diff --git a/contract-toolkit/CLAUDE.md b/contract-toolkit/CLAUDE.md
index 096fe21610..7e2dd799fc 100644
--- a/contract-toolkit/CLAUDE.md
+++ b/contract-toolkit/CLAUDE.md
@@ -64,6 +64,8 @@ demonstrates distinct feature surface, verified by `tests/*.pkl`.
   diverse widgets, UIRules, extraNodes.
 - `bundle`: multi-entrypoint app (crawler + miner); shared credential configmap;
   per-entrypoint artifact subfolders.
+- `credential-configs`: `additionalCredentialConfigs` — more than one credential
+  configmap per entrypoint, including a bare (wrapper-less) one; hoisted and deduped.
 - `deploy`: single-pool migration example — KEDA, resources, env, pool-level `overrides`; shows v0.16.x → v0.17.0 migration path.
 - `pools`: `pools` map (preferred) — named hot/cold worker pools with per-pool `cooldownPeriod` and resources.
 - `system-app`: `type = "system"` — no `entrypoints` block or card, no credential config, no `uiConfig`; typed `inputs` render `_input.py` with no manifest, and `contract/generated/input.pkl`, synced into the toolkit as `src/system/<name>.pkl` for callers.
diff --git a/contract-toolkit/README.md b/contract-toolkit/README.md
index 46bbd8e582..8b369e0ed0 100644
--- a/contract-toolkit/README.md
+++ b/contract-toolkit/README.md
@@ -103,6 +103,7 @@ The `examples/` directory contains executable contracts that teach stable toolki
 - [`examples/tree-filters/`](examples/tree-filters/) — extraction app whose include/exclude filters are tree pickers with `treeSelection = true`; `AppInputContract` extends `TreeSelectionExtractionInput`.
 - [`examples/full/`](examples/full/) — every overridable feature: JDBC URL auth, all pipeline steps, diverse widgets, UIRules, extraNodes.
 - [`examples/bundle/`](examples/bundle/) — multi-entrypoint app (crawler + miner); shared credential configmap; per-entrypoint artifact subfolders.
+- [`examples/credential-configs/`](examples/credential-configs/) — `additionalCredentialConfigs`: an entrypoint that emits more than one credential configmap (primary + wrapped delivery + bare object-store), and one whose only credential is the shared bare config. The bundle hoists and dedupes them. See [CredentialConfig](docs/reference.md#credentialconfig--additional-credential-configmaps).
 - [`examples/card-split/`](examples/card-split/) — two entrypoints where only one is a marketplace UI card (`packageId` on the card entrypoint; route-only entrypoint has none).
 - [`examples/behind-the-scenes/`](examples/behind-the-scenes/) — single-entrypoint app with `marketplaceCard = false`; routable but no marketplace card or `package_id` emitted.
 - [`examples/system-app/`](examples/system-app/) — `type = "system"`: an in-tenant app started by other apps' DAG nodes. No `entrypoints` block, no card, no credential config, no manifest. Typed `inputs` (string, number, enum, bounded list/map, nested object) render `_input.py` without a `uiConfig`. They also render `contract/generated/input.pkl`, the typed DAG node that is synced into the toolkit as `src/system/<name>.pkl` for callers to import.
@@ -234,7 +235,7 @@ The single entry point for all new native app contracts. Amend this module and d
 
 - App metadata: `name`, `displayName`, `connector`, `icon`
 - Marketplace metadata: `shortDescription`, `longDescription`, `tags` (emitted top-level into `atlan.yaml`; Build & Publish syncs `tags` to the Global Marketplace App row after each publish, where marketplace search reads them as keywords; `atlan app register` sends all three when it creates the app); `docsUrl` (emitted top-level into `atlan.yaml`)
-- Credential config: `credentialCommonFields`, `credentialAuthOptions`, `credentialConnectorType`
+- Credential config: `credentialCommonFields`, `credentialAuthOptions`, `credentialConnectorType`; extra or bare (wrapper-less) credential configmaps via `additionalCredentialConfigs`
 - Workflow config: `uiConfig` (form steps and fields using `Widgets.*` types)
 - Pipeline: typed `pipeline` block (extract → parseQueries → popularity → lineage → publish)
 - Deployment: `deploy` (typed `DeployConfig?` — app-level `dapr` / `overrides` plus a named `pools` map; pool keys must match `@task(pool="…")` strings) — see `Deployment.pkl`. `dapr.objectstore` defaults to `true` and must stay on: the SDK requires the deployment object store and fails at startup without it (conformance rule K029 flags `false`)
diff --git a/contract-toolkit/docs/reference.md b/contract-toolkit/docs/reference.md
index 353eb2731f..3604c8fa0b 100644
--- a/contract-toolkit/docs/reference.md
+++ b/contract-toolkit/docs/reference.md
@@ -884,6 +884,7 @@ class LineagePublishStep {               // wraps LineagePublishNode
 | `credentialAuthHiddenEnumListForCreating` | Listing<String>? | null | Auth-type enum values hidden during credential creation. |
 | `credentialNamePlaceholder` | String | `"Host Name"` | Placeholder for hidden credential `name` field. |
 | `credentialUrlGroup` | AdvancedJDBCUrlGroup? | null | Opt-in JDBC Host↔URL credential form. Requires all `credentialAuthOptions` to be `JDBCUrlAuthOption`. |
+| `additionalCredentialConfigs` | Listing<CredentialConfig> | `[]` | Extra credential configmaps beyond `<connectorConfigName>.json`; `wrapper` / `identityProperties` reproduce legacy shapes. See [CredentialConfig](#credentialconfig--additional-credential-configmaps). |
 
 The auth-type radio's `ui.hidden` is auto-derived from `credentialAuthOptions.length == 1` — when the connector declares a single auth option, the radio is hidden and the default value is still emitted. No manual flag is required.
 
@@ -1438,6 +1439,7 @@ Developers amend this module. It defines the app's identity, credentials, workfl
 | `credentialNamePlaceholder` | String | `"Host Name"` | Placeholder for the hidden credential `name` field. |
 | `credentialConnectorDefault` | String? | null | Optional default for the hidden credential `connector` field. |
 | `credentialUrlGroup` | AdvancedJDBCUrlGroup? | null | Opt-in JDBC Host↔URL credential form. When set, every `credentialAuthOptions` entry must be a `JDBCUrlAuthOption`. See [AdvancedJDBCUrlGroup](#advancedjdbcurlgroup--hostrlarrowurl-jdbc-credential-form). |
+| `additionalCredentialConfigs` | Listing<CredentialConfig> | `[]` | Extra credential configmaps beyond `<connectorConfigName>.json`; `wrapper` / `identityProperties` reproduce legacy shapes. See [CredentialConfig](#credentialconfig--additional-credential-configmaps). |
 
 The auth-type radio's `ui.hidden` is auto-derived from `credentialAuthOptions.length == 1` — when the connector declares a single auth option, the radio is hidden and the default value is still emitted. No manual flag is required.
 
@@ -1827,6 +1829,8 @@ open class AuthOption {
   nestedLabel: String = ""                                        // Custom label for nested section wrapper
   nestedPlaceholder: String?                                      // Custom placeholder for nested section wrapper
   nestedHidden: Boolean = true                                    // Hide nested auth pane by default
+  nestedHelp: String?                                             // `ui.help` on the nested pane; omitted when null
+  nestedWidth: Int?                                               // `ui.grid` on the nested pane; omitted when null
   nestedExtraLabel: String = ""                                   // Label on the per-option `extra` nested section
   nestedExtraHeader: String? = "Advanced"                         // Header on `extra`; null omits it
 }
@@ -1932,6 +1936,95 @@ credentialAuthOptions {
 
 ---
 
+## CredentialConfig — Additional Credential Configmaps
+
+Each contract emits at most one primary credential configmap,
+`<connectorConfigName>.json`, built from the top-level `credential*` properties.
+List further configmaps in `additionalCredentialConfigs` when one entrypoint's
+form selects more than one credential type (`CredentialInput { credType = "<name>" }`),
+or selects one that is not its own connection credential, such as an
+object-store delivery target.
+
+```pkl
+class CredentialConfig {
+  name: String                                  // Configmap name = file stem = credType: (atlan|csa)-connectors-<kebab-case>
+  wrapper: Boolean = true                       // false: no icon/helpdeskLink/logo/connector/defaultConnectorType
+  identityProperties: Boolean = true            // false: no hidden name/connector/connectorType properties
+  connector: String?                            // Envelope `connector`; defaults to the app's. Refused when !wrapper
+  connectorType: String?                        // Envelope `defaultConnectorType` (default "rest"). Refused when !wrapper
+  icon: String?; logo: String?; helpdeskLink: String?   // Wrapper keys; default to the app's
+  authOptions: Mapping<String, AuthOption>      // Radio options + nested panes + anyOf rules
+  commonFields: Listing<CredentialFieldEntry> = []
+  sharedExtraFields: Listing<CredentialFieldEntry> = []
+  authTitle: String = "Authentication"
+  authDefault: String?                          // Defaults to the first authOptions key
+  authRules: Listing<Dynamic>?; authPlaceholder: String?; authWidth: Int?
+  authHiddenEnumListForCreating: Listing<String>?
+  namePlaceholder: String?                      // Hidden `name` placeholder (default "Host Name"). Refused when !identityProperties
+  connectorDefault: String?                     // Hidden `connector` default; refused when !identityProperties
+}
+```
+
+Each entry renders through the same renderer as the primary config, so the
+auth-type radio, panes and `anyOf` rules have the same shape. The knobs mirror the
+top-level properties of the same name. `credentialUrlGroup` (JDBC Host↔URL) applies
+only to the primary config.
+
+**`wrapper` and `identityProperties`.** By default an entry carries what the
+primary carries:
+
+- the envelope: top-level `icon`, `helpdeskLink`, `logo`, `connector`,
+  `defaultConnectorType`;
+- hidden `name` / `connector` / `connectorType` form properties.
+
+Turn either off only to reproduce a legacy credential type whose form never had
+it. Neither is neutral for such a type:
+
+- the SDK configmap route returns `defaultConnectorType` as
+  `data.defaultConnectorType`;
+- the hidden properties are submitted in every credential body the form creates.
+
+| Legacy shape | `wrapper` | `identityProperties` |
+|---|---|---|
+| `@atlan/connectors` `csa-connectors-objectstore` (bare `{"config": ...}`) | `false` | `false` |
+| Credential.pkl configs, e.g. generic-miner's object-store form (envelope, no identity properties) | `true` | `false` |
+
+A field that a flag turns off is refused rather than ignored: `connector` /
+`connectorType` / `icon` / `logo` / `helpdeskLink` with `wrapper = false`, and
+`connectorDefault` / `namePlaceholder` with `identityProperties = false`.
+
+**Output.** A single-entrypoint contract writes `app/generated/<name>.json` per
+entry. A bundle hoists these files to `app/generated/` and dedupes them by name,
+as it does the primary. Two entrypoints may declare the same name only if the
+rendered content is identical; otherwise generation fails.
+
+**Unchanged.** The primary config, `credentialFieldName`, `_input.py` and the e2e
+credential codegen (`_e2e_credential.py`) describe only the primary credential.
+`hasCredentialConfig = false` suppresses only the primary, so a contract whose only
+credentials are additional ones still emits them.
+
+**Refused at generation:**
+
+- a multi-entrypoint bundle root, which emits no form or credential of its own:
+  declare the entry on each entrypoint's `contract`;
+- no `uiConfig`, since nothing could select the config;
+- a name that is not `atlan-connectors-` / `csa-connectors-` plus lowercase
+  kebab-case (the SDK treats only those stems as credential templates, so any other
+  stem can be served as the setup form; `/` or `..` would write outside
+  `app/generated/`);
+- duplicate names, or a name that collides with the primary, workflow config or
+  manifest;
+- an entry with `wrapper = true` and no connector on the entry or the app;
+- a field the entry's flags make unused (see above).
+
+Example: `examples/credential-configs/` is a bundle. Its `export` entrypoint emits
+a primary, a wrapped delivery config and a shared bare object-store config
+(`wrapper = false`, `identityProperties = false`). Its
+`report` entrypoint has no primary, only the shared object-store config, which the
+bundle writes once.
+
+---
+
 ## AdvancedJDBCUrlGroup — Host↔URL JDBC Credential Form
 
