diff --git a/.librarian/state.yaml b/.librarian/state.yaml
index 7b2efe9ff..d1b8b3732 100644
--- a/.librarian/state.yaml
+++ b/.librarian/state.yaml
@@ -1,4 +1,4 @@
-image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:8e2c32496077054105bd06c54a59d6a6694287bc053588e24debe6da6920ad91
+image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:234b9d1f2ddb057ed7ac6a38db0bf8163d839c65c6cf88ade52530cddebce59e
 libraries:
   - id: google-cloud-storage
     version: 3.10.1
diff --git a/google/cloud/_storage_v2/__init__.py b/google/cloud/_storage_v2/__init__.py
index de9735f8d..88cdff339 100644
--- a/google/cloud/_storage_v2/__init__.py
+++ b/google/cloud/_storage_v2/__init__.py
@@ -15,8 +15,18 @@
 #
 from google.cloud._storage_v2 import gapic_version as package_version
 
+import google.api_core as api_core
+import sys
+
 __version__ = package_version.__version__
 
+if sys.version_info >= (3, 8):  # pragma: NO COVER
+    from importlib import metadata
+else:  # pragma: NO COVER
+    # TODO(https://github.com/googleapis/python-api-core/issues/835): Remove
+    # this code path once we drop support for Python 3.7
+    import importlib_metadata as metadata
+
 
 from .services.storage import StorageClient
 from .services.storage import StorageAsyncClient
@@ -78,6 +88,100 @@
 from .types.storage import WriteObjectResponse
 from .types.storage import WriteObjectSpec
 
+if hasattr(api_core, "check_python_version") and hasattr(
+    api_core, "check_dependency_versions"
+):  # pragma: NO COVER
+    api_core.check_python_version("google.cloud._storage_v2")  # type: ignore
+    api_core.check_dependency_versions("google.cloud._storage_v2")  # type: ignore
+else:  # pragma: NO COVER
+    # An older version of api_core is installed which does not define the
+    # functions above. We do equivalent checks manually.
+    try:
+        import warnings
+        import sys
+
+        _py_version_str = sys.version.split()[0]
+        _package_label = "google.cloud._storage_v2"
+        if sys.version_info < (3, 9):
+            warnings.warn(
+                "You are using a non-supported Python version "
+                + f"({_py_version_str}).  Google will not post any further "
+                + f"updates to {_package_label} supporting this Python version. "
+                + "Please upgrade to the latest Python version, or at "
+                + f"least to Python 3.9, and then update {_package_label}.",
+                FutureWarning,
+            )
+        if sys.version_info[:2] == (3, 9):
+            warnings.warn(
+                f"You are using a Python version ({_py_version_str}) "
+                + f"which Google will stop supporting in {_package_label} in "
+                + "January 2026. Please "
+                + "upgrade to the latest Python version, or at "
+                + "least to Python 3.10, before then, and "
+                + f"then update {_package_label}.",
+                FutureWarning,
+            )
+
+        def parse_version_to_tuple(version_string: str):
+            """Safely converts a semantic version string to a comparable tuple of integers.
+            Example: "4.25.8" -> (4, 25, 8)
+            Ignores non-numeric parts and handles common version formats.
+            Args:
+                version_string: Version string in the format "x.y.z" or "x.y.z<suffix>"
+            Returns:
+                Tuple of integers for the parsed version string.
+            """
+            parts = []
+            for part in version_string.split("."):
+                try:
+                    parts.append(int(part))
+                except ValueError:
+                    # If it's a non-numeric part (e.g., '1.0.0b1' -> 'b1'), stop here.
+                    # This is a simplification compared to 'packaging.parse_version', but sufficient
+                    # for comparing strictly numeric semantic versions.
+                    break
+            return tuple(parts)
+
+        def _get_version(dependency_name):
+            try:
+                version_string: str = metadata.version(dependency_name)
+                parsed_version = parse_version_to_tuple(version_string)
+                return (parsed_version, version_string)
+            except Exception:
+                # Catch exceptions from metadata.version() (e.g., PackageNotFoundError)
+                # or errors during parse_version_to_tuple
+                return (None, "--")
+
+        _dependency_package = "google.protobuf"
+        _next_supported_version = "4.25.8"
+        _next_supported_version_tuple = (4, 25, 8)
+        _recommendation = " (we recommend 6.x)"
+        (_version_used, _version_used_string) = _get_version(_dependency_package)
+        if _version_used and _version_used < _next_supported_version_tuple:
+            warnings.warn(
+                f"Package {_package_label} depends on "
+                + f"{_dependency_package}, currently installed at version "
+                + f"{_version_used_string}. Future updates to "
+                + f"{_package_label} will require {_dependency_package} at "
+                + f"version {_next_supported_version} or higher{_recommendation}."
+                + " Please ensure "
+                + "that either (a) your Python environment doesn't pin the "
+                + f"version of {_dependency_package}, so that updates to "
+                + f"{_package_label} can require the higher version, or "
+                + "(b) you manually update your Python environment to use at "
+                + f"least version {_next_supported_version} of "
+                + f"{_dependency_package}.",
+                FutureWarning,
+            )
+    except Exception:
+        warnings.warn(
+            "Could not determine the version of Python "
+            + "currently being used. To continue receiving "
+            + "updates for {_package_label}, ensure you are "
+            + "using a supported version of Python; see "
+            + "https://devguide.python.org/versions/"
+        )
+
 __all__ = (
     "StorageAsyncClient",
     "AppendObjectSpec",
diff --git a/google/cloud/_storage_v2/services/storage/async_client.py b/google/cloud/_storage_v2/services/storage/async_client.py
index cd376a088..004b19e4a 100644
--- a/google/cloud/_storage_v2/services/storage/async_client.py
+++ b/google/cloud/_storage_v2/services/storage/async_client.py
@@ -50,11 +50,11 @@
 
