diff --git a/.env.example b/.env.example
index 0d2a515..d1df4b9 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,7 @@
 # Barbacane image version to pull from ghcr.io/barbacane-dev
-# Set to a specific release tag (e.g. 0.10.0) to pin the playground to that version.
+# Set to a specific release tag (e.g. 0.11.0) to pin the playground to that version.
 # Use "latest" to always pull the most recent release.
-BARBACANE_VERSION=0.10.0
+BARBACANE_VERSION=0.11.0
 
 # Admin token for the control plane. Since 0.8 the control plane refuses to
 # start without a non-empty token. This is a demo default — change it for any
diff --git a/README.md b/README.md
index f0b0ff1..793fbd5 100644
--- a/README.md
+++ b/README.md
@@ -27,7 +27,7 @@ By default the playground pulls the `latest` images from [GitHub Container Regis
 
 ```bash
 cp .env.example .env
-# Edit .env and set BARBACANE_VERSION=0.10.0 (or any release tag)
+# Edit .env and set BARBACANE_VERSION=0.11.0 (or any release tag)
 docker compose pull
 docker compose up -d
 ```
diff --git a/docker-compose.yml b/docker-compose.yml
index 5817863..47a9a2a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,7 +20,7 @@ services:
   # Spec Compiler (init container - compiles specs before gateway starts)
   # ==========================================================================
   compiler:
-    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.10.0}
+    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.11.0}
     command: ["compile", "--spec", "/specs/train-travel-api.yaml", "--spec", "/specs/train-events.yaml", "--spec", "/specs/s3-proxy.yaml", "--spec", "/specs/waf-demo.yaml", "--manifest", "/manifest/barbacane.yaml", "--output", "/output/api.bca", "--allow-plaintext"]
     # Run as root so the init container can write the shared artifact volume,
     # which is root-owned by default. The gateway mounts it read-only.
@@ -36,7 +36,7 @@ services:
   # API Gateway (Data Plane)
   # ==========================================================================
   barbacane:
-    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.10.0}
+    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.11.0}
     # --admin-bind on 0.0.0.0 exposes the admin API (/health, /metrics,
     # /provenance) to Prometheus and the host. It defaults to loopback, which
     # other containers cannot reach. The admin endpoints are unauthenticated;
@@ -88,7 +88,7 @@ services:
   # Control Plane (Web UI + API)
   # ==========================================================================
   control-plane:
-    image: ghcr.io/barbacane-dev/barbacane-control:${BARBACANE_VERSION:-0.10.0}
+    image: ghcr.io/barbacane-dev/barbacane-control:${BARBACANE_VERSION:-0.11.0}
     ports:
       - "3001:80"    # Web UI
       - "9091:9090"  # Control Plane API
diff --git a/specs/s3-proxy.yaml b/specs/s3-proxy.yaml
index 0182375..5adc3d1 100644
--- a/specs/s3-proxy.yaml
+++ b/specs/s3-proxy.yaml
@@ -35,6 +35,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       x-barbacane-dispatch:
         name: s3
         config:
@@ -84,6 +86,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       x-barbacane-dispatch:
         name: s3
         config:
@@ -119,6 +123,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       x-barbacane-dispatch:
         name: s3
         config:
@@ -168,3 +174,9 @@ paths:
           description: Asset content
         "404":
           description: Asset not found
+
+components:
+  securitySchemes:
+    OpenIdConnect:
+      type: openIdConnect
+      openIdConnectUrl: http://localhost:9099/barbacane/.well-known/openid-configuration
diff --git a/specs/train-travel-api.yaml b/specs/train-travel-api.yaml
index 5cadb50..e4a8d9c 100644
--- a/specs/train-travel-api.yaml
+++ b/specs/train-travel-api.yaml
@@ -338,6 +338,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: status
           in: query
@@ -389,6 +391,8 @@ paths:
           config:
             latency_slo_ms: 1000
             detailed_request_logs: true
+      security:
+        - OpenIdConnect: []
       requestBody:
         required: true
         content:
@@ -429,6 +433,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -462,6 +468,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -492,6 +500,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -527,6 +537,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -563,6 +575,8 @@ paths:
             latency_slo_ms: 5000
             detailed_request_logs: true
             detailed_response_logs: true
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -592,6 +606,10 @@ paths:
           $ref: "#/components/responses/PaymentRequired"
 
 components:
+  securitySchemes:
+    OpenIdConnect:
+      type: openIdConnect
+      openIdConnectUrl: http://localhost:9099/barbacane/.well-known/openid-configuration
   schemas:
     Station:
       type: object