diff --git a/api/BUILD b/api/BUILD
index f7c75a2d7faea..59332b7c8c3c4 100644
--- a/api/BUILD
+++ b/api/BUILD
@@ -136,13 +136,16 @@ proto_library(
         "//envoy/config/filter/thrift/router/v2alpha1:pkg",
         "//envoy/config/grpc_credential/v3:pkg",
         "//envoy/config/health_checker/redis/v2:pkg",
+        "//envoy/config/health_checker/redis/v3:pkg",
         "//envoy/config/listener/v3:pkg",
         "//envoy/config/metrics/v3:pkg",
         "//envoy/config/overload/v3:pkg",
         "//envoy/config/ratelimit/v3:pkg",
         "//envoy/config/rbac/v3:pkg",
         "//envoy/config/resource_monitor/fixed_heap/v2alpha:pkg",
+        "//envoy/config/resource_monitor/fixed_heap/v3:pkg",
         "//envoy/config/resource_monitor/injected_resource/v2alpha:pkg",
+        "//envoy/config/resource_monitor/injected_resource/v3:pkg",
         "//envoy/config/retry/omit_canary_hosts/v2:pkg",
         "//envoy/config/retry/previous_hosts/v2:pkg",
         "//envoy/config/route/v3:pkg",
@@ -230,6 +233,7 @@ proto_library(
         "//envoy/extensions/filters/network/sni_dynamic_forward_proxy/v3alpha:pkg",
         "//envoy/extensions/filters/network/tcp_proxy/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/filters/ratelimit/v3:pkg",
+        "//envoy/extensions/filters/network/thrift_proxy/router/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/v3:pkg",
         "//envoy/extensions/filters/network/wasm/v3:pkg",
         "//envoy/extensions/filters/network/zookeeper_proxy/v3:pkg",
@@ -240,6 +244,7 @@ proto_library(
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
         "//envoy/extensions/network/socket_interface/v3:pkg",
         "//envoy/extensions/retry/host/omit_host_metadata/v3:pkg",
+        "//envoy/extensions/retry/host/previous_hosts/v3:pkg",
         "//envoy/extensions/retry/priority/previous_priorities/v3:pkg",
         "//envoy/extensions/stat_sinks/wasm/v3:pkg",
         "//envoy/extensions/transport_sockets/alts/v3:pkg",
diff --git a/api/envoy/config/filter/thrift/router/v2alpha1/router.proto b/api/envoy/config/filter/thrift/router/v2alpha1/router.proto
index 5463ab6513bee..8640277f414cd 100644
--- a/api/envoy/config/filter/thrift/router/v2alpha1/router.proto
+++ b/api/envoy/config/filter/thrift/router/v2alpha1/router.proto
@@ -7,7 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.config.filter.thrift.router.v2alpha1";
 option java_outer_classname = "RouterProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Router]
 // Thrift router :ref:`configuration overview <config_thrift_filters_router>`.
diff --git a/api/envoy/config/health_checker/redis/v2/redis.proto b/api/envoy/config/health_checker/redis/v2/redis.proto
index 0c569f5c75e8c..4e6d8e47d7be0 100644
--- a/api/envoy/config/health_checker/redis/v2/redis.proto
+++ b/api/envoy/config/health_checker/redis/v2/redis.proto
@@ -7,7 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.config.health_checker.redis.v2";
 option java_outer_classname = "RedisProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Redis]
 // Redis health checker :ref:`configuration overview <config_health_checkers_redis>`.
diff --git a/api/envoy/config/health_checker/redis/v3/BUILD b/api/envoy/config/health_checker/redis/v3/BUILD
new file mode 100644
index 0000000000000..1cb4c6154f26e
--- /dev/null
+++ b/api/envoy/config/health_checker/redis/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/health_checker/redis/v2:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/api/envoy/config/health_checker/redis/v3/redis.proto b/api/envoy/config/health_checker/redis/v3/redis.proto
new file mode 100644
index 0000000000000..0cf9a11170afb
--- /dev/null
+++ b/api/envoy/config/health_checker/redis/v3/redis.proto
@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package envoy.config.health_checker.redis.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.config.health_checker.redis.v3";
+option java_outer_classname = "RedisProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Redis]
+// Redis health checker :ref:`configuration overview <config_health_checkers_redis>`.