 from google.cloud._storage_v2.services.storage import pagers
 from google.cloud._storage_v2.types import storage
-from google.iam.v1 import iam_policy_pb2  # type: ignore
-from google.iam.v1 import policy_pb2  # type: ignore
 from google.longrunning import operations_pb2  # type: ignore
-from google.protobuf import field_mask_pb2  # type: ignore
-from google.protobuf import timestamp_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
+import google.iam.v1.policy_pb2 as policy_pb2  # type: ignore
+import google.protobuf.field_mask_pb2 as field_mask_pb2  # type: ignore
+import google.protobuf.timestamp_pb2 as timestamp_pb2  # type: ignore
 from .transports.base import StorageTransport, DEFAULT_CLIENT_INFO
 from .transports.grpc_asyncio import StorageGrpcAsyncIOTransport
 from .client import StorageClient
@@ -148,7 +148,8 @@ def from_service_account_info(cls, info: dict, *args, **kwargs):
         Returns:
             StorageAsyncClient: The constructed client.
         """
-        return StorageClient.from_service_account_info.__func__(StorageAsyncClient, info, *args, **kwargs)  # type: ignore
+        sa_info_func = StorageClient.from_service_account_info.__func__  # type: ignore
+        return sa_info_func(StorageAsyncClient, info, *args, **kwargs)
 
     @classmethod
     def from_service_account_file(cls, filename: str, *args, **kwargs):
@@ -164,7 +165,8 @@ def from_service_account_file(cls, filename: str, *args, **kwargs):
         Returns:
             StorageAsyncClient: The constructed client.
         """
-        return StorageClient.from_service_account_file.__func__(StorageAsyncClient, filename, *args, **kwargs)  # type: ignore
+        sa_file_func = StorageClient.from_service_account_file.__func__  # type: ignore
+        return sa_file_func(StorageAsyncClient, filename, *args, **kwargs)
 
     from_service_account_json = from_service_account_file
 
@@ -214,7 +216,7 @@ def transport(self) -> StorageTransport:
         return self._client.transport
 
     @property
-    def api_endpoint(self):
+    def api_endpoint(self) -> str:
         """Return the API endpoint used by the client instance.
 