 Toolkit primitive for SQL-family connectors whose credential form exposes a
@@ -4251,6 +4344,12 @@ deploy = new DeployConfig {
 For Argo-era apps only. Do not use for new native apps (use `FieldSpec` instead). Still used
 by CSA connector credential configs.
 
+An App.pkl contract that needs a second credential configmap, the job a
+`NativeApp.pkl` `additionalOutputFiles` + Credential.pkl pairing used to do, lists it in
+`additionalCredentialConfigs` instead. Set `identityProperties = false` to keep
+Credential.pkl's output shape (envelope, no hidden identity properties). See
+[CredentialConfig](#credentialconfig--additional-credential-configmaps).
+
 Widget classes come from the modern `Widgets.pkl` module (not the older `Config.pkl`), and
 Credential.pkl re-exports them as unqualified typealiases — mirroring App.pkl — so a credential
 contract writes `new TextInput { }`, `new PasswordInput { }`, `new NestedInput { }`, etc.
diff --git a/contract-toolkit/examples/credential-configs/app.pkl b/contract-toolkit/examples/credential-configs/app.pkl
new file mode 100644
index 0000000000..6acba43e71
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app.pkl
@@ -0,0 +1,41 @@
+/// Credential-configs example: entrypoints that emit more than one credential
+/// configmap, including a bare (wrapper-less) one, via `additionalCredentialConfigs`.
+///
+/// - `export` owns a primary credential (`atlan-connectors-credential-configs`)
+///   and also emits two additional ones: the shared bare object-store config and
+///   a wrapped delivery config.
+/// - `report` has no primary credential (`hasCredentialConfig = false`). Its only
+///   credential config is the shared bare object-store one.
+///
+/// Credential configmaps are hoisted to `app/generated/` and deduped by name, so
+/// the object-store config both entrypoints declare is written once.
+///
+/// Generated layout:
+///   app/generated/atlan-connectors-credential-configs.json            ← export primary
+///   app/generated/atlan-connectors-credential-configs-delivery.json   ← export, wrapped
+///   app/generated/csa-connectors-objectstore.json                     ← both, bare, deduped
+///   app/generated/export/{export.json,manifest.json,_input.py,...}
+///   app/generated/report/{report.json,manifest.json,_input.py,...}
+amends "../../src/App.pkl"
+
+import "export.pkl" as Export
+import "report.pkl" as Report
+
+name = "credential-configs"
+displayName = "Credential Configs Example"
+icon = "https://assets.atlan.com/assets/download.svg"
+// The bundle root owns no credential config; its entrypoints do.
+hasCredentialConfig = false
+
+entrypoints {
+  new Entrypoint {
+    name = "export"
+    displayName = "Export"
+    contract = Export
+  }
+  new Entrypoint {
+    name = "report"
+    displayName = "Report"
+    contract = Report
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app.yaml b/contract-toolkit/examples/credential-configs/app.yaml
new file mode 100644
index 0000000000..94657b54e2
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app.yaml
@@ -0,0 +1,5 @@
+# AUTO-GENERATED from contract/app.pkl — DO NOT EDIT MANUALLY.
+# To regenerate: pkl eval -m . contract/app.pkl
+app_name: credential-configs
+app_image: ${APP_IMAGE}
+app_port: 8000
diff --git a/contract-toolkit/examples/credential-configs/app/generated/atlan-connectors-credential-configs-delivery.json b/contract-toolkit/examples/credential-configs/app/generated/atlan-connectors-credential-configs-delivery.json
new file mode 100644
index 0000000000..72a0d56ec9
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/atlan-connectors-credential-configs-delivery.json
@@ -0,0 +1,163 @@
+{
+  "icon": "https://assets.atlan.com/assets/download.svg",
+  "helpdeskLink": "",
+  "logo": "https://assets.atlan.com/assets/download.svg",
+  "connector": "s3",
+  "defaultConnectorType": "rest",
+  "config": {
+    "properties": {
+      "name": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "label": "Name",
+          "hidden": true,
+          "placeholder": "Host Name"
+        }
+      },
+      "connector": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "label": "Connector",
+          "hidden": true,
+          "placeholder": "Connector"
+        }
+      },
+      "connectorType": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "key": "_host",
+          "label": "connectorType",
+          "placeholder": "connectorType",
+          "hidden": true
+        }
+      },
+      "auth-type": {
+        "type": "string",
+        "enum": [
+          "s3",
+          "email"
+        ],
+        "default": "s3",
+        "required": true,
+        "enumNames": [
+          "S3",
+          "Email"
+        ],
+        "ui": {
+          "widget": "radio",
+          "hidden": false,
+          "label": "Output destination"
+        }
+      },
+      "s3": {
+        "type": "object",
+        "ui": {
+          "widget": "nested",
+          "label": "S3 bucket",
+          "hidden": false,
+          "nestedValue": false
+        },
+        "properties": {
+          "username": {
+            "type": "string",
+            "ui": {
+              "widget": "input",
+              "label": "AWS access key",
+              "hidden": false,
+              "grid": 6
+            }
+          },
+          "password": {
+            "type": "string",
+            "ui": {
+              "widget": "password",
+              "label": "AWS secret key",
+              "hidden": false,
+              "grid": 6
+            }
+          },
+          "extra": {
+            "type": "object",
+            "ui": {
+              "widget": "nested",
+              "label": "",
+              "header": "Advanced",
+              "hidden": false
+            },
+            "properties": {
+              "s3-bucket-name": {
+                "type": "string",
+                "required": true,
+                "ui": {
+                  "widget": "input",
+                  "label": "S3 bucket name",
+                  "hidden": false,
+                  "placeholder": "my-bucket",
+                  "grid": 4
+                }
+              }
+            }
+          }
+        }
+      },
+      "email": {
+        "type": "object",
+        "ui": {
+          "widget": "nested",
+          "label": "Email",
+          "hidden": false,
+          "nestedValue": false
+        },
+        "properties": {
+          "extra": {
+            "type": "object",
+            "ui": {
+              "widget": "nested",
+              "label": "",
+              "header": "Advanced",
+              "hidden": false
+            },
+            "properties": {
+              "recipients": {
+                "type": "string",
+                "required": true,
+                "ui": {
+                  "widget": "input",
+                  "label": "Recipients",
+                  "hidden": false,
+                  "placeholder": "a@example.com",
+                  "grid": 8
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "anyOf": [
+      {
+        "properties": {
+          "auth-type": {
+            "const": "s3"
+          }
+        },
+        "required": [
+          "s3"
+        ]
+      },
+      {
+        "properties": {
+          "auth-type": {
+            "const": "email"
+          }
+        },
+        "required": [
+          "email"
+        ]
+      }
+    ]
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app/generated/atlan-connectors-credential-configs.json b/contract-toolkit/examples/credential-configs/app/generated/atlan-connectors-credential-configs.json
new file mode 100644
index 0000000000..115346e7f6
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/atlan-connectors-credential-configs.json
@@ -0,0 +1,88 @@
+{
+  "icon": "https://assets.atlan.com/assets/download.svg",
+  "helpdeskLink": "",
+  "logo": "https://assets.atlan.com/assets/download.svg",
+  "connector": "s3",
+  "defaultConnectorType": "rest",
+  "config": {
+    "properties": {
+      "name": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "label": "Name",
+          "hidden": true,
+          "placeholder": "Host Name"
+        }
+      },
+      "connector": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "label": "Connector",
+          "hidden": true,
+          "placeholder": "Connector"
+        }
+      },
+      "connectorType": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "key": "_host",
+          "label": "connectorType",
+          "placeholder": "connectorType",
+          "hidden": true
+        }
+      },
+      "auth-type": {
+        "type": "string",
+        "enum": [
+          "api"
+        ],
+        "default": "api",
+        "required": true,
+        "enumNames": [
+          "API token"
+        ],
+        "ui": {
+          "widget": "radio",
+          "hidden": true,
+          "label": "Authentication"
+        }
+      },
+      "api": {
+        "type": "object",
+        "ui": {
+          "widget": "nested",
+          "label": "",
+          "hidden": true,
+          "nestedValue": false
+        },
+        "properties": {
+          "password": {
+            "type": "string",
+            "required": true,
+            "ui": {
+              "widget": "password",
+              "label": "Atlan API token",
+              "hidden": false,
+              "grid": 6
+            }
+          }
+        }
+      }
+    },
+    "anyOf": [
+      {
+        "properties": {
+          "auth-type": {
+            "const": "api"
+          }
+        },
+        "required": [
+          "api"
+        ]
+      }
+    ]
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app/generated/csa-connectors-objectstore.json b/contract-toolkit/examples/credential-configs/app/generated/csa-connectors-objectstore.json
new file mode 100644
index 0000000000..7b99f479da
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/csa-connectors-objectstore.json
@@ -0,0 +1,299 @@
+{
+  "config": {
+    "properties": {
+      "auth-type": {
+        "type": "string",
+        "enum": [
+          "s3",
+          "gcs",
+          "adls"
+        ],
+        "default": "s3",
+        "required": true,
+        "enumNames": [
+          "S3",
+          "GCS",
+          "ADLS"
+        ],
+        "ui": {
+          "widget": "radio",
+          "hidden": false,
+          "label": "Cloud object store",
+          "grid": 8
+        }
+      },
+      "s3": {
+        "type": "object",
+        "ui": {
+          "widget": "nested",
+          "label": "S3",
+          "hidden": false,
+          "help": "Details for accessing information from Amazon S3.",
+          "grid": 8,
+          "nestedValue": false
+        },
+        "properties": {
+          "username": {
+            "type": "string",
+            "required": false,
+            "ui": {
+              "widget": "input",
+              "label": "AWS access key",
+              "hidden": false,
+              "help": "Enter your AWS access key.",
+              "placeholder": "",
+              "grid": 4
+            }
+          },
+          "password": {
+            "type": "string",
+            "required": false,
+            "ui": {
+              "widget": "password",
+              "label": "AWS secret key",
+              "hidden": false,
+              "help": "Enter your AWS secret key.",
+              "grid": 4
+            }
+          },
+          "extra": {
+            "type": "object",
+            "required": false,
+            "ui": {
+              "widget": "nested",
+              "label": "S3 details",
+              "hidden": false,
+              "help": "",
+              "grid": 8,
+              "nestedValue": false
+            },
+            "properties": {
+              "aws_role_arn": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "input",
+                  "label": "AWS Role ARN",
+                  "hidden": false,
+                  "help": "ARN of the AWS role to assume",
+                  "placeholder": "arn:aws:iam::123456789012:role/roleName",
+                  "grid": 8,
+                  "rules": [
+                    {
+                      "message": "Please enter a valid role ARN",
+                      "pattern": "^arn:aws:iam::\\d{12}:role/.+",
+                      "trigger": "blur"
+                    }
+                  ]
+                }
+              },
+              "region": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "input",
+                  "label": "Region",
+                  "hidden": false,
+                  "help": "Enter your AWS region.",
+                  "placeholder": "us-west-1",
+                  "grid": 4
+                }
+              },
+              "s3_bucket": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "input",
+                  "label": "Bucket",
+                  "hidden": false,
+                  "help": "Enter the bucket from which to retrieve the object store object(s).",
+                  "placeholder": "bucket-name",
+                  "grid": 4
+                }
+              }
+            }
+          }
+        }
+      },
+      "gcs": {
+        "type": "object",
+        "ui": {
+          "widget": "nested",
+          "label": "GCS",
+          "hidden": false,
+          "help": "Details for accessing information from Google Cloud Storage (GCS).",
+          "grid": 8,
+          "nestedValue": false
+        },
+        "properties": {
+          "username": {
+            "type": "string",
+            "required": false,
+            "ui": {
+              "widget": "input",
+              "label": "Project ID",
+              "hidden": false,
+              "help": "Enter the ID of the GCP project.",
+              "placeholder": "",
+              "grid": 4
+            }
+          },
+          "password": {
+            "type": "string",
+            "required": false,
+            "ui": {
+              "widget": "password",
+              "label": "Service account JSON",
+              "hidden": false,
+              "help": "Enter the JSON for your service account credentials.",
+              "grid": 8
+            }
+          },
+          "extra": {
+            "type": "object",
+            "required": false,
+            "ui": {
+              "widget": "nested",
+              "label": "GCS details",
+              "hidden": false,
+              "help": "",
+              "grid": 8,
+              "nestedValue": false
+            },
+            "properties": {
+              "gcs_bucket": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "input",
+                  "label": "Bucket",
+                  "hidden": false,
+                  "help": "Enter the bucket from which to retrieve the object store object(s).",
+                  "placeholder": "bucket-name",
+                  "grid": 4
+                }
+              }
+            }
+          }
+        }
+      },
+      "adls": {
+        "type": "object",
+        "ui": {
+          "widget": "nested",
+          "label": "ADLS",
+          "hidden": false,
+          "help": "Details for access information from Azure Data Lake Storage (ADLS).",
+          "grid": 8,
+          "nestedValue": false
+        },
+        "properties": {
+          "username": {
+            "type": "string",
+            "required": false,
+            "ui": {
+              "widget": "input",
+              "label": "Azure client ID",
+              "hidden": false,
+              "help": "Enter the unique application (client) ID assigned to your app by Azure AD when the app was registered.",
+              "placeholder": "",
+              "grid": 4
+            }
+          },
+          "password": {
+            "type": "string",
+            "required": false,
+            "ui": {
+              "widget": "password",
+              "label": "Azure client secret",
+              "hidden": false,
+              "help": "Enter your client secret.",
+              "grid": 4
+            }
+          },
+          "extra": {
+            "type": "object",
+            "required": false,
+            "ui": {
+              "widget": "nested",
+              "label": "ADLS details",
+              "hidden": false,
+              "help": "",
+              "grid": 8,
+              "nestedValue": false
+            },
+            "properties": {
+              "azure_tenant_id": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "password",
+                  "label": "Azure tenant ID",
+                  "hidden": false,
+                  "help": "Enter the unique identifier of the Azure Active Directory instance.",
+                  "grid": 4
+                }
+              },
+              "storage_account_name": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "input",
+                  "label": "Storage account name",
+                  "hidden": false,
+                  "help": "Enter the name of your storage account.",
+                  "placeholder": "",
+                  "grid": 4
+                }
+              },
+              "adls_container": {
+                "type": "string",
+                "required": false,
+                "ui": {
+                  "widget": "input",
+                  "label": "Container",
+                  "hidden": false,
+                  "help": "Enter the container from which to retrieve the object store object(s).",
+                  "placeholder": "container-name",
+                  "grid": 4
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "anyOf": [
+      {
+        "properties": {
+          "auth-type": {
+            "const": "s3"
+          }
+        },
+        "required": [
+          "s3"
+        ]
+      },
+      {
+        "properties": {
+          "auth-type": {
+            "const": "gcs"
+          }
+        },
+        "required": [
+          "gcs"
+        ]
+      },
+      {
+        "properties": {
+          "auth-type": {
+            "const": "adls"
+          }
+        },
+        "required": [
+          "adls"
+        ]
+      }
+    ]
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/__init__.py b/contract-toolkit/examples/credential-configs/app/generated/export/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_base.py b/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_base.py
new file mode 100644
index 0000000000..82d95016f5
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_base.py
@@ -0,0 +1,29 @@
+# Generated from contract/app.pkl via contract-toolkit. DO NOT EDIT.
+# Regenerate with: pkl eval -m . contract/app.pkl
+from application_sdk.testing.e2e import BaseE2ETest
+
+
+class ExportGeneratedE2EBase(BaseE2ETest):
+    connector_short_name = "credential-configs"
+    argo_package_name = "@atlan/credential-configs"
+    argo_template_name = "atlan-credential-configs"
+    app_service_url = (
+        "http://credential-configs.credential-configs-app.svc.cluster.local"
+    )
+    connection_type = "s3"
+    connection_category = "ObjectStore"
+    connector_config_name = "atlan-connectors-credential-configs"
+    # This entrypoint's own manifest. Without it the harness reads the
+    # single-entrypoint default (app/generated/manifest.json), which a bundle
+    # does not have, and fails with ManifestFileNotFoundError.
+    manifest_path = "app/generated/export/manifest.json"
+    # Sent as metadata.entrypoint on the AE submit so Automation Engine
+    # fetches THIS entrypoint's manifest from the deployed pod. A bare fetch
+    # 404s "No manifest available" on a multi-entrypoint app.
+    entrypoint = "export"
+    # Derived from this entrypoint's pipeline, so the assertions match the
+    # DAG that was generated rather than the crawler-shaped SDK defaults.
+    required_dag_nodes = ("extract", "publish")
+    expect_connection = True
+    require_nonempty_assets = True
+    expect_lineage = False
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_credential.py b/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_credential.py
new file mode 100644
index 0000000000..78b8cecd1b
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_credential.py
@@ -0,0 +1,19 @@
+# Generated from contract/app.pkl via contract-toolkit. DO NOT EDIT.
+# Regenerate with: pkl eval -m . contract/app.pkl
+from application_sdk.testing.e2e.credential import CredentialBody
+from pydantic import Field
+
+
+class ExportCredentialBody(CredentialBody):
+    name: str = Field(alias="name")
+    auth_type: str = Field(default="api", alias="authType")
+    password: str = Field(default="", alias="password")
+
+
+class ExportAgentCredentialBody(CredentialBody):
+    name: str = Field(alias="name")
+    auth_type: str = Field(default="api", alias="authType")
+    connector_config_name: str = Field(
+        default="atlan-connectors-credential-configs", alias="connectorConfigName"
+    )
+    extra: dict = Field(default_factory=dict, alias="extra")
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_substitutions.py b/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_substitutions.py
new file mode 100644
index 0000000000..c968c667ac
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/export/_e2e_substitutions.py
@@ -0,0 +1,17 @@
+# Generated from contract/app.pkl via contract-toolkit. DO NOT EDIT.
+# Regenerate with: pkl eval -m . contract/app.pkl
+from __future__ import annotations
+
+from application_sdk.testing.e2e.substitutions import MustacheSubstitutions
+from pydantic import Field
+
+
+class ExportMustacheSubstitutions(MustacheSubstitutions):
+    delivery_credential_guid: str = Field(
+        default="",
+        alias="{{delivery-credential-guid}}",
+    )
+    objectstore_credential_guid: str = Field(
+        default="",
+        alias="{{objectstore-credential-guid}}",
+    )
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/_input.py b/contract-toolkit/examples/credential-configs/app/generated/export/_input.py
new file mode 100644
index 0000000000..bc7255baa6
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/export/_input.py
@@ -0,0 +1,32 @@
+# AUTO-GENERATED from contract/app.pkl — DO NOT EDIT MANUALLY.
+# To regenerate: pkl eval -m . contract/app.pkl
+from __future__ import annotations
+
+from typing import ClassVar
+
