diff --git a/api/v1/challenge/challenge.pb.go b/api/v1/challenge/challenge.pb.go
index 7c409330..cdaf97bf 100644
--- a/api/v1/challenge/challenge.pb.go
+++ b/api/v1/challenge/challenge.pb.go
@@ -100,7 +100,9 @@ type CreateChallengeRequest struct {
 	// The timeout after which the janitor will have permission to delete the instance.
 	Timeout *durationpb.Duration `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"`
 	// The date after which the janitor will have permission to delete the instance.
-	Until         *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=until,proto3" json:"until,omitempty"`
+	Until *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=until,proto3" json:"until,omitempty"`
+	// A key=value configuration to pass to the instance when created.
+	Config        map[string]string `protobuf:"bytes,6,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -163,6 +165,13 @@ func (x *CreateChallengeRequest) GetUntil() *timestamppb.Timestamp {
 	return nil
 }
 
+func (x *CreateChallengeRequest) GetConfig() map[string]string {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
 type RetrieveChallengeRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The challenge identifier.
@@ -223,8 +232,10 @@ type UpdateChallengeRequest struct {
 	// The timeout after which the janitor will have permission to delete the instances.
 	Timeout *durationpb.Duration `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"`
 	// The date after which the janitor will have permission to delete the instances.
-	Until         *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=until,proto3" json:"until,omitempty"`
-	UpdateMask    *fieldmaskpb.FieldMask `protobuf:"bytes,6,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	Until      *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=until,proto3" json:"until,omitempty"`
+	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,6,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
+	// A key=value configuration to pass to the instance when created.
+	Config        map[string]string `protobuf:"bytes,7,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -301,6 +312,13 @@ func (x *UpdateChallengeRequest) GetUpdateMask() *fieldmaskpb.FieldMask {
 	return nil
 }
 
+func (x *UpdateChallengeRequest) GetConfig() map[string]string {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
 type DeleteChallengeRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The challenge identifier.
@@ -363,7 +381,9 @@ type Challenge struct {
 	// the instances.
 	Until *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=until,proto3" json:"until,omitempty"`
 	// The challenge running instances.
-	Instances     []*instance.Instance `protobuf:"bytes,5,rep,name=instances,proto3" json:"instances,omitempty"`
+	Instances []*instance.Instance `protobuf:"bytes,5,rep,name=instances,proto3" json:"instances,omitempty"`
+	// A key=value configuration to pass to the instance when created.
+	Config        map[string]string `protobuf:"bytes,6,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -433,6 +453,13 @@ func (x *Challenge) GetInstances() []*instance.Instance {
 	return nil
 }
 
+func (x *Challenge) GetConfig() map[string]string {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
 var File_api_v1_challenge_challenge_proto protoreflect.FileDescriptor
 
 var file_api_v1_challenge_challenge_proto_rawDesc = []byte{
@@ -456,7 +483,7 @@ var file_api_v1_challenge_challenge_proto_rawDesc = []byte{
 	0x73, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74,
 	0x61, 0x6e, 0x63, 0x65, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x22, 0xde, 0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x68,
+	0x6f, 0x74, 0x6f, 0x22, 0xed, 0x02, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x68,
 	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a,
 	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a,
 	0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x02, 0x69, 0x64, 0x12, 0x35, 0x0a, 0x08, 0x73, 0x63,
@@ -470,56 +497,82 @@ var file_api_v1_challenge_challenge_proto_rawDesc = []byte{
 	0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
 	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x05, 0x75,
-	0x6e, 0x74, 0x69, 0x6c, 0x22, 0x36, 0x0a, 0x18, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x76, 0x65,
-	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41,
-	0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x02, 0x69, 0x64, 0x22, 0x91, 0x03, 0x0a,
-	0x16, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52,
-	0x02, 0x69, 0x64, 0x12, 0x3a, 0x0a, 0x08, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x19, 0x92, 0x41, 0x12, 0x4a, 0x10, 0x22, 0x62, 0x61, 0x73,
-	0x65, 0x36, 0x34, 0x28, 0x7a, 0x69, 0x70, 0x28, 0x2e, 0x29, 0x29, 0x22, 0xe2, 0x41, 0x01, 0x01,
-	0x48, 0x00, 0x52, 0x08, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x88, 0x01, 0x01, 0x12,
-	0x4e, 0x0a, 0x0f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65,
-	0x67, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76,
-	0x31, 0x2e, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x2e, 0x55, 0x70, 0x64, 0x61,
-	0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x48, 0x01, 0x52, 0x0e, 0x75, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x88, 0x01, 0x01, 0x12,
-	0x39, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x04, 0xe2, 0x41, 0x01,
-	0x01, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x36, 0x0a, 0x05, 0x75, 0x6e,
-	0x74, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
-	0x73, 0x74, 0x61, 0x6d, 0x70, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x05, 0x75, 0x6e, 0x74,
-	0x69, 0x6c, 0x12, 0x3b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73,
-	0x6b, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d,
-	0x61, 0x73, 0x6b, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x73, 0x6b, 0x42,
-	0x0b, 0x0a, 0x09, 0x5f, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x42, 0x12, 0x0a, 0x10,
-	0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
-	0x22, 0x34, 0x0a, 0x16, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65,
-	0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41,
-	0x01, 0x02, 0x52, 0x02, 0x69, 0x64, 0x22, 0x95, 0x02, 0x0a, 0x09, 0x43, 0x68, 0x61, 0x6c, 0x6c,
-	0x65, 0x6e, 0x67, 0x65, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x3a, 0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x26,
-	0x92, 0x41, 0x1f, 0x4a, 0x1d, 0x22, 0x6d, 0x64, 0x35, 0x28, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34,
-	0x28, 0x3c, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x2e, 0x7a, 0x69, 0x70, 0x3e, 0x29,
-	0x29, 0x22, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x39, 0x0a, 0x07,
-	0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x07,
-	0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x36, 0x0a, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x12,
-	0x3d, 0x0a, 0x09, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x42, 0x04, 0xe2,
-	0x41, 0x01, 0x01, 0x52, 0x09, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x73, 0x2a, 0x43,
+	0x6e, 0x74, 0x69, 0x6c, 0x12, 0x52, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x63, 0x68,
+	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x68,
+	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01,
+	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x39, 0x0a, 0x0b, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x22, 0x36, 0x0a, 0x18, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x76, 0x65, 0x43,
+	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03,
+	0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x02, 0x69, 0x64, 0x22, 0xa0, 0x04, 0x0a, 0x16,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x3a, 0x0a, 0x08, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x19, 0x92, 0x41, 0x12, 0x4a, 0x10, 0x22, 0x62, 0x61, 0x73, 0x65,
+	0x36, 0x34, 0x28, 0x7a, 0x69, 0x70, 0x28, 0x2e, 0x29, 0x29, 0x22, 0xe2, 0x41, 0x01, 0x01, 0x48,
+	0x00, 0x52, 0x08, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x88, 0x01, 0x01, 0x12, 0x4e,
+	0x0a, 0x0f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67,
+	0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31,
+	0x2e, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x48, 0x01, 0x52, 0x0e, 0x75, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x88, 0x01, 0x01, 0x12, 0x39,
+	0x0a, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01,
+	0x52, 0x07, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x36, 0x0a, 0x05, 0x75, 0x6e, 0x74,
+	0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x05, 0x75, 0x6e, 0x74, 0x69,
+	0x6c, 0x12, 0x3b, 0x0a, 0x0b, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6d, 0x61, 0x73, 0x6b,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61,
+	0x73, 0x6b, 0x52, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x73, 0x6b, 0x12, 0x52,
+	0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x1a, 0x39, 0x0a, 0x0b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x0b, 0x0a,
+	0x09, 0x5f, 0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x75,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x22, 0x34,
+	0x0a, 0x16, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02,
+	0x52, 0x02, 0x69, 0x64, 0x22, 0x97, 0x03, 0x0a, 0x09, 0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e,
+	0x67, 0x65, 0x12, 0x1a, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a,
+	0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x02, 0x69, 0x64, 0x12, 0x3a,
+	0x0a, 0x04, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x26, 0x92, 0x41,
+	0x1f, 0x4a, 0x1d, 0x22, 0x6d, 0x64, 0x35, 0x28, 0x62, 0x61, 0x73, 0x65, 0x36, 0x34, 0x28, 0x3c,
+	0x73, 0x63, 0x65, 0x6e, 0x61, 0x72, 0x69, 0x6f, 0x2e, 0x7a, 0x69, 0x70, 0x3e, 0x29, 0x29, 0x22,
+	0xe2, 0x41, 0x01, 0x02, 0x52, 0x04, 0x68, 0x61, 0x73, 0x68, 0x12, 0x39, 0x0a, 0x07, 0x74, 0x69,
+	0x6d, 0x65, 0x6f, 0x75, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x07, 0x74, 0x69,
+	0x6d, 0x65, 0x6f, 0x75, 0x74, 0x12, 0x36, 0x0a, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x12, 0x3d, 0x0a,
+	0x09, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x42, 0x04, 0xe2, 0x41, 0x01,
+	0x01, 0x52, 0x09, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x73, 0x12, 0x45, 0x0a, 0x06,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x2e,
+	0x43, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x06, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x1a, 0x39, 0x0a, 0x0b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x2a, 0x43,
 	0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
 	0x12, 0x13, 0x0a, 0x0f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x6e, 0x5f, 0x70, 0x6c,
 	0x61, 0x63, 0x65, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x62, 0x6c, 0x75, 0x65, 0x5f, 0x67, 0x72,
@@ -582,7 +635,7 @@ func file_api_v1_challenge_challenge_proto_rawDescGZIP() []byte {
 }
 
