diff --git a/.github/upstream-projects.yaml b/.github/upstream-projects.yaml
index 3486edab..cde56640 100644
--- a/.github/upstream-projects.yaml
+++ b/.github/upstream-projects.yaml
@@ -35,7 +35,7 @@ projects:
 
   - id: toolhive
     repo: stacklok/toolhive
-    version: v0.28.0
+    version: v0.28.1
     # toolhive is a monorepo covering the CLI, the Kubernetes
     # operator, and the vMCP gateway. It also introduces cross-
     # cutting features that land in concepts/, integrations/,
diff --git a/static/api-specs/crds/virtualmcpservers.schema.json b/static/api-specs/crds/virtualmcpservers.schema.json
index 6156cab6..6024caaf 100644
--- a/static/api-specs/crds/virtualmcpservers.schema.json
+++ b/static/api-specs/crds/virtualmcpservers.schema.json
@@ -1581,7 +1581,7 @@
                         "type": "object"
                       },
                       "type": {
-                        "description": "Type is the auth strategy: \"unauthenticated\", \"header_injection\", \"token_exchange\", \"upstream_inject\", \"aws_sts\"",
+                        "description": "Type is the auth strategy: \"unauthenticated\", \"header_injection\", \"token_exchange\", \"upstream_inject\", \"aws_sts\", \"obo\"",
                         "type": "string"
                       },
                       "upstreamInject": {
@@ -1743,7 +1743,7 @@
                       "type": "object"
                     },
                     "type": {
-                      "description": "Type is the auth strategy: \"unauthenticated\", \"header_injection\", \"token_exchange\", \"upstream_inject\", \"aws_sts\"",
+                      "description": "Type is the auth strategy: \"unauthenticated\", \"header_injection\", \"token_exchange\", \"upstream_inject\", \"aws_sts\", \"obo\"",
                       "type": "string"
                     },
                     "upstreamInject": {