         Returns:
@@ -1038,7 +1040,7 @@ async def get_iam_policy(
             #   client as shown in:
             #   https://googleapis.dev/python/google-api-core/latest/client_options.html
             from google.cloud import storage_v2
-            from google.iam.v1 import iam_policy_pb2  # type: ignore
+            import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
             async def sample_get_iam_policy():
                 # Create a client
@@ -1193,7 +1195,7 @@ async def set_iam_policy(
             #   client as shown in:
             #   https://googleapis.dev/python/google-api-core/latest/client_options.html
             from google.cloud import storage_v2
-            from google.iam.v1 import iam_policy_pb2  # type: ignore
+            import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
             async def sample_set_iam_policy():
                 # Create a client
@@ -1352,7 +1354,7 @@ async def test_iam_permissions(
             #   client as shown in:
             #   https://googleapis.dev/python/google-api-core/latest/client_options.html
             from google.cloud import storage_v2
-            from google.iam.v1 import iam_policy_pb2  # type: ignore
+            import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
             async def sample_test_iam_permissions():
                 # Create a client
diff --git a/google/cloud/_storage_v2/services/storage/transports/README.rst b/google/cloud/_storage_v2/services/storage/transports/README.rst
index 803b98632..575429372 100644
--- a/google/cloud/_storage_v2/services/storage/transports/README.rst
+++ b/google/cloud/_storage_v2/services/storage/transports/README.rst
@@ -2,8 +2,9 @@
 transport inheritance structure
 _______________________________
 
-`StorageTransport` is the ABC for all transports.
-- public child `StorageGrpcTransport` for sync gRPC transport (defined in `grpc.py`).
-- public child `StorageGrpcAsyncIOTransport` for async gRPC transport (defined in `grpc_asyncio.py`).
-- private child `_BaseStorageRestTransport` for base REST transport with inner classes `_BaseMETHOD` (defined in `rest_base.py`).
-- public child `StorageRestTransport` for sync REST transport with inner classes `METHOD` derived from the parent's corresponding `_BaseMETHOD` classes (defined in `rest.py`).
+``StorageTransport`` is the ABC for all transports.
+
+- public child ``StorageGrpcTransport`` for sync gRPC transport (defined in ``grpc.py``).
+- public child ``StorageGrpcAsyncIOTransport`` for async gRPC transport (defined in ``grpc_asyncio.py``).
+- private child ``_BaseStorageRestTransport`` for base REST transport with inner classes ``_BaseMETHOD`` (defined in ``rest_base.py``).
+- public child ``StorageRestTransport`` for sync REST transport with inner classes ``METHOD`` derived from the parent's corresponding ``_BaseMETHOD`` classes (defined in ``rest.py``).
diff --git a/google/cloud/_storage_v2/services/storage/transports/base.py b/google/cloud/_storage_v2/services/storage/transports/base.py
index b45d47623..df40865c1 100644
--- a/google/cloud/_storage_v2/services/storage/transports/base.py
+++ b/google/cloud/_storage_v2/services/storage/transports/base.py
@@ -28,10 +28,10 @@
 import google.protobuf
 
 from google.cloud._storage_v2.types import storage
-from google.iam.v1 import iam_policy_pb2  # type: ignore
-from google.iam.v1 import policy_pb2  # type: ignore
 from google.longrunning import operations_pb2  # type: ignore
-from google.protobuf import empty_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
+import google.iam.v1.policy_pb2 as policy_pb2  # type: ignore
+import google.protobuf.empty_pb2 as empty_pb2  # type: ignore
 
 DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
     gapic_version=package_version.__version__
@@ -91,10 +91,12 @@ def __init__(
                 your own client library.
             always_use_jwt_access (Optional[bool]): Whether self signed JWT should
                 be used for service account credentials.
+            api_audience (Optional[str]): The intended audience for the API calls
+                to the service that will be set when using certain 3rd party
+                authentication flows. Audience is typically a resource identifier.
+                If not set, the host value will be used as a default.
         """
 
-        scopes_kwargs = {"scopes": scopes, "default_scopes": self.AUTH_SCOPES}
-
         # Save the scopes.
         self._scopes = scopes
         if not hasattr(self, "_ignore_credentials"):
@@ -109,11 +111,16 @@ def __init__(
 
         if credentials_file is not None:
             credentials, _ = google.auth.load_credentials_from_file(
-                credentials_file, **scopes_kwargs, quota_project_id=quota_project_id
+                credentials_file,
+                scopes=scopes,
+                quota_project_id=quota_project_id,
+                default_scopes=self.AUTH_SCOPES,
             )
         elif credentials is None and not self._ignore_credentials:
             credentials, _ = google.auth.default(
-                **scopes_kwargs, quota_project_id=quota_project_id
+                scopes=scopes,
+                quota_project_id=quota_project_id,
+                default_scopes=self.AUTH_SCOPES,
             )
             # Don't apply audience if the credentials file passed from user.
             if hasattr(credentials, "with_gdch_audience"):
@@ -137,6 +144,8 @@ def __init__(
             host += ":443"
         self._host = host
 