+// [#extension: envoy.health_checkers.redis]
+
+message Redis {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.health_checker.redis.v2.Redis";
+
+  // If set, optionally perform ``EXISTS <key>`` instead of ``PING``. A return value
+  // from Redis of 0 (does not exist) is considered a passing healthcheck. A return value other
+  // than 0 is considered a failure. This allows the user to mark a Redis instance for maintenance
+  // by setting the specified key to any value and waiting for traffic to drain.
+  string key = 1;
+}
diff --git a/api/envoy/config/overload/v3/overload.proto b/api/envoy/config/overload/v3/overload.proto
index 55a66500c94ed..6e658de9028c7 100644
--- a/api/envoy/config/overload/v3/overload.proto
+++ b/api/envoy/config/overload/v3/overload.proto
@@ -36,9 +36,9 @@ message ResourceMonitor {
   // resource monitor type. The built-in resource monitors are:
   //
   // * :ref:`envoy.resource_monitors.fixed_heap
-  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig>`
+  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v3.FixedHeapConfig>`
   // * :ref:`envoy.resource_monitors.injected_resource
-  //   <envoy_api_msg_config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig>`
+  //   <envoy_api_msg_config.resource_monitor.injected_resource.v3.InjectedResourceConfig>`
   string name = 1 [(validate.rules).string = {min_len: 1}];
 
   // Configuration for the resource monitor being instantiated.
diff --git a/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto b/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
index 529622a071e77..65612a40f1391 100644
--- a/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
+++ b/api/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
@@ -8,7 +8,7 @@ import "validate/validate.proto";
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.fixed_heap.v2alpha";
 option java_outer_classname = "FixedHeapProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Fixed heap]
 // [#extension: envoy.resource_monitors.fixed_heap]
diff --git a/api/envoy/config/resource_monitor/fixed_heap/v3/BUILD b/api/envoy/config/resource_monitor/fixed_heap/v3/BUILD
new file mode 100644
index 0000000000000..3fb51ff1ccaa9
--- /dev/null
+++ b/api/envoy/config/resource_monitor/fixed_heap/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/resource_monitor/fixed_heap/v2alpha:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/api/envoy/config/resource_monitor/fixed_heap/v3/fixed_heap.proto b/api/envoy/config/resource_monitor/fixed_heap/v3/fixed_heap.proto
new file mode 100644
index 0000000000000..138ed1a76a935
--- /dev/null
+++ b/api/envoy/config/resource_monitor/fixed_heap/v3/fixed_heap.proto
@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package envoy.config.resource_monitor.fixed_heap.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.resource_monitor.fixed_heap.v3";
+option java_outer_classname = "FixedHeapProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Fixed heap]
+// [#extension: envoy.resource_monitors.fixed_heap]
+
+// The fixed heap resource monitor reports the Envoy process memory pressure, computed as a
+// fraction of currently reserved heap memory divided by a statically configured maximum
+// specified in the FixedHeapConfig.
