diff --git a/cmd/spire-server/cli/agent/agent_windows_test.go b/cmd/spire-server/cli/agent/agent_windows_test.go
index 7b98b75005..5c0daa3afb 100644
--- a/cmd/spire-server/cli/agent/agent_windows_test.go
+++ b/cmd/spire-server/cli/agent/agent_windows_test.go
@@ -8,11 +8,14 @@ var (
     	Indicates that the command will not perform any action, but will print the agents that would be purged.
   -expiredFor duration
     	Amount of time that has passed since the agent's SVID has expired. It is used to determine which agents to purge. (default 720h0m0s)
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	listUsage = `Usage of agent list:
   -attestationType string
     	Filter by attestation type, like join_token or x509pop.
@@ -22,6 +25,8 @@ var (
     	Filter based on string received, 'true': agents that can reattest, 'false': agents that can't reattest, other value will return all.
   -expiresBefore string
     	Filter by expiration time (format: "2006-01-02 15:04:05 -0700 -07")
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -matchSelectorsOn string
     	The match mode used when filtering by selectors. Options: exact, any, superset and subset (default "superset")
   -namedPipeName string
@@ -31,7 +36,10 @@ var (
   -selector value
     	A colon-delimited type:value selector. Can be used more than once
 `
+
 	banUsage = `Usage of agent ban:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -39,7 +47,10 @@ var (
   -spiffeID string
     	The SPIFFE ID of the agent to ban (agent identity)
 `
+
 	evictUsage = `Usage of agent evict:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -47,6 +58,7 @@ var (
   -spiffeID string
     	The SPIFFE ID of the agent to evict (agent identity)
 `
+
 	countUsage = `Usage of agent count:
   -attestationType string
     	Filter by attestation type, like join_token or x509pop.
@@ -56,8 +68,12 @@ var (
     	Filter based on string received, 'true': agents that can reattest, 'false': agents that can't reattest, other value will return all.
   -expiresBefore string
     	Filter by expiration time (format: "2006-01-02 15:04:05 -0700 -07")
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -matchSelectorsOn string
     	The match mode used when filtering by selectors. Options: exact, any, superset and subset (default "superset")
+  -instance string
+        Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -65,7 +81,10 @@ var (
   -selector value
     	A colon-delimited type:value selector. Can be used more than once
 `
+
 	showUsage = `Usage of agent show:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/bundle/bundle_windows_test.go b/cmd/spire-server/cli/bundle/bundle_windows_test.go
index 50cb993dc7..642ac912ce 100644
--- a/cmd/spire-server/cli/bundle/bundle_windows_test.go
+++ b/cmd/spire-server/cli/bundle/bundle_windows_test.go
@@ -8,6 +8,8 @@ var (
     	The format of the bundle data. Either "pem" or "spiffe". (default "pem")
   -id string
     	SPIFFE ID of the trust domain
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -15,33 +17,45 @@ var (
   -path string
     	Path to the bundle data
 `
+
 	showUsage = `Usage of bundle show:
   -format string
     	The format to show the bundle (only pretty output format supports this flag). Either "pem" or "spiffe". (default "pem")
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	countUsage = `Usage of bundle count:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	listUsage = `Usage of bundle list:
   -format string
     	The format to list federated bundles (only pretty output format supports this flag). Either "pem" or "spiffe". (default "pem")
   -id string
     	SPIFFE ID of the trust domain
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	deleteUsage = `Usage of bundle delete:
   -id string
     	SPIFFE ID of the trust domain
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -mode string
     	Deletion mode: one of restrict, delete, or dissociate (default "restrict")
   -namedPipeName string
@@ -49,4 +63,4 @@ var (
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
-)
+)
\ No newline at end of file
diff --git a/cmd/spire-server/cli/entry/util_windows_test.go b/cmd/spire-server/cli/entry/util_windows_test.go
index 373091ace3..4526886eb9 100644
--- a/cmd/spire-server/cli/entry/util_windows_test.go
+++ b/cmd/spire-server/cli/entry/util_windows_test.go
@@ -22,11 +22,10 @@ const (
     	SPIFFE ID of a trust domain to federate with. Can be used more than once
   -hint string
     	The entry hint, used to disambiguate entries with the same SPIFFE ID
-  -jwtSVIDIncludeJTI
-` + "    \tA boolean value that, when set, includes a unique 'jti' claim in JWT-SVIDs issued for this entry and bypasses the agent JWT-SVID cache\n" + `  -jwtSVIDTTL int
-    	The lifetime, in seconds, for JWT-SVIDs issued based on this registration entry.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
-    	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
+        Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -node
     	If set, this entry will be applied to matching nodes rather than workloads
   -output value
@@ -42,6 +41,7 @@ const (
   -x509SVIDTTL int
     	The lifetime, in seconds, for x509-SVIDs issued based on this registration entry.
 `
+
 	showUsage = `Usage of entry show:
   -downstream
     	A boolean value that, when set, indicates that the entry describes a downstream SPIRE server
@@ -51,6 +51,8 @@ const (
     	SPIFFE ID of a trust domain an entry is federate with. Can be used more than once
   -hint string
     	The Hint of the records to show (optional)
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -matchFederatesWithOn string
     	The match mode used when filtering by federates with. Options: exact, any, superset and subset (default "superset")
   -matchSelectorsOn string
@@ -66,6 +68,7 @@ const (
   -spiffeID string
     	The SPIFFE ID of the records to show
 `
+
 	updateUsage = `Usage of entry update:
   -admin
     	If set, the SPIFFE ID in this entry will be granted access to the SPIRE Server's management APIs
@@ -85,9 +88,10 @@ const (
     	SPIFFE ID of a trust domain to federate with. Can be used more than once
   -hint string
     	The entry hint, used to disambiguate entries with the same SPIFFE ID
-  -jwtSVIDIncludeJTI
-` + "    \tA boolean value that, when set, includes a unique 'jti' claim in JWT-SVIDs issued for this entry and bypasses the agent JWT-SVID cache\n" + `  -jwtSVIDTTL int
+  -jwtSVIDTTL int
     	The lifetime, in seconds, for JWT-SVIDs issued based on this registration entry.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).		
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -103,16 +107,20 @@ const (
   -x509SVIDTTL int
     	The lifetime, in seconds, for x509-SVIDs issued based on this registration entry.
 `
+
 	deleteUsage = `Usage of entry delete:
   -entryID string
     	The Registration Entry ID of the record to delete.
   -file string
     	Path to a file containing a JSON structure for batch deletion (optional). If set to '-', read from stdin.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	countUsage = `Usage of entry count:
   -downstream
     	A boolean value that, when set, indicates that the entry describes a downstream SPIRE server
@@ -120,6 +128,8 @@ const (
     	SPIFFE ID of a trust domain an entry is federate with. Can be used more than once
   -hint string
     	The Hint of the records to count (optional)
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -matchFederatesWithOn string
     	The match mode used when filtering by federates with. Options: exact, any, superset and subset (default "superset")
   -matchSelectorsOn string
diff --git a/cmd/spire-server/cli/federation/util_windows_test.go b/cmd/spire-server/cli/federation/util_windows_test.go
index 379fc10be9..737e8a31f0 100644
--- a/cmd/spire-server/cli/federation/util_windows_test.go
+++ b/cmd/spire-server/cli/federation/util_windows_test.go
@@ -12,6 +12,8 @@ const (
     	Path to a file containing federation relationships in JSON format (optional). If set to '-', read the JSON from stdin.
   -endpointSpiffeID string
     	SPIFFE ID of the SPIFFE bundle endpoint server. Only used for 'spiffe' profile.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -23,29 +25,41 @@ const (
   -trustDomainBundlePath string
     	Path to the trust domain bundle data (optional).
 `
+
 	deleteUsage = `Usage of federation delete:
   -id string
     	SPIFFE ID of the trust domain
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	listUsage = `Usage of federation list:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	refreshUsage = `Usage of federation refresh:
   -id string
     	SPIFFE ID of the trust domain
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
+
 	showUsage = `Usage of federation show:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -53,6 +67,7 @@ const (
   -trustDomain string
     	The trust domain name of the federation relationship to show
 `
+
 	updateUsage = `Usage of federation update:
   -bundleEndpointProfile string
     	Endpoint profile type (either "https_web" or "https_spiffe")
@@ -62,6 +77,8 @@ const (
     	Path to a file containing federation relationships in JSON format (optional). If set to '-', read the JSON from stdin.
   -endpointSpiffeID string
     	SPIFFE ID of the SPIFFE bundle endpoint server. Only used for 'spiffe' profile.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
@@ -73,4 +90,4 @@ const (
   -trustDomainBundlePath string
     	Path to the trust domain bundle data (optional).
 `
-)
+)
\ No newline at end of file
diff --git a/cmd/spire-server/cli/healthcheck/healthcheck_windows_test.go b/cmd/spire-server/cli/healthcheck/healthcheck_windows_test.go
index 71644c1ac8..83cf62c3e4 100644
--- a/cmd/spire-server/cli/healthcheck/healthcheck_windows_test.go
+++ b/cmd/spire-server/cli/healthcheck/healthcheck_windows_test.go
@@ -4,6 +4,8 @@ package healthcheck
 
