{
+				All: proto.Bool(true),
+			}.Build()),
 		},
 		{
 			// This should not be returned in the list since it's not for this user.
@@ -111,39 +106,35 @@ func TestNotifications(t *testing.T) {
 		},
 		{
 			// Matcher matches by read & write permission on nodes.
-			globalNotification: newGlobalNotification(t, "auditor-6", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								Rules: []types.Rule{
-									{
-										Resources: []string{types.KindNode},
-										Verbs:     services.RW(),
-									},
+			globalNotification: newGlobalNotification(t, "auditor-6", notificationsv1.GlobalNotificationSpec_builder{
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							Rules: []types.Rule{
+								{
+									Resources: []string{types.KindNode},
+									Verbs:     services.RW(),
 								},
 							},
 						},
 					},
-				},
-			}),
+				}.Build(),
+			}.Build()),
 		},
 		{
-			globalNotification: newGlobalNotification(t, "auditor-7", &notificationsv1.GlobalNotificationSpec{
-				Matcher: &notificationsv1.GlobalNotificationSpec_ByPermissions{
-					ByPermissions: &notificationsv1.ByPermissions{
-						RoleConditions: []*types.RoleConditions{
-							{
-								Logins: []string{"auditor"},
-							},
-							{
-								Logins: []string{"user"},
-							},
+			globalNotification: newGlobalNotification(t, "auditor-7", notificationsv1.GlobalNotificationSpec_builder{
+				ByPermissions: notificationsv1.ByPermissions_builder{
+					RoleConditions: []*types.RoleConditions{
+						{
+							Logins: []string{"auditor"},
+						},
+						{
+							Logins: []string{"user"},
 						},
 					},
-				},
+				}.Build(),
 				MatchAllConditions: true,
-			}),
+			}.Build()),
 		},
 	}
 
@@ -249,14 +240,14 @@ func newUserNotification(t *testing.T, username string, title string) *notificat
 
 	notification := notificationsv1.Notification{
 		SubKind: "test-subkind",
-		Spec: &notificationsv1.NotificationSpec{
+		Spec: notificationsv1.NotificationSpec_builder{
 			Username: username,
-		},
-		Metadata: &headerv1.Metadata{
+		}.Build(),
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
+		}.Build(),
 	}
 
 	return &notification
@@ -265,15 +256,15 @@ func newUserNotification(t *testing.T, username string, title string) *notificat
 func newGlobalNotification(t *testing.T, title string, spec *notificationsv1.GlobalNotificationSpec) *notificationsv1.GlobalNotification {
 	t.Helper()
 
-	spec.Notification = &notificationsv1.Notification{
+	spec.SetNotification(notificationsv1.Notification_builder{
 		SubKind: "test-subkind",
 		Spec:    &notificationsv1.NotificationSpec{},
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Labels: map[string]string{
 				types.NotificationTitleLabel: title,
 			},
-		},
-	}
+		}.Build(),
+	}.Build())
 
 	notification := notificationsv1.GlobalNotification{
 		Spec: spec,
diff --git a/lib/web/recordingmetadata.go b/lib/web/recordingmetadata.go
index d725e5abd71..6010d3c13f9 100644
--- a/lib/web/recordingmetadata.go
+++ b/lib/web/recordingmetadata.go
@@ -77,9 +77,9 @@ func (h *Handler) getSessionRecordingMetadata(
 		return nil, nil
 	}
 
-	stream, err := clt.RecordingMetadataServiceClient().GetMetadata(ctx, &recordingmetadatav1.GetMetadataRequest{
+	stream, err := clt.RecordingMetadataServiceClient().GetMetadata(ctx, recordingmetadatav1.GetMetadataRequest_builder{
 		SessionId: sessionID,
-	})
+	}.Build())
 	if err != nil {
 		sendMessage(ws, recordingErrorMessageType, sessionRecordingErrorResponse{
 			Error: err.Error(),
@@ -156,9 +156,9 @@ func (h *Handler) getSessionRecordingThumbnail(
 		return nil, trace.Wrap(err)
 	}
 
-	response, err := clt.RecordingMetadataServiceClient().GetThumbnail(r.Context(), &recordingmetadatav1.GetThumbnailRequest{
+	response, err := clt.RecordingMetadataServiceClient().GetThumbnail(r.Context(), recordingmetadatav1.GetThumbnailRequest_builder{
 		SessionId: sessionId,
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotFound(err) {
 			return nil, trace.NotFound("thumbnail not found for session %q", sessionId)
@@ -166,11 +166,11 @@ func (h *Handler) getSessionRecordingThumbnail(
 		return nil, trace.Wrap(err)
 	}
 
-	if response.Thumbnail == nil {
+	if !response.HasThumbnail() {
 		return nil, trace.NotFound("thumbnail not found for session %q", sessionId)
 	}
 
-	return encodeSessionRecordingThumbnail(response.Thumbnail), nil
+	return encodeSessionRecordingThumbnail(response.GetThumbnail()), nil
 }
 
 type baseEvent struct {
@@ -234,40 +234,40 @@ func pbTypeToString(t recordingmetadatav1.SessionRecordingType) string {
 // to use.
 func encodeSessionRecordingMetadata(metadata *recordingmetadatav1.SessionRecordingMetadata) sessionRecordingMetadata {
 	result := sessionRecordingMetadata{
-		Duration:     convertDurationToMs(metadata.Duration),
-		StartCols:    metadata.StartCols,
-		StartRows:    metadata.StartRows,
-		Events:       make([]sessionRecordingEvent, 0, len(metadata.Events)),
-		StartTime:    metadata.StartTime.AsTime().Unix(),
-		EndTime:      metadata.EndTime.AsTime().Unix(),
-		ClusterName:  metadata.ClusterName,
-		ResourceName: metadata.ResourceName,
-		User:         metadata.User,
-		Type:         pbTypeToString(metadata.Type),
+		Duration:     convertDurationToMs(metadata.GetDuration()),
+		StartCols:    metadata.GetStartCols(),
+		StartRows:    metadata.GetStartRows(),
+		Events:       make([]sessionRecordingEvent, 0, len(metadata.GetEvents())),
+		StartTime:    metadata.GetStartTime().AsTime().Unix(),
+		EndTime:      metadata.GetEndTime().AsTime().Unix(),
+		ClusterName:  metadata.GetClusterName(),
+		ResourceName: metadata.GetResourceName(),
+		User:         metadata.GetUser(),
+		Type:         pbTypeToString(metadata.GetType()),
 	}
 
-	for _, event := range metadata.Events {
+	for _, event := range metadata.GetEvents() {
 		base := baseEvent{
-			StartOffset: convertDurationToMs(event.StartOffset),
-			EndOffset:   convertDurationToMs(event.EndOffset),
+			StartOffset: convertDurationToMs(event.GetStartOffset()),
+			EndOffset:   convertDurationToMs(event.GetEndOffset()),
 		}
 
-		switch e := event.Event.(type) {
-		case *recordingmetadatav1.SessionRecordingEvent_Inactivity:
+		switch event.WhichEvent() {
+		case recordingmetadatav1.SessionRecordingEvent_Inactivity_case:
 			base.Type = "inactivity"
 			result.Events = append(result.Events, inactivityEvent{baseEvent: base})
-		case *recordingmetadatav1.SessionRecordingEvent_Join:
+		case recordingmetadatav1.SessionRecordingEvent_Join_case:
 			base.Type = "join"
 			result.Events = append(result.Events, joinEvent{
 				baseEvent: base,
-				User:      e.Join.User,
+				User:      event.GetJoin().GetUser(),
 			})
-		case *recordingmetadatav1.SessionRecordingEvent_Resize:
+		case recordingmetadatav1.SessionRecordingEvent_Resize_case:
 			base.Type = "resize"
 			result.Events = append(result.Events, resizeEvent{
 				baseEvent: base,
-				Cols:      e.Resize.Cols,
-				Rows:      e.Resize.Rows,
+				Cols:      event.GetResize().GetCols(),
+				Rows:      event.GetResize().GetRows(),
 			})
 		}
 	}
@@ -292,17 +292,17 @@ type sessionRecordingThumbnailResponse struct {
 // encodeSessionRecordingThumbnail converts the session recording thumbnail to a format more suitable for the frontend.
 func encodeSessionRecordingThumbnail(thumbnail *recordingmetadatav1.SessionRecordingThumbnail) sessionRecordingThumbnailResponse {
 	return sessionRecordingThumbnailResponse{
-		Svg:           string(thumbnail.Svg),
-		Cols:          thumbnail.Cols,
-		Rows:          thumbnail.Rows,
-		CursorX:       thumbnail.CursorX,
-		CursorY:       thumbnail.CursorY,
-		CursorVisible: thumbnail.CursorVisible,
-		StartOffset:   convertDurationToMs(thumbnail.StartOffset),
-		EndOffset:     convertDurationToMs(thumbnail.EndOffset),
-		Png:           thumbnail.Png,
-		ScreenWidth:   thumbnail.ScreenWidth,
-		ScreenHeight:  thumbnail.ScreenHeight,
+		Svg:           string(thumbnail.GetSvg()),
+		Cols:          thumbnail.GetCols(),
+		Rows:          thumbnail.GetRows(),
+		CursorX:       thumbnail.GetCursorX(),
+		CursorY:       thumbnail.GetCursorY(),
+		CursorVisible: thumbnail.GetCursorVisible(),
+		StartOffset:   convertDurationToMs(thumbnail.GetStartOffset()),
+		EndOffset:     convertDurationToMs(thumbnail.GetEndOffset()),
+		Png:           thumbnail.GetPng(),
+		ScreenWidth:   thumbnail.GetScreenWidth(),
+		ScreenHeight:  thumbnail.GetScreenHeight(),
 	}
 }
 
diff --git a/lib/web/resources.go b/lib/web/resources.go
index 1df99dcf2cc..6f294e4ff47 100644
--- a/lib/web/resources.go
+++ b/lib/web/resources.go
@@ -109,13 +109,13 @@ func (h *Handler) listRequestableRolesHandle(w http.ResponseWriter, r *http.Requ
 		return nil, trace.Wrap(err)
 	}
 
-	rolesReq := &proto.ListRequestableRolesRequest{
+	rolesReq := proto.ListRequestableRolesRequest_builder{
 		PageSize:  limit,
 		PageToken: values.Get("startKey"),
-		Filter: &proto.ListRequestableRolesRequest_Filter{
+		Filter: proto.ListRequestableRolesRequest_Filter_builder{
 			SearchKeywords: client.ParseSearchKeywords(values.Get("search"), ' '),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	resp, err := clt.ListRequestableRoles(r.Context(), rolesReq)
 	if err != nil {
@@ -123,8 +123,8 @@ func (h *Handler) listRequestableRolesHandle(w http.ResponseWriter, r *http.Requ
 	}
 
 	return &listResourcesWithoutCountGetResponse{
-		Items:    ui.RequestableRolesFromProto(resp.Roles),
-		StartKey: resp.NextPageToken,
+		Items:    ui.RequestableRolesFromProto(resp.GetRoles()),
+		StartKey: resp.GetNextPageToken(),
 	}, nil
 }
 
@@ -648,7 +648,7 @@ func newKubeListRequest(values url.Values, site, resourceKind string) (*kubeprot
 	sortBy := types.GetSortByFromString(values.Get("sort"))
 
 	startKey := values.Get("startKey")
-	req := &kubeproto.ListKubernetesResourcesRequest{
+	req := kubeproto.ListKubernetesResourcesRequest_builder{
 		ResourceType:        resourceKind,
 		Limit:               limit,
 		StartKey:            startKey,
@@ -659,7 +659,7 @@ func newKubeListRequest(values url.Values, site, resourceKind string) (*kubeprot
 		TeleportCluster:     site,
 		KubernetesCluster:   values.Get("kubeCluster"),
 		KubernetesNamespace: values.Get("kubeNamespace"),
-	}
+	}.Build()
 	return req, nil
 }
 
diff --git a/lib/web/resources_test.go b/lib/web/resources_test.go
index 0f1324f61ae..2df23a03605 100644
--- a/lib/web/resources_test.go
+++ b/lib/web/resources_test.go
@@ -960,12 +960,12 @@ func Test_newKubeListRequest(t *testing.T) {
 				site:         "site1",
 				resourceKind: "kind1",
 			},
-			want: &kubeproto.ListKubernetesResourcesRequest{
+			want: kubeproto.ListKubernetesResourcesRequest_builder{
 				TeleportCluster: "site1",
 				ResourceType:    "kind1",
 				SortBy:          &types.SortBy{},
 				Limit:           defaults.MaxIterationLimit,
-			},
+			}.Build(),
 		},
 		{
 			name: "list resources with sort and query",
@@ -974,7 +974,7 @@ func Test_newKubeListRequest(t *testing.T) {
 				site:         "site1",
 				resourceKind: "kind1",
 			},
-			want: &kubeproto.ListKubernetesResourcesRequest{
+			want: kubeproto.ListKubernetesResourcesRequest_builder{
 				TeleportCluster:     "site1",
 				ResourceType:        "kind1",
 				PredicateExpression: "foo",
@@ -983,7 +983,7 @@ func Test_newKubeListRequest(t *testing.T) {
 					IsDesc: true,
 				},
 				Limit: 10,
-			},
+			}.Build(),
 		},
 		{
 			name: "list resources with search as roles",
@@ -992,7 +992,7 @@ func Test_newKubeListRequest(t *testing.T) {
 				site:         "site1",
 				resourceKind: "kind1",
 			},
-			want: &kubeproto.ListKubernetesResourcesRequest{
+			want: kubeproto.ListKubernetesResourcesRequest_builder{
 				StartKey:            "startK1",
 				KubernetesCluster:   "cluster",
 				KubernetesNamespace: "namespace",
@@ -1005,7 +1005,7 @@ func Test_newKubeListRequest(t *testing.T) {
 				},
 				UseSearchAsRoles: true,
 				Limit:            10,
-			},
+			}.Build(),
 		},
 	}
 	for _, tt := range tests {
diff --git a/lib/web/servers.go b/lib/web/servers.go
index 36dbd0569f7..3bab959254f 100644
--- a/lib/web/servers.go
+++ b/lib/web/servers.go
@@ -93,9 +93,9 @@ func (h *Handler) clusterKubeResourcesGet(w http.ResponseWriter, r *http.Request
 	}
 
 	return listResourcesGetResponse{
-		Items:      webui.MakeKubeResources(resp.Resources, kubeCluster),
-		StartKey:   resp.NextKey,
-		TotalCount: int(resp.TotalCount),
+		Items:      webui.MakeKubeResources(resp.GetResources(), kubeCluster),
+		StartKey:   resp.GetNextKey(),
+		TotalCount: int(resp.GetTotalCount()),
 	}, nil
 }
 
diff --git a/lib/web/ui/instance.go b/lib/web/ui/instance.go
index 961def1819c..a82e1af3537 100644
--- a/lib/web/ui/instance.go
+++ b/lib/web/ui/instance.go
@@ -111,16 +111,16 @@ func makeInstanceUnifiedItem(instance *types.InstanceV1) UnifiedInstance {
 
 func makeBotInstanceUnifiedItem(botInstance *machineidv1.BotInstance) UnifiedInstance {
 	botData := &BotInstanceData{
-		Name: botInstance.Spec.BotName,
+		Name: botInstance.GetSpec().GetBotName(),
 	}
 
-	if botInstance.Status != nil && len(botInstance.Status.LatestHeartbeats) > 0 {
-		heartbeat := botInstance.Status.LatestHeartbeats[0]
-		botData.Version = strings.TrimPrefix(heartbeat.Version, "v")
+	if botInstance.HasStatus() && len(botInstance.GetStatus().GetLatestHeartbeats()) > 0 {
+		heartbeat := botInstance.GetStatus().GetLatestHeartbeats()[0]
+		botData.Version = strings.TrimPrefix(heartbeat.GetVersion(), "v")
 	}
 
 	return UnifiedInstance{
-		ID:          botInstance.Metadata.Name,
+		ID:          botInstance.GetMetadata().GetName(),
 		Type:        "bot_instance",
 		BotInstance: botData,
 	}
diff --git a/lib/web/ui/notification.go b/lib/web/ui/notification.go
index 1a83682c5df..278ad00dfbd 100644
--- a/lib/web/ui/notification.go
+++ b/lib/web/ui/notification.go
@@ -38,17 +38,17 @@ type Notification struct {
 
 // MakeNotification creates a notification object for the WebUI.
 func MakeNotification(notification *notificationsv1.Notification) Notification {
-	labels := ui.MakeLabelsWithoutInternalPrefixes(notification.Metadata.Labels)
+	labels := ui.MakeLabelsWithoutInternalPrefixes(notification.GetMetadata().GetLabels())
 
-	clicked := notification.Metadata.GetLabels()[types.NotificationClickedLabel] == "true"
+	clicked := notification.GetMetadata().GetLabels()[types.NotificationClickedLabel] == "true"
 
 	return Notification{
-		ID:          notification.Metadata.GetName(),
-		Title:       notification.Metadata.GetLabels()[types.NotificationTitleLabel],
-		SubKind:     notification.SubKind,
-		Created:     notification.Spec.Created.AsTime(),
+		ID:          notification.GetMetadata().GetName(),
+		Title:       notification.GetMetadata().GetLabels()[types.NotificationTitleLabel],
+		SubKind:     notification.GetSubKind(),
+		Created:     notification.GetSpec().GetCreated().AsTime(),
 		Clicked:     clicked,
-		TextContent: notification.Metadata.GetLabels()[types.NotificationTextContentLabel],
+		TextContent: notification.GetMetadata().GetLabels()[types.NotificationTextContentLabel],
 		Labels:      labels,
 	}
 }
diff --git a/lib/web/ui/resource.go b/lib/web/ui/resource.go
index 4721be04547..afd4ed04523 100644
--- a/lib/web/ui/resource.go
+++ b/lib/web/ui/resource.go
@@ -100,8 +100,8 @@ func RequestableRolesFromProto(roles []*proto.ListRequestableRolesResponse_Reque
 	out := make([]RequestableRole, 0, len(roles))
 	for _, role := range roles {
 		item := &RequestableRole{
-			Name:        role.Name,
-			Description: role.Description,
+			Name:        role.GetName(),
+			Description: role.GetDescription(),
 		}
 
 		out = append(out, *item)
diff --git a/lib/web/ui/server.go b/lib/web/ui/server.go
index 617c4fe9c16..5d983a8848d 100644
--- a/lib/web/ui/server.go
+++ b/lib/web/ui/server.go
@@ -212,14 +212,14 @@ func MakeEKSClusters(clusters []*integrationv1.EKSCluster) []EKSCluster {
 
 	for _, cluster := range clusters {
 		uiEKSClusters = append(uiEKSClusters, EKSCluster{
-			Name:                 cluster.Name,
-			Region:               cluster.Region,
-			Arn:                  cluster.Arn,
-			Labels:               ui.MakeLabelsWithoutInternalPrefixes(cluster.Labels),
-			JoinLabels:           ui.MakeLabelsWithoutInternalPrefixes(cluster.JoinLabels),
-			Status:               cluster.Status,
-			EndpointPublicAccess: cluster.EndpointPublicAccess,
-			AuthenticationMode:   cluster.AuthenticationMode,
+			Name:                 cluster.GetName(),
+			Region:               cluster.GetRegion(),
+			Arn:                  cluster.GetArn(),
+			Labels:               ui.MakeLabelsWithoutInternalPrefixes(cluster.GetLabels()),
+			JoinLabels:           ui.MakeLabelsWithoutInternalPrefixes(cluster.GetJoinLabels()),
+			Status:               cluster.GetStatus(),
+			EndpointPublicAccess: cluster.GetEndpointPublicAccess(),
+			AuthenticationMode:   cluster.GetAuthenticationMode(),
 		})
 	}
 	return uiEKSClusters
@@ -526,15 +526,15 @@ type Desktop struct {
 }
 
 func MakeLinuxDesktop(linuxDesktop *linuxdesktopv1.LinuxDesktop, logins []string, requiresRequest bool) Desktop {
-	uiLabels := ui.MakeLabelsWithoutInternalPrefixes(linuxDesktop.Metadata.Labels)
+	uiLabels := ui.MakeLabelsWithoutInternalPrefixes(linuxDesktop.GetMetadata().GetLabels())
 
 	return Desktop{
 		Kind:            linuxDesktop.GetKind(),
 		OS:              constants.LinuxOS,
-		Name:            linuxDesktop.Spec.Hostname,
-		Addr:            linuxDesktop.Spec.Addr,
+		Name:            linuxDesktop.GetSpec().GetHostname(),
+		Addr:            linuxDesktop.GetSpec().GetAddr(),
 		Labels:          uiLabels,
-		HostID:          linuxDesktop.Metadata.Name,
+		HostID:          linuxDesktop.GetMetadata().GetName(),
 		Logins:          logins,
 		RequiresRequest: requiresRequest,
 	}
diff --git a/lib/web/ui/server_test.go b/lib/web/ui/server_test.go
index 725f1a26b05..900979d4e37 100644
--- a/lib/web/ui/server_test.go
+++ b/lib/web/ui/server_test.go
@@ -482,22 +482,22 @@ func TestMakeLinuxDesktop(t *testing.T) {
 		{
 			name: "basic linux desktop",
 			desktop: func(t *testing.T) *linuxdesktopv1.LinuxDesktop {
-				return &linuxdesktopv1.LinuxDesktop{
+				return linuxdesktopv1.LinuxDesktop_builder{
 					Kind:    types.KindLinuxDesktop,
 					Version: types.V3,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "linux-desktop-1",
 						Labels: map[string]string{
 							"env":    "prod",
 							"region": "us-west",
 						},
-					},
-					Spec: &linuxdesktopv1.LinuxDesktopSpec{
+					}.Build(),
+					Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 						Addr:     "10.0.0.1:22",
 						Hostname: "linux-host-1",
 						ProxyIds: []string{"proxy-1"},
-					},
-				}
+					}.Build(),
+				}.Build()
 			},
 			logins:          []string{"ubuntu", "root"},
 			requiresRequest: false,
@@ -518,22 +518,22 @@ func TestMakeLinuxDesktop(t *testing.T) {
 		{
 			name: "linux desktop with internal labels filtered",
 			desktop: func(t *testing.T) *linuxdesktopv1.LinuxDesktop {
-				return &linuxdesktopv1.LinuxDesktop{
+				return linuxdesktopv1.LinuxDesktop_builder{
 					Kind:    types.KindLinuxDesktop,
 					Version: types.V3,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "linux-desktop-2",
 						Labels: map[string]string{
 							"teleport.internal/resource-id": "12345",
 							"teleport.hidden/secret":        "value",
 							"visible":                       "label",
 						},
-					},
-					Spec: &linuxdesktopv1.LinuxDesktopSpec{
+					}.Build(),
+					Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 						Addr:     "192.168.1.100:22",
 						Hostname: "linux-host-2",
-					},
-				}
+					}.Build(),
+				}.Build()
 			},
 			logins:          []string{"admin"},
 			requiresRequest: true,
@@ -553,17 +553,17 @@ func TestMakeLinuxDesktop(t *testing.T) {
 		{
 			name: "linux desktop with no labels",
 			desktop: func(t *testing.T) *linuxdesktopv1.LinuxDesktop {
-				return &linuxdesktopv1.LinuxDesktop{
+				return linuxdesktopv1.LinuxDesktop_builder{
 					Kind:    types.KindLinuxDesktop,
 					Version: types.V3,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: "linux-desktop-3",
-					},
-					Spec: &linuxdesktopv1.LinuxDesktopSpec{
+					}.Build(),
+					Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 						Addr:     "example.com:2222",
 						Hostname: "linux-host-3",
-					},
-				}
+					}.Build(),
+				}.Build()
 			},
 			logins:          nil,
 			requiresRequest: false,
diff --git a/lib/web/userpreferences.go b/lib/web/userpreferences.go
index 36be7457d78..dffe25e4619 100644
--- a/lib/web/userpreferences.go
+++ b/lib/web/userpreferences.go
@@ -100,7 +100,7 @@ func (h *Handler) getUserClusterPreferences(_ http.ResponseWriter, r *http.Reque
 		return nil, trace.Wrap(err)
 	}
 
-	return clusterPreferencesResponse(resp.Preferences.ClusterPreferences), nil
+	return clusterPreferencesResponse(resp.GetPreferences().GetClusterPreferences()), nil
 }
 
 // updateUserClusterPreferences is a handler for PUT /webapi/user/preferences.
@@ -137,49 +137,49 @@ func (h *Handler) getUserPreferences(_ http.ResponseWriter, r *http.Request, _ h
 		return nil, trace.Wrap(err)
 	}
 
-	return userPreferencesResponse(resp.Preferences), nil
+	return userPreferencesResponse(resp.GetPreferences()), nil
 }
 
 func makePreferenceRequest(req UserPreferencesResponse) *userpreferencesv1.UpsertUserPreferencesRequest {
 	var discoverGuide *userpreferencesv1.DiscoverGuide
 	if req.DiscoverResourcePreferences.DiscoverGuide != nil {
-		discoverGuide = &userpreferencesv1.DiscoverGuide{
+		discoverGuide = userpreferencesv1.DiscoverGuide_builder{
 			Pinned: req.DiscoverResourcePreferences.DiscoverGuide.Pinned,
-		}
+		}.Build()
 	}
-	return &userpreferencesv1.UpsertUserPreferencesRequest{
-		Preferences: &userpreferencesv1.UserPreferences{
+	return userpreferencesv1.UpsertUserPreferencesRequest_builder{
+		Preferences: userpreferencesv1.UserPreferences_builder{
 			KeyboardLayout: req.KeyboardLayout,
 			Theme:          req.Theme,
-			UnifiedResourcePreferences: &userpreferencesv1.UnifiedResourcePreferences{
+			UnifiedResourcePreferences: userpreferencesv1.UnifiedResourcePreferences_builder{
 				DefaultTab:            req.UnifiedResourcePreferences.DefaultTab,
 				ViewMode:              req.UnifiedResourcePreferences.ViewMode,
 				LabelsViewMode:        req.UnifiedResourcePreferences.LabelsViewMode,
 				AvailableResourceMode: req.UnifiedResourcePreferences.AvailableResourceMode,
-			},
-			Onboard: &userpreferencesv1.OnboardUserPreferences{
+			}.Build(),
+			Onboard: userpreferencesv1.OnboardUserPreferences_builder{
 				PreferredResources: req.Onboard.PreferredResources,
-				MarketingParams: &userpreferencesv1.MarketingParams{
+				MarketingParams: userpreferencesv1.MarketingParams_builder{
 					Campaign: req.Onboard.MarketingParams.Campaign,
 					Source:   req.Onboard.MarketingParams.Source,
 					Medium:   req.Onboard.MarketingParams.Medium,
 					Intent:   req.Onboard.MarketingParams.Intent,
-				},
-			},
-			ClusterPreferences: &userpreferencesv1.ClusterUserPreferences{
-				PinnedResources: &userpreferencesv1.PinnedResourcesUserPreferences{
+				}.Build(),
+			}.Build(),
+			ClusterPreferences: userpreferencesv1.ClusterUserPreferences_builder{
+				PinnedResources: userpreferencesv1.PinnedResourcesUserPreferences_builder{
 					ResourceIds: req.ClusterPreferences.PinnedResources,
-				},
-			},
-			AccessGraph: &userpreferencesv1.AccessGraphUserPreferences{
+				}.Build(),
+			}.Build(),
+			AccessGraph: userpreferencesv1.AccessGraphUserPreferences_builder{
 				HasBeenRedirected: req.AccessGraph.HasBeenRedirected,
-			},
+			}.Build(),
 			SideNavDrawerMode: req.SideNavDrawerMode,
-			DiscoverResourcePreferences: &userpreferencesv1.DiscoverResourcePreferences{
+			DiscoverResourcePreferences: userpreferencesv1.DiscoverResourcePreferences_builder{
 				DiscoverGuide: discoverGuide,
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 // updateUserPreferences is a handler for PUT /webapi/user/preferences.
@@ -206,14 +206,14 @@ func (h *Handler) updateUserPreferences(_ http.ResponseWriter, r *http.Request,
 // userPreferencesResponse creates a JSON response for the user preferences.
 func userPreferencesResponse(resp *userpreferencesv1.UserPreferences) *UserPreferencesResponse {
 	jsonResp := &UserPreferencesResponse{
-		Theme:                       resp.Theme,
-		Onboard:                     onboardUserPreferencesResponse(resp.Onboard),
-		ClusterPreferences:          clusterPreferencesResponse(resp.ClusterPreferences),
-		UnifiedResourcePreferences:  unifiedResourcePreferencesResponse(resp.UnifiedResourcePreferences),
-		AccessGraph:                 accessGraphPreferencesResponse(resp.AccessGraph),
-		SideNavDrawerMode:           resp.SideNavDrawerMode,
-		DiscoverResourcePreferences: discoverResourcePreferenceResponse(resp.DiscoverResourcePreferences),
-		KeyboardLayout:              resp.KeyboardLayout,
+		Theme:                       resp.GetTheme(),
+		Onboard:                     onboardUserPreferencesResponse(resp.GetOnboard()),
+		ClusterPreferences:          clusterPreferencesResponse(resp.GetClusterPreferences()),
+		UnifiedResourcePreferences:  unifiedResourcePreferencesResponse(resp.GetUnifiedResourcePreferences()),
+		AccessGraph:                 accessGraphPreferencesResponse(resp.GetAccessGraph()),
+		SideNavDrawerMode:           resp.GetSideNavDrawerMode(),
+		DiscoverResourcePreferences: discoverResourcePreferenceResponse(resp.GetDiscoverResourcePreferences()),
+		KeyboardLayout:              resp.GetKeyboardLayout(),
 	}
 
 	return jsonResp
@@ -226,33 +226,33 @@ func clusterPreferencesResponse(prefs *userpreferencesv1.ClusterUserPreferences)
 		return resp
 	}
 
-	resp.PinnedResources = append(resp.PinnedResources, prefs.PinnedResources.ResourceIds...)
+	resp.PinnedResources = append(resp.PinnedResources, prefs.GetPinnedResources().GetResourceIds()...)
 	return resp
 }
 
 // unifiedResourcePreferencesResponse creates a JSON response for the assist user preferences.
 func unifiedResourcePreferencesResponse(resp *userpreferencesv1.UnifiedResourcePreferences) UnifiedResourcePreferencesResponse {
 	return UnifiedResourcePreferencesResponse{
-		DefaultTab:            resp.DefaultTab,
-		ViewMode:              resp.ViewMode,
-		LabelsViewMode:        resp.LabelsViewMode,
-		AvailableResourceMode: resp.AvailableResourceMode,
+		DefaultTab:            resp.GetDefaultTab(),
+		ViewMode:              resp.GetViewMode(),
+		LabelsViewMode:        resp.GetLabelsViewMode(),
+		AvailableResourceMode: resp.GetAvailableResourceMode(),
 	}
 }
 
 // onboardUserPreferencesResponse creates a JSON response for the onboard user preferences.
 func onboardUserPreferencesResponse(resp *userpreferencesv1.OnboardUserPreferences) OnboardUserPreferencesResponse {
 	jsonResp := OnboardUserPreferencesResponse{
-		PreferredResources: make([]userpreferencesv1.Resource, 0, len(resp.PreferredResources)),
+		PreferredResources: make([]userpreferencesv1.Resource, 0, len(resp.GetPreferredResources())),
 		MarketingParams: preferencesMarketingParams{
-			Campaign: resp.MarketingParams.Campaign,
-			Source:   resp.MarketingParams.Source,
-			Medium:   resp.MarketingParams.Medium,
-			Intent:   resp.MarketingParams.Intent,
+			Campaign: resp.GetMarketingParams().GetCampaign(),
+			Source:   resp.GetMarketingParams().GetSource(),
+			Medium:   resp.GetMarketingParams().GetMedium(),
+			Intent:   resp.GetMarketingParams().GetIntent(),
 		},
 	}
 
-	jsonResp.PreferredResources = append(jsonResp.PreferredResources, resp.PreferredResources...)
+	jsonResp.PreferredResources = append(jsonResp.PreferredResources, resp.GetPreferredResources()...)
 
 	return jsonResp
 }
@@ -266,7 +266,7 @@ func accessGraphPreferencesResponse(resp *userpreferencesv1.AccessGraphUserPrefe
 	}
 
 	return AccessGraphPreferencesResponse{
-		HasBeenRedirected: resp.HasBeenRedirected,
+		HasBeenRedirected: resp.GetHasBeenRedirected(),
 	}
 }
 
diff --git a/lib/web/users.go b/lib/web/users.go
index b6d6f51c9a8..6e7b553787f 100644
--- a/lib/web/users.go
+++ b/lib/web/users.go
@@ -85,20 +85,20 @@ func (h *Handler) listUsersHandle(w http.ResponseWriter, r *http.Request, params
 		int(limit),
 		values.Get("startKey"),
 		func(ctx context.Context, pageSize int, pageToken string) ([]*types.UserV2, string, error) {
-			resp, err := clt.ListUsers(r.Context(), &userspb.ListUsersRequest{
+			resp, err := clt.ListUsers(r.Context(), userspb.ListUsersRequest_builder{
 				PageSize:  int32(pageSize),
 				PageToken: pageToken,
 				Filter: &types.UserFilter{
 					SearchKeywords:  client.ParseSearchKeywords(values.Get("search"), ' '),
 					SkipSystemUsers: true,
 				},
-			})
+			}.Build())
 
 			if err != nil {
 				return nil, "", trace.Wrap(err)
 			}
 
-			return resp.Users, resp.NextPageToken, nil
+			return resp.GetUsers(), resp.GetNextPageToken(), nil
 		})
 
 	if err != nil {
diff --git a/lib/web/usertasks.go b/lib/web/usertasks.go
index 285e1651998..151ddd98d3e 100644
--- a/lib/web/usertasks.go
+++ b/lib/web/usertasks.go
@@ -56,7 +56,7 @@ func (h *Handler) userTaskStateUpdate(w http.ResponseWriter, r *http.Request, p
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	userTask.Spec.State = req.State
+	userTask.GetSpec().SetState(req.State)
 
 	newUserTask, err := clt.UserTasksServiceClient().UpsertUserTask(r.Context(), userTask)
 	if err != nil {
@@ -116,10 +116,10 @@ func (h *Handler) userTaskListByIntegration(w http.ResponseWriter, r *http.Reque
 
 	taskStateFilter := values.Get("state")
 
-	filters := &usertasksv1.ListUserTasksFilters{
+	filters := usertasksv1.ListUserTasksFilters_builder{
 		Integration: integrationName,
 		TaskState:   taskStateFilter,
-	}
+	}.Build()
 	userTasks, nextKey, err := clt.UserTasksServiceClient().ListUserTasks(r.Context(), int64(limit), startKey, filters)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/lib/web/usertasks_test.go b/lib/web/usertasks_test.go
index 4cf28441709..94309eddc72 100644
--- a/lib/web/usertasks_test.go
+++ b/lib/web/usertasks_test.go
@@ -74,23 +74,23 @@ func TestUserTask(t *testing.T) {
 	}
 	var userTaskForTest *usertasksv1.UserTask
 	for _, issueType := range issueTypes {
-		userTask, err := usertasks.NewDiscoverEC2UserTask(&usertasksv1.UserTaskSpec{
+		userTask, err := usertasks.NewDiscoverEC2UserTask(usertasksv1.UserTaskSpec_builder{
 			Integration: "my-integration",
 			TaskType:    usertasks.TaskTypeDiscoverEC2,
 			IssueType:   issueType,
 			State:       usertasks.TaskStateOpen,
-			DiscoverEc2: &usertasksv1.DiscoverEC2{
+			DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 				AccountId: "123456789012",
 				Region:    "us-east-1",
 				Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-					"i-123": {
+					"i-123": usertasksv1.DiscoverEC2Instance_builder{
 						InstanceId:      "i-123",
 						DiscoveryConfig: "dc01",
 						DiscoveryGroup:  "dg01",
-					},
+					}.Build(),
 				},
-			},
-		})
+			}.Build(),
+		}.Build())
 		require.NoError(t, err)
 
 		_, err = adminClient.UserTasksServiceClient().CreateUserTask(ctx, userTask)
diff --git a/lib/web/workload_identity.go b/lib/web/workload_identity.go
index a6ca8ec8d88..00c7f522e42 100644
--- a/lib/web/workload_identity.go
+++ b/lib/web/workload_identity.go
@@ -39,24 +39,24 @@ func (h *Handler) listWorkloadIdentities(_ http.ResponseWriter, r *http.Request,
 		return nil, trace.Wrap(err)
 	}
 
-	request := &workloadidentityv1.ListWorkloadIdentitiesV2Request{
+	request := workloadidentityv1.ListWorkloadIdentitiesV2Request_builder{
 		PageSize:         20,
 		PageToken:        r.URL.Query().Get("page_token"),
 		SortField:        r.URL.Query().Get("sort_field"),
 		FilterSearchTerm: r.URL.Query().Get("search"),
-	}
+	}.Build()
 
 	if r.URL.Query().Has("page_size") {
 		pageSize, err := strconv.ParseInt(r.URL.Query().Get("page_size"), 10, 32)
 		if err != nil {
 			return nil, trace.BadParameter("invalid page size")
 		}
-		request.PageSize = int32(pageSize)
+		request.SetPageSize(int32(pageSize))
 	}
 
 	if r.URL.Query().Has("sort_dir") {
 		sortDir := r.URL.Query().Get("sort_dir")
-		request.SortDesc = strings.ToLower(sortDir) == "desc"
+		request.SetSortDesc(strings.ToLower(sortDir) == "desc")
 	}
 
 	result, err := clt.WorkloadIdentityResourceServiceClient().ListWorkloadIdentitiesV2(r.Context(), request)
@@ -64,12 +64,12 @@ func (h *Handler) listWorkloadIdentities(_ http.ResponseWriter, r *http.Request,
 		return nil, trace.Wrap(err)
 	}
 
-	uiItems := tslices.Map(result.WorkloadIdentities, func(item *workloadidentityv1.WorkloadIdentity) WorkloadIdentity {
+	uiItems := tslices.Map(result.GetWorkloadIdentities(), func(item *workloadidentityv1.WorkloadIdentity) WorkloadIdentity {
 		uiItem := WorkloadIdentity{
-			Name:       item.Metadata.Name,
-			SpiffeID:   item.Spec.Spiffe.Id,
-			SpiffeHint: item.Spec.Spiffe.Hint,
-			Labels:     item.Metadata.Labels,
+			Name:       item.GetMetadata().GetName(),
+			SpiffeID:   item.GetSpec().GetSpiffe().GetId(),
+			SpiffeHint: item.GetSpec().GetSpiffe().GetHint(),
+			Labels:     item.GetMetadata().GetLabels(),
 		}
 
 		return uiItem
@@ -77,7 +77,7 @@ func (h *Handler) listWorkloadIdentities(_ http.ResponseWriter, r *http.Request,
 
 	return ListWorkloadIdentitiesResponse{
 		Items:         uiItems,
-		NextPageToken: result.NextPageToken,
+		NextPageToken: result.GetNextPageToken(),
 	}, nil
 }
 
diff --git a/lib/web/workload_identity_test.go b/lib/web/workload_identity_test.go
index c79cca16e53..0416d409cb2 100644
--- a/lib/web/workload_identity_test.go
+++ b/lib/web/workload_identity_test.go
@@ -54,23 +54,23 @@ func TestListWorkloadIdentities(t *testing.T) {
 
 	name := uuid.New().String()
 
-	_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+	_, err := env.server.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 		Kind:    types.KindWorkloadIdentity,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
 			Labels: map[string]string{
 				"label-1": "value-1",
 				"label-2": "value-2",
 			},
-		},
-		Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-			Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+		}.Build(),
+		Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+			Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 				Id:   "/test/spiffe/id",
 				Hint: "Lorem ipsum delor sit",
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	response, err := pack.clt.Get(ctx, endpoint, url.Values{})
@@ -136,18 +136,18 @@ func TestListWorkloadIdentitiesPaging(t *testing.T) {
 			)
 
 			for i := range tc.numInstances {
-				_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+				_, err := env.server.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 					Kind:    types.KindWorkloadIdentity,
 					Version: types.V1,
-					Metadata: &headerv1.Metadata{
+					Metadata: headerv1.Metadata_builder{
 						Name: uuid.New().String(),
-					},
-					Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-						Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+					}.Build(),
+					Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+						Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 							Id: "/test/spiffe/" + uuid.New().String(),
-						},
-					},
-				})
+						}.Build(),
+					}.Build(),
+				}.Build())
 				require.NoError(t, err, "failed to create WorkloadIdentity index:%d", i)
 			}
 
@@ -182,18 +182,18 @@ func TestListWorkloadIdentitiesSorting(t *testing.T) {
 	)
 
 	for i := range 10 {
-		_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+		_, err := env.server.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: uuid.New().String(),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/test/spiffe/" + uuid.New().String(),
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 		require.NoError(t, err, "failed to create WorkloadIdentity index:%d", i)
 	}
 
@@ -228,26 +228,26 @@ func TestListWorkloadIdentitiesWithSearchTermFilter(t *testing.T) {
 		{
 			name:       "match on name",
 			searchTerm: "nick",
-			metadata: &headerv1.Metadata{
+			metadata: headerv1.Metadata_builder{
 				Name: "this-is-nicks-workload-identity",
-			},
-			spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/spiffe/id/99",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:       "match on spiffe id",
 			searchTerm: "id/22",
-			metadata: &headerv1.Metadata{
+			metadata: headerv1.Metadata_builder{
 				Name: "this-is-nicks-workload-identity",
-			},
-			spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/spiffe/id/22",
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	}
 
@@ -265,26 +265,26 @@ func TestListWorkloadIdentitiesWithSearchTermFilter(t *testing.T) {
 				"workload-identity",
 			)
 
-			_, err := env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+			_, err := env.server.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:     types.KindWorkloadIdentity,
 				Version:  types.V1,
 				Metadata: tc.metadata,
 				Spec:     tc.spec,
-			})
+			}.Build())
 			require.NoError(t, err)
 