+from application_sdk.credentials.ref import CredentialRef
+from application_sdk.templates.contracts import ExtractionInput
+
+
+class ExportAppInputContract(ExtractionInput):
+    _config_hash_exclude: ClassVar[set[str]] = {
+        "output_dir",
+        "checkpoint_dir",
+        "load_to_atlan",
+        "publish_dry_run",
+    }
+
+    delivery_credential_guid: str = ""
+    objectstore_credential_guid: str = ""
+    export_credential: CredentialRef | None = None
+    output_dir: str = ""
+    """Directory for output JSONL files."""
+    checkpoint_dir: str = ""
+    """Directory for checkpoint database. If provided, enables incremental extraction."""
+    load_to_atlan: bool = True
+    """If True, load extracted metadata to Atlan via publish-app."""
+    publish_dry_run: bool = False
+    """When True, skip the Atlas publish step (executor_enabled=False)."""
+
+
+AppInputContract = ExportAppInputContract
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/export.json b/contract-toolkit/examples/credential-configs/app/generated/export/export.json
new file mode 100644
index 0000000000..0af3ba67ba
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/export/export.json
@@ -0,0 +1,67 @@
+{
+  "id": "export",
+  "name": "Export",
+  "logo": "https://assets.atlan.com/assets/download.svg",
+  "config": {
+    "properties": {
+      "credential-guid": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "widget": "credential",
+          "label": "",
+          "hidden": false,
+          "help": "",
+          "grid": 8,
+          "credentialType": "atlan-connectors-credential-configs",
+          "isTestAuthenticationDisabled": false
+        }
+      },
+      "delivery-credential-guid": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "widget": "credential",
+          "label": "",
+          "hidden": false,
+          "help": "",
+          "grid": 8,
+          "credentialType": "atlan-connectors-credential-configs-delivery",
+          "isTestAuthenticationDisabled": false
+        }
+      },
+      "objectstore-credential-guid": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "widget": "credential",
+          "label": "",
+          "hidden": false,
+          "help": "",
+          "grid": 8,
+          "credentialType": "csa-connectors-objectstore",
+          "isTestAuthenticationDisabled": false
+        }
+      }
+    },
+    "steps": [
+      {
+        "title": "Credential",
+        "description": "",
+        "id": "credential",
+        "properties": [
+          "credential-guid"
+        ]
+      },
+      {
+        "title": "Delivery",
+        "description": "",
+        "id": "delivery",
+        "properties": [
+          "delivery-credential-guid",
+          "objectstore-credential-guid"
+        ]
+      }
+    ]
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app/generated/export/manifest.json b/contract-toolkit/examples/credential-configs/app/generated/export/manifest.json
new file mode 100644
index 0000000000..a56ccb0b7b
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/export/manifest.json
@@ -0,0 +1,60 @@
+{
+  "execution_mode": "automation-engine",
+  "dag": {
+    "extract": {
+      "activity_name": "execute_workflow",
+      "activity_display_name": "Extract Export Metadata",
+      "app_name": "export",
+      "inputs": {
+        "workflow_type": "export",
+        "app_name": "export",
+        "app_id": "",
+        "argo_workflow_slug": "",
+        "task_queue": "atlan-export-{deployment_name}",
+        "args": {
+          "app_name": "export",
+          "credential": "{{credential}}",
+          "agent_json": "{{agent-json}}",
+          "extraction_method": "{{extraction-method}}",
+          "credential_guid": "{{credential-guid}}",
+          "delivery_credential_guid": "{{delivery-credential-guid}}",
+          "objectstore_credential_guid": "{{objectstore-credential-guid}}"
+        }
+      },
+      "error_handling": {
+        "start_to_close_timeout_seconds": 86400
+      }
+    },
+    "publish": {
+      "activity_name": "execute_workflow",
+      "activity_display_name": "Publish to Atlas",
+      "app_name": "publish",
+      "inputs": {
+        "workflow_type": "PublishWorkflow",
+        "app_name": "publish",
+        "task_queue": "atlan-publish-{deployment_name}",
+        "args": {
+          "connection_qualified_name": "$.extract.outputs.connection_qualified_name",
+          "transformed_data_prefix": "$.extract.outputs.transformed_data_prefix",
+          "publish_state_prefix": "$.extract.outputs.publish_state_prefix",
+          "current_state_prefix": "$.extract.outputs.current_state_prefix",
+          "connection_creation_enabled": true,
+          "executor_enabled": true,
+          "connection_entity": "{{connection}}",
+          "connection_cache_enabled": true,
+          "connection_cache_via_app_enabled": true,
+          "current_state_enabled": true,
+          "current_state_via_app_enabled": true,
+          "app_name": "publish"
+        }
+      },
+      "depends_on": {
+        "node_id": "extract",
+        "tag": "success"
+      },
+      "error_handling": {
+        "start_to_close_timeout_seconds": 259200
+      }
+    }
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app/generated/report/__init__.py b/contract-toolkit/examples/credential-configs/app/generated/report/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/contract-toolkit/examples/credential-configs/app/generated/report/_e2e_base.py b/contract-toolkit/examples/credential-configs/app/generated/report/_e2e_base.py
new file mode 100644
index 0000000000..a41d908a3b
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/report/_e2e_base.py
@@ -0,0 +1,27 @@
+# Generated from contract/app.pkl via contract-toolkit. DO NOT EDIT.
+# Regenerate with: pkl eval -m . contract/app.pkl
+from application_sdk.testing.e2e import BaseE2ETest
+
+
+class ReportGeneratedE2EBase(BaseE2ETest):
+    connector_short_name = "credential-configs"
+    argo_package_name = "@atlan/credential-configs"
+    argo_template_name = "atlan-credential-configs"
+    app_service_url = (
+        "http://credential-configs.credential-configs-app.svc.cluster.local"
+    )
+    connector_config_name = "atlan-connectors-credential-configs"
+    # This entrypoint's own manifest. Without it the harness reads the
+    # single-entrypoint default (app/generated/manifest.json), which a bundle
+    # does not have, and fails with ManifestFileNotFoundError.
+    manifest_path = "app/generated/report/manifest.json"
+    # Sent as metadata.entrypoint on the AE submit so Automation Engine
+    # fetches THIS entrypoint's manifest from the deployed pod. A bare fetch
+    # 404s "No manifest available" on a multi-entrypoint app.
+    entrypoint = "report"
+    # Derived from this entrypoint's pipeline, so the assertions match the
+    # DAG that was generated rather than the crawler-shaped SDK defaults.
+    required_dag_nodes = ("extract", "publish")
+    expect_connection = True
+    require_nonempty_assets = True
+    expect_lineage = False
diff --git a/contract-toolkit/examples/credential-configs/app/generated/report/_e2e_substitutions.py b/contract-toolkit/examples/credential-configs/app/generated/report/_e2e_substitutions.py
new file mode 100644
index 0000000000..f2f1b6e32d
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/report/_e2e_substitutions.py
@@ -0,0 +1,13 @@
+# Generated from contract/app.pkl via contract-toolkit. DO NOT EDIT.
+# Regenerate with: pkl eval -m . contract/app.pkl
+from __future__ import annotations
+
+from application_sdk.testing.e2e.substitutions import MustacheSubstitutions
+from pydantic import Field
+
+
+class ReportMustacheSubstitutions(MustacheSubstitutions):
+    objectstore_credential_guid: str = Field(
+        default="",
+        alias="{{objectstore-credential-guid}}",
+    )
diff --git a/contract-toolkit/examples/credential-configs/app/generated/report/_input.py b/contract-toolkit/examples/credential-configs/app/generated/report/_input.py
new file mode 100644
index 0000000000..d116f01eb7
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/report/_input.py
@@ -0,0 +1,29 @@
+# AUTO-GENERATED from contract/app.pkl — DO NOT EDIT MANUALLY.
+# To regenerate: pkl eval -m . contract/app.pkl
+from __future__ import annotations
+
+from typing import ClassVar
+
+from application_sdk.templates.contracts import ExtractionInput
+
+
+class ReportAppInputContract(ExtractionInput):
+    _config_hash_exclude: ClassVar[set[str]] = {
+        "output_dir",
+        "checkpoint_dir",
+        "load_to_atlan",
+        "publish_dry_run",
+    }
+
+    objectstore_credential_guid: str = ""
+    output_dir: str = ""
+    """Directory for output JSONL files."""
+    checkpoint_dir: str = ""
+    """Directory for checkpoint database. If provided, enables incremental extraction."""
+    load_to_atlan: bool = True
+    """If True, load extracted metadata to Atlan via publish-app."""
+    publish_dry_run: bool = False
+    """When True, skip the Atlas publish step (executor_enabled=False)."""
+
+
+AppInputContract = ReportAppInputContract
diff --git a/contract-toolkit/examples/credential-configs/app/generated/report/manifest.json b/contract-toolkit/examples/credential-configs/app/generated/report/manifest.json
new file mode 100644
index 0000000000..ca91f7a61f
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/report/manifest.json
@@ -0,0 +1,58 @@
+{
+  "execution_mode": "automation-engine",
+  "dag": {
+    "extract": {
+      "activity_name": "execute_workflow",
+      "activity_display_name": "Extract Report Metadata",
+      "app_name": "report",
+      "inputs": {
+        "workflow_type": "report",
+        "app_name": "report",
+        "app_id": "",
+        "argo_workflow_slug": "",
+        "task_queue": "atlan-report-{deployment_name}",
+        "args": {
+          "app_name": "report",
+          "credential": "{{credential}}",
+          "agent_json": "{{agent-json}}",
+          "extraction_method": "{{extraction-method}}",
+          "objectstore_credential_guid": "{{objectstore-credential-guid}}"
+        }
+      },
+      "error_handling": {
+        "start_to_close_timeout_seconds": 86400
+      }
+    },
+    "publish": {
+      "activity_name": "execute_workflow",
+      "activity_display_name": "Publish to Atlas",
+      "app_name": "publish",
+      "inputs": {
+        "workflow_type": "PublishWorkflow",
+        "app_name": "publish",
+        "task_queue": "atlan-publish-{deployment_name}",
+        "args": {
+          "connection_qualified_name": "$.extract.outputs.connection_qualified_name",
+          "transformed_data_prefix": "$.extract.outputs.transformed_data_prefix",
+          "publish_state_prefix": "$.extract.outputs.publish_state_prefix",
+          "current_state_prefix": "$.extract.outputs.current_state_prefix",
+          "connection_creation_enabled": true,
+          "executor_enabled": true,
+          "connection_entity": "{{connection}}",
+          "connection_cache_enabled": true,
+          "connection_cache_via_app_enabled": true,
+          "current_state_enabled": true,
+          "current_state_via_app_enabled": true,
+          "app_name": "publish"
+        }
+      },
+      "depends_on": {
+        "node_id": "extract",
+        "tag": "success"
+      },
+      "error_handling": {
+        "start_to_close_timeout_seconds": 259200
+      }
+    }
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/app/generated/report/report.json b/contract-toolkit/examples/credential-configs/app/generated/report/report.json
new file mode 100644
index 0000000000..f1e4a2df6c
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/app/generated/report/report.json
@@ -0,0 +1,32 @@
+{
+  "id": "report",
+  "name": "Report",
+  "logo": "https://assets.atlan.com/assets/download.svg",
+  "config": {
+    "properties": {
+      "objectstore-credential-guid": {
+        "type": "string",
+        "required": false,
+        "ui": {
+          "widget": "credential",
+          "label": "",
+          "hidden": false,
+          "help": "",
+          "grid": 8,
+          "credentialType": "csa-connectors-objectstore",
+          "isTestAuthenticationDisabled": false
+        }
+      }
+    },
+    "steps": [
+      {
+        "title": "Delivery",
+        "description": "",
+        "id": "delivery",
+        "properties": [
+          "objectstore-credential-guid"
+        ]
+      }
+    ]
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/atlan.yaml b/contract-toolkit/examples/credential-configs/atlan.yaml
new file mode 100644
index 0000000000..9f48e20735
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/atlan.yaml
@@ -0,0 +1,19 @@
+# AUTO-GENERATED from contract/app.pkl — DO NOT EDIT MANUALLY.
+# To regenerate: pkl eval -m . contract/app.pkl
+name: credential-configs
+display_name: Credential Configs Example
+type: connector
+execution_mode: native
+icon_url: https://assets.atlan.com/assets/download.svg
+visibility: public
+build_tag: v1
+self_deployed_runtime: true
+entrypoints:
+- name: export
+  display_name: Export
+  icon_url: https://assets.atlan.com/assets/download.svg
+  type: connector
+- name: report
+  display_name: Report
+  icon_url: https://assets.atlan.com/assets/download.svg
+  type: connector
diff --git a/contract-toolkit/examples/credential-configs/export.pkl b/contract-toolkit/examples/credential-configs/export.pkl
new file mode 100644
index 0000000000..df2799bab3
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/export.pkl
@@ -0,0 +1,79 @@
+/// Export entrypoint for the credential-configs example.
+///
+/// Emits three credential configmaps: its primary credential, plus two listed in
+/// `additionalCredentialConfigs`, a wrapped delivery config and the shared bare
+/// object-store config.
+amends "../../src/App.pkl"
+
+import "../../src/Connectors.pkl"
+import "objectstore.pkl" as ObjectStore
+
+name = "export"
+displayName = "Export"
+icon = "https://assets.atlan.com/assets/download.svg"
+connector = Connectors.S3
+// Named after the bundle so every entrypoint can share the credType.
+connectorConfigName = "atlan-connectors-credential-configs"
+
+credentialAuthOptions {
+  ["api"] = new AuthOption {
+    label = "API token"
+    fields {
+      new FieldSpec { name = "password"; displayName = "Atlan API token"; sensitive = true; width = 6 }
+    }
+  }
+}
+
+additionalCredentialConfigs {
+  // Wrapped: carries the full credential wrapper and hidden identity properties.
+  // `connector` falls back to the app's.
+  new CredentialConfig {
+    name = "atlan-connectors-credential-configs-delivery"
+    authTitle = "Output destination"
+    authOptions {
+      ["s3"] = new AuthOption {
+        label = "S3"
+        nestedLabel = "S3 bucket"
+        nestedHidden = false
+        fields {
+          new FieldSpec { name = "username"; displayName = "AWS access key"; required = false; width = 6 }
+          new FieldSpec { name = "password"; displayName = "AWS secret key"; sensitive = true; required = false; width = 6 }
+        }
+        extraFields {
+          new FieldSpec { name = "s3-bucket-name"; displayName = "S3 bucket name"; placeholder = "my-bucket"; width = 4 }
+        }
+      }
+      ["email"] = new AuthOption {
+        label = "Email"
+        nestedLabel = "Email"
+        nestedHidden = false
+        extraFields {
+          new FieldSpec { name = "recipients"; displayName = "Recipients"; placeholder = "a@example.com"; width = 8 }
+        }
+      }
+    }
+  }
+  ObjectStore.config
+}
+
+uiConfig = new UIConfig {
+  tasks {
+    ["Credential"] {
+      inputs {
+        ["credential-guid"] = new CredentialInput {
+          credType = "atlan-connectors-credential-configs"
+        }
+      }
+    }
+    ["Delivery"] {
+      inputs {
+        ["delivery-credential-guid"] = new CredentialInput {
+          credType = "atlan-connectors-credential-configs-delivery"
+        }
+        ["objectstore-credential-guid"] = new CredentialInput {
+          credType = "csa-connectors-objectstore"
+        }
+      }
+    }
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/objectstore.pkl b/contract-toolkit/examples/credential-configs/objectstore.pkl
new file mode 100644
index 0000000000..d05773a91c
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/objectstore.pkl
@@ -0,0 +1,102 @@
+// Shared object-store credential config for the credential-configs example.
+//
+// A bare config (`wrapper = false`, `identityProperties = false`): only
+// `{"config": {properties, anyOf}}`, with no credential envelope and no hidden
+// name/connector/connectorType properties. This
+// is the shape of a legacy marketplace credential type such as
+// `csa-connectors-objectstore`, whose existing credentials were created from a
+// form without those properties.
+//
+// Both entrypoints list it in `additionalCredentialConfigs`. The bundle hoists it
+// to `app/generated/csa-connectors-objectstore.json` once, because both copies
+// render identically.
+import "../../src/App.pkl"
+import "../../src/Widgets.pkl"
+
+local function input(label: String, help: String, ph: String, w: Int): App.TextInput = new {
+  title = label
+  helpText = help
+  placeholderText = ph
+  width = w
+}
+
+local function secret(label: String, help: String, w: Int): App.PasswordInput = new {
+  title = label
+  helpText = help
+  width = w
+}
+
+local function details(label: String, inputs_: Mapping<String, App.UIElement>): App.NamedWidget = new {
+  name = "extra"
+  widget = new App.NestedInput {
+    title = label
+    inputs = inputs_
+  }
+}
+
+local function field(n: String, w: App.UIElement): App.NamedWidget = new { name = n; widget = w }
+
+config: App.CredentialConfig = new {
+  name = "csa-connectors-objectstore"
+  wrapper = false
+  identityProperties = false
+  authTitle = "Cloud object store"
+  authDefault = "s3"
+  authWidth = 8
+  authOptions {
+    ["s3"] = new App.AuthOption {
+      label = "S3"
+      nestedLabel = "S3"
+      nestedHidden = false
+      nestedHelp = "Details for accessing information from Amazon S3."
+      nestedWidth = 8
+      fields {
+        field("username", input("AWS access key", "Enter your AWS access key.", "", 4))
+        field("password", secret("AWS secret key", "Enter your AWS secret key.", 4))
+        details("S3 details", new Mapping {
+          ["aws_role_arn"] = (input("AWS Role ARN", "ARN of the AWS role to assume", "arn:aws:iam::123456789012:role/roleName", 8)) {
+            validationRules {
+              new Widgets.ValidationRule {
+                pattern = #"^arn:aws:iam::\d{12}:role/.+"#
+                message = "Please enter a valid role ARN"
+                trigger = "blur"
+              }
+            }
+          }
+          ["region"] = input("Region", "Enter your AWS region.", "us-west-1", 4)
+          ["s3_bucket"] = input("Bucket", "Enter the bucket from which to retrieve the object store object(s).", "bucket-name", 4)
+        })
+      }
+    }
+    ["gcs"] = new App.AuthOption {
+      label = "GCS"
+      nestedLabel = "GCS"
+      nestedHidden = false
+      nestedHelp = "Details for accessing information from Google Cloud Storage (GCS)."
+      nestedWidth = 8
+      fields {
+        field("username", input("Project ID", "Enter the ID of the GCP project.", "", 4))
+        field("password", secret("Service account JSON", "Enter the JSON for your service account credentials.", 8))
+        details("GCS details", new Mapping {
+          ["gcs_bucket"] = input("Bucket", "Enter the bucket from which to retrieve the object store object(s).", "bucket-name", 4)
+        })
+      }
+    }
+    ["adls"] = new App.AuthOption {
+      label = "ADLS"
+      nestedLabel = "ADLS"
+      nestedHidden = false
+      nestedHelp = "Details for access information from Azure Data Lake Storage (ADLS)."
+      nestedWidth = 8
+      fields {
+        field("username", input("Azure client ID", "Enter the unique application (client) ID assigned to your app by Azure AD when the app was registered.", "", 4))
+        field("password", secret("Azure client secret", "Enter your client secret.", 4))
+        details("ADLS details", new Mapping {
+          ["azure_tenant_id"] = secret("Azure tenant ID", "Enter the unique identifier of the Azure Active Directory instance.", 4)
+          ["storage_account_name"] = input("Storage account name", "Enter the name of your storage account.", "", 4)
+          ["adls_container"] = input("Container", "Enter the container from which to retrieve the object store object(s).", "container-name", 4)
+        })
+      }
+    }
+  }
+}
diff --git a/contract-toolkit/examples/credential-configs/report.pkl b/contract-toolkit/examples/credential-configs/report.pkl
new file mode 100644
index 0000000000..20aeb020e8
--- /dev/null
+++ b/contract-toolkit/examples/credential-configs/report.pkl
@@ -0,0 +1,29 @@
+/// Report entrypoint for the credential-configs example.
+///
+/// Has no primary credential (`hasCredentialConfig = false`). Its only
+/// credential configmap is the shared bare object-store config, which the bundle
+/// dedupes with the copy `export` declares.
+amends "../../src/App.pkl"
+
+import "objectstore.pkl" as ObjectStore
+
+name = "report"
+displayName = "Report"
+icon = "https://assets.atlan.com/assets/download.svg"
+hasCredentialConfig = false
+
+additionalCredentialConfigs {
+  ObjectStore.config
+}
+
+uiConfig = new UIConfig {
+  tasks {
+    ["Delivery"] {
+      inputs {
+        ["objectstore-credential-guid"] = new CredentialInput {
+          credType = "csa-connectors-objectstore"
+        }
+      }
+    }
+  }
+}
diff --git a/contract-toolkit/scripts/check-invariants.sh b/contract-toolkit/scripts/check-invariants.sh
index 045557ae02..7ccdf76410 100755
--- a/contract-toolkit/scripts/check-invariants.sh
+++ b/contract-toolkit/scripts/check-invariants.sh
@@ -277,7 +277,7 @@ check_eval_fails() {
   rm -f "$contract"
   rm -rf "$out_dir"
   if ! echo "$err" | grep -q "$expect"; then
-    echo "FAIL: streaming refusal did not fire for $label (expected: $expect)"
+    echo "FAIL: eval-time refusal did not fire for $label (expected: $expect)"
     echo "  Got: $err"
     fail=1
   fi
@@ -1015,6 +1015,60 @@ fi
 rm -f "$DD_CTRL_CONTRACT"
 rm -rf "$DD_CTRL_OUT"
 
