diff --git a/plugins/grpc-ecosystem/gateway/v2.27.7/.dockerignore b/plugins/grpc-ecosystem/gateway/v2.27.7/.dockerignore
new file mode 100644
index 000000000..12458999e
--- /dev/null
+++ b/plugins/grpc-ecosystem/gateway/v2.27.7/.dockerignore
@@ -0,0 +1,3 @@
+*
+!Dockerfile
+!separate_pkg_additional_imports.patch
diff --git a/plugins/grpc-ecosystem/gateway/v2.27.7/Dockerfile b/plugins/grpc-ecosystem/gateway/v2.27.7/Dockerfile
new file mode 100644
index 000000000..5495d0d8e
--- /dev/null
+++ b/plugins/grpc-ecosystem/gateway/v2.27.7/Dockerfile
@@ -0,0 +1,21 @@
+# syntax=docker/dockerfile:1.19
+FROM --platform=$BUILDPLATFORM golang:1.25.6-bookworm AS build
+
+ARG TARGETOS TARGETARCH
+ENV CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH
+
+WORKDIR /tmp
+RUN git clone --depth 1 --branch v2.27.7 https://github.com/grpc-ecosystem/grpc-gateway.git
+COPY --link separate_pkg_additional_imports.patch /tmp/separate_pkg_additional_imports.patch
+WORKDIR /tmp/grpc-gateway
+RUN git apply /tmp/separate_pkg_additional_imports.patch
+WORKDIR /tmp/grpc-gateway/protoc-gen-grpc-gateway
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go install -ldflags="-s -w" -trimpath \
+    && mv /go/bin/${GOOS}_${GOARCH}/protoc-gen-grpc-gateway /go/bin/protoc-gen-grpc-gateway || true
+
+FROM scratch
+COPY --from=build --link --chown=root:root /etc/passwd /etc/passwd
+COPY --from=build --link --chown=root:root /go/bin/protoc-gen-grpc-gateway /
+USER nobody
+ENTRYPOINT [ "/protoc-gen-grpc-gateway" ]
diff --git a/plugins/grpc-ecosystem/gateway/v2.27.7/buf.plugin.yaml b/plugins/grpc-ecosystem/gateway/v2.27.7/buf.plugin.yaml
new file mode 100644
index 000000000..a062620b9
--- /dev/null
+++ b/plugins/grpc-ecosystem/gateway/v2.27.7/buf.plugin.yaml
@@ -0,0 +1,23 @@
+version: v1
+name: buf.build/grpc-ecosystem/gateway
+plugin_version: v2.27.7
+source_url: https://github.com/grpc-ecosystem/grpc-gateway
+integration_guide_url: https://github.com/grpc-ecosystem/grpc-gateway#usage
+description: gRPC to JSON proxy generator following the gRPC HTTP spec.
+output_languages:
+  - go
+registry:
+  go:
+    min_version: "1.24"
+    deps:
+      - module: github.com/grpc-ecosystem/grpc-gateway/v2
+        version: v2.27.7
+  opts:
+    - paths=source_relative
+    - standalone=true
+    - separate_package=true
+deps:
+  - plugin: buf.build/protocolbuffers/go:v1.36.11
+  - plugin: buf.build/grpc/go:v1.6.0
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/grpc-ecosystem/grpc-gateway/blob/v2.27.7/LICENSE
diff --git a/plugins/grpc-ecosystem/gateway/v2.27.7/separate_pkg_additional_imports.patch b/plugins/grpc-ecosystem/gateway/v2.27.7/separate_pkg_additional_imports.patch
new file mode 100644
index 000000000..39c469b3c
--- /dev/null
+++ b/plugins/grpc-ecosystem/gateway/v2.27.7/separate_pkg_additional_imports.patch
@@ -0,0 +1,766 @@
+diff --git a/internal/descriptor/buf_build.go b/internal/descriptor/buf_build.go
+new file mode 100644
+index 00000000..1c6725fc
+--- /dev/null
++++ b/internal/descriptor/buf_build.go
+@@ -0,0 +1,58 @@
++package descriptor
++
++import (
++	"path/filepath"
++	"strings"
++)
++
++const (
++	BaseTypePackageSubPath = "protocolbuffers/go"
++	grpcPackageSubPath     = "grpc/go"
++	// TODO: change "v2" to "v3" when v3 of grpc gateway is released,
++	// or, even better, stop generating at the extra location.
++	GatewayPackageSubPath = "grpc-ecosystem/gateway/v2"
++)
++
++// SetSeparatePackage sets separatePackage
++func (r *Registry) SetSeparatePackage(use bool) {
++	r.separatePackage = use
++}
++
++// IncludeAdditionalImports adds additionalImports to the registry on a per-package basis
++func (r *Registry) IncludeAdditionalImports(svc *Service, goPkg GoPackage) {
++	if !r.separatePackage {
++		return
++	}
++	if r.additionalImports == nil {
++		r.additionalImports = make(map[string][]string)
++	}
++	// when generating a separate package for the gateway, we need to generate an import statement
++	// for the gRPC stubs that are no longer in the same package. This is done by adding the grpc
++	// package to the additionalImports list. In order to prepare a valid import statement, we'll replace
++	// the source package name, something like: ../pet/v1/v1petgateway with ../pet/v1/v1petgrpc
++
++	packageName := strings.TrimSuffix(goPkg.Name, "gateway") + "grpc"
++	svc.GRPCFile = &File{
++		GoPkg: GoPackage{
++			// additionally, as the `go_package` option is passed through from the generator, and can only be
++			// set the one time, without making major changes, we'll use the package name sent through the
++			// options as a basis, and replace the source package name with the grpc package name.
++			Path: strings.Replace(
++				filepath.Join(goPkg.Path, packageName),
++				BaseTypePackageSubPath,
++				grpcPackageSubPath,
++				1,
++			),
++			Name: strings.Replace(packageName, BaseTypePackageSubPath, grpcPackageSubPath, 1),
++		},
++	}
++	r.additionalImports[goPkg.Path] = append(r.additionalImports[goPkg.Path], svc.GRPCFile.GoPkg.Path)
++}
++
++// GetAdditionalImports returns additionalImports
++func (r *Registry) GetAdditionalImports(goPkg GoPackage) []string {
++	if !r.separatePackage || r.additionalImports == nil {
++		return nil
++	}
++	return r.additionalImports[goPkg.Path]
++}
+diff --git a/internal/descriptor/registry.go b/internal/descriptor/registry.go
+index 743cea8f..b80f1663 100644
+--- a/internal/descriptor/registry.go
++++ b/internal/descriptor/registry.go
+@@ -160,6 +160,13 @@ type Registry struct {
+ 	// allowPatchFeature determines whether to use PATCH feature involving update masks (using google.protobuf.FieldMask).
+ 	allowPatchFeature bool
+ 
++	// separatePackage determines whether to output the generated code into a separate package.
++	separatePackage bool
++
++	// additionalImports is a list of additional imports to be added to the generated code.
++	// N.B. additional imports is not a flag option
++	additionalImports map[string][]string
++
+ 	// preserveRPCOrder, if true, will ensure the order of paths emitted in openapi swagger files mirror
+ 	// the order of RPC methods found in proto files. If false, emitted paths will be ordered alphabetically.
+ 	preserveRPCOrder bool
+@@ -273,6 +280,9 @@ func (r *Registry) loadFile(filePath string, file *protogen.File) {
+ 		pkg.Alias = "ext" + cases.Title(language.AmericanEnglish).String(pkg.Name)
+ 	}
+ 
++	if r.separatePackage {
++		pkg.Name += "gateway"
++	}
+ 	if err := r.ReserveGoPackageAlias(pkg.Name, pkg.Path); err != nil {
+ 		for i := 0; ; i++ {
+ 			alias := fmt.Sprintf("%s_%d", pkg.Name, i)
+diff --git a/internal/descriptor/services.go b/internal/descriptor/services.go
+index ad1764ce..ae58f7e3 100644
+--- a/internal/descriptor/services.go
++++ b/internal/descriptor/services.go
+@@ -29,6 +29,7 @@ func (r *Registry) loadServices(file *File) error {
+ 			ServiceDescriptorProto: sd,
+ 			ForcePrefixedName:      r.standalone,
+ 		}
++		r.IncludeAdditionalImports(svc, file.GoPkg)
+ 		for _, md := range sd.GetMethod() {
+ 			if grpclog.V(2) {
+ 				grpclog.Infof("Processing %s.%s", sd.GetName(), md.GetName())
+diff --git a/internal/descriptor/types.go b/internal/descriptor/types.go
+index 5a43472b..c0c02966 100644
+--- a/internal/descriptor/types.go
++++ b/internal/descriptor/types.go
+@@ -164,6 +164,9 @@ type Service struct {
+ 	*descriptorpb.ServiceDescriptorProto
+ 	// File is the file where this service is defined.
