Insecure Direct Object Reference attack via predictable secret ID in Juju

@@ -6,11 +6,13 @@ package resources
 import (
 	"context"
 	"io"
+	"slices"
 	"strings"
 
 	charmresource "github.com/juju/charm/v12/resource"
 	"github.com/juju/errors"
 	"github.com/juju/names/v5"
+	"gopkg.in/errgo.v1"
 
 	"github.com/juju/juju/api/base"
 	apicharm "github.com/juju/juju/api/common/charm"
@@ -100,6 +102,18 @@ func newListResourcesArgs(applications []string) (params.ListResourcesArgs, erro
 	return args, nil
 }
 
+func translateUploadError(err error) error {
+	permissionCodes := []string{params.CodeForbidden, params.CodeUnauthorized}
+	var uploadErr *errgo.Err
+	if errors.As(err, &uploadErr) {
+		if slices.Contains(permissionCodes, params.ErrCode(uploadErr.Cause())) ||
+			slices.Contains(permissionCodes, params.ErrCode(uploadErr.Underlying())) {
+			return apiservererrors.ErrPerm
+		}
+	}
+	return err
+}
+
 // Upload sends the provided resource blob up to Juju.
 func (c Client) Upload(application, name, filename, pendingID string, reader io.ReadSeeker) error {
 	uReq, err := NewUploadRequest(application, name, filename, reader)
@@ -117,7 +131,7 @@ func (c Client) Upload(application, name, filename, pendingID string, reader io.
 	var response params.UploadResult // ignored
 	ctx := context.TODO()
 	if err := c.httpClient.Do(ctx, req, &response); err != nil {
-		return errors.Trace(err)
+		return errors.Trace(translateUploadError(err))
 	}
 
 	return nil

@@ -19,6 +19,7 @@ import (
 	"github.com/kr/pretty"
 	"go.uber.org/mock/gomock"
 	gc "gopkg.in/check.v1"
+	"gopkg.in/errgo.v1"
 
 	"github.com/juju/juju/api/base/mocks"
 	"github.com/juju/juju/api/client/resources"
@@ -113,7 +114,7 @@ func (s *UploadSuite) TestUploadBadApplication(c *gc.C) {
 	c.Check(err, gc.ErrorMatches, `.*invalid application.*`)
 }
 
-func (s *UploadSuite) TestUploadFailed(c *gc.C) {
+func (s *UploadSuite) assertUploadFailed(c *gc.C, uploadErr error, expectedMsg string) {
 	defer s.setup(c).Finish()
 
 	data := "<data>"
@@ -128,9 +129,21 @@ func (s *UploadSuite) TestUploadFailed(c *gc.C) {
 	req.ContentLength = int64(len(data))
 
 	ctx := context.TODO()
-	s.mockHTTPClient.EXPECT().Do(ctx, reqMatcher{c, req}, gomock.Any()).Return(errors.New("boom"))
+	s.mockHTTPClient.EXPECT().Do(ctx, reqMatcher{c, req}, gomock.Any()).Return(uploadErr)
 	err = s.client.Upload("a-application", "spam", "foo.zip", "", strings.NewReader(data))
-	c.Assert(err, gc.ErrorMatches, "boom")
+	c.Assert(err, gc.ErrorMatches, expectedMsg)
+}
+
+func (s *UploadSuite) TestUploadFailed(c *gc.C) {
+	s.assertUploadFailed(c, errors.New("upload failed"), "upload failed")
+}
+
+func (s *UploadSuite) TestUploadAuthError(c *gc.C) {
+	authErr := errgo.Mask(params.Error{
+		Code:    params.CodeUnauthorized,
+		Message: "user unauthorized",
+	})
+	s.assertUploadFailed(c, authErr, "permission denied")
 }
 
 func (s *UploadSuite) TestAddPendingResources(c *gc.C) {
@@ -243,7 +256,7 @@ func (s *UploadSuite) TestUploadPendingResourceBadApplication(c *gc.C) {
 	c.Assert(err, gc.ErrorMatches, `.*invalid application.*`)
 }
 
-func (s *UploadSuite) TestUploadPendingResourceFailed(c *gc.C) {
+func (s *UploadSuite) assertUploadPendingResourceFailed(c *gc.C, uploadErr error, expectedMsg string) {
 	defer s.setup(c).Finish()
 
 	res, apiResult := newResourceResult(c, "spam")
@@ -271,10 +284,22 @@ func (s *UploadSuite) TestUploadPendingResourceFailed(c *gc.C) {
 
 	ctx := context.TODO()
 	s.mockFacadeCaller.EXPECT().FacadeCall("AddPendingResources", &args, gomock.Any()).SetArg(2, results).Return(nil)
-	s.mockHTTPClient.EXPECT().Do(ctx, reqMatcher{c, req}, gomock.Any()).Return(errors.New("boom"))
+	s.mockHTTPClient.EXPECT().Do(ctx, reqMatcher{c, req}, gomock.Any()).Return(uploadErr)
 
 	_, err = s.client.UploadPendingResource("a-application", res[0].Resource, "file.zip", strings.NewReader(data))
-	c.Assert(err, gc.ErrorMatches, "boom")
+	c.Assert(err, gc.ErrorMatches, expectedMsg)
+}
+
+func (s *UploadSuite) TestUploadPendingResourceFailed(c *gc.C) {
+	s.assertUploadPendingResourceFailed(c, errors.New("upload failed"), "upload failed")
+}
+
+func (s *UploadSuite) TestUploadPendingResourceAuthError(c *gc.C) {
+	authErr := errgo.Mask(params.Error{
+		Code:    params.CodeUnauthorized,
+		Message: "user unauthorized",
+	})
+	s.assertUploadPendingResourceFailed(c, authErr, "permission denied")
 }
 
 func newResourceResult(c *gc.C, names ...string) ([]coreresources.Resource, params.ResourcesResult) {

@@ -0,0 +1,60 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	"time"
+
+	"github.com/juju/errors"
+
+	"github.com/juju/juju/api/base"
+	apiwatcher "github.com/juju/juju/api/watcher"
+	apiservererrors "github.com/juju/juju/apiserver/errors"
+	"github.com/juju/juju/core/watcher"
+	"github.com/juju/juju/rpc/params"
+)
+
+// Client is the api client for the SecretRevoker facade.
+type Client struct {
+	facade base.FacadeCaller
+}
+
+// NewClient creates a secret revoker API client.
+func NewClient(caller base.APICaller) *Client {
+	return &Client{
+		facade: base.NewFacadeCaller(caller, "SecretsRevoker"),
+	}
+}
+
+// WatchIssuedTokenExpiry calls the SecretsRevoker facade to create a secret
+// backends issued token expiry watcher. The watcher fires when a secret backend
+// issued token is created, sending the RFC3339 encoded timestamp when it will
+// expire.
+func (c *Client) WatchIssuedTokenExpiry() (watcher.StringsWatcher, error) {
+	var result params.StringsWatchResult
+	err := c.facade.FacadeCall("WatchIssuedTokenExpiry", nil, &result)
+	if err != nil {
+		return nil, err
+	}
+	if result.Error != nil {
+		return nil, apiservererrors.RestoreError(result.Error)
+	}
+	w := apiwatcher.NewStringsWatcher(c.facade.RawAPICaller(), result)
+	return w, nil
+}
+
+// RevokeIssuedTokens calls the SecretsRevoker facade to revoke all issued
+// tokens up until the specified time and returns the time for the next
+// revocation.
+func (c *Client) RevokeIssuedTokens(until time.Time) (time.Time, error) {
+	var result params.RevokeIssuedTokensResult
+	err := c.facade.FacadeCall("RevokeIssuedTokens", until, &result)
+	if err != nil {
+		return time.Time{}, errors.Trace(err)
+	}
+	if result.Error != nil {
+		return time.Time{}, result.Error
+	}
+	return result.Next, nil
+}

@@ -0,0 +1,88 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker_test
+
+import (
+	"time"
+
+	jc "github.com/juju/testing/checkers"
+	gc "gopkg.in/check.v1"
+
+	"github.com/juju/juju/api/base/testing"
+	"github.com/juju/juju/api/controller/secretsrevoker"
+	"github.com/juju/juju/rpc/params"
+	coretesting "github.com/juju/juju/testing"
+)
+
+var _ = gc.Suite(&SecretRevokerSuite{})
+
+type SecretRevokerSuite struct {
+	coretesting.BaseSuite
+}
+
+func (s *SecretRevokerSuite) TestNewClient(c *gc.C) {
+	apiCaller := testing.APICallerFunc(func(objType string, version int, id, request string, arg, result any) error {
+		return nil
+	})
+	client := secretsrevoker.NewClient(apiCaller)
+	c.Assert(client, gc.NotNil)
+}
+
+func (s *SecretRevokerSuite) TestWatchIssuedTokenExpiry(c *gc.C) {
+	apiCaller := testing.APICallerFunc(func(objType string, version int, id, request string, arg, result any) error {
+		c.Check(objType, gc.Equals, "SecretsRevoker")
+		c.Check(version, gc.Equals, 0)
+		c.Check(id, gc.Equals, "")
+		c.Check(request, gc.Equals, "WatchIssuedTokenExpiry")
+		c.Check(arg, gc.IsNil)
+		c.Assert(result, gc.FitsTypeOf, &params.StringsWatchResult{})
+		*(result.(*params.StringsWatchResult)) = params.StringsWatchResult{
+			Error: &params.Error{Message: "FAIL"},
+		}
+		return nil
+	})
+	client := secretsrevoker.NewClient(apiCaller)
+	_, err := client.WatchIssuedTokenExpiry()
+	c.Assert(err, gc.ErrorMatches, "FAIL")
+}
+
+func (s *SecretRevokerSuite) TestRevokeIssuedTokens(c *gc.C) {
+	now := time.Now()
+	apiCaller := testing.APICallerFunc(func(objType string, version int, id, request string, arg, result any) error {
+		c.Check(objType, gc.Equals, "SecretsRevoker")
+		c.Check(version, gc.Equals, 0)
+		c.Check(id, gc.Equals, "")
+		c.Check(request, gc.Equals, "RevokeIssuedTokens")
+		c.Check(arg, jc.DeepEquals, now)
+		c.Assert(result, gc.FitsTypeOf, &params.RevokeIssuedTokensResult{})
+		*(result.(*params.RevokeIssuedTokensResult)) = params.RevokeIssuedTokensResult{
+			Error: &params.Error{Message: "boom"},
+		}
+		return nil
+	})
+	client := secretsrevoker.NewClient(apiCaller)
+	next, err := client.RevokeIssuedTokens(now)
+	c.Assert(err, gc.ErrorMatches, "boom")
+	c.Check(next, gc.Equals, time.Time{})
+}
+
+func (s *SecretRevokerSuite) TestRevokeIssuedTokensWithResult(c *gc.C) {
+	now := time.Now()
+	apiCaller := testing.APICallerFunc(func(objType string, version int, id, request string, arg, result any) error {
+		c.Check(objType, gc.Equals, "SecretsRevoker")
+		c.Check(version, gc.Equals, 0)
+		c.Check(id, gc.Equals, "")
+		c.Check(request, gc.Equals, "RevokeIssuedTokens")
+		c.Check(arg, jc.DeepEquals, now)
+		c.Assert(result, gc.FitsTypeOf, &params.RevokeIssuedTokensResult{})
+		*(result.(*params.RevokeIssuedTokensResult)) = params.RevokeIssuedTokensResult{
+			Next: now,
+		}
+		return nil
+	})
+	client := secretsrevoker.NewClient(apiCaller)
+	next, err := client.RevokeIssuedTokens(now)
+	c.Assert(err, gc.IsNil)
+	c.Check(next, gc.Equals, now)
+}

@@ -0,0 +1,5 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+// Package secretsrevoker provides the api client for the secretsrevoker facade.
+package secretsrevoker

@@ -0,0 +1,14 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker_test
+
+import (
+	"testing"
+
+	gc "gopkg.in/check.v1"
+)
+
+func TestPackage(t *testing.T) {
+	gc.TestingT(t)
+}

@@ -120,6 +120,7 @@ var facadeVersions = facades.FacadeVersions{
 	"Secrets":                      {1, 2},
 	"SecretsManager":               {1, 2, 3, 4},
 	"SecretsDrain":                 {1},
+	"SecretsRevoker":               {1},
 	"UserSecretsDrain":             {1},
 	"UserSecretsManager":           {1},
 	"Singular":                     {2},

@@ -69,6 +69,13 @@ var httpClientTests = []struct {
 	handler:       http.NotFound,
 	expectError:   `(?m)Get http://.*/: 404 page not found.*`,
 	expectErrorIs: errors.NotFound,
+}, {
+	about: "non-JSON auth error response",
+	handler: func(w http.ResponseWriter, req *http.Request) {
+		http.Error(w, "some unauth error", http.StatusUnauthorized)
+	},
+	expectError:   `(?m)Get http://.*/: some unauth error.*`,
+	expectErrorIs: errors.Unauthorized,
 }, {
 	about: "bad error response",
 	handler: func(w http.ResponseWriter, req *http.Request) {

@@ -100,6 +100,7 @@ import (
 	"github.com/juju/juju/apiserver/facades/controller/migrationtarget"
 	"github.com/juju/juju/apiserver/facades/controller/remoterelations"
 	"github.com/juju/juju/apiserver/facades/controller/secretbackendmanager"
+	"github.com/juju/juju/apiserver/facades/controller/secretsrevoker"
 	"github.com/juju/juju/apiserver/facades/controller/singular"
 	"github.com/juju/juju/apiserver/facades/controller/sshserver"
 	"github.com/juju/juju/apiserver/facades/controller/sshtunneler"
@@ -267,11 +268,12 @@ func AllFacades() *facade.Registry {
 	resourceshookcontext.Register(registry)
 	retrystrategy.Register(registry)
 	singular.Register(registry)
-	secrets.Register(registry)
-	secretbackends.Register(registry)
 	secretbackendmanager.Register(registry)
-	secretsmanager.Register(registry)
+	secretbackends.Register(registry)
+	secrets.Register(registry)
 	secretsdrain.Register(registry)
+	secretsmanager.Register(registry)
+	secretsrevoker.Register(registry)
 	usersecrets.Register(registry)
 	usersecretsdrain.Register(registry)
 	sshclient.Register(registry)

@@ -723,7 +723,8 @@ func (srv *Server) endpoints() ([]apihttp.Endpoint, error) {
 		controllerTag: systemState.ControllerTag(),
 	}
 	var debuglogAuth httpcontext.CompositeAuthorizer = []authentication.Authorizer{
-		tagKindAuthorizer{names.MachineTagKind, names.ControllerAgentTagKind},
+		tagKindAuthorizer{names.ControllerAgentTagKind},
+		controllerAuthorizer{},
 		controllerAdminAuthorizer,
 		modelPermissionAuthorizer{
 			perm: permission.ReadAccess,
@@ -796,14 +797,18 @@ func (srv *Server) endpoints() ([]apihttp.Endpoint, error) {
 		},
 	}
 	modelToolsDownloadHandler := srv.monitoredHandler(newToolsDownloadHandler(httpCtxt), "tools")
-	resourcesHandler := srv.monitoredHandler(&ResourcesHandler{
-		StateAuthFunc: func(req *http.Request, tagKinds ...string) (ResourcesBackend, state.PoolHelper, names.Tag,
-			error) {
-			st, entity, err := httpCtxt.stateForRequestAuthenticatedTag(req, tagKinds...)
+	var resourcesUploadAuthorizer httpcontext.CompositeAuthorizer = []authentication.Authorizer{
+		controllerAdminAuthorizer,
+		modelPermissionAuthorizer{
+			perm: permission.WriteAccess,
+		},
+	}
+	resourceUploadHandler := srv.monitoredHandler(&ResourcesUploadHandler{
+		StateFunc: func(req *http.Request) (ResourcesBackend, state.PoolHelper, names.Tag, error) {
+			st, entity, err := httpCtxt.stateForRequestAuthenticated(req)
 			if err != nil {
 				return nil, nil, nil, errors.Trace(err)
 			}
-
 			rst := st.Resources()
 			return rst, st, entity.Tag(), nil
 		},
@@ -821,6 +826,23 @@ func (srv *Server) endpoints() ([]apihttp.Endpoint, error) {
 			return nil
 		},
 	}, "applications")
+	var resourcesDownloadAuthorizer httpcontext.CompositeAuthorizer = []authentication.Authorizer{
+		controllerAdminAuthorizer,
+		modelPermissionAuthorizer{
+			perm: permission.ReadAccess,
+		},
+		tagKindAuthorizer{names.ControllerAgentTagKind, names.MachineTagKind, names.ApplicationTagKind},
+	}
+	resourceDownloadHandler := srv.monitoredHandler(&ResourcesDownloadHandler{
+		StateFunc: func(req *http.Request) (ResourcesBackend, state.PoolHelper, names.Tag, error) {
+			st, entity, err := httpCtxt.stateForRequestAuthenticated(req)
+			if err != nil {
+				return nil, nil, nil, errors.Trace(err)
+			}
+			rst := st.Resources()
+			return rst, st, entity.Tag(), nil
+		},
+	}, "applications")
 	unitResourcesHandler := srv.monitoredHandler(&UnitResourcesHandler{
 		NewOpener: func(req *http.Request, tagKinds ...string) (resources.Opener, state.PoolHelper, error) {
 			st, _, err := httpCtxt.stateForRequestAuthenticatedTag(req, tagKinds...)
@@ -931,8 +953,15 @@ func (srv *Server) endpoints() ([]apihttp.Endpoint, error) {
 		handler:         modelToolsDownloadHandler,
 		unauthenticated: true,
 	}, {
-		pattern: modelRoutePrefix + "/applications/:application/resources/:resource",
-		handler: resourcesHandler,
+		pattern:    modelRoutePrefix + "/applications/:application/resources/:resource",
+		methods:    []string{"GET"},
+		handler:    resourceDownloadHandler,
+		authorizer: resourcesDownloadAuthorizer,
+	}, {
+		pattern:    modelRoutePrefix + "/applications/:application/resources/:resource",
+		methods:    []string{"PUT"},
+		handler:    resourceUploadHandler,
+		authorizer: resourcesUploadAuthorizer,
 	}, {
 		pattern: modelRoutePrefix + "/units/:unit/resources/:resource",
 		handler: unitResourcesHandler,

@@ -42,6 +42,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -84,6 +99,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -100,18 +129,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -72,6 +72,20 @@ func (mr *MockSecretsStoreMockRecorder) CreateSecret(arg0, arg1 any) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateSecret", reflect.TypeOf((*MockSecretsStore)(nil).CreateSecret), arg0, arg1)
 }
 
+// CreateSecretBackendIssuedToken mocks base method.
+func (m *MockSecretsStore) CreateSecretBackendIssuedToken(arg0 state.SecretBackendIssuedToken) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateSecretBackendIssuedToken", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateSecretBackendIssuedToken indicates an expected call of CreateSecretBackendIssuedToken.
+func (mr *MockSecretsStoreMockRecorder) CreateSecretBackendIssuedToken(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateSecretBackendIssuedToken", reflect.TypeOf((*MockSecretsStore)(nil).CreateSecretBackendIssuedToken), arg0)
+}
+
 // DeleteSecret mocks base method.
 func (m *MockSecretsStore) DeleteSecret(arg0 *secrets.URI, arg1 ...int) ([]secrets.ValueRef, error) {
 	m.ctrl.T.Helper()
@@ -92,6 +106,20 @@ func (mr *MockSecretsStoreMockRecorder) DeleteSecret(arg0 any, arg1 ...any) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteSecret", reflect.TypeOf((*MockSecretsStore)(nil).DeleteSecret), varargs...)
 }
 
+// ExpireSecretBackendIssuedTokensForConsumer mocks base method.
+func (m *MockSecretsStore) ExpireSecretBackendIssuedTokensForConsumer(arg0 names.Tag) state.ModelOperation {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ExpireSecretBackendIssuedTokensForConsumer", arg0)
+	ret0, _ := ret[0].(state.ModelOperation)
+	return ret0
+}
+
+// ExpireSecretBackendIssuedTokensForConsumer indicates an expected call of ExpireSecretBackendIssuedTokensForConsumer.
+func (mr *MockSecretsStoreMockRecorder) ExpireSecretBackendIssuedTokensForConsumer(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExpireSecretBackendIssuedTokensForConsumer", reflect.TypeOf((*MockSecretsStore)(nil).ExpireSecretBackendIssuedTokensForConsumer), arg0)
+}
+
 // GetOwnedSecretMetadataAsApp mocks base method.
 func (m *MockSecretsStore) GetOwnedSecretMetadataAsApp(arg0 names.ApplicationTag, arg1 *secrets.URI) (*secrets.SecretMetadataOwnerIdent, error) {
 	m.ctrl.T.Helper()
@@ -258,6 +286,51 @@ func (mr *MockSecretsStoreMockRecorder) ListModelSecrets(arg0 any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListModelSecrets", reflect.TypeOf((*MockSecretsStore)(nil).ListModelSecrets), arg0)
 }
 
+// ListReservedSecrets mocks base method.
+func (m *MockSecretsStore) ListReservedSecrets(arg0 []names.Tag) ([]*secrets.URI, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListReservedSecrets", arg0)
+	ret0, _ := ret[0].([]*secrets.URI)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListReservedSecrets indicates an expected call of ListReservedSecrets.
+func (mr *MockSecretsStoreMockRecorder) ListReservedSecrets(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListReservedSecrets", reflect.TypeOf((*MockSecretsStore)(nil).ListReservedSecrets), arg0)
+}
+
+// ListSecretBackendIssuedTokenUntil mocks base method.
+func (m *MockSecretsStore) ListSecretBackendIssuedTokenUntil(arg0 time.Time) ([]state.SecretBackendIssuedToken, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListSecretBackendIssuedTokenUntil", arg0)
+	ret0, _ := ret[0].([]state.SecretBackendIssuedToken)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListSecretBackendIssuedTokenUntil indicates an expected call of ListSecretBackendIssuedTokenUntil.
+func (mr *MockSecretsStoreMockRecorder) ListSecretBackendIssuedTokenUntil(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecretBackendIssuedTokenUntil", reflect.TypeOf((*MockSecretsStore)(nil).ListSecretBackendIssuedTokenUntil), arg0)
+}
+
+// ListSecretBackendIssuedTokenUntilForConsumer mocks base method.
+func (m *MockSecretsStore) ListSecretBackendIssuedTokenUntilForConsumer(arg0 time.Time, arg1 names.Tag) ([]state.SecretBackendIssuedToken, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListSecretBackendIssuedTokenUntilForConsumer", arg0, arg1)
+	ret0, _ := ret[0].([]state.SecretBackendIssuedToken)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListSecretBackendIssuedTokenUntilForConsumer indicates an expected call of ListSecretBackendIssuedTokenUntilForConsumer.
+func (mr *MockSecretsStoreMockRecorder) ListSecretBackendIssuedTokenUntilForConsumer(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecretBackendIssuedTokenUntilForConsumer", reflect.TypeOf((*MockSecretsStore)(nil).ListSecretBackendIssuedTokenUntilForConsumer), arg0, arg1)
+}
+
 // ListSecretRevisions mocks base method.
 func (m *MockSecretsStore) ListSecretRevisions(arg0 *secrets.URI) ([]*secrets.SecretRevisionMetadata, error) {
 	m.ctrl.T.Helper()
@@ -303,6 +376,63 @@ func (mr *MockSecretsStoreMockRecorder) ListUnusedSecretRevisions(arg0 any) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUnusedSecretRevisions", reflect.TypeOf((*MockSecretsStore)(nil).ListUnusedSecretRevisions), arg0)
 }
 
+// NextSecretBackendIssuedTokenExpiry mocks base method.
+func (m *MockSecretsStore) NextSecretBackendIssuedTokenExpiry() (time.Time, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NextSecretBackendIssuedTokenExpiry")
+	ret0, _ := ret[0].(time.Time)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// NextSecretBackendIssuedTokenExpiry indicates an expected call of NextSecretBackendIssuedTokenExpiry.
+func (mr *MockSecretsStoreMockRecorder) NextSecretBackendIssuedTokenExpiry() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NextSecretBackendIssuedTokenExpiry", reflect.TypeOf((*MockSecretsStore)(nil).NextSecretBackendIssuedTokenExpiry))
+}
+
+// RemoveSecretBackendIssuedTokens mocks base method.
+func (m *MockSecretsStore) RemoveSecretBackendIssuedTokens(arg0 []string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveSecretBackendIssuedTokens", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RemoveSecretBackendIssuedTokens indicates an expected call of RemoveSecretBackendIssuedTokens.
+func (mr *MockSecretsStoreMockRecorder) RemoveSecretBackendIssuedTokens(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecretBackendIssuedTokens", reflect.TypeOf((*MockSecretsStore)(nil).RemoveSecretBackendIssuedTokens), arg0)
+}
+
+// RemoveSecretReservations mocks base method.
+func (m *MockSecretsStore) RemoveSecretReservations(arg0 names.Tag) state.ModelOperation {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveSecretReservations", arg0)
+	ret0, _ := ret[0].(state.ModelOperation)
+	return ret0
+}
+
+// RemoveSecretReservations indicates an expected call of RemoveSecretReservations.
+func (mr *MockSecretsStoreMockRecorder) RemoveSecretReservations(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecretReservations", reflect.TypeOf((*MockSecretsStore)(nil).RemoveSecretReservations), arg0)
+}
+
+// ReserveSecret mocks base method.
+func (m *MockSecretsStore) ReserveSecret(arg0 *secrets.URI, arg1 names.Tag) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReserveSecret", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ReserveSecret indicates an expected call of ReserveSecret.
+func (mr *MockSecretsStoreMockRecorder) ReserveSecret(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReserveSecret", reflect.TypeOf((*MockSecretsStore)(nil).ReserveSecret), arg0, arg1)
+}
+
 // SecretGrants mocks base method.
 func (m *MockSecretsStore) SecretGrants(arg0 *secrets.URI, arg1 secrets.SecretRole) ([]secrets.AccessInfo, error) {
 	m.ctrl.T.Helper()
@@ -378,6 +508,20 @@ func (mr *MockSecretsStoreMockRecorder) WatchRevisionsToPrune(arg0 any) *gomock.
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchRevisionsToPrune", reflect.TypeOf((*MockSecretsStore)(nil).WatchRevisionsToPrune), arg0)
 }
 
+// WatchSecretBackendIssuedTokenExpiry mocks base method.
+func (m *MockSecretsStore) WatchSecretBackendIssuedTokenExpiry() state.StringsWatcher {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WatchSecretBackendIssuedTokenExpiry")
+	ret0, _ := ret[0].(state.StringsWatcher)
+	return ret0
+}
+
+// WatchSecretBackendIssuedTokenExpiry indicates an expected call of WatchSecretBackendIssuedTokenExpiry.
+func (mr *MockSecretsStoreMockRecorder) WatchSecretBackendIssuedTokenExpiry() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchSecretBackendIssuedTokenExpiry", reflect.TypeOf((*MockSecretsStore)(nil).WatchSecretBackendIssuedTokenExpiry))
+}
+
 // MockSecretBackendsStorage is a mock of SecretBackendsStorage interface.
 type MockSecretBackendsStorage struct {
 	ctrl     *gomock.Controller

@@ -7,8 +7,11 @@ import (
 	"context"
 	"encoding/json"
 	"sort"
+	"time"
 
+	"github.com/google/uuid"
 	"github.com/juju/collections/set"
+	"github.com/juju/collections/transform"
 	"github.com/juju/errors"
 	"github.com/juju/loggo"
 	"github.com/juju/names/v5"
@@ -146,7 +149,7 @@ func DrainBackendConfigInfo(backendID string, model Model, authTag names.Tag, le
 	if !ok {
 		return nil, errors.Errorf("missing secret backend %q", backendID)
 	}
-	backendCfg, err := backendConfigInfo(model, backendID, &cfg, authTag, leadershipChecker, true, true)
+	backendCfg, err := backendConfigInfo(model, backendID, &cfg, authTag, leadershipChecker, true, true, nil)
 	if err != nil {
 		return nil, errors.Trace(err)
 	}
@@ -180,8 +183,13 @@ func SecretCleanupBackendConfigInfo(model Model, backendID string) (*provider.Mo
 // The client is expected to be restricted to write only those secrets
 // owned by the agent, and read only those secrets shared with the agent.
 // The result includes config for all relevant backends, including the id
-// of the current active backend.
-func BackendConfigInfo(model Model, sameController bool, backendIDs []string, wantAll bool, authTag names.Tag, leadershipChecker leadership.Checker) (*provider.ModelBackendConfigInfo, error) {
+// of the current active backend. If [only] is passed, then the config may be
+// restricted down to just that URI, if the auth tag has access to it.
+func BackendConfigInfo(
+	model Model, sameController bool, backendIDs []string, wantAll bool,
+	authTag names.Tag, leadershipChecker leadership.Checker,
+	only []*coresecrets.URI,
+) (*provider.ModelBackendConfigInfo, error) {
 	adminModelCfg, err := AdminBackendConfigInfo(model)
 	if err != nil {
 		return nil, errors.Annotate(err, "getting configured secrets providers")
@@ -204,7 +212,16 @@ func BackendConfigInfo(model Model, sameController bool, backendIDs []string, wa
 		if !ok {
 			return nil, errors.Errorf("missing secret backend %q", backendID)
 		}
-		backendCfg, err := backendConfigInfo(model, backendID, &cfg, authTag, leadershipChecker, sameController, false)
+		backendCfg, err := backendConfigInfo(
+			model,
+			backendID,
+			&cfg,
+			authTag,
+			leadershipChecker,
+			sameController,
+			false,
+			only,
+		)
 		if err != nil {
 			return nil, errors.Trace(err)
 		}
@@ -214,8 +231,13 @@ func BackendConfigInfo(model Model, sameController bool, backendIDs []string, wa
 }
 
 func backendConfigInfo(
-	model Model, backendID string, adminCfg *provider.ModelBackendConfig,
-	authTag names.Tag, leadershipChecker leadership.Checker, sameController, forDrain bool,
+	model Model,
+	backendID string,
+	adminCfg *provider.ModelBackendConfig,
+	authTag names.Tag,
+	leadershipChecker leadership.Checker,
+	sameController, forDrain bool,
+	only []*coresecrets.URI,
 ) (*provider.ModelBackendConfig, error) {
 	p, err := GetProvider(adminCfg.BackendType)
 	if err != nil {
@@ -231,11 +253,13 @@ func backendConfigInfo(
 	// (or its app if the agent is a leader).
 	ownedFilter := state.SecretsFilter{
 		OwnerTags: []names.Tag{authTag},
+		URIs:      only,
 	}
 	// Find secrets shared with the agent.
 	// We include secrets shared with the app or just the specified unit.
 	readFilter := state.SecretsFilter{
 		ConsumerTags: []names.Tag{authTag},
+		URIs:         only,
 	}
 	// Find secrets owned by the application that should be readable for non leader units.
 	readAppOwnedFilter := state.SecretsFilter{}
@@ -259,30 +283,79 @@ func backendConfigInfo(
 		// Granted secrets can be consumed in application level for all units.
 		readFilter.ConsumerTags = append(readFilter.ConsumerTags, authApp)
 	case names.ApplicationTag:
+		// App Tag has access to application secrets.
 	case names.ModelTag:
-		// Model Tag is validate for user secrets.
+		// Model Tag has access to user secrets.
 	default:
 		return nil, errors.NotSupportedf("login as %q", authTag)
 	}
 
-	ownedRevisions := map[string]provider.SecretRevisions{}
-	if err := getExternalRevisions(secretsState, backendID, ownedFilter, ownedRevisions); err != nil {
+	ownedIDs, ownedRevs, err := getExternalRevisions(
+		secretsState, backendID, ownedFilter)
+	if err != nil {
 		return nil, errors.Trace(err)
 	}
 