-			_, err = env.server.Auth().CreateWorkloadIdentity(ctx, &workloadidentityv1pb.WorkloadIdentity{
+			_, err = env.server.Auth().CreateWorkloadIdentity(ctx, workloadidentityv1pb.WorkloadIdentity_builder{
 				Kind:    types.KindWorkloadIdentity,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: "gone",
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-					Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+					Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 						Id: "/test/spiffe/id",
-					},
-				},
-			})
+					}.Build(),
+				}.Build(),
+			}.Build())
 			require.NoError(t, err)
 
 			response, err := pack.clt.Get(ctx, endpoint, url.Values{
diff --git a/lib/web/yaml_test.go b/lib/web/yaml_test.go
index 49f55540949..874f4537ef8 100644
--- a/lib/web/yaml_test.go
+++ b/lib/web/yaml_test.go
@@ -78,21 +78,21 @@ spec:
 `
 
 func getAccessMonitoringRuleResource() *accessmonitoringrulesv1.AccessMonitoringRule {
-	return &accessmonitoringrulesv1.AccessMonitoringRule{
+	return accessmonitoringrulesv1.AccessMonitoringRule_builder{
 		Kind:    types.KindAccessMonitoringRule,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "foo",
-		},
-		Spec: &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+		}.Build(),
+		Spec: accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 			Subjects:  []string{types.KindAccessRequest},
 			Condition: "some-condition",
-			Notification: &accessmonitoringrulesv1.Notification{
+			Notification: accessmonitoringrulesv1.Notification_builder{
 				Name:       "mattermost",
 				Recipients: []string{"apple"},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 }
 
 func getTokenResource() *types.ProvisionTokenV2 {
diff --git a/lib/winpki/certificate_authority.go b/lib/winpki/certificate_authority.go
index e3539822956..3158b984799 100644
--- a/lib/winpki/certificate_authority.go
+++ b/lib/winpki/certificate_authority.go
@@ -203,7 +203,7 @@ func (c *CertificateStoreClient) updateCAOverrideCRLs(ctx context.Context, tc *t
 			)
 			continue
 		}
-		block, _ := pem.Decode([]byte(crlPB.Pem))
+		block, _ := pem.Decode([]byte(crlPB.GetPem()))
 		if block == nil {
 			logger.WarnContext(ctx, "Failed to decode CA override CRL PEM")
 			continue
diff --git a/lib/winpki/certificate_authority_test.go b/lib/winpki/certificate_authority_test.go
index 09edea3e532..7704bc13100 100644
--- a/lib/winpki/certificate_authority_test.go
+++ b/lib/winpki/certificate_authority_test.go
@@ -88,33 +88,33 @@ func TestCertificateStoreClient_Update(t *testing.T) {
 	require.NoError(t, err)
 	overrideCert, overrideCertPEM := overrideCA.Cert, overrideCA.CertPEM
 	publicKeyHash := subca.HashCertificatePublicKey(overrideCert)
-	caOverride := &subcav1.CertAuthorityOverride{
+	caOverride := subcav1.CertAuthorityOverride_builder{
 		Kind:    types.KindCertAuthorityOverride,
 		SubKind: string(types.WindowsCA),
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: clusterName,
-		},
-		Spec: &subcav1.CertAuthorityOverrideSpec{
+		}.Build(),
+		Spec: subcav1.CertAuthorityOverrideSpec_builder{
 			CertificateOverrides: []*subcav1.CertificateOverride{
-				{
+				subcav1.CertificateOverride_builder{
 					PublicKey:   publicKeyHash,
 					Certificate: string(overrideCertPEM),
 					Disabled:    true, // We'll push the CRL even if it's disabled.
-				},
+				}.Build(),
 			},
-		},
-		Status: &subcav1.CertAuthorityOverrideStatus{
+		}.Build(),
+		Status: subcav1.CertAuthorityOverrideStatus_builder{
 			PublicKeyHashToCrl: map[string]*subcav1.CertificateRevocationList{
-				publicKeyHash: {
+				publicKeyHash: subcav1.CertificateRevocationList_builder{
 					Pem: string(pem.EncodeToMemory(&pem.Block{
 						Type:  "X509 CRL",
 						Bytes: []byte(overrideCRL),
 					})),
-				},
+				}.Build(),
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	ap := &fakeAccessPoint{
 		cas: []types.CertAuthority{ca},
@@ -230,7 +230,7 @@ func (f *fakeAccessPoint) GetCertAuthorityOverride(ctx context.Context, id types
 	}
 
 	for _, caOverride := range f.caOverrides {
-		if caOverride.Metadata.Name == id.ClusterName && caOverride.SubKind == id.CAType {
+		if caOverride.GetMetadata().GetName() == id.ClusterName && caOverride.GetSubKind() == id.CAType {
 			return caOverride, nil
 		}
 	}
diff --git a/tool/tctl/common/accessmonitoring/command.go b/tool/tctl/common/accessmonitoring/command.go
index 419f4f25736..0f87d778504 100644
--- a/tool/tctl/common/accessmonitoring/command.go
+++ b/tool/tctl/common/accessmonitoring/command.go
@@ -190,8 +190,8 @@ func (c *cmdHandler) onAuditQuerySchema(ctx context.Context, authClient *authcli
 	}
 	for _, view := range resp.GetViews() {
 		table := asciitable.MakeTable([]string{"Name", "Type", "Description"})
-		for _, v := range view.Columns {
-			table.AddRow([]string{v.Name, v.Type, v.Desc})
+		for _, v := range view.GetColumns() {
+			table.AddRow([]string{v.GetName(), v.GetType(), v.GetDesc()})
 		}
 		_, err = table.AsBuffer().WriteTo(os.Stdout)
 		if err != nil {
diff --git a/tool/tctl/common/admin_action_test.go b/tool/tctl/common/admin_action_test.go
index 1aaca6980b3..8e9192e7c7b 100644
--- a/tool/tctl/common/admin_action_test.go
+++ b/tool/tctl/common/admin_action_test.go
@@ -140,18 +140,18 @@ func (s *adminActionTestSuite) testBots(t *testing.T) {
 	ctx := context.Background()
 
 	botName := "bot"
-	botReq := &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	botReq := machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: botName,
-			},
-			Spec: &machineidv1pb.BotSpec{
+			}.Build(),
+			Spec: machineidv1pb.BotSpec_builder{
 				Roles: []string{teleport.PresetAccessRoleName},
-			},
-		},
-	}
+			}.Build(),
+		}.Build(),
+	}.Build()
 
 	createBot := func() error {
 		_, err := s.localAdminClient.BotServiceClient().CreateBot(ctx, botReq)
@@ -159,9 +159,9 @@ func (s *adminActionTestSuite) testBots(t *testing.T) {
 	}
 
 	deleteBot := func() error {
-		_, err := s.localAdminClient.BotServiceClient().DeleteBot(ctx, &machineidv1pb.DeleteBotRequest{
+		_, err := s.localAdminClient.BotServiceClient().DeleteBot(ctx, machineidv1pb.DeleteBotRequest_builder{
 			BotName: botName,
-		})
+		}.Build())
 		return trace.Wrap(err)
 	}
 
diff --git a/tool/tctl/common/auth_command.go b/tool/tctl/common/auth_command.go
index e0460de0228..09f699c1dae 100644
--- a/tool/tctl/common/auth_command.go
+++ b/tool/tctl/common/auth_command.go
@@ -622,7 +622,7 @@ func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI certifica
 	}
 	clusterName := cn.GetClusterName()
 
-	res, err := clusterAPI.TrustClient().GenerateHostCert(ctx, &trustpb.GenerateHostCertRequest{
+	res, err := clusterAPI.TrustClient().GenerateHostCert(ctx, trustpb.GenerateHostCertRequest_builder{
 		Key:         key.MarshalSSHPublicKey(),
 		HostId:      "",
 		NodeName:    "",
@@ -630,7 +630,7 @@ func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI certifica
 		ClusterName: clusterName,
 		Role:        string(types.RoleNode),
 		Ttl:         durationpb.New(0),
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -641,7 +641,7 @@ func (a *AuthCommand) generateHostKeys(ctx context.Context, clusterAPI certifica
 	}
 	keyRing := &client.KeyRing{
 		SSHPrivateKey: key,
-		Cert:          res.SshCertificate,
+		Cert:          res.GetSshCertificate(),
 		TrustedCerts:  authclient.AuthoritiesToTrustedCerts(hostCAs),
 	}
 
diff --git a/tool/tctl/common/autoupdate_command.go b/tool/tctl/common/autoupdate_command.go
index d89d8bc2e81..39288eb5c06 100644
--- a/tool/tctl/common/autoupdate_command.go
+++ b/tool/tctl/common/autoupdate_command.go
@@ -374,7 +374,7 @@ func getAllReports(ctx context.Context, client autoupdateClient) ([]*autoupdatev
 
 func rolloutHasAgentCounters(rollout *autoupdatev1pb.AutoUpdateAgentRollout) bool {
 	for _, group := range rollout.GetStatus().GetGroups() {
-		if group.PresentCount != 0 {
+		if group.GetPresentCount() != 0 {
 			return true
 		}
 	}
@@ -389,8 +389,8 @@ func rolloutGroupTable(rollout *autoupdatev1pb.AutoUpdateAgentRollout, writer io
 		table := asciitable.MakeTable(headers)
 		for i, group := range groups {
 			groupName := group.GetName()
-			groupCount := group.PresentCount
-			groupUpToDate := group.UpToDateCount
+			groupCount := group.GetPresentCount()
+			groupUpToDate := group.GetUpToDateCount()
 			if i == len(groups)-1 {
 				groupName = groupName + " (catch-all)"
 			}
@@ -399,12 +399,12 @@ func rolloutGroupTable(rollout *autoupdatev1pb.AutoUpdateAgentRollout, writer io
 			// If this is the canary state, we annotate the group state with the canary progress
 			if group.GetState() == autoupdatev1pb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY {
 				successCount := 0
-				for _, canary := range group.Canaries {
-					if canary.Success {
+				for _, canary := range group.GetCanaries() {
+					if canary.GetSuccess() {
 						successCount++
 					}
 				}
-				state = fmt.Sprintf("%s (%d/%d)", state, successCount, group.CanaryCount)
+				state = fmt.Sprintf("%s (%d/%d)", state, successCount, group.GetCanaryCount())
 			}
 
 			table.AddRow([]string{
@@ -526,16 +526,16 @@ func (c *AutoUpdateCommand) ToolsStatus(ctx context.Context, client autoupdateCl
 	if err != nil && !trace.IsNotFound(err) {
 		return trace.Wrap(err)
 	}
-	if config != nil && config.Spec.Tools != nil {
-		response.Mode = config.Spec.Tools.Mode
+	if config != nil && config.GetSpec().HasTools() {
+		response.Mode = config.GetSpec().GetTools().GetMode()
 	}
 
 	version, err := client.GetAutoUpdateVersion(ctx)
 	if err != nil && !trace.IsNotFound(err) {
 		return trace.Wrap(err)
 	}
-	if version != nil && version.Spec.Tools != nil {
-		response.TargetVersion = version.Spec.Tools.TargetVersion
+	if version != nil && version.GetSpec().HasTools() {
+		response.TargetVersion = version.GetSpec().GetTools().GetTargetVersion()
 	}
 
 	return c.printToolsResponse(response)
@@ -574,13 +574,13 @@ func (c *AutoUpdateCommand) setToolsMode(ctx context.Context, client autoupdateC
 		return trace.Wrap(err)
 	}
 
-	if config.Spec.Tools == nil {
-		config.Spec.Tools = &autoupdatev1pb.AutoUpdateConfigSpecTools{}
+	if !config.GetSpec().HasTools() {
+		config.GetSpec().SetTools(&autoupdatev1pb.AutoUpdateConfigSpecTools{})
 	}
 
-	config.Spec.Tools.Mode = autoupdate.ToolsUpdateModeDisabled
+	config.GetSpec().GetTools().SetMode(autoupdate.ToolsUpdateModeDisabled)
 	if enabled {
-		config.Spec.Tools.Mode = autoupdate.ToolsUpdateModeEnabled
+		config.GetSpec().GetTools().SetMode(autoupdate.ToolsUpdateModeEnabled)
 	}
 	if _, err := setMode(ctx, config); err != nil {
 		return trace.Wrap(err)
@@ -604,11 +604,11 @@ func (c *AutoUpdateCommand) setToolsTargetVersion(ctx context.Context, client au
 	} else if err != nil {
 		return trace.Wrap(err)
 	}
-	if version.Spec.Tools == nil {
-		version.Spec.Tools = &autoupdatev1pb.AutoUpdateVersionSpecTools{}
+	if !version.GetSpec().HasTools() {
+		version.GetSpec().SetTools(&autoupdatev1pb.AutoUpdateVersionSpecTools{})
 	}
-	if version.Spec.Tools.TargetVersion != c.toolsTargetVersion {
-		version.Spec.Tools.TargetVersion = c.toolsTargetVersion
+	if version.GetSpec().GetTools().GetTargetVersion() != c.toolsTargetVersion {
+		version.GetSpec().GetTools().SetTargetVersion(c.toolsTargetVersion)
 		if _, err := setTargetVersion(ctx, version); err != nil {
 			return trace.Wrap(err)
 		}
@@ -624,8 +624,8 @@ func (c *AutoUpdateCommand) clearToolsTargetVersion(ctx context.Context, client
 	} else if err != nil {
 		return trace.Wrap(err)
 	}
-	if version.Spec.Tools != nil {
-		version.Spec.Tools = nil
+	if version.GetSpec().HasTools() {
+		version.GetSpec().ClearTools()
 		if _, err := client.UpdateAutoUpdateVersion(ctx, version); err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/tool/tctl/common/autoupdate_command_test.go b/tool/tctl/common/autoupdate_command_test.go
index 0d4d2ad74c3..ee6e436760c 100644
--- a/tool/tctl/common/autoupdate_command_test.go
+++ b/tool/tctl/common/autoupdate_command_test.go
@@ -71,7 +71,7 @@ func TestClientToolsAutoUpdateCommands(t *testing.T) {
 
 	config, err := authClient.GetAutoUpdateConfig(ctx)
 	require.NoError(t, err)
-	assert.Equal(t, "enabled", config.Spec.Tools.Mode)
+	assert.Equal(t, "enabled", config.GetSpec().GetTools().GetMode())
 
 	// Disable client tools auto updates to check that AutoUpdateConfig resource is modified.
 	_, err = runAutoUpdateCommand(t, authClient, []string{"client-tools", "disable"})
@@ -79,7 +79,7 @@ func TestClientToolsAutoUpdateCommands(t *testing.T) {
 
 	config, err = authClient.GetAutoUpdateConfig(ctx)
 	require.NoError(t, err)
-	assert.Equal(t, "disabled", config.Spec.Tools.Mode)
+	assert.Equal(t, "disabled", config.GetSpec().GetTools().GetMode())
 
 	// Set target version for client tools auto updates.
 	_, err = runAutoUpdateCommand(t, authClient, []string{"client-tools", "target", "1.2.3"})
@@ -87,7 +87,7 @@ func TestClientToolsAutoUpdateCommands(t *testing.T) {
 
 	version, err := authClient.GetAutoUpdateVersion(ctx)
 	require.NoError(t, err)
-	assert.Equal(t, "1.2.3", version.Spec.Tools.TargetVersion)
+	assert.Equal(t, "1.2.3", version.GetSpec().GetTools().GetTargetVersion())
 
 	getBuf, err := runAutoUpdateCommand(t, authClient, []string{"client-tools", "status", "--format=json"})
 	require.NoError(t, err)
@@ -110,7 +110,7 @@ func TestClientToolsAutoUpdateCommands(t *testing.T) {
 	require.NoError(t, err)
 	version, err = authClient.GetAutoUpdateVersion(ctx)
 	require.NoError(t, err)
-	assert.Nil(t, version.Spec.Tools)
+	assert.Nil(t, version.GetSpec().GetTools())
 }
 
 func runAutoUpdateCommand(t *testing.T, client *authclient.Client, args []string) (*bytes.Buffer, error) {
@@ -166,14 +166,14 @@ func TestAutoUpdateAgentStatusCommand(t *testing.T) {
 		},
 		{
 			name: "rollout immediate schedule",
-			fixture: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			fixture: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleImmediate,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedOutput: `Agent autoupdate mode: enabled
 Start version: 1.2.3
 Target version: 1.2.4
@@ -183,18 +183,18 @@ Schedule is immediate. Every group immediately updates to the target version.
 		},
 		{
 			name: "rollout regular schedule time-based",
-			fixture: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			fixture: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:              "1.2.3",
 					TargetVersion:             "1.2.4",
 					Schedule:                  autoupdate.AgentsScheduleRegular,
 					AutoupdateMode:            autoupdate.AgentsUpdateModeEnabled,
 					Strategy:                  autoupdate.AgentsStrategyTimeBased,
 					MaintenanceWindowDuration: durationpb.New(1 * time.Hour),
-				},
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "dev",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 12, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
@@ -202,29 +202,29 @@ Schedule is immediate. Every group immediately updates to the target version.
 							LastUpdateReason: "outside_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  8,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "stage",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 14, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 							LastUpdateReason: "in_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  14,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "prod",
 							StartTime:        nil,
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 							LastUpdateReason: "outside_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  18,
-						},
+						}.Build(),
 					},
 					State:        autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 					StartTime:    timestamppb.New(time.Date(2025, 1, 15, 2, 0, 0, 0, time.UTC)),
 					TimeOverride: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedOutput: `Agent autoupdate mode: enabled
 Rollout creation date: 2025-01-15 02:00:00
 Start version: 1.2.3
@@ -241,17 +241,17 @@ prod       Unstarted                     outside_window
 		},
 		{
 			name: "rollout regular schedule halt-on-error",
-			fixture: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			fixture: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
-				},
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "dev",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 12, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
@@ -259,29 +259,29 @@ prod       Unstarted                     outside_window
 							LastUpdateReason: "outside_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  8,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "stage",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 14, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 							LastUpdateReason: "in_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  14,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "prod",
 							StartTime:        nil,
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
 							LastUpdateReason: "outside_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  18,
-						},
+						}.Build(),
 					},
 					State:        autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 					StartTime:    timestamppb.New(time.Date(2025, 1, 15, 2, 0, 0, 0, time.UTC)),
 					TimeOverride: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedOutput: `Agent autoupdate mode: enabled
 Rollout creation date: 2025-01-15 02:00:00
 Start version: 1.2.3
@@ -298,17 +298,17 @@ prod       Unstarted                     outside_window
 		},
 		{
 			name: "rollout regular schedule halt-on-error with progress",
-			fixture: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			fixture: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
-				},
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "dev",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 12, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
@@ -319,16 +319,16 @@ prod       Unstarted                     outside_window
 							PresentCount:     1023,
 							UpToDateCount:    567,
 							InitialCount:     1012,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "stage",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 14, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_ACTIVE,
 							LastUpdateReason: "in_window",
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  14,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "prod",
 							StartTime:        nil,
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
@@ -336,13 +336,13 @@ prod       Unstarted                     outside_window
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  18,
 							PresentCount:     789,
-						},
+						}.Build(),
 					},
 					State:        autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 					StartTime:    timestamppb.New(time.Date(2025, 1, 15, 2, 0, 0, 0, time.UTC)),
 					TimeOverride: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedOutput: `Agent autoupdate mode: enabled
 Rollout creation date: 2025-01-15 02:00:00
 Start version: 1.2.3
@@ -359,17 +359,17 @@ prod (catch-all) Unstarted                     outside_window 789         0
 		},
 		{
 			name: "rollout regular schedule halt-on-error with progress, with canary",
-			fixture: &autoupdatepb.AutoUpdateAgentRollout{
-				Spec: &autoupdatepb.AutoUpdateAgentRolloutSpec{
+			fixture: autoupdatepb.AutoUpdateAgentRollout_builder{
+				Spec: autoupdatepb.AutoUpdateAgentRolloutSpec_builder{
 					StartVersion:   "1.2.3",
 					TargetVersion:  "1.2.4",
 					Schedule:       autoupdate.AgentsScheduleRegular,
 					AutoupdateMode: autoupdate.AgentsUpdateModeEnabled,
 					Strategy:       autoupdate.AgentsStrategyHaltOnError,
-				},
-				Status: &autoupdatepb.AutoUpdateAgentRolloutStatus{
+				}.Build(),
+				Status: autoupdatepb.AutoUpdateAgentRolloutStatus_builder{
 					Groups: []*autoupdatepb.AutoUpdateAgentRolloutStatusGroup{
-						{
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "dev",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 12, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_DONE,
@@ -380,8 +380,8 @@ prod (catch-all) Unstarted                     outside_window 789         0
 							PresentCount:     1023,
 							UpToDateCount:    567,
 							InitialCount:     1012,
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "stage",
 							StartTime:        timestamppb.New(time.Date(2025, 1, 15, 14, 00, 0, 0, time.UTC)),
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_CANARY,
@@ -390,27 +390,27 @@ prod (catch-all) Unstarted                     outside_window 789         0
 							ConfigStartHour:  14,
 							CanaryCount:      5,
 							Canaries: []*autoupdatepb.Canary{
-								{
+								autoupdatepb.Canary_builder{
 									UpdaterId: uuid.NewString(),
 									HostId:    uuid.NewString(),
 									Hostname:  "host-1",
 									Success:   true,
-								},
-								{
+								}.Build(),
+								autoupdatepb.Canary_builder{
 									UpdaterId: uuid.NewString(),
 									HostId:    uuid.NewString(),
 									Hostname:  "host-2",
 									Success:   false,
-								},
-								{
+								}.Build(),
+								autoupdatepb.Canary_builder{
 									UpdaterId: uuid.NewString(),
 									HostId:    uuid.NewString(),
 									Hostname:  "host-3",
 									Success:   true,
-								},
+								}.Build(),
 							},
-						},
-						{
+						}.Build(),
+						autoupdatepb.AutoUpdateAgentRolloutStatusGroup_builder{
 							Name:             "prod",
 							StartTime:        nil,
 							State:            autoupdatepb.AutoUpdateAgentGroupState_AUTO_UPDATE_AGENT_GROUP_STATE_UNSTARTED,
@@ -418,13 +418,13 @@ prod (catch-all) Unstarted                     outside_window 789         0
 							ConfigDays:       []string{"Mon", "Tue", "Wed", "Thu", "Fri"},
 							ConfigStartHour:  18,
 							PresentCount:     789,
-						},
+						}.Build(),
 					},
 					State:        autoupdatepb.AutoUpdateAgentRolloutState_AUTO_UPDATE_AGENT_ROLLOUT_STATE_ACTIVE,
 					StartTime:    timestamppb.New(time.Date(2025, 1, 15, 2, 0, 0, 0, time.UTC)),
 					TimeOverride: nil,
-				},
-			},
+				}.Build(),
+			}.Build(),
 			expectedOutput: `Agent autoupdate mode: enabled
 Rollout creation date: 2025-01-15 02:00:00
 Start version: 1.2.3
@@ -486,34 +486,34 @@ func TestAutoUpdateAgentReportCommand(t *testing.T) {
 		{
 			name: "only expired agent reports",
 			fixtures: []*autoupdatepb.AutoUpdateAgentReport{
-				{
-					Metadata: &headerv1.Metadata{Name: "auth1"},
-					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+				autoupdatepb.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+					Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewMinutesAgo),
 						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-							"dev": {
+							"dev": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 123},
-									"1.2.4": {Count: 234},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+									"1.2.4": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 234}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-				{
-					Metadata: &headerv1.Metadata{Name: "auth2"},
-					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+					}.Build(),
+				}.Build(),
+				autoupdatepb.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth2"}.Build(),
+					Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewMinutesAgo),
 						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-							"dev": {
+							"dev": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 456},
-									"1.2.4": {Count: 567},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 456}.Build(),
+									"1.2.4": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 567}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			expectedOutput: "Read 2 reports, but they are expired. If you just (re)deployed the Auth service, you might want to retry after 60 seconds.\n",
 			expectErr:      require.Error,
@@ -521,44 +521,44 @@ func TestAutoUpdateAgentReportCommand(t *testing.T) {
 		{
 			name: "valid reports",
 			fixtures: []*autoupdatepb.AutoUpdateAgentReport{
-				{
-					Metadata: &headerv1.Metadata{Name: "auth1"},
-					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+				autoupdatepb.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+					Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewSecondsAgo),
 						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-							"dev": {
+							"dev": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 123},
-									"1.2.4": {Count: 234},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+									"1.2.4": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 234}.Build(),
 								},
-							},
-							"stage": {
+							}.Build(),
+							"stage": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 123},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
-				{
-					Metadata: &headerv1.Metadata{Name: "auth2"},
-					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+					}.Build(),
+				}.Build(),
+				autoupdatepb.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth2"}.Build(),
+					Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewSecondsAgo),
 						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-							"dev": {
+							"dev": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 456},
-									"1.2.4": {Count: 567},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 456}.Build(),
+									"1.2.4": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 567}.Build(),
 								},
-							},
-							"prod": {
+							}.Build(),
+							"prod": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 789},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 789}.Build(),
 								},
-							},
+							}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			expectErr: require.NoError,
 			expectedOutput: `2 autoupdate agent reports aggregated
@@ -572,50 +572,50 @@ Agent Version dev  prod stage
 		{
 			name: "valid reports with omissions",
 			fixtures: []*autoupdatepb.AutoUpdateAgentReport{
-				{
-					Metadata: &headerv1.Metadata{Name: "auth1"},
-					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+				autoupdatepb.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth1"}.Build(),
+					Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewSecondsAgo),
 						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-							"dev": {
+							"dev": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 123},
-									"1.2.4": {Count: 234},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
+									"1.2.4": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 234}.Build(),
 								},
-							},
-							"stage": {
+							}.Build(),
+							"stage": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 123},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 123}.Build(),
 								},
-							},
+							}.Build(),
 						},
 						Omitted: []*autoupdatepb.AutoUpdateAgentReportSpecOmitted{
-							{Reason: "agent is too old", Count: 2},
+							autoupdatepb.AutoUpdateAgentReportSpecOmitted_builder{Reason: "agent is too old", Count: 2}.Build(),
 						},
-					},
-				},
-				{
-					Metadata: &headerv1.Metadata{Name: "auth2"},
-					Spec: &autoupdatepb.AutoUpdateAgentReportSpec{
+					}.Build(),
+				}.Build(),
+				autoupdatepb.AutoUpdateAgentReport_builder{
+					Metadata: headerv1.Metadata_builder{Name: "auth2"}.Build(),
+					Spec: autoupdatepb.AutoUpdateAgentReportSpec_builder{
 						Timestamp: timestamppb.New(fewSecondsAgo),
 						Groups: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroup{
-							"dev": {
+							"dev": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 456},
-									"1.2.4": {Count: 567},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 456}.Build(),
+									"1.2.4": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 567}.Build(),
 								},
-							},
-							"prod": {
+							}.Build(),
+							"prod": autoupdatepb.AutoUpdateAgentReportSpecGroup_builder{
 								Versions: map[string]*autoupdatepb.AutoUpdateAgentReportSpecGroupVersion{
-									"1.2.3": {Count: 789},
+									"1.2.3": autoupdatepb.AutoUpdateAgentReportSpecGroupVersion_builder{Count: 789}.Build(),
 								},
-							},
+							}.Build(),
 						},
 						Omitted: []*autoupdatepb.AutoUpdateAgentReportSpecOmitted{
-							{Reason: "updater is disabled", Count: 5},
+							autoupdatepb.AutoUpdateAgentReportSpecOmitted_builder{Reason: "updater is disabled", Count: 5}.Build(),
 						},
-					},
-				},
+					}.Build(),
+				}.Build(),
 			},
 			expectErr: require.NoError,
 			expectedOutput: `2 autoupdate agent reports aggregated
diff --git a/tool/tctl/common/bots_command.go b/tool/tctl/common/bots_command.go
index 54756fd598e..58f876910fa 100644
--- a/tool/tctl/common/bots_command.go
+++ b/tool/tctl/common/bots_command.go
@@ -267,11 +267,11 @@ func (c *BotsCommand) ListBots(ctx context.Context, client botsCommandClient) er
 			return trace.Wrap(err)
 		}
 
-		bots = append(bots, resp.Bots...)
-		if resp.NextPageToken == "" {
+		bots = append(bots, resp.GetBots()...)
+		if resp.GetNextPageToken() == "" {
 			break
 		}
-		req.PageToken = resp.NextPageToken
+		req.SetPageToken(resp.GetNextPageToken())
 	}
 
 	switch c.format {
@@ -283,7 +283,7 @@ func (c *BotsCommand) ListBots(ctx context.Context, client botsCommandClient) er
 		t := asciitable.MakeTable([]string{"Bot", "User", "Roles"})
 		for _, u := range bots {
 			t.AddRow([]string{
-				u.Metadata.Name, u.Status.UserName, strings.Join(u.Spec.GetRoles(), ","),
+				u.GetMetadata().GetName(), u.GetStatus().GetUserName(), strings.Join(u.GetSpec().GetRoles(), ","),
 			})
 		}
 		fmt.Fprintln(c.stdout, t.AsBuffer().String())
@@ -512,27 +512,27 @@ func (c *BotsCommand) AddBot(ctx context.Context, client botsCommandClient) erro
 		maxSessionTTL = durationpb.New(c.maxSessionTTL)
 	}
 
-	bot := &machineidv1pb.Bot{
+	bot := machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: c.botName,
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: roles,
 			Traits: []*machineidv1pb.Trait{
-				{
+				machineidv1pb.Trait_builder{
 					Name:   constants.TraitLogins,
 					Values: flattenSlice(c.allowedLogins),
-				},
+				}.Build(),
 			},
 			MaxSessionTtl: maxSessionTTL,
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	bot, err = client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+	bot, err = client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
 		Bot: bot,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -541,9 +541,9 @@ func (c *BotsCommand) AddBot(ctx context.Context, client botsCommandClient) erro
 }
 
 func (c *BotsCommand) RemoveBot(ctx context.Context, client botsCommandClient) error {
-	_, err := client.BotServiceClient().DeleteBot(ctx, &machineidv1pb.DeleteBotRequest{
+	_, err := client.BotServiceClient().DeleteBot(ctx, machineidv1pb.DeleteBotRequest_builder{
 		BotName: c.botName,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -598,8 +598,8 @@ func (c *BotsCommand) LockBot(ctx context.Context, client botsCommandClient) err
 // updating the field mask if any updates were made.
 func (c *BotsCommand) updateBotLogins(ctx context.Context, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask) error {
 	traits := map[string][]string{}
-	for _, t := range bot.Spec.GetTraits() {
-		traits[t.Name] = t.Values
+	for _, t := range bot.GetSpec().GetTraits() {
+		traits[t.GetName()] = t.GetValues()
 	}
 
 	currentLogins := set.New[string]()
@@ -637,13 +637,13 @@ func (c *BotsCommand) updateBotLogins(ctx context.Context, bot *machineidv1pb.Bo
 
 	traitsArray := []*machineidv1pb.Trait{}
 	for k, v := range traits {
-		traitsArray = append(traitsArray, &machineidv1pb.Trait{
+		traitsArray = append(traitsArray, machineidv1pb.Trait_builder{
 			Name:   k,
 			Values: v,
-		})
+		}.Build())
 	}
 
-	bot.Spec.Traits = traitsArray
+	bot.GetSpec().SetTraits(traitsArray)
 
 	return trace.Wrap(mask.Append(&machineidv1pb.Bot{}, "spec.traits"))
 }
@@ -651,7 +651,7 @@ func (c *BotsCommand) updateBotLogins(ctx context.Context, bot *machineidv1pb.Bo
 // updateBotRoles applies updates from CLI arguments to a bot's roles, updating
 // the field mask as necessary if any updates were made.
 func (c *BotsCommand) updateBotRoles(ctx context.Context, client botsCommandClient, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask) error {
-	currentRoles := set.New[string](bot.Spec.Roles...)
+	currentRoles := set.New[string](bot.GetSpec().GetRoles()...)
 
 	var desiredRoles set.Set[string]
 	if c.botRoles != "" {
@@ -680,16 +680,16 @@ func (c *BotsCommand) updateBotRoles(ctx context.Context, client botsCommandClie
 		}
 	}
 
-	bot.Spec.Roles = desiredRolesArray
+	bot.GetSpec().SetRoles(desiredRolesArray)
 
 	return trace.Wrap(mask.Append(&machineidv1pb.Bot{}, "spec.roles"))
 }
 
 // UpdateBot performs various updates to existing bot users and roles.
 func (c *BotsCommand) UpdateBot(ctx context.Context, client botsCommandClient) error {
-	bot, err := client.BotServiceClient().GetBot(ctx, &machineidv1pb.GetBotRequest{
+	bot, err := client.BotServiceClient().GetBot(ctx, machineidv1pb.GetBotRequest_builder{
 		BotName: c.botName,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -712,7 +712,7 @@ func (c *BotsCommand) UpdateBot(ctx context.Context, client botsCommandClient) e
 	}
 
 	if c.maxSessionTTL > 0 {
-		bot.Spec.MaxSessionTtl = durationpb.New(c.maxSessionTTL)
+		bot.GetSpec().SetMaxSessionTtl(durationpb.New(c.maxSessionTTL))
 		if err := fieldMask.Append(&machineidv1pb.Bot{}, "spec.max_session_ttl"); err != nil {
 			return trace.Wrap(err)
 		}
@@ -723,10 +723,10 @@ func (c *BotsCommand) UpdateBot(ctx context.Context, client botsCommandClient) e
 		return nil
 	}
 
-	_, err = client.BotServiceClient().UpdateBot(ctx, &machineidv1pb.UpdateBotRequest{
+	_, err = client.BotServiceClient().UpdateBot(ctx, machineidv1pb.UpdateBotRequest_builder{
 		Bot:        bot,
 		UpdateMask: fieldMask,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -739,17 +739,17 @@ func (c *BotsCommand) UpdateBot(ctx context.Context, client botsCommandClient) e
 // ListBotInstances lists bot instances, possibly filtering for a specific bot
 func (c *BotsCommand) ListBotInstances(ctx context.Context, client botsCommandClient) error {
 	pageFunc := func(ctx context.Context, pageSize int, pageToken string) ([]*machineidv1pb.BotInstance, string, error) {
-		resp, err := client.BotInstanceServiceClient().ListBotInstancesV2(ctx, &machineidv1pb.ListBotInstancesV2Request{
+		resp, err := client.BotInstanceServiceClient().ListBotInstancesV2(ctx, machineidv1pb.ListBotInstancesV2Request_builder{
 			PageSize:  int32(pageSize),
 			PageToken: pageToken,
 			SortField: c.sortIndex,
 			SortDesc:  c.sortOrder == "descending",
-			Filter: &machineidv1pb.ListBotInstancesV2Request_Filters{
+			Filter: machineidv1pb.ListBotInstancesV2Request_Filters_builder{
 				BotName:    c.botName,
 				SearchTerm: c.search,
 				Query:      c.query,
-			},
-		})
+			}.Build(),
+		}.Build())
 		return resp.GetBotInstances(), resp.GetNextPageToken(), trace.Wrap(err)
 	}
 
@@ -760,7 +760,7 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client botsCommandCl
 		fallbackPageFunc := func(ctx context.Context, pageSize int, pageToken string) ([]*machineidv1pb.BotInstance, string, error) {
 			// Needed for backwards compatibility
 			//nolint:staticcheck // SA1019
-			resp, err := client.BotInstanceServiceClient().ListBotInstances(ctx, &machineidv1pb.ListBotInstancesRequest{
+			resp, err := client.BotInstanceServiceClient().ListBotInstances(ctx, machineidv1pb.ListBotInstancesRequest_builder{
 				FilterBotName:    c.botName,
 				PageSize:         int32(pageSize),
 				PageToken:        pageToken,
@@ -769,7 +769,7 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client botsCommandCl
 					Field:  c.sortIndex,
 					IsDesc: c.sortOrder == "descending",
 				},
-			})
+			}.Build())
 			return resp.GetBotInstances(), resp.GetNextPageToken(), trace.Wrap(err)
 		}
 		return stream.Collect(clientutils.Resources(ctx, fallbackPageFunc))
@@ -826,42 +826,42 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client botsCommandCl
 		)
 
 		initialJoinMethod := cmp.Or(
-			i.Status.InitialAuthentication.GetJoinAttrs().GetMeta().GetJoinMethod(),
-			i.Status.InitialAuthentication.JoinMethod,
+			i.GetStatus().GetInitialAuthentication().GetJoinAttrs().GetMeta().GetJoinMethod(),
+			i.GetStatus().GetInitialAuthentication().GetJoinMethod(),
 		)
 
-		lastSeen := i.Status.InitialAuthentication.AuthenticatedAt.AsTime()
+		lastSeen := i.GetStatus().GetInitialAuthentication().GetAuthenticatedAt().AsTime()
 
-		if len(i.Status.LatestAuthentications) > 0 {
-			auth := i.Status.LatestAuthentications[len(i.Status.LatestAuthentications)-1]
+		if len(i.GetStatus().GetLatestAuthentications()) > 0 {
+			auth := i.GetStatus().GetLatestAuthentications()[len(i.GetStatus().GetLatestAuthentications())-1]
 
 			authJM := cmp.Or(
 				auth.GetJoinAttrs().GetMeta().GetJoinMethod(),
-				auth.JoinMethod,
+				auth.GetJoinMethod(),
 			)
 			if authJM == initialJoinMethod {
 				joinMethod = authJM
 			} else {
 				// If the join method changed, show the original method and latest
-				joinMethod = fmt.Sprintf("%s (%s)", auth.JoinMethod, initialJoinMethod)
+				joinMethod = fmt.Sprintf("%s (%s)", auth.GetJoinMethod(), initialJoinMethod)
 			}
 
-			if auth.AuthenticatedAt.AsTime().After(lastSeen) {
-				lastSeen = auth.AuthenticatedAt.AsTime()
+			if auth.GetAuthenticatedAt().AsTime().After(lastSeen) {
+				lastSeen = auth.GetAuthenticatedAt().AsTime()
 			}
 		}
 
-		if len(i.Status.LatestHeartbeats) == 0 {
+		if len(i.GetStatus().GetLatestHeartbeats()) == 0 {
 			hostname = "-"
 			version = "-"
 		} else {
-			hb := i.Status.LatestHeartbeats[len(i.Status.LatestHeartbeats)-1]
+			hb := i.GetStatus().GetLatestHeartbeats()[len(i.GetStatus().GetLatestHeartbeats())-1]
 
-			hostname = hb.Hostname
-			version = hb.Version
+			hostname = hb.GetHostname()
+			version = hb.GetVersion()
 
-			if hb.RecordedAt.AsTime().After(lastSeen) {
-				lastSeen = hb.RecordedAt.AsTime()
+			if hb.GetRecordedAt().AsTime().After(lastSeen) {
+				lastSeen = hb.GetRecordedAt().AsTime()
 			}
 		}
 
@@ -871,7 +871,7 @@ func (c *BotsCommand) ListBotInstances(ctx context.Context, client botsCommandCl
 		}
 
 		t.AddRow([]string{
-			fmt.Sprintf("%s/%s", i.Spec.BotName, i.Spec.InstanceId), joinMethod,
+			fmt.Sprintf("%s/%s", i.GetSpec().GetBotName(), i.GetSpec().GetInstanceId()), joinMethod,
 			version, hostname, healthStatus, lastSeen.Format(time.RFC3339),
 		})
 	}
@@ -900,9 +900,9 @@ func (c *BotsCommand) AddBotInstance(ctx context.Context, client botsCommandClie
 		return trace.Wrap(err)
 	}
 
-	bot, err := client.BotServiceClient().GetBot(ctx, &machineidv1pb.GetBotRequest{
+	bot, err := client.BotServiceClient().GetBot(ctx, machineidv1pb.GetBotRequest_builder{
 		BotName: c.botName,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -993,27 +993,27 @@ func (c *BotsCommand) ShowBotInstance(ctx context.Context, client botsCommandCli
 		return trace.Wrap(err)
 	}
 
-	instance, err := client.BotInstanceServiceClient().GetBotInstance(ctx, &machineidv1pb.GetBotInstanceRequest{
+	instance, err := client.BotInstanceServiceClient().GetBotInstance(ctx, machineidv1pb.GetBotInstanceRequest_builder{
 		BotName:    botName,
 		InstanceId: instanceID,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	initialAuthenticationTable := formatBotInstanceAuthentication(instance.Status.InitialAuthentication)
+	initialAuthenticationTable := formatBotInstanceAuthentication(instance.GetStatus().GetInitialAuthentication())
 
 	var latestAuthenticationTable string
-	if len(instance.Status.LatestAuthentications) > 0 {
-		latest := instance.Status.LatestAuthentications[len(instance.Status.LatestAuthentications)-1]
+	if len(instance.GetStatus().GetLatestAuthentications()) > 0 {
+		latest := instance.GetStatus().GetLatestAuthentications()[len(instance.GetStatus().GetLatestAuthentications())-1]
 		latestAuthenticationTable = formatBotInstanceAuthentication(latest)
 	} else {
 		latestAuthenticationTable = "No authentication records."
 	}
 
 	var heartbeatTable string
-	if len(instance.Status.LatestHeartbeats) > 0 {
-		latest := instance.Status.LatestHeartbeats[len(instance.Status.LatestHeartbeats)-1]
+	if len(instance.GetStatus().GetLatestHeartbeats()) > 0 {
+		latest := instance.GetStatus().GetLatestHeartbeats()[len(instance.GetStatus().GetLatestHeartbeats())-1]
 		heartbeatTable = formatBotInstanceHeartbeat(latest)
 	} else {
 		heartbeatTable = "No heartbeat records."
@@ -1091,8 +1091,8 @@ func (c *BotsCommand) outputToken(
 		// when we called an older RPC. We've preserved it here to avoid
 		// breaking customer scripts.
 		response := botJSONResponse{
-			UserName: bot.Status.UserName,
-			RoleName: bot.Status.RoleName,
+			UserName: bot.GetStatus().GetUserName(),
+			RoleName: bot.GetStatus().GetRoleName(),
 			TokenID:  token.GetName(),
 			TokenTTL: tokenTTL,
 			JoinURI:  uri.String(),
@@ -1212,16 +1212,16 @@ func splitEntries(flag string) []string {
 // a textual representation of a bot authentication record.
 func formatBotInstanceAuthentication(record *machineidv1pb.BotInstanceStatusAuthentication) string {
 	table := asciitable.MakeHeadlessTable(2)
-	table.AddRow([]string{"Authenticated At:", record.AuthenticatedAt.AsTime().Format(time.RFC3339)})
-	table.AddRow([]string{"Join Method:", cmp.Or(record.GetJoinAttrs().GetMeta().GetJoinMethod(), record.JoinMethod)})
-	table.AddRow([]string{"Join Token:", cmp.Or(record.GetJoinAttrs().GetMeta().GetJoinTokenName(), record.JoinToken)})
-	var meta fmt.Stringer = record.Metadata
+	table.AddRow([]string{"Authenticated At:", record.GetAuthenticatedAt().AsTime().Format(time.RFC3339)})
+	table.AddRow([]string{"Join Method:", cmp.Or(record.GetJoinAttrs().GetMeta().GetJoinMethod(), record.GetJoinMethod())})
+	table.AddRow([]string{"Join Token:", cmp.Or(record.GetJoinAttrs().GetMeta().GetJoinTokenName(), record.GetJoinToken())})
+	var meta fmt.Stringer = record.GetMetadata()
 	if attrs := record.GetJoinAttrs(); attrs != nil {
 		meta = attrs
 	}
 	table.AddRow([]string{"Join Metadata:", meta.String()})
-	table.AddRow([]string{"Generation:", fmt.Sprint(record.Generation)})
-	table.AddRow([]string{"Public Key:", fmt.Sprintf("<%d bytes>", len(record.PublicKey))})
+	table.AddRow([]string{"Generation:", fmt.Sprint(record.GetGeneration())})
+	table.AddRow([]string{"Public Key:", fmt.Sprintf("<%d bytes>", len(record.GetPublicKey()))})
 
 	return "\n" + indentString(table.AsBuffer().String(), "  ")
 }
@@ -1230,15 +1230,15 @@ func formatBotInstanceAuthentication(record *machineidv1pb.BotInstanceStatusAuth
 // a textual representation of a bot heartbeat.
 func formatBotInstanceHeartbeat(record *machineidv1pb.BotInstanceStatusHeartbeat) string {
 	table := asciitable.MakeHeadlessTable(2)
-	table.AddRow([]string{"Recorded At:", record.RecordedAt.AsTime().Format(time.RFC3339)})
-	table.AddRow([]string{"Is Startup:", fmt.Sprint(record.IsStartup)})
-	table.AddRow([]string{"Version:", record.Version})
-	table.AddRow([]string{"Hostname:", record.Hostname})
-	table.AddRow([]string{"Uptime:", record.Uptime.AsDuration().String()})
-	table.AddRow([]string{"Join Method:", record.JoinMethod})
-	table.AddRow([]string{"One Shot:", fmt.Sprint(record.OneShot)})
-	table.AddRow([]string{"Architecture:", record.Architecture})
-	table.AddRow([]string{"OS:", record.Os})
+	table.AddRow([]string{"Recorded At:", record.GetRecordedAt().AsTime().Format(time.RFC3339)})
+	table.AddRow([]string{"Is Startup:", fmt.Sprint(record.GetIsStartup())})
+	table.AddRow([]string{"Version:", record.GetVersion()})
+	table.AddRow([]string{"Hostname:", record.GetHostname()})
+	table.AddRow([]string{"Uptime:", record.GetUptime().AsDuration().String()})
+	table.AddRow([]string{"Join Method:", record.GetJoinMethod()})
+	table.AddRow([]string{"One Shot:", fmt.Sprint(record.GetOneShot())})
+	table.AddRow([]string{"Architecture:", record.GetArchitecture()})
+	table.AddRow([]string{"OS:", record.GetOs()})
 
 	return "\n" + indentString(table.AsBuffer().String(), "  ")
 }
diff --git a/tool/tctl/common/bots_command_test.go b/tool/tctl/common/bots_command_test.go
index 5b8923f7c91..dbf5fa1add1 100644
--- a/tool/tctl/common/bots_command_test.go
+++ b/tool/tctl/common/bots_command_test.go
@@ -218,7 +218,7 @@ func TestUpdateBotLogins(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.ElementsMatch(t, mask.Paths, []string{"spec.traits"})
-				require.ElementsMatch(t, bot.Spec.Traits[0].Values, splitEntries("a,b,c,d,e"))
+				require.ElementsMatch(t, bot.GetSpec().GetTraits()[0].GetValues(), splitEntries("a,b,c,d,e"))
 			},
 		},
 		{
@@ -229,7 +229,7 @@ func TestUpdateBotLogins(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.Empty(t, mask.Paths)
-				require.ElementsMatch(t, bot.Spec.Traits[0].Values, splitEntries("a,b,c,d,e"))
+				require.ElementsMatch(t, bot.GetSpec().GetTraits()[0].GetValues(), splitEntries("a,b,c,d,e"))
 			},
 		},
 		{
@@ -238,7 +238,7 @@ func TestUpdateBotLogins(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.ElementsMatch(t, mask.Paths, []string{"spec.traits"})
-				require.ElementsMatch(t, bot.Spec.Traits[0].Values, splitEntries("a,b,c"))
+				require.ElementsMatch(t, bot.GetSpec().GetTraits()[0].GetValues(), splitEntries("a,b,c"))
 			},
 		},
 		{
@@ -248,7 +248,7 @@ func TestUpdateBotLogins(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.ElementsMatch(t, mask.Paths, []string{"spec.traits"})
-				require.ElementsMatch(t, bot.Spec.Traits[0].Values, splitEntries("a,b,c"))
+				require.ElementsMatch(t, bot.GetSpec().GetTraits()[0].GetValues(), splitEntries("a,b,c"))
 			},
 		},
 	}
@@ -260,23 +260,23 @@ func TestUpdateBotLogins(t *testing.T) {
 		t.Run(tt.desc, func(t *testing.T) {
 			traits := []*machineidv1pb.Trait{}
 			if len(tt.initialLogins) > 0 {
-				traits = append(traits, &machineidv1pb.Trait{
+				traits = append(traits, machineidv1pb.Trait_builder{
 					Name:   constants.TraitLogins,
 					Values: tt.initialLogins,
-				})
+				}.Build())
 			}
 