+ 	File *File
++	// GRPCFile is the file where this service's gRPC stubs are defined.
++	// This is nil if the service's gRPC stubs are defined alongside the messages.
++	GRPCFile *File
+ 	// Methods is the list of methods defined in this service.
+ 	Methods []*Method
+ 	// ForcePrefixedName when set to true, prefixes a type with a package prefix.
+@@ -173,7 +176,9 @@ type Service struct {
+ // FQSN returns the fully qualified service name of this service.
+ func (s *Service) FQSN() string {
+ 	components := []string{""}
+-	if s.File.Package != nil {
++	if s.GRPCFile != nil && s.GRPCFile.GetPackage() != "" {
++		components = append(components, s.GRPCFile.GetPackage())
++	} else if s.File.Package != nil {
+ 		components = append(components, s.File.GetPackage())
+ 	}
+ 	components = append(components, s.GetName())
+@@ -185,7 +190,11 @@ func (s *Service) InstanceName() string {
+ 	if !s.ForcePrefixedName {
+ 		return s.GetName()
+ 	}
+-	return fmt.Sprintf("%s.%s", s.File.Pkg(), s.GetName())
++	pkg := s.File.Pkg()
++	if s.GRPCFile != nil {
++		pkg = s.GRPCFile.Pkg()
++	}
++	return fmt.Sprintf("%s.%s", pkg, s.GetName())
+ }
+ 
+ // ClientConstructorName returns name of the Client constructor with package prefix if needed
+@@ -194,7 +203,11 @@ func (s *Service) ClientConstructorName() string {
+ 	if !s.ForcePrefixedName {
+ 		return constructor
+ 	}
+-	return fmt.Sprintf("%s.%s", s.File.Pkg(), constructor)
++	pkg := s.File.Pkg()
++	if s.GRPCFile != nil {
++		pkg = s.GRPCFile.Pkg()
++	}
++	return fmt.Sprintf("%s.%s", pkg, constructor)
+ }
+ 
+ // Method wraps descriptorpb.MethodDescriptorProto for richer features.
+diff --git a/protoc-gen-grpc-gateway/internal/gengateway/generator.go b/protoc-gen-grpc-gateway/internal/gengateway/generator.go
+index 5a58625c..37f6fa3b 100644
+--- a/protoc-gen-grpc-gateway/internal/gengateway/generator.go
++++ b/protoc-gen-grpc-gateway/internal/gengateway/generator.go
+@@ -5,6 +5,7 @@ import (
+ 	"fmt"
+ 	"go/format"
+ 	"path"
++	"strings"
+ 
+ 	"github.com/grpc-ecosystem/grpc-gateway/v2/internal/descriptor"
+ 	gen "github.com/grpc-ecosystem/grpc-gateway/v2/internal/generator"
+@@ -23,11 +24,12 @@ type generator struct {
+ 	allowPatchFeature  bool
+ 	standalone         bool
+ 	useOpaqueAPI       bool
++	separatePackage    bool
+ }
+ 
+ // New returns a new generator which generates grpc gateway files.
+ func New(reg *descriptor.Registry, useRequestContext bool, registerFuncSuffix string,
+-	allowPatchFeature, standalone bool, useOpaqueAPI bool) gen.Generator {
++	allowPatchFeature, standalone bool, useOpaqueAPI bool, separatePackage bool) gen.Generator {
+ 	var imports []descriptor.GoPackage
+ 	for _, pkgpath := range []string{
+ 		"context",
+@@ -68,6 +70,7 @@ func New(reg *descriptor.Registry, useRequestContext bool, registerFuncSuffix st
+ 		allowPatchFeature:  allowPatchFeature,
+ 		standalone:         standalone,
+ 		useOpaqueAPI:       useOpaqueAPI,
++		separatePackage:    separatePackage,
+ 	}
+ }
+ 
+@@ -78,7 +81,7 @@ func (g *generator) Generate(targets []*descriptor.File) ([]*descriptor.Response
+ 			grpclog.Infof("Processing %s", file.GetName())
+ 		}
+ 
+-		code, err := g.generate(file)
++		code, err := g.generate(file, nil)
+ 		if errors.Is(err, errNoTargetService) {
+ 			if grpclog.V(1) {
+ 				grpclog.Infof("%s: %v", file.GetName(), err)
+@@ -93,10 +96,64 @@ func (g *generator) Generate(targets []*descriptor.File) ([]*descriptor.Response
+ 			grpclog.Errorf("%v: %s", err, code)
+ 			return nil, err
+ 		}
++		if !g.separatePackage {
++			files = append(files, &descriptor.ResponseFile{
++				GoPkg: file.GoPkg,
++				CodeGeneratorResponse_File: &pluginpb.CodeGeneratorResponse_File{
++					Name:    proto.String(file.GeneratedFilenamePrefix + ".pb.gw.go"),
++					Content: proto.String(string(formatted)),
++				},
++			})
++			continue
++		}
++		goPkg := descriptor.GoPackage{
++			Path: path.Join(file.GoPkg.Path, file.GoPkg.Name),
++			Name: file.GoPkg.Name,
++		}
++		fileNamePrefix := path.Join(path.Dir(file.GeneratedFilenamePrefix), file.GoPkg.Name, path.Base(file.GeneratedFilenamePrefix))
+ 		files = append(files, &descriptor.ResponseFile{
+-			GoPkg: file.GoPkg,
++			GoPkg: goPkg,
+ 			CodeGeneratorResponse_File: &pluginpb.CodeGeneratorResponse_File{
+-				Name:    proto.String(file.GeneratedFilenamePrefix + ".pb.gw.go"),
++				Name:    proto.String(fileNamePrefix + ".pb.gw.go"),
++				Content: proto.String(string(formatted)),
++			},
++		})
++		// There was a bug where we include an extra path element (the filename), resulting
++		// in a stuttering import path. Fixing this bug cannot involve removing the Go file
++		// generated at the wrong path, because that would be a breaking change.
++		//
++		// Instead, we generate the same file both at the right path and at the wrong path,
++		// marking the file (its package) at the wrong path as deprecated.
++		//
++		// If gateway has a new major version, we should then stop generating at the wrong path.
++		aliasedPackage := &descriptor.GoPackage{
++			// When generating for generated SDK, the original goPkg points to code generated by "protocolbuffers/go",
++			// but we are aliasing to a package generated by "grpc-ecosystem/gateway".
++			Path:  strings.Replace(goPkg.Path, "/"+descriptor.BaseTypePackageSubPath, "/"+descriptor.GatewayPackageSubPath, 1),
++			Name:  goPkg.Name,
++			Alias: "gateway",
++		}
++		code, err = g.generate(file, aliasedPackage)
++		if errors.Is(err, errNoTargetService) {
++			if grpclog.V(1) {
++				grpclog.Infof("%s: %v", file.GetName(), err)
++			}
++			continue
++		}
++		if err != nil {
++			return nil, err
++		}
++		formatted, err = format.Source([]byte(code))
++		if err != nil {
++			grpclog.Errorf("%v: %s", err, code)
++			return nil, err
++		}
++		// The prefix is incorrect, but we are still generating it for backwards compatibility.
