diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17e369d129..912957c9ce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,6 +45,12 @@
       - **Deprecation:** `CreateLabel`, `DeleteLabel`, `ListLabels` operations are now deprecated and scheduled for sunset on 2027-10-01; use the `labelsMap` field on the `Zone` resource instead
       - **Improvement:** `ListRecordSets`/`ListZones` docs clarify that records/zones in the `DELETE_SUCCEEDED` state are excluded by default; pass `state[eq]=DELETE_SUCCEEDED` to retrieve them
       - **Breaking Change:** `PartialUpdateZonePayload.Extensions` type changed from `ZoneExtensions` to `DomainExtensions`, now also exposing `observabilityExtension.state`
+- `dremio`:
+  - [v0.7.0](services/dremio/CHANGELOG.md#v070)
+    - `v1betaapi`:
+      - **Breaking Change:** Updated `NewDremioResponse()` constructor signature to require new `Acl` parameter
+      - **Breaking Change:** Added new required `Acl` field to `DremioResponse` model
+      - **Feature:** Add new `Acl` field to `CreateDremioInstancePayload` and `UpdateDremioInstancePayload` models to manage the list of IPv4/IPv6 CIDR ranges allowed to connect to the Dremio instance
 - `git`:
   - [v0.15.0](services/git/CHANGELOG.md#v0150)
     - **Breaking change:** Removal of deprecated compatibility layer previously found in the root of the SDK module
diff --git a/services/dremio/CHANGELOG.md b/services/dremio/CHANGELOG.md
index 2d9bdfb94d..9e8efbf066 100644
--- a/services/dremio/CHANGELOG.md
+++ b/services/dremio/CHANGELOG.md
@@ -1,3 +1,9 @@
+## v0.7.0
+- `v1betaapi`:
+  - **Breaking Change:** Updated `NewDremioResponse()` constructor signature to require new `Acl` parameter
+  - **Breaking Change:** Added new required `Acl` field to `DremioResponse` model
+  - **Feature:** Add new `Acl` field to `CreateDremioInstancePayload` and `UpdateDremioInstancePayload` models to manage the list of IPv4/IPv6 CIDR ranges allowed to connect to the Dremio instance
+
 ## v0.6.1
 - **Dependencies:** Bump STACKIT SDK core module from `v0.26.0` to `v0.27.0`
 
diff --git a/services/dremio/VERSION b/services/dremio/VERSION
index 14909610e6..e7f5d1aa6e 100644
--- a/services/dremio/VERSION
+++ b/services/dremio/VERSION
@@ -1 +1 @@
-v0.6.1
+v0.7.0
\ No newline at end of file
diff --git a/services/dremio/oas_commit b/services/dremio/oas_commit
index fa742ff4a1..6a8ba08d49 100644
--- a/services/dremio/oas_commit
+++ b/services/dremio/oas_commit
@@ -1 +1 @@
-7fd0fb8e513021dfbad1f5ee736785ec72987b40
+ef9232ba8d49c72fc3397a365b09ca1a8205b25e
diff --git a/services/dremio/v1betaapi/model_create_dremio_instance_payload.go b/services/dremio/v1betaapi/model_create_dremio_instance_payload.go
index fae724234f..97826ad217 100644
--- a/services/dremio/v1betaapi/model_create_dremio_instance_payload.go
+++ b/services/dremio/v1betaapi/model_create_dremio_instance_payload.go
@@ -20,6 +20,8 @@ var _ MappedNullable = &CreateDremioInstancePayload{}
 
 // CreateDremioInstancePayload struct for CreateDremioInstancePayload
 type CreateDremioInstancePayload struct {
+	// The Access Control List (ACL) defining the IPv4 or IPv6 CIDR ranges allowed to connect to the Dremio instance. An empty list allows access from any address. Omitting this field on creation allows access from any address. Omitting it on update preserves the current list. Updates replace the entire list and take effect asynchronously.
+	Acl            []string        `json:"acl,omitempty"`
 	Authentication *Authentication `json:"authentication,omitempty"`
 	// The description is a longer text chosen by the user to provide more context for the resource.
 	Description *string `json:"description,omitempty"`
@@ -48,6 +50,38 @@ func NewCreateDremioInstancePayloadWithDefaults() *CreateDremioInstancePayload {
 	return &this
 }
 
