diff --git a/app/cli/cmd/casbackend.go b/app/cli/cmd/casbackend.go
index 4b41f492b..3d6eaa5a6 100644
--- a/app/cli/cmd/casbackend.go
+++ b/app/cli/cmd/casbackend.go
@@ -22,6 +22,11 @@ import (
 	"github.com/spf13/cobra"
 )
 
+var (
+	isDefaultCASBackendUpdateOption   *bool
+	descriptionCASBackendUpdateOption *string
+)
+
 func newCASBackendCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "cas-backend",
@@ -119,3 +124,41 @@ func confirmationPrompt(msg string) bool {
 
 	return gotChallenge == "y" || gotChallenge == "Y"
 }
+
+// captureUpdateFlags reads the --default and --description flags only when explicitly set and
+// stores their values in the package-level pointer options. This avoids treating their zero
+// values as an intention to update.
+func captureUpdateFlags(cmd *cobra.Command) error {
+	if f := cmd.Flags().Lookup("default"); f != nil && f.Changed {
+		v, err := cmd.Flags().GetBool("default")
+		if err != nil {
+			return err
+		}
+		isDefaultCASBackendUpdateOption = &v
+	}
+
+	if f := cmd.Flags().Lookup("description"); f != nil && f.Changed {
+		v, err := cmd.Flags().GetString("description")
+		if err != nil {
+			return err
+		}
+		descriptionCASBackendUpdateOption = &v
+	}
+
+	return nil
+}
+
+// handleDefaultUpdateConfirmation centralizes the confirmation logic when the --default flag
+// is provided. It returns (true, nil) when it's ok to proceed, (false, nil) when the user
+// declined confirmation, or (false, err) when an error happened.
+func handleDefaultUpdateConfirmation(actionOpts *action.ActionsOpts, name string) (bool, error) {
+	if isDefaultCASBackendUpdateOption == nil {
+		return true, nil
+	}
+
+	if *isDefaultCASBackendUpdateOption {
+		return confirmDefaultCASBackendOverride(actionOpts, name)
+	}
+
+	return confirmDefaultCASBackendUnset(name, "You are setting the default CAS backend to false", actionOpts)
+}
diff --git a/app/cli/cmd/casbackend_update_azureblob.go b/app/cli/cmd/casbackend_update_azureblob.go
index bf5ab58d0..53a7b7817 100644
--- a/app/cli/cmd/casbackend_update_azureblob.go
+++ b/app/cli/cmd/casbackend_update_azureblob.go
@@ -27,41 +27,28 @@ func newCASBackendUpdateAzureBlobCmd() *cobra.Command {
 		Use:   "azure-blob",
 		Short: "Update a AzureBlob CAS Backend description, credentials or default status",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			// If we are setting the default, we list existing CAS backends
-			// and ask the user to confirm the rewrite
-			isDefault, err := cmd.Flags().GetBool("default")
-			cobra.CheckErr(err)
-
-			description, err := cmd.Flags().GetString("description")
-			cobra.CheckErr(err)
+			// capture flags only when explicitly set
+			if err := captureUpdateFlags(cmd); err != nil {
+				return err
+			}
 
-			// If we are overriding the default we ask for confirmation
-			if isDefault {
-				if confirmed, err := confirmDefaultCASBackendOverride(actionOpts, backendName); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
-			} else {
-				// If we are removing the default we ask for confirmation too
-				if confirmed, err := confirmDefaultCASBackendUnset(backendName, "You are setting the default CAS backend to false", actionOpts); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
+			// If we are overriding/unsetting the default we ask for confirmation
+			if ok, err := handleDefaultUpdateConfirmation(actionOpts, backendName); err != nil {
+				return err
+			} else if !ok {
+				log.Info("Aborting...")
+				return nil
 			}
 
 			opts := &action.NewCASBackendUpdateOpts{
 				Name:        backendName,
-				Description: description,
+				Description: descriptionCASBackendUpdateOption,
 				Credentials: map[string]any{
 					"tenantID":     tenantID,
 					"clientID":     clientID,
 					"clientSecret": clientSecret,
 				},
-				Default: isDefault,
+				Default: isDefaultCASBackendUpdateOption,
 			}
 
 			// this means that we are not updating credentials
diff --git a/app/cli/cmd/casbackend_update_inline.go b/app/cli/cmd/casbackend_update_inline.go
index 434561e59..75640a2fe 100644
--- a/app/cli/cmd/casbackend_update_inline.go
+++ b/app/cli/cmd/casbackend_update_inline.go
@@ -27,34 +27,23 @@ func newCASBackendUpdateInlineCmd() *cobra.Command {
 		Use:   "inline",
 		Short: "Update the Inline, fallback CAS Backend description or default status",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			isDefault, err := cmd.Flags().GetBool("default")
-			cobra.CheckErr(err)
-
-			description, err := cmd.Flags().GetString("description")
-			cobra.CheckErr(err)
+			// capture flags only when explicitly set
+			if err := captureUpdateFlags(cmd); err != nil {
+				return err
+			}
 