 var file_api_v1_challenge_challenge_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_api_v1_challenge_challenge_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_api_v1_challenge_challenge_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_api_v1_challenge_challenge_proto_goTypes = []any{
 	(UpdateStrategy)(0),              // 0: api.v1.challenge.UpdateStrategy
 	(*CreateChallengeRequest)(nil),   // 1: api.v1.challenge.CreateChallengeRequest
@@ -590,37 +643,43 @@ var file_api_v1_challenge_challenge_proto_goTypes = []any{
 	(*UpdateChallengeRequest)(nil),   // 3: api.v1.challenge.UpdateChallengeRequest
 	(*DeleteChallengeRequest)(nil),   // 4: api.v1.challenge.DeleteChallengeRequest
 	(*Challenge)(nil),                // 5: api.v1.challenge.Challenge
-	(*durationpb.Duration)(nil),      // 6: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),    // 7: google.protobuf.Timestamp
-	(*fieldmaskpb.FieldMask)(nil),    // 8: google.protobuf.FieldMask
-	(*instance.Instance)(nil),        // 9: api.v1.instance.Instance
-	(*emptypb.Empty)(nil),            // 10: google.protobuf.Empty
+	nil,                              // 6: api.v1.challenge.CreateChallengeRequest.ConfigEntry
+	nil,                              // 7: api.v1.challenge.UpdateChallengeRequest.ConfigEntry
+	nil,                              // 8: api.v1.challenge.Challenge.ConfigEntry
+	(*durationpb.Duration)(nil),      // 9: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),    // 10: google.protobuf.Timestamp
+	(*fieldmaskpb.FieldMask)(nil),    // 11: google.protobuf.FieldMask
+	(*instance.Instance)(nil),        // 12: api.v1.instance.Instance
+	(*emptypb.Empty)(nil),            // 13: google.protobuf.Empty
 }
 var file_api_v1_challenge_challenge_proto_depIdxs = []int32{
-	6,  // 0: api.v1.challenge.CreateChallengeRequest.timeout:type_name -> google.protobuf.Duration
-	7,  // 1: api.v1.challenge.CreateChallengeRequest.until:type_name -> google.protobuf.Timestamp
-	0,  // 2: api.v1.challenge.UpdateChallengeRequest.update_strategy:type_name -> api.v1.challenge.UpdateStrategy
-	6,  // 3: api.v1.challenge.UpdateChallengeRequest.timeout:type_name -> google.protobuf.Duration
-	7,  // 4: api.v1.challenge.UpdateChallengeRequest.until:type_name -> google.protobuf.Timestamp
-	8,  // 5: api.v1.challenge.UpdateChallengeRequest.update_mask:type_name -> google.protobuf.FieldMask
-	6,  // 6: api.v1.challenge.Challenge.timeout:type_name -> google.protobuf.Duration
-	7,  // 7: api.v1.challenge.Challenge.until:type_name -> google.protobuf.Timestamp
-	9,  // 8: api.v1.challenge.Challenge.instances:type_name -> api.v1.instance.Instance
-	1,  // 9: api.v1.challenge.ChallengeStore.CreateChallenge:input_type -> api.v1.challenge.CreateChallengeRequest
-	2,  // 10: api.v1.challenge.ChallengeStore.RetrieveChallenge:input_type -> api.v1.challenge.RetrieveChallengeRequest
-	10, // 11: api.v1.challenge.ChallengeStore.QueryChallenge:input_type -> google.protobuf.Empty
-	3,  // 12: api.v1.challenge.ChallengeStore.UpdateChallenge:input_type -> api.v1.challenge.UpdateChallengeRequest
-	4,  // 13: api.v1.challenge.ChallengeStore.DeleteChallenge:input_type -> api.v1.challenge.DeleteChallengeRequest
-	5,  // 14: api.v1.challenge.ChallengeStore.CreateChallenge:output_type -> api.v1.challenge.Challenge
-	5,  // 15: api.v1.challenge.ChallengeStore.RetrieveChallenge:output_type -> api.v1.challenge.Challenge
-	5,  // 16: api.v1.challenge.ChallengeStore.QueryChallenge:output_type -> api.v1.challenge.Challenge
-	5,  // 17: api.v1.challenge.ChallengeStore.UpdateChallenge:output_type -> api.v1.challenge.Challenge
-	10, // 18: api.v1.challenge.ChallengeStore.DeleteChallenge:output_type -> google.protobuf.Empty
-	14, // [14:19] is the sub-list for method output_type
-	9,  // [9:14] is the sub-list for method input_type
-	9,  // [9:9] is the sub-list for extension type_name
-	9,  // [9:9] is the sub-list for extension extendee
-	0,  // [0:9] is the sub-list for field type_name
+	9,  // 0: api.v1.challenge.CreateChallengeRequest.timeout:type_name -> google.protobuf.Duration
+	10, // 1: api.v1.challenge.CreateChallengeRequest.until:type_name -> google.protobuf.Timestamp
+	6,  // 2: api.v1.challenge.CreateChallengeRequest.config:type_name -> api.v1.challenge.CreateChallengeRequest.ConfigEntry
+	0,  // 3: api.v1.challenge.UpdateChallengeRequest.update_strategy:type_name -> api.v1.challenge.UpdateStrategy
+	9,  // 4: api.v1.challenge.UpdateChallengeRequest.timeout:type_name -> google.protobuf.Duration
+	10, // 5: api.v1.challenge.UpdateChallengeRequest.until:type_name -> google.protobuf.Timestamp
+	11, // 6: api.v1.challenge.UpdateChallengeRequest.update_mask:type_name -> google.protobuf.FieldMask
+	7,  // 7: api.v1.challenge.UpdateChallengeRequest.config:type_name -> api.v1.challenge.UpdateChallengeRequest.ConfigEntry
+	9,  // 8: api.v1.challenge.Challenge.timeout:type_name -> google.protobuf.Duration
+	10, // 9: api.v1.challenge.Challenge.until:type_name -> google.protobuf.Timestamp
+	12, // 10: api.v1.challenge.Challenge.instances:type_name -> api.v1.instance.Instance
+	8,  // 11: api.v1.challenge.Challenge.config:type_name -> api.v1.challenge.Challenge.ConfigEntry
+	1,  // 12: api.v1.challenge.ChallengeStore.CreateChallenge:input_type -> api.v1.challenge.CreateChallengeRequest
+	2,  // 13: api.v1.challenge.ChallengeStore.RetrieveChallenge:input_type -> api.v1.challenge.RetrieveChallengeRequest
+	13, // 14: api.v1.challenge.ChallengeStore.QueryChallenge:input_type -> google.protobuf.Empty
+	3,  // 15: api.v1.challenge.ChallengeStore.UpdateChallenge:input_type -> api.v1.challenge.UpdateChallengeRequest
+	4,  // 16: api.v1.challenge.ChallengeStore.DeleteChallenge:input_type -> api.v1.challenge.DeleteChallengeRequest
+	5,  // 17: api.v1.challenge.ChallengeStore.CreateChallenge:output_type -> api.v1.challenge.Challenge
+	5,  // 18: api.v1.challenge.ChallengeStore.RetrieveChallenge:output_type -> api.v1.challenge.Challenge
+	5,  // 19: api.v1.challenge.ChallengeStore.QueryChallenge:output_type -> api.v1.challenge.Challenge
+	5,  // 20: api.v1.challenge.ChallengeStore.UpdateChallenge:output_type -> api.v1.challenge.Challenge
+	13, // 21: api.v1.challenge.ChallengeStore.DeleteChallenge:output_type -> google.protobuf.Empty
+	17, // [17:22] is the sub-list for method output_type
+	12, // [12:17] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_api_v1_challenge_challenge_proto_init() }
@@ -635,7 +694,7 @@ func file_api_v1_challenge_challenge_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_api_v1_challenge_challenge_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   5,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/v1/challenge/challenge.proto b/api/v1/challenge/challenge.proto
index f8f3c065..0f65d05d 100644
--- a/api/v1/challenge/challenge.proto
+++ b/api/v1/challenge/challenge.proto
@@ -83,6 +83,9 @@ message CreateChallengeRequest {
 