++		fileNamePrefix = path.Join(file.GeneratedFilenamePrefix, file.GoPkg.Name, path.Base(file.GeneratedFilenamePrefix))
++		files = append(files, &descriptor.ResponseFile{
++			GoPkg: goPkg,
++			CodeGeneratorResponse_File: &pluginpb.CodeGeneratorResponse_File{
++				Name:    proto.String(fileNamePrefix + ".pb.gw.go"),
+ 				Content: proto.String(string(formatted)),
+ 			},
+ 		})
+@@ -104,7 +161,7 @@ func (g *generator) Generate(targets []*descriptor.File) ([]*descriptor.Response
+ 	return files, nil
+ }
+ 
+-func (g *generator) generate(file *descriptor.File) (string, error) {
++func (g *generator) generate(file *descriptor.File, aliasedPkg *descriptor.GoPackage) (string, error) {
+ 	pkgSeen := make(map[string]bool)
+ 	var imports []descriptor.GoPackage
+ 	for _, pkg := range g.baseImports {
+@@ -112,6 +169,14 @@ func (g *generator) generate(file *descriptor.File) (string, error) {
+ 		imports = append(imports, pkg)
+ 	}
+ 
++	for _, additionalImport := range g.reg.GetAdditionalImports(file.GoPkg) {
++		elems := strings.Split(additionalImport, "/")
++		imports = append(imports, descriptor.GoPackage{
++			Path: additionalImport,
++			Name: elems[len(elems)-1],
++		})
++	}
++
+ 	if g.standalone {
+ 		imports = append(imports, file.GoPkg)
+ 	}
+@@ -129,6 +194,7 @@ func (g *generator) generate(file *descriptor.File) (string, error) {
+ 		}
+ 	}
+ 	params := param{
++		AliasedPkg:         aliasedPkg,
+ 		File:               file,
+ 		Imports:            imports,
+ 		UseRequestContext:  g.useRequestContext,
+diff --git a/protoc-gen-grpc-gateway/internal/gengateway/generator_test.go b/protoc-gen-grpc-gateway/internal/gengateway/generator_test.go
+index 59f0fce1..d53d41f5 100644
+--- a/protoc-gen-grpc-gateway/internal/gengateway/generator_test.go
++++ b/protoc-gen-grpc-gateway/internal/gengateway/generator_test.go
+@@ -1,6 +1,9 @@
+ package gengateway
+ 
+ import (
++	"fmt"
++	"path/filepath"
++	"strings"
+ 	"testing"
+ 
+ 	"github.com/grpc-ecosystem/grpc-gateway/v2/internal/descriptor"
+@@ -75,6 +78,18 @@ func newExampleFileDescriptorWithGoPkg(gp *descriptor.GoPackage, filenamePrefix
+ 	}
+ }
+ 
++func newExampleFileDescriptorWithGoPkgWithoutBinding(gp *descriptor.GoPackage, filenamePrefix string) *descriptor.File {
++	file := newExampleFileDescriptorWithGoPkg(gp, filenamePrefix)
++	for _, service := range file.Services {
++		for _, method := range service.Methods {
++			if method != nil {
++				method.Bindings = nil
++			}
++		}
++	}
++	return file
++}
++
+ func TestGenerator_Generate(t *testing.T) {
+ 
+ 	// Test with Open Struct API (default)
+@@ -110,3 +125,232 @@ func testGeneratorGenerate(t *testing.T, useOpaqueAPI bool) {
+ 		t.Fatalf("invalid name %q, expected %q", gotName, expectedName)
+ 	}
+ }
++
++func TestGenerator_GenerateSeparatePackage(t *testing.T) {
++	reg := descriptor.NewRegistry()
++	reg.SetSeparatePackage(true)
++	reg.SetStandalone(true)
++	g := New(reg, true, "Handler", true, true, true, true)
++	targets := []*descriptor.File{
++		crossLinkFixture(newExampleFileDescriptorWithGoPkg(&descriptor.GoPackage{
++			Path:  "example.com/mymodule/foo/bar/v1",
++			Name:  "v1" + "gateway", // Name is appended with "gateway" with standalone set to true.
++			Alias: "extalias",
++		}, "foo/bar/v1/example")),
++	}
++	// Set ForcePrefixedName (usually set when standalone=true).
++	for _, f := range targets {
++		for _, msg := range f.Messages {
++			msg.ForcePrefixedName = true
++			for _, field := range msg.Fields {
++				field.ForcePrefixedName = true
++			}
++		}
++		for _, enum := range f.Enums {
++			enum.ForcePrefixedName = true
++		}
++		for _, svc := range f.Services {
++			packageName := strings.TrimSuffix(svc.File.GoPkg.Name, "gateway") + "grpc"
++			svc.ForcePrefixedName = true
++			// replicates behavior in internal/descriptor/services.go (loadServices)
++			svc.GRPCFile = &descriptor.File{
++				GoPkg: descriptor.GoPackage{
++					Path: strings.Replace(
++						filepath.Join(svc.File.GoPkg.Path, packageName),
++						"protocolbuffers/go",
++						"grpc/go",
++						1,
++					),
++					Name: strings.Replace(packageName, "protocolbuffers/go", "grpc/go", 1),
++				},
++			}
++			reg.IncludeAdditionalImports(svc, f.GoPkg)
++		}
++	}
++	result, err := g.Generate(targets)
++	if err != nil {
++		t.Fatalf("failed to generate stubs: %v", err)
++	}
++	if len(result) != 2 {
++		t.Fatalf("expected to generate 2 files, got: %d", len(result))
++	}
++	expectedName := "foo/bar/v1/v1gateway/example.pb.gw.go"
++	expectedGoPkgPath := "example.com/mymodule/foo/bar/v1/v1gateway"
++	expectedGoPkgName := "v1gateway"
++	correctFile := result[0]
++	if correctFile == nil {
++		t.Fatal("result is nil")
++	}
++	if correctFile.GetName() != expectedName {
++		t.Errorf("invalid name %q, expected %q", correctFile.GetName(), expectedName)
++	}
++	if correctFile.GoPkg.Path != expectedGoPkgPath {
++		t.Errorf("invalid path %q, expected %q", result[0].GoPkg.Path, expectedGoPkgPath)
++	}
++	if correctFile.GoPkg.Name != expectedGoPkgName {
++		t.Errorf("invalid name %q, expected %q", result[0].GoPkg.Name, expectedGoPkgName)
++	}
++	// Require the two dependencies to be declared as imported packages
++	correctFileContent := correctFile.GetContent()
++	for _, expectedImport := range []string{
++		`extalias "example.com/mymodule/foo/bar/v1"`,
++		`"example.com/mymodule/foo/bar/v1/v1grpc"`,
++	} {
++		if !strings.Contains(correctFileContent, expectedImport) {
++			t.Errorf("expected to find import %q in the generated file: %s", expectedImport, correctFileContent[:400])
++		}
++	}
++
++	expectedName = "foo/bar/v1/example/v1gateway/example.pb.gw.go"
++	// wrong path but correct go package
++	aliasFile := result[1]
++	if aliasFile == nil {
++		t.Fatal("result is nil")
++	}
++	if aliasFile.GetName() != expectedName {
++		t.Errorf("invalid name %q, expected %q", aliasFile.GetName(), expectedName)
++	}
++	if aliasFile.GoPkg.Path != expectedGoPkgPath {
++		t.Errorf("invalid path %q, expected %q", aliasFile.GoPkg.Path, expectedGoPkgPath)
++	}
++	if aliasFile.GoPkg.Name != expectedGoPkgName {
++		t.Errorf("invalid name %q, expected %q", aliasFile.GoPkg.Name, expectedGoPkgName)
++	}
++	aliasFileContent := aliasFile.GetContent()
++	// Require the two dependencies to be declared as imported packages
++	expectedImport := `gateway "example.com/mymodule/foo/bar/v1/v1gateway"`
++	if !strings.Contains(aliasFileContent, expectedImport) {
++		t.Errorf("expected to find import %q in the generated file: %s...", expectedImport, aliasFileContent[:500])
++	}
++	aliasedFunctions := []string{
++		"RegisterExampleServiceHandlerServer",
++		"RegisterExampleServiceHandlerClient",
++		"RegisterExampleServiceHandlerFromEndpoint",
++		"RegisterExampleServiceHandler",
++	}
++	for _, aliasedFunction := range aliasedFunctions {
++		aliasDefinition := fmt.Sprintf("%[1]s = gateway.%[1]s", aliasedFunction)
++		if !strings.Contains(aliasFileContent, aliasDefinition) {
++			t.Fatalf("expected %q in the alias file: %s", aliasDefinition, aliasFileContent)
++		}
++		if strings.Contains(correctFileContent, aliasDefinition) {
++			t.Fatalf("unexpected alias %q in the correct file: %s", aliasDefinition, correctFileContent)
++		}
++	}
++}
++
++func TestGenerator_GenerateSeparatePackage_WithoutBinding(t *testing.T) {
++	reg := descriptor.NewRegistry()
++	reg.SetSeparatePackage(true)
++	reg.SetStandalone(true)
++	g := New(reg, true, "Handler", true, true, true, true)
++	targets := []*descriptor.File{
++		crossLinkFixture(newExampleFileDescriptorWithGoPkgWithoutBinding(&descriptor.GoPackage{
++			Path:  "example.com/mymodule/foo/bar/v1",
++			Name:  "v1" + "gateway",
++			Alias: "extalias",
++		}, "foo/bar/v1/example")),
++	}
++	result, err := g.Generate(targets)
++	if err != nil {
++		t.Fatalf("failed to generate stubs: %v", err)
++	}
++	if len(result) != 0 {
++		t.Fatalf("expected to generate 0 file, got: %d", len(result))
++	}
++}
++
++func TestGenerator_GenerateSeparatePackage_WithOmitPackageDoc_Local(t *testing.T) {
++	reg := descriptor.NewRegistry()
++	reg.SetSeparatePackage(true)
++	reg.SetStandalone(true)
++	reg.SetOmitPackageDoc(true)
++	g := New(reg, true, "Handler", true, true, true, true)
++	targets := []*descriptor.File{
++		crossLinkFixture(newExampleFileDescriptorWithGoPkg(&descriptor.GoPackage{
++			Path:  "example.com/mymodule/foo/bar/v1",
++			Name:  "v1" + "gateway",
++			Alias: "extalias",
++		}, "foo/bar/v1/example")),
++	}
++	result, err := g.Generate(targets)
++	if err != nil {
++		t.Fatalf("failed to generate stubs: %v", err)
++	}
++	if len(result) != 2 {
++		t.Fatalf("expected to generate 2 files, got: %d", len(result))
++	}
++	correctFileContent := result[0].GetContent()
++	if strings.Contains(correctFileContent, "Deprecated:") {
++		t.Errorf("the correct file should not be deprecated: %s...", correctFileContent[:500])
++	}
++	deprecationDoc := `/*
++Deprecated: This package has moved to "example.com/mymodule/foo/bar/v1/v1gateway". Use that import path instead.