-			// If we are overriding the default we ask for confirmation
-			if isDefault {
-				if confirmed, err := confirmDefaultCASBackendOverride(actionOpts, backendName); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
-			} else {
-				// If we are removing the default we ask for confirmation too
-				if confirmed, err := confirmDefaultCASBackendUnset(backendName, "You are setting the default CAS backend to false", actionOpts); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
+			// If we are overriding/unsetting the default we ask for confirmation
+			if ok, err := handleDefaultUpdateConfirmation(actionOpts, backendName); err != nil {
+				return err
+			} else if !ok {
+				log.Info("Aborting...")
+				return nil
 			}
 
 			opts := &action.NewCASBackendUpdateOpts{
 				Name:        backendName,
-				Description: description,
-				Default:     isDefault,
+				Description: descriptionCASBackendUpdateOption,
+				Default:     isDefaultCASBackendUpdateOption,
 			}
 
 			res, err := action.NewCASBackendUpdate(actionOpts).Run(opts)
diff --git a/app/cli/cmd/casbackend_update_oci.go b/app/cli/cmd/casbackend_update_oci.go
index 0be295ec1..d9909a018 100644
--- a/app/cli/cmd/casbackend_update_oci.go
+++ b/app/cli/cmd/casbackend_update_oci.go
@@ -27,40 +27,27 @@ func newCASBackendUpdateOCICmd() *cobra.Command {
 		Use:   "oci",
 		Short: "Update a OCI CAS Backend description, credentials or default status",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			// If we are setting the default, we list existing CAS backends
-			// and ask the user to confirm the rewrite
-			isDefault, err := cmd.Flags().GetBool("default")
-			cobra.CheckErr(err)
-
-			description, err := cmd.Flags().GetString("description")
-			cobra.CheckErr(err)
+			// capture flags only when explicitly set
+			if err := captureUpdateFlags(cmd); err != nil {
+				return err
+			}
 
-			// If we are overriding the default we ask for confirmation
-			if isDefault {
-				if confirmed, err := confirmDefaultCASBackendOverride(actionOpts, backendName); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
-			} else {
-				// If we are removing the default we ask for confirmation too
-				if confirmed, err := confirmDefaultCASBackendUnset(backendName, "You are setting the default CAS backend to false", actionOpts); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
+			// If we are overriding/unsetting the default we ask for confirmation
+			if ok, err := handleDefaultUpdateConfirmation(actionOpts, backendName); err != nil {
+				return err
+			} else if !ok {
+				log.Info("Aborting...")
+				return nil
 			}
 
 			opts := &action.NewCASBackendUpdateOpts{
 				Name:        backendName,
-				Description: description,
+				Description: descriptionCASBackendUpdateOption,
 				Credentials: map[string]any{
 					"username": username,
 					"password": password,
 				},
-				Default: isDefault,
+				Default: isDefaultCASBackendUpdateOption,
 			}
 
 			if username == "" && password == "" {
diff --git a/app/cli/cmd/casbackend_update_s3.go b/app/cli/cmd/casbackend_update_s3.go
index f84511059..e6e1b16b0 100644
--- a/app/cli/cmd/casbackend_update_s3.go
+++ b/app/cli/cmd/casbackend_update_s3.go
@@ -27,41 +27,28 @@ func newCASBackendUpdateAWSS3Cmd() *cobra.Command {
 		Use:   "aws-s3",
 		Short: "Update a AWS S3 CAS Backend description, credentials or default status",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			// If we are setting the default, we list existing CAS backends
-			// and ask the user to confirm the rewrite
-			isDefault, err := cmd.Flags().GetBool("default")
-			cobra.CheckErr(err)
-
-			description, err := cmd.Flags().GetString("description")
-			cobra.CheckErr(err)
+			// capture flags only when explicitly set
+			if err := captureUpdateFlags(cmd); err != nil {
+				return err
+			}
 