+message FixedHeapConfig {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig";
+
+  uint64 max_heap_size_bytes = 1 [(validate.rules).uint64 = {gt: 0}];
+}
diff --git a/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto b/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
index a9f056d2d29aa..b8d48b60f98e1 100644
--- a/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
+++ b/api/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
@@ -8,7 +8,7 @@ import "validate/validate.proto";
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.injected_resource.v2alpha";
 option java_outer_classname = "InjectedResourceProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Injected resource]
 // [#extension: envoy.resource_monitors.injected_resource]
diff --git a/api/envoy/config/resource_monitor/injected_resource/v3/BUILD b/api/envoy/config/resource_monitor/injected_resource/v3/BUILD
new file mode 100644
index 0000000000000..975b8fcbd5a32
--- /dev/null
+++ b/api/envoy/config/resource_monitor/injected_resource/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/resource_monitor/injected_resource/v2alpha:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/api/envoy/config/resource_monitor/injected_resource/v3/injected_resource.proto b/api/envoy/config/resource_monitor/injected_resource/v3/injected_resource.proto
new file mode 100644
index 0000000000000..c903ef266906b
--- /dev/null
+++ b/api/envoy/config/resource_monitor/injected_resource/v3/injected_resource.proto
@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package envoy.config.resource_monitor.injected_resource.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.resource_monitor.injected_resource.v3";
+option java_outer_classname = "InjectedResourceProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Injected resource]
+// [#extension: envoy.resource_monitors.injected_resource]
+
+// The injected resource monitor allows injecting a synthetic resource pressure into Envoy
+// via a text file, which must contain a floating-point number in the range [0..1] representing
+// the resource pressure and be updated atomically by a symbolic link swap.
+// This is intended primarily for integration tests to force Envoy into an overloaded state.
+message InjectedResourceConfig {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig";
+
+  string filename = 1 [(validate.rules).string = {min_len: 1}];
+}
diff --git a/api/envoy/extensions/filters/network/thrift_proxy/router/v3/BUILD b/api/envoy/extensions/filters/network/thrift_proxy/router/v3/BUILD
new file mode 100644
index 0000000000000..c24f669b9bbde
--- /dev/null
+++ b/api/envoy/extensions/filters/network/thrift_proxy/router/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/filter/thrift/router/v2alpha1:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/api/envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto b/api/envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto
new file mode 100644
index 0000000000000..860622cb61e42
--- /dev/null
+++ b/api/envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto
@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.network.thrift_proxy.router.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.network.thrift_proxy.router.v3";
+option java_outer_classname = "RouterProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Router]
+// Thrift router :ref:`configuration overview <config_thrift_filters_router>`.
+// [#extension: envoy.filters.thrift.router]
+
+message Router {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.filter.thrift.router.v2alpha1.Router";
+}
diff --git a/api/envoy/extensions/retry/host/omit_canary_hosts/v3/BUILD b/api/envoy/extensions/retry/host/omit_canary_hosts/v3/BUILD
new file mode 100644
index 0000000000000..ee92fb652582e
--- /dev/null
+++ b/api/envoy/extensions/retry/host/omit_canary_hosts/v3/BUILD
@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)
diff --git a/api/envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto b/api/envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto
new file mode 100644
index 0000000000000..b6cf1dee86fda
--- /dev/null
