From 89213f9214fc550a23871902e450ed43bf2b796a Mon Sep 17 00:00:00 2001
From: Aaron Gable <aaron@letsencrypt.org>
Date: Fri, 24 May 2024 13:54:25 -0700
Subject: [PATCH] Use generic types for gRPC stream implementations (#7501)

Update the version of protoc-gen-go-grpc that we use to generate Go gRPC
code from our proto files, and update the versions of other gRPC tools
and libraries that we use to match. Turn on the new
`use_generic_streams` code generation flag to change how
protoc-gen-go-grpc generates implementations of our streaming methods,
from creating a wholly independent implementation for every stream to
using shared generic implementations.

Take advantage of this code-sharing to remove our SA "wrapper" methods,
now that they have truly the same signature as the SARO methods which
they wrap. Also remove all references to the old-style stream names
(e.g. foopb.FooService_BarMethodClient) and replace them with the new
underlying generic names, for the sake of consistency. Finally, also
remove a few custom stream test mocks, replacing them with the generic
mocks.ServerStreamClient.

Note that this PR does not change the names in //mocks/sa.go, to avoid
conflicts with work happening in the pursuit of
https://github.com/letsencrypt/boulder/issues/7476. Note also that this
PR updates the version of protoc-gen-go-grpc that we use to a specific
commit. This is because, although a new release of grpc-go itself has
been cut, the codegen binary is a separate Go module with its own
releases, and it hasn't had a new release cut yet. Tracking for that is
in https://github.com/grpc/grpc-go/issues/7030.
---
 .github/workflows/boulder-ci.yml              |   2 +-
 akamai/proto/akamai.pb.go                     |   2 +-
 akamai/proto/akamai_grpc.pb.go                |  15 +-
 ca/crl.go                                     |   4 +-
 ca/proto/ca.pb.go                             |   2 +-
 ca/proto/ca_grpc.pb.go                        |  95 +-
 cmd/admin/cert_test.go                        |  58 +-
 cmd/admin/key_test.go                         |   2 +-
 core/proto/core.pb.go                         |   2 +-
 crl/storer/proto/storer.pb.go                 |   2 +-
 crl/storer/proto/storer_grpc.pb.go            |  74 +-
 crl/storer/storer.go                          |   3 +-
 crl/updater/updater_test.go                   |  12 +-
 go.mod                                        |   4 +-
 go.sum                                        |  10 +-
 grpc/protogen.sh                              |   3 +-
 grpc/test_proto/interceptors_test.pb.go       |   2 +-
 grpc/test_proto/interceptors_test_grpc.pb.go  |  15 +-
 mocks/ca.go                                   |   2 +-
 mocks/grpc.go                                 |  18 +-
 nonce/proto/nonce.pb.go                       |   2 +-
 nonce/proto/nonce_grpc.pb.go                  |  21 +-
 publisher/proto/publisher.pb.go               |   2 +-
 publisher/proto/publisher_grpc.pb.go          |  15 +-
 ra/proto/ra.pb.go                             |   2 +-
 ra/proto/ra_grpc.pb.go                        |  75 +-
 sa/proto/sa.pb.go                             |   2 +-
 sa/proto/sa_grpc.pb.go                        | 828 +++++++++---------
 sa/sa.go                                      |   8 +-
 sa/sa_test.go                                 |   6 +-
 sa/saro.go                                    | 137 +--
 test/boulder-tools/Dockerfile                 |   4 +-
 test/inmem/sa/sa.go                           |   2 +-
 va/proto/va.pb.go                             |   2 +-
 va/proto/va_grpc.pb.go                        |  24 +-
 vendor/google.golang.org/grpc/CONTRIBUTING.md |   2 +-
 vendor/google.golang.org/grpc/MAINTAINERS.md  |   1 +
 vendor/google.golang.org/grpc/Makefile        |   7 +-
 .../grpc_binarylog_v1/binarylog.pb.go         |   2 +-
 vendor/google.golang.org/grpc/clientconn.go   |  30 +-
 vendor/google.golang.org/grpc/codegen.sh      |  17 -
 vendor/google.golang.org/grpc/codes/codes.go  |   2 +-
 .../grpc/credentials/credentials.go           |   6 +-
 vendor/google.golang.org/grpc/dialoptions.go  |  36 +-
 .../grpc/health/grpc_health_v1/health.pb.go   |   2 +-
 .../health/grpc_health_v1/health_grpc.pb.go   |  14 +-
 .../balancer/gracefulswitch/config.go         |   1 -
 .../balancer/gracefulswitch/gracefulswitch.go |   1 -
 .../grpc/internal/binarylog/method_logger.go  |   6 +-
 .../grpc/internal/envconfig/envconfig.go      |   3 -
 .../grpc/internal/grpcutil/compressor.go      |   5 -
 .../internal/resolver/dns/dns_resolver.go     |  32 +-
 .../resolver/dns/internal/internal.go         |   6 +-
 .../grpc/internal/transport/controlbuf.go     |  33 +-
 .../grpc/internal/transport/http2_client.go   |  68 +-
 .../grpc/internal/transport/http2_server.go   |  12 +-
 .../grpc/internal/transport/transport.go      |   2 +-
 .../grpc/metadata/metadata.go                 |  15 +
 vendor/google.golang.org/grpc/peer/peer.go    |  30 +
 .../google.golang.org/grpc/picker_wrapper.go  |   3 +-
 vendor/google.golang.org/grpc/pickfirst.go    |  42 +-
 vendor/google.golang.org/grpc/regenerate.sh   |   6 +-
 .../grpc/resolver/dns/dns_resolver.go         |  12 +-
 vendor/google.golang.org/grpc/rpc_util.go     |   3 +-
 vendor/google.golang.org/grpc/server.go       |  16 +-
 .../google.golang.org/grpc/service_config.go  |   8 +-
 vendor/google.golang.org/grpc/stats/stats.go  |  10 +-
 vendor/google.golang.org/grpc/stream.go       |   1 +
 .../grpc/stream_interfaces.go                 | 152 ++++
 vendor/google.golang.org/grpc/version.go      |   2 +-
 vendor/google.golang.org/grpc/vet.sh          | 195 -----
 vendor/modules.txt                            |   4 +-
 72 files changed, 1090 insertions(+), 1154 deletions(-)
 delete mode 100644 vendor/google.golang.org/grpc/codegen.sh
 create mode 100644 vendor/google.golang.org/grpc/stream_interfaces.go
 delete mode 100644 vendor/google.golang.org/grpc/vet.sh

diff --git a/.github/workflows/boulder-ci.yml b/.github/workflows/boulder-ci.yml
index eb638ffcc82..842a0f0f40a 100644
--- a/.github/workflows/boulder-ci.yml
+++ b/.github/workflows/boulder-ci.yml
@@ -36,7 +36,7 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.22.3_2024-05-13
+          - go1.22.3_2024-05-22
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.
diff --git a/akamai/proto/akamai.pb.go b/akamai/proto/akamai.pb.go
index 2e327307a02..bdc56162f5d 100644
--- a/akamai/proto/akamai.pb.go
+++ b/akamai/proto/akamai.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: akamai.proto
 
diff --git a/akamai/proto/akamai_grpc.pb.go b/akamai/proto/akamai_grpc.pb.go
index e48b36b7587..6970a2c671f 100644
--- a/akamai/proto/akamai_grpc.pb.go
+++ b/akamai/proto/akamai_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: akamai.proto
 
@@ -16,8 +16,12 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	AkamaiPurger_Purge_FullMethodName = "/akamai.AkamaiPurger/Purge"
+)
 
 // AkamaiPurgerClient is the client API for AkamaiPurger service.
 //
@@ -35,8 +39,9 @@ func NewAkamaiPurgerClient(cc grpc.ClientConnInterface) AkamaiPurgerClient {
 }
 
 func (c *akamaiPurgerClient) Purge(ctx context.Context, in *PurgeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/akamai.AkamaiPurger/Purge", in, out, opts...)
+	err := c.cc.Invoke(ctx, AkamaiPurger_Purge_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -81,7 +86,7 @@ func _AkamaiPurger_Purge_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/akamai.AkamaiPurger/Purge",
+		FullMethod: AkamaiPurger_Purge_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(AkamaiPurgerServer).Purge(ctx, req.(*PurgeRequest))
diff --git a/ca/crl.go b/ca/crl.go
index 35bf4c07d58..b88b6623a34 100644
--- a/ca/crl.go
+++ b/ca/crl.go
@@ -8,6 +8,8 @@ import (
 	"io"
 	"strings"
 
+	"google.golang.org/grpc"
+
 	capb "github.com/letsencrypt/boulder/ca/proto"
 	"github.com/letsencrypt/boulder/core"
 	corepb "github.com/letsencrypt/boulder/core/proto"
@@ -51,7 +53,7 @@ func NewCRLImpl(
 	}, nil
 }
 
-func (ci *crlImpl) GenerateCRL(stream capb.CRLGenerator_GenerateCRLServer) error {
+func (ci *crlImpl) GenerateCRL(stream grpc.BidiStreamingServer[capb.GenerateCRLRequest, capb.GenerateCRLResponse]) error {
 	var issuer *issuance.Issuer
 	var req *issuance.CRLRequest
 	rcs := make([]x509.RevocationListEntry, 0)
diff --git a/ca/proto/ca.pb.go b/ca/proto/ca.pb.go
index b67a014c7de..fec630087b0 100644
--- a/ca/proto/ca.pb.go
+++ b/ca/proto/ca.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: ca.proto
 
diff --git a/ca/proto/ca_grpc.pb.go b/ca/proto/ca_grpc.pb.go
index 9f2bbe5e093..c2d87bc0c4b 100644
--- a/ca/proto/ca_grpc.pb.go
+++ b/ca/proto/ca_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: ca.proto
 
@@ -16,8 +16,13 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	CertificateAuthority_IssuePrecertificate_FullMethodName               = "/ca.CertificateAuthority/IssuePrecertificate"
+	CertificateAuthority_IssueCertificateForPrecertificate_FullMethodName = "/ca.CertificateAuthority/IssueCertificateForPrecertificate"
+)
 
 // CertificateAuthorityClient is the client API for CertificateAuthority service.
 //
@@ -36,8 +41,9 @@ func NewCertificateAuthorityClient(cc grpc.ClientConnInterface) CertificateAutho
 }
 
 func (c *certificateAuthorityClient) IssuePrecertificate(ctx context.Context, in *IssueCertificateRequest, opts ...grpc.CallOption) (*IssuePrecertificateResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(IssuePrecertificateResponse)
-	err := c.cc.Invoke(ctx, "/ca.CertificateAuthority/IssuePrecertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, CertificateAuthority_IssuePrecertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -45,8 +51,9 @@ func (c *certificateAuthorityClient) IssuePrecertificate(ctx context.Context, in
 }
 
 func (c *certificateAuthorityClient) IssueCertificateForPrecertificate(ctx context.Context, in *IssueCertificateForPrecertificateRequest, opts ...grpc.CallOption) (*proto.Certificate, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Certificate)
-	err := c.cc.Invoke(ctx, "/ca.CertificateAuthority/IssueCertificateForPrecertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, CertificateAuthority_IssueCertificateForPrecertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +102,7 @@ func _CertificateAuthority_IssuePrecertificate_Handler(srv interface{}, ctx cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ca.CertificateAuthority/IssuePrecertificate",
+		FullMethod: CertificateAuthority_IssuePrecertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(CertificateAuthorityServer).IssuePrecertificate(ctx, req.(*IssueCertificateRequest))
@@ -113,7 +120,7 @@ func _CertificateAuthority_IssueCertificateForPrecertificate_Handler(srv interfa
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ca.CertificateAuthority/IssueCertificateForPrecertificate",
+		FullMethod: CertificateAuthority_IssueCertificateForPrecertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(CertificateAuthorityServer).IssueCertificateForPrecertificate(ctx, req.(*IssueCertificateForPrecertificateRequest))
@@ -141,6 +148,10 @@ var CertificateAuthority_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "ca.proto",
 }
 
+const (
+	OCSPGenerator_GenerateOCSP_FullMethodName = "/ca.OCSPGenerator/GenerateOCSP"
+)
+
 // OCSPGeneratorClient is the client API for OCSPGenerator service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -157,8 +168,9 @@ func NewOCSPGeneratorClient(cc grpc.ClientConnInterface) OCSPGeneratorClient {
 }
 
 func (c *oCSPGeneratorClient) GenerateOCSP(ctx context.Context, in *GenerateOCSPRequest, opts ...grpc.CallOption) (*OCSPResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(OCSPResponse)
-	err := c.cc.Invoke(ctx, "/ca.OCSPGenerator/GenerateOCSP", in, out, opts...)
+	err := c.cc.Invoke(ctx, OCSPGenerator_GenerateOCSP_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -203,7 +215,7 @@ func _OCSPGenerator_GenerateOCSP_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ca.OCSPGenerator/GenerateOCSP",
+		FullMethod: OCSPGenerator_GenerateOCSP_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(OCSPGeneratorServer).GenerateOCSP(ctx, req.(*GenerateOCSPRequest))
@@ -227,11 +239,15 @@ var OCSPGenerator_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "ca.proto",
 }
 
+const (
+	CRLGenerator_GenerateCRL_FullMethodName = "/ca.CRLGenerator/GenerateCRL"
+)
+
 // CRLGeneratorClient is the client API for CRLGenerator service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type CRLGeneratorClient interface {
-	GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (CRLGenerator_GenerateCRLClient, error)
+	GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[GenerateCRLRequest, GenerateCRLResponse], error)
 }
 
 type cRLGeneratorClient struct {
@@ -242,42 +258,24 @@ func NewCRLGeneratorClient(cc grpc.ClientConnInterface) CRLGeneratorClient {
 	return &cRLGeneratorClient{cc}
 }
 
-func (c *cRLGeneratorClient) GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (CRLGenerator_GenerateCRLClient, error) {
-	stream, err := c.cc.NewStream(ctx, &CRLGenerator_ServiceDesc.Streams[0], "/ca.CRLGenerator/GenerateCRL", opts...)
+func (c *cRLGeneratorClient) GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[GenerateCRLRequest, GenerateCRLResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &CRLGenerator_ServiceDesc.Streams[0], CRLGenerator_GenerateCRL_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &cRLGeneratorGenerateCRLClient{stream}
+	x := &grpc.GenericClientStream[GenerateCRLRequest, GenerateCRLResponse]{ClientStream: stream}
 	return x, nil
 }
 
-type CRLGenerator_GenerateCRLClient interface {
-	Send(*GenerateCRLRequest) error
-	Recv() (*GenerateCRLResponse, error)
-	grpc.ClientStream
-}
-
-type cRLGeneratorGenerateCRLClient struct {
-	grpc.ClientStream
-}
-
-func (x *cRLGeneratorGenerateCRLClient) Send(m *GenerateCRLRequest) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *cRLGeneratorGenerateCRLClient) Recv() (*GenerateCRLResponse, error) {
-	m := new(GenerateCRLResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type CRLGenerator_GenerateCRLClient = grpc.BidiStreamingClient[GenerateCRLRequest, GenerateCRLResponse]
 
 // CRLGeneratorServer is the server API for CRLGenerator service.
 // All implementations must embed UnimplementedCRLGeneratorServer
 // for forward compatibility
 type CRLGeneratorServer interface {
-	GenerateCRL(CRLGenerator_GenerateCRLServer) error
+	GenerateCRL(grpc.BidiStreamingServer[GenerateCRLRequest, GenerateCRLResponse]) error
 	mustEmbedUnimplementedCRLGeneratorServer()
 }
 
@@ -285,7 +283,7 @@ type CRLGeneratorServer interface {
 type UnimplementedCRLGeneratorServer struct {
 }
 
-func (UnimplementedCRLGeneratorServer) GenerateCRL(CRLGenerator_GenerateCRLServer) error {
+func (UnimplementedCRLGeneratorServer) GenerateCRL(grpc.BidiStreamingServer[GenerateCRLRequest, GenerateCRLResponse]) error {
 	return status.Errorf(codes.Unimplemented, "method GenerateCRL not implemented")
 }
 func (UnimplementedCRLGeneratorServer) mustEmbedUnimplementedCRLGeneratorServer() {}
@@ -302,30 +300,11 @@ func RegisterCRLGeneratorServer(s grpc.ServiceRegistrar, srv CRLGeneratorServer)
 }
 
 func _CRLGenerator_GenerateCRL_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(CRLGeneratorServer).GenerateCRL(&cRLGeneratorGenerateCRLServer{stream})
-}
-
-type CRLGenerator_GenerateCRLServer interface {
-	Send(*GenerateCRLResponse) error
-	Recv() (*GenerateCRLRequest, error)
-	grpc.ServerStream
-}
-
-type cRLGeneratorGenerateCRLServer struct {
-	grpc.ServerStream
-}
-
-func (x *cRLGeneratorGenerateCRLServer) Send(m *GenerateCRLResponse) error {
-	return x.ServerStream.SendMsg(m)
+	return srv.(CRLGeneratorServer).GenerateCRL(&grpc.GenericServerStream[GenerateCRLRequest, GenerateCRLResponse]{ServerStream: stream})
 }
 
-func (x *cRLGeneratorGenerateCRLServer) Recv() (*GenerateCRLRequest, error) {
-	m := new(GenerateCRLRequest)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type CRLGenerator_GenerateCRLServer = grpc.BidiStreamingServer[GenerateCRLRequest, GenerateCRLResponse]
 
 // CRLGenerator_ServiceDesc is the grpc.ServiceDesc for CRLGenerator service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/cmd/admin/cert_test.go b/cmd/admin/cert_test.go
index 4745cad9765..185d497010b 100644
--- a/cmd/admin/cert_test.go
+++ b/cmd/admin/cert_test.go
@@ -8,7 +8,6 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
-	"io"
 	"os"
 	"path"
 	"slices"
@@ -25,6 +24,7 @@ import (
 	corepb "github.com/letsencrypt/boulder/core/proto"
 	berrors "github.com/letsencrypt/boulder/errors"
 	blog "github.com/letsencrypt/boulder/log"
+	"github.com/letsencrypt/boulder/mocks"
 	rapb "github.com/letsencrypt/boulder/ra/proto"
 	"github.com/letsencrypt/boulder/revocation"
 	sapb "github.com/letsencrypt/boulder/sa/proto"
@@ -41,23 +41,12 @@ type mockSAWithIncident struct {
 
 // SerialsForIncident returns a fake gRPC stream client object which itself
 // will return the mockSAWithIncident's serials in order.
-func (msa *mockSAWithIncident) SerialsForIncident(_ context.Context, _ *sapb.SerialsForIncidentRequest, _ ...grpc.CallOption) (sapb.StorageAuthorityReadOnly_SerialsForIncidentClient, error) {
-	return &mockSerialsForIncidentClient{unsentSerials: msa.incidentSerials}, nil
-}
-
-type mockSerialsForIncidentClient struct {
-	grpc.ClientStream
-	unsentSerials []string
-}
-
-// Recv returns the next serial from the pre-loaded list.
-func (c *mockSerialsForIncidentClient) Recv() (*sapb.IncidentSerial, error) {
-	if len(c.unsentSerials) > 0 {
-		res := c.unsentSerials[0]
-		c.unsentSerials = c.unsentSerials[1:]
-		return &sapb.IncidentSerial{Serial: res}, nil
+func (msa *mockSAWithIncident) SerialsForIncident(_ context.Context, _ *sapb.SerialsForIncidentRequest, _ ...grpc.CallOption) (grpc.ServerStreamingClient[sapb.IncidentSerial], error) {
+	fakeResults := make([]*sapb.IncidentSerial, len(msa.incidentSerials))
+	for i, serial := range msa.incidentSerials {
+		fakeResults[i] = &sapb.IncidentSerial{Serial: serial}
 	}
-	return nil, io.EOF
+	return &mocks.ServerStreamClient[sapb.IncidentSerial]{Results: fakeResults}, nil
 }
 
 func TestSerialsFromIncidentTable(t *testing.T) {
@@ -99,26 +88,15 @@ type mockSAWithKey struct {
 
 // GetSerialsByKey returns a fake gRPC stream client object which itself
 // will return the mockSAWithKey's serials in order.
-func (msa *mockSAWithKey) GetSerialsByKey(_ context.Context, req *sapb.SPKIHash, _ ...grpc.CallOption) (sapb.StorageAuthorityReadOnly_GetSerialsByKeyClient, error) {
+func (msa *mockSAWithKey) GetSerialsByKey(_ context.Context, req *sapb.SPKIHash, _ ...grpc.CallOption) (grpc.ServerStreamingClient[sapb.Serial], error) {
 	if !slices.Equal(req.KeyHash, msa.keyHash) {
-		return &mockSerialsClient{}, nil
+		return &mocks.ServerStreamClient[sapb.Serial]{}, nil
 	}
-	return &mockSerialsClient{unsentSerials: msa.serials}, nil
-}
-
-type mockSerialsClient struct {
-	grpc.ClientStream
-	unsentSerials []string
-}
-
-// Recv returns the next serial from the pre-loaded list.
-func (c *mockSerialsClient) Recv() (*sapb.Serial, error) {
-	if len(c.unsentSerials) > 0 {
-		res := c.unsentSerials[0]
-		c.unsentSerials = c.unsentSerials[1:]
-		return &sapb.Serial{Serial: res}, nil
+	fakeResults := make([]*sapb.Serial, len(msa.serials))
+	for i, serial := range msa.serials {
+		fakeResults[i] = &sapb.Serial{Serial: serial}
 	}
-	return nil, io.EOF
+	return &mocks.ServerStreamClient[sapb.Serial]{Results: fakeResults}, nil
 }
 
 func TestSerialsFromPrivateKey(t *testing.T) {
@@ -162,13 +140,17 @@ func (msa *mockSAWithAccount) GetRegistration(_ context.Context, req *sapb.Regis
 	return &corepb.Registration{}, nil
 }
 
-// SerialsForIncident returns a fake gRPC stream client object which itself
+// GetSerialsByAccount returns a fake gRPC stream client object which itself
 // will return the mockSAWithAccount's serials in order.
-func (msa *mockSAWithAccount) GetSerialsByAccount(_ context.Context, req *sapb.RegistrationID, _ ...grpc.CallOption) (sapb.StorageAuthorityReadOnly_GetSerialsByAccountClient, error) {
+func (msa *mockSAWithAccount) GetSerialsByAccount(_ context.Context, req *sapb.RegistrationID, _ ...grpc.CallOption) (grpc.ServerStreamingClient[sapb.Serial], error) {
 	if req.Id != msa.regID {
-		return &mockSerialsClient{}, nil
+		return &mocks.ServerStreamClient[sapb.Serial]{}, nil
+	}
+	fakeResults := make([]*sapb.Serial, len(msa.serials))
+	for i, serial := range msa.serials {
+		fakeResults[i] = &sapb.Serial{Serial: serial}
 	}
-	return &mockSerialsClient{unsentSerials: msa.serials}, nil
+	return &mocks.ServerStreamClient[sapb.Serial]{Results: fakeResults}, nil
 }
 
 func TestSerialsFromRegID(t *testing.T) {
diff --git a/cmd/admin/key_test.go b/cmd/admin/key_test.go
index 426576032e5..0bb19223609 100644
--- a/cmd/admin/key_test.go
+++ b/cmd/admin/key_test.go
@@ -90,7 +90,7 @@ type mockSARO struct {
 	sapb.StorageAuthorityReadOnlyClient
 }
 
-func (sa *mockSARO) GetSerialsByKey(ctx context.Context, _ *sapb.SPKIHash, _ ...grpc.CallOption) (sapb.StorageAuthorityReadOnly_GetSerialsByKeyClient, error) {
+func (sa *mockSARO) GetSerialsByKey(ctx context.Context, _ *sapb.SPKIHash, _ ...grpc.CallOption) (grpc.ServerStreamingClient[sapb.Serial], error) {
 	return &mocks.ServerStreamClient[sapb.Serial]{}, nil
 }
 
diff --git a/core/proto/core.pb.go b/core/proto/core.pb.go
index 50852a4be29..45cedb235f0 100644
--- a/core/proto/core.pb.go
+++ b/core/proto/core.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: core.proto
 
diff --git a/crl/storer/proto/storer.pb.go b/crl/storer/proto/storer.pb.go
index 4e74a4f6b2f..ba95c8ab1ce 100644
--- a/crl/storer/proto/storer.pb.go
+++ b/crl/storer/proto/storer.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: storer.proto
 
diff --git a/crl/storer/proto/storer_grpc.pb.go b/crl/storer/proto/storer_grpc.pb.go
index 26a507d022c..06e8b0c7da1 100644
--- a/crl/storer/proto/storer_grpc.pb.go
+++ b/crl/storer/proto/storer_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: storer.proto
 
@@ -16,14 +16,18 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	CRLStorer_UploadCRL_FullMethodName = "/storer.CRLStorer/UploadCRL"
+)
 
 // CRLStorerClient is the client API for CRLStorer service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type CRLStorerClient interface {
-	UploadCRL(ctx context.Context, opts ...grpc.CallOption) (CRLStorer_UploadCRLClient, error)
+	UploadCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[UploadCRLRequest, emptypb.Empty], error)
 }
 
 type cRLStorerClient struct {
@@ -34,45 +38,24 @@ func NewCRLStorerClient(cc grpc.ClientConnInterface) CRLStorerClient {
 	return &cRLStorerClient{cc}
 }
 
-func (c *cRLStorerClient) UploadCRL(ctx context.Context, opts ...grpc.CallOption) (CRLStorer_UploadCRLClient, error) {
-	stream, err := c.cc.NewStream(ctx, &CRLStorer_ServiceDesc.Streams[0], "/storer.CRLStorer/UploadCRL", opts...)
+func (c *cRLStorerClient) UploadCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[UploadCRLRequest, emptypb.Empty], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &CRLStorer_ServiceDesc.Streams[0], CRLStorer_UploadCRL_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &cRLStorerUploadCRLClient{stream}
+	x := &grpc.GenericClientStream[UploadCRLRequest, emptypb.Empty]{ClientStream: stream}
 	return x, nil
 }
 
-type CRLStorer_UploadCRLClient interface {
-	Send(*UploadCRLRequest) error
-	CloseAndRecv() (*emptypb.Empty, error)
-	grpc.ClientStream
-}
-
-type cRLStorerUploadCRLClient struct {
-	grpc.ClientStream
-}
-
-func (x *cRLStorerUploadCRLClient) Send(m *UploadCRLRequest) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *cRLStorerUploadCRLClient) CloseAndRecv() (*emptypb.Empty, error) {
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	m := new(emptypb.Empty)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type CRLStorer_UploadCRLClient = grpc.ClientStreamingClient[UploadCRLRequest, emptypb.Empty]
 
 // CRLStorerServer is the server API for CRLStorer service.
 // All implementations must embed UnimplementedCRLStorerServer
 // for forward compatibility
 type CRLStorerServer interface {
-	UploadCRL(CRLStorer_UploadCRLServer) error
+	UploadCRL(grpc.ClientStreamingServer[UploadCRLRequest, emptypb.Empty]) error
 	mustEmbedUnimplementedCRLStorerServer()
 }
 
@@ -80,7 +63,7 @@ type CRLStorerServer interface {
 type UnimplementedCRLStorerServer struct {
 }
 
-func (UnimplementedCRLStorerServer) UploadCRL(CRLStorer_UploadCRLServer) error {
+func (UnimplementedCRLStorerServer) UploadCRL(grpc.ClientStreamingServer[UploadCRLRequest, emptypb.Empty]) error {
 	return status.Errorf(codes.Unimplemented, "method UploadCRL not implemented")
 }
 func (UnimplementedCRLStorerServer) mustEmbedUnimplementedCRLStorerServer() {}
@@ -97,30 +80,11 @@ func RegisterCRLStorerServer(s grpc.ServiceRegistrar, srv CRLStorerServer) {
 }
 
 func _CRLStorer_UploadCRL_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(CRLStorerServer).UploadCRL(&cRLStorerUploadCRLServer{stream})
-}
-
-type CRLStorer_UploadCRLServer interface {
-	SendAndClose(*emptypb.Empty) error
-	Recv() (*UploadCRLRequest, error)
-	grpc.ServerStream
-}
-
-type cRLStorerUploadCRLServer struct {
-	grpc.ServerStream
+	return srv.(CRLStorerServer).UploadCRL(&grpc.GenericServerStream[UploadCRLRequest, emptypb.Empty]{ServerStream: stream})
 }
 
-func (x *cRLStorerUploadCRLServer) SendAndClose(m *emptypb.Empty) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *cRLStorerUploadCRLServer) Recv() (*UploadCRLRequest, error) {
-	m := new(UploadCRLRequest)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type CRLStorer_UploadCRLServer = grpc.ClientStreamingServer[UploadCRLRequest, emptypb.Empty]
 
 // CRLStorer_ServiceDesc is the grpc.ServiceDesc for CRLStorer service.
 // It's only intended for direct use with grpc.RegisterService,
diff --git a/crl/storer/storer.go b/crl/storer/storer.go
index 10b1753c7a7..6abbb74008d 100644
--- a/crl/storer/storer.go
+++ b/crl/storer/storer.go
@@ -18,6 +18,7 @@ import (
 	smithyhttp "github.com/aws/smithy-go/transport/http"
 	"github.com/jmhodges/clock"
 	"github.com/prometheus/client_golang/prometheus"
+	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"
 