-			// If we are overriding the default we ask for confirmation
-			if isDefault {
-				if confirmed, err := confirmDefaultCASBackendOverride(actionOpts, backendName); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
-			} else {
-				// If we are removing the default we ask for confirmation too
-				if confirmed, err := confirmDefaultCASBackendUnset(backendName, "You are setting the default CAS backend to false", actionOpts); err != nil {
-					return err
-				} else if !confirmed {
-					log.Info("Aborting...")
-					return nil
-				}
+			// If we are overriding/unsetting the default we ask for confirmation
+			if ok, err := handleDefaultUpdateConfirmation(actionOpts, backendName); err != nil {
+				return err
+			} else if !ok {
+				log.Info("Aborting...")
+				return nil
 			}
 
 			opts := &action.NewCASBackendUpdateOpts{
 				Name:        backendName,
-				Description: description,
+				Description: descriptionCASBackendUpdateOption,
 				Credentials: map[string]any{
 					"accessKeyID":     accessKeyID,
 					"secretAccessKey": secretAccessKey,
 					"region":          region,
 				},
-				Default: isDefault,
+				Default: isDefaultCASBackendUpdateOption,
 			}
 
 			// this means that we are not updating credentials
diff --git a/app/cli/internal/action/casbackend_update.go b/app/cli/internal/action/casbackend_update.go
index bf4e8a97e..592bd35d6 100644
--- a/app/cli/internal/action/casbackend_update.go
+++ b/app/cli/internal/action/casbackend_update.go
@@ -29,8 +29,8 @@ type CASBackendUpdate struct {
 
 type NewCASBackendUpdateOpts struct {
 	Name        string
-	Description string
-	Default     bool
+	Description *string
+	Default     *bool
 	Credentials map[string]any
 }
 
diff --git a/app/controlplane/api/controlplane/v1/cas_backends.pb.go b/app/controlplane/api/controlplane/v1/cas_backends.pb.go
index bd09f58fe..3d8b9b45a 100644
--- a/app/controlplane/api/controlplane/v1/cas_backends.pb.go
+++ b/app/controlplane/api/controlplane/v1/cas_backends.pb.go
@@ -324,9 +324,9 @@ type CASBackendServiceUpdateRequest struct {
 
 	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
 	// Description
-	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+	Description *string `protobuf:"bytes,2,opt,name=description,proto3,oneof" json:"description,omitempty"`
 	// Set as default in your organization
-	Default bool `protobuf:"varint,3,opt,name=default,proto3" json:"default,omitempty"`
+	Default *bool `protobuf:"varint,3,opt,name=default,proto3,oneof" json:"default,omitempty"`
 	// Credentials, useful for rotation
 	Credentials *structpb.Struct `protobuf:"bytes,4,opt,name=credentials,proto3" json:"credentials,omitempty"`
 }
@@ -371,15 +371,15 @@ func (x *CASBackendServiceUpdateRequest) GetName() string {
 }
 
 func (x *CASBackendServiceUpdateRequest) GetDescription() string {
-	if x != nil {
-		return x.Description
+	if x != nil && x.Description != nil {
+		return *x.Description
 	}
 	return ""
 }
 