+        self._wrapped_methods: Dict[Callable, Callable] = {}
+
     @property
     def host(self):
         return self._host
diff --git a/google/cloud/_storage_v2/services/storage/transports/grpc.py b/google/cloud/_storage_v2/services/storage/transports/grpc.py
index 6497959d7..60566a5d4 100644
--- a/google/cloud/_storage_v2/services/storage/transports/grpc.py
+++ b/google/cloud/_storage_v2/services/storage/transports/grpc.py
@@ -31,10 +31,10 @@
 import proto  # type: ignore
 
 from google.cloud._storage_v2.types import storage
-from google.iam.v1 import iam_policy_pb2  # type: ignore
-from google.iam.v1 import policy_pb2  # type: ignore
 from google.longrunning import operations_pb2  # type: ignore
-from google.protobuf import empty_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
+import google.iam.v1.policy_pb2 as policy_pb2  # type: ignore
+import google.protobuf.empty_pb2 as empty_pb2  # type: ignore
 from .base import StorageTransport, DEFAULT_CLIENT_INFO
 
 try:
@@ -59,7 +59,7 @@ def intercept_unary_unary(self, continuation, client_call_details, request):
             elif isinstance(request, google.protobuf.message.Message):
                 request_payload = MessageToJson(request)
             else:
-                request_payload = f"{type(request).__name__}: {pickle.dumps(request)}"
+                request_payload = f"{type(request).__name__}: {pickle.dumps(request)!r}"
 
             request_metadata = {
                 key: value.decode("utf-8") if isinstance(value, bytes) else value
@@ -94,7 +94,7 @@ def intercept_unary_unary(self, continuation, client_call_details, request):
             elif isinstance(result, google.protobuf.message.Message):
                 response_payload = MessageToJson(result)
             else:
-                response_payload = f"{type(result).__name__}: {pickle.dumps(result)}"
+                response_payload = f"{type(result).__name__}: {pickle.dumps(result)!r}"
             grpc_response = {
                 "payload": response_payload,
                 "metadata": metadata,
@@ -221,6 +221,10 @@ def __init__(
                 your own client library.
             always_use_jwt_access (Optional[bool]): Whether self signed JWT should
                 be used for service account credentials.
+            api_audience (Optional[str]): The intended audience for the API calls
+                to the service that will be set when using certain 3rd party
+                authentication flows. Audience is typically a resource identifier.
+                If not set, the host value will be used as a default.
 
         Raises:
           google.auth.exceptions.MutualTLSChannelError: If mutual TLS transport
diff --git a/google/cloud/_storage_v2/services/storage/transports/grpc_asyncio.py b/google/cloud/_storage_v2/services/storage/transports/grpc_asyncio.py
index 1c7743a72..c8d4dee4c 100644
--- a/google/cloud/_storage_v2/services/storage/transports/grpc_asyncio.py
+++ b/google/cloud/_storage_v2/services/storage/transports/grpc_asyncio.py
@@ -34,10 +34,10 @@
 from grpc.experimental import aio  # type: ignore
 
 from google.cloud._storage_v2.types import storage
-from google.iam.v1 import iam_policy_pb2  # type: ignore
-from google.iam.v1 import policy_pb2  # type: ignore
 from google.longrunning import operations_pb2  # type: ignore
-from google.protobuf import empty_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
+import google.iam.v1.policy_pb2 as policy_pb2  # type: ignore
+import google.protobuf.empty_pb2 as empty_pb2  # type: ignore
 from .base import StorageTransport, DEFAULT_CLIENT_INFO
 from .grpc import StorageGrpcTransport
 