 	"github.com/letsencrypt/boulder/crl"
@@ -97,7 +98,7 @@ func New(
 // UploadCRL implements the gRPC method of the same name. It takes a stream of
 // bytes as its input, parses and runs some sanity checks on the CRL, and then
 // uploads it to S3.
-func (cs *crlStorer) UploadCRL(stream cspb.CRLStorer_UploadCRLServer) error {
+func (cs *crlStorer) UploadCRL(stream grpc.ClientStreamingServer[cspb.UploadCRLRequest, emptypb.Empty]) error {
 	var issuer *issuance.Certificate
 	var shardIdx int64
 	var crlNumber *big.Int
diff --git a/crl/updater/updater_test.go b/crl/updater/updater_test.go
index 604a0001b36..9b2b1610869 100644
--- a/crl/updater/updater_test.go
+++ b/crl/updater/updater_test.go
@@ -24,7 +24,7 @@ import (
 	"github.com/letsencrypt/boulder/test"
 )
 
-// fakeGRCC is a fake sapb.StorageAuthority_GetRevokedCertsClient which can be
+// fakeGRCC is a fake grpc.ClientStreamingClient which can be
 // populated with some CRL entries or an error for use as the return value of
 // a faked GetRevokedCerts call.
 type fakeGRCC struct {
@@ -56,7 +56,7 @@ type fakeSAC struct {
 	leaseError  error
 }
 
-func (f *fakeSAC) GetRevokedCerts(ctx context.Context, _ *sapb.GetRevokedCertsRequest, _ ...grpc.CallOption) (sapb.StorageAuthority_GetRevokedCertsClient, error) {
+func (f *fakeSAC) GetRevokedCerts(ctx context.Context, _ *sapb.GetRevokedCertsRequest, _ ...grpc.CallOption) (grpc.ServerStreamingClient[corepb.CRLEntry], error) {
 	return &f.grcc, nil
 }
 
@@ -71,7 +71,7 @@ func (f *fakeSAC) LeaseCRLShard(_ context.Context, req *sapb.LeaseCRLShardReques
 	return &sapb.LeaseCRLShardResponse{IssuerNameID: req.IssuerNameID, ShardIdx: req.MinShardIdx}, nil
 }
 
-// fakeGCC is a fake capb.CRLGenerator_GenerateCRLClient which can be
+// fakeGCC is a fake grpc.BidiStreamingClient which can be
 // populated with some CRL entries or an error for use as the return value of
 // a faked GenerateCRL call.
 type fakeGCC struct {
@@ -108,11 +108,11 @@ type fakeCGC struct {
 	gcc fakeGCC
 }
 
-func (f *fakeCGC) GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (capb.CRLGenerator_GenerateCRLClient, error) {
+func (f *fakeCGC) GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[capb.GenerateCRLRequest, capb.GenerateCRLResponse], error) {
 	return &f.gcc, nil
 }
 
-// fakeUCC is a fake cspb.CRLStorer_UploadCRLClient which can be populated with
+// fakeUCC is a fake grpc.ClientStreamingClient which can be populated with
 // an error for use as the return value of a faked UploadCRL call.
 type fakeUCC struct {
 	grpc.ClientStream
@@ -137,7 +137,7 @@ type fakeCSC struct {
 	ucc fakeUCC
 }
 
-func (f *fakeCSC) UploadCRL(ctx context.Context, opts ...grpc.CallOption) (cspb.CRLStorer_UploadCRLClient, error) {
+func (f *fakeCSC) UploadCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.ClientStreamingClient[cspb.UploadCRLRequest, emptypb.Empty], error) {
 	return &f.ucc, nil
 }
 
diff --git a/go.mod b/go.mod
index d9cce2f7b88..161a3027651 100644
--- a/go.mod
+++ b/go.mod
@@ -41,7 +41,7 @@ require (
 	golang.org/x/sync v0.7.0
 	golang.org/x/term v0.20.0
 	golang.org/x/text v0.15.0
-	google.golang.org/grpc v1.63.2
+	google.golang.org/grpc v1.64.0
 	google.golang.org/protobuf v1.33.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -83,7 +83,7 @@ require (
 	golang.org/x/mod v0.14.0 // indirect
 	golang.org/x/sys v0.20.0 // indirect
 	golang.org/x/tools v0.17.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	k8s.io/klog/v2 v2.100.1 // indirect
diff --git a/go.sum b/go.sum
index 2f35d2552b9..521caf9ecd5 100644
--- a/go.sum
+++ b/go.sum
@@ -402,16 +402,14 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de h1:F6qOa9AZTYJXOUEr4jDysRDLrm4PHePlge4v4TGAlxY=
-google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:VUhTRKeHn9wwcdrk73nvdC9gF178Tzhmt/qyaFcPLSo=
-google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de h1:jFNzHPIeuzhdRwVhbZdiym9q0ory/xY3sA+v2wPg8I0=
-google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de/go.mod h1:5iCWqnniDlqZHrd3neWVTOwvh/v6s3232omMecelax8=
+google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 h1:RFiFrvy37/mpSpdySBDrUdipW/dHwsRwh3J3+A9VgT4=
+google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237/go.mod h1:Z5Iiy3jtmioajWHDGFk7CeugTyHtPvMHA4UTmUkyalE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
-google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/grpc v1.64.0 h1:KH3VH9y/MgNQg1dE7b3XfVK0GsPSIzJwdF617gUSbvY=
+google.golang.org/grpc v1.64.0/go.mod h1:oxjF8E3FBnjp+/gVFYdWacaLDx9na1aqy9oovLpxQYg=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
diff --git a/grpc/protogen.sh b/grpc/protogen.sh
index 497ab3c19aa..8e5701d00ce 100755
--- a/grpc/protogen.sh
+++ b/grpc/protogen.sh
@@ -19,5 +19,6 @@ do
   # --go-grpc_out="${proto_dir}" does the same for _grpc.pb.go
   # --go_opt=paths=source_relative derives output filenames from input filenames
   # --go-grpc_opt=paths=source_relative does the same for _grpc.pb.go
-  protoc -I "${proto_dir}" -I "${root_dir}" --go_out="${proto_dir}" --go-grpc_out="${proto_dir}" --go_opt=paths=source_relative --go-grpc_opt=paths=source_relative "${proto_file}"
+  # --go-grpc_opt=use_generic_streams=true causes protoc-gen-go-grpc to use generics for its stream objects, rather than generating a new impl for each one
+  protoc -I "${proto_dir}" -I "${root_dir}" --go_out="${proto_dir}" --go-grpc_out="${proto_dir}" --go_opt=paths=source_relative --go-grpc_opt=paths=source_relative,use_generic_streams_experimental=true "${proto_file}"
 done
diff --git a/grpc/test_proto/interceptors_test.pb.go b/grpc/test_proto/interceptors_test.pb.go
index 36c929c74ca..09ffb40adcc 100644
--- a/grpc/test_proto/interceptors_test.pb.go
+++ b/grpc/test_proto/interceptors_test.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: interceptors_test.proto
 
diff --git a/grpc/test_proto/interceptors_test_grpc.pb.go b/grpc/test_proto/interceptors_test_grpc.pb.go
index c0b1e3adead..01d660b6461 100644
--- a/grpc/test_proto/interceptors_test_grpc.pb.go
+++ b/grpc/test_proto/interceptors_test_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: interceptors_test.proto
 
@@ -15,8 +15,12 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
+
+const (
+	Chiller_Chill_FullMethodName = "/Chiller/Chill"
+)
 
 // ChillerClient is the client API for Chiller service.
 //
@@ -35,8 +39,9 @@ func NewChillerClient(cc grpc.ClientConnInterface) ChillerClient {
 }
 
 func (c *chillerClient) Chill(ctx context.Context, in *Time, opts ...grpc.CallOption) (*Time, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Time)
-	err := c.cc.Invoke(ctx, "/Chiller/Chill", in, out, opts...)
+	err := c.cc.Invoke(ctx, Chiller_Chill_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -82,7 +87,7 @@ func _Chiller_Chill_Handler(srv interface{}, ctx context.Context, dec func(inter
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/Chiller/Chill",
+		FullMethod: Chiller_Chill_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(ChillerServer).Chill(ctx, req.(*Time))
diff --git a/mocks/ca.go b/mocks/ca.go
index 8a6bcf575b7..929c204e7ac 100644
--- a/mocks/ca.go
+++ b/mocks/ca.go
@@ -64,6 +64,6 @@ func (ca *MockOCSPGenerator) GenerateOCSP(ctx context.Context, req *capb.Generat
 type MockCRLGenerator struct{}
 
 // GenerateCRL is a mock
-func (ca *MockCRLGenerator) GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (capb.CRLGenerator_GenerateCRLClient, error) {
+func (ca *MockCRLGenerator) GenerateCRL(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[capb.GenerateCRLRequest, capb.GenerateCRLResponse], error) {
 	return nil, nil
 }
diff --git a/mocks/grpc.go b/mocks/grpc.go
index c2c687058e2..f1c18f2c7f1 100644
--- a/mocks/grpc.go
+++ b/mocks/grpc.go
@@ -8,12 +8,24 @@ import (
 
 // ServerStreamClient is a mock which satisfies the grpc.ClientStream interface,
 // allowing it to be returned by methods where the server returns a stream of
-// results. This simple mock will always return zero results.
+// results. It can be populated with a list of results to return, or an error
+// to return.
 type ServerStreamClient[T any] struct {
 	grpc.ClientStream
+	Results []*T
+	Err     error
 }
 
-// Recv immediately returns the EOF error, indicating that the stream is done.
+// Recv returns the error, if populated. Otherwise it returns the next item from
+// the list of results. If it has returned all items already, it returns EOF.
 func (c *ServerStreamClient[T]) Recv() (*T, error) {
-	return nil, io.EOF
+	if c.Err != nil {
+		return nil, c.Err
+	}
+	if len(c.Results) == 0 {
+		return nil, io.EOF
+	}
+	res := c.Results[0]
+	c.Results = c.Results[1:]
+	return res, nil
 }
diff --git a/nonce/proto/nonce.pb.go b/nonce/proto/nonce.pb.go
index dce780bca43..b500162f74f 100644
--- a/nonce/proto/nonce.pb.go
+++ b/nonce/proto/nonce.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: nonce.proto
 
diff --git a/nonce/proto/nonce_grpc.pb.go b/nonce/proto/nonce_grpc.pb.go
index 299f903e9aa..e3cb5412fff 100644
--- a/nonce/proto/nonce_grpc.pb.go
+++ b/nonce/proto/nonce_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: nonce.proto
 
@@ -16,8 +16,13 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	NonceService_Nonce_FullMethodName  = "/nonce.NonceService/Nonce"
+	NonceService_Redeem_FullMethodName = "/nonce.NonceService/Redeem"
+)
 
 // NonceServiceClient is the client API for NonceService service.
 //
@@ -36,8 +41,9 @@ func NewNonceServiceClient(cc grpc.ClientConnInterface) NonceServiceClient {
 }
 
 func (c *nonceServiceClient) Nonce(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*NonceMessage, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(NonceMessage)
-	err := c.cc.Invoke(ctx, "/nonce.NonceService/Nonce", in, out, opts...)
+	err := c.cc.Invoke(ctx, NonceService_Nonce_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -45,8 +51,9 @@ func (c *nonceServiceClient) Nonce(ctx context.Context, in *emptypb.Empty, opts
 }
 
 func (c *nonceServiceClient) Redeem(ctx context.Context, in *NonceMessage, opts ...grpc.CallOption) (*ValidMessage, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ValidMessage)
-	err := c.cc.Invoke(ctx, "/nonce.NonceService/Redeem", in, out, opts...)
+	err := c.cc.Invoke(ctx, NonceService_Redeem_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +102,7 @@ func _NonceService_Nonce_Handler(srv interface{}, ctx context.Context, dec func(
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/nonce.NonceService/Nonce",
+		FullMethod: NonceService_Nonce_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(NonceServiceServer).Nonce(ctx, req.(*emptypb.Empty))
@@ -113,7 +120,7 @@ func _NonceService_Redeem_Handler(srv interface{}, ctx context.Context, dec func
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/nonce.NonceService/Redeem",
+		FullMethod: NonceService_Redeem_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(NonceServiceServer).Redeem(ctx, req.(*NonceMessage))
diff --git a/publisher/proto/publisher.pb.go b/publisher/proto/publisher.pb.go
index 0e53558be15..9705dea9aac 100644
--- a/publisher/proto/publisher.pb.go
+++ b/publisher/proto/publisher.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: publisher.proto
 
diff --git a/publisher/proto/publisher_grpc.pb.go b/publisher/proto/publisher_grpc.pb.go
index 1e275ac925f..0c91e6fb5c2 100644
--- a/publisher/proto/publisher_grpc.pb.go
+++ b/publisher/proto/publisher_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: publisher.proto
 
@@ -15,8 +15,12 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Publisher_SubmitToSingleCTWithResult_FullMethodName = "/Publisher/SubmitToSingleCTWithResult"
+)
 
 // PublisherClient is the client API for Publisher service.
 //
@@ -34,8 +38,9 @@ func NewPublisherClient(cc grpc.ClientConnInterface) PublisherClient {
 }
 
 func (c *publisherClient) SubmitToSingleCTWithResult(ctx context.Context, in *Request, opts ...grpc.CallOption) (*Result, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Result)
-	err := c.cc.Invoke(ctx, "/Publisher/SubmitToSingleCTWithResult", in, out, opts...)
+	err := c.cc.Invoke(ctx, Publisher_SubmitToSingleCTWithResult_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -80,7 +85,7 @@ func _Publisher_SubmitToSingleCTWithResult_Handler(srv interface{}, ctx context.
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/Publisher/SubmitToSingleCTWithResult",
+		FullMethod: Publisher_SubmitToSingleCTWithResult_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(PublisherServer).SubmitToSingleCTWithResult(ctx, req.(*Request))
diff --git a/ra/proto/ra.pb.go b/ra/proto/ra.pb.go
index 85a83632285..e94f89ba16c 100644
--- a/ra/proto/ra.pb.go
+++ b/ra/proto/ra.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: ra.proto
 
diff --git a/ra/proto/ra_grpc.pb.go b/ra/proto/ra_grpc.pb.go
index dc7aaf15903..b98d716516f 100644
--- a/ra/proto/ra_grpc.pb.go
+++ b/ra/proto/ra_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: ra.proto
 
@@ -18,8 +18,22 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	RegistrationAuthority_NewRegistration_FullMethodName                   = "/ra.RegistrationAuthority/NewRegistration"
+	RegistrationAuthority_UpdateRegistration_FullMethodName                = "/ra.RegistrationAuthority/UpdateRegistration"
+	RegistrationAuthority_PerformValidation_FullMethodName                 = "/ra.RegistrationAuthority/PerformValidation"
+	RegistrationAuthority_DeactivateRegistration_FullMethodName            = "/ra.RegistrationAuthority/DeactivateRegistration"
+	RegistrationAuthority_DeactivateAuthorization_FullMethodName           = "/ra.RegistrationAuthority/DeactivateAuthorization"
+	RegistrationAuthority_RevokeCertByApplicant_FullMethodName             = "/ra.RegistrationAuthority/RevokeCertByApplicant"
+	RegistrationAuthority_RevokeCertByKey_FullMethodName                   = "/ra.RegistrationAuthority/RevokeCertByKey"
+	RegistrationAuthority_AdministrativelyRevokeCertificate_FullMethodName = "/ra.RegistrationAuthority/AdministrativelyRevokeCertificate"
+	RegistrationAuthority_NewOrder_FullMethodName                          = "/ra.RegistrationAuthority/NewOrder"
+	RegistrationAuthority_FinalizeOrder_FullMethodName                     = "/ra.RegistrationAuthority/FinalizeOrder"
+	RegistrationAuthority_GenerateOCSP_FullMethodName                      = "/ra.RegistrationAuthority/GenerateOCSP"
+)
 
 // RegistrationAuthorityClient is the client API for RegistrationAuthority service.
 //
@@ -48,8 +62,9 @@ func NewRegistrationAuthorityClient(cc grpc.ClientConnInterface) RegistrationAut
 }
 
 func (c *registrationAuthorityClient) NewRegistration(ctx context.Context, in *proto.Registration, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/NewRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_NewRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -57,8 +72,9 @@ func (c *registrationAuthorityClient) NewRegistration(ctx context.Context, in *p
 }
 
 func (c *registrationAuthorityClient) UpdateRegistration(ctx context.Context, in *UpdateRegistrationRequest, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/UpdateRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_UpdateRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -66,8 +82,9 @@ func (c *registrationAuthorityClient) UpdateRegistration(ctx context.Context, in
 }
 
 func (c *registrationAuthorityClient) PerformValidation(ctx context.Context, in *PerformValidationRequest, opts ...grpc.CallOption) (*proto.Authorization, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Authorization)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/PerformValidation", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_PerformValidation_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -75,8 +92,9 @@ func (c *registrationAuthorityClient) PerformValidation(ctx context.Context, in
 }
 
 func (c *registrationAuthorityClient) DeactivateRegistration(ctx context.Context, in *proto.Registration, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/DeactivateRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_DeactivateRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -84,8 +102,9 @@ func (c *registrationAuthorityClient) DeactivateRegistration(ctx context.Context
 }
 
 func (c *registrationAuthorityClient) DeactivateAuthorization(ctx context.Context, in *proto.Authorization, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/DeactivateAuthorization", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_DeactivateAuthorization_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -93,8 +112,9 @@ func (c *registrationAuthorityClient) DeactivateAuthorization(ctx context.Contex
 }
 
 func (c *registrationAuthorityClient) RevokeCertByApplicant(ctx context.Context, in *RevokeCertByApplicantRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/RevokeCertByApplicant", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_RevokeCertByApplicant_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -102,8 +122,9 @@ func (c *registrationAuthorityClient) RevokeCertByApplicant(ctx context.Context,
 }
 
 func (c *registrationAuthorityClient) RevokeCertByKey(ctx context.Context, in *RevokeCertByKeyRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/RevokeCertByKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_RevokeCertByKey_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -111,8 +132,9 @@ func (c *registrationAuthorityClient) RevokeCertByKey(ctx context.Context, in *R
 }
 
 func (c *registrationAuthorityClient) AdministrativelyRevokeCertificate(ctx context.Context, in *AdministrativelyRevokeCertificateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/AdministrativelyRevokeCertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_AdministrativelyRevokeCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -120,8 +142,9 @@ func (c *registrationAuthorityClient) AdministrativelyRevokeCertificate(ctx cont
 }
 
 func (c *registrationAuthorityClient) NewOrder(ctx context.Context, in *NewOrderRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/NewOrder", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_NewOrder_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -129,8 +152,9 @@ func (c *registrationAuthorityClient) NewOrder(ctx context.Context, in *NewOrder
 }
 
 func (c *registrationAuthorityClient) FinalizeOrder(ctx context.Context, in *FinalizeOrderRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/FinalizeOrder", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_FinalizeOrder_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -138,8 +162,9 @@ func (c *registrationAuthorityClient) FinalizeOrder(ctx context.Context, in *Fin
 }
 
 func (c *registrationAuthorityClient) GenerateOCSP(ctx context.Context, in *GenerateOCSPRequest, opts ...grpc.CallOption) (*proto1.OCSPResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto1.OCSPResponse)
-	err := c.cc.Invoke(ctx, "/ra.RegistrationAuthority/GenerateOCSP", in, out, opts...)
+	err := c.cc.Invoke(ctx, RegistrationAuthority_GenerateOCSP_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -225,7 +250,7 @@ func _RegistrationAuthority_NewRegistration_Handler(srv interface{}, ctx context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/NewRegistration",
+		FullMethod: RegistrationAuthority_NewRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).NewRegistration(ctx, req.(*proto.Registration))
@@ -243,7 +268,7 @@ func _RegistrationAuthority_UpdateRegistration_Handler(srv interface{}, ctx cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/UpdateRegistration",
+		FullMethod: RegistrationAuthority_UpdateRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).UpdateRegistration(ctx, req.(*UpdateRegistrationRequest))
@@ -261,7 +286,7 @@ func _RegistrationAuthority_PerformValidation_Handler(srv interface{}, ctx conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/PerformValidation",
+		FullMethod: RegistrationAuthority_PerformValidation_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).PerformValidation(ctx, req.(*PerformValidationRequest))
@@ -279,7 +304,7 @@ func _RegistrationAuthority_DeactivateRegistration_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/DeactivateRegistration",
+		FullMethod: RegistrationAuthority_DeactivateRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).DeactivateRegistration(ctx, req.(*proto.Registration))
@@ -297,7 +322,7 @@ func _RegistrationAuthority_DeactivateAuthorization_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/DeactivateAuthorization",
+		FullMethod: RegistrationAuthority_DeactivateAuthorization_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).DeactivateAuthorization(ctx, req.(*proto.Authorization))
@@ -315,7 +340,7 @@ func _RegistrationAuthority_RevokeCertByApplicant_Handler(srv interface{}, ctx c
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/RevokeCertByApplicant",
+		FullMethod: RegistrationAuthority_RevokeCertByApplicant_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).RevokeCertByApplicant(ctx, req.(*RevokeCertByApplicantRequest))
@@ -333,7 +358,7 @@ func _RegistrationAuthority_RevokeCertByKey_Handler(srv interface{}, ctx context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/RevokeCertByKey",
+		FullMethod: RegistrationAuthority_RevokeCertByKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).RevokeCertByKey(ctx, req.(*RevokeCertByKeyRequest))
@@ -351,7 +376,7 @@ func _RegistrationAuthority_AdministrativelyRevokeCertificate_Handler(srv interf
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/AdministrativelyRevokeCertificate",
+		FullMethod: RegistrationAuthority_AdministrativelyRevokeCertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).AdministrativelyRevokeCertificate(ctx, req.(*AdministrativelyRevokeCertificateRequest))
@@ -369,7 +394,7 @@ func _RegistrationAuthority_NewOrder_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/NewOrder",
+		FullMethod: RegistrationAuthority_NewOrder_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).NewOrder(ctx, req.(*NewOrderRequest))
@@ -387,7 +412,7 @@ func _RegistrationAuthority_FinalizeOrder_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/FinalizeOrder",
+		FullMethod: RegistrationAuthority_FinalizeOrder_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).FinalizeOrder(ctx, req.(*FinalizeOrderRequest))
@@ -405,7 +430,7 @@ func _RegistrationAuthority_GenerateOCSP_Handler(srv interface{}, ctx context.Co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/ra.RegistrationAuthority/GenerateOCSP",
+		FullMethod: RegistrationAuthority_GenerateOCSP_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(RegistrationAuthorityServer).GenerateOCSP(ctx, req.(*GenerateOCSPRequest))
diff --git a/sa/proto/sa.pb.go b/sa/proto/sa.pb.go
index 30024ceee9f..6d45c2ccc59 100644
--- a/sa/proto/sa.pb.go
+++ b/sa/proto/sa.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: sa.proto
 
diff --git a/sa/proto/sa_grpc.pb.go b/sa/proto/sa_grpc.pb.go
index c2952f15807..aa141e15f5d 100644
--- a/sa/proto/sa_grpc.pb.go
+++ b/sa/proto/sa_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: sa.proto
 
@@ -18,8 +18,42 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	StorageAuthorityReadOnly_CountCertificatesByNames_FullMethodName     = "/sa.StorageAuthorityReadOnly/CountCertificatesByNames"
+	StorageAuthorityReadOnly_CountFQDNSets_FullMethodName                = "/sa.StorageAuthorityReadOnly/CountFQDNSets"
+	StorageAuthorityReadOnly_CountInvalidAuthorizations2_FullMethodName  = "/sa.StorageAuthorityReadOnly/CountInvalidAuthorizations2"
+	StorageAuthorityReadOnly_CountOrders_FullMethodName                  = "/sa.StorageAuthorityReadOnly/CountOrders"
+	StorageAuthorityReadOnly_CountPendingAuthorizations2_FullMethodName  = "/sa.StorageAuthorityReadOnly/CountPendingAuthorizations2"
+	StorageAuthorityReadOnly_CountRegistrationsByIP_FullMethodName       = "/sa.StorageAuthorityReadOnly/CountRegistrationsByIP"
+	StorageAuthorityReadOnly_CountRegistrationsByIPRange_FullMethodName  = "/sa.StorageAuthorityReadOnly/CountRegistrationsByIPRange"
+	StorageAuthorityReadOnly_FQDNSetExists_FullMethodName                = "/sa.StorageAuthorityReadOnly/FQDNSetExists"
+	StorageAuthorityReadOnly_FQDNSetTimestampsForWindow_FullMethodName   = "/sa.StorageAuthorityReadOnly/FQDNSetTimestampsForWindow"
+	StorageAuthorityReadOnly_GetAuthorization2_FullMethodName            = "/sa.StorageAuthorityReadOnly/GetAuthorization2"
+	StorageAuthorityReadOnly_GetAuthorizations2_FullMethodName           = "/sa.StorageAuthorityReadOnly/GetAuthorizations2"
+	StorageAuthorityReadOnly_GetCertificate_FullMethodName               = "/sa.StorageAuthorityReadOnly/GetCertificate"
+	StorageAuthorityReadOnly_GetLintPrecertificate_FullMethodName        = "/sa.StorageAuthorityReadOnly/GetLintPrecertificate"
+	StorageAuthorityReadOnly_GetCertificateStatus_FullMethodName         = "/sa.StorageAuthorityReadOnly/GetCertificateStatus"
+	StorageAuthorityReadOnly_GetMaxExpiration_FullMethodName             = "/sa.StorageAuthorityReadOnly/GetMaxExpiration"
+	StorageAuthorityReadOnly_GetOrder_FullMethodName                     = "/sa.StorageAuthorityReadOnly/GetOrder"
+	StorageAuthorityReadOnly_GetOrderForNames_FullMethodName             = "/sa.StorageAuthorityReadOnly/GetOrderForNames"
+	StorageAuthorityReadOnly_GetPendingAuthorization2_FullMethodName     = "/sa.StorageAuthorityReadOnly/GetPendingAuthorization2"
+	StorageAuthorityReadOnly_GetRegistration_FullMethodName              = "/sa.StorageAuthorityReadOnly/GetRegistration"
+	StorageAuthorityReadOnly_GetRegistrationByKey_FullMethodName         = "/sa.StorageAuthorityReadOnly/GetRegistrationByKey"
+	StorageAuthorityReadOnly_GetRevocationStatus_FullMethodName          = "/sa.StorageAuthorityReadOnly/GetRevocationStatus"
+	StorageAuthorityReadOnly_GetRevokedCerts_FullMethodName              = "/sa.StorageAuthorityReadOnly/GetRevokedCerts"
+	StorageAuthorityReadOnly_GetSerialMetadata_FullMethodName            = "/sa.StorageAuthorityReadOnly/GetSerialMetadata"
+	StorageAuthorityReadOnly_GetSerialsByAccount_FullMethodName          = "/sa.StorageAuthorityReadOnly/GetSerialsByAccount"
+	StorageAuthorityReadOnly_GetSerialsByKey_FullMethodName              = "/sa.StorageAuthorityReadOnly/GetSerialsByKey"
+	StorageAuthorityReadOnly_GetValidAuthorizations2_FullMethodName      = "/sa.StorageAuthorityReadOnly/GetValidAuthorizations2"
+	StorageAuthorityReadOnly_GetValidOrderAuthorizations2_FullMethodName = "/sa.StorageAuthorityReadOnly/GetValidOrderAuthorizations2"
+	StorageAuthorityReadOnly_IncidentsForSerial_FullMethodName           = "/sa.StorageAuthorityReadOnly/IncidentsForSerial"
+	StorageAuthorityReadOnly_KeyBlocked_FullMethodName                   = "/sa.StorageAuthorityReadOnly/KeyBlocked"
+	StorageAuthorityReadOnly_ReplacementOrderExists_FullMethodName       = "/sa.StorageAuthorityReadOnly/ReplacementOrderExists"
+	StorageAuthorityReadOnly_SerialsForIncident_FullMethodName           = "/sa.StorageAuthorityReadOnly/SerialsForIncident"
+)
 