++*/`
++	aliasFileContent := result[1].GetContent()
++	// Even though omit_package_doc is set, we still need to deprecate the package.
++	if !strings.Contains(aliasFileContent, deprecationDoc) {
++		t.Errorf("expected to find deprecation doc in the alias file: %s...", aliasFileContent[:500])
++	}
++}
++
++func TestGenerator_GenerateSeparatePackage_WithOmitPackageDoc_Generate_SDK(t *testing.T) {
++	reg := descriptor.NewRegistry()
++	reg.SetSeparatePackage(true)
++	reg.SetStandalone(true)
++	reg.SetOmitPackageDoc(true)
++	g := New(reg, true, "Handler", true, true, true, true)
++	targets := []*descriptor.File{
++		crossLinkFixture(newExampleFileDescriptorWithGoPkg(&descriptor.GoPackage{
++			Path:  "example.com/gen/go/owner/module/protocolbuffers/go/foo/bar/v1",
++			Name:  "v1" + "gateway",
++			Alias: "extalias",
++		}, "foo/bar/v1/example")),
++	}
++	result, err := g.Generate(targets)
++	if err != nil {
++		t.Fatalf("failed to generate stubs: %v", err)
++	}
++	if len(result) != 2 {
++		t.Fatalf("expected to generate 2 files, got: %d", len(result))
++	}
++	correctFileContent := result[0].GetContent()
++	if strings.Contains(correctFileContent, "Deprecated:") {
++		t.Errorf("the correct file should not be deprecated: %s...", correctFileContent[:500])
++	}
++	deprecationDoc := `/*
++Deprecated: This package has moved to "example.com/gen/go/owner/module/grpc-ecosystem/gateway/v2/foo/bar/v1/v1gateway". Use that import path instead.
++*/`
++	aliasFileContent := result[1].GetContent()
++	// Even though omit_package_doc is set, we still need to deprecate the package.
++	if !strings.Contains(aliasFileContent, deprecationDoc) {
++		t.Errorf("expected to find deprecation doc in the alias file: %s...", aliasFileContent[:500])
++	}
++}
++
++func TestGenerator_GenerateSeparatePackage_WithoutService(t *testing.T) {
++	reg := descriptor.NewRegistry()
++	reg.SetSeparatePackage(true)
++	reg.SetStandalone(true)
++	g := New(reg, true, "Handler", true, true, true, true)
++	targets := []*descriptor.File{
++		{
++			FileDescriptorProto: &descriptorpb.FileDescriptorProto{
++				Name:    proto.String("example.proto"),
++				Package: proto.String("example"),
++			},
++			GoPkg: descriptor.GoPackage{
++				Path: "foo/bar/baz/gen/v1",
++				Name: "v1",
++			},
++			GeneratedFilenamePrefix: "gen/v1/example",
++		},
++	}
++	result, err := g.Generate(targets)
++	if err != nil {
++		t.Fatalf("failed to generate stubs: %v", err)
++	}
++	if len(result) != 0 {
++		t.Fatalf("expected to generate 0 file, got: %d", len(result))
++	}
++}
+diff --git a/protoc-gen-grpc-gateway/internal/gengateway/template.go b/protoc-gen-grpc-gateway/internal/gengateway/template.go
+index b647e1df..4988e7dd 100644
+--- a/protoc-gen-grpc-gateway/internal/gengateway/template.go
++++ b/protoc-gen-grpc-gateway/internal/gengateway/template.go
+@@ -16,6 +16,7 @@ import (
+ 
+ type param struct {
+ 	*descriptor.File
++	AliasedPkg         *descriptor.GoPackage
+ 	Imports            []descriptor.GoPackage
+ 	UseRequestContext  bool
+ 	RegisterFuncSuffix string
+@@ -146,6 +147,7 @@ func (f queryParamFilter) String() string {
+ }
+ 
+ type trailerParams struct {
++	AliasedPkg         *descriptor.GoPackage
+ 	Services           []*descriptor.Service
+ 	UseRequestContext  bool
+ 	RegisterFuncSuffix string
+@@ -176,11 +178,14 @@ func applyTemplate(p param, reg *descriptor.Registry) (string, error) {
+ 			methName := casing.Camel(*meth.Name)
+ 			meth.Name = &methName
+ 			for _, b := range meth.Bindings {
++				methodWithBindingsSeen = true
++				if p.AliasedPkg != nil {
++					break
++				}
+ 				if err := reg.CheckDuplicateAnnotation(b.HTTPMethod, b.PathTmpl.Template, svc); err != nil {
+ 					return "", err
+ 				}
+ 
+-				methodWithBindingsSeen = true
+ 				if err := handlerTemplate.Execute(w, binding{
+ 					Binding:           b,
+ 					Registry:          reg,
+@@ -210,6 +215,7 @@ func applyTemplate(p param, reg *descriptor.Registry) (string, error) {
+ 	}
+ 
+ 	tp := trailerParams{
++		AliasedPkg:         p.AliasedPkg,
+ 		Services:           targetServices,
+ 		UseRequestContext:  p.UseRequestContext,
+ 		RegisterFuncSuffix: p.RegisterFuncSuffix,
+@@ -246,8 +252,18 @@ var (
+ Package {{ .GoPkg.Name }} is a reverse proxy.
+ 
+ It translates gRPC into RESTful JSON APIs.
++{{if $.AliasedPkg}}
++Deprecated: This package has moved to "{{$.AliasedPkg.Path}}". Use that import path instead.
++{{- end}}
++*/
++{{- else if $.AliasedPkg}}
++/*
++Deprecated: This package has moved to "{{$.AliasedPkg.Path}}". Use that import path instead.
+ */{{ end }}
+ package {{ .GoPkg.Name }}
++{{- if $.AliasedPkg}}
++import {{$.AliasedPkg}}
++{{- else}}
+ import (
+ 	{{ range $i := .Imports }}{{ if $i.Standard }}{{ $i | printf "%s\n" }}{{ end }}{{ end }}
+ 
+@@ -264,6 +280,7 @@ var (
+ 	_ = utilities.NewDoubleArray
+ 	_ = metadata.Join
+ )
++{{- end}}
+ `))
+ 
+ 	handlerTemplate = template.Must(template.New("handler").Parse(`
+@@ -738,6 +755,9 @@ func local_request_{{ .Method.Service.GetName }}_{{ .Method.GetName }}_{{ .Index
+ }`))
+ 
+ 	localTrailerTemplate = template.Must(template.New("local-trailer").Funcs(funcMap).Parse(`
++{{- if $.AliasedPkg }}
++var (
++{{- end }}
+ {{ $UseRequestContext := .UseRequestContext }}
+ {{ range $svc := .Services }}
+ // Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Server registers the http handlers for service {{ $svc.GetName }} to "mux".
+@@ -745,6 +765,9 @@ func local_request_{{ .Method.Service.GetName }}_{{ .Method.GetName }}_{{ .Index
+ // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+ // Note that using this registration option will cause many gRPC library features to stop working. Consider using Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}FromEndpoint instead.
+ // GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
++{{- if $.AliasedPkg}}
++	Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}Server = {{$.AliasedPkg.Alias}}.Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}Server
++{{- else}}
+ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Server(ctx context.Context, mux *runtime.ServeMux, server {{ $svc.InstanceName }}Server) error {
+ 	{{- range $m := $svc.Methods }}
+ 	{{- range $b := $m.Bindings }}
+@@ -793,6 +816,7 @@ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Server(ctx context.Cont
+ 	{{- end }}
+ 	return nil
+ }
++{{end}}
+ {{ end }}`))
+ 
+ 	trailerTemplate = template.Must(template.New("trailer").Funcs(funcMap).Parse(`
+@@ -801,6 +825,9 @@ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Server(ctx context.Cont
+ {{range $svc := .Services}}
+ // Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}FromEndpoint is same as Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }} but
+ // automatically dials to "endpoint" and closes the connection when "ctx" gets done.