-	readRevisions := map[string]provider.SecretRevisions{}
-	if err := getExternalRevisions(secretsState, backendID, readFilter, readRevisions); err != nil {
+	ownedReservedIDs, err := secretsState.ListReservedSecrets(ownedFilter.OwnerTags)
+	if err != nil {
+		return nil, errors.Trace(err)
+	}
+	if len(only) > 0 {
+		onlySet := set.NewStrings(transform.Slice(only, func(uri *coresecrets.URI) string {
+			return uri.ID
+		})...)
+		for _, reservedSecretID := range ownedReservedIDs {
+			if onlySet.Contains(reservedSecretID.ID) {
+				ownedIDs = append(ownedIDs, reservedSecretID.ID)
+			}
+		}
+	} else {
+		for _, reservedSecretID := range ownedReservedIDs {
+			ownedIDs = append(ownedIDs, reservedSecretID.ID)
+		}
+	}
+
+	_, readRevs, err := getExternalRevisions(
+		secretsState, backendID, readFilter)
+	if err != nil {
 		return nil, errors.Trace(err)
 	}
 
 	if len(readAppOwnedFilter.OwnerTags) > 0 {
-		if err := getExternalRevisions(secretsState, backendID, readAppOwnedFilter, readRevisions); err != nil {
+		_, appOwnedReadRevs, err := getExternalRevisions(
+			secretsState, backendID, readAppOwnedFilter)
+		if err != nil {
 			return nil, errors.Trace(err)
 		}
+		readRevs.Insert(appOwnedReadRevs)
 	}
 
-	logger.Debugf("secrets for %v:\nowned: %v\nconsumed:%v", authTag.String(), ownedRevisions, readRevisions)
-	cfg, err := p.RestrictedConfig(adminCfg, sameController, forDrain, authTag, ownedRevisions[backendID], readRevisions[backendID])
+	issuedTokenUUID := ""
+	if p.IssuesTokens() {
+		v, err := uuid.NewRandom()
+		if err != nil {
+			return nil, errors.Trace(err)
+		}
+		issuedTokenUUID = v.String()
+
+		args := state.SecretBackendIssuedToken{
+			UUID:       issuedTokenUUID,
+			ExpireTime: time.Now().Add(coresecrets.IssuedTokenValidity),
+			BackendID:  backendID,
+			Consumer:   authTag,
+		}
+		err = secretsState.CreateSecretBackendIssuedToken(args)
+		if err != nil {
+			return nil, errors.Trace(err)
+		}
+	}
+
+	logger.Debugf(
+		"secrets for %v:\nowned: %v\nowned revs: %v\nconsumed revs:%v",
+		authTag.String(), ownedIDs, ownedRevs, readRevs)
+	cfg, err := p.RestrictedConfig(
+		adminCfg, sameController, forDrain, issuedTokenUUID, authTag, ownedIDs,
+		ownedRevs, readRevs)
 	if err != nil {
 		return nil, errors.Trace(err)
 	}
@@ -295,29 +368,39 @@ func backendConfigInfo(
 	return info, nil
 }
 
-func getExternalRevisions(backend state.SecretsStore, backendID string, filter state.SecretsFilter, revisions map[string]provider.SecretRevisions) error {
+func getExternalRevisions(
+	backend state.SecretsStore,
+	backendID string,
+	filter state.SecretsFilter,
+) ([]string, provider.SecretRevisions, error) {
 	secrets, err := backend.ListSecrets(filter)
 	if err != nil {
-		return errors.Trace(err)
+		return nil, nil, errors.Trace(err)
 	}
+
+	revs := provider.SecretRevisions{}
+	ids := []string{}
 	for _, md := range secrets {
-		revs, err := backend.ListSecretRevisions(md.URI)
+		secretRevs, err := backend.ListSecretRevisions(md.URI)
 		if err != nil {
-			return errors.Annotatef(err, "cannot get revisions for secret %q", md.URI)
+			return nil, nil, errors.Annotatef(err,
+				"cannot get revisions for secret %q", md.URI)
 		}
-		for _, rev := range revs {
-			if rev.ValueRef == nil || rev.ValueRef.BackendID != backendID {
+
+		for _, secretRev := range secretRevs {
+			if secretRev.ValueRef == nil {
 				continue
 			}
-			revs, ok := revisions[rev.ValueRef.BackendID]
-			if !ok {
-				revs = provider.SecretRevisions{}
+			if secretRev.ValueRef.BackendID != backendID {
+				continue
 			}
-			revs.Add(md.URI, rev.ValueRef.RevisionID)
-			revisions[rev.ValueRef.BackendID] = revs
+			revs.Add(md.URI, secretRev.ValueRef.RevisionID)
 		}
+
+		ids = append(ids, md.URI.ID)
 	}
-	return nil
+
+	return ids, revs, nil
 }
 
 func cloudSpecForModel(m Model) (cloudspec.CloudSpec, error) {
@@ -683,7 +766,7 @@ func secretDeletionPreflightCheck(uriStr string, label string, removeState Secre
 // there are multiple secrets with the same label.
 func getSecretURIForLabel(secretsState ListSecretsState, modelUUID string, label string) (*coresecrets.URI, error) {
 	results, err := secretsState.ListSecrets(state.SecretsFilter{
-		Label:     &label,
+		Labels:    []string{label},
 		OwnerTags: []names.Tag{names.NewModelTag(modelUUID)},
 	})
 	if err != nil {

@@ -86,7 +86,7 @@ var (
 func (s *secretsSuite) TestMarshallLegacyBackendConfig(c *gc.C) {
 	cfg := params.SecretBackendConfig{
 		BackendType: kubernetes.BackendType,
-		Params: map[string]interface{}{
+		Params: map[string]any{
 			"endpoint":                 "http://nowhere",
 			"ca-certs":                 []string{"cert-data"},
 			"namespace":                "fred",
@@ -98,7 +98,7 @@ func (s *secretsSuite) TestMarshallLegacyBackendConfig(c *gc.C) {
 	c.Assert(err, jc.ErrorIsNil)
 	c.Assert(cfg, jc.DeepEquals, params.SecretBackendConfig{
 		BackendType: kubernetes.BackendType,
-		Params: map[string]interface{}{
+		Params: map[string]any{
 			"endpoint":            "http://nowhere",
 			"ca-certs":            []string{"cert-data"},
 			"credential":          `{"auth-type":"oauth2","Attributes":{"Token":"bar"}}`,
@@ -220,7 +220,7 @@ func (s *secretsSuite) assertAdminBackendConfigInfoDefault(
 		ID:          vaultBackendID,
 		Name:        "myvault",
 		BackendType: vault.BackendType,
-		Config: map[string]interface{}{
+		Config: map[string]any{
 			"endpoint": "http://vault",
 		},
 	}}, nil)
@@ -231,14 +231,6 @@ func (s *secretsSuite) assertAdminBackendConfigInfoDefault(
 }
 
 func (s *secretsSuite) TestBackendConfigInfoLeaderUnit(c *gc.C) {
-	s.assertBackendConfigInfoLeaderUnit(c, []string{"backend-id"})
-}
-
-func (s *secretsSuite) TestBackendConfigInfoDefaultAdmin(c *gc.C) {
-	s.assertBackendConfigInfoLeaderUnit(c, nil)
-}
-
-func (s *secretsSuite) assertBackendConfigInfoLeaderUnit(c *gc.C, wanted []string) {
 	ctrl := gomock.NewController(c)
 	defer ctrl.Finish()
 
@@ -254,9 +246,14 @@ func (s *secretsSuite) assertBackendConfigInfoLeaderUnit(c *gc.C, wanted []strin
 	s.PatchValue(&secrets.GetSecretsState, func(secrets.Model) state.SecretsStore { return secretsState })
 	s.PatchValue(&secrets.GetSecretBackendsState, func(secrets.Model) state.SecretBackendsStorage { return backendState })
 
+	backendIDs := []string{"backend-id"}
+	issuedTokenUUID := ""
 	owned := []*coresecrets.SecretMetadata{
 		{URI: &coresecrets.URI{ID: "owned-1"}},
 	}
+	ownedIDs := []string{
+		"owned-1",
+	}
 	ownedRevs := map[string]set.Strings{
 		"owned-1": set.NewStrings("owned-rev-1", "owned-rev-2"),
 	}
@@ -280,47 +277,52 @@ func (s *secretsSuite) assertBackendConfigInfoLeaderUnit(c *gc.C, wanted []strin
 	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
 	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
 	model.EXPECT().Name().Return("fred").AnyTimes()
-	gomock.InOrder(
-		model.EXPECT().Config().Return(modelCfg, nil),
-		model.EXPECT().Type().Return(state.ModelTypeIAAS),
-		backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
-			ID:          "backend-id",
-			Name:        "backend-name",
-			BackendType: "some-backend",
-		}, {
-			ID:          "backend-id2",
-			Name:        "backend-name2",
-			BackendType: "some-backend2",
-		}}, nil),
-		p.EXPECT().Initialise(gomock.Any()).Return(nil),
-		leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token),
-		token.EXPECT().Check().Return(nil),
-
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			OwnerTags: []names.Tag{
-				unitTag, names.NewApplicationTag("gitlab"),
-			},
-		}).Return(owned, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
-			}, {
-				Revision: 2,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
-			}}, nil),
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
-		}).Return(read, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
-			}}, nil),
-	)
-	p.EXPECT().RestrictedConfig(&adminCfg, true, false, unitTag, ownedRevs, readRevs).Return(&adminCfg.BackendConfig, nil)
+	model.EXPECT().Config().Return(modelCfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	secretsState.EXPECT().ListReservedSecrets(
+		[]names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	).Return(nil, nil)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "backend-id",
+		Name:        "backend-name",
+		BackendType: "some-backend",
+	}, {
+		ID:          "backend-id2",
+		Name:        "backend-name2",
+		BackendType: "some-backend2",
+	}}, nil)
+	p.EXPECT().Initialise(gomock.Any()).Return(nil)
+	p.EXPECT().IssuesTokens().Return(false)
+	leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token)
+	token.EXPECT().Check().Return(nil)
 
-	info, err := secrets.BackendConfigInfo(model, true, wanted, false, unitTag, leadershipChecker)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{
+			unitTag, names.NewApplicationTag("gitlab"),
+		},
+	}).Return(owned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	}).Return(read, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
+		}}, nil)
+	p.EXPECT().RestrictedConfig(
+		&adminCfg, true, false, issuedTokenUUID, unitTag,
+		ownedIDs, ownedRevs, readRevs,
+	).Return(&adminCfg.BackendConfig, nil)
+
+	info, err := secrets.BackendConfigInfo(model, true, backendIDs, false, unitTag, leadershipChecker, nil)
 	c.Assert(err, jc.ErrorIsNil)
 	c.Assert(info, jc.DeepEquals, &provider.ModelBackendConfigInfo{
 		ActiveID: "backend-id",
@@ -353,6 +355,8 @@ func (s *secretsSuite) TestBackendConfigInfoNonLeaderUnit(c *gc.C) {
 	s.PatchValue(&secrets.GetSecretsState, func(secrets.Model) state.SecretsStore { return secretsState })
 	s.PatchValue(&secrets.GetSecretBackendsState, func(secrets.Model) state.SecretBackendsStorage { return backendState })
 
+	issuedTokenUUID := ""
+	ownedIDs := []string{"owned-1"}
 	unitOwned := []*coresecrets.SecretMetadata{
 		{URI: &coresecrets.URI{ID: "owned-1"}},
 	}
@@ -383,55 +387,59 @@ func (s *secretsSuite) TestBackendConfigInfoNonLeaderUnit(c *gc.C) {
 	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
 	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
 	model.EXPECT().Name().Return("fred").AnyTimes()
-	gomock.InOrder(
-		model.EXPECT().Config().Return(modelCfg, nil),
-		model.EXPECT().Type().Return(state.ModelTypeIAAS),
-		backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
-			ID:          "backend-id",
-			Name:        "backend-name",
-			BackendType: "some-backend",
-		}}, nil),
-		p.EXPECT().Initialise(gomock.Any()).Return(nil),
-		leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token),
-		token.EXPECT().Check().Return(leadership.NewNotLeaderError("", "")),
-
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			OwnerTags: []names.Tag{unitTag},
-		}).Return(unitOwned, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
-			}, {
-				Revision: 2,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
-			}}, nil),
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
-		}).Return(read, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
-			}}, nil),
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			OwnerTags: []names.Tag{names.NewApplicationTag("gitlab")},
-		}).Return(appOwned, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "app-owned-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-1"},
-			}, {
-				Revision: 2,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-2"},
-			}, {
-				Revision: 3,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-3"},
-			}}, nil),
-	)
-	p.EXPECT().RestrictedConfig(&adminCfg, true, false, unitTag, ownedRevs, readRevs).Return(&adminCfg.BackendConfig, nil)
-
-	info, err := secrets.BackendConfigInfo(model, true, []string{"backend-id"}, false, unitTag, leadershipChecker)
+	model.EXPECT().Config().Return(modelCfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "backend-id",
+		Name:        "backend-name",
+		BackendType: "some-backend",
+	}}, nil)
+	p.EXPECT().Initialise(gomock.Any()).Return(nil)
+	p.EXPECT().IssuesTokens().Return(false)
+	leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token)
+	token.EXPECT().Check().Return(leadership.NewNotLeaderError("", ""))
+
+	secretsState.EXPECT().ListReservedSecrets(
+		[]names.Tag{unitTag}).Return(nil, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{unitTag},
+	}).Return(unitOwned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	}).Return(read, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{names.NewApplicationTag("gitlab")},
+	}).Return(appOwned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "app-owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-2"},
+		}, {
+			Revision: 3,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-3"},
+		}}, nil)
+	p.EXPECT().RestrictedConfig(
+		&adminCfg, true, false, issuedTokenUUID, unitTag,
+		ownedIDs, ownedRevs, readRevs,
+	).Return(&adminCfg.BackendConfig, nil)
+
+	info, err := secrets.BackendConfigInfo(model, true, []string{"backend-id"}, false, unitTag, leadershipChecker, nil)
 	c.Assert(err, jc.ErrorIsNil)
 	c.Assert(info, jc.DeepEquals, &provider.ModelBackendConfigInfo{
 		ActiveID: "backend-id",
@@ -464,6 +472,10 @@ func (s *secretsSuite) TestDrainBackendConfigInfo(c *gc.C) {
 	s.PatchValue(&secrets.GetSecretsState, func(secrets.Model) state.SecretsStore { return secretsState })
 	s.PatchValue(&secrets.GetSecretBackendsState, func(secrets.Model) state.SecretBackendsStorage { return backendState })
 
+	issuedTokenUUID := ""
+	ownedIDs := []string{
+		"owned-1",
+	}
 	unitOwned := []*coresecrets.SecretMetadata{
 		{URI: &coresecrets.URI{ID: "owned-1"}},
 	}
@@ -494,53 +506,57 @@ func (s *secretsSuite) TestDrainBackendConfigInfo(c *gc.C) {
 	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
 	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
 	model.EXPECT().Name().Return("fred").AnyTimes()
-	gomock.InOrder(
-		model.EXPECT().Config().Return(modelCfg, nil),
-		model.EXPECT().Type().Return(state.ModelTypeIAAS),
-		backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
-			ID:          "backend-id",
-			Name:        "backend-name",
-			BackendType: "some-backend",
-		}}, nil),
-		p.EXPECT().Initialise(gomock.Any()).Return(nil),
-		leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token),
-		token.EXPECT().Check().Return(leadership.NewNotLeaderError("", "")),
-
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			OwnerTags: []names.Tag{unitTag},
-		}).Return(unitOwned, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
-			}, {
-				Revision: 2,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
-			}}, nil),
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
-		}).Return(read, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
-			}}, nil),
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			OwnerTags: []names.Tag{names.NewApplicationTag("gitlab")},
-		}).Return(appOwned, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "app-owned-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-1"},
-			}, {
-				Revision: 2,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-2"},
-			}, {
-				Revision: 3,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-3"},
-			}}, nil),
-	)
-	p.EXPECT().RestrictedConfig(&adminCfg, true, true, unitTag, ownedRevs, readRevs).Return(&adminCfg.BackendConfig, nil)
+	model.EXPECT().Config().Return(modelCfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "backend-id",
+		Name:        "backend-name",
+		BackendType: "some-backend",
+	}}, nil)
+	p.EXPECT().Initialise(gomock.Any()).Return(nil)
+	p.EXPECT().IssuesTokens().Return(false)
+	leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token)
+	token.EXPECT().Check().Return(leadership.NewNotLeaderError("", ""))
+
+	secretsState.EXPECT().ListReservedSecrets(
+		[]names.Tag{unitTag}).Return(nil, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{unitTag},
+	}).Return(unitOwned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	}).Return(read, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{names.NewApplicationTag("gitlab")},
+	}).Return(appOwned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "app-owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-2"},
+		}, {
+			Revision: 3,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "app-owned-rev-3"},
+		}}, nil)
+	p.EXPECT().RestrictedConfig(
+		&adminCfg, true, true, issuedTokenUUID, unitTag,
+		ownedIDs, ownedRevs, readRevs,
+	).Return(&adminCfg.BackendConfig, nil)
 
 	info, err := secrets.DrainBackendConfigInfo("backend-id", model, unitTag, leadershipChecker)
 	c.Assert(err, jc.ErrorIsNil)
@@ -616,6 +632,8 @@ func (s *secretsSuite) TestBackendConfigInfoAppTagLogin(c *gc.C) {
 	s.PatchValue(&secrets.GetSecretsState, func(secrets.Model) state.SecretsStore { return secretsState })
 	s.PatchValue(&secrets.GetSecretBackendsState, func(secrets.Model) state.SecretBackendsStorage { return backendState })
 
+	issuedTokenUUID := ""
+	ownedIDs := []string{"owned-1"}
 	owned := []*coresecrets.SecretMetadata{
 		{URI: &coresecrets.URI{ID: "owned-1"}},
 	}
@@ -642,39 +660,41 @@ func (s *secretsSuite) TestBackendConfigInfoAppTagLogin(c *gc.C) {
 	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
 	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
 	model.EXPECT().Name().Return("fred").AnyTimes()
-	gomock.InOrder(
-		model.EXPECT().Config().Return(modelCfg, nil),
-		model.EXPECT().Type().Return(state.ModelTypeIAAS),
-		backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
-			ID:          "backend-id",
-			Name:        "backend-name",
-			BackendType: "some-backend",
-		}}, nil),
-		p.EXPECT().Initialise(gomock.Any()).Return(nil),
-
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			OwnerTags: []names.Tag{appTag},
-		}).Return(owned, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
-			}, {
-				Revision: 2,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
-			}}, nil),
-		secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			ConsumerTags: []names.Tag{appTag},
-		}).Return(read, nil),
-		secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
-			Return([]*coresecrets.SecretRevisionMetadata{{
-				Revision: 1,
-				ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
-			}}, nil),
-	)
-	p.EXPECT().RestrictedConfig(&adminCfg, true, false, appTag, ownedRevs, readRevs).Return(&adminCfg.BackendConfig, nil)
-
-	info, err := secrets.BackendConfigInfo(model, true, []string{"backend-id"}, false, appTag, leadershipChecker)
+	model.EXPECT().Config().Return(modelCfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "backend-id",
+		Name:        "backend-name",
+		BackendType: "some-backend",
+	}}, nil)
+	p.EXPECT().Initialise(gomock.Any()).Return(nil)
+	p.EXPECT().IssuesTokens().Return(false)
+	secretsState.EXPECT().ListReservedSecrets([]names.Tag{appTag}).Return(nil, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{appTag},
+	}).Return(owned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		ConsumerTags: []names.Tag{appTag},
+	}).Return(read, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
+		}}, nil)
+	p.EXPECT().RestrictedConfig(
+		&adminCfg, true, false, issuedTokenUUID, appTag,
+		ownedIDs, ownedRevs, readRevs,
+	).Return(&adminCfg.BackendConfig, nil)
+
+	info, err := secrets.BackendConfigInfo(model, true, []string{"backend-id"}, false, appTag, leadershipChecker, nil)
 	c.Assert(err, jc.ErrorIsNil)
 	c.Assert(info, jc.DeepEquals, &provider.ModelBackendConfigInfo{
 		ActiveID: "backend-id",
@@ -712,21 +732,19 @@ func (s *secretsSuite) TestBackendConfigInfoFailedInvalidAuthTag(c *gc.C) {
 	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
 	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
 	model.EXPECT().Name().Return("fred").AnyTimes()
-	gomock.InOrder(
-		model.EXPECT().Config().Return(cfg, nil),
-		model.EXPECT().Type().Return(state.ModelTypeIAAS),
-		backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
-			ID:          "some-id",
-			Name:        "myvault",
-			BackendType: vault.BackendType,
-			Config: map[string]interface{}{
-				"endpoint": "http://vault",
-			},
-		}}, nil),
-		p.EXPECT().Initialise(gomock.Any()).Return(nil),
-	)
+	model.EXPECT().Config().Return(cfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "some-id",
+		Name:        "myvault",
+		BackendType: vault.BackendType,
+		Config: map[string]any{
+			"endpoint": "http://vault",
+		},
+	}}, nil)
+	p.EXPECT().Initialise(gomock.Any()).Return(nil)
 
-	_, err := secrets.BackendConfigInfo(model, true, []string{"some-id"}, false, badTag, leadershipChecker)
+	_, err := secrets.BackendConfigInfo(model, true, []string{"some-id"}, false, badTag, leadershipChecker, nil)
 	c.Assert(err, gc.ErrorMatches, `login as "user-foo" not supported`)
 }
 
@@ -925,10 +943,6 @@ func (s *secretsSuite) TestRemoveSecretsForSecretOwners(c *gc.C) {
 	})
 }
 
-func ptr[T any](v T) *T {
-	return &v
-}
-
 func (s *secretsSuite) TestRemoveSecretsByLabel(c *gc.C) {
 	ctrl := gomock.NewController(c)
 	defer ctrl.Finish()
@@ -940,7 +954,7 @@ func (s *secretsSuite) TestRemoveSecretsByLabel(c *gc.C) {
 	s.PatchValue(&secrets.GetProvider, func(string) (provider.SecretBackendProvider, error) { return mockprovider, nil })
 
 	removeState.EXPECT().ListSecrets(state.SecretsFilter{
-		Label:     ptr("my-secret"),
+		Labels:    []string{"my-secret"},
 		OwnerTags: []names.Tag{coretesting.ModelTag},
 	}).Return([]*coresecrets.SecretMetadata{{
 		URI: uri,
@@ -1004,7 +1018,6 @@ func (s *secretsSuite) TestRemoveSecretsForModelAdminFromJujuBackend(c *gc.C) {
 	c.Assert(results, jc.DeepEquals, params.ErrorResults{
 		Results: []params.ErrorResult{{}},
 	})
-
 }
 
 func (s *secretsSuite) TestRemoveSecretsForModelAdminWithRevisions(c *gc.C) {
@@ -1034,7 +1047,7 @@ func (s *secretsSuite) TestRemoveSecretsForModelAdminWithRevisions(c *gc.C) {
 		ModelName:      "fred",
 		BackendConfig: provider.BackendConfig{
 			BackendType: "some-backend",
-			Config:      map[string]interface{}{"foo": "admin"},
+			Config:      map[string]any{"foo": "admin"},
 		},
 	}
 	mockprovider.EXPECT().NewBackend(cfg).Return(backend, nil)
@@ -1102,7 +1115,7 @@ func (s *secretsSuite) TestRemoveSecretsForModelAdmin(c *gc.C) {
 		ModelName:      "fred",
 		BackendConfig: provider.BackendConfig{
 			BackendType: "some-backend",
-			Config:      map[string]interface{}{"foo": "admin"},
+			Config:      map[string]any{"foo": "admin"},
 		},
 	}
 	mockprovider.EXPECT().NewBackend(cfg).Return(backend, nil)
@@ -1177,7 +1190,7 @@ func (s *secretsSuite) TestRemoveSecretsForModelAdminDuringBackendMigration(c *g
 		ModelName:      "fred",
 		BackendConfig: provider.BackendConfig{
 			BackendType: "some-backend",
-			Config:      map[string]interface{}{"before": "migration"},
+			Config:      map[string]any{"before": "migration"},
 		},
 	}
 	backendAfterMigrationCfg := &provider.ModelBackendConfig{
@@ -1186,7 +1199,7 @@ func (s *secretsSuite) TestRemoveSecretsForModelAdminDuringBackendMigration(c *g
 		ModelName:      "fred",
 		BackendConfig: provider.BackendConfig{
 			BackendType: "some-backend",
-			Config:      map[string]interface{}{"after": "migration"},
+			Config:      map[string]any{"after": "migration"},
 		},
 	}
 
@@ -1253,7 +1266,6 @@ func (s *secretsSuite) TestRemoveSecretsForModelAdminDuringBackendMigration(c *g
 	c.Assert(results, jc.DeepEquals, params.ErrorResults{
 		Results: []params.ErrorResult{{}},
 	})
-
 }
 
 func (s *secretsSuite) TestRemoveSecretNotFoundForModelAdmin(c *gc.C) {
@@ -1333,5 +1345,234 @@ func (s *secretsSuite) TestRemoveSecretNotFoundForModelAdmin(c *gc.C) {
 	c.Assert(results, jc.DeepEquals, params.ErrorResults{
 		Results: []params.ErrorResult{{}},
 	})
+}
+
+func (s *secretsSuite) TestBackendConfigInfoIssuesToken(c *gc.C) {
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	unitTag := names.NewUnitTag("gitlab/0")
+	model := mocks.NewMockModel(ctrl)
+	leadershipChecker := mocks.NewMockChecker(ctrl)
+	token := mocks.NewMockToken(ctrl)
+	secretProvider := mocks.NewMockSecretBackendProvider(ctrl)
+	backendState := mocks.NewMockSecretBackendsStorage(ctrl)
+	secretsState := mocks.NewMockSecretsStore(ctrl)
+
+	s.PatchValue(&secrets.GetProvider, func(string) (provider.SecretBackendProvider, error) { return secretProvider, nil })
+	s.PatchValue(&secrets.GetSecretsState, func(secrets.Model) state.SecretsStore { return secretsState })
+	s.PatchValue(&secrets.GetSecretBackendsState, func(secrets.Model) state.SecretBackendsStorage { return backendState })
+
+	backendIDs := []string{"backend-id"}
+	issuedTokenUUID := ""
+	owned := []*coresecrets.SecretMetadata{
+		{URI: &coresecrets.URI{ID: "owned-1"}},
+	}
+	ownedIDs := []string{
+		"owned-1",
+	}
+	ownedRevs := map[string]set.Strings{
+		"owned-1": set.NewStrings("owned-rev-1", "owned-rev-2"),
+	}
+	read := []*coresecrets.SecretMetadata{
+		{URI: &coresecrets.URI{ID: "read-1"}},
+	}
+	readRevs := map[string]set.Strings{
+		"read-1": set.NewStrings("read-rev-1"),
+	}
+	modelCfg := coretesting.CustomModelConfig(c, coretesting.Attrs{
+		"secret-backend": "backend-name",
+	})
+	adminCfg := provider.ModelBackendConfig{
+		ControllerUUID: coretesting.ControllerTag.Id(),
+		ModelUUID:      coretesting.ModelTag.Id(),
+		ModelName:      "fred",
+		BackendConfig: provider.BackendConfig{
+			BackendType: "some-backend",
+		},
+	}
+	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
+	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
+	model.EXPECT().Name().Return("fred").AnyTimes()
+	model.EXPECT().Config().Return(modelCfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	secretsState.EXPECT().ListReservedSecrets(
+		[]names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	).Return(nil, nil)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "backend-id",
+		Name:        "backend-name",
+		BackendType: "some-backend",
+	}}, nil)
+	secretProvider.EXPECT().Initialise(gomock.Any()).Return(nil)
+	secretProvider.EXPECT().IssuesTokens().Return(true)
+	secretsState.EXPECT().CreateSecretBackendIssuedToken(
+		gomock.Any(),
+	).DoAndReturn(func(sbit state.SecretBackendIssuedToken) error {
+		issuedTokenUUID = sbit.UUID
+		c.Check(sbit.Consumer, gc.Equals, unitTag)
+		c.Check(sbit.BackendID, gc.Equals, "backend-id")
+		c.Check(sbit.ExpireTime, jc.After, time.Now())
+		return nil
+	})
+	leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token)
+	token.EXPECT().Check().Return(nil)
 
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{
+			unitTag, names.NewApplicationTag("gitlab"),
+		},
+	}).Return(owned, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "owned-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-1"},
+		}, {
+			Revision: 2,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "owned-rev-2"},
+		}}, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	}).Return(read, nil)
+	secretsState.EXPECT().ListSecretRevisions(&coresecrets.URI{ID: "read-1"}).
+		Return([]*coresecrets.SecretRevisionMetadata{{
+			Revision: 1,
+			ValueRef: &coresecrets.ValueRef{BackendID: "backend-id", RevisionID: "read-rev-1"},
+		}}, nil)
+	secretProvider.EXPECT().RestrictedConfig(
+		&adminCfg, true, false, gomock.Any(), unitTag,
+		ownedIDs, ownedRevs, readRevs,
+	).DoAndReturn(func(
+		_ *provider.ModelBackendConfig,
+		_, _ bool,
+		gotIssuedTokenUUID string,
+		_ names.Tag,
+		_ []string,
+		_, _ provider.SecretRevisions,
+	) (*provider.BackendConfig, error) {
+		c.Check(gotIssuedTokenUUID, gc.Equals, issuedTokenUUID)
+		return &adminCfg.BackendConfig, nil
+	})
+
+	info, err := secrets.BackendConfigInfo(model, true, backendIDs, false, unitTag, leadershipChecker, nil)
+	c.Assert(err, jc.ErrorIsNil)
+	c.Assert(info, jc.DeepEquals, &provider.ModelBackendConfigInfo{
+		ActiveID: "backend-id",
+		Configs: map[string]provider.ModelBackendConfig{
+			"backend-id": {
+				ControllerUUID: coretesting.ControllerTag.Id(),
+				ModelUUID:      coretesting.ModelTag.Id(),
+				ModelName:      "fred",
+				BackendConfig: provider.BackendConfig{
+					BackendType: "some-backend",
+				},
+			},
+		},
+	})
+}
+
+func (s *secretsSuite) TestBackendConfigInfoIssuesTokenWithReservedSecrets(c *gc.C) {
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	unitTag := names.NewUnitTag("gitlab/0")
+	model := mocks.NewMockModel(ctrl)
+	leadershipChecker := mocks.NewMockChecker(ctrl)
+	token := mocks.NewMockToken(ctrl)
+	secretProvider := mocks.NewMockSecretBackendProvider(ctrl)
+	backendState := mocks.NewMockSecretBackendsStorage(ctrl)
+	secretsState := mocks.NewMockSecretsStore(ctrl)
+
+	s.PatchValue(&secrets.GetProvider, func(string) (provider.SecretBackendProvider, error) { return secretProvider, nil })
+	s.PatchValue(&secrets.GetSecretsState, func(secrets.Model) state.SecretsStore { return secretsState })
+	s.PatchValue(&secrets.GetSecretBackendsState, func(secrets.Model) state.SecretBackendsStorage { return backendState })
+
+	backendIDs := []string{"backend-id"}
+	issuedTokenUUID := ""
+	reserved := []*coresecrets.URI{
+		{ID: "reserved-1"},
+	}
+	owned := []*coresecrets.SecretMetadata{}
+	ownedIDs := []string{
+		"reserved-1",
+	}
+	ownedRevs := map[string]set.Strings{}
+	read := []*coresecrets.SecretMetadata{}
+	readRevs := map[string]set.Strings{}
+	modelCfg := coretesting.CustomModelConfig(c, coretesting.Attrs{
+		"secret-backend": "backend-name",
+	})
+	adminCfg := provider.ModelBackendConfig{
+		ControllerUUID: coretesting.ControllerTag.Id(),
+		ModelUUID:      coretesting.ModelTag.Id(),
+		ModelName:      "fred",
+		BackendConfig: provider.BackendConfig{
+			BackendType: "some-backend",
+		},
+	}
+	model.EXPECT().ControllerUUID().Return(coretesting.ControllerTag.Id()).AnyTimes()
+	model.EXPECT().UUID().Return(coretesting.ModelTag.Id()).AnyTimes()
+	model.EXPECT().Name().Return("fred").AnyTimes()
+	model.EXPECT().Config().Return(modelCfg, nil)
+	model.EXPECT().Type().Return(state.ModelTypeIAAS)
+	secretsState.EXPECT().ListReservedSecrets(
+		[]names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	).Return(reserved, nil)
+	backendState.EXPECT().ListSecretBackends().Return([]*coresecrets.SecretBackend{{
+		ID:          "backend-id",
+		Name:        "backend-name",
+		BackendType: "some-backend",
+	}}, nil)
+	secretProvider.EXPECT().Initialise(gomock.Any()).Return(nil)
+	secretProvider.EXPECT().IssuesTokens().Return(true)
+	secretsState.EXPECT().CreateSecretBackendIssuedToken(
+		gomock.Any(),
+	).DoAndReturn(func(sbit state.SecretBackendIssuedToken) error {
+		issuedTokenUUID = sbit.UUID
+		c.Check(sbit.Consumer, gc.Equals, unitTag)
+		c.Check(sbit.BackendID, gc.Equals, "backend-id")
+		c.Check(sbit.ExpireTime, jc.After, time.Now())
+		return nil
+	})
+	leadershipChecker.EXPECT().LeadershipCheck("gitlab", "gitlab/0").Return(token)
+	token.EXPECT().Check().Return(nil)
+
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		OwnerTags: []names.Tag{
+			unitTag, names.NewApplicationTag("gitlab"),
+		},
+	}).Return(owned, nil)
+	secretsState.EXPECT().ListSecrets(state.SecretsFilter{
+		ConsumerTags: []names.Tag{unitTag, names.NewApplicationTag("gitlab")},
+	}).Return(read, nil)
+	secretProvider.EXPECT().RestrictedConfig(
+		&adminCfg, true, false, gomock.Any(), unitTag,
+		ownedIDs, ownedRevs, readRevs,
+	).DoAndReturn(func(
+		_ *provider.ModelBackendConfig,
+		_, _ bool,
+		gotIssuedTokenUUID string,
+		_ names.Tag,
+		_ []string,
+		_, _ provider.SecretRevisions,
+	) (*provider.BackendConfig, error) {
+		c.Check(gotIssuedTokenUUID, gc.Equals, issuedTokenUUID)
+		return &adminCfg.BackendConfig, nil
+	})
+
+	info, err := secrets.BackendConfigInfo(model, true, backendIDs, false, unitTag, leadershipChecker, nil)
+	c.Assert(err, jc.ErrorIsNil)
+	c.Assert(info, jc.DeepEquals, &provider.ModelBackendConfigInfo{
+		ActiveID: "backend-id",
+		Configs: map[string]provider.ModelBackendConfig{
+			"backend-id": {
+				ControllerUUID: coretesting.ControllerTag.Id(),
+				ModelUUID:      coretesting.ModelTag.Id(),
+				ModelName:      "fred",
+				BackendConfig: provider.BackendConfig{
+					BackendType: "some-backend",
+				},
+			},
+		},
+	})
 }

