diff --git a/nebius/mk8s/v1/cluster.proto b/nebius/mk8s/v1/cluster.proto
index 26771a5..b2b6706 100644
--- a/nebius/mk8s/v1/cluster.proto
+++ b/nebius/mk8s/v1/cluster.proto
@@ -46,8 +46,10 @@ message ClusterSpec {
 }
 
 message ControlPlaneSpec {
-  // Desired Kubernetes version of the cluster. For now only acceptable format is
-  // `<major>.<minor>` like "1.31". Option for patch version update will be added later.
+  // Desired Kubernetes version of the cluster. May be lower than the actual cluster version
+  // if the desired version is no longer supported and the cluster has been automatically updated.
+  // For now only acceptable format is `<major>.<minor>` like "1.31".
+  // Option for patch version update will be added later.
   string version = 1 [(buf.validate.field) = {
     string: {pattern: "|^\\d\\.\\d\\d$"}
   }];
diff --git a/nebius/storage/v1/bucket.proto b/nebius/storage/v1/bucket.proto
index 73935cb..9c4829b 100644
--- a/nebius/storage/v1/bucket.proto
+++ b/nebius/storage/v1/bucket.proto
@@ -10,6 +10,7 @@ import "nebius/storage/v1/base.proto";
 import "nebius/storage/v1/bucket_counters.proto";
 import "nebius/storage/v1/bucket_policy.proto";
 import "nebius/storage/v1/cors.proto";
+import "nebius/storage/v1/insecure_endpoint.proto";
 import "nebius/storage/v1/lifecycle.proto";
 
 option go_package = "github.com/nebius/gosdk/proto/nebius/storage/v1";
@@ -126,4 +127,8 @@ message BucketStatus {
   // Indicator flag showing whether the bucket has any BucketPolicy rule
   // that grants anonymous access to any object, prefix, or the entire bucket.
   bool anonymous_access_enabled = 9;
+
+  // Insecure endpoint mode shows whether plain HTTP (without TLS) is forbidden, allowed for traffic from the
+  // same region or allowed from everywhere.
+  InsecureEndpoint insecure_endpoint = 10;
 }
diff --git a/nebius/storage/v1/insecure_endpoint.proto b/nebius/storage/v1/insecure_endpoint.proto
new file mode 100644
index 0000000..b76db20
--- /dev/null
+++ b/nebius/storage/v1/insecure_endpoint.proto
@@ -0,0 +1,27 @@
+syntax = "proto3";
+
+package nebius.storage.v1;
+
+option go_package = "github.com/nebius/gosdk/proto/nebius/storage/v1";
+option java_multiple_files = true;
+option java_outer_classname = "InsecureEndpointProto";
+option java_package = "ai.nebius.pub.storage.v1";
+
+message InsecureEndpoint {
+  // Defines where the plain HTTP endpoint is available.
+  enum Mode {
+    MODE_UNSPECIFIED = 0;
+
+    // Plain HTTP access is disabled.
+    DISABLED = 1;
+
+    // Plain HTTP access is available only from the same region.
+    REGION_LOCAL = 2;
+
+    // Plain HTTP access is available from any network.
+    ALL = 3;
+  }
+
+  // Determines where the plain HTTP endpoint is available.
+  Mode mode = 1;
+}