 var (
 	healthcheckUsage = `Usage of healthcheck:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -shallow
diff --git a/cmd/spire-server/cli/jwt/mint_test.go b/cmd/spire-server/cli/jwt/mint_test.go
index 62e3caf301..7fe8672656 100644
--- a/cmd/spire-server/cli/jwt/mint_test.go
+++ b/cmd/spire-server/cli/jwt/mint_test.go
@@ -33,9 +33,11 @@ qNV3lKIL59N7G2B4ojbhfSNneSIIpP448uPxUnaunaQZ+/m7+x9oobIp
 -----END PRIVATE KEY-----
 `))
 	availableFormats = []string{"pretty", "json"}
-	expectedUsage    = `Usage of jwt mint:
+	expectedUsage = `Usage of jwt mint:
   -audience value
-    	Audience claim that will be included in the SVID. Can be used more than once.` + clitest.AddrOutputUsage +
+    	Audience claim that will be included in the SVID. Can be used more than once.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).` + clitest.AddrOutputUsage +
 		`  -spiffeID string
     	SPIFFE ID of the JWT-SVID
   -ttl duration
diff --git a/cmd/spire-server/cli/localauthority/jwt/jwt_activate_windows_test.go b/cmd/spire-server/cli/localauthority/jwt/jwt_activate_windows_test.go
index 382b0df1bb..3d19c7591c 100644
--- a/cmd/spire-server/cli/localauthority/jwt/jwt_activate_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/jwt/jwt_activate_windows_test.go
@@ -6,6 +6,8 @@ var (
 	jwtActivateUsage = `Usage of localauthority jwt activate:
   -authorityID string
     	The authority ID of the JWT authority to activate
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/jwt/jwt_prepare_windows_test.go b/cmd/spire-server/cli/localauthority/jwt/jwt_prepare_windows_test.go
index bd54e03f07..b21ba8c917 100644
--- a/cmd/spire-server/cli/localauthority/jwt/jwt_prepare_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/jwt/jwt_prepare_windows_test.go
@@ -4,9 +4,11 @@ package jwt_test
 