-			bot := &machineidv1pb.Bot{
+			bot := machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: botName,
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles:  []string{},
 					Traits: traits,
-				},
-			}
+				}.Build(),
+			}.Build()
 
 			fieldMask, err := fieldmaskpb.New(&machineidv1pb.Bot{})
 			require.NoError(t, err)
@@ -325,7 +325,7 @@ func TestUpdateBotRoles(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.ElementsMatch(t, mask.Paths, []string{"spec.roles"})
-				require.ElementsMatch(t, bot.Spec.Roles, splitEntries("a,b,c,d,e"))
+				require.ElementsMatch(t, bot.GetSpec().GetRoles(), splitEntries("a,b,c,d,e"))
 			},
 		},
 		{
@@ -337,7 +337,7 @@ func TestUpdateBotRoles(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.Empty(t, mask.Paths)
-				require.ElementsMatch(t, bot.Spec.Roles, splitEntries("a,b,c,d,e"))
+				require.ElementsMatch(t, bot.GetSpec().GetRoles(), splitEntries("a,b,c,d,e"))
 			},
 		},
 		{
@@ -348,7 +348,7 @@ func TestUpdateBotRoles(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.NoError(t, err)
 				require.ElementsMatch(t, mask.Paths, []string{"spec.roles"})
-				require.ElementsMatch(t, bot.Spec.Roles, splitEntries("a,b,c"))
+				require.ElementsMatch(t, bot.GetSpec().GetRoles(), splitEntries("a,b,c"))
 			},
 		},
 		{
@@ -359,7 +359,7 @@ func TestUpdateBotRoles(t *testing.T) {
 			assert: func(t *testing.T, bot *machineidv1pb.Bot, mask *fieldmaskpb.FieldMask, err error) {
 				require.True(t, trace.IsNotFound(err))
 				require.Empty(t, mask.Paths)
-				require.ElementsMatch(t, bot.Spec.Roles, splitEntries("a,b,c"))
+				require.ElementsMatch(t, bot.GetSpec().GetRoles(), splitEntries("a,b,c"))
 			},
 		},
 	}
@@ -373,16 +373,16 @@ func TestUpdateBotRoles(t *testing.T) {
 				roles: tt.knownRoles,
 			}
 
-			bot := &machineidv1pb.Bot{
+			bot := machineidv1pb.Bot_builder{
 				Kind:    types.KindBot,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: botName,
-				},
-				Spec: &machineidv1pb.BotSpec{
+				}.Build(),
+				Spec: machineidv1pb.BotSpec_builder{
 					Roles: tt.initialRoles,
-				},
-			}
+				}.Build(),
+			}.Build()
 
 			fieldMask, err := fieldmaskpb.New(&machineidv1pb.Bot{})
 			require.NoError(t, err)
@@ -434,16 +434,16 @@ func TestAddAndListBotInstancesJSON(t *testing.T) {
 	require.Empty(t, tokens)
 
 	// Create an initial bot
-	bot, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
-		Bot: &machineidv1pb.Bot{
+	bot, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
+		Bot: machineidv1pb.Bot_builder{
 			Kind:    types.KindBot,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "test",
-			},
+			}.Build(),
 			Spec: &machineidv1pb.BotSpec{},
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Attempt to add a new instance and ensure a new token was created.
@@ -451,7 +451,7 @@ func TestAddAndListBotInstancesJSON(t *testing.T) {
 	cmd := BotsCommand{
 		stdout:  &buf,
 		format:  teleport.JSON,
-		botName: bot.Metadata.Name,
+		botName: bot.GetMetadata().GetName(),
 	}
 	require.NoError(t, cmd.AddBotInstance(ctx, client))
 
@@ -637,13 +637,13 @@ func TestListBotInstances(t *testing.T) {
 
 	instance0 := createBotInstance(t, ctx, process)
 	instance1 := createBotInstance(t, ctx, process, func(instance *machineidv1pb.BotInstance) {
-		instance.Status.InitialHeartbeat.Hostname = "test-hostname-3"
-		instance.Status.InitialHeartbeat.Version = "19.0.1"
+		instance.GetStatus().GetInitialHeartbeat().SetHostname("test-hostname-3")
+		instance.GetStatus().GetInitialHeartbeat().SetVersion("19.0.1")
 	})
 	instance2 := createBotInstance(t, ctx, process, func(instance *machineidv1pb.BotInstance) {
-		instance.Spec.BotName = "test-bot-2"
-		instance.Status.InitialHeartbeat.Hostname = "test-hostname-2"
-		instance.Status.InitialHeartbeat.Version = "18.1.0"
+		instance.GetSpec().SetBotName("test-bot-2")
+		instance.GetStatus().GetInitialHeartbeat().SetHostname("test-hostname-2")
+		instance.GetStatus().GetInitialHeartbeat().SetVersion("18.1.0")
 	})
 
 	// Give the auth cache a chance to catch-up
@@ -767,27 +767,27 @@ func assertContainsInstance(t *testing.T, res []*machineidv1pb.BotInstance, inst
 }
 
 func createBotInstance(t *testing.T, ctx context.Context, process *service.TeleportProcess, options ...func(instance *machineidv1pb.BotInstance)) (result *machineidv1pb.BotInstance) {
-	heartbeat := &machineidv1pb.BotInstanceStatusHeartbeat{
+	heartbeat := machineidv1pb.BotInstanceStatusHeartbeat_builder{
 		RecordedAt: timestamppb.New(time.Now()),
 		IsStartup:  true,
 		Version:    "19.0.0",
 		Hostname:   "test-hostname-1",
 		Uptime:     durationpb.New(1 * time.Hour),
 		Os:         "linux",
-	}
+	}.Build()
 
-	base := &machineidv1pb.BotInstance{
-		Spec: &machineidv1pb.BotInstanceSpec{
+	base := machineidv1pb.BotInstance_builder{
+		Spec: machineidv1pb.BotInstanceSpec_builder{
 			BotName:    "test-bot-1",
 			InstanceId: uuid.New().String(),
-		},
-		Status: &machineidv1pb.BotInstanceStatus{
+		}.Build(),
+		Status: machineidv1pb.BotInstanceStatus_builder{
 			InitialHeartbeat: heartbeat,
 			LatestHeartbeats: []*machineidv1pb.BotInstanceStatusHeartbeat{
 				heartbeat,
 			},
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	for _, fn := range options {
 		fn(base)
diff --git a/tool/tctl/common/clusterconfig/accessgraphsettings.go b/tool/tctl/common/clusterconfig/accessgraphsettings.go
index 360e3405103..a235317f1dc 100644
--- a/tool/tctl/common/clusterconfig/accessgraphsettings.go
+++ b/tool/tctl/common/clusterconfig/accessgraphsettings.go
@@ -92,14 +92,14 @@ func UnmarshalAccessGraphSettings(raw []byte) (*clusterconfigpb.AccessGraphSetti
 // implements types.Resource and can be marshaled to YAML or JSON in a
 // human-friendly format.
 func ProtoToResource(set *clusterconfigpb.AccessGraphSettings) (*AccessGraphSettings, error) {
-	conf, err := secretsScanConfigToString(set.Spec.SecretsScanConfig)
+	conf, err := secretsScanConfigToString(set.GetSpec().GetSecretsScanConfig())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
 	r := &AccessGraphSettings{
 		ResourceHeader: types.ResourceHeader{
-			Kind:     set.Kind,
-			Version:  set.Version,
+			Kind:     set.GetKind(),
+			Version:  set.GetVersion(),
 			Metadata: legacy.FromHeaderMetadata(headerv1.FromMetadataProto(set.GetMetadata())),
 		},
 		Spec: accessGraphSettingsSpec{
@@ -114,15 +114,15 @@ func resourceToProto(r *AccessGraphSettings) (*clusterconfigpb.AccessGraphSettin
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	return &clusterconfigpb.AccessGraphSettings{
+	return clusterconfigpb.AccessGraphSettings_builder{
 		Kind:     r.Kind,
 		SubKind:  r.SubKind,
 		Version:  r.Version,
 		Metadata: headerv1.ToMetadataProto(legacy.ToHeaderMetadata(r.Metadata)),
-		Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+		Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 			SecretsScanConfig: secretsScanConfig,
-		},
-	}, nil
+		}.Build(),
+	}.Build(), nil
 }
 
 func secretsScanConfigToString(secretsScanConfig clusterconfigpb.AccessGraphSecretsScanConfig) (string, error) {
diff --git a/tool/tctl/common/clusterconfig/accessgraphsettings_test.go b/tool/tctl/common/clusterconfig/accessgraphsettings_test.go
index 01a1a7e3f43..0e1398fde51 100644
--- a/tool/tctl/common/clusterconfig/accessgraphsettings_test.go
+++ b/tool/tctl/common/clusterconfig/accessgraphsettings_test.go
@@ -52,16 +52,16 @@ metadata:
 spec:
   secrets_scan_config: "disabled"
 `,
-			expected: &clusterconfigpb.AccessGraphSettings{
+			expected: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "off",
@@ -73,16 +73,16 @@ metadata:
 spec:
   secrets_scan_config: "off"
 `,
-			expected: &clusterconfigpb.AccessGraphSettings{
+			expected: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "enabled",
@@ -94,16 +94,16 @@ metadata:
 spec:
   secrets_scan_config: "enabled"
 `,
-			expected: &clusterconfigpb.AccessGraphSettings{
+			expected: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "on",
@@ -115,16 +115,16 @@ metadata:
 spec:
   secrets_scan_config: "on"
 `,
-			expected: &clusterconfigpb.AccessGraphSettings{
+			expected: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "invalid settings",
@@ -205,16 +205,16 @@ func TestProtoToResource(t *testing.T) {
 					SecretsScanConfig: "disabled",
 				},
 			},
-			input: &clusterconfigpb.AccessGraphSettings{
+			input: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_DISABLED,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc: "enabled",
@@ -228,30 +228,30 @@ func TestProtoToResource(t *testing.T) {
 					SecretsScanConfig: "enabled",
 				},
 			},
-			input: &clusterconfigpb.AccessGraphSettings{
+			input: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: clusterconfigpb.AccessGraphSecretsScanConfig_ACCESS_GRAPH_SECRETS_SCAN_CONFIG_ENABLED,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 		{
 			desc:          "incorrect data",
 			errorContains: "unexpected secrets scan config",
-			input: &clusterconfigpb.AccessGraphSettings{
+			input: clusterconfigpb.AccessGraphSettings_builder{
 				Version: types.V1,
 				Kind:    types.KindAccessGraphSettings,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name: types.MetaNameAccessGraphSettings,
-				},
-				Spec: &clusterconfigpb.AccessGraphSettingsSpec{
+				}.Build(),
+				Spec: clusterconfigpb.AccessGraphSettingsSpec_builder{
 					SecretsScanConfig: 5,
-				},
-			},
+				}.Build(),
+			}.Build(),
 		},
 	} {
 		t.Run(tc.desc, func(t *testing.T) {
diff --git a/tool/tctl/common/collection.go b/tool/tctl/common/collection.go
index e6c0abb74ac..5f6e9218e0d 100644
--- a/tool/tctl/common/collection.go
+++ b/tool/tctl/common/collection.go
@@ -256,7 +256,7 @@ func (c *crownJewelCollection) WriteText(w io.Writer, verbose bool) error {
 	var rows [][]string
 	for _, item := range c.items {
 		labels := common.FormatLabels(item.GetMetadata().GetLabels(), verbose)
-		rows = append(rows, []string{item.Metadata.GetName(), item.GetSpec().String(), labels})
+		rows = append(rows, []string{item.GetMetadata().GetName(), item.GetSpec().String(), labels})
 	}
 	headers := []string{"Name", "Spec", "Labels"}
 	var t asciitable.Table
@@ -371,12 +371,12 @@ func (c *deviceCollection) WriteText(w io.Writer, verbose bool) error {
 	t := asciitable.MakeTable([]string{"ID", "OS Type", "Asset Tag", "Enrollment Status", "Creation Time", "Last Updated"})
 	for _, device := range c.devices {
 		t.AddRow([]string{
-			device.Id,
-			devicetrust.FriendlyOSType(device.OsType),
-			device.AssetTag,
-			devicetrust.FriendlyDeviceEnrollStatus(device.EnrollStatus),
-			device.CreateTime.AsTime().Format(time.RFC3339),
-			device.UpdateTime.AsTime().Format(time.RFC3339),
+			device.GetId(),
+			devicetrust.FriendlyOSType(device.GetOsType()),
+			device.GetAssetTag(),
+			devicetrust.FriendlyDeviceEnrollStatus(device.GetEnrollStatus()),
+			device.GetCreateTime().AsTime().Format(time.RFC3339),
+			device.GetUpdateTime().AsTime().Format(time.RFC3339),
 		})
 	}
 	_, err := t.AsBuffer().WriteTo(w)
diff --git a/tool/tctl/common/databaseobject/resource.go b/tool/tctl/common/databaseobject/resource.go
index 09d88396c01..52f707b6940 100644
--- a/tool/tctl/common/databaseobject/resource.go
+++ b/tool/tctl/common/databaseobject/resource.go
@@ -68,18 +68,18 @@ func ResourceToProto(r *Resource) *databaseobjectv1.DatabaseObject {
 		expires = timestamppb.New(*md.Expires)
 	}
 
-	return &databaseobjectv1.DatabaseObject{
+	return databaseobjectv1.DatabaseObject_builder{
 		Kind:    r.GetKind(),
 		SubKind: r.GetSubKind(),
 		Version: r.GetVersion(),
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        md.Name,
 			Description: md.Description,
 			Namespace:   defaults.Namespace,
 			Labels:      md.Labels,
 			Expires:     expires,
 			Revision:    md.Revision,
-		},
+		}.Build(),
 		Spec: r.Spec,
-	}
+	}.Build()
 }
diff --git a/tool/tctl/common/databaseobjectimportrule/resource.go b/tool/tctl/common/databaseobjectimportrule/resource.go
index 9e752b2a93d..164d7df77e4 100644
--- a/tool/tctl/common/databaseobjectimportrule/resource.go
+++ b/tool/tctl/common/databaseobjectimportrule/resource.go
@@ -68,18 +68,18 @@ func ResourceToProto(r *Resource) *dbobjectimportrulev1.DatabaseObjectImportRule
 		expires = timestamppb.New(*md.Expires)
 	}
 
-	return &dbobjectimportrulev1.DatabaseObjectImportRule{
+	return dbobjectimportrulev1.DatabaseObjectImportRule_builder{
 		Kind:    r.GetKind(),
 		SubKind: r.GetSubKind(),
 		Version: r.GetVersion(),
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:        md.Name,
 			Description: md.Description,
 			Namespace:   defaults.Namespace,
 			Labels:      md.Labels,
 			Expires:     expires,
 			Revision:    md.Revision,
-		},
+		}.Build(),
 		Spec: r.Spec,
-	}
+	}.Build()
 }
diff --git a/tool/tctl/common/decision/evaluate_db_command.go b/tool/tctl/common/decision/evaluate_db_command.go
index 3d182bf2d2d..706b3850834 100644
--- a/tool/tctl/common/decision/evaluate_db_command.go
+++ b/tool/tctl/common/decision/evaluate_db_command.go
@@ -52,14 +52,14 @@ func (c *EvaluateDatabaseCommand) FullCommand() string {
 
 // Run executes the subcommand.
 func (c *EvaluateDatabaseCommand) Run(ctx context.Context, clt Client) error {
-	resp, err := clt.DecisionClient().EvaluateDatabaseAccess(ctx, &decisionpb.EvaluateDatabaseAccessRequest{
-		Metadata:    &decisionpb.RequestMetadata{PepVersionHint: teleport.Version},
+	resp, err := clt.DecisionClient().EvaluateDatabaseAccess(ctx, decisionpb.EvaluateDatabaseAccessRequest_builder{
+		Metadata:    decisionpb.RequestMetadata_builder{PepVersionHint: teleport.Version}.Build(),
 		TlsIdentity: &decisionpb.TLSIdentity{},
-		Database: &decisionpb.Resource{
+		Database: decisionpb.Resource_builder{
 			Kind: types.KindDatabase,
 			Name: c.DatabaseID,
-		},
-	})
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/decision/evaluate_db_command_test.go b/tool/tctl/common/decision/evaluate_db_command_test.go
index b300ab69a6c..8c750b6120d 100644
--- a/tool/tctl/common/decision/evaluate_db_command_test.go
+++ b/tool/tctl/common/decision/evaluate_db_command_test.go
@@ -36,29 +36,25 @@ func TestEvaluateDB(t *testing.T) {
 	}{
 		{
 			name: "denied",
-			response: &decisionpb.EvaluateDatabaseAccessResponse{
-				Result: &decisionpb.EvaluateDatabaseAccessResponse_Denial{
-					Denial: &decisionpb.DatabaseAccessDenial{
-						Metadata: &decisionpb.DenialMetadata{
-							PdpVersion:  teleport.Version,
-							UserMessage: "denial",
-						},
-					},
-				},
-			},
+			response: decisionpb.EvaluateDatabaseAccessResponse_builder{
+				Denial: decisionpb.DatabaseAccessDenial_builder{
+					Metadata: decisionpb.DenialMetadata_builder{
+						PdpVersion:  teleport.Version,
+						UserMessage: "denial",
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:   "permitted",
 			format: teleport.YAML,
-			response: &decisionpb.EvaluateDatabaseAccessResponse{
-				Result: &decisionpb.EvaluateDatabaseAccessResponse_Permit{
-					Permit: &decisionpb.DatabaseAccessPermit{
-						Metadata: &decisionpb.PermitMetadata{
-							PdpVersion: teleport.Version,
-						},
-					},
-				},
-			},
+			response: decisionpb.EvaluateDatabaseAccessResponse_builder{
+				Permit: decisionpb.DatabaseAccessPermit_builder{
+					Metadata: decisionpb.PermitMetadata_builder{
+						PdpVersion: teleport.Version,
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 	}
 
diff --git a/tool/tctl/common/decision/evaluate_ssh_command.go b/tool/tctl/common/decision/evaluate_ssh_command.go
index ea16bc28b20..1aa902f6180 100644
--- a/tool/tctl/common/decision/evaluate_ssh_command.go
+++ b/tool/tctl/common/decision/evaluate_ssh_command.go
@@ -65,26 +65,26 @@ func (c *EvaluateSSHCommand) Run(ctx context.Context, clt Client) error {
 		return trace.Wrap(err)
 	}
 
-	resp, err := clt.DecisionClient().EvaluateSSHAccess(ctx, &decisionpb.EvaluateSSHAccessRequest{
-		Metadata: &decisionpb.RequestMetadata{
+	resp, err := clt.DecisionClient().EvaluateSSHAccess(ctx, decisionpb.EvaluateSSHAccessRequest_builder{
+		Metadata: decisionpb.RequestMetadata_builder{
 			PepVersionHint: teleport.Version,
 			DryRun:         true,
-			DryRunOptions: &decisionpb.DryRunOptions{
-				GenerateIdentity: &decisionpb.DryRunIdentity{
+			DryRunOptions: decisionpb.DryRunOptions_builder{
+				GenerateIdentity: decisionpb.DryRunIdentity_builder{
 					Username: c.Username,
-				},
-			},
-		},
-		SshAuthority: &decisionpb.SSHAuthority{
+				}.Build(),
+			}.Build(),
+		}.Build(),
+		SshAuthority: decisionpb.SSHAuthority_builder{
 			ClusterName:   clusterName.GetClusterName(),
 			AuthorityType: string(types.UserCA),
-		},
-		Node: &decisionpb.Resource{
+		}.Build(),
+		Node: decisionpb.Resource_builder{
 			Kind: types.KindNode,
 			Name: c.ServerID,
-		},
+		}.Build(),
 		OsUser: c.Login,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/decision/evaluate_ssh_command_test.go b/tool/tctl/common/decision/evaluate_ssh_command_test.go
index fcc73ad66c4..d1f8a476941 100644
--- a/tool/tctl/common/decision/evaluate_ssh_command_test.go
+++ b/tool/tctl/common/decision/evaluate_ssh_command_test.go
@@ -36,32 +36,28 @@ func TestEvaluateSSH(t *testing.T) {
 	}{
 		{
 			name: "denied",
-			response: &decisionpb.EvaluateSSHAccessResponse{
-				Decision: &decisionpb.EvaluateSSHAccessResponse_Denial{
-					Denial: &decisionpb.SSHAccessDenial{
-						Metadata: &decisionpb.DenialMetadata{
-							PdpVersion:  teleport.Version,
-							UserMessage: "denial",
-						},
-					},
-				},
-			},
+			response: decisionpb.EvaluateSSHAccessResponse_builder{
+				Denial: decisionpb.SSHAccessDenial_builder{
+					Metadata: decisionpb.DenialMetadata_builder{
+						PdpVersion:  teleport.Version,
+						UserMessage: "denial",
+					}.Build(),
+				}.Build(),
+			}.Build(),
 		},
 		{
 			name:   "permitted",
 			format: teleport.YAML,
-			response: &decisionpb.EvaluateSSHAccessResponse{
-				Decision: &decisionpb.EvaluateSSHAccessResponse_Permit{
-					Permit: &decisionpb.SSHAccessPermit{
-						Metadata: &decisionpb.PermitMetadata{
-							PdpVersion: teleport.Version,
-						},
-						ForwardAgent:    true,
-						X11Forwarding:   true,
-						PortForwardMode: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_LOCAL,
-					},
-				},
-			},
+			response: decisionpb.EvaluateSSHAccessResponse_builder{
+				Permit: decisionpb.SSHAccessPermit_builder{
+					Metadata: decisionpb.PermitMetadata_builder{
+						PdpVersion: teleport.Version,
+					}.Build(),
+					ForwardAgent:    true,
+					X11Forwarding:   true,
+					PortForwardMode: decisionpb.SSHPortForwardMode_SSH_PORT_FORWARD_MODE_LOCAL,
+				}.Build(),
+			}.Build(),
 		},
 	}
 
diff --git a/tool/tctl/common/devices.go b/tool/tctl/common/devices.go
index 1cf100f983f..8a609a641cc 100644
--- a/tool/tctl/common/devices.go
+++ b/tool/tctl/common/devices.go
@@ -202,14 +202,14 @@ func (c *deviceAddCommand) Run(ctx context.Context, authClient *authclient.Clien
 	if c.enrollTTL > 0 {
 		enrollExpireTime = timestamppb.New(time.Now().Add(c.enrollTTL))
 	}
-	created, err := authClient.DevicesClient().CreateDevice(ctx, &devicepb.CreateDeviceRequest{
-		Device: &devicepb.Device{
+	created, err := authClient.DevicesClient().CreateDevice(ctx, devicepb.CreateDeviceRequest_builder{
+		Device: devicepb.Device_builder{
 			OsType:   c.osType,
 			AssetTag: c.assetTag,
-		},
+		}.Build(),
 		CreateEnrollToken:     c.enroll,
 		EnrollTokenExpireTime: enrollExpireTime,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -218,9 +218,9 @@ func (c *deviceAddCommand) Run(ctx context.Context, authClient *authclient.Clien
 	case teleport.Text:
 		fmt.Fprintf(c.stdout,
 			"Device %v/%v added to the inventory\n",
-			created.AssetTag,
-			devicetrust.FriendlyOSType(created.OsType))
-		printEnrollMessage(created.AssetTag, created.EnrollToken, c.stdout)
+			created.GetAssetTag(),
+			devicetrust.FriendlyOSType(created.GetOsType()))
+		printEnrollMessage(created.GetAssetTag(), created.GetEnrollToken(), c.stdout)
 	case teleport.JSON:
 		out, err := json.MarshalIndent(created, "", "  ")
 		if err != nil {
@@ -240,7 +240,7 @@ func printEnrollMessage(name string, token *devicepb.DeviceEnrollToken, stdout i
 	if token.GetToken() == "" {
 		return
 	}
-	expireTime := token.ExpireTime.AsTime()
+	expireTime := token.GetExpireTime().AsTime()
 
 	fmt.Fprintf(stdout, `The enrollment token: %v
 This token will expire in %v.
@@ -248,7 +248,7 @@ This token will expire in %v.
 Run the command below on device %q to enroll it:
 tsh device enroll --token=%v
 `,
-		token.Token, time.Until(expireTime).Round(time.Second), name, token.Token,
+		token.GetToken(), time.Until(expireTime).Round(time.Second), name, token.GetToken(),
 	)
 }
 
@@ -262,9 +262,9 @@ func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Clie
 	devices := authClient.DevicesClient()
 
 	// List all devices.
-	req := &devicepb.ListDevicesRequest{
+	req := devicepb.ListDevicesRequest_builder{
 		View: devicepb.DeviceView_DEVICE_VIEW_LIST,
-	}
+	}.Build()
 	var devs []*devicepb.Device
 	for {
 		resp, err := devices.ListDevices(ctx, req)
@@ -272,12 +272,12 @@ func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Clie
 			return trace.Wrap(err)
 		}
 
-		devs = append(devs, resp.Devices...)
+		devs = append(devs, resp.GetDevices()...)
 
-		if resp.NextPageToken == "" {
+		if resp.GetNextPageToken() == "" {
 			break
 		}
-		req.PageToken = resp.NextPageToken
+		req.SetPageToken(resp.GetNextPageToken())
 	}
 	if len(devs) == 0 {
 		fmt.Fprintln(c.stdout, "No devices found")
@@ -289,11 +289,11 @@ func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Clie
 		d1 := devs[i]
 		d2 := devs[j]
 
-		if d1.AssetTag == d2.AssetTag {
-			return d1.OsType < d2.OsType
+		if d1.GetAssetTag() == d2.GetAssetTag() {
+			return d1.GetOsType() < d2.GetOsType()
 		}
 
-		return d1.AssetTag < d2.AssetTag
+		return d1.GetAssetTag() < d2.GetAssetTag()
 	})
 
 	// Print devices.
@@ -302,12 +302,12 @@ func (c *deviceListCommand) Run(ctx context.Context, authClient *authclient.Clie
 		table := asciitable.MakeTable([]string{"Asset Tag", "OS", "Source", "Enroll Status", "Owner", "Device ID"})
 		for _, dev := range devs {
 			table.AddRow([]string{
-				dev.AssetTag,
-				devicetrust.FriendlyOSType(dev.OsType),
-				deviceSourceToString(dev.Source),
-				devicetrust.FriendlyDeviceEnrollStatus(dev.EnrollStatus),
-				dev.Owner,
-				dev.Id,
+				dev.GetAssetTag(),
+				devicetrust.FriendlyOSType(dev.GetOsType()),
+				deviceSourceToString(dev.GetSource()),
+				devicetrust.FriendlyDeviceEnrollStatus(dev.GetEnrollStatus()),
+				dev.GetOwner(),
+				dev.GetId(),
 			})
 		}
 		fmt.Fprintln(c.stdout, table.AsBuffer().String())
@@ -338,11 +338,11 @@ func deviceSourceToString(source *devicepb.DeviceSource) string {
 		return ""
 	}
 
-	if defaultName, found := deviceOriginToDefaultName[source.Origin]; found && source.Name == defaultName {
-		return cmp.Or(deviceOriginToPrettyName[source.Origin], defaultName)
+	if defaultName, found := deviceOriginToDefaultName[source.GetOrigin()]; found && source.GetName() == defaultName {
+		return cmp.Or(deviceOriginToPrettyName[source.GetOrigin()], defaultName)
 	}
 
-	return source.Name
+	return source.GetName()
 }
 
 type deviceRemoveCommand struct {
@@ -377,9 +377,9 @@ func (c *deviceRemoveCommand) Run(ctx context.Context, authClient *authclient.Cl
 		return trace.Wrap(err)
 	}
 
-	if _, err := devices.DeleteDevice(ctx, &devicepb.DeleteDeviceRequest{
+	if _, err := devices.DeleteDevice(ctx, devicepb.DeleteDeviceRequest_builder{
 		DeviceId: deviceID,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -424,10 +424,10 @@ func (c *deviceEnrollCommand) Run(ctx context.Context, authClient *authclient.Cl
 	if c.ttl > 0 {
 		expireTime = timestamppb.New(time.Now().Add(c.ttl))
 	}
-	token, err := devices.CreateDeviceEnrollToken(ctx, &devicepb.CreateDeviceEnrollTokenRequest{
+	token, err := devices.CreateDeviceEnrollToken(ctx, devicepb.CreateDeviceEnrollTokenRequest_builder{
 		DeviceId:   deviceID,
 		ExpireTime: expireTime,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -526,15 +526,15 @@ func findDeviceID(
 		return deviceID, deviceID, nil
 	}
 
-	resp, err := devices.FindDevices(ctx, &devicepb.FindDevicesRequest{
+	resp, err := devices.FindDevices(ctx, devicepb.FindDevicesRequest_builder{
 		IdOrTag: assetTag,
-	})
+	}.Build())
 	if err != nil {
 		return "", "", trace.Wrap(err)
 	}
-	for _, found := range resp.Devices {
+	for _, found := range resp.GetDevices() {
 		// Skip ID matches and unexpected osTypes.
-		if found.AssetTag != assetTag || (osType != devicepb.OSType_OS_TYPE_UNSPECIFIED && found.OsType != osType) {
+		if found.GetAssetTag() != assetTag || (osType != devicepb.OSType_OS_TYPE_UNSPECIFIED && found.GetOsType() != osType) {
 			continue
 		}
 
@@ -544,7 +544,7 @@ func findDeviceID(
 				"found multiple devices for asset tag %q, please retry using the device ID instead", assetTag)
 		}
 
-		deviceID = found.Id
+		deviceID = found.GetId()
 	}
 	if deviceID == "" {
 		return "", "", trace.NotFound("device %q not found", assetTag)
@@ -574,8 +574,8 @@ func (c *canOperateOnCurrentDevice) setCurrentDevice() (bool, error) {
 		return false, trace.Wrap(err)
 	}
 
-	c.osType = cdd.OsType
-	c.assetTag = cdd.SerialNumber
+	c.osType = cdd.GetOsType()
+	c.assetTag = cdd.GetSerialNumber()
 	slog.DebugContext(
 		context.Background(),
 		"Running device command against current device",
diff --git a/tool/tctl/common/devices_test.go b/tool/tctl/common/devices_test.go
index 647f18815d1..0a571f8589e 100644
--- a/tool/tctl/common/devices_test.go
+++ b/tool/tctl/common/devices_test.go
@@ -32,12 +32,12 @@ func TestDeviceSourceToString(t *testing.T) {
 	}{
 		{
 			name:   "default name for origin",
-			source: &devicepb.DeviceSource{Origin: devicepb.DeviceOrigin_DEVICE_ORIGIN_INTUNE, Name: "intune"},
+			source: devicepb.DeviceSource_builder{Origin: devicepb.DeviceOrigin_DEVICE_ORIGIN_INTUNE, Name: "intune"}.Build(),
 			want:   "Intune",
 		},
 		{
 			name:   "custom name",
-			source: &devicepb.DeviceSource{Origin: devicepb.DeviceOrigin_DEVICE_ORIGIN_JAMF, Name: "cool jamf"},
+			source: devicepb.DeviceSource_builder{Origin: devicepb.DeviceOrigin_DEVICE_ORIGIN_JAMF, Name: "cool jamf"}.Build(),
 			want:   "cool jamf",
 		},
 		{
@@ -47,7 +47,7 @@ func TestDeviceSourceToString(t *testing.T) {
 		},
 		{
 			name:   "unsupported origin",
-			source: &devicepb.DeviceSource{Origin: 1337, Name: "even cooler jamf"},
+			source: devicepb.DeviceSource_builder{Origin: 1337, Name: "even cooler jamf"}.Build(),
 			// Show the name instead of something like "unknown" as name is required and likely more
 			// informative than displaying "unknown".
 			want: "even cooler jamf",
diff --git a/tool/tctl/common/discovery/nodes_test.go b/tool/tctl/common/discovery/nodes_test.go
index d4958bed092..fee28d9931a 100644
--- a/tool/tctl/common/discovery/nodes_test.go
+++ b/tool/tctl/common/discovery/nodes_test.go
@@ -30,23 +30,23 @@ func makeEC2Task(t *testing.T, issueType string, instanceIDs ...string) *usertas
 	t.Helper()
 	instances := make(map[string]*usertasksv1.DiscoverEC2Instance, len(instanceIDs))
 	for _, id := range instanceIDs {
-		instances[id] = &usertasksv1.DiscoverEC2Instance{
+		instances[id] = usertasksv1.DiscoverEC2Instance_builder{
 			InstanceId:      id,
 			DiscoveryConfig: "dc01",
 			DiscoveryGroup:  "dg01",
-		}
+		}.Build()
 	}
-	task, err := usertaskstypes.NewDiscoverEC2UserTask(&usertasksv1.UserTaskSpec{
+	task, err := usertaskstypes.NewDiscoverEC2UserTask(usertasksv1.UserTaskSpec_builder{
 		Integration: "my-integration",
 		TaskType:    "discover-ec2",
 		IssueType:   issueType,
 		State:       "OPEN",
-		DiscoverEc2: &usertasksv1.DiscoverEC2{
+		DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 			AccountId: "111",
 			Region:    "us-east-1",
 			Instances: instances,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 	return task
 }
@@ -55,21 +55,21 @@ func makeAzureVMTask(t *testing.T, issueType string, vmIDs ...string) *usertasks
 	t.Helper()
 	instances := make(map[string]*usertasksv1.DiscoverAzureVMInstance, len(vmIDs))
 	for _, id := range vmIDs {
-		instances[id] = &usertasksv1.DiscoverAzureVMInstance{
+		instances[id] = usertasksv1.DiscoverAzureVMInstance_builder{
 			VmId:            id,
 			DiscoveryConfig: "dc01",
 			DiscoveryGroup:  "dg01",
-		}
+		}.Build()
 	}
 	task, err := usertaskstypes.NewDiscoverAzureVMUserTask(usertaskstypes.TaskGroup{
 		Integration: "my-integration",
 		IssueType:   issueType,
-	}, time.Now().Add(time.Hour), &usertasksv1.DiscoverAzureVM{
+	}, time.Now().Add(time.Hour), usertasksv1.DiscoverAzureVM_builder{
 		SubscriptionId: "sub-1",
 		ResourceGroup:  "rg-1",
 		Region:         "eastus",
 		Instances:      instances,
-	})
+	}.Build())
 	require.NoError(t, err)
 	return task
 }
diff --git a/tool/tctl/common/edit_command_test.go b/tool/tctl/common/edit_command_test.go
index 8f7fc5dc87c..4fd4b1bc513 100644
--- a/tool/tctl/common/edit_command_test.go
+++ b/tool/tctl/common/edit_command_test.go
@@ -550,19 +550,19 @@ func testEditSAMLConnector(t *testing.T, clt *authclient.Client) {
 func testEditStaticHostUser(t *testing.T, clt *authclient.Client) {
 	ctx := context.Background()
 
-	expected := userprovisioning.NewStaticHostUser("alice", &userprovisioningpb.StaticHostUserSpec{
+	expected := userprovisioning.NewStaticHostUser("alice", userprovisioningpb.StaticHostUserSpec_builder{
 		Matchers: []*userprovisioningpb.Matcher{
-			{
+			userprovisioningpb.Matcher_builder{
 				NodeLabels: []*labelv1.Label{
-					{
+					labelv1.Label_builder{
 						Name:   "foo",
 						Values: []string{"bar"},
-					},
+					}.Build(),
 				},
 				Groups: []string{"foo", "bar"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	created, err := clt.StaticHostUserClient().CreateStaticHostUser(ctx, expected)
 	require.NoError(t, err)
 
@@ -572,8 +572,8 @@ func testEditStaticHostUser(t *testing.T, clt *authclient.Client) {
 			return trace.Wrap(err, "opening file to edit")
 		}
 
-		expected.GetMetadata().Revision = created.GetMetadata().Revision
-		expected.Spec.Matchers[0].Groups = []string{"baz", "quux"}
+		expected.GetMetadata().SetRevision(created.GetMetadata().GetRevision())
+		expected.GetSpec().GetMatchers()[0].SetGroups([]string{"baz", "quux"})
 
 		collection := resources.NewStaticHostUserCollection([]*userprovisioningpb.StaticHostUser{expected})
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
@@ -582,7 +582,7 @@ func testEditStaticHostUser(t *testing.T, clt *authclient.Client) {
 	_, err = runEditCommand(t, clt, []string{"edit", "host_user/alice"}, withEditor(editor))
 	require.NoError(t, err)
 
-	actual, err := clt.StaticHostUserClient().GetStaticHostUser(ctx, expected.GetMetadata().Name)
+	actual, err := clt.StaticHostUserClient().GetStaticHostUser(ctx, expected.GetMetadata().GetName())
 	require.NoError(t, err)
 	require.Empty(t, cmp.Diff(expected, actual,
 		protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
@@ -597,22 +597,22 @@ func testEditStaticHostUser(t *testing.T, clt *authclient.Client) {
 func testEditAutoUpdateConfig(t *testing.T, clt *authclient.Client) {
 	ctx := context.Background()
 
-	expected, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	expected, err := autoupdate.NewAutoUpdateConfig(autoupdatev1pb.AutoUpdateConfigSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 			Mode: autoupdate.ToolsUpdateModeEnabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	initial, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Tools: &autoupdatev1pb.AutoUpdateConfigSpecTools{
+	initial, err := autoupdate.NewAutoUpdateConfig(autoupdatev1pb.AutoUpdateConfigSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateConfigSpecTools_builder{
 			Mode: autoupdate.ToolsUpdateModeDisabled,
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	serviceClient := autoupdatev1pb.NewAutoUpdateServiceClient(clt.GetConnection())
-	initial, err = serviceClient.CreateAutoUpdateConfig(ctx, &autoupdatev1pb.CreateAutoUpdateConfigRequest{Config: initial})
+	initial, err = serviceClient.CreateAutoUpdateConfig(ctx, autoupdatev1pb.CreateAutoUpdateConfigRequest_builder{Config: initial}.Build())
 	require.NoError(t, err, "creating initial autoupdate config")
 
 	editor := func(name string) error {
@@ -620,7 +620,7 @@ func testEditAutoUpdateConfig(t *testing.T, clt *authclient.Client) {
 		if err != nil {
 			return trace.Wrap(err, "opening file to edit")
 		}
-		expected.GetMetadata().Revision = initial.GetMetadata().GetRevision()
+		expected.GetMetadata().SetRevision(initial.GetMetadata().GetRevision())
 		collection := resources.NewAutoUpdateConfigCollection(expected)
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
 	}
@@ -631,7 +631,7 @@ func testEditAutoUpdateConfig(t *testing.T, clt *authclient.Client) {
 
 	actual, err := clt.GetAutoUpdateConfig(ctx)
 	require.NoError(t, err, "failed to get autoupdate config after edit")
-	assert.NotEqual(t, initial.GetSpec().GetTools().Mode, actual.GetSpec().GetTools().GetMode(),
+	assert.NotEqual(t, initial.GetSpec().GetTools().GetMode(), actual.GetSpec().GetTools().GetMode(),
 		"tools_autoupdate should have been modified by edit")
 	assert.Equal(t, expected.GetSpec().GetTools().GetMode(), actual.GetSpec().GetTools().GetMode())
 }
@@ -639,22 +639,22 @@ func testEditAutoUpdateConfig(t *testing.T, clt *authclient.Client) {
 func testEditAutoUpdateVersion(t *testing.T, clt *authclient.Client) {
 	ctx := context.Background()
 
-	expected, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
-		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	expected, err := autoupdate.NewAutoUpdateVersion(autoupdatev1pb.AutoUpdateVersionSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "3.2.1",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
-	initial, err := autoupdate.NewAutoUpdateVersion(&autoupdatev1pb.AutoUpdateVersionSpec{
-		Tools: &autoupdatev1pb.AutoUpdateVersionSpecTools{
+	initial, err := autoupdate.NewAutoUpdateVersion(autoupdatev1pb.AutoUpdateVersionSpec_builder{
+		Tools: autoupdatev1pb.AutoUpdateVersionSpecTools_builder{
 			TargetVersion: "1.2.3",
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	serviceClient := autoupdatev1pb.NewAutoUpdateServiceClient(clt.GetConnection())
-	initial, err = serviceClient.CreateAutoUpdateVersion(ctx, &autoupdatev1pb.CreateAutoUpdateVersionRequest{Version: initial})
+	initial, err = serviceClient.CreateAutoUpdateVersion(ctx, autoupdatev1pb.CreateAutoUpdateVersionRequest_builder{Version: initial}.Build())
 	require.NoError(t, err, "creating initial autoupdate version")
 
 	editor := func(name string) error {
@@ -662,7 +662,7 @@ func testEditAutoUpdateVersion(t *testing.T, clt *authclient.Client) {
 		if err != nil {
 			return trace.Wrap(err, "opening file to edit")
 		}
-		expected.GetMetadata().Revision = initial.GetMetadata().GetRevision()
+		expected.GetMetadata().SetRevision(initial.GetMetadata().GetRevision())
 		collection := resources.NewAutoUpdateVersionCollection(expected)
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
 	}
@@ -712,20 +712,20 @@ func testEditScopedToken(t *testing.T, clt *authclient.Client) {
 
 	ctx := t.Context()
 
-	created, err := clt.CreateScopedToken(ctx, &joiningv1.ScopedToken{
+	created, err := clt.CreateScopedToken(ctx, joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
 		Scope:   "/staging",
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "test-token",
-		},
-		Spec: &joiningv1.ScopedTokenSpec{
+		}.Build(),
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			AssignedScope: "/staging/aa",
 			Roles:         []string{string(types.RoleNode)},
 			UsageMode:     "unlimited",
 			JoinMethod:    string(types.JoinMethodToken),
-		},
-	})
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	initialRevision := created.GetMetadata().GetRevision()
@@ -736,11 +736,11 @@ func testEditScopedToken(t *testing.T, clt *authclient.Client) {
 			return trace.Wrap(err, "opening file to edit")
 		}
 		// Always use the original revision — it becomes stale after the first edit.
-		created.GetMetadata().Revision = initialRevision
-		if created.Metadata.Labels == nil {
-			created.Metadata.Labels = make(map[string]string)
+		created.GetMetadata().SetRevision(initialRevision)
+		if created.GetMetadata().GetLabels() == nil {
+			created.GetMetadata().SetLabels(make(map[string]string))
 		}
-		created.Metadata.Labels["env"] = "test"
+		created.GetMetadata().GetLabels()["env"] = "test"
 
 		collection := resources.NewScopedTokenCollection([]*joiningv1.ScopedToken{created})
 		return trace.NewAggregate(writeYAML(collection, f), f.Close())
diff --git a/tool/tctl/common/idp_command.go b/tool/tctl/common/idp_command.go
index e29beb102ee..060c4fb60ce 100644
--- a/tool/tctl/common/idp_command.go
+++ b/tool/tctl/common/idp_command.go
@@ -161,10 +161,10 @@ func (t *testAttributeMapping) run(ctx context.Context, c *authclient.Client) er
 		return trace.BadParameter("users not found in file: %s", t.users)
 	}
 