+# --------------------------------------------------------------------------
+# 12. FND-4755: additionalCredentialConfigs must be refused, not emitted or
+#     dropped, when the name would escape app/generated/ (or be served as a
+#     setup form), or when an entry sets a field its own flags turn off.
+#     tests/additional_credential_configs_test.pkl covers the rest of the guard.
+# --------------------------------------------------------------------------
+# $1 = CredentialConfig body
+extra_credential_body() {
+  cat <<PKLEOF
+amends "src/App.pkl"
+
+name = "extra-cred-app"
+displayName = "Extra Cred"
+icon = "https://example.com/icon.svg"
+hasCredentialConfig = false
+
+additionalCredentialConfigs {
+  new CredentialConfig {
+    $1
+    authOptions { ["basic"] = new AuthOption { label = "Basic"; fields {} } }
+  }
+}
+
+uiConfig = new UIConfig {
+  tasks {
+    ["Credential"] {
+      inputs { ["c"] = new CredentialInput { credType = "csa-connectors-extra" } }
+    }
+  }
+}
+PKLEOF
+}
+
+echo ":: Checking additionalCredentialConfigs refusals..."
+check_eval_fails "path-traversal name" "lowercase kebab-case" \
+  "$(extra_credential_body 'name = "csa-connectors-x/../../evil"; wrapper = false; identityProperties = false')"
+check_eval_fails "connectorType with wrapper = false" "only the envelope carries" \
+  "$(extra_credential_body 'name = "csa-connectors-extra"; wrapper = false; identityProperties = false; connectorType = "jdbc"')"
+check_eval_fails "namePlaceholder with identityProperties = false" "only the hidden identity properties" \
+  "$(extra_credential_body 'name = "csa-connectors-extra"; wrapper = false; identityProperties = false; namePlaceholder = "Host"')"
+
+# Control: the same bare entry, with nothing the flags turn off, generates.
+XC_CONTRACT="$(mktemp "$REPO_ROOT/test-extra-cred-XXXXXX.pkl")"
+XC_OUT="$(mktemp -d "$REPO_ROOT/test-extra-cred-out-XXXXXX")"
+extra_credential_body 'name = "csa-connectors-extra"; wrapper = false; identityProperties = false' > "$XC_CONTRACT"
+XC_ERR="$(pkl eval -m "$XC_OUT" "$XC_CONTRACT" 2>&1 || true)"
+if [ ! -f "$XC_OUT/app/generated/csa-connectors-extra.json" ]; then
+  echo "FAIL: control bare additional credential config did not generate"
+  echo "  Got: $XC_ERR"
+  fail=1
+fi
+rm -f "$XC_CONTRACT"
+rm -rf "$XC_OUT"
+
 # --------------------------------------------------------------------------
 # Done
 # --------------------------------------------------------------------------
diff --git a/contract-toolkit/src/App.pkl b/contract-toolkit/src/App.pkl
index 30a558c10f..af036c41db 100644
--- a/contract-toolkit/src/App.pkl
+++ b/contract-toolkit/src/App.pkl
@@ -437,6 +437,33 @@ credentialConnectorDefault: String?
 /// Field name for the app's credential reference in the generated Input class.
 credentialFieldName: String? = if (hasCredentialConfig) "\(name.replaceAll("-", "_"))_credential" else null
 