@@ -16,6 +16,7 @@ import (
 	"github.com/juju/juju/apiserver/websocket/websockettest"
 	"github.com/juju/juju/core/permission"
 	"github.com/juju/juju/rpc/params"
+	"github.com/juju/juju/state"
 	"github.com/juju/juju/testing/factory"
 )
 
@@ -97,9 +98,10 @@ func (s *debugLogDBSuite) TestUserLoginRejected(c *gc.C) {
 	websockettest.AssertWebsocketClosed(c, conn)
 }
 
-func (s *debugLogDBSuite) TestMachineLoginsAccepted(c *gc.C) {
+func (s *debugLogDBSuite) TestControllerMachineLoginsAccepted(c *gc.C) {
 	m, password := s.Factory.MakeMachineReturningPassword(c, &factory.MachineParams{
 		Nonce: "foo-nonce",
+		Jobs:  []state.MachineJob{state.JobManageModel},
 	})
 	header := jujuhttp.BasicAuthHeader(m.Tag().String(), password)
 	header.Add(params.MachineNonceHeader, "foo-nonce")
@@ -111,6 +113,20 @@ func (s *debugLogDBSuite) TestMachineLoginsAccepted(c *gc.C) {
 	c.Assert(result.Error, gc.IsNil)
 }
 
+func (s *debugLogDBSuite) TestNonControllerMachineLoginsRejected(c *gc.C) {
+	m, password := s.Factory.MakeMachineReturningPassword(c, &factory.MachineParams{
+		Nonce: "foo-nonce",
+	})
+	header := jujuhttp.BasicAuthHeader(m.Tag().String(), password)
+	header.Add(params.MachineNonceHeader, "foo-nonce")
+	conn, _, err := s.dialWebsocketInternal(c, noResultsPlease, header) //nolint:bodyclose // WebSocket library handles response body closure
+	c.Assert(err, jc.ErrorIsNil)
+	defer conn.Close()
+
+	websockettest.AssertJSONError(c, conn, "authorization failed: permission denied")
+	websockettest.AssertWebsocketClosed(c, conn)
+}
+
 func (s *debugLogDBSuite) logURL(scheme string, queryParams url.Values) *url.URL {
 	url := s.URL("/log", queryParams)
 	url.Scheme = scheme

@@ -40,6 +40,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -82,6 +97,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -98,18 +127,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -271,6 +271,20 @@ func (mr *MockSecretsStateMockRecorder) ListSecrets(arg0 any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecrets", reflect.TypeOf((*MockSecretsState)(nil).ListSecrets), arg0)
 }
 
+// ReserveSecret mocks base method.
+func (m *MockSecretsState) ReserveSecret(arg0 *secrets.URI, arg1 names.Tag) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReserveSecret", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ReserveSecret indicates an expected call of ReserveSecret.
+func (mr *MockSecretsStateMockRecorder) ReserveSecret(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReserveSecret", reflect.TypeOf((*MockSecretsState)(nil).ReserveSecret), arg0, arg1)
+}
+
 // SecretGrants mocks base method.
 func (m *MockSecretsState) SecretGrants(arg0 *secrets.URI, arg1 secrets.SecretRole) ([]secrets.AccessInfo, error) {
 	m.ctrl.T.Helper()

@@ -82,7 +82,7 @@ func NewSecretManagerAPI(context facade.Context) (*SecretsManagerAPI, error) {
 		return nil, errors.Trace(err)
 	}
 	secretBackendConfigGetter := func(backendIDs []string, wantAll bool) (*provider.ModelBackendConfigInfo, error) {
-		return secrets.BackendConfigInfo(secrets.SecretsModel(model), true, backendIDs, wantAll, context.Auth().GetAuthTag(), leadershipChecker)
+		return secrets.BackendConfigInfo(secrets.SecretsModel(model), true, backendIDs, wantAll, context.Auth().GetAuthTag(), leadershipChecker, nil)
 	}
 	secretBackendAdminConfigGetter := func() (*provider.ModelBackendConfigInfo, error) {
 		return secrets.AdminBackendConfigInfo(secrets.SecretsModel(model))

@@ -240,14 +240,19 @@ func (s *SecretsManagerAPI) getBackend(backendID string) (*secretsprovider.Model
 // CreateSecretURIs creates new secret URIs.
 func (s *SecretsManagerAPI) CreateSecretURIs(arg params.CreateSecretURIsArg) (params.StringResults, error) {
 	if arg.Count <= 0 {
-		return params.StringResults{}, errors.NotValidf("secret URi count %d", arg.Count)
+		return params.StringResults{}, errors.NotValidf("secret URI count %d", arg.Count)
 	}
 	result := params.StringResults{
 		Results: make([]params.StringResult, arg.Count),
 	}
 	for i := 0; i < arg.Count; i++ {
 		uri := coresecrets.NewURI().WithSource(s.modelUUID)
-		result.Results[i] = params.StringResult{Result: uri.String()}
+		err := s.secretsState.ReserveSecret(uri, s.authTag)
+		if err != nil {
+			result.Results[i].Error = apiservererrors.ServerError(err)
+		} else {
+			result.Results[i] = params.StringResult{Result: uri.String()}
+		}
 	}
 	return result, nil
 }

@@ -228,6 +228,9 @@ func (s *SecretsManagerSuite) TestGetSecretBackendConfigsForDrain(c *gc.C) {
 func (s *SecretsManagerSuite) TestCreateSecretURIs(c *gc.C) {
 	defer s.setup(c).Finish()
 
+	s.secretsState.EXPECT().ReserveSecret(
+		gomock.Any(), s.authTag).Return(nil).Times(2)
+
 	results, err := s.facade.CreateSecretURIs(params.CreateSecretURIsArg{
 		Count: 2,
 	})

@@ -31,7 +31,9 @@ type SecretsConsumer interface {
 	SecretAccess(uri *secrets.URI, subject names.Tag) (secrets.SecretRole, error)
 }
 
+// SecretsState provides the secrets manager agent facade access to secrets.
 type SecretsState interface {
+	ReserveSecret(*secrets.URI, names.Tag) error
 	CreateSecret(*secrets.URI, state.CreateSecretParams) (*secrets.SecretMetadata, error)
 	UpdateSecret(*secrets.URI, state.UpdateSecretParams) (*secrets.SecretMetadata, error)
 	DeleteSecret(*secrets.URI, ...int) ([]secrets.ValueRef, error)

@@ -15,6 +15,7 @@ import (
 	"github.com/juju/juju/apiserver/facade"
 	"github.com/juju/juju/apiserver/facades/agent/meterstatus"
 	"github.com/juju/juju/apiserver/facades/agent/secretsmanager"
+	"github.com/juju/juju/state"
 )
 
 // Register is called to expose a package of facades onto a given registry.
@@ -130,6 +131,7 @@ func newUniterAPI(context facade.Context) (*UniterAPI, error) {
 
 		m:                 m,
 		st:                st,
+		secrets:           state.NewSecrets(st),
 		clock:             aClock,
 		cancel:            context.Cancel(),
 		cacheModel:        cacheModel,

@@ -55,6 +55,7 @@ type UniterAPI struct {
 	lxdProfileAPI       *LXDProfileAPIv2
 	m                   *state.Model
 	st                  *state.State
+	secrets             state.SecretsStore
 	clock               clock.Clock
 	cancel              <-chan struct{}
 	auth                facade.Authorizer
@@ -2913,6 +2914,17 @@ func (u *UniterAPI) commitHookChangesForOneUnit(unitTag names.UnitTag, changes p
 		}
 	}
 
+	// Remove any secret reservations that, by this point, have not been
+	// turned into a secret. Secrets are reserved by the uniter in a call to
+	// CreateSecretURIs.
+	modelOps = append(modelOps, u.secrets.RemoveSecretReservations(unitTag))
+
+	// Expire any secret issued backend tokens that, by this point, should no
+	// longer be used by this agent.
+	modelOps = append(
+		modelOps, u.secrets.ExpireSecretBackendIssuedTokensForConsumer(unitTag),
+	)
+
 	// Apply all changes in a single transaction.
 	return u.st.ApplyOperation(state.ComposeModelOperations(modelOps...))
 }

@@ -4762,6 +4762,84 @@ func (s *uniterSuite) TestCommitHookChangesWithSecrets(c *gc.C) {
 	c.Assert(info.LatestRevision, gc.Equals, 2)
 }
 
+func (s *uniterSuite) TestCommitHookChangesRemovesSecretReservations(c *gc.C) {
+	store := state.NewSecrets(s.State)
+
+	// Reserve some secrets for the unit.
+	for range 10 {
+		u := secrets.NewURI()
+		err := store.ReserveSecret(u, s.wordpressUnit.Tag())
+		c.Assert(err, jc.ErrorIsNil)
+	}
+	reserved, err := store.ListReservedSecrets([]names.Tag{
+		s.wordpressUnit.Tag(),
+	})
+	c.Assert(err, jc.ErrorIsNil)
+	c.Check(reserved, gc.HasLen, 10)
+
+	// Commit the hook changes.
+	b := apiuniter.NewCommitHookParamsBuilder(s.wordpressUnit.UnitTag())
+	b.UpdateCharmState(map[string]string{"charm-key": "charm-value"})
+	req, _ := b.Build()
+
+	result, err := s.uniter.CommitHookChanges(req)
+	c.Assert(err, jc.ErrorIsNil)
+	c.Check(result, gc.DeepEquals, params.ErrorResults{
+		Results: []params.ErrorResult{
+			{Error: nil},
+		},
+	})
+
+	// Check all the secret reservations were removed.
+	reserved, err = store.ListReservedSecrets([]names.Tag{s.wordpressUnit.Tag()})
+	c.Assert(err, jc.ErrorIsNil)
+	c.Assert(reserved, gc.HasLen, 0)
+}
+
+func (s *uniterSuite) TestCommitHookChangesExpiresSecretBackendTokens(c *gc.C) {
+	store := state.NewSecrets(s.State)
+	now := time.Now()
+
+	// Create some secret backend issued tokens that are not expired yet.
+	for range 10 {
+		issuedToken := state.SecretBackendIssuedToken{
+			UUID:       utils.MustNewUUID().String(),
+			ExpireTime: now.Add(time.Hour),
+			BackendID:  "backend-id",
+			Consumer:   s.wordpressUnit.Tag(),
+		}
+		err := store.CreateSecretBackendIssuedToken(issuedToken)
+		c.Assert(err, jc.ErrorIsNil)
+	}
+	tokens, err := store.ListSecretBackendIssuedTokenUntilForConsumer(
+		now, s.wordpressUnit.Tag())
+	c.Assert(err, jc.ErrorIsNil)
+	c.Check(tokens, gc.HasLen, 0)
+	tokens, err = store.ListSecretBackendIssuedTokenUntilForConsumer(
+		now.Add(time.Hour).Add(time.Minute), s.wordpressUnit.Tag())
+	c.Assert(err, jc.ErrorIsNil)
+	c.Check(tokens, gc.HasLen, 10)
+
+	// Commit the hook changes.
+	b := apiuniter.NewCommitHookParamsBuilder(s.wordpressUnit.UnitTag())
+	b.UpdateCharmState(map[string]string{"charm-key": "charm-value"})
+	req, _ := b.Build()
+
+	result, err := s.uniter.CommitHookChanges(req)
+	c.Assert(err, jc.ErrorIsNil)
+	c.Check(result, gc.DeepEquals, params.ErrorResults{
+		Results: []params.ErrorResult{
+			{Error: nil},
+		},
+	})
+
+	// Check that the secret backend issued tokens are all expired now.
+	tokens, err = store.ListSecretBackendIssuedTokenUntilForConsumer(
+		now, s.wordpressUnit.Tag())
+	c.Assert(err, jc.ErrorIsNil)
+	c.Check(tokens, gc.HasLen, 10)
+}
+
 func (s *uniterSuite) TestCommitHookChangesWithStorage(c *gc.C) {
 	// We need to set up a unit that has storage metadata defined.
 	ch := s.AddTestingCharm(c, "storage-block2") // supports multiple storage instances

@@ -11,6 +11,7 @@ package mocks
 
 import (
 	reflect "reflect"
+	time "time"
 
 	set "github.com/juju/collections/set"
 	network "github.com/juju/juju/core/network"
@@ -548,6 +549,20 @@ func (mr *MockSecretsStoreMockRecorder) CreateSecret(arg0, arg1 any) *gomock.Cal
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateSecret", reflect.TypeOf((*MockSecretsStore)(nil).CreateSecret), arg0, arg1)
 }
 
+// CreateSecretBackendIssuedToken mocks base method.
+func (m *MockSecretsStore) CreateSecretBackendIssuedToken(arg0 state.SecretBackendIssuedToken) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CreateSecretBackendIssuedToken", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CreateSecretBackendIssuedToken indicates an expected call of CreateSecretBackendIssuedToken.
+func (mr *MockSecretsStoreMockRecorder) CreateSecretBackendIssuedToken(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateSecretBackendIssuedToken", reflect.TypeOf((*MockSecretsStore)(nil).CreateSecretBackendIssuedToken), arg0)
+}
+
 // DeleteSecret mocks base method.
 func (m *MockSecretsStore) DeleteSecret(arg0 *secrets.URI, arg1 ...int) ([]secrets.ValueRef, error) {
 	m.ctrl.T.Helper()
@@ -568,6 +583,20 @@ func (mr *MockSecretsStoreMockRecorder) DeleteSecret(arg0 any, arg1 ...any) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteSecret", reflect.TypeOf((*MockSecretsStore)(nil).DeleteSecret), varargs...)
 }
 
+// ExpireSecretBackendIssuedTokensForConsumer mocks base method.
+func (m *MockSecretsStore) ExpireSecretBackendIssuedTokensForConsumer(arg0 names.Tag) state.ModelOperation {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ExpireSecretBackendIssuedTokensForConsumer", arg0)
+	ret0, _ := ret[0].(state.ModelOperation)
+	return ret0
+}
+
+// ExpireSecretBackendIssuedTokensForConsumer indicates an expected call of ExpireSecretBackendIssuedTokensForConsumer.
+func (mr *MockSecretsStoreMockRecorder) ExpireSecretBackendIssuedTokensForConsumer(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ExpireSecretBackendIssuedTokensForConsumer", reflect.TypeOf((*MockSecretsStore)(nil).ExpireSecretBackendIssuedTokensForConsumer), arg0)
+}
+
 // GetOwnedSecretMetadataAsApp mocks base method.
 func (m *MockSecretsStore) GetOwnedSecretMetadataAsApp(arg0 names.ApplicationTag, arg1 *secrets.URI) (*secrets.SecretMetadataOwnerIdent, error) {
 	m.ctrl.T.Helper()
@@ -734,6 +763,51 @@ func (mr *MockSecretsStoreMockRecorder) ListModelSecrets(arg0 any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListModelSecrets", reflect.TypeOf((*MockSecretsStore)(nil).ListModelSecrets), arg0)
 }
 
+// ListReservedSecrets mocks base method.
+func (m *MockSecretsStore) ListReservedSecrets(arg0 []names.Tag) ([]*secrets.URI, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListReservedSecrets", arg0)
+	ret0, _ := ret[0].([]*secrets.URI)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListReservedSecrets indicates an expected call of ListReservedSecrets.
+func (mr *MockSecretsStoreMockRecorder) ListReservedSecrets(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListReservedSecrets", reflect.TypeOf((*MockSecretsStore)(nil).ListReservedSecrets), arg0)
+}
+
+// ListSecretBackendIssuedTokenUntil mocks base method.
+func (m *MockSecretsStore) ListSecretBackendIssuedTokenUntil(arg0 time.Time) ([]state.SecretBackendIssuedToken, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListSecretBackendIssuedTokenUntil", arg0)
+	ret0, _ := ret[0].([]state.SecretBackendIssuedToken)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListSecretBackendIssuedTokenUntil indicates an expected call of ListSecretBackendIssuedTokenUntil.
+func (mr *MockSecretsStoreMockRecorder) ListSecretBackendIssuedTokenUntil(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecretBackendIssuedTokenUntil", reflect.TypeOf((*MockSecretsStore)(nil).ListSecretBackendIssuedTokenUntil), arg0)
+}
+
+// ListSecretBackendIssuedTokenUntilForConsumer mocks base method.
+func (m *MockSecretsStore) ListSecretBackendIssuedTokenUntilForConsumer(arg0 time.Time, arg1 names.Tag) ([]state.SecretBackendIssuedToken, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListSecretBackendIssuedTokenUntilForConsumer", arg0, arg1)
+	ret0, _ := ret[0].([]state.SecretBackendIssuedToken)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListSecretBackendIssuedTokenUntilForConsumer indicates an expected call of ListSecretBackendIssuedTokenUntilForConsumer.
+func (mr *MockSecretsStoreMockRecorder) ListSecretBackendIssuedTokenUntilForConsumer(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecretBackendIssuedTokenUntilForConsumer", reflect.TypeOf((*MockSecretsStore)(nil).ListSecretBackendIssuedTokenUntilForConsumer), arg0, arg1)
+}
+
 // ListSecretRevisions mocks base method.
 func (m *MockSecretsStore) ListSecretRevisions(arg0 *secrets.URI) ([]*secrets.SecretRevisionMetadata, error) {
 	m.ctrl.T.Helper()
@@ -779,6 +853,63 @@ func (mr *MockSecretsStoreMockRecorder) ListUnusedSecretRevisions(arg0 any) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUnusedSecretRevisions", reflect.TypeOf((*MockSecretsStore)(nil).ListUnusedSecretRevisions), arg0)
 }
 
+// NextSecretBackendIssuedTokenExpiry mocks base method.
+func (m *MockSecretsStore) NextSecretBackendIssuedTokenExpiry() (time.Time, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NextSecretBackendIssuedTokenExpiry")
+	ret0, _ := ret[0].(time.Time)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// NextSecretBackendIssuedTokenExpiry indicates an expected call of NextSecretBackendIssuedTokenExpiry.
+func (mr *MockSecretsStoreMockRecorder) NextSecretBackendIssuedTokenExpiry() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NextSecretBackendIssuedTokenExpiry", reflect.TypeOf((*MockSecretsStore)(nil).NextSecretBackendIssuedTokenExpiry))
+}
+
+// RemoveSecretBackendIssuedTokens mocks base method.
+func (m *MockSecretsStore) RemoveSecretBackendIssuedTokens(arg0 []string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveSecretBackendIssuedTokens", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RemoveSecretBackendIssuedTokens indicates an expected call of RemoveSecretBackendIssuedTokens.
+func (mr *MockSecretsStoreMockRecorder) RemoveSecretBackendIssuedTokens(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecretBackendIssuedTokens", reflect.TypeOf((*MockSecretsStore)(nil).RemoveSecretBackendIssuedTokens), arg0)
+}
+
+// RemoveSecretReservations mocks base method.
+func (m *MockSecretsStore) RemoveSecretReservations(arg0 names.Tag) state.ModelOperation {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveSecretReservations", arg0)
+	ret0, _ := ret[0].(state.ModelOperation)
+	return ret0
+}
+
+// RemoveSecretReservations indicates an expected call of RemoveSecretReservations.
+func (mr *MockSecretsStoreMockRecorder) RemoveSecretReservations(arg0 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecretReservations", reflect.TypeOf((*MockSecretsStore)(nil).RemoveSecretReservations), arg0)
+}
+
+// ReserveSecret mocks base method.
+func (m *MockSecretsStore) ReserveSecret(arg0 *secrets.URI, arg1 names.Tag) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReserveSecret", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ReserveSecret indicates an expected call of ReserveSecret.
+func (mr *MockSecretsStoreMockRecorder) ReserveSecret(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReserveSecret", reflect.TypeOf((*MockSecretsStore)(nil).ReserveSecret), arg0, arg1)
+}
+
 // SecretGrants mocks base method.
 func (m *MockSecretsStore) SecretGrants(arg0 *secrets.URI, arg1 secrets.SecretRole) ([]secrets.AccessInfo, error) {
 	m.ctrl.T.Helper()
@@ -853,3 +984,17 @@ func (mr *MockSecretsStoreMockRecorder) WatchRevisionsToPrune(arg0 any) *gomock.
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchRevisionsToPrune", reflect.TypeOf((*MockSecretsStore)(nil).WatchRevisionsToPrune), arg0)
 }
+
+// WatchSecretBackendIssuedTokenExpiry mocks base method.
+func (m *MockSecretsStore) WatchSecretBackendIssuedTokenExpiry() state.StringsWatcher {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WatchSecretBackendIssuedTokenExpiry")
+	ret0, _ := ret[0].(state.StringsWatcher)
+	return ret0
+}
+
+// WatchSecretBackendIssuedTokenExpiry indicates an expected call of WatchSecretBackendIssuedTokenExpiry.
+func (mr *MockSecretsStoreMockRecorder) WatchSecretBackendIssuedTokenExpiry() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchSecretBackendIssuedTokenExpiry", reflect.TypeOf((*MockSecretsStore)(nil).WatchSecretBackendIssuedTokenExpiry))
+}

@@ -72,6 +72,19 @@ func (api *BaseAPI) modelForName(modelName, ownerName string) (Model, string, bo
 	return model, modelPath, model != nil, nil
 }
 
+// resolveUserDisplayName resolves the display name of a user.
+// External users return an empty display name.
+func (api *BaseAPI) resolveUserDisplayName(backend Backend, user names.UserTag) (string, error) {
+	u, err := backend.User(user)
+	if errors.Is(err, errors.NotFound) {
+		// External users don't have display names.
+		return "", nil
+	} else if err != nil {
+		return "", errors.Trace(err)
+	}
+	return u.DisplayName(), nil
+}
+
 // applicationOffersFromModel gets details about remote applications that match given filters.
 func (api *BaseAPI) applicationOffersFromModel(
 	modelUUID string,
@@ -103,12 +116,9 @@ func (api *BaseAPI) applicationOffersFromModel(
 		return nil, errors.Trace(err)
 	}
 
-	var apiUserDisplayName string
-	u, err := backend.User(user)
-	if err != nil && !errors.Is(err, errors.NotFound) {
+	apiUserDisplayName, err := api.resolveUserDisplayName(backend, user)
+	if err != nil {
 		return nil, errors.Trace(err)
-	} else if err == nil {
-		apiUserDisplayName = u.DisplayName()
 	}
 
 	var results []params.ApplicationOfferAdminDetailsV5

@@ -228,7 +228,6 @@ func (c *Client) FullStatus(args params.StatusParams) (params.FullStatus, error)
 
 	var noStatus params.FullStatus
 	var context statusContext
-	context.cachedModel = c.modelCache
 	context.appCharmCache = map[string]string{}
 
 	m, err := c.stateAccessor.Model()
@@ -678,7 +677,6 @@ type applicationStatusInfo struct {
 
 type statusContext struct {
 	providerType string
-	cachedModel  *cache.Model
 	model        *state.Model
 	status       *state.ModelStatus
 	presence     common.ModelPresenceContext
@@ -1417,21 +1415,64 @@ func (context *statusContext) processApplication(application *state.Application)
 		return processedStatus
 	}
 	units := context.allAppsUnitsCharmBindings.units[application.Name()]
+
+	expectWorkload := false
+	if context.model.Type() == state.ModelTypeCAAS {
+		if charm.MetaFormat(applicationCharm) == charm.FormatV1 {
+			cm, err := context.model.CAASModel()
+			if err != nil {
+				processedStatus.Err = apiservererrors.ServerError(err)
+				return processedStatus
+			}
+			_, err = cm.PodSpec(application.ApplicationTag())
+			if err != nil && !errors.Is(err, errors.NotFound) {
+				processedStatus.Err = apiservererrors.ServerError(err)
+				return processedStatus
+			}
+			expectWorkload = err == nil
+		}
+	}
 	if application.IsPrincipal() {
-		expectWorkload, err := state.CheckApplicationExpectsWorkload(context.model, application.Name())
-		if err != nil {
-			return params.ApplicationStatus{Err: apiservererrors.ServerError(err)}
+		processedStatus.Units = context.processUnits(
+			units, applicationCharm.URL(), expectWorkload)
+	}
+
+	applicationStatus, err := application.Status()
+	if err != nil && !errors.Is(err, errors.NotFound) {
+		processedStatus.Err = apiservererrors.ServerError(err)
+		return processedStatus
+	}
+	if applicationStatus.Status == status.Unset {
+		// Derive the application status from the non-presence affected unit
+		// workload status
+		statuses := make([]status.StatusInfo, 0, len(units))
+		for unitName := range units {
+			status, err := context.status.UnitWorkload(unitName, expectWorkload)
+			if errors.Is(err, errors.NotFound) {
+				continue
+			} else if err != nil {
+				processedStatus.Err = apiservererrors.ServerError(err)
+				return processedStatus
+			}
+			statuses = append(statuses, status)
+		}
+		derivedApplicationStatus := status.DeriveStatus(statuses)
+		if derivedApplicationStatus.Since == nil {
+			derivedApplicationStatus.Since = applicationStatus.Since
 		}
-		processedStatus.Units = context.processUnits(units, applicationCharm.URL(), expectWorkload)
+		applicationStatus = derivedApplicationStatus
 	}
 
-	// If for whatever reason the application isn't yet in the cache,
-	// we have an unknown status.
-	applicationStatus := status.StatusInfo{Status: status.Unknown}
-	cachedApp, err := context.cachedModel.Application(application.Name())
-	if err == nil {
-		applicationStatus = cachedApp.DisplayStatus()
+	if context.model.Type() == state.ModelTypeCAAS {
+		operatorStatus, err := application.OperatorStatus()
+		if err != nil && !errors.Is(err, errors.NotFound) {
+			processedStatus.Err = apiservererrors.ServerError(err)
+			return processedStatus
+		}
+		applicationStatus = status.ApplicationDisplayStatus(
+			applicationStatus, operatorStatus, expectWorkload)
 	}
+
 	processedStatus.Status.Status = applicationStatus.Status.String()
 	processedStatus.Status.Info = applicationStatus.Message
 	processedStatus.Status.Data = applicationStatus.Data

@@ -42,6 +42,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -84,6 +99,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -100,18 +129,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -42,6 +42,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -84,6 +99,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -100,18 +129,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -22,6 +22,8 @@ type SecretsBackendState interface {
 	GetSecretBackendByID(ID string) (*secrets.SecretBackend, error)
 }
 
+// SecretsState provides the secrets backends client facade access to list model
+// secrets.
 type SecretsState interface {
 	ListModelSecrets(all bool) (map[string]set.Strings, error)
 }

@@ -123,6 +123,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -165,6 +180,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -181,18 +210,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -167,6 +167,20 @@ func (mr *MockSecretsStateMockRecorder) ListUnusedSecretRevisions(arg0 any) *gom
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListUnusedSecretRevisions", reflect.TypeOf((*MockSecretsState)(nil).ListUnusedSecretRevisions), arg0)
 }
 
+// ReserveSecret mocks base method.
+func (m *MockSecretsState) ReserveSecret(arg0 *secrets.URI, arg1 names.Tag) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ReserveSecret", arg0, arg1)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ReserveSecret indicates an expected call of ReserveSecret.
+func (mr *MockSecretsStateMockRecorder) ReserveSecret(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ReserveSecret", reflect.TypeOf((*MockSecretsState)(nil).ReserveSecret), arg0, arg1)
+}
+
 // SecretGrants mocks base method.
 func (m *MockSecretsState) SecretGrants(arg0 *secrets.URI, arg1 secrets.SecretRole) ([]secrets.AccessInfo, error) {
 	m.ctrl.T.Helper()

@@ -11,6 +11,7 @@ import (
 
 	apiservererrors "github.com/juju/juju/apiserver/errors"
 	"github.com/juju/juju/apiserver/facade"
+	coresecrets "github.com/juju/juju/core/secrets"
 	"github.com/juju/juju/secrets/provider"
 	coretesting "github.com/juju/juju/testing"
 )
@@ -27,7 +28,7 @@ func NewTestAPI(
 	secretsState SecretsState,
 	secretsConsumer SecretsConsumer,
 	adminBackendConfigGetter func() (*provider.ModelBackendConfigInfo, error),
-	backendConfigGetterForUserSecretsWrite func(backendID string) (*provider.ModelBackendConfigInfo, error),
+	backendConfigGetterForUserSecretsWrite func(string, []*coresecrets.URI) (*provider.ModelBackendConfigInfo, error),
 	backendGetter func(*provider.ModelBackendConfig) (provider.SecretsBackend, error),
 ) (*SecretsAPI, error) {
 	if !authorizer.AuthClient() {