 // StorageAuthorityReadOnlyClient is the client API for StorageAuthorityReadOnly service.
 //
@@ -46,16 +80,16 @@ type StorageAuthorityReadOnlyClient interface {
 	GetRegistration(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*proto.Registration, error)
 	GetRegistrationByKey(ctx context.Context, in *JSONWebKey, opts ...grpc.CallOption) (*proto.Registration, error)
 	GetRevocationStatus(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*RevocationStatus, error)
-	GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (StorageAuthorityReadOnly_GetRevokedCertsClient, error)
+	GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[proto.CRLEntry], error)
 	GetSerialMetadata(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*SerialMetadata, error)
-	GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (StorageAuthorityReadOnly_GetSerialsByAccountClient, error)
-	GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (StorageAuthorityReadOnly_GetSerialsByKeyClient, error)
+	GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error)
+	GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error)
 	GetValidAuthorizations2(ctx context.Context, in *GetValidAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error)
 	GetValidOrderAuthorizations2(ctx context.Context, in *GetValidOrderAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error)
 	IncidentsForSerial(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Incidents, error)
 	KeyBlocked(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (*Exists, error)
 	ReplacementOrderExists(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Exists, error)
-	SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (StorageAuthorityReadOnly_SerialsForIncidentClient, error)
+	SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[IncidentSerial], error)
 }
 
 type storageAuthorityReadOnlyClient struct {
@@ -67,8 +101,9 @@ func NewStorageAuthorityReadOnlyClient(cc grpc.ClientConnInterface) StorageAutho
 }
 
 func (c *storageAuthorityReadOnlyClient) CountCertificatesByNames(ctx context.Context, in *CountCertificatesByNamesRequest, opts ...grpc.CallOption) (*CountByNames, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CountByNames)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountCertificatesByNames", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountCertificatesByNames_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -76,8 +111,9 @@ func (c *storageAuthorityReadOnlyClient) CountCertificatesByNames(ctx context.Co
 }
 
 func (c *storageAuthorityReadOnlyClient) CountFQDNSets(ctx context.Context, in *CountFQDNSetsRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountFQDNSets", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountFQDNSets_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -85,8 +121,9 @@ func (c *storageAuthorityReadOnlyClient) CountFQDNSets(ctx context.Context, in *
 }
 
 func (c *storageAuthorityReadOnlyClient) CountInvalidAuthorizations2(ctx context.Context, in *CountInvalidAuthorizationsRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountInvalidAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountInvalidAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -94,8 +131,9 @@ func (c *storageAuthorityReadOnlyClient) CountInvalidAuthorizations2(ctx context
 }
 
 func (c *storageAuthorityReadOnlyClient) CountOrders(ctx context.Context, in *CountOrdersRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountOrders", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountOrders_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -103,8 +141,9 @@ func (c *storageAuthorityReadOnlyClient) CountOrders(ctx context.Context, in *Co
 }
 
 func (c *storageAuthorityReadOnlyClient) CountPendingAuthorizations2(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountPendingAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountPendingAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -112,8 +151,9 @@ func (c *storageAuthorityReadOnlyClient) CountPendingAuthorizations2(ctx context
 }
 
 func (c *storageAuthorityReadOnlyClient) CountRegistrationsByIP(ctx context.Context, in *CountRegistrationsByIPRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountRegistrationsByIP", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountRegistrationsByIP_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -121,8 +161,9 @@ func (c *storageAuthorityReadOnlyClient) CountRegistrationsByIP(ctx context.Cont
 }
 
 func (c *storageAuthorityReadOnlyClient) CountRegistrationsByIPRange(ctx context.Context, in *CountRegistrationsByIPRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/CountRegistrationsByIPRange", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_CountRegistrationsByIPRange_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -130,8 +171,9 @@ func (c *storageAuthorityReadOnlyClient) CountRegistrationsByIPRange(ctx context
 }
 
 func (c *storageAuthorityReadOnlyClient) FQDNSetExists(ctx context.Context, in *FQDNSetExistsRequest, opts ...grpc.CallOption) (*Exists, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Exists)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/FQDNSetExists", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_FQDNSetExists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -139,8 +181,9 @@ func (c *storageAuthorityReadOnlyClient) FQDNSetExists(ctx context.Context, in *
 }
 
 func (c *storageAuthorityReadOnlyClient) FQDNSetTimestampsForWindow(ctx context.Context, in *CountFQDNSetsRequest, opts ...grpc.CallOption) (*Timestamps, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Timestamps)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/FQDNSetTimestampsForWindow", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_FQDNSetTimestampsForWindow_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -148,8 +191,9 @@ func (c *storageAuthorityReadOnlyClient) FQDNSetTimestampsForWindow(ctx context.
 }
 
 func (c *storageAuthorityReadOnlyClient) GetAuthorization2(ctx context.Context, in *AuthorizationID2, opts ...grpc.CallOption) (*proto.Authorization, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Authorization)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetAuthorization2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetAuthorization2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -157,8 +201,9 @@ func (c *storageAuthorityReadOnlyClient) GetAuthorization2(ctx context.Context,
 }
 
 func (c *storageAuthorityReadOnlyClient) GetAuthorizations2(ctx context.Context, in *GetAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authorizations)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -166,8 +211,9 @@ func (c *storageAuthorityReadOnlyClient) GetAuthorizations2(ctx context.Context,
 }
 
 func (c *storageAuthorityReadOnlyClient) GetCertificate(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*proto.Certificate, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Certificate)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetCertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -175,8 +221,9 @@ func (c *storageAuthorityReadOnlyClient) GetCertificate(ctx context.Context, in
 }
 
 func (c *storageAuthorityReadOnlyClient) GetLintPrecertificate(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*proto.Certificate, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Certificate)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetLintPrecertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetLintPrecertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -184,8 +231,9 @@ func (c *storageAuthorityReadOnlyClient) GetLintPrecertificate(ctx context.Conte
 }
 
 func (c *storageAuthorityReadOnlyClient) GetCertificateStatus(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*proto.CertificateStatus, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.CertificateStatus)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetCertificateStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetCertificateStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -193,8 +241,9 @@ func (c *storageAuthorityReadOnlyClient) GetCertificateStatus(ctx context.Contex
 }
 
 func (c *storageAuthorityReadOnlyClient) GetMaxExpiration(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*timestamppb.Timestamp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(timestamppb.Timestamp)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetMaxExpiration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetMaxExpiration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -202,8 +251,9 @@ func (c *storageAuthorityReadOnlyClient) GetMaxExpiration(ctx context.Context, i
 }
 
 func (c *storageAuthorityReadOnlyClient) GetOrder(ctx context.Context, in *OrderRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetOrder", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetOrder_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -211,8 +261,9 @@ func (c *storageAuthorityReadOnlyClient) GetOrder(ctx context.Context, in *Order
 }
 
 func (c *storageAuthorityReadOnlyClient) GetOrderForNames(ctx context.Context, in *GetOrderForNamesRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetOrderForNames", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetOrderForNames_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -220,8 +271,9 @@ func (c *storageAuthorityReadOnlyClient) GetOrderForNames(ctx context.Context, i
 }
 
 func (c *storageAuthorityReadOnlyClient) GetPendingAuthorization2(ctx context.Context, in *GetPendingAuthorizationRequest, opts ...grpc.CallOption) (*proto.Authorization, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Authorization)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetPendingAuthorization2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetPendingAuthorization2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -229,8 +281,9 @@ func (c *storageAuthorityReadOnlyClient) GetPendingAuthorization2(ctx context.Co
 }
 
 func (c *storageAuthorityReadOnlyClient) GetRegistration(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -238,8 +291,9 @@ func (c *storageAuthorityReadOnlyClient) GetRegistration(ctx context.Context, in
 }
 
 func (c *storageAuthorityReadOnlyClient) GetRegistrationByKey(ctx context.Context, in *JSONWebKey, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetRegistrationByKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetRegistrationByKey_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -247,20 +301,22 @@ func (c *storageAuthorityReadOnlyClient) GetRegistrationByKey(ctx context.Contex
 }
 
 func (c *storageAuthorityReadOnlyClient) GetRevocationStatus(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*RevocationStatus, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RevocationStatus)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetRevocationStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetRevocationStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *storageAuthorityReadOnlyClient) GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (StorageAuthorityReadOnly_GetRevokedCertsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[0], "/sa.StorageAuthorityReadOnly/GetRevokedCerts", opts...)
+func (c *storageAuthorityReadOnlyClient) GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[proto.CRLEntry], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[0], StorageAuthorityReadOnly_GetRevokedCerts_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityReadOnlyGetRevokedCertsClient{stream}
+	x := &grpc.GenericClientStream[GetRevokedCertsRequest, proto.CRLEntry]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -270,38 +326,26 @@ func (c *storageAuthorityReadOnlyClient) GetRevokedCerts(ctx context.Context, in
 	return x, nil
 }
 
-type StorageAuthorityReadOnly_GetRevokedCertsClient interface {
-	Recv() (*proto.CRLEntry, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityReadOnlyGetRevokedCertsClient struct {
-	grpc.ClientStream
-}
-
-func (x *storageAuthorityReadOnlyGetRevokedCertsClient) Recv() (*proto.CRLEntry, error) {
-	m := new(proto.CRLEntry)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_GetRevokedCertsClient = grpc.ServerStreamingClient[proto.CRLEntry]
 
 func (c *storageAuthorityReadOnlyClient) GetSerialMetadata(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*SerialMetadata, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SerialMetadata)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetSerialMetadata", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetSerialMetadata_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *storageAuthorityReadOnlyClient) GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (StorageAuthorityReadOnly_GetSerialsByAccountClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[1], "/sa.StorageAuthorityReadOnly/GetSerialsByAccount", opts...)
+func (c *storageAuthorityReadOnlyClient) GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[1], StorageAuthorityReadOnly_GetSerialsByAccount_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityReadOnlyGetSerialsByAccountClient{stream}
+	x := &grpc.GenericClientStream[RegistrationID, Serial]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -311,29 +355,16 @@ func (c *storageAuthorityReadOnlyClient) GetSerialsByAccount(ctx context.Context
 	return x, nil
 }
 
-type StorageAuthorityReadOnly_GetSerialsByAccountClient interface {
-	Recv() (*Serial, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityReadOnlyGetSerialsByAccountClient struct {
-	grpc.ClientStream
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_GetSerialsByAccountClient = grpc.ServerStreamingClient[Serial]
 
-func (x *storageAuthorityReadOnlyGetSerialsByAccountClient) Recv() (*Serial, error) {
-	m := new(Serial)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *storageAuthorityReadOnlyClient) GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (StorageAuthorityReadOnly_GetSerialsByKeyClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[2], "/sa.StorageAuthorityReadOnly/GetSerialsByKey", opts...)
+func (c *storageAuthorityReadOnlyClient) GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[2], StorageAuthorityReadOnly_GetSerialsByKey_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityReadOnlyGetSerialsByKeyClient{stream}
+	x := &grpc.GenericClientStream[SPKIHash, Serial]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -343,26 +374,13 @@ func (c *storageAuthorityReadOnlyClient) GetSerialsByKey(ctx context.Context, in
 	return x, nil
 }
 
-type StorageAuthorityReadOnly_GetSerialsByKeyClient interface {
-	Recv() (*Serial, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityReadOnlyGetSerialsByKeyClient struct {
-	grpc.ClientStream
-}
-
-func (x *storageAuthorityReadOnlyGetSerialsByKeyClient) Recv() (*Serial, error) {
-	m := new(Serial)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_GetSerialsByKeyClient = grpc.ServerStreamingClient[Serial]
 
 func (c *storageAuthorityReadOnlyClient) GetValidAuthorizations2(ctx context.Context, in *GetValidAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authorizations)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetValidAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetValidAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -370,8 +388,9 @@ func (c *storageAuthorityReadOnlyClient) GetValidAuthorizations2(ctx context.Con
 }
 
 func (c *storageAuthorityReadOnlyClient) GetValidOrderAuthorizations2(ctx context.Context, in *GetValidOrderAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authorizations)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/GetValidOrderAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_GetValidOrderAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -379,8 +398,9 @@ func (c *storageAuthorityReadOnlyClient) GetValidOrderAuthorizations2(ctx contex
 }
 
 func (c *storageAuthorityReadOnlyClient) IncidentsForSerial(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Incidents, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Incidents)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/IncidentsForSerial", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_IncidentsForSerial_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -388,8 +408,9 @@ func (c *storageAuthorityReadOnlyClient) IncidentsForSerial(ctx context.Context,
 }
 
 func (c *storageAuthorityReadOnlyClient) KeyBlocked(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (*Exists, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Exists)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/KeyBlocked", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_KeyBlocked_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -397,20 +418,22 @@ func (c *storageAuthorityReadOnlyClient) KeyBlocked(ctx context.Context, in *SPK
 }
 
 func (c *storageAuthorityReadOnlyClient) ReplacementOrderExists(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Exists, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Exists)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthorityReadOnly/ReplacementOrderExists", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthorityReadOnly_ReplacementOrderExists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *storageAuthorityReadOnlyClient) SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (StorageAuthorityReadOnly_SerialsForIncidentClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[3], "/sa.StorageAuthorityReadOnly/SerialsForIncident", opts...)
+func (c *storageAuthorityReadOnlyClient) SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[IncidentSerial], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthorityReadOnly_ServiceDesc.Streams[3], StorageAuthorityReadOnly_SerialsForIncident_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityReadOnlySerialsForIncidentClient{stream}
+	x := &grpc.GenericClientStream[SerialsForIncidentRequest, IncidentSerial]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -420,22 +443,8 @@ func (c *storageAuthorityReadOnlyClient) SerialsForIncident(ctx context.Context,
 	return x, nil
 }
 
-type StorageAuthorityReadOnly_SerialsForIncidentClient interface {
-	Recv() (*IncidentSerial, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityReadOnlySerialsForIncidentClient struct {
-	grpc.ClientStream
-}
-
-func (x *storageAuthorityReadOnlySerialsForIncidentClient) Recv() (*IncidentSerial, error) {
-	m := new(IncidentSerial)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_SerialsForIncidentClient = grpc.ServerStreamingClient[IncidentSerial]
 
 // StorageAuthorityReadOnlyServer is the server API for StorageAuthorityReadOnly service.
 // All implementations must embed UnimplementedStorageAuthorityReadOnlyServer
@@ -462,16 +471,16 @@ type StorageAuthorityReadOnlyServer interface {
 	GetRegistration(context.Context, *RegistrationID) (*proto.Registration, error)
 	GetRegistrationByKey(context.Context, *JSONWebKey) (*proto.Registration, error)
 	GetRevocationStatus(context.Context, *Serial) (*RevocationStatus, error)
-	GetRevokedCerts(*GetRevokedCertsRequest, StorageAuthorityReadOnly_GetRevokedCertsServer) error
+	GetRevokedCerts(*GetRevokedCertsRequest, grpc.ServerStreamingServer[proto.CRLEntry]) error
 	GetSerialMetadata(context.Context, *Serial) (*SerialMetadata, error)
-	GetSerialsByAccount(*RegistrationID, StorageAuthorityReadOnly_GetSerialsByAccountServer) error
-	GetSerialsByKey(*SPKIHash, StorageAuthorityReadOnly_GetSerialsByKeyServer) error
+	GetSerialsByAccount(*RegistrationID, grpc.ServerStreamingServer[Serial]) error
+	GetSerialsByKey(*SPKIHash, grpc.ServerStreamingServer[Serial]) error
 	GetValidAuthorizations2(context.Context, *GetValidAuthorizationsRequest) (*Authorizations, error)
 	GetValidOrderAuthorizations2(context.Context, *GetValidOrderAuthorizationsRequest) (*Authorizations, error)
 	IncidentsForSerial(context.Context, *Serial) (*Incidents, error)
 	KeyBlocked(context.Context, *SPKIHash) (*Exists, error)
 	ReplacementOrderExists(context.Context, *Serial) (*Exists, error)
-	SerialsForIncident(*SerialsForIncidentRequest, StorageAuthorityReadOnly_SerialsForIncidentServer) error
+	SerialsForIncident(*SerialsForIncidentRequest, grpc.ServerStreamingServer[IncidentSerial]) error
 	mustEmbedUnimplementedStorageAuthorityReadOnlyServer()
 }
 
@@ -542,16 +551,16 @@ func (UnimplementedStorageAuthorityReadOnlyServer) GetRegistrationByKey(context.
 func (UnimplementedStorageAuthorityReadOnlyServer) GetRevocationStatus(context.Context, *Serial) (*RevocationStatus, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetRevocationStatus not implemented")
 }
-func (UnimplementedStorageAuthorityReadOnlyServer) GetRevokedCerts(*GetRevokedCertsRequest, StorageAuthorityReadOnly_GetRevokedCertsServer) error {
+func (UnimplementedStorageAuthorityReadOnlyServer) GetRevokedCerts(*GetRevokedCertsRequest, grpc.ServerStreamingServer[proto.CRLEntry]) error {
 	return status.Errorf(codes.Unimplemented, "method GetRevokedCerts not implemented")
 }
 func (UnimplementedStorageAuthorityReadOnlyServer) GetSerialMetadata(context.Context, *Serial) (*SerialMetadata, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSerialMetadata not implemented")
 }
-func (UnimplementedStorageAuthorityReadOnlyServer) GetSerialsByAccount(*RegistrationID, StorageAuthorityReadOnly_GetSerialsByAccountServer) error {
+func (UnimplementedStorageAuthorityReadOnlyServer) GetSerialsByAccount(*RegistrationID, grpc.ServerStreamingServer[Serial]) error {
 	return status.Errorf(codes.Unimplemented, "method GetSerialsByAccount not implemented")
 }
-func (UnimplementedStorageAuthorityReadOnlyServer) GetSerialsByKey(*SPKIHash, StorageAuthorityReadOnly_GetSerialsByKeyServer) error {
+func (UnimplementedStorageAuthorityReadOnlyServer) GetSerialsByKey(*SPKIHash, grpc.ServerStreamingServer[Serial]) error {
 	return status.Errorf(codes.Unimplemented, "method GetSerialsByKey not implemented")
 }
 func (UnimplementedStorageAuthorityReadOnlyServer) GetValidAuthorizations2(context.Context, *GetValidAuthorizationsRequest) (*Authorizations, error) {
@@ -569,7 +578,7 @@ func (UnimplementedStorageAuthorityReadOnlyServer) KeyBlocked(context.Context, *
 func (UnimplementedStorageAuthorityReadOnlyServer) ReplacementOrderExists(context.Context, *Serial) (*Exists, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReplacementOrderExists not implemented")
 }
-func (UnimplementedStorageAuthorityReadOnlyServer) SerialsForIncident(*SerialsForIncidentRequest, StorageAuthorityReadOnly_SerialsForIncidentServer) error {
+func (UnimplementedStorageAuthorityReadOnlyServer) SerialsForIncident(*SerialsForIncidentRequest, grpc.ServerStreamingServer[IncidentSerial]) error {
 	return status.Errorf(codes.Unimplemented, "method SerialsForIncident not implemented")
 }
 func (UnimplementedStorageAuthorityReadOnlyServer) mustEmbedUnimplementedStorageAuthorityReadOnlyServer() {
@@ -596,7 +605,7 @@ func _StorageAuthorityReadOnly_CountCertificatesByNames_Handler(srv interface{},
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountCertificatesByNames",
+		FullMethod: StorageAuthorityReadOnly_CountCertificatesByNames_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountCertificatesByNames(ctx, req.(*CountCertificatesByNamesRequest))
@@ -614,7 +623,7 @@ func _StorageAuthorityReadOnly_CountFQDNSets_Handler(srv interface{}, ctx contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountFQDNSets",
+		FullMethod: StorageAuthorityReadOnly_CountFQDNSets_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountFQDNSets(ctx, req.(*CountFQDNSetsRequest))
@@ -632,7 +641,7 @@ func _StorageAuthorityReadOnly_CountInvalidAuthorizations2_Handler(srv interface
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountInvalidAuthorizations2",
+		FullMethod: StorageAuthorityReadOnly_CountInvalidAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountInvalidAuthorizations2(ctx, req.(*CountInvalidAuthorizationsRequest))
@@ -650,7 +659,7 @@ func _StorageAuthorityReadOnly_CountOrders_Handler(srv interface{}, ctx context.
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountOrders",
+		FullMethod: StorageAuthorityReadOnly_CountOrders_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountOrders(ctx, req.(*CountOrdersRequest))
@@ -668,7 +677,7 @@ func _StorageAuthorityReadOnly_CountPendingAuthorizations2_Handler(srv interface
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountPendingAuthorizations2",
+		FullMethod: StorageAuthorityReadOnly_CountPendingAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountPendingAuthorizations2(ctx, req.(*RegistrationID))
@@ -686,7 +695,7 @@ func _StorageAuthorityReadOnly_CountRegistrationsByIP_Handler(srv interface{}, c
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountRegistrationsByIP",
+		FullMethod: StorageAuthorityReadOnly_CountRegistrationsByIP_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountRegistrationsByIP(ctx, req.(*CountRegistrationsByIPRequest))
@@ -704,7 +713,7 @@ func _StorageAuthorityReadOnly_CountRegistrationsByIPRange_Handler(srv interface
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/CountRegistrationsByIPRange",
+		FullMethod: StorageAuthorityReadOnly_CountRegistrationsByIPRange_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).CountRegistrationsByIPRange(ctx, req.(*CountRegistrationsByIPRequest))
@@ -722,7 +731,7 @@ func _StorageAuthorityReadOnly_FQDNSetExists_Handler(srv interface{}, ctx contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/FQDNSetExists",
+		FullMethod: StorageAuthorityReadOnly_FQDNSetExists_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).FQDNSetExists(ctx, req.(*FQDNSetExistsRequest))
@@ -740,7 +749,7 @@ func _StorageAuthorityReadOnly_FQDNSetTimestampsForWindow_Handler(srv interface{
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/FQDNSetTimestampsForWindow",
+		FullMethod: StorageAuthorityReadOnly_FQDNSetTimestampsForWindow_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).FQDNSetTimestampsForWindow(ctx, req.(*CountFQDNSetsRequest))
@@ -758,7 +767,7 @@ func _StorageAuthorityReadOnly_GetAuthorization2_Handler(srv interface{}, ctx co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetAuthorization2",
+		FullMethod: StorageAuthorityReadOnly_GetAuthorization2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetAuthorization2(ctx, req.(*AuthorizationID2))
@@ -776,7 +785,7 @@ func _StorageAuthorityReadOnly_GetAuthorizations2_Handler(srv interface{}, ctx c
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetAuthorizations2",
+		FullMethod: StorageAuthorityReadOnly_GetAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetAuthorizations2(ctx, req.(*GetAuthorizationsRequest))
@@ -794,7 +803,7 @@ func _StorageAuthorityReadOnly_GetCertificate_Handler(srv interface{}, ctx conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetCertificate",
+		FullMethod: StorageAuthorityReadOnly_GetCertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetCertificate(ctx, req.(*Serial))
@@ -812,7 +821,7 @@ func _StorageAuthorityReadOnly_GetLintPrecertificate_Handler(srv interface{}, ct
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetLintPrecertificate",
+		FullMethod: StorageAuthorityReadOnly_GetLintPrecertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetLintPrecertificate(ctx, req.(*Serial))
@@ -830,7 +839,7 @@ func _StorageAuthorityReadOnly_GetCertificateStatus_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetCertificateStatus",
+		FullMethod: StorageAuthorityReadOnly_GetCertificateStatus_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetCertificateStatus(ctx, req.(*Serial))
@@ -848,7 +857,7 @@ func _StorageAuthorityReadOnly_GetMaxExpiration_Handler(srv interface{}, ctx con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetMaxExpiration",
+		FullMethod: StorageAuthorityReadOnly_GetMaxExpiration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetMaxExpiration(ctx, req.(*emptypb.Empty))
@@ -866,7 +875,7 @@ func _StorageAuthorityReadOnly_GetOrder_Handler(srv interface{}, ctx context.Con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetOrder",
+		FullMethod: StorageAuthorityReadOnly_GetOrder_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetOrder(ctx, req.(*OrderRequest))
@@ -884,7 +893,7 @@ func _StorageAuthorityReadOnly_GetOrderForNames_Handler(srv interface{}, ctx con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetOrderForNames",
+		FullMethod: StorageAuthorityReadOnly_GetOrderForNames_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetOrderForNames(ctx, req.(*GetOrderForNamesRequest))
@@ -902,7 +911,7 @@ func _StorageAuthorityReadOnly_GetPendingAuthorization2_Handler(srv interface{},
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetPendingAuthorization2",
+		FullMethod: StorageAuthorityReadOnly_GetPendingAuthorization2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetPendingAuthorization2(ctx, req.(*GetPendingAuthorizationRequest))
@@ -920,7 +929,7 @@ func _StorageAuthorityReadOnly_GetRegistration_Handler(srv interface{}, ctx cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetRegistration",
+		FullMethod: StorageAuthorityReadOnly_GetRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetRegistration(ctx, req.(*RegistrationID))
@@ -938,7 +947,7 @@ func _StorageAuthorityReadOnly_GetRegistrationByKey_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetRegistrationByKey",
+		FullMethod: StorageAuthorityReadOnly_GetRegistrationByKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetRegistrationByKey(ctx, req.(*JSONWebKey))
@@ -956,7 +965,7 @@ func _StorageAuthorityReadOnly_GetRevocationStatus_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetRevocationStatus",
+		FullMethod: StorageAuthorityReadOnly_GetRevocationStatus_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetRevocationStatus(ctx, req.(*Serial))
@@ -969,21 +978,11 @@ func _StorageAuthorityReadOnly_GetRevokedCerts_Handler(srv interface{}, stream g
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityReadOnlyServer).GetRevokedCerts(m, &storageAuthorityReadOnlyGetRevokedCertsServer{stream})
+	return srv.(StorageAuthorityReadOnlyServer).GetRevokedCerts(m, &grpc.GenericServerStream[GetRevokedCertsRequest, proto.CRLEntry]{ServerStream: stream})
 }
 
-type StorageAuthorityReadOnly_GetRevokedCertsServer interface {
-	Send(*proto.CRLEntry) error
-	grpc.ServerStream
-}
-
-type storageAuthorityReadOnlyGetRevokedCertsServer struct {
-	grpc.ServerStream
-}
-
-func (x *storageAuthorityReadOnlyGetRevokedCertsServer) Send(m *proto.CRLEntry) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_GetRevokedCertsServer = grpc.ServerStreamingServer[proto.CRLEntry]
 
 func _StorageAuthorityReadOnly_GetSerialMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(Serial)
@@ -995,7 +994,7 @@ func _StorageAuthorityReadOnly_GetSerialMetadata_Handler(srv interface{}, ctx co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetSerialMetadata",
+		FullMethod: StorageAuthorityReadOnly_GetSerialMetadata_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetSerialMetadata(ctx, req.(*Serial))
@@ -1008,42 +1007,22 @@ func _StorageAuthorityReadOnly_GetSerialsByAccount_Handler(srv interface{}, stre
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityReadOnlyServer).GetSerialsByAccount(m, &storageAuthorityReadOnlyGetSerialsByAccountServer{stream})
-}
-
-type StorageAuthorityReadOnly_GetSerialsByAccountServer interface {
-	Send(*Serial) error
-	grpc.ServerStream
+	return srv.(StorageAuthorityReadOnlyServer).GetSerialsByAccount(m, &grpc.GenericServerStream[RegistrationID, Serial]{ServerStream: stream})
 }
 
-type storageAuthorityReadOnlyGetSerialsByAccountServer struct {
-	grpc.ServerStream
-}
-
-func (x *storageAuthorityReadOnlyGetSerialsByAccountServer) Send(m *Serial) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_GetSerialsByAccountServer = grpc.ServerStreamingServer[Serial]
 
 func _StorageAuthorityReadOnly_GetSerialsByKey_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(SPKIHash)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityReadOnlyServer).GetSerialsByKey(m, &storageAuthorityReadOnlyGetSerialsByKeyServer{stream})
-}
-
-type StorageAuthorityReadOnly_GetSerialsByKeyServer interface {
-	Send(*Serial) error
-	grpc.ServerStream
+	return srv.(StorageAuthorityReadOnlyServer).GetSerialsByKey(m, &grpc.GenericServerStream[SPKIHash, Serial]{ServerStream: stream})
 }
 
-type storageAuthorityReadOnlyGetSerialsByKeyServer struct {
-	grpc.ServerStream
-}
-
-func (x *storageAuthorityReadOnlyGetSerialsByKeyServer) Send(m *Serial) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_GetSerialsByKeyServer = grpc.ServerStreamingServer[Serial]
 
 func _StorageAuthorityReadOnly_GetValidAuthorizations2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetValidAuthorizationsRequest)
@@ -1055,7 +1034,7 @@ func _StorageAuthorityReadOnly_GetValidAuthorizations2_Handler(srv interface{},
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetValidAuthorizations2",
+		FullMethod: StorageAuthorityReadOnly_GetValidAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetValidAuthorizations2(ctx, req.(*GetValidAuthorizationsRequest))
@@ -1073,7 +1052,7 @@ func _StorageAuthorityReadOnly_GetValidOrderAuthorizations2_Handler(srv interfac
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/GetValidOrderAuthorizations2",
+		FullMethod: StorageAuthorityReadOnly_GetValidOrderAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).GetValidOrderAuthorizations2(ctx, req.(*GetValidOrderAuthorizationsRequest))
@@ -1091,7 +1070,7 @@ func _StorageAuthorityReadOnly_IncidentsForSerial_Handler(srv interface{}, ctx c
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/IncidentsForSerial",
+		FullMethod: StorageAuthorityReadOnly_IncidentsForSerial_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).IncidentsForSerial(ctx, req.(*Serial))
@@ -1109,7 +1088,7 @@ func _StorageAuthorityReadOnly_KeyBlocked_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/KeyBlocked",
+		FullMethod: StorageAuthorityReadOnly_KeyBlocked_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).KeyBlocked(ctx, req.(*SPKIHash))
@@ -1127,7 +1106,7 @@ func _StorageAuthorityReadOnly_ReplacementOrderExists_Handler(srv interface{}, c
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthorityReadOnly/ReplacementOrderExists",
+		FullMethod: StorageAuthorityReadOnly_ReplacementOrderExists_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityReadOnlyServer).ReplacementOrderExists(ctx, req.(*Serial))
@@ -1140,21 +1119,11 @@ func _StorageAuthorityReadOnly_SerialsForIncident_Handler(srv interface{}, strea
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityReadOnlyServer).SerialsForIncident(m, &storageAuthorityReadOnlySerialsForIncidentServer{stream})
+	return srv.(StorageAuthorityReadOnlyServer).SerialsForIncident(m, &grpc.GenericServerStream[SerialsForIncidentRequest, IncidentSerial]{ServerStream: stream})
 }
 
-type StorageAuthorityReadOnly_SerialsForIncidentServer interface {
-	Send(*IncidentSerial) error
-	grpc.ServerStream
-}
-
-type storageAuthorityReadOnlySerialsForIncidentServer struct {
-	grpc.ServerStream
-}
-
-func (x *storageAuthorityReadOnlySerialsForIncidentServer) Send(m *IncidentSerial) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthorityReadOnly_SerialsForIncidentServer = grpc.ServerStreamingServer[IncidentSerial]
 