 func (x *CASBackendServiceUpdateRequest) GetDefault() bool {
-	if x != nil {
-		return x.Default
+	if x != nil && x.Default != nil {
+		return *x.Default
 	}
 	return false
 }
@@ -566,7 +566,7 @@ var file_controlplane_v1_cas_backends_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c,
 	0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e,
-	0x64, 0x49, 0x74, 0x65, 0x6d, 0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x22, 0xb1, 0x02,
+	0x64, 0x49, 0x74, 0x65, 0x6d, 0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x22, 0xd7, 0x02,
 	0x0a, 0x1e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76,
 	0x69, 0x63, 0x65, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x12, 0x97, 0x01, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
@@ -578,78 +578,80 @@ var file_controlplane_v1_cas_backends_proto_rawDesc = []byte{
 	0x6e, 0x73, 0x2e, 0x1a, 0x2f, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65,
 	0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x2d, 0x61,
 	0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x29,
-	0x3f, 0x24, 0x27, 0x29, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x18, 0x0a, 0x07,
-	0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x64,
-	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x12, 0x39, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
-	0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74,
-	0x72, 0x75, 0x63, 0x74, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c,
-	0x73, 0x22, 0x5a, 0x0a, 0x1f, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c,
-	0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e,
-	0x64, 0x49, 0x74, 0x65, 0x6d, 0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x22, 0xba, 0x01,
-	0x0a, 0x1e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x97, 0x01, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
-	0x82, 0x01, 0xba, 0x48, 0x7f, 0xba, 0x01, 0x7c, 0x0a, 0x0d, 0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x64,
-	0x6e, 0x73, 0x2d, 0x31, 0x31, 0x32, 0x33, 0x12, 0x3a, 0x6d, 0x75, 0x73, 0x74, 0x20, 0x63, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x6f, 0x6e, 0x6c, 0x79, 0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72,
-	0x63, 0x61, 0x73, 0x65, 0x20, 0x6c, 0x65, 0x74, 0x74, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x6e, 0x75,
-	0x6d, 0x62, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64, 0x20, 0x68, 0x79, 0x70, 0x68, 0x65,
-	0x6e, 0x73, 0x2e, 0x1a, 0x2f, 0x74, 0x68, 0x69, 0x73, 0x2e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65,
-	0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x28, 0x5b, 0x2d, 0x61,
-	0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x2a, 0x5b, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x29,
-	0x3f, 0x24, 0x27, 0x29, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x21, 0x0a, 0x1f, 0x43, 0x41,
-	0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0xa0, 0x01,
-	0x0a, 0x15, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x45, 0x72, 0x72, 0x6f,
-	0x72, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x28, 0x0a, 0x24, 0x43, 0x41, 0x53, 0x5f, 0x42,
+	0x3f, 0x24, 0x27, 0x29, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x25, 0x0a, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x00, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01,
+	0x01, 0x12, 0x1d, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x48, 0x01, 0x52, 0x07, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x88, 0x01, 0x01,
+	0x12, 0x39, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x52, 0x0b,
+	0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x42, 0x0e, 0x0a, 0x0c, 0x5f,
+	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x0a, 0x0a, 0x08, 0x5f,
+	0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x22, 0x5a, 0x0a, 0x1f, 0x43, 0x41, 0x53, 0x42, 0x61,
+	0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37, 0x0a, 0x06, 0x72, 0x65,
+	0x73, 0x75, 0x6c, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53,
+	0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x49, 0x74, 0x65, 0x6d, 0x52, 0x06, 0x72, 0x65, 0x73,
+	0x75, 0x6c, 0x74, 0x22, 0xba, 0x01, 0x0a, 0x1e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65,
+	0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x97, 0x01, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x82, 0x01, 0xba, 0x48, 0x7f, 0xba, 0x01, 0x7c, 0x0a, 0x0d,
+	0x6e, 0x61, 0x6d, 0x65, 0x2e, 0x64, 0x6e, 0x73, 0x2d, 0x31, 0x31, 0x32, 0x33, 0x12, 0x3a, 0x6d,
+	0x75, 0x73, 0x74, 0x20, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x20, 0x6f, 0x6e, 0x6c, 0x79,
+	0x20, 0x6c, 0x6f, 0x77, 0x65, 0x72, 0x63, 0x61, 0x73, 0x65, 0x20, 0x6c, 0x65, 0x74, 0x74, 0x65,
+	0x72, 0x73, 0x2c, 0x20, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x73, 0x2c, 0x20, 0x61, 0x6e, 0x64,
+	0x20, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6e, 0x73, 0x2e, 0x1a, 0x2f, 0x74, 0x68, 0x69, 0x73, 0x2e,
+	0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x28, 0x27, 0x5e, 0x5b, 0x61, 0x2d, 0x7a, 0x30, 0x2d,
+	0x39, 0x5d, 0x28, 0x5b, 0x2d, 0x61, 0x2d, 0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x2a, 0x5b, 0x61, 0x2d,
+	0x7a, 0x30, 0x2d, 0x39, 0x5d, 0x29, 0x3f, 0x24, 0x27, 0x29, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x22, 0x21, 0x0a, 0x1f, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x2a, 0xa0, 0x01, 0x0a, 0x15, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65,
+	0x6e, 0x64, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x28, 0x0a,
+	0x24, 0x43, 0x41, 0x53, 0x5f, 0x42, 0x41, 0x43, 0x4b, 0x45, 0x4e, 0x44, 0x5f, 0x45, 0x52, 0x52,
+	0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x2b, 0x0a, 0x21, 0x43, 0x41, 0x53, 0x5f, 0x42,
