diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8ee62817..e6c655a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ changes accumulate. Track in-flight protocol changes via PRs touching
 
 ### Added
 
+- Optional `nonce` field on `ContentRef`.
 - Optional `intention` field on `chat/toolCallStart` and every `ToolCallState`
   variant, providing a human-readable description of what the invocation intends
   to do.
diff --git a/clients/go/CHANGELOG.md b/clients/go/CHANGELOG.md
index fd43e073..75dcfeab 100644
--- a/clients/go/CHANGELOG.md
+++ b/clients/go/CHANGELOG.md
@@ -16,6 +16,7 @@ tag whose matching `## [X.Y.Z]` heading is missing from this file.
 
 ### Added
 
+- Optional `Nonce` field on `ContentRef`.
 - `SubscribeParams.Delivery.MaxLatencyMs` and `Client.SubscribeWithDelivery`
   for clients to request a maximum subscription delivery latency, including
   `0` for no intentional coalescing.
diff --git a/clients/go/ahptypes/state.generated.go b/clients/go/ahptypes/state.generated.go
index 700beae5..33278b92 100644
--- a/clients/go/ahptypes/state.generated.go
+++ b/clients/go/ahptypes/state.generated.go
@@ -1517,6 +1517,8 @@ type MessageResourceAttachment struct {
 	SizeHint *int64 `json:"sizeHint,omitempty"`
 	// Content MIME type
 	ContentType *string `json:"contentType,omitempty"`
+	// Content nonce
+	Nonce *string `json:"nonce,omitempty"`
 	// Discriminant
 	Type MessageAttachmentKind `json:"type"`
 	// Optional selection within the referenced textual resource.
@@ -1583,6 +1585,8 @@ type ContentRef struct {
 	SizeHint *int64 `json:"sizeHint,omitempty"`
 	// Content MIME type
 	ContentType *string `json:"contentType,omitempty"`
+	// Content nonce
+	Nonce *string `json:"nonce,omitempty"`
 }
 
 // A content part that's a reference to large content stored outside the state tree.
@@ -1593,6 +1597,8 @@ type ResourceResponsePart struct {
 	SizeHint *int64 `json:"sizeHint,omitempty"`
 	// Content MIME type
 	ContentType *string `json:"contentType,omitempty"`
+	// Content nonce
+	Nonce *string `json:"nonce,omitempty"`
 	// Discriminant
 	Kind ResponsePartKind `json:"kind"`
 }
@@ -1954,8 +1960,10 @@ type ToolResultResourceContent struct {
 	// Approximate size in bytes
 	SizeHint *int64 `json:"sizeHint,omitempty"`
 	// Content MIME type
-	ContentType *string               `json:"contentType,omitempty"`
-	Type        ToolResultContentType `json:"type"`
+	ContentType *string `json:"contentType,omitempty"`
+	// Content nonce
+	Nonce *string               `json:"nonce,omitempty"`
+	Type  ToolResultContentType `json:"type"`
 }
 
 // Describes a file modification performed by a tool.
diff --git a/clients/kotlin/CHANGELOG.md b/clients/kotlin/CHANGELOG.md
index eb5c051e..2a1a66b8 100644
--- a/clients/kotlin/CHANGELOG.md
+++ b/clients/kotlin/CHANGELOG.md
@@ -17,6 +17,7 @@ versions (`*-SNAPSHOT`) are explicitly rejected by the publish pipeline; bump
 
