diff --git a/.github/actions/install-external-tools/action.yml b/.github/actions/install-external-tools/action.yml
new file mode 100644
index 0000000000..c9b125291e
--- /dev/null
+++ b/.github/actions/install-external-tools/action.yml
@@ -0,0 +1,32 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Install external tools for CI
+description: Install external tools CI
+
+# When possible, prefer installing pre-built external tools for speed. This allows us to avoid
+# downloading modules and compiling external tools on CI runners.
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/set-up-buf
+      with:
+        version: v1.25.0 # This should match the version in tools/tool.sh
+    - uses: ./.github/actions/set-up-gofumpt
+    - uses: ./.github/actions/set-up-gotestsum
+    - uses: ./.github/actions/set-up-misspell
+    - uses: ./.github/actions/set-up-staticcheck
+      # We assume that the Go toolchain will be managed by the caller workflow so we don't set one
+      # up here.
+    - run: go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+      shell: bash
+    - run: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+      shell: bash
+    - run: go install github.com/favadi/protoc-go-inject-tag@latest
+      shell: bash
+    - run: go install golang.org/x/tools/cmd/goimports@latest
+      shell: bash
+    - run: go install github.com/golangci/revgrep/cmd/revgrep@latest
+      shell: bash
diff --git a/.github/actions/set-up-buf/action.yml b/.github/actions/set-up-buf/action.yml
new file mode 100644
index 0000000000..c871f8b499
--- /dev/null
+++ b/.github/actions/set-up-buf/action.yml
@@ -0,0 +1,63 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Set up buf from Github releases
+description: Set up buf from Github releases
+
+inputs:
+  destination:
+    description: "Where to install the buf binary (default: $HOME/bin/buf)"
+    type: boolean
+    default: "$HOME/bin/buf"
+  version:
+    description: "The version to install (default: latest)"
+    type: string
+    default: Latest
+
+outputs:
+  destination:
+    description: Where the installed buf binary is
+    value: ${{ steps.install.outputs.destination }}
+  destination-dir:
+    description: The directory where the installed buf binary is
+    value: ${{ steps.install.outputs.destination-dir }}
+  version:
+    description: The installed version of buf
+    value: ${{ steps.install.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - id: install
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        VERSION=$(gh release list -R bufbuild/buf --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
+        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+        mkdir -p $(dirname ${{ inputs.destination }})
+        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
+        echo "destination=$DESTINATION" >> "$GITHUB_OUTPUT"
+        DESTINATION_DIR="$(dirname "$DESTINATION")"
+        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
+        echo "destination-dir=$DESTINATION_DIR" >> "$GITHUB_OUTPUT"
+
+        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
+        OS="$RUNNER_OS"
+        if [ "$ARCH" = "x64" ]; then
+          export ARCH="x86_64"
+        fi
+        if [ "$ARCH" = "arm64" ] && [ "$OS" = "Linux" ]; then
+          export ARCH="aarch64"
+        fi
+        if [ "$OS" = "macOS" ]; then
+          export OS="Darwin"
+        fi
+
+        mkdir -p tmp
+        gh release download "$VERSION" -p "buf-${OS}-${ARCH}.tar.gz" -O tmp/buf.tgz -R bufbuild/buf
+        pushd tmp && tar -xvf buf.tgz && popd
+        mv tmp/buf/bin/buf "$DESTINATION"
+        rm -rf tmp
diff --git a/.github/actions/set-up-go/action.yml b/.github/actions/set-up-go/action.yml
index e559b88616..280fcc5240 100644
--- a/.github/actions/set-up-go/action.yml
+++ b/.github/actions/set-up-go/action.yml
@@ -65,10 +65,5 @@ runs:
       shell: bash
       run: |
         git config --global url."https://${{ inputs.github-token }}@github.com".insteadOf https://github.com
-        for mod in $(find . -type f -name go.mod); do
-          pushd "$(dirname $mod)"
-            go list ./...
-            go list -test ./...
-            go mod download
-          popd
-        done
+        make go-mod-download
+        du -h -d 1 ${{ steps.metadata.outputs.cache-path }}
diff --git a/.github/actions/set-up-gofumpt/action.yml b/.github/actions/set-up-gofumpt/action.yml
new file mode 100644
index 0000000000..5f32b1cc3a
--- /dev/null
+++ b/.github/actions/set-up-gofumpt/action.yml
@@ -0,0 +1,58 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Set up gofumpt from Github releases
+description: Set up gofumpt from Github releases
+
+inputs:
+  destination:
+    description: "Where to install the gofumpt binary (default: $HOME/bin/gofumpt)"
+    type: boolean
+    default: "$HOME/bin/gofumpt"
+  version:
+    description: "The version to install (default: latest)"
+    type: string
+    default: Latest
+
+outputs:
+  destination:
+    description: Where the installed gofumpt binary is
+    value: ${{ steps.install.outputs.destination }}
+  destination-dir:
+    description: The directory where the installed gofumpt binary is
+    value: ${{ steps.install.outputs.destination-dir }}
+  version:
+    description: The installed version of gofumpt
+    value: ${{ steps.install.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - id: install
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        VERSION=$(gh release list -R mvdan/gofumpt --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
+        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+        mkdir -p $(dirname ${{ inputs.destination }})
+        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
+        echo "destination=$DESTINATION" >> "$GITHUB_OUTPUT"
+        DESTINATION_DIR="$(dirname "$DESTINATION")"
+        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
+        echo "destination-dir=$DESTINATION_DIR" >> "$GITHUB_OUTPUT"
+
+        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
+        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
+        if [ "$ARCH" = "x64" ]; then
+          export ARCH="amd64"
+        fi
+        if [ "$OS" = "macos" ]; then
+          export OS="darwin"
+        fi
+
+        gh release download "$VERSION" -p "gofumpt_*_${OS}_${ARCH}" -O gofumpt -R mvdan/gofumpt
+        chmod +x gofumpt
+        mv gofumpt "$DESTINATION"
diff --git a/.github/actions/set-up-gotestsum/action.yml b/.github/actions/set-up-gotestsum/action.yml
index 8967889b03..15d9220200 100644
--- a/.github/actions/set-up-gotestsum/action.yml
+++ b/.github/actions/set-up-gotestsum/action.yml
@@ -9,7 +9,7 @@ inputs:
   destination:
     description: "Where to install the gotestsum binary (default: $HOME/bin/gotestsum)"
     type: boolean
-    default: "$HOME/bin"
+    default: "$HOME/bin/gotestsum"
   version:
     description: "The version to install (default: latest)"
     type: string
@@ -34,15 +34,15 @@ runs:
       env:
         GH_TOKEN: ${{ github.token }}
       run: |
-        VERSION=$(gh release list -R gotestyourself/gotestsum --exclude-drafts --exclude-pre-releases | grep Latest | cut -f1)
+        VERSION=$(gh release list -R gotestyourself/gotestsum --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
         echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
-        mkdir -p "$HOME/bin"
-        DESTINATION="$(readlink -f "$HOME/bin")"
-        echo "destination=$DESTINATION" >> "GITHUB_OUTPUT"
+        mkdir -p $(dirname ${{ inputs.destination }})
+        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
+        echo "destination=$DESTINATION" >> "$GITHUB_OUTPUT"
         DESTINATION_DIR="$(dirname "$DESTINATION")"
         echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
-        echo "destination-dir=$DESTINATION_DIR" >> "GITHUB_OUTPUT"
+        echo "destination-dir=$DESTINATION_DIR" >> "$GITHUB_OUTPUT"
 
         OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
         ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
@@ -50,6 +50,8 @@ runs:
           export ARCH="amd64"
         fi
 
-        gh release download "$VERSION" -p "*${OS}_${ARCH}.tar.gz" -O gotestsum.tgz -R gotestyourself/gotestsum
-        tar -xvf gotestsum.tgz
-        mv gotestsum "${DESTINATION_DIR}/gotestsum"
+        mkdir -p tmp
+        gh release download "$VERSION" -p "*${OS}_${ARCH}.tar.gz" -O tmp/gotestsum.tgz -R gotestyourself/gotestsum
+        pushd tmp && tar -xvf gotestsum.tgz && popd
+        mv tmp/gotestsum "$DESTINATION"
+        rm -rf tmp
diff --git a/.github/actions/set-up-misspell/action.yml b/.github/actions/set-up-misspell/action.yml
new file mode 100644
index 0000000000..6029c1d40c
--- /dev/null
+++ b/.github/actions/set-up-misspell/action.yml
@@ -0,0 +1,60 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Set up misspell from Github releases
+description: Set up misspell from Github releases
+
+inputs:
+  destination:
+    description: "Where to install the misspell binary (default: $HOME/bin/misspell)"
+    type: boolean
+    default: "$HOME/bin/misspell"
+  version:
+    description: "The version to install (default: latest)"
+    type: string
+    default: Latest
+
+outputs:
+  destination:
+    description: Where the installed misspell binary is
+    value: ${{ steps.install.outputs.destination }}
+  destination-dir:
+    description: The directory where the installed misspell binary is
+    value: ${{ steps.install.outputs.destination-dir }}
+  version:
+    description: The installed version of misspell
+    value: ${{ steps.install.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - id: install
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        VERSION=$(gh release list -R golangci/misspell --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -f1)
+        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+        mkdir -p $(dirname ${{ inputs.destination }})
+        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
+        echo "destination=$DESTINATION" >> "$GITHUB_OUTPUT"
+        DESTINATION_DIR="$(dirname "$DESTINATION")"
+        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
+        echo "destination-dir=$DESTINATION_DIR" >> "$GITHUB_OUTPUT"
+
+        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
+        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
+        if [ "$ARCH" = "x64" ]; then
+          export ARCH="64bit"
+        fi
+        if [ "$OS" = "macos" ]; then
+          export OS="mac"
+        fi
+
+        mkdir -p tmp
+        gh release download "$VERSION" -p "misspell_*_${OS}_${ARCH}.tar.gz" -O tmp/misspell.tgz -R golangci/misspell
+        pushd tmp && tar -xvf misspell.tgz && popd
+        mv tmp/misspell "$DESTINATION"
+        rm -rf tmp
diff --git a/.github/actions/set-up-staticcheck/action.yml b/.github/actions/set-up-staticcheck/action.yml
new file mode 100644
index 0000000000..6a4b6a3978
--- /dev/null
+++ b/.github/actions/set-up-staticcheck/action.yml
@@ -0,0 +1,60 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+---
+name: Set up staticcheck from Github releases
+description: Set up staticcheck from Github releases
+
+inputs:
+  destination:
+    description: "Where to install the staticcheck binary (default: $HOME/bin/staticcheck)"
+    type: boolean
+    default: "$HOME/bin/staticcheck"
+  version:
+    description: "The version to install (default: latest)"
+    type: string
+    default: Latest
+
+outputs:
+  destination:
+    description: Where the installed staticcheck binary is
+    value: ${{ steps.install.outputs.destination }}
+  destination-dir:
+    description: The directory where the installed staticcheck binary is
+    value: ${{ steps.install.outputs.destination-dir }}
+  version:
+    description: The installed version of staticcheck
+    value: ${{ steps.install.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - id: install
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        VERSION=$(gh release list -R dominikh/go-tools --exclude-drafts --exclude-pre-releases | grep ${{ inputs.version }} | cut -d " " -f2)
+        echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+        mkdir -p $(dirname ${{ inputs.destination }})
+        DESTINATION="$(readlink -f "${{ inputs.destination }}")"
+        echo "destination=$DESTINATION" >> "$GITHUB_OUTPUT"
+        DESTINATION_DIR="$(dirname "$DESTINATION")"
+        echo "$DESTINATION_DIR" >> "$GITHUB_PATH"
+        echo "destination-dir=$DESTINATION_DIR" >> "$GITHUB_OUTPUT"
+
+        ARCH="$(echo "$RUNNER_ARCH" | tr '[:upper:]' '[:lower:]')"
+        OS="$(echo "$RUNNER_OS" | tr '[:upper:]' '[:lower:]')"
+        if [ "$ARCH" = "x64" ]; then
+          export ARCH="amd64"
+        fi
+        if [ "$OS" = "macos" ]; then
+          export OS="darwin"
+        fi
+
+        mkdir -p tmp
+        gh release download "$VERSION" -p "staticcheck_${OS}_${ARCH}.tar.gz" -O tmp/staticcheck.tgz -R dominikh/go-tools
+        pushd tmp && tar -xvf staticcheck.tgz && popd
+        mv tmp/staticcheck/staticcheck "$DESTINATION"
+        rm -rf tmp
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af6f042b9a..989b5eaf7a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -152,7 +152,7 @@ jobs:
     if: |
       needs.setup.outputs.enterprise == 1 &&
       needs.verify-changes.outputs.is_docs_change == 'false' &&
-      needs.verify-changes.outputs.is_ui_change == 'false' && 
+      needs.verify-changes.outputs.is_ui_change == 'false' &&
       (contains(github.event.pull_request.labels.*.name, 'fips') || github.ref_name == 'main' || startsWith(github.ref_name, 'release/'))
     needs:
       - setup
@@ -243,8 +243,7 @@ jobs:
         run: |
           rm -rf ./pkg
           mkdir ./pkg
-
-          make ci-bootstrap dev
+          make prep dev
       - id: test-ui
         name: test-ui
         if: github.repository == 'hashicorp/vault-enterprise'
@@ -261,7 +260,7 @@ jobs:
         name: test-ui-oss
         run: |
           export PATH="${PWD}/bin:${PATH}"
-          
+
           # Run Ember tests
           cd ui
           mkdir -p test-results/qunit
diff --git a/.github/workflows/code-checker.yml b/.github/workflows/code-checker.yml
index 7a973a4f14..576e801b39 100644
--- a/.github/workflows/code-checker.yml
+++ b/.github/workflows/code-checker.yml
@@ -13,9 +13,21 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  setup:
+    name: Setup
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Ensure Go modules are cached
+        uses: ./.github/actions/set-up-go
+        with:
+          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          no-restore: true # don't download them on a cache hit
+
   deprecations:
     name: Deprecated functions
     runs-on: ubuntu-latest
+    needs: setup
     if: github.base_ref == 'main'
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
@@ -24,12 +36,14 @@ jobs:
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/install-external-tools # for staticcheck
       - run: make ci-deprecations
         name: Check deprecations
 