-	resp, err := c.SAMLIdPClient().TestSAMLIdPAttributeMapping(ctx, &samlidpv1.TestSAMLIdPAttributeMappingRequest{
+	resp, err := c.SAMLIdPClient().TestSAMLIdPAttributeMapping(ctx, samlidpv1.TestSAMLIdPAttributeMappingRequest_builder{
 		ServiceProvider: &serviceProvider,
 		Users:           users,
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotImplemented(err) {
 			return trace.NotImplemented("the server does not support testing SAML attribute mapping")
@@ -174,21 +174,21 @@ func (t *testAttributeMapping) run(ctx context.Context, c *authclient.Client) er
 
 	switch t.outFormat {
 	case teleport.YAML:
-		if err := utils.WriteYAML(os.Stdout, resp.MappedAttributes); err != nil {
+		if err := utils.WriteYAML(os.Stdout, resp.GetMappedAttributes()); err != nil {
 			return trace.Wrap(err)
 		}
 	case teleport.JSON:
-		if err := utils.WriteJSON(os.Stdout, resp.MappedAttributes); err != nil {
+		if err := utils.WriteJSON(os.Stdout, resp.GetMappedAttributes()); err != nil {
 			return trace.Wrap(err)
 		}
 	default:
-		for i, mappedAttribute := range resp.MappedAttributes {
+		for i, mappedAttribute := range resp.GetMappedAttributes() {
 			table := asciitable.MakeTable([]string{"Attribute Name", "Attribute Value"})
 			if i > 0 {
 				fmt.Println("---")
 			}
-			fmt.Printf("User: %s\n", mappedAttribute.Username)
-			for name, value := range mappedAttribute.MappedValues {
+			fmt.Printf("User: %s\n", mappedAttribute.GetUsername())
+			for name, value := range mappedAttribute.GetMappedValues() {
 				table.AddRow([]string{
 					name,
 					strings.Join(value.Values, ", "),
diff --git a/tool/tctl/common/inventory_command.go b/tool/tctl/common/inventory_command.go
index 0c560864e99..7d2fc62b5df 100644
--- a/tool/tctl/common/inventory_command.go
+++ b/tool/tctl/common/inventory_command.go
@@ -115,9 +115,9 @@ func (c *InventoryCommand) TryRun(ctx context.Context, cmd string, clientFunc co
 }
 
 func (c *InventoryCommand) Status(ctx context.Context, client *authclient.Client) error {
-	rsp, err := client.GetInventoryStatus(ctx, &proto.InventoryStatusRequest{
+	rsp, err := client.GetInventoryStatus(ctx, proto.InventoryStatusRequest_builder{
 		Connected: c.getConnected,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -140,10 +140,10 @@ func (c *InventoryCommand) Status(ctx context.Context, client *authclient.Client
 		}
 
 		printHierarchicalData(map[string]any{
-			"Versions":        toAnyMap(rsp.VersionCounts),
-			"Upgraders":       toAnyMap(rsp.UpgraderCounts),
-			"Services":        toAnyMap(rsp.ServiceCounts),
-			"Total Instances": rsp.InstanceCount,
+			"Versions":        toAnyMap(rsp.GetVersionCounts()),
+			"Upgraders":       toAnyMap(rsp.GetUpgraderCounts()),
+			"Services":        toAnyMap(rsp.GetServiceCounts()),
+			"Total Instances": rsp.GetInstanceCount(),
 		}, "  ", 0)
 	case teleport.JSON:
 		output, err := json.Marshal(rsp)
diff --git a/tool/tctl/common/loadtest_command.go b/tool/tctl/common/loadtest_command.go
index 31525c63728..a26f8946076 100644
--- a/tool/tctl/common/loadtest_command.go
+++ b/tool/tctl/common/loadtest_command.go
@@ -379,7 +379,7 @@ func (c *LoadtestCommand) AuditEvents(ctx context.Context, client *authclient.Cl
 
 	go func() {
 		for event := range outch {
-			s, err := utils.FastMarshal(event.Event.Unstructured)
+			s, err := utils.FastMarshal(event.GetEvent().GetUnstructured())
 			if err != nil {
 				panic(err)
 			}
diff --git a/tool/tctl/common/loginrule/command.go b/tool/tctl/common/loginrule/command.go
index 15a7f9521db..0ba66573b57 100644
--- a/tool/tctl/common/loginrule/command.go
+++ b/tool/tctl/common/loginrule/command.go
@@ -149,11 +149,11 @@ func (t *testCommand) run(ctx context.Context, c *authclient.Client) error {
 		return trace.Wrap(err)
 	}
 
-	result, err := c.LoginRuleClient().TestLoginRule(ctx, &loginrulepb.TestLoginRuleRequest{
+	result, err := c.LoginRuleClient().TestLoginRule(ctx, loginrulepb.TestLoginRuleRequest_builder{
 		LoginRules:      loginRules,
 		Traits:          traitsMapResourceToProto(traits),
 		LoadFromCluster: t.loadFromCluster,
-	})
+	}.Build())
 	if err != nil {
 		if trace.IsNotImplemented(err) {
 			return trace.NotImplemented("the server does not support testing login rules - try downgrading your client to match the server version")
@@ -164,9 +164,9 @@ func (t *testCommand) run(ctx context.Context, c *authclient.Client) error {
 
 	switch t.outputFormat {
 	case teleport.YAML:
-		utils.WriteYAML(os.Stdout, traitsMapProtoToResource(result.Traits))
+		utils.WriteYAML(os.Stdout, traitsMapProtoToResource(result.GetTraits()))
 	case teleport.JSON:
-		utils.WriteJSONObject(os.Stdout, traitsMapProtoToResource(result.Traits))
+		utils.WriteJSONObject(os.Stdout, traitsMapProtoToResource(result.GetTraits()))
 	default:
 		return trace.BadParameter("unsupported output format %q, supported values are %s and %s", t.outputFormat, teleport.YAML, teleport.JSON)
 	}
diff --git a/tool/tctl/common/loginrule/command_test.go b/tool/tctl/common/loginrule/command_test.go
index 7fde8a2574a..5c91a226e16 100644
--- a/tool/tctl/common/loginrule/command_test.go
+++ b/tool/tctl/common/loginrule/command_test.go
@@ -55,7 +55,7 @@ spec:
 	require.NoError(t, err)
 
 	makeRule := func(name, login string, priority int32) *loginrulepb.LoginRule {
-		return &loginrulepb.LoginRule{
+		return loginrulepb.LoginRule_builder{
 			Metadata: &types.Metadata{
 				Name:      name,
 				Namespace: "default",
@@ -67,7 +67,7 @@ spec:
 					Values: []string{login},
 				},
 			},
-		}
+		}.Build()
 	}
 
 	require.Equal(t, []*loginrulepb.LoginRule{
diff --git a/tool/tctl/common/loginrule/resource.go b/tool/tctl/common/loginrule/resource.go
index 46ef878be48..6920c42eb08 100644
--- a/tool/tctl/common/loginrule/resource.go
+++ b/tool/tctl/common/loginrule/resource.go
@@ -110,26 +110,26 @@ func ProtoToResource(rule *loginrulepb.LoginRule) *Resource {
 	r := &Resource{
 		ResourceHeader: types.ResourceHeader{
 			Kind:     types.KindLoginRule,
-			Version:  rule.Version,
-			Metadata: *apiutils.CloneProtoMsg(rule.Metadata),
+			Version:  rule.GetVersion(),
+			Metadata: *apiutils.CloneProtoMsg(rule.GetMetadata()),
 		},
 		Spec: spec{
-			Priority:         rule.Priority,
-			TraitsExpression: rule.TraitsExpression,
-			TraitsMap:        traitsMapProtoToResource(rule.TraitsMap),
+			Priority:         rule.GetPriority(),
+			TraitsExpression: rule.GetTraitsExpression(),
+			TraitsMap:        traitsMapProtoToResource(rule.GetTraitsMap()),
 		},
 	}
 	return r
 }
 
 func resourceToProto(r *Resource) *loginrulepb.LoginRule {
-	return &loginrulepb.LoginRule{
+	return loginrulepb.LoginRule_builder{
 		Metadata:         apiutils.CloneProtoMsg(&r.Metadata),
 		Version:          r.Version,
 		Priority:         r.Spec.Priority,
 		TraitsMap:        traitsMapResourceToProto(r.Spec.TraitsMap),
 		TraitsExpression: r.Spec.TraitsExpression,
-	}
+	}.Build()
 }
 
 func traitsMapResourceToProto(in map[string][]string) map[string]*wrappers.StringValues {
diff --git a/tool/tctl/common/loginrule/resource_test.go b/tool/tctl/common/loginrule/resource_test.go
index eed74621c0b..a4583004e01 100644
--- a/tool/tctl/common/loginrule/resource_test.go
+++ b/tool/tctl/common/loginrule/resource_test.go
@@ -57,7 +57,7 @@ spec:
       - "external.groups"
       - teleport
 `,
-			expected: &loginrulepb.LoginRule{
+			expected: loginrulepb.LoginRule_builder{
 				Version: "v1",
 				Metadata: &types.Metadata{
 					Name:      "test_rule",
@@ -72,7 +72,7 @@ spec:
 						Values: []string{"external.groups", "teleport"},
 					},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "traits_map json",
@@ -90,7 +90,7 @@ spec:
 					}
 				}
 			}`,
-			expected: &loginrulepb.LoginRule{
+			expected: loginrulepb.LoginRule_builder{
 				Version: "v1",
 				Metadata: &types.Metadata{
 					Name:      "test_rule",
@@ -105,7 +105,7 @@ spec:
 						Values: []string{"external.groups", "teleport"},
 					},
 				},
-			},
+			}.Build(),
 		},
 		{
 			desc: "empty map value yaml",
@@ -150,7 +150,7 @@ spec:
   priority: 1
   traits_expression: external.remove_keys("test")
 `,
-			expected: &loginrulepb.LoginRule{
+			expected: loginrulepb.LoginRule_builder{
 				Version: "v1",
 				Metadata: &types.Metadata{
 					Name:      "test_rule",
@@ -158,7 +158,7 @@ spec:
 				},
 				Priority:         1,
 				TraitsExpression: `external.remove_keys("test")`,
-			},
+			}.Build(),
 		},
 		{
 			desc: "traits_expression json",
@@ -173,7 +173,7 @@ spec:
 					"traits_expression": "external.remove_keys(\"test\")"
 				}
 			}`,
-			expected: &loginrulepb.LoginRule{
+			expected: loginrulepb.LoginRule_builder{
 				Version: "v1",
 				Metadata: &types.Metadata{
 					Name:      "test_rule",
@@ -181,7 +181,7 @@ spec:
 				},
 				Priority:         1,
 				TraitsExpression: `external.remove_keys("test")`,
-			},
+			}.Build(),
 		},
 		{
 			// Make sure yaml with a "folded scalar" (>) can be parsed
@@ -198,7 +198,7 @@ spec:
       .remove_keys("test")
       .add_values("groups", "teleport")
 `,
-			expected: &loginrulepb.LoginRule{
+			expected: loginrulepb.LoginRule_builder{
 				Version: "v1",
 				Metadata: &types.Metadata{
 					Name:      "test_rule",
@@ -209,7 +209,7 @@ spec:
   .remove_keys("test")
   .add_values("groups", "teleport")
 `,
-			},
+			}.Build(),
 		},
 		{
 			// Make sure yaml with a "literal scalar" (|) can be parsed
@@ -226,7 +226,7 @@ spec:
       .remove_keys("test")
       .add_values("groups", "teleport")
 `,
-			expected: &loginrulepb.LoginRule{
+			expected: loginrulepb.LoginRule_builder{
 				Version: "v1",
 				Metadata: &types.Metadata{
 					Name:      "test_rule",
@@ -237,7 +237,7 @@ spec:
   .remove_keys("test")
   .add_values("groups", "teleport")
 `,
-			},
+			}.Build(),
 		},
 		{
 			desc: "no map or expression yaml",
diff --git a/tool/tctl/common/notification_command.go b/tool/tctl/common/notification_command.go
index d96bac7e1a0..a4c63a7eea1 100644
--- a/tool/tctl/common/notification_command.go
+++ b/tool/tctl/common/notification_command.go
@@ -28,6 +28,7 @@ import (
 
 	"github.com/alecthomas/kingpin/v2"
 	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/gravitational/teleport"
@@ -133,10 +134,10 @@ func (n *NotificationCommand) Create(ctx context.Context, client *authclient.Cli
 	labels[types.NotificationTitleLabel] = n.title
 	labels[types.NotificationTextContentLabel] = n.content
 
-	meta := &headerv1.Metadata{
+	meta := headerv1.Metadata_builder{
 		Expires: timestamppb.New(time.Now().Add(n.ttl)),
 		Labels:  labels,
-	}
+	}.Build()
 
 	subKind := types.NotificationUserCreatedInformationalSubKind
 	if n.warning {
@@ -158,17 +159,17 @@ func (n *NotificationCommand) Create(ctx context.Context, client *authclient.Cli
 			return trace.BadParameter("roles cannot be configured for a notification which targets a specific user")
 		}
 
-		created, err := nc.CreateUserNotification(ctx, &notificationspb.CreateUserNotificationRequest{
+		created, err := nc.CreateUserNotification(ctx, notificationspb.CreateUserNotificationRequest_builder{
 			Username: n.user,
-			Notification: &notificationspb.Notification{
+			Notification: notificationspb.Notification_builder{
 				Kind:     types.KindNotification,
 				SubKind:  subKind,
 				Metadata: meta,
-				Spec: &notificationspb.NotificationSpec{
+				Spec: notificationspb.NotificationSpec_builder{
 					Username: n.user,
-				},
-			},
-		})
+				}.Build(),
+			}.Build(),
+		}.Build())
 
 		if err != nil {
 			return trail.FromGRPC(err)
@@ -179,25 +180,23 @@ func (n *NotificationCommand) Create(ctx context.Context, client *authclient.Cli
 	}
 
 	if len(n.roles) != 0 {
-		created, err := nc.CreateGlobalNotification(ctx, &notificationspb.CreateGlobalNotificationRequest{
-			GlobalNotification: &notificationspb.GlobalNotification{
+		created, err := nc.CreateGlobalNotification(ctx, notificationspb.CreateGlobalNotificationRequest_builder{
+			GlobalNotification: notificationspb.GlobalNotification_builder{
 				Kind: types.KindGlobalNotification,
-				Spec: &notificationspb.GlobalNotificationSpec{
-					Matcher: &notificationspb.GlobalNotificationSpec_ByRoles{
-						ByRoles: &notificationspb.ByRoles{
-							Roles: n.roles,
-						},
-					},
+				Spec: notificationspb.GlobalNotificationSpec_builder{
+					ByRoles: notificationspb.ByRoles_builder{
+						Roles: n.roles,
+					}.Build(),
 					MatchAllConditions: n.requireAllRoles,
-					Notification: &notificationspb.Notification{
+					Notification: notificationspb.Notification_builder{
 						Kind:     types.KindNotification,
 						SubKind:  subKind,
 						Metadata: meta,
 						Spec:     &notificationspb.NotificationSpec{},
-					},
-				},
-			},
-		})
+					}.Build(),
+				}.Build(),
+			}.Build(),
+		}.Build())
 
 		if err != nil {
 			return trail.FromGRPC(err)
@@ -217,22 +216,20 @@ func (n *NotificationCommand) Create(ctx context.Context, client *authclient.Cli
 	}
 
 	// If roles weren't provided, default to targeting all users.
-	created, err := nc.CreateGlobalNotification(ctx, &notificationspb.CreateGlobalNotificationRequest{
-		GlobalNotification: &notificationspb.GlobalNotification{
+	created, err := nc.CreateGlobalNotification(ctx, notificationspb.CreateGlobalNotificationRequest_builder{
+		GlobalNotification: notificationspb.GlobalNotification_builder{
 			Kind: types.KindGlobalNotification,
-			Spec: &notificationspb.GlobalNotificationSpec{
-				Matcher: &notificationspb.GlobalNotificationSpec_All{
-					All: true,
-				},
-				Notification: &notificationspb.Notification{
+			Spec: notificationspb.GlobalNotificationSpec_builder{
+				All: proto.Bool(true),
+				Notification: notificationspb.Notification_builder{
 					Kind:     types.KindNotification,
 					SubKind:  subKind,
 					Metadata: meta,
 					Spec:     &notificationspb.NotificationSpec{},
-				},
-			},
-		},
-	})
+				}.Build(),
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return trail.FromGRPC(err)
 	}
@@ -247,32 +244,32 @@ func (n *NotificationCommand) List(ctx context.Context, client *authclient.Clien
 		return trace.Wrap(err)
 	}
 
-	filters := &notificationspb.NotificationFilters{
+	filters := notificationspb.NotificationFilters_builder{
 		UserCreatedOnly: !n.allNotifications,
 		Labels:          labels,
-	}
+	}.Build()
 
 	if n.user != "" {
 		// If a user was specified, list user-specific notifications for them.
-		filters.Username = n.user
+		filters.SetUsername(n.user)
 	} else {
 		// Otherwise, list global notifications
-		filters.GlobalOnly = true
+		filters.SetGlobalOnly(true)
 	}
 
 	nc := client.NotificationServiceClient()
 	result, err := stream.Collect(clientutils.Resources(
 		ctx,
 		func(ctx context.Context, pageSize int, pageToken string) ([]*notificationspb.Notification, string, error) {
-			resp, err := nc.ListNotifications(ctx, &notificationspb.ListNotificationsRequest{
+			resp, err := nc.ListNotifications(ctx, notificationspb.ListNotificationsRequest_builder{
 				PageSize:  defaults.DefaultChunkSize,
 				PageToken: pageToken,
 				Filters:   filters,
-			})
+			}.Build())
 			if err != nil {
 				return nil, "", trace.Wrap(err)
 			}
-			return resp.Notifications, resp.GetNextPageToken(), nil
+			return resp.GetNotifications(), resp.GetNextPageToken(), nil
 		}),
 	)
 	if err != nil {
@@ -320,14 +317,14 @@ func (n *NotificationCommand) Remove(ctx context.Context, client *authclient.Cli
 
 	switch {
 	case n.user != "":
-		_, err = nc.DeleteUserNotification(ctx, &notificationspb.DeleteUserNotificationRequest{
+		_, err = nc.DeleteUserNotification(ctx, notificationspb.DeleteUserNotificationRequest_builder{
 			Username:       n.user,
 			NotificationId: n.title,
-		})
+		}.Build())
 	default:
-		_, err = nc.DeleteGlobalNotification(ctx, &notificationspb.DeleteGlobalNotificationRequest{
+		_, err = nc.DeleteGlobalNotification(ctx, notificationspb.DeleteGlobalNotificationRequest_builder{
 			NotificationId: n.title,
-		})
+		}.Build())
 	}
 
 	return trail.FromGRPC(err)
diff --git a/tool/tctl/common/plugin/awsic.go b/tool/tctl/common/plugin/awsic.go
index 6d2f89b0aeb..c0c1cc63a58 100644
--- a/tool/tctl/common/plugin/awsic.go
+++ b/tool/tctl/common/plugin/awsic.go
@@ -322,7 +322,7 @@ func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args pluginServices)
 		}
 	}
 
-	req := &pluginspb.CreatePluginRequest{
+	req := pluginspb.CreatePluginRequest_builder{
 		Plugin: &types.PluginV1{
 			Metadata: types.Metadata{
 				Name: apicommon.OriginAWSIdentityCenter,
@@ -351,7 +351,7 @@ func (p *PluginsCommand) InstallAWSIC(ctx context.Context, args pluginServices)
 				},
 			},
 		},
-	}
+	}.Build()
 
 	_, err = args.plugins.CreatePlugin(ctx, req)
 	if err != nil {
@@ -381,9 +381,9 @@ func (p *PluginsCommand) initEditAWSIC(parent *kingpin.CmdClause) {
 }
 
 func (p *PluginsCommand) EditAWSIC(ctx context.Context, args pluginServices) error {
-	plugin, err := args.plugins.GetPlugin(ctx, &pluginspb.GetPluginRequest{
+	plugin, err := args.plugins.GetPlugin(ctx, pluginspb.GetPluginRequest_builder{
 		Name: p.edit.awsIC.pluginName,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -398,9 +398,9 @@ func (p *PluginsCommand) EditAWSIC(ctx context.Context, args pluginServices) err
 		icSettings.RolesSyncMode = cliArgs.rolesSyncMode
 	}
 
-	_, err = args.plugins.UpdatePlugin(ctx, &pluginspb.UpdatePluginRequest{
+	_, err = args.plugins.UpdatePlugin(ctx, pluginspb.UpdatePluginRequest_builder{
 		Plugin: plugin,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -437,10 +437,10 @@ func (p *PluginsCommand) RotateAWSICCreds(ctx context.Context, args pluginServic
 	cliArgs := &p.rotateCreds.awsic
 
 	slog.InfoContext(ctx, "Fetching plugin...", "plugin_name", cliArgs.pluginName)
-	plugin, err := args.plugins.GetPlugin(ctx, &pluginspb.GetPluginRequest{
+	plugin, err := args.plugins.GetPlugin(ctx, pluginspb.GetPluginRequest_builder{
 		Name:        cliArgs.pluginName,
 		WithSecrets: true,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "fetching plugin %q", cliArgs.pluginName)
 	}
@@ -463,9 +463,9 @@ func (p *PluginsCommand) RotateAWSICCreds(ctx context.Context, args pluginServic
 
 	req := pluginspb.UpdatePluginStaticCredentialsRequest{
 		Target: &pluginspb.UpdatePluginStaticCredentialsRequest_Query{
-			Query: &pluginspb.CredentialQuery{
+			Query: pluginspb.CredentialQuery_builder{
 				Labels: staticCredsRef.Labels,
-			},
+			}.Build(),
 		},
 		Credential: &types.PluginStaticCredentialsSpecV1{
 			Credentials: &types.PluginStaticCredentialsSpecV1_APIToken{
diff --git a/tool/tctl/common/plugin/awsic_test.go b/tool/tctl/common/plugin/awsic_test.go
index 58b891cb67e..7da7fbbaf44 100644
--- a/tool/tctl/common/plugin/awsic_test.go
+++ b/tool/tctl/common/plugin/awsic_test.go
@@ -564,8 +564,8 @@ func TestRotateAWSICSCIMToken(t *testing.T) {
 				Run(func(args mock.Arguments) {
 					req, ok := args.Get(1).(*pluginsv1.GetPluginRequest)
 					require.True(t, ok, "expecting a *pluginsv1.GetPluginRequest, got %T", args.Get(1))
-					require.Equal(t, test.cliArgs.pluginName, req.Name)
-					require.True(t, req.WithSecrets)
+					require.Equal(t, test.cliArgs.pluginName, req.GetName())
+					require.True(t, req.GetWithSecrets())
 				}).
 				Return(test.pluginValueProvider(), test.pluginFetchError)
 
@@ -575,11 +575,11 @@ func TestRotateAWSICSCIMToken(t *testing.T) {
 					Return(func(ctx context.Context, in *pluginsv1.UpdatePluginStaticCredentialsRequest, _ ...grpc.CallOption) (*pluginsv1.UpdatePluginStaticCredentialsResponse, error) {
 						q := in.GetQuery()
 						require.NotNil(t, q, "Update request must specify target labels")
-						require.NotEmpty(t, q.Labels, "Update request must specify non-empty labels")
+						require.NotEmpty(t, q.GetLabels(), "Update request must specify non-empty labels")
 
-						return &pluginsv1.UpdatePluginStaticCredentialsResponse{
+						return pluginsv1.UpdatePluginStaticCredentialsResponse_builder{
 							Credential: &types.PluginStaticCredentialsV1{Spec: in.GetCredential()},
-						}, test.updateError
+						}.Build(), test.updateError
 					})
 			}
 
diff --git a/tool/tctl/common/plugin/entraid.go b/tool/tctl/common/plugin/entraid.go
index 5bed1ab4109..05da24a764d 100644
--- a/tool/tctl/common/plugin/entraid.go
+++ b/tool/tctl/common/plugin/entraid.go
@@ -363,7 +363,7 @@ func (p *PluginsCommand) InstallEntra(ctx context.Context, args pluginServices)
 		return trace.Wrap(err, "failed to read Access List owners source")
 	}
 
-	req := &pluginspb.CreatePluginRequest{
+	req := pluginspb.CreatePluginRequest_builder{
 		Plugin: &types.PluginV1{
 			Metadata: types.Metadata{
 				Name: inputs.name,
@@ -388,7 +388,7 @@ func (p *PluginsCommand) InstallEntra(ctx context.Context, args pluginServices)
 				},
 			},
 		},
-	}
+	}.Build()
 
 	_, err = args.plugins.CreatePlugin(ctx, req)
 	if err != nil {
@@ -397,17 +397,17 @@ func (p *PluginsCommand) InstallEntra(ctx context.Context, args pluginServices)
 		}
 		plugin := req.GetPlugin()
 		{
-			oldPlugin, err := args.plugins.GetPlugin(ctx, &pluginspb.GetPluginRequest{
+			oldPlugin, err := args.plugins.GetPlugin(ctx, pluginspb.GetPluginRequest_builder{
 				Name: inputs.name,
-			})
+			}.Build())
 			if err != nil {
 				return trace.Wrap(err)
 			}
 			plugin.Metadata.Revision = oldPlugin.GetMetadata().Revision
 		}
-		if _, err = args.plugins.UpdatePlugin(ctx, &pluginspb.UpdatePluginRequest{
+		if _, err = args.plugins.UpdatePlugin(ctx, pluginspb.UpdatePluginRequest_builder{
 			Plugin: plugin,
-		}); err != nil {
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
diff --git a/tool/tctl/common/plugin/github.go b/tool/tctl/common/plugin/github.go
index 38095041c87..9fdaaed167b 100644
--- a/tool/tctl/common/plugin/github.go
+++ b/tool/tctl/common/plugin/github.go
@@ -114,13 +114,13 @@ func (p *PluginsCommand) InstallGithub(ctx context.Context, args pluginServices)
 
 	creds := buildPrvKeyCredentials(settings.orgName, settings.privateKeyData)
 
-	createPluginRequest := &pluginspb.CreatePluginRequest{
+	createPluginRequest := pluginspb.CreatePluginRequest_builder{
 		Plugin:                plugin,
 		StaticCredentialsList: []*types.PluginStaticCredentialsV1{creds},
 		CredentialLabels: map[string]string{
 			"github": plugin.GetName(),
 		},
-	}
+	}.Build()
 
 	if _, err = args.plugins.CreatePlugin(ctx, createPluginRequest); err != nil {
 		return trace.Wrap(err, "failed to create Github plugin")
diff --git a/tool/tctl/common/plugin/netiq.go b/tool/tctl/common/plugin/netiq.go
index 12b2364418e..e084c424e17 100644
--- a/tool/tctl/common/plugin/netiq.go
+++ b/tool/tctl/common/plugin/netiq.go
@@ -191,13 +191,13 @@ func (p *PluginsCommand) InstallNetIQ(ctx context.Context, args pluginServices)
 		return trace.Wrap(err, "failed to get NetIQ plugin credentials")
 	}
 
-	createPluginRequest := &pluginspb.CreatePluginRequest{
+	createPluginRequest := pluginspb.CreatePluginRequest_builder{
 		Plugin:                plugin,
 		StaticCredentialsList: creds,
 		CredentialLabels: map[string]string{
 			netIQOrgURLLabel: settings.apiURL,
 		},
-	}
+	}.Build()
 
 	if _, err = args.plugins.CreatePlugin(ctx, createPluginRequest); err != nil {
 		return trace.Wrap(err, "failed to create NetIQ plugin")
diff --git a/tool/tctl/common/plugin/okta.go b/tool/tctl/common/plugin/okta.go
index 1f85e9eaa11..9cbc48b9bbf 100644
--- a/tool/tctl/common/plugin/okta.go
+++ b/tool/tctl/common/plugin/okta.go
@@ -193,7 +193,7 @@ func (p *PluginsCommand) InstallOkta(ctx context.Context, args pluginServices) e
 			EnableSystemLogExport:     oktaSettings.enableAuditLogsExport,
 		},
 	}
-	req := &pluginsv1.CreatePluginRequest{
+	req := pluginsv1.CreatePluginRequest_builder{
 		Plugin: &types.PluginV1{
 			SubKind: types.PluginSubkindAccess,
 			Metadata: types.Metadata{
@@ -208,7 +208,7 @@ func (p *PluginsCommand) InstallOkta(ctx context.Context, args pluginServices) e
 		CredentialLabels: map[string]string{
 			types.OktaOrgURLLabel: oktaSettings.org.String(),
 		},
-	}
+	}.Build()
 
 	if _, err := args.plugins.CreatePlugin(ctx, req); err != nil {
 		return trace.Wrap(err)
diff --git a/tool/tctl/common/plugin/plugins_command.go b/tool/tctl/common/plugin/plugins_command.go
index 4c4a6cc4b99..1738dddc118 100644
--- a/tool/tctl/common/plugin/plugins_command.go
+++ b/tool/tctl/common/plugin/plugins_command.go
@@ -145,7 +145,7 @@ func (p *PluginsCommand) initEdit(parent *kingpin.CmdClause) {
 func (p *PluginsCommand) Delete(ctx context.Context, args pluginServices) error {
 	log := p.config.Logger.With("plugin", p.delete.name)
 
-	req := &pluginsv1.DeletePluginRequest{Name: p.delete.name}
+	req := pluginsv1.DeletePluginRequest_builder{Name: p.delete.name}.Build()
 	if _, err := args.plugins.DeletePlugin(ctx, req); err != nil {
 		if trace.IsNotFound(err) {
 			log.InfoContext(ctx, "Plugin not found")
@@ -159,19 +159,19 @@ func (p *PluginsCommand) Delete(ctx context.Context, args pluginServices) error
 
 // Cleanup cleans up the given plugin.
 func (p *PluginsCommand) Cleanup(ctx context.Context, args pluginServices) error {
-	needsCleanup, err := args.plugins.NeedsCleanup(ctx, &pluginsv1.NeedsCleanupRequest{
+	needsCleanup, err := args.plugins.NeedsCleanup(ctx, pluginsv1.NeedsCleanupRequest_builder{
 		Type: p.pluginType,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
 
-	if needsCleanup.PluginActive {
+	if needsCleanup.GetPluginActive() {
 		fmt.Printf("Plugin of type %q is currently active, can't cleanup!\n", p.pluginType)
 		return nil
 	}
 
-	if !needsCleanup.NeedsCleanup {
+	if !needsCleanup.GetNeedsCleanup() {
 		fmt.Printf("Plugin of type %q doesn't need a cleanup!\n", p.pluginType)
 		return nil
 	}
@@ -182,7 +182,7 @@ func (p *PluginsCommand) Cleanup(ctx context.Context, args pluginServices) error
 		fmt.Println("Deleting the following resources:")
 	}
 
-	for _, resource := range needsCleanup.ResourcesToCleanup {
+	for _, resource := range needsCleanup.GetResourcesToCleanup() {
 		fmt.Printf("- %s\n", resource)
 	}
 
@@ -191,9 +191,9 @@ func (p *PluginsCommand) Cleanup(ctx context.Context, args pluginServices) error
 		return nil
 	}
 
-	if _, err := args.plugins.Cleanup(ctx, &pluginsv1.CleanupRequest{
+	if _, err := args.plugins.Cleanup(ctx, pluginsv1.CleanupRequest_builder{
 		Type: p.pluginType,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/tool/tctl/common/plugin/plugins_command_test.go b/tool/tctl/common/plugin/plugins_command_test.go
index 8566f83ba7d..0c7825be53d 100644
--- a/tool/tctl/common/plugin/plugins_command_test.go
+++ b/tool/tctl/common/plugin/plugins_command_test.go
@@ -104,7 +104,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				},
 			},
 			expectSAMLConnectorQuery: "okta-integration",
-			expectRequest: &pluginsv1.CreatePluginRequest{
+			expectRequest: pluginsv1.CreatePluginRequest_builder{
 				Plugin: &types.PluginV1{
 					SubKind: types.PluginSubkindAccess,
 					Metadata: types.Metadata{
@@ -144,7 +144,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				CredentialLabels: map[string]string{
 					types.OktaOrgURLLabel: "https://example.okta.com",
 				},
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
@@ -167,7 +167,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				},
 			},
 			expectSAMLConnectorQuery: "saml-connector-name",
-			expectRequest: &pluginsv1.CreatePluginRequest{
+			expectRequest: pluginsv1.CreatePluginRequest_builder{
 				Plugin: &types.PluginV1{
 					SubKind: types.PluginSubkindAccess,
 					Metadata: types.Metadata{
@@ -212,7 +212,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				CredentialLabels: map[string]string{
 					types.OktaOrgURLLabel: "https://example.okta.com",
 				},
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
@@ -238,7 +238,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 			},
 			expectPing:               true,
 			expectSAMLConnectorQuery: "teleport-saml-connector-id",
-			expectRequest: &pluginsv1.CreatePluginRequest{
+			expectRequest: pluginsv1.CreatePluginRequest_builder{
 				Plugin: &types.PluginV1{
 					SubKind: types.PluginSubkindAccess,
 					Metadata: types.Metadata{
@@ -299,7 +299,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				CredentialLabels: map[string]string{
 					types.OktaOrgURLLabel: "https://example.okta.com",
 				},
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
@@ -319,7 +319,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 			},
 			expectSAMLConnectorQuery: "okta-integration",
 			expectPing:               true,
-			expectRequest: &pluginsv1.CreatePluginRequest{
+			expectRequest: pluginsv1.CreatePluginRequest_builder{
 				Plugin: &types.PluginV1{
 					SubKind: types.PluginSubkindAccess,
 					Metadata: types.Metadata{
@@ -359,7 +359,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				CredentialLabels: map[string]string{
 					types.OktaOrgURLLabel: "https://example.okta.com",
 				},
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
@@ -378,7 +378,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 			},
 			expectSAMLConnectorQuery: "okta-integration",
 			expectPing:               true,
-			expectRequest: &pluginsv1.CreatePluginRequest{
+			expectRequest: pluginsv1.CreatePluginRequest_builder{
 				Plugin: &types.PluginV1{
 					SubKind: types.PluginSubkindAccess,
 					Metadata: types.Metadata{
@@ -419,7 +419,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				CredentialLabels: map[string]string{
 					types.OktaOrgURLLabel: "https://example.okta.com",
 				},
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 		{
@@ -438,7 +438,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				},
 			},
 			expectSAMLConnectorQuery: "okta-integration",
-			expectRequest: &pluginsv1.CreatePluginRequest{
+			expectRequest: pluginsv1.CreatePluginRequest_builder{
 				Plugin: &types.PluginV1{
 					SubKind: types.PluginSubkindAccess,
 					Metadata: types.Metadata{
@@ -480,7 +480,7 @@ func TestPluginsInstallOkta(t *testing.T) {
 				CredentialLabels: map[string]string{
 					types.OktaOrgURLLabel: "https://okta.example.com",
 				},
-			},
+			}.Build(),
 			expectError: require.NoError,
 		},
 	}
diff --git a/tool/tctl/common/plugin/scim.go b/tool/tctl/common/plugin/scim.go
index 5a4f4acaf8a..f5e1f992130 100644
--- a/tool/tctl/common/plugin/scim.go
+++ b/tool/tctl/common/plugin/scim.go
@@ -94,10 +94,10 @@ func (p *PluginsCommand) InstallSCIM(ctx context.Context, args pluginServices) e
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	req := &pluginspb.CreatePluginRequest{
+	req := pluginspb.CreatePluginRequest_builder{
 		Plugin:                plugin,
 		StaticCredentialsList: []*types.PluginStaticCredentialsV1{creds.PluginStaticCredentialsV1},
-	}
+	}.Build()
 	if _, err := args.plugins.CreatePlugin(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/recordings/detail.go b/tool/tctl/common/recordings/detail.go
index e162b714b5e..dc3e626b329 100644
--- a/tool/tctl/common/recordings/detail.go
+++ b/tool/tctl/common/recordings/detail.go
@@ -114,18 +114,18 @@ func renderDetail(s *sessionsearchv1pb.SessionSummary, p palette) string {
 
 	if props := s.GetResourceProperties(); props != nil {
 		b.WriteString("\n")
-		switch t := props.Type.(type) {
-		case *sessionsearchv1pb.ResourceProperties_Ssh:
+		switch props.WhichType() {
+		case sessionsearchv1pb.ResourceProperties_Ssh_case:
 			section("SSH Properties")
-			field("Hostname", t.Ssh.GetServerHostname())
-			field("Address", t.Ssh.GetServerAddr())
-		case *sessionsearchv1pb.ResourceProperties_Kubernetes:
+			field("Hostname", props.GetSsh().GetServerHostname())
+			field("Address", props.GetSsh().GetServerAddr())
+		case sessionsearchv1pb.ResourceProperties_Kubernetes_case:
 			section("Kubernetes Properties")
-			field("Namespace", t.Kubernetes.GetPodNamespace())
-			field("Pod", t.Kubernetes.GetPodName())
-		case *sessionsearchv1pb.ResourceProperties_Database:
+			field("Namespace", props.GetKubernetes().GetPodNamespace())
+			field("Pod", props.GetKubernetes().GetPodName())
+		case sessionsearchv1pb.ResourceProperties_Database_case:
 			section("Database Properties")
-			field("Database", t.Database.GetDatabaseName())
+			field("Database", props.GetDatabase().GetDatabaseName())
 		}
 	}
 
diff --git a/tool/tctl/common/recordings/sanitize_test.go b/tool/tctl/common/recordings/sanitize_test.go
index 72bfc9816b4..bff69fa023b 100644
--- a/tool/tctl/common/recordings/sanitize_test.go
+++ b/tool/tctl/common/recordings/sanitize_test.go
@@ -26,19 +26,19 @@ import (
 )
 
 func TestRenderTimelineSanitizesTerminalControlSequences(t *testing.T) {
-	timeline := renderTimeline(&summarizerv1pb.EnhancedSummary{
+	timeline := renderTimeline(summarizerv1pb.EnhancedSummary_builder{
 		NotableCommandIndexes: []int32{0},
 		Commands: []*summarizerv1pb.CommandAnalysis{
-			{
+			summarizerv1pb.CommandAnalysis_builder{
 				TimelineTitle:    "\x1b]0;owned title\aListed files\x1b[31m",
 				TimelineSubtitle: "\x1b]8;;https://example.com\aDenied\x1b]8;;\a",
 				RiskLevel:        summarizerv1pb.RiskLevel_RISK_LEVEL_HIGH,
-			},
-			{
+			}.Build(),
+			summarizerv1pb.CommandAnalysis_builder{
 				Command: "\x1b]52;c;AAAA\acat /etc/passwd",
-			},
+			}.Build(),
 		},
-	}, 100, buildPalette())
+	}.Build(), 100, buildPalette())
 
 	visible := stripANSI(timeline)
 	for _, forbidden := range []string{"\x1b", "\a", "owned title", "AAAA"} {
diff --git a/tool/tctl/common/recordings/summary_popup.go b/tool/tctl/common/recordings/summary_popup.go
index bf21f5bde77..ce533e60800 100644
--- a/tool/tctl/common/recordings/summary_popup.go
+++ b/tool/tctl/common/recordings/summary_popup.go
@@ -240,7 +240,7 @@ func (m *summaryPopupModel) close() {
 
 func loadSummaryCmd(ctx context.Context, getter SummaryGetter, sessionID string) tea.Cmd {
 	return func() tea.Msg {
-		resp, err := getter.GetSummary(ctx, &summarizerv1pb.GetSummaryRequest{SessionId: sessionID})
+		resp, err := getter.GetSummary(ctx, summarizerv1pb.GetSummaryRequest_builder{SessionId: sessionID}.Build())
 		if err != nil {
 			return summaryLoadedMsg{err: err}
 		}
diff --git a/tool/tctl/common/recordings_command.go b/tool/tctl/common/recordings_command.go
index 355dc78f54e..6c576d8c495 100644
--- a/tool/tctl/common/recordings_command.go
+++ b/tool/tctl/common/recordings_command.go
@@ -288,9 +288,9 @@ func (c *RecordingsCommand) SearchRecordings(ctx context.Context, tc *authclient
 	// fetcher is defined early so it can be used both for resume and for normal pagination.
 	fetcher := recordingstui.BatchFetcher(func(ctx context.Context, token string) ([]*sessionsearchv1pb.SessionSummary, string, error) {
 		// When BatchToken is set the server ignores all other filter fields per the proto contract.
-		batchStream, err := searchClient.SearchSessionSummaries(ctx, &sessionsearchv1pb.SearchSessionSummariesRequest{
+		batchStream, err := searchClient.SearchSessionSummaries(ctx, sessionsearchv1pb.SearchSessionSummariesRequest_builder{
 			BatchToken: token,
-		})
+		}.Build())
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
@@ -321,7 +321,7 @@ func (c *RecordingsCommand) SearchRecordings(ctx context.Context, tc *authclient
 	if len(c.searchQuery) > 0 {
 		search = []string{strings.Join(c.searchQuery, " ")}
 	}
-	req := &sessionsearchv1pb.SearchSessionSummariesRequest{
+	req := sessionsearchv1pb.SearchSessionSummariesRequest_builder{
 		StartTime:        timestamppb.New(fromUTC),
 		EndTime:          timestamppb.New(toUTC),
 		SearchQueries:    search,
@@ -330,34 +330,34 @@ func (c *RecordingsCommand) SearchRecordings(ctx context.Context, tc *authclient
 		Kinds:            c.searchKinds,
 		UserRoles:        c.searchRoles,
 		MaxResults:       c.searchLimit,
-	}
+	}.Build()
 	resourceProperties, err := c.buildSearchResourceProperties()
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	req.ResourceProperties = resourceProperties
+	req.SetResourceProperties(resourceProperties)
 	if c.searchUsername != "" {
-		req.Username = &c.searchUsername
+		req.SetUsername(c.searchUsername)
 	}
 	if c.searchResourceKind != "" {
-		req.ResourceKind = &c.searchResourceKind
+		req.SetResourceKind(c.searchResourceKind)
 	}
 	if c.searchResourceName != "" {
-		req.ResourceName = &c.searchResourceName
+		req.SetResourceName(c.searchResourceName)
 	}
 	if c.searchSeverity != "" {
 		level, err := parseSeverity(c.searchSeverity)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		req.Severity = &level
+		req.SetSeverity(level)
 	}
 	if c.searchMode != "" {
 		mode, err := parseSearchMode(c.searchMode)
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		req.SearchMode = mode
+		req.SetSearchMode(mode)
 	}
 
 	stream, err := searchClient.SearchSessionSummaries(ctx, req)
@@ -428,10 +428,10 @@ func (c *RecordingsCommand) buildSearchResourceProperties() (*sessionsearchv1pb.
 	case sshSet:
 		props := &sessionsearchv1pb.SSHProperties{}
 		if c.searchServerHostname != "" {
-			props.ServerHostname = &c.searchServerHostname
+			props.SetServerHostname(c.searchServerHostname)
 		}
 		if c.searchServerAddr != "" {
-			props.ServerAddr = &c.searchServerAddr
+			props.SetServerAddr(c.searchServerAddr)
 		}
 		return &sessionsearchv1pb.ResourceProperties{
 			Type: &sessionsearchv1pb.ResourceProperties_Ssh{
@@ -441,10 +441,10 @@ func (c *RecordingsCommand) buildSearchResourceProperties() (*sessionsearchv1pb.
 	case kubernetesSet:
 		props := &sessionsearchv1pb.KubernetesProperties{}
 		if c.searchPodNamespace != "" {
-			props.PodNamespace = &c.searchPodNamespace
+			props.SetPodNamespace(c.searchPodNamespace)
 		}
 		if c.searchPodName != "" {
-			props.PodName = &c.searchPodName
+			props.SetPodName(c.searchPodName)
 		}
 		return &sessionsearchv1pb.ResourceProperties{
 			Type: &sessionsearchv1pb.ResourceProperties_Kubernetes{
@@ -452,13 +452,11 @@ func (c *RecordingsCommand) buildSearchResourceProperties() (*sessionsearchv1pb.
 			},
 		}, nil
 	case databaseSet:
-		return &sessionsearchv1pb.ResourceProperties{
-			Type: &sessionsearchv1pb.ResourceProperties_Database{
-				Database: &sessionsearchv1pb.DatabaseProperties{
-					DatabaseName: &c.searchDatabaseName,
-				},
-			},
-		}, nil
+		return sessionsearchv1pb.ResourceProperties_builder{
+			Database: sessionsearchv1pb.DatabaseProperties_builder{
+				DatabaseName: &c.searchDatabaseName,
+			}.Build(),
+		}.Build(), nil
 	default:
 		return nil, nil
 	}
@@ -500,12 +498,12 @@ func collectStream(stream sessionsearchv1pb.SessionSearchService_SearchSessionSu
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
-		switch p := resp.Payload.(type) {
-		case *sessionsearchv1pb.SearchSessionSummariesResponse_Summary:
-			sessions = append(sessions, p.Summary)
-		case *sessionsearchv1pb.SearchSessionSummariesResponse_BatchComplete_:
-			if p.BatchComplete.GetHasMore() {
-				nextToken = p.BatchComplete.GetNextBatchToken()
+		switch resp.WhichPayload() {
+		case sessionsearchv1pb.SearchSessionSummariesResponse_Summary_case:
+			sessions = append(sessions, resp.GetSummary())
+		case sessionsearchv1pb.SearchSessionSummariesResponse_BatchComplete_case:
+			if resp.GetBatchComplete().GetHasMore() {
+				nextToken = resp.GetBatchComplete().GetNextBatchToken()
 			}
 		}
 	}
diff --git a/tool/tctl/common/recordings_encryption_command.go b/tool/tctl/common/recordings_encryption_command.go
index 6f9290d745a..61808ff7832 100644
--- a/tool/tctl/common/recordings_encryption_command.go
+++ b/tool/tctl/common/recordings_encryption_command.go
@@ -169,17 +169,17 @@ func (c *recordingsEncryptionCommand) writeStatusText(w io.Writer, keyStates []*
 	rotationState := recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_UNSPECIFIED
 	t := asciitable.MakeTable([]string{"Key Pair Fingerprint", "State"})
 	for _, pair := range keyStates {
-		if pair.State == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE {
-			rotationState = pair.State
+		if pair.GetState() == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE {
+			rotationState = pair.GetState()
 		}
 
-		if pair.State == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING {
+		if pair.GetState() == recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING {
 			if rotationState != recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_INACCESSIBLE {
-				rotationState = pair.State
+				rotationState = pair.GetState()
 			}
 		}
 
-		t.AddRow([]string{pair.Fingerprint, c.getFriendlyStatusString(pair.State)})
+		t.AddRow([]string{pair.GetFingerprint(), c.getFriendlyStatusString(pair.GetState())})
 	}
 
 	switch rotationState {
diff --git a/tool/tctl/common/recordings_encryption_command_test.go b/tool/tctl/common/recordings_encryption_command_test.go
index 2e7faa64a5a..1add80559d8 100644
--- a/tool/tctl/common/recordings_encryption_command_test.go
+++ b/tool/tctl/common/recordings_encryption_command_test.go
@@ -63,7 +63,7 @@ func TestRecordingEncryptionKeyRotation(t *testing.T) {
 	keyStates := getEncryptionKeyStates(t, clt)
 	require.Len(t, keyStates, 1)
 	initialKeyState := keyStates[0]
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKeyState.State)
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, initialKeyState.GetState())
 
 	// start key rotation
 	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rotate"})
@@ -75,9 +75,9 @@ func TestRecordingEncryptionKeyRotation(t *testing.T) {
 	rotatedKeyState := keyStates[0]
 	newKeyState := keyStates[1]
 
-	require.Equal(t, initialKeyState.Fingerprint, rotatedKeyState.Fingerprint)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, rotatedKeyState.State)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.State)
+	require.Equal(t, initialKeyState.GetFingerprint(), rotatedKeyState.GetFingerprint())
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, rotatedKeyState.GetState())
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.GetState())
 
 	// confirm a second rotation fails when one is already in progress
 	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rotate"})
@@ -91,8 +91,8 @@ func TestRecordingEncryptionKeyRotation(t *testing.T) {
 	keyStates = getEncryptionKeyStates(t, clt)
 	require.Len(t, keyStates, 1)
 	newKeyState = keyStates[0]
-	require.Equal(t, initialKeyState.Fingerprint, newKeyState.Fingerprint)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.State)
+	require.Equal(t, initialKeyState.GetFingerprint(), newKeyState.GetFingerprint())
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.GetState())
 
 	// start a new rotation
 	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "rotate"})
@@ -103,9 +103,9 @@ func TestRecordingEncryptionKeyRotation(t *testing.T) {
 	require.Len(t, keyStates, 2)
 	rotatedKeyState = keyStates[0]
 	newKeyState = keyStates[1]
-	require.Equal(t, initialKeyState.Fingerprint, rotatedKeyState.Fingerprint)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, rotatedKeyState.State)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.State)
+	require.Equal(t, initialKeyState.GetFingerprint(), rotatedKeyState.GetFingerprint())
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ROTATING, rotatedKeyState.GetState())
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, newKeyState.GetState())
 
 	// complete rotation
 	_, err = runRecordingsCommand(t, clt, []string{"recordings", "encryption", "complete-rotation"})
@@ -115,8 +115,8 @@ func TestRecordingEncryptionKeyRotation(t *testing.T) {
 	keyStates = getEncryptionKeyStates(t, clt)
 	require.Len(t, keyStates, 1)
 	finalKeyState := keyStates[0]
-	require.Equal(t, newKeyState.Fingerprint, finalKeyState.Fingerprint)
-	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, finalKeyState.State)
+	require.Equal(t, newKeyState.GetFingerprint(), finalKeyState.GetFingerprint())
+	require.Equal(t, recordingencryptionv1.KeyPairState_KEY_PAIR_STATE_ACTIVE, finalKeyState.GetState())
 }
 
 func getEncryptionKeyStates(t *testing.T, client *authclient.Client) []*recordingencryptionv1.FingerprintWithState {
diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index c30a10c4c1d..e6fe997724f 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -500,16 +500,16 @@ func (rc *ResourceCommand) createDevice(ctx context.Context, client *authclient.
 	}
 
 	if rc.IsForced() {
-		_, err = client.DevicesClient().UpsertDevice(ctx, &devicepb.UpsertDeviceRequest{
+		_, err = client.DevicesClient().UpsertDevice(ctx, devicepb.UpsertDeviceRequest_builder{
 			Device:           dev,
 			CreateAsResource: true,
-		})
+		}.Build())
 		// err checked below
 	} else {
-		_, err = client.DevicesClient().CreateDevice(ctx, &devicepb.CreateDeviceRequest{
+		_, err = client.DevicesClient().CreateDevice(ctx, devicepb.CreateDeviceRequest_builder{
 			Device:           dev,
 			CreateAsResource: true,
-		})
+		}.Build())
 		// err checked below
 	}
 	if err != nil {
@@ -522,8 +522,8 @@ func (rc *ResourceCommand) createDevice(ctx context.Context, client *authclient.
 	}
 
 	fmt.Printf("Device %v/%v %v\n",
-		dev.AssetTag,
-		devicetrust.FriendlyOSType(dev.OsType),
+		dev.GetAssetTag(),
+		devicetrust.FriendlyOSType(dev.GetOsType()),
 		verb,
 	)
 	return nil
@@ -708,9 +708,9 @@ func (rc *ResourceCommand) Delete(ctx context.Context, client *authclient.Client
 			return trace.Wrap(err)
 		}
 
-		if _, err := remote.DeleteDevice(ctx, &devicepb.DeleteDeviceRequest{
-			DeviceId: device[0].Id,
-		}); err != nil {
+		if _, err := remote.DeleteDevice(ctx, devicepb.DeleteDeviceRequest_builder{
+			DeviceId: device[0].GetId(),
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 		fmt.Printf("Device %q removed\n", rc.ref.Name)
@@ -948,19 +948,19 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 	case types.KindDevice:
 		remote := client.DevicesClient()
 		if rc.ref.Name != "" {
-			resp, err := remote.FindDevices(ctx, &devicepb.FindDevicesRequest{
+			resp, err := remote.FindDevices(ctx, devicepb.FindDevicesRequest_builder{
 				IdOrTag: rc.ref.Name,
-			})
+			}.Build())
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
 
-			return &deviceCollection{resp.Devices}, nil
+			return &deviceCollection{resp.GetDevices()}, nil
 		}
 
-		req := &devicepb.ListDevicesRequest{
+		req := devicepb.ListDevicesRequest_builder{
 			View: devicepb.DeviceView_DEVICE_VIEW_RESOURCE,
-		}
+		}.Build()
 		var devs []*devicepb.Device
 		for {
 			resp, err := remote.ListDevices(ctx, req)
@@ -968,23 +968,23 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 				return nil, trace.Wrap(err)
 			}
 
-			devs = append(devs, resp.Devices...)
+			devs = append(devs, resp.GetDevices()...)
 