 	0x41, 0x43, 0x4b, 0x45, 0x4e, 0x44, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41,
-	0x53, 0x4f, 0x4e, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
-	0x00, 0x12, 0x2b, 0x0a, 0x21, 0x43, 0x41, 0x53, 0x5f, 0x42, 0x41, 0x43, 0x4b, 0x45, 0x4e, 0x44,
-	0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x52, 0x45,
-	0x51, 0x55, 0x49, 0x52, 0x45, 0x44, 0x10, 0x01, 0x1a, 0x04, 0xa8, 0x45, 0x93, 0x03, 0x12, 0x2a,
-	0x0a, 0x20, 0x43, 0x41, 0x53, 0x5f, 0x42, 0x41, 0x43, 0x4b, 0x45, 0x4e, 0x44, 0x5f, 0x45, 0x52,
-	0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e, 0x5f, 0x49, 0x4e, 0x56, 0x41, 0x4c,
-	0x49, 0x44, 0x10, 0x02, 0x1a, 0x04, 0xa8, 0x45, 0x93, 0x03, 0x1a, 0x04, 0xa0, 0x45, 0xf4, 0x03,
-	0x32, 0xc1, 0x03, 0x0a, 0x11, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x65, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x2d,
-	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31,
-	0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e,
+	0x53, 0x4f, 0x4e, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x49, 0x52, 0x45, 0x44, 0x10, 0x01, 0x1a, 0x04,
+	0xa8, 0x45, 0x93, 0x03, 0x12, 0x2a, 0x0a, 0x20, 0x43, 0x41, 0x53, 0x5f, 0x42, 0x41, 0x43, 0x4b,
+	0x45, 0x4e, 0x44, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x5f, 0x52, 0x45, 0x41, 0x53, 0x4f, 0x4e,
+	0x5f, 0x49, 0x4e, 0x56, 0x41, 0x4c, 0x49, 0x44, 0x10, 0x02, 0x1a, 0x04, 0xa8, 0x45, 0x93, 0x03,
+	0x1a, 0x04, 0xa0, 0x45, 0xf4, 0x03, 0x32, 0xc1, 0x03, 0x0a, 0x11, 0x43, 0x41, 0x53, 0x42, 0x61,
+	0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x65, 0x0a, 0x04,
+	0x4c, 0x69, 0x73, 0x74, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c,
+	0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e,
+	0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61,
+	0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a, 0x06, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x2e,
 	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e,
 	0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a,
-	0x06, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x6b, 0x0a, 0x06, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53,
+	0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41,
+	0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a,
+	0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
 	0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63,
-	0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74,
 	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72,
 	0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61,
-	0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a, 0x06, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c,
-	0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e,
-	0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70,
-	0x6c, 0x61, 0x6e, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65,
-	0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x6b, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65,
-	0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65,
-	0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x30, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e,
-	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x41, 0x53, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x4c, 0x5a, 0x4a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2d, 0x64, 0x65, 0x76,
-	0x2f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70, 0x2f, 0x61, 0x70, 0x70, 0x2f, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x76, 0x31, 0x3b,
-	0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x4c, 0x5a, 0x4a, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f,
+	0x6f, 0x70, 0x2d, 0x64, 0x65, 0x76, 0x2f, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x6c, 0x6f, 0x6f, 0x70,
+	0x2f, 0x61, 0x70, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e,
+	0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61,
+	0x6e, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -804,6 +806,7 @@ func file_controlplane_v1_cas_backends_proto_init() {
 			}
 		}
 	}
+	file_controlplane_v1_cas_backends_proto_msgTypes[4].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
diff --git a/app/controlplane/api/controlplane/v1/cas_backends.proto b/app/controlplane/api/controlplane/v1/cas_backends.proto
index 0fb3c7887..647836acb 100644
--- a/app/controlplane/api/controlplane/v1/cas_backends.proto
+++ b/app/controlplane/api/controlplane/v1/cas_backends.proto
@@ -69,9 +69,9 @@ message CASBackendServiceUpdateRequest {
     }
   }];
   // Description
-  string description = 2;
+  optional string description = 2;
   // Set as default in your organization
-  bool default = 3;
+  optional bool default = 3;
   // Credentials, useful for rotation
   google.protobuf.Struct credentials = 4;
 }
diff --git a/app/controlplane/api/gen/frontend/controlplane/v1/cas_backends.ts b/app/controlplane/api/gen/frontend/controlplane/v1/cas_backends.ts
index 545586736..f19e79090 100644
--- a/app/controlplane/api/gen/frontend/controlplane/v1/cas_backends.ts
+++ b/app/controlplane/api/gen/frontend/controlplane/v1/cas_backends.ts
@@ -84,9 +84,13 @@ export interface CASBackendServiceCreateResponse {
 export interface CASBackendServiceUpdateRequest {
   name: string;
   /** Description */
-  description: string;
+  description?:
+    | string
+    | undefined;
   /** Set as default in your organization */
-  default: boolean;
+  default?:
+    | boolean
+    | undefined;
   /** Credentials, useful for rotation */
   credentials?: { [key: string]: any };
 }
@@ -394,7 +398,7 @@ export const CASBackendServiceCreateResponse = {
 };
 