+// GetAcl returns the Acl field value if set, zero value otherwise.
+func (o *CreateDremioInstancePayload) GetAcl() []string {
+	if o == nil || IsNil(o.Acl) {
+		var ret []string
+		return ret
+	}
+	return o.Acl
+}
+
+// GetAclOk returns a tuple with the Acl field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *CreateDremioInstancePayload) GetAclOk() ([]string, bool) {
+	if o == nil || IsNil(o.Acl) {
+		return nil, false
+	}
+	return o.Acl, true
+}
+
+// HasAcl returns a boolean if a field has been set.
+func (o *CreateDremioInstancePayload) HasAcl() bool {
+	if o != nil && !IsNil(o.Acl) {
+		return true
+	}
+
+	return false
+}
+
+// SetAcl gets a reference to the given []string and assigns it to the Acl field.
+func (o *CreateDremioInstancePayload) SetAcl(v []string) {
+	o.Acl = v
+}
+
 // GetAuthentication returns the Authentication field value if set, zero value otherwise.
 func (o *CreateDremioInstancePayload) GetAuthentication() Authentication {
 	if o == nil || IsNil(o.Authentication) {
@@ -146,6 +180,9 @@ func (o CreateDremioInstancePayload) MarshalJSON() ([]byte, error) {
 
 func (o CreateDremioInstancePayload) ToMap() (map[string]interface{}, error) {
 	toSerialize := map[string]interface{}{}
+	if !IsNil(o.Acl) {
+		toSerialize["acl"] = o.Acl
+	}
 	if !IsNil(o.Authentication) {
 		toSerialize["authentication"] = o.Authentication
 	}
@@ -196,6 +233,7 @@ func (o *CreateDremioInstancePayload) UnmarshalJSON(data []byte) (err error) {
 	additionalProperties := make(map[string]interface{})
 
 	if err = json.Unmarshal(data, &additionalProperties); err == nil {
+		delete(additionalProperties, "acl")
 		delete(additionalProperties, "authentication")
 		delete(additionalProperties, "description")
 		delete(additionalProperties, "displayName")
diff --git a/services/dremio/v1betaapi/model_dremio_response.go b/services/dremio/v1betaapi/model_dremio_response.go
index 4f437be281..227a0429c8 100644
--- a/services/dremio/v1betaapi/model_dremio_response.go
+++ b/services/dremio/v1betaapi/model_dremio_response.go
@@ -21,6 +21,8 @@ var _ MappedNullable = &DremioResponse{}
 
 // DremioResponse struct for DremioResponse
 type DremioResponse struct {
+	// The Access Control List (ACL) defining the IPv4 or IPv6 CIDR ranges allowed to connect to the Dremio instance. An empty list allows access from any address. Omitting this field on creation allows access from any address. Omitting it on update preserves the current list. Updates replace the entire list and take effect asynchronously.
+	Acl            []string       `json:"acl"`
 	Authentication Authentication `json:"authentication"`
 	// The point in time the resource was created.
 	CreateTime time.Time `json:"create_time"`
@@ -43,8 +45,9 @@ type _DremioResponse DremioResponse
 // This constructor will assign default values to properties that have it defined,
 // and makes sure properties required by API are set, but the set of arguments
 // will change when the set of required properties is changed
-func NewDremioResponse(authentication Authentication, createTime time.Time, displayName string, endpoints Endpoints, id string, state DremioResponseState) *DremioResponse {
+func NewDremioResponse(acl []string, authentication Authentication, createTime time.Time, displayName string, endpoints Endpoints, id string, state DremioResponseState) *DremioResponse {
 	this := DremioResponse{}
+	this.Acl = acl
 	this.Authentication = authentication
 	this.CreateTime = createTime
 	this.DisplayName = displayName
@@ -62,6 +65,30 @@ func NewDremioResponseWithDefaults() *DremioResponse {
 	return &this
 }
 
+// GetAcl returns the Acl field value
+func (o *DremioResponse) GetAcl() []string {
+	if o == nil {
+		var ret []string
+		return ret
+	}
+
+	return o.Acl
+}
+
+// GetAclOk returns a tuple with the Acl field value
+// and a boolean to check if the value has been set.
+func (o *DremioResponse) GetAclOk() ([]string, bool) {
+	if o == nil {
+		return nil, false
+	}
+	return o.Acl, true
+}
+
+// SetAcl sets field value
+func (o *DremioResponse) SetAcl(v []string) {
+	o.Acl = v
+}
+
 // GetAuthentication returns the Authentication field value
 func (o *DremioResponse) GetAuthentication() Authentication {
 	if o == nil {
@@ -280,6 +307,7 @@ func (o DremioResponse) MarshalJSON() ([]byte, error) {
 