+/// Credential configmaps this contract emits besides the primary
+/// `<connectorConfigName>.json`. Default: none.
+///
+/// Use it when one entrypoint's form selects more than one credential type, or
+/// selects a type that is not its own connection credential. An example is an
+/// object-store delivery target (`CredentialInput { credType = "<name>" }`).
+/// Each entry is a [CredentialConfig], rendered by the same renderer as the
+/// primary config. `wrapper` / `identityProperties` reproduce legacy configs
+/// that lack the envelope keys or the hidden identity properties.
+///
+/// Output: one `app/generated/<name>.json` per entry. In a multi-entrypoint
+/// bundle these are hoisted to `app/generated/` and deduped by name, like the
+/// primary config. Two entrypoints may emit the same name only if the content
+/// is identical.
+///
+/// Unchanged: the primary config, `credentialFieldName`, `_input.py` and the
+/// e2e credential codegen still describe only the primary credential. Works with
+/// `hasCredentialConfig = false`, for an app whose only credentials are these.
+///
+/// Refused at generation on a bundle root (declare it on each entrypoint's
+/// contract), when `uiConfig` is null (nothing could select it), when a name is
+/// not `atlan-connectors-` / `csa-connectors-` plus kebab-case, when names
+/// collide with each other or with the primary / workflow config, when an entry
+/// with `wrapper = true` has no connector, and when an entry sets a field its
+/// flags make it ignore.
+additionalCredentialConfigs: Listing<CredentialConfig> = new Listing {}
+
 // ── WORKFLOW / UI CONFIG ──────────────────────────────────────────────────────
 