-			if resp.NextPageToken == "" {
+			if resp.GetNextPageToken() == "" {
 				break
 			}
-			req.PageToken = resp.NextPageToken
+			req.SetPageToken(resp.GetNextPageToken())
 		}
 
 		sort.Slice(devs, func(i, j int) bool {
 			d1 := devs[i]
 			d2 := devs[j]
 
-			if d1.AssetTag == d2.AssetTag {
-				return d1.OsType < d2.OsType
+			if d1.GetAssetTag() == d2.GetAssetTag() {
+				return d1.GetOsType() < d2.GetOsType()
 			}
 
-			return d1.AssetTag < d2.AssetTag
+			return d1.GetAssetTag() < d2.GetAssetTag()
 		})
 
 		return &deviceCollection{devices: devs}, nil
@@ -1064,7 +1064,7 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		return &securityReportCollection{items: resources}, nil
 	case types.KindPlugin:
 		if rc.ref.Name != "" {
-			plugin, err := client.PluginsClient().GetPlugin(ctx, &pluginsv1.GetPluginRequest{Name: rc.ref.Name})
+			plugin, err := client.PluginsClient().GetPlugin(ctx, pluginsv1.GetPluginRequest_builder{Name: rc.ref.Name}.Build())
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
@@ -1073,21 +1073,21 @@ func (rc *ResourceCommand) getCollection(ctx context.Context, client *authclient
 		var plugins []types.Plugin
 		startKey := ""
 		for {
-			resp, err := client.PluginsClient().ListPlugins(ctx, &pluginsv1.ListPluginsRequest{
+			resp, err := client.PluginsClient().ListPlugins(ctx, pluginsv1.ListPluginsRequest_builder{
 				PageSize:    100,
 				StartKey:    startKey,
 				WithSecrets: rc.withSecrets,
-			})
+			}.Build())
 			if err != nil {
 				return nil, trace.Wrap(err)
 			}
-			for _, v := range resp.Plugins {
+			for _, v := range resp.GetPlugins() {
 				plugins = append(plugins, v)
 			}
-			if resp.NextKey == "" {
+			if resp.GetNextKey() == "" {
 				break
 			}
-			startKey = resp.NextKey
+			startKey = resp.GetNextKey()
 		}
 		return &pluginCollection{plugins: plugins}, nil
 
@@ -1135,21 +1135,21 @@ func UpsertVerb(exists bool, force bool) string {
 }
 
 func findDeviceByIDOrTag(ctx context.Context, remote devicepb.DeviceTrustServiceClient, idOrTag string) ([]*devicepb.Device, error) {
-	resp, err := remote.FindDevices(ctx, &devicepb.FindDevicesRequest{
+	resp, err := remote.FindDevices(ctx, devicepb.FindDevicesRequest_builder{
 		IdOrTag: idOrTag,
-	})
+	}.Build())
 	switch {
 	case err != nil:
 		return nil, trace.Wrap(err)
-	case len(resp.Devices) == 0:
+	case len(resp.GetDevices()) == 0:
 		return nil, trace.NotFound("device %q not found", idOrTag)
-	case len(resp.Devices) == 1:
-		return resp.Devices, nil
+	case len(resp.GetDevices()) == 1:
+		return resp.GetDevices(), nil
 	}
 
 	// Do we have an ID match?
-	for _, dev := range resp.Devices {
-		if dev.Id == idOrTag {
+	for _, dev := range resp.GetDevices() {
+		if dev.GetId() == idOrTag {
 			return []*devicepb.Device{dev}, nil
 		}
 	}
@@ -1178,7 +1178,7 @@ func (rc *ResourceCommand) updatePlugin(ctx context.Context, client *authclient.
 	if err := utils.FastUnmarshal(raw.Raw, &item); err != nil {
 		return trace.Wrap(err)
 	}
-	if _, err := client.PluginsClient().UpdatePlugin(ctx, &pluginsv1.UpdatePluginRequest{Plugin: &item.PluginV1}); err != nil {
+	if _, err := client.PluginsClient().UpdatePlugin(ctx, pluginsv1.UpdatePluginRequest_builder{Plugin: &item.PluginV1}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	return nil
@@ -1195,7 +1195,7 @@ func (rc *ResourceCommand) createPlugin(ctx context.Context, client *authclient.
 		// Plugin needs to be installed before it can be updated.
 		return trace.BadParameter("Only plugin update operation is supported. Please use 'tctl plugins install' instead\n")
 	}
-	if _, err := client.PluginsClient().UpdatePlugin(ctx, &pluginsv1.UpdatePluginRequest{Plugin: &item.PluginV1}); err != nil {
+	if _, err := client.PluginsClient().UpdatePlugin(ctx, pluginsv1.UpdatePluginRequest_builder{Plugin: &item.PluginV1}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Printf("plugin %q has been updated\n", item.GetName())
diff --git a/tool/tctl/common/resource_command_test.go b/tool/tctl/common/resource_command_test.go
index c8628f8f5fe..101d016127d 100644
--- a/tool/tctl/common/resource_command_test.go
+++ b/tool/tctl/common/resource_command_test.go
@@ -413,17 +413,17 @@ version: v1
 	require.Len(t, rs, 1)
 
 	// Compare with expected value
-	expected := &scopedaccessv1.ScopedRole{
+	expected := scopedaccessv1.ScopedRole_builder{
 		Kind: scopedaccess.KindScopedRole,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "some-role",
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleSpec{
+		Spec: scopedaccessv1.ScopedRoleSpec_builder{
 			AssignableScopes: []string{"/foo"},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
 	require.Empty(t, cmp.Diff(expected, rs[0], protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
@@ -490,24 +490,24 @@ version: v1
 	require.Equal(t, assignmentName, asByName[0].GetMetadata().GetName())
 
 	// Compare with expected value
-	expectedAssignment := &scopedaccessv1.ScopedRoleAssignment{
+	expectedAssignment := scopedaccessv1.ScopedRoleAssignment_builder{
 		Kind:    scopedaccess.KindScopedRoleAssignment,
 		SubKind: scopedaccess.SubKindDynamic,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: assignmentName,
-		},
+		}.Build(),
 		Scope: "/",
-		Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+		Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 			User: "bob",
 			Assignments: []*scopedaccessv1.Assignment{
-				{
+				scopedaccessv1.Assignment_builder{
 					Role:  "some-role",
 					Scope: "/foo",
-				},
+				}.Build(),
 			},
-		},
+		}.Build(),
 		Version: types.V1,
-	}
+	}.Build()
 
 	require.Empty(t, cmp.Diff(expectedAssignment, as[0], protocmp.Transform(), protocmp.IgnoreFields(&headerv1.Metadata{}, "revision")))
 
@@ -680,8 +680,8 @@ spec:
 	require.True(t, trace.IsAlreadyExists(err), "expected already exists error, got %v", err)
 
 	// Using --force should succeed and act as an upsert
-	allTokens[0].Metadata.Labels = map[string]string{"env": "staging"}
-	allTokens[0].Spec.AssignedScope = "/bar"
+	allTokens[0].GetMetadata().SetLabels(map[string]string{"env": "staging"})
+	allTokens[0].GetSpec().SetAssignedScope("/bar")
 	updatedBytes, err := services.MarshalProtoResource(allTokens[0])
 	require.NoError(t, err)
 	require.NoError(t, os.WriteFile(scopedTokenYAMLPath, updatedBytes, 0644))
@@ -2680,7 +2680,7 @@ spec:
 
 	// Explicitly change the revision and try creating the user with and without
 	// the force flag.
-	expected.GetMetadata().Revision = uuid.NewString()
+	expected.GetMetadata().SetRevision(uuid.NewString())
 	hostUserBytes, err := services.MarshalProtoResource(&expected, services.PreserveRevision())
 	require.NoError(t, err)
 	require.NoError(t, os.WriteFile(userYAMLPath, hostUserBytes, 0644))
diff --git a/tool/tctl/common/resource_health_check_config_test.go b/tool/tctl/common/resource_health_check_config_test.go
index 9ea284056bc..1b15e32c68c 100644
--- a/tool/tctl/common/resource_health_check_config_test.go
+++ b/tool/tctl/common/resource_health_check_config_test.go
@@ -92,7 +92,7 @@ spec:
 
 	// Explicitly change the revision and try creating the resource with and
 	// without the force flag.
-	expected.GetMetadata().Revision = uuid.NewString()
+	expected.GetMetadata().SetRevision(uuid.NewString())
 	blob, err := services.MarshalHealthCheckConfig(expected, services.PreserveRevision())
 	require.NoError(t, err)
 	require.NoError(t, os.WriteFile(resourceYAMLPath, blob, 0644))
@@ -110,11 +110,11 @@ func testEditHealthCheckConfig(t *testing.T, clt *authclient.Client) {
 
 	// create expected health check config
 	expected, err := healthcheckconfig.NewHealthCheckConfig("test",
-		&healthcheckconfigv1.HealthCheckConfigSpec{
-			Match: &healthcheckconfigv1.Matcher{
+		healthcheckconfigv1.HealthCheckConfigSpec_builder{
+			Match: healthcheckconfigv1.Matcher_builder{
 				DbLabelsExpression: "labels.env == `dev`",
-			},
-		},
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	created, err := clt.CreateHealthCheckConfig(ctx, expected)
@@ -125,7 +125,7 @@ func testEditHealthCheckConfig(t *testing.T, clt *authclient.Client) {
 		if err != nil {
 			return trace.Wrap(err, "opening file to edit")
 		}
-		expected.GetMetadata().Revision = created.GetMetadata().GetRevision()
+		expected.GetMetadata().SetRevision(created.GetMetadata().GetRevision())
 		collection := &healthCheckConfigCollection{
 			items: []*healthcheckconfigv1.HealthCheckConfig{expected},
 		}
diff --git a/tool/tctl/common/resources/access_monitoring_rule.go b/tool/tctl/common/resources/access_monitoring_rule.go
index 381aecbdb74..66e77f858a3 100644
--- a/tool/tctl/common/resources/access_monitoring_rule.go
+++ b/tool/tctl/common/resources/access_monitoring_rule.go
@@ -51,7 +51,7 @@ func (c *accessMonitoringRuleCollection) WriteText(w io.Writer, verbose bool) er
 	var rows [][]string
 	for _, item := range c.items {
 		labels := common.FormatLabels(item.GetMetadata().GetLabels(), verbose)
-		rows = append(rows, []string{item.Metadata.GetName(), labels})
+		rows = append(rows, []string{item.GetMetadata().GetName(), labels})
 	}
 	headers := []string{"Name", "Labels"}
 	t := asciitable.MakeTable(headers, rows...)
diff --git a/tool/tctl/common/resources/accessgraphsettings.go b/tool/tctl/common/resources/accessgraphsettings.go
index 1219c42dd16..d061860c545 100644
--- a/tool/tctl/common/resources/accessgraphsettings.go
+++ b/tool/tctl/common/resources/accessgraphsettings.go
@@ -79,7 +79,7 @@ func upsertAccessGraphSettings(ctx context.Context, client *authclient.Client, r
 		return trace.Wrap(err)
 	}
 
-	if _, err = client.ClusterConfigClient().UpsertAccessGraphSettings(ctx, &clusterconfigpb.UpsertAccessGraphSettingsRequest{AccessGraphSettings: settings}); err != nil {
+	if _, err = client.ClusterConfigClient().UpsertAccessGraphSettings(ctx, clusterconfigpb.UpsertAccessGraphSettingsRequest_builder{AccessGraphSettings: settings}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -93,7 +93,7 @@ func updateAccessGraphSettings(ctx context.Context, client *authclient.Client, r
 		return trace.Wrap(err)
 	}
 
-	if _, err = client.ClusterConfigClient().UpdateAccessGraphSettings(ctx, &clusterconfigpb.UpdateAccessGraphSettingsRequest{AccessGraphSettings: settings}); err != nil {
+	if _, err = client.ClusterConfigClient().UpdateAccessGraphSettings(ctx, clusterconfigpb.UpdateAccessGraphSettingsRequest_builder{AccessGraphSettings: settings}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Println("access_graph_settings has been updated")
diff --git a/tool/tctl/common/resources/accesslist.go b/tool/tctl/common/resources/accesslist.go
index 9f0b2a22662..e89feceef58 100644
--- a/tool/tctl/common/resources/accesslist.go
+++ b/tool/tctl/common/resources/accesslist.go
@@ -84,10 +84,10 @@ func getAccessList(ctx context.Context, client *authclient.Client, ref services.
 	accessLists, err := stream.Collect(
 		clientutils.Resources(ctx, func(ctx context.Context, size int, token string) ([]*accesslist.AccessList, string, error) {
 			return client.AccessListClient().ListAccessListsV2(ctx,
-				&accesslistv1.ListAccessListsV2Request{
+				accesslistv1.ListAccessListsV2Request_builder{
 					PageSize:  int32(size),
 					PageToken: token,
-				})
+				}.Build())
 		}),
 	)
 
diff --git a/tool/tctl/common/resources/appauthconfig.go b/tool/tctl/common/resources/appauthconfig.go
index 04be0649d78..3ec106dd8b9 100644
--- a/tool/tctl/common/resources/appauthconfig.go
+++ b/tool/tctl/common/resources/appauthconfig.go
@@ -58,17 +58,17 @@ func (c *appAuthConfigCollection) WriteText(w io.Writer, verbose bool) error {
 	var rows [][]string
 	for _, item := range c.configs {
 		subKind := "undefined"
-		switch item.Spec.SubKindSpec.(type) {
-		case *appauthconfigv1.AppAuthConfigSpec_Jwt:
+		switch item.GetSpec().WhichSubKindSpec() {
+		case appauthconfigv1.AppAuthConfigSpec_Jwt_case:
 			subKind = "JWT"
 		}
 
 		rows = append(rows, []string{
-			item.Metadata.Name,
+			item.GetMetadata().GetName(),
 			subKind,
 			// Always format in verbose given that internal labels can be used
 			// as matchers and should be shown to the users.
-			common.FormatMultiValueLabels(label.ToMap(item.Spec.AppLabels), true),
+			common.FormatMultiValueLabels(label.ToMap(item.GetSpec().GetAppLabels()), true),
 		})
 	}
 
@@ -95,7 +95,7 @@ func appAuthConfigHandler() Handler {
 func getAppAuthConfig(ctx context.Context, client *authclient.Client, ref services.Ref, opts GetOpts) (Collection, error) {
 	c := client.AppAuthConfigClient()
 	if ref.Name != "" {
-		config, err := c.GetAppAuthConfig(ctx, &appauthconfigv1.GetAppAuthConfigRequest{Name: ref.Name})
+		config, err := c.GetAppAuthConfig(ctx, appauthconfigv1.GetAppAuthConfigRequest_builder{Name: ref.Name}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -103,10 +103,10 @@ func getAppAuthConfig(ctx context.Context, client *authclient.Client, ref servic
 	}
 
 	configs, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*appauthconfigv1.AppAuthConfig, string, error) {
-		resp, err := c.ListAppAuthConfigs(ctx, &appauthconfigv1.ListAppAuthConfigsRequest{
+		resp, err := c.ListAppAuthConfigs(ctx, appauthconfigv1.ListAppAuthConfigsRequest_builder{
 			PageSize:  int32(limit),
 			PageToken: pageToken,
-		})
+		}.Build())
 
 		return resp.GetConfigs(), resp.GetNextPageToken(), trace.Wrap(err)
 	}))
@@ -124,15 +124,15 @@ func createAppAuthConfig(ctx context.Context, client *authclient.Client, raw ser
 
 	c := client.AppAuthConfigClient()
 	if opts.Force {
-		if _, err := c.UpsertAppAuthConfig(ctx, &appauthconfigv1.UpsertAppAuthConfigRequest{
+		if _, err := c.UpsertAppAuthConfig(ctx, appauthconfigv1.UpsertAppAuthConfigRequest_builder{
 			Config: in,
-		}); err != nil {
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 	} else {
-		if _, err := c.CreateAppAuthConfig(ctx, &appauthconfigv1.CreateAppAuthConfigRequest{
+		if _, err := c.CreateAppAuthConfig(ctx, appauthconfigv1.CreateAppAuthConfigRequest_builder{
 			Config: in,
-		}); err != nil {
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -148,9 +148,9 @@ func updateAppAuthConfig(ctx context.Context, client *authclient.Client, raw ser
 	}
 
 	c := client.AppAuthConfigClient()
-	if _, err := c.UpdateAppAuthConfig(ctx, &appauthconfigv1.UpdateAppAuthConfigRequest{
+	if _, err := c.UpdateAppAuthConfig(ctx, appauthconfigv1.UpdateAppAuthConfigRequest_builder{
 		Config: in,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -160,9 +160,9 @@ func updateAppAuthConfig(ctx context.Context, client *authclient.Client, raw ser
 
 func deleteAppAuthConfig(ctx context.Context, client *authclient.Client, ref services.Ref) error {
 	c := client.AppAuthConfigClient()
-	_, err := c.DeleteAppAuthConfig(ctx, &appauthconfigv1.DeleteAppAuthConfigRequest{
+	_, err := c.DeleteAppAuthConfig(ctx, appauthconfigv1.DeleteAppAuthConfigRequest_builder{
 		Name: ref.Name,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/autoupdate_agent_rollout.go b/tool/tctl/common/resources/autoupdate_agent_rollout.go
index 8491a192f5a..2dc9220ef50 100644
--- a/tool/tctl/common/resources/autoupdate_agent_rollout.go
+++ b/tool/tctl/common/resources/autoupdate_agent_rollout.go
@@ -81,10 +81,10 @@ func createAutoUpdateAgentRollout(ctx context.Context, client *authclient.Client
 	}
 
 	if rollout.GetMetadata() == nil {
-		rollout.Metadata = &headerv1.Metadata{}
+		rollout.SetMetadata(&headerv1.Metadata{})
 	}
 	if rollout.GetMetadata().GetName() == "" {
-		rollout.Metadata.Name = types.MetaNameAutoUpdateAgentRollout
+		rollout.GetMetadata().SetName(types.MetaNameAutoUpdateAgentRollout)
 	}
 
 	if opts.Force {
@@ -107,10 +107,10 @@ func updateAutoUpdateAgentRollout(ctx context.Context, client *authclient.Client
 	}
 
 	if rollout.GetMetadata() == nil {
-		rollout.Metadata = &headerv1.Metadata{}
+		rollout.SetMetadata(&headerv1.Metadata{})
 	}
 	if rollout.GetMetadata().GetName() == "" {
-		rollout.Metadata.Name = types.MetaNameAutoUpdateAgentRollout
+		rollout.GetMetadata().SetName(types.MetaNameAutoUpdateAgentRollout)
 	}
 
 	if _, err := client.UpdateAutoUpdateAgentRollout(ctx, rollout); err != nil {
diff --git a/tool/tctl/common/resources/autoupdate_config.go b/tool/tctl/common/resources/autoupdate_config.go
index 72419e79fb2..8878328939c 100644
--- a/tool/tctl/common/resources/autoupdate_config.go
+++ b/tool/tctl/common/resources/autoupdate_config.go
@@ -84,10 +84,10 @@ func createAutoUpdateConfig(ctx context.Context, client *authclient.Client, raw
 	}
 
 	if config.GetMetadata() == nil {
-		config.Metadata = &headerv1.Metadata{}
+		config.SetMetadata(&headerv1.Metadata{})
 	}
 	if config.GetMetadata().GetName() == "" {
-		config.Metadata.Name = types.MetaNameAutoUpdateConfig
+		config.GetMetadata().SetName(types.MetaNameAutoUpdateConfig)
 	}
 
 	if opts.Force {
@@ -110,10 +110,10 @@ func updateAutoUpdateConfig(ctx context.Context, client *authclient.Client, raw
 	}
 
 	if config.GetMetadata() == nil {
-		config.Metadata = &headerv1.Metadata{}
+		config.SetMetadata(&headerv1.Metadata{})
 	}
 	if config.GetMetadata().GetName() == "" {
-		config.Metadata.Name = types.MetaNameAutoUpdateConfig
+		config.GetMetadata().SetName(types.MetaNameAutoUpdateConfig)
 	}
 
 	if _, err := client.UpdateAutoUpdateConfig(ctx, config); err != nil {
diff --git a/tool/tctl/common/resources/autoupdate_config_test.go b/tool/tctl/common/resources/autoupdate_config_test.go
index b8d65cff964..97338394869 100644
--- a/tool/tctl/common/resources/autoupdate_config_test.go
+++ b/tool/tctl/common/resources/autoupdate_config_test.go
@@ -53,21 +53,21 @@ func (c *autoUpdateConfigBrokenCollection) Resources() []types.Resource {
 // checks we can do a round-trip with one of those proto-struct resource.
 func TestRoundTripProtoResource153(t *testing.T) {
 	// Test setup: generate fixture.
-	initial, err := autoupdate.NewAutoUpdateConfig(&autoupdatev1pb.AutoUpdateConfigSpec{
-		Agents: &autoupdatev1pb.AutoUpdateConfigSpecAgents{
+	initial, err := autoupdate.NewAutoUpdateConfig(autoupdatev1pb.AutoUpdateConfigSpec_builder{
+		Agents: autoupdatev1pb.AutoUpdateConfigSpecAgents_builder{
 			Mode:                      autoupdate.AgentsUpdateModeEnabled,
 			Strategy:                  autoupdate.AgentsStrategyTimeBased,
 			MaintenanceWindowDuration: durationpb.New(1 * time.Hour),
-			Schedules: &autoupdatev1pb.AgentAutoUpdateSchedules{
+			Schedules: autoupdatev1pb.AgentAutoUpdateSchedules_builder{
 				Regular: []*autoupdatev1pb.AgentAutoUpdateGroup{
-					{
+					autoupdatev1pb.AgentAutoUpdateGroup_builder{
 						Name: "group1",
 						Days: []string{types.Wildcard},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Test execution: dump the resource into a YAML manifest.
diff --git a/tool/tctl/common/resources/autoupdate_version.go b/tool/tctl/common/resources/autoupdate_version.go
index 6de9b3a130b..f2470b75d19 100644
--- a/tool/tctl/common/resources/autoupdate_version.go
+++ b/tool/tctl/common/resources/autoupdate_version.go
@@ -51,7 +51,7 @@ func (c *autoUpdateVersionCollection) WriteText(w io.Writer, verbose bool) error
 	t := asciitable.MakeTable([]string{"Name", "Tools AutoUpdate Version"})
 	t.AddRow([]string{
 		c.version.GetMetadata().GetName(),
-		fmt.Sprintf("%v", c.version.GetSpec().GetTools().TargetVersion),
+		fmt.Sprintf("%v", c.version.GetSpec().GetTools().GetTargetVersion()),
 	})
 	_, err := t.AsBuffer().WriteTo(w)
 	return trace.Wrap(err)
@@ -84,10 +84,10 @@ func createAutoUpdateVersion(ctx context.Context, client *authclient.Client, raw
 	}
 
 	if version.GetMetadata() == nil {
-		version.Metadata = &headerv1.Metadata{}
+		version.SetMetadata(&headerv1.Metadata{})
 	}
 	if version.GetMetadata().GetName() == "" {
-		version.Metadata.Name = types.MetaNameAutoUpdateVersion
+		version.GetMetadata().SetName(types.MetaNameAutoUpdateVersion)
 	}
 
 	if opts.Force {
@@ -110,10 +110,10 @@ func updateAutoUpdateVersion(ctx context.Context, client *authclient.Client, raw
 	}
 
 	if version.GetMetadata() == nil {
-		version.Metadata = &headerv1.Metadata{}
+		version.SetMetadata(&headerv1.Metadata{})
 	}
 	if version.GetMetadata().GetName() == "" {
-		version.Metadata.Name = types.MetaNameAutoUpdateVersion
+		version.GetMetadata().SetName(types.MetaNameAutoUpdateVersion)
 	}
 
 	if _, err := client.UpdateAutoUpdateVersion(ctx, version); err != nil {
diff --git a/tool/tctl/common/resources/bot.go b/tool/tctl/common/resources/bot.go
index 92f11cc3b84..dc20ec528df 100644
--- a/tool/tctl/common/resources/bot.go
+++ b/tool/tctl/common/resources/bot.go
@@ -50,8 +50,8 @@ func (c *botCollection) WriteText(w io.Writer, verbose bool) error {
 	t := asciitable.MakeTable([]string{"Name", "Roles"})
 	for _, b := range c.bots {
 		t.AddRow([]string{
-			b.Metadata.Name,
-			strings.Join(b.Spec.Roles, ", "),
+			b.GetMetadata().GetName(),
+			strings.Join(b.GetSpec().GetRoles(), ", "),
 		})
 	}
 	_, err := t.AsBuffer().WriteTo(w)
@@ -77,9 +77,9 @@ func getBot(
 ) (Collection, error) {
 	c := client.BotServiceClient()
 	if ref.Name != "" {
-		bot, err := c.GetBot(ctx, &machineidv1pb.GetBotRequest{
+		bot, err := c.GetBot(ctx, machineidv1pb.GetBotRequest_builder{
 			BotName: ref.Name,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -88,10 +88,10 @@ func getBot(
 	}
 
 	bots, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, token string) ([]*machineidv1pb.Bot, string, error) {
-		resp, err := c.ListBots(ctx, &machineidv1pb.ListBotsRequest{
+		resp, err := c.ListBots(ctx, machineidv1pb.ListBotsRequest_builder{
 			PageSize:  int32(limit),
 			PageToken: token,
-		})
+		}.Build())
 
 		return resp.GetBots(), resp.GetNextPageToken(), trace.Wrap(err)
 	}))
@@ -113,23 +113,23 @@ func createBot(
 		return trace.Wrap(err)
 	}
 	if opts.Force {
-		_, err := client.BotServiceClient().UpsertBot(ctx, &machineidv1pb.UpsertBotRequest{
+		_, err := client.BotServiceClient().UpsertBot(ctx, machineidv1pb.UpsertBotRequest_builder{
 			Bot: bot,
-		})
+		}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		fmt.Printf("Bot %q has been created\n", bot.Metadata.Name)
+		fmt.Printf("Bot %q has been created\n", bot.GetMetadata().GetName())
 		return nil
 	}
 
-	_, err := client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+	_, err := client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
 		Bot: bot,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	fmt.Printf("Bot %q has been created\n", bot.Metadata.Name)
+	fmt.Printf("Bot %q has been created\n", bot.GetMetadata().GetName())
 	return nil
 }
 
@@ -138,9 +138,9 @@ func deleteBot(
 	client *authclient.Client,
 	ref services.Ref,
 ) error {
-	_, err := client.BotServiceClient().DeleteBot(ctx, &machineidv1pb.DeleteBotRequest{
+	_, err := client.BotServiceClient().DeleteBot(ctx, machineidv1pb.DeleteBotRequest_builder{
 		BotName: ref.Name,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/bot_instance.go b/tool/tctl/common/resources/bot_instance.go
index 07543ceba8d..9fa03d53509 100644
--- a/tool/tctl/common/resources/bot_instance.go
+++ b/tool/tctl/common/resources/bot_instance.go
@@ -50,7 +50,7 @@ func (c *botInstanceCollection) WriteText(w io.Writer, verbose bool) error {
 	// last heartbeat, last auth, etc.
 	var rows [][]string
 	for _, item := range c.items {
-		rows = append(rows, []string{item.Spec.BotName, item.Spec.InstanceId})
+		rows = append(rows, []string{item.GetSpec().GetBotName(), item.GetSpec().GetInstanceId()})
 	}
 
 	t := asciitable.MakeTable(headers, rows...)
@@ -78,10 +78,10 @@ func getBotInstance(
 	c := client.BotInstanceServiceClient()
 	if ref.Name != "" && ref.SubKind != "" {
 		// Gets a specific bot instance, e.g. bot_instance/<bot name>/<instance id>
-		bi, err := c.GetBotInstance(ctx, &machineidv1pb.GetBotInstanceRequest{
+		bi, err := c.GetBotInstance(ctx, machineidv1pb.GetBotInstanceRequest_builder{
 			BotName:    ref.SubKind,
 			InstanceId: ref.Name,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -92,13 +92,13 @@ func getBotInstance(
 	instances, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*machineidv1pb.BotInstance, string, error) {
 		// TODO(nicholasmarais1158) Use ListBotInstancesV2 instead.
 		//nolint:staticcheck // SA1019
-		resp, err := c.ListBotInstances(ctx, &machineidv1pb.ListBotInstancesRequest{
+		resp, err := c.ListBotInstances(ctx, machineidv1pb.ListBotInstancesRequest_builder{
 			PageSize:  int32(limit),
 			PageToken: pageToken,
 
 			// Note: empty filter lists all bot instances
 			FilterBotName: ref.Name,
-		})
+		}.Build())
 
 		return resp.GetBotInstances(), resp.GetNextPageToken(), trace.Wrap(err)
 	}))
diff --git a/tool/tctl/common/resources/bot_instance_report.go b/tool/tctl/common/resources/bot_instance_report.go
index db4fc4d8b34..a52a6ccdabe 100644
--- a/tool/tctl/common/resources/bot_instance_report.go
+++ b/tool/tctl/common/resources/bot_instance_report.go
@@ -46,7 +46,7 @@ func (c *autoUpdateBotInstanceReportCollection) WriteText(w io.Writer, _ bool) e
 			groupName = "<no update group>"
 		}
 		for versionName, versionMetrics := range groupMetrics.GetVersions() {
-			t.AddRow([]string{groupName, versionName, strconv.Itoa(int(versionMetrics.Count))})
+			t.AddRow([]string{groupName, versionName, strconv.Itoa(int(versionMetrics.GetCount()))})
 		}
 	}
 	t.SortRowsBy([]int{0, 1}, true)
diff --git a/tool/tctl/common/resources/cert_authority_override.go b/tool/tctl/common/resources/cert_authority_override.go
index 3ab326e1dbe..8c689e665a8 100644
--- a/tool/tctl/common/resources/cert_authority_override.go
+++ b/tool/tctl/common/resources/cert_authority_override.go
@@ -63,9 +63,9 @@ func (c *certAuthorityOverrideCollection) WriteText(w io.Writer, verbose bool) e
 		}
 
 		for _, o := range overrides {
-			pkh := o.PublicKey
+			pkh := o.GetPublicKey()
 			if pkh == "" {
-				cert, err := tlsutils.ParseCertificatePEM([]byte(o.Certificate))
+				cert, err := tlsutils.ParseCertificatePEM([]byte(o.GetCertificate()))
 				if err != nil {
 					return trace.Wrap(err, "parse CA override certificate")
 				}
@@ -114,10 +114,10 @@ func getCertAuthorityOverride(
 		caOverrides, err := stream.Collect(clientutils.Resources(
 			ctx,
 			func(ctx context.Context, pageSize int, pageToken string) ([]*subcav1.CertAuthorityOverride, string, error) {
-				resp, err := subCA.ListCertAuthorityOverride(ctx, &subcav1.ListCertAuthorityOverrideRequest{
+				resp, err := subCA.ListCertAuthorityOverride(ctx, subcav1.ListCertAuthorityOverrideRequest_builder{
 					PageSize:  int32(pageSize),
 					PageToken: pageToken,
-				})
+				}.Build())
 				return resp.GetCaOverrides(), resp.GetNextPageToken(), trace.Wrap(err)
 			},
 		))
@@ -137,18 +137,18 @@ func getCertAuthorityOverride(
 	}
 
 	// TODO(codingllama): Support cluster_name in ca_override Gets.
-	resp, err := subCA.GetCertAuthorityOverride(ctx, &subcav1.GetCertAuthorityOverrideRequest{
-		CaId: &subcav1.CertAuthorityOverrideID{
+	resp, err := subCA.GetCertAuthorityOverride(ctx, subcav1.GetCertAuthorityOverrideRequest_builder{
+		CaId: subcav1.CertAuthorityOverrideID_builder{
 			CaType: caType,
-		},
-	})
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}
-	caOverride := resp.CaOverride
+	caOverride := resp.GetCaOverride()
 
 	// Simulate a Get-by-name if the name was specified.
-	if clusterName != "" && caOverride.Metadata.Name != clusterName {
+	if clusterName != "" && caOverride.GetMetadata().GetName() != clusterName {
 		return nil, trace.NotFound("%s %s/%s not found", ref.Kind, caType, clusterName)
 	}
 
@@ -173,17 +173,17 @@ func createCertAuthorityOverride(ctx context.Context,
 	var created *subcav1.CertAuthorityOverride
 	var action string
 	if opts.Force {
-		resp, err1 := subCA.UpsertCertAuthorityOverride(ctx, &subcav1.UpsertCertAuthorityOverrideRequest{
+		resp, err1 := subCA.UpsertCertAuthorityOverride(ctx, subcav1.UpsertCertAuthorityOverrideRequest_builder{
 			CaOverride:            caOverride,
 			ForceImmediateDisable: true,
-		})
+		}.Build())
 		created = resp.GetCaOverride()
 		err = err1
 		action = "updated"
 	} else {
-		resp, err1 := subCA.CreateCertAuthorityOverride(ctx, &subcav1.CreateCertAuthorityOverrideRequest{
+		resp, err1 := subCA.CreateCertAuthorityOverride(ctx, subcav1.CreateCertAuthorityOverrideRequest_builder{
 			CaOverride: caOverride,
-		})
+		}.Build())
 		created = resp.GetCaOverride()
 		err = err1
 		action = "created"
@@ -194,8 +194,8 @@ func createCertAuthorityOverride(ctx context.Context,
 
 	fmt.Printf("%s %s/%s %s\n",
 		types.KindCertAuthorityOverride,
-		created.SubKind,
-		created.Metadata.Name,
+		created.GetSubKind(),
+		created.GetMetadata().GetName(),
 		action,
 	)
 	return nil
@@ -215,18 +215,18 @@ func updateCertAuthorityOverride(
 
 	resp, err := authClient.
 		SubCAClient().
-		UpdateCertAuthorityOverride(ctx, &subcav1.UpdateCertAuthorityOverrideRequest{
+		UpdateCertAuthorityOverride(ctx, subcav1.UpdateCertAuthorityOverrideRequest_builder{
 			CaOverride: caOverride,
-		})
+		}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	updated := resp.CaOverride
+	updated := resp.GetCaOverride()
 
 	fmt.Printf("%s %s/%s updated\n",
 		types.KindCertAuthorityOverride,
-		updated.SubKind,
-		updated.Metadata.Name,
+		updated.GetSubKind(),
+		updated.GetMetadata().GetName(),
 	)
 	return nil
 }
@@ -250,11 +250,11 @@ func deleteCertAuthorityOverride(
 	// TODO(codingllama): Support cluster_name in ca_override Deletes.
 	if _, err := authClient.
 		SubCAClient().
-		DeleteCertAuthorityOverride(ctx, &subcav1.DeleteCertAuthorityOverrideRequest{
-			CaId: &subcav1.CertAuthorityOverrideID{
+		DeleteCertAuthorityOverride(ctx, subcav1.DeleteCertAuthorityOverrideRequest_builder{
+			CaId: subcav1.CertAuthorityOverrideID_builder{
 				CaType: caType,
-			},
-		}); err != nil {
+			}.Build(),
+		}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
diff --git a/tool/tctl/common/resources/database_object.go b/tool/tctl/common/resources/database_object.go
index 6fdb514cb18..d0283175815 100644
--- a/tool/tctl/common/resources/database_object.go
+++ b/tool/tctl/common/resources/database_object.go
@@ -74,7 +74,7 @@ func databaseObjectHandler() Handler {
 func getDatabaseObject(ctx context.Context, client *authclient.Client, ref services.Ref, _ GetOpts) (Collection, error) {
 	remote := client.DatabaseObjectClient()
 	if ref.Name != "" {
-		object, err := remote.GetDatabaseObject(ctx, &dbobjectv1.GetDatabaseObjectRequest{Name: ref.Name})
+		object, err := remote.GetDatabaseObject(ctx, dbobjectv1.GetDatabaseObjectRequest_builder{Name: ref.Name}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -83,10 +83,10 @@ func getDatabaseObject(ctx context.Context, client *authclient.Client, ref servi
 
 	objects, err := stream.Collect(clientutils.Resources(ctx,
 		func(ctx context.Context, limit int, token string) ([]*dbobjectv1.DatabaseObject, string, error) {
-			resp, err := remote.ListDatabaseObjects(ctx, &dbobjectv1.ListDatabaseObjectsRequest{
+			resp, err := remote.ListDatabaseObjects(ctx, dbobjectv1.ListDatabaseObjectsRequest_builder{
 				PageSize:  int32(limit),
 				PageToken: token,
-			})
+			}.Build())
 
 			return resp.GetObjects(), resp.GetNextPageToken(), trace.Wrap(err)
 		}))
@@ -102,18 +102,18 @@ func createDatabaseObject(ctx context.Context, client *authclient.Client, raw se
 		return trace.Wrap(err)
 	}
 	if opts.Force {
-		_, err = client.DatabaseObjectClient().UpsertDatabaseObject(ctx, &dbobjectv1.UpsertDatabaseObjectRequest{
+		_, err = client.DatabaseObjectClient().UpsertDatabaseObject(ctx, dbobjectv1.UpsertDatabaseObjectRequest_builder{
 			Object: object,
-		})
+		}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
 		fmt.Printf("database object %q has been created\n", object.GetMetadata().GetName())
 		return nil
 	}
-	_, err = client.DatabaseObjectClient().CreateDatabaseObject(ctx, &dbobjectv1.CreateDatabaseObjectRequest{
+	_, err = client.DatabaseObjectClient().CreateDatabaseObject(ctx, dbobjectv1.CreateDatabaseObjectRequest_builder{
 		Object: object,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -127,9 +127,9 @@ func updateDatabaseObject(ctx context.Context, client *authclient.Client, raw se
 		return trace.Wrap(err)
 	}
 