     // The date after which the janitor will have permission to delete the instance.
     google.protobuf.Timestamp until = 5 [(google.api.field_behavior) = OPTIONAL];
+
+    // A key=value configuration to pass to the instance when created.
+    map<string, string> config = 6 [(google.api.field_behavior) = OPTIONAL];
 }
 
 message RetrieveChallengeRequest {
@@ -111,6 +114,9 @@ message UpdateChallengeRequest {
     google.protobuf.Timestamp until = 5 [(google.api.field_behavior) = OPTIONAL];
 
     google.protobuf.FieldMask update_mask = 6;
+
+    // A key=value configuration to pass to the instance when created.
+    map<string, string> config = 7 [(google.api.field_behavior) = OPTIONAL];
 }
 
 message DeleteChallengeRequest {
@@ -139,6 +145,9 @@ message Challenge {
 
     // The challenge running instances.
     repeated instance.Instance instances = 5 [(google.api.field_behavior) = OPTIONAL];
+
+    // A key=value configuration to pass to the instance when created.
+    map<string, string> config = 6 [(google.api.field_behavior) = OPTIONAL];
 }
 
 // The UpdateStrategy to use in case of a Challenge scenario update with running instances.
diff --git a/api/v1/challenge/create.go b/api/v1/challenge/create.go
index d9e05eda..5fb7e7d6 100644
--- a/api/v1/challenge/create.go
+++ b/api/v1/challenge/create.go
@@ -111,6 +111,7 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 		Hash:      h,
 		Timeout:   toDuration(req.Timeout),
 		Until:     toTime(req.Until),
+		Config:    req.Config,
 	}
 	if err := fschall.Save(); err != nil {
 		err := &errs.ErrInternal{Sub: err}
@@ -129,6 +130,7 @@ func (store *Store) CreateChallenge(ctx context.Context, req *CreateChallengeReq
 		Timeout:   req.Timeout,
 		Until:     req.Until,
 		Instances: []*instance.Instance{},
+		Config:    req.Config,
 	}
 
 	// 6. Unlock RW challenge
diff --git a/api/v1/challenge/query.go b/api/v1/challenge/query.go
index c142056d..998524f7 100644
--- a/api/v1/challenge/query.go
+++ b/api/v1/challenge/query.go
@@ -125,6 +125,7 @@ func (store *Store) QueryChallenge(_ *emptypb.Empty, server ChallengeStore_Query
 					Until:          until,
 					ConnectionInfo: fsist.ConnectionInfo,
 					Flag:           fsist.Flag,
+					Config:         fsist.Config,
 				})
 			}
 
@@ -134,6 +135,7 @@ func (store *Store) QueryChallenge(_ *emptypb.Empty, server ChallengeStore_Query
 				Timeout:   toPBDuration(fschall.Timeout),
 				Until:     toPBTimestamp(fschall.Until),
 				Instances: ists,
+				Config:    fschall.Config,
 			}); err != nil {
 				cerr <- err
 				return
diff --git a/api/v1/challenge/retrieve.go b/api/v1/challenge/retrieve.go
index cde8bd9b..b7f65c71 100644
--- a/api/v1/challenge/retrieve.go
+++ b/api/v1/challenge/retrieve.go
@@ -125,6 +125,7 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 			Until:          until,
 			ConnectionInfo: fsist.ConnectionInfo,
 			Flag:           fsist.Flag,
+			Config:         fsist.Config,
 		})
 	}
 
@@ -134,6 +135,7 @@ func (store *Store) RetrieveChallenge(ctx context.Context, req *RetrieveChalleng
 		Timeout:   toPBDuration(fschall.Timeout),
 		Until:     toPBTimestamp(fschall.Until),
 		Instances: ists,
+		Config:    fschall.Config,
 	}, nil
 }
 
diff --git a/api/v1/challenge/update.go b/api/v1/challenge/update.go
index 7eaf61af..07b254c5 100644
--- a/api/v1/challenge/update.go
+++ b/api/v1/challenge/update.go
@@ -94,21 +94,18 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 	}
 
 	// 5. Update challenge until/timeout and scenario on filesystem
+	updateConfig := false
 	um := req.GetUpdateMask()
 	if um.IsValid(req) {
 		if slices.Contains(um.Paths, "until") {
-			if req.Until != nil {
-				fschall.Until = toTime(req.Until)
-			} else {
-				fschall.Until = nil
-			}
+			fschall.Until = toTime(req.Until)
 		}
 		if slices.Contains(um.Paths, "timeout") {
-			if req.Timeout != nil {
-				fschall.Timeout = toDuration(req.Timeout)
-			} else {
-				fschall.Timeout = nil
-			}
+			fschall.Timeout = toDuration(req.Timeout)
+		}
+		if slices.Contains(um.Paths, "config") {
+			fschall.Config = req.Config
+			updateConfig = true
 		}
 	}
 
@@ -171,7 +168,11 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 	logger.Info(ctx, "updating challenge",
 		zap.Int("instances", len(iids)),
 		zap.Bool("update_scenario", updateScenario),
+		zap.Bool("update_config", updateConfig),
 	)
+	if req.UpdateStrategy == nil {
+		req.UpdateStrategy = UpdateStrategy_update_in_place.Enum()
+	}
 	relock := &sync.WaitGroup{}
 	relock.Add(len(iids))
 	work := &sync.WaitGroup{}
@@ -222,8 +223,12 @@ func (store *Store) UpdateChallenge(ctx context.Context, req *UpdateChallengeReq
 			fsist.Until = common.ComputeUntil(fschall.Until, fschall.Timeout)
 
 			// 8.d. If scenario is not nil, update it
+			ndir := fschall.Directory
 			if updateScenario {
-				if err := iac.Update(ctx, *oldDir, req.UpdateStrategy.String(), fschall, fsist); err != nil {
+				ndir = *oldDir
+			}
+			if updateScenario || updateConfig {
+				if err := iac.Update(ctx, ndir, req.UpdateStrategy.String(), fschall, fsist); err != nil {
 					cerr <- err
 					return
 				}
diff --git a/api/v1/instance/create.go b/api/v1/instance/create.go
index b19ad3ab..932e3f0d 100644
--- a/api/v1/instance/create.go
+++ b/api/v1/instance/create.go
@@ -128,6 +128,12 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 		)
 		return nil, errs.ErrInternalNoSub
 	}
+	if err := iac.Additional(ctx, stack, fschall.Config, req.Config); err != nil {
+		logger.Error(ctx, "configuring additionals on stack",
+			zap.Error(err),
+		)
+		return nil, errs.ErrInternalNoSub
+	}
 
 	logger.Info(ctx, "creating instance")
 
@@ -148,6 +154,7 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 		Since:       now,
 		LastRenew:   now,
 		Until:       common.ComputeUntil(fschall.Until, fschall.Timeout),
+		Config:      req.Config,
 	}
 	if err := iac.Extract(ctx, stack, sr, fsist); err != nil {
 		logger.Error(ctx, "extracting stack info",
@@ -183,5 +190,6 @@ func (man *Manager) CreateInstance(ctx context.Context, req *CreateInstanceReque
 		Until:          until,
 		ConnectionInfo: fsist.ConnectionInfo,
 		Flag:           fsist.Flag,
+		Config:         req.Config,
 	}, nil
 }
diff --git a/api/v1/instance/instance.pb.go b/api/v1/instance/instance.pb.go
index 92253f88..ea1da585 100644
--- a/api/v1/instance/instance.pb.go
+++ b/api/v1/instance/instance.pb.go
@@ -30,7 +30,9 @@ type CreateInstanceRequest struct {
 	// The challenge identifier
 	ChallengeId string `protobuf:"bytes,1,opt,name=challenge_id,json=challengeId,proto3" json:"challenge_id,omitempty"`
 	// The source (user/team) identifier.
-	SourceId      string `protobuf:"bytes,2,opt,name=source_id,json=sourceId,proto3" json:"source_id,omitempty"`
+	SourceId string `protobuf:"bytes,2,opt,name=source_id,json=sourceId,proto3" json:"source_id,omitempty"`
+	// A key=value configuration to pass to the instance when created.
+	Config        map[string]string `protobuf:"bytes,3,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -79,6 +81,13 @@ func (x *CreateInstanceRequest) GetSourceId() string {
 	return ""
 }
 
