diff --git a/assets/agw-docs/pages/security/jwt-setup.md b/assets/agw-docs/pages/security/jwt-setup.md
index 4a190a1d9..e13e734c5 100644
--- a/assets/agw-docs/pages/security/jwt-setup.md
+++ b/assets/agw-docs/pages/security/jwt-setup.md
@@ -56,7 +56,7 @@ Configure an {{< reuse "agw-docs/snippets/policy.md" >}} to validate JWTs using
| `issuer` | The issuer URL that must match the `iss` claim in JWT tokens exactly. Agentgateway rejects tokens from other issuers.{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x" >}} Agentgateway also rejects a token that has no `iss` claim.{{< /version >}}
Example value: `http://keycloak:8080/realms/master` |
| `audiences` | List of allowed audience values. The JWT's `aud` claim must contain at least one of these values. Omit the field to accept any audience.{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x" >}} An empty list also accepts any audience, and a non-empty list rejects a token that has no `aud` claim.{{< /version >}}
Example value: `["my-application"]` |{{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x" >}}
| `preserveToken` | Keeps a validated JWT in the location that it was read from. By default, the gateway removes the token after validation, so the backend does not receive the client's credential. Set this field when another policy on the same route reads the token from the request, such as an OAuth token exchange{{< version include-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x" >}} ([OAuth token exchange]({{< link-hextra path="/documentation/security/backend-authn/oauth-token-exchange/" >}})){{< /version >}}{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x" >}} ([Standard token exchange]({{< link-hextra path="/documentation/security/backend-authn/token-exchange/standard/" >}})){{< /version >}} that takes it as the subject token. When only the backend needs the token, prefer the `passthrough` [backend authentication]({{< link-hextra path="/documentation/security/backend-authn/" >}}) method instead, which does not expose the credential to every policy that runs later.
Example value: `true` |{{< /version >}}
- | `jwks.remote.jwksPath` | The path to the JWKS endpoint on the identity provider, relative to the backend root. This endpoint returns the public keys used to verify JWT signatures. {{< reuse "agw-docs/snippets/jwks-path.md" >}}
Example value: `/realms/master/protocol/openid-connect/certs` |
+ | `jwks.remote.jwksPath` | The path to the JWKS endpoint on the identity provider, relative to the backend root. This endpoint returns the public keys used to verify JWT signatures. {{< reuse "agw-docs/snippets/jwks-path.md" >}}{{< version exclude-if="1.0.x,1.1.x,1.2.x,1.3.x,1.4.x,1.5.x,1.6.x,2.2.x" >}} When the controller runs with `GODEBUG=fips140=only`, the controller accepts JWKS documents that include `x5c` certificate chains and `x5t` SHA-1 thumbprints.{{< /version >}}
Example value: `/realms/master/protocol/openid-connect/certs` |
| `jwks.remote.cacheDuration` | How long to cache the JWKS keys locally. This setting reduces load on the identity provider and improves performance. Keys are automatically refreshed when the cache expires.
Example value: `5m` (5 minutes) |
| `jwks.remote.backendRef` | Reference to the backend that hosts the identity provider. Agentgateway uses this value to fetch the JWKS keys from the identity provider. For an in-cluster provider, reference a Kubernetes Service. For an external provider that is reached over TLS, reference an {{< reuse "/agw-docs/snippets/backend.md" >}} instead. See [External identity provider over TLS](#external-identity-provider-over-tls).{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x,2026.7.1,2.3.x,2.2.x,2.1.x" >}} Mutually exclusive with `url`. Set exactly one of the two.{{< /version >}}
Example value: The details of the Keycloak service |{{< version exclude-if="1.4.x,1.3.x,1.2.x,1.1.x,1.0.x,2026.7.1,2.3.x,2.2.x,2.1.x" >}}
| `jwks.remote.url` | The full address of the JWKS endpoint, including the path. Use this field instead of `backendRef` and `jwksPath` to point at the identity provider directly, without creating an intermediate Kubernetes object. When the scheme is `https`, backend TLS is enabled automatically, so you do not need a separate `BackendTLSPolicy`. Mutually exclusive with `backendRef`. Do not set `jwksPath` when you use `url`.
Example value: `https://my-org.okta.com/oauth2/default/v1/keys` |{{< /version >}}
diff --git a/content/docs/kubernetes/main/release-notes/release-notes.md b/content/docs/kubernetes/main/release-notes/release-notes.md
index 9e5547e0c..cde8b19d0 100644
--- a/content/docs/kubernetes/main/release-notes/release-notes.md
+++ b/content/docs/kubernetes/main/release-notes/release-notes.md
@@ -37,6 +37,7 @@ Review the release notes for agentgateway on Kubernetes.
+
**Traffic management**
@@ -59,6 +60,7 @@ Review the release notes for agentgateway on Kubernetes.
**Security**
- Invalid `oauthTokenExchange` or `crossAppAccess` backend authentication no longer blocks the rest of your configuration from reaching the proxy. Only requests that use the invalid block fail, with HTTP `500` and the message `oauthTokenExchange configuration is invalid` or `crossAppAccess configuration is invalid`. The policy reports `Accepted: True` with the reason `PartiallyValid`. For more information, see [Debug your setup]({{< link-hextra path="/documentation/operations/debug/" >}}).
+- JWT policies can use JWKS documents that include `x5c` certificate chains and `x5t` SHA-1 thumbprints when the controller runs with `GODEBUG=fips140=only`.
**Operations**