+++ b/api/envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package envoy.extensions.retry.host.omit_canary_hosts.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.retry.host.omit_canary_hosts.v3";
+option java_outer_classname = "OmitCanaryHostsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Omit Canary Hosts Predicate]
+// [#extension: envoy.retry_host_predicates.omit_canary_hosts]
+
+message OmitCanaryHostsPredicate {
+}
diff --git a/api/envoy/extensions/retry/host/previous_hosts/v3/BUILD b/api/envoy/extensions/retry/host/previous_hosts/v3/BUILD
new file mode 100644
index 0000000000000..ee92fb652582e
--- /dev/null
+++ b/api/envoy/extensions/retry/host/previous_hosts/v3/BUILD
@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)
diff --git a/api/envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto b/api/envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto
new file mode 100644
index 0000000000000..fe31b9e305c6d
--- /dev/null
+++ b/api/envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package envoy.extensions.retry.host.previous_hosts.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.retry.host.previous_hosts.v3";
+option java_outer_classname = "PreviousHostsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Previous Hosts Predicate]
+// [#extension: envoy.retry_host_predicates.previous_hosts]
+
+message PreviousHostsPredicate {
+}
diff --git a/api/versioning/BUILD b/api/versioning/BUILD
index 41addf767671d..525c453e510f2 100644
--- a/api/versioning/BUILD
+++ b/api/versioning/BUILD
@@ -16,16 +16,15 @@ proto_library(
         "//envoy/config/common/matcher/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/endpoint/v3:pkg",
-        "//envoy/config/filter/thrift/router/v2alpha1:pkg",
         "//envoy/config/grpc_credential/v3:pkg",
-        "//envoy/config/health_checker/redis/v2:pkg",
+        "//envoy/config/health_checker/redis/v3:pkg",
         "//envoy/config/listener/v3:pkg",
         "//envoy/config/metrics/v3:pkg",
         "//envoy/config/overload/v3:pkg",
         "//envoy/config/ratelimit/v3:pkg",
         "//envoy/config/rbac/v3:pkg",
-        "//envoy/config/resource_monitor/fixed_heap/v2alpha:pkg",
-        "//envoy/config/resource_monitor/injected_resource/v2alpha:pkg",
+        "//envoy/config/resource_monitor/fixed_heap/v3:pkg",
+        "//envoy/config/resource_monitor/injected_resource/v3:pkg",
         "//envoy/config/retry/omit_canary_hosts/v2:pkg",
         "//envoy/config/retry/previous_hosts/v2:pkg",
         "//envoy/config/route/v3:pkg",
@@ -113,6 +112,7 @@ proto_library(
         "//envoy/extensions/filters/network/sni_dynamic_forward_proxy/v3alpha:pkg",
         "//envoy/extensions/filters/network/tcp_proxy/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/filters/ratelimit/v3:pkg",
+        "//envoy/extensions/filters/network/thrift_proxy/router/v3:pkg",
         "//envoy/extensions/filters/network/thrift_proxy/v3:pkg",
         "//envoy/extensions/filters/network/wasm/v3:pkg",
         "//envoy/extensions/filters/network/zookeeper_proxy/v3:pkg",
@@ -123,6 +123,7 @@ proto_library(
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
         "//envoy/extensions/network/socket_interface/v3:pkg",
         "//envoy/extensions/retry/host/omit_host_metadata/v3:pkg",
+        "//envoy/extensions/retry/host/previous_hosts/v3:pkg",
         "//envoy/extensions/retry/priority/previous_priorities/v3:pkg",
         "//envoy/extensions/stat_sinks/wasm/v3:pkg",
         "//envoy/extensions/transport_sockets/alts/v3:pkg",
@@ -243,13 +244,17 @@ proto_library(
         "//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg",
         "//envoy/config/filter/network/zookeeper_proxy/v1alpha1:pkg",
         "//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg",
+        "//envoy/config/filter/thrift/router/v2alpha1:pkg",
         "//envoy/config/filter/udp/udp_proxy/v2alpha:pkg",
         "//envoy/config/grpc_credential/v2alpha:pkg",
+        "//envoy/config/health_checker/redis/v2:pkg",
         "//envoy/config/listener/v2:pkg",
         "//envoy/config/metrics/v2:pkg",
         "//envoy/config/overload/v2alpha:pkg",
         "//envoy/config/ratelimit/v2:pkg",
         "//envoy/config/rbac/v2:pkg",
+        "//envoy/config/resource_monitor/fixed_heap/v2alpha:pkg",
