diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index c63a9436..d3e0b1ea 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -116,6 +116,10 @@ nfpms:
       - src: extra/example.conf
         dst: /etc/versitygw.d/example.conf
         type: config
+
+      - src: extra/example-iam.conf
+        dst: /etc/versitygw.d/example-iam.conf
+        type: config
   
       - dst: /etc/versitygw.d
         type: dir
diff --git a/extra/example-iam.conf b/extra/example-iam.conf
new file mode 100644
index 00000000..48877029
--- /dev/null
+++ b/extra/example-iam.conf
@@ -0,0 +1,144 @@
+##########################################
+# VersityGW standalone IAM configuration #
+##########################################
+
+# Copy this file to /etc/versitygw.d/ and rename it to a unique service name.
+# For example, /etc/versitygw.d/iam.conf is started with:
+# systemctl start versitygw@iam
+# systemctl enable versitygw@iam
+
+##############################
+# VersityGW Required Options #
+##############################
+
+# Run the standalone IAM API server.
+VGW_BACKEND=iam
+
+# The IAM API needs one storage backend. Set VGW_IAM_DIR for local file-backed
+# storage, or configure VGW_IAM_VAULT_ENDPOINT_URL and its authentication
+# options below for HashiCorp Vault storage.
+VGW_IAM_DIR=/var/lib/versitygw/iam
+
+# The access and secret options specify the root account credentials. The root
+# account has full authorization to IAM API requests after authentication.
+ROOT_ACCESS_KEY_ID=
+ROOT_SECRET_ACCESS_KEY=
+
+############################
+# VersityGW Global Options #
+############################
+
+# The IAM API listener address. It accepts the same comma-separated TCP or
+# UNIX-socket addresses as the gateway, for example :7076 or /run/vgw/iam.sock.
+#VGW_PORT=:7076
+
+# TLS certificate and private key for the IAM API listener.
+#VGW_CERT=
+#VGW_KEY=
+
+# Maximum concurrent connections and in-flight requests.
+#VGW_MAX_CONNECTIONS=250000
+#VGW_MAX_REQUESTS=100000
+
+# Region returned by IAM responses. Defaults to us-east-1.
+#VGW_REGION=us-east-1
+
+# Silence request logging to stdout.
+#VGW_QUIET=false
+
+# Enable HTTP keep-alive connections.
+#VGW_KEEP_ALIVE=false
+
+# File-mode permissions for file-backed UNIX sockets, as an octal integer.
+#VGW_SOCKET_PERM=
+
+# Configure this when a browser-based WebUI on another origin accesses IAM.
+#VGW_CORS_ALLOW_ORIGIN=
+
+# Override the S3 gateway URLs offered by the WebUI. Specify one or more
+# comma-separated URLs, for example http://localhost:7070 or
+# https://s3.example.com.
+#VGW_WEBUI_GATEWAYS=
+
+#################
+# Vault Storage #
+#################
+
+# Use Vault instead of VGW_IAM_DIR by setting the Vault endpoint and suitable
+# credentials.
+
+# Vault server URL for IAM storage.
+#VGW_IAM_VAULT_ENDPOINT_URL=
+
+# Fallback Vault namespace for both AppRole authentication and KV v2 storage.