@@ -11,6 +11,7 @@ import (
 	"github.com/juju/juju/apiserver/common/secrets"
 	apiservererrors "github.com/juju/juju/apiserver/errors"
 	"github.com/juju/juju/apiserver/facade"
+	coresecrets "github.com/juju/juju/core/secrets"
 	"github.com/juju/juju/secrets/provider"
 	"github.com/juju/juju/state"
 )
@@ -50,10 +51,15 @@ func newSecretsAPI(context facade.Context) (*SecretsAPI, error) {
 	adminBackendConfigGetter := func() (*provider.ModelBackendConfigInfo, error) {
 		return secrets.AdminBackendConfigInfo(secrets.SecretsModel(model))
 	}
-	backendConfigGetterForUserSecretsWrite := func(backendID string) (*provider.ModelBackendConfigInfo, error) {
+	backendConfigGetterForUserSecretsWrite := func(
+		backendID string, only []*coresecrets.URI,
+	) (*provider.ModelBackendConfigInfo, error) {
 		// User secrets are owned by the model.
 		authTag := model.ModelTag()
-		return secrets.BackendConfigInfo(secrets.SecretsModel(model), true, []string{backendID}, false, authTag, leadershipChecker)
+		return secrets.BackendConfigInfo(
+			secrets.SecretsModel(model), true, []string{backendID}, false,
+			authTag, leadershipChecker, only,
+		)
 	}
 
 	backendGetter := func(cfg *provider.ModelBackendConfig) (provider.SecretsBackend, error) {

@@ -41,7 +41,7 @@ type SecretsAPI struct {
 	secretsConsumer SecretsConsumer
 
 	adminBackendConfigGetter               func() (*provider.ModelBackendConfigInfo, error)
-	backendConfigGetterForUserSecretsWrite func(backendID string) (*provider.ModelBackendConfigInfo, error)
+	backendConfigGetterForUserSecretsWrite func(backendID string, only []*coresecrets.URI) (*provider.ModelBackendConfigInfo, error)
 	backendGetter                          func(*provider.ModelBackendConfig) (provider.SecretsBackend, error)
 }
 
@@ -81,17 +81,16 @@ func (s *SecretsAPI) ListSecrets(arg params.ListSecretsArgs) (params.ListSecretR
 			return result, errors.Trace(err)
 		}
 	}
-	var uri *coresecrets.URI
+	filter := state.SecretsFilter{}
 	if arg.Filter.URI != nil {
-		var err error
-		uri, err = coresecrets.ParseURI(*arg.Filter.URI)
+		uri, err := coresecrets.ParseURI(*arg.Filter.URI)
 		if err != nil {
 			return params.ListSecretResults{}, errors.Trace(err)
 		}
+		filter.URIs = append(filter.URIs, uri)
 	}
-	filter := state.SecretsFilter{
-		URI:   uri,
-		Label: arg.Filter.Label,
+	if arg.Filter.Label != nil {
+		filter.Labels = append(filter.Labels, *arg.Filter.Label)
 	}
 	if arg.Filter.OwnerTag != nil {
 		tag, err := names.ParseTag(*arg.Filter.OwnerTag)
@@ -241,13 +240,18 @@ func (s *SecretsAPI) secretContentFromBackend(uri *coresecrets.URI, rev int) (co
 	}
 }
 
-func (s *SecretsAPI) getBackendForUserSecretsWrite() (provider.SecretsBackend, error) {
+// getBackendForUserSecretsWrite returns the secret backend for user secrets,
+// optionally limited to the list of secrets if a non-zero number is supplied.
+func (s *SecretsAPI) getBackendForUserSecretsWrite(
+	only []*coresecrets.URI,
+) (provider.SecretsBackend, error) {
 	if s.activeBackendID == "" {
 		if err := s.getBackendInfo(); err != nil {
 			return nil, errors.Trace(err)
 		}
 	}
-	cfgInfo, err := s.backendConfigGetterForUserSecretsWrite(s.activeBackendID)
+	cfgInfo, err := s.backendConfigGetterForUserSecretsWrite(
+		s.activeBackendID, only)
 	if err != nil {
 		return nil, errors.Trace(err)
 	}
@@ -270,13 +274,53 @@ func (s *SecretsAPI) CreateSecrets(args params.CreateSecretArgs) (params.StringR
 	if err := s.checkCanWrite(); err != nil {
 		return result, errors.Trace(err)
 	}
-	backend, err := s.getBackendForUserSecretsWrite()
+
+	// Validate secrets before generating a secret URI.
+	for i, arg := range args.Args {
+		var err error
+		if arg.URI != nil {
+			err = errors.NotValidf(
+				"secret uri cannot be set on user secret create",
+			)
+		}
+		if arg.OwnerTag != "" && arg.OwnerTag != s.modelUUID {
+			err = errors.NotValidf("owner tag %q", arg.OwnerTag)
+		}
+		if len(arg.Content.Data) == 0 {
+			err = errors.NotValidf("empty secret value")
+		}
+		if err != nil {
+			result.Results[i].Error = apiservererrors.ServerError(err)
+		}
+	}
+
+	secretOwner := names.NewModelTag(s.modelUUID)
+	uris := make([]*coresecrets.URI, len(args.Args))
+	// Generate secret URIs
+	for i := range args.Args {
+		if result.Results[i].Error != nil {
+			continue
+		}
+
+		uri := coresecrets.NewURI()
+		err := s.secretsState.ReserveSecret(uri, secretOwner)
+		if err != nil {
+			result.Results[i].Error = apiservererrors.ServerError(err)
+			continue
+		}
+		uris[i] = uri
+	}
+
+	backend, err := s.getBackendForUserSecretsWrite(uris)
 	if err != nil {
 		return result, errors.Trace(err)
 	}
 	for i, arg := range args.Args {
-		ID, err := s.createSecret(backend, arg)
-		result.Results[i].Result = ID
+		if result.Results[i].Error != nil {
+			continue
+		}
+		var err error
+		result.Results[i].Result, err = s.createSecret(backend, arg, uris[i])
 		if errors.Is(err, state.LabelExists) {
 			err = errors.AlreadyExistsf("secret with name %q", *arg.Label)
 		}
@@ -292,44 +336,32 @@ func (t successfulToken) Check() error {
 	return nil
 }
 
-func (s *SecretsAPI) createSecret(backend provider.SecretsBackend, arg params.CreateSecretArg) (_ string, errOut error) {
-	if arg.OwnerTag != "" && arg.OwnerTag != s.modelUUID {
-		return "", errors.NotValidf("owner tag %q", arg.OwnerTag)
-	}
+func (s *SecretsAPI) createSecret(
+	backend provider.SecretsBackend,
+	arg params.CreateSecretArg,
+	uri *coresecrets.URI,
+) (_ string, errOut error) {
 	secretOwner := names.NewModelTag(s.modelUUID)
-	var uri *coresecrets.URI
-	var err error
-	if arg.URI != nil {
-		uri, err = coresecrets.ParseURI(*arg.URI)
-		if err != nil {
-			return "", errors.Trace(err)
-		}
-	} else {
-		uri = coresecrets.NewURI()
-	}
 
-	if len(arg.Content.Data) == 0 {
-		return "", errors.NotValidf("empty secret value")
-	}
 	v := coresecrets.NewSecretValue(arg.Content.Data)
 	checksum, err := v.Checksum()
 	if err != nil {
 		return "", errors.Annotate(err, "calculating secret checksum")
 	}
 	arg.UpsertSecretArg.Content.Checksum = checksum
+
 	revId, err := backend.SaveContent(context.TODO(), uri, 1, coresecrets.NewSecretValue(arg.Content.Data))
 	if err != nil && !errors.Is(err, errors.NotSupported) {
 		return "", errors.Trace(err)
-	}
-	if err == nil {
+	} else if err == nil {
 		defer func() {
 			if errOut != nil {
 				// If we failed to create the secret, we should delete the
 				// secret value from the backend.
-				if err2 := backend.DeleteContent(context.TODO(), revId); err2 != nil &&
-					!errors.Is(err2, errors.NotSupported) &&
-					!errors.Is(err2, errors.NotFound) {
-					logger.Errorf("failed to delete secret %q: %v", revId, err2)
+				if err := backend.DeleteContent(context.TODO(), revId); err != nil &&
+					!errors.Is(err, errors.NotSupported) &&
+					!errors.Is(err, errors.NotFound) {
+					logger.Errorf("failed to delete secret %q: %v", revId, err)
 				}
 			}
 		}()
@@ -400,12 +432,26 @@ func (s *SecretsAPI) UpdateSecrets(args params.UpdateUserSecretArgs) (params.Err
 	if err := s.checkCanWrite(); err != nil {
 		return result, errors.Trace(err)
 	}
-	backend, err := s.getBackendForUserSecretsWrite()
+
+	uris := make([]*coresecrets.URI, len(args.Args))
+	for i, arg := range args.Args {
+		var err error
+		if arg.URI != "" {
+			uris[i], err = coresecrets.ParseURI(arg.URI)
+		} else {
+			uris[i], err = s.getSecretURI(s.modelUUID, arg.ExistingLabel)
+		}
+		if err != nil {
+			result.Results[i].Error = apiservererrors.ServerError(err)
+		}
+	}
+
+	backend, err := s.getBackendForUserSecretsWrite(uris)
 	if err != nil {
 		return result, errors.Trace(err)
 	}
 	for i, arg := range args.Args {
-		err := s.updateSecret(backend, arg)
+		err := s.updateSecret(backend, arg, uris[i])
 		if errors.Is(err, state.LabelExists) {
 			err = errors.AlreadyExistsf("secret with name %q", *arg.Label)
 		}
@@ -414,22 +460,14 @@ func (s *SecretsAPI) UpdateSecrets(args params.UpdateUserSecretArgs) (params.Err
 	return result, nil
 }
 
-func (s *SecretsAPI) updateSecret(backend provider.SecretsBackend, arg params.UpdateUserSecretArg) (errOut error) {
+func (s *SecretsAPI) updateSecret(
+	backend provider.SecretsBackend,
+	arg params.UpdateUserSecretArg,
+	uri *coresecrets.URI,
+) (errOut error) {
 	if err := arg.Validate(); err != nil {
 		return errors.Trace(err)
 	}
-	var (
-		uri *coresecrets.URI
-		err error
-	)
-	if arg.URI != "" {
-		uri, err = coresecrets.ParseURI(arg.URI)
-	} else {
-		uri, err = s.getSecretURI(s.modelUUID, arg.ExistingLabel)
-	}
-	if err != nil {
-		return errors.Trace(err)
-	}
 
 	md, err := s.secretsState.GetSecret(uri)
 	if err != nil {
@@ -557,7 +595,7 @@ type grantRevokeFunc func(*coresecrets.URI, state.SecretAccessParams) error
 
 func (s *SecretsAPI) getSecretURI(modelUUID, label string) (*coresecrets.URI, error) {
 	results, err := s.secretsState.ListSecrets(state.SecretsFilter{
-		Label:     &label,
+		Labels:    []string{label},
 		OwnerTags: []names.Tag{names.NewModelTag(modelUUID)},
 	})
 	if err != nil {

@@ -68,8 +68,8 @@ func adminBackendConfigGetter() (*provider.ModelBackendConfigInfo, error) {
 	}, nil
 }
 
-func backendConfigGetterForUserSecretsWrite(c *gc.C) func(backendID string) (*provider.ModelBackendConfigInfo, error) {
-	return func(backendID string) (*provider.ModelBackendConfigInfo, error) {
+func backendConfigGetterForUserSecretsWrite(c *gc.C) func(string, []*coresecrets.URI) (*provider.ModelBackendConfigInfo, error) {
+	return func(backendID string, _ []*coresecrets.URI) (*provider.ModelBackendConfigInfo, error) {
 		c.Assert(backendID, gc.Equals, "backend-id")
 		return &provider.ModelBackendConfigInfo{
 			ActiveID: "backend-id",
@@ -326,13 +326,19 @@ func (s *SecretsSuite) assertCreateSecrets(c *gc.C, isInternal bool, finalStepFa
 	s.expectAuthClient()
 	s.authorizer.EXPECT().HasPermission(permission.WriteAccess, coretesting.ModelTag).Return(nil)
 
-	uri := coresecrets.NewURI()
-	uriStrPtr := ptr(uri.String())
+	var uri *coresecrets.URI
+	s.secretsState.EXPECT().ReserveSecret(
+		gomock.Any(), coretesting.ModelTag,
+	).DoAndReturn(func(arg1 *coresecrets.URI, owner names.Tag) error {
+		uri = arg1
+		return nil
+	})
+
 	if isInternal {
-		s.secretsBackend.EXPECT().SaveContent(gomock.Any(), uri, 1, coresecrets.NewSecretValue(map[string]string{"foo": "bar"})).
+		s.secretsBackend.EXPECT().SaveContent(gomock.Any(), gomock.Any(), 1, coresecrets.NewSecretValue(map[string]string{"foo": "bar"})).
 			Return("", errors.NotSupportedf("not supported"))
 	} else {
-		s.secretsBackend.EXPECT().SaveContent(gomock.Any(), uri, 1, coresecrets.NewSecretValue(map[string]string{"foo": "bar"})).
+		s.secretsBackend.EXPECT().SaveContent(gomock.Any(), gomock.Any(), 1, coresecrets.NewSecretValue(map[string]string{"foo": "bar"})).
 			Return("rev-id", nil)
 	}
 	s.secretsState.EXPECT().CreateSecret(gomock.Any(), gomock.Any()).DoAndReturn(func(arg1 *coresecrets.URI, params state.CreateSecretParams) (*coresecrets.SecretMetadata, error) {
@@ -381,7 +387,6 @@ func (s *SecretsSuite) assertCreateSecrets(c *gc.C, isInternal bool, finalStepFa
 		Args: []params.CreateSecretArg{
 			{
 				OwnerTag: coretesting.ModelTag.Id(),
-				URI:      uriStrPtr,
 				UpsertSecretArg: params.UpsertSecretArg{
 					Description: ptr("this is a user secret."),
 					Label:       ptr("label"),
@@ -425,7 +430,7 @@ func (s *SecretsSuite) assertUpdateSecrets(c *gc.C, uri *coresecrets.URI, isInte
 		existingLabel = "my-secret"
 		uri = coresecrets.NewURI()
 		s.secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-			Label:     ptr("my-secret"),
+			Labels:    []string{"my-secret"},
 			OwnerTags: []names.Tag{coretesting.ModelTag},
 		}).Return([]*coresecrets.SecretMetadata{{
 			URI: uri,
@@ -847,7 +852,7 @@ func (s *SecretsSuite) TestGrantSecretByName(c *gc.C) {
 
 	uri := coresecrets.NewURI()
 	s.secretsState.EXPECT().ListSecrets(state.SecretsFilter{
-		Label:     ptr("my-secret"),
+		Labels:    []string{"my-secret"},
 		OwnerTags: []names.Tag{coretesting.ModelTag},
 	}).Return([]*coresecrets.SecretMetadata{{
 		URI: uri,

@@ -12,6 +12,7 @@ import (
 
 // SecretsState instances provide secret apis.
 type SecretsState interface {
+	ReserveSecret(*secrets.URI, names.Tag) error
 	CreateSecret(*secrets.URI, state.CreateSecretParams) (*secrets.SecretMetadata, error)
 	UpdateSecret(*secrets.URI, state.UpdateSecretParams) (*secrets.SecretMetadata, error)
 	GetSecret(uri *secrets.URI) (*secrets.SecretMetadata, error)

@@ -52,7 +52,7 @@ func newStateCrossModelSecretsAPI(ctx facade.Context) (*CrossModelSecretsAPI, er
 			return nil, errors.Trace(err)
 		}
 		defer closer.Release()
-		return secrets.BackendConfigInfo(secrets.SecretsModel(model), sameController, []string{backendID}, false, consumer, leadershipChecker)
+		return secrets.BackendConfigInfo(secrets.SecretsModel(model), sameController, []string{backendID}, false, consumer, leadershipChecker, nil)
 	}
 	secretInfoGetter := func(modelUUID string) (SecretsState, SecretsConsumer, func() bool, error) {
 		st, err := ctx.StatePool().Get(modelUUID)

@@ -40,6 +40,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -82,6 +97,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -98,18 +127,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -0,0 +1,6 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+// Package secretsrevoker provides the facade for revoking secret backend issued
+// tokens. This facade can be removed in Juju 4.0, replaced with a removal job.
+package secretsrevoker

@@ -0,0 +1,14 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	secretsprovider "github.com/juju/juju/secrets/provider"
+)
+
+// Getters is used for mocks only.
+type Getters interface {
+	BackendConfigGetter() (*secretsprovider.ModelBackendConfigInfo, error)
+	ProviderGetter(backendType string) (secretsprovider.SecretBackendProvider, error)
+}

@@ -0,0 +1,297 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/juju/juju/apiserver/facades/controller/secretsrevoker (interfaces: SecretsState,Getters)
+//
+// Generated by this command:
+//
+//	mockgen -typed -package secretsrevoker -destination mocks_test.go github.com/juju/juju/apiserver/facades/controller/secretsrevoker SecretsState,Getters
+//
+
+// Package secretsrevoker is a generated GoMock package.
+package secretsrevoker
+
+import (
+	reflect "reflect"
+	time "time"
+
+	provider "github.com/juju/juju/secrets/provider"
+	state "github.com/juju/juju/state"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSecretsState is a mock of SecretsState interface.
+type MockSecretsState struct {
+	ctrl     *gomock.Controller
+	recorder *MockSecretsStateMockRecorder
+}
+
+// MockSecretsStateMockRecorder is the mock recorder for MockSecretsState.
+type MockSecretsStateMockRecorder struct {
+	mock *MockSecretsState
+}
+
+// NewMockSecretsState creates a new mock instance.
+func NewMockSecretsState(ctrl *gomock.Controller) *MockSecretsState {
+	mock := &MockSecretsState{ctrl: ctrl}
+	mock.recorder = &MockSecretsStateMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSecretsState) EXPECT() *MockSecretsStateMockRecorder {
+	return m.recorder
+}
+
+// ListSecretBackendIssuedTokenUntil mocks base method.
+func (m *MockSecretsState) ListSecretBackendIssuedTokenUntil(arg0 time.Time) ([]state.SecretBackendIssuedToken, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListSecretBackendIssuedTokenUntil", arg0)
+	ret0, _ := ret[0].([]state.SecretBackendIssuedToken)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListSecretBackendIssuedTokenUntil indicates an expected call of ListSecretBackendIssuedTokenUntil.
+func (mr *MockSecretsStateMockRecorder) ListSecretBackendIssuedTokenUntil(arg0 any) *MockSecretsStateListSecretBackendIssuedTokenUntilCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecretBackendIssuedTokenUntil", reflect.TypeOf((*MockSecretsState)(nil).ListSecretBackendIssuedTokenUntil), arg0)
+	return &MockSecretsStateListSecretBackendIssuedTokenUntilCall{Call: call}
+}
+
+// MockSecretsStateListSecretBackendIssuedTokenUntilCall wrap *gomock.Call
+type MockSecretsStateListSecretBackendIssuedTokenUntilCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretsStateListSecretBackendIssuedTokenUntilCall) Return(arg0 []state.SecretBackendIssuedToken, arg1 error) *MockSecretsStateListSecretBackendIssuedTokenUntilCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretsStateListSecretBackendIssuedTokenUntilCall) Do(f func(time.Time) ([]state.SecretBackendIssuedToken, error)) *MockSecretsStateListSecretBackendIssuedTokenUntilCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretsStateListSecretBackendIssuedTokenUntilCall) DoAndReturn(f func(time.Time) ([]state.SecretBackendIssuedToken, error)) *MockSecretsStateListSecretBackendIssuedTokenUntilCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// NextSecretBackendIssuedTokenExpiry mocks base method.
+func (m *MockSecretsState) NextSecretBackendIssuedTokenExpiry() (time.Time, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NextSecretBackendIssuedTokenExpiry")
+	ret0, _ := ret[0].(time.Time)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// NextSecretBackendIssuedTokenExpiry indicates an expected call of NextSecretBackendIssuedTokenExpiry.
+func (mr *MockSecretsStateMockRecorder) NextSecretBackendIssuedTokenExpiry() *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NextSecretBackendIssuedTokenExpiry", reflect.TypeOf((*MockSecretsState)(nil).NextSecretBackendIssuedTokenExpiry))
+	return &MockSecretsStateNextSecretBackendIssuedTokenExpiryCall{Call: call}
+}
+
+// MockSecretsStateNextSecretBackendIssuedTokenExpiryCall wrap *gomock.Call
+type MockSecretsStateNextSecretBackendIssuedTokenExpiryCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall) Return(arg0 time.Time, arg1 error) *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall) Do(f func() (time.Time, error)) *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall) DoAndReturn(f func() (time.Time, error)) *MockSecretsStateNextSecretBackendIssuedTokenExpiryCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RemoveSecretBackendIssuedTokens mocks base method.
+func (m *MockSecretsState) RemoveSecretBackendIssuedTokens(arg0 []string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveSecretBackendIssuedTokens", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RemoveSecretBackendIssuedTokens indicates an expected call of RemoveSecretBackendIssuedTokens.
+func (mr *MockSecretsStateMockRecorder) RemoveSecretBackendIssuedTokens(arg0 any) *MockSecretsStateRemoveSecretBackendIssuedTokensCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecretBackendIssuedTokens", reflect.TypeOf((*MockSecretsState)(nil).RemoveSecretBackendIssuedTokens), arg0)
+	return &MockSecretsStateRemoveSecretBackendIssuedTokensCall{Call: call}
+}
+
+// MockSecretsStateRemoveSecretBackendIssuedTokensCall wrap *gomock.Call
+type MockSecretsStateRemoveSecretBackendIssuedTokensCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretsStateRemoveSecretBackendIssuedTokensCall) Return(arg0 error) *MockSecretsStateRemoveSecretBackendIssuedTokensCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretsStateRemoveSecretBackendIssuedTokensCall) Do(f func([]string) error) *MockSecretsStateRemoveSecretBackendIssuedTokensCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretsStateRemoveSecretBackendIssuedTokensCall) DoAndReturn(f func([]string) error) *MockSecretsStateRemoveSecretBackendIssuedTokensCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WatchSecretBackendIssuedTokenExpiry mocks base method.
+func (m *MockSecretsState) WatchSecretBackendIssuedTokenExpiry() state.StringsWatcher {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WatchSecretBackendIssuedTokenExpiry")
+	ret0, _ := ret[0].(state.StringsWatcher)
+	return ret0
+}
+
+// WatchSecretBackendIssuedTokenExpiry indicates an expected call of WatchSecretBackendIssuedTokenExpiry.
+func (mr *MockSecretsStateMockRecorder) WatchSecretBackendIssuedTokenExpiry() *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchSecretBackendIssuedTokenExpiry", reflect.TypeOf((*MockSecretsState)(nil).WatchSecretBackendIssuedTokenExpiry))
+	return &MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall{Call: call}
+}
+
+// MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall wrap *gomock.Call
+type MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall) Return(arg0 state.StringsWatcher) *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall) Do(f func() state.StringsWatcher) *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall) DoAndReturn(f func() state.StringsWatcher) *MockSecretsStateWatchSecretBackendIssuedTokenExpiryCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// MockGetters is a mock of Getters interface.
+type MockGetters struct {
+	ctrl     *gomock.Controller
+	recorder *MockGettersMockRecorder
+}
+
+// MockGettersMockRecorder is the mock recorder for MockGetters.
+type MockGettersMockRecorder struct {
+	mock *MockGetters
+}
+
+// NewMockGetters creates a new mock instance.
+func NewMockGetters(ctrl *gomock.Controller) *MockGetters {
+	mock := &MockGetters{ctrl: ctrl}
+	mock.recorder = &MockGettersMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockGetters) EXPECT() *MockGettersMockRecorder {
+	return m.recorder
+}
+
+// BackendConfigGetter mocks base method.
+func (m *MockGetters) BackendConfigGetter() (*provider.ModelBackendConfigInfo, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "BackendConfigGetter")
+	ret0, _ := ret[0].(*provider.ModelBackendConfigInfo)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// BackendConfigGetter indicates an expected call of BackendConfigGetter.
+func (mr *MockGettersMockRecorder) BackendConfigGetter() *MockGettersBackendConfigGetterCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BackendConfigGetter", reflect.TypeOf((*MockGetters)(nil).BackendConfigGetter))
+	return &MockGettersBackendConfigGetterCall{Call: call}
+}
+
+// MockGettersBackendConfigGetterCall wrap *gomock.Call
+type MockGettersBackendConfigGetterCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockGettersBackendConfigGetterCall) Return(arg0 *provider.ModelBackendConfigInfo, arg1 error) *MockGettersBackendConfigGetterCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockGettersBackendConfigGetterCall) Do(f func() (*provider.ModelBackendConfigInfo, error)) *MockGettersBackendConfigGetterCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockGettersBackendConfigGetterCall) DoAndReturn(f func() (*provider.ModelBackendConfigInfo, error)) *MockGettersBackendConfigGetterCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ProviderGetter mocks base method.
+func (m *MockGetters) ProviderGetter(arg0 string) (provider.SecretBackendProvider, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ProviderGetter", arg0)
+	ret0, _ := ret[0].(provider.SecretBackendProvider)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ProviderGetter indicates an expected call of ProviderGetter.
+func (mr *MockGettersMockRecorder) ProviderGetter(arg0 any) *MockGettersProviderGetterCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ProviderGetter", reflect.TypeOf((*MockGetters)(nil).ProviderGetter), arg0)
+	return &MockGettersProviderGetterCall{Call: call}
+}
+
+// MockGettersProviderGetterCall wrap *gomock.Call
+type MockGettersProviderGetterCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockGettersProviderGetterCall) Return(arg0 provider.SecretBackendProvider, arg1 error) *MockGettersProviderGetterCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockGettersProviderGetterCall) Do(f func(string) (provider.SecretBackendProvider, error)) *MockGettersProviderGetterCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockGettersProviderGetterCall) DoAndReturn(f func(string) (provider.SecretBackendProvider, error)) *MockGettersProviderGetterCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}

@@ -0,0 +1,17 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	"testing"
+
+	gc "gopkg.in/check.v1"
+)
+
+//go:generate go run go.uber.org/mock/mockgen -typed -package secretsrevoker -destination mocks_test.go github.com/juju/juju/apiserver/facades/controller/secretsrevoker SecretsState,Getters
+//go:generate go run go.uber.org/mock/mockgen -typed -package secretsrevoker -destination secretsprovider_mocks_test.go github.com/juju/juju/secrets/provider SecretBackendProvider
+
+func TestPackage(t *testing.T) {
+	gc.TestingT(t)
+}

@@ -0,0 +1,47 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	"reflect"
+
+	"github.com/juju/errors"
+
+	commonsecrets "github.com/juju/juju/apiserver/common/secrets"
+	apiservererrors "github.com/juju/juju/apiserver/errors"
+	"github.com/juju/juju/apiserver/facade"
+	secretsprovider "github.com/juju/juju/secrets/provider"
+	"github.com/juju/juju/state"
+)
+
+// Register is called to expose a package of facades onto a given registry.
+func Register(registry facade.FacadeRegistry) {
+	registry.MustRegister("SecretsRevoker", 1, func(ctx facade.Context) (facade.Facade, error) {
+		return newSecretsRevokerAPI(ctx)
+	}, reflect.TypeOf((*SecretsRevokerAPI)(nil)))
+}
+
+// newSecretsRevokerAPI creates a SecretsRevokerAPI for revoking secret backend
+// tokens.
+func newSecretsRevokerAPI(context facade.Context) (*SecretsRevokerAPI, error) {
+	if !context.Auth().AuthController() {
+		return nil, apiservererrors.ErrPerm
+	}
+	model, err := context.State().Model()
+	if err != nil {
+		return nil, errors.Trace(err)
+	}
+
+	secretBackendConfigGetter := func() (*secretsprovider.ModelBackendConfigInfo, error) {
+		return commonsecrets.AdminBackendConfigInfo(commonsecrets.SecretsModel(model))
+	}
+
+	return &SecretsRevokerAPI{
+		resources: context.Resources(),
+		state:     state.NewSecrets(context.State()),
+
+		backendConfigGetter: secretBackendConfigGetter,
+		providerGetter:      secretsprovider.Provider,
+	}, nil
+}

@@ -0,0 +1,122 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	"time"
+
+	"github.com/juju/errors"
+
+	commonsecrets "github.com/juju/juju/apiserver/common/secrets"
+	apiservererrors "github.com/juju/juju/apiserver/errors"
+	"github.com/juju/juju/apiserver/facade"
+	"github.com/juju/juju/rpc/params"
+	secretsprovider "github.com/juju/juju/secrets/provider"
+)
+
+// SecretsRevokerAPI is the implementation for the SecretsRevoker facade.
+type SecretsRevokerAPI struct {
+	state SecretsState
+
+	resources facade.Resources
+
+	backendConfigGetter commonsecrets.BackendAdminConfigGetter
+	providerGetter      func(string) (secretsprovider.SecretBackendProvider, error)
+}
+
+// WatchIssuedTokenExpiry creates a secret backends issued token expiry watcher.
+// The watcher fires when a secret backend issued token is created, sending the
+// RFC3339 encoded timestamp when it will expire.
+func (api *SecretsRevokerAPI) WatchIssuedTokenExpiry() (params.StringsWatchResult, error) {
+	result := params.StringsWatchResult{}
+	watch := api.state.WatchSecretBackendIssuedTokenExpiry()
+	if changes, ok := <-watch.Changes(); ok {
+		result.StringsWatcherId = api.resources.Register(watch)
+		result.Changes = changes
+	} else {
+		return result, errors.Errorf("cannot obtain token expiry times")
+	}
+	return result, nil
+}
+
+// RevokeIssuedTokens revokes all issued tokens up until the specified time and
+// returning the time for the next revocation.
+func (api *SecretsRevokerAPI) RevokeIssuedTokens(
+	until time.Time,
+) (params.RevokeIssuedTokensResult, error) {
+	result := params.RevokeIssuedTokensResult{}
+
+	var err error
+	result.Next, err = api.revokeIssuedTokens(until)
+	if err != nil {
+		result.Error = apiservererrors.ServerError(err)
+	}
+
+	return result, nil
+}
+
+func (api *SecretsRevokerAPI) revokeIssuedTokens(
+	until time.Time,
+) (time.Time, error) {
+	issuedTokens, err := api.state.ListSecretBackendIssuedTokenUntil(until)
+	if err != nil {
+		return time.Time{}, errors.Trace(err)
+	}
+
+	if len(issuedTokens) == 0 {
+		next, err := api.state.NextSecretBackendIssuedTokenExpiry()
+		if err != nil {
+			return time.Time{}, errors.Trace(err)
+		}
+		return next, nil
+	}
+
+	issuedTokensToBackend := map[string][]string{}
+	for _, ik := range issuedTokens {
+		b := issuedTokensToBackend[ik.BackendID]
+		b = append(b, ik.UUID)
+		issuedTokensToBackend[ik.BackendID] = b
+	}
+
+	adminCfg, err := api.backendConfigGetter()
+	if err != nil {
+		return time.Time{}, errors.Trace(err)
+	}
+
+	for backendID, issuedTokenUUIDs := range issuedTokensToBackend {
+		backendCfg, ok := adminCfg.Configs[backendID]
+		if !ok {
+			// If the backend doesn't exist. Discard the tokens.
+			err = api.state.RemoveSecretBackendIssuedTokens(issuedTokenUUIDs)
+			if err != nil {
+				return time.Time{}, errors.Trace(err)
+			}
+			continue
+		}
+
+		p, err := api.providerGetter(backendCfg.BackendType)
+		if err != nil {
+			return time.Time{}, errors.Trace(err)
+		}
+
+		removedUUIDs, cleanUpErr := p.CleanupIssuedTokens(
+			&backendCfg, issuedTokenUUIDs)
+		if len(removedUUIDs) > 0 {
+			err = api.state.RemoveSecretBackendIssuedTokens(removedUUIDs)
+			if err != nil {
+				return time.Time{}, errors.Trace(err)
+			}
+		}
+		if cleanUpErr != nil {
+			return time.Time{}, errors.Trace(cleanUpErr)
+		}
+	}
+
+	next, err := api.state.NextSecretBackendIssuedTokenExpiry()
+	if err != nil {
+		return time.Time{}, errors.Trace(err)
+	}
+
+	return next, nil
+}

