diff --git a/core/proxy.proto b/core/proxy.proto
index 4c2194b..2d9d081 100644
--- a/core/proxy.proto
+++ b/core/proxy.proto
@@ -362,6 +362,11 @@ service Proxy {
   * so requests and responses are actually sent in reverse.
   */
   rpc Bidi(stream CoreResponse) returns (stream CoreRequest);
+  /*
+  * Purges existing on-disk gRPC TLS credentials and signals the server to re-enter setup mode
+  * so that core can provision new ones.
+  */
+  rpc Purge(google.protobuf.Empty) returns (google.protobuf.Empty);
 }
 
 message LogEntry {