 ### Added
 
+- Optional `nonce` field on `ContentRef`.
 - `SubscribeParams.delivery.maxLatencyMs` for clients to request a maximum
   subscription delivery latency, including `0` for no intentional coalescing.
 - Optional `capabilities` field on `AgentInfo` (`AgentCapabilities` with a
diff --git a/clients/kotlin/src/main/kotlin/com/microsoft/agenthostprotocol/generated/State.generated.kt b/clients/kotlin/src/main/kotlin/com/microsoft/agenthostprotocol/generated/State.generated.kt
index 4ca2b7de..243ef5e3 100644
--- a/clients/kotlin/src/main/kotlin/com/microsoft/agenthostprotocol/generated/State.generated.kt
+++ b/clients/kotlin/src/main/kotlin/com/microsoft/agenthostprotocol/generated/State.generated.kt
@@ -2112,6 +2112,10 @@ data class MessageResourceAttachment(
      * Content MIME type
      */
     val contentType: String? = null,
+    /**
+     * Content nonce
+     */
+    val nonce: String? = null,
     /**
      * Discriminant
      */
@@ -2204,7 +2208,11 @@ data class ContentRef(
     /**
      * Content MIME type
      */
-    val contentType: String? = null
+    val contentType: String? = null,
+    /**
+     * Content nonce
+     */
+    val nonce: String? = null
 )
 
 @Serializable
@@ -2221,6 +2229,10 @@ data class ResourceReponsePart(
      * Content MIME type
      */
     val contentType: String? = null,
+    /**
+     * Content nonce
+     */
+    val nonce: String? = null,
     /**
      * Discriminant
      */
@@ -2785,6 +2797,10 @@ data class ToolResultResourceContent(
      * Content MIME type
      */
     val contentType: String? = null,
+    /**
+     * Content nonce
+     */
+    val nonce: String? = null,
     val type: ToolResultContentType
 )
 
diff --git a/clients/rust/CHANGELOG.md b/clients/rust/CHANGELOG.md
index 68deb44e..d24b55d9 100644
--- a/clients/rust/CHANGELOG.md
+++ b/clients/rust/CHANGELOG.md
@@ -17,6 +17,7 @@ matching `## [X.Y.Z]` heading is missing from this file.
 
 ### Added
 
+- Optional `nonce` field on `ContentRef`.
 - `SubscribeParams.delivery.max_latency_ms` and
   `Client::subscribe_with_delivery` for clients to request a maximum
   subscription delivery latency, including `0` for no intentional coalescing.
diff --git a/clients/rust/crates/ahp-types/src/state.rs b/clients/rust/crates/ahp-types/src/state.rs
index 2e8b15d8..61fd6dc8 100644
--- a/clients/rust/crates/ahp-types/src/state.rs
+++ b/clients/rust/crates/ahp-types/src/state.rs
@@ -1919,6 +1919,9 @@ pub struct MessageResourceAttachment {
     /// Content MIME type
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub content_type: Option<String>,
+    /// Content nonce
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nonce: Option<String>,
     /// Optional selection within the referenced textual resource.
     ///
     /// Only meaningful for textual resources.
@@ -1992,6 +1995,9 @@ pub struct ContentRef {
     /// Content MIME type
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub content_type: Option<String>,
+    /// Content nonce
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nonce: Option<String>,
 }
 
 /// A content part that's a reference to large content stored outside the state tree.
@@ -2006,6 +2012,9 @@ pub struct ResourceResponsePart {
     /// Content MIME type
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub content_type: Option<String>,
+    /// Content nonce
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nonce: Option<String>,
 }
 
 /// A tool call represented as a response part.
@@ -2443,6 +2452,9 @@ pub struct ToolResultResourceContent {
     /// Content MIME type
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub content_type: Option<String>,
+    /// Content nonce
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub nonce: Option<String>,
 }
 
