diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 20220b4..847b8a5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.19.x, 1.20.x, 1.21.x]
+        go-version: [1.20.x, 1.21.x, 1.22.x]
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -32,5 +32,5 @@ jobs:
         # conflicting guidance, run only on the most recent supported version.
         # For the same reason, only check generated code on the most recent
         # supported version.
-        if: matrix.go-version == '1.21.x'
+        if: matrix.go-version == '1.22.x'
         run: make checkgenerate && make lint
diff --git a/Makefile b/Makefile
index 3dd8cd8..7a9bc62 100644
--- a/Makefile
+++ b/Makefile
@@ -11,6 +11,7 @@ export PATH := $(BIN):$(PATH)
 export GOBIN := $(abspath $(BIN))
 COPYRIGHT_YEARS := 2023-2024
 LICENSE_IGNORE := --ignore testdata/
+BUF_VERSION := 1.33.0
 
 .PHONY: help
 help: ## Describe useful make targets
@@ -70,7 +71,7 @@ checkgenerate:
 
 $(BIN)/license-header: Makefile
 	@mkdir -p $(@D)
-	go install github.com/bufbuild/buf/private/pkg/licenseheader/cmd/license-header@v1.27.2
+	go install github.com/bufbuild/buf/private/pkg/licenseheader/cmd/license-header@v${BUF_VERSION}
 
 $(BIN)/golangci-lint: Makefile
 	@mkdir -p $(@D)
@@ -78,7 +79,7 @@ $(BIN)/golangci-lint: Makefile
 
 $(BIN)/buf: Makefile
 	@mkdir -p $(@D)
-	go install github.com/bufbuild/buf/cmd/buf@v1.27.2
+	go install github.com/bufbuild/buf/cmd/buf@v${BUF_VERSION}
 
 $(BIN)/protoc-gen-go: Makefile go.mod
 	@mkdir -p $(@D)
diff --git a/buf.gen.yaml b/buf.gen.yaml
index 6a8f5d0..97fd0b9 100644
--- a/buf.gen.yaml
+++ b/buf.gen.yaml
@@ -1,12 +1,13 @@
-version: v1
+version: v2
 managed:
   enabled: true
-  go_package_prefix:
-    default: connectrpc.com/authn/internal/gen
+  override:
+    - file_option: go_package_prefix
+      value: connectrpc.com/authn/internal/gen
 plugins:
-  - name: go
+  - local: protoc-gen-go
     out: internal/gen
     opt: paths=source_relative
-  - name: connect-go
+  - local: protoc-gen-connect-go
     out: internal/gen
     opt: paths=source_relative
diff --git a/buf.work.yaml b/buf.work.yaml
deleted file mode 100644
index 30f1e1f..0000000
--- a/buf.work.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-version: v1
-directories:
-  - internal/proto
diff --git a/buf.yaml b/buf.yaml
new file mode 100644
index 0000000..a2eccfd
--- /dev/null
+++ b/buf.yaml
@@ -0,0 +1,10 @@
+version: v2
+modules:
+  - path: internal/proto
+lint:
+  use:
+    - DEFAULT
+  disallow_comment_ignores: true
+breaking:
+  use:
+    - WIRE_JSON
diff --git a/go.mod b/go.mod
index 6d3ed22..97ae457 100644
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,11 @@
 module connectrpc.com/authn
 
-go 1.19
+go 1.20
 
 require (
 	connectrpc.com/connect v1.14.0
 	github.com/stretchr/testify v1.8.4
-	google.golang.org/protobuf v1.32.0
+	google.golang.org/protobuf v1.33.0
 )
 
 require (
diff --git a/go.sum b/go.sum
index 14140c2..b49db3d 100644
--- a/go.sum
+++ b/go.sum
@@ -1,22 +1,16 @@
-connectrpc.com/connect v1.12.0 h1:HwKdOY0lGhhoHdsza+hW55aqHEC64pYpObRNoAgn70g=
-connectrpc.com/connect v1.12.0/go.mod h1:3AGaO6RRGMx5IKFfqbe3hvK1NqLosFNP2BxDYTPmNPo=
 connectrpc.com/connect v1.14.0 h1:PDS+J7uoz5Oui2VEOMcfz6Qft7opQM9hPiKvtGC01pA=
 connectrpc.com/connect v1.14.0/go.mod h1:uoAq5bmhhn43TwhaKdGKN/bZcGtzPW1v+ngDTn5u+8s=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
-google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/internal/gen/authn/ping/v1/ping.pb.go b/internal/gen/authn/ping/v1/ping.pb.go
index 3984f1a..af4982c 100644
--- a/internal/gen/authn/ping/v1/ping.pb.go
+++ b/internal/gen/authn/ping/v1/ping.pb.go
@@ -17,7 +17,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.32.0
+// 	protoc-gen-go v1.33.0
 // 	protoc        (unknown)
 // source: authn/ping/v1/ping.proto
 
diff --git a/internal/proto/buf.yaml b/internal/proto/buf.yaml
deleted file mode 100644
index efda402..0000000
--- a/internal/proto/buf.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-version: v1
-lint:
-  use:
-    - DEFAULT
-breaking:
-  use:
-    - WIRE_JSON