+        "//envoy/config/resource_monitor/injected_resource/v2alpha:pkg",
         "//envoy/config/retry/omit_host_metadata/v2:pkg",
         "//envoy/config/retry/previous_priorities:pkg",
         "//envoy/config/trace/v2:pkg",
diff --git a/ci/windows_ci_steps.sh b/ci/windows_ci_steps.sh
index fd3497e8474d3..7b3cc370ff193 100755
--- a/ci/windows_ci_steps.sh
+++ b/ci/windows_ci_steps.sh
@@ -46,7 +46,7 @@ export TEST_TMPDIR=${BUILD_DIR}/tmp
 
 BAZEL_STARTUP_OPTIONS+=("--output_base=${TEST_TMPDIR/\/c/c:}")
 BAZEL_BUILD_OPTIONS=(
-    -c opt
+    -c dbg
     --show_task_finish
     --verbose_failures
     "--test_output=errors"
diff --git a/docs/root/api-v3/config/health_checker/health_checker.rst b/docs/root/api-v3/config/health_checker/health_checker.rst
index 3e5d283725056..e661e8f1a4af8 100644
--- a/docs/root/api-v3/config/health_checker/health_checker.rst
+++ b/docs/root/api-v3/config/health_checker/health_checker.rst
@@ -5,4 +5,5 @@ Health checkers
   :glob:
   :maxdepth: 2
 
-  */v2/*
\ No newline at end of file
+  */v2/*
+  */v3/*
diff --git a/docs/root/api-v3/config/resource_monitor/resource_monitor.rst b/docs/root/api-v3/config/resource_monitor/resource_monitor.rst
index ef47ad7dca3e7..7a2ce19f78af1 100644
--- a/docs/root/api-v3/config/resource_monitor/resource_monitor.rst
+++ b/docs/root/api-v3/config/resource_monitor/resource_monitor.rst
@@ -7,4 +7,5 @@ Resource monitors
   :glob:
   :maxdepth: 2
 
+  */v3/*
   */v2alpha/*
diff --git a/docs/root/configuration/other_protocols/thrift_filters/router_filter.rst b/docs/root/configuration/other_protocols/thrift_filters/router_filter.rst
index 22ce7bcbf1376..c08a02f80630c 100644
--- a/docs/root/configuration/other_protocols/thrift_filters/router_filter.rst
+++ b/docs/root/configuration/other_protocols/thrift_filters/router_filter.rst
@@ -7,7 +7,7 @@ The router filter implements Thrift forwarding. It will be used in almost all Th
 scenarios. The filter's main job is to follow the instructions specified in the configured
 :ref:`route table <envoy_v3_api_msg_extensions.filters.network.thrift_proxy.v3.RouteConfiguration>`.
 
-* :ref:`v3 API reference <envoy_v3_api_msg_config.filter.thrift.router.v2alpha1.Router>`
+* :ref:`v3 API reference <envoy_v3_api_msg_extensions.filters.network.thrift_proxy.router.v3.Router>`
 * This filter should be configured with the name *envoy.filters.thrift.router*.
 
 Statistics
diff --git a/docs/root/configuration/upstream/health_checkers/redis.rst b/docs/root/configuration/upstream/health_checkers/redis.rst
index 03ad07741e673..6469c1a0af6df 100644
--- a/docs/root/configuration/upstream/health_checkers/redis.rst
+++ b/docs/root/configuration/upstream/health_checkers/redis.rst
@@ -8,7 +8,7 @@ which checks Redis upstream hosts. It sends a Redis PING command and expect a PO
 Redis server can respond with anything other than PONG to cause an immediate active health check failure.
 Optionally, Envoy can perform EXISTS on a user-specified key. If the key does not exist it is considered a
 passing health check. This allows the user to mark a Redis instance for maintenance by setting the
-specified :ref:`key <envoy_v3_api_field_config.health_checker.redis.v2.Redis.key>` to any value and waiting
+specified :ref:`key <envoy_v3_api_field_config.health_checker.redis.v3.Redis.key>` to any value and waiting
 for traffic to drain.
 
 An example setting for :ref:`custom_health_check <envoy_v3_api_msg_config.core.v3.HealthCheck.CustomHealthCheck>` as a
diff --git a/docs/root/intro/arch_overview/upstream/health_checking.rst b/docs/root/intro/arch_overview/upstream/health_checking.rst
index d6b7bf9cc6187..a0a77f1df32bc 100644
--- a/docs/root/intro/arch_overview/upstream/health_checking.rst
+++ b/docs/root/intro/arch_overview/upstream/health_checking.rst
@@ -24,7 +24,7 @@ unhealthy, successes required before marking a host healthy, etc.):
   failure. Optionally, Envoy can perform EXISTS on a user-specified key. If the key does not exist
   it is considered a passing healthcheck. This allows the user to mark a Redis instance for
   maintenance by setting the specified key to any value and waiting for traffic to drain. See
-  :ref:`redis_key <envoy_v3_api_msg_config.health_checker.redis.v2.Redis>`.
