diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 60ec2369a4..f2571ecd5c 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -16160,6 +16160,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "chrono",
+ "ed25519-dalek",
  "futures",
  "lazy_static",
  "regex",
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 8ba0c97c0b..b40437560a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-d29a7c0dad120e137105b1186d0bbe3ea1504b5d
+664708fff04d4f9e0660bcae3edb307fb2c9481b
diff --git a/backend/windmill-api-settings/Cargo.toml b/backend/windmill-api-settings/Cargo.toml
index 0ec99ef6d0..034a24edf1 100644
--- a/backend/windmill-api-settings/Cargo.toml
+++ b/backend/windmill-api-settings/Cargo.toml
@@ -13,7 +13,7 @@ default = []
 enterprise = ["license"]
 private = ["windmill-common/private", "windmill-audit/private"]
 parquet = ["windmill-common/parquet", "windmill-object-store/parquet"]
-license = ["dep:rsa"]
+license = ["dep:rsa", "dep:ed25519-dalek"]
 
 [dependencies]
 windmill-ai = { workspace = true, default-features = false }
@@ -38,4 +38,5 @@ uuid.workspace = true
 base64.workspace = true
 sha2.workspace = true
 rsa = { workspace = true, optional = true }
+ed25519-dalek = { workspace = true, optional = true }
 windmill-object-store.workspace = true
diff --git a/backend/windmill-common/src/min_version.rs b/backend/windmill-common/src/min_version.rs
index 70878e3713..3719abd31c 100644
--- a/backend/windmill-common/src/min_version.rs
+++ b/backend/windmill-common/src/min_version.rs
@@ -30,6 +30,11 @@ pub const MIN_VERSION_SUPPORTS_JOB_TOKEN_SCOPES: VC = vc(1, 822, 0, "Restricted
 // Also gates widening `variable.value`, which needs every process to retire the connections
 // the widening poisons (`db::retire_connections_opened_before_now`): that also ships in 1.832.
 pub const MIN_VERSION_SUPPORTS_AEAD_SECRETS: VC = vc(1, 832, 0, "AES-GCM secret encryption");
+// A renewed license key replaces the one every process reads, and a worker that predates
+// Ed25519 support rejects an Ed25519-signed key and stops pulling jobs, so renewal only offers
+// to accept one once this is met. Only worker versions are seen here, not servers. Must name
+// the release this ships in.
+pub const MIN_VERSION_SUPPORTS_ED25519_LICENSE: VC = vc(1, 838, 0, "Ed25519 license keys");
 pub const MIN_VERSION_SUPPORTS_NODE_DEBOUNCING: VC = vc(1, 658, 0, "Flow node debouncing");
 pub const MIN_VERSION_SUPPORTS_TOKEN_HASH: VC = vc(1, 659, 0, "Token hash storage");
 pub const MIN_VERSION_SUPPORTS_SYNC_JOBS_DEBOUNCING: VC = vc(1, 602, 0, "Sync jobs debouncing");