 /// The workflow configmap name (e.g., "redshift").
@@ -927,11 +954,98 @@ open class AuthOption {
 
   nestedHidden: Boolean = true
 
+  /// Help text on the nested pane (`ui.help`). Omitted when null.
+  nestedHelp: String?
+
+  /// Width of the nested pane (`ui.grid`; 8 is full width). Omitted when null.
+  nestedWidth: Int?
+
   nestedExtraLabel: String = ""
 
   nestedExtraHeader: String? = "Advanced"
 }
 
+/// One credential configmap a contract emits besides its primary
+/// `<connectorConfigName>.json`. Listed in [additionalCredentialConfigs].
+///
+/// Renders through the same renderer as the primary config, so the auth-type
+/// radio, the per-option panes and the `anyOf` rules have the same shape. The
+/// knobs mirror the top-level `credential*` properties of the same name.
+///
+/// Written to `app/generated/<name>.json` and served at
+/// `/api/service/configmaps/<name>`. A `CredentialInput` selects it with
+/// `credType = "<name>"`.
+class CredentialConfig {
+  /// Configmap name, which is also the file stem and the `credentialType`.
+  /// Must be `atlan-connectors-` or `csa-connectors-` plus lowercase
+  /// kebab-case: the SDK treats only those stems as credential templates, so
+  /// it never serves one as a setup form.
+  name: String
+
+  /// Emit the top-level envelope keys: `icon`, `helpdeskLink`, `logo`,
+  /// `connector`, `defaultConnectorType`. Default `true`, as for the primary.
+  ///
+  /// `false` emits only `{"config": ...}`. Use it only to reproduce a legacy
+  /// configmap that never had them, e.g. the `@atlan/connectors`
+  /// `csa-connectors-objectstore` form: the SDK configmap route returns
+  /// `defaultConnectorType` to the frontend. With `false`, setting `connector`,
+  /// `connectorType`, `icon`, `logo` or `helpdeskLink` is refused, since nothing would read them.
+  wrapper: Boolean = true
+
+  /// Emit the hidden `name` / `connector` / `connectorType` form properties.
+  /// Default `true`, as for the primary.
+  ///
+  /// `false` leaves them out. Use it only for a legacy credential type whose
+  /// form never had them (both `csa-connectors-objectstore` and Credential.pkl
+  /// configs such as generic-miner's object-store form): the frontend submits
+  /// these properties in every credential body, so adding them changes what
+  /// existing credentials of that type look like. With `false`, setting
+  /// `connectorDefault` or `namePlaceholder` is refused.
+  identityProperties: Boolean = true
+
+  /// Top-level `connector`. Defaults to the app's `connector`. Required (here
+  /// or on the app) when `wrapper`.
+  connector: String?
+
+  /// Top-level `defaultConnectorType`. Default `"rest"`. Refused when `!wrapper`.
+  connectorType: String?
+
+  /// Top-level `icon` / `logo` / `helpdeskLink`. Default to the app's.
+  icon: String?
+  logo: String?
+  helpdeskLink: String?
+
+  /// Auth-type options. Each key becomes a radio option and a nested pane.
+  authOptions: Mapping<String, AuthOption>
+
+  /// Fields shared across all auth types, rendered before the radio.
+  commonFields: Listing<CredentialFieldEntry> = new Listing {}
+
+  /// Fields nested under a shared top-level `extra` object.
+  sharedExtraFields: Listing<CredentialFieldEntry> = new Listing {}
+
+  /// Label of the auth-type radio.
+  authTitle: String = "Authentication"
+
+  /// Default auth type. Defaults to the first `authOptions` key.
+  authDefault: String?
+
+  /// Validation rules, placeholder and grid width of the auth-type radio.
+  authRules: Listing<Dynamic>?
+  authPlaceholder: String?
+  authWidth: Int?
+
+  /// Auth-type options hidden during credential creation.
+  authHiddenEnumListForCreating: Listing<String>?
+
+  /// Placeholder for the hidden `name` property. Default `"Host Name"`.
+  /// Refused when `!identityProperties`.
+  namePlaceholder: String?
+
+  /// Default for the hidden `connector` property. Requires `identityProperties`.
+  connectorDefault: String?
+}
+
 // ── JDBC URL credential types ─────────────────────────────────────────────────
 
 abstract class UrlValue {}
@@ -2493,6 +2607,8 @@ local function renderAuthOption(opt: AuthOption): Mapping<String, Any> = new Map
     ["label"] = opt.nestedLabel
     when (opt.nestedPlaceholder != null) { ["placeholder"] = opt.nestedPlaceholder }
     ["hidden"] = opt.nestedHidden
+    when (opt.nestedHelp != null) { ["help"] = opt.nestedHelp }
+    when (opt.nestedWidth != null) { ["grid"] = opt.nestedWidth }
     ["nestedValue"] = false
   }
   when (!opt.fields.isEmpty || !opt.extraFields.isEmpty || !opt.postExtraFields.isEmpty) {
@@ -2552,6 +2668,8 @@ local function renderJdbcAuthOption(opt: AuthOption): Mapping<String, Any> = new
     ["label"] = opt.nestedLabel
     when (opt.nestedPlaceholder != null) { ["placeholder"] = opt.nestedPlaceholder }
     ["hidden"] = opt.nestedHidden
+    when (opt.nestedHelp != null) { ["help"] = opt.nestedHelp }
+    when (opt.nestedWidth != null) { ["grid"] = opt.nestedWidth }
     ["nestedValue"] = false
   }
   when (!opt.fields.isEmpty || !opt.extraFields.isEmpty || !opt.postExtraFields.isEmpty) {
@@ -2988,70 +3106,97 @@ local streamingReservedUiFieldInvariant: Any =
 local credentialAuthHidden: Boolean =
   credentialAuthOptions != null && credentialAuthOptions!!.length == 1
 