-	_, err = client.DatabaseObjectClient().UpdateDatabaseObject(ctx, &dbobjectv1.UpdateDatabaseObjectRequest{
+	_, err = client.DatabaseObjectClient().UpdateDatabaseObject(ctx, dbobjectv1.UpdateDatabaseObjectRequest_builder{
 		Object: object,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -139,7 +139,7 @@ func updateDatabaseObject(ctx context.Context, client *authclient.Client, raw se
 }
 
 func deleteDatabaseObject(ctx context.Context, client *authclient.Client, ref services.Ref) error {
-	if _, err := client.DatabaseObjectClient().DeleteDatabaseObject(ctx, &dbobjectv1.DeleteDatabaseObjectRequest{Name: ref.Name}); err != nil {
+	if _, err := client.DatabaseObjectClient().DeleteDatabaseObject(ctx, dbobjectv1.DeleteDatabaseObjectRequest_builder{Name: ref.Name}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Printf("database object %q has been deleted\n", ref.Name)
diff --git a/tool/tctl/common/resources/database_object_import_rule.go b/tool/tctl/common/resources/database_object_import_rule.go
index 4cc5cb982e0..6670347febb 100644
--- a/tool/tctl/common/resources/database_object_import_rule.go
+++ b/tool/tctl/common/resources/database_object_import_rule.go
@@ -74,7 +74,7 @@ func databaseObjectImportRuleHandler() Handler {
 func getDatabaseObjectImportRule(ctx context.Context, client *authclient.Client, ref services.Ref, _ GetOpts) (Collection, error) {
 	remote := client.DatabaseObjectImportRuleClient()
 	if ref.Name != "" {
-		rule, err := remote.GetDatabaseObjectImportRule(ctx, &dbobjectimportrulev1.GetDatabaseObjectImportRuleRequest{Name: ref.Name})
+		rule, err := remote.GetDatabaseObjectImportRule(ctx, dbobjectimportrulev1.GetDatabaseObjectImportRuleRequest_builder{Name: ref.Name}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -83,10 +83,10 @@ func getDatabaseObjectImportRule(ctx context.Context, client *authclient.Client,
 
 	rules, err := stream.Collect(clientutils.Resources(ctx,
 		func(ctx context.Context, limit int, token string) ([]*dbobjectimportrulev1.DatabaseObjectImportRule, string, error) {
-			resp, err := remote.ListDatabaseObjectImportRules(ctx, &dbobjectimportrulev1.ListDatabaseObjectImportRulesRequest{
+			resp, err := remote.ListDatabaseObjectImportRules(ctx, dbobjectimportrulev1.ListDatabaseObjectImportRulesRequest_builder{
 				PageSize:  int32(limit),
 				PageToken: token,
-			})
+			}.Build())
 
 			return resp.GetRules(), resp.GetNextPageToken(), trace.Wrap(err)
 		}))
@@ -102,18 +102,18 @@ func createDatabaseObjectImportRule(ctx context.Context, client *authclient.Clie
 		return trace.Wrap(err)
 	}
 	if opts.Force {
-		_, err = client.DatabaseObjectImportRuleClient().UpsertDatabaseObjectImportRule(ctx, &dbobjectimportrulev1.UpsertDatabaseObjectImportRuleRequest{
+		_, err = client.DatabaseObjectImportRuleClient().UpsertDatabaseObjectImportRule(ctx, dbobjectimportrulev1.UpsertDatabaseObjectImportRuleRequest_builder{
 			Rule: rule,
-		})
+		}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
 		fmt.Printf("rule %q has been created\n", rule.GetMetadata().GetName())
 		return nil
 	}
-	_, err = client.DatabaseObjectImportRuleClient().CreateDatabaseObjectImportRule(ctx, &dbobjectimportrulev1.CreateDatabaseObjectImportRuleRequest{
+	_, err = client.DatabaseObjectImportRuleClient().CreateDatabaseObjectImportRule(ctx, dbobjectimportrulev1.CreateDatabaseObjectImportRuleRequest_builder{
 		Rule: rule,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -127,9 +127,9 @@ func updateDatabaseObjectImportRule(ctx context.Context, client *authclient.Clie
 		return trace.Wrap(err)
 	}
 
-	_, err = client.DatabaseObjectImportRuleClient().UpdateDatabaseObjectImportRule(ctx, &dbobjectimportrulev1.UpdateDatabaseObjectImportRuleRequest{
+	_, err = client.DatabaseObjectImportRuleClient().UpdateDatabaseObjectImportRule(ctx, dbobjectimportrulev1.UpdateDatabaseObjectImportRuleRequest_builder{
 		Rule: rule,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -139,7 +139,7 @@ func updateDatabaseObjectImportRule(ctx context.Context, client *authclient.Clie
 }
 
 func deleteDatabaseObjectImportRule(ctx context.Context, client *authclient.Client, ref services.Ref) error {
-	if _, err := client.DatabaseObjectImportRuleClient().DeleteDatabaseObjectImportRule(ctx, &dbobjectimportrulev1.DeleteDatabaseObjectImportRuleRequest{Name: ref.Name}); err != nil {
+	if _, err := client.DatabaseObjectImportRuleClient().DeleteDatabaseObjectImportRule(ctx, dbobjectimportrulev1.DeleteDatabaseObjectImportRuleRequest_builder{Name: ref.Name}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Printf("rule %q has been deleted\n", ref.Name)
diff --git a/tool/tctl/common/resources/database_object_import_rule_test.go b/tool/tctl/common/resources/database_object_import_rule_test.go
index 28924dae90c..cfe4e5a7608 100644
--- a/tool/tctl/common/resources/database_object_import_rule_test.go
+++ b/tool/tctl/common/resources/database_object_import_rule_test.go
@@ -30,23 +30,23 @@ import (
 func makeDatabaseObjectImportRule(t *testing.T, name string, priority int) *dbobjectimportrulev1.DatabaseObjectImportRule {
 	t.Helper()
 
-	r, err := databaseobjectimportrule.NewDatabaseObjectImportRule(name, &dbobjectimportrulev1.DatabaseObjectImportRuleSpec{
+	r, err := databaseobjectimportrule.NewDatabaseObjectImportRule(name, dbobjectimportrulev1.DatabaseObjectImportRuleSpec_builder{
 		Priority: int32(priority),
 		DatabaseLabels: label.FromMap(map[string][]string{
 			"foo":   {"bar"},
 			"beast": {"dragon", "phoenix"},
 		}),
 		Mappings: []*dbobjectimportrulev1.DatabaseObjectImportRuleMapping{
-			{
-				Match: &dbobjectimportrulev1.DatabaseObjectImportMatch{
+			dbobjectimportrulev1.DatabaseObjectImportRuleMapping_builder{
+				Match: dbobjectimportrulev1.DatabaseObjectImportMatch_builder{
 					TableNames: []string{"dummy"},
-				},
+				}.Build(),
 				AddLabels: map[string]string{
 					"dummy_table": "true",
 					"another":     "label"},
-			},
+			}.Build(),
 		},
-	})
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
diff --git a/tool/tctl/common/resources/database_object_test.go b/tool/tctl/common/resources/database_object_test.go
index b2394fd22d9..a01c2e10315 100644
--- a/tool/tctl/common/resources/database_object_test.go
+++ b/tool/tctl/common/resources/database_object_test.go
@@ -28,12 +28,12 @@ import (
 
 func makeDatabaseObject(t *testing.T, name string) *dbobjectv1.DatabaseObject {
 	t.Helper()
-	r, err := databaseobject.NewDatabaseObject(name, &dbobjectv1.DatabaseObjectSpec{
+	r, err := databaseobject.NewDatabaseObject(name, dbobjectv1.DatabaseObjectSpec_builder{
 		Name:                name,
 		Protocol:            "postgres",
 		DatabaseServiceName: "pg",
 		ObjectKind:          "table",
-	})
+	}.Build())
 	require.NoError(t, err)
 	return r
 }
diff --git a/tool/tctl/common/resources/inference_model.go b/tool/tctl/common/resources/inference_model.go
index 28fb29053bb..5ec656fc6ac 100644
--- a/tool/tctl/common/resources/inference_model.go
+++ b/tool/tctl/common/resources/inference_model.go
@@ -56,7 +56,7 @@ func (c inferenceModelCollection) WriteText(w io.Writer, verbose bool) error {
 		providerModel := ""
 		if spec.GetOpenai() != nil {
 			providerName = "OpenAI"
-			providerModel = spec.GetOpenai().OpenaiModelId
+			providerModel = spec.GetOpenai().GetOpenaiModelId()
 		}
 		rows = append(rows, []string{
 			meta.GetName(),
@@ -97,14 +97,14 @@ func createInferenceModel(ctx context.Context, clt *authclient.Client, raw servi
 
 	sclt := clt.SummarizerServiceClient()
 	if opts.Force {
-		req := &summarizerv1.UpsertInferenceModelRequest{
+		req := summarizerv1.UpsertInferenceModelRequest_builder{
 			Model: model,
-		}
+		}.Build()
 		_, err = sclt.UpsertInferenceModel(ctx, req)
 	} else {
-		req := &summarizerv1.CreateInferenceModelRequest{
+		req := summarizerv1.CreateInferenceModelRequest_builder{
 			Model: model,
-		}
+		}.Build()
 		_, err = sclt.CreateInferenceModel(ctx, req)
 	}
 	if err != nil {
@@ -121,9 +121,9 @@ func updateInferenceModel(ctx context.Context, clt *authclient.Client, raw servi
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	req := &summarizerv1.UpdateInferenceModelRequest{
+	req := summarizerv1.UpdateInferenceModelRequest_builder{
 		Model: model,
-	}
+	}.Build()
 	if _, err := clt.SummarizerServiceClient().UpdateInferenceModel(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
@@ -134,14 +134,14 @@ func updateInferenceModel(ctx context.Context, clt *authclient.Client, raw servi
 func getInferenceModel(ctx context.Context, clt *authclient.Client, ref services.Ref, opts GetOpts) (Collection, error) {
 	ssclt := clt.SummarizerServiceClient()
 	if ref.Name != "" {
-		req := &summarizerv1.GetInferenceModelRequest{
+		req := summarizerv1.GetInferenceModelRequest_builder{
 			Name: ref.Name,
-		}
+		}.Build()
 		res, err := ssclt.GetInferenceModel(ctx, req)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return inferenceModelCollection{res.Model}, nil
+		return inferenceModelCollection{res.GetModel()}, nil
 	}
 
 	items, err := stream.Collect(clientutils.Resources(
@@ -151,9 +151,9 @@ func getInferenceModel(ctx context.Context, clt *authclient.Client, ref services
 		) ([]*summarizerv1.InferenceModel, string, error) {
 			resp, err := ssclt.ListInferenceModels(
 				ctx,
-				&summarizerv1.ListInferenceModelsRequest{
+				summarizerv1.ListInferenceModelsRequest_builder{
 					PageToken: nextPageToken,
-				})
+				}.Build())
 			return resp.GetModels(), resp.GetNextPageToken(), trace.Wrap(err)
 		}))
 	if err != nil {
@@ -163,9 +163,9 @@ func getInferenceModel(ctx context.Context, clt *authclient.Client, ref services
 }
 
 func deleteInferenceModel(ctx context.Context, clt *authclient.Client, ref services.Ref) error {
-	req := &summarizerv1.DeleteInferenceModelRequest{
+	req := summarizerv1.DeleteInferenceModelRequest_builder{
 		Name: ref.Name,
-	}
+	}.Build()
 	if _, err := clt.SummarizerServiceClient().DeleteInferenceModel(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/inference_model_test.go b/tool/tctl/common/resources/inference_model_test.go
index d57bb2a68fc..7c9197552e9 100644
--- a/tool/tctl/common/resources/inference_model_test.go
+++ b/tool/tctl/common/resources/inference_model_test.go
@@ -25,13 +25,11 @@ import (
 )
 
 func makeInferenceModel(name, modelSuffix string) *summarizerv1.InferenceModel {
-	return summarizer.NewInferenceModel(name, &summarizerv1.InferenceModelSpec{
-		Provider: &summarizerv1.InferenceModelSpec_Openai{
-			Openai: &summarizerv1.OpenAIProvider{
-				OpenaiModelId: "gpt-4o" + modelSuffix,
-			},
-		},
-	})
+	return summarizer.NewInferenceModel(name, summarizerv1.InferenceModelSpec_builder{
+		Openai: summarizerv1.OpenAIProvider_builder{
+			OpenaiModelId: "gpt-4o" + modelSuffix,
+		}.Build(),
+	}.Build())
 }
 
 func TestInferenceModelCollection_writeText(t *testing.T) {
diff --git a/tool/tctl/common/resources/inference_policy.go b/tool/tctl/common/resources/inference_policy.go
index 0908f07f947..9c7b6121c9d 100644
--- a/tool/tctl/common/resources/inference_policy.go
+++ b/tool/tctl/common/resources/inference_policy.go
@@ -54,9 +54,9 @@ func (c inferencePolicyCollection) WriteText(w io.Writer, verbose bool) error {
 		rows = append(rows, []string{
 			meta.GetName(),
 			meta.GetDescription(),
-			strings.Join(spec.Kinds, ", "),
-			spec.Filter,
-			spec.Model,
+			strings.Join(spec.GetKinds(), ", "),
+			spec.GetFilter(),
+			spec.GetModel(),
 		})
 	}
 	var t asciitable.Table
@@ -95,14 +95,14 @@ func createInferencePolicy(
 
 	sclt := clt.SummarizerServiceClient()
 	if opts.Force {
-		req := &summarizerv1.UpsertInferencePolicyRequest{
+		req := summarizerv1.UpsertInferencePolicyRequest_builder{
 			Policy: policy,
-		}
+		}.Build()
 		_, err = sclt.UpsertInferencePolicy(ctx, req)
 	} else {
-		req := &summarizerv1.CreateInferencePolicyRequest{
+		req := summarizerv1.CreateInferencePolicyRequest_builder{
 			Policy: policy,
-		}
+		}.Build()
 		_, err = sclt.CreateInferencePolicy(ctx, req)
 	}
 	if err != nil {
@@ -121,9 +121,9 @@ func updateInferencePolicy(
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	req := &summarizerv1.UpdateInferencePolicyRequest{
+	req := summarizerv1.UpdateInferencePolicyRequest_builder{
 		Policy: policy,
-	}
+	}.Build()
 	if _, err := clt.SummarizerServiceClient().UpdateInferencePolicy(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
@@ -136,14 +136,14 @@ func getInferencePolicies(
 ) (Collection, error) {
 	ssclt := clt.SummarizerServiceClient()
 	if ref.Name != "" {
-		req := &summarizerv1.GetInferencePolicyRequest{
+		req := summarizerv1.GetInferencePolicyRequest_builder{
 			Name: ref.Name,
-		}
+		}.Build()
 		res, err := ssclt.GetInferencePolicy(ctx, req)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return inferencePolicyCollection{res.Policy}, nil
+		return inferencePolicyCollection{res.GetPolicy()}, nil
 	}
 
 	items, err := stream.Collect(clientutils.Resources(
@@ -153,9 +153,9 @@ func getInferencePolicies(
 		) ([]*summarizerv1.InferencePolicy, string, error) {
 			resp, err := ssclt.ListInferencePolicies(
 				ctx,
-				&summarizerv1.ListInferencePoliciesRequest{
+				summarizerv1.ListInferencePoliciesRequest_builder{
 					PageToken: nextPageToken,
-				})
+				}.Build())
 			return resp.GetPolicies(), resp.GetNextPageToken(), trace.Wrap(err)
 		}))
 	if err != nil {
@@ -167,9 +167,9 @@ func getInferencePolicies(
 func deleteInferencePolicy(
 	ctx context.Context, clt *authclient.Client, ref services.Ref,
 ) error {
-	req := &summarizerv1.DeleteInferencePolicyRequest{
+	req := summarizerv1.DeleteInferencePolicyRequest_builder{
 		Name: ref.Name,
-	}
+	}.Build()
 	if _, err := clt.SummarizerServiceClient().DeleteInferencePolicy(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/inference_policy_test.go b/tool/tctl/common/resources/inference_policy_test.go
index 32cf22c6b14..4e851c6f45e 100644
--- a/tool/tctl/common/resources/inference_policy_test.go
+++ b/tool/tctl/common/resources/inference_policy_test.go
@@ -25,11 +25,11 @@ import (
 )
 
 func makeInferencePolicy(name, modelSuffix string) *summarizerv1.InferencePolicy {
-	return summarizer.NewInferencePolicy(name, &summarizerv1.InferencePolicySpec{
+	return summarizer.NewInferencePolicy(name, summarizerv1.InferencePolicySpec_builder{
 		Kinds:  []string{"ssh"},
 		Filter: `resource.metadata.labels["env"] == "prod"`,
 		Model:  "some-model" + modelSuffix,
-	})
+	}.Build())
 }
 
 func TestInferencePolicyCollection_writeText(t *testing.T) {
diff --git a/tool/tctl/common/resources/inference_secret.go b/tool/tctl/common/resources/inference_secret.go
index e6103ecc0e6..5c9b7535ea1 100644
--- a/tool/tctl/common/resources/inference_secret.go
+++ b/tool/tctl/common/resources/inference_secret.go
@@ -88,14 +88,14 @@ func createInferenceSecret(ctx context.Context, clt *authclient.Client, raw serv
 
 	sclt := clt.SummarizerServiceClient()
 	if opts.Force {
-		req := &summarizerv1.UpsertInferenceSecretRequest{
+		req := summarizerv1.UpsertInferenceSecretRequest_builder{
 			Secret: secret,
-		}
+		}.Build()
 		_, err = sclt.UpsertInferenceSecret(ctx, req)
 	} else {
-		req := &summarizerv1.CreateInferenceSecretRequest{
+		req := summarizerv1.CreateInferenceSecretRequest_builder{
 			Secret: secret,
-		}
+		}.Build()
 		_, err = sclt.CreateInferenceSecret(ctx, req)
 	}
 	if err != nil {
@@ -112,9 +112,9 @@ func updateInferenceSecret(ctx context.Context, clt *authclient.Client, raw serv
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	req := &summarizerv1.UpdateInferenceSecretRequest{
+	req := summarizerv1.UpdateInferenceSecretRequest_builder{
 		Secret: secret,
-	}
+	}.Build()
 	if _, err := clt.SummarizerServiceClient().UpdateInferenceSecret(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
@@ -125,14 +125,14 @@ func updateInferenceSecret(ctx context.Context, clt *authclient.Client, raw serv
 func getInferenceSecret(ctx context.Context, clt *authclient.Client, ref services.Ref, opts GetOpts) (Collection, error) {
 	ssclt := clt.SummarizerServiceClient()
 	if ref.Name != "" {
-		req := &summarizerv1.GetInferenceSecretRequest{
+		req := summarizerv1.GetInferenceSecretRequest_builder{
 			Name: ref.Name,
-		}
+		}.Build()
 		res, err := ssclt.GetInferenceSecret(ctx, req)
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
-		return inferenceSecretCollection{res.Secret}, nil
+		return inferenceSecretCollection{res.GetSecret()}, nil
 	}
 
 	items, err := stream.Collect(clientutils.Resources(
@@ -142,9 +142,9 @@ func getInferenceSecret(ctx context.Context, clt *authclient.Client, ref service
 		) ([]*summarizerv1.InferenceSecret, string, error) {
 			resp, err := ssclt.ListInferenceSecrets(
 				ctx,
-				&summarizerv1.ListInferenceSecretsRequest{
+				summarizerv1.ListInferenceSecretsRequest_builder{
 					PageToken: nextPageToken,
-				})
+				}.Build())
 			return resp.GetSecrets(), resp.GetNextPageToken(), trace.Wrap(err)
 		}))
 	if err != nil {
@@ -154,9 +154,9 @@ func getInferenceSecret(ctx context.Context, clt *authclient.Client, ref service
 }
 
 func deleteInferenceSecret(ctx context.Context, clt *authclient.Client, ref services.Ref) error {
-	req := &summarizerv1.DeleteInferenceSecretRequest{
+	req := summarizerv1.DeleteInferenceSecretRequest_builder{
 		Name: ref.Name,
-	}
+	}.Build()
 	if _, err := clt.SummarizerServiceClient().DeleteInferenceSecret(ctx, req); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/inference_secret_test.go b/tool/tctl/common/resources/inference_secret_test.go
index d07704d2e69..3fe19aebbb9 100644
--- a/tool/tctl/common/resources/inference_secret_test.go
+++ b/tool/tctl/common/resources/inference_secret_test.go
@@ -25,9 +25,9 @@ import (
 )
 
 func makeInferenceSecret(name string) *summarizerv1.InferenceSecret {
-	return summarizer.NewInferenceSecret(name, &summarizerv1.InferenceSecretSpec{
+	return summarizer.NewInferenceSecret(name, summarizerv1.InferenceSecretSpec_builder{
 		Value: "some-value",
-	})
+	}.Build())
 }
 
 func TestInferenceSecretCollection_writeText(t *testing.T) {
diff --git a/tool/tctl/common/resources/linux_desktop.go b/tool/tctl/common/resources/linux_desktop.go
index f1e40f97951..4f6dd71866f 100644
--- a/tool/tctl/common/resources/linux_desktop.go
+++ b/tool/tctl/common/resources/linux_desktop.go
@@ -61,8 +61,8 @@ func (c *linuxDesktopCollection) Resources() (r []types.Resource) {
 func (c *linuxDesktopCollection) WriteText(w io.Writer, verbose bool) error {
 	var rows [][]string
 	for _, d := range c.desktops {
-		labels := common.FormatLabels(d.Metadata.Labels, verbose)
-		rows = append(rows, []string{d.Metadata.Name, d.Spec.Addr, d.Spec.Hostname, labels})
+		labels := common.FormatLabels(d.GetMetadata().GetLabels(), verbose)
+		rows = append(rows, []string{d.GetMetadata().GetName(), d.GetSpec().GetAddr(), d.GetSpec().GetHostname(), labels})
 	}
 	headers := []string{"Name", "Address", "Hostname", "Labels"}
 	var t asciitable.Table
@@ -116,18 +116,18 @@ func createLinuxDesktop(ctx context.Context, client *authclient.Client, raw serv
 	if _, err := linuxDesktopClient.CreateLinuxDesktop(ctx, desktop); err != nil {
 		if trace.IsAlreadyExists(err) {
 			if !opts.Force {
-				return trace.AlreadyExists("linux desktop %q already exists", desktop.Metadata.Name)
+				return trace.AlreadyExists("linux desktop %q already exists", desktop.GetMetadata().GetName())
 			}
 			if _, err := linuxDesktopClient.UpsertLinuxDesktop(ctx, desktop); err != nil {
 				return trace.Wrap(err)
 			}
-			fmt.Printf("linux desktop %q has been updated\n", desktop.Metadata.Name)
+			fmt.Printf("linux desktop %q has been updated\n", desktop.GetMetadata().GetName())
 			return nil
 		}
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("linux desktop %q has been created\n", desktop.Metadata.Name)
+	fmt.Printf("linux desktop %q has been created\n", desktop.GetMetadata().GetName())
 	return nil
 }
 
@@ -142,6 +142,6 @@ func updateLinuxDesktop(ctx context.Context, client *authclient.Client, raw serv
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("linux desktop %q has been updated\n", desktop.Metadata.Name)
+	fmt.Printf("linux desktop %q has been updated\n", desktop.GetMetadata().GetName())
 	return nil
 }
diff --git a/tool/tctl/common/resources/linux_desktop_test.go b/tool/tctl/common/resources/linux_desktop_test.go
index f97c0a6a101..6694af4a857 100644
--- a/tool/tctl/common/resources/linux_desktop_test.go
+++ b/tool/tctl/common/resources/linux_desktop_test.go
@@ -30,18 +30,18 @@ import (
 )
 
 func makeLinuxDesktop(name, addr, hostname string, labels map[string]string) *linuxdesktopv1.LinuxDesktop {
-	return &linuxdesktopv1.LinuxDesktop{
+	return linuxdesktopv1.LinuxDesktop_builder{
 		Kind:    types.KindLinuxDesktop,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:   name,
 			Labels: labels,
-		},
-		Spec: &linuxdesktopv1.LinuxDesktopSpec{
+		}.Build(),
+		Spec: linuxdesktopv1.LinuxDesktopSpec_builder{
 			Addr:     addr,
 			Hostname: hostname,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
 
 func TestLinuxDesktopCollection_WriteText(t *testing.T) {
diff --git a/tool/tctl/common/resources/login_rule.go b/tool/tctl/common/resources/login_rule.go
index b052bfcbb91..aee6ad42ad7 100644
--- a/tool/tctl/common/resources/login_rule.go
+++ b/tool/tctl/common/resources/login_rule.go
@@ -73,10 +73,10 @@ func getLoginRule(ctx context.Context, client *authclient.Client, ref services.R
 	loginRuleClient := client.LoginRuleClient()
 	if ref.Name == "" {
 		rules, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, token string) ([]*loginrulepb.LoginRule, string, error) {
-			resp, err := loginRuleClient.ListLoginRules(ctx, &loginrulepb.ListLoginRulesRequest{
+			resp, err := loginRuleClient.ListLoginRules(ctx, loginrulepb.ListLoginRulesRequest_builder{
 				PageSize:  int32(limit),
 				PageToken: token,
-			})
+			}.Build())
 			return resp.GetLoginRules(), resp.GetNextPageToken(), trace.Wrap(err)
 		}))
 		if err != nil {
@@ -85,9 +85,9 @@ func getLoginRule(ctx context.Context, client *authclient.Client, ref services.R
 
 		return &loginRuleCollection{rules}, nil
 	}
-	rule, err := loginRuleClient.GetLoginRule(ctx, &loginrulepb.GetLoginRuleRequest{
+	rule, err := loginRuleClient.GetLoginRule(ctx, loginrulepb.GetLoginRuleRequest_builder{
 		Name: ref.Name,
-	})
+	}.Build())
 	if err != nil {
 		return nil, trail.FromGRPC(err)
 	}
@@ -102,16 +102,16 @@ func createLoginRule(ctx context.Context, client *authclient.Client, raw service
 
 	loginRuleClient := client.LoginRuleClient()
 	if opts.Force {
-		_, err := loginRuleClient.UpsertLoginRule(ctx, &loginrulepb.UpsertLoginRuleRequest{
+		_, err := loginRuleClient.UpsertLoginRule(ctx, loginrulepb.UpsertLoginRuleRequest_builder{
 			LoginRule: rule,
-		})
+		}.Build())
 		if err != nil {
 			return trail.FromGRPC(err)
 		}
 	} else {
-		_, err = loginRuleClient.CreateLoginRule(ctx, &loginrulepb.CreateLoginRuleRequest{
+		_, err = loginRuleClient.CreateLoginRule(ctx, loginrulepb.CreateLoginRuleRequest_builder{
 			LoginRule: rule,
-		})
+		}.Build())
 		if err != nil {
 			return trail.FromGRPC(err)
 		}
@@ -123,9 +123,9 @@ func createLoginRule(ctx context.Context, client *authclient.Client, raw service
 
 func deleteLoginRule(ctx context.Context, client *authclient.Client, ref services.Ref) error {
 	loginRuleClient := client.LoginRuleClient()
-	_, err := loginRuleClient.DeleteLoginRule(ctx, &loginrulepb.DeleteLoginRuleRequest{
+	_, err := loginRuleClient.DeleteLoginRule(ctx, loginrulepb.DeleteLoginRuleRequest_builder{
 		Name: ref.Name,
-	})
+	}.Build())
 	if err != nil {
 		return trail.FromGRPC(err)
 	}
diff --git a/tool/tctl/common/resources/resource_test.go b/tool/tctl/common/resources/resource_test.go
index db3b91589e4..1324527d608 100644
--- a/tool/tctl/common/resources/resource_test.go
+++ b/tool/tctl/common/resources/resource_test.go
@@ -207,23 +207,23 @@ func TestHandlers(t *testing.T) {
 			kind: types.KindUserTask,
 			makeResource: func(t *testing.T, name string) types.Resource {
 				t.Helper()
-				userTask, err := usertasks.NewDiscoverEC2UserTask(&usertasksv1.UserTaskSpec{
+				userTask, err := usertasks.NewDiscoverEC2UserTask(usertasksv1.UserTaskSpec_builder{
 					Integration: name + "-integration",
 					TaskType:    "discover-ec2",
 					IssueType:   "ec2-ssm-invocation-failure",
 					State:       "OPEN",
-					DiscoverEc2: &usertasksv1.DiscoverEC2{
+					DiscoverEc2: usertasksv1.DiscoverEC2_builder{
 						AccountId: "123456789012",
 						Region:    "us-east-1",
 						Instances: map[string]*usertasksv1.DiscoverEC2Instance{
-							"i-123": {
+							"i-123": usertasksv1.DiscoverEC2Instance_builder{
 								InstanceId:      "i-123",
 								DiscoveryConfig: "dc01",
 								DiscoveryGroup:  "dg01",
-							},
+							}.Build(),
 						},
-					},
-				})
+					}.Build(),
+				}.Build())
 				require.NoError(t, err)
 				return types.ProtoResource153ToLegacy(userTask)
 			},
@@ -237,32 +237,32 @@ func TestHandlers(t *testing.T) {
 			kind: types.KindAccessMonitoringRule,
 			makeResource: func(t *testing.T, name string) types.Resource {
 				t.Helper()
-				accessMonitoringRule, err := services.NewAccessMonitoringRuleWithLabels(name, nil, &accessmonitoringrulesv1.AccessMonitoringRuleSpec{
+				accessMonitoringRule, err := services.NewAccessMonitoringRuleWithLabels(name, nil, accessmonitoringrulesv1.AccessMonitoringRuleSpec_builder{
 					Subjects:  []string{types.KindAccessRequest},
 					Condition: "true",
-					Notification: &accessmonitoringrulesv1.Notification{
+					Notification: accessmonitoringrulesv1.Notification_builder{
 						Name:       name + "-notification",
 						Recipients: []string{"recipient"},
-					},
-					AutomaticReview: &accessmonitoringrulesv1.AutomaticReview{
+					}.Build(),
+					AutomaticReview: accessmonitoringrulesv1.AutomaticReview_builder{
 						Integration: name + "-review",
 						Decision:    types.RequestState_APPROVED.String(),
-					},
+					}.Build(),
 					DesiredState: types.AccessMonitoringRuleStateReviewed,
 					Schedules: map[string]*accessmonitoringrulesv1.Schedule{
-						"default": {
-							Time: &accessmonitoringrulesv1.TimeSchedule{
+						"default": accessmonitoringrulesv1.Schedule_builder{
+							Time: accessmonitoringrulesv1.TimeSchedule_builder{
 								Shifts: []*accessmonitoringrulesv1.TimeSchedule_Shift{
-									{
+									accessmonitoringrulesv1.TimeSchedule_Shift_builder{
 										Weekday: time.Monday.String(),
 										Start:   "00:00",
 										End:     "23:59",
-									},
+									}.Build(),
 								},
-							},
-						},
+							}.Build(),
+						}.Build(),
 					},
-				})
+				}.Build())
 				require.NoError(t, err)
 				return types.ProtoResource153ToLegacy(accessMonitoringRule)
 			},
diff --git a/tool/tctl/common/resources/retrieval_model.go b/tool/tctl/common/resources/retrieval_model.go
index 5ffdd7e9f94..e78dd4b0c5c 100644
--- a/tool/tctl/common/resources/retrieval_model.go
+++ b/tool/tctl/common/resources/retrieval_model.go
@@ -98,13 +98,13 @@ func createRetrievalModel(ctx context.Context, clt *authclient.Client, raw servi
 
 	sclt := clt.SummarizerServiceClient()
 	if opts.Force {
-		_, err = sclt.UpsertRetrievalModel(ctx, &summarizerv1.UpsertRetrievalModelRequest{
+		_, err = sclt.UpsertRetrievalModel(ctx, summarizerv1.UpsertRetrievalModelRequest_builder{
 			Model: model,
-		})
+		}.Build())
 	} else {
-		_, err = sclt.CreateRetrievalModel(ctx, &summarizerv1.CreateRetrievalModelRequest{
+		_, err = sclt.CreateRetrievalModel(ctx, summarizerv1.CreateRetrievalModelRequest_builder{
 			Model: model,
-		})
+		}.Build())
 	}
 	if err != nil {
 		return trace.Wrap(err)
@@ -120,9 +120,9 @@ func updateRetrievalModel(ctx context.Context, clt *authclient.Client, raw servi
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	if _, err := clt.SummarizerServiceClient().UpdateRetrievalModel(ctx, &summarizerv1.UpdateRetrievalModelRequest{
+	if _, err := clt.SummarizerServiceClient().UpdateRetrievalModel(ctx, summarizerv1.UpdateRetrievalModelRequest_builder{
 		Model: model,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Printf("retrieval_model %q has been updated\n", model.GetMetadata().GetName())
diff --git a/tool/tctl/common/resources/scoped_role.go b/tool/tctl/common/resources/scoped_role.go
index 70d8c8de9cd..e6f4f4bcf33 100644
--- a/tool/tctl/common/resources/scoped_role.go
+++ b/tool/tctl/common/resources/scoped_role.go
@@ -83,9 +83,9 @@ func createScopedRole(ctx context.Context, client *authclient.Client, raw servic
 	}
 
 	if opts.Force {
-		rsp, err := client.ScopedAccessServiceClient().UpsertScopedRole(ctx, &scopedaccessv1.UpsertScopedRoleRequest{
+		rsp, err := client.ScopedAccessServiceClient().UpsertScopedRole(ctx, scopedaccessv1.UpsertScopedRoleRequest_builder{
 			Role: r,
-		})
+		}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -97,9 +97,9 @@ func createScopedRole(ctx context.Context, client *authclient.Client, raw servic
 		return nil
 	}
 
-	if _, err := client.ScopedAccessServiceClient().CreateScopedRole(ctx, &scopedaccessv1.CreateScopedRoleRequest{
+	if _, err := client.ScopedAccessServiceClient().CreateScopedRole(ctx, scopedaccessv1.CreateScopedRoleRequest_builder{
 		Role: r,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -118,9 +118,9 @@ func updateScopedRole(ctx context.Context, client *authclient.Client, raw servic
 		return trace.Wrap(err)
 	}
 
-	if _, err = client.ScopedAccessServiceClient().UpdateScopedRole(ctx, &scopedaccessv1.UpdateScopedRoleRequest{
+	if _, err = client.ScopedAccessServiceClient().UpdateScopedRole(ctx, scopedaccessv1.UpdateScopedRoleRequest_builder{
 		Role: r,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -135,14 +135,14 @@ func updateScopedRole(ctx context.Context, client *authclient.Client, raw servic
 
 func getScopedRole(ctx context.Context, client *authclient.Client, ref services.Ref, opts GetOpts) (Collection, error) {
 	if ref.Name != "" {
-		rsp, err := client.ScopedAccessServiceClient().GetScopedRole(ctx, &scopedaccessv1.GetScopedRoleRequest{
+		rsp, err := client.ScopedAccessServiceClient().GetScopedRole(ctx, scopedaccessv1.GetScopedRoleRequest_builder{
 			Name: ref.Name,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		return &scopedRoleCollection{roles: []*scopedaccessv1.ScopedRole{rsp.Role}}, nil
+		return &scopedRoleCollection{roles: []*scopedaccessv1.ScopedRole{rsp.GetRole()}}, nil
 	}
 
 	items, err := stream.Collect(scopedutils.RangeScopedRoles(ctx, client.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRolesRequest{}))
@@ -153,9 +153,9 @@ func getScopedRole(ctx context.Context, client *authclient.Client, ref services.
 }
 
 func deleteScopedRole(ctx context.Context, client *authclient.Client, ref services.Ref) error {
-	if _, err := client.ScopedAccessServiceClient().DeleteScopedRole(ctx, &scopedaccessv1.DeleteScopedRoleRequest{
+	if _, err := client.ScopedAccessServiceClient().DeleteScopedRole(ctx, scopedaccessv1.DeleteScopedRoleRequest_builder{
 		Name: ref.Name,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Printf(
diff --git a/tool/tctl/common/resources/scoped_role_assignment.go b/tool/tctl/common/resources/scoped_role_assignment.go
index 0b41986dcb2..764626ecc26 100644
--- a/tool/tctl/common/resources/scoped_role_assignment.go
+++ b/tool/tctl/common/resources/scoped_role_assignment.go
@@ -97,9 +97,9 @@ func createScopedRoleAssignment(ctx context.Context, client *authclient.Client,
 	// created and the user is re-applying the same resource file). if there is no name, fall through
 	// to create, which will generate one server-side.
 	if opts.Force && r.GetMetadata().GetName() != "" {
-		rsp, err := client.ScopedAccessServiceClient().UpsertScopedRoleAssignment(ctx, &scopedaccessv1.UpsertScopedRoleAssignmentRequest{
+		rsp, err := client.ScopedAccessServiceClient().UpsertScopedRoleAssignment(ctx, scopedaccessv1.UpsertScopedRoleAssignmentRequest_builder{
 			Assignment: r,
-		})
+		}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
@@ -111,9 +111,9 @@ func createScopedRoleAssignment(ctx context.Context, client *authclient.Client,
 		return nil
 	}
 
-	rsp, err := client.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+	rsp, err := client.ScopedAccessServiceClient().CreateScopedRoleAssignment(ctx, scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 		Assignment: r,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -133,9 +133,9 @@ func updateScopedRoleAssignment(ctx context.Context, client *authclient.Client,
 		return trace.Wrap(err)
 	}
 
-	if _, err = client.ScopedAccessServiceClient().UpdateScopedRoleAssignment(ctx, &scopedaccessv1.UpdateScopedRoleAssignmentRequest{
+	if _, err = client.ScopedAccessServiceClient().UpdateScopedRoleAssignment(ctx, scopedaccessv1.UpdateScopedRoleAssignmentRequest_builder{
 		Assignment: r,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 
@@ -153,15 +153,15 @@ func getScopedRoleAssignment(ctx context.Context, client *authclient.Client, ref
 		if ref.SubKind == "" {
 			return nil, trace.BadParameter("scoped_role_assignment requires an explicit subkind when getting a single resource, try: tctl get scoped_role_assignment/dynamic/%s", ref.Name)
 		}
-		rsp, err := client.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, &scopedaccessv1.GetScopedRoleAssignmentRequest{
+		rsp, err := client.ScopedAccessServiceClient().GetScopedRoleAssignment(ctx, scopedaccessv1.GetScopedRoleAssignmentRequest_builder{
 			Name:    ref.Name,
 			SubKind: ref.SubKind,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		return &ScopedRoleAssignmentCollection{roleAssignments: []*scopedaccessv1.ScopedRoleAssignment{rsp.Assignment}}, nil
+		return &ScopedRoleAssignmentCollection{roleAssignments: []*scopedaccessv1.ScopedRoleAssignment{rsp.GetAssignment()}}, nil
 	}
 
 	items, err := stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, client.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{}))
@@ -178,10 +178,10 @@ func deleteScopedRoleAssignment(ctx context.Context, client *authclient.Client,
 	if ref.SubKind == scopedaccess.SubKindMaterialized {
 		return trace.BadParameter("%s scoped_role_assignments are derived from access lists and cannot be deleted directly", scopedaccess.SubKindMaterialized)
 	}
-	if _, err := client.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, &scopedaccessv1.DeleteScopedRoleAssignmentRequest{
+	if _, err := client.ScopedAccessServiceClient().DeleteScopedRoleAssignment(ctx, scopedaccessv1.DeleteScopedRoleAssignmentRequest_builder{
 		Name:    ref.Name,
 		SubKind: ref.SubKind,
-	}); err != nil {
+	}.Build()); err != nil {
 		return trace.Wrap(err)
 	}
 	fmt.Printf(
diff --git a/tool/tctl/common/resources/scoped_token.go b/tool/tctl/common/resources/scoped_token.go
index dd5e477dcc6..f38c08166e3 100644
--- a/tool/tctl/common/resources/scoped_token.go
+++ b/tool/tctl/common/resources/scoped_token.go
@@ -119,32 +119,32 @@ func getScopedToken(ctx context.Context, client *authclient.Client, ref services
 			return nil, trace.Wrap(err)
 		}
 		if !opts.WithSecrets && token.GetStatus().GetSecret() != "" {
-			token.GetStatus().Secret = "******"
+			token.GetStatus().SetSecret("******")
 		}
 		// As a note, this seems to be dead code, these secrets are always empty
 		// if WithSecrets is unset, since the server will strip the value.
 		if !opts.WithSecrets && token.GetStatus().GetUsage().GetBoundKeypair().GetRegistrationSecret() != "" {
-			token.GetStatus().GetUsage().GetBoundKeypair().RegistrationSecret = "******"
+			token.GetStatus().GetUsage().GetBoundKeypair().SetRegistrationSecret("******")
 		}
 		return &scopedTokenCollection{[]*joiningv1.ScopedToken{token}}, nil
 	}
 
 	tokens, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageKey string) ([]*joiningv1.ScopedToken, string, error) {
-		res, err := client.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{
+		res, err := client.ListScopedTokens(ctx, joiningv1.ListScopedTokensRequest_builder{
 			Limit:       uint32(pageSize),
 			Cursor:      pageKey,
 			WithSecrets: opts.WithSecrets,
-		})
+		}.Build())
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
 		if !opts.WithSecrets {
 			for _, token := range res.GetTokens() {
 				if token.GetStatus().GetSecret() != "" {
-					token.GetStatus().Secret = "******"
+					token.GetStatus().SetSecret("******")
 				}
 				if token.GetStatus().GetUsage().GetBoundKeypair().GetRegistrationSecret() != "" {
-					token.GetStatus().GetUsage().GetBoundKeypair().RegistrationSecret = "******"
+					token.GetStatus().GetUsage().GetBoundKeypair().SetRegistrationSecret("******")
 				}
 			}
 		}
@@ -198,7 +198,7 @@ func ScopedTokenTextHelper(tokens []*joiningv1.ScopedToken, withSecrets bool) *b
 			strings.Join(t.GetSpec().GetRoles(), ","),
 			t.GetScope(),
 			t.GetSpec().GetAssignedScope(),
-			PrintMetadataLabels(t.GetMetadata().Labels),
+			PrintMetadataLabels(t.GetMetadata().GetLabels()),
 			expiry,
 		}
 		if withSecrets {
diff --git a/tool/tctl/common/resources/sigstore_policy.go b/tool/tctl/common/resources/sigstore_policy.go
index 359fe0b21b3..75f393ac7cf 100644
--- a/tool/tctl/common/resources/sigstore_policy.go
+++ b/tool/tctl/common/resources/sigstore_policy.go
@@ -47,7 +47,7 @@ func (c *sigstorePolicyCollection) Resources() []types.Resource {
 func (c *sigstorePolicyCollection) WriteText(w io.Writer, verbose bool) error {
 	t := asciitable.MakeTable([]string{"Name"})
 	for _, policy := range c.items {
-		t.AddRow([]string{policy.Metadata.Name})
+		t.AddRow([]string{policy.GetMetadata().GetName()})
 	}
 	return trace.Wrap(t.WriteTo(w))
 }
@@ -74,9 +74,9 @@ func getSigstorePolicy(
 	if ref.Name != "" {
 		r, err := c.GetSigstorePolicy(
 			ctx,
-			&workloadidentityv1pb.GetSigstorePolicyRequest{
+			workloadidentityv1pb.GetSigstorePolicyRequest_builder{
 				Name: ref.Name,
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -90,10 +90,10 @@ func getSigstorePolicy(
 		clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.SigstorePolicy, string, error) {
 			resp, err := c.ListSigstorePolicies(
 				ctx,
-				&workloadidentityv1pb.ListSigstorePoliciesRequest{
+				workloadidentityv1pb.ListSigstorePoliciesRequest_builder{
 					PageSize:  int32(limit),
 					PageToken: pageToken,
-				},
+				}.Build(),
 			)
 
 			return resp.GetSigstorePolicies(), resp.GetNextPageToken(), trace.Wrap(err)
@@ -114,9 +114,9 @@ func deleteSigstorePolicy(
 	c := client.SigstorePolicyResourceServiceClient()
 	if _, err := c.DeleteSigstorePolicy(
 		ctx,
-		&workloadidentityv1pb.DeleteSigstorePolicyRequest{
+		workloadidentityv1pb.DeleteSigstorePolicyRequest_builder{
 			Name: ref.Name,
-		},
+		}.Build(),
 	); err != nil {
 		return trace.Wrap(err)
 	}
@@ -144,18 +144,18 @@ func createSigstorePolicy(
 	if opts.Force {
 		if _, err := c.UpsertSigstorePolicy(
 			ctx,
-			&workloadidentityv1pb.UpsertSigstorePolicyRequest{
+			workloadidentityv1pb.UpsertSigstorePolicyRequest_builder{
 				SigstorePolicy: r,
-			},
+			}.Build(),
 		); err != nil {
 			return trace.Wrap(err)
 		}
 	} else {
 		if _, err := c.CreateSigstorePolicy(
 			ctx,
-			&workloadidentityv1pb.CreateSigstorePolicyRequest{
+			workloadidentityv1pb.CreateSigstorePolicyRequest_builder{
 				SigstorePolicy: r,
-			},
+			}.Build(),
 		); err != nil {
 			return trace.Wrap(err)
 		}
@@ -184,9 +184,9 @@ func updateSigstorePolicy(
 	c := client.SigstorePolicyResourceServiceClient()
 	if _, err = c.UpdateSigstorePolicy(
 		ctx,
-		&workloadidentityv1pb.UpdateSigstorePolicyRequest{
+		workloadidentityv1pb.UpdateSigstorePolicyRequest_builder{
 			SigstorePolicy: r,
-		},
+		}.Build(),
 	); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/spiffe_federation.go b/tool/tctl/common/resources/spiffe_federation.go
index 1921c820248..3a072197a02 100644
--- a/tool/tctl/common/resources/spiffe_federation.go
+++ b/tool/tctl/common/resources/spiffe_federation.go
@@ -53,7 +53,7 @@ func (c *spiffeFederationCollection) WriteText(w io.Writer, verbose bool) error
 			lastSynced = t.Format(time.RFC3339)
 		}
 		rows = append(rows, []string{
-			item.Metadata.Name,
+			item.GetMetadata().GetName(),
 			lastSynced,
 		})
 	}
@@ -85,9 +85,9 @@ func getSPIFFEFederation(
 ) (Collection, error) {
 	c := client.SPIFFEFederationServiceClient()
 	if ref.Name != "" {
-		resource, err := c.GetSPIFFEFederation(ctx, &machineidv1pb.GetSPIFFEFederationRequest{
+		resource, err := c.GetSPIFFEFederation(ctx, machineidv1pb.GetSPIFFEFederationRequest_builder{
 			Name: ref.Name,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -97,19 +97,19 @@ func getSPIFFEFederation(
 	var resources []*machineidv1pb.SPIFFEFederation
 	pageToken := ""
 	for {
-		resp, err := c.ListSPIFFEFederations(ctx, &machineidv1pb.ListSPIFFEFederationsRequest{
+		resp, err := c.ListSPIFFEFederations(ctx, machineidv1pb.ListSPIFFEFederationsRequest_builder{
 			PageToken: pageToken,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
 
-		resources = append(resources, resp.SpiffeFederations...)
+		resources = append(resources, resp.GetSpiffeFederations()...)
 