   codechecker:
     name: Code checks
     runs-on: ubuntu-latest
+    needs: setup
     if: github.base_ref == 'main'
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
@@ -38,61 +52,44 @@ jobs:
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/install-external-tools # for buf
         # Note: if there is a function we want to ignore the nilnil check for,
         # You can add 'ignore-nil-nil-function-check' somewhere in the
         # godoc for the function.
       - run: make ci-vet-codechecker
         name: Check custom linters
-      - run: |
-          make bootstrap
-          make protolint
+      - run: make protolint
         name: Protobuf lint
 
   generate-delta:
     name: Protobuf generate delta
     runs-on: ubuntu-latest
+    needs: setup
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+      - uses: ./.github/actions/install-external-tools # for buf and protoc-*
       - name: Check generate delta
-        run: |
-          make bootstrap
-          # Delete all protobuf files first, in case we removed a protobuf file
-          find . -type f -name '*.pb.go' -delete
-          make proto
-          if ! git diff --exit-code; then
-            echo "Protobuf files need regenerating. Run 'make proto' to fix"
-            exit 1
-          fi
+        run: make prep check-proto-delta
 
   format:
     name: Format
     runs-on: ubuntu-latest
+    needs: setup
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - uses: ./.github/actions/install-external-tools # for buf and gofumpt
       - uses: ./.github/actions/set-up-go
         with:
           github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
       - name: Go format
-        run: |
-          make ci-bootstrap
-          echo "Using gofumpt version $(go run mvdan.cc/gofumpt -version)"
-          make fmt
-          if ! git diff --exit-code; then
-            echo "Code has formatting errors. Run 'make fmt' to fix"
-            exit 1
-          fi
+        run: make prep check-go-fmt
       - name: Protobuf format
         run: |
-          make bootstrap
-          echo "Using buf version $(go run github.com/bufbuild/buf/cmd/buf --version)"
-          make protofmt
-          if ! git diff --exit-code; then
-            echo "Protobuf code has formatting errors. Run 'make protofmt' to fix"
-            exit 1
-          fi
+          echo "Using buf version $(buf --version)"
+          make check-proto-fmt
 
   semgrep:
     name: Semgrep
@@ -102,5 +99,4 @@ jobs:
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
       - name: Run Semgrep Rules
-        id: semgrep
         run: semgrep ci --include '*.go' --config 'tools/semgrep/ci'
diff --git a/.github/workflows/test-go.yml b/.github/workflows/test-go.yml
index bcfc5ec05e..0d5656a159 100644
--- a/.github/workflows/test-go.yml
+++ b/.github/workflows/test-go.yml
@@ -248,12 +248,13 @@ jobs:
         if: github.repository != 'hashicorp/vault-enterprise'
         run: |
           git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN}}@github.com".insteadOf https://github.com
-      - id: build
-        if: inputs.binary-tests && matrix.id == inputs.total-runners
+      - uses: ./.github/actions/install-external-tools
+      - if: inputs.binary-tests && matrix.id == inputs.total-runners
+        name: Build dev binary for binary tests
+        # The dev mode binary has to exist for binary tests that are dispatched on the last runner.
         env:
           GOPRIVATE: github.com/hashicorp/*
-        run: time make ci-bootstrap dev
-      - uses: ./.github/actions/set-up-gotestsum
+        run: time make prep dev
       - name: Install gVisor
         # Enterprise repo runners do not allow sudo, so can't install gVisor there yet.
         if: ${{ !inputs.enterprise }}
@@ -342,11 +343,11 @@ jobs:
           # The docker/binary tests are more expensive, and we've had problems with timeouts when running at full
           # parallelism.  The default if -p isn't specified is to use NumCPUs, which seems fine for regular tests.
           package_parallelism=""
-          
+
           if [ -f bin/vault ]; then
             VAULT_BINARY="$(pwd)/bin/vault"
             export VAULT_BINARY
-          
+
             package_parallelism="-p 2"
           fi
 
@@ -364,7 +365,6 @@ jobs:
           VAULT_TEST_LOG_DIR="$(pwd)/test-results/go-test/logs-${{ matrix.id }}"
           export VAULT_TEST_LOG_DIR
           mkdir -p "$VAULT_TEST_LOG_DIR"
-          
           # shellcheck disable=SC2086 # can't quote RERUN_FAILS
           GOARCH=${{ inputs.go-arch }} VAULT_ADDR='' \
             gotestsum --format=short-verbose \
diff --git a/.hooks/pre-commit b/.hooks/pre-commit
index d2d52a71ab..40482966c9 100755
--- a/.hooks/pre-commit
+++ b/.hooks/pre-commit
@@ -68,8 +68,8 @@ backend_lint() {
     return 0
   fi
 
-  # Only run fmtcheck on staged files
-  ./scripts/gofmtcheck.sh "${staged}" || block "Backend linting failed; run 'make fmt' to fix."
+  # Only run check-fmt on staged files
+  ./scripts/go-helper.sh check-fmt "${staged}" || block "Backend linting failed; run 'make fmt' to fix."
 }
 
 for CHECK in $CHECKS; do
diff --git a/Makefile b/Makefile
index 315d855c9f..50c6e92a7a 100644
--- a/Makefile
+++ b/Makefile
@@ -7,13 +7,6 @@ TEST_TIMEOUT?=45m
 EXTENDED_TEST_TIMEOUT=60m
 INTEG_TEST_TIMEOUT=120m
 VETARGS?=-asmdecl -atomic -bool -buildtags -copylocks -methods -nilfunc -printf -rangeloops -shift -structtags -unsafeptr
-EXTERNAL_TOOLS_CI=\
-	golang.org/x/tools/cmd/goimports \
-	github.com/golangci/revgrep/cmd/revgrep \
-	mvdan.cc/gofumpt \
-	honnef.co/go/tools/cmd/staticcheck
-EXTERNAL_TOOLS=\
-	github.com/client9/misspell/cmd/misspell
 GOFMT_FILES?=$$(find . -name '*.go' | grep -v pb.go | grep -v vendor)
 SED?=$(shell command -v gsed || command -v sed)
 
@@ -119,39 +112,40 @@ deprecations: bootstrap prep
 
 # ci-deprecations runs staticcheck tool to look for deprecations. All output gets piped to revgrep
 # which will only return an error if changes that is not on main has deprecated function, variable, constant or field
-ci-deprecations: ci-bootstrap prep
+ci-deprecations: prep check-tools-external
 	@BUILD_TAGS='$(BUILD_TAGS)' ./scripts/deprecations-checker.sh main
 
-tools/codechecker/.bin/codechecker:
-	@cd tools/codechecker && $(GO_CMD) build -o .bin/codechecker .
-
 # vet-codechecker runs our custom linters on the test functions. All output gets
 # piped to revgrep which will only return an error if new piece of code violates
 # the check
-vet-codechecker: bootstrap tools/codechecker/.bin/codechecker prep
-	@$(GO_CMD) vet -vettool=./tools/codechecker/.bin/codechecker -tags=$(BUILD_TAGS) ./... 2>&1 | revgrep
+vet-codechecker: check-tools-internal
+	@echo "==> Running go vet with ./tools/codechecker..."
+	@$(GO_CMD) vet -vettool=$$(which codechecker) -tags=$(BUILD_TAGS) ./... 2>&1 | revgrep
 
 # vet-codechecker runs our custom linters on the test functions. All output gets
 # piped to revgrep which will only return an error if new piece of code that is
 # not on main violates the check
-ci-vet-codechecker: ci-bootstrap tools/codechecker/.bin/codechecker prep
-	@$(GO_CMD) vet -vettool=./tools/codechecker/.bin/codechecker -tags=$(BUILD_TAGS) ./... 2>&1 | revgrep origin/main
+ci-vet-codechecker: tools-internal check-tools-external
+	@echo "==> Running go vet with ./tools/codechecker..."
+	@$(GO_CMD) vet -vettool=$$(which codechecker) -tags=$(BUILD_TAGS) ./... 2>&1 | revgrep origin/main
 
 # lint runs vet plus a number of other checkers, it is more comprehensive, but louder
-lint:
+lint: check-tools-external
 	@$(GO_CMD) list -f '{{.Dir}}' ./... | grep -v /vendor/ \
 		| xargs golangci-lint run; if [ $$? -eq 1 ]; then \
 			echo ""; \
 			echo "Lint found suspicious constructs. Please check the reported constructs"; \
 			echo "and fix them if necessary before submitting the code for reviewal."; \
 		fi
+
 # for ci jobs, runs lint against the changed packages in the commit
-ci-lint:
+ci-lint: check-tools-external
 	@golangci-lint run --deadline 10m --new-from-rev=HEAD~
 
 # Lint protobuf files
-protolint: ci-bootstrap
-	buf lint
+protolint: prep check-tools-external
+	@echo "==> Linting protobufs..."
+	@buf lint
 
 # prep runs `go generate` to build the dynamically generated
 # source files.
@@ -160,26 +154,14 @@ protolint: ci-bootstrap
 # now run as a pre-commit hook (and there's little value in
 # making every build run the formatter), we've removed that
 # dependency.
-prep:
-	@sh -c "'$(CURDIR)/scripts/goversioncheck.sh' '$(GO_VERSION_MIN)'"
+prep: check-go-version
+	@echo "==> Running go generate..."
 	@GOARCH= GOOS= $(GO_CMD) generate $$($(GO_CMD) list ./... | grep -v /vendor/)
 	@if [ -d .git/hooks ]; then cp .hooks/* .git/hooks/; fi
 
-# bootstrap the build by downloading additional tools needed to build
-ci-bootstrap: .ci-bootstrap
-.ci-bootstrap:
-	@for tool in  $(EXTERNAL_TOOLS_CI) ; do \
-		echo "Installing/Updating $$tool" ; \
-		GO111MODULE=off $(GO_CMD) get -u $$tool; \
-	done
-	go install github.com/bufbuild/buf/cmd/buf@v1.25.0
-	@touch .ci-bootstrap
-
-# bootstrap the build by downloading additional tools that may be used by devs
-bootstrap: ci-bootstrap
-	@sh -c "'$(CURDIR)/scripts/goversioncheck.sh' '$(GO_VERSION_MIN)'"
-	go generate -tags tools tools/tools.go
-	go install github.com/bufbuild/buf/cmd/buf@v1.25.0
+# bootstrap the build by generating any necessary code and downloading additional tools that may
+# be used by devs.
+bootstrap: prep tools
 
 # Note: if you have plugins in GOPATH you can update all of them via something like:
 # for i in $(ls | grep vault-plugin-); do cd $i; git remote update; git reset --hard origin/master; dep ensure -update; git add .; git commit; git push; cd ..; done
@@ -190,37 +172,33 @@ static-assets-dir:
 	@mkdir -p ./http/web_ui
 
 install-ui-dependencies:
-	@echo "--> Installing JavaScript assets"
+	@echo "==> Installing JavaScript assets"
 	@cd ui && yarn
 
 test-ember: install-ui-dependencies
-	@echo "--> Running ember tests"
+	@echo "==> Running ember tests"
 	@cd ui && yarn run test:oss
 
 test-ember-enos: install-ui-dependencies
-	@echo "--> Running ember tests with a real backend"
+	@echo "==> Running ember tests with a real backend"
 	@cd ui && yarn run test:enos
 
-check-vault-in-path:
-	@VAULT_BIN=$$(command -v vault) || { echo "vault command not found"; exit 1; }; \
-		[ -x "$$VAULT_BIN" ] || { echo "$$VAULT_BIN not executable"; exit 1; }; \
-		printf "Using Vault at %s:\n\$$ vault version\n%s\n" "$$VAULT_BIN" "$$(vault version)"
-
 ember-dist: install-ui-dependencies
 	@cd ui && npm rebuild node-sass
-	@echo "--> Building Ember application"
+	@echo "==> Building Ember application"
 	@cd ui && yarn run build
 	@rm -rf ui/if-you-need-to-delete-this-open-an-issue-async-disk-cache
 
 ember-dist-dev: install-ui-dependencies
 	@cd ui && npm rebuild node-sass
-	@echo "--> Building Ember application"
+	@echo "==> Building Ember application"
 	@cd ui && yarn run build:dev
 
 static-dist: ember-dist
 static-dist-dev: ember-dist-dev
 
-proto: bootstrap
+proto: check-tools-external
+	@echo "==> Generating Go code from protobufs..."
 	buf generate
 
 	# No additional sed expressions should be added to this list. Going forward
@@ -233,21 +211,25 @@ proto: bootstrap
 	protoc-go-inject-tag -input=./helper/identity/types.pb.go
 	protoc-go-inject-tag -input=./helper/identity/mfa/types.pb.go
 
-fmtcheck:
-	@sh -c "'$(CURDIR)/scripts/gofmtcheck.sh'"
+fmt:
+	find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs gofumpt -w
 
-fmt: ci-bootstrap
-	find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs go run mvdan.cc/gofumpt -w
+fmtcheck: check-go-fmt
 
-protofmt: ci-bootstrap
+.PHONY: go-mod-download
+go-mod-download:
+	@$(CURDIR)/scripts/go-helper.sh mod-download
+
+.PHONY: go-mod-tidy
+go-mod-tidy:
+	@$(CURDIR)/scripts/go-helper.sh mod-tidy
+
+protofmt:
 	buf format -w
 
 semgrep:
 	semgrep --include '*.go' --exclude 'vendor' -a -f tools/semgrep .
 
