diff --git a/nebius/ai/v1/endpoint.proto b/nebius/ai/v1/endpoint.proto
index 91867a7..672fd1d 100644
--- a/nebius/ai/v1/endpoint.proto
+++ b/nebius/ai/v1/endpoint.proto
@@ -139,7 +139,8 @@ message EndpointSpec {
   message VolumeMount {
     // Source of the volume mount.
     //
-    // Can be a name of an ID of Nebius Storage bucket or filesystem.
+    // Can be a name or an ID of Nebius Storage bucket or filesystem,
+    // or an S3 URI (e.g. "s3://bucket-name") when using external S3 storage.
     string source = 1;
 
     // Path inside the source volume.
@@ -155,6 +156,11 @@ message EndpointSpec {
     // Mount mode.
     Mode mode = 4 [(buf.validate.field).required = true];
 
+    // Source Config
+    oneof source_config {
+      S3Config s3_config = 5;
+    }
+
     // Mode that will be used to mount the volume.
     enum Mode {
       MODE_UNSPECIFIED = 0;
@@ -165,6 +171,45 @@ message EndpointSpec {
       // Read-write mode.
       READ_WRITE = 2;
     }
+
+    // Config for accessing an external S3-compatible storage.
+    //
+    // The bucket name is specified in the `source` field as an S3 URI.
+    message S3Config {
+      // S3-compatible endpoint URL (e.g. "https://s3.amazonaws.com").
+      string endpoint = 1 [(buf.validate.field).required = true];
+
+      reserved 2;
+
+      reserved "bucket";
+
+      // S3 region.
+      string region = 3 [(buf.validate.field).required = true];
+
+      // Authentication method.
+      oneof auth {
+        // Inline S3 credentials.
+        S3Credentials credentials = 4;
+      }
+
+      // Inline S3 credentials.
+      message S3Credentials {
+        // Access key ID.
+        string access_key_id = 1 [
+          (buf.validate.field).required = true,
+          (sensitive) = true
+        ];
+
+        // Secret access key.
+        string secret_access_key = 2 [
+          (buf.validate.field).required = true,
+          (sensitive) = true
+        ];
+
+        // Session token (optional, for temporary credentials).
+        string session_token = 3 [(sensitive) = true];
+      }
+    }
   }
 
   message DiskSpec {
diff --git a/nebius/ai/v1/job.proto b/nebius/ai/v1/job.proto
index 92f4230..f754e1b 100644
--- a/nebius/ai/v1/job.proto
+++ b/nebius/ai/v1/job.proto
@@ -141,7 +141,8 @@ message JobSpec {
   message VolumeMount {
     // Source of the volume mount.
     //
-    // Can be a name of an ID of Nebius Storage bucket or filesystem.
+    // Can be a name or an ID of Nebius Storage bucket or filesystem,
+    // or an S3 URI (e.g. "s3://bucket-name") when using external S3 storage.
     string source = 1;
 
     // Path inside the source volume.
@@ -157,6 +158,11 @@ message JobSpec {
     // Mount mode.
     Mode mode = 4 [(buf.validate.field).required = true];
 
+    // Source Config
+    oneof source_config {
+      S3Config s3_config = 5;
+    }
+
     // Mode that will be used to mount the volume.
     enum Mode {
       MODE_UNSPECIFIED = 0;
@@ -167,6 +173,45 @@ message JobSpec {
       // Read-only mode.
       READ_ONLY = 2;
     }
+
+    // Config for accessing an external S3-compatible storage.
+    //
+    // The bucket name is specified in the `source` field as an S3 URI.
+    message S3Config {
+      // S3-compatible endpoint URL (e.g. "https://s3.amazonaws.com").
+      string endpoint = 1 [(buf.validate.field).required = true];
+
+      reserved 2;
+
+      reserved "bucket";
+
+      // S3 region.
+      string region = 3 [(buf.validate.field).required = true];
+
+      // Authentication method.
+      oneof auth {
+        // Inline S3 credentials.
+        S3Credentials credentials = 4;
+      }
+
+      // Inline S3 credentials.
+      message S3Credentials {
+        // Access key ID.
+        string access_key_id = 1 [
+          (buf.validate.field).required = true,
+          (sensitive) = true
+        ];
+
+        // Secret access key.
+        string secret_access_key = 2 [
+          (buf.validate.field).required = true,
+          (sensitive) = true
+        ];
+
+        // Session token (optional, for temporary credentials).
+        string session_token = 3 [(sensitive) = true];
+      }
+    }
   }
 
   message DiskSpec {
diff --git a/nebius/annotations.proto b/nebius/annotations.proto
index d3392e5..96f81a2 100644
--- a/nebius/annotations.proto
+++ b/nebius/annotations.proto
@@ -47,6 +47,9 @@ extend google.protobuf.MethodOptions {
   //
   // Read `MethodBehavior` enum for more details and examples.
   repeated MethodBehavior method_behavior = 1197;
+
+  // Overrides for some settings for fields of this method's input.
+  repeated SubfieldSettings request_fields = 1198;
 }
 
