diff --git a/nodejs/src/client.ts b/nodejs/src/client.ts
index 160a12d48..7da103267 100644
--- a/nodejs/src/client.ts
+++ b/nodejs/src/client.ts
@@ -1472,6 +1472,7 @@ export class CopilotClient {
                 remoteSession: config.remoteSession,
                 cloud: config.cloud,
                 expAssignments: config.expAssignments,
+                selfFetchManagedSettings: config.selfFetchManagedSettings,
             });
 
             const {
@@ -1683,6 +1684,7 @@ export class CopilotClient {
                 remoteSession: config.remoteSession,
                 openCanvases: config.openCanvases,
                 expAssignments: config.expAssignments,
+                selfFetchManagedSettings: config.selfFetchManagedSettings,
             });
 
             const { workspacePath, capabilities, openCanvases } = response as {
diff --git a/nodejs/src/types.ts b/nodejs/src/types.ts
index 97182b5f1..c4ef57626 100644
--- a/nodejs/src/types.ts
+++ b/nodejs/src/types.ts
@@ -2189,6 +2189,14 @@ export interface SessionConfigBase {
      */
     gitHubToken?: string;
 
+    /**
+     * Opt-in: when true, the runtime self-fetches enterprise managed settings
+     * (bypass-permissions policy) at session bootstrap using the session's
+     * `gitHubToken`. Requires {@link SessionConfigBase.gitHubToken} to be set;
+     * if omitted, the runtime is expected to reject session creation (fail-closed).
+     */
+    selfFetchManagedSettings?: boolean;
+
     /**
      * When true, skips embedding-based retrieval for this session.
      * Use in multitenant deployments to prevent cross-session information leakage