-semgrep-ci:
-	semgrep --error --include '*.go' --exclude 'vendor' -f tools/semgrep/ci .
-
 assetcheck:
 	@echo "==> Checking compiled UI assets..."
 	@sh -c "'$(CURDIR)/scripts/assetcheck.sh'"
@@ -256,6 +238,60 @@ spellcheck:
 	@echo "==> Spell checking website..."
 	@misspell -error -source=text website/source
 
+.PHONY check-go-fmt:
+check-go-fmt:
+	@$(CURDIR)/scripts/go-helper.sh check-fmt
+
+.PHONY check-go-version:
+check-go-version:
+	@$(CURDIR)/scripts/go-helper.sh check-version $(GO_VERSION_MIN)
+
+.PHONY: check-proto-fmt
+check-proto-fmt:
+	buf format -d --error-format github-actions --exit-code
+
+.PHONY: check-proto-delta
+check-proto-delta: prep
+	@echo "==> Checking for a delta in proto generated Go files..."
+	@echo "==> Deleting all *.pg.go files..."
+	find . -type f -name '*.pb.go' -delete -print0
+	@$(MAKE) -f $(THIS_FILE) proto
+	@if ! git diff --exit-code; then echo "Go protobuf bindings need to be regenerated. Run 'make proto' to fix them." && exit 1; fi
+
+.PHONY:check-sempgrep
+check-sempgrep: check-tools-external
+	@echo "==> Checking semgrep..."
+	@semgrep --error --include '*.go' --exclude 'vendor' -f tools/semgrep/ci .
+
+.PHONY: check-tools
+check-tools:
+	@$(CURDIR)/tools/tools.sh check
+
+.PHONY: check-tools-external
+check-tools-external:
+	@$(CURDIR)/tools/tools.sh check-external
+
+.PHONY: check-tools-internal
+check-tools-internal:
+	@$(CURDIR)/tools/tools.sh check-internal
+
+check-vault-in-path:
+	@VAULT_BIN=$$(command -v vault) || { echo "vault command not found"; exit 1; }; \
+		[ -x "$$VAULT_BIN" ] || { echo "$$VAULT_BIN not executable"; exit 1; }; \
+		printf "Using Vault at %s:\n\$$ vault version\n%s\n" "$$VAULT_BIN" "$$(vault version)"
+
+.PHONY: tools
+tools:
+	@$(CURDIR)/tools/tools.sh install
+
+.PHONY: tools-external
+tools-external:
+	@$(CURDIR)/tools/tools.sh install-external
+
+.PHONY: tools-internal
+tools-internal:
+	@$(CURDIR)/tools/tools.sh install-internal
+
 mysql-database-plugin:
 	@CGO_ENABLED=0 $(GO_CMD) build -o bin/mysql-database-plugin ./plugins/database/mysql/mysql-database-plugin
 
@@ -280,10 +316,6 @@ hana-database-plugin:
 mongodb-database-plugin:
 	@CGO_ENABLED=0 $(GO_CMD) build -o bin/mongodb-database-plugin ./plugins/database/mongodb/mongodb-database-plugin
 
-.PHONY: bin default prep test vet bootstrap ci-bootstrap fmt fmtcheck mysql-database-plugin mysql-legacy-database-plugin cassandra-database-plugin influxdb-database-plugin postgresql-database-plugin mssql-database-plugin hana-database-plugin mongodb-database-plugin ember-dist ember-dist-dev static-dist static-dist-dev assetcheck check-vault-in-path packages build build-ci semgrep semgrep-ci vet-codechecker ci-vet-codechecker
-
-.NOTPARALLEL: ember-dist ember-dist-dev
-
 # These ci targets are used for used for building and testing in Github Actions
 # workflows and for Enos scenarios.
 .PHONY: ci-build
@@ -314,10 +346,18 @@ ci-get-revision:
 ci-get-version-package:
 	@$(CURDIR)/scripts/ci-helper.sh version-package
 
+.PHONY: ci-install-external-tools
+ci-install-external-tools:
+	@$(CURDIR)/scripts/ci-helper.sh install-external-tools
+
 .PHONY: ci-prepare-legal
 ci-prepare-legal:
 	@$(CURDIR)/scripts/ci-helper.sh prepare-legal
 
+.PHONY: ci-update-external-tool-modules
+ci-update-external-tool-modules:
+	@$(CURDIR)/scripts/ci-helper.sh update-external-tool-modules
+
 .PHONY: ci-copywriteheaders
 ci-copywriteheaders:
 	copywrite headers --plan
@@ -326,3 +366,6 @@ ci-copywriteheaders:
 	cd sdk && $(CURDIR)/scripts/copywrite-exceptions.sh
 	cd shamir && $(CURDIR)/scripts/copywrite-exceptions.sh
 
+.PHONY: all bin default prep test vet bootstrap fmt fmtcheck mysql-database-plugin mysql-legacy-database-plugin cassandra-database-plugin influxdb-database-plugin postgresql-database-plugin mssql-database-plugin hana-database-plugin mongodb-database-plugin ember-dist ember-dist-dev static-dist static-dist-dev assetcheck check-vault-in-path packages build build-ci semgrep semgrep-ci vet-codechecker ci-vet-codechecker clean dev
+
+.NOTPARALLEL: ember-dist ember-dist-dev
diff --git a/go.mod b/go.mod
index 9f866bd65a..117f02c0f6 100644
--- a/go.mod
+++ b/go.mod
@@ -49,7 +49,6 @@ require (
 	github.com/axiomhq/hyperloglog v0.0.0-20220105174342-98591331716a
 	github.com/cenkalti/backoff/v3 v3.2.2
 	github.com/chrismalek/oktasdk-go v0.0.0-20181212195951-3430665dfaa0
-	github.com/client9/misspell v0.3.4
 	github.com/cockroachdb/cockroach-go v0.0.0-20181001143604-e0a95dfd547c
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/denisenkom/go-mssqldb v0.12.3
@@ -58,7 +57,6 @@ require (
 	github.com/dustin/go-humanize v1.0.1
 	github.com/fatih/color v1.16.0
 	github.com/fatih/structs v1.1.0
-	github.com/favadi/protoc-go-inject-tag v1.4.0
 	github.com/gammazero/workerpool v1.1.3
 	github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
 	github.com/go-errors/errors v1.5.0
@@ -71,7 +69,6 @@ require (
 	github.com/gocql/gocql v1.0.0
 	github.com/golang-jwt/jwt/v4 v4.5.0
 	github.com/golang/protobuf v1.5.3
-	github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6
 	github.com/google/go-cmp v0.5.9
 	github.com/google/go-github v17.0.0+incompatible
 	github.com/google/go-metrics-stackdriver v0.2.0
@@ -228,14 +225,10 @@ require (
 	golang.org/x/tools v0.14.0
 	google.golang.org/api v0.139.0
 	google.golang.org/grpc v1.58.3
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0
 	google.golang.org/protobuf v1.31.0
 	gopkg.in/ory-am/dockertest.v3 v3.3.4
-	gotest.tools/gotestsum v1.10.0
-	honnef.co/go/tools v0.4.3
 	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
 	layeh.com/radius v0.0.0-20190322222518-890bc1058917
-	mvdan.cc/gofumpt v0.5.0
 	nhooyr.io/websocket v1.8.7
 )
 
@@ -330,7 +323,6 @@ require (
 	github.com/dgryski/go-metro v0.0.0-20180109044635-280f6062b5bc // indirect
 	github.com/digitalocean/godo v1.7.5 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/dnephin/pflag v1.0.7 // indirect
 	github.com/docker/cli v23.0.3+incompatible // indirect
 	github.com/docker/distribution v2.8.2+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
@@ -343,7 +335,6 @@ require (
 	github.com/envoyproxy/protoc-gen-validate v1.0.2 // indirect
 	github.com/evanphx/json-patch/v5 v5.6.0 // indirect
 	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
-	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
 	github.com/gammazero/deque v0.2.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
@@ -516,7 +507,6 @@ require (
 	go.opentelemetry.io/otel/metric v1.19.0 // indirect
 	go.uber.org/multierr v1.7.0 // indirect
 	go.uber.org/zap v1.19.1 // indirect
-	golang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a // indirect
 	golang.org/x/mod v0.13.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
diff --git a/go.sum b/go.sum
index 14c93b1257..87fb96bc3a 100644
--- a/go.sum
+++ b/go.sum
@@ -1290,7 +1290,6 @@ github.com/circonus-labs/circonusllhist v0.1.3 h1:TJH+oke8D16535+jHExHj4nQvzlZrj
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/cjlapao/common-go v0.0.39 h1:bAAUrj2B9v0kMzbAOhzjSmiyDy+rd56r2sy7oEiQLlA=
 github.com/cjlapao/common-go v0.0.39/go.mod h1:M3dzazLjTjEtZJbbxoA5ZDiGCiHmpwqW9l4UWaddwOA=
-github.com/client9/misspell v0.3.4 h1:ta993UF76GwbvJcIo3Y68y/M3WxlpEHPWIGDkJYwzJI=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
 github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
@@ -1533,8 +1532,6 @@ github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyG
 github.com/dnaeon/go-vcr v1.1.0/go.mod h1:M7tiix8f0r6mKKJ3Yq/kqU1OYf3MnfmBWVbPx/yU9ko=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/dnephin/pflag v1.0.7 h1:oxONGlWxhmUct0YzKTgrpQv9AUA1wtPBn7zuSjJqptk=
-github.com/dnephin/pflag v1.0.7/go.mod h1:uxE91IoWURlOiTUIA8Mq5ZZkAv3dPUfZNaT80Zm7OQE=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v20.10.17+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v20.10.20+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
@@ -1626,8 +1623,6 @@ github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
 github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/favadi/protoc-go-inject-tag v1.4.0 h1:K3KXxbgRw5WT4f43LbglARGz/8jVsDOS7uMjG4oNvXY=
-github.com/favadi/protoc-go-inject-tag v1.4.0/go.mod h1:AZ+PK+QDKUOLlBRG0rYiKkUX5Hw7+7GTFzlU99GFSbQ=
 github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.2/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
@@ -1891,8 +1886,6 @@ github.com/golang/snappy v0.0.2/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEW
 github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6 h1:DIPQnGy2Gv2FSA4B/hh8Q7xx3B7AIDk3DAMeHclH1vQ=
-github.com/golangci/revgrep v0.0.0-20220804021717-745bb2f7c2e6/go.mod h1:0AKcRCkMoKvUvlf89F6O7H2LYdhr1zBh736mBItOdRs=
 github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
@@ -3394,8 +3387,6 @@ golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p
 golang.org/x/exp v0.0.0-20230206171751-46f607a40771/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63 h1:m64FZMko/V45gv0bNmrNYoDEq8U5YUhetc9cBWKS1TQ=
 golang.org/x/exp v0.0.0-20230817173708-d852ddb80c63/go.mod h1:0v4NqG35kSWCMzLaMeX+IQrlSnVE/bqGSyC2cz/9Le8=
-golang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a h1:Jw5wfR+h9mnIYH+OtGT2im5wV1YGGDora5vTv/aa5bE=
-golang.org/x/exp/typeparams v0.0.0-20221208152030-732eee02a75a/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -3770,7 +3761,6 @@ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9sn
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
@@ -3903,7 +3893,6 @@ golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E=
-golang.org/x/tools v0.1.11/go.mod h1:SgwaegtQh8clINPpECJMqnxLv9I09HLqnW3RMqW0CA4=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
@@ -4260,7 +4249,6 @@ google.golang.org/grpc v1.57.2/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt
 google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
 google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0 h1:M1YKkFIboKNieVO5DLUEVzQfGwJD30Nv2jfUgzb5UcE=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -4337,8 +4325,6 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
-gotest.tools/gotestsum v1.10.0 h1:lVO4uQJoxdsJb7jgmr1fg8QW7zGQ/tuqvsq5fHKyoHQ=
-gotest.tools/gotestsum v1.10.0/go.mod h1:6JHCiN6TEjA7Kaz23q1bH0e2Dc3YJjDUZ0DmctFZf+w=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
 gotest.tools/v3 v3.3.0/go.mod h1:Mcr9QNxkg0uMvy/YElmo4SpXgJKWgQvYrT7Kw5RzJ1A=
@@ -4352,8 +4338,6 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
-honnef.co/go/tools v0.4.3 h1:o/n5/K5gXqk8Gozvs2cnL0F2S1/g1vcGCAx2vETjITw=
-honnef.co/go/tools v0.4.3/go.mod h1:36ZgoUOrqOk1GxwHhyryEkq8FQWkUO2xGuSMhUCcdvA=
 k8s.io/api v0.18.2/go.mod h1:SJCWI7OLzhZSvbY7U8zwNl9UA4o1fizoug34OV/2r78=
 k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
 k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
@@ -4493,8 +4477,6 @@ modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
 mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
 mvdan.cc/gofumpt v0.2.1/go.mod h1:a/rvZPhsNaedOJBzqRD9omnwVwHZsBdJirXHa9Gh9Ig=
-mvdan.cc/gofumpt v0.5.0 h1:0EQ+Z56k8tXjj/6TQD25BFNKQXpCvT0rnansIc7Ug5E=
-mvdan.cc/gofumpt v0.5.0/go.mod h1:HBeVDtMKRZpXyxFciAirzdKklDlGu8aAy1wEbH5Y9js=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
 nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 oras.land/oras-go v1.2.0/go.mod h1:pFNs7oHp2dYsYMSS82HaX5l4mpnGO7hbpPN6EWH2ltc=
diff --git a/helper/forwarding/types.pb.go b/helper/forwarding/types.pb.go
index fb1d180c26..feb855208c 100644
--- a/helper/forwarding/types.pb.go
+++ b/helper/forwarding/types.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: helper/forwarding/types.proto
 
