diff --git a/Makefile b/Makefile
index 9e0b3f58d8c..02ab1378920 100644
--- a/Makefile
+++ b/Makefile
@@ -1352,7 +1352,7 @@ protos/format: buf/installed
 .PHONY: protos/lint
 protos/lint: buf/installed
 	$(BUF) lint
-	$(BUF) lint --config=api/proto/buf-legacy.yaml api/proto
+	$(BUF) lint --config=buf-legacy.yaml api/proto
 
 .PHONY: protos/breaking
 protos/breaking: BASE=origin/master
diff --git a/api/proto/buf.lock b/api/proto/buf.lock
deleted file mode 100644
index 35a2cdf16b4..00000000000
--- a/api/proto/buf.lock
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by buf. DO NOT EDIT.
-version: v1
-deps:
-  - remote: buf.build
-    owner: gogo
-    repository: protobuf
-    commit: 4df00b267f944190a229ce3695781e99
-  - remote: buf.build
-    owner: googleapis
-    repository: googleapis
-    commit: d1263fe26f8e430a967dc22a4d0cad18
diff --git a/api/proto/buf.yaml b/api/proto/buf.yaml
deleted file mode 100644
index dbc4011a20b..00000000000
--- a/api/proto/buf.yaml
+++ /dev/null
@@ -1,65 +0,0 @@
-version: v1
-deps:
-  # gogo/protobuf v1.3.2, keep in sync with build.assets/Makefile.
-  - buf.build/gogo/protobuf:b03c65ea87cdc3521ede29f62fe3ce239267c1bc
-  - buf.build/googleapis/googleapis:beb34b4050abfcfff72ff5cc6a28f0afa4043ce0
-lint:
-  use:
-    - DEFAULT
-    - PACKAGE_NO_IMPORT_CYCLE
-    - UNARY_RPC
-    # Top-level types require comments.
-    - COMMENT_ENUM
-    - COMMENT_MESSAGE
-    - COMMENT_RPC
-    - COMMENT_SERVICE
-  except:
-    # Allow Google API-style responses (CreateFoo returns Foo).
-    # See https://cloud.google.com/apis/design/standard_methods.
-    - RPC_REQUEST_RESPONSE_UNIQUE
-    - RPC_RESPONSE_STANDARD_NAME
-  ignore:
-    - teleport/legacy/client/proto/authservice.proto
-    - teleport/legacy/client/proto/certs.proto
-    - teleport/legacy/client/proto/event.proto
-    - teleport/legacy/client/proto/proxyservice.proto
-    - teleport/legacy/types/events/events.proto
-    - teleport/legacy/types/events/athena.proto
-    - teleport/legacy/types/types.proto
-    - teleport/legacy/types/wrappers/wrappers.proto
-  ignore_only:
-    # Allow package/directory mismatch for legacy protos.
-    FIELD_LOWER_SNAKE_CASE:
-      - teleport/legacy/types/device.proto
-    # Allow package/directory mismatch for legacy protos.
-    PACKAGE_DIRECTORY_MATCH:
-      - teleport/legacy/client/proto/joinservice.proto
-      - teleport/legacy/types/device.proto
-      - teleport/legacy/types/webauthn/webauthn.proto
-    # Allow non-versioned packages for legacy protos.
-    PACKAGE_VERSION_SUFFIX:
-      - teleport/legacy/client/proto/joinservice.proto
-      - teleport/legacy/types/device.proto
-      - teleport/legacy/types/webauthn/webauthn.proto
-    # Allow only certain services to use streaming RPCs.
-    #
-    # We should avoid streaming RPCs until we have a compelling reason to use them (e.g. the
-    # implementation needs 1-N messages or the server cannot dial directly to the client).
-    #
-    # Check out the links below. If you still have questions or doubts, reach out to @codingllama.
-    #
-    # https://docs.buf.build/lint/rules#unary_rpc
-    # https://github.com/gravitational/teleport/pull/16043#issuecomment-1235728212
-    # https://github.com/twitchtv/twirp/issues/70#issuecomment-470367807
-    UNARY_RPC:
-      - teleport/devicetrust/v1/devicetrust_service.proto
-      - teleport/legacy/client/proto/joinservice.proto
-      - teleport/transport/v1/transport_service.proto
-      - teleport/auditlog/v1/auditlog.proto
-breaking:
-  use:
-    - WIRE_JSON
-    - ENUM_VALUE_NO_DELETE
-  ignore_only:
-    RESERVED_ENUM_NO_DELETE:
-      - teleport/legacy/types/types.proto
diff --git a/api/proto/buf-legacy.yaml b/buf-legacy.yaml
similarity index 66%
rename from api/proto/buf-legacy.yaml
rename to buf-legacy.yaml
index f458acb5166..f932112d37b 100644
--- a/api/proto/buf-legacy.yaml
+++ b/buf-legacy.yaml
@@ -1,7 +1,16 @@
-version: v1
+# buf-legacy.yaml is used so we can apply tighter settings to legacy protos.