+func (x *CreateInstanceRequest) GetConfig() map[string]string {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
 type RetrieveInstanceRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The challenge identifier
@@ -306,7 +315,9 @@ type Instance struct {
 	ConnectionInfo string `protobuf:"bytes,6,opt,name=connection_info,json=connectionInfo,proto3" json:"connection_info,omitempty"`
 	// If specified, the flag that validates the challenge instance.
 	// This avoids shareflag, but don't block sharing solving strategy/write-up.
-	Flag          *string `protobuf:"bytes,7,opt,name=flag,proto3,oneof" json:"flag,omitempty"`
+	Flag *string `protobuf:"bytes,7,opt,name=flag,proto3,oneof" json:"flag,omitempty"`
+	// A key=value configuration to pass to the instance when created.
+	Config        map[string]string `protobuf:"bytes,8,rep,name=config,proto3" json:"config,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -390,6 +401,13 @@ func (x *Instance) GetFlag() string {
 	return ""
 }
 
+func (x *Instance) GetConfig() map[string]string {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
 var File_api_v1_instance_instance_proto protoreflect.FileDescriptor
 
 var file_api_v1_instance_instance_proto_rawDesc = []byte{
@@ -408,111 +426,128 @@ var file_api_v1_instance_instance_proto_rawDesc = []byte{
 	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x2d, 0x67, 0x65, 0x6e, 0x2d, 0x6f, 0x70, 0x65, 0x6e, 0x61,
 	0x70, 0x69, 0x76, 0x32, 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x61, 0x6e, 0x6e,
-	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x6f,
-	0x0a, 0x15, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c, 0x63, 0x68, 0x61, 0x6c, 0x6c,
-	0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92,
-	0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x68, 0x61, 0x6c, 0x6c,
-	0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01,
-	0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x22,
-	0x71, 0x0a, 0x17, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x76, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61,
+	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xfc,
+	0x01, 0x0a, 0x15, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c, 0x63, 0x68, 0x61, 0x6c,
+	0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a,
+	0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x68, 0x61, 0x6c,
+	0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a,
+	0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64,
+	0x12, 0x50, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x32, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x1a, 0x39, 0x0a, 0x0b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x71, 0x0a,
+	0x17, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x76, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c, 0x63, 0x68, 0x61, 0x6c,
+	0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a,
+	0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x68, 0x61, 0x6c,
+	0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a,
+	0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64,
+	0x22, 0x3f, 0x0a, 0x14, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03,
+	0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49,
+	0x64, 0x22, 0x6e, 0x0a, 0x14, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c, 0x63, 0x68, 0x61,
+	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42,
+	0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x68, 0x61,
+	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03,
+	0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49,
+	0x64, 0x22, 0x6f, 0x0a, 0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61,
 	0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c, 0x63, 0x68,
 	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
 	0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x68,
 	0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75,
 	0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41,
 	0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x49, 0x64, 0x22, 0x3f, 0x0a, 0x14, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6e, 0x73, 0x74, 0x61,
-	0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92,
-	0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x49, 0x64, 0x22, 0x6e, 0x0a, 0x14, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x49, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c, 0x63,
-	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b, 0x63,
-	0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92,
-	0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x49, 0x64, 0x22, 0x6f, 0x0a, 0x15, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x49, 0x6e, 0x73,
-	0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x0c,
-	0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0b,
-	0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27, 0x0a, 0x09, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a,
-	0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x49, 0x64, 0x22, 0x97, 0x03, 0x0a, 0x08, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
-	0x65, 0x12, 0x2d, 0x0a, 0x0c, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2,
-	0x41, 0x01, 0x02, 0x52, 0x0b, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64,
-	0x12, 0x27, 0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52,
-	0x08, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x3c, 0x0a, 0x05, 0x73, 0x69, 0x6e,
-	0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02,
-	0x52, 0x05, 0x73, 0x69, 0x6e, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x0a, 0x6c, 0x61, 0x73, 0x74, 0x5f,
-	0x72, 0x65, 0x6e, 0x65, 0x77, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x49, 0x64, 0x22, 0x97, 0x04, 0x0a, 0x08, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12,
+	0x2d, 0x0a, 0x0c, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01,
+	0x02, 0x52, 0x0b, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x49, 0x64, 0x12, 0x27,
+	0x0a, 0x09, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x08, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x64, 0x12, 0x3c, 0x0a, 0x05, 0x73, 0x69, 0x6e, 0x63, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x05,
+	0x73, 0x69, 0x6e, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x0a, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65,
+	0x6e, 0x65, 0x77, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01,
+	0x02, 0x52, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x12, 0x41, 0x0a, 0x05,
+	0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
 	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2,
-	0x41, 0x01, 0x02, 0x52, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x12, 0x41,
-	0x0a, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01,
-	0x31, 0xe2, 0x41, 0x01, 0x01, 0x48, 0x00, 0x52, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x88, 0x01,
-	0x01, 0x12, 0x33, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x69, 0x6e, 0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a,
-	0x01, 0x31, 0xe2, 0x41, 0x01, 0x02, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
-	0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x23, 0x0a, 0x04, 0x66, 0x6c, 0x61, 0x67, 0x18, 0x07,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x01,
-	0x48, 0x01, 0x52, 0x04, 0x66, 0x6c, 0x61, 0x67, 0x88, 0x01, 0x01, 0x42, 0x08, 0x0a, 0x06, 0x5f,
-	0x75, 0x6e, 0x74, 0x69, 0x6c, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x66, 0x6c, 0x61, 0x67, 0x32, 0x95,
-	0x05, 0x0a, 0x0f, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x4d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x72, 0x12, 0x70, 0x0a, 0x0e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x12, 0x26, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e,
-	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73,
-	0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49,
-	0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x3a,
-	0x01, 0x2a, 0x22, 0x10, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x12, 0x8c, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x76,
-	0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12, 0x28, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x74, 0x72,
-	0x69, 0x65, 0x76, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73,
-	0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x22, 0x33,
-	0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2d, 0x12, 0x2b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f,
-	0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2f, 0x7b, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65,
-	0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x7b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f,
-	0x69, 0x64, 0x7d, 0x12, 0x6d, 0x0a, 0x0d, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x12, 0x25, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e,
-	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e,
-	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x22, 0x18, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x12, 0x12, 0x10,
-	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65,
-	0x30, 0x01, 0x12, 0x89, 0x01, 0x0a, 0x0d, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x49, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x12, 0x25, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e,
-	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x49, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e,
-	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x22, 0x36, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x30, 0x3a, 0x01,
-	0x2a, 0x32, 0x2b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61,
-	0x6e, 0x63, 0x65, 0x2f, 0x7b, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69,
-	0x64, 0x7d, 0x2f, 0x7b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x12, 0x85,
-	0x01, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
-	0x65, 0x12, 0x26, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61,
-	0x6e, 0x63, 0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
-	0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
-	0x79, 0x22, 0x33, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2d, 0x2a, 0x2b, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2f, 0x7b, 0x63, 0x68, 0x61,
-	0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x7b, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x42, 0x3c, 0x5a, 0x3a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x74, 0x66, 0x65, 0x72, 0x2d, 0x69, 0x6f, 0x2f, 0x63, 0x68,
-	0x61, 0x6c, 0x6c, 0x2d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x3b, 0x69, 0x6e, 0x73, 0x74,
-	0x61, 0x6e, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x41, 0x01, 0x01, 0x48, 0x00, 0x52, 0x05, 0x75, 0x6e, 0x74, 0x69, 0x6c, 0x88, 0x01, 0x01, 0x12,
+	0x33, 0x0a, 0x0f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x6e,
+	0x66, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31,
+	0xe2, 0x41, 0x01, 0x02, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x23, 0x0a, 0x04, 0x66, 0x6c, 0x61, 0x67, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x09, 0x42, 0x0a, 0x92, 0x41, 0x03, 0x4a, 0x01, 0x31, 0xe2, 0x41, 0x01, 0x01, 0x48, 0x01,
+	0x52, 0x04, 0x66, 0x6c, 0x61, 0x67, 0x88, 0x01, 0x01, 0x12, 0x43, 0x0a, 0x06, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x42, 0x04, 0xe2, 0x41, 0x01, 0x01, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x39,
+	0x0a, 0x0b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x75, 0x6e,
+	0x74, 0x69, 0x6c, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x66, 0x6c, 0x61, 0x67, 0x32, 0x95, 0x05, 0x0a,
+	0x0f, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72,
+	0x12, 0x70, 0x0a, 0x0e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x12, 0x26, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61,
+	0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73,
+	0x74, 0x61, 0x6e, 0x63, 0x65, 0x22, 0x1b, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x15, 0x3a, 0x01, 0x2a,
+	0x22, 0x10, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x12, 0x8c, 0x01, 0x0a, 0x10, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x76, 0x65, 0x49,
+	0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12, 0x28, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31,
+	0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x74, 0x72, 0x69, 0x65,
+	0x76, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61,
+	0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x22, 0x33, 0x82, 0xd3,
+	0xe4, 0x93, 0x02, 0x2d, 0x12, 0x2b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e,
+	0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2f, 0x7b, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67,
+	0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x7b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64,
+	0x7d, 0x12, 0x6d, 0x0a, 0x0d, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x12, 0x25, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x22, 0x18, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x12, 0x12, 0x10, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x30, 0x01,
+	0x12, 0x89, 0x01, 0x0a, 0x0d, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x12, 0x25, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2e, 0x49, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x22, 0x36, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x30, 0x3a, 0x01, 0x2a, 0x32,
+	0x2b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x2f, 0x7b, 0x63, 0x68, 0x61, 0x6c, 0x6c, 0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x7d,
+	0x2f, 0x7b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x12, 0x85, 0x01, 0x0a,
+	0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12,
+	0x26, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x76, 0x31, 0x2e, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63,
+	0x65, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22,
+	0x33, 0x82, 0xd3, 0xe4, 0x93, 0x02, 0x2d, 0x2a, 0x2b, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x2f, 0x7b, 0x63, 0x68, 0x61, 0x6c, 0x6c,
+	0x65, 0x6e, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x7d, 0x2f, 0x7b, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x5f, 0x69, 0x64, 0x7d, 0x42, 0x3c, 0x5a, 0x3a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x63, 0x74, 0x66, 0x65, 0x72, 0x2d, 0x69, 0x6f, 0x2f, 0x63, 0x68, 0x61, 0x6c,
+	0x6c, 0x2d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x72, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x76, 0x31,
+	0x2f, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x3b, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -527,7 +562,7 @@ func file_api_v1_instance_instance_proto_rawDescGZIP() []byte {
 	return file_api_v1_instance_instance_proto_rawDescData
 }
 