diff --git a/helper/identity/mfa/types.pb.go b/helper/identity/mfa/types.pb.go
index e3e1b491e4..2773679ff4 100644
--- a/helper/identity/mfa/types.pb.go
+++ b/helper/identity/mfa/types.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: helper/identity/mfa/types.proto
 
diff --git a/helper/identity/types.pb.go b/helper/identity/types.pb.go
index 3c2cd4378f..af46cde478 100644
--- a/helper/identity/types.pb.go
+++ b/helper/identity/types.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: helper/identity/types.proto
 
diff --git a/helper/storagepacker/types.pb.go b/helper/storagepacker/types.pb.go
index 27cf2b3661..3f9f3be1a9 100644
--- a/helper/storagepacker/types.pb.go
+++ b/helper/storagepacker/types.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: helper/storagepacker/types.proto
 
diff --git a/physical/raft/types.pb.go b/physical/raft/types.pb.go
index 4a2ca33c89..01366c6bc7 100644
--- a/physical/raft/types.pb.go
+++ b/physical/raft/types.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: physical/raft/types.proto
 
diff --git a/scripts/ci-helper.sh b/scripts/ci-helper.sh
index 611df09c6c..794312833a 100755
--- a/scripts/ci-helper.sh
+++ b/scripts/ci-helper.sh
@@ -47,7 +47,7 @@ function artifact_basename() {
 # Bundle the dist directory into a zip
 function bundle() {
   : "${BUNDLE_PATH:=$(repo_root)/vault.zip}"
-  echo "--> Bundling dist/* to $BUNDLE_PATH"
+  echo "==> Bundling dist/* to $BUNDLE_PATH..."
   zip -r -j "$BUNDLE_PATH" dist/
 }
 
@@ -88,7 +88,7 @@ function build() {
   (unset GOOS; unset GOARCH; go generate ./...)
 
   # Build our ldflags
-  msg="--> Building Vault revision $revision, built $build_date"
+  msg="==> Building Vault revision $revision, built $build_date..."
 
   # Keep the symbol and dwarf information by default
   if [ -n "$REMOVE_SYMBOLS" ]; then
diff --git a/scripts/deprecations-checker.sh b/scripts/deprecations-checker.sh
index ccdca49d91..b63ab905d7 100755
--- a/scripts/deprecations-checker.sh
+++ b/scripts/deprecations-checker.sh
@@ -5,25 +5,25 @@
 
 # Usage:
 # To check deprecations locally using the script, follow these steps:
-# From the repository root or within a package folder, execute deprecations-checker.sh 
-# Optionally: to only show deprecations in changed files between the current branch and 
+# From the repository root or within a package folder, execute deprecations-checker.sh
+# Optionally: to only show deprecations in changed files between the current branch and
 # a specific branch, pass the other branch name as an argument to the script.
 #
-# For example: 
+# For example:
 # ./scripts/deprecations-checker.sh (or) make deprecations
 # ./scripts/deprecations-checker.sh main (or) make ci-deprecations
 #
 # If no branch name is specified, the command will show all usage of deprecations in the code.
 #
-# GitHub Actions runs this against the PR's base ref branch. 
+# GitHub Actions runs this against the PR's base ref branch.
 
-# Staticcheck uses static analysis to finds bugs and performance issues, offers simplifications, 
+# Staticcheck uses static analysis to finds bugs and performance issues, offers simplifications,
 # and enforces style rules.
 # Here, it is used to check if a deprecated function, variable, constant or field is used.
 
-# Run staticcheck 
+# Run staticcheck
 set -e
-echo "Performing deprecations check: running staticcheck"
+echo "==> Performing deprecations check: running staticcheck..."
 
 
 # If no compare branch name is specified, output all deprecations
@@ -34,5 +34,5 @@ if [ -z $1 ]
     else
         # GitHub Actions will use this to find only changes wrt PR's base ref branch
         # revgrep CLI tool will return an exit status of 1 if any issues match, else it will return 0
-        staticcheck  -checks="SA1019" -tags="$BUILD_TAGS" 2>&1 | revgrep origin/"$1" 
+        staticcheck  -checks="SA1019" -tags="$BUILD_TAGS" 2>&1 | revgrep origin/"$1"
 fi
diff --git a/scripts/go-helper.sh b/scripts/go-helper.sh
new file mode 100755
index 0000000000..86a9f0803c
--- /dev/null
+++ b/scripts/go-helper.sh
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+# Perform Go formatting checks with gofumpt.
+check_fmt() {
+  echo "==> Checking code formatting..."
+
+  declare -a malformed=()
+  readarray -t files <<< "$1"
+  if [ -n "$1" ] && [ "${#files[@]}" -ne 0 ]; then
+    echo "--> Checking changed files..."
+    for file in "${files[@]}"; do
+      if [ ! -f "$file" ]; then
+        echo "--> $file no longer exists ⚠"
+        continue
+      fi
+
+      if echo "$file" | grep -v pb.go | grep -v vendor > /dev/null; then
+        if ! gofumpt -l "$file" > /dev/null; then
+          malformed+=("$file")
+          continue
+        fi
+      fi
+
+      echo "--> ${file} ✔"
+    done
+  else
+    echo "--> Checking all files..."
+    readarray -t malformed <<< "$(find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs gofumpt -l)"
+  fi
+
+  if [ "${#malformed[@]}" -ne 0 ] && [ -n "${malformed[0]}" ] ; then
+    echo "--> The following files need to be reformatted with gofumpt"
+    printf '%s\n' "${malformed[@]}"
+    echo "Run \`make fmt\` to reformat code."
+    exit 1
+  fi
+}
+
+# Check that the Go toolchain meets minimum version requiremets.
+check_version() {
+  GO_CMD=${GO_CMD:-go}
+
+  GO_VERSION_MIN=$1
+  echo "==> Checking that build is using go version >= $1..."
+
+  if $GO_CMD version | grep -q devel; then
+    GO_VERSION="devel"
+  else
+    GO_VERSION=$($GO_CMD version | grep -o 'go[0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?' | tr -d 'go')
+
+    IFS="." read -r -a GO_VERSION_ARR <<< "$GO_VERSION"
+    IFS="." read -r -a GO_VERSION_REQ <<< "$GO_VERSION_MIN"
+
+    if [[ ${GO_VERSION_ARR[0]} -lt ${GO_VERSION_REQ[0]} ||
+      ( ${GO_VERSION_ARR[0]} -eq ${GO_VERSION_REQ[0]} &&
+      ( ${GO_VERSION_ARR[1]} -lt ${GO_VERSION_REQ[1]} ||
+      ( ${GO_VERSION_ARR[1]} -eq ${GO_VERSION_REQ[1]} && ${GO_VERSION_ARR[2]} -lt ${GO_VERSION_REQ[2]} )))
+    ]]; then
+      echo "Vault requires go $GO_VERSION_MIN to build; found $GO_VERSION."
+      exit 1
+    fi
+  fi
+
+  echo "--> Using go version $GO_VERSION..."
+}
+
+# Download all the modules for all go.mod's defined in the project.
+mod_download() {
+  while IFS= read -r -d '' mod; do
+    echo "==> Downloading Go modules for $mod to $(go env GOMODCACHE)..."
+    pushd "$(dirname "$mod")" > /dev/null || (echo "failed to push into module dir" && exit 1)
+      GOOS=linux GOARCH=amd64 go mod download -x
+    popd > /dev/null || (echo "failed to pop out of module dir" && exit 1)
+  done < <(find . -type f -name go.mod -print0)
+}
+
+# Tidy all the go.mod's defined in the project.
+mod_tidy() {
+  while IFS= read -r -d '' mod; do
+    echo "==> Tidying $mod..."
+    pushd "$(dirname "$mod")" > /dev/null || (echo "failed to push into module dir" && exit 1)
+      GOOS=linux GOARCH=amd64 go mod tidy
+    popd > /dev/null || (echo "failed to pop out of module dir" && exit 1)
+  done < <(find . -type f -name go.mod -print0)
+}
+
+main() {
+  case $1 in
+  mod-download)
+    mod_download
+  ;;
+  mod-tidy)
+    mod_tidy
+  ;;
+  check-fmt)
+    check_fmt "${2-}"
+  ;;
+  check-version)
+    check_version "$2"
+  ;;
+  *)
+    echo "unknown sub-command" >&2
+    exit 1
+  ;;
+  esac
+}
+
+main "$@"
diff --git a/scripts/gofmtcheck.sh b/scripts/gofmtcheck.sh
deleted file mode 100755
index b603274071..0000000000
--- a/scripts/gofmtcheck.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-echo "==> Checking that code complies with gofmt requirements..."
-
-files=$(echo $1 | xargs)
-if [ -n "$files" ]; then
-    echo "Checking changed files..."
-    gofmt_files="$(echo $1 | grep -v pb.go | grep -v vendor | xargs go run mvdan.cc/gofumpt -l)"
-else
-    echo "Checking all files..."
-    gofmt_files="$(find . -name '*.go' | grep -v pb.go | grep -v vendor | xargs go run mvdan.cc/gofumpt -l)"
-fi
-
-if [[ -n "${gofmt_files}" ]]; then
-    echo 'gofumpt needs running on the following files:'
-    echo "${gofmt_files}"
-    echo "You can use the command: \`make fmt\` to reformat code."
-    exit 1
-fi
diff --git a/scripts/goversioncheck.sh b/scripts/goversioncheck.sh
deleted file mode 100755
index d9d34e7504..0000000000
--- a/scripts/goversioncheck.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-GO_CMD=${GO_CMD:-go}
-
-GO_VERSION_MIN=$1
-echo "==> Checking that build is using go version >= $1..."
-
-if $GO_CMD version | grep -q devel;
-then
-	GO_VERSION="devel"
-else
-	GO_VERSION=$($GO_CMD version | grep -o 'go[0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?' | tr -d 'go')
-
-	IFS="." read -r -a GO_VERSION_ARR <<< "$GO_VERSION"
-	IFS="." read -r -a GO_VERSION_REQ <<< "$GO_VERSION_MIN"
-
-	if [[ ${GO_VERSION_ARR[0]} -lt ${GO_VERSION_REQ[0]} ||
-		( ${GO_VERSION_ARR[0]} -eq ${GO_VERSION_REQ[0]} &&
-		( ${GO_VERSION_ARR[1]} -lt ${GO_VERSION_REQ[1]} ||
-		( ${GO_VERSION_ARR[1]} -eq ${GO_VERSION_REQ[1]} && ${GO_VERSION_ARR[2]} -lt ${GO_VERSION_REQ[2]} )))
-	]]; then
-		echo "Vault requires go $GO_VERSION_MIN to build; found $GO_VERSION."
-		exit 1
-	fi
-fi
-
-echo "==> Using go version $GO_VERSION..."
diff --git a/scripts/protocversioncheck.sh b/scripts/protocversioncheck.sh
deleted file mode 100755
index db82ec1481..0000000000
--- a/scripts/protocversioncheck.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -euo pipefail
-
-PROTOC_CMD=${PROTOC_CMD:-protoc}
-PROTOC_VERSION_EXACT="$1"
-echo "==> Checking that protoc is at version $1..."
-
-PROTOC_VERSION=$($PROTOC_CMD --version | grep -o '[0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?')
-
-if [ "$PROTOC_VERSION" == "$PROTOC_VERSION_EXACT" ]; then
-  echo "Using protoc version $PROTOC_VERSION"
-else
-  echo "protoc should be at $PROTOC_VERSION_EXACT; found $PROTOC_VERSION."
-  echo "If your version is higher than the version this script is looking for, updating the Makefile with the newer version."
-  exit 1
-fi
diff --git a/scripts/update_deps.sh b/scripts/update_deps.sh
deleted file mode 100755
index bb5660dd84..0000000000
--- a/scripts/update_deps.sh
+++ /dev/null
@@ -1,60 +0,0 @@
-#!/bin/sh
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
-
-set -e
-
-TOOL=vault
-
-## Make a temp dir
-tempdir=$(mktemp -d update-${TOOL}-deps.XXXXXX)
-
-## Set paths
-export GOPATH="$(pwd)/${tempdir}"
-export PATH="${GOPATH}/bin:${PATH}"
-cd $tempdir
-
-## Get Vault
-mkdir -p src/github.com/hashicorp
-cd src/github.com/hashicorp
-echo "Fetching ${TOOL}..."
-git clone https://github.com/hashicorp/${TOOL}
-cd ${TOOL}
-
-## Clean out earlier vendoring
-rm -rf Godeps vendor
-
-## Get govendor
-go get github.com/kardianos/govendor
-
-## Init
-govendor init
-
-## Fetch deps
-echo "Fetching deps, will take some time..."
-govendor fetch -v +missing
-
-# Clean up after the logrus mess
-govendor remove -v github.com/Sirupsen/logrus
-cd vendor
-find -type f | grep '.go' | xargs sed -i -e 's/Sirupsen/sirupsen/'
-
-# Need the v2 branch for Azure
-govendor fetch -v github.com/coreos/go-oidc@v2
-
-# Need the v3 branch for dockertest
-govendor fetch -v github.com/ory/dockertest@v3
-
-# Current influx master is alpha, pin to v1.7.3
-govendor fetch github.com/influxdata/influxdb/client/v2@v1.7.4
-govendor fetch github.com/influxdata/influxdb/models@v1.7.4
-govendor fetch github.com/influxdata/influxdb/pkg/escape@v1.7.4
-
-# Current circonus needs v3
-grep circonus-gometrics vendor.json | cut -d '"' -f 4 | while read -r i; do govendor fetch $i@v2; done
-
-# API breakage
-govendor fetch github.com/satori/go.uuid@f58768cc1a7a7e77a3bd49e98cdd21419399b6a3
-
-echo "Done; to commit run \n\ncd ${GOPATH}/src/github.com/hashicorp/${TOOL}\n"
diff --git a/sdk/database/dbplugin/database.pb.go b/sdk/database/dbplugin/database.pb.go
index 4dcaad4ece..7ca8eb7535 100644
--- a/sdk/database/dbplugin/database.pb.go
+++ b/sdk/database/dbplugin/database.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/database/dbplugin/database.proto
 
