diff --git a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/README.md b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/README.md
index 67a62b4b6a4..10e77ef763f 100644
--- a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/README.md
+++ b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/README.md
@@ -22,7 +22,7 @@ Add the following lines to your `pom.xml` file:
     <dependency>
       <groupId>com.google.apis</groupId>
       <artifactId>google-api-services-binaryauthorization</artifactId>
-      <version>v1beta1-rev20260703-2.0.0</version>
+      <version>v1beta1-rev20261016-2.0.0</version>
     </dependency>
   </dependencies>
 </project>
@@ -35,7 +35,7 @@ repositories {
   mavenCentral()
 }
 dependencies {
-  implementation 'com.google.apis:google-api-services-binaryauthorization:v1beta1-rev20260703-2.0.0'
+  implementation 'com.google.apis:google-api-services-binaryauthorization:v1beta1-rev20261016-2.0.0'
 }
 ```
 
diff --git a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/AdmissionRule.java b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/AdmissionRule.java
index a4e1a0967d1..faf198d09f2 100644
--- a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/AdmissionRule.java
+++ b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/AdmissionRule.java
@@ -48,6 +48,11 @@ public final class AdmissionRule extends com.google.api.client.json.GenericJson
   private java.lang.String evaluationMode;
 
   /**
+   * Optional. The resource names of the attestors that must attest to a container image, in the
+   * format `projects/attestors`. Each attestor must exist before a policy can reference it. To add
+   * an attestor to a policy the principal issuing the policy change request must be able to read
+   * the attestor resource. Note: this field must be non-empty when the evaluation_mode field
+   * specifies REQUIRE_ATTESTATION, otherwise it must be empty.
    * The value may be {@code null}.
    */
   @com.google.api.client.util.Key
@@ -88,6 +93,11 @@ public AdmissionRule setEvaluationMode(java.lang.String evaluationMode) {
   }
 
   /**
+   * Optional. The resource names of the attestors that must attest to a container image, in the
+   * format `projects/attestors`. Each attestor must exist before a policy can reference it. To add
+   * an attestor to a policy the principal issuing the policy change request must be able to read
+   * the attestor resource. Note: this field must be non-empty when the evaluation_mode field
+   * specifies REQUIRE_ATTESTATION, otherwise it must be empty.
    * @return value or {@code null} for none
    */
   public java.util.List<java.lang.String> getRequireAttestationsBy() {
@@ -95,6 +105,11 @@ public java.util.List<java.lang.String> getRequireAttestationsBy() {
   }
 
   /**
+   * Optional. The resource names of the attestors that must attest to a container image, in the
+   * format `projects/attestors`. Each attestor must exist before a policy can reference it. To add
+   * an attestor to a policy the principal issuing the policy change request must be able to read
+   * the attestor resource. Note: this field must be non-empty when the evaluation_mode field
+   * specifies REQUIRE_ATTESTATION, otherwise it must be empty.
    * @param requireAttestationsBy requireAttestationsBy or {@code null} for none
    */
   public AdmissionRule setRequireAttestationsBy(java.util.List<java.lang.String> requireAttestationsBy) {
diff --git a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/Policy.java b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/Policy.java
index 1d0677b0ebe..9203af66a38 100644
--- a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/Policy.java
+++ b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/com/google/api/services/binaryauthorization/v1beta1/model/Policy.java
@@ -46,10 +46,13 @@ public final class Policy extends com.google.api.client.json.GenericJson {
   }
 
   /**
-   * Optional. Per-cluster admission rules. Cluster spec format: `location.clusterId`. There can be
-   * at most one admission rule per cluster spec. A `location` is either a compute zone (e.g. us-
-   * central1-a) or a region (e.g. us-central1). For `clusterId` syntax restrictions see
-   * https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
+   * Optional. A valid Policy has only one of the following rule maps non-empty, i.e. only one of
+   * cluster_admission_rules, kubernetes_service_account_admission_rules or
+   * istio_service_identity_admission_rules can be non-empty. Per-cluster admission rules. Cluster
+   * spec format: `location.clusterId`. There can be at most one admission rule per cluster spec. A
+   * `location` is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For
+   * `clusterId` syntax restrictions see https://cloud.google.com/container-
+   * engine/reference/rest/v1/projects.zones.clusters.
    * The value may be {@code null}.