 var (
 	jwtPrepareUsage = `Usage of localauthority jwt prepare:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
-)
+)
\ No newline at end of file
diff --git a/cmd/spire-server/cli/localauthority/jwt/jwt_revoke_windows_test.go b/cmd/spire-server/cli/localauthority/jwt/jwt_revoke_windows_test.go
index f0f76a9b0b..2c8b9468db 100644
--- a/cmd/spire-server/cli/localauthority/jwt/jwt_revoke_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/jwt/jwt_revoke_windows_test.go
@@ -6,9 +6,11 @@ var (
 	jwtRevokeUsage = `Usage of localauthority jwt revoke:
   -authorityID string
     	The authority ID of the JWT authority to revoke
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
-)
+)
\ No newline at end of file
diff --git a/cmd/spire-server/cli/localauthority/jwt/jwt_show_windows_test.go b/cmd/spire-server/cli/localauthority/jwt/jwt_show_windows_test.go
index 9b7c48b162..3527aaff05 100644
--- a/cmd/spire-server/cli/localauthority/jwt/jwt_show_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/jwt/jwt_show_windows_test.go
@@ -4,6 +4,8 @@ package jwt_test
 
 var (
 	jwtShowUsage = `Usage of localauthority jwt show:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/jwt/jwt_taint_windows_test.go b/cmd/spire-server/cli/localauthority/jwt/jwt_taint_windows_test.go
index 17929f1a6b..40dcbbb9b5 100644
--- a/cmd/spire-server/cli/localauthority/jwt/jwt_taint_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/jwt/jwt_taint_windows_test.go
@@ -6,6 +6,8 @@ var (
 	jwtTaintUsage = `Usage of localauthority jwt taint:
   -authorityID string
     	The authority ID of the JWT authority to taint
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/x509/x509_activate_windows_test.go b/cmd/spire-server/cli/localauthority/x509/x509_activate_windows_test.go
index b011473b71..d7131e7dda 100644
--- a/cmd/spire-server/cli/localauthority/x509/x509_activate_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/x509/x509_activate_windows_test.go
@@ -6,6 +6,8 @@ var (
 	x509ActivateUsage = `Usage of localauthority x509 activate:
   -authorityID string
     	The authority ID of the X.509 authority to activate
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/x509/x509_prepare_windows_test.go b/cmd/spire-server/cli/localauthority/x509/x509_prepare_windows_test.go
index 353ee4654e..dc66205790 100644
--- a/cmd/spire-server/cli/localauthority/x509/x509_prepare_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/x509/x509_prepare_windows_test.go
@@ -4,6 +4,8 @@ package x509_test
 