 /// Describes a file modification performed by a tool.
diff --git a/clients/swift/AgentHostProtocol/Sources/AgentHostProtocol/Generated/State.generated.swift b/clients/swift/AgentHostProtocol/Sources/AgentHostProtocol/Generated/State.generated.swift
index 4e278a52..f575fdb6 100644
--- a/clients/swift/AgentHostProtocol/Sources/AgentHostProtocol/Generated/State.generated.swift
+++ b/clients/swift/AgentHostProtocol/Sources/AgentHostProtocol/Generated/State.generated.swift
@@ -2061,6 +2061,8 @@ public struct MessageResourceAttachment: Codable, Sendable {
     public var sizeHint: Int?
     /// Content MIME type
     public var contentType: String?
+    /// Content nonce
+    public var nonce: String?
     /// Discriminant
     public var type: MessageAttachmentKind
     /// Optional selection within the referenced textual resource.
@@ -2076,6 +2078,7 @@ public struct MessageResourceAttachment: Codable, Sendable {
         case uri
         case sizeHint
         case contentType
+        case nonce
         case type
         case selection
     }
@@ -2088,6 +2091,7 @@ public struct MessageResourceAttachment: Codable, Sendable {
         uri: String,
         sizeHint: Int? = nil,
         contentType: String? = nil,
+        nonce: String? = nil,
         type: MessageAttachmentKind,
         selection: TextSelection? = nil
     ) {
@@ -2098,6 +2102,7 @@ public struct MessageResourceAttachment: Codable, Sendable {
         self.uri = uri
         self.sizeHint = sizeHint
         self.contentType = contentType
+        self.nonce = nonce
         self.type = type
         self.selection = selection
     }
@@ -2192,15 +2197,19 @@ public struct ContentRef: Codable, Sendable {
     public var sizeHint: Int?
     /// Content MIME type
     public var contentType: String?
+    /// Content nonce
+    public var nonce: String?
 
     public init(
         uri: String,
         sizeHint: Int? = nil,
-        contentType: String? = nil
+        contentType: String? = nil,
+        nonce: String? = nil
     ) {
         self.uri = uri
         self.sizeHint = sizeHint
         self.contentType = contentType
+        self.nonce = nonce
     }
 }
 
@@ -2211,6 +2220,8 @@ public struct ResourceReponsePart: Codable, Sendable {
     public var sizeHint: Int?
     /// Content MIME type
     public var contentType: String?
+    /// Content nonce
+    public var nonce: String?
     /// Discriminant
     public var kind: ResponsePartKind
 
@@ -2218,11 +2229,13 @@ public struct ResourceReponsePart: Codable, Sendable {
         uri: String,
         sizeHint: Int? = nil,
         contentType: String? = nil,
+        nonce: String? = nil,
         kind: ResponsePartKind
     ) {
         self.uri = uri
         self.sizeHint = sizeHint
         self.contentType = contentType
+        self.nonce = nonce
         self.kind = kind
     }
 }
@@ -2939,17 +2952,21 @@ public struct ToolResultResourceContent: Codable, Sendable {
     public var sizeHint: Int?
     /// Content MIME type
     public var contentType: String?
+    /// Content nonce
+    public var nonce: String?
     public var type: ToolResultContentType
 
     public init(
         uri: String,
         sizeHint: Int? = nil,
         contentType: String? = nil,
+        nonce: String? = nil,
         type: ToolResultContentType
     ) {
         self.uri = uri
         self.sizeHint = sizeHint
         self.contentType = contentType
+        self.nonce = nonce
         self.type = type
     }
 }
diff --git a/clients/swift/CHANGELOG.md b/clients/swift/CHANGELOG.md
index 7bf7e226..3bfc8257 100644
--- a/clients/swift/CHANGELOG.md
+++ b/clients/swift/CHANGELOG.md
@@ -19,6 +19,7 @@ the tag matches the version pinned in [`VERSION`](VERSION).
 
 ### Added
 
+- Optional `nonce` field on `ContentRef`.
 - `SubscribeParams.delivery.maxLatencyMs` and
   `AHPClient.subscribe(_:delivery:)` for clients to request a maximum
   subscription delivery latency, including `0` for no intentional coalescing.
diff --git a/clients/typescript/CHANGELOG.md b/clients/typescript/CHANGELOG.md
index 88476600..9623a328 100644
--- a/clients/typescript/CHANGELOG.md
+++ b/clients/typescript/CHANGELOG.md
@@ -22,6 +22,7 @@ hotfix escape hatch.
 