 function createBaseCASBackendServiceUpdateRequest(): CASBackendServiceUpdateRequest {
-  return { name: "", description: "", default: false, credentials: undefined };
+  return { name: "", description: undefined, default: undefined, credentials: undefined };
 }
 
 export const CASBackendServiceUpdateRequest = {
@@ -402,10 +406,10 @@ export const CASBackendServiceUpdateRequest = {
     if (message.name !== "") {
       writer.uint32(10).string(message.name);
     }
-    if (message.description !== "") {
+    if (message.description !== undefined) {
       writer.uint32(18).string(message.description);
     }
-    if (message.default === true) {
+    if (message.default !== undefined) {
       writer.uint32(24).bool(message.default);
     }
     if (message.credentials !== undefined) {
@@ -461,8 +465,8 @@ export const CASBackendServiceUpdateRequest = {
   fromJSON(object: any): CASBackendServiceUpdateRequest {
     return {
       name: isSet(object.name) ? String(object.name) : "",
-      description: isSet(object.description) ? String(object.description) : "",
-      default: isSet(object.default) ? Boolean(object.default) : false,
+      description: isSet(object.description) ? String(object.description) : undefined,
+      default: isSet(object.default) ? Boolean(object.default) : undefined,
       credentials: isObject(object.credentials) ? object.credentials : undefined,
     };
   },
@@ -485,8 +489,8 @@ export const CASBackendServiceUpdateRequest = {
   ): CASBackendServiceUpdateRequest {
     const message = createBaseCASBackendServiceUpdateRequest();
     message.name = object.name ?? "";
-    message.description = object.description ?? "";
-    message.default = object.default ?? false;
+    message.description = object.description ?? undefined;
+    message.default = object.default ?? undefined;
     message.credentials = object.credentials ?? undefined;
     return message;
   },
diff --git a/app/controlplane/pkg/biz/casbackend.go b/app/controlplane/pkg/biz/casbackend.go
index 116139bbc..c11fa6335 100644
--- a/app/controlplane/pkg/biz/casbackend.go
+++ b/app/controlplane/pkg/biz/casbackend.go
@@ -43,6 +43,8 @@ const (
 	CASBackendInlineDefaultMaxBytes int64              = 500 * 1024 // 500KB
 )
 
+var CASBackendInlineDescription = "Embed artifacts content in the attestation (fallback)"
+
 type CASBackendValidationStatus string
 
 var CASBackendValidationOK CASBackendValidationStatus = "OK"
@@ -74,12 +76,13 @@ type CASBackendLimits struct {
 }
 
 type CASBackendOpts struct {
-	OrgID                             uuid.UUID
-	Location, SecretName, Description string
-	Provider                          CASBackendProvider
-	Default                           bool
-	ValidationStatus                  CASBackendValidationStatus
-	ValidationError                   *string
+	OrgID                uuid.UUID
+	Location, SecretName string
+	Description          *string
+	Provider             CASBackendProvider
+	Default              *bool
+	ValidationStatus     CASBackendValidationStatus
+	ValidationError      *string
 }
 
 type CASBackendCreateOpts struct {
@@ -237,8 +240,8 @@ func (uc *CASBackendUseCase) CreateInlineFallbackBackend(ctx context.Context, or
 		Fallback: true,
 		MaxBytes: CASBackendInlineDefaultMaxBytes,
 		CASBackendOpts: &CASBackendOpts{
-			Provider: CASBackendInline, Default: true,
-			Description: "Embed artifacts content in the attestation (fallback)",
+			Provider: CASBackendInline, Default: ToPtr(true),
+			Description: &CASBackendInlineDescription,
 			OrgID:       orgUUID,
 		},
 	})
@@ -259,7 +262,7 @@ func (uc *CASBackendUseCase) defaultFallbackBackend(ctx context.Context, orgID s
 		return nil, nil
 	}
 
-	return uc.repo.Update(ctx, &CASBackendUpdateOpts{ID: backend.ID, CASBackendOpts: &CASBackendOpts{Default: true}})
+	return uc.repo.Update(ctx, &CASBackendUpdateOpts{ID: backend.ID, CASBackendOpts: &CASBackendOpts{Default: ToPtr(true)}})
 }
 
 func (uc *CASBackendUseCase) Create(ctx context.Context, orgID, name, location, description string, provider CASBackendProvider, creds any, defaultB bool) (*CASBackend, error) {
@@ -286,8 +289,8 @@ func (uc *CASBackendUseCase) Create(ctx context.Context, orgID, name, location,
 		MaxBytes: uc.MaxBytesDefault,
 		Name:     name,
 		CASBackendOpts: &CASBackendOpts{
-			Location: location, SecretName: secretName, Provider: provider, Default: defaultB,
-			Description: description,
+			Location: location, SecretName: secretName, Provider: provider, Default: ToPtr(defaultB),
+			Description: &description,
 			OrgID:       orgUUID,
 		},
 	})
@@ -317,7 +320,7 @@ func (uc *CASBackendUseCase) Create(ctx context.Context, orgID, name, location,
 }
 