@@ -0,0 +1,120 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/juju/names/v5"
+	"github.com/juju/testing"
+	jc "github.com/juju/testing/checkers"
+	"go.uber.org/mock/gomock"
+	gc "gopkg.in/check.v1"
+
+	facademocks "github.com/juju/juju/apiserver/facade/mocks"
+	"github.com/juju/juju/rpc/params"
+	secretsprovider "github.com/juju/juju/secrets/provider"
+	"github.com/juju/juju/state"
+	"github.com/juju/juju/state/watcher/watchertest"
+)
+
+type facadeSuite struct {
+	testing.IsolationSuite
+
+	authorizer *facademocks.MockAuthorizer
+	resources  *facademocks.MockResources
+	state      *MockSecretsState
+	getters    *MockGetters
+	provider   *MockSecretBackendProvider
+	facade     *SecretsRevokerAPI
+}
+
+var _ = gc.Suite(&facadeSuite{})
+
+func (s *facadeSuite) setup(c *gc.C) *gomock.Controller {
+	ctrl := gomock.NewController(c)
+
+	s.authorizer = facademocks.NewMockAuthorizer(ctrl)
+	s.resources = facademocks.NewMockResources(ctrl)
+	s.state = NewMockSecretsState(ctrl)
+	s.getters = NewMockGetters(ctrl)
+	s.provider = NewMockSecretBackendProvider(ctrl)
+
+	s.facade = &SecretsRevokerAPI{
+		state:     s.state,
+		resources: s.resources,
+
+		backendConfigGetter: s.getters.BackendConfigGetter,
+		providerGetter:      s.getters.ProviderGetter,
+	}
+
+	s.authorizer.EXPECT().AuthController().Return(true).AnyTimes()
+	s.getters.EXPECT().ProviderGetter(
+		"my-backend-type").Return(s.provider, nil).AnyTimes()
+
+	return ctrl
+}
+
+func (s *facadeSuite) TestRevokeIssuedTokens(c *gc.C) {
+	defer s.setup(c).Finish()
+
+	now := time.Now()
+	next := now.Add(time.Hour)
+	uuids := []string{uuid.NewString(), uuid.NewString()}
+	tokens := []state.SecretBackendIssuedToken{{
+		UUID:       uuids[0],
+		ExpireTime: now.Add(-time.Second),
+		BackendID:  "some-backend",
+		Consumer:   names.NewUnitTag("app/0"),
+	}, {
+		UUID:       uuids[1],
+		ExpireTime: now.Add(-time.Second),
+		BackendID:  "some-backend",
+		Consumer:   names.NewUnitTag("app/0"),
+	}}
+	s.state.EXPECT().ListSecretBackendIssuedTokenUntil(now).Return(tokens, nil)
+	s.state.EXPECT().NextSecretBackendIssuedTokenExpiry().Return(next, nil)
+
+	backends := &secretsprovider.ModelBackendConfigInfo{
+		ActiveID: "some-backend",
+		Configs: map[string]secretsprovider.ModelBackendConfig{
+			"some-backend": {
+				BackendConfig: secretsprovider.BackendConfig{
+					BackendType: "my-backend-type",
+				},
+			},
+		},
+	}
+	s.getters.EXPECT().BackendConfigGetter().Return(backends, nil)
+
+	s.provider.EXPECT().CleanupIssuedTokens(
+		gomock.Any(), uuids).Return(uuids[:1], nil)
+	s.state.EXPECT().RemoveSecretBackendIssuedTokens(uuids[:1]).Return(nil)
+
+	res, err := s.facade.RevokeIssuedTokens(now)
+	c.Assert(err, jc.ErrorIsNil)
+	c.Assert(res, gc.DeepEquals, params.RevokeIssuedTokensResult{
+		Next: next,
+	})
+}
+
+func (s *facadeSuite) TestWatchIssuedTokenExpiry(c *gc.C) {
+	defer s.setup(c).Finish()
+
+	ch := make(chan []string, 1)
+	ch <- []string{"something"}
+	w := watchertest.NewStringsWatcher(ch)
+	defer w.Kill()
+
+	s.state.EXPECT().WatchSecretBackendIssuedTokenExpiry().Return(w)
+	s.resources.EXPECT().Register(w).Return("abc")
+
+	res, err := s.facade.WatchIssuedTokenExpiry()
+	c.Assert(err, jc.ErrorIsNil)
+	c.Assert(res, gc.DeepEquals, params.StringsWatchResult{
+		StringsWatcherId: "abc",
+		Changes:          []string{"something"},
+	})
+}

@@ -0,0 +1,348 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/juju/juju/secrets/provider (interfaces: SecretBackendProvider)
+//
+// Generated by this command:
+//
+//	mockgen -typed -package secretsrevoker -destination secretsprovider_mocks_test.go github.com/juju/juju/secrets/provider SecretBackendProvider
+//
+
+// Package secretsrevoker is a generated GoMock package.
+package secretsrevoker
+
+import (
+	reflect "reflect"
+
+	provider "github.com/juju/juju/secrets/provider"
+	names "github.com/juju/names/v5"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSecretBackendProvider is a mock of SecretBackendProvider interface.
+type MockSecretBackendProvider struct {
+	ctrl     *gomock.Controller
+	recorder *MockSecretBackendProviderMockRecorder
+}
+
+// MockSecretBackendProviderMockRecorder is the mock recorder for MockSecretBackendProvider.
+type MockSecretBackendProviderMockRecorder struct {
+	mock *MockSecretBackendProvider
+}
+
+// NewMockSecretBackendProvider creates a new mock instance.
+func NewMockSecretBackendProvider(ctrl *gomock.Controller) *MockSecretBackendProvider {
+	mock := &MockSecretBackendProvider{ctrl: ctrl}
+	mock.recorder = &MockSecretBackendProviderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecorder {
+	return m.recorder
+}
+
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+	return &MockSecretBackendProviderCleanupIssuedTokensCall{Call: call}
+}
+
+// MockSecretBackendProviderCleanupIssuedTokensCall wrap *gomock.Call
+type MockSecretBackendProviderCleanupIssuedTokensCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderCleanupIssuedTokensCall) Return(arg0 []string, arg1 error) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderCleanupIssuedTokensCall) Do(f func(*provider.ModelBackendConfig, []string) ([]string, error)) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderCleanupIssuedTokensCall) DoAndReturn(f func(*provider.ModelBackendConfig, []string) ([]string, error)) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// CleanupModel mocks base method.
+func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupModel", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CleanupModel indicates an expected call of CleanupModel.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupModel(arg0 any) *MockSecretBackendProviderCleanupModelCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupModel", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupModel), arg0)
+	return &MockSecretBackendProviderCleanupModelCall{Call: call}
+}
+
+// MockSecretBackendProviderCleanupModelCall wrap *gomock.Call
+type MockSecretBackendProviderCleanupModelCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderCleanupModelCall) Return(arg0 error) *MockSecretBackendProviderCleanupModelCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderCleanupModelCall) Do(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderCleanupModelCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderCleanupModelCall) DoAndReturn(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderCleanupModelCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// CleanupSecrets mocks base method.
+func (m *MockSecretBackendProvider) CleanupSecrets(arg0 *provider.ModelBackendConfig, arg1 names.Tag, arg2 provider.SecretRevisions) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupSecrets", arg0, arg1, arg2)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CleanupSecrets indicates an expected call of CleanupSecrets.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupSecrets(arg0, arg1, arg2 any) *MockSecretBackendProviderCleanupSecretsCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupSecrets", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupSecrets), arg0, arg1, arg2)
+	return &MockSecretBackendProviderCleanupSecretsCall{Call: call}
+}
+
+// MockSecretBackendProviderCleanupSecretsCall wrap *gomock.Call
+type MockSecretBackendProviderCleanupSecretsCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderCleanupSecretsCall) Return(arg0 error) *MockSecretBackendProviderCleanupSecretsCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderCleanupSecretsCall) Do(f func(*provider.ModelBackendConfig, names.Tag, provider.SecretRevisions) error) *MockSecretBackendProviderCleanupSecretsCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderCleanupSecretsCall) DoAndReturn(f func(*provider.ModelBackendConfig, names.Tag, provider.SecretRevisions) error) *MockSecretBackendProviderCleanupSecretsCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Initialise mocks base method.
+func (m *MockSecretBackendProvider) Initialise(arg0 *provider.ModelBackendConfig) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Initialise", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Initialise indicates an expected call of Initialise.
+func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *MockSecretBackendProviderInitialiseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
+	return &MockSecretBackendProviderInitialiseCall{Call: call}
+}
+
+// MockSecretBackendProviderInitialiseCall wrap *gomock.Call
+type MockSecretBackendProviderInitialiseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderInitialiseCall) Return(arg0 error) *MockSecretBackendProviderInitialiseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderInitialiseCall) Do(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderInitialiseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderInitialiseCall) DoAndReturn(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderInitialiseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *MockSecretBackendProviderIssuesTokensCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+	return &MockSecretBackendProviderIssuesTokensCall{Call: call}
+}
+
+// MockSecretBackendProviderIssuesTokensCall wrap *gomock.Call
+type MockSecretBackendProviderIssuesTokensCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderIssuesTokensCall) Return(arg0 bool) *MockSecretBackendProviderIssuesTokensCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderIssuesTokensCall) Do(f func() bool) *MockSecretBackendProviderIssuesTokensCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderIssuesTokensCall) DoAndReturn(f func() bool) *MockSecretBackendProviderIssuesTokensCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// NewBackend mocks base method.
+func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewBackend", arg0)
+	ret0, _ := ret[0].(provider.SecretsBackend)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// NewBackend indicates an expected call of NewBackend.
+func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *MockSecretBackendProviderNewBackendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewBackend", reflect.TypeOf((*MockSecretBackendProvider)(nil).NewBackend), arg0)
+	return &MockSecretBackendProviderNewBackendCall{Call: call}
+}
+
+// MockSecretBackendProviderNewBackendCall wrap *gomock.Call
+type MockSecretBackendProviderNewBackendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderNewBackendCall) Return(arg0 provider.SecretsBackend, arg1 error) *MockSecretBackendProviderNewBackendCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderNewBackendCall) Do(f func(*provider.ModelBackendConfig) (provider.SecretsBackend, error)) *MockSecretBackendProviderNewBackendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderNewBackendCall) DoAndReturn(f func(*provider.ModelBackendConfig) (provider.SecretsBackend, error)) *MockSecretBackendProviderNewBackendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RestrictedConfig mocks base method.
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
+	ret0, _ := ret[0].(*provider.BackendConfig)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RestrictedConfig indicates an expected call of RestrictedConfig.
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *MockSecretBackendProviderRestrictedConfigCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
+	return &MockSecretBackendProviderRestrictedConfigCall{Call: call}
+}
+
+// MockSecretBackendProviderRestrictedConfigCall wrap *gomock.Call
+type MockSecretBackendProviderRestrictedConfigCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderRestrictedConfigCall) Return(arg0 *provider.BackendConfig, arg1 error) *MockSecretBackendProviderRestrictedConfigCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderRestrictedConfigCall) Do(f func(*provider.ModelBackendConfig, bool, bool, string, names.Tag, []string, provider.SecretRevisions, provider.SecretRevisions) (*provider.BackendConfig, error)) *MockSecretBackendProviderRestrictedConfigCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderRestrictedConfigCall) DoAndReturn(f func(*provider.ModelBackendConfig, bool, bool, string, names.Tag, []string, provider.SecretRevisions, provider.SecretRevisions) (*provider.BackendConfig, error)) *MockSecretBackendProviderRestrictedConfigCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Type mocks base method.
+func (m *MockSecretBackendProvider) Type() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Type")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// Type indicates an expected call of Type.
+func (mr *MockSecretBackendProviderMockRecorder) Type() *MockSecretBackendProviderTypeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Type", reflect.TypeOf((*MockSecretBackendProvider)(nil).Type))
+	return &MockSecretBackendProviderTypeCall{Call: call}
+}
+
+// MockSecretBackendProviderTypeCall wrap *gomock.Call
+type MockSecretBackendProviderTypeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderTypeCall) Return(arg0 string) *MockSecretBackendProviderTypeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderTypeCall) Do(f func() string) *MockSecretBackendProviderTypeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderTypeCall) DoAndReturn(f func() string) *MockSecretBackendProviderTypeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}

@@ -0,0 +1,21 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package secretsrevoker
+
+import (
+	"time"
+
+	"github.com/juju/juju/state"
+)
+
+// SecretsState provides the secrets revoker controller facade access to secret
+// backend issued tokens.
+type SecretsState interface {
+	WatchSecretBackendIssuedTokenExpiry() state.StringsWatcher
+	ListSecretBackendIssuedTokenUntil(
+		until time.Time,
+	) ([]state.SecretBackendIssuedToken, error)
+	RemoveSecretBackendIssuedTokens(uuids []string) error
+	NextSecretBackendIssuedTokenExpiry() (time.Time, error)
+}

@@ -0,0 +1,793 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/juju/juju/apiserver/facades/controller/undertaker (interfaces: State,Model)
+//
+// Generated by this command:
+//
+//	mockgen -typed -package undertaker_test -destination generatedmocks_test.go github.com/juju/juju/apiserver/facades/controller/undertaker State,Model
+//
+
+// Package undertaker_test is a generated GoMock package.
+package undertaker_test
+
+import (
+	reflect "reflect"
+	time "time"
+
+	undertaker "github.com/juju/juju/apiserver/facades/controller/undertaker"
+	config "github.com/juju/juju/environs/config"
+	state "github.com/juju/juju/state"
+	names "github.com/juju/names/v5"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockState is a mock of State interface.
+type MockState struct {
+	ctrl     *gomock.Controller
+	recorder *MockStateMockRecorder
+}
+
+// MockStateMockRecorder is the mock recorder for MockState.
+type MockStateMockRecorder struct {
+	mock *MockState
+}
+
+// NewMockState creates a new mock instance.
+func NewMockState(ctrl *gomock.Controller) *MockState {
+	mock := &MockState{ctrl: ctrl}
+	mock.recorder = &MockStateMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockState) EXPECT() *MockStateMockRecorder {
+	return m.recorder
+}
+
+// ControllerUUID mocks base method.
+func (m *MockState) ControllerUUID() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ControllerUUID")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// ControllerUUID indicates an expected call of ControllerUUID.
+func (mr *MockStateMockRecorder) ControllerUUID() *MockStateControllerUUIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ControllerUUID", reflect.TypeOf((*MockState)(nil).ControllerUUID))
+	return &MockStateControllerUUIDCall{Call: call}
+}
+
+// MockStateControllerUUIDCall wrap *gomock.Call
+type MockStateControllerUUIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateControllerUUIDCall) Return(arg0 string) *MockStateControllerUUIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateControllerUUIDCall) Do(f func() string) *MockStateControllerUUIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateControllerUUIDCall) DoAndReturn(f func() string) *MockStateControllerUUIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// FindEntity mocks base method.
+func (m *MockState) FindEntity(arg0 names.Tag) (state.Entity, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "FindEntity", arg0)
+	ret0, _ := ret[0].(state.Entity)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// FindEntity indicates an expected call of FindEntity.
+func (mr *MockStateMockRecorder) FindEntity(arg0 any) *MockStateFindEntityCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FindEntity", reflect.TypeOf((*MockState)(nil).FindEntity), arg0)
+	return &MockStateFindEntityCall{Call: call}
+}
+
+// MockStateFindEntityCall wrap *gomock.Call
+type MockStateFindEntityCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateFindEntityCall) Return(arg0 state.Entity, arg1 error) *MockStateFindEntityCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateFindEntityCall) Do(f func(names.Tag) (state.Entity, error)) *MockStateFindEntityCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateFindEntityCall) DoAndReturn(f func(names.Tag) (state.Entity, error)) *MockStateFindEntityCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// IsController mocks base method.
+func (m *MockState) IsController() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IsController")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IsController indicates an expected call of IsController.
+func (mr *MockStateMockRecorder) IsController() *MockStateIsControllerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsController", reflect.TypeOf((*MockState)(nil).IsController))
+	return &MockStateIsControllerCall{Call: call}
+}
+
+// MockStateIsControllerCall wrap *gomock.Call
+type MockStateIsControllerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateIsControllerCall) Return(arg0 bool) *MockStateIsControllerCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateIsControllerCall) Do(f func() bool) *MockStateIsControllerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateIsControllerCall) DoAndReturn(f func() bool) *MockStateIsControllerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ListSecretBackendIssuedTokenUntil mocks base method.
+func (m *MockState) ListSecretBackendIssuedTokenUntil(arg0 time.Time) ([]state.SecretBackendIssuedToken, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListSecretBackendIssuedTokenUntil", arg0)
+	ret0, _ := ret[0].([]state.SecretBackendIssuedToken)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListSecretBackendIssuedTokenUntil indicates an expected call of ListSecretBackendIssuedTokenUntil.
+func (mr *MockStateMockRecorder) ListSecretBackendIssuedTokenUntil(arg0 any) *MockStateListSecretBackendIssuedTokenUntilCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListSecretBackendIssuedTokenUntil", reflect.TypeOf((*MockState)(nil).ListSecretBackendIssuedTokenUntil), arg0)
+	return &MockStateListSecretBackendIssuedTokenUntilCall{Call: call}
+}
+
+// MockStateListSecretBackendIssuedTokenUntilCall wrap *gomock.Call
+type MockStateListSecretBackendIssuedTokenUntilCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateListSecretBackendIssuedTokenUntilCall) Return(arg0 []state.SecretBackendIssuedToken, arg1 error) *MockStateListSecretBackendIssuedTokenUntilCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateListSecretBackendIssuedTokenUntilCall) Do(f func(time.Time) ([]state.SecretBackendIssuedToken, error)) *MockStateListSecretBackendIssuedTokenUntilCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateListSecretBackendIssuedTokenUntilCall) DoAndReturn(f func(time.Time) ([]state.SecretBackendIssuedToken, error)) *MockStateListSecretBackendIssuedTokenUntilCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Model mocks base method.
+func (m *MockState) Model() (undertaker.Model, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Model")
+	ret0, _ := ret[0].(undertaker.Model)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// Model indicates an expected call of Model.
+func (mr *MockStateMockRecorder) Model() *MockStateModelCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Model", reflect.TypeOf((*MockState)(nil).Model))
+	return &MockStateModelCall{Call: call}
+}
+
+// MockStateModelCall wrap *gomock.Call
+type MockStateModelCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateModelCall) Return(arg0 undertaker.Model, arg1 error) *MockStateModelCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateModelCall) Do(f func() (undertaker.Model, error)) *MockStateModelCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateModelCall) DoAndReturn(f func() (undertaker.Model, error)) *MockStateModelCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ModelUUID mocks base method.
+func (m *MockState) ModelUUID() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ModelUUID")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// ModelUUID indicates an expected call of ModelUUID.
+func (mr *MockStateMockRecorder) ModelUUID() *MockStateModelUUIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ModelUUID", reflect.TypeOf((*MockState)(nil).ModelUUID))
+	return &MockStateModelUUIDCall{Call: call}
+}
+
+// MockStateModelUUIDCall wrap *gomock.Call
+type MockStateModelUUIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateModelUUIDCall) Return(arg0 string) *MockStateModelUUIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateModelUUIDCall) Do(f func() string) *MockStateModelUUIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateModelUUIDCall) DoAndReturn(f func() string) *MockStateModelUUIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ProcessDyingModel mocks base method.
+func (m *MockState) ProcessDyingModel() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ProcessDyingModel")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// ProcessDyingModel indicates an expected call of ProcessDyingModel.
+func (mr *MockStateMockRecorder) ProcessDyingModel() *MockStateProcessDyingModelCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ProcessDyingModel", reflect.TypeOf((*MockState)(nil).ProcessDyingModel))
+	return &MockStateProcessDyingModelCall{Call: call}
+}
+
+// MockStateProcessDyingModelCall wrap *gomock.Call
+type MockStateProcessDyingModelCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateProcessDyingModelCall) Return(arg0 error) *MockStateProcessDyingModelCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateProcessDyingModelCall) Do(f func() error) *MockStateProcessDyingModelCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateProcessDyingModelCall) DoAndReturn(f func() error) *MockStateProcessDyingModelCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RemoveDyingModel mocks base method.
+func (m *MockState) RemoveDyingModel() error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveDyingModel")
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RemoveDyingModel indicates an expected call of RemoveDyingModel.
+func (mr *MockStateMockRecorder) RemoveDyingModel() *MockStateRemoveDyingModelCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveDyingModel", reflect.TypeOf((*MockState)(nil).RemoveDyingModel))
+	return &MockStateRemoveDyingModelCall{Call: call}
+}
+
+// MockStateRemoveDyingModelCall wrap *gomock.Call
+type MockStateRemoveDyingModelCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateRemoveDyingModelCall) Return(arg0 error) *MockStateRemoveDyingModelCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateRemoveDyingModelCall) Do(f func() error) *MockStateRemoveDyingModelCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateRemoveDyingModelCall) DoAndReturn(f func() error) *MockStateRemoveDyingModelCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RemoveSecretBackendIssuedTokens mocks base method.
+func (m *MockState) RemoveSecretBackendIssuedTokens(arg0 []string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RemoveSecretBackendIssuedTokens", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// RemoveSecretBackendIssuedTokens indicates an expected call of RemoveSecretBackendIssuedTokens.
+func (mr *MockStateMockRecorder) RemoveSecretBackendIssuedTokens(arg0 any) *MockStateRemoveSecretBackendIssuedTokensCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RemoveSecretBackendIssuedTokens", reflect.TypeOf((*MockState)(nil).RemoveSecretBackendIssuedTokens), arg0)
+	return &MockStateRemoveSecretBackendIssuedTokensCall{Call: call}
+}
+
+// MockStateRemoveSecretBackendIssuedTokensCall wrap *gomock.Call
+type MockStateRemoveSecretBackendIssuedTokensCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateRemoveSecretBackendIssuedTokensCall) Return(arg0 error) *MockStateRemoveSecretBackendIssuedTokensCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateRemoveSecretBackendIssuedTokensCall) Do(f func([]string) error) *MockStateRemoveSecretBackendIssuedTokensCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateRemoveSecretBackendIssuedTokensCall) DoAndReturn(f func([]string) error) *MockStateRemoveSecretBackendIssuedTokensCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WatchModelEntityReferences mocks base method.
+func (m *MockState) WatchModelEntityReferences(arg0 string) state.NotifyWatcher {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WatchModelEntityReferences", arg0)
+	ret0, _ := ret[0].(state.NotifyWatcher)
+	return ret0
+}
+
+// WatchModelEntityReferences indicates an expected call of WatchModelEntityReferences.
+func (mr *MockStateMockRecorder) WatchModelEntityReferences(arg0 any) *MockStateWatchModelEntityReferencesCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchModelEntityReferences", reflect.TypeOf((*MockState)(nil).WatchModelEntityReferences), arg0)
+	return &MockStateWatchModelEntityReferencesCall{Call: call}
+}
+
+// MockStateWatchModelEntityReferencesCall wrap *gomock.Call
+type MockStateWatchModelEntityReferencesCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockStateWatchModelEntityReferencesCall) Return(arg0 state.NotifyWatcher) *MockStateWatchModelEntityReferencesCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockStateWatchModelEntityReferencesCall) Do(f func(string) state.NotifyWatcher) *MockStateWatchModelEntityReferencesCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockStateWatchModelEntityReferencesCall) DoAndReturn(f func(string) state.NotifyWatcher) *MockStateWatchModelEntityReferencesCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// MockModel is a mock of Model interface.
+type MockModel struct {
+	ctrl     *gomock.Controller
+	recorder *MockModelMockRecorder
+}
+
+// MockModelMockRecorder is the mock recorder for MockModel.
+type MockModelMockRecorder struct {
+	mock *MockModel
+}
+
+// NewMockModel creates a new mock instance.
+func NewMockModel(ctrl *gomock.Controller) *MockModel {
+	mock := &MockModel{ctrl: ctrl}
+	mock.recorder = &MockModelMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockModel) EXPECT() *MockModelMockRecorder {
+	return m.recorder
+}
+
+// DestroyTimeout mocks base method.
+func (m *MockModel) DestroyTimeout() *time.Duration {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DestroyTimeout")
+	ret0, _ := ret[0].(*time.Duration)
+	return ret0
+}
+
+// DestroyTimeout indicates an expected call of DestroyTimeout.
+func (mr *MockModelMockRecorder) DestroyTimeout() *MockModelDestroyTimeoutCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DestroyTimeout", reflect.TypeOf((*MockModel)(nil).DestroyTimeout))
+	return &MockModelDestroyTimeoutCall{Call: call}
+}
+
+// MockModelDestroyTimeoutCall wrap *gomock.Call
+type MockModelDestroyTimeoutCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelDestroyTimeoutCall) Return(arg0 *time.Duration) *MockModelDestroyTimeoutCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelDestroyTimeoutCall) Do(f func() *time.Duration) *MockModelDestroyTimeoutCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelDestroyTimeoutCall) DoAndReturn(f func() *time.Duration) *MockModelDestroyTimeoutCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ForceDestroyed mocks base method.
+func (m *MockModel) ForceDestroyed() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ForceDestroyed")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// ForceDestroyed indicates an expected call of ForceDestroyed.
+func (mr *MockModelMockRecorder) ForceDestroyed() *MockModelForceDestroyedCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ForceDestroyed", reflect.TypeOf((*MockModel)(nil).ForceDestroyed))
+	return &MockModelForceDestroyedCall{Call: call}
+}
+
+// MockModelForceDestroyedCall wrap *gomock.Call
+type MockModelForceDestroyedCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelForceDestroyedCall) Return(arg0 bool) *MockModelForceDestroyedCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelForceDestroyedCall) Do(f func() bool) *MockModelForceDestroyedCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelForceDestroyedCall) DoAndReturn(f func() bool) *MockModelForceDestroyedCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Life mocks base method.
+func (m *MockModel) Life() state.Life {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Life")
+	ret0, _ := ret[0].(state.Life)
+	return ret0
+}
+
+// Life indicates an expected call of Life.
+func (mr *MockModelMockRecorder) Life() *MockModelLifeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Life", reflect.TypeOf((*MockModel)(nil).Life))
+	return &MockModelLifeCall{Call: call}
+}
+
+// MockModelLifeCall wrap *gomock.Call
+type MockModelLifeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelLifeCall) Return(arg0 state.Life) *MockModelLifeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelLifeCall) Do(f func() state.Life) *MockModelLifeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelLifeCall) DoAndReturn(f func() state.Life) *MockModelLifeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// ModelConfig mocks base method.
+func (m *MockModel) ModelConfig() (*config.Config, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ModelConfig")
+	ret0, _ := ret[0].(*config.Config)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ModelConfig indicates an expected call of ModelConfig.
+func (mr *MockModelMockRecorder) ModelConfig() *MockModelModelConfigCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ModelConfig", reflect.TypeOf((*MockModel)(nil).ModelConfig))
+	return &MockModelModelConfigCall{Call: call}
+}
+
+// MockModelModelConfigCall wrap *gomock.Call
+type MockModelModelConfigCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelModelConfigCall) Return(arg0 *config.Config, arg1 error) *MockModelModelConfigCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelModelConfigCall) Do(f func() (*config.Config, error)) *MockModelModelConfigCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelModelConfigCall) DoAndReturn(f func() (*config.Config, error)) *MockModelModelConfigCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Name mocks base method.
+func (m *MockModel) Name() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Name")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// Name indicates an expected call of Name.
+func (mr *MockModelMockRecorder) Name() *MockModelNameCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Name", reflect.TypeOf((*MockModel)(nil).Name))
+	return &MockModelNameCall{Call: call}
+}
+
+// MockModelNameCall wrap *gomock.Call
+type MockModelNameCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelNameCall) Return(arg0 string) *MockModelNameCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelNameCall) Do(f func() string) *MockModelNameCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelNameCall) DoAndReturn(f func() string) *MockModelNameCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Owner mocks base method.
+func (m *MockModel) Owner() names.UserTag {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Owner")
+	ret0, _ := ret[0].(names.UserTag)
+	return ret0
+}
+
+// Owner indicates an expected call of Owner.
+func (mr *MockModelMockRecorder) Owner() *MockModelOwnerCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Owner", reflect.TypeOf((*MockModel)(nil).Owner))
+	return &MockModelOwnerCall{Call: call}
+}
+
+// MockModelOwnerCall wrap *gomock.Call
+type MockModelOwnerCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelOwnerCall) Return(arg0 names.UserTag) *MockModelOwnerCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelOwnerCall) Do(f func() names.UserTag) *MockModelOwnerCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelOwnerCall) DoAndReturn(f func() names.UserTag) *MockModelOwnerCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// UUID mocks base method.
+func (m *MockModel) UUID() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UUID")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// UUID indicates an expected call of UUID.
+func (mr *MockModelMockRecorder) UUID() *MockModelUUIDCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UUID", reflect.TypeOf((*MockModel)(nil).UUID))
+	return &MockModelUUIDCall{Call: call}
+}
+
+// MockModelUUIDCall wrap *gomock.Call
+type MockModelUUIDCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelUUIDCall) Return(arg0 string) *MockModelUUIDCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelUUIDCall) Do(f func() string) *MockModelUUIDCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelUUIDCall) DoAndReturn(f func() string) *MockModelUUIDCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Watch mocks base method.
+func (m *MockModel) Watch() state.NotifyWatcher {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Watch")
+	ret0, _ := ret[0].(state.NotifyWatcher)
+	return ret0
+}
+
+// Watch indicates an expected call of Watch.
+func (mr *MockModelMockRecorder) Watch() *MockModelWatchCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Watch", reflect.TypeOf((*MockModel)(nil).Watch))
+	return &MockModelWatchCall{Call: call}
+}
+
+// MockModelWatchCall wrap *gomock.Call
+type MockModelWatchCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelWatchCall) Return(arg0 state.NotifyWatcher) *MockModelWatchCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelWatchCall) Do(f func() state.NotifyWatcher) *MockModelWatchCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelWatchCall) DoAndReturn(f func() state.NotifyWatcher) *MockModelWatchCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// WatchForModelConfigChanges mocks base method.
+func (m *MockModel) WatchForModelConfigChanges() state.NotifyWatcher {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WatchForModelConfigChanges")
+	ret0, _ := ret[0].(state.NotifyWatcher)
+	return ret0
+}
+
+// WatchForModelConfigChanges indicates an expected call of WatchForModelConfigChanges.
+func (mr *MockModelMockRecorder) WatchForModelConfigChanges() *MockModelWatchForModelConfigChangesCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WatchForModelConfigChanges", reflect.TypeOf((*MockModel)(nil).WatchForModelConfigChanges))
+	return &MockModelWatchForModelConfigChangesCall{Call: call}
+}
+
+// MockModelWatchForModelConfigChangesCall wrap *gomock.Call
+type MockModelWatchForModelConfigChangesCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockModelWatchForModelConfigChangesCall) Return(arg0 state.NotifyWatcher) *MockModelWatchForModelConfigChangesCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockModelWatchForModelConfigChangesCall) Do(f func() state.NotifyWatcher) *MockModelWatchForModelConfigChangesCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockModelWatchForModelConfigChangesCall) DoAndReturn(f func() state.NotifyWatcher) *MockModelWatchForModelConfigChangesCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}

@@ -9,19 +9,24 @@ import (
 	"github.com/juju/errors"
 	"github.com/juju/names/v5"
 	"github.com/juju/utils/v3"
+	"go.uber.org/mock/gomock"
 