 ### Added
 
+- Optional `nonce` field on `ContentRef`.
 - `SubscribeParams.delivery.maxLatencyMs` and `AhpClient.subscribe` delivery
   options for clients to request a maximum subscription delivery latency,
   including `0` for no intentional coalescing.
diff --git a/schema/actions.schema.json b/schema/actions.schema.json
index 62e065d9..9012e298 100644
--- a/schema/actions.schema.json
+++ b/schema/actions.schema.json
@@ -2216,6 +2216,10 @@
         "contentType": {
           "type": "string",
           "description": "Content MIME type"
+        },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
         }
       },
       "required": [
@@ -4807,6 +4811,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/MessageAttachmentKind.Resource",
           "description": "Discriminant"
@@ -4903,6 +4911,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "kind": {
           "$ref": "#/$defs/ResponsePartKind.ContentRef",
           "description": "Discriminant"
@@ -5629,6 +5641,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/ToolResultContentType.Resource"
         }
diff --git a/schema/commands.schema.json b/schema/commands.schema.json
index 0136d547..0aa780c9 100644
--- a/schema/commands.schema.json
+++ b/schema/commands.schema.json
@@ -1561,6 +1561,10 @@
         "contentType": {
           "type": "string",
           "description": "Content MIME type"
+        },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
         }
       },
       "required": [
@@ -4152,6 +4156,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/MessageAttachmentKind.Resource",
           "description": "Discriminant"
@@ -4248,6 +4256,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "kind": {
           "$ref": "#/$defs/ResponsePartKind.ContentRef",
           "description": "Discriminant"
@@ -4974,6 +4986,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/ToolResultContentType.Resource"
         }
diff --git a/schema/errors.schema.json b/schema/errors.schema.json
index 08d3863e..e6ed6f7e 100644
--- a/schema/errors.schema.json
+++ b/schema/errors.schema.json
@@ -379,6 +379,10 @@
         "contentType": {
           "type": "string",
           "description": "Content MIME type"
+        },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
         }
       },
       "required": [
@@ -2970,6 +2974,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/MessageAttachmentKind.Resource",
           "description": "Discriminant"
@@ -3066,6 +3074,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "kind": {
           "$ref": "#/$defs/ResponsePartKind.ContentRef",
           "description": "Discriminant"
@@ -3792,6 +3804,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/ToolResultContentType.Resource"
         }
diff --git a/schema/notifications.schema.json b/schema/notifications.schema.json
index fe8b92f3..abe3e99a 100644
--- a/schema/notifications.schema.json
+++ b/schema/notifications.schema.json
@@ -539,6 +539,10 @@
         "contentType": {
           "type": "string",
           "description": "Content MIME type"
+        },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
         }
       },
       "required": [
@@ -3130,6 +3134,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/MessageAttachmentKind.Resource",
           "description": "Discriminant"
@@ -3226,6 +3234,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "kind": {
           "$ref": "#/$defs/ResponsePartKind.ContentRef",
           "description": "Discriminant"
@@ -3952,6 +3964,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/ToolResultContentType.Resource"
         }
diff --git a/schema/state.schema.json b/schema/state.schema.json
index f58baac1..4df40258 100644
--- a/schema/state.schema.json
+++ b/schema/state.schema.json
@@ -290,6 +290,10 @@
         "contentType": {
           "type": "string",
           "description": "Content MIME type"
+        },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
         }
       },
       "required": [
@@ -2881,6 +2885,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/MessageAttachmentKind.Resource",
           "description": "Discriminant"
@@ -2977,6 +2985,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "kind": {
           "$ref": "#/$defs/ResponsePartKind.ContentRef",
           "description": "Discriminant"
@@ -3703,6 +3715,10 @@
           "type": "string",
           "description": "Content MIME type"
         },
+        "nonce": {
+          "type": "string",
+          "description": "Content nonce"
+        },
         "type": {
           "$ref": "#/$defs/ToolResultContentType.Resource"
         }
diff --git a/types/common/state.ts b/types/common/state.ts
index a451c5f1..044e3063 100644
--- a/types/common/state.ts
+++ b/types/common/state.ts
@@ -252,6 +252,8 @@ export interface ContentRef {
   sizeHint?: number;
   /** Content MIME type */
   contentType?: string;
+  /** Content nonce */
+  nonce?: string;
 }
 
 // ─── File Edit ───────────────────────────────────────────────────────────────