diff --git a/sdk/database/dbplugin/database_grpc.pb.go b/sdk/database/dbplugin/database_grpc.pb.go
index 0e34e00a3c..f62de0236b 100644
--- a/sdk/database/dbplugin/database_grpc.pb.go
+++ b/sdk/database/dbplugin/database_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: sdk/database/dbplugin/database.proto
 
 package dbplugin
 
@@ -14,6 +21,19 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	Database_Type_FullMethodName                  = "/dbplugin.Database/Type"
+	Database_CreateUser_FullMethodName            = "/dbplugin.Database/CreateUser"
+	Database_RenewUser_FullMethodName             = "/dbplugin.Database/RenewUser"
+	Database_RevokeUser_FullMethodName            = "/dbplugin.Database/RevokeUser"
+	Database_RotateRootCredentials_FullMethodName = "/dbplugin.Database/RotateRootCredentials"
+	Database_Init_FullMethodName                  = "/dbplugin.Database/Init"
+	Database_Close_FullMethodName                 = "/dbplugin.Database/Close"
+	Database_SetCredentials_FullMethodName        = "/dbplugin.Database/SetCredentials"
+	Database_GenerateCredentials_FullMethodName   = "/dbplugin.Database/GenerateCredentials"
+	Database_Initialize_FullMethodName            = "/dbplugin.Database/Initialize"
+)
+
 // DatabaseClient is the client API for Database service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -41,7 +61,7 @@ func NewDatabaseClient(cc grpc.ClientConnInterface) DatabaseClient {
 
 func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TypeResponse, error) {
 	out := new(TypeResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/Type", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Type_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -50,7 +70,7 @@ func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallO
 
 func (c *databaseClient) CreateUser(ctx context.Context, in *CreateUserRequest, opts ...grpc.CallOption) (*CreateUserResponse, error) {
 	out := new(CreateUserResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/CreateUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_CreateUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -59,7 +79,7 @@ func (c *databaseClient) CreateUser(ctx context.Context, in *CreateUserRequest,
 
 func (c *databaseClient) RenewUser(ctx context.Context, in *RenewUserRequest, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/RenewUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_RenewUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -68,7 +88,7 @@ func (c *databaseClient) RenewUser(ctx context.Context, in *RenewUserRequest, op
 
 func (c *databaseClient) RevokeUser(ctx context.Context, in *RevokeUserRequest, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/RevokeUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_RevokeUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -77,7 +97,7 @@ func (c *databaseClient) RevokeUser(ctx context.Context, in *RevokeUserRequest,
 
 func (c *databaseClient) RotateRootCredentials(ctx context.Context, in *RotateRootCredentialsRequest, opts ...grpc.CallOption) (*RotateRootCredentialsResponse, error) {
 	out := new(RotateRootCredentialsResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/RotateRootCredentials", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_RotateRootCredentials_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -86,7 +106,7 @@ func (c *databaseClient) RotateRootCredentials(ctx context.Context, in *RotateRo
 
 func (c *databaseClient) Init(ctx context.Context, in *InitRequest, opts ...grpc.CallOption) (*InitResponse, error) {
 	out := new(InitResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/Init", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Init_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +115,7 @@ func (c *databaseClient) Init(ctx context.Context, in *InitRequest, opts ...grpc
 
 func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/Close", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Close_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +124,7 @@ func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.Call
 
 func (c *databaseClient) SetCredentials(ctx context.Context, in *SetCredentialsRequest, opts ...grpc.CallOption) (*SetCredentialsResponse, error) {
 	out := new(SetCredentialsResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/SetCredentials", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_SetCredentials_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -113,7 +133,7 @@ func (c *databaseClient) SetCredentials(ctx context.Context, in *SetCredentialsR
 
 func (c *databaseClient) GenerateCredentials(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*GenerateCredentialsResponse, error) {
 	out := new(GenerateCredentialsResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/GenerateCredentials", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_GenerateCredentials_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -123,7 +143,7 @@ func (c *databaseClient) GenerateCredentials(ctx context.Context, in *Empty, opt
 // Deprecated: Do not use.
 func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/dbplugin.Database/Initialize", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Initialize_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -205,7 +225,7 @@ func _Database_Type_Handler(srv interface{}, ctx context.Context, dec func(inter
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/Type",
+		FullMethod: Database_Type_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Type(ctx, req.(*Empty))
@@ -223,7 +243,7 @@ func _Database_CreateUser_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/CreateUser",
+		FullMethod: Database_CreateUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).CreateUser(ctx, req.(*CreateUserRequest))
@@ -241,7 +261,7 @@ func _Database_RenewUser_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/RenewUser",
+		FullMethod: Database_RenewUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).RenewUser(ctx, req.(*RenewUserRequest))
@@ -259,7 +279,7 @@ func _Database_RevokeUser_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/RevokeUser",
+		FullMethod: Database_RevokeUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).RevokeUser(ctx, req.(*RevokeUserRequest))
@@ -277,7 +297,7 @@ func _Database_RotateRootCredentials_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/RotateRootCredentials",
+		FullMethod: Database_RotateRootCredentials_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).RotateRootCredentials(ctx, req.(*RotateRootCredentialsRequest))
@@ -295,7 +315,7 @@ func _Database_Init_Handler(srv interface{}, ctx context.Context, dec func(inter
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/Init",
+		FullMethod: Database_Init_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Init(ctx, req.(*InitRequest))
@@ -313,7 +333,7 @@ func _Database_Close_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/Close",
+		FullMethod: Database_Close_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Close(ctx, req.(*Empty))
@@ -331,7 +351,7 @@ func _Database_SetCredentials_Handler(srv interface{}, ctx context.Context, dec
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/SetCredentials",
+		FullMethod: Database_SetCredentials_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).SetCredentials(ctx, req.(*SetCredentialsRequest))
@@ -349,7 +369,7 @@ func _Database_GenerateCredentials_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/GenerateCredentials",
+		FullMethod: Database_GenerateCredentials_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).GenerateCredentials(ctx, req.(*Empty))
@@ -367,7 +387,7 @@ func _Database_Initialize_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.Database/Initialize",
+		FullMethod: Database_Initialize_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Initialize(ctx, req.(*InitializeRequest))
diff --git a/sdk/database/dbplugin/v5/proto/database.pb.go b/sdk/database/dbplugin/v5/proto/database.pb.go
index 576313ec50..c2e2a35119 100644
--- a/sdk/database/dbplugin/v5/proto/database.pb.go
+++ b/sdk/database/dbplugin/v5/proto/database.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/database/dbplugin/v5/proto/database.proto
 
diff --git a/sdk/database/dbplugin/v5/proto/database_grpc.pb.go b/sdk/database/dbplugin/v5/proto/database_grpc.pb.go
index 8a549fef92..49610c3b04 100644
--- a/sdk/database/dbplugin/v5/proto/database_grpc.pb.go
+++ b/sdk/database/dbplugin/v5/proto/database_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: sdk/database/dbplugin/v5/proto/database.proto
 
 package proto
 
@@ -14,6 +21,15 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	Database_Initialize_FullMethodName = "/dbplugin.v5.Database/Initialize"
+	Database_NewUser_FullMethodName    = "/dbplugin.v5.Database/NewUser"
+	Database_UpdateUser_FullMethodName = "/dbplugin.v5.Database/UpdateUser"
+	Database_DeleteUser_FullMethodName = "/dbplugin.v5.Database/DeleteUser"
+	Database_Type_FullMethodName       = "/dbplugin.v5.Database/Type"
+	Database_Close_FullMethodName      = "/dbplugin.v5.Database/Close"
+)
+
 // DatabaseClient is the client API for Database service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -36,7 +52,7 @@ func NewDatabaseClient(cc grpc.ClientConnInterface) DatabaseClient {
 
 func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest, opts ...grpc.CallOption) (*InitializeResponse, error) {
 	out := new(InitializeResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.v5.Database/Initialize", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Initialize_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -45,7 +61,7 @@ func (c *databaseClient) Initialize(ctx context.Context, in *InitializeRequest,
 
 func (c *databaseClient) NewUser(ctx context.Context, in *NewUserRequest, opts ...grpc.CallOption) (*NewUserResponse, error) {
 	out := new(NewUserResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.v5.Database/NewUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_NewUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -54,7 +70,7 @@ func (c *databaseClient) NewUser(ctx context.Context, in *NewUserRequest, opts .
 
 func (c *databaseClient) UpdateUser(ctx context.Context, in *UpdateUserRequest, opts ...grpc.CallOption) (*UpdateUserResponse, error) {
 	out := new(UpdateUserResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.v5.Database/UpdateUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_UpdateUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -63,7 +79,7 @@ func (c *databaseClient) UpdateUser(ctx context.Context, in *UpdateUserRequest,
 
 func (c *databaseClient) DeleteUser(ctx context.Context, in *DeleteUserRequest, opts ...grpc.CallOption) (*DeleteUserResponse, error) {
 	out := new(DeleteUserResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.v5.Database/DeleteUser", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_DeleteUser_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -72,7 +88,7 @@ func (c *databaseClient) DeleteUser(ctx context.Context, in *DeleteUserRequest,
 
 func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TypeResponse, error) {
 	out := new(TypeResponse)
-	err := c.cc.Invoke(ctx, "/dbplugin.v5.Database/Type", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Type_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -81,7 +97,7 @@ func (c *databaseClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallO
 
 func (c *databaseClient) Close(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/dbplugin.v5.Database/Close", in, out, opts...)
+	err := c.cc.Invoke(ctx, Database_Close_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -146,7 +162,7 @@ func _Database_Initialize_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.v5.Database/Initialize",
+		FullMethod: Database_Initialize_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Initialize(ctx, req.(*InitializeRequest))
@@ -164,7 +180,7 @@ func _Database_NewUser_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.v5.Database/NewUser",
+		FullMethod: Database_NewUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).NewUser(ctx, req.(*NewUserRequest))
@@ -182,7 +198,7 @@ func _Database_UpdateUser_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.v5.Database/UpdateUser",
+		FullMethod: Database_UpdateUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).UpdateUser(ctx, req.(*UpdateUserRequest))
@@ -200,7 +216,7 @@ func _Database_DeleteUser_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.v5.Database/DeleteUser",
+		FullMethod: Database_DeleteUser_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).DeleteUser(ctx, req.(*DeleteUserRequest))
@@ -218,7 +234,7 @@ func _Database_Type_Handler(srv interface{}, ctx context.Context, dec func(inter
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.v5.Database/Type",
+		FullMethod: Database_Type_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Type(ctx, req.(*Empty))
@@ -236,7 +252,7 @@ func _Database_Close_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/dbplugin.v5.Database/Close",
+		FullMethod: Database_Close_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DatabaseServer).Close(ctx, req.(*Empty))
diff --git a/sdk/helper/clientcountutil/generation/generate_data.pb.go b/sdk/helper/clientcountutil/generation/generate_data.pb.go
index 888def8bd4..5e64ce9dfb 100644
--- a/sdk/helper/clientcountutil/generation/generate_data.pb.go
+++ b/sdk/helper/clientcountutil/generation/generate_data.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/helper/clientcountutil/generation/generate_data.proto
 
diff --git a/sdk/helper/pluginutil/multiplexing.pb.go b/sdk/helper/pluginutil/multiplexing.pb.go
index ef1e52147a..d7b9529864 100644
--- a/sdk/helper/pluginutil/multiplexing.pb.go
+++ b/sdk/helper/pluginutil/multiplexing.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/helper/pluginutil/multiplexing.proto
 
diff --git a/sdk/helper/pluginutil/multiplexing_grpc.pb.go b/sdk/helper/pluginutil/multiplexing_grpc.pb.go
index aa8d0e47ba..1fc6cba7c6 100644
--- a/sdk/helper/pluginutil/multiplexing_grpc.pb.go
+++ b/sdk/helper/pluginutil/multiplexing_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: sdk/helper/pluginutil/multiplexing.proto
 
