diff --git a/static/schemas/Builder.schema.json b/static/schemas/Builder.schema.json
index 539e99d..84a6180 100644
--- a/static/schemas/Builder.schema.json
+++ b/static/schemas/Builder.schema.json
@@ -53,7 +53,7 @@
     "instance_id": {
       "description": "Instance ID from `xmpMM:InstanceID` in XMP metadata.",
       "type": "string",
-      "default": "xmp:iid:71fdc000-fc8a-48c7-a6b0-d5287352ebf1"
+      "default": "xmp:iid:641aeb01-3d3d-4a2b-a4c2-9ac324bbd5f1"
     },
     "thumbnail": {
       "description": "An optional ResourceRef to a thumbnail image that represents the asset that was signed.\nMust be available when the manifest is signed.",
diff --git a/static/schemas/ManifestDefinition.schema.json b/static/schemas/ManifestDefinition.schema.json
index 37de787..3df6989 100644
--- a/static/schemas/ManifestDefinition.schema.json
+++ b/static/schemas/ManifestDefinition.schema.json
@@ -53,7 +53,7 @@
     "instance_id": {
       "description": "Instance ID from `xmpMM:InstanceID` in XMP metadata.",
       "type": "string",
-      "default": "xmp:iid:74bac48c-2fac-4329-941d-dccfa287bb97"
+      "default": "xmp:iid:915f9d8b-7f7d-4805-84a9-5b85b1c3207b"
     },
     "thumbnail": {
       "description": "An optional ResourceRef to a thumbnail image that represents the asset that was signed.\nMust be available when the manifest is signed.",
diff --git a/static/schemas/Reader.schema.json b/static/schemas/Reader.schema.json
index 16c805e..a058da6 100644
--- a/static/schemas/Reader.schema.json
+++ b/static/schemas/Reader.schema.json
@@ -108,7 +108,7 @@
         "instance_id": {
           "description": "Instance ID from `xmpMM:InstanceID` in XMP metadata.",
           "type": "string",
-          "default": "xmp:iid:b69102a5-27e9-4277-b39e-3c60b0f109ef"
+          "default": "xmp:iid:2ddff3fb-db7e-404a-8ed9-46ab86347697"
         },
         "thumbnail": {
           "anyOf": [
diff --git a/static/schemas/Settings.schema.json b/static/schemas/Settings.schema.json
index 9cd563c..26adb7c 100644
--- a/static/schemas/Settings.schema.json
+++ b/static/schemas/Settings.schema.json
@@ -19,7 +19,8 @@
         "user_anchors": null,
         "trust_anchors": null,
         "trust_config": null,
-        "allowed_list": null
+        "allowed_list": null,
+        "trusted_ica_issuers": null
       }
     },
     "cawg_trust": {
@@ -30,7 +31,8 @@
         "user_anchors": null,
         "trust_anchors": null,
         "trust_config": null,
-        "allowed_list": null
+        "allowed_list": null,
+        "trusted_ica_issuers": null
       }
     },
     "core": {
@@ -162,6 +164,17 @@
             "null"
           ],
           "default": null
+        },
+        "trusted_ica_issuers": {
+          "description": "Exact-match allow-list of trusted CAWG identity claims aggregation (ICA)\nissuer DIDs.\n\nEach entry is a full DID string (any DID method) that is compared, after\nstripping any fragment, against the `issuer` of an ICA verifiable\ncredential. An issuer that is not present on this list is reported with\nthe informational code `cawg.ica.untrusted_issuer` for that identity\nassertion and its `cawg.ica.credential_valid` success code is withheld.\n\nThe default value is empty, meaning that NO ICA issuer is trusted. This\nis a deliberate secure default: a self-issued `did:jwk` (or any other\nissuer) is not trustworthy simply because its signature is\nself-consistent. Populate this list with the DIDs of issuers you trust.",
+          "type": [
+            "array",
+            "null"
+          ],
+          "items": {
+            "type": "string"
+          },
+          "default": null
         }
       }
     },