 // StorageAuthorityReadOnly_ServiceDesc is the grpc.ServiceDesc for StorageAuthorityReadOnly service.
 // It's only intended for direct use with grpc.RegisterService,
@@ -1297,6 +1266,58 @@ var StorageAuthorityReadOnly_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "sa.proto",
 }
 
+const (
+	StorageAuthority_CountCertificatesByNames_FullMethodName     = "/sa.StorageAuthority/CountCertificatesByNames"
+	StorageAuthority_CountFQDNSets_FullMethodName                = "/sa.StorageAuthority/CountFQDNSets"
+	StorageAuthority_CountInvalidAuthorizations2_FullMethodName  = "/sa.StorageAuthority/CountInvalidAuthorizations2"
+	StorageAuthority_CountOrders_FullMethodName                  = "/sa.StorageAuthority/CountOrders"
+	StorageAuthority_CountPendingAuthorizations2_FullMethodName  = "/sa.StorageAuthority/CountPendingAuthorizations2"
+	StorageAuthority_CountRegistrationsByIP_FullMethodName       = "/sa.StorageAuthority/CountRegistrationsByIP"
+	StorageAuthority_CountRegistrationsByIPRange_FullMethodName  = "/sa.StorageAuthority/CountRegistrationsByIPRange"
+	StorageAuthority_FQDNSetExists_FullMethodName                = "/sa.StorageAuthority/FQDNSetExists"
+	StorageAuthority_FQDNSetTimestampsForWindow_FullMethodName   = "/sa.StorageAuthority/FQDNSetTimestampsForWindow"
+	StorageAuthority_GetAuthorization2_FullMethodName            = "/sa.StorageAuthority/GetAuthorization2"
+	StorageAuthority_GetAuthorizations2_FullMethodName           = "/sa.StorageAuthority/GetAuthorizations2"
+	StorageAuthority_GetCertificate_FullMethodName               = "/sa.StorageAuthority/GetCertificate"
+	StorageAuthority_GetLintPrecertificate_FullMethodName        = "/sa.StorageAuthority/GetLintPrecertificate"
+	StorageAuthority_GetCertificateStatus_FullMethodName         = "/sa.StorageAuthority/GetCertificateStatus"
+	StorageAuthority_GetMaxExpiration_FullMethodName             = "/sa.StorageAuthority/GetMaxExpiration"
+	StorageAuthority_GetOrder_FullMethodName                     = "/sa.StorageAuthority/GetOrder"
+	StorageAuthority_GetOrderForNames_FullMethodName             = "/sa.StorageAuthority/GetOrderForNames"
+	StorageAuthority_GetPendingAuthorization2_FullMethodName     = "/sa.StorageAuthority/GetPendingAuthorization2"
+	StorageAuthority_GetRegistration_FullMethodName              = "/sa.StorageAuthority/GetRegistration"
+	StorageAuthority_GetRegistrationByKey_FullMethodName         = "/sa.StorageAuthority/GetRegistrationByKey"
+	StorageAuthority_GetRevocationStatus_FullMethodName          = "/sa.StorageAuthority/GetRevocationStatus"
+	StorageAuthority_GetRevokedCerts_FullMethodName              = "/sa.StorageAuthority/GetRevokedCerts"
+	StorageAuthority_GetSerialMetadata_FullMethodName            = "/sa.StorageAuthority/GetSerialMetadata"
+	StorageAuthority_GetSerialsByAccount_FullMethodName          = "/sa.StorageAuthority/GetSerialsByAccount"
+	StorageAuthority_GetSerialsByKey_FullMethodName              = "/sa.StorageAuthority/GetSerialsByKey"
+	StorageAuthority_GetValidAuthorizations2_FullMethodName      = "/sa.StorageAuthority/GetValidAuthorizations2"
+	StorageAuthority_GetValidOrderAuthorizations2_FullMethodName = "/sa.StorageAuthority/GetValidOrderAuthorizations2"
+	StorageAuthority_IncidentsForSerial_FullMethodName           = "/sa.StorageAuthority/IncidentsForSerial"
+	StorageAuthority_KeyBlocked_FullMethodName                   = "/sa.StorageAuthority/KeyBlocked"
+	StorageAuthority_ReplacementOrderExists_FullMethodName       = "/sa.StorageAuthority/ReplacementOrderExists"
+	StorageAuthority_SerialsForIncident_FullMethodName           = "/sa.StorageAuthority/SerialsForIncident"
+	StorageAuthority_AddBlockedKey_FullMethodName                = "/sa.StorageAuthority/AddBlockedKey"
+	StorageAuthority_AddCertificate_FullMethodName               = "/sa.StorageAuthority/AddCertificate"
+	StorageAuthority_AddPrecertificate_FullMethodName            = "/sa.StorageAuthority/AddPrecertificate"
+	StorageAuthority_SetCertificateStatusReady_FullMethodName    = "/sa.StorageAuthority/SetCertificateStatusReady"
+	StorageAuthority_AddSerial_FullMethodName                    = "/sa.StorageAuthority/AddSerial"
+	StorageAuthority_DeactivateAuthorization2_FullMethodName     = "/sa.StorageAuthority/DeactivateAuthorization2"
+	StorageAuthority_DeactivateRegistration_FullMethodName       = "/sa.StorageAuthority/DeactivateRegistration"
+	StorageAuthority_FinalizeAuthorization2_FullMethodName       = "/sa.StorageAuthority/FinalizeAuthorization2"
+	StorageAuthority_FinalizeOrder_FullMethodName                = "/sa.StorageAuthority/FinalizeOrder"
+	StorageAuthority_NewOrderAndAuthzs_FullMethodName            = "/sa.StorageAuthority/NewOrderAndAuthzs"
+	StorageAuthority_NewRegistration_FullMethodName              = "/sa.StorageAuthority/NewRegistration"
+	StorageAuthority_RevokeCertificate_FullMethodName            = "/sa.StorageAuthority/RevokeCertificate"
+	StorageAuthority_SetOrderError_FullMethodName                = "/sa.StorageAuthority/SetOrderError"
+	StorageAuthority_SetOrderProcessing_FullMethodName           = "/sa.StorageAuthority/SetOrderProcessing"
+	StorageAuthority_UpdateRegistration_FullMethodName           = "/sa.StorageAuthority/UpdateRegistration"
+	StorageAuthority_UpdateRevokedCertificate_FullMethodName     = "/sa.StorageAuthority/UpdateRevokedCertificate"
+	StorageAuthority_LeaseCRLShard_FullMethodName                = "/sa.StorageAuthority/LeaseCRLShard"
+	StorageAuthority_UpdateCRLShard_FullMethodName               = "/sa.StorageAuthority/UpdateCRLShard"
+)
+
 // StorageAuthorityClient is the client API for StorageAuthority service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -1323,16 +1344,16 @@ type StorageAuthorityClient interface {
 	GetRegistration(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*proto.Registration, error)
 	GetRegistrationByKey(ctx context.Context, in *JSONWebKey, opts ...grpc.CallOption) (*proto.Registration, error)
 	GetRevocationStatus(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*RevocationStatus, error)
-	GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (StorageAuthority_GetRevokedCertsClient, error)
+	GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[proto.CRLEntry], error)
 	GetSerialMetadata(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*SerialMetadata, error)
-	GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (StorageAuthority_GetSerialsByAccountClient, error)
-	GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (StorageAuthority_GetSerialsByKeyClient, error)
+	GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error)
+	GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error)
 	GetValidAuthorizations2(ctx context.Context, in *GetValidAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error)
 	GetValidOrderAuthorizations2(ctx context.Context, in *GetValidOrderAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error)
 	IncidentsForSerial(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Incidents, error)
 	KeyBlocked(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (*Exists, error)
 	ReplacementOrderExists(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Exists, error)
-	SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (StorageAuthority_SerialsForIncidentClient, error)
+	SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[IncidentSerial], error)
 	// Adders
 	AddBlockedKey(ctx context.Context, in *AddBlockedKeyRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	AddCertificate(ctx context.Context, in *AddCertificateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -1363,8 +1384,9 @@ func NewStorageAuthorityClient(cc grpc.ClientConnInterface) StorageAuthorityClie
 }
 
 func (c *storageAuthorityClient) CountCertificatesByNames(ctx context.Context, in *CountCertificatesByNamesRequest, opts ...grpc.CallOption) (*CountByNames, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CountByNames)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountCertificatesByNames", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountCertificatesByNames_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1372,8 +1394,9 @@ func (c *storageAuthorityClient) CountCertificatesByNames(ctx context.Context, i
 }
 
 func (c *storageAuthorityClient) CountFQDNSets(ctx context.Context, in *CountFQDNSetsRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountFQDNSets", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountFQDNSets_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1381,8 +1404,9 @@ func (c *storageAuthorityClient) CountFQDNSets(ctx context.Context, in *CountFQD
 }
 
 func (c *storageAuthorityClient) CountInvalidAuthorizations2(ctx context.Context, in *CountInvalidAuthorizationsRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountInvalidAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountInvalidAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1390,8 +1414,9 @@ func (c *storageAuthorityClient) CountInvalidAuthorizations2(ctx context.Context
 }
 
 func (c *storageAuthorityClient) CountOrders(ctx context.Context, in *CountOrdersRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountOrders", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountOrders_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1399,8 +1424,9 @@ func (c *storageAuthorityClient) CountOrders(ctx context.Context, in *CountOrder
 }
 
 func (c *storageAuthorityClient) CountPendingAuthorizations2(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountPendingAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountPendingAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1408,8 +1434,9 @@ func (c *storageAuthorityClient) CountPendingAuthorizations2(ctx context.Context
 }
 
 func (c *storageAuthorityClient) CountRegistrationsByIP(ctx context.Context, in *CountRegistrationsByIPRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountRegistrationsByIP", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountRegistrationsByIP_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1417,8 +1444,9 @@ func (c *storageAuthorityClient) CountRegistrationsByIP(ctx context.Context, in
 }
 
 func (c *storageAuthorityClient) CountRegistrationsByIPRange(ctx context.Context, in *CountRegistrationsByIPRequest, opts ...grpc.CallOption) (*Count, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Count)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/CountRegistrationsByIPRange", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_CountRegistrationsByIPRange_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1426,8 +1454,9 @@ func (c *storageAuthorityClient) CountRegistrationsByIPRange(ctx context.Context
 }
 
 func (c *storageAuthorityClient) FQDNSetExists(ctx context.Context, in *FQDNSetExistsRequest, opts ...grpc.CallOption) (*Exists, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Exists)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/FQDNSetExists", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_FQDNSetExists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1435,8 +1464,9 @@ func (c *storageAuthorityClient) FQDNSetExists(ctx context.Context, in *FQDNSetE
 }
 
 func (c *storageAuthorityClient) FQDNSetTimestampsForWindow(ctx context.Context, in *CountFQDNSetsRequest, opts ...grpc.CallOption) (*Timestamps, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Timestamps)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/FQDNSetTimestampsForWindow", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_FQDNSetTimestampsForWindow_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1444,8 +1474,9 @@ func (c *storageAuthorityClient) FQDNSetTimestampsForWindow(ctx context.Context,
 }
 
 func (c *storageAuthorityClient) GetAuthorization2(ctx context.Context, in *AuthorizationID2, opts ...grpc.CallOption) (*proto.Authorization, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Authorization)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetAuthorization2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetAuthorization2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1453,8 +1484,9 @@ func (c *storageAuthorityClient) GetAuthorization2(ctx context.Context, in *Auth
 }
 
 func (c *storageAuthorityClient) GetAuthorizations2(ctx context.Context, in *GetAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authorizations)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1462,8 +1494,9 @@ func (c *storageAuthorityClient) GetAuthorizations2(ctx context.Context, in *Get
 }
 
 func (c *storageAuthorityClient) GetCertificate(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*proto.Certificate, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Certificate)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetCertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1471,8 +1504,9 @@ func (c *storageAuthorityClient) GetCertificate(ctx context.Context, in *Serial,
 }
 
 func (c *storageAuthorityClient) GetLintPrecertificate(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*proto.Certificate, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Certificate)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetLintPrecertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetLintPrecertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1480,8 +1514,9 @@ func (c *storageAuthorityClient) GetLintPrecertificate(ctx context.Context, in *
 }
 
 func (c *storageAuthorityClient) GetCertificateStatus(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*proto.CertificateStatus, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.CertificateStatus)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetCertificateStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetCertificateStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1489,8 +1524,9 @@ func (c *storageAuthorityClient) GetCertificateStatus(ctx context.Context, in *S
 }
 
 func (c *storageAuthorityClient) GetMaxExpiration(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*timestamppb.Timestamp, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(timestamppb.Timestamp)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetMaxExpiration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetMaxExpiration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1498,8 +1534,9 @@ func (c *storageAuthorityClient) GetMaxExpiration(ctx context.Context, in *empty
 }
 
 func (c *storageAuthorityClient) GetOrder(ctx context.Context, in *OrderRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetOrder", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetOrder_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1507,8 +1544,9 @@ func (c *storageAuthorityClient) GetOrder(ctx context.Context, in *OrderRequest,
 }
 
 func (c *storageAuthorityClient) GetOrderForNames(ctx context.Context, in *GetOrderForNamesRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetOrderForNames", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetOrderForNames_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1516,8 +1554,9 @@ func (c *storageAuthorityClient) GetOrderForNames(ctx context.Context, in *GetOr
 }
 
 func (c *storageAuthorityClient) GetPendingAuthorization2(ctx context.Context, in *GetPendingAuthorizationRequest, opts ...grpc.CallOption) (*proto.Authorization, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Authorization)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetPendingAuthorization2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetPendingAuthorization2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1525,8 +1564,9 @@ func (c *storageAuthorityClient) GetPendingAuthorization2(ctx context.Context, i
 }
 
 func (c *storageAuthorityClient) GetRegistration(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1534,8 +1574,9 @@ func (c *storageAuthorityClient) GetRegistration(ctx context.Context, in *Regist
 }
 
 func (c *storageAuthorityClient) GetRegistrationByKey(ctx context.Context, in *JSONWebKey, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetRegistrationByKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetRegistrationByKey_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1543,20 +1584,22 @@ func (c *storageAuthorityClient) GetRegistrationByKey(ctx context.Context, in *J
 }
 
 func (c *storageAuthorityClient) GetRevocationStatus(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*RevocationStatus, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(RevocationStatus)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetRevocationStatus", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetRevocationStatus_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *storageAuthorityClient) GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (StorageAuthority_GetRevokedCertsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[0], "/sa.StorageAuthority/GetRevokedCerts", opts...)
+func (c *storageAuthorityClient) GetRevokedCerts(ctx context.Context, in *GetRevokedCertsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[proto.CRLEntry], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[0], StorageAuthority_GetRevokedCerts_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityGetRevokedCertsClient{stream}
+	x := &grpc.GenericClientStream[GetRevokedCertsRequest, proto.CRLEntry]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -1566,38 +1609,26 @@ func (c *storageAuthorityClient) GetRevokedCerts(ctx context.Context, in *GetRev
 	return x, nil
 }
 
-type StorageAuthority_GetRevokedCertsClient interface {
-	Recv() (*proto.CRLEntry, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityGetRevokedCertsClient struct {
-	grpc.ClientStream
-}
-
-func (x *storageAuthorityGetRevokedCertsClient) Recv() (*proto.CRLEntry, error) {
-	m := new(proto.CRLEntry)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_GetRevokedCertsClient = grpc.ServerStreamingClient[proto.CRLEntry]
 
 func (c *storageAuthorityClient) GetSerialMetadata(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*SerialMetadata, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(SerialMetadata)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetSerialMetadata", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetSerialMetadata_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *storageAuthorityClient) GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (StorageAuthority_GetSerialsByAccountClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[1], "/sa.StorageAuthority/GetSerialsByAccount", opts...)
+func (c *storageAuthorityClient) GetSerialsByAccount(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[1], StorageAuthority_GetSerialsByAccount_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityGetSerialsByAccountClient{stream}
+	x := &grpc.GenericClientStream[RegistrationID, Serial]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -1607,29 +1638,16 @@ func (c *storageAuthorityClient) GetSerialsByAccount(ctx context.Context, in *Re
 	return x, nil
 }
 
-type StorageAuthority_GetSerialsByAccountClient interface {
-	Recv() (*Serial, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityGetSerialsByAccountClient struct {
-	grpc.ClientStream
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_GetSerialsByAccountClient = grpc.ServerStreamingClient[Serial]
 
-func (x *storageAuthorityGetSerialsByAccountClient) Recv() (*Serial, error) {
-	m := new(Serial)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *storageAuthorityClient) GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (StorageAuthority_GetSerialsByKeyClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[2], "/sa.StorageAuthority/GetSerialsByKey", opts...)
+func (c *storageAuthorityClient) GetSerialsByKey(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Serial], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[2], StorageAuthority_GetSerialsByKey_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthorityGetSerialsByKeyClient{stream}
+	x := &grpc.GenericClientStream[SPKIHash, Serial]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -1639,26 +1657,13 @@ func (c *storageAuthorityClient) GetSerialsByKey(ctx context.Context, in *SPKIHa
 	return x, nil
 }
 
-type StorageAuthority_GetSerialsByKeyClient interface {
-	Recv() (*Serial, error)
-	grpc.ClientStream
-}
-
-type storageAuthorityGetSerialsByKeyClient struct {
-	grpc.ClientStream
-}
-
-func (x *storageAuthorityGetSerialsByKeyClient) Recv() (*Serial, error) {
-	m := new(Serial)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_GetSerialsByKeyClient = grpc.ServerStreamingClient[Serial]
 
 func (c *storageAuthorityClient) GetValidAuthorizations2(ctx context.Context, in *GetValidAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authorizations)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetValidAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetValidAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1666,8 +1671,9 @@ func (c *storageAuthorityClient) GetValidAuthorizations2(ctx context.Context, in
 }
 
 func (c *storageAuthorityClient) GetValidOrderAuthorizations2(ctx context.Context, in *GetValidOrderAuthorizationsRequest, opts ...grpc.CallOption) (*Authorizations, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Authorizations)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/GetValidOrderAuthorizations2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_GetValidOrderAuthorizations2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1675,8 +1681,9 @@ func (c *storageAuthorityClient) GetValidOrderAuthorizations2(ctx context.Contex
 }
 
 func (c *storageAuthorityClient) IncidentsForSerial(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Incidents, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Incidents)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/IncidentsForSerial", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_IncidentsForSerial_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1684,8 +1691,9 @@ func (c *storageAuthorityClient) IncidentsForSerial(ctx context.Context, in *Ser
 }
 
 func (c *storageAuthorityClient) KeyBlocked(ctx context.Context, in *SPKIHash, opts ...grpc.CallOption) (*Exists, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Exists)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/KeyBlocked", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_KeyBlocked_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1693,20 +1701,22 @@ func (c *storageAuthorityClient) KeyBlocked(ctx context.Context, in *SPKIHash, o
 }
 
 func (c *storageAuthorityClient) ReplacementOrderExists(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*Exists, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Exists)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/ReplacementOrderExists", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_ReplacementOrderExists_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *storageAuthorityClient) SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (StorageAuthority_SerialsForIncidentClient, error) {
-	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[3], "/sa.StorageAuthority/SerialsForIncident", opts...)
+func (c *storageAuthorityClient) SerialsForIncident(ctx context.Context, in *SerialsForIncidentRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[IncidentSerial], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &StorageAuthority_ServiceDesc.Streams[3], StorageAuthority_SerialsForIncident_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &storageAuthoritySerialsForIncidentClient{stream}
+	x := &grpc.GenericClientStream[SerialsForIncidentRequest, IncidentSerial]{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -1716,26 +1726,13 @@ func (c *storageAuthorityClient) SerialsForIncident(ctx context.Context, in *Ser
 	return x, nil
 }
 
-type StorageAuthority_SerialsForIncidentClient interface {
-	Recv() (*IncidentSerial, error)
-	grpc.ClientStream
-}
-
-type storageAuthoritySerialsForIncidentClient struct {
-	grpc.ClientStream
-}
-
-func (x *storageAuthoritySerialsForIncidentClient) Recv() (*IncidentSerial, error) {
-	m := new(IncidentSerial)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_SerialsForIncidentClient = grpc.ServerStreamingClient[IncidentSerial]
 
 func (c *storageAuthorityClient) AddBlockedKey(ctx context.Context, in *AddBlockedKeyRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/AddBlockedKey", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_AddBlockedKey_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1743,8 +1740,9 @@ func (c *storageAuthorityClient) AddBlockedKey(ctx context.Context, in *AddBlock
 }
 
 func (c *storageAuthorityClient) AddCertificate(ctx context.Context, in *AddCertificateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/AddCertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_AddCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1752,8 +1750,9 @@ func (c *storageAuthorityClient) AddCertificate(ctx context.Context, in *AddCert
 }
 
 func (c *storageAuthorityClient) AddPrecertificate(ctx context.Context, in *AddCertificateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/AddPrecertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_AddPrecertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1761,8 +1760,9 @@ func (c *storageAuthorityClient) AddPrecertificate(ctx context.Context, in *AddC
 }
 
 func (c *storageAuthorityClient) SetCertificateStatusReady(ctx context.Context, in *Serial, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/SetCertificateStatusReady", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_SetCertificateStatusReady_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1770,8 +1770,9 @@ func (c *storageAuthorityClient) SetCertificateStatusReady(ctx context.Context,
 }
 
 func (c *storageAuthorityClient) AddSerial(ctx context.Context, in *AddSerialRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/AddSerial", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_AddSerial_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1779,8 +1780,9 @@ func (c *storageAuthorityClient) AddSerial(ctx context.Context, in *AddSerialReq
 }
 
 func (c *storageAuthorityClient) DeactivateAuthorization2(ctx context.Context, in *AuthorizationID2, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/DeactivateAuthorization2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_DeactivateAuthorization2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1788,8 +1790,9 @@ func (c *storageAuthorityClient) DeactivateAuthorization2(ctx context.Context, i
 }
 
 func (c *storageAuthorityClient) DeactivateRegistration(ctx context.Context, in *RegistrationID, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/DeactivateRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_DeactivateRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1797,8 +1800,9 @@ func (c *storageAuthorityClient) DeactivateRegistration(ctx context.Context, in
 }
 
 func (c *storageAuthorityClient) FinalizeAuthorization2(ctx context.Context, in *FinalizeAuthorizationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/FinalizeAuthorization2", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_FinalizeAuthorization2_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1806,8 +1810,9 @@ func (c *storageAuthorityClient) FinalizeAuthorization2(ctx context.Context, in
 }
 
 func (c *storageAuthorityClient) FinalizeOrder(ctx context.Context, in *FinalizeOrderRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/FinalizeOrder", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_FinalizeOrder_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1815,8 +1820,9 @@ func (c *storageAuthorityClient) FinalizeOrder(ctx context.Context, in *Finalize
 }
 
 func (c *storageAuthorityClient) NewOrderAndAuthzs(ctx context.Context, in *NewOrderAndAuthzsRequest, opts ...grpc.CallOption) (*proto.Order, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Order)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/NewOrderAndAuthzs", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_NewOrderAndAuthzs_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1824,8 +1830,9 @@ func (c *storageAuthorityClient) NewOrderAndAuthzs(ctx context.Context, in *NewO
 }
 
 func (c *storageAuthorityClient) NewRegistration(ctx context.Context, in *proto.Registration, opts ...grpc.CallOption) (*proto.Registration, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(proto.Registration)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/NewRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_NewRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1833,8 +1840,9 @@ func (c *storageAuthorityClient) NewRegistration(ctx context.Context, in *proto.
 }
 
 func (c *storageAuthorityClient) RevokeCertificate(ctx context.Context, in *RevokeCertificateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/RevokeCertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_RevokeCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1842,8 +1850,9 @@ func (c *storageAuthorityClient) RevokeCertificate(ctx context.Context, in *Revo
 }
 
 func (c *storageAuthorityClient) SetOrderError(ctx context.Context, in *SetOrderErrorRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/SetOrderError", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_SetOrderError_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1851,8 +1860,9 @@ func (c *storageAuthorityClient) SetOrderError(ctx context.Context, in *SetOrder
 }
 
 func (c *storageAuthorityClient) SetOrderProcessing(ctx context.Context, in *OrderRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/SetOrderProcessing", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_SetOrderProcessing_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1860,8 +1870,9 @@ func (c *storageAuthorityClient) SetOrderProcessing(ctx context.Context, in *Ord
 }
 
 func (c *storageAuthorityClient) UpdateRegistration(ctx context.Context, in *proto.Registration, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/UpdateRegistration", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_UpdateRegistration_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1869,8 +1880,9 @@ func (c *storageAuthorityClient) UpdateRegistration(ctx context.Context, in *pro
 }
 
 func (c *storageAuthorityClient) UpdateRevokedCertificate(ctx context.Context, in *RevokeCertificateRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/UpdateRevokedCertificate", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_UpdateRevokedCertificate_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1878,8 +1890,9 @@ func (c *storageAuthorityClient) UpdateRevokedCertificate(ctx context.Context, i
 }
 
 func (c *storageAuthorityClient) LeaseCRLShard(ctx context.Context, in *LeaseCRLShardRequest, opts ...grpc.CallOption) (*LeaseCRLShardResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LeaseCRLShardResponse)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/LeaseCRLShard", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_LeaseCRLShard_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1887,8 +1900,9 @@ func (c *storageAuthorityClient) LeaseCRLShard(ctx context.Context, in *LeaseCRL
 }
 