-		if resp.NextPageToken == "" {
+		if resp.GetNextPageToken() == "" {
 			break
 		}
-		pageToken = resp.NextPageToken
+		pageToken = resp.GetNextPageToken()
 	}
 
 	return &spiffeFederationCollection{items: resources}, nil
@@ -127,9 +127,9 @@ func createSPIFFEFederation(
 	}
 
 	c := client.SPIFFEFederationServiceClient()
-	_, err = c.CreateSPIFFEFederation(ctx, &machineidv1pb.CreateSPIFFEFederationRequest{
+	_, err = c.CreateSPIFFEFederation(ctx, machineidv1pb.CreateSPIFFEFederationRequest_builder{
 		SpiffeFederation: in,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -144,9 +144,9 @@ func deleteSPIFFEFederation(
 ) error {
 	c := client.SPIFFEFederationServiceClient()
 	_, err := c.DeleteSPIFFEFederation(
-		ctx, &machineidv1pb.DeleteSPIFFEFederationRequest{
+		ctx, machineidv1pb.DeleteSPIFFEFederationRequest_builder{
 			Name: ref.Name,
-		})
+		}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/static_host_user.go b/tool/tctl/common/resources/static_host_user.go
index 8530f664b4a..ef0a77456ea 100644
--- a/tool/tctl/common/resources/static_host_user.go
+++ b/tool/tctl/common/resources/static_host_user.go
@@ -59,25 +59,25 @@ func (c *staticHostUserCollection) WriteText(w io.Writer, verbose bool) error {
 	var rows [][]string
 	for _, item := range c.items {
 
-		for _, matcher := range item.Spec.Matchers {
-			labelMap := label.ToMap(matcher.NodeLabels)
+		for _, matcher := range item.GetSpec().GetMatchers() {
+			labelMap := label.ToMap(matcher.GetNodeLabels())
 			labelStringMap := make(map[string]string, len(labelMap))
 			for k, vals := range labelMap {
 				labelStringMap[k] = fmt.Sprintf("[%s]", printSortedStringSlice(vals))
 			}
 			var uid string
-			if matcher.Uid != 0 {
-				uid = strconv.Itoa(int(matcher.Uid))
+			if matcher.GetUid() != 0 {
+				uid = strconv.Itoa(int(matcher.GetUid()))
 			}
 			var gid string
-			if matcher.Gid != 0 {
-				gid = strconv.Itoa(int(matcher.Gid))
+			if matcher.GetGid() != 0 {
+				gid = strconv.Itoa(int(matcher.GetGid()))
 			}
 			rows = append(rows, []string{
-				item.GetMetadata().Name,
+				item.GetMetadata().GetName(),
 				common.FormatLabels(labelStringMap, verbose),
-				matcher.NodeLabelsExpression,
-				printSortedStringSlice(matcher.Groups),
+				matcher.GetNodeLabelsExpression(),
+				printSortedStringSlice(matcher.GetGroups()),
 				uid,
 				gid,
 			})
@@ -151,12 +151,12 @@ func createStaticHostUser(
 		if _, err := c.UpsertStaticHostUser(ctx, hostUser); err != nil {
 			return trace.Wrap(err)
 		}
-		fmt.Printf("static host user %q has been updated\n", hostUser.GetMetadata().Name)
+		fmt.Printf("static host user %q has been updated\n", hostUser.GetMetadata().GetName())
 	} else {
 		if _, err := c.CreateStaticHostUser(ctx, hostUser); err != nil {
 			return trace.Wrap(err)
 		}
-		fmt.Printf("static host user %q has been created\n", hostUser.GetMetadata().Name)
+		fmt.Printf("static host user %q has been created\n", hostUser.GetMetadata().GetName())
 	}
 
 	return nil
@@ -175,7 +175,7 @@ func updateStaticHostUser(
 	if _, err := client.StaticHostUserClient().UpdateStaticHostUser(ctx, hostUser); err != nil {
 		return trace.Wrap(err)
 	}
-	fmt.Printf("static host user %q has been updated\n", hostUser.GetMetadata().Name)
+	fmt.Printf("static host user %q has been updated\n", hostUser.GetMetadata().GetName())
 	return nil
 }
 
diff --git a/tool/tctl/common/resources/summarizer_service_test.go b/tool/tctl/common/resources/summarizer_service_test.go
index 61ff25b120c..be93f0b245b 100644
--- a/tool/tctl/common/resources/summarizer_service_test.go
+++ b/tool/tctl/common/resources/summarizer_service_test.go
@@ -45,142 +45,142 @@ func registerMockSummarizerServiceServer(svc grpc.ServiceRegistrar) {
 }
 
 func (m *mockSummarizerServiceServer) ListInferenceModels(context.Context, *summarizerv1.ListInferenceModelsRequest) (*summarizerv1.ListInferenceModelsResponse, error) {
-	return &summarizerv1.ListInferenceModelsResponse{
+	return summarizerv1.ListInferenceModelsResponse_builder{
 		Models:        slices.Concat(slices.Collect(maps.Values(m.models))),
 		NextPageToken: "",
-	}, nil
+	}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) CreateInferenceModel(ctx context.Context, req *summarizerv1.CreateInferenceModelRequest) (*summarizerv1.CreateInferenceModelResponse, error) {
-	name := req.Model.Metadata.Name
+	name := req.GetModel().GetMetadata().GetName()
 	if _, exists := m.models[name]; exists {
 		return nil, trace.AlreadyExists("inference model %q already exists", name)
 	}
-	m.models[name] = req.Model
-	return &summarizerv1.CreateInferenceModelResponse{Model: req.Model}, nil
+	m.models[name] = req.GetModel()
+	return summarizerv1.CreateInferenceModelResponse_builder{Model: req.GetModel()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) GetInferenceModel(ctx context.Context, req *summarizerv1.GetInferenceModelRequest) (*summarizerv1.GetInferenceModelResponse, error) {
-	model, exists := m.models[req.Name]
+	model, exists := m.models[req.GetName()]
 	if !exists {
-		return nil, trace.NotFound("inference model %q not found", req.Name)
+		return nil, trace.NotFound("inference model %q not found", req.GetName())
 	}
-	return &summarizerv1.GetInferenceModelResponse{Model: model}, nil
+	return summarizerv1.GetInferenceModelResponse_builder{Model: model}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) UpdateInferenceModel(ctx context.Context, req *summarizerv1.UpdateInferenceModelRequest) (*summarizerv1.UpdateInferenceModelResponse, error) {
-	name := req.Model.Metadata.Name
+	name := req.GetModel().GetMetadata().GetName()
 	if _, exists := m.models[name]; !exists {
 		return nil, trace.NotFound("inference model %q not found", name)
 	}
-	req.Model.Metadata.Revision = uuid.NewString()
-	m.models[name] = req.Model
-	return &summarizerv1.UpdateInferenceModelResponse{Model: req.Model}, nil
+	req.GetModel().GetMetadata().SetRevision(uuid.NewString())
+	m.models[name] = req.GetModel()
+	return summarizerv1.UpdateInferenceModelResponse_builder{Model: req.GetModel()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) UpsertInferenceModel(ctx context.Context, req *summarizerv1.UpsertInferenceModelRequest) (*summarizerv1.UpsertInferenceModelResponse, error) {
-	m.models[req.Model.Metadata.Name] = req.Model
-	return &summarizerv1.UpsertInferenceModelResponse{Model: req.Model}, nil
+	m.models[req.GetModel().GetMetadata().GetName()] = req.GetModel()
+	return summarizerv1.UpsertInferenceModelResponse_builder{Model: req.GetModel()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) DeleteInferenceModel(ctx context.Context, req *summarizerv1.DeleteInferenceModelRequest) (*summarizerv1.DeleteInferenceModelResponse, error) {
-	if _, exists := m.models[req.Name]; !exists {
-		return nil, trace.NotFound("inference model %q not found", req.Name)
+	if _, exists := m.models[req.GetName()]; !exists {
+		return nil, trace.NotFound("inference model %q not found", req.GetName())
 	}
-	delete(m.models, req.Name)
+	delete(m.models, req.GetName())
 	return &summarizerv1.DeleteInferenceModelResponse{}, nil
 }
 
 func (m *mockSummarizerServiceServer) ListInferenceSecrets(context.Context, *summarizerv1.ListInferenceSecretsRequest) (*summarizerv1.ListInferenceSecretsResponse, error) {
-	return &summarizerv1.ListInferenceSecretsResponse{
+	return summarizerv1.ListInferenceSecretsResponse_builder{
 		Secrets:       slices.Concat(slices.Collect(maps.Values(m.secrets))),
 		NextPageToken: "",
-	}, nil
+	}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) CreateInferenceSecret(ctx context.Context, req *summarizerv1.CreateInferenceSecretRequest) (*summarizerv1.CreateInferenceSecretResponse, error) {
-	name := req.Secret.Metadata.Name
+	name := req.GetSecret().GetMetadata().GetName()
 	if _, exists := m.secrets[name]; exists {
 		return nil, trace.AlreadyExists("inference secret %q already exists", name)
 	}
-	m.secrets[name] = req.Secret
-	return &summarizerv1.CreateInferenceSecretResponse{Secret: req.Secret}, nil
+	m.secrets[name] = req.GetSecret()
+	return summarizerv1.CreateInferenceSecretResponse_builder{Secret: req.GetSecret()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) GetInferenceSecret(ctx context.Context, req *summarizerv1.GetInferenceSecretRequest) (*summarizerv1.GetInferenceSecretResponse, error) {
-	secret, exists := m.secrets[req.Name]
+	secret, exists := m.secrets[req.GetName()]
 	if !exists {
-		return nil, trace.NotFound("inference secret %q not found", req.Name)
+		return nil, trace.NotFound("inference secret %q not found", req.GetName())
 	}
-	return &summarizerv1.GetInferenceSecretResponse{Secret: secret}, nil
+	return summarizerv1.GetInferenceSecretResponse_builder{Secret: secret}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) UpdateInferenceSecret(ctx context.Context, req *summarizerv1.UpdateInferenceSecretRequest) (*summarizerv1.UpdateInferenceSecretResponse, error) {
-	name := req.Secret.Metadata.Name
+	name := req.GetSecret().GetMetadata().GetName()
 	if _, exists := m.secrets[name]; !exists {
 		return nil, trace.NotFound("inference secret %q not found", name)
 	}
-	req.Secret.Metadata.Revision = uuid.NewString()
-	m.secrets[name] = req.Secret
-	return &summarizerv1.UpdateInferenceSecretResponse{Secret: req.Secret}, nil
+	req.GetSecret().GetMetadata().SetRevision(uuid.NewString())
+	m.secrets[name] = req.GetSecret()
+	return summarizerv1.UpdateInferenceSecretResponse_builder{Secret: req.GetSecret()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) UpsertInferenceSecret(ctx context.Context, req *summarizerv1.UpsertInferenceSecretRequest) (*summarizerv1.UpsertInferenceSecretResponse, error) {
-	m.secrets[req.Secret.Metadata.Name] = req.Secret
-	return &summarizerv1.UpsertInferenceSecretResponse{Secret: req.Secret}, nil
+	m.secrets[req.GetSecret().GetMetadata().GetName()] = req.GetSecret()
+	return summarizerv1.UpsertInferenceSecretResponse_builder{Secret: req.GetSecret()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) DeleteInferenceSecret(ctx context.Context, req *summarizerv1.DeleteInferenceSecretRequest) (*summarizerv1.DeleteInferenceSecretResponse, error) {
-	if _, exists := m.secrets[req.Name]; !exists {
-		return nil, trace.NotFound("inference secret %q not found", req.Name)
+	if _, exists := m.secrets[req.GetName()]; !exists {
+		return nil, trace.NotFound("inference secret %q not found", req.GetName())
 	}
-	delete(m.secrets, req.Name)
+	delete(m.secrets, req.GetName())
 	return &summarizerv1.DeleteInferenceSecretResponse{}, nil
 }
 
 func (m *mockSummarizerServiceServer) ListInferencePolicies(context.Context, *summarizerv1.ListInferencePoliciesRequest) (*summarizerv1.ListInferencePoliciesResponse, error) {
-	return &summarizerv1.ListInferencePoliciesResponse{
+	return summarizerv1.ListInferencePoliciesResponse_builder{
 		Policies:      slices.Concat(slices.Collect(maps.Values(m.policies))),
 		NextPageToken: "",
-	}, nil
+	}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) CreateInferencePolicy(ctx context.Context, req *summarizerv1.CreateInferencePolicyRequest) (*summarizerv1.CreateInferencePolicyResponse, error) {
-	name := req.Policy.Metadata.Name
+	name := req.GetPolicy().GetMetadata().GetName()
 	if _, exists := m.policies[name]; exists {
 		return nil, trace.AlreadyExists("inference policy %q already exists", name)
 	}
-	m.policies[name] = req.Policy
-	return &summarizerv1.CreateInferencePolicyResponse{Policy: req.Policy}, nil
+	m.policies[name] = req.GetPolicy()
+	return summarizerv1.CreateInferencePolicyResponse_builder{Policy: req.GetPolicy()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) GetInferencePolicy(ctx context.Context, req *summarizerv1.GetInferencePolicyRequest) (*summarizerv1.GetInferencePolicyResponse, error) {
-	policy, exists := m.policies[req.Name]
+	policy, exists := m.policies[req.GetName()]
 	if !exists {
-		return nil, trace.NotFound("inference policy %q not found", req.Name)
+		return nil, trace.NotFound("inference policy %q not found", req.GetName())
 	}
-	return &summarizerv1.GetInferencePolicyResponse{Policy: policy}, nil
+	return summarizerv1.GetInferencePolicyResponse_builder{Policy: policy}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) UpdateInferencePolicy(ctx context.Context, req *summarizerv1.UpdateInferencePolicyRequest) (*summarizerv1.UpdateInferencePolicyResponse, error) {
-	name := req.Policy.Metadata.Name
+	name := req.GetPolicy().GetMetadata().GetName()
 	if _, exists := m.policies[name]; !exists {
 		return nil, trace.NotFound("inference policy %q not found", name)
 	}
-	req.Policy.Metadata.Revision = uuid.NewString()
-	m.policies[name] = req.Policy
-	return &summarizerv1.UpdateInferencePolicyResponse{Policy: req.Policy}, nil
+	req.GetPolicy().GetMetadata().SetRevision(uuid.NewString())
+	m.policies[name] = req.GetPolicy()
+	return summarizerv1.UpdateInferencePolicyResponse_builder{Policy: req.GetPolicy()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) UpsertInferencePolicy(ctx context.Context, req *summarizerv1.UpsertInferencePolicyRequest) (*summarizerv1.UpsertInferencePolicyResponse, error) {
-	m.policies[req.Policy.Metadata.Name] = req.Policy
-	return &summarizerv1.UpsertInferencePolicyResponse{Policy: req.Policy}, nil
+	m.policies[req.GetPolicy().GetMetadata().GetName()] = req.GetPolicy()
+	return summarizerv1.UpsertInferencePolicyResponse_builder{Policy: req.GetPolicy()}.Build(), nil
 }
 
 func (m *mockSummarizerServiceServer) DeleteInferencePolicy(ctx context.Context, req *summarizerv1.DeleteInferencePolicyRequest) (*summarizerv1.DeleteInferencePolicyResponse, error) {
-	if _, exists := m.policies[req.Name]; !exists {
-		return nil, trace.NotFound("inference policy %q not found", req.Name)
+	if _, exists := m.policies[req.GetName()]; !exists {
+		return nil, trace.NotFound("inference policy %q not found", req.GetName())
 	}
-	delete(m.policies, req.Name)
+	delete(m.policies, req.GetName())
 	return &summarizerv1.DeleteInferencePolicyResponse{}, nil
 }
diff --git a/tool/tctl/common/resources/user_tasks.go b/tool/tctl/common/resources/user_tasks.go
index cb73787e10e..8ee117b3ceb 100644
--- a/tool/tctl/common/resources/user_tasks.go
+++ b/tool/tctl/common/resources/user_tasks.go
@@ -52,7 +52,7 @@ func (c userTasksCollection) WriteText(w io.Writer, verbose bool) error {
 	var rows [][]string
 	for _, item := range c {
 		labels := common.FormatLabels(item.GetMetadata().GetLabels(), verbose)
-		rows = append(rows, []string{item.Metadata.GetName(), labels, item.Spec.TaskType, item.Spec.IssueType, item.Spec.GetIntegration()})
+		rows = append(rows, []string{item.GetMetadata().GetName(), labels, item.GetSpec().GetTaskType(), item.GetSpec().GetIssueType(), item.GetSpec().GetIntegration()})
 	}
 	t := asciitable.MakeTable(headers, rows...)
 	t.SortRowsBy([]int{0}, true)
diff --git a/tool/tctl/common/resources/vnetconfig.go b/tool/tctl/common/resources/vnetconfig.go
index ee79b752804..0461db0605d 100644
--- a/tool/tctl/common/resources/vnetconfig.go
+++ b/tool/tctl/common/resources/vnetconfig.go
@@ -82,8 +82,8 @@ func (c *vnetConfigCollection) Resources() []types.Resource {
 
 func (c *vnetConfigCollection) WriteText(w io.Writer, verbose bool) error {
 	var dnsZoneSuffixes []string
-	for _, dnsZone := range c.vnetConfig.Spec.CustomDnsZones {
-		dnsZoneSuffixes = append(dnsZoneSuffixes, dnsZone.Suffix)
+	for _, dnsZone := range c.vnetConfig.GetSpec().GetCustomDnsZones() {
+		dnsZoneSuffixes = append(dnsZoneSuffixes, dnsZone.GetSuffix())
 	}
 	t := asciitable.MakeTable([]string{"IPv4 CIDR range", "Custom DNS Zones"})
 	t.AddRow([]string{
diff --git a/tool/tctl/common/resources/workload_identity.go b/tool/tctl/common/resources/workload_identity.go
index 5b95df649d9..ad675ae7930 100644
--- a/tool/tctl/common/resources/workload_identity.go
+++ b/tool/tctl/common/resources/workload_identity.go
@@ -50,7 +50,7 @@ func (c *workloadIdentityCollection) WriteText(w io.Writer, verbose bool) error
 	var rows [][]string
 	for _, item := range c.items {
 		rows = append(rows, []string{
-			item.Metadata.Name,
+			item.GetMetadata().GetName(),
 			item.GetSpec().GetSpiffe().GetId(),
 		})
 	}
@@ -83,9 +83,9 @@ func getWorkloadIdentity(
 	c := client.WorkloadIdentityResourceServiceClient()
 
 	if ref.Name != "" {
-		resource, err := c.GetWorkloadIdentity(ctx, &workloadidentityv1pb.GetWorkloadIdentityRequest{
+		resource, err := c.GetWorkloadIdentity(ctx, workloadidentityv1pb.GetWorkloadIdentityRequest_builder{
 			Name: ref.Name,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -93,10 +93,10 @@ func getWorkloadIdentity(
 	}
 
 	resources, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.WorkloadIdentity, string, error) {
-		resp, err := client.WorkloadIdentityResourceServiceClient().ListWorkloadIdentities(ctx, &workloadidentityv1pb.ListWorkloadIdentitiesRequest{
+		resp, err := client.WorkloadIdentityResourceServiceClient().ListWorkloadIdentities(ctx, workloadidentityv1pb.ListWorkloadIdentitiesRequest_builder{
 			PageSize:  int32(limit),
 			PageToken: pageToken,
-		})
+		}.Build())
 
 		return resp.GetWorkloadIdentities(), resp.GetNextPageToken(), trace.Wrap(err)
 	}))
@@ -120,15 +120,15 @@ func createWorkloadIdentity(
 
 	c := client.WorkloadIdentityResourceServiceClient()
 	if opts.Force {
-		if _, err := c.UpsertWorkloadIdentity(ctx, &workloadidentityv1pb.UpsertWorkloadIdentityRequest{
+		if _, err := c.UpsertWorkloadIdentity(ctx, workloadidentityv1pb.UpsertWorkloadIdentityRequest_builder{
 			WorkloadIdentity: in,
-		}); err != nil {
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 	} else {
-		if _, err := c.CreateWorkloadIdentity(ctx, &workloadidentityv1pb.CreateWorkloadIdentityRequest{
+		if _, err := c.CreateWorkloadIdentity(ctx, workloadidentityv1pb.CreateWorkloadIdentityRequest_builder{
 			WorkloadIdentity: in,
-		}); err != nil {
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 	}
@@ -144,9 +144,9 @@ func deleteWorkloadIdentity(
 	ref services.Ref,
 ) error {
 	c := client.WorkloadIdentityResourceServiceClient()
-	_, err := c.DeleteWorkloadIdentity(ctx, &workloadidentityv1pb.DeleteWorkloadIdentityRequest{
+	_, err := c.DeleteWorkloadIdentity(ctx, workloadidentityv1pb.DeleteWorkloadIdentityRequest_builder{
 		Name: ref.Name,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/workload_identity_x509_issuer_override.go b/tool/tctl/common/resources/workload_identity_x509_issuer_override.go
index d08dd7633b8..5217b900ef4 100644
--- a/tool/tctl/common/resources/workload_identity_x509_issuer_override.go
+++ b/tool/tctl/common/resources/workload_identity_x509_issuer_override.go
@@ -47,7 +47,7 @@ func (c *workloadIdentityX509IssuerOverrideCollection) Resources() []types.Resou
 func (c *workloadIdentityX509IssuerOverrideCollection) WriteText(w io.Writer, verbose bool) error {
 	t := asciitable.MakeTable([]string{"Name"})
 	for _, override := range c.items {
-		t.AddRow([]string{override.Metadata.Name})
+		t.AddRow([]string{override.GetMetadata().GetName()})
 	}
 	return trace.Wrap(t.WriteTo(w))
 }
@@ -74,9 +74,9 @@ func getWorkloadIdentityX509IssuerOverride(
 	if ref.Name != "" {
 		r, err := c.GetX509IssuerOverride(
 			ctx,
-			&workloadidentityv1pb.GetX509IssuerOverrideRequest{
+			workloadidentityv1pb.GetX509IssuerOverrideRequest_builder{
 				Name: ref.Name,
-			},
+			}.Build(),
 		)
 		if err != nil {
 			return nil, trace.Wrap(err)
@@ -92,10 +92,10 @@ func getWorkloadIdentityX509IssuerOverride(
 		clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.X509IssuerOverride, string, error) {
 			resp, err := c.ListX509IssuerOverrides(
 				ctx,
-				&workloadidentityv1pb.ListX509IssuerOverridesRequest{
+				workloadidentityv1pb.ListX509IssuerOverridesRequest_builder{
 					PageSize:  int32(limit),
 					PageToken: pageToken,
-				},
+				}.Build(),
 			)
 
 			return resp.GetX509IssuerOverrides(), resp.GetNextPageToken(), trace.Wrap(err)
@@ -125,18 +125,18 @@ func createWorkloadIdentityX509IssuerOverride(
 	if opts.Force {
 		if _, err := c.UpsertX509IssuerOverride(
 			ctx,
-			&workloadidentityv1pb.UpsertX509IssuerOverrideRequest{
+			workloadidentityv1pb.UpsertX509IssuerOverrideRequest_builder{
 				X509IssuerOverride: r,
-			},
+			}.Build(),
 		); err != nil {
 			return trace.Wrap(err)
 		}
 	} else {
 		if _, err := c.CreateX509IssuerOverride(
 			ctx,
-			&workloadidentityv1pb.CreateX509IssuerOverrideRequest{
+			workloadidentityv1pb.CreateX509IssuerOverrideRequest_builder{
 				X509IssuerOverride: r,
-			},
+			}.Build(),
 		); err != nil {
 			return trace.Wrap(err)
 		}
@@ -163,9 +163,9 @@ func updateWorkloadIdentityX509IssuerOverride(
 	c := client.WorkloadIdentityX509OverridesClient()
 	if _, err = c.UpdateX509IssuerOverride(
 		ctx,
-		&workloadidentityv1pb.UpdateX509IssuerOverrideRequest{
+		workloadidentityv1pb.UpdateX509IssuerOverrideRequest_builder{
 			X509IssuerOverride: r,
-		},
+		}.Build(),
 	); err != nil {
 		return trace.Wrap(err)
 	}
@@ -183,9 +183,9 @@ func deleteWorkloadIdentityX509IssuerOverride(
 	c := client.WorkloadIdentityX509OverridesClient()
 	if _, err := c.DeleteX509IssuerOverride(
 		ctx,
-		&workloadidentityv1pb.DeleteX509IssuerOverrideRequest{
+		workloadidentityv1pb.DeleteX509IssuerOverrideRequest_builder{
 			Name: ref.Name,
-		},
+		}.Build(),
 	); err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/workload_identity_x509_revocation.go b/tool/tctl/common/resources/workload_identity_x509_revocation.go
index aa84e9ce03d..11b4499fbf3 100644
--- a/tool/tctl/common/resources/workload_identity_x509_revocation.go
+++ b/tool/tctl/common/resources/workload_identity_x509_revocation.go
@@ -54,7 +54,7 @@ func (c *workloadIdentityX509RevocationCollection) WriteText(w io.Writer, verbos
 		revokeTime := item.GetSpec().GetRevokedAt().AsTime()
 
 		rows = append(rows, []string{
-			item.Metadata.Name,
+			item.GetMetadata().GetName(),
 			revokeTime.Format(time.RFC3339),
 			expiryTime.Format(time.RFC3339),
 			item.GetSpec().GetReason(),
@@ -87,9 +87,9 @@ func getWorkloadIdentityX509Revocation(
 ) (Collection, error) {
 	c := client.WorkloadIdentityRevocationServiceClient()
 	if ref.Name != "" {
-		resource, err := c.GetWorkloadIdentityX509Revocation(ctx, &workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest{
+		resource, err := c.GetWorkloadIdentityX509Revocation(ctx, workloadidentityv1pb.GetWorkloadIdentityX509RevocationRequest_builder{
 			Name: ref.Name,
-		})
+		}.Build())
 		if err != nil {
 			return nil, trace.Wrap(err)
 		}
@@ -97,10 +97,10 @@ func getWorkloadIdentityX509Revocation(
 	}
 
 	resources, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, limit int, pageToken string) ([]*workloadidentityv1pb.WorkloadIdentityX509Revocation, string, error) {
-		resp, err := c.ListWorkloadIdentityX509Revocations(ctx, &workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest{
+		resp, err := c.ListWorkloadIdentityX509Revocations(ctx, workloadidentityv1pb.ListWorkloadIdentityX509RevocationsRequest_builder{
 			PageSize:  int32(limit),
 			PageToken: pageToken,
-		})
+		}.Build())
 
 		return resp.GetWorkloadIdentityX509Revocations(), resp.GetNextPageToken(), trace.Wrap(err)
 	}))
@@ -118,9 +118,9 @@ func deleteWorkloadIdentityX509Revocation(
 ) error {
 	c := client.WorkloadIdentityRevocationServiceClient()
 	_, err := c.DeleteWorkloadIdentityX509Revocation(
-		ctx, &workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
+		ctx, workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest_builder{
 			Name: ref.Name,
-		})
+		}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
diff --git a/tool/tctl/common/resources/workloadcluster.go b/tool/tctl/common/resources/workloadcluster.go
index 73789649998..bfcc960e9d2 100644
--- a/tool/tctl/common/resources/workloadcluster.go
+++ b/tool/tctl/common/resources/workloadcluster.go
@@ -111,7 +111,7 @@ func createWorkloadCluster(ctx context.Context, client *authclient.Client, raw s
 		return trace.Wrap(err)
 	}
 
-	fmt.Printf("workload cluster %q has been created\n", cc.Metadata.GetName())
+	fmt.Printf("workload cluster %q has been created\n", cc.GetMetadata().GetName())
 	return nil
 }
 
@@ -124,7 +124,7 @@ func updateWorkloadCluster(ctx context.Context, client *authclient.Client, raw s
 	if err != nil {
 		return trace.Wrap(err)
 	}
-	fmt.Printf("workload cluster %q has been updated\n", cc.Metadata.GetName())
+	fmt.Printf("workload cluster %q has been updated\n", cc.GetMetadata().GetName())
 	return nil
 }
 
diff --git a/tool/tctl/common/scoped_assignments_command.go b/tool/tctl/common/scoped_assignments_command.go
index f18f2e3aa4f..5ee4443b991 100644
--- a/tool/tctl/common/scoped_assignments_command.go
+++ b/tool/tctl/common/scoped_assignments_command.go
@@ -101,10 +101,10 @@ func (c *scopedAssignmentsListCommand) TryRun(ctx context.Context, cmd string, c
 
 // list retrieves scoped role assignments matching the configured filters and writes them.
 func (c *scopedAssignmentsListCommand) list(ctx context.Context, client services.ScopedRoleAssignmentReader) error {
-	items, err := stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, client, &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+	items, err := stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, client, scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 		User: c.user,
 		Role: c.role,
-	}))
+	}.Build()))
 	if err != nil {
 		return trace.Wrap(err, "collecting filtered scoped role assignments")
 	}
diff --git a/tool/tctl/common/scoped_assignments_command_test.go b/tool/tctl/common/scoped_assignments_command_test.go
index 9eca39c0e3f..de91888597f 100644
--- a/tool/tctl/common/scoped_assignments_command_test.go
+++ b/tool/tctl/common/scoped_assignments_command_test.go
@@ -64,79 +64,79 @@ func TestScopedAssignmentListCommand(t *testing.T) {
 	t.Cleanup(func() { _ = clt.Close() })
 
 	assignments := map[string]*scopedaccessv1.ScopedRoleAssignment{
-		"alice-role1": {
+		"alice-role1": scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
 			Scope:   "/testscope",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "alice-role1",
-			},
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			}.Build(),
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "alice",
-				Assignments: []*scopedaccessv1.Assignment{{
+				Assignments: []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "role1",
 					Scope: "/testscope",
-				}},
-			},
-		},
-		"bob-role1": {
+				}.Build()},
+			}.Build(),
+		}.Build(),
+		"bob-role1": scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
 			Scope:   "/testscope",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "bob-role1",
-			},
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			}.Build(),
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "bob",
-				Assignments: []*scopedaccessv1.Assignment{{
+				Assignments: []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "role1",
 					Scope: "/testscope",
-				}},
-			},
-		},
-		"charlie-role2": {
+				}.Build()},
+			}.Build(),
+		}.Build(),
+		"charlie-role2": scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
 			Scope:   "/testscope",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "charlie-role2",
-			},
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			}.Build(),
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "charlie",
-				Assignments: []*scopedaccessv1.Assignment{{
+				Assignments: []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "role2",
 					Scope: "/testscope",
-				}},
-			},
-		},
-		"charlie-role3": {
+				}.Build()},
+			}.Build(),
+		}.Build(),
+		"charlie-role3": scopedaccessv1.ScopedRoleAssignment_builder{
 			Kind:    scopedaccess.KindScopedRoleAssignment,
 			SubKind: scopedaccess.SubKindDynamic,
 			Version: types.V1,
 			Scope:   "/testscope",
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name: "charlie-role3",
-			},
-			Spec: &scopedaccessv1.ScopedRoleAssignmentSpec{
+			}.Build(),
+			Spec: scopedaccessv1.ScopedRoleAssignmentSpec_builder{
 				User: "charlie",
-				Assignments: []*scopedaccessv1.Assignment{{
+				Assignments: []*scopedaccessv1.Assignment{scopedaccessv1.Assignment_builder{
 					Role:  "role3",
 					Scope: "/testscope",
-				}},
-			},
-		},
+				}.Build()},
+			}.Build(),
+		}.Build(),
 	}
 
 	scopedClt := clt.ScopedAccessServiceClient()
 	for name, assignment := range assignments {
-		created, err := scopedClt.CreateScopedRoleAssignment(t.Context(), &scopedaccessv1.CreateScopedRoleAssignmentRequest{
+		created, err := scopedClt.CreateScopedRoleAssignment(t.Context(), scopedaccessv1.CreateScopedRoleAssignmentRequest_builder{
 			Assignment: assignment,
-		})
+		}.Build())
 		require.NoError(t, err)
-		assignments[name] = created.Assignment
+		assignments[name] = created.GetAssignment()
 	}
 
 	allAssignmentNames := slices.Collect(maps.Keys(assignments))
@@ -154,7 +154,7 @@ func TestScopedAssignmentListCommand(t *testing.T) {
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
 		resp, err := scopedClt.ListScopedRoleAssignments(ctx, &scopedaccessv1.ListScopedRoleAssignmentsRequest{})
 		require.NoError(t, err)
-		require.Len(t, resp.Assignments, len(assignments))
+		require.Len(t, resp.GetAssignments(), len(assignments))
 	}, 10*time.Second, 50*time.Millisecond, "waiting for scoped role assignments to be present in cache")
 
 	for _, tc := range []struct {
diff --git a/tool/tctl/common/scoped_token_command.go b/tool/tctl/common/scoped_token_command.go
index 9b53804551f..78d03db5958 100644
--- a/tool/tctl/common/scoped_token_command.go
+++ b/tool/tctl/common/scoped_token_command.go
@@ -190,29 +190,29 @@ func (c *ScopedTokensCommand) Add(ctx context.Context, client *authclient.Client
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		immutableLabels = &joiningv1.ImmutableLabels{
+		immutableLabels = joiningv1.ImmutableLabels_builder{
 			Ssh: sshLabels,
-		}
+		}.Build()
 	}
 
 	expires := time.Now().UTC().Add(c.ttl)
-	tok := &joiningv1.ScopedToken{
+	tok := joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    tokenName,
 			Expires: timestamppb.New(expires),
 			Labels:  labels,
-		},
+		}.Build(),
 		Scope: c.tokenScope,
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			Roles:           roles.StringSlice(),
 			AssignedScope:   c.assignedScope,
 			UsageMode:       cmp.Or(c.mode, joining.TokenUsageModeUnlimited),
 			ImmutableLabels: immutableLabels,
 			JoinMethod:      string(types.JoinMethodToken),
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	tok, err = client.CreateScopedToken(ctx, tok)
 	if err != nil {
@@ -285,11 +285,11 @@ func (c *ScopedTokensCommand) Del(ctx context.Context, client *authclient.Client
 // List is called to execute "tokens ls" command.
 func (c *ScopedTokensCommand) List(ctx context.Context, client *authclient.Client) error {
 	tokens, err := stream.Collect(clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageKey string) ([]*joiningv1.ScopedToken, string, error) {
-		res, err := client.ListScopedTokens(ctx, &joiningv1.ListScopedTokensRequest{
+		res, err := client.ListScopedTokens(ctx, joiningv1.ListScopedTokensRequest_builder{
 			Limit:       uint32(pageSize),
 			Cursor:      pageKey,
 			WithSecrets: c.withSecrets,
-		})
+		}.Build())
 		if err != nil {
 			return nil, "", trace.Wrap(err)
 		}
diff --git a/tool/tctl/common/scoped_token_command_test.go b/tool/tctl/common/scoped_token_command_test.go
index 68dbebef495..1f3058739fb 100644
--- a/tool/tctl/common/scoped_token_command_test.go
+++ b/tool/tctl/common/scoped_token_command_test.go
@@ -97,29 +97,29 @@ func TestScopedTokens(t *testing.T) {
 	out = mustDecodeJSON[addedToken](t, buf)
 
 	// Create a GCP scoped token to verify it appears in listings.
-	_, err = clt.CreateScopedToken(t.Context(), &joiningv1.ScopedToken{
+	_, err = clt.CreateScopedToken(t.Context(), joiningv1.ScopedToken_builder{
 		Kind:    types.KindScopedToken,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: "gcp-test-token",
-		},
+		}.Build(),
 		Scope: "/aa",
-		Spec: &joiningv1.ScopedTokenSpec{
+		Spec: joiningv1.ScopedTokenSpec_builder{
 			Roles:         []string{types.KindNode},
 			AssignedScope: "/aa/bb",
 			JoinMethod:    "gcp",
 			UsageMode:     "unlimited",
-			Gcp: &joiningv1.GCP{
+			Gcp: joiningv1.GCP_builder{
 				Allow: []*joiningv1.GCP_Rule{
-					{
+					joiningv1.GCP_Rule_builder{
 						ProjectIds:      []string{"example-project-123456"},
 						Locations:       []string{"us-west1"},
 						ServiceAccounts: []string{"123456789-compute@developer.gserviceaccount.com"},
-					},
+					}.Build(),
 				},
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	require.NoError(t, err)
 
 	// Test all output formats of "tokens ls".
diff --git a/tool/tctl/common/stableunixusers/command.go b/tool/tctl/common/stableunixusers/command.go
index fe38bd15d9a..ad856e2a65b 100644
--- a/tool/tctl/common/stableunixusers/command.go
+++ b/tool/tctl/common/stableunixusers/command.go
@@ -74,10 +74,10 @@ func (c *Command) ls(ctx context.Context, clientFunc client.InitFunc) error {
 
 	var pageToken string
 	for {
-		resp, err := clt.ListStableUNIXUsers(ctx, &stableunixusersv1.ListStableUNIXUsersRequest{
+		resp, err := clt.ListStableUNIXUsers(ctx, stableunixusersv1.ListStableUNIXUsersRequest_builder{
 			PageSize:  0,
 			PageToken: pageToken,
-		})
+		}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/tool/tctl/common/subca/subca_command.go b/tool/tctl/common/subca/subca_command.go
index c12106c9be5..68e94c56f16 100644
--- a/tool/tctl/common/subca/subca_command.go
+++ b/tool/tctl/common/subca/subca_command.go
@@ -219,9 +219,9 @@ func (c *createOverrideCSRCommand) Run(
 
 	var pubKey *subcav1.PublicKeyHash
 	if c.publicKey != "" {
-		pubKey = &subcav1.PublicKeyHash{
+		pubKey = subcav1.PublicKeyHash_builder{
 			Value: c.publicKey,
-		}
+		}.Build()
 	}
 
 	var customSubject *subcav1.DistinguishedName
@@ -245,31 +245,31 @@ func (c *createOverrideCSRCommand) Run(
 	subCA := authClient.SubCAClient()
 
 	// Request CSRs.
-	resp, err := subCA.CreateCSR(ctx, &subcav1.CreateCSRRequest{
+	resp, err := subCA.CreateCSR(ctx, subcav1.CreateCSRRequest_builder{
 		CaType:        caType,
 		PublicKeyHash: pubKey,
 		CustomSubject: customSubject,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "create CSRs")
 	}
 	// Defensive. Should fail server-side if that's the case.
-	if len(resp.Csrs) == 0 {
+	if len(resp.GetCsrs()) == 0 {
 		return trace.BadParameter("no CSRs created")
 	}
 
 	// If writing to stdout there's no need to parse the PEMs or form filenames.
 	if c.out == "" {
-		for _, csr := range resp.Csrs {
-			fmt.Fprintln(s.Stdout, csr.Pem)
+		for _, csr := range resp.GetCsrs() {
+			fmt.Fprintln(s.Stdout, csr.GetPem())
 		}
 		return nil
 	}
 
 	// Parse CSRs and calculate public key hashes.
-	publicKeyHashes := make([]string, len(resp.Csrs))
-	for i, csr := range resp.Csrs {
-		block, _ := pem.Decode([]byte(csr.Pem))
+	publicKeyHashes := make([]string, len(resp.GetCsrs()))
+	for i, csr := range resp.GetCsrs() {
+		block, _ := pem.Decode([]byte(csr.GetPem()))
 		if block == nil {
 			return trace.BadParameter("csrs[%d]: CSR is not a valid PEM", i)
 		}
@@ -284,9 +284,9 @@ func (c *createOverrideCSRCommand) Run(
 	minHashes := findMinHashes(publicKeyHashes)
 
 	// Write output files.
-	for i, csr := range resp.Csrs {
+	for i, csr := range resp.GetCsrs() {
 		name := c.out + caType + "-" + minHashes[i] + "-csr.pem"
-		if err := os.WriteFile(name, []byte(csr.Pem), 0644); err != nil {
+		if err := os.WriteFile(name, []byte(csr.GetPem()), 0644); err != nil {
 			return trace.Wrap(err)
 		}
 		fmt.Fprintf(s.Stdout, "Wrote %s\n", name)
diff --git a/tool/tctl/common/subca/subca_command_test.go b/tool/tctl/common/subca/subca_command_test.go
index f758498c3b5..d2b0eed94af 100644
--- a/tool/tctl/common/subca/subca_command_test.go
+++ b/tool/tctl/common/subca/subca_command_test.go
@@ -64,9 +64,9 @@ func TestCommand_CreateOverrideCSR(t *testing.T) {
 				"--type", "db-client",
 			},
 			csrPEMs: []string{dbClientCSRPEM},
-			wantReq: &subcav1.CreateCSRRequest{
+			wantReq: subcav1.CreateCSRRequest_builder{
 				CaType: string(types.DatabaseClientCA),
-			},
+			}.Build(),
 			wantStdout: dbClientCSRPEM + "\n",
 		},
 		{
@@ -75,9 +75,9 @@ func TestCommand_CreateOverrideCSR(t *testing.T) {
 				"--type", string(types.DatabaseClientCA),
 			},
 			csrPEMs: []string{dbClientCSRPEM},
-			wantReq: &subcav1.CreateCSRRequest{
+			wantReq: subcav1.CreateCSRRequest_builder{
 				CaType: string(types.DatabaseClientCA),
-			},
+			}.Build(),
 			wantStdout: dbClientCSRPEM + "\n",
 		},
 		{
@@ -86,9 +86,9 @@ func TestCommand_CreateOverrideCSR(t *testing.T) {
 				"--type", string(types.WindowsCA),
 			},
 			csrPEMs: []string{windowsCSRPEM},
-			wantReq: &subcav1.CreateCSRRequest{
+			wantReq: subcav1.CreateCSRRequest_builder{
 				CaType: string(types.WindowsCA),
-			},
+			}.Build(),
 			wantStdout: windowsCSRPEM + "\n",
 		},
 		{
@@ -99,18 +99,18 @@ func TestCommand_CreateOverrideCSR(t *testing.T) {
 				"--subject=O=Llama,CN=Llamo",
 			},
 			csrPEMs: []string{windowsCustomCSRPEM},
-			wantReq: &subcav1.CreateCSRRequest{
+			wantReq: subcav1.CreateCSRRequest_builder{
 				CaType: string(types.WindowsCA),
-				PublicKeyHash: &subcav1.PublicKeyHash{
+				PublicKeyHash: subcav1.PublicKeyHash_builder{
 					Value: "f4522365888fdddcf3c854e79e5928447fe1a2388353efb2f0d30db8ba7c81bc",
-				},
-				CustomSubject: &subcav1.DistinguishedName{
+				}.Build(),
+				CustomSubject: subcav1.DistinguishedName_builder{
 					Names: []*subcav1.AttributeTypeAndValue{
-						{Oid: []int32{2, 5, 4, 10}, Value: &oLlama}, // O
-						{Oid: []int32{2, 5, 4, 3}, Value: &cnLlamo}, // CN
+						subcav1.AttributeTypeAndValue_builder{Oid: []int32{2, 5, 4, 10}, Value: &oLlama}.Build(), // O
+						subcav1.AttributeTypeAndValue_builder{Oid: []int32{2, 5, 4, 3}, Value: &cnLlamo}.Build(), // CN
 					},
-				},
-			},
+				}.Build(),
+			}.Build(),
 			wantStdout: windowsCustomCSRPEM + "\n",
 		},
 		{
@@ -122,9 +122,9 @@ func TestCommand_CreateOverrideCSR(t *testing.T) {
 				windowsCSRPEM,
 				windowsCSRPEM2,
 			},
-			wantReq: &subcav1.CreateCSRRequest{
+			wantReq: subcav1.CreateCSRRequest_builder{
 				CaType: string(types.WindowsCA),
-			},
+			}.Build(),
 			wantStdout: windowsCSRPEM + "\n" + windowsCSRPEM2 + "\n",
 		},
 		{
@@ -137,9 +137,9 @@ func TestCommand_CreateOverrideCSR(t *testing.T) {
 				windowsCSRPEM,
 				windowsCSRPEM2,
 			},
-			wantReq: &subcav1.CreateCSRRequest{
+			wantReq: subcav1.CreateCSRRequest_builder{
 				CaType: string(types.WindowsCA),
-			},
+			}.Build(),
 			wantStdout: "" +
 				"Wrote " + wantWindows1File + "\n" +
 				"Wrote " + wantWindows2File + "\n",
@@ -351,13 +351,13 @@ func (f *fakeAuthClient) CreateCSR(
 		return nil, trace.BadParameter("cannot create CSRs for CA")
 	}
 