-local function generateCredentialConfig(): Mapping<String, Any> =
-  let (_ = jdbcInvariant)
+/// The primary credential config, as a [CredentialConfig] built from the
+/// top-level `credential*` properties. Read only when the primary is emitted
+/// (`hasCredentialConfig && credentialAuthOptions != null`).
+local primaryCredentialConfig: CredentialConfig = new CredentialConfig {
+  name = connectorConfigName
+  connector = module.connector?.value
+  connectorType = credentialConnectorType
+  authOptions = credentialAuthOptions!!
+  commonFields = credentialCommonFields
+  sharedExtraFields = credentialSharedExtraFields
+  authTitle = credentialAuthTitle
+  authDefault = credentialAuthDefault
+  authRules = credentialAuthRules
+  authPlaceholder = credentialAuthPlaceholder
+  authWidth = credentialAuthWidth
+  authHiddenEnumListForCreating = credentialAuthHiddenEnumListForCreating
+  namePlaceholder = credentialNamePlaceholder
+  connectorDefault = credentialConnectorDefault
+}
+
+/// Render one credential configmap. `urlGroup` is the primary's JDBC Host↔URL
+/// form (`credentialUrlGroup`); additional configs pass null.
+local function renderCredentialConfig(c: CredentialConfig, urlGroup: AdvancedJDBCUrlGroup?): Mapping<String, Any> =
+  // Same rule as `credentialAuthHidden`: a one-option radio adds nothing.
+  let (authHidden = c.authOptions.length == 1)
   new Mapping {
-  ["icon"] = icon
-  ["helpdeskLink"] = helpdeskLink
-  ["logo"] = logo
-  ["connector"] = connector?.value
-  ["defaultConnectorType"] = credentialConnectorType
+  when (c.wrapper) {
+    ["icon"] = c.icon ?? icon
+    ["helpdeskLink"] = c.helpdeskLink ?? helpdeskLink
+    ["logo"] = c.logo ?? logo
+    ["connector"] = c.connector ?? connector?.value
+    ["defaultConnectorType"] = c.connectorType ?? "rest"
+  }
   ["config"] = new Mapping {
     ["properties"] = new Mapping {
-      ["name"] = new Mapping {
-        ["type"] = "string"
-        ["required"] = false
-        ["ui"] = new Mapping { ["label"] = "Name"; ["hidden"] = true; ["placeholder"] = credentialNamePlaceholder }
-      }
-      ["connector"] = new Mapping {
-        ["type"] = "string"
-        when (credentialConnectorDefault != null) { ["default"] = credentialConnectorDefault }
-        ["required"] = false
-        ["ui"] = new Mapping { ["label"] = "Connector"; ["hidden"] = true; ["placeholder"] = "Connector" }
-      }
-      ["connectorType"] = new Mapping {
-        ["type"] = "string"
-        ["required"] = false
-        ["ui"] = new Mapping { ["key"] = "_host"; ["label"] = "connectorType"; ["placeholder"] = "connectorType"; ["hidden"] = true }
+      when (c.identityProperties) {
+        ["name"] = new Mapping {
+          ["type"] = "string"
+          ["required"] = false
+          ["ui"] = new Mapping { ["label"] = "Name"; ["hidden"] = true; ["placeholder"] = c.namePlaceholder ?? "Host Name" }
+        }
+        ["connector"] = new Mapping {
+          ["type"] = "string"
+          when (c.connectorDefault != null) { ["default"] = c.connectorDefault }
+          ["required"] = false
+          ["ui"] = new Mapping { ["label"] = "Connector"; ["hidden"] = true; ["placeholder"] = "Connector" }
+        }
+        ["connectorType"] = new Mapping {
+          ["type"] = "string"
+          ["required"] = false
+          ["ui"] = new Mapping { ["key"] = "_host"; ["label"] = "connectorType"; ["placeholder"] = "connectorType"; ["hidden"] = true }
+        }
       }
-      when (credentialUrlGroup == null) {
-        for (f in credentialCommonFields) {
+      when (urlGroup == null) {
+        for (f in c.commonFields) {
           [f.name] = renderAnyField(f)
         }
       }
-      when (credentialUrlGroup != null && credentialAuthOptions != null) {
-        ["connectBy"] = renderConnectByRadio(credentialUrlGroup!!)
-        ["jdbcUrl"] = renderJdbcUrlField(credentialUrlGroup!!, credentialAuthOptions!!)
+      when (urlGroup != null) {
+        ["connectBy"] = renderConnectByRadio(urlGroup!!)
+        ["jdbcUrl"] = renderJdbcUrlField(urlGroup!!, c.authOptions)
         // Top-level copies are agent merge targets only. The visible JDBC auth
         // panes live inside jdbcUrl.properties.
-        for (k, opt in credentialAuthOptions!!) {
+        for (k, opt in c.authOptions) {
           [k] = renderJdbcAuthMergeTargetOption(opt)
         }
       }
-      when (credentialUrlGroup == null && credentialAuthOptions != null) {
+      when (urlGroup == null) {
         ["auth-type"] = new Mapping {
           ["type"] = "string"
-          ["enum"] = new Listing { for (k, _ in credentialAuthOptions!!) { k } }
-          ["default"] = credentialAuthDefault ?? credentialAuthOptions!!.keys.first
+          ["enum"] = new Listing { for (k, _ in c.authOptions) { k } }
+          ["default"] = c.authDefault ?? c.authOptions.keys.first
           ["required"] = true
-          ["enumNames"] = new Listing { for (_, v in credentialAuthOptions!!) { v.label } }
-          when (credentialAuthHiddenEnumListForCreating != null) {
-            ["hiddenEnumListForCreating"] = credentialAuthHiddenEnumListForCreating
+          ["enumNames"] = new Listing { for (_, v in c.authOptions) { v.label } }
+          when (c.authHiddenEnumListForCreating != null) {
+            ["hiddenEnumListForCreating"] = c.authHiddenEnumListForCreating
           }
           ["ui"] = new Mapping {
             ["widget"] = "radio"
-            ["hidden"] = credentialAuthHidden
-            ["label"] = credentialAuthTitle
-            when (credentialAuthRules != null) { ["rules"] = credentialAuthRules }
-            when (credentialAuthPlaceholder != null) { ["placeholder"] = credentialAuthPlaceholder }
-            when (credentialAuthWidth != null) { ["grid"] = credentialAuthWidth }
+            ["hidden"] = authHidden
+            ["label"] = c.authTitle
+            when (c.authRules != null) { ["rules"] = c.authRules }
+            when (c.authPlaceholder != null) { ["placeholder"] = c.authPlaceholder }
+            when (c.authWidth != null) { ["grid"] = c.authWidth }
           }
         }
-        for (k, opt in credentialAuthOptions!!) {
+        for (k, opt in c.authOptions) {
           [k] = renderAuthOption(opt)
         }
       }
-      when (!credentialSharedExtraFields.isEmpty && credentialUrlGroup == null) {
+      when (!c.sharedExtraFields.isEmpty && urlGroup == null) {
         ["extra"] = new Mapping {
           ["type"] = "object"
           ["ui"] = new Mapping {
@@ -3061,16 +3206,16 @@ local function generateCredentialConfig(): Mapping<String, Any> =
             ["hidden"] = false
           }
           ["properties"] = new Mapping {
-            for (f in credentialSharedExtraFields) {
+            for (f in c.sharedExtraFields) {
               [f.name] = renderAnyField(f)
             }
           }
         }
       }
     }
-    when (credentialUrlGroup == null && credentialAuthOptions != null) {
+    when (urlGroup == null) {
       ["anyOf"] = new Listing {
-        for (k, opt in credentialAuthOptions!!) {
+        for (k, opt in c.authOptions) {
           new Mapping {
             ["properties"] = new Mapping {
               ["auth-type"] = new Mapping { ["const"] = k }
@@ -3088,6 +3233,10 @@ local function generateCredentialConfig(): Mapping<String, Any> =
   }
 }
 
+local function generateCredentialConfig(): Mapping<String, Any> =
+  let (_ = jdbcInvariant)
+  renderCredentialConfig(primaryCredentialConfig, credentialUrlGroup)
+
 // ── Manifest / DAG generation ─────────────────────────────────────────────────
 
 /// Auto-detected publish tag pipeline value from uiConfig properties.
@@ -5338,8 +5487,10 @@ local function isCredentialFile(entrypoint: Entrypoint, rawFileName: String): Bo
   let (normalized = normalizeContractFileName(rawFileName))
   normalized != "" &&
   entrypoint.contract != null &&
-  entrypoint.contract!!.hasCredentialConfig &&
-  normalized == "\(entrypoint.contract!!.connectorConfigName).json"
+  ((entrypoint.contract!!.hasCredentialConfig &&
+    normalized == "\(entrypoint.contract!!.connectorConfigName).json") ||
+   entrypoint.contract!!.additionalCredentialConfigs.toList()
+     .any((c) -> normalized == "\(c.name).json"))
 
 local credentialFiles: Listing<ContractFile> = new Listing {
   for (entrypoint in entrypoints) {
@@ -5413,6 +5564,61 @@ local _legacyWorkflowTypesPlacementCheck: Any =
       + "keep App.legacy_workflow_types as the app's only declaration site.")
   else null
 