 func (c *storageAuthorityClient) UpdateCRLShard(ctx context.Context, in *UpdateCRLShardRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, "/sa.StorageAuthority/UpdateCRLShard", in, out, opts...)
+	err := c.cc.Invoke(ctx, StorageAuthority_UpdateCRLShard_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -1921,16 +1935,16 @@ type StorageAuthorityServer interface {
 	GetRegistration(context.Context, *RegistrationID) (*proto.Registration, error)
 	GetRegistrationByKey(context.Context, *JSONWebKey) (*proto.Registration, error)
 	GetRevocationStatus(context.Context, *Serial) (*RevocationStatus, error)
-	GetRevokedCerts(*GetRevokedCertsRequest, StorageAuthority_GetRevokedCertsServer) error
+	GetRevokedCerts(*GetRevokedCertsRequest, grpc.ServerStreamingServer[proto.CRLEntry]) error
 	GetSerialMetadata(context.Context, *Serial) (*SerialMetadata, error)
-	GetSerialsByAccount(*RegistrationID, StorageAuthority_GetSerialsByAccountServer) error
-	GetSerialsByKey(*SPKIHash, StorageAuthority_GetSerialsByKeyServer) error
+	GetSerialsByAccount(*RegistrationID, grpc.ServerStreamingServer[Serial]) error
+	GetSerialsByKey(*SPKIHash, grpc.ServerStreamingServer[Serial]) error
 	GetValidAuthorizations2(context.Context, *GetValidAuthorizationsRequest) (*Authorizations, error)
 	GetValidOrderAuthorizations2(context.Context, *GetValidOrderAuthorizationsRequest) (*Authorizations, error)
 	IncidentsForSerial(context.Context, *Serial) (*Incidents, error)
 	KeyBlocked(context.Context, *SPKIHash) (*Exists, error)
 	ReplacementOrderExists(context.Context, *Serial) (*Exists, error)
-	SerialsForIncident(*SerialsForIncidentRequest, StorageAuthority_SerialsForIncidentServer) error
+	SerialsForIncident(*SerialsForIncidentRequest, grpc.ServerStreamingServer[IncidentSerial]) error
 	// Adders
 	AddBlockedKey(context.Context, *AddBlockedKeyRequest) (*emptypb.Empty, error)
 	AddCertificate(context.Context, *AddCertificateRequest) (*emptypb.Empty, error)
@@ -2020,16 +2034,16 @@ func (UnimplementedStorageAuthorityServer) GetRegistrationByKey(context.Context,
 func (UnimplementedStorageAuthorityServer) GetRevocationStatus(context.Context, *Serial) (*RevocationStatus, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetRevocationStatus not implemented")
 }
-func (UnimplementedStorageAuthorityServer) GetRevokedCerts(*GetRevokedCertsRequest, StorageAuthority_GetRevokedCertsServer) error {
+func (UnimplementedStorageAuthorityServer) GetRevokedCerts(*GetRevokedCertsRequest, grpc.ServerStreamingServer[proto.CRLEntry]) error {
 	return status.Errorf(codes.Unimplemented, "method GetRevokedCerts not implemented")
 }
 func (UnimplementedStorageAuthorityServer) GetSerialMetadata(context.Context, *Serial) (*SerialMetadata, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSerialMetadata not implemented")
 }
-func (UnimplementedStorageAuthorityServer) GetSerialsByAccount(*RegistrationID, StorageAuthority_GetSerialsByAccountServer) error {
+func (UnimplementedStorageAuthorityServer) GetSerialsByAccount(*RegistrationID, grpc.ServerStreamingServer[Serial]) error {
 	return status.Errorf(codes.Unimplemented, "method GetSerialsByAccount not implemented")
 }
-func (UnimplementedStorageAuthorityServer) GetSerialsByKey(*SPKIHash, StorageAuthority_GetSerialsByKeyServer) error {
+func (UnimplementedStorageAuthorityServer) GetSerialsByKey(*SPKIHash, grpc.ServerStreamingServer[Serial]) error {
 	return status.Errorf(codes.Unimplemented, "method GetSerialsByKey not implemented")
 }
 func (UnimplementedStorageAuthorityServer) GetValidAuthorizations2(context.Context, *GetValidAuthorizationsRequest) (*Authorizations, error) {
@@ -2047,7 +2061,7 @@ func (UnimplementedStorageAuthorityServer) KeyBlocked(context.Context, *SPKIHash
 func (UnimplementedStorageAuthorityServer) ReplacementOrderExists(context.Context, *Serial) (*Exists, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReplacementOrderExists not implemented")
 }
-func (UnimplementedStorageAuthorityServer) SerialsForIncident(*SerialsForIncidentRequest, StorageAuthority_SerialsForIncidentServer) error {
+func (UnimplementedStorageAuthorityServer) SerialsForIncident(*SerialsForIncidentRequest, grpc.ServerStreamingServer[IncidentSerial]) error {
 	return status.Errorf(codes.Unimplemented, "method SerialsForIncident not implemented")
 }
 func (UnimplementedStorageAuthorityServer) AddBlockedKey(context.Context, *AddBlockedKeyRequest) (*emptypb.Empty, error) {
@@ -2127,7 +2141,7 @@ func _StorageAuthority_CountCertificatesByNames_Handler(srv interface{}, ctx con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountCertificatesByNames",
+		FullMethod: StorageAuthority_CountCertificatesByNames_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountCertificatesByNames(ctx, req.(*CountCertificatesByNamesRequest))
@@ -2145,7 +2159,7 @@ func _StorageAuthority_CountFQDNSets_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountFQDNSets",
+		FullMethod: StorageAuthority_CountFQDNSets_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountFQDNSets(ctx, req.(*CountFQDNSetsRequest))
@@ -2163,7 +2177,7 @@ func _StorageAuthority_CountInvalidAuthorizations2_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountInvalidAuthorizations2",
+		FullMethod: StorageAuthority_CountInvalidAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountInvalidAuthorizations2(ctx, req.(*CountInvalidAuthorizationsRequest))
@@ -2181,7 +2195,7 @@ func _StorageAuthority_CountOrders_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountOrders",
+		FullMethod: StorageAuthority_CountOrders_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountOrders(ctx, req.(*CountOrdersRequest))
@@ -2199,7 +2213,7 @@ func _StorageAuthority_CountPendingAuthorizations2_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountPendingAuthorizations2",
+		FullMethod: StorageAuthority_CountPendingAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountPendingAuthorizations2(ctx, req.(*RegistrationID))
@@ -2217,7 +2231,7 @@ func _StorageAuthority_CountRegistrationsByIP_Handler(srv interface{}, ctx conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountRegistrationsByIP",
+		FullMethod: StorageAuthority_CountRegistrationsByIP_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountRegistrationsByIP(ctx, req.(*CountRegistrationsByIPRequest))
@@ -2235,7 +2249,7 @@ func _StorageAuthority_CountRegistrationsByIPRange_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/CountRegistrationsByIPRange",
+		FullMethod: StorageAuthority_CountRegistrationsByIPRange_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).CountRegistrationsByIPRange(ctx, req.(*CountRegistrationsByIPRequest))
@@ -2253,7 +2267,7 @@ func _StorageAuthority_FQDNSetExists_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/FQDNSetExists",
+		FullMethod: StorageAuthority_FQDNSetExists_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).FQDNSetExists(ctx, req.(*FQDNSetExistsRequest))
@@ -2271,7 +2285,7 @@ func _StorageAuthority_FQDNSetTimestampsForWindow_Handler(srv interface{}, ctx c
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/FQDNSetTimestampsForWindow",
+		FullMethod: StorageAuthority_FQDNSetTimestampsForWindow_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).FQDNSetTimestampsForWindow(ctx, req.(*CountFQDNSetsRequest))
@@ -2289,7 +2303,7 @@ func _StorageAuthority_GetAuthorization2_Handler(srv interface{}, ctx context.Co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetAuthorization2",
+		FullMethod: StorageAuthority_GetAuthorization2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetAuthorization2(ctx, req.(*AuthorizationID2))
@@ -2307,7 +2321,7 @@ func _StorageAuthority_GetAuthorizations2_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetAuthorizations2",
+		FullMethod: StorageAuthority_GetAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetAuthorizations2(ctx, req.(*GetAuthorizationsRequest))
@@ -2325,7 +2339,7 @@ func _StorageAuthority_GetCertificate_Handler(srv interface{}, ctx context.Conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetCertificate",
+		FullMethod: StorageAuthority_GetCertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetCertificate(ctx, req.(*Serial))
@@ -2343,7 +2357,7 @@ func _StorageAuthority_GetLintPrecertificate_Handler(srv interface{}, ctx contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetLintPrecertificate",
+		FullMethod: StorageAuthority_GetLintPrecertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetLintPrecertificate(ctx, req.(*Serial))
@@ -2361,7 +2375,7 @@ func _StorageAuthority_GetCertificateStatus_Handler(srv interface{}, ctx context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetCertificateStatus",
+		FullMethod: StorageAuthority_GetCertificateStatus_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetCertificateStatus(ctx, req.(*Serial))
@@ -2379,7 +2393,7 @@ func _StorageAuthority_GetMaxExpiration_Handler(srv interface{}, ctx context.Con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetMaxExpiration",
+		FullMethod: StorageAuthority_GetMaxExpiration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetMaxExpiration(ctx, req.(*emptypb.Empty))
@@ -2397,7 +2411,7 @@ func _StorageAuthority_GetOrder_Handler(srv interface{}, ctx context.Context, de
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetOrder",
+		FullMethod: StorageAuthority_GetOrder_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetOrder(ctx, req.(*OrderRequest))
@@ -2415,7 +2429,7 @@ func _StorageAuthority_GetOrderForNames_Handler(srv interface{}, ctx context.Con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetOrderForNames",
+		FullMethod: StorageAuthority_GetOrderForNames_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetOrderForNames(ctx, req.(*GetOrderForNamesRequest))
@@ -2433,7 +2447,7 @@ func _StorageAuthority_GetPendingAuthorization2_Handler(srv interface{}, ctx con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetPendingAuthorization2",
+		FullMethod: StorageAuthority_GetPendingAuthorization2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetPendingAuthorization2(ctx, req.(*GetPendingAuthorizationRequest))
@@ -2451,7 +2465,7 @@ func _StorageAuthority_GetRegistration_Handler(srv interface{}, ctx context.Cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetRegistration",
+		FullMethod: StorageAuthority_GetRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetRegistration(ctx, req.(*RegistrationID))
@@ -2469,7 +2483,7 @@ func _StorageAuthority_GetRegistrationByKey_Handler(srv interface{}, ctx context
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetRegistrationByKey",
+		FullMethod: StorageAuthority_GetRegistrationByKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetRegistrationByKey(ctx, req.(*JSONWebKey))
@@ -2487,7 +2501,7 @@ func _StorageAuthority_GetRevocationStatus_Handler(srv interface{}, ctx context.
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetRevocationStatus",
+		FullMethod: StorageAuthority_GetRevocationStatus_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetRevocationStatus(ctx, req.(*Serial))
@@ -2500,21 +2514,11 @@ func _StorageAuthority_GetRevokedCerts_Handler(srv interface{}, stream grpc.Serv
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityServer).GetRevokedCerts(m, &storageAuthorityGetRevokedCertsServer{stream})
-}
-
-type StorageAuthority_GetRevokedCertsServer interface {
-	Send(*proto.CRLEntry) error
-	grpc.ServerStream
+	return srv.(StorageAuthorityServer).GetRevokedCerts(m, &grpc.GenericServerStream[GetRevokedCertsRequest, proto.CRLEntry]{ServerStream: stream})
 }
 
-type storageAuthorityGetRevokedCertsServer struct {
-	grpc.ServerStream
-}
-
-func (x *storageAuthorityGetRevokedCertsServer) Send(m *proto.CRLEntry) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_GetRevokedCertsServer = grpc.ServerStreamingServer[proto.CRLEntry]
 
 func _StorageAuthority_GetSerialMetadata_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(Serial)
@@ -2526,7 +2530,7 @@ func _StorageAuthority_GetSerialMetadata_Handler(srv interface{}, ctx context.Co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetSerialMetadata",
+		FullMethod: StorageAuthority_GetSerialMetadata_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetSerialMetadata(ctx, req.(*Serial))
@@ -2539,42 +2543,22 @@ func _StorageAuthority_GetSerialsByAccount_Handler(srv interface{}, stream grpc.
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityServer).GetSerialsByAccount(m, &storageAuthorityGetSerialsByAccountServer{stream})
-}
-
-type StorageAuthority_GetSerialsByAccountServer interface {
-	Send(*Serial) error
-	grpc.ServerStream
-}
-
-type storageAuthorityGetSerialsByAccountServer struct {
-	grpc.ServerStream
+	return srv.(StorageAuthorityServer).GetSerialsByAccount(m, &grpc.GenericServerStream[RegistrationID, Serial]{ServerStream: stream})
 }
 
-func (x *storageAuthorityGetSerialsByAccountServer) Send(m *Serial) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_GetSerialsByAccountServer = grpc.ServerStreamingServer[Serial]
 
 func _StorageAuthority_GetSerialsByKey_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(SPKIHash)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityServer).GetSerialsByKey(m, &storageAuthorityGetSerialsByKeyServer{stream})
-}
-
-type StorageAuthority_GetSerialsByKeyServer interface {
-	Send(*Serial) error
-	grpc.ServerStream
-}
-
-type storageAuthorityGetSerialsByKeyServer struct {
-	grpc.ServerStream
+	return srv.(StorageAuthorityServer).GetSerialsByKey(m, &grpc.GenericServerStream[SPKIHash, Serial]{ServerStream: stream})
 }
 
-func (x *storageAuthorityGetSerialsByKeyServer) Send(m *Serial) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_GetSerialsByKeyServer = grpc.ServerStreamingServer[Serial]
 
 func _StorageAuthority_GetValidAuthorizations2_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(GetValidAuthorizationsRequest)
@@ -2586,7 +2570,7 @@ func _StorageAuthority_GetValidAuthorizations2_Handler(srv interface{}, ctx cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetValidAuthorizations2",
+		FullMethod: StorageAuthority_GetValidAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetValidAuthorizations2(ctx, req.(*GetValidAuthorizationsRequest))
@@ -2604,7 +2588,7 @@ func _StorageAuthority_GetValidOrderAuthorizations2_Handler(srv interface{}, ctx
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/GetValidOrderAuthorizations2",
+		FullMethod: StorageAuthority_GetValidOrderAuthorizations2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).GetValidOrderAuthorizations2(ctx, req.(*GetValidOrderAuthorizationsRequest))
@@ -2622,7 +2606,7 @@ func _StorageAuthority_IncidentsForSerial_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/IncidentsForSerial",
+		FullMethod: StorageAuthority_IncidentsForSerial_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).IncidentsForSerial(ctx, req.(*Serial))
@@ -2640,7 +2624,7 @@ func _StorageAuthority_KeyBlocked_Handler(srv interface{}, ctx context.Context,
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/KeyBlocked",
+		FullMethod: StorageAuthority_KeyBlocked_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).KeyBlocked(ctx, req.(*SPKIHash))
@@ -2658,7 +2642,7 @@ func _StorageAuthority_ReplacementOrderExists_Handler(srv interface{}, ctx conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/ReplacementOrderExists",
+		FullMethod: StorageAuthority_ReplacementOrderExists_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).ReplacementOrderExists(ctx, req.(*Serial))
@@ -2671,21 +2655,11 @@ func _StorageAuthority_SerialsForIncident_Handler(srv interface{}, stream grpc.S
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(StorageAuthorityServer).SerialsForIncident(m, &storageAuthoritySerialsForIncidentServer{stream})
-}
-
-type StorageAuthority_SerialsForIncidentServer interface {
-	Send(*IncidentSerial) error
-	grpc.ServerStream
+	return srv.(StorageAuthorityServer).SerialsForIncident(m, &grpc.GenericServerStream[SerialsForIncidentRequest, IncidentSerial]{ServerStream: stream})
 }
 
-type storageAuthoritySerialsForIncidentServer struct {
-	grpc.ServerStream
-}
-
-func (x *storageAuthoritySerialsForIncidentServer) Send(m *IncidentSerial) error {
-	return x.ServerStream.SendMsg(m)
-}
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type StorageAuthority_SerialsForIncidentServer = grpc.ServerStreamingServer[IncidentSerial]
 
 func _StorageAuthority_AddBlockedKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(AddBlockedKeyRequest)
@@ -2697,7 +2671,7 @@ func _StorageAuthority_AddBlockedKey_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/AddBlockedKey",
+		FullMethod: StorageAuthority_AddBlockedKey_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).AddBlockedKey(ctx, req.(*AddBlockedKeyRequest))
@@ -2715,7 +2689,7 @@ func _StorageAuthority_AddCertificate_Handler(srv interface{}, ctx context.Conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/AddCertificate",
+		FullMethod: StorageAuthority_AddCertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).AddCertificate(ctx, req.(*AddCertificateRequest))
@@ -2733,7 +2707,7 @@ func _StorageAuthority_AddPrecertificate_Handler(srv interface{}, ctx context.Co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/AddPrecertificate",
+		FullMethod: StorageAuthority_AddPrecertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).AddPrecertificate(ctx, req.(*AddCertificateRequest))
@@ -2751,7 +2725,7 @@ func _StorageAuthority_SetCertificateStatusReady_Handler(srv interface{}, ctx co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/SetCertificateStatusReady",
+		FullMethod: StorageAuthority_SetCertificateStatusReady_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).SetCertificateStatusReady(ctx, req.(*Serial))
@@ -2769,7 +2743,7 @@ func _StorageAuthority_AddSerial_Handler(srv interface{}, ctx context.Context, d
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/AddSerial",
+		FullMethod: StorageAuthority_AddSerial_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).AddSerial(ctx, req.(*AddSerialRequest))
@@ -2787,7 +2761,7 @@ func _StorageAuthority_DeactivateAuthorization2_Handler(srv interface{}, ctx con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/DeactivateAuthorization2",
+		FullMethod: StorageAuthority_DeactivateAuthorization2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).DeactivateAuthorization2(ctx, req.(*AuthorizationID2))
@@ -2805,7 +2779,7 @@ func _StorageAuthority_DeactivateRegistration_Handler(srv interface{}, ctx conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/DeactivateRegistration",
+		FullMethod: StorageAuthority_DeactivateRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).DeactivateRegistration(ctx, req.(*RegistrationID))
@@ -2823,7 +2797,7 @@ func _StorageAuthority_FinalizeAuthorization2_Handler(srv interface{}, ctx conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/FinalizeAuthorization2",
+		FullMethod: StorageAuthority_FinalizeAuthorization2_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).FinalizeAuthorization2(ctx, req.(*FinalizeAuthorizationRequest))
@@ -2841,7 +2815,7 @@ func _StorageAuthority_FinalizeOrder_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/FinalizeOrder",
+		FullMethod: StorageAuthority_FinalizeOrder_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).FinalizeOrder(ctx, req.(*FinalizeOrderRequest))
@@ -2859,7 +2833,7 @@ func _StorageAuthority_NewOrderAndAuthzs_Handler(srv interface{}, ctx context.Co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/NewOrderAndAuthzs",
+		FullMethod: StorageAuthority_NewOrderAndAuthzs_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).NewOrderAndAuthzs(ctx, req.(*NewOrderAndAuthzsRequest))
@@ -2877,7 +2851,7 @@ func _StorageAuthority_NewRegistration_Handler(srv interface{}, ctx context.Cont
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/NewRegistration",
+		FullMethod: StorageAuthority_NewRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).NewRegistration(ctx, req.(*proto.Registration))
@@ -2895,7 +2869,7 @@ func _StorageAuthority_RevokeCertificate_Handler(srv interface{}, ctx context.Co
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/RevokeCertificate",
+		FullMethod: StorageAuthority_RevokeCertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).RevokeCertificate(ctx, req.(*RevokeCertificateRequest))
@@ -2913,7 +2887,7 @@ func _StorageAuthority_SetOrderError_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/SetOrderError",
+		FullMethod: StorageAuthority_SetOrderError_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).SetOrderError(ctx, req.(*SetOrderErrorRequest))
@@ -2931,7 +2905,7 @@ func _StorageAuthority_SetOrderProcessing_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/SetOrderProcessing",
+		FullMethod: StorageAuthority_SetOrderProcessing_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).SetOrderProcessing(ctx, req.(*OrderRequest))
@@ -2949,7 +2923,7 @@ func _StorageAuthority_UpdateRegistration_Handler(srv interface{}, ctx context.C
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/UpdateRegistration",
+		FullMethod: StorageAuthority_UpdateRegistration_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).UpdateRegistration(ctx, req.(*proto.Registration))
@@ -2967,7 +2941,7 @@ func _StorageAuthority_UpdateRevokedCertificate_Handler(srv interface{}, ctx con
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/UpdateRevokedCertificate",
+		FullMethod: StorageAuthority_UpdateRevokedCertificate_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).UpdateRevokedCertificate(ctx, req.(*RevokeCertificateRequest))
@@ -2985,7 +2959,7 @@ func _StorageAuthority_LeaseCRLShard_Handler(srv interface{}, ctx context.Contex
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/LeaseCRLShard",
+		FullMethod: StorageAuthority_LeaseCRLShard_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).LeaseCRLShard(ctx, req.(*LeaseCRLShardRequest))
@@ -3003,7 +2977,7 @@ func _StorageAuthority_UpdateCRLShard_Handler(srv interface{}, ctx context.Conte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/sa.StorageAuthority/UpdateCRLShard",
+		FullMethod: StorageAuthority_UpdateCRLShard_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(StorageAuthorityServer).UpdateCRLShard(ctx, req.(*UpdateCRLShardRequest))
diff --git a/sa/sa.go b/sa/sa.go
index f354e41956f..a8bfd6090c4 100644
--- a/sa/sa.go
+++ b/sa/sa.go
@@ -36,7 +36,13 @@ var (
 // read-only methods provided by the SQLStorageAuthorityRO, those wrapper
 // implementations are in saro.go, next to the real implementations.
 type SQLStorageAuthority struct {
-	sapb.UnimplementedStorageAuthorityServer
+	// Here we consciously opt out of "forward compatibility", by embedding this
+	// type instead of sapb.UnimplementedStorageAuthorityServer. We make this
+	// trade-off to avoid Go's compile-time "ambiguous selector" error, which it
+	// raises because sapb.UnimplementedStorageAuthorityServer and the embedded
+	// *SQLStorageAuthorityRO both provide methods with the same signatures.
+	sapb.UnsafeStorageAuthorityServer
+
 	*SQLStorageAuthorityRO
 
 	dbMap *db.WrappedMap
diff --git a/sa/sa_test.go b/sa/sa_test.go
index 5c036c95503..48902f37294 100644
--- a/sa/sa_test.go
+++ b/sa/sa_test.go
@@ -75,8 +75,12 @@ func (s *fakeServerStream[T]) Context() context.Context {
 }
 
 func TestImplementation(t *testing.T) {
-	test.AssertImplementsGRPCServer(t, &SQLStorageAuthority{}, sapb.UnimplementedStorageAuthorityServer{})
 	test.AssertImplementsGRPCServer(t, &SQLStorageAuthorityRO{}, sapb.UnimplementedStorageAuthorityReadOnlyServer{})
+	// We do not run AssertImplementsGRPCServer for SQLStorageAuthority and
+	// sapb.UnimplementedStorageAuthorityServer, but this is okay: because
+	// SQLStorageAuthority does not embed sapb.UnimplementedStorageauthorityServer
+	// (choosing instead to embed sapb.UnsafeStorageAuthorityServer), we would get
+	// a compile time failure if it did not implement all of those methods.
 }
 
 // initSA constructs a SQLStorageAuthority and a clean up function that should
diff --git a/sa/saro.go b/sa/saro.go
index 25592e30c93..f4f44503379 100644
--- a/sa/saro.go
+++ b/sa/saro.go
@@ -14,6 +14,7 @@ import (
 	"github.com/go-jose/go-jose/v4"
 	"github.com/jmhodges/clock"
 	"github.com/prometheus/client_golang/prometheus"
+	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
@@ -135,10 +136,6 @@ func (ssa *SQLStorageAuthorityRO) GetRegistration(ctx context.Context, req *sapb
 	return registrationModelToPb(model)
 }
 
-func (ssa *SQLStorageAuthority) GetRegistration(ctx context.Context, req *sapb.RegistrationID) (*corepb.Registration, error) {
-	return ssa.SQLStorageAuthorityRO.GetRegistration(ctx, req)
-}
-
 // GetRegistrationByKey obtains a Registration by JWK
 func (ssa *SQLStorageAuthorityRO) GetRegistrationByKey(ctx context.Context, req *sapb.JSONWebKey) (*corepb.Registration, error) {
 	if req == nil || len(req.Jwk) == 0 {
@@ -166,10 +163,6 @@ func (ssa *SQLStorageAuthorityRO) GetRegistrationByKey(ctx context.Context, req
 	return registrationModelToPb(model)
 }
 
-func (ssa *SQLStorageAuthority) GetRegistrationByKey(ctx context.Context, req *sapb.JSONWebKey) (*corepb.Registration, error) {
-	return ssa.SQLStorageAuthorityRO.GetRegistrationByKey(ctx, req)
-}
-
 // incrementIP returns a copy of `ip` incremented at a bit index `index`,
 // or in other words the first IP of the next highest subnet given a mask of
 // length `index`.
@@ -244,10 +237,6 @@ func (ssa *SQLStorageAuthorityRO) CountRegistrationsByIP(ctx context.Context, re
 	return &sapb.Count{Count: count}, nil
 }
 
-func (ssa *SQLStorageAuthority) CountRegistrationsByIP(ctx context.Context, req *sapb.CountRegistrationsByIPRequest) (*sapb.Count, error) {
-	return ssa.SQLStorageAuthorityRO.CountRegistrationsByIP(ctx, req)
-}
-
 // CountRegistrationsByIPRange returns the number of registrations created in
 // the time range in an IP range. For IPv4 addresses, that range is limited to
 // the single IP. For IPv6 addresses, that range is a /48, since it's not
@@ -281,10 +270,6 @@ func (ssa *SQLStorageAuthorityRO) CountRegistrationsByIPRange(ctx context.Contex
 	return &sapb.Count{Count: count}, nil
 }
 
-func (ssa *SQLStorageAuthority) CountRegistrationsByIPRange(ctx context.Context, req *sapb.CountRegistrationsByIPRequest) (*sapb.Count, error) {
-	return ssa.SQLStorageAuthorityRO.CountRegistrationsByIPRange(ctx, req)
-}
-
 // CountCertificatesByNames counts, for each input domain, the number of
 // certificates issued in the given time range for that domain and its
 // subdomains. It returns a map from domains to counts and a timestamp. The map
@@ -367,10 +352,6 @@ func (ssa *SQLStorageAuthorityRO) CountCertificatesByNames(ctx context.Context,
 	return &sapb.CountByNames{Counts: counts, Earliest: earliest}, nil
 }
 
-func (ssa *SQLStorageAuthority) CountCertificatesByNames(ctx context.Context, req *sapb.CountCertificatesByNamesRequest) (*sapb.CountByNames, error) {
-	return ssa.SQLStorageAuthorityRO.CountCertificatesByNames(ctx, req)
-}
-
 func ReverseName(domain string) string {
 	labels := strings.Split(domain, ".")
 	for i, j := 0, len(labels)-1; i < j; i, j = i+1, j-1 {
@@ -413,10 +394,6 @@ func (ssa *SQLStorageAuthorityRO) GetSerialMetadata(ctx context.Context, req *sa
 	}, nil
 }
 
-func (ssa *SQLStorageAuthority) GetSerialMetadata(ctx context.Context, req *sapb.Serial) (*sapb.SerialMetadata, error) {
-	return ssa.SQLStorageAuthorityRO.GetSerialMetadata(ctx, req)
-}
-
 // GetCertificate takes a serial number and returns the corresponding
 // certificate, or error if it does not exist.
 func (ssa *SQLStorageAuthorityRO) GetCertificate(ctx context.Context, req *sapb.Serial) (*corepb.Certificate, error) {
@@ -437,10 +414,6 @@ func (ssa *SQLStorageAuthorityRO) GetCertificate(ctx context.Context, req *sapb.
 	return bgrpc.CertToPB(cert), nil
 }
 
-func (ssa *SQLStorageAuthority) GetCertificate(ctx context.Context, req *sapb.Serial) (*corepb.Certificate, error) {
-	return ssa.SQLStorageAuthorityRO.GetCertificate(ctx, req)
-}
-
 // GetLintPrecertificate takes a serial number and returns the corresponding
 // linting precertificate, or error if it does not exist. The returned precert
 // is identical to the actual submitted-to-CT-logs precertificate, except for
@@ -463,10 +436,6 @@ func (ssa *SQLStorageAuthorityRO) GetLintPrecertificate(ctx context.Context, req
 	return bgrpc.CertToPB(cert), nil
 }
 
-func (ssa *SQLStorageAuthority) GetLintPrecertificate(ctx context.Context, req *sapb.Serial) (*corepb.Certificate, error) {
-	return ssa.SQLStorageAuthorityRO.GetLintPrecertificate(ctx, req)
-}
-
 // GetCertificateStatus takes a hexadecimal string representing the full 128-bit serial
 // number of a certificate and returns data about that certificate's current
 // validity.
@@ -490,10 +459,6 @@ func (ssa *SQLStorageAuthorityRO) GetCertificateStatus(ctx context.Context, req
 	return bgrpc.CertStatusToPB(certStatus), nil
 }
 
-func (ssa *SQLStorageAuthority) GetCertificateStatus(ctx context.Context, req *sapb.Serial) (*corepb.CertificateStatus, error) {
-	return ssa.SQLStorageAuthorityRO.GetCertificateStatus(ctx, req)
-}
-
 // GetRevocationStatus takes a hexadecimal string representing the full serial
 // number of a certificate and returns a minimal set of data about that cert's
 // current validity.
@@ -516,10 +481,6 @@ func (ssa *SQLStorageAuthorityRO) GetRevocationStatus(ctx context.Context, req *
 	return status, nil
 }
 
-func (ssa *SQLStorageAuthority) GetRevocationStatus(ctx context.Context, req *sapb.Serial) (*sapb.RevocationStatus, error) {
-	return ssa.SQLStorageAuthorityRO.GetRevocationStatus(ctx, req)
-}
-
 func (ssa *SQLStorageAuthorityRO) CountOrders(ctx context.Context, req *sapb.CountOrdersRequest) (*sapb.Count, error) {
 	// TODO(#7153): Check each value via core.IsAnyNilOrZero
 	if req.AccountID == 0 || core.IsAnyNilOrZero(req.Range.Earliest, req.Range.Latest) {
@@ -529,10 +490,6 @@ func (ssa *SQLStorageAuthorityRO) CountOrders(ctx context.Context, req *sapb.Cou
 	return countNewOrders(ctx, ssa.dbReadOnlyMap, req)
 }
 
-func (ssa *SQLStorageAuthority) CountOrders(ctx context.Context, req *sapb.CountOrdersRequest) (*sapb.Count, error) {
-	return ssa.SQLStorageAuthorityRO.CountOrders(ctx, req)
-}
-
 // CountFQDNSets counts the total number of issuances, for a set of domains,
 // that occurred during a given window of time.
 func (ssa *SQLStorageAuthorityRO) CountFQDNSets(ctx context.Context, req *sapb.CountFQDNSetsRequest) (*sapb.Count, error) {
@@ -553,10 +510,6 @@ func (ssa *SQLStorageAuthorityRO) CountFQDNSets(ctx context.Context, req *sapb.C
 	return &sapb.Count{Count: count}, err
 }
 
-func (ssa *SQLStorageAuthority) CountFQDNSets(ctx context.Context, req *sapb.CountFQDNSetsRequest) (*sapb.Count, error) {
-	return ssa.SQLStorageAuthorityRO.CountFQDNSets(ctx, req)
-}
-
 // FQDNSetTimestampsForWindow returns the issuance timestamps for each
 // certificate, issued for a set of domains, during a given window of time,
 // starting from the most recent issuance.
@@ -589,10 +542,6 @@ func (ssa *SQLStorageAuthorityRO) FQDNSetTimestampsForWindow(ctx context.Context
 	return &sapb.Timestamps{Timestamps: results}, nil
 }
 
-func (ssa *SQLStorageAuthority) FQDNSetTimestampsForWindow(ctx context.Context, req *sapb.CountFQDNSetsRequest) (*sapb.Timestamps, error) {
-	return ssa.SQLStorageAuthorityRO.FQDNSetTimestampsForWindow(ctx, req)
-}
-
 // FQDNSetExists returns a bool indicating if one or more FQDN sets |names|
 // exists in the database
 func (ssa *SQLStorageAuthorityRO) FQDNSetExists(ctx context.Context, req *sapb.FQDNSetExistsRequest) (*sapb.Exists, error) {
@@ -606,10 +555,6 @@ func (ssa *SQLStorageAuthorityRO) FQDNSetExists(ctx context.Context, req *sapb.F
 	return &sapb.Exists{Exists: exists}, nil
 }
 
-func (ssa *SQLStorageAuthority) FQDNSetExists(ctx context.Context, req *sapb.FQDNSetExistsRequest) (*sapb.Exists, error) {
-	return ssa.SQLStorageAuthorityRO.FQDNSetExists(ctx, req)
-}
-
 // oneSelectorFunc is a func type that matches both borp.Transaction.SelectOne
 // and borp.DbMap.SelectOne.
 type oneSelectorFunc func(ctx context.Context, holder interface{}, query string, args ...interface{}) error
@@ -725,10 +670,6 @@ func (ssa *SQLStorageAuthorityRO) GetOrder(ctx context.Context, req *sapb.OrderR
 	return order, nil
 }
 