-var file_api_v1_instance_instance_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_api_v1_instance_instance_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_api_v1_instance_instance_proto_goTypes = []any{
 	(*CreateInstanceRequest)(nil),   // 0: api.v1.instance.CreateInstanceRequest
 	(*RetrieveInstanceRequest)(nil), // 1: api.v1.instance.RetrieveInstanceRequest
@@ -535,28 +570,32 @@ var file_api_v1_instance_instance_proto_goTypes = []any{
 	(*RenewInstanceRequest)(nil),    // 3: api.v1.instance.RenewInstanceRequest
 	(*DeleteInstanceRequest)(nil),   // 4: api.v1.instance.DeleteInstanceRequest
 	(*Instance)(nil),                // 5: api.v1.instance.Instance
-	(*timestamppb.Timestamp)(nil),   // 6: google.protobuf.Timestamp
-	(*emptypb.Empty)(nil),           // 7: google.protobuf.Empty
+	nil,                             // 6: api.v1.instance.CreateInstanceRequest.ConfigEntry
+	nil,                             // 7: api.v1.instance.Instance.ConfigEntry
+	(*timestamppb.Timestamp)(nil),   // 8: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),           // 9: google.protobuf.Empty
 }
 var file_api_v1_instance_instance_proto_depIdxs = []int32{
-	6, // 0: api.v1.instance.Instance.since:type_name -> google.protobuf.Timestamp
-	6, // 1: api.v1.instance.Instance.last_renew:type_name -> google.protobuf.Timestamp
-	6, // 2: api.v1.instance.Instance.until:type_name -> google.protobuf.Timestamp
-	0, // 3: api.v1.instance.InstanceManager.CreateInstance:input_type -> api.v1.instance.CreateInstanceRequest
-	1, // 4: api.v1.instance.InstanceManager.RetrieveInstance:input_type -> api.v1.instance.RetrieveInstanceRequest
-	2, // 5: api.v1.instance.InstanceManager.QueryInstance:input_type -> api.v1.instance.QueryInstanceRequest
-	3, // 6: api.v1.instance.InstanceManager.RenewInstance:input_type -> api.v1.instance.RenewInstanceRequest
-	4, // 7: api.v1.instance.InstanceManager.DeleteInstance:input_type -> api.v1.instance.DeleteInstanceRequest
-	5, // 8: api.v1.instance.InstanceManager.CreateInstance:output_type -> api.v1.instance.Instance
-	5, // 9: api.v1.instance.InstanceManager.RetrieveInstance:output_type -> api.v1.instance.Instance
-	5, // 10: api.v1.instance.InstanceManager.QueryInstance:output_type -> api.v1.instance.Instance
-	5, // 11: api.v1.instance.InstanceManager.RenewInstance:output_type -> api.v1.instance.Instance
-	7, // 12: api.v1.instance.InstanceManager.DeleteInstance:output_type -> google.protobuf.Empty
-	8, // [8:13] is the sub-list for method output_type
-	3, // [3:8] is the sub-list for method input_type
-	3, // [3:3] is the sub-list for extension type_name
-	3, // [3:3] is the sub-list for extension extendee
-	0, // [0:3] is the sub-list for field type_name
+	6,  // 0: api.v1.instance.CreateInstanceRequest.config:type_name -> api.v1.instance.CreateInstanceRequest.ConfigEntry
+	8,  // 1: api.v1.instance.Instance.since:type_name -> google.protobuf.Timestamp
+	8,  // 2: api.v1.instance.Instance.last_renew:type_name -> google.protobuf.Timestamp
+	8,  // 3: api.v1.instance.Instance.until:type_name -> google.protobuf.Timestamp
+	7,  // 4: api.v1.instance.Instance.config:type_name -> api.v1.instance.Instance.ConfigEntry
+	0,  // 5: api.v1.instance.InstanceManager.CreateInstance:input_type -> api.v1.instance.CreateInstanceRequest
+	1,  // 6: api.v1.instance.InstanceManager.RetrieveInstance:input_type -> api.v1.instance.RetrieveInstanceRequest
+	2,  // 7: api.v1.instance.InstanceManager.QueryInstance:input_type -> api.v1.instance.QueryInstanceRequest
+	3,  // 8: api.v1.instance.InstanceManager.RenewInstance:input_type -> api.v1.instance.RenewInstanceRequest
+	4,  // 9: api.v1.instance.InstanceManager.DeleteInstance:input_type -> api.v1.instance.DeleteInstanceRequest
+	5,  // 10: api.v1.instance.InstanceManager.CreateInstance:output_type -> api.v1.instance.Instance
+	5,  // 11: api.v1.instance.InstanceManager.RetrieveInstance:output_type -> api.v1.instance.Instance
+	5,  // 12: api.v1.instance.InstanceManager.QueryInstance:output_type -> api.v1.instance.Instance
+	5,  // 13: api.v1.instance.InstanceManager.RenewInstance:output_type -> api.v1.instance.Instance
+	9,  // 14: api.v1.instance.InstanceManager.DeleteInstance:output_type -> google.protobuf.Empty
+	10, // [10:15] is the sub-list for method output_type
+	5,  // [5:10] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
 }
 
 func init() { file_api_v1_instance_instance_proto_init() }
@@ -571,7 +610,7 @@ func file_api_v1_instance_instance_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_api_v1_instance_instance_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   6,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/api/v1/instance/instance.proto b/api/v1/instance/instance.proto
index 2893c34a..3dfe988f 100644
--- a/api/v1/instance/instance.proto
+++ b/api/v1/instance/instance.proto
@@ -68,6 +68,9 @@ message CreateInstanceRequest {
 