 package pluginutil
 
@@ -14,6 +21,10 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	PluginMultiplexing_MultiplexingSupport_FullMethodName = "/pluginutil.multiplexing.PluginMultiplexing/MultiplexingSupport"
+)
+
 // PluginMultiplexingClient is the client API for PluginMultiplexing service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -31,7 +42,7 @@ func NewPluginMultiplexingClient(cc grpc.ClientConnInterface) PluginMultiplexing
 
 func (c *pluginMultiplexingClient) MultiplexingSupport(ctx context.Context, in *MultiplexingSupportRequest, opts ...grpc.CallOption) (*MultiplexingSupportResponse, error) {
 	out := new(MultiplexingSupportResponse)
-	err := c.cc.Invoke(ctx, "/pluginutil.multiplexing.PluginMultiplexing/MultiplexingSupport", in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginMultiplexing_MultiplexingSupport_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -76,7 +87,7 @@ func _PluginMultiplexing_MultiplexingSupport_Handler(srv interface{}, ctx contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pluginutil.multiplexing.PluginMultiplexing/MultiplexingSupport",
+		FullMethod: PluginMultiplexing_MultiplexingSupport_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(PluginMultiplexingServer).MultiplexingSupport(ctx, req.(*MultiplexingSupportRequest))
diff --git a/sdk/logical/event.pb.go b/sdk/logical/event.pb.go
index 630293bd86..a011cd894c 100644
--- a/sdk/logical/event.pb.go
+++ b/sdk/logical/event.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/logical/event.proto
 
diff --git a/sdk/logical/identity.pb.go b/sdk/logical/identity.pb.go
index 3da9feabbf..c00bfc9c93 100644
--- a/sdk/logical/identity.pb.go
+++ b/sdk/logical/identity.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/logical/identity.proto
 
diff --git a/sdk/logical/plugin.pb.go b/sdk/logical/plugin.pb.go
index 600f705105..3793d0974b 100644
--- a/sdk/logical/plugin.pb.go
+++ b/sdk/logical/plugin.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/logical/plugin.proto
 
diff --git a/sdk/logical/version.pb.go b/sdk/logical/version.pb.go
index aa3340d4f8..8f638ef7c2 100644
--- a/sdk/logical/version.pb.go
+++ b/sdk/logical/version.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/logical/version.proto
 
diff --git a/sdk/logical/version_grpc.pb.go b/sdk/logical/version_grpc.pb.go
index a69e970599..bdb3561449 100644
--- a/sdk/logical/version_grpc.pb.go
+++ b/sdk/logical/version_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: sdk/logical/version.proto
 
 package logical
 
@@ -14,6 +21,10 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	PluginVersion_Version_FullMethodName = "/logical.PluginVersion/Version"
+)
+
 // PluginVersionClient is the client API for PluginVersion service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -32,7 +43,7 @@ func NewPluginVersionClient(cc grpc.ClientConnInterface) PluginVersionClient {
 
 func (c *pluginVersionClient) Version(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*VersionReply, error) {
 	out := new(VersionReply)
-	err := c.cc.Invoke(ctx, "/logical.PluginVersion/Version", in, out, opts...)
+	err := c.cc.Invoke(ctx, PluginVersion_Version_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -78,7 +89,7 @@ func _PluginVersion_Version_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/logical.PluginVersion/Version",
+		FullMethod: PluginVersion_Version_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(PluginVersionServer).Version(ctx, req.(*Empty))
diff --git a/sdk/plugin/pb/backend.pb.go b/sdk/plugin/pb/backend.pb.go
index 1e68e7a4b1..29dbf63e66 100644
--- a/sdk/plugin/pb/backend.pb.go
+++ b/sdk/plugin/pb/backend.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: sdk/plugin/pb/backend.proto
 
diff --git a/sdk/plugin/pb/backend_grpc.pb.go b/sdk/plugin/pb/backend_grpc.pb.go
index a8f3107e04..615e2324cb 100644
--- a/sdk/plugin/pb/backend_grpc.pb.go
+++ b/sdk/plugin/pb/backend_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: sdk/plugin/pb/backend.proto
 
 package pb
 
@@ -14,6 +21,17 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	Backend_HandleRequest_FullMethodName        = "/pb.Backend/HandleRequest"
+	Backend_SpecialPaths_FullMethodName         = "/pb.Backend/SpecialPaths"
+	Backend_HandleExistenceCheck_FullMethodName = "/pb.Backend/HandleExistenceCheck"
+	Backend_Cleanup_FullMethodName              = "/pb.Backend/Cleanup"
+	Backend_InvalidateKey_FullMethodName        = "/pb.Backend/InvalidateKey"
+	Backend_Setup_FullMethodName                = "/pb.Backend/Setup"
+	Backend_Initialize_FullMethodName           = "/pb.Backend/Initialize"
+	Backend_Type_FullMethodName                 = "/pb.Backend/Type"
+)
+
 // BackendClient is the client API for Backend service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -65,7 +83,7 @@ func NewBackendClient(cc grpc.ClientConnInterface) BackendClient {
 
 func (c *backendClient) HandleRequest(ctx context.Context, in *HandleRequestArgs, opts ...grpc.CallOption) (*HandleRequestReply, error) {
 	out := new(HandleRequestReply)
-	err := c.cc.Invoke(ctx, "/pb.Backend/HandleRequest", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_HandleRequest_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -74,7 +92,7 @@ func (c *backendClient) HandleRequest(ctx context.Context, in *HandleRequestArgs
 
 func (c *backendClient) SpecialPaths(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*SpecialPathsReply, error) {
 	out := new(SpecialPathsReply)
-	err := c.cc.Invoke(ctx, "/pb.Backend/SpecialPaths", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_SpecialPaths_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -83,7 +101,7 @@ func (c *backendClient) SpecialPaths(ctx context.Context, in *Empty, opts ...grp
 
 func (c *backendClient) HandleExistenceCheck(ctx context.Context, in *HandleExistenceCheckArgs, opts ...grpc.CallOption) (*HandleExistenceCheckReply, error) {
 	out := new(HandleExistenceCheckReply)
-	err := c.cc.Invoke(ctx, "/pb.Backend/HandleExistenceCheck", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_HandleExistenceCheck_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -92,7 +110,7 @@ func (c *backendClient) HandleExistenceCheck(ctx context.Context, in *HandleExis
 
 func (c *backendClient) Cleanup(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/pb.Backend/Cleanup", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Cleanup_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -101,7 +119,7 @@ func (c *backendClient) Cleanup(ctx context.Context, in *Empty, opts ...grpc.Cal
 
 func (c *backendClient) InvalidateKey(ctx context.Context, in *InvalidateKeyArgs, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/pb.Backend/InvalidateKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_InvalidateKey_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -110,7 +128,7 @@ func (c *backendClient) InvalidateKey(ctx context.Context, in *InvalidateKeyArgs
 
 func (c *backendClient) Setup(ctx context.Context, in *SetupArgs, opts ...grpc.CallOption) (*SetupReply, error) {
 	out := new(SetupReply)
-	err := c.cc.Invoke(ctx, "/pb.Backend/Setup", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Setup_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -119,7 +137,7 @@ func (c *backendClient) Setup(ctx context.Context, in *SetupArgs, opts ...grpc.C
 
 func (c *backendClient) Initialize(ctx context.Context, in *InitializeArgs, opts ...grpc.CallOption) (*InitializeReply, error) {
 	out := new(InitializeReply)
-	err := c.cc.Invoke(ctx, "/pb.Backend/Initialize", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Initialize_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,7 +146,7 @@ func (c *backendClient) Initialize(ctx context.Context, in *InitializeArgs, opts
 
 func (c *backendClient) Type(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TypeReply, error) {
 	out := new(TypeReply)
-	err := c.cc.Invoke(ctx, "/pb.Backend/Type", in, out, opts...)
+	err := c.cc.Invoke(ctx, Backend_Type_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -228,7 +246,7 @@ func _Backend_HandleRequest_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/HandleRequest",
+		FullMethod: Backend_HandleRequest_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).HandleRequest(ctx, req.(*HandleRequestArgs))
@@ -246,7 +264,7 @@ func _Backend_SpecialPaths_Handler(srv interface{}, ctx context.Context, dec fun
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/SpecialPaths",
+		FullMethod: Backend_SpecialPaths_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).SpecialPaths(ctx, req.(*Empty))
@@ -264,7 +282,7 @@ func _Backend_HandleExistenceCheck_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/HandleExistenceCheck",
+		FullMethod: Backend_HandleExistenceCheck_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).HandleExistenceCheck(ctx, req.(*HandleExistenceCheckArgs))
@@ -282,7 +300,7 @@ func _Backend_Cleanup_Handler(srv interface{}, ctx context.Context, dec func(int
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/Cleanup",
+		FullMethod: Backend_Cleanup_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).Cleanup(ctx, req.(*Empty))
@@ -300,7 +318,7 @@ func _Backend_InvalidateKey_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/InvalidateKey",
+		FullMethod: Backend_InvalidateKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).InvalidateKey(ctx, req.(*InvalidateKeyArgs))
@@ -318,7 +336,7 @@ func _Backend_Setup_Handler(srv interface{}, ctx context.Context, dec func(inter
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/Setup",
+		FullMethod: Backend_Setup_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).Setup(ctx, req.(*SetupArgs))
@@ -336,7 +354,7 @@ func _Backend_Initialize_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/Initialize",
+		FullMethod: Backend_Initialize_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).Initialize(ctx, req.(*InitializeArgs))
@@ -354,7 +372,7 @@ func _Backend_Type_Handler(srv interface{}, ctx context.Context, dec func(interf
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Backend/Type",
+		FullMethod: Backend_Type_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(BackendServer).Type(ctx, req.(*Empty))
@@ -406,6 +424,13 @@ var Backend_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "sdk/plugin/pb/backend.proto",
 }
 
+const (
+	Storage_List_FullMethodName   = "/pb.Storage/List"
+	Storage_Get_FullMethodName    = "/pb.Storage/Get"
+	Storage_Put_FullMethodName    = "/pb.Storage/Put"
+	Storage_Delete_FullMethodName = "/pb.Storage/Delete"
+)
+
 // StorageClient is the client API for Storage service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -426,7 +451,7 @@ func NewStorageClient(cc grpc.ClientConnInterface) StorageClient {
 
 func (c *storageClient) List(ctx context.Context, in *StorageListArgs, opts ...grpc.CallOption) (*StorageListReply, error) {
 	out := new(StorageListReply)
-	err := c.cc.Invoke(ctx, "/pb.Storage/List", in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_List_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -435,7 +460,7 @@ func (c *storageClient) List(ctx context.Context, in *StorageListArgs, opts ...g
 
 func (c *storageClient) Get(ctx context.Context, in *StorageGetArgs, opts ...grpc.CallOption) (*StorageGetReply, error) {
 	out := new(StorageGetReply)
-	err := c.cc.Invoke(ctx, "/pb.Storage/Get", in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_Get_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -444,7 +469,7 @@ func (c *storageClient) Get(ctx context.Context, in *StorageGetArgs, opts ...grp
 
 func (c *storageClient) Put(ctx context.Context, in *StoragePutArgs, opts ...grpc.CallOption) (*StoragePutReply, error) {
 	out := new(StoragePutReply)
-	err := c.cc.Invoke(ctx, "/pb.Storage/Put", in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_Put_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -453,7 +478,7 @@ func (c *storageClient) Put(ctx context.Context, in *StoragePutArgs, opts ...grp
 
 func (c *storageClient) Delete(ctx context.Context, in *StorageDeleteArgs, opts ...grpc.CallOption) (*StorageDeleteReply, error) {
 	out := new(StorageDeleteReply)
-	err := c.cc.Invoke(ctx, "/pb.Storage/Delete", in, out, opts...)
+	err := c.cc.Invoke(ctx, Storage_Delete_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -510,7 +535,7 @@ func _Storage_List_Handler(srv interface{}, ctx context.Context, dec func(interf
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Storage/List",
+		FullMethod: Storage_List_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageServer).List(ctx, req.(*StorageListArgs))
@@ -528,7 +553,7 @@ func _Storage_Get_Handler(srv interface{}, ctx context.Context, dec func(interfa
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Storage/Get",
+		FullMethod: Storage_Get_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageServer).Get(ctx, req.(*StorageGetArgs))
@@ -546,7 +571,7 @@ func _Storage_Put_Handler(srv interface{}, ctx context.Context, dec func(interfa
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Storage/Put",
+		FullMethod: Storage_Put_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageServer).Put(ctx, req.(*StoragePutArgs))
@@ -564,7 +589,7 @@ func _Storage_Delete_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Storage/Delete",
+		FullMethod: Storage_Delete_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageServer).Delete(ctx, req.(*StorageDeleteArgs))
@@ -600,6 +625,22 @@ var Storage_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "sdk/plugin/pb/backend.proto",
 }
 