++{{- if $.AliasedPkg}}
++	Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}FromEndpoint = {{$.AliasedPkg.Alias}}.Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}FromEndpoint
++{{- else}}
+ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}FromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+ 	conn, err := grpc.NewClient(endpoint, opts...)
+ 	if err != nil {
+@@ -822,18 +849,26 @@ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}FromEndpoint(ctx contex
+ 	}()
+ 	return Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}(ctx, mux, conn)
+ }
++{{- end}}
+ 
+ // Register{{ $svc.GetName}}{{ $.RegisterFuncSuffix}} registers the http handlers for service {{ $svc.GetName }} to "mux".
+ // The handlers forward requests to the grpc endpoint over "conn".
++{{- if $.AliasedPkg}}
++	Register{{$svc.GetName}}{{$.RegisterFuncSuffix}} = {{$.AliasedPkg.Alias}}.Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}
++{{- else}}
+ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+ 	return Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Client(ctx, mux, {{ $svc.ClientConstructorName }}(conn))
+ }
++{{- end}}
+ 
+ // Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Client registers the http handlers for service {{ $svc.GetName }}
+ // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "{{ $svc.InstanceName }}Client".
+ // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "{{ $svc.InstanceName }}Client"
+ // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+ // "{{ $svc.InstanceName }}Client" to call the correct interceptors. This client ignores the HTTP middlewares.
++{{- if $.AliasedPkg}}
++	Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}Client = {{$.AliasedPkg.Alias}}.Register{{$svc.GetName}}{{$.RegisterFuncSuffix}}Client
++{{- else}}
+ func Register{{ $svc.GetName }}{{ $.RegisterFuncSuffix }}Client(ctx context.Context, mux *runtime.ServeMux, client {{ $svc.InstanceName }}Client) error {
+ 	{{- range $m := $svc.Methods }}
+ 	{{- range $b := $m.Bindings }}
+@@ -920,5 +955,9 @@ var (
+ 	{{- end }}
+ 	{{- end }}
+ )
+-{{ end }}`))
++{{end}}
++{{end}}
++{{- if $.AliasedPkg}}
++)
++{{- end}}`))
+ )
+diff --git a/protoc-gen-grpc-gateway/main.go b/protoc-gen-grpc-gateway/main.go
+index 862a8fc0..c17e4c31 100644
+--- a/protoc-gen-grpc-gateway/main.go
++++ b/protoc-gen-grpc-gateway/main.go
+@@ -10,6 +10,7 @@
+ package main
+ 
+ import (
++	"errors"
+ 	"flag"
+ 	"fmt"
+ 	"os"
+@@ -37,6 +38,7 @@ var (
+ 	warnOnUnboundMethods       = flag.Bool("warn_on_unbound_methods", false, "emit a warning message if an RPC method has no HttpRule annotation")
+ 	generateUnboundMethods     = flag.Bool("generate_unbound_methods", false, "generate proxy methods even for RPC methods that have no HttpRule annotation")
+ 	useOpaqueAPI               = flag.Bool("use_opaque_api", false, "generate code compatible with the new Opaque API instead of the older Open Struct API")
++	separatePackage            = flag.Bool("separate_package", false, "generate gateway code to v1gateway package (requires standalone=true).")
+ 
+ 	_ = flag.Bool("logtostderr", false, "Legacy glog compatibility. This flag is a no-op, you can safely remove it")
+ )
+@@ -74,15 +76,23 @@ func main() {
+ 		ParamFunc: flag.CommandLine.Set,
+ 	}.Run(func(gen *protogen.Plugin) error {
+ 		reg := descriptor.NewRegistry()
+-
+ 		if err := applyFlags(reg); err != nil {
+ 			return err
+ 		}
+-
++		if *separatePackage && !*standalone {
++			return errors.New("option separate_package=true must be specified with standalone=true")
++		}
++		generator := gengateway.New(
++			reg,
++			*useRequestContext,
++			*registerFuncSuffix,
++			*allowPatchFeature,
++			*standalone,
++			*useOpaqueAPI,
++			*separatePackage,
++		)
+ 		codegenerator.SetSupportedFeaturesOnPluginGen(gen)
+ 
+-		generator := gengateway.New(reg, *useRequestContext, *registerFuncSuffix, *allowPatchFeature, *standalone, *useOpaqueAPI)
+-
+ 		if grpclog.V(1) {
+ 			grpclog.Infof("Parsing code generator request")
+ 		}
+@@ -136,6 +146,7 @@ func applyFlags(reg *descriptor.Registry) error {
+ 	}
+ 	reg.SetStandalone(*standalone)
+ 	reg.SetAllowDeleteBody(*allowDeleteBody)
++	reg.SetSeparatePackage(*separatePackage)
+ 
+ 	flag.Visit(func(f *flag.Flag) {
+ 		if f.Name == "allow_repeated_fields_in_body" {
diff --git a/plugins/grpc-ecosystem/openapiv2/v2.27.7/.dockerignore b/plugins/grpc-ecosystem/openapiv2/v2.27.7/.dockerignore
new file mode 100644
index 000000000..5d0f124ff
--- /dev/null
+++ b/plugins/grpc-ecosystem/openapiv2/v2.27.7/.dockerignore
@@ -0,0 +1,2 @@
+*
+!Dockerfile
diff --git a/plugins/grpc-ecosystem/openapiv2/v2.27.7/Dockerfile b/plugins/grpc-ecosystem/openapiv2/v2.27.7/Dockerfile
new file mode 100644
index 000000000..a21056497
--- /dev/null
+++ b/plugins/grpc-ecosystem/openapiv2/v2.27.7/Dockerfile
@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1.19
+FROM --platform=$BUILDPLATFORM golang:1.25.6-bookworm AS build
+
+ARG TARGETOS TARGETARCH
+ENV CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH
+
+FROM golang:1.25.6-bookworm AS build
+RUN --mount=type=cache,target=/go/pkg/mod \
+    CGO_ENABLED=0 \
+    go install -ldflags="-s -w" -trimpath github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2@v2.27.7 \
+ && mv /go/bin/${GOOS}_${GOARCH}/protoc-gen-openapiv2 /go/bin/protoc-gen-openapiv2 || true
+
+FROM scratch
+COPY --from=build --link --chown=root:root /etc/passwd /etc/passwd
+COPY --from=build --link /go/bin/protoc-gen-openapiv2 /
+USER nobody
+ENTRYPOINT [ "/protoc-gen-openapiv2" ]
diff --git a/plugins/grpc-ecosystem/openapiv2/v2.27.7/buf.plugin.yaml b/plugins/grpc-ecosystem/openapiv2/v2.27.7/buf.plugin.yaml
new file mode 100644
index 000000000..a2588fd25
--- /dev/null
+++ b/plugins/grpc-ecosystem/openapiv2/v2.27.7/buf.plugin.yaml
@@ -0,0 +1,7 @@
+version: v1
+name: buf.build/grpc-ecosystem/openapiv2
+plugin_version: v2.27.7
+source_url: https://github.com/grpc-ecosystem/grpc-gateway
+description: Generates OpenAPI definitions for Protobuf services.
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/grpc-ecosystem/grpc-gateway/blob/v2.27.7/LICENSE
diff --git a/plugins/protocolbuffers/cpp/v33.5/.dockerignore b/plugins/protocolbuffers/cpp/v33.5/.dockerignore
new file mode 100644
index 000000000..c80455688
--- /dev/null
+++ b/plugins/protocolbuffers/cpp/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!cpp.cc
+!Dockerfile
diff --git a/plugins/protocolbuffers/cpp/v33.5/BUILD b/plugins/protocolbuffers/cpp/v33.5/BUILD
new file mode 100644
index 000000000..3cacc9e33
--- /dev/null
+++ b/plugins/protocolbuffers/cpp/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-cpp",
+    srcs = ["cpp.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/cpp/v33.5/Dockerfile b/plugins/protocolbuffers/cpp/v33.5/Dockerfile
new file mode 100644
index 000000000..27fcb86a0
--- /dev/null
+++ b/plugins/protocolbuffers/cpp/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD cpp.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-cpp.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-cpp .
+USER nobody
+ENTRYPOINT ["/protoc-gen-cpp"]
diff --git a/plugins/protocolbuffers/cpp/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/cpp/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..ed049e058
--- /dev/null
+++ b/plugins/protocolbuffers/cpp/v33.5/buf.plugin.yaml
@@ -0,0 +1,11 @@
+version: v1
+name: buf.build/protocolbuffers/cpp
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for C++. Generates message and enum types.