 	"github.com/juju/juju/apiserver/facades/controller/undertaker"
 	"github.com/juju/juju/cloud"
 	"github.com/juju/juju/core/status"
 	"github.com/juju/juju/environs/config"
-	"github.com/juju/juju/secrets/provider"
 	"github.com/juju/juju/state"
 	coretesting "github.com/juju/juju/testing"
 )
 
+//go:generate go run go.uber.org/mock/mockgen -typed -package undertaker_test -destination generatedmocks_test.go github.com/juju/juju/apiserver/facades/controller/undertaker State,Model
+//go:generate go run go.uber.org/mock/mockgen -typed -package undertaker_test -destination secretsmocks_test.go github.com/juju/juju/secrets/provider SecretBackendProvider
+
 // mockState implements State interface and allows inspection of called
 // methods.
 type mockState struct {
+	*MockState
+
 	model          *mockModel
 	removed        bool
 	isSystem       bool
@@ -32,24 +37,31 @@ type mockState struct {
 
 var _ undertaker.State = (*mockState)(nil)
 
-func newMockState(modelOwner names.UserTag, modelName string, isSystem bool, modelCfg config.Config) *mockState {
-
+func newMockState(
+	ctrl *gomock.Controller, modelOwner names.UserTag, modelName string,
+	isSystem bool, modelCfg config.Config,
+) *mockState {
 	model := mockModel{
+		MockModel:   NewMockModel(ctrl),
 		owner:       modelOwner,
 		name:        modelName,
 		uuid:        "9d3d3b19-2b0c-4a3f-acde-0b1645586a72",
 		life:        state.Alive,
 		modelConfig: modelCfg,
 	}
+	model.legacy(ctrl)
 
 	st := &mockState{
+		MockState:      NewMockState(ctrl),
 		model:          &model,
 		isSystem:       isSystem,
 		controllerUUID: utils.MustNewUUID().String(),
 		watcher: &mockWatcher{
 			changes: make(chan struct{}, 1),
 		},
 	}
+	st.legacy(ctrl)
+
 	return st
 }
 
@@ -60,52 +72,56 @@ func (m *mockState) EnsureModelRemoved() error {
 	return nil
 }
 
-func (m *mockState) RemoveDyingModel() error {
-	if m.model.life == state.Alive {
-		return errors.New("model not dying or dead")
-	}
-	m.removed = true
-	return nil
-}
-
-func (m *mockState) ProcessDyingModel() error {
-	if m.model.life != state.Dying {
-		return errors.New("model is not dying")
-	}
-	m.model.life = state.Dead
-	return nil
-}
-
-func (m *mockState) IsController() bool {
-	return m.isSystem
-}
-
-func (m *mockState) Model() (undertaker.Model, error) {
-	return m.model, nil
-}
-
-func (m *mockState) FindEntity(tag names.Tag) (state.Entity, error) {
-	if tag.Kind() == names.ModelTagKind && tag.Id() == m.model.UUID() {
+func (m *mockState) legacy(ctrl *gomock.Controller) {
+	m.MockState.EXPECT().RemoveDyingModel().DoAndReturn(func() error {
+		if m.model.life == state.Alive {
+			return errors.New("model not dying or dead")
+		}
+		m.removed = true
+		return nil
+	}).AnyTimes()
+
+	m.MockState.EXPECT().ProcessDyingModel().DoAndReturn(func() error {
+		if m.model.life != state.Dying {
+			return errors.New("model is not dying")
+		}
+		m.model.life = state.Dead
+		return nil
+	}).AnyTimes()
+
+	m.MockState.EXPECT().IsController().DoAndReturn(func() bool {
+		return m.isSystem
+	}).AnyTimes()
+
+	m.MockState.EXPECT().Model().DoAndReturn(func() (undertaker.Model, error) {
 		return m.model, nil
-	}
-	return nil, errors.NotFoundf("entity with tag %q", tag.String())
-}
+	}).AnyTimes()
 
-func (m *mockState) WatchModelEntityReferences(mUUID string) state.NotifyWatcher {
-	return m.watcher
-}
+	m.MockState.EXPECT().FindEntity(gomock.Any()).DoAndReturn(func(tag names.Tag) (state.Entity, error) {
+		if tag.Kind() == names.ModelTagKind && tag.Id() == m.model.UUID() {
+			return m.model, nil
+		}
+		return nil, errors.NotFoundf("entity with tag %q", tag.String())
+	}).AnyTimes()
 
-func (m *mockState) ModelUUID() string {
-	return m.model.UUID()
-}
+	m.MockState.EXPECT().WatchModelEntityReferences(gomock.Any()).DoAndReturn(func(mUUID string) state.NotifyWatcher {
+		return m.watcher
+	}).AnyTimes()
+
+	m.MockState.EXPECT().ModelUUID().DoAndReturn(func() string {
+		return m.model.UUID()
+	}).AnyTimes()
 
-func (m *mockState) ControllerUUID() string {
-	return m.controllerUUID
+	m.MockState.EXPECT().ControllerUUID().DoAndReturn(func() string {
+		return m.controllerUUID
+	}).AnyTimes()
 }
 
 // mockModel implements Model interface and allows inspection of called
 // methods.
 type mockModel struct {
+	*MockModel
+
 	owner       names.UserTag
 	life        state.Life
 	name        string
@@ -129,34 +145,10 @@ func (m *mockModel) Cloud() (cloud.Cloud, error) {
 	return cloud.Cloud{}, errors.NotImplemented
 }
 
-func (m *mockModel) Owner() names.UserTag {
-	return m.owner
-}
-
-func (m *mockModel) Life() state.Life {
-	return m.life
-}
-
-func (m *mockModel) ForceDestroyed() bool {
-	return m.forced
-}
-
-func (m *mockModel) DestroyTimeout() *time.Duration {
-	return m.timeout
-}
-
 func (m *mockModel) Tag() names.Tag {
 	return names.NewModelTag(m.uuid)
 }
 
-func (m *mockModel) Name() string {
-	return m.name
-}
-
-func (m *mockModel) UUID() string {
-	return m.uuid
-}
-
 func (m *mockModel) Destroy() error {
 	m.life = state.Dying
 	return nil
@@ -169,16 +161,42 @@ func (m *mockModel) SetStatus(sInfo status.StatusInfo) error {
 	return nil
 }
 
-func (m *mockModel) WatchForModelConfigChanges() state.NotifyWatcher {
-	return nil
-}
+func (m *mockModel) legacy(ctrl *gomock.Controller) {
+	m.MockModel.EXPECT().Owner().DoAndReturn(func() names.UserTag {
+		return m.owner
+	}).AnyTimes()
 
-func (m *mockModel) Watch() state.NotifyWatcher {
-	return nil
-}
+	m.MockModel.EXPECT().Life().DoAndReturn(func() state.Life {
+		return m.life
+	}).AnyTimes()
 
-func (m *mockModel) ModelConfig() (*config.Config, error) {
-	return &m.modelConfig, nil
+	m.MockModel.EXPECT().ForceDestroyed().DoAndReturn(func() bool {
+		return m.forced
+	}).AnyTimes()
+
+	m.MockModel.EXPECT().DestroyTimeout().DoAndReturn(func() *time.Duration {
+		return m.timeout
+	}).AnyTimes()
+
+	m.MockModel.EXPECT().Name().DoAndReturn(func() string {
+		return m.name
+	}).AnyTimes()
+
+	m.MockModel.EXPECT().UUID().DoAndReturn(func() string {
+		return m.uuid
+	}).AnyTimes()
+
+	m.MockModel.EXPECT().WatchForModelConfigChanges().DoAndReturn(func() state.NotifyWatcher {
+		return nil
+	}).AnyTimes()
+
+	m.MockModel.EXPECT().Watch().DoAndReturn(func() state.NotifyWatcher {
+		return nil
+	}).AnyTimes()
+
+	m.MockModel.EXPECT().ModelConfig().DoAndReturn(func() (*config.Config, error) {
+		return &m.modelConfig, nil
+	}).AnyTimes()
 }
 
 type mockWatcher struct {
@@ -189,16 +207,3 @@ type mockWatcher struct {
 func (w *mockWatcher) Changes() <-chan struct{} {
 	return w.changes
 }
-
-type mockSecrets struct {
-	provider.SecretBackendProvider
-	cleanedUUID string
-}
-
-func (m *mockSecrets) CleanupModel(cfg *provider.ModelBackendConfig) error {
-	if cfg.BackendType != "some-backend" {
-		return errors.New("unknown backend " + cfg.BackendType)
-	}
-	m.cleanedUUID = cfg.ModelUUID
-	return nil
-}

@@ -0,0 +1,348 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: github.com/juju/juju/secrets/provider (interfaces: SecretBackendProvider)
+//
+// Generated by this command:
+//
+//	mockgen -typed -package undertaker_test -destination secretsmocks_test.go github.com/juju/juju/secrets/provider SecretBackendProvider
+//
+
+// Package undertaker_test is a generated GoMock package.
+package undertaker_test
+
+import (
+	reflect "reflect"
+
+	provider "github.com/juju/juju/secrets/provider"
+	names "github.com/juju/names/v5"
+	gomock "go.uber.org/mock/gomock"
+)
+
+// MockSecretBackendProvider is a mock of SecretBackendProvider interface.
+type MockSecretBackendProvider struct {
+	ctrl     *gomock.Controller
+	recorder *MockSecretBackendProviderMockRecorder
+}
+
+// MockSecretBackendProviderMockRecorder is the mock recorder for MockSecretBackendProvider.
+type MockSecretBackendProviderMockRecorder struct {
+	mock *MockSecretBackendProvider
+}
+
+// NewMockSecretBackendProvider creates a new mock instance.
+func NewMockSecretBackendProvider(ctrl *gomock.Controller) *MockSecretBackendProvider {
+	mock := &MockSecretBackendProvider{ctrl: ctrl}
+	mock.recorder = &MockSecretBackendProviderMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecorder {
+	return m.recorder
+}
+
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+	return &MockSecretBackendProviderCleanupIssuedTokensCall{Call: call}
+}
+
+// MockSecretBackendProviderCleanupIssuedTokensCall wrap *gomock.Call
+type MockSecretBackendProviderCleanupIssuedTokensCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderCleanupIssuedTokensCall) Return(arg0 []string, arg1 error) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderCleanupIssuedTokensCall) Do(f func(*provider.ModelBackendConfig, []string) ([]string, error)) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderCleanupIssuedTokensCall) DoAndReturn(f func(*provider.ModelBackendConfig, []string) ([]string, error)) *MockSecretBackendProviderCleanupIssuedTokensCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// CleanupModel mocks base method.
+func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupModel", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CleanupModel indicates an expected call of CleanupModel.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupModel(arg0 any) *MockSecretBackendProviderCleanupModelCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupModel", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupModel), arg0)
+	return &MockSecretBackendProviderCleanupModelCall{Call: call}
+}
+
+// MockSecretBackendProviderCleanupModelCall wrap *gomock.Call
+type MockSecretBackendProviderCleanupModelCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderCleanupModelCall) Return(arg0 error) *MockSecretBackendProviderCleanupModelCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderCleanupModelCall) Do(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderCleanupModelCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderCleanupModelCall) DoAndReturn(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderCleanupModelCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// CleanupSecrets mocks base method.
+func (m *MockSecretBackendProvider) CleanupSecrets(arg0 *provider.ModelBackendConfig, arg1 names.Tag, arg2 provider.SecretRevisions) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupSecrets", arg0, arg1, arg2)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// CleanupSecrets indicates an expected call of CleanupSecrets.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupSecrets(arg0, arg1, arg2 any) *MockSecretBackendProviderCleanupSecretsCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupSecrets", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupSecrets), arg0, arg1, arg2)
+	return &MockSecretBackendProviderCleanupSecretsCall{Call: call}
+}
+
+// MockSecretBackendProviderCleanupSecretsCall wrap *gomock.Call
+type MockSecretBackendProviderCleanupSecretsCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderCleanupSecretsCall) Return(arg0 error) *MockSecretBackendProviderCleanupSecretsCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderCleanupSecretsCall) Do(f func(*provider.ModelBackendConfig, names.Tag, provider.SecretRevisions) error) *MockSecretBackendProviderCleanupSecretsCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderCleanupSecretsCall) DoAndReturn(f func(*provider.ModelBackendConfig, names.Tag, provider.SecretRevisions) error) *MockSecretBackendProviderCleanupSecretsCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Initialise mocks base method.
+func (m *MockSecretBackendProvider) Initialise(arg0 *provider.ModelBackendConfig) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Initialise", arg0)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// Initialise indicates an expected call of Initialise.
+func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *MockSecretBackendProviderInitialiseCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
+	return &MockSecretBackendProviderInitialiseCall{Call: call}
+}
+
+// MockSecretBackendProviderInitialiseCall wrap *gomock.Call
+type MockSecretBackendProviderInitialiseCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderInitialiseCall) Return(arg0 error) *MockSecretBackendProviderInitialiseCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderInitialiseCall) Do(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderInitialiseCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderInitialiseCall) DoAndReturn(f func(*provider.ModelBackendConfig) error) *MockSecretBackendProviderInitialiseCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *MockSecretBackendProviderIssuesTokensCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+	return &MockSecretBackendProviderIssuesTokensCall{Call: call}
+}
+
+// MockSecretBackendProviderIssuesTokensCall wrap *gomock.Call
+type MockSecretBackendProviderIssuesTokensCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderIssuesTokensCall) Return(arg0 bool) *MockSecretBackendProviderIssuesTokensCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderIssuesTokensCall) Do(f func() bool) *MockSecretBackendProviderIssuesTokensCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderIssuesTokensCall) DoAndReturn(f func() bool) *MockSecretBackendProviderIssuesTokensCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// NewBackend mocks base method.
+func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "NewBackend", arg0)
+	ret0, _ := ret[0].(provider.SecretsBackend)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// NewBackend indicates an expected call of NewBackend.
+func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *MockSecretBackendProviderNewBackendCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NewBackend", reflect.TypeOf((*MockSecretBackendProvider)(nil).NewBackend), arg0)
+	return &MockSecretBackendProviderNewBackendCall{Call: call}
+}
+
+// MockSecretBackendProviderNewBackendCall wrap *gomock.Call
+type MockSecretBackendProviderNewBackendCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderNewBackendCall) Return(arg0 provider.SecretsBackend, arg1 error) *MockSecretBackendProviderNewBackendCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderNewBackendCall) Do(f func(*provider.ModelBackendConfig) (provider.SecretsBackend, error)) *MockSecretBackendProviderNewBackendCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderNewBackendCall) DoAndReturn(f func(*provider.ModelBackendConfig) (provider.SecretsBackend, error)) *MockSecretBackendProviderNewBackendCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// RestrictedConfig mocks base method.
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
+	ret0, _ := ret[0].(*provider.BackendConfig)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RestrictedConfig indicates an expected call of RestrictedConfig.
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *MockSecretBackendProviderRestrictedConfigCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
+	return &MockSecretBackendProviderRestrictedConfigCall{Call: call}
+}
+
+// MockSecretBackendProviderRestrictedConfigCall wrap *gomock.Call
+type MockSecretBackendProviderRestrictedConfigCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderRestrictedConfigCall) Return(arg0 *provider.BackendConfig, arg1 error) *MockSecretBackendProviderRestrictedConfigCall {
+	c.Call = c.Call.Return(arg0, arg1)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderRestrictedConfigCall) Do(f func(*provider.ModelBackendConfig, bool, bool, string, names.Tag, []string, provider.SecretRevisions, provider.SecretRevisions) (*provider.BackendConfig, error)) *MockSecretBackendProviderRestrictedConfigCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderRestrictedConfigCall) DoAndReturn(f func(*provider.ModelBackendConfig, bool, bool, string, names.Tag, []string, provider.SecretRevisions, provider.SecretRevisions) (*provider.BackendConfig, error)) *MockSecretBackendProviderRestrictedConfigCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}
+
+// Type mocks base method.
+func (m *MockSecretBackendProvider) Type() string {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Type")
+	ret0, _ := ret[0].(string)
+	return ret0
+}
+
+// Type indicates an expected call of Type.
+func (mr *MockSecretBackendProviderMockRecorder) Type() *MockSecretBackendProviderTypeCall {
+	mr.mock.ctrl.T.Helper()
+	call := mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Type", reflect.TypeOf((*MockSecretBackendProvider)(nil).Type))
+	return &MockSecretBackendProviderTypeCall{Call: call}
+}
+
+// MockSecretBackendProviderTypeCall wrap *gomock.Call
+type MockSecretBackendProviderTypeCall struct {
+	*gomock.Call
+}
+
+// Return rewrite *gomock.Call.Return
+func (c *MockSecretBackendProviderTypeCall) Return(arg0 string) *MockSecretBackendProviderTypeCall {
+	c.Call = c.Call.Return(arg0)
+	return c
+}
+
+// Do rewrite *gomock.Call.Do
+func (c *MockSecretBackendProviderTypeCall) Do(f func() string) *MockSecretBackendProviderTypeCall {
+	c.Call = c.Call.Do(f)
+	return c
+}
+
+// DoAndReturn rewrite *gomock.Call.DoAndReturn
+func (c *MockSecretBackendProviderTypeCall) DoAndReturn(f func() string) *MockSecretBackendProviderTypeCall {
+	c.Call = c.Call.DoAndReturn(f)
+	return c
+}

@@ -41,6 +41,12 @@ type State interface {
 
 	// ControllerUUID returns the UUID of the controller.
 	ControllerUUID() string
+
+	ListSecretBackendIssuedTokenUntil(
+		until time.Time,
+	) ([]state.SecretBackendIssuedToken, error)
+
+	RemoveSecretBackendIssuedTokens(uuids []string) error
 }
 
 type stateShim struct {
@@ -51,6 +57,16 @@ func (s *stateShim) Model() (Model, error) {
 	return s.State.Model()
 }
 
+func (s *stateShim) ListSecretBackendIssuedTokenUntil(
+	until time.Time,
+) ([]state.SecretBackendIssuedToken, error) {
+	return state.NewSecrets(s.State).ListSecretBackendIssuedTokenUntil(until)
+}
+
+func (s *stateShim) RemoveSecretBackendIssuedTokens(uuids []string) error {
+	return state.NewSecrets(s.State).RemoveSecretBackendIssuedTokens(uuids)
+}
+
 // Model defines the needed methods of state.Model for
 // the work of the undertaker API.
 type Model interface {

@@ -4,6 +4,8 @@
 package undertaker
 
 import (
+	"time"
+
 	"github.com/juju/errors"
 	"github.com/juju/names/v5"
 
@@ -110,6 +112,34 @@ func (u *UndertakerAPI) RemoveModelSecrets() error {
 	if err != nil {
 		return errors.Annotate(err, "getting secrets backends config")
 	}
+
+	issuedTokens, err := u.st.ListSecretBackendIssuedTokenUntil(time.Now())
+	if err != nil {
+		return errors.Annotate(err, "getting secrets issued tokens")
+	}
+	if len(issuedTokens) > 0 {
+		issuedTokensToBackend := map[string][]string{}
+		for _, ik := range issuedTokens {
+			b := issuedTokensToBackend[ik.BackendID]
+			b = append(b, ik.UUID)
+			issuedTokensToBackend[ik.BackendID] = b
+		}
+		for backendID, issuedTokenUUIDs := range issuedTokensToBackend {
+			cfg, ok := secretBackendCfg.Configs[backendID]
+			if !ok {
+				err := u.st.RemoveSecretBackendIssuedTokens(issuedTokenUUIDs)
+				if err != nil {
+					return errors.Trace(err)
+				}
+				continue
+			}
+			err := u.revokeSecretIssuedTokensForBackend(&cfg, issuedTokenUUIDs)
+			if err != nil {
+				return errors.Trace(err)
+			}
+		}
+	}
+
 	for _, cfg := range secretBackendCfg.Configs {
 		if err := u.removeModelSecretsForBackend(&cfg); err != nil {
 			return errors.Annotatef(err, "cleaning model from inactive secrets provider %q", cfg.BackendType)
@@ -126,6 +156,24 @@ func (u *UndertakerAPI) removeModelSecretsForBackend(cfg *provider.ModelBackendC
 	return p.CleanupModel(cfg)
 }
 
+func (u *UndertakerAPI) revokeSecretIssuedTokensForBackend(
+	cfg *provider.ModelBackendConfig,
+	issuedTokenUUIDs []string,
+) error {
+	p, err := GetProvider(cfg.BackendType)
+	if err != nil {
+		return errors.Trace(err)
+	}
+	removed, cleanupErr := p.CleanupIssuedTokens(cfg, issuedTokenUUIDs)
+	if len(removed) > 0 {
+		err := u.st.RemoveSecretBackendIssuedTokens(removed)
+		if err != nil {
+			return errors.Trace(err)
+		}
+	}
+	return errors.Trace(cleanupErr)
+}
+
 func (u *UndertakerAPI) modelEntitiesWatcher() params.NotifyWatchResult {
 	var nothing params.NotifyWatchResult
 	watch := u.st.WatchModelEntityReferences(u.st.ModelUUID())

@@ -9,6 +9,7 @@ import (
 	"github.com/juju/errors"
 	"github.com/juju/names/v5"
 	jc "github.com/juju/testing/checkers"
+	"go.uber.org/mock/gomock"
 	gc "gopkg.in/check.v1"
 
 	"github.com/juju/juju/apiserver/facades/controller/undertaker"
@@ -25,12 +26,12 @@ import (
 
 type undertakerSuite struct {
 	coretesting.BaseSuite
-	secrets *mockSecrets
+	secrets *MockSecretBackendProvider
 }
 
 var _ = gc.Suite(&undertakerSuite{})
 
-func (s *undertakerSuite) setupStateAndAPI(c *gc.C, isSystem bool, modelName string, secretsConfigError error) (*mockState, *undertaker.UndertakerAPI) {
+func (s *undertakerSuite) setupStateAndAPI(c *gc.C, ctrl *gomock.Controller, isSystem bool, modelName string, secretsConfigError error) (*mockState, *undertaker.UndertakerAPI) {
 	machineNo := "1"
 	if isSystem {
 		machineNo = "0"
@@ -43,8 +44,8 @@ func (s *undertakerSuite) setupStateAndAPI(c *gc.C, isSystem bool, modelName str
 
 	modelCfg, err := config.New(config.NoDefaults, coretesting.FakeConfig())
 	c.Assert(err, gc.IsNil)
-	st := newMockState(names.NewUserTag("admin"), modelName, isSystem, *modelCfg)
-	s.secrets = &mockSecrets{}
+	st := newMockState(ctrl, names.NewUserTag("admin"), modelName, isSystem, *modelCfg)
+	s.secrets = NewMockSecretBackendProvider(ctrl)
 	s.PatchValue(&undertaker.GetProvider, func(string) (provider.SecretBackendProvider, error) { return s.secrets, nil })
 
 	secretBackendConfigGetter := func() (*provider.ModelBackendConfigInfo, error) {
@@ -67,14 +68,17 @@ func (s *undertakerSuite) setupStateAndAPI(c *gc.C, isSystem bool, modelName str
 }
 
 func (s *undertakerSuite) TestNoPerms(c *gc.C) {
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
 	modelCfg, err := config.New(config.NoDefaults, coretesting.FakeConfig())
 	c.Assert(err, gc.IsNil)
 	for _, authorizer := range []apiservertesting.FakeAuthorizer{{
 		Tag: names.NewMachineTag("0"),
 	}, {
 		Tag: names.NewUserTag("bob"),
 	}} {
-		st := newMockState(names.NewUserTag("admin"), "admin", true, *modelCfg)
+		st := newMockState(ctrl, names.NewUserTag("admin"), "admin", true, *modelCfg)
 		_, err := undertaker.NewUndertaker(
 			st,
 			nil,
@@ -89,8 +93,11 @@ func (s *undertakerSuite) TestNoPerms(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestModelInfo(c *gc.C) {
-	otherSt, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
-	st, api := s.setupStateAndAPI(c, true, "admin", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	otherSt, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
+	st, api := s.setupStateAndAPI(c, ctrl, true, "admin", nil)
 	for _, test := range []struct {
 		st        *mockState
 		api       *undertaker.UndertakerAPI
@@ -125,7 +132,10 @@ func (s *undertakerSuite) TestModelInfo(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestProcessDyingModel(c *gc.C) {
-	otherSt, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	otherSt, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 	model, err := otherSt.Model()
 	c.Assert(err, jc.ErrorIsNil)
 
@@ -140,7 +150,10 @@ func (s *undertakerSuite) TestProcessDyingModel(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestRemoveAliveModel(c *gc.C) {
-	otherSt, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	otherSt, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 	_, err := otherSt.Model()
 	c.Assert(err, jc.ErrorIsNil)
 
@@ -149,7 +162,10 @@ func (s *undertakerSuite) TestRemoveAliveModel(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestRemoveDyingModel(c *gc.C) {
-	otherSt, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	otherSt, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 
 	// Set model to dying
 	otherSt.model.life = state.Dying
@@ -158,7 +174,10 @@ func (s *undertakerSuite) TestRemoveDyingModel(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestDeadRemoveModel(c *gc.C) {
-	otherSt, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	otherSt, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 
 	// Set model to dead
 	otherSt.model.life = state.Dying
@@ -172,31 +191,64 @@ func (s *undertakerSuite) TestDeadRemoveModel(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestRemoveModelSecrets(c *gc.C) {
-	otherSt, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	st, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
+
+	cleanedUUID := ""
+	s.secrets.EXPECT().CleanupModel(gomock.Any()).DoAndReturn(func(cfg *provider.ModelBackendConfig) error {
+		if cfg.BackendType != "some-backend" {
+			return errors.New("unknown backend " + cfg.BackendType)
+		}
+		cleanedUUID = cfg.ModelUUID
+		return nil
+	})
+
+	tokenUUIDs := []string{"uuid-one", "uuid-two"}
+	tokens := []state.SecretBackendIssuedToken{{
+		UUID:      tokenUUIDs[0],
+		BackendID: "backend-id",
+	}, {
+		UUID:      tokenUUIDs[1],
+		BackendID: "backend-id",
+	}}
+	st.EXPECT().ListSecretBackendIssuedTokenUntil(
+		gomock.Any()).Return(tokens, nil)
+	s.secrets.EXPECT().CleanupIssuedTokens(
+		gomock.Any(), tokenUUIDs).Return(tokenUUIDs, nil)
+	st.EXPECT().RemoveSecretBackendIssuedTokens(tokenUUIDs).Return(nil)
 
 	err := hostedAPI.RemoveModelSecrets()
 	c.Assert(err, jc.ErrorIsNil)
-	c.Assert(s.secrets.cleanedUUID, gc.Equals, otherSt.model.uuid)
+	c.Assert(cleanedUUID, gc.Equals, st.model.uuid)
 }
 
 func (s *undertakerSuite) TestRemoveModelSecretsConfigNotFound(c *gc.C) {
-	_, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", errors.NotFound)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
 
+	_, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", errors.NotFound)
 	err := hostedAPI.RemoveModelSecrets()
 	c.Assert(err, jc.ErrorIsNil)
-	c.Assert(s.secrets.cleanedUUID, gc.Equals, "")
 }
 
 func (s *undertakerSuite) TestModelConfig(c *gc.C) {
-	_, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	_, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 
 	cfg, err := hostedAPI.ModelConfig()
 	c.Assert(err, jc.ErrorIsNil)
 	c.Assert(cfg, gc.NotNil)
 }
 
 func (s *undertakerSuite) TestSetStatus(c *gc.C) {
-	mock, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	mock, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 
 	results, err := hostedAPI.SetStatus(params.SetStatus{
 		Entities: []params.EntityStatusArgs{{
@@ -213,7 +265,10 @@ func (s *undertakerSuite) TestSetStatus(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestSetStatusControllerPermissions(c *gc.C) {
-	_, hostedAPI := s.setupStateAndAPI(c, true, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	_, hostedAPI := s.setupStateAndAPI(c, ctrl, true, "hostedmodel", nil)
 	results, err := hostedAPI.SetStatus(params.SetStatus{
 		Entities: []params.EntityStatusArgs{{
 			"model-6ada782f-bcd4-454b-a6da-d1793fbcb35e", status.Destroying.String(),
@@ -226,7 +281,10 @@ func (s *undertakerSuite) TestSetStatusControllerPermissions(c *gc.C) {
 }
 
 func (s *undertakerSuite) TestSetStatusNonControllerPermissions(c *gc.C) {
-	_, hostedAPI := s.setupStateAndAPI(c, false, "hostedmodel", nil)
+	ctrl := gomock.NewController(c)
+	defer ctrl.Finish()
+
+	_, hostedAPI := s.setupStateAndAPI(c, ctrl, false, "hostedmodel", nil)
 	results, err := hostedAPI.SetStatus(params.SetStatus{
 		Entities: []params.EntityStatusArgs{{
 			"model-6ada782f-bcd4-454b-a6da-d1793fbcb35e", status.Destroying.String(),

@@ -50,7 +50,7 @@ func newUserSecretsDrainAPI(context facade.Context) (*SecretsDrainAPI, error) {
 	}
 
 	secretBackendConfigGetter := func(backendIDs []string, wantAll bool) (*provider.ModelBackendConfigInfo, error) {
-		return commonsecrets.BackendConfigInfo(commonsecrets.SecretsModel(model), true, backendIDs, wantAll, authTag, leadershipChecker)
+		return commonsecrets.BackendConfigInfo(commonsecrets.SecretsModel(model), true, backendIDs, wantAll, authTag, leadershipChecker, nil)
 	}
 	secretBackendDrainConfigGetter := func(backendID string) (*provider.ModelBackendConfigInfo, error) {
 		return commonsecrets.DrainBackendConfigInfo(backendID, commonsecrets.SecretsModel(model), authTag, leadershipChecker)

@@ -123,6 +123,21 @@ func (m *MockSecretBackendProvider) EXPECT() *MockSecretBackendProviderMockRecor
 	return m.recorder
 }
 
+// CleanupIssuedTokens mocks base method.
+func (m *MockSecretBackendProvider) CleanupIssuedTokens(arg0 *provider.ModelBackendConfig, arg1 []string) ([]string, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CleanupIssuedTokens", arg0, arg1)
+	ret0, _ := ret[0].([]string)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CleanupIssuedTokens indicates an expected call of CleanupIssuedTokens.
+func (mr *MockSecretBackendProviderMockRecorder) CleanupIssuedTokens(arg0, arg1 any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupIssuedTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).CleanupIssuedTokens), arg0, arg1)
+}
+
 // CleanupModel mocks base method.
 func (m *MockSecretBackendProvider) CleanupModel(arg0 *provider.ModelBackendConfig) error {
 	m.ctrl.T.Helper()
@@ -165,6 +180,20 @@ func (mr *MockSecretBackendProviderMockRecorder) Initialise(arg0 any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Initialise", reflect.TypeOf((*MockSecretBackendProvider)(nil).Initialise), arg0)
 }
 
+// IssuesTokens mocks base method.
+func (m *MockSecretBackendProvider) IssuesTokens() bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "IssuesTokens")
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// IssuesTokens indicates an expected call of IssuesTokens.
+func (mr *MockSecretBackendProviderMockRecorder) IssuesTokens() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IssuesTokens", reflect.TypeOf((*MockSecretBackendProvider)(nil).IssuesTokens))
+}
+
 // NewBackend mocks base method.
 func (m *MockSecretBackendProvider) NewBackend(arg0 *provider.ModelBackendConfig) (provider.SecretsBackend, error) {
 	m.ctrl.T.Helper()
@@ -181,18 +210,18 @@ func (mr *MockSecretBackendProviderMockRecorder) NewBackend(arg0 any) *gomock.Ca
 }
 
 // RestrictedConfig mocks base method.
-func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 names.Tag, arg4, arg5 provider.SecretRevisions) (*provider.BackendConfig, error) {
+func (m *MockSecretBackendProvider) RestrictedConfig(arg0 *provider.ModelBackendConfig, arg1, arg2 bool, arg3 string, arg4 names.Tag, arg5 []string, arg6, arg7 provider.SecretRevisions) (*provider.BackendConfig, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5)
+	ret := m.ctrl.Call(m, "RestrictedConfig", arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 	ret0, _ := ret[0].(*provider.BackendConfig)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
 // RestrictedConfig indicates an expected call of RestrictedConfig.
-func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5 any) *gomock.Call {
+func (mr *MockSecretBackendProviderMockRecorder) RestrictedConfig(arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7 any) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RestrictedConfig", reflect.TypeOf((*MockSecretBackendProvider)(nil).RestrictedConfig), arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7)
 }
 
 // Type mocks base method.