-func (ssa *SQLStorageAuthority) GetOrder(ctx context.Context, req *sapb.OrderRequest) (*corepb.Order, error) {
-	return ssa.SQLStorageAuthorityRO.GetOrder(ctx, req)
-}
-
 // GetOrderForNames tries to find a **pending** or **ready** order with the
 // exact set of names requested, associated with the given accountID. Only
 // unexpired orders are considered. If no order meeting these requirements is
@@ -790,10 +731,6 @@ func (ssa *SQLStorageAuthorityRO) GetOrderForNames(ctx context.Context, req *sap
 	return order, nil
 }
 
-func (ssa *SQLStorageAuthority) GetOrderForNames(ctx context.Context, req *sapb.GetOrderForNamesRequest) (*corepb.Order, error) {
-	return ssa.SQLStorageAuthorityRO.GetOrderForNames(ctx, req)
-}
-
 // GetAuthorization2 returns the authz2 style authorization identified by the provided ID or an error.
 // If no authorization is found matching the ID a berrors.NotFound type error is returned.
 func (ssa *SQLStorageAuthorityRO) GetAuthorization2(ctx context.Context, req *sapb.AuthorizationID2) (*corepb.Authorization, error) {
@@ -826,10 +763,6 @@ func (ssa *SQLStorageAuthorityRO) GetAuthorization2(ctx context.Context, req *sa
 	return modelToAuthzPB(*(obj.(*authzModel)))
 }
 
-func (ssa *SQLStorageAuthority) GetAuthorization2(ctx context.Context, req *sapb.AuthorizationID2) (*corepb.Authorization, error) {
-	return ssa.SQLStorageAuthorityRO.GetAuthorization2(ctx, req)
-}
-
 // authzModelMapToPB converts a mapping of domain name to authzModels into a
 // protobuf authorizations map
 func authzModelMapToPB(m map[string]authzModel) (*sapb.Authorizations, error) {
@@ -901,10 +834,6 @@ func (ssa *SQLStorageAuthorityRO) GetAuthorizations2(ctx context.Context, req *s
 	return authzModelMapToPB(authzModelMap)
 }
 
-func (ssa *SQLStorageAuthority) GetAuthorizations2(ctx context.Context, req *sapb.GetAuthorizationsRequest) (*sapb.Authorizations, error) {
-	return ssa.SQLStorageAuthorityRO.GetAuthorizations2(ctx, req)
-}
-
 // GetPendingAuthorization2 returns the most recent Pending authorization with
 // the given identifier, if available. This method only supports DNS identifier types.
 // TODO(#5816): Consider removing this method, as it has no callers.
@@ -942,10 +871,6 @@ func (ssa *SQLStorageAuthorityRO) GetPendingAuthorization2(ctx context.Context,
 	return modelToAuthzPB(am)
 }
 
-func (ssa *SQLStorageAuthority) GetPendingAuthorization2(ctx context.Context, req *sapb.GetPendingAuthorizationRequest) (*corepb.Authorization, error) {
-	return ssa.SQLStorageAuthorityRO.GetPendingAuthorization2(ctx, req)
-}
-
 // CountPendingAuthorizations2 returns the number of pending, unexpired authorizations
 // for the given registration.
 func (ssa *SQLStorageAuthorityRO) CountPendingAuthorizations2(ctx context.Context, req *sapb.RegistrationID) (*sapb.Count, error) {
@@ -971,10 +896,6 @@ func (ssa *SQLStorageAuthorityRO) CountPendingAuthorizations2(ctx context.Contex
 	return &sapb.Count{Count: count}, nil
 }
 
-func (ssa *SQLStorageAuthority) CountPendingAuthorizations2(ctx context.Context, req *sapb.RegistrationID) (*sapb.Count, error) {
-	return ssa.SQLStorageAuthorityRO.CountPendingAuthorizations2(ctx, req)
-}
-
 // GetValidOrderAuthorizations2 is used to find the valid, unexpired authorizations
 // associated with a specific order and account ID.
 func (ssa *SQLStorageAuthorityRO) GetValidOrderAuthorizations2(ctx context.Context, req *sapb.GetValidOrderAuthorizationsRequest) (*sapb.Authorizations, error) {
@@ -1029,10 +950,6 @@ func (ssa *SQLStorageAuthorityRO) GetValidOrderAuthorizations2(ctx context.Conte
 	return authzModelMapToPB(byName)
 }
 
-func (ssa *SQLStorageAuthority) GetValidOrderAuthorizations2(ctx context.Context, req *sapb.GetValidOrderAuthorizationsRequest) (*sapb.Authorizations, error) {
-	return ssa.SQLStorageAuthorityRO.GetValidOrderAuthorizations2(ctx, req)
-}
-
 // CountInvalidAuthorizations2 counts invalid authorizations for a user expiring
 // in a given time range. This method only supports DNS identifier types.
 func (ssa *SQLStorageAuthorityRO) CountInvalidAuthorizations2(ctx context.Context, req *sapb.CountInvalidAuthorizationsRequest) (*sapb.Count, error) {
@@ -1067,10 +984,6 @@ func (ssa *SQLStorageAuthorityRO) CountInvalidAuthorizations2(ctx context.Contex
 	return &sapb.Count{Count: count}, nil
 }
 
-func (ssa *SQLStorageAuthority) CountInvalidAuthorizations2(ctx context.Context, req *sapb.CountInvalidAuthorizationsRequest) (*sapb.Count, error) {
-	return ssa.SQLStorageAuthorityRO.CountInvalidAuthorizations2(ctx, req)
-}
-
 // GetValidAuthorizations2 returns the latest authorization for all
 // domain names that the account has authorizations for. This method
 // only supports DNS identifier types.
@@ -1128,10 +1041,6 @@ func (ssa *SQLStorageAuthorityRO) GetValidAuthorizations2(ctx context.Context, r
 	return authzModelMapToPB(authzMap)
 }
 
-func (ssa *SQLStorageAuthority) GetValidAuthorizations2(ctx context.Context, req *sapb.GetValidAuthorizationsRequest) (*sapb.Authorizations, error) {
-	return ssa.SQLStorageAuthorityRO.GetValidAuthorizations2(ctx, req)
-}
-
 // KeyBlocked checks if a key, indicated by a hash, is present in the blockedKeys table
 func (ssa *SQLStorageAuthorityRO) KeyBlocked(ctx context.Context, req *sapb.SPKIHash) (*sapb.Exists, error) {
 	if req == nil || req.KeyHash == nil {
@@ -1150,10 +1059,6 @@ func (ssa *SQLStorageAuthorityRO) KeyBlocked(ctx context.Context, req *sapb.SPKI
 	return &sapb.Exists{Exists: true}, nil
 }
 
-func (ssa *SQLStorageAuthority) KeyBlocked(ctx context.Context, req *sapb.SPKIHash) (*sapb.Exists, error) {
-	return ssa.SQLStorageAuthorityRO.KeyBlocked(ctx, req)
-}
-
 // IncidentsForSerial queries each active incident table and returns every
 // incident that currently impacts `req.Serial`.
 func (ssa *SQLStorageAuthorityRO) IncidentsForSerial(ctx context.Context, req *sapb.Serial) (*sapb.Incidents, error) {
@@ -1193,17 +1098,13 @@ func (ssa *SQLStorageAuthorityRO) IncidentsForSerial(ctx context.Context, req *s
 	return &sapb.Incidents{Incidents: incidentsForSerial}, nil
 }
 
-func (ssa *SQLStorageAuthority) IncidentsForSerial(ctx context.Context, req *sapb.Serial) (*sapb.Incidents, error) {
-	return ssa.SQLStorageAuthorityRO.IncidentsForSerial(ctx, req)
-}
-
 // SerialsForIncident queries the provided incident table and returns the
 // resulting rows as a stream of `*sapb.IncidentSerial`s. An `io.EOF` error
 // signals that there are no more serials to send. If the incident table in
 // question contains zero rows, only an `io.EOF` error is returned. The
 // IncidentSerial messages returned may have the zero-value for their OrderID,
 // RegistrationID, and LastNoticeSent fields, if those are NULL in the database.
-func (ssa *SQLStorageAuthorityRO) SerialsForIncident(req *sapb.SerialsForIncidentRequest, stream sapb.StorageAuthorityReadOnly_SerialsForIncidentServer) error {
+func (ssa *SQLStorageAuthorityRO) SerialsForIncident(req *sapb.SerialsForIncidentRequest, stream grpc.ServerStreamingServer[sapb.IncidentSerial]) error {
 	if req.IncidentTable == "" {
 		return errIncompleteRequest
 	}
@@ -1248,17 +1149,13 @@ func (ssa *SQLStorageAuthorityRO) SerialsForIncident(req *sapb.SerialsForInciden
 	})
 }
 
-func (ssa *SQLStorageAuthority) SerialsForIncident(req *sapb.SerialsForIncidentRequest, stream sapb.StorageAuthority_SerialsForIncidentServer) error {
-	return ssa.SQLStorageAuthorityRO.SerialsForIncident(req, stream)
-}
-
 // GetRevokedCerts gets a request specifying an issuer and a period of time,
 // and writes to the output stream the set of all certificates issued by that
 // issuer which expire during that period of time and which have been revoked.
 // The starting timestamp is treated as inclusive (certs with exactly that
 // notAfter date are included), but the ending timestamp is exclusive (certs
 // with exactly that notAfter date are *not* included).
-func (ssa *SQLStorageAuthorityRO) GetRevokedCerts(req *sapb.GetRevokedCertsRequest, stream sapb.StorageAuthorityReadOnly_GetRevokedCertsServer) error {
+func (ssa *SQLStorageAuthorityRO) GetRevokedCerts(req *sapb.GetRevokedCertsRequest, stream grpc.ServerStreamingServer[corepb.CRLEntry]) error {
 	if req.ShardIdx != 0 {
 		return ssa.getRevokedCertsFromRevokedCertificatesTable(req, stream)
 	} else {
@@ -1266,14 +1163,10 @@ func (ssa *SQLStorageAuthorityRO) GetRevokedCerts(req *sapb.GetRevokedCertsReque
 	}
 }
 
-func (ssa *SQLStorageAuthority) GetRevokedCerts(req *sapb.GetRevokedCertsRequest, stream sapb.StorageAuthority_GetRevokedCertsServer) error {
-	return ssa.SQLStorageAuthorityRO.GetRevokedCerts(req, stream)
-}
-
 // getRevokedCertsFromRevokedCertificatesTable uses the new revokedCertificates
 // table to implement GetRevokedCerts. It must only be called when the request
 // contains a non-zero ShardIdx.
-func (ssa *SQLStorageAuthorityRO) getRevokedCertsFromRevokedCertificatesTable(req *sapb.GetRevokedCertsRequest, stream sapb.StorageAuthorityReadOnly_GetRevokedCertsServer) error {
+func (ssa *SQLStorageAuthorityRO) getRevokedCertsFromRevokedCertificatesTable(req *sapb.GetRevokedCertsRequest, stream grpc.ServerStreamingServer[corepb.CRLEntry]) error {
 	if req.ShardIdx == 0 {
 		return errors.New("can't select shard 0 from revokedCertificates table")
 	}
@@ -1321,7 +1214,7 @@ func (ssa *SQLStorageAuthorityRO) getRevokedCertsFromRevokedCertificatesTable(re
 
 // getRevokedCertsFromCertificateStatusTable uses the new old certificateStatus
 // table to implement GetRevokedCerts.
-func (ssa *SQLStorageAuthorityRO) getRevokedCertsFromCertificateStatusTable(req *sapb.GetRevokedCertsRequest, stream sapb.StorageAuthorityReadOnly_GetRevokedCertsServer) error {
+func (ssa *SQLStorageAuthorityRO) getRevokedCertsFromCertificateStatusTable(req *sapb.GetRevokedCertsRequest, stream grpc.ServerStreamingServer[corepb.CRLEntry]) error {
 	atTime := req.RevokedBefore.AsTime()
 
 	clauses := `
@@ -1385,10 +1278,6 @@ func (ssa *SQLStorageAuthorityRO) GetMaxExpiration(ctx context.Context, req *emp
 	return timestamppb.New(*model.MaxNotAfter), err
 }
 
-func (ssa *SQLStorageAuthority) GetMaxExpiration(ctx context.Context, req *emptypb.Empty) (*timestamppb.Timestamp, error) {
-	return ssa.SQLStorageAuthorityRO.GetMaxExpiration(ctx, req)
-}
-
 // Health implements the grpc.checker interface.
 func (ssa *SQLStorageAuthorityRO) Health(ctx context.Context) error {
 	err := ssa.dbReadOnlyMap.SelectOne(ctx, new(int), "SELECT 1")
@@ -1457,14 +1346,10 @@ func (ssa *SQLStorageAuthorityRO) ReplacementOrderExists(ctx context.Context, re
 	}
 }
 
-func (ssa *SQLStorageAuthority) ReplacementOrderExists(ctx context.Context, req *sapb.Serial) (*sapb.Exists, error) {
-	return ssa.SQLStorageAuthorityRO.ReplacementOrderExists(ctx, req)
-}
-
 // GetSerialsByKey returns a stream of serials for all unexpired certificates
 // whose public key matches the given SPKIHash. This is useful for revoking all
 // certificates affected by a key compromise.
-func (ssa *SQLStorageAuthorityRO) GetSerialsByKey(req *sapb.SPKIHash, stream sapb.StorageAuthorityReadOnly_GetSerialsByKeyServer) error {
+func (ssa *SQLStorageAuthorityRO) GetSerialsByKey(req *sapb.SPKIHash, stream grpc.ServerStreamingServer[sapb.Serial]) error {
 	clauses := `
 		WHERE keyHash = ?
 		AND certNotAfter > ?`
@@ -1488,14 +1373,10 @@ func (ssa *SQLStorageAuthorityRO) GetSerialsByKey(req *sapb.SPKIHash, stream sap
 	})
 }
 
-func (ssa *SQLStorageAuthority) GetSerialsByKey(req *sapb.SPKIHash, stream sapb.StorageAuthority_GetSerialsByKeyServer) error {
-	return ssa.SQLStorageAuthorityRO.GetSerialsByKey(req, stream)
-}
-
 // GetSerialsByAccount returns a stream of all serials for all unexpired
 // certificates issued to the given RegID. This is useful for revoking all of
 // an account's certs upon their request.
-func (ssa *SQLStorageAuthorityRO) GetSerialsByAccount(req *sapb.RegistrationID, stream sapb.StorageAuthorityReadOnly_GetSerialsByAccountServer) error {
+func (ssa *SQLStorageAuthorityRO) GetSerialsByAccount(req *sapb.RegistrationID, stream grpc.ServerStreamingServer[sapb.Serial]) error {
 	clauses := `
 		WHERE registrationID = ?
 		AND expires > ?`
@@ -1518,7 +1399,3 @@ func (ssa *SQLStorageAuthorityRO) GetSerialsByAccount(req *sapb.RegistrationID,
 		return stream.Send(&sapb.Serial{Serial: row.Serial})
 	})
 }
-
-func (ssa *SQLStorageAuthority) GetSerialsByAccount(req *sapb.RegistrationID, stream sapb.StorageAuthority_GetSerialsByAccountServer) error {
-	return ssa.SQLStorageAuthorityRO.GetSerialsByAccount(req, stream)
-}
diff --git a/test/boulder-tools/Dockerfile b/test/boulder-tools/Dockerfile
index 7470a47e5f0..3e3680b5522 100644
--- a/test/boulder-tools/Dockerfile
+++ b/test/boulder-tools/Dockerfile
@@ -10,8 +10,8 @@ ENV GOBIN /usr/local/bin/
 RUN curl "https://dl.google.com/go/go${GO_VERSION}.$(echo $TARGETPLATFORM | sed 's|\/|-|').tar.gz" |\
     tar -C /usr/local -xz
 RUN go install github.com/rubenv/sql-migrate/sql-migrate@v1.1.2
-RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.0
-RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.2.0
+RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.34.1
+RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@bb9882e6ae58f0a80a6390b50a5ec3bd63e46a3c
 RUN go install github.com/letsencrypt/pebble/v2/cmd/pebble-challtestsrv@66511d8
 RUN go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.57.2
 RUN go install honnef.co/go/tools/cmd/staticcheck@2023.1.7
diff --git a/test/inmem/sa/sa.go b/test/inmem/sa/sa.go
index dfa949c14cb..4df3017b9b8 100644
--- a/test/inmem/sa/sa.go
+++ b/test/inmem/sa/sa.go
@@ -163,7 +163,7 @@ func (s mockServerStream[T]) Context() context.Context {
 	return s.context
 }
 
-func (sa SA) SerialsForIncident(ctx context.Context, req *sapb.SerialsForIncidentRequest, _ ...grpc.CallOption) (sapb.StorageAuthority_SerialsForIncidentClient, error) {
+func (sa SA) SerialsForIncident(ctx context.Context, req *sapb.SerialsForIncidentRequest, _ ...grpc.CallOption) (grpc.ServerStreamingClient[sapb.IncidentSerial], error) {
 	streamChan := make(chan mockStreamResult[*sapb.IncidentSerial])
 	client := mockClientStream[*sapb.IncidentSerial]{stream: streamChan}
 	server := mockServerStream[*sapb.IncidentSerial]{context: ctx, stream: streamChan}
diff --git a/va/proto/va.pb.go b/va/proto/va.pb.go
index 173af332f93..744126917ed 100644
--- a/va/proto/va.pb.go
+++ b/va/proto/va.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.28.0
+// 	protoc-gen-go v1.34.1
 // 	protoc        v3.20.1
 // source: va.proto
 
diff --git a/va/proto/va_grpc.pb.go b/va/proto/va_grpc.pb.go
index 51621b1f3a1..b7c3df4f33b 100644
--- a/va/proto/va_grpc.pb.go
+++ b/va/proto/va_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.2.0
+// - protoc-gen-go-grpc v1.3.0
 // - protoc             v3.20.1
 // source: va.proto
 
@@ -15,8 +15,12 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	VA_PerformValidation_FullMethodName = "/va.VA/PerformValidation"
+)
 
 // VAClient is the client API for VA service.
 //
@@ -34,8 +38,9 @@ func NewVAClient(cc grpc.ClientConnInterface) VAClient {
 }
 
 func (c *vAClient) PerformValidation(ctx context.Context, in *PerformValidationRequest, opts ...grpc.CallOption) (*ValidationResult, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ValidationResult)
-	err := c.cc.Invoke(ctx, "/va.VA/PerformValidation", in, out, opts...)
+	err := c.cc.Invoke(ctx, VA_PerformValidation_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -80,7 +85,7 @@ func _VA_PerformValidation_Handler(srv interface{}, ctx context.Context, dec fun
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/va.VA/PerformValidation",
+		FullMethod: VA_PerformValidation_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(VAServer).PerformValidation(ctx, req.(*PerformValidationRequest))
@@ -104,6 +109,10 @@ var VA_ServiceDesc = grpc.ServiceDesc{
 	Metadata: "va.proto",
 }
 
+const (
+	CAA_IsCAAValid_FullMethodName = "/va.CAA/IsCAAValid"
+)
+
 // CAAClient is the client API for CAA service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
@@ -120,8 +129,9 @@ func NewCAAClient(cc grpc.ClientConnInterface) CAAClient {
 }
 
 func (c *cAAClient) IsCAAValid(ctx context.Context, in *IsCAAValidRequest, opts ...grpc.CallOption) (*IsCAAValidResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(IsCAAValidResponse)
-	err := c.cc.Invoke(ctx, "/va.CAA/IsCAAValid", in, out, opts...)
+	err := c.cc.Invoke(ctx, CAA_IsCAAValid_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -166,7 +176,7 @@ func _CAA_IsCAAValid_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/va.CAA/IsCAAValid",
+		FullMethod: CAA_IsCAAValid_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(CAAServer).IsCAAValid(ctx, req.(*IsCAAValidRequest))
diff --git a/vendor/google.golang.org/grpc/CONTRIBUTING.md b/vendor/google.golang.org/grpc/CONTRIBUTING.md
index 608aa6e1ac5..0854d298e41 100644
--- a/vendor/google.golang.org/grpc/CONTRIBUTING.md
+++ b/vendor/google.golang.org/grpc/CONTRIBUTING.md
@@ -66,7 +66,7 @@ How to get your contributions merged smoothly and quickly.
 - **All tests need to be passing** before your change can be merged. We
   recommend you **run tests locally** before creating your PR to catch breakages
   early on.
-  - `VET_SKIP_PROTO=1 ./vet.sh` to catch vet errors
+  - `./scripts/vet.sh` to catch vet errors
   - `go test -cpu 1,4 -timeout 7m ./...` to run the tests
   - `go test -race -cpu 1,4 -timeout 7m ./...` to run tests in race mode
 
diff --git a/vendor/google.golang.org/grpc/MAINTAINERS.md b/vendor/google.golang.org/grpc/MAINTAINERS.md
index c6672c0a3ef..6a8a07781ae 100644
--- a/vendor/google.golang.org/grpc/MAINTAINERS.md
+++ b/vendor/google.golang.org/grpc/MAINTAINERS.md
@@ -9,6 +9,7 @@ for general contribution guidelines.
 
 ## Maintainers (in alphabetical order)
 
+- [atollena](https://github.com/atollena), Datadog, Inc.
 - [cesarghali](https://github.com/cesarghali), Google LLC
 - [dfawley](https://github.com/dfawley), Google LLC
 - [easwars](https://github.com/easwars), Google LLC
diff --git a/vendor/google.golang.org/grpc/Makefile b/vendor/google.golang.org/grpc/Makefile
index 1f8960922b3..be38384ff6f 100644
--- a/vendor/google.golang.org/grpc/Makefile
+++ b/vendor/google.golang.org/grpc/Makefile
@@ -30,17 +30,20 @@ testdeps:
 	GO111MODULE=on go get -d -v -t google.golang.org/grpc/...
 
 vet: vetdeps
-	./vet.sh
+	./scripts/vet.sh
 
 vetdeps:
-	./vet.sh -install
+	./scripts/vet.sh -install
 
 .PHONY: \
 	all \
 	build \
 	clean \
+	deps \
 	proto \
 	test \
+	testsubmodule \
 	testrace \
+	testdeps \
 	vet \
 	vetdeps
diff --git a/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go b/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
index 856c75dd4e2..1afb1e84ac0 100644
--- a/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
+++ b/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/binarylog.pb.go
@@ -18,7 +18,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.33.0
 // 	protoc        v4.25.2
 // source: grpc/binlog/v1/binarylog.proto
 
diff --git a/vendor/google.golang.org/grpc/clientconn.go b/vendor/google.golang.org/grpc/clientconn.go
index c7f2607114a..2359f94b8a4 100644
--- a/vendor/google.golang.org/grpc/clientconn.go
+++ b/vendor/google.golang.org/grpc/clientconn.go
@@ -37,7 +37,6 @@ import (
 	"google.golang.org/grpc/internal/channelz"
 	"google.golang.org/grpc/internal/grpcsync"
 	"google.golang.org/grpc/internal/idle"
-	"google.golang.org/grpc/internal/pretty"
 	iresolver "google.golang.org/grpc/internal/resolver"
 	"google.golang.org/grpc/internal/transport"
 	"google.golang.org/grpc/keepalive"
@@ -121,8 +120,9 @@ func (dcs *defaultConfigSelector) SelectConfig(rpcInfo iresolver.RPCInfo) (*ires
 // https://github.com/grpc/grpc/blob/master/doc/naming.md.  e.g. to use dns
 // resolver, a "dns:///" prefix should be applied to the target.
 //
-// The DialOptions returned by WithBlock, WithTimeout, and
-// WithReturnConnectionError are ignored by this function.
+// The DialOptions returned by WithBlock, WithTimeout,
+// WithReturnConnectionError, and FailOnNonTempDialError are ignored by this
+// function.
 func NewClient(target string, opts ...DialOption) (conn *ClientConn, err error) {
 	cc := &ClientConn{
 		target: target,
@@ -196,6 +196,8 @@ func NewClient(target string, opts ...DialOption) (conn *ClientConn, err error)
 }
 
 // Dial calls DialContext(context.Background(), target, opts...).
+//
+// Deprecated: use NewClient instead.  Will be supported throughout 1.x.
 func Dial(target string, opts ...DialOption) (*ClientConn, error) {
 	return DialContext(context.Background(), target, opts...)
 }
@@ -209,6 +211,8 @@ func Dial(target string, opts ...DialOption) (*ClientConn, error) {
 // "passthrough" for backward compatibility.  This distinction should not matter
 // to most users, but could matter to legacy users that specify a custom dialer
 // and expect it to receive the target string directly.
+//
+// Deprecated: use NewClient instead.  Will be supported throughout 1.x.
 func DialContext(ctx context.Context, target string, opts ...DialOption) (conn *ClientConn, err error) {
 	// At the end of this method, we kick the channel out of idle, rather than
 	// waiting for the first rpc.
@@ -838,6 +842,9 @@ func (cc *ClientConn) newAddrConnLocked(addrs []resolver.Address, opts balancer.
 		stateChan:    make(chan struct{}),
 	}
 	ac.ctx, ac.cancel = context.WithCancel(cc.ctx)
+	// Start with our address set to the first address; this may be updated if
+	// we connect to different addresses.
+	ac.channelz.ChannelMetrics.Target.Store(&addrs[0].Addr)
 
 	channelz.AddTraceEvent(logger, ac.channelz, 0, &channelz.TraceEvent{
 		Desc:     "Subchannel created",
@@ -929,10 +936,14 @@ func equalAddresses(a, b []resolver.Address) bool {
 // updateAddrs updates ac.addrs with the new addresses list and handles active
 // connections or connection attempts.
 func (ac *addrConn) updateAddrs(addrs []resolver.Address) {
-	ac.mu.Lock()
-	channelz.Infof(logger, ac.channelz, "addrConn: updateAddrs curAddr: %v, addrs: %v", pretty.ToJSON(ac.curAddr), pretty.ToJSON(addrs))
-
 	addrs = copyAddressesWithoutBalancerAttributes(addrs)
+	limit := len(addrs)
+	if limit > 5 {
+		limit = 5
+	}
+	channelz.Infof(logger, ac.channelz, "addrConn: updateAddrs addrs (%d of %d): %v", limit, len(addrs), addrs[:limit])
+
+	ac.mu.Lock()
 	if equalAddresses(ac.addrs, addrs) {
 		ac.mu.Unlock()
 		return
@@ -1167,6 +1178,10 @@ type addrConn struct {
 	// is received, transport is closed, ac has been torn down).
 	transport transport.ClientTransport // The current transport.
 
