diff --git a/dag/extdeps/cloud/gcp/secret_manager.dag b/dag/extdeps/cloud/gcp/secret_manager.dag
index 5cd1301047b..03c430b7240 100644
--- a/dag/extdeps/cloud/gcp/secret_manager.dag
+++ b/dag/extdeps/cloud/gcp/secret_manager.dag
@@ -45,7 +45,7 @@ type GcpSecret {
   project: String
   replication: SmReplication
   labels: Map<String, String>?
-  create_time: String
+  create_time: String from "createTime"
   etag: String
 }
 
@@ -61,9 +61,9 @@ type SmVersionState = SmEnabled | SmDisabled | SmDestroyed
 type GcpSecretVersion {
   name: SmResolvedVersionIdentity
   state: SmVersionState
-  create_time: String
+  create_time: String from "createTime"
   etag: String?
-  destroy_time: String?
+  destroy_time: String? from "destroyTime"
 }
 
 // Pagination is part of this response's MEANING, not a transport detail to
@@ -74,12 +74,20 @@ type GcpSecretVersion {
 // representable upstream of any policy that would otherwise silently narrow.
 type ListSecretVersionsResponse {
   versions: List<GcpSecretVersion>
-  next_page_token: String?
-  total_size: Int?
+  next_page_token: String? from "nextPageToken"
+  total_size: Int? from "totalSize"
 }
 
+// The access response is the version's resource name beside its payload, and the payload's data is
+// base64 TEXT on the JSON wire (projects.secrets.versions.access, AccessSecretVersionResponse /
+// SecretPayload, Secret Manager v1). Decoding it to octets is the decode outcome below, not serde's.
 type SecretPayload {
-  data: Bytes
+  data: String
+}
+
+type AccessSecretVersionResponse {
+  name: SmResolvedVersionIdentity
+  payload: SecretPayload
 }
 
 type SmRotationSchedule {
@@ -480,7 +488,7 @@ service gcp.SecretManager {
     readonly
     transport rest { method: GET, path: "/v1/projects/\{project_id\}/secrets/\{secret\}/versions/\{version\}:access" }
     response {
-      200 => SecretPayload
+      200 => AccessSecretVersionResponse
       401 => GcpErrorShape
       403 => GcpErrorShape
       404 => GcpErrorShape
@@ -539,7 +547,7 @@ service gcp.SecretManager {
     }
     output {
       versions: List<GcpSecretVersion>
-      next_page_token: String from "nextPageToken"
+      next_page_token: String? from "nextPageToken"
       outcome: RestOutcome
     }
     readonly
@@ -642,7 +650,7 @@ service gcp.SecretManager {
   operation DestroyVersion {
     requires Network
     input { access_token: Secret, version_name: SmResolvedVersionIdentity, etag: String = "" }
-    output { name: SmResolvedVersionIdentity, state: SmVersionState, destroy_time: String from "destroyTime" }
+    output { name: SmResolvedVersionIdentity, state: SmVersionState, destroy_time: String? from "destroyTime" }
 
     transport rest {
       method: POST,