 // Update will update credentials, description or default status
-func (uc *CASBackendUseCase) Update(ctx context.Context, orgID, id, description string, creds any, defaultB bool) (*CASBackend, error) {
+func (uc *CASBackendUseCase) Update(ctx context.Context, orgID, id string, description *string, creds any, defaultB *bool) (*CASBackend, error) {
 	orgUUID, err := uuid.Parse(orgID)
 	if err != nil {
 		return nil, NewErrInvalidUUID(err)
@@ -402,7 +405,7 @@ func (uc *CASBackendUseCase) Update(ctx context.Context, orgID, id, description
 				Location:       after.Location,
 				Default:        after.Default,
 			},
-			NewDescription:     &description,
+			NewDescription:     description,
 			CredentialsChanged: credentialsUpdated,
 			PreviousDefault:    before.Default,
 		}, &orgUUID)
@@ -439,7 +442,7 @@ func (uc *CASBackendUseCase) CreateOrUpdate(ctx context.Context, orgID, name, us
 	if backend != nil && backend.Provider == provider {
 		return uc.repo.Update(ctx, &CASBackendUpdateOpts{
 			CASBackendOpts: &CASBackendOpts{
-				Location: name, SecretName: secretName, Provider: provider, Default: defaultB,
+				Location: name, SecretName: secretName, Provider: provider, Default: ToPtr(defaultB),
 			},
 			ID: backend.ID,
 		})
@@ -448,7 +451,7 @@ func (uc *CASBackendUseCase) CreateOrUpdate(ctx context.Context, orgID, name, us
 	return uc.repo.Create(ctx, &CASBackendCreateOpts{
 		CASBackendOpts: &CASBackendOpts{
 			Location: name, SecretName: secretName, Provider: provider,
-			Default: defaultB,
+			Default: ToPtr(defaultB),
 			OrgID:   orgUUID,
 		},
 	})
diff --git a/app/controlplane/pkg/biz/casbackend_integration_test.go b/app/controlplane/pkg/biz/casbackend_integration_test.go
index c1781404d..1d17e66da 100644
--- a/app/controlplane/pkg/biz/casbackend_integration_test.go
+++ b/app/controlplane/pkg/biz/casbackend_integration_test.go
@@ -35,9 +35,10 @@ import (
 )
 
 const location = "my-location"
-const description = "my-description"
 const backendType = oci.ProviderID
 
+var description = "my-description"
+
 func (s *CASBackendIntegrationTestSuite) TestUniqueNameDuringCreate() {
 	orgID, err := uuid.Parse(s.orgOne.ID)
 	require.NoError(s.T(), err)
@@ -243,7 +244,7 @@ func (s *CASBackendIntegrationTestSuite) TestUpdate() {
 		assert.False(nonDefaultB.Default)
 
 		// Update the non-default to be default
-		nonDefaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, nonDefaultB.ID.String(), "", nil, true)
+		nonDefaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, nonDefaultB.ID.String(), toPtrS(""), nil, toPtrBool(true))
 		assert.NoError(err)
 		assert.True(nonDefaultB.Default)
 
@@ -260,7 +261,7 @@ func (s *CASBackendIntegrationTestSuite) TestUpdate() {
 		assert.Equal(description, defaultB.Description)
 
 		// Update the description
-		defaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, defaultB.ID.String(), "updated desc", nil, true)
+		defaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, defaultB.ID.String(), toPtrS("updated desc"), nil, toPtrBool(true))
 		assert.NoError(err)
 		assert.Equal("updated desc", defaultB.Description)
 		assert.True(defaultB.Default)
@@ -273,7 +274,7 @@ func (s *CASBackendIntegrationTestSuite) TestUpdate() {
 		assert.Equal(description, defaultB.Description)
 
 		// update the status
-		defaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, defaultB.ID.String(), description, nil, false)
+		defaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, defaultB.ID.String(), toPtrS(description), nil, toPtrBool(false))
 		assert.NoError(err)
 		assert.Equal(description, defaultB.Description)
 		assert.False(defaultB.Default)
@@ -298,7 +299,7 @@ func (s *CASBackendIntegrationTestSuite) TestUpdate() {
 		assert.False(fallbackB.Default)
 
 		// update the status
-		defaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, defaultB.ID.String(), description, nil, false)
+		defaultB, err = s.CASBackend.Update(context.TODO(), s.orgNoBackend.ID, defaultB.ID.String(), toPtrS(description), nil, toPtrBool(false))
 		assert.NoError(err)
 		assert.False(defaultB.Default)
 