+# This should be used exclusively to lint legacy protos, all other actions
+# should use the default buf.yaml file.
+version: v2
+
+modules:
+  - path: api/proto
+
 deps:
-  # gogo/protobuf v1.3.2, keep in sync with build.assets/Makefile.
+  # gogo/protobuf v1.3.2, keep in sync with build.assets/versions.mk.
   - buf.build/gogo/protobuf:b03c65ea87cdc3521ede29f62fe3ce239267c1bc
+  - buf.build/googleapis/googleapis:beb34b4050abfcfff72ff5cc6a28f0afa4043ce0
+
 lint:
   use:
     - DEFAULT
@@ -26,6 +35,7 @@ lint:
     - RPC_REQUEST_RESPONSE_UNIQUE
     - RPC_REQUEST_STANDARD_NAME
     - RPC_RESPONSE_STANDARD_NAME
+
 breaking:
   use:
     - "buf-legacy.yaml should not be used for buf breaking"
diff --git a/buf.lock b/buf.lock
new file mode 100644
index 00000000000..7166a198d65
--- /dev/null
+++ b/buf.lock
@@ -0,0 +1,9 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/gogo/protobuf
+    commit: 4df00b267f944190a229ce3695781e99
+    digest: b5:f3c59023c8f0138b9262ec9755f9f090d330842d98171b559538c0db2c2aa367879527b8da893b443eb80ba36c7d4102713f9fb5233ca12682cb2a9883442c09
+  - name: buf.build/googleapis/googleapis
+    commit: d1263fe26f8e430a967dc22a4d0cad18
+    digest: b5:8e44f92843e3866793af18ae6b1d4e78e2d537353c267a2d4d362c104e037d2d3b651c46cf19b163be8765162c777eb1abbe2c1e35a33c1f0df11a7ce42e1b85
diff --git a/buf.work.yaml b/buf.work.yaml
deleted file mode 100644
index ed56c80c50a..00000000000
--- a/buf.work.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-version: v1
-directories:
-  - api/proto
-  - proto
diff --git a/buf.yaml b/buf.yaml
new file mode 100644
index 00000000000..a60eb8d9312
--- /dev/null
+++ b/buf.yaml
@@ -0,0 +1,85 @@
+version: v2
+
+modules:
+  - path: api/proto
+  - path: proto
+
+deps:
+  # gogo/protobuf v1.3.2, keep in sync with build.assets/versions.mk.
+  - buf.build/gogo/protobuf:b03c65ea87cdc3521ede29f62fe3ce239267c1bc
+  - buf.build/googleapis/googleapis:beb34b4050abfcfff72ff5cc6a28f0afa4043ce0
+
+lint:
+  use:
+    - COMMENT_ENUM
+    - COMMENT_MESSAGE
+    - COMMENT_RPC
+    - COMMENT_SERVICE
+    - DEFAULT
+    - PACKAGE_NO_IMPORT_CYCLE
+    - UNARY_RPC
+  except:
+    - FIELD_NOT_REQUIRED
+    - RPC_REQUEST_RESPONSE_UNIQUE
+    - RPC_RESPONSE_STANDARD_NAME
+  ignore:
+    - api/proto/teleport/legacy/client/proto/authservice.proto
+    - api/proto/teleport/legacy/client/proto/certs.proto
+    - api/proto/teleport/legacy/client/proto/event.proto
+    - api/proto/teleport/legacy/client/proto/proxyservice.proto
+    - api/proto/teleport/legacy/types/events/athena.proto
+    - api/proto/teleport/legacy/types/events/events.proto
+    - api/proto/teleport/legacy/types/types.proto
+    - api/proto/teleport/legacy/types/wrappers/wrappers.proto
+    - proto/teleport/lib/multiplexer/test/ping.proto
+    - proto/teleport/lib/web/terminal/envelope.proto
+  ignore_only:
+    COMMENT_MESSAGE:
+      - proto/prehog
+      - proto/teleport/lib/teleterm/v1/access_request.proto
+      - proto/teleport/lib/teleterm/v1/app.proto
+      - proto/teleport/lib/teleterm/v1/auth_settings.proto
+      - proto/teleport/lib/teleterm/v1/cluster.proto
+      - proto/teleport/lib/teleterm/v1/database.proto
+      - proto/teleport/lib/teleterm/v1/gateway.proto
+      - proto/teleport/lib/teleterm/v1/kube.proto
+      - proto/teleport/lib/teleterm/v1/label.proto
+      - proto/teleport/lib/teleterm/v1/server.proto
+      - proto/teleport/lib/teleterm/v1/service.proto
+      - proto/teleport/lib/teleterm/v1/tshd_events_service.proto
+      - proto/teleport/lib/teleterm/v1/usage_events.proto
+    COMMENT_RPC:
+      - proto/prehog
+    COMMENT_SERVICE:
+      - proto/prehog
+    FIELD_LOWER_SNAKE_CASE:
+      - api/proto/teleport/legacy/types/device.proto
+    PACKAGE_DIRECTORY_MATCH:
+      - api/proto/teleport/legacy/client/proto/joinservice.proto