+# The more-specific authentication and storage namespace options override it.
+#VGW_IAM_VAULT_NAMESPACE=
+
+# KV v2 path prefix used to store IAM users. Defaults to iam.
+#VGW_IAM_VAULT_SECRET_STORAGE_PATH=iam
+
+# Vault namespace for the KV v2 IAM storage path. Overrides VGW_IAM_VAULT_NAMESPACE.
+#VGW_IAM_VAULT_SECRET_STORAGE_NAMESPACE=
+
+# Vault authentication method mount path. Defaults to approle.
+#VGW_IAM_VAULT_AUTH_METHOD=approle
+
+# Vault namespace used for AppRole login. Overrides VGW_IAM_VAULT_NAMESPACE.
+#VGW_IAM_VAULT_AUTH_NAMESPACE=
+
+# Vault KV v2 secrets engine mount path. Defaults to kv-v2.
+#VGW_IAM_VAULT_MOUNT_PATH=kv-v2
+
+# Vault root token for authentication. Do not set this with the AppRole ID or
+# secret options below.
+#VGW_IAM_VAULT_ROOT_TOKEN=
+
+# Vault AppRole role ID for authentication. Set with VGW_IAM_VAULT_ROLE_SECRET
+# instead of VGW_IAM_VAULT_ROOT_TOKEN.
+#VGW_IAM_VAULT_ROLE_ID=
+
+# Vault AppRole secret ID for authentication. Set with VGW_IAM_VAULT_ROLE_ID
+# instead of VGW_IAM_VAULT_ROOT_TOKEN.
+#VGW_IAM_VAULT_ROLE_SECRET=
+
+# PEM-encoded Vault server TLS certificate used to verify the Vault server.
+#VGW_IAM_VAULT_SERVER_CERT=
+
+# PEM-encoded client TLS certificate presented to Vault.
+#VGW_IAM_VAULT_CLIENT_CERT=
+
+# PEM-encoded private key for VGW_IAM_VAULT_CLIENT_CERT.
+#VGW_IAM_VAULT_CLIENT_CERT_KEY=
+
+############################
+# Private IAM API Listener #
+############################
+
+# This private endpoint serves the VersityGW protocol used by S3 gateway
+# instances to communicate directly with the standalone IAM service.
+
+# Private endpoint listen addresses. Set one or more comma-separated UNIX
+# socket paths, or TCP addresses such as :7077 or 127.0.0.1:7077. TCP listeners
+# require the three mTLS settings below; UNIX sockets do not.
+#VGW_IAM_PRIVATE_PORTS=
+
+# TLS server certificate for TCP private endpoint listeners.
+#VGW_IAM_PRIVATE_CERT=
+
+# TLS private key for VGW_IAM_PRIVATE_CERT.
+#VGW_IAM_PRIVATE_CERT_KEY=
+
+# PEM-encoded CA bundle used to verify the S3 gateway's client certificate on
+# TCP private endpoint listeners.
+#VGW_IAM_PRIVATE_CLIENT_CA=
+
+# Octal permissions for file-backed UNIX private sockets, for example 0660.
+# This does not affect TCP or Linux abstract-namespace sockets.
+#VGW_IAM_PRIVATE_SOCKET_PERM=
+
+#################
+# OIDC Settings #
+#################
+
+# Reject OIDC provider creation without an explicit certificate thumbprint.
+#VGW_IAM_DISABLE_OIDC_THUMBPRINT_AUTOFETCH=false
\ No newline at end of file
diff --git a/extra/example.conf b/extra/example.conf
index ace350c7..3204301a 100644
--- a/extra/example.conf
+++ b/extra/example.conf
@@ -342,6 +342,15 @@ ROOT_SECRET_ACCESS_KEY=
 # Example: VGW_WEBUI_ADMIN_GATEWAYS=https://admin.example.com,http://192.168.1.100:7080
 #VGW_WEBUI_ADMIN_GATEWAYS=
 
