diff --git a/celerdata/CHANGELOG.md b/celerdata/CHANGELOG.md
index 77ff80d412..9a00cca619 100644
--- a/celerdata/CHANGELOG.md
+++ b/celerdata/CHANGELOG.md
@@ -1,5 +1,11 @@
 # CHANGELOG - celerdata
 
+## 1.3.0 / 2026-05-28
+
+***Added***:
+
+* Add the `celerdata.fe.slow_lock_held_time_ms` and `celerdata.fe.slow_lock_wait_time_ms` summary metrics, surfacing FE slow-lock held time and wait time (introduced by StarRocks/starrocks#66027)
+
 ## 1.2.1 / 2025-10-01
 
 ***Fixed***:
diff --git a/celerdata/README.md b/celerdata/README.md
index 27a9dc97e3..544432abe3 100644
--- a/celerdata/README.md
+++ b/celerdata/README.md
@@ -18,7 +18,7 @@ To collect StarRocks [metrics][9] and logs:
 2. Install the CelerData check on your host with the following command:
 
    ```shell
-   datadog-agent integration install -t datadog-celerdata==1.2.1
+   datadog-agent integration install -t datadog-celerdata==1.3.0
    ```
 
 ### Configuration
diff --git a/celerdata/datadog_checks/celerdata/__about__.py b/celerdata/datadog_checks/celerdata/__about__.py
index a955fdae12..67bc602abf 100644
--- a/celerdata/datadog_checks/celerdata/__about__.py
+++ b/celerdata/datadog_checks/celerdata/__about__.py
@@ -1 +1 @@
-__version__ = "1.2.1"
+__version__ = "1.3.0"
diff --git a/celerdata/datadog_checks/celerdata/config_models/defaults.py b/celerdata/datadog_checks/celerdata/config_models/defaults.py
index 0013907872..a14932fbfb 100644
--- a/celerdata/datadog_checks/celerdata/config_models/defaults.py
+++ b/celerdata/datadog_checks/celerdata/config_models/defaults.py
@@ -40,6 +40,10 @@ def instance_enable_health_service_check():
     return True
 
 
+def instance_enable_legacy_tags_normalization():
+    return True
+
+
 def instance_histogram_buckets_as_distributions():
     return False
 
diff --git a/celerdata/datadog_checks/celerdata/config_models/instance.py b/celerdata/datadog_checks/celerdata/config_models/instance.py
index 07646f388b..465c3c5996 100644
--- a/celerdata/datadog_checks/celerdata/config_models/instance.py
+++ b/celerdata/datadog_checks/celerdata/config_models/instance.py
@@ -9,6 +9,7 @@
 from typing import Any, Optional, Union
 
 from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+from typing_extensions import Literal
 
 from datadog_checks.base.utils.functions import identity
 from datadog_checks.base.utils.models import validation
@@ -16,6 +17,11 @@
 from . import defaults, validators
 
 
+SECURE_FIELD_NAMES = frozenset(
+    ['auth_token', 'kerberos_cache', 'kerberos_keytab', 'tls_ca_cert', 'tls_cert', 'tls_private_key']
+)
+
+
 class AuthToken(BaseModel):
     model_config = ConfigDict(
         arbitrary_types_allowed=True,
@@ -93,6 +99,7 @@ class InstanceConfig(BaseModel):
     disable_generic_tags: Optional[bool] = None
     empty_default_hostname: Optional[bool] = None
     enable_health_service_check: Optional[bool] = None
+    enable_legacy_tags_normalization: Optional[bool] = None
     exclude_labels: Optional[tuple[str, ...]] = None
     exclude_metrics: Optional[tuple[str, ...]] = None
     exclude_metrics_by_labels: Optional[MappingProxyType[str, Union[bool, tuple[str, ...]]]] = None
@@ -105,7 +112,7 @@ class InstanceConfig(BaseModel):
     ignore_connection_errors: Optional[bool] = None
     ignore_tags: Optional[tuple[str, ...]] = None
     include_labels: Optional[tuple[str, ...]] = None
-    kerberos_auth: Optional[str] = None
+    kerberos_auth: Optional[Literal['required', 'optional', 'disabled']] = None
     kerberos_cache: Optional[str] = None
     kerberos_delegate: Optional[bool] = None
     kerberos_force_initiate: Optional[bool] = None
@@ -158,6 +165,11 @@ def _validate(cls, value, info):
         field_name = field.alias or info.field_name
         if field_name in info.context['configured_fields']:
             value = getattr(validators, f'instance_{info.field_name}', identity)(value, field=field)
+
+            if info.field_name in SECURE_FIELD_NAMES:
+                validation.security.check_field_trusted_provider(
+                    info.field_name, value, info.context.get('security_config')
+                )
         else:
             value = getattr(defaults, f'instance_{info.field_name}', lambda: value)()
 