@@ -65,7 +65,7 @@ async def intercept_unary_unary(self, continuation, client_call_details, request
             elif isinstance(request, google.protobuf.message.Message):
                 request_payload = MessageToJson(request)
             else:
-                request_payload = f"{type(request).__name__}: {pickle.dumps(request)}"
+                request_payload = f"{type(request).__name__}: {pickle.dumps(request)!r}"
 
             request_metadata = {
                 key: value.decode("utf-8") if isinstance(value, bytes) else value
@@ -100,7 +100,7 @@ async def intercept_unary_unary(self, continuation, client_call_details, request
             elif isinstance(result, google.protobuf.message.Message):
                 response_payload = MessageToJson(result)
             else:
-                response_payload = f"{type(result).__name__}: {pickle.dumps(result)}"
+                response_payload = f"{type(result).__name__}: {pickle.dumps(result)!r}"
             grpc_response = {
                 "payload": response_payload,
                 "metadata": metadata,
@@ -272,6 +272,10 @@ def __init__(
                 your own client library.
             always_use_jwt_access (Optional[bool]): Whether self signed JWT should
                 be used for service account credentials.
+            api_audience (Optional[str]): The intended audience for the API calls
+                to the service that will be set when using certain 3rd party
+                authentication flows. Audience is typically a resource identifier.
+                If not set, the host value will be used as a default.
 
         Raises:
             google.auth.exceptions.MutualTlsChannelError: If mutual TLS transport
diff --git a/google/cloud/_storage_v2/types/storage.py b/google/cloud/_storage_v2/types/storage.py
index d1a7c5a36..df474f499 100644
--- a/google/cloud/_storage_v2/types/storage.py
+++ b/google/cloud/_storage_v2/types/storage.py
@@ -19,11 +19,11 @@
 
 import proto  # type: ignore
 
-from google.protobuf import duration_pb2  # type: ignore
-from google.protobuf import field_mask_pb2  # type: ignore
-from google.protobuf import timestamp_pb2  # type: ignore
-from google.rpc import status_pb2  # type: ignore
-from google.type import date_pb2  # type: ignore
+import google.protobuf.duration_pb2 as duration_pb2  # type: ignore
+import google.protobuf.field_mask_pb2 as field_mask_pb2  # type: ignore
+import google.protobuf.timestamp_pb2 as timestamp_pb2  # type: ignore
+import google.rpc.status_pb2 as status_pb2  # type: ignore
+import google.type.date_pb2 as date_pb2  # type: ignore
 
 
 __protobuf__ = proto.module(
diff --git a/mypy.ini b/mypy.ini
index 574c5aed3..e0e0da2e9 100644
--- a/mypy.ini
+++ b/mypy.ini
@@ -1,3 +1,15 @@
 [mypy]
-python_version = 3.7
+python_version = 3.14
 namespace_packages = True
+ignore_missing_imports = False
+
+# TODO(https://github.com/googleapis/gapic-generator-python/issues/2563):
+# Dependencies that historically lacks py.typed markers
+[mypy-google.iam.*]
+ignore_missing_imports = True
+
+# Helps mypy navigate the 'google' namespace more reliably in 3.10+
+explicit_package_bases = True
+
+# Performance: reuse results from previous runs to speed up 'nox'
+incremental = True
diff --git a/noxfile.py b/noxfile.py
index a00b72040..71672ba28 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# DO NOT EDIT THIS FILE OUTSIDE OF `.librarian/generator-input`
+# The source of truth for this file is `.librarian/generator-input`
+
+
 from __future__ import absolute_import
 import os
 import pathlib
diff --git a/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_async.py b/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_async.py
index a7920496b..c742efba5 100644
--- a/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_async.py
+++ b/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_async.py
@@ -32,7 +32,7 @@
 #   client as shown in:
 #   https://googleapis.dev/python/google-api-core/latest/client_options.html
 from google.cloud import storage_v2
-from google.iam.v1 import iam_policy_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
 
 async def sample_get_iam_policy():
diff --git a/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_sync.py b/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_sync.py
index a63fd2927..f6cc29f38 100644
--- a/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_sync.py
+++ b/samples/generated_samples/storage_v2_generated_storage_get_iam_policy_sync.py
@@ -32,7 +32,7 @@
 #   client as shown in:
 #   https://googleapis.dev/python/google-api-core/latest/client_options.html
 from google.cloud import storage_v2
-from google.iam.v1 import iam_policy_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
 