+# The VGW_WEBUI_IAM_GATEWAYS option specifies standalone IAM service URLs for
+# the Web GUI login page. The IAM service is a separate process, so its URLs
+# cannot be auto-detected from this S3 gateway. Multiple URLs can be specified
+# as a comma-separated list. When set, the Web GUI uses the standalone IAM
+# service rather than the admin API: admin login and management surfaces are
+# hidden, and management requests use the S3 and IAM APIs.
+# Example: VGW_WEBUI_IAM_GATEWAYS=https://iam.example.com,http://localhost:7076
+#VGW_WEBUI_IAM_GATEWAYS=
+
 ###################
 # Website Hosting #
 ###################
@@ -519,6 +528,46 @@ ROOT_SECRET_ACCESS_KEY=
 # FreeIPA IAM debug output
 #VGW_IPA_DEBUG=false
 
+# The standalone IAM options connect this gateway to a separately deployed IAM
+# service through its private endpoint. Use a UNIX socket path, or use a TCP
+# address with all three mTLS options below.
+#VGW_IAM_STANDALONE_ENDPOINT=
+
+# Access key used to sign this gateway's private IAM service requests. Set this
+# together with VGW_IAM_STANDALONE_SECRET, or leave both unset to use the root
+# access and secret credentials.
+#VGW_IAM_STANDALONE_ACCESS=
+
+# Secret key used to sign this gateway's private IAM service requests. Set this
+# together with VGW_IAM_STANDALONE_ACCESS, or leave both unset to use the root
+# access and secret credentials.
+#VGW_IAM_STANDALONE_SECRET=
+
+# TLS client certificate presented to the standalone IAM service. Required for
+# a TCP VGW_IAM_STANDALONE_ENDPOINT; not used for a UNIX socket endpoint.
+#VGW_IAM_STANDALONE_CLIENT_CERT=
+
+# Private key for VGW_IAM_STANDALONE_CLIENT_CERT.
+#VGW_IAM_STANDALONE_CLIENT_CERT_KEY=
+
+# PEM-encoded CA bundle used to verify the standalone IAM service TLS
+# certificate. Required for a TCP VGW_IAM_STANDALONE_ENDPOINT; not used for a
+# UNIX socket endpoint.
+#VGW_IAM_STANDALONE_SERVER_CA=
+
+# POSIX user ID assigned to every account resolved through standalone IAM.
+# Standalone IAM has no per-user POSIX identity, so all accounts use this value.
+# Defaults to 0.
+#VGW_IAM_STANDALONE_DEFAULT_UID=0
+
+# POSIX group ID assigned to every account resolved through standalone IAM.
+# Defaults to 0.
+#VGW_IAM_STANDALONE_DEFAULT_GID=0
+
+# Project ID assigned to every account resolved through standalone IAM.
+# Defaults to 0.
+#VGW_IAM_STANDALONE_DEFAULT_PROJECT_ID=0
+
 ###############
 # IAM caching #
 ###############
diff --git a/extra/versitygw@.service b/extra/versitygw@.service
index 3764bd5a..36a7b8ce 100644
--- a/extra/versitygw@.service
+++ b/extra/versitygw@.service
@@ -17,7 +17,7 @@ Group=root
 
 EnvironmentFile=/etc/versitygw.d/%i.conf
 
-ExecStart=/bin/bash -c 'if [[ ! ("${VGW_BACKEND}" == "posix" || "${VGW_BACKEND}" == "scoutfs" || "${VGW_BACKEND}" == "s3" || "${VGW_BACKEND}" == "azure" || "${VGW_BACKEND}" == "plugin") ]]; then echo "VGW_BACKEND environment variable ${VGW_BACKEND} not set to valid backend type"; exit 1; fi && exec /usr/bin/versitygw "$VGW_BACKEND" "$VGW_BACKEND_ARG"'
+ExecStart=/bin/bash -c 'if [[ ! ("${VGW_BACKEND}" == "posix" || "${VGW_BACKEND}" == "scoutfs" || "${VGW_BACKEND}" == "s3" || "${VGW_BACKEND}" == "azure" || "${VGW_BACKEND}" == "plugin" || "${VGW_BACKEND}" == "iam") ]]; then echo "VGW_BACKEND environment variable ${VGW_BACKEND} not set to valid backend type"; exit 1; fi && exec /usr/bin/versitygw "$VGW_BACKEND" "$VGW_BACKEND_ARG"'
 
 # Let systemd restart this service always
 Restart=always