@@ -321,7 +322,7 @@ func (s *CASBackendIntegrationTestSuite) TestUpdate() {
 		s.credsWriter.On("SaveCredentials", ctx, s.orgNoBackend.ID, creds).Return("new-secret", nil)
 		s.credsWriter.On("ReadCredentials", ctx, "new-secret", mock.Anything).Return(nil)
 		s.backendProvider.On("ValidateAndExtractCredentials", location, mock.Anything).Return(nil, nil)
-		defaultB, err = s.CASBackend.Update(ctx, s.orgNoBackend.ID, defaultB.ID.String(), description, creds, true)
+		defaultB, err = s.CASBackend.Update(ctx, s.orgNoBackend.ID, defaultB.ID.String(), toPtrS(description), creds, nil)
 		assert.NoError(err)
 		assert.Equal(description, defaultB.Description)
 		assert.Equal("new-secret", defaultB.SecretName)
diff --git a/app/controlplane/pkg/biz/casbackend_test.go b/app/controlplane/pkg/biz/casbackend_test.go
index 77fd5ac90..e57b1bd99 100644
--- a/app/controlplane/pkg/biz/casbackend_test.go
+++ b/app/controlplane/pkg/biz/casbackend_test.go
@@ -89,7 +89,7 @@ func (s *casBackendTestSuite) TestSaveDefaultBackendAlreadyExist() {
 	s.repo.On("Update", ctx, &biz.CASBackendUpdateOpts{
 		ID: s.validUUID,
 		CASBackendOpts: &biz.CASBackendOpts{
-			Location: repoName, SecretName: "secret-key", Default: true, Provider: backendType,
+			Location: repoName, SecretName: "secret-key", Default: toPtrBool(true), Provider: backendType,
 		},
 	}).Return(r, nil)
 
@@ -111,7 +111,7 @@ func (s *casBackendTestSuite) TestSaveDefaultBackendOk() {
 	s.repo.On("Create", ctx, &biz.CASBackendCreateOpts{
 		CASBackendOpts: &biz.CASBackendOpts{
 			OrgID:    s.validUUID,
-			Location: repo, SecretName: "secret-key", Default: true, Provider: backendType,
+			Location: repo, SecretName: "secret-key", Default: toPtrBool(true), Provider: backendType,
 		},
 	}).Return(newRepo, nil)
 
diff --git a/app/controlplane/pkg/data/casbackend.go b/app/controlplane/pkg/data/casbackend.go
index 2687e2685..6e2a266ce 100644
--- a/app/controlplane/pkg/data/casbackend.go
+++ b/app/controlplane/pkg/data/casbackend.go
@@ -90,7 +90,7 @@ func (r *CASBackendRepo) Create(ctx context.Context, opts *biz.CASBackendCreateO
 	)
 	if err := WithTx(ctx, r.data.DB, func(tx *ent.Tx) error {
 		// 1 - unset default backend for all the other backends in the org
-		if opts.Default {
+		if opts.Default != nil && *opts.Default {
 			if err := tx.CASBackend.Update().
 				Where(casbackend.HasOrganizationWith(organization.ID(opts.OrgID))).
 				Where(casbackend.Default(true)).
@@ -105,10 +105,10 @@ func (r *CASBackendRepo) Create(ctx context.Context, opts *biz.CASBackendCreateO
 			SetName(opts.Name).
 			SetOrganizationID(opts.OrgID).
 			SetLocation(opts.Location).
-			SetDescription(opts.Description).
+			SetNillableDescription(opts.Description).
 			SetFallback(opts.Fallback).
 			SetProvider(opts.Provider).
-			SetDefault(opts.Default).
+			SetNillableDefault(opts.Default).
 			SetSecretName(opts.SecretName).
 			SetMaxBlobSizeBytes(opts.MaxBytes).
 			Save(ctx)
@@ -135,7 +135,7 @@ func (r *CASBackendRepo) Update(ctx context.Context, opts *biz.CASBackendUpdateO
 	)
 	if err = WithTx(ctx, r.data.DB, func(tx *ent.Tx) error {
 		// 1 - unset default backend for all the other backends in the org
-		if opts.Default {
+		if opts.Default != nil && *opts.Default {
 			if err := tx.CASBackend.Update().
 				Where(casbackend.HasOrganizationWith(organization.ID(opts.OrgID))).
 				Where(casbackend.Default(true)).
@@ -148,10 +148,9 @@ func (r *CASBackendRepo) Update(ctx context.Context, opts *biz.CASBackendUpdateO
 		// 2 - Chain the list of updates
 		// TODO: allow setting values as empty, currently it's not possible.
 		// We do it in other models by providing pointers to string + setNillableX methods
-		updateChain := tx.CASBackend.UpdateOneID(opts.ID).SetDefault(opts.Default)
-		if opts.Description != "" {
-			updateChain = updateChain.SetDescription(opts.Description)
-		}
+		updateChain := tx.CASBackend.UpdateOneID(opts.ID).
+			SetNillableDefault(opts.Default).
+			SetNillableDescription(opts.Description)
 
 		// If secretName is provided we set it
 		if opts.SecretName != "" {