     // The source (user/team) identifier.
     string source_id = 2 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {example: "1"}, (google.api.field_behavior) = REQUIRED];
+
+    // A key=value configuration to pass to the instance when created.
+    map<string, string> config = 3 [(google.api.field_behavior) = OPTIONAL];
 }
 
 message RetrieveInstanceRequest {
@@ -125,4 +128,7 @@ message Instance {
     // If specified, the flag that validates the challenge instance.
     // This avoids shareflag, but don't block sharing solving strategy/write-up.
     optional string flag = 7 [(grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = {example: "1"}, (google.api.field_behavior) = OPTIONAL];
+
+    // A key=value configuration to pass to the instance when created.
+    map<string, string> config = 8 [(google.api.field_behavior) = OPTIONAL];
 }
diff --git a/api/v1/instance/query.go b/api/v1/instance/query.go
index e46a9239..ca661ee7 100644
--- a/api/v1/instance/query.go
+++ b/api/v1/instance/query.go
@@ -117,6 +117,7 @@ func (man *Manager) QueryInstance(req *QueryInstanceRequest, server InstanceMana
 					Until:          until,
 					ConnectionInfo: fsist.ConnectionInfo,
 					Flag:           fsist.Flag,
+					Config:         fsist.Config,
 				}); err != nil {
 					cerr <- err
 					return
diff --git a/api/v1/instance/retrieve.go b/api/v1/instance/retrieve.go
index 6c25003e..97ec9f62 100644
--- a/api/v1/instance/retrieve.go
+++ b/api/v1/instance/retrieve.go
@@ -137,5 +137,6 @@ func (man *Manager) RetrieveInstance(ctx context.Context, req *RetrieveInstanceR
 		Until:          until,
 		ConnectionInfo: fsist.ConnectionInfo,
 		Flag:           fsist.Flag,
+		Config:         fsist.Config,
 	}, nil
 }
diff --git a/cmd/chall-manager-cli/main.go b/cmd/chall-manager-cli/main.go
index 5fad3054..17c4718d 100644
--- a/cmd/chall-manager-cli/main.go
+++ b/cmd/chall-manager-cli/main.go
@@ -11,6 +11,7 @@ import (
 	"math"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/ctfer-io/chall-manager/api/v1/challenge"
@@ -72,6 +73,9 @@ func main() {
 								Name:   "until",
 								Layout: "02-01-2006",
 							},
+							&cli.StringSliceFlag{
+								Name: "config",
+							},
 						},
 						Action: func(ctx *cli.Context) error {
 							cliChall := ctx.Context.Value(cliChallKey{}).(challenge.ChallengeStoreClient)
@@ -98,6 +102,15 @@ func main() {
 							if ctx.IsSet("until") {
 								until = timestamppb.New(*ctx.Timestamp("until"))
 							}
+							var config map[string]string
+							if ctx.IsSet("config") {
+								slc := ctx.StringSlice("config")
+								config = make(map[string]string, len(slc))
+								for _, kv := range slc {
+									k, v, _ := strings.Cut(kv, "=")
+									config[k] = v
+								}
+							}
 
 							now := time.Now()
 							chall, err := cliChall.CreateChallenge(ctx.Context, &challenge.CreateChallengeRequest{
@@ -105,6 +118,7 @@ func main() {
 								Scenario: scn,
 								Timeout:  timeout,
 								Until:    until,
+								Config:   config,
 							}, grpc.MaxCallSendMsgSize(math.MaxInt64))
 							if err != nil {
 								return err
@@ -164,6 +178,12 @@ func main() {
 							&cli.BoolFlag{
 								Name: "reset-until",
 							},
+							&cli.StringSliceFlag{
+								Name: "config",
+							},
+							&cli.BoolFlag{
+								Name: "reset-config",
+							},
 						},
 						Action: func(ctx *cli.Context) error {
 							cliChall := ctx.Context.Value(cliChallKey{}).(challenge.ChallengeStoreClient)
@@ -213,12 +233,24 @@ func main() {
 									return err
 								}
 							}
+							if ctx.IsSet("config") {
+								if err := um.Append(req, "config"); err != nil {
+									return err
+								}
+								slc := ctx.StringSlice("config")
+								req.Config = make(map[string]string, len(slc))
+								for _, kv := range slc {
+									k, v, _ := strings.Cut(kv, "=")
+									req.Config[k] = v
+								}
+							} else if ctx.Bool("reset-config") {
+								if err := um.Append(req, "config"); err != nil {
+									return err
+								}
+							}
 
-							chall, err := cliChall.UpdateChallenge(ctx.Context, &challenge.UpdateChallengeRequest{
-								Id:         ctx.String("id"),
-								Scenario:   scn,
-								UpdateMask: um,
-							})
+							req.UpdateMask = um
+							chall, err := cliChall.UpdateChallenge(ctx.Context, req)
 							if err != nil {
 								return err
 							}
@@ -274,13 +306,26 @@ func main() {
 								Name:     "source_id",
 								Required: true,
 							},
+							&cli.StringSliceFlag{
+								Name: "config",
+							},
 						},
 						Action: func(ctx *cli.Context) error {
 							cliIst := ctx.Context.Value(cliIstKey{}).(instance.InstanceManagerClient)
 
+							var config map[string]string
+							if ctx.IsSet("config") {
+								slc := ctx.StringSlice("config")
+								config = make(map[string]string, len(slc))
+								for _, kv := range slc {
+									k, v, _ := strings.Cut(kv, "=")
+									config[k] = v
+								}
+							}
 							ist, err := cliIst.CreateInstance(ctx.Context, &instance.CreateInstanceRequest{
 								ChallengeId: ctx.String("challenge_id"),
 								SourceId:    ctx.String("source_id"),
+								Config:      config,
 							})
 							if err != nil {
 								return err
diff --git a/deploy/integration/update_challenge_test.go b/deploy/integration/update_challenge_test.go
index e0bb3a45..7af2edf3 100644
--- a/deploy/integration/update_challenge_test.go
+++ b/deploy/integration/update_challenge_test.go
@@ -44,27 +44,46 @@ func Test_I_Update(t *testing.T) {
 
