diff --git a/bento_lib/package.cfg b/bento_lib/package.cfg
index 3c2f5ab..8df1d61 100644
--- a/bento_lib/package.cfg
+++ b/bento_lib/package.cfg
@@ -1,5 +1,5 @@
 [package]
 name = bento_lib
-version = 9.0.0a3
+version = 9.0.0a4
 authors = David Lougheed, Paul Pillot
 author_emails = david.lougheed@mail.mcgill.ca, paul.pillot@computationalgenomics.ca
diff --git a/bento_lib/workflows/models.py b/bento_lib/workflows/models.py
index 5d7777d..314be73 100644
--- a/bento_lib/workflows/models.py
+++ b/bento_lib/workflows/models.py
@@ -98,10 +98,23 @@ class WorkflowDirectoryArrayInput(WorkflowBaseInput):
 
 
 class WorkflowServiceUrlInput(WorkflowInjectedInput):
+    # service URL from the service registry, using bento.serviceKind as a lookup
     type: Literal["service-url"] = "service-url"
     service_kind: str
 
 
+class WorkflowConfigInput(WorkflowInjectedInput):
+    # configuration injection from the workflow executor - stored in the database
+    type: Literal["config"] = "config"
+    key: str
+
+
+class WorkflowSecretInput(WorkflowInjectedInput):
+    # secret injection from the workflow executor - not present in the database, passed ephemerally
+    type: Literal["secret"] = "secret"
+    key: str
+
+
 WorkflowInput = (
     WorkflowStringInput |
     WorkflowStringArrayInput |
@@ -115,7 +128,9 @@ class WorkflowServiceUrlInput(WorkflowInjectedInput):
     WorkflowFileArrayInput |
     WorkflowDirectoryInput |
     WorkflowDirectoryArrayInput |
-    WorkflowServiceUrlInput
+    WorkflowServiceUrlInput |
+    WorkflowConfigInput |
+    WorkflowSecretInput
 )