+  :ref:`redis_key <envoy_v3_api_msg_config.health_checker.redis.v3.Redis>`.
 
 Health checks occur over the transport socket specified for the cluster. This implies that if a cluster is
 using a TLS-enabled transport socket, the health check will also occur over TLS. The
diff --git a/generated_api_shadow/envoy/config/filter/thrift/router/v2alpha1/router.proto b/generated_api_shadow/envoy/config/filter/thrift/router/v2alpha1/router.proto
index 5463ab6513bee..8640277f414cd 100644
--- a/generated_api_shadow/envoy/config/filter/thrift/router/v2alpha1/router.proto
+++ b/generated_api_shadow/envoy/config/filter/thrift/router/v2alpha1/router.proto
@@ -7,7 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.config.filter.thrift.router.v2alpha1";
 option java_outer_classname = "RouterProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Router]
 // Thrift router :ref:`configuration overview <config_thrift_filters_router>`.
diff --git a/generated_api_shadow/envoy/config/health_checker/redis/v2/redis.proto b/generated_api_shadow/envoy/config/health_checker/redis/v2/redis.proto
index 0c569f5c75e8c..4e6d8e47d7be0 100644
--- a/generated_api_shadow/envoy/config/health_checker/redis/v2/redis.proto
+++ b/generated_api_shadow/envoy/config/health_checker/redis/v2/redis.proto
@@ -7,7 +7,7 @@ import "udpa/annotations/status.proto";
 option java_package = "io.envoyproxy.envoy.config.health_checker.redis.v2";
 option java_outer_classname = "RedisProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Redis]
 // Redis health checker :ref:`configuration overview <config_health_checkers_redis>`.
diff --git a/generated_api_shadow/envoy/config/health_checker/redis/v3/BUILD b/generated_api_shadow/envoy/config/health_checker/redis/v3/BUILD
new file mode 100644
index 0000000000000..1cb4c6154f26e
--- /dev/null
+++ b/generated_api_shadow/envoy/config/health_checker/redis/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/health_checker/redis/v2:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/generated_api_shadow/envoy/config/health_checker/redis/v3/redis.proto b/generated_api_shadow/envoy/config/health_checker/redis/v3/redis.proto
new file mode 100644
index 0000000000000..0cf9a11170afb
--- /dev/null
+++ b/generated_api_shadow/envoy/config/health_checker/redis/v3/redis.proto
@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package envoy.config.health_checker.redis.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.config.health_checker.redis.v3";
+option java_outer_classname = "RedisProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Redis]
+// Redis health checker :ref:`configuration overview <config_health_checkers_redis>`.
+// [#extension: envoy.health_checkers.redis]
+
+message Redis {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.health_checker.redis.v2.Redis";
+
+  // If set, optionally perform ``EXISTS <key>`` instead of ``PING``. A return value
+  // from Redis of 0 (does not exist) is considered a passing healthcheck. A return value other
+  // than 0 is considered a failure. This allows the user to mark a Redis instance for maintenance
+  // by setting the specified key to any value and waiting for traffic to drain.
+  string key = 1;
+}
diff --git a/generated_api_shadow/envoy/config/overload/v3/overload.proto b/generated_api_shadow/envoy/config/overload/v3/overload.proto
index 21dd02811a34a..53d7d6d45c23a 100644
--- a/generated_api_shadow/envoy/config/overload/v3/overload.proto
+++ b/generated_api_shadow/envoy/config/overload/v3/overload.proto
@@ -32,9 +32,9 @@ message ResourceMonitor {
   // resource monitor type. The built-in resource monitors are:
   //
   // * :ref:`envoy.resource_monitors.fixed_heap
-  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig>`
+  //   <envoy_api_msg_config.resource_monitor.fixed_heap.v3.FixedHeapConfig>`
   // * :ref:`envoy.resource_monitors.injected_resource
-  //   <envoy_api_msg_config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig>`
+  //   <envoy_api_msg_config.resource_monitor.injected_resource.v3.InjectedResourceConfig>`
   string name = 1 [(validate.rules).string = {min_len: 1}];
 
   // Configuration for the resource monitor being instantiated.