 var (
 	x509PrepareUsage = `Usage of localauthority x509 prepare:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/x509/x509_revoke_windows_test.go b/cmd/spire-server/cli/localauthority/x509/x509_revoke_windows_test.go
index 85896e92af..e385c61c9a 100644
--- a/cmd/spire-server/cli/localauthority/x509/x509_revoke_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/x509/x509_revoke_windows_test.go
@@ -6,6 +6,8 @@ var (
 	x509RevokeUsage = `Usage of localauthority x509 revoke:
   -authorityID string
     	The authority ID of the X.509 authority to revoke
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/x509/x509_show_windows_test.go b/cmd/spire-server/cli/localauthority/x509/x509_show_windows_test.go
index a00cbc9694..48fe4d2cb2 100644
--- a/cmd/spire-server/cli/localauthority/x509/x509_show_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/x509/x509_show_windows_test.go
@@ -4,6 +4,8 @@ package x509_test
 
 var (
 	x509ShowUsage = `Usage of localauthority x509 show:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/localauthority/x509/x509_taint_windows_test.go b/cmd/spire-server/cli/localauthority/x509/x509_taint_windows_test.go
index 4f91931f02..f66f65845b 100644
--- a/cmd/spire-server/cli/localauthority/x509/x509_taint_windows_test.go
+++ b/cmd/spire-server/cli/localauthority/x509/x509_taint_windows_test.go
@@ -6,6 +6,8 @@ var (
 	x509TaintUsage = `Usage of localauthority x509 taint:
   -authorityID string
     	The authority ID of the X.509 authority to taint
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/logger/get_windows_test.go b/cmd/spire-server/cli/logger/get_windows_test.go
index d7a1c53582..4a376dc29b 100644
--- a/cmd/spire-server/cli/logger/get_windows_test.go
+++ b/cmd/spire-server/cli/logger/get_windows_test.go
@@ -4,9 +4,11 @@ package logger_test
 
 var (
 	getUsage = `Usage of logger get:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
     	Desired output format (pretty, json); default: pretty.
 `
-)
+)
\ No newline at end of file
diff --git a/cmd/spire-server/cli/logger/reset_windows_test.go b/cmd/spire-server/cli/logger/reset_windows_test.go
index e33892c48a..2906fef7ec 100644
--- a/cmd/spire-server/cli/logger/reset_windows_test.go
+++ b/cmd/spire-server/cli/logger/reset_windows_test.go
@@ -4,6 +4,8 @@ package logger_test
 
 var (
 	resetUsage = `Usage of logger reset:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/logger/set_windows_test.go b/cmd/spire-server/cli/logger/set_windows_test.go
index 492be43c99..b2870ef6d8 100644
--- a/cmd/spire-server/cli/logger/set_windows_test.go
+++ b/cmd/spire-server/cli/logger/set_windows_test.go
@@ -4,6 +4,8 @@ package logger_test
 
 var (
 	setUsage = `Usage of logger set:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -level string
     	The new log level, one of (panic, fatal, error, warn, info, debug, trace)
   -namedPipeName string
diff --git a/cmd/spire-server/cli/upstreamauthority/revoke_windows_test.go b/cmd/spire-server/cli/upstreamauthority/revoke_windows_test.go
index 51e079ec01..14bcdc1363 100644
--- a/cmd/spire-server/cli/upstreamauthority/revoke_windows_test.go
+++ b/cmd/spire-server/cli/upstreamauthority/revoke_windows_test.go
@@ -4,6 +4,8 @@ package upstreamauthority_test
 
 var (
 	revokeUsage = `Usage of upstreamauthority revoke:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/upstreamauthority/taint_windows_test.go b/cmd/spire-server/cli/upstreamauthority/taint_windows_test.go
index 47886764ce..5740f5427b 100644
--- a/cmd/spire-server/cli/upstreamauthority/taint_windows_test.go
+++ b/cmd/spire-server/cli/upstreamauthority/taint_windows_test.go
@@ -4,6 +4,8 @@ package upstreamauthority_test
 
 var (
 	taintUsage = `Usage of upstreamauthority taint:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -namedPipeName string
     	Pipe name of the SPIRE Server API named pipe (default "\\spire-server\\private\\api")
   -output value
diff --git a/cmd/spire-server/cli/wit/mint_windows_test.go b/cmd/spire-server/cli/wit/mint_windows_test.go
index c71f2e6e9c..9e2668c224 100644
--- a/cmd/spire-server/cli/wit/mint_windows_test.go
+++ b/cmd/spire-server/cli/wit/mint_windows_test.go
@@ -8,6 +8,8 @@ import (
 