diff --git a/celerdata/datadog_checks/celerdata/data/conf.yaml.example b/celerdata/datadog_checks/celerdata/data/conf.yaml.example
index 829f07ce76..54ba994470 100644
--- a/celerdata/datadog_checks/celerdata/data/conf.yaml.example
+++ b/celerdata/datadog_checks/celerdata/data/conf.yaml.example
@@ -86,6 +86,7 @@ instances:
     ## @param exclude_metrics - list of strings - optional
     ## A list of metrics to exclude, with each entry being either
     ## the exact metric name or a regular expression.
+    ##
     ## In order to exclude all metrics but the ones matching a specific filter,
     ## you can use a negative lookahead regex like:
     ##   - ^(?!foo).*$
diff --git a/celerdata/datadog_checks/celerdata/metrics.py b/celerdata/datadog_checks/celerdata/metrics.py
index 40eb4bf512..b07232730c 100644
--- a/celerdata/datadog_checks/celerdata/metrics.py
+++ b/celerdata/datadog_checks/celerdata/metrics.py
@@ -63,6 +63,12 @@
     "starrocks_fe_rps": "fe.rps",
     "starrocks_fe_safe_mode": "fe.safe_mode",
     "starrocks_fe_scheduled_tablet_num": "fe.scheduled_tablet_num",
+    "starrocks_fe_slow_lock_held_time_ms": "fe.slow_lock_held_time_ms",
+    "starrocks_fe_slow_lock_held_time_ms_count": "fe.slow_lock_held_time_ms.count",
+    "starrocks_fe_slow_lock_held_time_ms_sum": "fe.slow_lock_held_time_ms.sum",
+    "starrocks_fe_slow_lock_wait_time_ms": "fe.slow_lock_wait_time_ms",
+    "starrocks_fe_slow_lock_wait_time_ms_count": "fe.slow_lock_wait_time_ms.count",
+    "starrocks_fe_slow_lock_wait_time_ms_sum": "fe.slow_lock_wait_time_ms.sum",
     "starrocks_fe_slow_query": "fe.slow_query",
     "starrocks_fe_snmp": "fe.snmp",
     "starrocks_fe_table_num": "fe.table_num",
diff --git a/celerdata/metadata.csv b/celerdata/metadata.csv
index 87cd446d36..eede3e716d 100644
--- a/celerdata/metadata.csv
+++ b/celerdata/metadata.csv
@@ -63,6 +63,12 @@ celerdata.fe.shortcircuit_latency_ms.quantile,gauge,,,,,0,celerdata,,
 celerdata.fe.shortcircuit_latency_ms.sum,count,,,,,0,celerdata,,
 celerdata.fe.shortcircuit_query.count,count,,,,Total number of shortcircuit queries,0,celerdata,,
 celerdata.fe.shortcircuit_rpc.count,count,,,,Total number of shortcircuit RPCs,0,celerdata,,
+celerdata.fe.slow_lock_held_time_ms.count,count,,,,Number of slow lock samples on which lock held time is recorded,0,celerdata,,
+celerdata.fe.slow_lock_held_time_ms.quantile,gauge,,,,Quantiles (ms) of lock held time when slow locks are detected,0,celerdata,,
+celerdata.fe.slow_lock_held_time_ms.sum,count,,,,Sum (ms) of lock held time across slow lock samples,0,celerdata,,
+celerdata.fe.slow_lock_wait_time_ms.count,count,,,,Number of slow lock samples on which lock wait time is recorded,0,celerdata,,
+celerdata.fe.slow_lock_wait_time_ms.quantile,gauge,,,,Quantiles (ms) of lock wait time when slow locks are detected,0,celerdata,,
+celerdata.fe.slow_lock_wait_time_ms.sum,count,,,,Sum (ms) of lock wait time across slow lock samples,0,celerdata,,
 celerdata.fe.slow_query.count,count,,,,Total number of slow queries,0,celerdata,,
 celerdata.fe.snmp,gauge,,,,All TCP packets that were retransmitted,0,celerdata,,
 celerdata.fe.starmgr_journal_replay_ops.count,count,,,,Number of journals replayed,0,celerdata,,
diff --git a/celerdata/pyproject.toml b/celerdata/pyproject.toml
index 13346cdf31..71ac4b35eb 100644
--- a/celerdata/pyproject.toml
+++ b/celerdata/pyproject.toml
@@ -29,7 +29,7 @@ classifiers = [
     "Topic :: System :: Monitoring",
 ]
 dependencies = [
-    "datadog-checks-base>=36.16.0",
+    "datadog-checks-base>=37.21.0",
 ]
 dynamic = [
     "version",