diff --git a/KERNEL_REV b/KERNEL_REV
index beffc14b..966d44e8 100644
--- a/KERNEL_REV
+++ b/KERNEL_REV
@@ -1 +1 @@
-5e5dea91ebc17df49d63665e1f933bacb3072c65
+be4b8687cdddfe7a95dc0fd764cac11020a545a6
diff --git a/native/kernel/index.d.ts b/native/kernel/index.d.ts
index 6fb596e2..9e33b65d 100644
--- a/native/kernel/index.d.ts
+++ b/native/kernel/index.d.ts
@@ -679,6 +679,20 @@ export interface ConnectionOptions {
    * authority for [`AuthMode::OAuthM2m`] / [`AuthMode::OAuthM2mJwt`].
    */
   tokenUrl?: string
+  /**
+   * U2M on-disk token-cache control (kernel path). Omitted ⇒ the kernel
+   * default (cache enabled, encrypted under a machine-local key, survives
+   * restarts). `false` disables on-disk persistence (re-login each fresh
+   * process); `true` keeps it enabled. Applies to [`AuthMode::OAuthU2m`].
+   */
+  tokenCacheEnabled?: boolean
+  /**
+   * Optional passphrase for the U2M on-disk token cache (AES-256 key).
+   * Omitted/blank ⇒ a machine-local derived key. Supplying one is stronger.
+   * A passphrase with no explicit `tokenCacheEnabled` implies enabled.
+   * Applies to [`AuthMode::OAuthU2m`].
+   */
+  tokenCachePassphrase?: string
   /**
    * Path to the PEM private-key file. Required for
    * [`AuthMode::OAuthM2mJwt`].