+	// This mutex is used on the RPC path, so its usage should be minimized as
+	// much as possible.
+	// TODO: Find a lock-free way to retrieve the transport and state from the
+	// addrConn.
 	mu      sync.Mutex
 	curAddr resolver.Address   // The current address.
 	addrs   []resolver.Address // All addresses that the resolver resolved to.
@@ -1292,6 +1307,7 @@ func (ac *addrConn) resetTransport() {
 func (ac *addrConn) tryAllAddrs(ctx context.Context, addrs []resolver.Address, connectDeadline time.Time) error {
 	var firstConnErr error
 	for _, addr := range addrs {
+		ac.channelz.ChannelMetrics.Target.Store(&addr.Addr)
 		if ctx.Err() != nil {
 			return errConnClosing
 		}
@@ -1739,7 +1755,7 @@ func encodeAuthority(authority string) string {
 			return false
 		case '!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=': // Subdelim characters
 			return false
-		case ':', '[', ']', '@': // Authority related delimeters
+		case ':', '[', ']', '@': // Authority related delimiters
 			return false
 		}
 		// Everything else must be escaped.
diff --git a/vendor/google.golang.org/grpc/codegen.sh b/vendor/google.golang.org/grpc/codegen.sh
deleted file mode 100644
index 4cdc6ba7c09..00000000000
--- a/vendor/google.golang.org/grpc/codegen.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-# This script serves as an example to demonstrate how to generate the gRPC-Go
-# interface and the related messages from .proto file.
-#
-# It assumes the installation of i) Google proto buffer compiler at
-# https://github.com/google/protobuf (after v2.6.1) and ii) the Go codegen
-# plugin at https://github.com/golang/protobuf (after 2015-02-20). If you have
-# not, please install them first.
-#
-# We recommend running this script at $GOPATH/src.
-#
-# If this is not what you need, feel free to make your own scripts. Again, this
-# script is for demonstration purpose.
-#
-proto=$1
-protoc --go_out=plugins=grpc:. $proto
diff --git a/vendor/google.golang.org/grpc/codes/codes.go b/vendor/google.golang.org/grpc/codes/codes.go
index 08476ad1fe1..0b42c302b24 100644
--- a/vendor/google.golang.org/grpc/codes/codes.go
+++ b/vendor/google.golang.org/grpc/codes/codes.go
@@ -235,7 +235,7 @@ func (c *Code) UnmarshalJSON(b []byte) error {
 
 	if ci, err := strconv.ParseUint(string(b), 10, 32); err == nil {
 		if ci >= _maxCode {
-			return fmt.Errorf("invalid code: %q", ci)
+			return fmt.Errorf("invalid code: %d", ci)
 		}
 
 		*c = Code(ci)
diff --git a/vendor/google.golang.org/grpc/credentials/credentials.go b/vendor/google.golang.org/grpc/credentials/credentials.go
index f6b55c68b56..665e790bb0f 100644
--- a/vendor/google.golang.org/grpc/credentials/credentials.go
+++ b/vendor/google.golang.org/grpc/credentials/credentials.go
@@ -30,7 +30,7 @@ import (
 
 	"google.golang.org/grpc/attributes"
 	icredentials "google.golang.org/grpc/internal/credentials"
-	"google.golang.org/protobuf/protoadapt"
+	"google.golang.org/protobuf/proto"
 )
 
 // PerRPCCredentials defines the common interface for the credentials which need to
@@ -237,7 +237,7 @@ func ClientHandshakeInfoFromContext(ctx context.Context) ClientHandshakeInfo {
 }
 
 // CheckSecurityLevel checks if a connection's security level is greater than or equal to the specified one.
-// It returns success if 1) the condition is satisified or 2) AuthInfo struct does not implement GetCommonAuthInfo() method
+// It returns success if 1) the condition is satisfied or 2) AuthInfo struct does not implement GetCommonAuthInfo() method
 // or 3) CommonAuthInfo.SecurityLevel has an invalid zero value. For 2) and 3), it is for the purpose of backward-compatibility.
 //
 // This API is experimental.
@@ -287,5 +287,5 @@ type ChannelzSecurityValue interface {
 type OtherChannelzSecurityValue struct {
 	ChannelzSecurityValue
 	Name  string
-	Value protoadapt.MessageV1
+	Value proto.Message
 }
diff --git a/vendor/google.golang.org/grpc/dialoptions.go b/vendor/google.golang.org/grpc/dialoptions.go
index 402493224e0..00273702b69 100644
--- a/vendor/google.golang.org/grpc/dialoptions.go
+++ b/vendor/google.golang.org/grpc/dialoptions.go
@@ -300,6 +300,9 @@ func withBackoff(bs internalbackoff.Strategy) DialOption {
 //
 // Use of this feature is not recommended.  For more information, please see:
 // https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
+//
+// Deprecated: this DialOption is not supported by NewClient.
+// Will be supported throughout 1.x.
 func WithBlock() DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.block = true
@@ -314,10 +317,8 @@ func WithBlock() DialOption {
 // Use of this feature is not recommended.  For more information, please see:
 // https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
 //
-// # Experimental
-//
-// Notice: This API is EXPERIMENTAL and may be changed or removed in a
-// later release.
+// Deprecated: this DialOption is not supported by NewClient.
+// Will be supported throughout 1.x.
 func WithReturnConnectionError() DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.block = true
@@ -387,8 +388,8 @@ func WithCredentialsBundle(b credentials.Bundle) DialOption {
 // WithTimeout returns a DialOption that configures a timeout for dialing a
 // ClientConn initially. This is valid if and only if WithBlock() is present.
 //
-// Deprecated: use DialContext instead of Dial and context.WithTimeout
-// instead.  Will be supported throughout 1.x.
+// Deprecated: this DialOption is not supported by NewClient.
+// Will be supported throughout 1.x.
 func WithTimeout(d time.Duration) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
 		o.timeout = d
@@ -470,9 +471,8 @@ func withBinaryLogger(bl binarylog.Logger) DialOption {
 // Use of this feature is not recommended.  For more information, please see:
 // https://github.com/grpc/grpc-go/blob/master/Documentation/anti-patterns.md
 //
-// # Experimental
-//
-// Notice: This API is EXPERIMENTAL and may be changed or removed in a
+// Deprecated: this DialOption is not supported by NewClient.
+// This API may be changed or removed in a
 // later release.
 func FailOnNonTempDialError(f bool) DialOption {
 	return newFuncDialOption(func(o *dialOptions) {
@@ -601,12 +601,22 @@ func WithDisableRetry() DialOption {
 	})
 }
 
+// MaxHeaderListSizeDialOption is a DialOption that specifies the maximum
+// (uncompressed) size of header list that the client is prepared to accept.
+type MaxHeaderListSizeDialOption struct {
+	MaxHeaderListSize uint32
+}
+
+func (o MaxHeaderListSizeDialOption) apply(do *dialOptions) {
+	do.copts.MaxHeaderListSize = &o.MaxHeaderListSize
+}
+
 // WithMaxHeaderListSize returns a DialOption that specifies the maximum
 // (uncompressed) size of header list that the client is prepared to accept.
 func WithMaxHeaderListSize(s uint32) DialOption {
-	return newFuncDialOption(func(o *dialOptions) {
-		o.copts.MaxHeaderListSize = &s
-	})
+	return MaxHeaderListSizeDialOption{
+		MaxHeaderListSize: s,
+	}
 }
 
 // WithDisableHealthCheck disables the LB channel health checking for all
@@ -648,7 +658,7 @@ func defaultDialOptions() dialOptions {
 	}
 }
 
-// withGetMinConnectDeadline specifies the function that clientconn uses to
+// withMinConnectDeadline specifies the function that clientconn uses to
 // get minConnectDeadline. This can be used to make connection attempts happen
 // faster/slower.
 //
diff --git a/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go b/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go
index 5bf880d4190..6a93475a7fb 100644
--- a/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go
+++ b/vendor/google.golang.org/grpc/health/grpc_health_v1/health.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.33.0
 // 	protoc        v4.25.2
 // source: grpc/health/v1/health.proto
 
diff --git a/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go b/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
index 4c46c098dc6..8f793e6e89f 100644
--- a/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
+++ b/vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go
@@ -32,8 +32,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
+// Requires gRPC-Go v1.62.0 or later.
+const _ = grpc.SupportPackageIsVersion8
 
 const (
 	Health_Check_FullMethodName = "/grpc.health.v1.Health/Check"
@@ -81,8 +81,9 @@ func NewHealthClient(cc grpc.ClientConnInterface) HealthClient {
 }
 
 func (c *healthClient) Check(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (*HealthCheckResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(HealthCheckResponse)
-	err := c.cc.Invoke(ctx, Health_Check_FullMethodName, in, out, opts...)
+	err := c.cc.Invoke(ctx, Health_Check_FullMethodName, in, out, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -90,11 +91,12 @@ func (c *healthClient) Check(ctx context.Context, in *HealthCheckRequest, opts .
 }
 
 func (c *healthClient) Watch(ctx context.Context, in *HealthCheckRequest, opts ...grpc.CallOption) (Health_WatchClient, error) {
-	stream, err := c.cc.NewStream(ctx, &Health_ServiceDesc.Streams[0], Health_Watch_FullMethodName, opts...)
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Health_ServiceDesc.Streams[0], Health_Watch_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &healthWatchClient{stream}
+	x := &healthWatchClient{ClientStream: stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -198,7 +200,7 @@ func _Health_Watch_Handler(srv interface{}, stream grpc.ServerStream) error {
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(HealthServer).Watch(m, &healthWatchServer{stream})
+	return srv.(HealthServer).Watch(m, &healthWatchServer{ServerStream: stream})
 }
 
 type Health_WatchServer interface {
diff --git a/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/config.go b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/config.go
index 6bf7f87396f..13821a92660 100644
--- a/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/config.go
+++ b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/config.go
@@ -75,7 +75,6 @@ func ParseConfig(cfg json.RawMessage) (serviceconfig.LoadBalancingConfig, error)
 		if err != nil {
 			return nil, fmt.Errorf("error parsing config for policy %q: %v", name, err)
 		}
-
 		return &lbConfig{childBuilder: builder, childConfig: cfg}, nil
 	}
 
diff --git a/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
index 45d5e50ea9b..73bb4c4ee9a 100644
--- a/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
+++ b/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/gracefulswitch.go
@@ -169,7 +169,6 @@ func (gsb *Balancer) latestBalancer() *balancerWrapper {
 func (gsb *Balancer) UpdateClientConnState(state balancer.ClientConnState) error {
 	// The resolver data is only relevant to the most recent LB Policy.
 	balToUpdate := gsb.latestBalancer()
-
 	gsbCfg, ok := state.BalancerConfig.(*lbConfig)
 	if ok {
 		// Switch to the child in the config unless it is already active.
diff --git a/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go b/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
index e8456a77c25..aa4505a871d 100644
--- a/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
+++ b/vendor/google.golang.org/grpc/internal/binarylog/method_logger.go
@@ -65,7 +65,7 @@ type TruncatingMethodLogger struct {
 	callID          uint64
 	idWithinCallGen *callIDGenerator
 
-	sink Sink // TODO(blog): make this plugable.
+	sink Sink // TODO(blog): make this pluggable.
 }
 
 // NewTruncatingMethodLogger returns a new truncating method logger.
@@ -80,7 +80,7 @@ func NewTruncatingMethodLogger(h, m uint64) *TruncatingMethodLogger {
 		callID:          idGen.next(),
 		idWithinCallGen: &callIDGenerator{},
 
-		sink: DefaultSink, // TODO(blog): make it plugable.
+		sink: DefaultSink, // TODO(blog): make it pluggable.
 	}
 }
 
@@ -397,7 +397,7 @@ func metadataKeyOmit(key string) bool {
 	switch key {
 	case "lb-token", ":path", ":authority", "content-encoding", "content-type", "user-agent", "te":
 		return true
-	case "grpc-trace-bin": // grpc-trace-bin is special because it's visiable to users.
+	case "grpc-trace-bin": // grpc-trace-bin is special because it's visible to users.
 		return false
 	}
 	return strings.HasPrefix(key, "grpc-")
diff --git a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
index 685a3cb41b1..9c915d9e4b2 100644
--- a/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
+++ b/vendor/google.golang.org/grpc/internal/envconfig/envconfig.go
@@ -28,9 +28,6 @@ import (
 var (
 	// TXTErrIgnore is set if TXT errors should be ignored ("GRPC_GO_IGNORE_TXT_ERRORS" is not "false").
 	TXTErrIgnore = boolFromEnv("GRPC_GO_IGNORE_TXT_ERRORS", true)
-	// AdvertiseCompressors is set if registered compressor should be advertised
-	// ("GRPC_GO_ADVERTISE_COMPRESSORS" is not "false").
-	AdvertiseCompressors = boolFromEnv("GRPC_GO_ADVERTISE_COMPRESSORS", true)
 	// RingHashCap indicates the maximum ring size which defaults to 4096
 	// entries but may be overridden by setting the environment variable
 	// "GRPC_RING_HASH_CAP".  This does not override the default bounds
diff --git a/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go b/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go
index 9f409096798..e8d866984b3 100644
--- a/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go
+++ b/vendor/google.golang.org/grpc/internal/grpcutil/compressor.go
@@ -20,8 +20,6 @@ package grpcutil
 
 import (
 	"strings"
-
-	"google.golang.org/grpc/internal/envconfig"
 )
 
 // RegisteredCompressorNames holds names of the registered compressors.
@@ -40,8 +38,5 @@ func IsCompressorNameRegistered(name string) bool {
 // RegisteredCompressors returns a string of registered compressor names
 // separated by comma.
 func RegisteredCompressors() string {
-	if !envconfig.AdvertiseCompressors {
-		return ""
-	}
 	return strings.Join(RegisteredCompressorNames, ",")
 }
diff --git a/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go b/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
index abab35e250e..f3f52a59a86 100644
--- a/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
+++ b/vendor/google.golang.org/grpc/internal/resolver/dns/dns_resolver.go
@@ -41,18 +41,24 @@ import (
 	"google.golang.org/grpc/serviceconfig"
 )
 
-// EnableSRVLookups controls whether the DNS resolver attempts to fetch gRPCLB
-// addresses from SRV records.  Must not be changed after init time.
-var EnableSRVLookups = false
-
-// ResolvingTimeout specifies the maximum duration for a DNS resolution request.
-// If the timeout expires before a response is received, the request will be canceled.
-//
-// It is recommended to set this value at application startup. Avoid modifying this variable
-// after initialization as it's not thread-safe for concurrent modification.
-var ResolvingTimeout = 30 * time.Second
-
-var logger = grpclog.Component("dns")
+var (
+	// EnableSRVLookups controls whether the DNS resolver attempts to fetch gRPCLB
+	// addresses from SRV records.  Must not be changed after init time.
+	EnableSRVLookups = false
+
+	// MinResolutionInterval is the minimum interval at which re-resolutions are
+	// allowed. This helps to prevent excessive re-resolution.
+	MinResolutionInterval = 30 * time.Second
+
+	// ResolvingTimeout specifies the maximum duration for a DNS resolution request.
+	// If the timeout expires before a response is received, the request will be canceled.
+	//
+	// It is recommended to set this value at application startup. Avoid modifying this variable
+	// after initialization as it's not thread-safe for concurrent modification.
+	ResolvingTimeout = 30 * time.Second
+
+	logger = grpclog.Component("dns")
+)
 
 func init() {
 	resolver.Register(NewBuilder())
@@ -208,7 +214,7 @@ func (d *dnsResolver) watcher() {
 			// Success resolving, wait for the next ResolveNow. However, also wait 30
 			// seconds at the very least to prevent constantly re-resolving.
 			backoffIndex = 1
-			waitTime = internal.MinResolutionRate
+			waitTime = MinResolutionInterval
 			select {
 			case <-d.ctx.Done():
 				return
diff --git a/vendor/google.golang.org/grpc/internal/resolver/dns/internal/internal.go b/vendor/google.golang.org/grpc/internal/resolver/dns/internal/internal.go
index c7fc557d00c..a7ecaf8d522 100644
--- a/vendor/google.golang.org/grpc/internal/resolver/dns/internal/internal.go
+++ b/vendor/google.golang.org/grpc/internal/resolver/dns/internal/internal.go
@@ -28,7 +28,7 @@ import (
 
 // NetResolver groups the methods on net.Resolver that are used by the DNS
 // resolver implementation. This allows the default net.Resolver instance to be
-// overidden from tests.
+// overridden from tests.
 type NetResolver interface {
 	LookupHost(ctx context.Context, host string) (addrs []string, err error)
 	LookupSRV(ctx context.Context, service, proto, name string) (cname string, addrs []*net.SRV, err error)
@@ -50,10 +50,6 @@ var (
 
 // The following vars are overridden from tests.
 var (
-	// MinResolutionRate is the minimum rate at which re-resolutions are
-	// allowed. This helps to prevent excessive re-resolution.
-	MinResolutionRate = 30 * time.Second
-
 	// TimeAfterFunc is used by the DNS resolver to wait for the given duration
 	// to elapse. In non-test code, this is implemented by time.After.  In test
 	// code, this can be used to control the amount of time the resolver is
diff --git a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
index 83c3829826a..3deadfb4a20 100644
--- a/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
+++ b/vendor/google.golang.org/grpc/internal/transport/controlbuf.go
@@ -193,7 +193,7 @@ type goAway struct {
 	code      http2.ErrCode
 	debugData []byte
 	headsUp   bool
-	closeConn error // if set, loopyWriter will exit, resulting in conn closure
+	closeConn error // if set, loopyWriter will exit with this error
 }
 
 func (*goAway) isTransportResponseFrame() bool { return false }
@@ -336,7 +336,7 @@ func (c *controlBuffer) put(it cbItem) error {
 	return err
 }
 
-func (c *controlBuffer) executeAndPut(f func(it any) bool, it cbItem) (bool, error) {
+func (c *controlBuffer) executeAndPut(f func() bool, it cbItem) (bool, error) {
 	var wakeUp bool
 	c.mu.Lock()
 	if c.err != nil {
@@ -344,7 +344,7 @@ func (c *controlBuffer) executeAndPut(f func(it any) bool, it cbItem) (bool, err
 		return false, c.err
 	}
 	if f != nil {
-		if !f(it) { // f wasn't successful
+		if !f() { // f wasn't successful
 			c.mu.Unlock()
 			return false, nil
 		}
@@ -495,21 +495,22 @@ type loopyWriter struct {
 	ssGoAwayHandler func(*goAway) (bool, error)
 }
 
-func newLoopyWriter(s side, fr *framer, cbuf *controlBuffer, bdpEst *bdpEstimator, conn net.Conn, logger *grpclog.PrefixLogger) *loopyWriter {
+func newLoopyWriter(s side, fr *framer, cbuf *controlBuffer, bdpEst *bdpEstimator, conn net.Conn, logger *grpclog.PrefixLogger, goAwayHandler func(*goAway) (bool, error)) *loopyWriter {
 	var buf bytes.Buffer
 	l := &loopyWriter{
-		side:          s,
-		cbuf:          cbuf,
-		sendQuota:     defaultWindowSize,
-		oiws:          defaultWindowSize,
-		estdStreams:   make(map[uint32]*outStream),
-		activeStreams: newOutStreamList(),
-		framer:        fr,
-		hBuf:          &buf,
-		hEnc:          hpack.NewEncoder(&buf),
-		bdpEst:        bdpEst,
-		conn:          conn,
-		logger:        logger,
+		side:            s,
+		cbuf:            cbuf,
+		sendQuota:       defaultWindowSize,
+		oiws:            defaultWindowSize,
+		estdStreams:     make(map[uint32]*outStream),
+		activeStreams:   newOutStreamList(),
+		framer:          fr,
+		hBuf:            &buf,
+		hEnc:            hpack.NewEncoder(&buf),
+		bdpEst:          bdpEst,
+		conn:            conn,
+		logger:          logger,
+		ssGoAwayHandler: goAwayHandler,
 	}
 	return l
 }
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_client.go b/vendor/google.golang.org/grpc/internal/transport/http2_client.go
index deba0c4d9ef..3c63c706986 100644
--- a/vendor/google.golang.org/grpc/internal/transport/http2_client.go
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_client.go
@@ -114,11 +114,11 @@ type http2Client struct {
 	streamQuota           int64
 	streamsQuotaAvailable chan struct{}
 	waitingStreams        uint32
-	nextID                uint32
 	registeredCompressors string
 
 	// Do not access controlBuf with mu held.
 	mu            sync.Mutex // guard the following variables
+	nextID        uint32
 	state         transportState
 	activeStreams map[uint32]*Stream
 	// prevGoAway ID records the Last-Stream-ID in the previous GOAway frame.
@@ -408,10 +408,10 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 	readerErrCh := make(chan error, 1)
 	go t.reader(readerErrCh)
 	defer func() {
-		if err == nil {
-			err = <-readerErrCh
-		}
 		if err != nil {
+			// writerDone should be closed since the loopy goroutine
+			// wouldn't have started in the case this function returns an error.
+			close(t.writerDone)
 			t.Close(err)
 		}
 	}()
@@ -458,8 +458,12 @@ func newHTTP2Client(connectCtx, ctx context.Context, addr resolver.Address, opts
 	if err := t.framer.writer.Flush(); err != nil {
 		return nil, err
 	}
+	// Block until the server preface is received successfully or an error occurs.
+	if err = <-readerErrCh; err != nil {
+		return nil, err
+	}
 	go func() {
-		t.loopy = newLoopyWriter(clientSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger)
+		t.loopy = newLoopyWriter(clientSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger, t.outgoingGoAwayHandler)
 		if err := t.loopy.run(); !isIOError(err) {
 			// Immediately close the connection, as the loopy writer returns
 			// when there are no more active streams and we were draining (the
@@ -517,6 +521,17 @@ func (t *http2Client) getPeer() *peer.Peer {
 	}
 }
 
+// OutgoingGoAwayHandler writes a GOAWAY to the connection.  Always returns (false, err) as we want the GoAway
+// to be the last frame loopy writes to the transport.
+func (t *http2Client) outgoingGoAwayHandler(g *goAway) (bool, error) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if err := t.framer.fr.WriteGoAway(t.nextID-2, http2.ErrCodeNo, g.debugData); err != nil {
+		return false, err
+	}
+	return false, g.closeConn
+}
+
 func (t *http2Client) createHeaderFields(ctx context.Context, callHdr *CallHdr) ([]hpack.HeaderField, error) {
 	aud := t.createAudience(callHdr)
 	ri := credentials.RequestInfo{
@@ -781,7 +796,7 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 	firstTry := true
 	var ch chan struct{}
 	transportDrainRequired := false
-	checkForStreamQuota := func(it any) bool {
+	checkForStreamQuota := func() bool {
 		if t.streamQuota <= 0 { // Can go negative if server decreases it.
 			if firstTry {
 				t.waitingStreams++
@@ -793,23 +808,24 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 			t.waitingStreams--
 		}
 		t.streamQuota--
-		h := it.(*headerFrame)
-		h.streamID = t.nextID
-		t.nextID += 2
-
-		// Drain client transport if nextID > MaxStreamID which signals gRPC that
-		// the connection is closed and a new one must be created for subsequent RPCs.
-		transportDrainRequired = t.nextID > MaxStreamID
 
-		s.id = h.streamID
-		s.fc = &inFlow{limit: uint32(t.initialWindowSize)}
 		t.mu.Lock()
 		if t.state == draining || t.activeStreams == nil { // Can be niled from Close().
 			t.mu.Unlock()
 			return false // Don't create a stream if the transport is already closed.
 		}
+
+		hdr.streamID = t.nextID
+		t.nextID += 2
+		// Drain client transport if nextID > MaxStreamID which signals gRPC that
+		// the connection is closed and a new one must be created for subsequent RPCs.
+		transportDrainRequired = t.nextID > MaxStreamID
+
+		s.id = hdr.streamID
+		s.fc = &inFlow{limit: uint32(t.initialWindowSize)}
 		t.activeStreams[s.id] = s
 		t.mu.Unlock()
+
 		if t.streamQuota > 0 && t.waitingStreams > 0 {
 			select {
 			case t.streamsQuotaAvailable <- struct{}{}:
@@ -819,13 +835,12 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 		return true
 	}
 	var hdrListSizeErr error
-	checkForHeaderListSize := func(it any) bool {
+	checkForHeaderListSize := func() bool {
 		if t.maxSendHeaderListSize == nil {
 			return true
 		}
-		hdrFrame := it.(*headerFrame)
 		var sz int64
-		for _, f := range hdrFrame.hf {
+		for _, f := range hdr.hf {
 			if sz += int64(f.Size()); sz > int64(*t.maxSendHeaderListSize) {
 				hdrListSizeErr = status.Errorf(codes.Internal, "header list size to send violates the maximum size (%d bytes) set by server", *t.maxSendHeaderListSize)
 				return false
@@ -834,8 +849,8 @@ func (t *http2Client) NewStream(ctx context.Context, callHdr *CallHdr) (*Stream,
 		return true
 	}
 	for {
-		success, err := t.controlBuf.executeAndPut(func(it any) bool {
-			return checkForHeaderListSize(it) && checkForStreamQuota(it)
+		success, err := t.controlBuf.executeAndPut(func() bool {
+			return checkForHeaderListSize() && checkForStreamQuota()
 		}, hdr)
 		if err != nil {
 			// Connection closed.
@@ -946,7 +961,7 @@ func (t *http2Client) closeStream(s *Stream, err error, rst bool, rstCode http2.
 		rst:     rst,
 		rstCode: rstCode,
 	}
-	addBackStreamQuota := func(any) bool {
+	addBackStreamQuota := func() bool {
 		t.streamQuota++
 		if t.streamQuota > 0 && t.waitingStreams > 0 {
 			select {
@@ -966,7 +981,7 @@ func (t *http2Client) closeStream(s *Stream, err error, rst bool, rstCode http2.
 
 // Close kicks off the shutdown process of the transport. This should be called
 // only once on a transport. Once it is called, the transport should not be
-// accessed any more.
+// accessed anymore.
 func (t *http2Client) Close(err error) {
 	t.mu.Lock()
 	// Make sure we only close once.
@@ -991,7 +1006,10 @@ func (t *http2Client) Close(err error) {
 		t.kpDormancyCond.Signal()
 	}
 	t.mu.Unlock()
-	t.controlBuf.finish()
+	// Per HTTP/2 spec, a GOAWAY frame must be sent before closing the
+	// connection. See https://httpwg.org/specs/rfc7540.html#GOAWAY.
+	t.controlBuf.put(&goAway{code: http2.ErrCodeNo, debugData: []byte("client transport shutdown"), closeConn: err})
+	<-t.writerDone
 	t.cancel()
 	t.conn.Close()
 	channelz.RemoveEntry(t.channelz.ID)
@@ -1099,7 +1117,7 @@ func (t *http2Client) updateWindow(s *Stream, n uint32) {
 // for the transport and the stream based on the current bdp
 // estimation.
 func (t *http2Client) updateFlowControl(n uint32) {
-	updateIWS := func(any) bool {
+	updateIWS := func() bool {
 		t.initialWindowSize = int32(n)
 		t.mu.Lock()
 		for _, s := range t.activeStreams {
@@ -1252,7 +1270,7 @@ func (t *http2Client) handleSettings(f *http2.SettingsFrame, isFirst bool) {
 		}
 		updateFuncs = append(updateFuncs, updateStreamQuota)
 	}
-	t.controlBuf.executeAndPut(func(any) bool {
+	t.controlBuf.executeAndPut(func() bool {
 		for _, f := range updateFuncs {
 			f()
 		}
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
index d582e047109..cab0e2d3d44 100644
--- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
@@ -330,8 +330,7 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 	t.handleSettings(sf)
 
 	go func() {
-		t.loopy = newLoopyWriter(serverSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger)
-		t.loopy.ssGoAwayHandler = t.outgoingGoAwayHandler
+		t.loopy = newLoopyWriter(serverSide, t.framer, t.controlBuf, t.bdpEst, t.conn, t.logger, t.outgoingGoAwayHandler)
 		err := t.loopy.run()
 		close(t.loopyWriterDone)
 		if !isIOError(err) {
@@ -860,7 +859,7 @@ func (t *http2Server) handleSettings(f *http2.SettingsFrame) {
 		}
 		return nil
 	})
-	t.controlBuf.executeAndPut(func(any) bool {
+	t.controlBuf.executeAndPut(func() bool {
 		for _, f := range updateFuncs {
 			f()
 		}
@@ -1014,12 +1013,13 @@ func (t *http2Server) writeHeaderLocked(s *Stream) error {
 		headerFields = append(headerFields, hpack.HeaderField{Name: "grpc-encoding", Value: s.sendCompress})
 	}
 	headerFields = appendHeaderFieldsFromMD(headerFields, s.header)
-	success, err := t.controlBuf.executeAndPut(t.checkForHeaderListSize, &headerFrame{
+	hf := &headerFrame{
 		streamID:  s.id,
 		hf:        headerFields,
 		endStream: false,
 		onWrite:   t.setResetPingStrikes,
-	})
+	}
+	success, err := t.controlBuf.executeAndPut(func() bool { return t.checkForHeaderListSize(hf) }, hf)
 	if !success {
 		if err != nil {
 			return err
@@ -1208,7 +1208,7 @@ func (t *http2Server) keepalive() {
 				continue
 			}
 			if outstandingPing && kpTimeoutLeft <= 0 {
-				t.Close(fmt.Errorf("keepalive ping not acked within timeout %s", t.kp.Time))
+				t.Close(fmt.Errorf("keepalive ping not acked within timeout %s", t.kp.Timeout))
 				return
 			}
 			if !outstandingPing {
diff --git a/vendor/google.golang.org/grpc/internal/transport/transport.go b/vendor/google.golang.org/grpc/internal/transport/transport.go
index 0d2a6e47f67..4b39c0ade97 100644
--- a/vendor/google.golang.org/grpc/internal/transport/transport.go
+++ b/vendor/google.golang.org/grpc/internal/transport/transport.go
@@ -304,7 +304,7 @@ func (s *Stream) isHeaderSent() bool {
 }
 
 // updateHeaderSent updates headerSent and returns true
-// if it was alreay set. It is valid only on server-side.
+// if it was already set. It is valid only on server-side.
 func (s *Stream) updateHeaderSent() bool {
 	return atomic.SwapUint32(&s.headerSent, 1) == 1
 }
diff --git a/vendor/google.golang.org/grpc/metadata/metadata.go b/vendor/google.golang.org/grpc/metadata/metadata.go
index 1e9485fd6e2..6c01a9b359c 100644
--- a/vendor/google.golang.org/grpc/metadata/metadata.go
+++ b/vendor/google.golang.org/grpc/metadata/metadata.go
@@ -90,6 +90,21 @@ func Pairs(kv ...string) MD {
 	return md
 }
 
+// String implements the Stringer interface for pretty-printing a MD.
+// Ordering of the values is non-deterministic as it ranges over a map.
+func (md MD) String() string {
+	var sb strings.Builder
+	fmt.Fprintf(&sb, "MD{")
+	for k, v := range md {
+		if sb.Len() > 3 {
+			fmt.Fprintf(&sb, ", ")
+		}
+		fmt.Fprintf(&sb, "%s=[%s]", k, strings.Join(v, ", "))
+	}
+	fmt.Fprintf(&sb, "}")
+	return sb.String()
+}
+
 // Len returns the number of items in md.
 func (md MD) Len() int {
 	return len(md)
diff --git a/vendor/google.golang.org/grpc/peer/peer.go b/vendor/google.golang.org/grpc/peer/peer.go
index a821ff9b2b7..499a49c8c1c 100644
--- a/vendor/google.golang.org/grpc/peer/peer.go
+++ b/vendor/google.golang.org/grpc/peer/peer.go
@@ -22,7 +22,9 @@ package peer
 
 import (
 	"context"
+	"fmt"
 	"net"
+	"strings"
 
 	"google.golang.org/grpc/credentials"
 )
@@ -39,6 +41,34 @@ type Peer struct {
 	AuthInfo credentials.AuthInfo
 }
 
+// String ensures the Peer types implements the Stringer interface in order to
+// allow to print a context with a peerKey value effectively.
+func (p *Peer) String() string {
+	if p == nil {
+		return "Peer<nil>"
+	}
+	sb := &strings.Builder{}
+	sb.WriteString("Peer{")
+	if p.Addr != nil {
+		fmt.Fprintf(sb, "Addr: '%s', ", p.Addr.String())
+	} else {
+		fmt.Fprintf(sb, "Addr: <nil>, ")
+	}
+	if p.LocalAddr != nil {
+		fmt.Fprintf(sb, "LocalAddr: '%s', ", p.LocalAddr.String())
+	} else {
+		fmt.Fprintf(sb, "LocalAddr: <nil>, ")
+	}
+	if p.AuthInfo != nil {
+		fmt.Fprintf(sb, "AuthInfo: '%s'", p.AuthInfo.AuthType())
+	} else {
+		fmt.Fprintf(sb, "AuthInfo: <nil>")
+	}
+	sb.WriteString("}")
+
+	return sb.String()
+}
+
 type peerKey struct{}
 