+      - api/proto/teleport/legacy/types/device.proto
+      - api/proto/teleport/legacy/types/webauthn/webauthn.proto
+    PACKAGE_VERSION_SUFFIX:
+      - api/proto/teleport/legacy/client/proto/joinservice.proto
+      - api/proto/teleport/legacy/types/device.proto
+      - api/proto/teleport/legacy/types/webauthn/webauthn.proto
+    RPC_REQUEST_STANDARD_NAME:
+      - proto/teleport/lib/teleterm/v1/service.proto
+    UNARY_RPC:
+      - api/proto/teleport/auditlog/v1/auditlog.proto
+      - api/proto/teleport/devicetrust/v1/devicetrust_service.proto
+      - api/proto/teleport/legacy/client/proto/joinservice.proto
+      - api/proto/teleport/transport/v1/transport_service.proto
+      - proto/accessgraph/v1alpha/access_graph_service.proto
+      - proto/teleport/lib/teleterm/v1/service.proto
+  disallow_comment_ignores: true
+
+breaking:
+  use:
+    - ENUM_VALUE_NO_DELETE
+    - WIRE_JSON
+  except:
+    - FIELD_SAME_DEFAULT
+  ignore_only:
+    RESERVED_ENUM_NO_DELETE:
+      - api/proto/teleport/legacy/types/types.proto
+      - proto/teleport/legacy/types/types.proto
diff --git a/proto/buf.yaml b/proto/buf.yaml
deleted file mode 100644
index 2a6b04ab313..00000000000
--- a/proto/buf.yaml
+++ /dev/null
@@ -1,66 +0,0 @@
-version: v1
-deps:
-  # gogo/protobuf v1.3.2, keep in sync with build.assets/Makefile.
-  - buf.build/gogo/protobuf:b03c65ea87cdc3521ede29f62fe3ce239267c1bc
-lint:
-  use:
-    - DEFAULT
-    - PACKAGE_NO_IMPORT_CYCLE
-    - UNARY_RPC
-    # Top-level types require comments.
-    - COMMENT_ENUM
-    - COMMENT_MESSAGE
-    - COMMENT_RPC
-    - COMMENT_SERVICE
-  except:
-    # Allow Google API-style responses (CreateFoo returns Foo).
-    # See https://cloud.google.com/apis/design/standard_methods.
-    - RPC_REQUEST_RESPONSE_UNIQUE
-    - RPC_RESPONSE_STANDARD_NAME
-  ignore:
-    # "legacy" lib protos.
-    - teleport/lib/multiplexer/test/ping.proto
-    - teleport/lib/web/terminal/envelope.proto
-  ignore_only:
-    # Allow only certain services to use streaming RPCs.
-    #
-    # We should avoid streaming RPCs until we have a compelling reason to use them (e.g. the
-    # implementation needs 1-N messages or the server cannot dial directly to the client).
-    #
-    # Check out the links below. If you still have questions or doubts, reach out to @codingllama.
-    #
-    # https://docs.buf.build/lint/rules#unary_rpc
-    # https://github.com/gravitational/teleport/pull/16043#issuecomment-1235728212
-    # https://github.com/twitchtv/twirp/issues/70#issuecomment-470367807
-    UNARY_RPC:
-      - teleport/lib/teleterm/v1/service.proto
-      - accessgraph/v1alpha/access_graph_service.proto
-    # TODO(ravicious): Fix protos and re-enable lib/teleterm lint rules below.
-    RPC_REQUEST_STANDARD_NAME:
-      - teleport/lib/teleterm/v1/service.proto
-    # TODO(espadolini): Fix protos and re-enable prehog lint rules below.
-    COMMENT_MESSAGE:
-      - prehog
-      - teleport/lib/teleterm/v1/access_request.proto
-      - teleport/lib/teleterm/v1/app.proto
-      - teleport/lib/teleterm/v1/auth_settings.proto
-      - teleport/lib/teleterm/v1/cluster.proto
-      - teleport/lib/teleterm/v1/database.proto
-      - teleport/lib/teleterm/v1/gateway.proto
-      - teleport/lib/teleterm/v1/kube.proto
-      - teleport/lib/teleterm/v1/label.proto
-      - teleport/lib/teleterm/v1/server.proto
-      - teleport/lib/teleterm/v1/service.proto
-      - teleport/lib/teleterm/v1/tshd_events_service.proto
-      - teleport/lib/teleterm/v1/usage_events.proto
-    COMMENT_RPC:
-      - prehog
-    COMMENT_SERVICE:
-      - prehog
-breaking:
-  use:
-    - WIRE_JSON
-    - ENUM_VALUE_NO_DELETE
-  ignore_only:
-    RESERVED_ENUM_NO_DELETE:
-      - teleport/legacy/types/types.proto