 extend google.protobuf.MessageOptions {
@@ -86,6 +89,9 @@ extend google.protobuf.FieldOptions {
   // in the NID itself.
   // See `NIDFieldSettings` for more details.
   NIDFieldSettings nid = 1196;
+
+  // Overrides for some settings for subfields of this field.
+  repeated SubfieldSettings subfield_settings = 1197;
 }
 
 extend google.protobuf.OneofOptions {
@@ -164,6 +170,9 @@ enum FieldBehavior {
 
   // This indicates that the field can't be changed during a resource update.
   // Changing the field value will cause an `INVALID_ARGUMENT` error.
+  // For message fields, this applies to the field itself. Nested immutable
+  // fields do not make a mutable parent message immutable, and such a parent
+  // message may still be cleared.
   // Resource recreate requires a change of the field value.
   IMMUTABLE = 2;
 
@@ -215,12 +224,12 @@ message DeprecationDetails {
 
 message NIDFieldSettings {
   // Fields annotated with this option are treated as NIDs.
-  // `resource` lists allowed NID resource types (prefixes). Leave empty to accept any type.
+  // `resource` lists allowed NID resource types (prefixes). Leave empty or set to `*` to accept any type.
   // Validation only produces warnings.
   repeated string resource = 1;
 
   // For metadata fields, `parent_resource` lists allowed parent resource types for `metadata.parent_id`.
-  // Leave empty to allow any type. Validation only produces warnings.
+  // Leave empty or set to `*` to allow any type. Validation only produces warnings.
   // Typically set on the resource message; request-level overrides are supported.
   repeated string parent_resource = 2;
 }
@@ -251,3 +260,46 @@ enum MethodBehavior {
   // don't return any resource, or for resource deletion operations.
   METHOD_WITHOUT_GET = 4;
 }
+
+// SubfieldSettings describes overrides for some settings for subfields of a
+// field. Overrides are applied to fields in order of appearance, so the first
+// matching override is applied, and the rest are ignored.
+//
+// Example:
+// ```protobuf
+// message MyMessage {
+//   string field1 = 1;
+// }
+// message MyMessage2 {
+//   MyMessage field2 = 1 [(subfield_settings) = { field_path: "field1", is_required: true }];
+// }
+// ```
+// In this example, `field1` in `MyMessage2` is required, even if it is not
+// required in `MyMessage`.
+// The following example will override the setting again:
+// ```protobuf
+// service MyService {
+//   rpc MyMethod(MyMessage2) returns (MyMessage2) {
+//     option (method_behavior) = METHOD_UPDATER;
+//     option (request_fields) = { field_path: "field2.field1", is_required: false };
+//   }
+// }
+// ```
+// In this example, `field1` in `MyMessage2` is not required for the `MyMethod`,
+// even if it is required in `MyMessage2`.
+message SubfieldSettings {
+  // Subfield path in the message, for example `metadata.parent_id` or `metadata.name`.
+  // Must be a valid SelectMask.
+  // May match several fields, if necessary. For example, `some.*.subfield` or
+  // `some.(subfield,another_field)`.
+  string field_path = 1;
+
+  // For fields annotated with this option, values are treated as NIDs and
+  // warnings are emitted when they are not valid. These warnings are separate from server-side validation.
+  NIDFieldSettings nid = 2;
+
+  // Mark a field as required, even if it is not required in the message it contains.
+  // Unlike cel expressions, this setting can be reflected in tools documentation and
+  // help messages.
+  optional bool is_required = 4;
+}
diff --git a/nebius/compute/v1/instance.proto b/nebius/compute/v1/instance.proto
index ebfcaad..6638cf2 100644
--- a/nebius/compute/v1/instance.proto
+++ b/nebius/compute/v1/instance.proto
@@ -42,7 +42,7 @@ message InstanceSpec {
   }];
 
   // Specified boot disk attached to the instance.
-  AttachedDiskSpec boot_disk = 5 [(field_behavior) = IMMUTABLE];
+  AttachedDiskSpec boot_disk = 5;
 
   // List of additional data disks attached to the instance beyond the boot disk.
   repeated AttachedDiskSpec secondary_disks = 6;
@@ -87,6 +87,14 @@ message InstanceSpec {
   }];
 