 // NewContext creates a new context with peer information attached.
diff --git a/vendor/google.golang.org/grpc/picker_wrapper.go b/vendor/google.golang.org/grpc/picker_wrapper.go
index bf56faa76d3..56e8aba783f 100644
--- a/vendor/google.golang.org/grpc/picker_wrapper.go
+++ b/vendor/google.golang.org/grpc/picker_wrapper.go
@@ -20,6 +20,7 @@ package grpc
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"sync"
 
@@ -117,7 +118,7 @@ func (pw *pickerWrapper) pick(ctx context.Context, failfast bool, info balancer.
 				if lastPickErr != nil {
 					errStr = "latest balancer error: " + lastPickErr.Error()
 				} else {
-					errStr = ctx.Err().Error()
+					errStr = fmt.Sprintf("received context error while waiting for new LB policy update: %s", ctx.Err().Error())
 				}
 				switch ctx.Err() {
 				case context.DeadlineExceeded:
diff --git a/vendor/google.golang.org/grpc/pickfirst.go b/vendor/google.golang.org/grpc/pickfirst.go
index e3ea42ba962..8853626614e 100644
--- a/vendor/google.golang.org/grpc/pickfirst.go
+++ b/vendor/google.golang.org/grpc/pickfirst.go
@@ -54,7 +54,7 @@ type pfConfig struct {
 	serviceconfig.LoadBalancingConfig `json:"-"`
 
 	// If set to true, instructs the LB policy to shuffle the order of the list
-	// of addresses received from the name resolver before attempting to
+	// of endpoints received from the name resolver before attempting to
 	// connect to them.
 	ShuffleAddressList bool `json:"shuffleAddressList"`
 }
@@ -94,8 +94,7 @@ func (b *pickfirstBalancer) ResolverError(err error) {
 }
 
 func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState) error {
-	addrs := state.ResolverState.Addresses
-	if len(addrs) == 0 {
+	if len(state.ResolverState.Addresses) == 0 && len(state.ResolverState.Endpoints) == 0 {
 		// The resolver reported an empty address list. Treat it like an error by
 		// calling b.ResolverError.
 		if b.subConn != nil {
@@ -107,22 +106,49 @@ func (b *pickfirstBalancer) UpdateClientConnState(state balancer.ClientConnState
 		b.ResolverError(errors.New("produced zero addresses"))
 		return balancer.ErrBadResolverState
 	}
-
 	// We don't have to guard this block with the env var because ParseConfig
 	// already does so.
 	cfg, ok := state.BalancerConfig.(pfConfig)
 	if state.BalancerConfig != nil && !ok {
 		return fmt.Errorf("pickfirst: received illegal BalancerConfig (type %T): %v", state.BalancerConfig, state.BalancerConfig)
 	}
-	if cfg.ShuffleAddressList {
-		addrs = append([]resolver.Address{}, addrs...)
-		grpcrand.Shuffle(len(addrs), func(i, j int) { addrs[i], addrs[j] = addrs[j], addrs[i] })
-	}
 
 	if b.logger.V(2) {
 		b.logger.Infof("Received new config %s, resolver state %s", pretty.ToJSON(cfg), pretty.ToJSON(state.ResolverState))
 	}
 
+	var addrs []resolver.Address
+	if endpoints := state.ResolverState.Endpoints; len(endpoints) != 0 {
+		// Perform the optional shuffling described in gRFC A62. The shuffling will
+		// change the order of endpoints but not touch the order of the addresses
+		// within each endpoint. - A61
+		if cfg.ShuffleAddressList {
+			endpoints = append([]resolver.Endpoint{}, endpoints...)
+			grpcrand.Shuffle(len(endpoints), func(i, j int) { endpoints[i], endpoints[j] = endpoints[j], endpoints[i] })
+		}
+
+		// "Flatten the list by concatenating the ordered list of addresses for each
+		// of the endpoints, in order." - A61
+		for _, endpoint := range endpoints {
+			// "In the flattened list, interleave addresses from the two address
+			// families, as per RFC-8304 section 4." - A61
+			// TODO: support the above language.
+			addrs = append(addrs, endpoint.Addresses...)
+		}
+	} else {
+		// Endpoints not set, process addresses until we migrate resolver
+		// emissions fully to Endpoints. The top channel does wrap emitted
+		// addresses with endpoints, however some balancers such as weighted
+		// target do not forwarrd the corresponding correct endpoints down/split
+		// endpoints properly. Once all balancers correctly forward endpoints
+		// down, can delete this else conditional.
+		addrs = state.ResolverState.Addresses
+		if cfg.ShuffleAddressList {
+			addrs = append([]resolver.Address{}, addrs...)
+			grpcrand.Shuffle(len(addrs), func(i, j int) { addrs[i], addrs[j] = addrs[j], addrs[i] })
+		}
+	}
+
 	if b.subConn != nil {
 		b.cc.UpdateAddresses(b.subConn, addrs)
 		return nil
diff --git a/vendor/google.golang.org/grpc/regenerate.sh b/vendor/google.golang.org/grpc/regenerate.sh
index a6f26c8ab0f..3edca296c22 100644
--- a/vendor/google.golang.org/grpc/regenerate.sh
+++ b/vendor/google.golang.org/grpc/regenerate.sh
@@ -63,7 +63,7 @@ LEGACY_SOURCES=(
 
 # Generates only the new gRPC Service symbols
 SOURCES=(
-  $(git ls-files --exclude-standard --cached --others "*.proto" | grep -v '^\(profiling/proto/service.proto\|reflection/grpc_reflection_v1alpha/reflection.proto\)$')
+  $(git ls-files --exclude-standard --cached --others "*.proto" | grep -v '^profiling/proto/service.proto$')
   ${WORKDIR}/grpc-proto/grpc/gcp/altscontext.proto
   ${WORKDIR}/grpc-proto/grpc/gcp/handshaker.proto
   ${WORKDIR}/grpc-proto/grpc/gcp/transport_security_common.proto
@@ -93,7 +93,7 @@ Mgrpc/testing/empty.proto=google.golang.org/grpc/interop/grpc_testing
 
 for src in ${SOURCES[@]}; do
   echo "protoc ${src}"
-  protoc --go_out=${OPTS}:${WORKDIR}/out --go-grpc_out=${OPTS}:${WORKDIR}/out \
+  protoc --go_out=${OPTS}:${WORKDIR}/out --go-grpc_out=${OPTS},use_generic_streams_experimental=true:${WORKDIR}/out \
     -I"." \
     -I${WORKDIR}/grpc-proto \
     -I${WORKDIR}/googleapis \
@@ -118,6 +118,6 @@ mv ${WORKDIR}/out/google.golang.org/grpc/lookup/grpc_lookup_v1/* ${WORKDIR}/out/
 
 # grpc_testing_not_regenerate/*.pb.go are not re-generated,
 # see grpc_testing_not_regenerate/README.md for details.
-rm ${WORKDIR}/out/google.golang.org/grpc/reflection/grpc_testing_not_regenerate/*.pb.go
+rm ${WORKDIR}/out/google.golang.org/grpc/reflection/test/grpc_testing_not_regenerate/*.pb.go
 
 cp -R ${WORKDIR}/out/google.golang.org/grpc/* .
diff --git a/vendor/google.golang.org/grpc/resolver/dns/dns_resolver.go b/vendor/google.golang.org/grpc/resolver/dns/dns_resolver.go
index b54a3a3225d..ef3d6ed6c43 100644
--- a/vendor/google.golang.org/grpc/resolver/dns/dns_resolver.go
+++ b/vendor/google.golang.org/grpc/resolver/dns/dns_resolver.go
@@ -18,9 +18,6 @@
 
 // Package dns implements a dns resolver to be installed as the default resolver
 // in grpc.
-//
-// Deprecated: this package is imported by grpc and should not need to be
-// imported directly by users.
 package dns
 
 import (
@@ -52,3 +49,12 @@ func SetResolvingTimeout(timeout time.Duration) {
 func NewBuilder() resolver.Builder {
 	return dns.NewBuilder()
 }
+
+// SetMinResolutionInterval sets the default minimum interval at which DNS
+// re-resolutions are allowed. This helps to prevent excessive re-resolution.
+//
+// It must be called only at application startup, before any gRPC calls are
+// made. Modifying this value after initialization is not thread-safe.
+func SetMinResolutionInterval(d time.Duration) {
+	dns.MinResolutionInterval = d
+}
diff --git a/vendor/google.golang.org/grpc/rpc_util.go b/vendor/google.golang.org/grpc/rpc_util.go
index 998e251ddc4..fdd49e6e915 100644
--- a/vendor/google.golang.org/grpc/rpc_util.go
+++ b/vendor/google.golang.org/grpc/rpc_util.go
@@ -964,7 +964,7 @@ func setCallInfoCodec(c *callInfo) error {
 
 // The SupportPackageIsVersion variables are referenced from generated protocol
 // buffer files to ensure compatibility with the gRPC version used.  The latest
-// support package version is 7.
+// support package version is 9.
 //
 // Older versions are kept for compatibility.
 //
@@ -976,6 +976,7 @@ const (
 	SupportPackageIsVersion6 = true
 	SupportPackageIsVersion7 = true
 	SupportPackageIsVersion8 = true
+	SupportPackageIsVersion9 = true
 )
 
 const grpcUA = "grpc-go/" + Version
diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go
index fd4558daa52..89f8e4792bf 100644
--- a/vendor/google.golang.org/grpc/server.go
+++ b/vendor/google.golang.org/grpc/server.go
@@ -527,12 +527,22 @@ func ConnectionTimeout(d time.Duration) ServerOption {
 	})
 }
 
+// MaxHeaderListSizeServerOption is a ServerOption that sets the max
+// (uncompressed) size of header list that the server is prepared to accept.
+type MaxHeaderListSizeServerOption struct {
+	MaxHeaderListSize uint32
+}
+
+func (o MaxHeaderListSizeServerOption) apply(so *serverOptions) {
+	so.maxHeaderListSize = &o.MaxHeaderListSize
+}
+
 // MaxHeaderListSize returns a ServerOption that sets the max (uncompressed) size
 // of header list that the server is prepared to accept.
 func MaxHeaderListSize(s uint32) ServerOption {
-	return newFuncServerOption(func(o *serverOptions) {
-		o.maxHeaderListSize = &s
-	})
+	return MaxHeaderListSizeServerOption{
+		MaxHeaderListSize: s,
+	}
 }
 
 // HeaderTableSize returns a ServerOption that sets the size of dynamic
diff --git a/vendor/google.golang.org/grpc/service_config.go b/vendor/google.golang.org/grpc/service_config.go
index 2b35c5d2130..9da8fc8027d 100644
--- a/vendor/google.golang.org/grpc/service_config.go
+++ b/vendor/google.golang.org/grpc/service_config.go
@@ -172,7 +172,7 @@ func parseServiceConfig(js string) *serviceconfig.ParseResult {
 	var rsc jsonSC
 	err := json.Unmarshal([]byte(js), &rsc)
 	if err != nil {
-		logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
+		logger.Warningf("grpc: unmarshalling service config %s: %v", js, err)
 		return &serviceconfig.ParseResult{Err: err}
 	}
 	sc := ServiceConfig{
@@ -219,7 +219,7 @@ func parseServiceConfig(js string) *serviceconfig.ParseResult {
 			Timeout:      (*time.Duration)(m.Timeout),
 		}
 		if mc.RetryPolicy, err = convertRetryPolicy(m.RetryPolicy); err != nil {
-			logger.Warningf("grpc: unmarshaling service config %s: %v", js, err)
+			logger.Warningf("grpc: unmarshalling service config %s: %v", js, err)
 			return &serviceconfig.ParseResult{Err: err}
 		}
 		if m.MaxRequestMessageBytes != nil {
@@ -239,13 +239,13 @@ func parseServiceConfig(js string) *serviceconfig.ParseResult {
 		for i, n := range *m.Name {
 			path, err := n.generatePath()
 			if err != nil {
-				logger.Warningf("grpc: error unmarshaling service config %s due to methodConfig[%d]: %v", js, i, err)
+				logger.Warningf("grpc: error unmarshalling service config %s due to methodConfig[%d]: %v", js, i, err)
 				return &serviceconfig.ParseResult{Err: err}
 			}
 
 			if _, ok := paths[path]; ok {
 				err = errDuplicatedName
-				logger.Warningf("grpc: error unmarshaling service config %s due to methodConfig[%d]: %v", js, i, err)
+				logger.Warningf("grpc: error unmarshalling service config %s due to methodConfig[%d]: %v", js, i, err)
 				return &serviceconfig.ParseResult{Err: err}
 			}
 			paths[path] = struct{}{}
diff --git a/vendor/google.golang.org/grpc/stats/stats.go b/vendor/google.golang.org/grpc/stats/stats.go
index 4ab70e2d462..fdb0bd65182 100644
--- a/vendor/google.golang.org/grpc/stats/stats.go
+++ b/vendor/google.golang.org/grpc/stats/stats.go
@@ -73,9 +73,12 @@ func (*PickerUpdated) isRPCStats() {}
 type InPayload struct {
 	// Client is true if this InPayload is from client side.
 	Client bool
-	// Payload is the payload with original type.
+	// Payload is the payload with original type.  This may be modified after
+	// the call to HandleRPC which provides the InPayload returns and must be
+	// copied if needed later.
 	Payload any
 	// Data is the serialized message payload.
+	// Deprecated: Data will be removed in the next release.
 	Data []byte
 
 	// Length is the size of the uncompressed payload data. Does not include any
@@ -143,9 +146,12 @@ func (s *InTrailer) isRPCStats() {}
 type OutPayload struct {
 	// Client is true if this OutPayload is from client side.
 	Client bool
-	// Payload is the payload with original type.
+	// Payload is the payload with original type.  This may be modified after
+	// the call to HandleRPC which provides the OutPayload returns and must be
+	// copied if needed later.
 	Payload any
 	// Data is the serialized message payload.
+	// Deprecated: Data will be removed in the next release.
 	Data []byte
 	// Length is the size of the uncompressed payload data. Does not include any
 	// framing (gRPC or HTTP/2).
diff --git a/vendor/google.golang.org/grpc/stream.go b/vendor/google.golang.org/grpc/stream.go
index d939ffc6348..b54563e81cd 100644
--- a/vendor/google.golang.org/grpc/stream.go
+++ b/vendor/google.golang.org/grpc/stream.go
@@ -516,6 +516,7 @@ func (a *csAttempt) newStream() error {
 		return toRPCErr(nse.Err)
 	}
 	a.s = s
+	a.ctx = s.Context()
 	a.p = &parser{r: s, recvBufferPool: a.cs.cc.dopts.recvBufferPool}
 	return nil
 }
diff --git a/vendor/google.golang.org/grpc/stream_interfaces.go b/vendor/google.golang.org/grpc/stream_interfaces.go
new file mode 100644
index 00000000000..8b813529c0c
--- /dev/null
+++ b/vendor/google.golang.org/grpc/stream_interfaces.go
@@ -0,0 +1,152 @@
+/*
+ *
+ * Copyright 2024 gRPC authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+package grpc
+
+// ServerStreamingClient represents the client side of a server-streaming (one
+// request, many responses) RPC. It is generic over the type of the response
+// message. It is used in generated code.
+type ServerStreamingClient[Res any] interface {
+	Recv() (*Res, error)
+	ClientStream
+}
+
+// ServerStreamingServer represents the server side of a server-streaming (one
+// request, many responses) RPC. It is generic over the type of the response
+// message. It is used in generated code.
+type ServerStreamingServer[Res any] interface {
+	Send(*Res) error
+	ServerStream
+}
+
+// ClientStreamingClient represents the client side of a client-streaming (many
+// requests, one response) RPC. It is generic over both the type of the request
+// message stream and the type of the unary response message. It is used in
+// generated code.
+type ClientStreamingClient[Req any, Res any] interface {
+	Send(*Req) error
+	CloseAndRecv() (*Res, error)
+	ClientStream
+}
+
+// ClientStreamingServer represents the server side of a client-streaming (many
+// requests, one response) RPC. It is generic over both the type of the request
+// message stream and the type of the unary response message. It is used in
+// generated code.
+type ClientStreamingServer[Req any, Res any] interface {
+	Recv() (*Req, error)
+	SendAndClose(*Res) error
+	ServerStream
+}
+
+// BidiStreamingClient represents the client side of a bidirectional-streaming
+// (many requests, many responses) RPC. It is generic over both the type of the
+// request message stream and the type of the response message stream. It is
+// used in generated code.
+type BidiStreamingClient[Req any, Res any] interface {
+	Send(*Req) error
+	Recv() (*Res, error)
+	ClientStream
+}
+
+// BidiStreamingServer represents the server side of a bidirectional-streaming
+// (many requests, many responses) RPC. It is generic over both the type of the
+// request message stream and the type of the response message stream. It is
+// used in generated code.
+type BidiStreamingServer[Req any, Res any] interface {
+	Recv() (*Req, error)
+	Send(*Res) error
+	ServerStream
+}
+
+// GenericClientStream implements the ServerStreamingClient, ClientStreamingClient,
+// and BidiStreamingClient interfaces. It is used in generated code.
+type GenericClientStream[Req any, Res any] struct {
+	ClientStream
+}
+
+var _ ServerStreamingClient[string] = (*GenericClientStream[int, string])(nil)
+var _ ClientStreamingClient[int, string] = (*GenericClientStream[int, string])(nil)
+var _ BidiStreamingClient[int, string] = (*GenericClientStream[int, string])(nil)
+
+// Send pushes one message into the stream of requests to be consumed by the
+// server. The type of message which can be sent is determined by the Req type
+// parameter of the GenericClientStream receiver.
+func (x *GenericClientStream[Req, Res]) Send(m *Req) error {
+	return x.ClientStream.SendMsg(m)
+}
+
+// Recv reads one message from the stream of responses generated by the server.
+// The type of the message returned is determined by the Res type parameter
+// of the GenericClientStream receiver.
+func (x *GenericClientStream[Req, Res]) Recv() (*Res, error) {
+	m := new(Res)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// CloseAndRecv closes the sending side of the stream, then receives the unary
+// response from the server. The type of message which it returns is determined
+// by the Res type parameter of the GenericClientStream receiver.
+func (x *GenericClientStream[Req, Res]) CloseAndRecv() (*Res, error) {
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	m := new(Res)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// GenericServerStream implements the ServerStreamingServer, ClientStreamingServer,
+// and BidiStreamingServer interfaces. It is used in generated code.
+type GenericServerStream[Req any, Res any] struct {
+	ServerStream
+}
+
+var _ ServerStreamingServer[string] = (*GenericServerStream[int, string])(nil)
+var _ ClientStreamingServer[int, string] = (*GenericServerStream[int, string])(nil)
+var _ BidiStreamingServer[int, string] = (*GenericServerStream[int, string])(nil)
+
+// Send pushes one message into the stream of responses to be consumed by the
+// client. The type of message which can be sent is determined by the Res
+// type parameter of the serverStreamServer receiver.
+func (x *GenericServerStream[Req, Res]) Send(m *Res) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+// SendAndClose pushes the unary response to the client. The type of message
+// which can be sent is determined by the Res type parameter of the
+// clientStreamServer receiver.
+func (x *GenericServerStream[Req, Res]) SendAndClose(m *Res) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+// Recv reads one message from the stream of requests generated by the client.
+// The type of the message returned is determined by the Req type parameter
+// of the clientStreamServer receiver.
+func (x *GenericServerStream[Req, Res]) Recv() (*Req, error) {
+	m := new(Req)
+	if err := x.ServerStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go
index 2556f758386..e1806e76000 100644
--- a/vendor/google.golang.org/grpc/version.go
+++ b/vendor/google.golang.org/grpc/version.go
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.63.2"
+const Version = "1.64.0"
diff --git a/vendor/google.golang.org/grpc/vet.sh b/vendor/google.golang.org/grpc/vet.sh
deleted file mode 100644
index 7e6b92e491a..00000000000
--- a/vendor/google.golang.org/grpc/vet.sh
+++ /dev/null
@@ -1,195 +0,0 @@
-#!/bin/bash
-
-set -ex  # Exit on error; debugging enabled.
-set -o pipefail  # Fail a pipe if any sub-command fails.
-
-# not makes sure the command passed to it does not exit with a return code of 0.
-not() {
-  # This is required instead of the earlier (! $COMMAND) because subshells and
-  # pipefail don't work the same on Darwin as in Linux.
-  ! "$@"
-}
-
-die() {
-  echo "$@" >&2
-  exit 1
-}
-
-fail_on_output() {
-  tee /dev/stderr | not read
-}
-
-# Check to make sure it's safe to modify the user's git repo.
-git status --porcelain | fail_on_output
-
-# Undo any edits made by this script.
-cleanup() {
-  git reset --hard HEAD
-}
-trap cleanup EXIT
-
-PATH="${HOME}/go/bin:${GOROOT}/bin:${PATH}"
-go version
-
-if [[ "$1" = "-install" ]]; then
-  # Install the pinned versions as defined in module tools.
-  pushd ./test/tools
-  go install \
-    golang.org/x/tools/cmd/goimports \
-    honnef.co/go/tools/cmd/staticcheck \
-    github.com/client9/misspell/cmd/misspell
-  popd
-  if [[ -z "${VET_SKIP_PROTO}" ]]; then
-    if [[ "${GITHUB_ACTIONS}" = "true" ]]; then
-      PROTOBUF_VERSION=25.2 # a.k.a. v4.22.0 in pb.go files.
-      PROTOC_FILENAME=protoc-${PROTOBUF_VERSION}-linux-x86_64.zip
-      pushd /home/runner/go
-      wget https://github.com/google/protobuf/releases/download/v${PROTOBUF_VERSION}/${PROTOC_FILENAME}
-      unzip ${PROTOC_FILENAME}
-      bin/protoc --version
-      popd
-    elif not which protoc > /dev/null; then
-      die "Please install protoc into your path"
-    fi
-  fi
-  exit 0
-elif [[ "$#" -ne 0 ]]; then
-  die "Unknown argument(s): $*"
-fi
-
-# - Check that generated proto files are up to date.
-if [[ -z "${VET_SKIP_PROTO}" ]]; then
-  make proto && git status --porcelain 2>&1 | fail_on_output || \
-    (git status; git --no-pager diff; exit 1)
-fi
-
-if [[ -n "${VET_ONLY_PROTO}" ]]; then
-  exit 0
-fi
-
-# - Ensure all source files contain a copyright message.
-# (Done in two parts because Darwin "git grep" has broken support for compound
-# exclusion matches.)
-(grep -L "DO NOT EDIT" $(git grep -L "\(Copyright [0-9]\{4,\} gRPC authors\)" -- '*.go') || true) | fail_on_output
-
-# - Make sure all tests in grpc and grpc/test use leakcheck via Teardown.
-not grep 'func Test[^(]' *_test.go
-not grep 'func Test[^(]' test/*.go
-
-# - Check for typos in test function names
-git grep 'func (s) ' -- "*_test.go" | not grep -v 'func (s) Test'
-git grep 'func [A-Z]' -- "*_test.go" | not grep -v 'func Test\|Benchmark\|Example'
-
-# - Do not import x/net/context.
-not git grep -l 'x/net/context' -- "*.go"
-
-# - Do not use time.After except in tests.  It has the potential to leak the
-#   timer since there is no way to stop it early.
-git grep -l 'time.After(' -- "*.go" | not grep -v '_test.go\|test_utils\|testutils'
-
-# - Do not import math/rand for real library code.  Use internal/grpcrand for
-#   thread safety.
-git grep -l '"math/rand"' -- "*.go" 2>&1 | not grep -v '^examples\|^interop/stress\|grpcrand\|^benchmark\|wrr_test'
-
-# - Do not use "interface{}"; use "any" instead.
-git grep -l 'interface{}' -- "*.go" 2>&1 | not grep -v '\.pb\.go\|protoc-gen-go-grpc\|grpc_testing_not_regenerate'
-
-# - Do not call grpclog directly. Use grpclog.Component instead.
-git grep -l -e 'grpclog.I' --or -e 'grpclog.W' --or -e 'grpclog.E' --or -e 'grpclog.F' --or -e 'grpclog.V' -- "*.go" | not grep -v '^grpclog/component.go\|^internal/grpctest/tlogger_test.go'
-
-# - Ensure all ptypes proto packages are renamed when importing.
-not git grep "\(import \|^\s*\)\"github.com/golang/protobuf/ptypes/" -- "*.go"
-
-# - Ensure all usages of grpc_testing package are renamed when importing.
-not git grep "\(import \|^\s*\)\"google.golang.org/grpc/interop/grpc_testing" -- "*.go"
-
-# - Ensure all xds proto imports are renamed to *pb or *grpc.
-git grep '"github.com/envoyproxy/go-control-plane/envoy' -- '*.go' ':(exclude)*.pb.go' | not grep -v 'pb "\|grpc "'
-
-misspell -error .
-
-# - gofmt, goimports, go vet, go mod tidy.
-# Perform these checks on each module inside gRPC.
-for MOD_FILE in $(find . -name 'go.mod'); do
-  MOD_DIR=$(dirname ${MOD_FILE})
-  pushd ${MOD_DIR}
-  go vet -all ./... | fail_on_output
-  gofmt -s -d -l . 2>&1 | fail_on_output
-  goimports -l . 2>&1 | not grep -vE "\.pb\.go"
-
-  go mod tidy -compat=1.19
-  git status --porcelain 2>&1 | fail_on_output || \
-    (git status; git --no-pager diff; exit 1)
-  popd
-done
-
-# - Collection of static analysis checks
-SC_OUT="$(mktemp)"
-staticcheck -go 1.19 -checks 'all' ./... > "${SC_OUT}" || true
-
-# Error for anything other than checks that need exclusions.
-grep -v "(ST1000)" "${SC_OUT}" | grep -v "(SA1019)" | grep -v "(ST1003)" | not grep -v "(ST1019)\|\(other import of\)"
-
-# Exclude underscore checks for generated code.
-grep "(ST1003)" "${SC_OUT}" | not grep -v '\(.pb.go:\)\|\(code_string_test.go:\)\|\(grpc_testing_not_regenerate\)'
-
-# Error for duplicate imports not including grpc protos.
-grep "(ST1019)\|\(other import of\)" "${SC_OUT}" | not grep -Fv 'XXXXX PleaseIgnoreUnused
-channelz/grpc_channelz_v1"
-go-control-plane/envoy
-grpclb/grpc_lb_v1"
-health/grpc_health_v1"
-interop/grpc_testing"
-orca/v3"
-proto/grpc_gcp"
-proto/grpc_lookup_v1"
-reflection/grpc_reflection_v1"
-reflection/grpc_reflection_v1alpha"
-XXXXX PleaseIgnoreUnused'
-
-# Error for any package comments not in generated code.
-grep "(ST1000)" "${SC_OUT}" | not grep -v "\.pb\.go:"
-
-# Only ignore the following deprecated types/fields/functions and exclude
-# generated code.
-grep "(SA1019)" "${SC_OUT}" | not grep -Fv 'XXXXX PleaseIgnoreUnused
-XXXXX Protobuf related deprecation errors:
-"github.com/golang/protobuf
-.pb.go:
-grpc_testing_not_regenerate
-: ptypes.
-proto.RegisterType
-XXXXX gRPC internal usage deprecation errors:
-"google.golang.org/grpc
-: grpc.
-: v1alpha.
-: v1alphareflectionpb.
-BalancerAttributes is deprecated:
-CredsBundle is deprecated:
-Metadata is deprecated: use Attributes instead.
-NewSubConn is deprecated:
-OverrideServerName is deprecated:
-RemoveSubConn is deprecated:
-SecurityVersion is deprecated:
-Target is deprecated: Use the Target field in the BuildOptions instead.
-UpdateAddresses is deprecated:
-UpdateSubConnState is deprecated:
-balancer.ErrTransientFailure is deprecated:
-grpc/reflection/v1alpha/reflection.proto
-SwitchTo is deprecated:
-XXXXX xDS deprecated fields we support
-.ExactMatch
-.PrefixMatch
-.SafeRegexMatch
-.SuffixMatch
-GetContainsMatch
-GetExactMatch
-GetMatchSubjectAltNames
-GetPrefixMatch
-GetSafeRegexMatch
-GetSuffixMatch
-GetTlsCertificateCertificateProviderInstance
-GetValidationContextCertificateProviderInstance
-XXXXX PleaseIgnoreUnused'
-
-echo SUCCESS
diff --git a/vendor/modules.txt b/vendor/modules.txt
index fd1dc9db403..1d330bf2533 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -410,14 +410,14 @@ golang.org/x/tools/internal/tokeninternal
 golang.org/x/tools/internal/typeparams
 golang.org/x/tools/internal/typesinternal
 golang.org/x/tools/internal/versions
-# google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de
+# google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237
 ## explicit; go 1.19
 google.golang.org/genproto/googleapis/api/httpbody
 # google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda
 ## explicit; go 1.19
 google.golang.org/genproto/googleapis/rpc/errdetails
 google.golang.org/genproto/googleapis/rpc/status
-# google.golang.org/grpc v1.63.2
+# google.golang.org/grpc v1.64.0
 ## explicit; go 1.19
 google.golang.org/grpc
 google.golang.org/grpc/attributes