diff --git a/celerdata/CHANGELOG.md b/celerdata/CHANGELOG.md
index 77ff80d412..087e88f9be 100644
--- a/celerdata/CHANGELOG.md
+++ b/celerdata/CHANGELOG.md
@@ -1,5 +1,11 @@
 # CHANGELOG - celerdata
 
+## 1.2.2 / 2026-06-03
+
+***Fixed***:
+
+* Collect all per-database `starrocks_fe_table_num` series. StarRocks FE exposes this metric interleaved with `starrocks_fe_db_size_bytes`, so the OpenMetrics parser typed every series after the first as `unknown` and dropped them; pinning the metric type to `gauge` recovers all per-db series.
+
 ## 1.2.1 / 2025-10-01
 
 ***Fixed***:
diff --git a/celerdata/datadog_checks/celerdata/__about__.py b/celerdata/datadog_checks/celerdata/__about__.py
index a955fdae12..bc86c944fe 100644
--- a/celerdata/datadog_checks/celerdata/__about__.py
+++ b/celerdata/datadog_checks/celerdata/__about__.py
@@ -1 +1 @@
-__version__ = "1.2.1"
+__version__ = "1.2.2"
diff --git a/celerdata/datadog_checks/celerdata/config_models/defaults.py b/celerdata/datadog_checks/celerdata/config_models/defaults.py
index 0013907872..a14932fbfb 100644
--- a/celerdata/datadog_checks/celerdata/config_models/defaults.py
+++ b/celerdata/datadog_checks/celerdata/config_models/defaults.py
@@ -40,6 +40,10 @@ def instance_enable_health_service_check():
     return True
 
 
+def instance_enable_legacy_tags_normalization():
+    return True
+
+
 def instance_histogram_buckets_as_distributions():
     return False
 
diff --git a/celerdata/datadog_checks/celerdata/config_models/instance.py b/celerdata/datadog_checks/celerdata/config_models/instance.py
index 07646f388b..465c3c5996 100644
--- a/celerdata/datadog_checks/celerdata/config_models/instance.py
+++ b/celerdata/datadog_checks/celerdata/config_models/instance.py
@@ -9,6 +9,7 @@
 from typing import Any, Optional, Union
 
 from pydantic import BaseModel, ConfigDict, Field, field_validator, model_validator
+from typing_extensions import Literal
 
 from datadog_checks.base.utils.functions import identity
 from datadog_checks.base.utils.models import validation
@@ -16,6 +17,11 @@
 from . import defaults, validators
 
 
+SECURE_FIELD_NAMES = frozenset(
+    ['auth_token', 'kerberos_cache', 'kerberos_keytab', 'tls_ca_cert', 'tls_cert', 'tls_private_key']
+)
+
+
 class AuthToken(BaseModel):
     model_config = ConfigDict(
         arbitrary_types_allowed=True,
@@ -93,6 +99,7 @@ class InstanceConfig(BaseModel):
     disable_generic_tags: Optional[bool] = None
     empty_default_hostname: Optional[bool] = None
     enable_health_service_check: Optional[bool] = None
+    enable_legacy_tags_normalization: Optional[bool] = None
     exclude_labels: Optional[tuple[str, ...]] = None
     exclude_metrics: Optional[tuple[str, ...]] = None
     exclude_metrics_by_labels: Optional[MappingProxyType[str, Union[bool, tuple[str, ...]]]] = None
@@ -105,7 +112,7 @@ class InstanceConfig(BaseModel):
     ignore_connection_errors: Optional[bool] = None
     ignore_tags: Optional[tuple[str, ...]] = None
     include_labels: Optional[tuple[str, ...]] = None
-    kerberos_auth: Optional[str] = None
+    kerberos_auth: Optional[Literal['required', 'optional', 'disabled']] = None
     kerberos_cache: Optional[str] = None
     kerberos_delegate: Optional[bool] = None
     kerberos_force_initiate: Optional[bool] = None
@@ -158,6 +165,11 @@ def _validate(cls, value, info):
         field_name = field.alias or info.field_name
         if field_name in info.context['configured_fields']:
             value = getattr(validators, f'instance_{info.field_name}', identity)(value, field=field)
+
+            if info.field_name in SECURE_FIELD_NAMES:
+                validation.security.check_field_trusted_provider(
+                    info.field_name, value, info.context.get('security_config')
+                )
         else:
             value = getattr(defaults, f'instance_{info.field_name}', lambda: value)()
 
diff --git a/celerdata/datadog_checks/celerdata/data/conf.yaml.example b/celerdata/datadog_checks/celerdata/data/conf.yaml.example
index 829f07ce76..54ba994470 100644
--- a/celerdata/datadog_checks/celerdata/data/conf.yaml.example
+++ b/celerdata/datadog_checks/celerdata/data/conf.yaml.example
@@ -86,6 +86,7 @@ instances:
     ## @param exclude_metrics - list of strings - optional
     ## A list of metrics to exclude, with each entry being either
     ## the exact metric name or a regular expression.
+    ##
     ## In order to exclude all metrics but the ones matching a specific filter,
     ## you can use a negative lookahead regex like:
     ##   - ^(?!foo).*$
diff --git a/celerdata/datadog_checks/celerdata/metrics.py b/celerdata/datadog_checks/celerdata/metrics.py
index 40eb4bf512..8bdd0ea57e 100644
--- a/celerdata/datadog_checks/celerdata/metrics.py
+++ b/celerdata/datadog_checks/celerdata/metrics.py
@@ -65,7 +65,14 @@
     "starrocks_fe_scheduled_tablet_num": "fe.scheduled_tablet_num",
     "starrocks_fe_slow_query": "fe.slow_query",
     "starrocks_fe_snmp": "fe.snmp",
-    "starrocks_fe_table_num": "fe.table_num",
+    # StarRocks FE interleaves this metric with `starrocks_fe_db_size_bytes` (one pair per db),
+    # which breaks Prometheus family grouping: the parser tags only the first series as `gauge`
+    # and the rest as `unknown`, and OpenMetricsV2 drops `unknown`. Pinning the type recovers all
+    # per-db series. See celerdata#2854.
+    "starrocks_fe_table_num": {
+        "name": "fe.table_num",
+        "type": "gauge",
+    },
     "starrocks_fe_tablet_max_compaction_score": {
         "name": "fe.tablet.max_compaction_score",
         "type": "gauge",