 def sample_get_iam_policy():
diff --git a/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_async.py b/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_async.py
index 06a9c50fb..c6c72fdc6 100644
--- a/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_async.py
+++ b/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_async.py
@@ -32,7 +32,7 @@
 #   client as shown in:
 #   https://googleapis.dev/python/google-api-core/latest/client_options.html
 from google.cloud import storage_v2
-from google.iam.v1 import iam_policy_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
 
 async def sample_set_iam_policy():
diff --git a/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_sync.py b/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_sync.py
index 2b3c0c6bc..a3de89a02 100644
--- a/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_sync.py
+++ b/samples/generated_samples/storage_v2_generated_storage_set_iam_policy_sync.py
@@ -32,7 +32,7 @@
 #   client as shown in:
 #   https://googleapis.dev/python/google-api-core/latest/client_options.html
 from google.cloud import storage_v2
-from google.iam.v1 import iam_policy_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
 
 def sample_set_iam_policy():
diff --git a/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_async.py b/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_async.py
index dd4818f83..5ddac08ec 100644
--- a/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_async.py
+++ b/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_async.py
@@ -32,7 +32,7 @@
 #   client as shown in:
 #   https://googleapis.dev/python/google-api-core/latest/client_options.html
 from google.cloud import storage_v2
-from google.iam.v1 import iam_policy_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
 
 async def sample_test_iam_permissions():
diff --git a/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_sync.py b/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_sync.py
index e66d50d92..b62358d02 100644
--- a/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_sync.py
+++ b/samples/generated_samples/storage_v2_generated_storage_test_iam_permissions_sync.py
@@ -32,7 +32,7 @@
 #   client as shown in:
 #   https://googleapis.dev/python/google-api-core/latest/client_options.html
 from google.cloud import storage_v2
-from google.iam.v1 import iam_policy_pb2  # type: ignore
+import google.iam.v1.iam_policy_pb2 as iam_policy_pb2  # type: ignore
 
 
 def sample_test_iam_permissions():
diff --git a/setup.py b/setup.py
index 69fc2899e..b539a316c 100644
--- a/setup.py
+++ b/setup.py
@@ -12,6 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# DO NOT EDIT THIS FILE OUTSIDE OF `.librarian/generator-input`
+# The source of truth for this file is `.librarian/generator-input`
+
+
 import io
 import os
 
diff --git a/testing/constraints-3.10.txt b/testing/constraints-3.10.txt
index ef1c92fff..1cd0c5a2c 100644
--- a/testing/constraints-3.10.txt
+++ b/testing/constraints-3.10.txt
@@ -6,4 +6,6 @@ google-auth
 grpcio
 proto-plus
 protobuf
+# cryptography is a direct dependency of google-auth
+cryptography
 grpc-google-iam-v1
diff --git a/testing/constraints-3.11.txt b/testing/constraints-3.11.txt
index ef1c92fff..1cd0c5a2c 100644
--- a/testing/constraints-3.11.txt
+++ b/testing/constraints-3.11.txt
@@ -6,4 +6,6 @@ google-auth
 grpcio
 proto-plus
 protobuf
+# cryptography is a direct dependency of google-auth
+cryptography
 grpc-google-iam-v1
diff --git a/testing/constraints-3.12.txt b/testing/constraints-3.12.txt
index ef1c92fff..1cd0c5a2c 100644
--- a/testing/constraints-3.12.txt
+++ b/testing/constraints-3.12.txt
@@ -6,4 +6,6 @@ google-auth
 grpcio
 proto-plus
 protobuf
+# cryptography is a direct dependency of google-auth
+cryptography
 grpc-google-iam-v1
diff --git a/testing/constraints-3.8.txt b/testing/constraints-3.8.txt
deleted file mode 100644
index ef1c92fff..000000000
--- a/testing/constraints-3.8.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-# -*- coding: utf-8 -*-
-# This constraints file is required for unit tests.
-# List all library dependencies and extras in this file.
-google-api-core
-google-auth
-grpcio
-proto-plus
-protobuf
-grpc-google-iam-v1