-	resp := &subcav1.CreateCSRResponse{
+	resp := subcav1.CreateCSRResponse_builder{
 		Csrs: make([]*subcav1.CertificateSigningRequest, len(f.csrPEMs)),
-	}
+	}.Build()
 	for i, pem := range f.csrPEMs {
-		resp.Csrs[i] = &subcav1.CertificateSigningRequest{
+		resp.GetCsrs()[i] = subcav1.CertificateSigningRequest_builder{
 			Pem: pem,
-		}
+		}.Build()
 	}
 	return resp, nil
 }
diff --git a/tool/tctl/common/terraform_command.go b/tool/tctl/common/terraform_command.go
index 42a23c75631..ca15bcb13b8 100644
--- a/tool/tctl/common/terraform_command.go
+++ b/tool/tctl/common/terraform_command.go
@@ -252,22 +252,22 @@ func (c *TerraformCommand) createTransientBotAndToken(ctx context.Context, clien
 	}
 
 	// Create bot
-	bot := &machineidv1pb.Bot{
+	bot := machineidv1pb.Bot_builder{
 		Kind:    types.KindBot,
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name:    botName,
 			Expires: timestamppb.New(time.Now().Add(c.botTTL)),
 			Labels:  terraformEnvCommandLabels,
-		},
-		Spec: &machineidv1pb.BotSpec{
+		}.Build(),
+		Spec: machineidv1pb.BotSpec_builder{
 			Roles: []string{roleName},
-		},
-	}
+		}.Build(),
+	}.Build()
 
-	_, err = client.BotServiceClient().CreateBot(ctx, &machineidv1pb.CreateBotRequest{
+	_, err = client.BotServiceClient().CreateBot(ctx, machineidv1pb.CreateBotRequest_builder{
 		Bot: bot,
-	})
+	}.Build())
 	if err != nil {
 		return "", trace.Wrap(err, "creating bot")
 	}
diff --git a/tool/tctl/common/workload_identity_command.go b/tool/tctl/common/workload_identity_command.go
index 04bcf666813..08c8d8aa9be 100644
--- a/tool/tctl/common/workload_identity_command.go
+++ b/tool/tctl/common/workload_identity_command.go
@@ -249,9 +249,9 @@ func (c *WorkloadIdentityCommand) DeleteWorkloadIdentity(
 ) error {
 	workloadIdentityClient := client.WorkloadIdentityResourceServiceClient()
 	_, err := workloadIdentityClient.DeleteWorkloadIdentity(
-		ctx, &workloadidentityv1pb.DeleteWorkloadIdentityRequest{
+		ctx, workloadidentityv1pb.DeleteWorkloadIdentityRequest_builder{
 			Name: c.workloadIdentityName,
-		})
+		}.Build())
 	if err != nil {
 		return trace.Wrap(err)
 	}
@@ -279,12 +279,12 @@ func (c *WorkloadIdentityCommand) ListWorkloadIdentities(
 		}
 
 		workloadIdentities = append(
-			workloadIdentities, resp.WorkloadIdentities...,
+			workloadIdentities, resp.GetWorkloadIdentities()...,
 		)
-		if resp.NextPageToken == "" {
+		if resp.GetNextPageToken() == "" {
 			break
 		}
-		req.PageToken = resp.NextPageToken
+		req.SetPageToken(resp.GetNextPageToken())
 	}
 
 	switch c.format {
@@ -351,20 +351,20 @@ func (c *WorkloadIdentityCommand) AddRevocation(
 	}
 
 	revocationClient := client.WorkloadIdentityRevocationServiceClient()
-	_, err = revocationClient.CreateWorkloadIdentityX509Revocation(ctx, &workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest{
-		WorkloadIdentityX509Revocation: &workloadidentityv1pb.WorkloadIdentityX509Revocation{
+	_, err = revocationClient.CreateWorkloadIdentityX509Revocation(ctx, workloadidentityv1pb.CreateWorkloadIdentityX509RevocationRequest_builder{
+		WorkloadIdentityX509Revocation: workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 			Kind:    types.KindWorkloadIdentityX509Revocation,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:    normalizedSerial,
 				Expires: timestamppb.New(expiry),
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 				Reason:    c.revocationReason,
 				RevokedAt: timestamppb.New(c.now()),
-			},
-		},
-	})
+			}.Build(),
+		}.Build(),
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "creating revocation")
 	}
@@ -393,9 +393,9 @@ func (c *WorkloadIdentityCommand) DeleteRevocation(
 	}
 
 	revocationClient := client.WorkloadIdentityRevocationServiceClient()
-	_, err = revocationClient.DeleteWorkloadIdentityX509Revocation(ctx, &workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest{
+	_, err = revocationClient.DeleteWorkloadIdentityX509Revocation(ctx, workloadidentityv1pb.DeleteWorkloadIdentityX509RevocationRequest_builder{
 		Name: normalizedSerial,
-	})
+	}.Build())
 	if err != nil {
 		return trace.Wrap(err, "deleting revocation")
 	}
@@ -424,12 +424,12 @@ func (c *WorkloadIdentityCommand) ListRevocations(
 		}
 
 		revocations = append(
-			revocations, resp.WorkloadIdentityX509Revocations...,
+			revocations, resp.GetWorkloadIdentityX509Revocations()...,
 		)
-		if resp.NextPageToken == "" {
+		if resp.GetNextPageToken() == "" {
 			break
 		}
-		req.PageToken = resp.NextPageToken
+		req.SetPageToken(resp.GetNextPageToken())
 	}
 
 	switch c.format {
@@ -515,7 +515,7 @@ func (c *WorkloadIdentityCommand) StreamCRL(
 		slog.InfoContext(ctx, "Received CRL from server")
 		pemData := pem.EncodeToMemory(&pem.Block{
 			Type:  "X509 CRL",
-			Bytes: res.Crl,
+			Bytes: res.GetCrl(),
 		})
 		if err := write(pemData); err != nil {
 			return trace.Wrap(err, "writing CRL pem")
@@ -607,23 +607,23 @@ func (c *WorkloadIdentityCommand) runOverridesCreate(ctx context.Context, client
 		for _, cert := range override {
 			chainDer = append(chainDer, cert.Raw)
 		}
-		pbOverrides = append(pbOverrides, &workloadidentityv1pb.X509IssuerOverrideSpec_Override{
+		pbOverrides = append(pbOverrides, workloadidentityv1pb.X509IssuerOverrideSpec_Override_builder{
 			Issuer: chainDer[0],
 			Chain:  chainDer,
-		})
+		}.Build())
 	}
 
-	override := &workloadidentityv1pb.X509IssuerOverride{
+	override := workloadidentityv1pb.X509IssuerOverride_builder{
 		Kind:    types.KindWorkloadIdentityX509IssuerOverride,
 		SubKind: "",
 		Version: types.V1,
-		Metadata: &headerv1.Metadata{
+		Metadata: headerv1.Metadata_builder{
 			Name: c.overridesCreateName,
-		},
-		Spec: &workloadidentityv1pb.X509IssuerOverrideSpec{
+		}.Build(),
+		Spec: workloadidentityv1pb.X509IssuerOverrideSpec_builder{
 			Overrides: pbOverrides,
-		},
-	}
+		}.Build(),
+	}.Build()
 
 	if c.overridesCreateDryRun {
 		fmt.Fprintln(c.stderr, "Dry run mode enabled, the following override would have been created:")
@@ -634,15 +634,15 @@ func (c *WorkloadIdentityCommand) runOverridesCreate(ctx context.Context, client
 	}
 
 	if c.overridesCreateForce {
-		if _, err := oclt.UpsertX509IssuerOverride(ctx, &workloadidentityv1pb.UpsertX509IssuerOverrideRequest{
+		if _, err := oclt.UpsertX509IssuerOverride(ctx, workloadidentityv1pb.UpsertX509IssuerOverrideRequest_builder{
 			X509IssuerOverride: override,
-		}); err != nil {
+		}.Build()); err != nil {
 			return trace.Wrap(err)
 		}
 	} else {
-		if _, err := oclt.CreateX509IssuerOverride(ctx, &workloadidentityv1pb.CreateX509IssuerOverrideRequest{
+		if _, err := oclt.CreateX509IssuerOverride(ctx, workloadidentityv1pb.CreateX509IssuerOverrideRequest_builder{
 			X509IssuerOverride: override,
-		}); err != nil {
+		}.Build()); err != nil {
 			if trace.IsAlreadyExists(err) {
 				return trace.Wrap(err, "override already exists, use the --force option to overwrite it")
 			}
@@ -686,10 +686,10 @@ func (c *WorkloadIdentityCommand) runOverridesSignCSRs(ctx context.Context, clie
 		if err != nil {
 			return trace.Wrap(err)
 		}
-		resp, err := oclt.SignX509IssuerCSR(ctx, &workloadidentityv1pb.SignX509IssuerCSRRequest{
+		resp, err := oclt.SignX509IssuerCSR(ctx, workloadidentityv1pb.SignX509IssuerCSRRequest_builder{
 			Issuer:          issuer.Raw,
 			CsrCreationMode: c.overridesSignMode,
-		})
+		}.Build())
 		if err != nil {
 			if !c.overridesSignForce {
 				return trace.Wrap(err)
diff --git a/tool/tctl/common/workload_identity_command_overrides_test.go b/tool/tctl/common/workload_identity_command_overrides_test.go
index 262b6e15261..2465471ca95 100644
--- a/tool/tctl/common/workload_identity_command_overrides_test.go
+++ b/tool/tctl/common/workload_identity_command_overrides_test.go
@@ -306,8 +306,8 @@ type caServer struct {
 
 func (s *caServer) GetCertAuthority(ctx context.Context, req *trustv1.GetCertAuthorityRequest) (*types.CertAuthorityV2, error) {
 	ca, ok := s.cas[types.CertAuthID{
-		Type:       types.CertAuthType(req.Type),
-		DomainName: req.Domain,
+		Type:       types.CertAuthType(req.GetType()),
+		DomainName: req.GetDomain(),
 	}]
 	if !ok {
 		return nil, status.Errorf(codes.NotFound, "")
@@ -358,7 +358,7 @@ func (s *csrServer) SignX509IssuerCSR(ctx context.Context, req *workloadidentity
 	if !ok {
 		return nil, status.Errorf(codes.NotFound, signKeyNotFoundMessage)
 	}
-	return &workloadidentityv1.SignX509IssuerCSRResponse{Csr: csr}, nil
+	return workloadidentityv1.SignX509IssuerCSRResponse_builder{Csr: csr}.Build(), nil
 }
 
 func runFakeAPIServer(t *testing.T, register func(*grpc.Server)) *authclient.Client {
diff --git a/tool/tctl/common/workload_identity_test.go b/tool/tctl/common/workload_identity_test.go
index 417ac6a9aec..dfde49111c7 100644
--- a/tool/tctl/common/workload_identity_test.go
+++ b/tool/tctl/common/workload_identity_test.go
@@ -263,18 +263,18 @@ func TestWorkloadIdentityRevocation(t *testing.T) {
 		require.NoError(t, err)
 
 		require.Empty(t, cmp.Diff(
-			&workloadidentityv1pb.WorkloadIdentityX509Revocation{
+			workloadidentityv1pb.WorkloadIdentityX509Revocation_builder{
 				Kind:    types.KindWorkloadIdentityX509Revocation,
 				Version: types.V1,
-				Metadata: &headerv1.Metadata{
+				Metadata: headerv1.Metadata_builder{
 					Name:    "aabbccdd",
 					Expires: timestamppb.New(time.Date(2030, 2, 24, 15, 4, 0, 0, time.UTC)),
-				},
-				Spec: &workloadidentityv1pb.WorkloadIdentityX509RevocationSpec{
+				}.Build(),
+				Spec: workloadidentityv1pb.WorkloadIdentityX509RevocationSpec_builder{
 					Reason:    "compromised",
 					RevokedAt: timestamppb.New(time.Date(2024, 2, 5, 15, 4, 0, 0, time.UTC)),
-				},
-			},
+				}.Build(),
+			}.Build(),
 			resource,
 			protocmp.Transform(),
 			protocmp.IgnoreFields(&headerv1.Metadata{}, "revision"),
diff --git a/tool/tsh/common/access_request.go b/tool/tsh/common/access_request.go
index 602bd3acb0b..962f7d529bc 100644
--- a/tool/tsh/common/access_request.go
+++ b/tool/tsh/common/access_request.go
@@ -444,10 +444,10 @@ func searchRequestableRoles(cf *CLIConf) error {
 	var allRoles []*proto.ListRequestableRolesResponse_RequestableRole
 	err = tc.WithRootClusterClient(cf.Context, func(clt authclient.ClientI) error {
 		pageFunc := func(ctx context.Context, pageSize int, pageToken string) ([]*proto.ListRequestableRolesResponse_RequestableRole, string, error) {
-			req := &proto.ListRequestableRolesRequest{
+			req := proto.ListRequestableRolesRequest_builder{
 				PageSize:  int32(pageSize),
 				PageToken: pageToken,
-			}
+			}.Build()
 
 			resp, err := clt.ListRequestableRoles(ctx, req)
 			return resp.GetRoles(), resp.GetNextPageToken(), trace.Wrap(err)
@@ -464,8 +464,8 @@ func searchRequestableRoles(cf *CLIConf) error {
 	rows := make([]requestableRoleRow, 0, len(allRoles))
 	for _, r := range allRoles {
 		rows = append(rows, requestableRoleRow{
-			Role:        r.Name,
-			Description: r.Description,
+			Role:        r.GetName(),
+			Description: r.GetDescription(),
 		})
 	}
 
diff --git a/tool/tsh/common/beams.go b/tool/tsh/common/beams.go
index db93c335287..1810f3ddecf 100644
--- a/tool/tsh/common/beams.go
+++ b/tool/tsh/common/beams.go
@@ -130,9 +130,9 @@ type formattedBeam struct {
 func getBeam(ctx context.Context, client authclient.ClientI, ref string) (*beamsv1.Beam, error) {
 	req := &beamsv1.GetBeamRequest{}
 	if _, err := uuid.Parse(ref); err == nil {
-		req.Id = &beamsv1.GetBeamRequest_Name{Name: ref}
+		req.SetName(ref)
 	} else {
-		req.Id = &beamsv1.GetBeamRequest_Alias{Alias: ref}
+		req.SetAlias(ref)
 	}
 
 	rsp, err := client.
diff --git a/tool/tsh/common/beams_add.go b/tool/tsh/common/beams_add.go
index ea24e6fe106..97364d4ec06 100644
--- a/tool/tsh/common/beams_add.go
+++ b/tool/tsh/common/beams_add.go
@@ -87,9 +87,9 @@ func (c *beamsAddCommand) run(cf *CLIConf) error {
 		// Create the beam.
 		rsp, err := rootClient.
 			BeamServiceClient().
-			CreateBeam(ctx, &beamsv1.CreateBeamRequest{
+			CreateBeam(ctx, beamsv1.CreateBeamRequest_builder{
 				Egress: beamsv1.EgressMode_EGRESS_MODE_UNRESTRICTED,
-			})
+			}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/tool/tsh/common/beams_ls.go b/tool/tsh/common/beams_ls.go
index c2db41b5ec9..a1d42d239a8 100644
--- a/tool/tsh/common/beams_ls.go
+++ b/tool/tsh/common/beams_ls.go
@@ -107,18 +107,18 @@ func (c *beamsLSCommand) fetch(ctx context.Context, tc *client.TeleportClient, a
 			if err != nil {
 				return trace.Wrap(err)
 			}
-			filters.Users = []string{user.GetName()}
+			filters.SetUsers([]string{user.GetName()})
 		}
 
 		beams, err = stream.Collect(
 			clientutils.Resources(ctx, func(ctx context.Context, pageSize int, pageToken string) ([]*beamsv1.Beam, string, error) {
 				rsp, err := rootClient.
 					BeamServiceClient().
-					ListBeams(ctx, &beamsv1.ListBeamsRequest{
+					ListBeams(ctx, beamsv1.ListBeamsRequest_builder{
 						PageSize:  int32(pageSize),
 						PageToken: pageToken,
 						Filters:   filters,
-					})
+					}.Build())
 				if err != nil {
 					return nil, "", trace.Wrap(err)
 				}
diff --git a/tool/tsh/common/beams_ls_test.go b/tool/tsh/common/beams_ls_test.go
index 51d22187fc8..a905b03ff01 100644
--- a/tool/tsh/common/beams_ls_test.go
+++ b/tool/tsh/common/beams_ls_test.go
@@ -45,7 +45,7 @@ func TestBeamsLSCommand(t *testing.T) {
 			"alice",
 			"alpha-app",
 			time.Date(2026, time.January, 2, 3, 4, 5, 0, time.UTC),
-			&beamsv1.PublishSpec{Protocol: beamsv1.Protocol_PROTOCOL_HTTP, Port: 8080},
+			beamsv1.PublishSpec_builder{Protocol: beamsv1.Protocol_PROTOCOL_HTTP, Port: 8080}.Build(),
 		),
 		makeTestBeam(
 			"bravo",
@@ -61,7 +61,7 @@ func TestBeamsLSCommand(t *testing.T) {
 			"bob",
 			"charlie-app",
 			time.Date(2026, time.January, 2, 5, 6, 7, 0, time.UTC),
-			&beamsv1.PublishSpec{Protocol: beamsv1.Protocol_PROTOCOL_TCP, Port: 5432},
+			beamsv1.PublishSpec_builder{Protocol: beamsv1.Protocol_PROTOCOL_TCP, Port: 5432}.Build(),
 		),
 	}
 
@@ -137,18 +137,18 @@ func TestBeamsLSCommand(t *testing.T) {
 }
 
 func makeTestBeam(alias, name, owner, appName string, expires time.Time, publish *beamsv1.PublishSpec) *beamsv1.Beam {
-	return &beamsv1.Beam{
-		Metadata: &headerv1.Metadata{
+	return beamsv1.Beam_builder{
+		Metadata: headerv1.Metadata_builder{
 			Name: name,
-		},
-		Spec: &beamsv1.BeamSpec{
+		}.Build(),
+		Spec: beamsv1.BeamSpec_builder{
 			Expires: timestamppb.New(expires),
 			Publish: publish,
-		},
-		Status: &beamsv1.BeamStatus{
+		}.Build(),
+		Status: beamsv1.BeamStatus_builder{
 			Alias:   alias,
 			User:    owner,
 			AppName: appName,
-		},
-	}
+		}.Build(),
+	}.Build()
 }
diff --git a/tool/tsh/common/beams_publish.go b/tool/tsh/common/beams_publish.go
index c872e808427..33a62948514 100644
--- a/tool/tsh/common/beams_publish.go
+++ b/tool/tsh/common/beams_publish.go
@@ -75,12 +75,12 @@ func (c *beamsPublishCommand) run(cf *CLIConf) error {
 	}
 
 	// Set the `spec.publish` to trigger the creation of an app.
-	beam.Spec.Publish = &beamsv1.PublishSpec{
+	beam.GetSpec().SetPublish(beamsv1.PublishSpec_builder{
 		Port:     8080,
 		Protocol: beamsv1.Protocol_PROTOCOL_HTTP,
-	}
+	}.Build())
 	if c.tcp {
-		beam.Spec.Publish.Protocol = beamsv1.Protocol_PROTOCOL_TCP
+		beam.GetSpec().GetPublish().SetProtocol(beamsv1.Protocol_PROTOCOL_TCP)
 	}
 
 	updatedBeam, err := c.updateFn(ctx, tc, beam)
@@ -137,7 +137,7 @@ func (c *beamsPublishCommand) updateBeam(ctx context.Context, tc *client.Telepor
 
 		rsp, err := rootClient.
 			BeamServiceClient().
-			UpdateBeam(ctx, &beamsv1.UpdateBeamRequest{Beam: beam})
+			UpdateBeam(ctx, beamsv1.UpdateBeamRequest_builder{Beam: beam}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/tool/tsh/common/beams_rm.go b/tool/tsh/common/beams_rm.go
index 939fb67e58d..0a4ec5dc5db 100644
--- a/tool/tsh/common/beams_rm.go
+++ b/tool/tsh/common/beams_rm.go
@@ -72,9 +72,9 @@ func (c *beamsRMCommand) run(cf *CLIConf) error {
 		// Delete the beam.
 		_, err = rootClient.
 			BeamServiceClient().
-			DeleteBeam(ctx, &beamsv1.DeleteBeamRequest{
+			DeleteBeam(ctx, beamsv1.DeleteBeamRequest_builder{
 				Name: beam.GetMetadata().GetName(),
-			})
+			}.Build())
 		return trace.Wrap(err)
 	})
 	if err != nil {
diff --git a/tool/tsh/common/beams_scp_test.go b/tool/tsh/common/beams_scp_test.go
index 64fc243617d..7206681a917 100644
--- a/tool/tsh/common/beams_scp_test.go
+++ b/tool/tsh/common/beams_scp_test.go
@@ -112,7 +112,7 @@ func TestBeamsSCPCommandRun(t *testing.T) {
 						time.Date(2026, time.January, 2, 3, 4, 5, 0, time.UTC),
 						nil,
 					)
-					beam.Status.NodeId = nodeID
+					beam.GetStatus().SetNodeId(nodeID)
 					return beam, nil
 				},
 				withClusterFn: func(_ context.Context, _ *client.TeleportClient, fn func(authclient.ClientI) error) error {
diff --git a/tool/tsh/common/beams_unpublish.go b/tool/tsh/common/beams_unpublish.go
index 3210959f93a..21dbae68c09 100644
--- a/tool/tsh/common/beams_unpublish.go
+++ b/tool/tsh/common/beams_unpublish.go
@@ -61,12 +61,12 @@ func (c *beamsUnpublishCommand) run(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 
-	if beam.Spec.Publish == nil {
+	if !beam.GetSpec().HasPublish() {
 		return trace.Errorf("Beam %q is not published.", beam.GetStatus().GetAlias())
 	}
 
 	// Blank out the `spec.publish` to trigger the deletion of the app.
-	beam.Spec.Publish = nil
+	beam.GetSpec().ClearPublish()
 
 	updatedBeam, err := c.updateFn(ctx, tc, beam)
 	if err != nil {
@@ -124,7 +124,7 @@ func (c *beamsUnpublishCommand) updateBeam(ctx context.Context, tc *client.Telep
 
 		rsp, err := rootClient.
 			BeamServiceClient().
-			UpdateBeam(ctx, &beamsv1.UpdateBeamRequest{Beam: beam})
+			UpdateBeam(ctx, beamsv1.UpdateBeamRequest_builder{Beam: beam}.Build())
 		if err != nil {
 			return trace.Wrap(err)
 		}
diff --git a/tool/tsh/common/beams_unpublish_test.go b/tool/tsh/common/beams_unpublish_test.go
index 477b7b8c7b9..3cf3e0f8831 100644
--- a/tool/tsh/common/beams_unpublish_test.go
+++ b/tool/tsh/common/beams_unpublish_test.go
@@ -47,7 +47,7 @@ func TestBeamsUnpublishCommand(t *testing.T) {
 				"alice",
 				"alpha-app",
 				time.Date(2026, time.January, 2, 3, 4, 5, 0, time.UTC),
-				&beamsv1.PublishSpec{Protocol: beamsv1.Protocol_PROTOCOL_HTTP, Port: 8080},
+				beamsv1.PublishSpec_builder{Protocol: beamsv1.Protocol_PROTOCOL_HTTP, Port: 8080}.Build(),
 			),
 			wantOutput: "Beam \"alpha\" successfully unpublished.\n",
 		},
diff --git a/tool/tsh/common/delegation.go b/tool/tsh/common/delegation.go
index 89ae8a3e41c..781f200a07a 100644
--- a/tool/tsh/common/delegation.go
+++ b/tool/tsh/common/delegation.go
@@ -23,6 +23,7 @@ import (
 	"fmt"
 
 	"github.com/gravitational/trace"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/durationpb"
 
 	delegationv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/delegation/v1"
@@ -90,22 +91,20 @@ func buildCreateDelegationSessionRequest(cf *CLIConf) (*delegationv1pb.CreateDel
 			return nil, trace.BadParameter("--bot must not be empty")
 		}
 
-		authorizedUsers = append(authorizedUsers, &delegationv1pb.DelegationUserSpec{
-			Kind: types.KindBot,
-			Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-				BotName: botName,
-			},
-		})
+		authorizedUsers = append(authorizedUsers, delegationv1pb.DelegationUserSpec_builder{
+			Kind:    types.KindBot,
+			BotName: proto.String(botName),
+		}.Build())
 	}
 
-	return &delegationv1pb.CreateDelegationSessionRequest{
-		Spec: &delegationv1pb.DelegationSessionSpec{
+	return delegationv1pb.CreateDelegationSessionRequest_builder{
+		Spec: delegationv1pb.DelegationSessionSpec_builder{
 			User:            cf.Username,
 			Resources:       resources,
 			AuthorizedUsers: authorizedUsers,
-		},
+		}.Build(),
 		Ttl: durationpb.New(cf.SessionTTL),
-	}, nil
+	}.Build(), nil
 }
 
 func buildDelegationResources(cf *CLIConf) ([]*delegationv1pb.DelegationResourceSpec, error) {
@@ -120,10 +119,10 @@ func buildDelegationResources(cf *CLIConf) ([]*delegationv1pb.DelegationResource
 	case cf.DelegationAllowAll && explicitResources != 0:
 		return nil, trace.BadParameter("--allow-all is mutually exclusive with the other --allow-* flags")
 	case cf.DelegationAllowAll:
-		return []*delegationv1pb.DelegationResourceSpec{{
+		return []*delegationv1pb.DelegationResourceSpec{delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.Wildcard,
 			Name: types.Wildcard,
-		}}, nil
+		}.Build()}, nil
 	case explicitResources == 0:
 		return nil, trace.BadParameter("at least one resource must be provided via --allow-all or an --allow-* flag")
 	}
@@ -133,55 +132,55 @@ func buildDelegationResources(cf *CLIConf) ([]*delegationv1pb.DelegationResource
 		if name == "" {
 			return nil, trace.BadParameter("--allow-node must not be empty")
 		}
-		resources = append(resources, &delegationv1pb.DelegationResourceSpec{
+		resources = append(resources, delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.KindNode,
 			Name: name,
-		})
+		}.Build())
 	}
 	for _, name := range cf.DelegationAllowDatabases {
 		if name == "" {
 			return nil, trace.BadParameter("--allow-db must not be empty")
 		}
-		resources = append(resources, &delegationv1pb.DelegationResourceSpec{
+		resources = append(resources, delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.KindDatabase,
 			Name: name,
-		})
+		}.Build())
 	}
 	for _, name := range cf.DelegationAllowApps {
 		if name == "" {
 			return nil, trace.BadParameter("--allow-app must not be empty")
 		}
-		resources = append(resources, &delegationv1pb.DelegationResourceSpec{
+		resources = append(resources, delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.KindApp,
 			Name: name,
-		})
+		}.Build())
 	}
 	for _, name := range cf.DelegationAllowKubeClusters {
 		if name == "" {
 			return nil, trace.BadParameter("--allow-kube-cluster must not be empty")
 		}
-		resources = append(resources, &delegationv1pb.DelegationResourceSpec{
+		resources = append(resources, delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.KindKubernetesCluster,
 			Name: name,
-		})
+		}.Build())
 	}
 	for _, name := range cf.DelegationAllowWindowsDesktops {
 		if name == "" {
 			return nil, trace.BadParameter("--allow-windows-desktop must not be empty")
 		}
-		resources = append(resources, &delegationv1pb.DelegationResourceSpec{
+		resources = append(resources, delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.KindWindowsDesktop,
 			Name: name,
-		})
+		}.Build())
 	}
 	for _, name := range cf.DelegationAllowGitServers {
 		if name == "" {
 			return nil, trace.BadParameter("--allow-git-server must not be empty")
 		}
-		resources = append(resources, &delegationv1pb.DelegationResourceSpec{
+		resources = append(resources, delegationv1pb.DelegationResourceSpec_builder{
 			Kind: types.KindGitServer,
 			Name: name,
-		})
+		}.Build())
 	}
 
 	return resources, nil
diff --git a/tool/tsh/common/delegation_test.go b/tool/tsh/common/delegation_test.go
index 1e6d1e9137f..b52825d04e1 100644
--- a/tool/tsh/common/delegation_test.go
+++ b/tool/tsh/common/delegation_test.go
@@ -25,6 +25,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/testing/protocmp"
 
 	delegationv1pb "github.com/gravitational/teleport/api/gen/proto/go/teleport/delegation/v1"
@@ -59,26 +60,22 @@ func TestBuildCreateDelegationSessionRequest(t *testing.T) {
 			wantUser: "bob",
 			wantTTL:  10 * time.Minute,
 			wantResources: []*delegationv1pb.DelegationResourceSpec{
-				{Kind: types.KindNode, Name: "node1"},
-				{Kind: types.KindDatabase, Name: "database1"},
-				{Kind: types.KindApp, Name: "app1"},
-				{Kind: types.KindKubernetesCluster, Name: "cluster1"},
-				{Kind: types.KindWindowsDesktop, Name: "desktop1"},
-				{Kind: types.KindGitServer, Name: "git1"},
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.KindNode, Name: "node1"}.Build(),
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.KindDatabase, Name: "database1"}.Build(),
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.KindApp, Name: "app1"}.Build(),
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.KindKubernetesCluster, Name: "cluster1"}.Build(),
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.KindWindowsDesktop, Name: "desktop1"}.Build(),
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.KindGitServer, Name: "git1"}.Build(),
 			},
 			wantAuthorizedUser: []*delegationv1pb.DelegationUserSpec{
-				{
-					Kind: types.KindBot,
-					Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-						BotName: "bot1",
-					},
-				},
-				{
-					Kind: types.KindBot,
-					Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-						BotName: "bot2",
-					},
-				},
+				delegationv1pb.DelegationUserSpec_builder{
+					Kind:    types.KindBot,
+					BotName: proto.String("bot1"),
+				}.Build(),
+				delegationv1pb.DelegationUserSpec_builder{
+					Kind:    types.KindBot,
+					BotName: proto.String("bot2"),
+				}.Build(),
 			},
 		},
 		{
@@ -92,15 +89,13 @@ func TestBuildCreateDelegationSessionRequest(t *testing.T) {
 			wantUser: "bob",
 			wantTTL:  5 * time.Minute,
 			wantResources: []*delegationv1pb.DelegationResourceSpec{
-				{Kind: types.Wildcard, Name: types.Wildcard},
+				delegationv1pb.DelegationResourceSpec_builder{Kind: types.Wildcard, Name: types.Wildcard}.Build(),
 			},
 			wantAuthorizedUser: []*delegationv1pb.DelegationUserSpec{
-				{
-					Kind: types.KindBot,
-					Matcher: &delegationv1pb.DelegationUserSpec_BotName{
-						BotName: "bot1",
-					},
-				},
+				delegationv1pb.DelegationUserSpec_builder{
+					Kind:    types.KindBot,
+					BotName: proto.String("bot1"),
+				}.Build(),
 			},
 		},
 		{
diff --git a/tool/tsh/common/device.go b/tool/tsh/common/device.go
index dfdf7e7b650..054d08d486d 100644
--- a/tool/tsh/common/device.go
+++ b/tool/tsh/common/device.go
@@ -169,7 +169,7 @@ func printEnrollOutcome(out io.Writer, outcome enroll.RunAdminOutcome, dev *devi
 	fmt.Fprintf(
 		out,
 		"Device %q/%v %v\n",
-		dev.AssetTag, devicetrust.FriendlyOSType(dev.OsType), action)
+		dev.GetAssetTag(), devicetrust.FriendlyOSType(dev.GetOsType()), action)
 }
 
 type deviceCollectCommand struct {
@@ -205,7 +205,7 @@ func (c *deviceAssetTagCommand) run(cf *CLIConf) error {
 		return trace.Wrap(err)
 	}
 
-	fmt.Fprintln(cf.Stdout(), cdd.SerialNumber)
+	fmt.Fprintln(cf.Stdout(), cdd.GetSerialNumber())
 	return nil
 }
 
diff --git a/tool/tsh/common/scan.go b/tool/tsh/common/scan.go
index c7da2c74ea6..9eb8cb168c3 100644
--- a/tool/tsh/common/scan.go
+++ b/tool/tsh/common/scan.go
@@ -109,7 +109,7 @@ func (c *scanKeysCommand) run(cf *CLIConf) error {
 
 	privateKeys := scanner.ScanPrivateKeys(
 		ctx,
-		deviceCred.Id,
+		deviceCred.GetId(),
 	)
 
 	printPrivateKeys(privateKeys)
@@ -159,8 +159,8 @@ func printPrivateKeys(privateKeys []secretsscanner.SSHPrivateKey) {
 	for _, pk := range privateKeys {
 		path, key := pk.Path, pk.Key
 		fmt.Printf("- SHA256 fingerprint: %q (mode: %s) at %s\n",
-			key.Spec.PublicKeyFingerprint,
-			accessgraph.DescribePublicKeyMode(key.Spec.PublicKeyMode),
+			key.GetSpec().GetPublicKeyFingerprint(),
+			accessgraph.DescribePublicKeyMode(key.GetSpec().GetPublicKeyMode()),
 			path,
 		)
 	}
diff --git a/tool/tsh/common/scope_test.go b/tool/tsh/common/scope_test.go
index 31c757398a8..8bc68a554ba 100644
--- a/tool/tsh/common/scope_test.go
+++ b/tool/tsh/common/scope_test.go
@@ -52,7 +52,7 @@ func TestResolveDesiredScope(t *testing.T) {
 		{
 			name:            "no flag, scoped profile -> inherit scope, no change",
 			cf:              &CLIConf{},
-			profile:         &client.ProfileStatus{ScopePin: &scopesv1.Pin{Scope: "/staging/west"}},
+			profile:         &client.ProfileStatus{ScopePin: scopesv1.Pin_builder{Scope: "/staging/west"}.Build()},
 			wantScope:       "/staging/west",
 			wantScopeChange: false,
 		},
@@ -82,7 +82,7 @@ func TestResolveDesiredScope(t *testing.T) {
 				Scope:          "/staging/east",
 				ScopeSetByUser: true,
 			},
-			profile:         &client.ProfileStatus{ScopePin: &scopesv1.Pin{Scope: "/staging/east"}},
+			profile:         &client.ProfileStatus{ScopePin: scopesv1.Pin_builder{Scope: "/staging/east"}.Build()},
 			wantScope:       "/staging/east",
 			wantScopeChange: false,
 		},
@@ -92,7 +92,7 @@ func TestResolveDesiredScope(t *testing.T) {
 				Scope:          "/staging/east",
 				ScopeSetByUser: true,
 			},
-			profile:         &client.ProfileStatus{ScopePin: &scopesv1.Pin{Scope: "/staging/west"}},
+			profile:         &client.ProfileStatus{ScopePin: scopesv1.Pin_builder{Scope: "/staging/west"}.Build()},
 			wantScope:       "/staging/east",
 			wantScopeChange: true,
 		},
@@ -102,7 +102,7 @@ func TestResolveDesiredScope(t *testing.T) {
 				Scope:          "",
 				ScopeSetByUser: true,
 			},
-			profile:         &client.ProfileStatus{ScopePin: &scopesv1.Pin{Scope: "/staging/west"}},
+			profile:         &client.ProfileStatus{ScopePin: scopesv1.Pin_builder{Scope: "/staging/west"}.Build()},
 			wantScope:       "",
 			wantScopeChange: true,
 		},
diff --git a/tool/tsh/common/scopes.go b/tool/tsh/common/scopes.go
index 57dfd0578c0..bc71afc9afd 100644
--- a/tool/tsh/common/scopes.go
+++ b/tool/tsh/common/scopes.go
@@ -82,7 +82,7 @@ func (c *scopesLSCommand) run(cf *CLIConf) error {
 
 	var assignments []*scopedaccessv1.ScopedRoleAssignment
 	if err := tc.WithRootClusterClient(ctx, func(clt authclient.ClientI) error {
-		assignments, err = stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, clt.ScopedAccessServiceClient(), &scopedaccessv1.ListScopedRoleAssignmentsRequest{
+		assignments, err = stream.Collect(scopedutils.RangeScopedRoleAssignments(ctx, clt.ScopedAccessServiceClient(), scopedaccessv1.ListScopedRoleAssignmentsRequest_builder{
 			// note that we are using the AllCallerAssignments flag here rather than just looking for
 			// our assignments by username. This flag suppresses standard scope-pinning, which allows
 			// us to see assignments in parent/orthogonal scopes. Generally, scoped commands only show
@@ -90,7 +90,7 @@ func (c *scopesLSCommand) run(cf *CLIConf) error {
 			// is specifically to discover potential 'tsh login --scope=...' targets, so we want to see
 			// everything regardless of current scope.
 			AllCallerAssignments: true,
-		}))
+		}.Build()))
 		return trace.Wrap(err)
 	}); err != nil {
 		return trace.Wrap(err)
diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go
index 28379281549..da648131d1c 100644
--- a/tool/tsh/common/tsh.go
+++ b/tool/tsh/common/tsh.go
@@ -2312,7 +2312,7 @@ func resolveScope(cf *CLIConf, profile *client.ProfileStatus) (string, bool) {
 
 		currentScope := ""
 		if profile != nil && profile.ScopePin != nil {
-			currentScope = profile.ScopePin.Scope
+			currentScope = profile.ScopePin.GetScope()
 		}
 
 		return targetScope, targetScope != currentScope
@@ -2320,7 +2320,7 @@ func resolveScope(cf *CLIConf, profile *client.ProfileStatus) (string, bool) {
 
 	// --scope not provided, inherit from profile.
 	if profile != nil && profile.ScopePin != nil {
-		return profile.ScopePin.Scope, false
+		return profile.ScopePin.GetScope(), false
 	}
 
 	return "", false
diff --git a/tool/tsh/common/vnet_client_application.go b/tool/tsh/common/vnet_client_application.go
index 8763ba82791..fba75001f63 100644
--- a/tool/tsh/common/vnet_client_application.go
+++ b/tool/tsh/common/vnet_client_application.go
@@ -122,11 +122,11 @@ func (p *vnetClientApplication) GetDialOptions(ctx context.Context, profileName
 	if err != nil {
 		return nil, trace.Wrap(err, "loading user profile")
 	}
-	dialOpts := &vnetv1.DialOptions{
+	dialOpts := vnetv1.DialOptions_builder{
 		WebProxyAddr:            profile.WebProxyAddr,
 		AlpnConnUpgradeRequired: profile.TLSRoutingConnUpgradeRequired,
 		InsecureSkipVerify:      p.cf.InsecureSkipVerify,
-	}
+	}.Build()
 	dialOpts.RootClusterCaCertPool, err = p.getRootClusterCACertPoolPEM(ctx, profileName)
 	if err != nil {
 		return nil, trace.Wrap(err)
diff --git a/tool/tsh/common/vnet_darwin.go b/tool/tsh/common/vnet_darwin.go
index 72ccf75211b..eab4c23f924 100644
--- a/tool/tsh/common/vnet_darwin.go
+++ b/tool/tsh/common/vnet_darwin.go
@@ -78,7 +78,7 @@ func newPlatformVnetUninstallServiceCommand(app *kingpin.Application) vnetComman
 
 func runVnetDiagnostics(ctx context.Context, nsi *vnetv1.NetworkStackInfo) error {
 	routeConflictDiag, err := diag.NewRouteConflictDiag(&diag.RouteConflictConfig{
-		VnetIfaceName: nsi.InterfaceName,
+		VnetIfaceName: nsi.GetInterfaceName(),
 		Routing:       &diag.DarwinRouting{},
 		Interfaces:    &diag.NetInterfaces{},
 	})
@@ -90,7 +90,7 @@ func runVnetDiagnostics(ctx context.Context, nsi *vnetv1.NetworkStackInfo) error
 		return trace.Wrap(err)
 	}
 
-	for _, rc := range rcs.GetRouteConflictReport().RouteConflicts {
+	for _, rc := range rcs.GetRouteConflictReport().GetRouteConflicts() {
 		fmt.Printf("Found a conflicting route: %+v\n", rc)
 	}
 
diff --git a/tool/tsh/common/workload_identity.go b/tool/tsh/common/workload_identity.go
index ef283db11b6..9c123fe45d3 100644
--- a/tool/tsh/common/workload_identity.go
+++ b/tool/tsh/common/workload_identity.go
@@ -156,8 +156,8 @@ func (c *issueX509Command) run(cf *CLIConf) error {
 				received = append(received,
 					fmt.Sprintf(
 						"%s:%s",
-						cred.WorkloadIdentityName,
-						cred.SpiffeId,
+						cred.GetWorkloadIdentityName(),
+						cred.GetSpiffeId(),
 					),
 				)
 			}
@@ -240,7 +240,7 @@ func (c *issueX509Command) run(cf *CLIConf) error {
 		fmt.Fprintf(
 			cf.Stdout(),
 			"SVID %q issued. Files written to: \n - %s\n - %s\n - %s\n",
-			x509Credential.SpiffeId,
+			x509Credential.GetSpiffeId(),
 			keyPath,
 			svidPath,
 			trustBundlePath,
@@ -346,8 +346,8 @@ func (c *issueJWTCommand) run(cf *CLIConf) error {
 				received = append(received,
 					fmt.Sprintf(
 						"%s:%s",
-						cred.WorkloadIdentityName,
-						cred.SpiffeId,
+						cred.GetWorkloadIdentityName(),
+						cred.GetSpiffeId(),
 					),
 				)
 			}
@@ -373,7 +373,7 @@ func (c *issueJWTCommand) run(cf *CLIConf) error {
 		fmt.Fprintf(
 			cf.Stdout(),
 			"SVID %q issued. File written to: \n - %s\n",
-			jwtCredential.SpiffeId,
+			jwtCredential.GetSpiffeId(),
 			jwtPath,
 		)
 
diff --git a/tool/tsh/common/workload_identity_test.go b/tool/tsh/common/workload_identity_test.go
index 0b4bfd376d9..d4e6888e20f 100644
--- a/tool/tsh/common/workload_identity_test.go
+++ b/tool/tsh/common/workload_identity_test.go
@@ -73,19 +73,19 @@ func TestWorkloadIdentityIssueX509(t *testing.T) {
 
 	_, err = s.root.GetAuthServer().Services.UpsertWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:   "my-workload-identity",
 				Labels: map[string]string{},
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/test",
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	require.EventuallyWithT(t, func(t *assert.CollectT) {
@@ -167,19 +167,19 @@ func TestWorkloadIdentityIssueJWT(t *testing.T) {
 
 	_, err = s.root.GetAuthServer().Services.UpsertWorkloadIdentity(
 		ctx,
-		&workloadidentityv1pb.WorkloadIdentity{
+		workloadidentityv1pb.WorkloadIdentity_builder{
 			Kind:    types.KindWorkloadIdentity,
 			Version: types.V1,
-			Metadata: &headerv1.Metadata{
+			Metadata: headerv1.Metadata_builder{
 				Name:   "my-workload-identity",
 				Labels: map[string]string{},
-			},
-			Spec: &workloadidentityv1pb.WorkloadIdentitySpec{
-				Spiffe: &workloadidentityv1pb.WorkloadIdentitySPIFFE{
+			}.Build(),
+			Spec: workloadidentityv1pb.WorkloadIdentitySpec_builder{
+				Spiffe: workloadidentityv1pb.WorkloadIdentitySPIFFE_builder{
 					Id: "/test",
-				},
-			},
-		},
+				}.Build(),
+			}.Build(),
+		}.Build(),
 	)
 	require.NoError(t, err)
 	require.EventuallyWithT(t, func(t *assert.CollectT) {