+output_languages:
+  - cpp
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
+registry:
+  cmake: {}
diff --git a/plugins/protocolbuffers/cpp/v33.5/cpp.cc b/plugins/protocolbuffers/cpp/v33.5/cpp.cc
new file mode 100644
index 000000000..a3c5da56f
--- /dev/null
+++ b/plugins/protocolbuffers/cpp/v33.5/cpp.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/cpp/generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::cpp::CppGenerator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/csharp/v33.5/.dockerignore b/plugins/protocolbuffers/csharp/v33.5/.dockerignore
new file mode 100644
index 000000000..71e50a495
--- /dev/null
+++ b/plugins/protocolbuffers/csharp/v33.5/.dockerignore
@@ -0,0 +1,5 @@
+*
+!BUILD
+!csharp.cc
+!Dockerfile
+!build.csproj
diff --git a/plugins/protocolbuffers/csharp/v33.5/BUILD b/plugins/protocolbuffers/csharp/v33.5/BUILD
new file mode 100644
index 000000000..c68d051e0
--- /dev/null
+++ b/plugins/protocolbuffers/csharp/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-csharp",
+    srcs = ["csharp.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/csharp/v33.5/Dockerfile b/plugins/protocolbuffers/csharp/v33.5/Dockerfile
new file mode 100644
index 000000000..1d68682c8
--- /dev/null
+++ b/plugins/protocolbuffers/csharp/v33.5/Dockerfile
@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD csharp.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-csharp.stripped'
+
+FROM mcr.microsoft.com/dotnet/sdk:8.0.417-bookworm-slim@sha256:aa05b91be697b83229cb000b90120f0783604ad74ed92a0b45cdf3d1a9c873de AS dotnetrestore
+WORKDIR /build
+COPY --link ./build.csproj /build/build.csproj
+RUN mkdir /nuget && dotnet restore --packages /nuget
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --link --from=dotnetrestore /nuget /nuget
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-csharp .
+USER nobody
+ENTRYPOINT ["/protoc-gen-csharp"]
diff --git a/plugins/protocolbuffers/csharp/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/csharp/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..acf97ced1
--- /dev/null
+++ b/plugins/protocolbuffers/csharp/v33.5/buf.plugin.yaml
@@ -0,0 +1,18 @@
+version: v1
+name: buf.build/protocolbuffers/csharp
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for C#. Generates message and enum types.
+output_languages:
+  - csharp
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
+registry:
+  opts:
+    - base_namespace=
+  nuget:
+    target_frameworks:
+      - netstandard2.0
+    deps:
+      - name: Google.Protobuf
+        version: 3.33.5
diff --git a/plugins/protocolbuffers/csharp/v33.5/build.csproj b/plugins/protocolbuffers/csharp/v33.5/build.csproj
new file mode 100644
index 000000000..0240e3504
--- /dev/null
+++ b/plugins/protocolbuffers/csharp/v33.5/build.csproj
@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Google.Protobuf" Version="3.33.5" />
+  </ItemGroup>
+</Project>
diff --git a/plugins/protocolbuffers/csharp/v33.5/csharp.cc b/plugins/protocolbuffers/csharp/v33.5/csharp.cc
new file mode 100644
index 000000000..a82366018
--- /dev/null
+++ b/plugins/protocolbuffers/csharp/v33.5/csharp.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/csharp/csharp_generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::csharp::Generator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/java/v33.5/.dockerignore b/plugins/protocolbuffers/java/v33.5/.dockerignore
new file mode 100644
index 000000000..9612bcbe0
--- /dev/null
+++ b/plugins/protocolbuffers/java/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!java.cc
diff --git a/plugins/protocolbuffers/java/v33.5/BUILD b/plugins/protocolbuffers/java/v33.5/BUILD
new file mode 100644
index 000000000..34a738a84
--- /dev/null
+++ b/plugins/protocolbuffers/java/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-java",
+    srcs = ["java.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/java/v33.5/Dockerfile b/plugins/protocolbuffers/java/v33.5/Dockerfile
new file mode 100644
index 000000000..b857d8dc3
--- /dev/null
+++ b/plugins/protocolbuffers/java/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD java.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-java.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-java .
+USER nobody
+ENTRYPOINT ["/protoc-gen-java"]
diff --git a/plugins/protocolbuffers/java/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/java/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..39505c8f5
--- /dev/null
+++ b/plugins/protocolbuffers/java/v33.5/buf.plugin.yaml
@@ -0,0 +1,19 @@
+version: v1
+name: buf.build/protocolbuffers/java
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for Java. Generates message and enum types.
+output_languages:
+  - java
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
+registry:
+  maven:
+    deps:
+      - com.google.protobuf:protobuf-java:4.33.5
+    additional_runtimes:
+      - name: lite
+        deps:
+          - com.google.protobuf:protobuf-javalite:4.33.5
+          - build.buf:protobuf-javalite:4.33.5
+        opts: [lite]
diff --git a/plugins/protocolbuffers/java/v33.5/java.cc b/plugins/protocolbuffers/java/v33.5/java.cc
new file mode 100644
index 000000000..bd5cb1386
--- /dev/null
+++ b/plugins/protocolbuffers/java/v33.5/java.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/java/generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::java::JavaGenerator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/kotlin/v33.5/.dockerignore b/plugins/protocolbuffers/kotlin/v33.5/.dockerignore
new file mode 100644
index 000000000..d02a40d82
--- /dev/null
+++ b/plugins/protocolbuffers/kotlin/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!kotlin.cc
diff --git a/plugins/protocolbuffers/kotlin/v33.5/BUILD b/plugins/protocolbuffers/kotlin/v33.5/BUILD
new file mode 100644
index 000000000..340328b4c
--- /dev/null
+++ b/plugins/protocolbuffers/kotlin/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-kotlin",
+    srcs = ["kotlin.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/kotlin/v33.5/Dockerfile b/plugins/protocolbuffers/kotlin/v33.5/Dockerfile
new file mode 100644
index 000000000..f1c72e8fd
--- /dev/null
+++ b/plugins/protocolbuffers/kotlin/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD kotlin.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-kotlin.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-kotlin .
+USER nobody
+ENTRYPOINT ["/protoc-gen-kotlin"]
diff --git a/plugins/protocolbuffers/kotlin/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/kotlin/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..be4f843a2
--- /dev/null
+++ b/plugins/protocolbuffers/kotlin/v33.5/buf.plugin.yaml
@@ -0,0 +1,27 @@
+version: v1
+name: buf.build/protocolbuffers/kotlin
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+integration_guide_url: https://protobuf.dev/getting-started/kotlintutorial
+description: Base types for Kotlin. Generates message and enum types.
+deps:
+  - plugin: buf.build/protocolbuffers/java:v33.5
+output_languages:
+  - kotlin
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
+registry:
+  maven:
+    compiler:
+      kotlin:
+        version: 1.8.22
+    deps:
+      - com.google.protobuf:protobuf-kotlin:4.33.5
+      - org.jetbrains.kotlin:kotlin-stdlib:1.8.22
+      - org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.22
+    additional_runtimes:
+      - name: lite
+        deps:
+          - com.google.protobuf:protobuf-kotlin-lite:4.33.5
+          - org.jetbrains.kotlin:kotlin-stdlib:1.8.22
+        opts: [lite]
diff --git a/plugins/protocolbuffers/kotlin/v33.5/kotlin.cc b/plugins/protocolbuffers/kotlin/v33.5/kotlin.cc
new file mode 100644
index 000000000..b43851764
--- /dev/null
+++ b/plugins/protocolbuffers/kotlin/v33.5/kotlin.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/kotlin/generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::kotlin::KotlinGenerator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/objc/v33.5/.dockerignore b/plugins/protocolbuffers/objc/v33.5/.dockerignore
new file mode 100644
index 000000000..28438c51d
--- /dev/null
+++ b/plugins/protocolbuffers/objc/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!objectivec.cc
diff --git a/plugins/protocolbuffers/objc/v33.5/BUILD b/plugins/protocolbuffers/objc/v33.5/BUILD
new file mode 100644
index 000000000..cc22935a3
--- /dev/null
+++ b/plugins/protocolbuffers/objc/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-objectivec",
+    srcs = ["objectivec.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/objc/v33.5/Dockerfile b/plugins/protocolbuffers/objc/v33.5/Dockerfile
new file mode 100644
index 000000000..e646e7097
--- /dev/null
+++ b/plugins/protocolbuffers/objc/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD objectivec.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-objectivec.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-objectivec .