+/// Rendered additional credential configs, keyed by configmap name.
+local additionalCredentialConfigOutputs: Map<String, FileOutput> =
+  additionalCredentialConfigs.toList().toMap((c) -> c.name, (c) -> new FileOutput {
+    value = renderCredentialConfig(c, null)
+    renderer = new JsonRenderer {}
+  })
+
+/// Refuse an additional credential config that would be silently dropped,
+/// overwritten, mistaken for a setup form, or rendered without a connector.
+local _additionalCredentialConfigsCheck: Any =
+  let (cs = additionalCredentialConfigs.toList())
+  let (names = cs.map((c) -> c.name))
+  // Prefix plus kebab-case only: the name is a file stem under app/generated/,
+  // so `/` or `..` would write outside it or alias another output file.
+  let (badPrefix = names.filter((n) -> !n.matches(Regex(#"(atlan|csa)-connectors-[a-z0-9]+(-[a-z0-9]+)*"#))))
+  let (dupes = names.filter((n) -> names.filter((m) -> m == n).length > 1).distinct)
+  let (reserved = List(workflowConfigName)
+    + (if (hasCredentialConfig && credentialAuthOptions != null) List(connectorConfigName) else List()))
+  let (clashes = names.filter((n) -> reserved.contains(n)))
+  let (noConnector = cs.filter((c) -> c.wrapper && c.connector == null && connector == null).map((c) -> c.name))
+  let (unusedWrapperKeys = cs.filter((c) -> !c.wrapper
+    && (c.connector != null || c.connectorType != null || c.icon != null || c.logo != null
+      || c.helpdeskLink != null)).map((c) -> c.name))
+  let (unusedIdentityKeys = cs.filter((c) -> !c.identityProperties
+    && (c.connectorDefault != null || c.namePlaceholder != null)).map((c) -> c.name))
+  if (cs.isEmpty) null
+  else if (!entrypoints.isEmpty)
+    throw("additionalCredentialConfigs \(names) are declared on a multi-entrypoint bundle root, which "
+      + "renders no setup form or credential config of its own, so they would be dropped. Declare them on "
+      + "the `contract` of each entrypoint whose form selects them; the bundle hoists and dedupes them.")
+  else if (uiConfig == null)
+    throw("additionalCredentialConfigs \(names) are declared on a contract with no uiConfig. "
+      + "Credential configs are emitted only alongside a setup form, so they would be dropped. "
+      + "Declare a uiConfig with a CredentialInput that selects them, or remove them.")
+  else if (!badPrefix.isEmpty)
+    throw("additionalCredentialConfigs name(s) \(badPrefix.join(", ")) must be `atlan-connectors-` or "
+      + "`csa-connectors-` followed by lowercase kebab-case (a-z, 0-9, single hyphens). The SDK treats only "
+      + "those stems as credential templates, so any other stem can be served as the setup form; and the "
+      + "name is a file stem under app/generated/, so `/` or `..` would write outside it.")
+  else if (!dupes.isEmpty)
+    throw("additionalCredentialConfigs declares \(dupes.join(", ")) more than once. Each name is one file.")
+  else if (!clashes.isEmpty)
+    throw("additionalCredentialConfigs name(s) \(clashes.join(", ")) collide with a file this contract "
+      + "already emits (the primary credential config, the workflow config or manifest). Rename them.")
+  else if (!noConnector.isEmpty)
+    throw("additionalCredentialConfigs \(noConnector.join(", ")) render the credential wrapper but have no "
+      + "connector. Set `connector` on the entry or the app, or set `wrapper = false` for a legacy config with no envelope.")
+  else if (!unusedWrapperKeys.isEmpty)
+    throw("additionalCredentialConfigs \(unusedWrapperKeys.join(", ")) set `wrapper = false` but also set "
+      + "`connector`, `connectorType`, `icon`, `logo` or `helpdeskLink`, which only the envelope carries. Remove them.")
+  else if (!unusedIdentityKeys.isEmpty)
+    throw("additionalCredentialConfigs \(unusedIdentityKeys.join(", ")) set `identityProperties = false` but also set "
+      + "`connectorDefault` or `namePlaceholder`, which only the hidden identity properties carry. Remove them.")
+  else null
+
 hidden _credentialConflictCheck: Any =
   if (!credentialConflictNames.isEmpty)
     throw("App.pkl found credential config filename(s) generated with different content: \(credentialConflictNames.join(", ")). "
@@ -5427,6 +5633,7 @@ output =
   let (_jdbcCheck = jdbcInvariant)
   let (_connectorCheck = connectorInvariant)
   let (_credCheck = _credentialConflictCheck)
+  let (_addCredCheck = _additionalCredentialConfigsCheck)
   // Forced here because nothing that renders atlan.yaml reads it, so it would
   // otherwise never be evaluated.
   let (_sysAppCheck = _systemAppCheck)
@@ -5475,6 +5682,9 @@ output =
           when (hasCredentialConfig && credentialAuthOptions != null) {
             ["app/generated/\(connectorConfigName).json"] = credentialConfigOutput
           }
+          for (c in additionalCredentialConfigs) {
+            ["app/generated/\(c.name).json"] = additionalCredentialConfigOutputs[c.name]
+          }
           ["app/generated/manifest.json"] = manifestOutput
         }
         // The input model: from uiConfig, `inputs`, or both. `inputs` alone
diff --git a/contract-toolkit/tests/additional_credential_configs_test.pkl b/contract-toolkit/tests/additional_credential_configs_test.pkl
new file mode 100644
index 0000000000..e4e1f07df7
--- /dev/null
+++ b/contract-toolkit/tests/additional_credential_configs_test.pkl
@@ -0,0 +1,163 @@
+// FND-4755: `additionalCredentialConfigs` lets one contract emit more than one
+// credential configmap. `CredentialConfig.wrapper` and `.identityProperties`
+// independently drop the envelope keys and the hidden identity properties, so a
+// legacy config can be reproduced exactly (`{"config": {properties, anyOf}}` only,
+// or the envelope without identity properties as Credential.pkl rendered it). Each renders through the same
+// renderer as the primary `<connectorConfigName>.json`; a bundle hoists and
+// dedupes them like the primary.
+
+amends "pkl:test"
+
+import "pkl:json"
+
+import "../examples/credential-configs/app.pkl" as bundle
+import "../examples/credential-configs/export.pkl" as export
+import "../examples/credential-configs/report.pkl" as report
+import "../examples/credential-configs/objectstore.pkl" as objectstore
+import "../examples/minimal/app.pkl" as minimalApp
+import "../src/App.pkl" as App
+
+local function parsed(m: Module, path: String): Mapping =
+  (new json.Parser { useMapping = true }.parse(m.output.files[path].text) as Mapping)
+
+local objectstorePath = "app/generated/csa-connectors-objectstore.json"
+local deliveryPath = "app/generated/atlan-connectors-credential-configs-delivery.json"
+
+local bare = parsed(report, objectstorePath)
+local bareProps = bare["config"]["properties"] as Mapping
+local wrapped = parsed(export, deliveryPath)
+local bundleFiles = bundle.output.files.keys
+
+local function withExtra(base: Module, c: App.CredentialConfig) = (base) {
+  additionalCredentialConfigs { c }
+}
+
+local extra = new App.CredentialConfig {
+  name = "atlan-connectors-export-extra"
+  authOptions { ["basic"] = new App.AuthOption { label = "Basic"; fields {} } }
+}
+
+local function err(m: Module): String = module.catch(() -> m.output.files)
+
+facts {
+  ["A bare config is only `config`: no wrapper keys, no hidden identity properties"] {
+    bare.keys == Set("config")
+    bare["config"].keys == Set("properties", "anyOf")
+    !bareProps.containsKey("name")
+    !bareProps.containsKey("connector")
+    !bareProps.containsKey("connectorType")
+    bareProps.keys == Set("auth-type", "s3", "gcs", "adls")
+  }
+
+  ["A bare config keeps the auth-type radio and anyOf rules of the shared renderer"] {
+    bareProps["auth-type"]["enum"].toList() == List("s3", "gcs", "adls")
+    bareProps["auth-type"]["default"] == "s3"
+    bareProps["auth-type"]["ui"]["label"] == "Cloud object store"
+    bareProps["auth-type"]["ui"]["grid"] == 8
+    bare["config"]["anyOf"].toList().map((r) -> r["properties"]["auth-type"]["const"]) == List("s3", "gcs", "adls")
+  }
+
+  ["AuthOption nestedHelp / nestedWidth render on the pane; unset they are omitted"] {
+    bareProps["s3"]["ui"]["help"] == "Details for accessing information from Amazon S3."
+    bareProps["s3"]["ui"]["grid"] == 8
+    !wrapped["config"]["properties"]["s3"]["ui"].containsKey("help")
+    !wrapped["config"]["properties"]["s3"]["ui"].containsKey("grid")
+  }
+
+  ["A wrapped additional config carries the wrapper and falls back to the app's connector"] {
+    wrapped["connector"] == "s3"
+    wrapped["defaultConnectorType"] == "rest"
+    wrapped["icon"] == export.icon
+    wrapped["config"]["properties"].containsKey("name")
+    wrapped["config"]["properties"].containsKey("connectorType")
+  }
+
+  ["A contract emits its primary and every additional config side by side"] {
+    export.output.files.containsKey("app/generated/atlan-connectors-credential-configs.json")
+    export.output.files.containsKey(deliveryPath)
+    export.output.files.containsKey(objectstorePath)
+  }
+
+  ["hasCredentialConfig = false still emits additional configs, and no primary"] {
+    report.output.files.containsKey(objectstorePath)
+    !report.output.files.containsKey("app/generated/atlan-connectors-report.json")
+  }
+
+  ["A bundle hoists additional configs to app/generated/ and dedupes identical ones"] {
+    bundleFiles.contains(objectstorePath)
+    bundleFiles.contains(deliveryPath)
+    bundleFiles.contains("app/generated/atlan-connectors-credential-configs.json")
+    !bundleFiles.any((f) -> f.endsWith("/csa-connectors-objectstore.json") && f != objectstorePath)
+    bundle.output.files[objectstorePath].text == report.output.files[objectstorePath].text
+  }
+
+  ["The shared object-store config is the same value both entrypoints list"] {
+    report.additionalCredentialConfigs.toList().first.name == objectstore.config.name
+  }
+
+  ["Without additionalCredentialConfigs the output is unchanged"] {
+    minimalApp.additionalCredentialConfigs.isEmpty
+    !minimalApp.output.files.keys.any((f) -> f.contains("-extra"))
+  }
+
+  ["A name without a credential-template prefix is refused"] {
+    err(withExtra(export, (extra) { name = "export-extra" })).contains("lowercase kebab-case")
+  }
+
+  ["A name with path characters is refused"] {
+    err(withExtra(export, (extra) { name = "csa-connectors-x/../../evil" })).contains("lowercase kebab-case")
+    err(withExtra(export, (extra) { name = "atlan-connectors-Export" })).contains("lowercase kebab-case")
+  }
+
+  ["A bundle root declaring additional configs is refused, not silently dropped"] {
+    err((bundle) {
+      additionalCredentialConfigs { (extra) { wrapper = false } }
+      uiConfig = report.uiConfig
+    }).contains("bundle root")
+  }
+
+  ["An additional config that differs from another entrypoint's same-named file is refused"] {
+    err((bundle) {
+      entrypoints {
+        new App.Entrypoint {
+          name = "clash"
+          contract = withExtra(report, (extra) { name = export.connectorConfigName; wrapper = false })
+        }
+      }
+    }).contains("different content")
+  }
+
+  ["A name declared twice is refused"] {
+    err((export) { additionalCredentialConfigs { extra; extra } }).contains("more than once")
+  }
+
+  ["A name that collides with the primary config is refused"] {
+    err(withExtra(export, (extra) { name = export.connectorConfigName })).contains("collide")
+  }
+
+  ["A contract with no uiConfig is refused"] {
+    err((withExtra(report, extra)) { uiConfig = null }).contains("no uiConfig")
+  }
+
+  ["A wrapped config with no connector anywhere is refused; one without the envelope is not"] {
+    err(withExtra(report, extra)).contains("no connector")
+    withExtra(report, (extra) { wrapper = false })
+      .output.files.containsKey("app/generated/atlan-connectors-export-extra.json")
+  }
+
+  ["The envelope and the identity properties are independent switches"] {
+    let (envOnly = parsed(withExtra(export, (extra) { identityProperties = false }), "app/generated/atlan-connectors-export-extra.json"))
+      envOnly.containsKey("defaultConnectorType")
+        && !envOnly["config"]["properties"].containsKey("name")
+        && !envOnly["config"]["properties"].containsKey("connectorType")
+    let (idOnly = parsed(withExtra(export, (extra) { wrapper = false }), "app/generated/atlan-connectors-export-extra.json"))
+      idOnly.keys == Set("config") && idOnly["config"]["properties"].containsKey("connectorType")
+  }
+
+  ["Fields a flag makes unused are refused rather than ignored"] {
+    err(withExtra(export, (extra) { wrapper = false; icon = "x" })).contains("only the envelope carries")
+    err(withExtra(export, (extra) { wrapper = false; connectorType = "jdbc" })).contains("only the envelope carries")
+    err(withExtra(export, (extra) { identityProperties = false; connectorDefault = "s3" })).contains("only the hidden")
+    err(withExtra(export, (extra) { identityProperties = false; namePlaceholder = "Host" })).contains("only the hidden")
+  }
+}