 	var tests = map[string]struct {
 		Scenario1      []byte
+		FirstConfig    map[string]string
 		Scenario2      []byte
+		SecondConfig   map[string]string
 		UpdateStrategy challenge.UpdateStrategy
 	}{
 		"unchanged-scenario": {
 			Scenario1:      scn2024,
+			FirstConfig:    nil,
 			Scenario2:      scn2024,
+			SecondConfig:   nil,
+			UpdateStrategy: challenge.UpdateStrategy_update_in_place,
+		},
+		"unchanged-scenario-set-config": {
+			Scenario1:   scn2024,
+			FirstConfig: nil,
+			Scenario2:   scn2024,
+			SecondConfig: map[string]string{
+				"something": "something",
+			},
 			UpdateStrategy: challenge.UpdateStrategy_update_in_place,
 		},
 		"update-in-place": {
 			Scenario1:      scn2024,
+			FirstConfig:    nil,
 			Scenario2:      scn2025,
+			SecondConfig:   nil,
 			UpdateStrategy: challenge.UpdateStrategy_update_in_place,
 		},
 		"blue-green": {
 			Scenario1:      scn2024,
+			FirstConfig:    nil,
 			Scenario2:      scn2025,
+			SecondConfig:   nil,
 			UpdateStrategy: challenge.UpdateStrategy_blue_green,
 		},
 		"recreate": {
 			Scenario1:      scn2024,
+			FirstConfig:    nil,
 			Scenario2:      scn2025,
+			SecondConfig:   nil,
 			UpdateStrategy: challenge.UpdateStrategy_recreate,
 		},
 	}
@@ -102,6 +121,7 @@ func Test_I_Update(t *testing.T) {
 						Scenario: scn1,
 						Timeout:  durationpb.New(10 * time.Minute),
 						Until:    nil, // no date limit
+						Config:   tt.FirstConfig,
 					}); !assert.Nil(err) {
 						t.Fatal("got unexpected error")
 					}
@@ -119,6 +139,7 @@ func Test_I_Update(t *testing.T) {
 						Id:             challenge_id,
 						Scenario:       &scn2,
 						UpdateStrategy: &tt.UpdateStrategy,
+						Config:         tt.SecondConfig,
 					}); !assert.Nil(err) {
 						t.Fatal("got unexpected error")
 					}
diff --git a/gen/api/v1/challenge/challenge.swagger.json b/gen/api/v1/challenge/challenge.swagger.json
index 8ae3ad16..cb03979e 100644
--- a/gen/api/v1/challenge/challenge.swagger.json
+++ b/gen/api/v1/challenge/challenge.swagger.json
@@ -206,6 +206,13 @@
         },
         "updateMask": {
           "type": "string"
+        },
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "A key=value configuration to pass to the instance when created."
         }
       },
       "description": "The request to update a challenge."
@@ -239,6 +246,13 @@
             "$ref": "#/definitions/instanceInstance"
           },
           "description": "The challenge running instances."
+        },
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "A key=value configuration to pass to the instance when created."
         }
       },
       "description": "The challenge object that the chall-manager exposes.\nNotice it differs from the internal representation, as it also handles\nfilesystem-related information.",
@@ -268,6 +282,13 @@
           "type": "string",
           "format": "date-time",
           "description": "The date after which the janitor will have permission to delete the instance."
+        },
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "A key=value configuration to pass to the instance when created."
         }
       },
       "description": "The request to create a challenge.",
@@ -326,6 +347,13 @@
           "type": "string",
           "example": 1,
           "description": "If specified, the flag that validates the challenge instance.\nThis avoids shareflag, but don't block sharing solving strategy/write-up."
+        },
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "A key=value configuration to pass to the instance when created."
         }
       },
       "description": "The challenge instance object that the chall-manager exposes.\nNotice it differs from the internal representation, as it handles\nfilesystem-related information.",
diff --git a/gen/api/v1/instance/instance.swagger.json b/gen/api/v1/instance/instance.swagger.json
index 5b72aff1..333d2748 100644
--- a/gen/api/v1/instance/instance.swagger.json
+++ b/gen/api/v1/instance/instance.swagger.json
@@ -227,6 +227,13 @@
           "type": "string",
           "example": 1,
           "description": "The source (user/team) identifier."
+        },
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "A key=value configuration to pass to the instance when created."
         }
       },
       "required": [
@@ -274,6 +281,13 @@
           "type": "string",
           "example": 1,
           "description": "If specified, the flag that validates the challenge instance.\nThis avoids shareflag, but don't block sharing solving strategy/write-up."
+        },
+        "config": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string"
+          },
+          "description": "A key=value configuration to pass to the instance when created."
         }
       },
       "description": "The challenge instance object that the chall-manager exposes.\nNotice it differs from the internal representation, as it handles\nfilesystem-related information.",
diff --git a/go.work.sum b/go.work.sum
index d3414703..a41e4d9d 100644
--- a/go.work.sum
+++ b/go.work.sum
@@ -835,6 +835,8 @@ github.com/gorilla/css v1.0.0/go.mod h1:Dn721qIggHpt4+EFCcTLTU/vk5ySda2ReITrtgBl
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grafana/regexp v0.0.0-20221122212121-6b5c0a4cb7fd/go.mod h1:M5qHK+eWfAv8VR/265dIuEpL3fNfeC21tXXp9itM24A=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 h1:+9834+KizmvFV7pXQGSXQTsaWhq2GjuNUt0aUU0YBYw=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
@@ -844,6 +846,7 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0/go.mod h1:YN5jB8ie0yfIUg6VvR9K
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0/go.mod h1:igFoXX2ELCW06bol23DWPB5BEWfZISOzSP5K2sbLea0=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0/go.mod h1:qztMSjm835F2bXf+5HKAPIS5qsmQDqZna/PgVt4rWtI=
 github.com/hanwen/go-fuse/v2 v2.5.0/go.mod h1:xKwi1cF7nXAOBCXujD5ie0ZKsxc8GGSA1rlMJc+8IJs=
 github.com/hashicorp/consul/api v1.27.0/go.mod h1:JkekNRSou9lANFdt+4IKx3Za7XY0JzzpQjEb4Ivo1c8=
 github.com/hashicorp/cronexpr v1.1.2/go.mod h1:P4wA0KBl9C5q2hABiMO7cp6jcIg96CDh1Efb3g1PWA4=
@@ -869,6 +872,7 @@ github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uG
 github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
 github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/hcl/v2 v2.17.0/go.mod h1:gJyW2PTShkJqQBKpAmPO3yxMxIuoXkOF2TpqXzrQyx4=
+github.com/hashicorp/hcl/v2 v2.18.0/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
 github.com/hashicorp/nomad/api v0.0.0-20230721134942-515895c7690c/go.mod h1:O23qLAZuCx4htdY9zBaO4cJPXgleSFEdq6D/sezGgYE=
 github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
 github.com/hashicorp/vault/sdk v0.6.1 h1:sjZC1z4j5Rh2GXYbkxn5BLK05S1p7+MhW4AgdUmgRUA=
@@ -1697,6 +1701,7 @@ google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHh
 google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 google.golang.org/protobuf v1.34.3-0.20240816073751-94ecbc261689/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.0/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/DataDog/dd-trace-go.v1 v1.27.1/go.mod h1:Sp1lku8WJMvNV0kjDI4Ni/T7J/U3BO5ct5kEaoVU8+I=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/pkg/fs/challenge.go b/pkg/fs/challenge.go
index e82f92b4..56983dee 100644
--- a/pkg/fs/challenge.go
+++ b/pkg/fs/challenge.go
@@ -18,9 +18,10 @@ type Challenge struct {
 	ID        string `json:"id"`
 	Directory string `json:"directory"`
 	// must be kept up coherent with directory content as its sha256 sum of base64(zip(content))
-	Hash    string         `json:"hash"`
-	Until   *time.Time     `json:"until,omitempty"`
-	Timeout *time.Duration `json:"timeout,omitempty"`
+	Hash    string            `json:"hash"`
+	Until   *time.Time        `json:"until,omitempty"`
+	Timeout *time.Duration    `json:"timeout,omitempty"`
+	Config  map[string]string `json:"config,omitempty"`
 }
 
 func ChallengeDirectory(id string) string {
diff --git a/pkg/fs/instance.go b/pkg/fs/instance.go
index 6272a131..c80a1931 100644
--- a/pkg/fs/instance.go
+++ b/pkg/fs/instance.go
@@ -14,15 +14,16 @@ import (
 // Instance is the internal model of an API Instance as it is stored on the
 // filesystem (at `<global.Conf.Directory>/chall/<id>/instance/<id>/info.json`)
 type Instance struct {
-	Identity       string     `json:"identity"`
-	ChallengeID    string     `json:"challenge_id"`
-	SourceID       string     `json:"source_id"`
-	State          any        `json:"state"`
-	Since          time.Time  `json:"since"`
-	LastRenew      time.Time  `json:"last_renew"`
-	Until          *time.Time `json:"until,omitempty"`
-	ConnectionInfo string     `json:"connection_info"`
-	Flag           *string    `json:"flag,omitempty"`
+	Identity       string            `json:"identity"`
+	ChallengeID    string            `json:"challenge_id"`
+	SourceID       string            `json:"source_id"`
+	State          any               `json:"state"`
+	Since          time.Time         `json:"since"`
+	LastRenew      time.Time         `json:"last_renew"`
+	Until          *time.Time        `json:"until,omitempty"`
+	ConnectionInfo string            `json:"connection_info"`
+	Flag           *string           `json:"flag,omitempty"`
+	Config         map[string]string `json:"config,omitempty"`
 }
 
 func InstanceDirectory(challID, sourceID string) string {
diff --git a/pkg/iac/stack.go b/pkg/iac/stack.go
index 3180db13..a66b3562 100644
--- a/pkg/iac/stack.go
+++ b/pkg/iac/stack.go
@@ -2,6 +2,7 @@ package iac
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -115,6 +116,26 @@ func Extract(ctx context.Context, stack auto.Stack, sr auto.UpResult, fsist *fs.
 	return nil
 }
 
+func Additional(ctx context.Context, stack auto.Stack, challConf, istConf map[string]string) error {
+	// Merge configuration, override challenge one with instance if necessary
+	cm := map[string]string{}
+	for k, v := range challConf {
+		cm[k] = v
+	}
+	for k, v := range istConf {
+		cm[k] = v
+	}
+
+	// Marshal in object
+	b, err := json.Marshal(cm)
+	if err != nil {
+		return err
+	}
+
+	// Set in additional configuration
+	return stack.SetConfig(ctx, "additional", auto.ConfigValue{Value: string(b)})
+}
+
 func loadPulumiYml(dir string) ([]byte, string, error) {
 	b, err := os.ReadFile(filepath.Join(dir, "Pulumi.yaml"))
 	if err == nil {
diff --git a/pkg/iac/update.go b/pkg/iac/update.go
index c261e48e..14fd8a25 100644
--- a/pkg/iac/update.go
+++ b/pkg/iac/update.go
@@ -26,7 +26,7 @@ func Update(ctx context.Context, oldDir string, us string, fschall *fs.Challenge
 // Update-In-Place strategy loads the existing stack and state then moves to the
 // new stack and update the state.
 func updateInPlace(ctx context.Context, fschall *fs.Challenge, fsist *fs.Instance) error {
-	return up(ctx, fschall.Directory, fsist.Identity, fsist)
+	return up(ctx, fschall.Directory, fsist.Identity, fschall, fsist)
 }
 