+USER nobody
+ENTRYPOINT ["/protoc-gen-objectivec"]
diff --git a/plugins/protocolbuffers/objc/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/objc/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..befec33ef
--- /dev/null
+++ b/plugins/protocolbuffers/objc/v33.5/buf.plugin.yaml
@@ -0,0 +1,9 @@
+version: v1
+name: buf.build/protocolbuffers/objc
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for Objective-C. Generates message and enum types.
+output_languages:
+  - objective_c
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
diff --git a/plugins/protocolbuffers/objc/v33.5/objectivec.cc b/plugins/protocolbuffers/objc/v33.5/objectivec.cc
new file mode 100644
index 000000000..1fda20829
--- /dev/null
+++ b/plugins/protocolbuffers/objc/v33.5/objectivec.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/objectivec/generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::objectivec::ObjectiveCGenerator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/php/v33.5/.dockerignore b/plugins/protocolbuffers/php/v33.5/.dockerignore
new file mode 100644
index 000000000..1cc459074
--- /dev/null
+++ b/plugins/protocolbuffers/php/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!php.cc
diff --git a/plugins/protocolbuffers/php/v33.5/BUILD b/plugins/protocolbuffers/php/v33.5/BUILD
new file mode 100644
index 000000000..a813f9104
--- /dev/null
+++ b/plugins/protocolbuffers/php/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-php",
+    srcs = ["php.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/php/v33.5/Dockerfile b/plugins/protocolbuffers/php/v33.5/Dockerfile
new file mode 100644
index 000000000..57a6c7391
--- /dev/null
+++ b/plugins/protocolbuffers/php/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD php.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-php.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-php .
+USER nobody
+ENTRYPOINT ["/protoc-gen-php"]
diff --git a/plugins/protocolbuffers/php/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/php/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..c043dac68
--- /dev/null
+++ b/plugins/protocolbuffers/php/v33.5/buf.plugin.yaml
@@ -0,0 +1,9 @@
+version: v1
+name: buf.build/protocolbuffers/php
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for PHP. Generates message and enum types.
+output_languages:
+  - php
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
diff --git a/plugins/protocolbuffers/php/v33.5/php.cc b/plugins/protocolbuffers/php/v33.5/php.cc
new file mode 100644
index 000000000..107efe882
--- /dev/null
+++ b/plugins/protocolbuffers/php/v33.5/php.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/php/php_generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::php::Generator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/pyi/v33.5/.dockerignore b/plugins/protocolbuffers/pyi/v33.5/.dockerignore
new file mode 100644
index 000000000..54ca5b118
--- /dev/null
+++ b/plugins/protocolbuffers/pyi/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!pyi.cc
diff --git a/plugins/protocolbuffers/pyi/v33.5/BUILD b/plugins/protocolbuffers/pyi/v33.5/BUILD
new file mode 100644
index 000000000..89eebd092
--- /dev/null
+++ b/plugins/protocolbuffers/pyi/v33.5/BUILD
@@ -0,0 +1,8 @@
+# Create a standalone binary to generate Python .pyi files
+cc_binary(
+    name = "protoc-gen-pyi",
+    srcs = ["pyi.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/pyi/v33.5/Dockerfile b/plugins/protocolbuffers/pyi/v33.5/Dockerfile
new file mode 100644
index 000000000..4f8b3bd7c
--- /dev/null
+++ b/plugins/protocolbuffers/pyi/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY BUILD pyi.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-pyi.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-pyi .
+USER nobody
+ENTRYPOINT ["/protoc-gen-pyi"]
diff --git a/plugins/protocolbuffers/pyi/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/pyi/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..89d987665
--- /dev/null
+++ b/plugins/protocolbuffers/pyi/v33.5/buf.plugin.yaml
@@ -0,0 +1,19 @@
+version: v1
+name: buf.build/protocolbuffers/pyi
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for Python Stubs. Generates stub files for message and enum types.
+output_languages:
+  - python
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
+registry:
+  python:
+    package_type: "stub-only"
+    # https://github.com/protocolbuffers/protobuf/blob/v33.5/python/dist/setup.py#L91
+    requires_python: ">=3.9"
+    deps:
+      # https://pypi.org/project/protobuf/
+      - "protobuf>=3.20"
+      # https://pypi.org/project/types-protobuf/
+      - "types-protobuf"
diff --git a/plugins/protocolbuffers/pyi/v33.5/pyi.cc b/plugins/protocolbuffers/pyi/v33.5/pyi.cc
new file mode 100644
index 000000000..4d32abebf
--- /dev/null
+++ b/plugins/protocolbuffers/pyi/v33.5/pyi.cc
@@ -0,0 +1,8 @@
+#include <google/protobuf/compiler/python/pyi_generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+// Standalone binary to generate Python .pyi files
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::python::PyiGenerator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/python/v33.5/.dockerignore b/plugins/protocolbuffers/python/v33.5/.dockerignore
new file mode 100644
index 000000000..ee7c3bab2
--- /dev/null
+++ b/plugins/protocolbuffers/python/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!python.cc
diff --git a/plugins/protocolbuffers/python/v33.5/BUILD b/plugins/protocolbuffers/python/v33.5/BUILD
new file mode 100644
index 000000000..013f4312b
--- /dev/null
+++ b/plugins/protocolbuffers/python/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-python",
+    srcs = ["python.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/python/v33.5/Dockerfile b/plugins/protocolbuffers/python/v33.5/Dockerfile
new file mode 100644
index 000000000..af6e97a5b
--- /dev/null
+++ b/plugins/protocolbuffers/python/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD python.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-python.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-python .
+USER nobody
+ENTRYPOINT ["/protoc-gen-python"]
diff --git a/plugins/protocolbuffers/python/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/python/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..b0235f8b9
--- /dev/null
+++ b/plugins/protocolbuffers/python/v33.5/buf.plugin.yaml
@@ -0,0 +1,19 @@
+version: v1
+name: buf.build/protocolbuffers/python
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for Python. Generates message and enum types.
+deps:
+  - plugin: buf.build/protocolbuffers/pyi:v33.5
+output_languages:
+  - python
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
+registry:
+  python:
+    package_type: "runtime"
+    # https://github.com/protocolbuffers/protobuf/blob/v33.5/python/dist/setup.py#L91
+    requires_python: ">=3.9"
+    deps:
+      # https://pypi.org/project/protobuf/
+      - "protobuf>=3.20"
diff --git a/plugins/protocolbuffers/python/v33.5/python.cc b/plugins/protocolbuffers/python/v33.5/python.cc
new file mode 100644
index 000000000..f8a9f636d
--- /dev/null
+++ b/plugins/protocolbuffers/python/v33.5/python.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/python/generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::python::Generator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/plugins/protocolbuffers/ruby/v33.5/.dockerignore b/plugins/protocolbuffers/ruby/v33.5/.dockerignore
new file mode 100644
index 000000000..2bdb552e6
--- /dev/null
+++ b/plugins/protocolbuffers/ruby/v33.5/.dockerignore
@@ -0,0 +1,4 @@
+*
+!BUILD
+!Dockerfile
+!ruby.cc
diff --git a/plugins/protocolbuffers/ruby/v33.5/BUILD b/plugins/protocolbuffers/ruby/v33.5/BUILD
new file mode 100644
index 000000000..8bd93e181
--- /dev/null
+++ b/plugins/protocolbuffers/ruby/v33.5/BUILD
@@ -0,0 +1,7 @@
+cc_binary(
+    name = "protoc-gen-ruby",
+    srcs = ["ruby.cc"],
+    deps = [
+        "//:protoc_lib",
+    ],
+)
diff --git a/plugins/protocolbuffers/ruby/v33.5/Dockerfile b/plugins/protocolbuffers/ruby/v33.5/Dockerfile
new file mode 100644
index 000000000..74604daed
--- /dev/null
+++ b/plugins/protocolbuffers/ruby/v33.5/Dockerfile
@@ -0,0 +1,30 @@
+# syntax=docker/dockerfile:1.19
+FROM debian:bookworm-20260112 AS build
+
+ARG TARGETARCH
+ARG BAZEL_OPTS="--host_jvm_args=-Djava.net.preferIPv4Stack=true"
+
+RUN apt-get update \
+ && apt-get install -y curl git cmake build-essential autoconf clang libc++-dev libtool pkg-config unzip zip
+RUN curl -fsSL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${TARGETARCH} \
+ && chmod +x /usr/local/bin/bazelisk \
+ && mkdir /build \
+ && chown nobody:nogroup /build \
+ && usermod --home /build nobody
+
+USER nobody
+WORKDIR /build
+RUN curl -fsSL -o protoc.tar.gz https://github.com/protocolbuffers/protobuf/releases/download/v33.5/protobuf-33.5.tar.gz \
+ && tar --strip-components=1 -zxf protoc.tar.gz \
+ && rm protoc.tar.gz
+RUN bazelisk ${BAZEL_OPTS} build '//:protoc_lib'
+COPY --link BUILD ruby.cc plugins/
+RUN bazelisk ${BAZEL_OPTS} build '//plugins:protoc-gen-ruby.stripped'
+
+FROM gcr.io/distroless/cc-debian12:latest@sha256:72344f7f909a8bf003c67f55687e6d51a441b49661af8f660aa7b285f00e57df AS base
+
+FROM scratch
+COPY --from=base --link / /
+COPY --from=build --link --chmod=0755 /build/bazel-bin/plugins/protoc-gen-ruby .