diff --git a/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto b/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
index 529622a071e77..65612a40f1391 100644
--- a/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
+++ b/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v2alpha/fixed_heap.proto
@@ -8,7 +8,7 @@ import "validate/validate.proto";
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.fixed_heap.v2alpha";
 option java_outer_classname = "FixedHeapProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Fixed heap]
 // [#extension: envoy.resource_monitors.fixed_heap]
diff --git a/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v3/BUILD b/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v3/BUILD
new file mode 100644
index 0000000000000..3fb51ff1ccaa9
--- /dev/null
+++ b/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/resource_monitor/fixed_heap/v2alpha:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v3/fixed_heap.proto b/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v3/fixed_heap.proto
new file mode 100644
index 0000000000000..138ed1a76a935
--- /dev/null
+++ b/generated_api_shadow/envoy/config/resource_monitor/fixed_heap/v3/fixed_heap.proto
@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package envoy.config.resource_monitor.fixed_heap.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.resource_monitor.fixed_heap.v3";
+option java_outer_classname = "FixedHeapProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Fixed heap]
+// [#extension: envoy.resource_monitors.fixed_heap]
+
+// The fixed heap resource monitor reports the Envoy process memory pressure, computed as a
+// fraction of currently reserved heap memory divided by a statically configured maximum
+// specified in the FixedHeapConfig.
+message FixedHeapConfig {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.resource_monitor.fixed_heap.v2alpha.FixedHeapConfig";
+
+  uint64 max_heap_size_bytes = 1 [(validate.rules).uint64 = {gt: 0}];
+}
diff --git a/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto b/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
index a9f056d2d29aa..b8d48b60f98e1 100644
--- a/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
+++ b/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v2alpha/injected_resource.proto
@@ -8,7 +8,7 @@ import "validate/validate.proto";
 option java_package = "io.envoyproxy.envoy.config.resource_monitor.injected_resource.v2alpha";
 option java_outer_classname = "InjectedResourceProto";
 option java_multiple_files = true;
-option (udpa.annotations.file_status).package_version_status = ACTIVE;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 // [#protodoc-title: Injected resource]
 // [#extension: envoy.resource_monitors.injected_resource]
diff --git a/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v3/BUILD b/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v3/BUILD
new file mode 100644
index 0000000000000..975b8fcbd5a32
--- /dev/null
+++ b/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/resource_monitor/injected_resource/v2alpha:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v3/injected_resource.proto b/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v3/injected_resource.proto
new file mode 100644
index 0000000000000..c903ef266906b
--- /dev/null
+++ b/generated_api_shadow/envoy/config/resource_monitor/injected_resource/v3/injected_resource.proto
@@ -0,0 +1,26 @@
+syntax = "proto3";
+
+package envoy.config.resource_monitor.injected_resource.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.resource_monitor.injected_resource.v3";
+option java_outer_classname = "InjectedResourceProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Injected resource]
+// [#extension: envoy.resource_monitors.injected_resource]
+
+// The injected resource monitor allows injecting a synthetic resource pressure into Envoy
+// via a text file, which must contain a floating-point number in the range [0..1] representing
+// the resource pressure and be updated atomically by a symbolic link swap.
+// This is intended primarily for integration tests to force Envoy into an overloaded state.
+message InjectedResourceConfig {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.resource_monitor.injected_resource.v2alpha.InjectedResourceConfig";
+
+  string filename = 1 [(validate.rules).string = {min_len: 1}];
+}
diff --git a/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/router/v3/BUILD b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/router/v3/BUILD
new file mode 100644
index 0000000000000..c24f669b9bbde
--- /dev/null
+++ b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/router/v3/BUILD
@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/config/filter/thrift/router/v2alpha1:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)
diff --git a/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto
new file mode 100644
index 0000000000000..860622cb61e42
--- /dev/null
+++ b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/router/v3/router.proto
@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package envoy.extensions.filters.network.thrift_proxy.router.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.filters.network.thrift_proxy.router.v3";
+option java_outer_classname = "RouterProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Router]
+// Thrift router :ref:`configuration overview <config_thrift_filters_router>`.