+const (
+	SystemView_DefaultLeaseTTL_FullMethodName            = "/pb.SystemView/DefaultLeaseTTL"
+	SystemView_MaxLeaseTTL_FullMethodName                = "/pb.SystemView/MaxLeaseTTL"
+	SystemView_Tainted_FullMethodName                    = "/pb.SystemView/Tainted"
+	SystemView_CachingDisabled_FullMethodName            = "/pb.SystemView/CachingDisabled"
+	SystemView_ReplicationState_FullMethodName           = "/pb.SystemView/ReplicationState"
+	SystemView_ResponseWrapData_FullMethodName           = "/pb.SystemView/ResponseWrapData"
+	SystemView_MlockEnabled_FullMethodName               = "/pb.SystemView/MlockEnabled"
+	SystemView_LocalMount_FullMethodName                 = "/pb.SystemView/LocalMount"
+	SystemView_EntityInfo_FullMethodName                 = "/pb.SystemView/EntityInfo"
+	SystemView_PluginEnv_FullMethodName                  = "/pb.SystemView/PluginEnv"
+	SystemView_GroupsForEntity_FullMethodName            = "/pb.SystemView/GroupsForEntity"
+	SystemView_GeneratePasswordFromPolicy_FullMethodName = "/pb.SystemView/GeneratePasswordFromPolicy"
+	SystemView_ClusterInfo_FullMethodName                = "/pb.SystemView/ClusterInfo"
+)
+
 // SystemViewClient is the client API for SystemView service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -656,7 +697,7 @@ func NewSystemViewClient(cc grpc.ClientConnInterface) SystemViewClient {
 
 func (c *systemViewClient) DefaultLeaseTTL(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TTLReply, error) {
 	out := new(TTLReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/DefaultLeaseTTL", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_DefaultLeaseTTL_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -665,7 +706,7 @@ func (c *systemViewClient) DefaultLeaseTTL(ctx context.Context, in *Empty, opts
 
 func (c *systemViewClient) MaxLeaseTTL(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TTLReply, error) {
 	out := new(TTLReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/MaxLeaseTTL", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_MaxLeaseTTL_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -674,7 +715,7 @@ func (c *systemViewClient) MaxLeaseTTL(ctx context.Context, in *Empty, opts ...g
 
 func (c *systemViewClient) Tainted(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*TaintedReply, error) {
 	out := new(TaintedReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/Tainted", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_Tainted_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -683,7 +724,7 @@ func (c *systemViewClient) Tainted(ctx context.Context, in *Empty, opts ...grpc.
 
 func (c *systemViewClient) CachingDisabled(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*CachingDisabledReply, error) {
 	out := new(CachingDisabledReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/CachingDisabled", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_CachingDisabled_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -692,7 +733,7 @@ func (c *systemViewClient) CachingDisabled(ctx context.Context, in *Empty, opts
 
 func (c *systemViewClient) ReplicationState(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ReplicationStateReply, error) {
 	out := new(ReplicationStateReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/ReplicationState", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_ReplicationState_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -701,7 +742,7 @@ func (c *systemViewClient) ReplicationState(ctx context.Context, in *Empty, opts
 
 func (c *systemViewClient) ResponseWrapData(ctx context.Context, in *ResponseWrapDataArgs, opts ...grpc.CallOption) (*ResponseWrapDataReply, error) {
 	out := new(ResponseWrapDataReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/ResponseWrapData", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_ResponseWrapData_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -710,7 +751,7 @@ func (c *systemViewClient) ResponseWrapData(ctx context.Context, in *ResponseWra
 
 func (c *systemViewClient) MlockEnabled(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*MlockEnabledReply, error) {
 	out := new(MlockEnabledReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/MlockEnabled", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_MlockEnabled_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -719,7 +760,7 @@ func (c *systemViewClient) MlockEnabled(ctx context.Context, in *Empty, opts ...
 
 func (c *systemViewClient) LocalMount(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*LocalMountReply, error) {
 	out := new(LocalMountReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/LocalMount", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_LocalMount_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -728,7 +769,7 @@ func (c *systemViewClient) LocalMount(ctx context.Context, in *Empty, opts ...gr
 
 func (c *systemViewClient) EntityInfo(ctx context.Context, in *EntityInfoArgs, opts ...grpc.CallOption) (*EntityInfoReply, error) {
 	out := new(EntityInfoReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/EntityInfo", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_EntityInfo_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -737,7 +778,7 @@ func (c *systemViewClient) EntityInfo(ctx context.Context, in *EntityInfoArgs, o
 
 func (c *systemViewClient) PluginEnv(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*PluginEnvReply, error) {
 	out := new(PluginEnvReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/PluginEnv", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_PluginEnv_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -746,7 +787,7 @@ func (c *systemViewClient) PluginEnv(ctx context.Context, in *Empty, opts ...grp
 
 func (c *systemViewClient) GroupsForEntity(ctx context.Context, in *EntityInfoArgs, opts ...grpc.CallOption) (*GroupsForEntityReply, error) {
 	out := new(GroupsForEntityReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/GroupsForEntity", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_GroupsForEntity_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -755,7 +796,7 @@ func (c *systemViewClient) GroupsForEntity(ctx context.Context, in *EntityInfoAr
 
 func (c *systemViewClient) GeneratePasswordFromPolicy(ctx context.Context, in *GeneratePasswordFromPolicyRequest, opts ...grpc.CallOption) (*GeneratePasswordFromPolicyReply, error) {
 	out := new(GeneratePasswordFromPolicyReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/GeneratePasswordFromPolicy", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_GeneratePasswordFromPolicy_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -764,7 +805,7 @@ func (c *systemViewClient) GeneratePasswordFromPolicy(ctx context.Context, in *G
 
 func (c *systemViewClient) ClusterInfo(ctx context.Context, in *Empty, opts ...grpc.CallOption) (*ClusterInfoReply, error) {
 	out := new(ClusterInfoReply)
-	err := c.cc.Invoke(ctx, "/pb.SystemView/ClusterInfo", in, out, opts...)
+	err := c.cc.Invoke(ctx, SystemView_ClusterInfo_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -884,7 +925,7 @@ func _SystemView_DefaultLeaseTTL_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/DefaultLeaseTTL",
+		FullMethod: SystemView_DefaultLeaseTTL_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).DefaultLeaseTTL(ctx, req.(*Empty))
@@ -902,7 +943,7 @@ func _SystemView_MaxLeaseTTL_Handler(srv interface{}, ctx context.Context, dec f
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/MaxLeaseTTL",
+		FullMethod: SystemView_MaxLeaseTTL_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).MaxLeaseTTL(ctx, req.(*Empty))
@@ -920,7 +961,7 @@ func _SystemView_Tainted_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/Tainted",
+		FullMethod: SystemView_Tainted_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).Tainted(ctx, req.(*Empty))
@@ -938,7 +979,7 @@ func _SystemView_CachingDisabled_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/CachingDisabled",
+		FullMethod: SystemView_CachingDisabled_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).CachingDisabled(ctx, req.(*Empty))
@@ -956,7 +997,7 @@ func _SystemView_ReplicationState_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/ReplicationState",
+		FullMethod: SystemView_ReplicationState_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).ReplicationState(ctx, req.(*Empty))
@@ -974,7 +1015,7 @@ func _SystemView_ResponseWrapData_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/ResponseWrapData",
+		FullMethod: SystemView_ResponseWrapData_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).ResponseWrapData(ctx, req.(*ResponseWrapDataArgs))
@@ -992,7 +1033,7 @@ func _SystemView_MlockEnabled_Handler(srv interface{}, ctx context.Context, dec
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/MlockEnabled",
+		FullMethod: SystemView_MlockEnabled_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).MlockEnabled(ctx, req.(*Empty))
@@ -1010,7 +1051,7 @@ func _SystemView_LocalMount_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/LocalMount",
+		FullMethod: SystemView_LocalMount_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).LocalMount(ctx, req.(*Empty))
@@ -1028,7 +1069,7 @@ func _SystemView_EntityInfo_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/EntityInfo",
+		FullMethod: SystemView_EntityInfo_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).EntityInfo(ctx, req.(*EntityInfoArgs))
@@ -1046,7 +1087,7 @@ func _SystemView_PluginEnv_Handler(srv interface{}, ctx context.Context, dec fun
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/PluginEnv",
+		FullMethod: SystemView_PluginEnv_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).PluginEnv(ctx, req.(*Empty))
@@ -1064,7 +1105,7 @@ func _SystemView_GroupsForEntity_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/GroupsForEntity",
+		FullMethod: SystemView_GroupsForEntity_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).GroupsForEntity(ctx, req.(*EntityInfoArgs))
@@ -1082,7 +1123,7 @@ func _SystemView_GeneratePasswordFromPolicy_Handler(srv interface{}, ctx context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/GeneratePasswordFromPolicy",
+		FullMethod: SystemView_GeneratePasswordFromPolicy_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).GeneratePasswordFromPolicy(ctx, req.(*GeneratePasswordFromPolicyRequest))
@@ -1100,7 +1141,7 @@ func _SystemView_ClusterInfo_Handler(srv interface{}, ctx context.Context, dec f
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.SystemView/ClusterInfo",
+		FullMethod: SystemView_ClusterInfo_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(SystemViewServer).ClusterInfo(ctx, req.(*Empty))
@@ -1172,6 +1213,10 @@ var SystemView_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "sdk/plugin/pb/backend.proto",
 }
 
+const (
+	Events_SendEvent_FullMethodName = "/pb.Events/SendEvent"
+)
+
 // EventsClient is the client API for Events service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -1189,7 +1234,7 @@ func NewEventsClient(cc grpc.ClientConnInterface) EventsClient {
 
 func (c *eventsClient) SendEvent(ctx context.Context, in *SendEventRequest, opts ...grpc.CallOption) (*Empty, error) {
 	out := new(Empty)
-	err := c.cc.Invoke(ctx, "/pb.Events/SendEvent", in, out, opts...)
+	err := c.cc.Invoke(ctx, Events_SendEvent_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1234,7 +1279,7 @@ func _Events_SendEvent_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/pb.Events/SendEvent",
+		FullMethod: Events_SendEvent_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(EventsServer).SendEvent(ctx, req.(*SendEventRequest))
diff --git a/tools/codechecker/.bin/codechecker b/tools/codechecker/.bin/codechecker
deleted file mode 100755
index 7c47d65efa..0000000000
Binary files a/tools/codechecker/.bin/codechecker and /dev/null differ
diff --git a/tools/tools.go b/tools/tools.go
index 1f7237a9d9..066198c071 100644
--- a/tools/tools.go
+++ b/tools/tools.go
@@ -3,41 +3,14 @@
 
 //go:build tools
 
-// This file ensures tool dependencies are kept in sync.  This is the
-// recommended way of doing this according to
-// https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module
-// To install the following tools at the version used by this repo run:
-// $ make bootstrap
-// or
+// This file is here for backwards compat only. You can now use make instead of go generate to
+// install tools.
+
+// You can replace
 // $ go generate -tags tools tools/tools.go
+// with
+// $ make tools
 
 package tools
 
-//go:generate go install golang.org/x/tools/cmd/goimports
-//go:generate go install github.com/client9/misspell/cmd/misspell
-//go:generate go install mvdan.cc/gofumpt
-//go:generate go install google.golang.org/protobuf/cmd/protoc-gen-go
-//go:generate go install google.golang.org/grpc/cmd/protoc-gen-go-grpc
-//go:generate go install github.com/favadi/protoc-go-inject-tag
-//go:generate go install honnef.co/go/tools/cmd/staticcheck
-//go:generate go install github.com/golangci/revgrep/cmd/revgrep
-//go:generate go install gotest.tools/gotestsum
-import (
-	_ "golang.org/x/tools/cmd/goimports"
-
-	_ "github.com/client9/misspell/cmd/misspell"
-
-	_ "mvdan.cc/gofumpt"
-
-	_ "google.golang.org/protobuf/cmd/protoc-gen-go"
-
-	_ "google.golang.org/grpc/cmd/protoc-gen-go-grpc"
-
-	_ "github.com/favadi/protoc-go-inject-tag"
-
-	_ "github.com/golangci/revgrep/cmd/revgrep"
-
-	_ "gotest.tools/gotestsum"
-
-	_ "honnef.co/go/tools/cmd/staticcheck"
-)
+//go:generate ./tools.sh install-tools
diff --git a/tools/tools.sh b/tools/tools.sh
new file mode 100755
index 0000000000..978893eae5
--- /dev/null
+++ b/tools/tools.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+set -euo pipefail
+
+# Determine the root directory of the repository
+repo_root() {
+  git rev-parse --show-toplevel
+}
+
+# Install an external Go tool.
+go_install() {
+  if go install "$1"; then
+    echo "--> $1 ✔"
+  else
+    echo "--> $1 ✖"
+    return 1
+  fi
+}
+
+# Check for a tool binary in the path.
+check_tool() {
+  if builtin type -P "$2" &> /dev/null; then
+    echo "--> $2 ✔"
+  else
+    echo "--> $2 ✖"
+    echo "Could not find required $1 tool $2. Run 'make tools-$1' to install it." 1>&2
+    return 1
+  fi
+}
+
+# Install external tools.
+install_external() {
+  local tools
+  # If you update this please update check_external below as well as our external tools
+  # install action ./github/actions/install-external-tools.yml
+  tools=(
+    github.com/bufbuild/buf/cmd/buf@v1.25.0
+    github.com/favadi/protoc-go-inject-tag@latest
+    github.com/golangci/misspell/cmd/misspell@latest
+    github.com/golangci/revgrep/cmd/revgrep@latest
+    golang.org/x/tools/cmd/goimports@latest
+    google.golang.org/protobuf/cmd/protoc-gen-go@latest
+    google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+    honnef.co/go/tools/cmd/staticcheck@latest
+    mvdan.cc/gofumpt@latest
+  )
+
+  echo "==> Installing external tools..."
+  for tool in "${tools[@]}"; do
+    go_install "$tool"
+  done
+}
+
+# Check that all tools are installed
+check_external() {
+  # Ensure that all external tools are available. In CI we'll prefer installing pre-built external
+  # tools for speed instead of go install so that we don't require downloading Go modules and
+  # compiling tools from scratch in every CI job.
+  # See .github/actions/install-external-tools.yml for that workflow.
+  local tools
+  tools=(
+    buf
+    gofumpt
+    goimports
+    gotestsum
+    misspell
+    protoc-gen-go
+    protoc-gen-go-grpc
+    protoc-go-inject-tag
+    revgrep
+    staticcheck
+  )
+
+  echo "==> Checking for external tools..."
+  for tool in "${tools[@]}"; do
+    check_tool external "$tool"
+  done
+}
+
+# Install internal tools.
+install_internal() {
+  local tools
+  # If you update this please update check tools below.
+  tools=(
+    codechecker
+    stubmaker
+  )
+
+  echo "==> Installing internal tools..."
+  pushd "$(repo_root)" &> /dev/null
+  for tool in "${tools[@]}"; do
+    go_install ./tools/"$tool"
+  done
+  popd &> /dev/null
+}
+
+# Check internal that all tools are installed
+check_internal() {
+  # Ensure that all required internal tools are available.
+  local tools
+  tools=(
+    codechecker
+    stubmaker
+  )
+
+  echo "==> Checking for internal tools..."
+  for tool in "${tools[@]}"; do
+    check_tool internal "$tool"
+  done
+}
+
+# Install tools.
+install() {
+  install_internal
+  install_external
+}
+
+# Check tools.
+check() {
+  check_internal
+  check_external
+}
+
+main() {
+  case $1 in
+  install-external)
+    install_external
+  ;;
+  install-internal)
+    install_internal
+  ;;
+  check-external)
+    check_external
+  ;;
+  check-internal)
+    check_internal
+  ;;
+  install)
+    install
+  ;;
+  check)
+    check
+  ;;
+  *)
+    echo "unknown sub-command" >&2
+    exit 1
+  ;;
+  esac
+}
+
+main "$@"
diff --git a/vault/activity/activity_log.pb.go b/vault/activity/activity_log.pb.go
index e0703215fb..5b666823c1 100644
--- a/vault/activity/activity_log.pb.go
+++ b/vault/activity/activity_log.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/activity/activity_log.proto
 