@@ -0,0 +1,152 @@
+// Copyright 2025 Canonical Ltd.
+// Licensed under the AGPLv3, see LICENCE file for details.
+
+package apiserver_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"mime"
+	"net/http"
+	"net/url"
+	"strings"
+
+	jc "github.com/juju/testing/checkers"
+	"github.com/juju/utils/v3"
+	gc "gopkg.in/check.v1"
+
+	apitesting "github.com/juju/juju/apiserver/testing"
+	"github.com/juju/juju/core/permission"
+	"github.com/juju/juju/core/resources"
+	"github.com/juju/juju/rpc/params"
+	"github.com/juju/juju/state"
+	"github.com/juju/juju/testing/factory"
+)
+
+type resourcesAuthSuite struct {
+	apiserverBaseSuite
+}
+
+func (s *resourcesAuthSuite) resourcesURL(app, res string) *url.URL {
+	u := s.URL(fmt.Sprintf("/model/%s/applications/%s/resources/%s", s.Model.UUID(), app, res), nil)
+	return u
+}
+
+func (s *resourcesAuthSuite) assertJSONErrorResponse(c *gc.C, resp *http.Response, expCode int, expError string) {
+	uploadResponse := s.assertResponse(c, resp, expCode)
+	c.Check(uploadResponse.Error, gc.NotNil)
+	c.Check(uploadResponse.Error.Message, gc.Matches, expError)
+}
+
+func (s *resourcesAuthSuite) assertPlainErrorResponse(c *gc.C, resp *http.Response, expCode int, expError string) {
+	body := apitesting.AssertResponse(c, resp, expCode, "text/plain; charset=utf-8")
+	c.Assert(string(body), gc.Matches, expError+"\n")
+}
+
+func (s *resourcesAuthSuite) assertResponse(c *gc.C, resp *http.Response, expStatus int) params.UploadResult {
+	body := apitesting.AssertResponse(c, resp, expStatus, params.ContentTypeJSON)
+	var uploadResult params.UploadResult
+	err := json.Unmarshal(body, &uploadResult)
+	c.Assert(err, jc.ErrorIsNil, gc.Commentf("Body: %s", body))
+	return uploadResult
+}
+
+var _ = gc.Suite(&resourcesAuthSuite{})
+
+func (s *resourcesAuthSuite) TestResourcesUploadedSecurely(c *gc.C) {
+	url := s.resourcesURL("tomcat", "jdk")
+	url.Scheme = "http"
+	resp := apitesting.SendHTTPRequest(c, apitesting.HTTPRequestParams{
+		Method:       "PUT",
+		URL:          url.String(),
+		ExpectStatus: http.StatusBadRequest,
+	})
+	defer resp.Body.Close()
+}
+
+func (s *resourcesAuthSuite) TestRequiresAuth(c *gc.C) {
+	resp := apitesting.SendHTTPRequest(c, apitesting.HTTPRequestParams{Method: "GET", URL: s.resourcesURL("tomcat", "jdk").String()})
+	defer resp.Body.Close()
+	s.assertPlainErrorResponse(c, resp, http.StatusUnauthorized, "authentication failed: no credentials provided")
+}
+
+func (s *resourcesAuthSuite) TestAuthRejectsNonsUser(c *gc.C) {
+	// Add a machine and try to login.
+	machine, err := s.State.AddMachine(state.UbuntuBase("12.10"), state.JobHostUnits)
+	c.Assert(err, jc.ErrorIsNil)
+	err = machine.SetProvisioned("foo", "", "fake_nonce", nil)
+	c.Assert(err, jc.ErrorIsNil)
+	password, err := utils.RandomPassword()
+	c.Assert(err, jc.ErrorIsNil)
+	err = machine.SetPassword(password)
+	c.Assert(err, jc.ErrorIsNil)
+
+	resp := apitesting.SendHTTPRequest(c, apitesting.HTTPRequestParams{
+		Tag:      machine.Tag().String(),
+		Password: password,
+		Method:   "PUT",
+		URL:      s.resourcesURL("tomcat", "jdk").String(),
+		Nonce:    "fake_nonce",
+	})
+	s.assertPlainErrorResponse(
+		c, resp, http.StatusForbidden,
+		"authorization failed: permission denied",
+	)
+	resp.Body.Close()
+
+	// Now try a user login.
+	content, err := resources.GenerateContent(strings.NewReader("resource"))
+	c.Assert(err, jc.ErrorIsNil)
+	filename := mime.BEncoding.Encode("utf-8", "foo.txt")
+	disp := mime.FormatMediaType(
+		"form-data",
+		map[string]string{"filename": filename},
+	)
+
+	resp = s.sendHTTPRequest(c, apitesting.HTTPRequestParams{
+		Method:      "PUT",
+		URL:         s.resourcesURL("tomcat", "jdk").String(),
+		ContentType: "application/octet-stream",
+		ExtraHeaders: map[string]string{
+			"Content-Sha384":      content.Fingerprint.String(),
+			"Content-Length":      fmt.Sprintf("%d", content.Size),
+			"Content-Disposition": disp,
+		},
+		Body: strings.NewReader("fake_nonce"),
+	})
+	s.assertJSONErrorResponse(c, resp, http.StatusNotFound, `application "tomcat" not found`)
+	resp.Body.Close()
+}
+
+func (s *resourcesAuthSuite) TestUploadAuthRejectsUserWithoutPermission(c *gc.C) {
+	s.Factory.MakeUser(c, &factory.UserParams{
+		Name:     "oryx",
+		Password: "gardener",
+		Access:   permission.ReadAccess,
+	})
+	s.assertAuthRejectsUserWithoutPermission(c, "PUT")
+}
+
+func (s *resourcesAuthSuite) TestDownloadAuthRejectsUserWithoutPermission(c *gc.C) {
+	s.Factory.MakeUser(c, &factory.UserParams{
+		Name:        "oryx",
+		Password:    "gardener",
+		NoModelUser: true,
+	})
+	s.assertAuthRejectsUserWithoutPermission(c, "GET")
+}
+
+func (s *resourcesAuthSuite) assertAuthRejectsUserWithoutPermission(c *gc.C, method string) {
+
+	resp := apitesting.SendHTTPRequest(c, apitesting.HTTPRequestParams{
+		Tag:      "user-oryx",
+		Password: "gardener",
+		Method:   method,
+		URL:      s.resourcesURL("tomcat", "jdk").String(),
+	})
+	defer resp.Body.Close()
+	s.assertPlainErrorResponse(
+		c, resp, http.StatusForbidden,
+		"authorization failed: permission denied",
+	)
+}

@@ -40,16 +40,22 @@ type ResourcesBackend interface {
 	UpdatePendingResource(applicationID, pendingID, userID string, res charmresource.Resource, r io.Reader) (resources.Resource, error)
 }
 
-// ResourcesHandler is the HTTP handler for client downloads and
+// ResourcesUploadHandler is the HTTP handler for client
 // uploads of resources.
-type ResourcesHandler struct {
-	StateAuthFunc     func(*http.Request, ...string) (ResourcesBackend, state.PoolHelper, names.Tag, error)
+type ResourcesUploadHandler struct {
 	ChangeAllowedFunc func(*http.Request) error
+	StateFunc         func(*http.Request) (ResourcesBackend, state.PoolHelper, names.Tag, error)
+}
+
+// ResourcesDownloadHandler is the HTTP handler for client
+// downloads of resources.
+type ResourcesDownloadHandler struct {
+	StateFunc func(*http.Request) (ResourcesBackend, state.PoolHelper, names.Tag, error)
 }
 
 // ServeHTTP implements http.Handler.
-func (h *ResourcesHandler) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
-	backend, poolhelper, tag, err := h.StateAuthFunc(req, names.UserTagKind, names.MachineTagKind, names.ControllerAgentTagKind, names.ApplicationTagKind)
+func (h *ResourcesDownloadHandler) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
+	backend, poolhelper, _, err := h.StateFunc(req)
 	if err != nil {
 		if err := sendError(resp, err); err != nil {
 			logger.Errorf("%v", err)
@@ -75,6 +81,36 @@ func (h *ResourcesHandler) ServeHTTP(resp http.ResponseWriter, req *http.Request
 		if _, err := io.Copy(resp, reader); err != nil {
 			logger.Errorf("resource download failed: %v", err)
 		}
+	default:
+		if err := sendError(resp, errors.MethodNotAllowedf("unsupported method: %q", req.Method)); err != nil {
+			logger.Errorf("%v", err)
+		}
+	}
+}
+
+func (h *ResourcesDownloadHandler) download(backend ResourcesBackend, req *http.Request) (io.ReadCloser, int64, error) {
+	defer req.Body.Close()
+
+	query := req.URL.Query()
+	application := query.Get(":application")
+	name := query.Get(":resource")
+
+	resource, reader, err := backend.OpenResource(application, name)
+	return reader, resource.Size, errors.Trace(err)
+}
+
+// ServeHTTP implements http.Handler.
+func (h *ResourcesUploadHandler) ServeHTTP(resp http.ResponseWriter, req *http.Request) {
+	backend, closer, tag, err := h.StateFunc(req)
+	if err != nil {
+		if err := sendError(resp, err); err != nil {
+			logger.Errorf("%v", err)
+		}
+		return
+	}
+	defer closer.Release()
+
+	switch req.Method {
 	case "PUT":
 		if err := h.ChangeAllowedFunc(req); err != nil {
 			if err := sendError(resp, err); err != nil {
@@ -99,18 +135,7 @@ func (h *ResourcesHandler) ServeHTTP(resp http.ResponseWriter, req *http.Request
 	}
 }
 
-func (h *ResourcesHandler) download(backend ResourcesBackend, req *http.Request) (io.ReadCloser, int64, error) {
-	defer req.Body.Close()
-
-	query := req.URL.Query()
-	application := query.Get(":application")
-	name := query.Get(":resource")
-
-	resource, reader, err := backend.OpenResource(application, name)
-	return reader, resource.Size, errors.Trace(err)
-}
-
-func (h *ResourcesHandler) upload(backend ResourcesBackend, req *http.Request, username string) (*params.UploadResult, error) {
+func (h *ResourcesUploadHandler) upload(backend ResourcesBackend, req *http.Request, username string) (*params.UploadResult, error) {
 	defer req.Body.Close()
 
 	uploaded, err := h.readResource(backend, req)
@@ -153,7 +178,7 @@ type uploadedResource struct {
 }
 
 // readResource extracts the relevant info from the request.
-func (h *ResourcesHandler) readResource(backend ResourcesBackend, req *http.Request) (*uploadedResource, error) {
+func (h *ResourcesUploadHandler) readResource(backend ResourcesBackend, req *http.Request) (*uploadedResource, error) {
 	uReq, err := extractUploadRequest(req)
 	if err != nil {
 		return nil, errors.Trace(err)

@@ -14,7 +14,6 @@ import (
 	"time"
 
 	charmresource "github.com/juju/charm/v12/resource"
-	"github.com/juju/collections/set"
 	"github.com/juju/errors"
 	"github.com/juju/names/v5"
 	"github.com/juju/testing"
@@ -34,12 +33,13 @@ import (
 type ResourcesHandlerSuite struct {
 	testing.IsolationSuite
 
-	stateAuthErr error
-	backend      *fakeBackend
-	username     string
-	req          *http.Request
-	recorder     *httptest.ResponseRecorder
-	handler      *apiserver.ResourcesHandler
+	stateAuthErr    error
+	backend         *fakeBackend
+	username        string
+	req             *http.Request
+	recorder        *httptest.ResponseRecorder
+	uploadHandler   *apiserver.ResourcesUploadHandler
+	downloadHandler *apiserver.ResourcesDownloadHandler
 }
 
 var _ = gc.Suite(&ResourcesHandlerSuite{})
@@ -58,13 +58,16 @@ func (s *ResourcesHandlerSuite) SetUpTest(c *gc.C) {
 	c.Assert(err, jc.ErrorIsNil)
 	s.req = req
 	s.recorder = httptest.NewRecorder()
-	s.handler = &apiserver.ResourcesHandler{
-		StateAuthFunc:     s.authState,
+	s.uploadHandler = &apiserver.ResourcesUploadHandler{
+		StateFunc:         s.stateFunc,
 		ChangeAllowedFunc: func(*http.Request) error { return nil },
 	}
+	s.downloadHandler = &apiserver.ResourcesDownloadHandler{
+		StateFunc: s.stateFunc,
+	}
 }
 
-func (s *ResourcesHandlerSuite) authState(req *http.Request, tagKinds ...string) (
+func (s *ResourcesHandlerSuite) stateFunc(req *http.Request) (
 	apiserver.ResourcesBackend, state.PoolHelper, names.Tag, error,
 ) {
 	if s.stateAuthErr != nil {
@@ -76,45 +79,45 @@ func (s *ResourcesHandlerSuite) authState(req *http.Request, tagKinds ...string)
 	return s.backend, ph, tag, nil
 }
 
-func (s *ResourcesHandlerSuite) TestExpectedAuthTags(c *gc.C) {
-	expectedTags := set.NewStrings(names.UserTagKind, names.MachineTagKind, names.ControllerAgentTagKind, names.ApplicationTagKind)
-
-	s.handler.StateAuthFunc = func(req *http.Request, tagKinds ...string) (apiserver.ResourcesBackend, state.PoolHelper, names.Tag, error) {
-		gotTags := set.NewStrings(tagKinds...)
-		if gotTags.Difference(expectedTags).Size() != 0 || expectedTags.Difference(gotTags).Size() != 0 {
-			c.Fatalf("unexpected tag kinds %v", tagKinds)
-			return nil, nil, nil, errors.NotValidf("tag kinds %v", tagKinds)
-		}
-		ph := apiservertesting.StubPoolHelper{StubRelease: func() bool { return false }}
-		tag := names.NewUserTag(s.username)
-		return s.backend, ph, tag, nil
-	}
-	s.req.Method = "GET"
-	s.handler.ServeHTTP(s.recorder, s.req)
-	s.checkResp(c, http.StatusOK, "application/octet-stream", resourceBody)
+func (s *ResourcesHandlerSuite) TestDownloadStateAuthFailure(c *gc.C) {
+	failure, expected := apiFailure("<failure>", "")
+	s.stateAuthErr = failure
+
+	s.downloadHandler.ServeHTTP(s.recorder, s.req)
+
+	s.checkResp(c, http.StatusInternalServerError, "application/json", expected)
 }
 
-func (s *ResourcesHandlerSuite) TestStateAuthFailure(c *gc.C) {
+func (s *ResourcesHandlerSuite) TestUploadStateAuthFailure(c *gc.C) {
 	failure, expected := apiFailure("<failure>", "")
 	s.stateAuthErr = failure
 
-	s.handler.ServeHTTP(s.recorder, s.req)
+	s.uploadHandler.ServeHTTP(s.recorder, s.req)
 
 	s.checkResp(c, http.StatusInternalServerError, "application/json", expected)
 }
 
-func (s *ResourcesHandlerSuite) TestUnsupportedMethod(c *gc.C) {
-	s.req.Method = "POST"
+func (s *ResourcesHandlerSuite) TestDownloadUnsupportedMethod(c *gc.C) {
+	s.req.Method = "PUT"
+
+	s.downloadHandler.ServeHTTP(s.recorder, s.req)
+
+	_, expected := apiFailure(`unsupported method: "PUT"`, params.CodeMethodNotAllowed)
+	s.checkResp(c, http.StatusMethodNotAllowed, "application/json", expected)
+}
+
+func (s *ResourcesHandlerSuite) TestUploadUnsupportedMethod(c *gc.C) {
+	s.req.Method = "GET"
 
-	s.handler.ServeHTTP(s.recorder, s.req)
+	s.uploadHandler.ServeHTTP(s.recorder, s.req)
 
-	_, expected := apiFailure(`unsupported method: "POST"`, params.CodeMethodNotAllowed)
+	_, expected := apiFailure(`unsupported method: "GET"`, params.CodeMethodNotAllowed)
 	s.checkResp(c, http.StatusMethodNotAllowed, "application/json", expected)
 }
 
 func (s *ResourcesHandlerSuite) TestGetSuccess(c *gc.C) {
 	s.req.Method = "GET"
-	s.handler.ServeHTTP(s.recorder, s.req)
+	s.downloadHandler.ServeHTTP(s.recorder, s.req)
 	s.checkResp(c, http.StatusOK, "application/octet-stream", resourceBody)
 }
 
@@ -126,7 +129,7 @@ func (s *ResourcesHandlerSuite) TestPutSuccess(c *gc.C) {
 	s.backend.ReturnSetResource = res
 
 	req, _ := newUploadRequest(c, "spam", "a-application", uploadContent)
-	s.handler.ServeHTTP(s.recorder, req)
+	s.uploadHandler.ServeHTTP(s.recorder, req)
 
 	expected := mustMarshalJSON(&params.UploadResult{
 		Resource: api.Resource2API(res),
@@ -142,12 +145,12 @@ func (s *ResourcesHandlerSuite) TestPutChangeBlocked(c *gc.C) {
 	s.backend.ReturnSetResource = res
 
 	expectedError := apiservererrors.OperationBlockedError("test block")
-	s.handler.ChangeAllowedFunc = func(*http.Request) error {
+	s.uploadHandler.ChangeAllowedFunc = func(*http.Request) error {
 		return expectedError
 	}
 
 	req, _ := newUploadRequest(c, "spam", "a-application", uploadContent)
-	s.handler.ServeHTTP(s.recorder, req)
+	s.uploadHandler.ServeHTTP(s.recorder, req)
 
 	expected := mustMarshalJSON(&params.ErrorResult{apiservererrors.ServerError(expectedError)})
 	s.checkResp(c, http.StatusBadRequest, "application/json", string(expected))
@@ -161,7 +164,7 @@ func (s *ResourcesHandlerSuite) TestPutSuccessDockerResource(c *gc.C) {
 	s.backend.ReturnSetResource = res
 
 	req, _ := newUploadRequest(c, "spam", "a-application", uploadContent)
-	s.handler.ServeHTTP(s.recorder, req)
+	s.uploadHandler.ServeHTTP(s.recorder, req)
 
 	expected := mustMarshalJSON(&params.UploadResult{
 		Resource: api.Resource2API(res),
@@ -180,7 +183,7 @@ func (s *ResourcesHandlerSuite) TestPutExtensionMismatch(c *gc.C) {
 
 	req, _ := newUploadRequest(c, "spam", "a-application", content)
 	req.Header.Set("Content-Disposition", "form-data; filename=different.ext")
-	s.handler.ServeHTTP(s.recorder, req)
+	s.uploadHandler.ServeHTTP(s.recorder, req)
 
 	_, expected := apiFailure(`incorrect extension on resource upload "different.ext", expected ".tgz"`,
 		"")
@@ -198,7 +201,7 @@ func (s *ResourcesHandlerSuite) TestPutWithPending(c *gc.C) {
 
 	req, _ := newUploadRequest(c, "spam", "a-application", content)
 	req.URL.RawQuery += "&pendingid=some-unique-id"
-	s.handler.ServeHTTP(s.recorder, req)
+	s.uploadHandler.ServeHTTP(s.recorder, req)
 
 	expected := mustMarshalJSON(&params.UploadResult{
 		Resource: api.Resource2API(res),
@@ -214,7 +217,7 @@ func (s *ResourcesHandlerSuite) TestPutSetResourceFailure(c *gc.C) {
 	s.backend.SetResourceErr = failure
 
 	req, _ := newUploadRequest(c, "spam", "a-application", content)
-	s.handler.ServeHTTP(s.recorder, req)
+	s.uploadHandler.ServeHTTP(s.recorder, req)
 	s.checkResp(c, http.StatusInternalServerError, "application/json", expected)
 }
 

@@ -60,14 +60,15 @@ var commonModelFacadeNames = set.NewStrings(
 	"RemoteRelations",
 	"Resumer",
 	"RetryStrategy",
-	"Secrets",
-	"SecretsManager",
-	"SecretsDrain",
-	"UserSecretsDrain",
 	"SecretBackendsManager",
 	"SecretBackendsRotateWatcher",
+	"Secrets",
+	"SecretsDrain",
+	"SecretsManager",
 	"SecretsRevisionWatcher",
+	"SecretsRevoker",
 	"SecretsTriggerWatcher",
+	"UserSecretsDrain",
 	"UserSecretsManager",
 	"Singular",
 	"StatusHistory",

@@ -13,8 +13,8 @@ RUN useradd --uid 171 --gid 171 --no-create-home --shell /usr/bin/bash sjuju
 RUN mkdir -p /etc/sudoers.d && echo "sjuju ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/sjuju
 
 # Some Python dependencies.
-RUN apt-get update \
-    && apt-get install -y --no-install-recommends \
+RUN DEBIAN_FRONTEND=noninteractive apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
     sudo \
     python3-yaml \
     python3-pip \

@@ -201,9 +201,9 @@ func AssertManifoldsDependencies(c *gc.C, manifolds dependency.Manifolds, expect
 	names := set.NewStrings(keys(dependencies)...)
 	expectedNames := set.NewStrings(keys(expected)...)
 	// Unexpected names...
-	c.Assert(names.Difference(expectedNames), gc.DeepEquals, empty)
+	c.Check(names.Difference(expectedNames), gc.DeepEquals, empty)
 	// Missing names...
-	c.Assert(expectedNames.Difference(names), gc.DeepEquals, empty)
+	c.Check(expectedNames.Difference(names), gc.DeepEquals, empty)
 
 	for _, n := range manifoldNames.SortedValues() {
 		c.Check(dependencies[n], jc.SameContents, expected[n], gc.Commentf("mismatched dependencies for worker %q", n))

@@ -54,6 +54,7 @@ var (
 		"undertaker",
 		"unit-assigner", // tertiary dependency: will be inactive because migration workers will be inactive
 		"secrets-pruner",
+		"secrets-revoker",
 		"user-secrets-drain-worker",
 	}
 	aliveModelWorkers = []string{
@@ -78,6 +79,7 @@ var (
 		"storage-provisioner",
 		"unit-assigner",
 		"secrets-pruner",
+		"secrets-revoker",
 		"user-secrets-drain-worker",
 	}
 	migratingModelWorkers = []string{

@@ -63,6 +63,7 @@ import (
 	"github.com/juju/juju/internal/worker/remoterelations"
 	"github.com/juju/juju/internal/worker/secretsdrainworker"
 	"github.com/juju/juju/internal/worker/secretspruner"
+	"github.com/juju/juju/internal/worker/secretsrevoker"
 	"github.com/juju/juju/internal/worker/singular"
 	"github.com/juju/juju/internal/worker/statushistorypruner"
 	"github.com/juju/juju/internal/worker/storageprovisioner"
@@ -344,6 +345,16 @@ func commonManifolds(config ManifoldsConfig) dependency.Manifolds {
 			NewWorker:             secretsdrainworker.NewWorker,
 			NewBackendsClient:     secretsdrainworker.NewUserSecretBackendsClient,
 		})),
+		// secrets revoker worker deals with revoking authentication tokens from
+		// secret backends used by this model. In 4.0, this could probably be
+		// replaced with a cleanup job that schedules cleanups in the future.
+		secretsRevokerName: ifNotMigrating(secretsrevoker.Manifold(secretsrevoker.ManifoldConfig{
+			APICallerName:    apiCallerName,
+			Clock:            config.Clock,
+			Logger:           config.LoggingContext.GetLogger("juju.worker.secretsrevoker"),
+			NewSecretsFacade: secretsrevoker.NewSecretsFacade,
+			NewWorker:        secretsrevoker.NewWorker,
+		})),
 	}
 	return result
 }
@@ -744,6 +755,7 @@ const (
 
 	secretsPrunerName      = "secrets-pruner"
 	userSecretsDrainWorker = "user-secrets-drain-worker"
+	secretsRevokerName     = "secrets-revoker"
 
 	validCredentialFlagName = "valid-credential-flag"
 )

@@ -61,6 +61,7 @@ func (s *ManifoldsSuite) TestIAASNames(c *gc.C) {
 		"not-dead-flag",
 		"remote-relations",
 		"secrets-pruner",
+		"secrets-revoker",
 		"state-cleaner",
 		"status-history-pruner",
 		"storage-provisioner",
@@ -112,6 +113,7 @@ func (s *ManifoldsSuite) TestCAASNames(c *gc.C) {
 		"not-dead-flag",
 		"remote-relations",
 		"secrets-pruner",
+		"secrets-revoker",
 		"state-cleaner",
 		"status-history-pruner",
 		"undertaker",
@@ -229,6 +231,17 @@ var expectedCAASModelManifoldsWithDependencies = map[string][]string{
 		"not-dead-flag",
 	},
 
+	"secrets-revoker": {
+		"agent",
+		"api-caller",
+		"environ-upgrade-gate",
+		"environ-upgraded-flag",
+		"is-responsible-flag",
+		"migration-fortress",
+		"migration-inactive-flag",
+		"not-dead-flag",
+	},
+
 	"user-secrets-drain-worker": {
 		"agent",
 		"api-caller",
@@ -474,6 +487,17 @@ var expectedIAASModelManifoldsWithDependencies = map[string][]string{
 		"not-dead-flag",
 	},
 
+	"secrets-revoker": {
+		"agent",
+		"api-caller",
+		"environ-upgrade-gate",
+		"environ-upgraded-flag",
+		"is-responsible-flag",
+		"migration-fortress",
+		"migration-inactive-flag",
+		"not-dead-flag",
+	},
+
 	"user-secrets-drain-worker": {
 		"agent",
 		"api-caller",

@@ -5,6 +5,8 @@ package secrets_test
 
 import (
 	"fmt"
+	"slices"
+	"strings"
 
 	"github.com/juju/cmd/v3/cmdtesting"
 	jujutesting "github.com/juju/testing"
@@ -81,13 +83,19 @@ ID                    Name       Owner    Rotation  Revision  Last updated
 func (s *ListSuite) TestListYAML(c *gc.C) {
 	defer s.setup(c).Finish()
 
-	uri := coresecrets.NewURI()
-	uri2 := coresecrets.NewURI()
-	uri3 := coresecrets.NewURI()
+	// Sorted list for test output stability.
+	uris := []*coresecrets.URI{
+		coresecrets.NewURI(),
+		coresecrets.NewURI(),
+		coresecrets.NewURI(),
+	}
+	slices.SortFunc(uris, func(a *coresecrets.URI, b *coresecrets.URI) int {
+		return strings.Compare(a.ID, b.ID)
+	})
 	s.secretsAPI.EXPECT().ListSecrets(false, coresecrets.Filter{}).Return(
 		[]apisecrets.SecretDetails{{
 			Metadata: coresecrets.SecretMetadata{
-				URI: uri, RotatePolicy: coresecrets.RotateHourly,
+				URI: uris[0], RotatePolicy: coresecrets.RotateHourly,
 				Version: 1, LatestRevision: 2,
 				Description: "my secret",
 				OwnerTag:    "application-mysql",
@@ -96,12 +104,12 @@ func (s *ListSuite) TestListYAML(c *gc.C) {
 			Value: coresecrets.NewSecretValue(map[string]string{"foo": "YmFy"}),
 		}, {
 			Metadata: coresecrets.SecretMetadata{
-				URI: uri2, Version: 1, LatestRevision: 1, OwnerTag: "application-mariadb",
+				URI: uris[1], Version: 1, LatestRevision: 1, OwnerTag: "application-mariadb",
 			},
 			Error: "boom",
 		}, {
 			Metadata: coresecrets.SecretMetadata{
-				URI: uri3, Version: 1, LatestRevision: 1,
+				URI: uris[2], Version: 1, LatestRevision: 1,
 				Label: "my-secret", OwnerTag: coretesting.ModelTag.String(),
 			},
 		}}, nil)
@@ -110,7 +118,7 @@ func (s *ListSuite) TestListYAML(c *gc.C) {
 	ctx, err := cmdtesting.RunCommand(c, secrets.NewListCommandForTest(s.store, s.secretsAPI), "--format", "yaml")
 	c.Assert(err, jc.ErrorIsNil)
 	out := cmdtesting.Stdout(ctx)
-	c.Assert(out, gc.Equals, fmt.Sprintf(`
+	c.Assert(out, jc.Contains, fmt.Sprintf(`
 %s:
   revision: 2
   rotation: hourly
@@ -119,19 +127,25 @@ func (s *ListSuite) TestListYAML(c *gc.C) {
   label: foobar
   created: 0001-01-01T00:00:00Z
   updated: 0001-01-01T00:00:00Z
+`[1:], uris[0].ID))
+
+	c.Assert(out, jc.Contains, fmt.Sprintf(`
 %s:
   revision: 1
   owner: mariadb
   created: 0001-01-01T00:00:00Z
   updated: 0001-01-01T00:00:00Z
   error: boom
+`[1:], uris[1].ID))
+
+	c.Assert(out, jc.Contains, fmt.Sprintf(`
 %s:
   revision: 1
   owner: <model>
   name: my-secret
   created: 0001-01-01T00:00:00Z
   updated: 0001-01-01T00:00:00Z
-`[1:], uri.ID, uri2.ID, uri3.ID))
+`[1:], uris[2].ID))
 }
 
 func (s *ListSuite) TestListJSON(c *gc.C) {

@@ -11,6 +11,12 @@ import (
 	"github.com/juju/utils/v3"
 )
 
+const (
+	// IssuedTokenValidity is the expected minimum duration for a token issued
+	// from a secret backend.
+	IssuedTokenValidity = 10 * time.Minute
+)
+
 // IsInternalSecretBackendID returns true if the supplied backend ID is the internal backend ID.
 func IsInternalSecretBackendID(backendID string) bool {
 	return utils.IsValidUUIDString(backendID)

@@ -4,9 +4,12 @@
 package secrets
 
 import (
+	"crypto/rand"
+	"encoding/base32"
 	"fmt"
 	"net/url"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 
@@ -47,16 +50,27 @@ type URI struct {
 const (
 	idSnippet   = `[0-9a-z]{20}`
 	uuidSnippet = `[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`
+	revSnippet  = `[0-9]+`
 
 	// SecretScheme is the URL prefix for a secret.
 	SecretScheme = "secret"
 )
 
-var validUUID = regexp.MustCompile(uuidSnippet)
+var (
+	validUUID = regexp.MustCompile(uuidSnippet)
 
-var secretURIParse = regexp.MustCompile(`^` +
-	fmt.Sprintf(`((?P<source>%s)/)?(?P<id>%s)`, uuidSnippet, idSnippet) +
-	`$`)
+	secretURI = regexp.MustCompile(fmt.Sprintf(
+		`^((?P<source>%s)/)?(?P<id>%s)$`, uuidSnippet, idSnippet,
+	))
+	secretURISourceIdx = secretURI.SubexpIndex("source")
+	secretURIIdIdx     = secretURI.SubexpIndex("id")
+
+	secretRevision = regexp.MustCompile(fmt.Sprintf(
+		`^(?P<id>%s)-(?P<rev>%s)$`, idSnippet, revSnippet,
+	))
+	secretRevisionIdIdx  = secretRevision.SubexpIndex("id")
+	secretRevisionRevIdx = secretRevision.SubexpIndex("rev")
+)
 
 // ParseURI parses the specified string into a URI.
 func ParseURI(str string) (*URI, error) {
@@ -77,15 +91,16 @@ func ParseURI(str string) (*URI, error) {
 	if idStr == "" {
 		idStr = u.Opaque
 	}
-	valid := secretURIParse.MatchString(idStr)
-	if !valid {
+
+	matched := secretURI.FindStringSubmatch(idStr)
+	if len(matched) <= max(secretURIIdIdx, secretURISourceIdx) {
 		return nil, errors.NotValidf("secret URI %q", str)
 	}
-	sourceUUID := secretURIParse.ReplaceAllString(idStr, "$source")
+	sourceUUID := matched[secretURISourceIdx]
 	if sourceUUID == "" {
 		sourceUUID = u.Host
 	}
-	idPart := secretURIParse.ReplaceAllString(idStr, "$id")
+	idPart := matched[secretURIIdIdx]
 	id, err := xid.FromString(idPart)
 	if err != nil {
 		return nil, errors.NotValidf("secret URI %q", str)
@@ -97,10 +112,17 @@ func ParseURI(str string) (*URI, error) {
 	return result, nil
 }
 
+var xidEncoding = base32.NewEncoding(
+	"0123456789abcdefghijklmnopqrstuv",
+).WithPadding(base32.NoPadding)
+
 // NewURI returns a new secret URI.
 func NewURI() *URI {
+	var r [12]byte
+	_, _ = rand.Read(r[:])
+	id := xidEncoding.EncodeToString(r[:])
 	return &URI{
-		ID: xid.New().String(),
+		ID: id,
 	}
 }
 
@@ -116,9 +138,30 @@ func (u *URI) IsLocal(sourceUUID string) bool {
 	return u.SourceUUID == "" || u.SourceUUID == sourceUUID
 }
 
-// Name generates the secret name.
+// Name generates the secret revision name.
 func (u URI) Name(revision int) string {
-	return fmt.Sprintf("%s-%d", u.ID, revision)
+	return RevisionName(u.ID, revision)
+}
+
+// RevisionName generates the secret revision name.
+func RevisionName(secretID string, revision int) string {
+	return fmt.Sprintf("%s-%d", secretID, revision)
+}
+
+// ParseRevisionName parses the provided revision name, returning the secret ID
+// and the revision number, or an error.
+func ParseRevisionName(revisionName string) (string, int, error) {
+	matched := secretRevision.FindStringSubmatch(revisionName)
+	if len(matched) <= max(secretRevisionIdIdx, secretRevisionRevIdx) {
+		return "", 0, errors.NotValidf("secret revision %q", revisionName)
+	}
+	id := matched[secretRevisionIdIdx]
+	rev, err := strconv.Atoi(matched[secretRevisionRevIdx])
+	if err != nil {
+		return "", 0, errors.NotValidf("secret revision %q: %v",
+			revisionName, err)
+	}
+	return id, rev, nil
 }
 
 // String prints the URI as a string.