+USER nobody
+ENTRYPOINT ["/protoc-gen-ruby"]
diff --git a/plugins/protocolbuffers/ruby/v33.5/buf.plugin.yaml b/plugins/protocolbuffers/ruby/v33.5/buf.plugin.yaml
new file mode 100644
index 000000000..829b55ccc
--- /dev/null
+++ b/plugins/protocolbuffers/ruby/v33.5/buf.plugin.yaml
@@ -0,0 +1,9 @@
+version: v1
+name: buf.build/protocolbuffers/ruby
+plugin_version: v33.5
+source_url: https://github.com/protocolbuffers/protobuf
+description: Base types for Ruby. Generates message and enum types.
+output_languages:
+  - ruby
+spdx_license_id: BSD-3-Clause
+license_url: https://github.com/protocolbuffers/protobuf/blob/v33.5/LICENSE
diff --git a/plugins/protocolbuffers/ruby/v33.5/ruby.cc b/plugins/protocolbuffers/ruby/v33.5/ruby.cc
new file mode 100644
index 000000000..73ba6a6ae
--- /dev/null
+++ b/plugins/protocolbuffers/ruby/v33.5/ruby.cc
@@ -0,0 +1,7 @@
+#include <google/protobuf/compiler/ruby/ruby_generator.h>
+#include <google/protobuf/compiler/plugin.h>
+
+int main(int argc, char *argv[]) {
+  google::protobuf::compiler::ruby::Generator generator;
+  return google::protobuf::compiler::PluginMain(argc, argv, &generator);
+}
diff --git a/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/eliza/plugin.sum b/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/eliza/plugin.sum
new file mode 100644
index 000000000..7d9c0f31d
--- /dev/null
+++ b/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
diff --git a/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/grpc-gateway/plugin.sum b/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/grpc-gateway/plugin.sum
new file mode 100644
index 000000000..6633c6049
--- /dev/null
+++ b/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/grpc-gateway/plugin.sum
@@ -0,0 +1 @@
+h1:0JShv7I0go1H1hK0sufq6cScuj+NPrLiIGcutDbqUZo=
diff --git a/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/petapis/plugin.sum b/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/petapis/plugin.sum
new file mode 100644
index 000000000..7d9c0f31d
--- /dev/null
+++ b/tests/testdata/buf.build/grpc-ecosystem/gateway/v2.27.7/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
diff --git a/tests/testdata/buf.build/grpc-ecosystem/openapiv2/v2.27.7/eliza/plugin.sum b/tests/testdata/buf.build/grpc-ecosystem/openapiv2/v2.27.7/eliza/plugin.sum
new file mode 100644
index 000000000..ab9321074
--- /dev/null
+++ b/tests/testdata/buf.build/grpc-ecosystem/openapiv2/v2.27.7/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:JQ/i5FmoiOHbdeMMOregjBJILrbRFRfUlbnCKugtJ00=
diff --git a/tests/testdata/buf.build/grpc-ecosystem/openapiv2/v2.27.7/petapis/plugin.sum b/tests/testdata/buf.build/grpc-ecosystem/openapiv2/v2.27.7/petapis/plugin.sum
new file mode 100644
index 000000000..31b154daa
--- /dev/null
+++ b/tests/testdata/buf.build/grpc-ecosystem/openapiv2/v2.27.7/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:EElDlJnmkn0xseLhNtgsYfZgnUgg1+5DHcBINMlLZHQ=
diff --git a/tests/testdata/buf.build/protocolbuffers/cpp/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/cpp/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..6e0ca5140
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/cpp/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:4WquPOx1//7zl63Ld3uEqo+X2vQolyI7S1JC9q9b+pk=
diff --git a/tests/testdata/buf.build/protocolbuffers/cpp/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/cpp/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..d7cebdfe7
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/cpp/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:OUIJSOT2J5tpwAsO/RXzz8qByrsnvzKzYn8FneRiRag=
diff --git a/tests/testdata/buf.build/protocolbuffers/csharp/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/csharp/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..7ce484537
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/csharp/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:DkwuBVPi0d23QGFSabB3Xtmk+70VRNgm9M3HLZEHuoA=
diff --git a/tests/testdata/buf.build/protocolbuffers/csharp/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/csharp/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..496f4399e
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/csharp/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:MkwMeoPPud7IULSQ4evKWu/or1M6c7Izxx5ieDjPV90=
diff --git a/tests/testdata/buf.build/protocolbuffers/java/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/java/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..d5f9f78ac
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/java/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:qvbuUQlPYz0z/lEsTRS80CVvs0mLovImwcM1k6mBTOM=
diff --git a/tests/testdata/buf.build/protocolbuffers/java/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/java/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..68e0644c9
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/java/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:ANU7GcgVnWmZmYrriC6T9g3rHyM5rRr2nQd46FOKH4k=
diff --git a/tests/testdata/buf.build/protocolbuffers/kotlin/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/kotlin/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..c2d2c4f85
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/kotlin/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:Q26cDw+4NCCw7fhQseRXK/5vFLD31t4EnXJ5oc6Po7M=
diff --git a/tests/testdata/buf.build/protocolbuffers/kotlin/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/kotlin/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..828e36ae3
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/kotlin/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:qErKoSan+tBubttyp9BIdEjQ5cayI+f7pW30rOgnQGM=
diff --git a/tests/testdata/buf.build/protocolbuffers/objc/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/objc/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..81999c495
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/objc/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:77z/xF29LSYoBycTKtSRR+TE1wsEps6o5eCur4Bz2rA=
diff --git a/tests/testdata/buf.build/protocolbuffers/objc/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/objc/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..4c634bb15
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/objc/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:RJdaZauIteT9wnQRBXcsWeMqcB0PHErSo0xPAJAtONs=
diff --git a/tests/testdata/buf.build/protocolbuffers/php/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/php/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..1992a17a6
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/php/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:I4qrbQ/xHaIrZ1tsEbDERvaRSAH3OSoHqhlgHesRcQI=
diff --git a/tests/testdata/buf.build/protocolbuffers/php/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/php/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..9bb883a20
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/php/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:n9Je73K/RW7Rs+ZayAvf5KHUbMN3UtQ/uJ9ftoiEIyM=
diff --git a/tests/testdata/buf.build/protocolbuffers/pyi/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/pyi/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..196fe700f
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/pyi/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:G5FqoiiggweB/wzLjL0N+pmAmS9MVvZ0r88nEeOKuWg=
diff --git a/tests/testdata/buf.build/protocolbuffers/pyi/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/pyi/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..9e3ef1a3b
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/pyi/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:nx278l8ybUpUZ/pFVZLnPN1wBN7ENBmqb2uhMCu6wXk=
diff --git a/tests/testdata/buf.build/protocolbuffers/python/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/python/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..87619b68a
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/python/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:h6/YQhlyhhVknCYPQSuSiKFrc2UoZyi3Y4IqGI+jJzY=
diff --git a/tests/testdata/buf.build/protocolbuffers/python/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/python/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..daec50c22
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/python/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:YEnBqVOmAIMtneffuh1PGMck7aI9Xy8X6+XfInXKs/E=
diff --git a/tests/testdata/buf.build/protocolbuffers/ruby/v33.5/eliza/plugin.sum b/tests/testdata/buf.build/protocolbuffers/ruby/v33.5/eliza/plugin.sum
new file mode 100644
index 000000000..5e0f16747
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/ruby/v33.5/eliza/plugin.sum
@@ -0,0 +1 @@
+h1:eQ9M5akPS26qcuIEZaoFUvRBCXVDcYcPXFqo3SQXl4I=
diff --git a/tests/testdata/buf.build/protocolbuffers/ruby/v33.5/petapis/plugin.sum b/tests/testdata/buf.build/protocolbuffers/ruby/v33.5/petapis/plugin.sum
new file mode 100644
index 000000000..1c42b9fc7
--- /dev/null
+++ b/tests/testdata/buf.build/protocolbuffers/ruby/v33.5/petapis/plugin.sum
@@ -0,0 +1 @@
+h1:Kf1buxG7nygnMgQTbLk1NaIu/O9Jfi2nm6TyyApY6KY=