diff --git a/vault/hcp_link/proto/link_control/link_control.pb.go b/vault/hcp_link/proto/link_control/link_control.pb.go
index 4c78112b7a..1c14593f06 100644
--- a/vault/hcp_link/proto/link_control/link_control.pb.go
+++ b/vault/hcp_link/proto/link_control/link_control.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/hcp_link/proto/link_control/link_control.proto
 
diff --git a/vault/hcp_link/proto/link_control/link_control_grpc.pb.go b/vault/hcp_link/proto/link_control/link_control_grpc.pb.go
index e071bb7186..330e55259d 100644
--- a/vault/hcp_link/proto/link_control/link_control_grpc.pb.go
+++ b/vault/hcp_link/proto/link_control/link_control_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: vault/hcp_link/proto/link_control/link_control.proto
 
 package link_control
 
@@ -14,6 +21,10 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	HCPLinkControl_PurgePolicy_FullMethodName = "/link_control.HCPLinkControl/PurgePolicy"
+)
+
 // HCPLinkControlClient is the client API for HCPLinkControl service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -33,7 +44,7 @@ func NewHCPLinkControlClient(cc grpc.ClientConnInterface) HCPLinkControlClient {
 
 func (c *hCPLinkControlClient) PurgePolicy(ctx context.Context, in *PurgePolicyRequest, opts ...grpc.CallOption) (*PurgePolicyResponse, error) {
 	out := new(PurgePolicyResponse)
-	err := c.cc.Invoke(ctx, "/link_control.HCPLinkControl/PurgePolicy", in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkControl_PurgePolicy_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -80,7 +91,7 @@ func _HCPLinkControl_PurgePolicy_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/link_control.HCPLinkControl/PurgePolicy",
+		FullMethod: HCPLinkControl_PurgePolicy_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HCPLinkControlServer).PurgePolicy(ctx, req.(*PurgePolicyRequest))
diff --git a/vault/hcp_link/proto/meta/meta.pb.go b/vault/hcp_link/proto/meta/meta.pb.go
index c8939d48b8..01bffd0dbd 100644
--- a/vault/hcp_link/proto/meta/meta.pb.go
+++ b/vault/hcp_link/proto/meta/meta.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/hcp_link/proto/meta/meta.proto
 
diff --git a/vault/hcp_link/proto/meta/meta_grpc.pb.go b/vault/hcp_link/proto/meta/meta_grpc.pb.go
index 742e8b5013..f1a85bc7ad 100644
--- a/vault/hcp_link/proto/meta/meta_grpc.pb.go
+++ b/vault/hcp_link/proto/meta/meta_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: vault/hcp_link/proto/meta/meta.proto
 
 package meta
 
@@ -14,6 +21,13 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	HCPLinkMeta_ListNamespaces_FullMethodName   = "/meta.HCPLinkMeta/ListNamespaces"
+	HCPLinkMeta_ListMounts_FullMethodName       = "/meta.HCPLinkMeta/ListMounts"
+	HCPLinkMeta_ListAuths_FullMethodName        = "/meta.HCPLinkMeta/ListAuths"
+	HCPLinkMeta_GetClusterStatus_FullMethodName = "/meta.HCPLinkMeta/GetClusterStatus"
+)
+
 // HCPLinkMetaClient is the client API for HCPLinkMeta service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -38,7 +52,7 @@ func NewHCPLinkMetaClient(cc grpc.ClientConnInterface) HCPLinkMetaClient {
 
 func (c *hCPLinkMetaClient) ListNamespaces(ctx context.Context, in *ListNamespacesRequest, opts ...grpc.CallOption) (*ListNamespacesResponse, error) {
 	out := new(ListNamespacesResponse)
-	err := c.cc.Invoke(ctx, "/meta.HCPLinkMeta/ListNamespaces", in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_ListNamespaces_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -47,7 +61,7 @@ func (c *hCPLinkMetaClient) ListNamespaces(ctx context.Context, in *ListNamespac
 
 func (c *hCPLinkMetaClient) ListMounts(ctx context.Context, in *ListMountsRequest, opts ...grpc.CallOption) (*ListMountsResponse, error) {
 	out := new(ListMountsResponse)
-	err := c.cc.Invoke(ctx, "/meta.HCPLinkMeta/ListMounts", in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_ListMounts_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -56,7 +70,7 @@ func (c *hCPLinkMetaClient) ListMounts(ctx context.Context, in *ListMountsReques
 
 func (c *hCPLinkMetaClient) ListAuths(ctx context.Context, in *ListAuthsRequest, opts ...grpc.CallOption) (*ListAuthResponse, error) {
 	out := new(ListAuthResponse)
-	err := c.cc.Invoke(ctx, "/meta.HCPLinkMeta/ListAuths", in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_ListAuths_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -65,7 +79,7 @@ func (c *hCPLinkMetaClient) ListAuths(ctx context.Context, in *ListAuthsRequest,
 
 func (c *hCPLinkMetaClient) GetClusterStatus(ctx context.Context, in *GetClusterStatusRequest, opts ...grpc.CallOption) (*GetClusterStatusResponse, error) {
 	out := new(GetClusterStatusResponse)
-	err := c.cc.Invoke(ctx, "/meta.HCPLinkMeta/GetClusterStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, HCPLinkMeta_GetClusterStatus_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -126,7 +140,7 @@ func _HCPLinkMeta_ListNamespaces_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/meta.HCPLinkMeta/ListNamespaces",
+		FullMethod: HCPLinkMeta_ListNamespaces_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HCPLinkMetaServer).ListNamespaces(ctx, req.(*ListNamespacesRequest))
@@ -144,7 +158,7 @@ func _HCPLinkMeta_ListMounts_Handler(srv interface{}, ctx context.Context, dec f
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/meta.HCPLinkMeta/ListMounts",
+		FullMethod: HCPLinkMeta_ListMounts_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HCPLinkMetaServer).ListMounts(ctx, req.(*ListMountsRequest))
@@ -162,7 +176,7 @@ func _HCPLinkMeta_ListAuths_Handler(srv interface{}, ctx context.Context, dec fu
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/meta.HCPLinkMeta/ListAuths",
+		FullMethod: HCPLinkMeta_ListAuths_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HCPLinkMetaServer).ListAuths(ctx, req.(*ListAuthsRequest))
@@ -180,7 +194,7 @@ func _HCPLinkMeta_GetClusterStatus_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/meta.HCPLinkMeta/GetClusterStatus",
+		FullMethod: HCPLinkMeta_GetClusterStatus_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(HCPLinkMetaServer).GetClusterStatus(ctx, req.(*GetClusterStatusRequest))
diff --git a/vault/hcp_link/proto/node_status/status.pb.go b/vault/hcp_link/proto/node_status/status.pb.go
index 0080ddb48f..b646ce6aff 100644
--- a/vault/hcp_link/proto/node_status/status.pb.go
+++ b/vault/hcp_link/proto/node_status/status.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/hcp_link/proto/node_status/status.proto
 
diff --git a/vault/request_forwarding_service.pb.go b/vault/request_forwarding_service.pb.go
index 2f0d206bf7..9402692e09 100644
--- a/vault/request_forwarding_service.pb.go
+++ b/vault/request_forwarding_service.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/request_forwarding_service.proto
 
diff --git a/vault/request_forwarding_service_grpc.pb.go b/vault/request_forwarding_service_grpc.pb.go
index 9ff0c496aa..d0b63b3693 100644
--- a/vault/request_forwarding_service_grpc.pb.go
+++ b/vault/request_forwarding_service_grpc.pb.go
@@ -1,4 +1,11 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             (unknown)
+// source: vault/request_forwarding_service.proto
 
 package vault
 
@@ -15,6 +22,12 @@ import (
 // Requires gRPC-Go v1.32.0 or later.
 const _ = grpc.SupportPackageIsVersion7
 
+const (
+	RequestForwarding_ForwardRequest_FullMethodName                    = "/vault.RequestForwarding/ForwardRequest"
+	RequestForwarding_Echo_FullMethodName                              = "/vault.RequestForwarding/Echo"
+	RequestForwarding_PerformanceStandbyElectionRequest_FullMethodName = "/vault.RequestForwarding/PerformanceStandbyElectionRequest"
+)
+
 // RequestForwardingClient is the client API for RequestForwarding service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -34,7 +47,7 @@ func NewRequestForwardingClient(cc grpc.ClientConnInterface) RequestForwardingCl
 
 func (c *requestForwardingClient) ForwardRequest(ctx context.Context, in *forwarding.Request, opts ...grpc.CallOption) (*forwarding.Response, error) {
 	out := new(forwarding.Response)
-	err := c.cc.Invoke(ctx, "/vault.RequestForwarding/ForwardRequest", in, out, opts...)
+	err := c.cc.Invoke(ctx, RequestForwarding_ForwardRequest_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -43,7 +56,7 @@ func (c *requestForwardingClient) ForwardRequest(ctx context.Context, in *forwar
 
 func (c *requestForwardingClient) Echo(ctx context.Context, in *EchoRequest, opts ...grpc.CallOption) (*EchoReply, error) {
 	out := new(EchoReply)
-	err := c.cc.Invoke(ctx, "/vault.RequestForwarding/Echo", in, out, opts...)
+	err := c.cc.Invoke(ctx, RequestForwarding_Echo_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -51,7 +64,7 @@ func (c *requestForwardingClient) Echo(ctx context.Context, in *EchoRequest, opt
 }
 
 func (c *requestForwardingClient) PerformanceStandbyElectionRequest(ctx context.Context, in *PerfStandbyElectionInput, opts ...grpc.CallOption) (RequestForwarding_PerformanceStandbyElectionRequestClient, error) {
-	stream, err := c.cc.NewStream(ctx, &RequestForwarding_ServiceDesc.Streams[0], "/vault.RequestForwarding/PerformanceStandbyElectionRequest", opts...)
+	stream, err := c.cc.NewStream(ctx, &RequestForwarding_ServiceDesc.Streams[0], RequestForwarding_PerformanceStandbyElectionRequest_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -128,7 +141,7 @@ func _RequestForwarding_ForwardRequest_Handler(srv interface{}, ctx context.Cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/vault.RequestForwarding/ForwardRequest",
+		FullMethod: RequestForwarding_ForwardRequest_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RequestForwardingServer).ForwardRequest(ctx, req.(*forwarding.Request))
@@ -146,7 +159,7 @@ func _RequestForwarding_Echo_Handler(srv interface{}, ctx context.Context, dec f
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/vault.RequestForwarding/Echo",
+		FullMethod: RequestForwarding_Echo_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RequestForwardingServer).Echo(ctx, req.(*EchoRequest))
diff --git a/vault/seal/multi_wrap_value.pb.go b/vault/seal/multi_wrap_value.pb.go
index 3ce8fec293..7f2696da27 100644
--- a/vault/seal/multi_wrap_value.pb.go
+++ b/vault/seal/multi_wrap_value.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/seal/multi_wrap_value.proto
 
diff --git a/vault/tokens/token.pb.go b/vault/tokens/token.pb.go
index d5d9682c98..a7f770e534 100644
--- a/vault/tokens/token.pb.go
+++ b/vault/tokens/token.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.31.0
+// 	protoc-gen-go v1.32.0
 // 	protoc        (unknown)
 // source: vault/tokens/token.proto