    */
   @com.google.api.client.util.Key
@@ -172,10 +175,13 @@ public Policy setAdmissionWhitelistPatterns(java.util.List<AdmissionWhitelistPat
   }
 
   /**
-   * Optional. Per-cluster admission rules. Cluster spec format: `location.clusterId`. There can be
-   * at most one admission rule per cluster spec. A `location` is either a compute zone (e.g. us-
-   * central1-a) or a region (e.g. us-central1). For `clusterId` syntax restrictions see
-   * https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
+   * Optional. A valid Policy has only one of the following rule maps non-empty, i.e. only one of
+   * cluster_admission_rules, kubernetes_service_account_admission_rules or
+   * istio_service_identity_admission_rules can be non-empty. Per-cluster admission rules. Cluster
+   * spec format: `location.clusterId`. There can be at most one admission rule per cluster spec. A
+   * `location` is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For
+   * `clusterId` syntax restrictions see https://cloud.google.com/container-
+   * engine/reference/rest/v1/projects.zones.clusters.
    * @return value or {@code null} for none
    */
   public java.util.Map<String, AdmissionRule> getClusterAdmissionRules() {
@@ -183,10 +189,13 @@ public java.util.Map<String, AdmissionRule> getClusterAdmissionRules() {
   }
 
   /**
-   * Optional. Per-cluster admission rules. Cluster spec format: `location.clusterId`. There can be
-   * at most one admission rule per cluster spec. A `location` is either a compute zone (e.g. us-
-   * central1-a) or a region (e.g. us-central1). For `clusterId` syntax restrictions see
-   * https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
+   * Optional. A valid Policy has only one of the following rule maps non-empty, i.e. only one of
+   * cluster_admission_rules, kubernetes_service_account_admission_rules or
+   * istio_service_identity_admission_rules can be non-empty. Per-cluster admission rules. Cluster
+   * spec format: `location.clusterId`. There can be at most one admission rule per cluster spec. A
+   * `location` is either a compute zone (e.g. us-central1-a) or a region (e.g. us-central1). For
+   * `clusterId` syntax restrictions see https://cloud.google.com/container-
+   * engine/reference/rest/v1/projects.zones.clusters.
    * @param clusterAdmissionRules clusterAdmissionRules or {@code null} for none
    */
   public Policy setClusterAdmissionRules(java.util.Map<String, AdmissionRule> clusterAdmissionRules) {
diff --git a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/pom.xml b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/pom.xml
index b9d292e14e4..b3618a0859a 100644
--- a/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/pom.xml
+++ b/clients/google-api-services-binaryauthorization/v1beta1/2.0.0/pom.xml
@@ -8,8 +8,8 @@
 
   <groupId>com.google.apis</groupId>
   <artifactId>google-api-services-binaryauthorization</artifactId>
-  <version>v1beta1-rev20260703-2.0.0</version>
-  <name>Binary Authorization API v1beta1-rev20260703-2.0.0</name>
+  <version>v1beta1-rev20261016-2.0.0</version>
+  <name>Binary Authorization API v1beta1-rev20261016-2.0.0</name>
   <packaging>jar</packaging>
 
   <inceptionYear>2011</inceptionYear>
diff --git a/clients/google-api-services-binaryauthorization/v1beta1/README.md b/clients/google-api-services-binaryauthorization/v1beta1/README.md
index 67a62b4b6a4..10e77ef763f 100644
--- a/clients/google-api-services-binaryauthorization/v1beta1/README.md
+++ b/clients/google-api-services-binaryauthorization/v1beta1/README.md
@@ -22,7 +22,7 @@ Add the following lines to your `pom.xml` file:
     <dependency>
       <groupId>com.google.apis</groupId>
       <artifactId>google-api-services-binaryauthorization</artifactId>
-      <version>v1beta1-rev20260703-2.0.0</version>
+      <version>v1beta1-rev20261016-2.0.0</version>
     </dependency>
   </dependencies>
 </project>
@@ -35,7 +35,7 @@ repositories {
   mavenCentral()
 }
 dependencies {
-  implementation 'com.google.apis:google-api-services-binaryauthorization:v1beta1-rev20260703-2.0.0'
+  implementation 'com.google.apis:google-api-services-binaryauthorization:v1beta1-rev20261016-2.0.0'
 }
 ```