 func (o DremioResponse) ToMap() (map[string]interface{}, error) {
 	toSerialize := map[string]interface{}{}
+	toSerialize["acl"] = o.Acl
 	toSerialize["authentication"] = o.Authentication
 	toSerialize["create_time"] = o.CreateTime
 	if !IsNil(o.Description) {
@@ -305,6 +333,7 @@ func (o *DremioResponse) UnmarshalJSON(data []byte) (err error) {
 	// by unmarshalling the object into a generic map with string keys and checking
 	// that every required field exists as a key in the generic map.
 	requiredProperties := []string{
+		"acl",
 		"authentication",
 		"create_time",
 		"displayName",
@@ -340,6 +369,7 @@ func (o *DremioResponse) UnmarshalJSON(data []byte) (err error) {
 	additionalProperties := make(map[string]interface{})
 
 	if err = json.Unmarshal(data, &additionalProperties); err == nil {
+		delete(additionalProperties, "acl")
 		delete(additionalProperties, "authentication")
 		delete(additionalProperties, "create_time")
 		delete(additionalProperties, "description")
diff --git a/services/dremio/v1betaapi/model_update_dremio_instance_payload.go b/services/dremio/v1betaapi/model_update_dremio_instance_payload.go
index 8925d5f182..57e9446005 100644
--- a/services/dremio/v1betaapi/model_update_dremio_instance_payload.go
+++ b/services/dremio/v1betaapi/model_update_dremio_instance_payload.go
@@ -19,6 +19,8 @@ var _ MappedNullable = &UpdateDremioInstancePayload{}
 
 // UpdateDremioInstancePayload struct for UpdateDremioInstancePayload
 type UpdateDremioInstancePayload struct {
+	// The Access Control List (ACL) defining the IPv4 or IPv6 CIDR ranges allowed to connect to the Dremio instance. An empty list allows access from any address. Omitting this field on creation allows access from any address. Omitting it on update preserves the current list. Updates replace the entire list and take effect asynchronously.
+	Acl            []string        `json:"acl,omitempty"`
 	Authentication *Authentication `json:"authentication,omitempty"`
 	// The description is a longer text chosen by the user to provide more context for the resource.
 	Description *string `json:"description,omitempty"`
@@ -46,6 +48,38 @@ func NewUpdateDremioInstancePayloadWithDefaults() *UpdateDremioInstancePayload {
 	return &this
 }
 
+// GetAcl returns the Acl field value if set, zero value otherwise.
+func (o *UpdateDremioInstancePayload) GetAcl() []string {
+	if o == nil || IsNil(o.Acl) {
+		var ret []string
+		return ret
+	}
+	return o.Acl
+}
+
+// GetAclOk returns a tuple with the Acl field value if set, nil otherwise
+// and a boolean to check if the value has been set.
+func (o *UpdateDremioInstancePayload) GetAclOk() ([]string, bool) {
+	if o == nil || IsNil(o.Acl) {
+		return nil, false
+	}
+	return o.Acl, true
+}
+
+// HasAcl returns a boolean if a field has been set.
+func (o *UpdateDremioInstancePayload) HasAcl() bool {
+	if o != nil && !IsNil(o.Acl) {
+		return true
+	}
+
+	return false
+}
+
+// SetAcl gets a reference to the given []string and assigns it to the Acl field.
+func (o *UpdateDremioInstancePayload) SetAcl(v []string) {
+	o.Acl = v
+}
+
 // GetAuthentication returns the Authentication field value if set, zero value otherwise.
 func (o *UpdateDremioInstancePayload) GetAuthentication() Authentication {
 	if o == nil || IsNil(o.Authentication) {
@@ -152,6 +186,9 @@ func (o UpdateDremioInstancePayload) MarshalJSON() ([]byte, error) {
 
 func (o UpdateDremioInstancePayload) ToMap() (map[string]interface{}, error) {
 	toSerialize := map[string]interface{}{}
+	if !IsNil(o.Acl) {
+		toSerialize["acl"] = o.Acl
+	}
 	if !IsNil(o.Authentication) {
 		toSerialize["authentication"] = o.Authentication
 	}
@@ -183,6 +220,7 @@ func (o *UpdateDremioInstancePayload) UnmarshalJSON(data []byte) (err error) {
 	additionalProperties := make(map[string]interface{})
 
 	if err = json.Unmarshal(data, &additionalProperties); err == nil {
+		delete(additionalProperties, "acl")
 		delete(additionalProperties, "authentication")
 		delete(additionalProperties, "description")
 		delete(additionalProperties, "displayName")