   ReservationPolicy reservation_policy = 23;
+
+  // Local disks are meaningfully different from regular (remote) disks:
+  // they are provided by the underlying host and are tied to a particular VM run.
+  // Local disk data is not preserved across Stop-Start initiated via Compute API.
+  // Local disks are not provided by default. To get them, explicitly request them via this field.
+  // Availability depends on the selected platform, preset and region.
+  // Changing this field will result in disks change and content loss, but only after stop and start the instance.
+  LocalDisksSpec local_disks = 24;
 }
 
 message PreemptibleSpec {
@@ -272,3 +280,23 @@ message ReservationPolicy {
   // Capacity block groups, order matters
   repeated string reservation_ids = 2;
 }
+
+message LocalDisksSpec {
+  oneof request {
+    option (buf.validate.oneof).required = true;
+
+    // Requests passthrough local disks from the host.
+    // Topology of the provided disks is preserved during stop and start
+    // for every instance of a specific platform and preset in the region.
+    PassthroughGroupRequest passthrough_group = 1;
+  }
+}
+
+message PassthroughGroupRequest {
+  // Passthrough local disks from the underlying host.
+  //
+  // Devices are expected to appear in the guest as NVMe devices (nvme0, nvme1, ...),
+  // but the exact number depends on the preset.
+  // Enabled only when this field is explicitly set.
+  bool requested = 1;
+}
diff --git a/nebius/dns/v1/zone.proto b/nebius/dns/v1/zone.proto
index 6cec437..9a65e4f 100644
--- a/nebius/dns/v1/zone.proto
+++ b/nebius/dns/v1/zone.proto
@@ -38,16 +38,20 @@ message Zone {
 // DNS Zone specification
 message ZoneSpec {
   // Fully qualified domain name of this zone, including `.` at the end
-  string domain_name = 1 [(buf.validate.field) = {
-    cel: [
-      {
-        id: "domain_name_format"
-        message: "domain_name must be a fully-qualified domain name with '.' at the end, e.g. 'x.y.z.'"
-        expression: "size(this) < 253 && this.matches('^[a-z0-9][-a-z0-9.]*[.]$')"
-      }
-    ]
-    required: true
-  }];
+  // Cannot be changed after creating the zone
+  string domain_name = 1 [
+    (buf.validate.field) = {
+      cel: [
+        {
+          id: "domain_name_format"
+          message: "domain_name must be a fully-qualified domain name with '.' at the end, e.g. 'x.y.z.'"
+          expression: "size(this) < 253 && this.matches('^[a-z0-9][-a-z0-9.]*[.]$')"
+        }
+      ]
+      required: true
+    },
+    (field_behavior) = IMMUTABLE
+  ];
 
   // Scope for this zone
   // The scope is chosen at zone creation time and cannot be changed, but scope's attributes can sometimes be changed
diff --git a/nebius/logging/v1/agentmanager/version_service.proto b/nebius/logging/v1/agentmanager/version_service.proto
index 7859a8d..ff46d22 100644
--- a/nebius/logging/v1/agentmanager/version_service.proto
+++ b/nebius/logging/v1/agentmanager/version_service.proto
@@ -129,6 +129,15 @@ message ModulesHealth {
 
   // Health status of the vm service logs pipeline module.
   ModuleHealth vm_service_logs_pipeline = 7;
+
+  // Health status of the compute GPU logs pipeline module.
+  ModuleHealth compute_gpu_logs_pipeline = 8;
+
+  // Health status of the journald pipeline module.
+  ModuleHealth journald_pipeline = 9;
+
+  // Health status of the NCCL metrics pipeline module.
+  ModuleHealth nccl_metrics_pipeline = 10;
 }
 
 // Health check logs information for monitoring disk usage.
diff --git a/nebius/storage/v1/base.proto b/nebius/storage/v1/base.proto
index 0db454e..61c2f96 100644
--- a/nebius/storage/v1/base.proto
+++ b/nebius/storage/v1/base.proto
@@ -14,7 +14,7 @@ enum StorageClass {
 
   ENHANCED_THROUGHPUT = 2;
 
-  INTELLIGENT_TIERING = 3;
+  INTELLIGENT = 3;
 }
 
 enum VersioningPolicy {
diff --git a/nebius/storage/v1/bucket.proto b/nebius/storage/v1/bucket.proto
index ed053d9..73935cb 100644
--- a/nebius/storage/v1/bucket.proto
+++ b/nebius/storage/v1/bucket.proto
@@ -34,6 +34,8 @@ message BucketSpec {
   //  * enabled <-> suspended
   VersioningPolicy versioning_policy = 2 [(field_behavior) = NON_EMPTY_DEFAULT];
 
+  reserved 3;
+
   // Maximum bucket size.
   // Zero means unlimited.
   // Actual limit can be lower if customer doesn't have enough quota.
@@ -49,16 +51,7 @@ message BucketSpec {
   // If not set - STANDARD is used as a default storage class.
   StorageClass default_storage_class = 9;
 
-  // Storage class to override any other storage class of uploading objects. It overrides the storage class regardless
-  // of how the original storage class was specified - either the default storage class
-  // or the one provided via the `x-amz-storage-class` header.
-  StorageClass override_storage_class = 10 [
-    deprecated = true,
-    (field_deprecation_details) = {
-      effective_at: "2025-12-01"
-      description: "Use `default_storage_class` with `force_storage_class` instead"
-    }
-  ];
+  reserved 10;
 
   // Flag to force usage of default_storage_class, ignoring `x-amz-storage-class` header.
   bool force_storage_class = 11;