 // Blue Green deployment spins up a new instance in parallel and once
@@ -35,32 +35,31 @@ func blueGreen(ctx context.Context, oldDir string, fschall *fs.Challenge, fsist
 	oldID := fsist.Identity
 	fsist.Identity = identity.Compute(fschall.ID, fsist.SourceID)
 
-	if err := up(ctx, fschall.Directory, fsist.Identity, fsist); err != nil {
+	if err := up(ctx, fschall.Directory, fsist.Identity, fschall, fsist); err != nil {
 		return err
 	}
-	return down(ctx, oldDir, oldID, fsist)
+	return down(ctx, oldDir, oldID, fschall, fsist)
 }
 
 // Recreate destroys the existing instance then spins up a new one.
 func recreate(ctx context.Context, oldDir string, fschall *fs.Challenge, fsist *fs.Instance) error {
-	if err := down(ctx, oldDir, fsist.Identity, fsist); err != nil {
+	if err := down(ctx, oldDir, fsist.Identity, fschall, fsist); err != nil {
 		return err
 	}
-	return up(ctx, fschall.Directory, fsist.Identity, fsist)
+	return up(ctx, fschall.Directory, fsist.Identity, fschall, fsist)
 }
 
-func up(ctx context.Context, dir, id string, fsist *fs.Instance) error {
+func up(ctx context.Context, dir, id string, fschall *fs.Challenge, fsist *fs.Instance) error {
 	global.Log().Info(ctx, "spinning up or updating instance", zap.String("instance", id))
 
 	stack, err := LoadStack(ctx, dir, id)
 	if err != nil {
 		return err
 	}
-	if err := stack.SetAllConfig(ctx, auto.ConfigMap{
-		"identity": auto.ConfigValue{
-			Value: id,
-		},
-	}); err != nil {
+	if err := Additional(ctx, stack, fschall.Config, fsist.Config); err != nil {
+		return err
+	}
+	if err := stack.SetConfig(ctx, "identity", auto.ConfigValue{Value: id}); err != nil {
 		return err
 	}
 
@@ -82,18 +81,17 @@ func up(ctx context.Context, dir, id string, fsist *fs.Instance) error {
 	return nil
 }
 
-func down(ctx context.Context, dir, id string, fsist *fs.Instance) error {
+func down(ctx context.Context, dir, id string, fschall *fs.Challenge, fsist *fs.Instance) error {
 	global.Log().Info(ctx, "destroying instance", zap.String("instance", id))
 
 	stack, err := LoadStack(ctx, dir, id)
 	if err != nil {
 		return err
 	}
-	if err := stack.SetAllConfig(ctx, auto.ConfigMap{
-		"identity": auto.ConfigValue{
-			Value: id,
-		},
-	}); err != nil {
+	if err := Additional(ctx, stack, fschall.Config, fsist.Config); err != nil {
+		return err
+	}
+	if err := stack.SetConfig(ctx, "identity", auto.ConfigValue{Value: id}); err != nil {
 		return err
 	}
 
diff --git a/sdk/entrypoint.go b/sdk/entrypoint.go
index 5f972980..909f3c5d 100644
--- a/sdk/entrypoint.go
+++ b/sdk/entrypoint.go
@@ -102,14 +102,20 @@ type Response struct {
 // Configuration is the struct that contains the flattened configuration
 // from a chall-manager stack up.
 type Configuration struct {
-	Identity string
+	Identity   string
+	Additional map[string]string
 }
 
 // Load flatten the Pulumi stack configuration into a ready-to-use struct.
 func Load(ctx *pulumi.Context, project string) *Configuration {
 	cfg := config.New(ctx, project)
 
+	additional := map[string]string{}
+	if err := cfg.GetObject("additional", &additional); err != nil {
+		panic(err)
+	}
 	return &Configuration{
-		Identity: cfg.Get("identity"),
+		Identity:   cfg.Get("identity"),
+		Additional: additional,
 	}
 }
diff --git a/webdocs/challmaker-guides/create-scenario/index.md b/webdocs/challmaker-guides/create-scenario/index.md
index cf85237f..0e340182 100644
--- a/webdocs/challmaker-guides/create-scenario/index.md
+++ b/webdocs/challmaker-guides/create-scenario/index.md
@@ -145,3 +145,51 @@ If you don't pre-compiled your [scenario](/docs/chall-manager/glossary#scenario)
 
 If you prebuilt the [scenario](/docs/chall-manager/glossary#scenario), you'll only need to pack the `main` binary and `Pulumi.yaml` file.
 {{< /alert >}}
+
+## Use an additional configuration
+
+{{< alert title="Note" color="secondary">}}
+This section represents an **advanced usage** of the Chall-Manager scenario API.
+It should not be used by a beginner.
+{{< /alert >}}
+
+A scenario can get provided [additional configuration](/docs/chall-manager/design/software-development-kit/#additional-configuration) over a _key=value_ map. Using this, you can further configure your scenario at last moment, or even reuse them.
+
+For intance, if your challenge provide a configuration _key=value_ pair for a Docker image to use, and your instance does too for an authorized CIDR, then you might reuse your scenario for multiple use cases.
+
+To configure those values, please refer to the [API documentation](/docs/chall-manager/dev-guides/integrate/).
+From the SDK point of view, you can access those additional configuration _key=value_ pairs as follows.
+
+{{< card code=true header="`main.go`" lang="go" >}}
+package main
+
+import (
+	"github.com/ctfer-io/chall-manager/sdk"
+	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
+)
+
+func main() {
+	sdk.Run(func(req *sdk.Request, resp *sdk.Response, opts ...pulumi.ResourceOption) error {
+		// 1. Get your additional configuration pairs
+		image, ok := req.Config.Additional["image"]
+		if !ok {
+			return missing("image")
+		}
+		cidr, ok := req.Config.Additional["cidr"]
+		if !ok {
+			return missing("cidr")
+		}
+
+		// 2. Use them
+		// ...
+
+		// 3. Return content as always
+		resp.ConnectionInfo = pulumi.String(string(b)).ToStringOutput()
+		return nil
+	})
+}
+
+func missing(key string) error {
+	return fmt.Errorf("missing additional configuration for %s", key)
+}
+{{< /card >}}
diff --git a/webdocs/design/software-development-kit/index.md b/webdocs/design/software-development-kit/index.md
index 85868c00..27440323 100644
--- a/webdocs/design/software-development-kit/index.md
+++ b/webdocs/design/software-development-kit/index.md
@@ -68,6 +68,18 @@ Nevertheless, our differentiation strategy can be the basis of a proper solution
 
 Moreover, it considers a precise scenario of advanced malicious collaborative sources, where shareflag consider malicious collaborative sources only (more "accessible" by definition).
 
+## Additional configuration
+
+When creating your first scenarios, you have a high coupling between your idea and how it is deployed. But as time goes, you create helper functions that abstracts the complexity and does most of the job for you (e.g. the [`kubernetes.ExposedMonopod`](/docs/chall-manager/challmaker-guides/software-development-kit/#kubernetes-exposedmonopod)).
+
+Despite those improvements, for every challenge that are deployed the same way (for instance, on the NoBrackets 2024, more than 90% of the challenges were deployed by the same scenario with a modified configuration), you have to redo the job multiple times: duplicate, reconfigure, compile, archive, test, destroy, push, ...
+
+Furthermore, if you want to provide fine-grained data to the scenario, you could not. For instance, to edit firewall rules to access a bunch of VMs or a CPS, you may want to provide the scenario the requester IP address. This require on-the-fly configuration to be provided to the scenario when the Instance is created.
+
+To solve both problems, we introduced the **additional configuration** _key=value_ pairs. Both the Challenge and the Instance can provide their configuration pairs to the scenario. They are merged from the Instance's pairs over the Challenge's pairs thus enable _key=value_ pair overwrite if necessary, e.g. to overload a default value.
+
+This open the possibility of creating a small set of scenarios that will be reconfigured on the fly by the challenges (e.g. the previous NoBrackets 2024 example could have run over 2 scenarios for 14 challenges).
+
 ## What's next ?
 
 The final step from there is to ensure the quality of our work, with [testing](/docs/chall-manager/design/testing).