diff --git a/command/base_predict_test.go b/command/base_predict_test.go
index 72c2a945f6..4b61e6f0c6 100644
--- a/command/base_predict_test.go
+++ b/command/base_predict_test.go
@@ -392,6 +392,7 @@ func TestPredict_Plugins(t *testing.T) {
 				"saml",
 				"scep",
 				"snowflake-database-plugin",
+				"spiffe",
 				"ssh",
 				"terraform",
 				"totp",
@@ -453,6 +454,14 @@ func TestPredict_Plugins(t *testing.T) {
 						}
 					}
 				}
+				if !strutil.StrListContains(act, "spiffe") {
+					for i, v := range tc.exp {
+						if v == "spiffe" {
+							tc.exp = append(tc.exp[:i], tc.exp[i+1:]...)
+							break
+						}
+					}
+				}
 				if d := cmp.Diff(act, tc.exp); len(d) > 0 {
 					t.Errorf("expected: %q, got: %q, diff: %v", tc.exp, act, d)
 				}
diff --git a/helper/builtinplugins/registry_test.go b/helper/builtinplugins/registry_test.go
index a6d57c1801..a6bc76a1ff 100644
--- a/helper/builtinplugins/registry_test.go
+++ b/helper/builtinplugins/registry_test.go
@@ -99,7 +99,7 @@ func Test_RegistryKeyCounts(t *testing.T) {
 			name:       "number of auth plugins",
 			pluginType: consts.PluginTypeCredential,
 			want:       18,
-			entWant:    2,
+			entWant:    3,
 		},
 		{
 			name:       "number of database plugins",
diff --git a/scripts/gen_openapi.sh b/scripts/gen_openapi.sh
index 7db57ef24e..634ed018e9 100755
--- a/scripts/gen_openapi.sh
+++ b/scripts/gen_openapi.sh
@@ -96,6 +96,7 @@ if vault version | grep -q "+ent"; then
     vault secrets enable "transform"
     vault auth enable "saml"
     vault auth enable "scep"
+    vault auth enable "spiffe"
 fi
 
 # Output OpenAPI, optionally formatted