 var (
 	expectedUsage = `Usage of wit mint:
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).
   -keyType string
     	Key type of the WIT-SVID (default "ec-p256")` + clitest.AddrOutputForCasesWhereOptionsStartWithS +
 		`  -signingAlgorithm string
@@ -19,4 +21,4 @@ var (
   -write string
     	Directory to write output to instead of stdout
 `
-)
+)
\ No newline at end of file
diff --git a/cmd/spire-server/cli/x509/mint_test.go b/cmd/spire-server/cli/x509/mint_test.go
index dae3c6f9d5..d7d402bdde 100644
--- a/cmd/spire-server/cli/x509/mint_test.go
+++ b/cmd/spire-server/cli/x509/mint_test.go
@@ -34,8 +34,9 @@ import (
 var (
 	expectedUsage = `Usage of x509 mint:
   -dns value
-    	DNS name that will be included in SVID. Can be used more than once.` + clitest.AddrOutputUsage +
-		`  -spiffeID string
+    	DNS name that will be included in SVID. Can be used more than once.
+  -instance string
+    	Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).` + clitest.AddrOutputUsage + `  -spiffeID string
     	SPIFFE ID of the X509-SVID
   -ttl duration
     	TTL of the X509-SVID
diff --git a/cmd/spire-server/util/util_windows.go b/cmd/spire-server/util/util_windows.go
index 494ad4ad97..6bdb03f357 100644
--- a/cmd/spire-server/util/util_windows.go
+++ b/cmd/spire-server/util/util_windows.go
@@ -8,16 +8,21 @@ import (
 	"net"
 	"strings"
 
+	"fmt"
+	"os"
+
 	"github.com/Microsoft/go-winio"
 	"github.com/spiffe/spire/pkg/common/namedpipe"
 )
 
 type adapterOS struct {
 	namedPipeName string
+	instance      string
 }
 
 func (a *Adapter) addOSFlags(flags *flag.FlagSet) {
 	flags.StringVar(&a.namedPipeName, "namedPipeName", DefaultNamedPipeName, "Pipe name of the SPIRE Server API named pipe")
+	flags.StringVar(&a.instance, "instance", "", "Instance name to substitute into socket templates (env SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE).")
 }
 
 func dialer(ctx context.Context, addr string) (net.Conn, error) {
@@ -28,14 +33,41 @@ func dialer(ctx context.Context, addr string) (net.Conn, error) {
 }
 
 func (a *Adapter) getGRPCAddr() (string, error) {
-	if a.namedPipeName == "" {
-		a.namedPipeName = DefaultNamedPipeName
+	tpl := os.Getenv("SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE")
+	pipe := os.Getenv("SPIRE_SERVER_PRIVATE_SOCKET")
+
+	if a.instance != "" {
+		if tpl == "" {
+			return "", fmt.Errorf(
+				"you must define %s to use the instance flag",
+				"SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE",
+			)
+		}
+
+		if !strings.Contains(tpl, "%i") {
+			return "", fmt.Errorf(
+				"failed to find %%i in %s",
+				"SPIRE_SERVER_PRIVATE_SOCKET_TEMPLATE",
+			)
+		}
 	}
 
+	namedPipeName := DefaultNamedPipeName
+
+	switch {
+	case a.namedPipeName != DefaultNamedPipeName:
+		namedPipeName = a.namedPipeName
+
+	case a.instance != "":
+		namedPipeName = strings.ReplaceAll(tpl, "%i", a.instance)
+
+	case pipe != "":
+		namedPipeName = pipe
+	}
 	// When grpc-go deprecated grpc.DialContext() in favor of grpc.NewClient(),
 	// they made a breaking change to always use the DNS resolver, even when overriding the context dialer.
 	// This is problematic for clients that do not use DNS for address resolution and don't set a resolver in the address.
 	// As a workaround, use the passthrough resolver to prevent using the DNS resolver.
 	// More context can be found in this issue: https://github.com/grpc/grpc-go/issues/1786#issuecomment-2114124036
-	return "passthrough:" + namedpipe.AddrFromName(a.namedPipeName).String(), nil
+	return "passthrough:" + namedpipe.AddrFromName(namedPipeName).String(), nil
 }
diff --git a/failures.txt b/failures.txt
new file mode 100644
index 0000000000..e69de29bb2