diff --git a/extra/example-iam.conf b/extra/example-iam.conf
index d6bb7e42..37041de0 100644
--- a/extra/example-iam.conf
+++ b/extra/example-iam.conf
@@ -43,23 +43,60 @@ ROOT_SECRET_ACCESS_KEY=
 # Region returned by IAM responses. Defaults to us-east-1.
 #VGW_REGION=us-east-1
 
+# Set the debug logger verbosity to silent, debug, or unsafe. The unsafe level
+# writes credentials and tokens in the clear, so use it only for local
+# troubleshooting on a trusted machine.
+#VGW_LOG_LEVEL=silent
+
+# VGW_DEBUG is a deprecated alias for VGW_LOG_LEVEL=debug.
+#VGW_DEBUG=false
+
+# Enable the pprof HTTP server on the specified address, for example
+# localhost:6060.
+#VGW_PPROF=
+
 # Silence request logging to stdout.
 #VGW_QUIET=false
 
 # Enable HTTP keep-alive connections.
 #VGW_KEEP_ALIVE=false
 
+# Configure an unauthenticated GET health endpoint, for example /health.
+#VGW_HEALTH=
+
 # File-mode permissions for file-backed UNIX sockets, as an octal integer.
 #VGW_SOCKET_PERM=
 
 # Configure this when a browser-based WebUI on another origin accesses IAM.
 #VGW_CORS_ALLOW_ORIGIN=
 
+# Enable the WebUI on one or more comma-separated listener addresses.
+#VGW_WEBUI_PORT=
+
+# Use separate TLS credentials for the WebUI. When unset, the WebUI uses
+# VGW_CERT and VGW_KEY.
+#VGW_WEBUI_CERT=
+#VGW_WEBUI_KEY=
+
+# Disable WebUI TLS even when TLS is configured for the IAM API.
+#VGW_WEBUI_NO_TLS=false
+
+# Mount the WebUI under a single path segment, for example /ui.
+#VGW_WEBUI_PATH_PREFIX=
+
 # Override the S3 gateway URLs offered by the WebUI. Specify one or more
 # comma-separated URLs, for example http://localhost:7070 or
 # https://s3.example.com.
 #VGW_WEBUI_GATEWAYS=
 
+# Override the admin gateway URLs offered by the WebUI. Specify one or more
+# comma-separated URLs, for example https://admin.example.com.
+#VGW_WEBUI_ADMIN_GATEWAYS=
+
+# Override the public IAM API URLs used by the WebUI, for example when this
+# service is reached through an ingress hostname that differs from VGW_PORT.
+#VGW_WEBUI_IAM_GATEWAYS=
+
 #################
 # Vault Storage #
 #################
diff --git a/extra/example.conf b/extra/example.conf
index 589564cb..d19f354f 100644
--- a/extra/example.conf
+++ b/extra/example.conf
@@ -504,7 +504,6 @@ ROOT_SECRET_ACCESS_KEY=
 # secret credentials and role respectively. The other options are used to
 # connect to the LDAP service.
 #VGW_IAM_LDAP_URL=
-#VGW_IAM_LDAP_BASE_DN=
 #VGW_IAM_LDAP_BIND_DN=
 #VGW_IAM_LDAP_BIND_PASS=
 #VGW_IAM_LDAP_QUERY_BASE=
@@ -514,6 +513,7 @@ ROOT_SECRET_ACCESS_KEY=
 #VGW_IAM_LDAP_ROLE_ATR=
 #VGW_IAM_LDAP_USER_ID_ATR=
 #VGW_IAM_LDAP_GROUP_ID_ATR=
+#VGW_IAM_LDAP_PROJECT_ID_ATR=
 # Disable TLS certificate verification for LDAP connections (insecure, allows
 # self-signed certificates). This should only be used in testing environments
 # or when using self-signed certificates. The default is false (verification
@@ -535,8 +535,6 @@ ROOT_SECRET_ACCESS_KEY=
 #VGW_IPA_PASSWORD=
 # Disable verify TLS certificate of FreeIPA server
 #VGW_IPA_INSECURE=false
-# FreeIPA IAM debug output
-#VGW_IPA_DEBUG=false
 
 # The standalone IAM options connect this gateway to a separately deployed IAM
 # service through its private endpoint. Use a UNIX socket path, or use a TCP