diff --git a/.oagen-manifest.json b/.oagen-manifest.json
index f4f42b13..7a3d67bd 100644
--- a/.oagen-manifest.json
+++ b/.oagen-manifest.json
@@ -1,7 +1,7 @@
 {
   "version": 1,
   "language": "python",
-  "generatedAt": "2026-04-13T15:44:50.450Z",
+  "generatedAt": "2026-04-14T16:36:59.471Z",
   "files": [
     "src/workos/_client.py",
     "src/workos/admin_portal/__init__.py",
diff --git a/src/workos/_client.py b/src/workos/_client.py
index 89485160..df199e59 100644
--- a/src/workos/_client.py
+++ b/src/workos/_client.py
@@ -28,10 +28,13 @@
 from .webhooks._resource import Webhooks, AsyncWebhooks
 from .widgets._resource import Widgets, AsyncWidgets
 from .audit_logs._resource import AuditLogs, AsyncAuditLogs
+
+# @oagen-ignore-start — non-spec service imports (hand-maintained)
 from .passwordless import AsyncPasswordless, Passwordless
 from .vault import AsyncVault, Vault
 from .actions import Actions, AsyncActions
 from .pkce import PKCE
+# @oagen-ignore-end
 
 
 class WorkOSClient(_SyncBase):
@@ -127,6 +130,8 @@ def mfa(self) -> MultiFactorAuth:
         """Alias for multi_factor_auth."""
         return self.multi_factor_auth
 
+    # @oagen-ignore-start — non-spec service accessors (hand-maintained)
+
     @functools.cached_property
     def passwordless(self) -> Passwordless:
         """Passwordless authentication sessions."""
@@ -147,6 +152,8 @@ def pkce(self) -> PKCE:
         """PKCE (Proof Key for Code Exchange) utilities."""
         return PKCE()
 
+    # @oagen-ignore-end
+
 
 class AsyncWorkOSClient(_AsyncBase):
     """Asynchronous WorkOS API client with service accessors."""
@@ -241,6 +248,8 @@ def mfa(self) -> AsyncMultiFactorAuth:
         """Alias for multi_factor_auth."""
         return self.multi_factor_auth
 
+    # @oagen-ignore-start — non-spec service accessors (hand-maintained)
+
     @functools.cached_property
     def passwordless(self) -> AsyncPasswordless:
         """Passwordless authentication sessions."""
@@ -260,3 +269,5 @@ def actions(self) -> AsyncActions:
     def pkce(self) -> PKCE:
         """PKCE (Proof Key for Code Exchange) utilities."""
         return PKCE()
+
+    # @oagen-ignore-end