@@ -13,6 +13,32 @@ myst:
 ```{note}
 Juju 2.9 series is LTS
 ```
+### 🔸 **Juju 2.9.56**
+🗓️ 18 Mar 2025
+
+This is a security release for Juju 2.9, which includes fixes for several CVEs,
+including Mongo Bleed and other vulnerabilities.
+
+**Important**: upgrading to this release will not update the MongoDB version used
+by existing controllers.<br>To benefit from the Mongo Bleed fixes, you will need to
+bootstrap a new controller with this release and migrate your models to it.
+
+🛠️ Fixes:
+
+#### Mongo Bleed
+- fix: [CVE-2025-14847](https://github.com/juju/juju/security/advisories/GHSA-29v7-rr38-wf32)
+- fix: mongodb accepts unauthenticated connection https://github.com/juju/juju/security/advisories/GHSA-9j5v-49f8-cpp8
+
+#### Other CVEs
+- fix: [CVE-2025-68152](https://github.com/juju/juju/security/advisories/GHSA-j6f6-jp3p-53mw)
+- fix: [CVE-2025-68153](https://github.com/juju/juju/security/advisories/GHSA-245v-p8fj-vwm2)
+
+#### Other fixes
+- fix: upgrade broken on k8s @wallyworld in https://github.com/juju/juju/issues/21979
+- fix: allow noble charms to be deployed with `--force` by @wallyworld in https://github.com/juju/juju/issues/21562
+
+See the full list on the [Github release](https://github.com/juju/juju/releases/tag/v2.9.56).
+
 ### 🔸 **Juju 2.9.53**
 🗓️ 11 Dec 2025
 

@@ -14,6 +14,94 @@ myst:
 Juju 3.6 series is LTS
 ```
 
+## 🔸 **Juju 3.6.19**
+🗓️ 19 Mar 2025
+
+This is a security and critical bug fix release for Juju 3.6.
+Included are fixes for several CVEs, including Mongo Bleed and other vulnerabilities.
+In addition, there's 2 critical bug fixes worth highlighting:
+1. a fix to handle concurrent secret updates correctly
+2. a fix to ensure MongoDB consistency in HA controllers
+
+We recommend that all users running Juju 3.6 upgrade to this release as soon
+as possible to benefit from the security fixes and critical bug fixes.
+
+**Important**: upgrading to this release will not update the MongoDB version used
+by existing controllers.<br>To benefit from the Mongo Bleed fixes, you will need to
+bootstrap a new controller with this release and migrate your models to it.
+
+⚙️ **Features:**
+
+### Better management of Juju controller API port ingress
+
+Previously, the bootstrap process created a hardcoded global firewall rule
+to open the controller API port `17070` to `0.0.0.0/0`.
+
+Juju now removes this hard coded rule and instead models the API port as an
+asset of the controller charm, which is opened by the controller charm itself.
+The result is that the user can now use the normal expose mechanism to limit
+access to the API port, for example by specifying CIDR restrictions.
+
+eg `juju expose -m controller controller --to-cidrs 10.0.0.0/24`
+
+* feat: limit api port access for the controller using juju expose @adglkh in https://github.com/juju/juju/pull/20682
+
+### Support for Ubuntu 26.04 workloads
+
+Ubuntu 26.04 workloads are now supported for charms with a compatible base.
+This means that when deploying a charm with `--base=ubuntu@26.04` will now succeed.
+
+* chore: add support for ubuntu 26.04 @wallyworld in https://github.com/juju/juju/pull/21875
+
+🛠️ **Fixes**:
+
+### Mongo Bleed
+- fix: [CVE-2025-14847](https://github.com/juju/juju/security/advisories/GHSA-29v7-rr38-wf32)
+- fix: mongodb accepts unauthenticated connection https://github.com/juju/juju/security/advisories/GHSA-9j5v-49f8-cpp8
+
+### Other CVEs
+- fix: [CVE-2026-32691](https://github.com/juju/juju/security/advisories/GHSA-gfgr-6hrj-85ww)
+- fix: [CVE-2026-32692](https://github.com/juju/juju/security/advisories/GHSA-89x7-5m5m-mcmm)
+- fix: [CVE-2026-32694](https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p)
+- fix: [CVE-2026-32693](https://github.com/juju/juju/security/advisories/GHSA-439w-v2p7-pggc)
+
+### Handle concurrent secret updates correctly
+When a secret owner adds a new revision to a secret at precisely the same moment as a secret consumer
+is refreshing their secret content, it was possible that the latest secret revision could be considered
+as obsolete and deleted.
+
+- fix: handle concurrent updates when marking obsolete secret revisions @wallyworld in https://github.com/juju/juju/pull/21779
+
+### MongoDB consistency in HA controllers
+When a Juju controller opens a mongodb connection, it was querying the db version to determine
+whether the database supports server side transactions. An error doing this check was ignored
+with a fallback to using client side transactions. This could lead to a mismatch in transaction
+handling between controllers, and potentially bugs like [intermittent disconnects](https://github.com/juju/juju/issues/21664).
+
+Juju now always uses server side transactions so the entire pre-flight check is removed.
+
+- chore: update juju/txn dep for sstxn checking @wallyworld in https://github.com/juju/juju/pull/21939
+- fix: error in critical version preflight check ignored @hpidcock in https://github.com/juju/txn/pull/70
+- fix: do not feed state watcher from txn stash @wallyworld in https://github.com/juju/juju/pull/21885
+
+### Handling deleted users showing offers
+When displaying application offers with `show-offer`, if there were users who had previously
+been granted access to the offer but have since been deleted, the result would include an incomplete
+list of users.
+
+- fix(cmr): handle deleted users in show-offer @iyiguncevik in https://github.com/juju/juju/pull/21763
+
+### Other fixes
+- fix: upgrade broken on k8s @wallyworld in https://github.com/juju/juju/issues/21979
+- fix(ssh): disable PTY allocation when remote command is provided @kooltuoehias in https://github.com/juju/juju/pull/21716
+- fix: deduplicate DNS in container fallback path @goldberl in https://github.com/juju/juju/pull/21738
+- fix: retry caas provisioning if charm not ready @wallyworld in https://github.com/juju/juju/pull/21759
+- feat: always log offending ops on transaction errors @manadart in https://github.com/juju/juju/pull/21782
+- fix(k8s): delete orphaned StatefulSets before recreating to avoid PVC mismatch @marceloneppel in https://github.com/juju/juju/pull/21786
+- fix: retry writing agent config during migration @SimonRichardson in https://github.com/juju/juju/pull/21821
+
+See the full list on the [Github release](https://github.com/juju/juju/releases/tag/v3.6.18).
+
 ## 🔸 **Juju 3.6.14**
 
 🗓️ 28 Jan 2026

@@ -9,7 +9,6 @@ import (
 	"os"
 
 	jc "github.com/juju/testing/checkers"
-	"github.com/juju/utils/v3/shell"
 	"github.com/juju/version/v2"
 	gc "gopkg.in/check.v1"
 
@@ -23,6 +22,7 @@ import (
 	"github.com/juju/juju/environs/manual/sshprovisioner"
 	envtesting "github.com/juju/juju/environs/testing"
 	envtools "github.com/juju/juju/environs/tools"
+	"github.com/juju/juju/internal/provider/common"
 	"github.com/juju/juju/juju/testing"
 	"github.com/juju/juju/rpc/params"
 	jujuversion "github.com/juju/juju/version"
@@ -193,6 +193,6 @@ func (s *provisionerSuite) TestProvisioningScript(c *gc.C) {
 	c.Assert(err, jc.ErrorIsNil)
 
 	removeLogFile := "rm -f '/var/log/cloud-init-output.log'\n"
-	expectedScript := removeLogFile + shell.DumpFileOnErrorScript("/var/log/cloud-init-output.log") + provisioningScript
+	expectedScript := removeLogFile + common.DumpOnErrorScript("/var/log/cloud-init-output.log") + provisioningScript
 	c.Assert(script, gc.Equals, expectedScript)
 }

@@ -13,7 +13,6 @@ import (
 
 	"github.com/juju/errors"
 	"github.com/juju/utils/v3"
-	"github.com/juju/utils/v3/shell"
 	"github.com/juju/utils/v3/ssh"
 
 	"github.com/juju/juju/cloudconfig"
@@ -25,6 +24,7 @@ import (
 	"github.com/juju/juju/core/instance"
 	"github.com/juju/juju/core/model"
 	"github.com/juju/juju/environs/manual"
+	"github.com/juju/juju/internal/provider/common"
 	"github.com/juju/juju/rpc/params"
 	"github.com/juju/juju/service"
 )
@@ -334,7 +334,7 @@ func ProvisioningScript(icfg *instancecfg.InstanceConfig) (string, error) {
 	// Always remove the cloud-init-output.log file first, if it exists.
 	fmt.Fprintf(&buf, "rm -f %s\n", utils.ShQuote(icfg.CloudInitOutputLog))
 	// If something goes wrong, dump cloud-init-output.log to stderr.
-	buf.WriteString(shell.DumpFileOnErrorScript(icfg.CloudInitOutputLog))
+	buf.WriteString(common.DumpOnErrorScript(icfg.CloudInitOutputLog))
 	buf.WriteString(configScript)
 	return buf.String(), nil
 }

@@ -0,0 +1,15 @@
+---
+version: 0.1.0
+extraKubeletArgs:
+  --cluster-domain: cluster.local
+  --cluster-dns: 10.152.183.10
+addons:
+  - name: dns
+containerdRegistryConfigs:
+  docker.io: |
+    [host."${DOCKERHUB_MIRROR}"]
+      capabilities = ["pull", "resolve"]
+  10.152.183.69: |
+    [host."https://10.152.183.69:443"]
+      capabilities = ["pull", "resolve", "push"]
+      skip_verify = true

@@ -0,0 +1,12 @@
+---
+version: 0.1.0
+extraKubeletArgs:
+  --cluster-domain: cluster.local
+  --cluster-dns: 10.152.183.10
+addons:
+  - name: dns
+containerdRegistryConfigs:
+  10.152.183.69: |
+    [host."https://10.152.183.69:443"]
+      capabilities = ["pull", "resolve", "push"]
+      skip_verify = true

@@ -0,0 +1,119 @@
+#!/bin/bash
+
+
+sudo DEBIAN_FRONTEND=noninteractive apt install -y squid nginx ||
+(sudo DEBIAN_FRONTEND=noninteractive apt update -y &&
+ sudo DEBIAN_FRONTEND=noninteractive apt install -y squid nginx)
+
+sudo tee /etc/netplan/90-squid.yaml <<'EOF'
+network:
+  version: 2
+  dummy-devices:
+    squid:
+      addresses:
+        - 10.255.255.1/32
+EOF
+sudo chmod 644 /etc/netplan/90-squid.yaml
+sudo netplan apply
+
+sudo tee /etc/squid/squid.conf <<SQUID_EOF
+http_port 10.255.255.1:3128
+acl localhost src 127.0.0.0/8 ::1 10.255.255.1
+acl rfc1918 src 10.0.0.0/8
+acl rfc1918 src 172.16.0.0/12
+acl rfc1918 src 192.168.0.0/16
+acl ipv6_local src fc00::/7
+acl ipv6_local src fe80::/10
+acl SSL_ports port 443
+acl Safe_ports port 80
+acl Safe_ports port 443
+acl CONNECT method CONNECT
+http_access deny !Safe_ports
+http_access deny CONNECT !SSL_ports
+http_access allow localhost
+http_access allow rfc1918
+http_access allow ipv6_local
+http_access deny all
+forward_max_tries 20
+connect_timeout 60 seconds
+read_timeout 120 seconds
+request_timeout 120 seconds
+server_persistent_connections on
+client_persistent_connections on
+dns_retransmit_interval 2 seconds
+dns_timeout 60 seconds
+access_log stdio:/tmp/squid-access.log squid
+cache_log /tmp/squid-cache.log
+cache deny all
+pid_filename /tmp/squid.pid
+SQUID_EOF
+sudo chmod 644 /etc/squid/squid.conf
+
+sudo squid -k parse
+
+sudo systemctl enable squid
+sudo systemctl restart squid
+
+echo "HTTP_PROXY=http://10.255.255.1:3128"  >> "$GITHUB_ENV"
+echo "HTTPS_PROXY=http://10.255.255.1:3128" >> "$GITHUB_ENV"
+echo "http_proxy=http://10.255.255.1:3128"  >> "$GITHUB_ENV"
+echo "https_proxy=http://10.255.255.1:3128" >> "$GITHUB_ENV"
+echo "NO_PROXY=localhost,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1" >> "$GITHUB_ENV"
+echo "no_proxy=localhost,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1" >> "$GITHUB_ENV"
+sudo snap set system proxy.http="http://10.255.255.1:3128"
+sudo snap set system proxy.https="http://10.255.255.1:3128"
+sudo snap set system proxy.no-proxy="localhost,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,::1"
+
+sudo tee /etc/nginx/nginx.conf <<NGINX_EOF
+worker_processes auto;
+events {
+    worker_connections 1024;
+}
+http {
+    proxy_buffering on;
+    proxy_buffer_size 16k;
+    proxy_buffers 8193 64k;
+    proxy_busy_buffers_size 512m;
+    proxy_max_temp_file_size 1024m;
+    proxy_temp_path /var/cache/nginx/proxy_temp;
+    proxy_connect_timeout 10s;
+    proxy_read_timeout 300s;
+    proxy_send_timeout 60s;
+    upstream goproxy {
+        server proxy.golang.org:443;
+        keepalive 120;
+    }
+    server {
+        listen 10.255.255.1:8999;
+        server_name _;
+        error_page 500 502 503 504 =410 /410;
+        location /410 {
+            internal;
+            default_type text/plain;
+            return 410 "Gone";
+        }
+        location / {
+            proxy_pass https://goproxy;
+            proxy_ssl_server_name on;
+            proxy_ssl_name proxy.golang.org;
+            proxy_set_header Host proxy.golang.org;
+            proxy_http_version 1.1;
+            proxy_set_header Connection "";
+            proxy_intercept_errors on;
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
+            proxy_next_upstream_tries 15;
+            proxy_next_upstream_timeout 600s;
+        }
+    }
+}
+NGINX_EOF
+sudo chmod 644 /etc/nginx/nginx.conf
+sudo mkdir -p /var/cache/nginx/proxy_temp
+sudo chown www-data:www-data /var/cache/nginx/proxy_temp
+
+sudo nginx -t
+
+sudo systemctl enable nginx
+sudo systemctl restart nginx
+
+echo "GOPROXY=http://10.255.255.1:8999/cached-only,direct" >> "$GITHUB_ENV"

@@ -6,22 +6,31 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [self-hosted, linux, "${{ matrix.platform.host_arch }}", aws, large]
+    runs-on:
+      - self-hosted
+      - linux
+      - ${{ matrix.platform.host_arch }}
+      - ${{ (github.repository_owner == 'juju' && 'aws') || (github.repository_owner == 'canonical' && 'noble') }}
+      - large
     strategy:
       fail-fast: false
       matrix:
         platform:
           - { os: linux, arch: amd64, host_arch: x64 }
           - { os: linux, arch: arm64, host_arch: arm64 }
-# Until we get rid of musl, lets just disable these to save build time.
-#          - { os: linux, arch: s390x }
-#          - { os: linux, arch: ppc64le }
+          # Until we get rid of musl, lets just disable these to save build time.
+          #          - { os: linux, arch: s390x }
+          #          - { os: linux, arch: ppc64le }
           - { os: darwin, arch: arm64, host_arch: arm64 }
 
     steps:
       - name: "Checkout"
         uses: actions/checkout@v4
 
+      - name: "Squid"
+        if: github.repository_owner != 'juju'
+        run: ./.github/squid.sh
+
       - name: "Set up Go"
         uses: actions/setup-go@v5
         with:

@@ -1,5 +1,5 @@
 name: "CLA check"
-on: [pull_request, workflow_dispatch]
+on: [pull_request, workflow_dispatch, merge_group]
 
 jobs:
   cla-check:

@@ -7,27 +7,55 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
   workflow_dispatch:
+  merge_group:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   changed-files:
     name: "Collate changed files"
     runs-on: ubuntu-latest
     outputs:
       check-build: ${{ steps.filter-files.outputs.check-build }}
+      check-unit-tests: ${{ steps.filter-files.outputs.check-unit-tests }}
       check-migrate: ${{ steps.filter-files.outputs.check-migrate }}
       check-upgrade: ${{ steps.filter-files.outputs.check-upgrade }}
       check-terraform: ${{ steps.filter-files.outputs.check-terraform }}
       check-snap: ${{ steps.filter-files.outputs.check-snap }}
       check-generate: ${{ steps.filter-files.outputs.check-generate }}
       check-docs: ${{ steps.filter-files.outputs.check-docs }}
+      ref: ${{ steps.refs.outputs.head_ref }}
+      base: ${{ steps.refs.outputs.base_ref }}
     steps:
+      - name: Checkout
+        if: github.event_name != 'pull_request'
+        uses: actions/checkout@v4
+
+      - name: Calculate Refs
+        id: refs
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "head_ref=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_OUTPUT"
+            echo "base_ref=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_OUTPUT"
+          elif [ "${{ github.event_name }}" = "push" ]; then
+            echo "head_ref=${{ github.event.push.after }}" >> "$GITHUB_OUTPUT"
+            echo "base_ref=${{ github.event.push.before }}" >> "$GITHUB_OUTPUT"
+          elif [ "${{ github.event_name }}" = "merge_group" ]; then
+            echo "head_ref=${{ github.event.merge_group.head_sha }}" >> "$GITHUB_OUTPUT"
+            echo "base_ref=${{ github.event.merge_group.base_sha }}" >> "$GITHUB_OUTPUT"
+          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "head_ref=${{ github.event.ref }}" >> "$GITHUB_OUTPUT"
+            echo "base_ref=$(git log --max-parents=0 --first-parent --format=%H)" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Filter Files
         id: filter-files
         uses: dorny/paths-filter@v3
         with:
+          ref: ${{ steps.refs.outputs.head_ref }}
+          base: ${{ steps.refs.outputs.base_ref }}
           filters: |
             check-build:
               - '**.go'
@@ -36,6 +64,13 @@ jobs:
               - 'scripts/dqlite/**'
               - 'Makefile'
               - 'make_functions.sh'
+            check-unit-tests:
+              - '**.go'
+              - 'go.mod'
+              - '.github/workflows/build.yml'
+              - 'scripts/dqlite/**'
+              - 'Makefile'
+              - 'make_functions.sh'
             check-migrate:
               - '**.go'
               - 'go.mod'
@@ -80,60 +115,68 @@ jobs:
     if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-build == 'true'
     uses: ./.github/workflows/build.yml
 
+  unit-tests:
+    needs: [changed-files]
+    name: Unit Tests
+    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-unit-tests == 'true'
+    uses: ./.github/workflows/unit-tests.yml
+    with:
+      base: ${{ needs.changed-files.outputs.base }}
+
   snap:
     needs: [changed-files]
     name: Snap
-    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-snap == 'true'
+    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-snap == 'true' && github.event_name != 'merge_group'
     uses: ./.github/workflows/snap.yml
 
   generate:
     needs: [changed-files]
     name: Generate
-    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-generate == 'true'
+    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-generate == 'true' && github.event_name != 'merge_group'
     uses: ./.github/workflows/gen.yml
 
   docs:
     needs: [changed-files]
     name: Documentation
-    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-docs == 'true'
+    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-docs == 'true' && github.event_name != 'merge_group'
     uses: ./.github/workflows/docs.yml
 
   terraform:
     needs: [changed-files]
     name: Terraform Smoke
     # TODO - always skip terraform tests until they are made reliable on 3.x branches.
-    if: false && github.event.pull_request.draft == false && github.base_ref != 'main' && needs.changed-files.outputs.check-terraform == 'true'
+    if: false && github.event.pull_request.draft == false && github.base_ref != 'main' && needs.changed-files.outputs.check-terraform == 'true' && github.event_name != 'merge_group'
     uses: ./.github/workflows/terraform-smoke.yml
 
   migrate:
     needs: [changed-files]
     name: Migrate
-    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-migrate == 'true'
+    if: github.event.pull_request.draft == false && needs.changed-files.outputs.check-migrate == 'true' && github.event_name != 'merge_group'
     uses: ./.github/workflows/migrate.yml
 
   upgrade:
     needs: [changed-files]
     name: Upgrade
-    if: github.event.pull_request.draft == false && github.base_ref != 'main' && needs.changed-files.outputs.check-upgrade == 'true'
+    if: github.event.pull_request.draft == false && github.base_ref != 'main' && needs.changed-files.outputs.check-upgrade == 'true' && github.event_name != 'merge_group'
     uses: ./.github/workflows/upgrade.yml
 
   result-check:
-    needs: [build,snap,generate,docs,terraform,migrate,upgrade]
+    needs: [build, snap, generate, docs, terraform, migrate, upgrade]
     runs-on: ubuntu-latest
     name: Check Tests Passed
     if: always() && !cancelled()
     steps:
-        - name: Check Results
-          shell: bash
-          run: |
-            # TODO - add terraform once ready.
-            if ${{ needs.build.result == 'success' || needs.build.result == 'skipped' }} \
-                && ${{ needs.snap.result == 'success' || needs.snap.result == 'skipped' }} \
-                && ${{ needs.generate.result == 'success' || needs.generate.result == 'skipped' }} \
-                && ${{ needs.docs.result == 'success' || needs.docs.result == 'skipped' }} \
-                && ${{ needs.terraform.result != 'fix me' || needs.terraform.result == 'skipped' }} \
-                && ${{ needs.migrate.result == 'success' || needs.migrate.result == 'skipped' }} \
-                && ${{ needs.upgrade.result == 'success' || needs.upgrade.result == 'skipped' }}; then
-              exit 0
-            fi
-            exit 1
+      - name: Check Results
+        shell: bash
+        run: |
+          # TODO - add terraform once ready.
+          if ${{ needs.build.result == 'success' || needs.build.result == 'skipped' }} \
+              && ${{ needs.snap.result == 'success' || needs.snap.result == 'skipped' }} \
+              && ${{ needs.generate.result == 'success' || needs.generate.result == 'skipped' }} \
+              && ${{ needs.docs.result == 'success' || needs.docs.result == 'skipped' }} \
+              && ${{ needs.terraform.result != 'fix me' || needs.terraform.result == 'skipped' }} \
+              && ${{ needs.migrate.result == 'success' || needs.migrate.result == 'skipped' }} \
+              && ${{ needs.upgrade.result == 'success' || needs.upgrade.result == 'skipped' }}; then
+            exit 0
+          fi
+          exit 1

@@ -15,19 +15,27 @@ on:
     - cron: "0 2 * * 1,5" # Runs at 02:00 AM on every Monday and Friday.
   workflow_dispatch:
 
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   build:
     name: build
-    runs-on: [linux, self-hosted, x64, large, jammy]
+    runs-on:
+      - linux
+      - self-hosted
+      - x64
+      - large
+      - ${{ (github.repository_owner == 'juju' && 'aws') || (github.repository_owner == 'canonical' && 'noble') }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: "Squid"
+        if: github.repository_owner != 'juju'
+        run: ./.github/squid.sh
+
       - name: Install dependencies
         run: |
           set -ex

@@ -7,21 +7,30 @@ on:
 jobs:
   docs:
     name: Check Autogenerated Documentation
-    runs-on: [linux, self-hosted, x64, large]
+    runs-on:
+      - linux
+      - self-hosted
+      - x64
+      - large
+      - ${{ (github.repository_owner == 'juju' && 'aws') || (github.repository_owner == 'canonical' && 'noble') }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: "Squid"
+        if: github.repository_owner != 'juju'
+        run: ./.github/squid.sh
+
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: 'go.mod'
+          go-version-file: "go.mod"
           cache: true
 
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: '3.10'
+          python-version: "3.10"
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -69,4 +78,4 @@ jobs:
             echo ""
             echo "*****"
             exit 1
-          fi
\ No newline at end of file
+          fi

@@ -6,12 +6,21 @@ on:
 jobs:
   generate:
     name: Check Generated Mocks
-    runs-on: [self-hosted, linux, arm64, aws, xxlarge]
+    runs-on:
+      - self-hosted
+      - linux
+      - arm64
+      - ${{ (github.repository_owner == 'juju' && 'aws') || (github.repository_owner == 'canonical' && 'noble') }}
+      - ${{ (github.repository_owner == 'juju' && 'xxlarge') || (github.repository_owner == 'canonical' && 'xlarge') }}
 
     steps:
       - name: "Checkout"
         uses: actions/checkout@v4
 
+      - name: "Squid"
+        if: github.repository_owner != 'juju'
+        run: ./.github/squid.sh
+
       - name: "Set up Go"
         uses: actions/setup-go@v5
         with:

@@ -12,13 +12,22 @@ permissions:
 jobs:
   smoke:
     name: JAAS Smoke Test
-    runs-on: [self-hosted, linux, x64, aws, large]
+    runs-on:
+      - self-hosted
+      - linux
+      - x64
+      - ${{ (github.repository_owner == 'juju' && 'aws') || (github.repository_owner == 'canonical' && 'noble') }}
+      - large
 
     steps:
       - uses: actions/checkout@v4
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@v1
 
+      - name: "Squid"
+        if: github.repository_owner != 'juju'
+        run: ./.github/squid.sh
+
       - name: Install Dependencies
         shell: bash
         run: |
@@ -32,7 +41,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: 'go.mod'
+          go-version-file: "go.mod"
           cache: true
 
       - name: Setup env
@@ -45,7 +54,7 @@ jobs:
         shell: bash
         run: |
           make go-install
-          
+
       - name: Start JIMM, bootstrap a Juju controller and add it to JIMM.
         uses: canonical/jimm/.github/actions/test-server@v3
         id: jaas
@@ -54,7 +63,7 @@ jobs:
           ghcr-pat: ${{ secrets.GITHUB_TOKEN }}
           dump-logs: true
           use-charmed-k8s-action: "false"
-      
+
       - name: Create a model, deploy an application and run juju status
         run: |
           juju add-model foo && \

@@ -1,98 +0,0 @@
-name: Merge
-on:
-  push:
-    branches: ['2.9', '3.1', '3.3', '3.4', '3.5', '3.6']
-
-jobs:
-  check-merge:
-    name: Check for conflicts
-    runs-on: ubuntu-latest
-    env:
-      MERGE_TARGETS: |
-        2.9: 3.1
-        3.1: 3.3
-        3.3: 3.4
-        3.4: 3.5
-        3.5: 3.6
-        3.6: main
-
-    steps:
-      - name: Determine source/target branches
-        id: branch
-        run: |
-          set -x
-          SOURCE_BRANCH=${{ github.ref_name }}
-          echo "source=$SOURCE_BRANCH" >> "$GITHUB_OUTPUT"
-          TARGET_BRANCH=$(echo "$MERGE_TARGETS" | yq ".\"$SOURCE_BRANCH\"")
-          echo "target=$TARGET_BRANCH" >> "$GITHUB_OUTPUT"
-
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ steps.branch.outputs.source }}
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: 'go.mod'
-          cache: false
-
-        # We need to do this before trying to merge, because if the merge
-        # creates conflicts in go.mod, we won't be able to use the go command.
-      - name: Pre-compile try-merge script
-        run: |
-          go install ./scripts/try-merge
-
-      - name: Attempt to merge
-        id: merge
-        env:
-          SOURCE_BRANCH: ${{ steps.branch.outputs.source }}
-          TARGET_BRANCH: ${{ steps.branch.outputs.target }}
-        run: |
-          set -x
-          git fetch origin "$TARGET_BRANCH"
-          git branch "$TARGET_BRANCH" "origin/$TARGET_BRANCH"
-          # Need to set Git username/email to do the merge (yawn)
-          git config user.name 'jujubot'
-          git config user.email 'fake@address.me'
-
-          set +e
-          git switch "$TARGET_BRANCH"
-          git merge "$SOURCE_BRANCH"
-          case $? in
-          0)
-            echo "conflicts=false" >> "$GITHUB_OUTPUT"
-            ;;
-          1)
-            echo "conflicts=true" >> "$GITHUB_OUTPUT"
-            ;;
-          *)
-            exit $?
-            ;;
-          esac
-
-      - name: Generate notification message
-        if: steps.merge.outputs.conflicts == 'true'
-        id: message
-        env:
-          SOURCE_BRANCH: ${{ steps.branch.outputs.source }}
-          TARGET_BRANCH: ${{ steps.branch.outputs.target }}
-          EMAIL_TO_MM_USER: ${{ secrets.EMAIL_TO_MM_USER }}
-          IGNORE_EMAILS: ${{ secrets.MERGE_NOTIFY_IGNORE_EMAILS }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          MESSAGE=$(try-merge errmsg)
-          echo "message=$MESSAGE" >> "$GITHUB_OUTPUT"
-
-      - name: Notify if merge has conflicts
-        if: steps.merge.outputs.conflicts == 'true' && steps.message.outputs.message != ''
-        env:
-          MM_TOKEN: ${{ secrets.MM_TOKEN }}
-          MESSAGE: ${{ steps.message.outputs.message }}
-        run: |
-          # install mmctl
-          curl https://github.com/mattermost/mmctl/releases/download/v7.8.5/linux_amd64.tar -Lo mmctl.tar
-          tar -xvf mmctl.tar
-          ./mmctl auth login 'https://chat.charmhub.io' --name Charmhub --access-token $MM_TOKEN
-          ./mmctl post create Charmhub:juju-bot --message "$MESSAGE"