+// [#extension: envoy.filters.thrift.router]
+
+message Router {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.filter.thrift.router.v2alpha1.Router";
+}
diff --git a/generated_api_shadow/envoy/extensions/retry/host/omit_canary_hosts/v3/BUILD b/generated_api_shadow/envoy/extensions/retry/host/omit_canary_hosts/v3/BUILD
new file mode 100644
index 0000000000000..ee92fb652582e
--- /dev/null
+++ b/generated_api_shadow/envoy/extensions/retry/host/omit_canary_hosts/v3/BUILD
@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)
diff --git a/generated_api_shadow/envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto b/generated_api_shadow/envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto
new file mode 100644
index 0000000000000..b6cf1dee86fda
--- /dev/null
+++ b/generated_api_shadow/envoy/extensions/retry/host/omit_canary_hosts/v3/omit_canary_hosts.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package envoy.extensions.retry.host.omit_canary_hosts.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.retry.host.omit_canary_hosts.v3";
+option java_outer_classname = "OmitCanaryHostsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Omit Canary Hosts Predicate]
+// [#extension: envoy.retry_host_predicates.omit_canary_hosts]
+
+message OmitCanaryHostsPredicate {
+}
diff --git a/generated_api_shadow/envoy/extensions/retry/host/previous_hosts/v3/BUILD b/generated_api_shadow/envoy/extensions/retry/host/previous_hosts/v3/BUILD
new file mode 100644
index 0000000000000..ee92fb652582e
--- /dev/null
+++ b/generated_api_shadow/envoy/extensions/retry/host/previous_hosts/v3/BUILD
@@ -0,0 +1,9 @@
+# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+)
diff --git a/generated_api_shadow/envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto b/generated_api_shadow/envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto
new file mode 100644
index 0000000000000..fe31b9e305c6d
--- /dev/null
+++ b/generated_api_shadow/envoy/extensions/retry/host/previous_hosts/v3/previous_hosts.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package envoy.extensions.retry.host.previous_hosts.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.extensions.retry.host.previous_hosts.v3";
+option java_outer_classname = "PreviousHostsProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+// [#protodoc-title: Previous Hosts Predicate]
+// [#extension: envoy.retry_host_predicates.previous_hosts]
+
+message PreviousHostsPredicate {
+}
diff --git a/source/common/config/BUILD b/source/common/config/BUILD
index 067f1d9ada0f0..9ebdb02053407 100644
--- a/source/common/config/BUILD
+++ b/source/common/config/BUILD
@@ -13,6 +13,7 @@ envoy_cc_library(
     srcs = ["api_type_oracle.cc"],
     hdrs = ["api_type_oracle.h"],
     deps = [
+        "//source/common/common:macros",
         "//source/common/protobuf",
         "//source/common/protobuf:type_util_lib",
         "@com_github_cncf_udpa//udpa/annotations:pkg_cc_proto",
diff --git a/source/common/config/api_type_oracle.cc b/source/common/config/api_type_oracle.cc
index f6feba09828a1..1c57ccf908ee9 100644
--- a/source/common/config/api_type_oracle.cc
+++ b/source/common/config/api_type_oracle.cc
@@ -5,6 +5,16 @@
 namespace Envoy {
 namespace Config {
 
+// To exclude rejecting below v2 protos.
+static const std::set<absl::string_view>& excludeV2ProtoSet() {
+  CONSTRUCT_ON_FIRST_USE(
+      std::set<absl::string_view>,
+      {"envoy.config.health_checker.redis.v2", "envoy.config.filter.thrift.router.v2alpha1",
+       "envoy.config.resource_monitor.fixed_heap.v2alpha",
+       "envoy.config.resource_monitor.injected_resource.v2alpha",
+       "envoy.config.retry.omit_canary_hosts.v2", "envoy.config.retry.previous_hosts.v2"});
+}
+
 const Protobuf::Descriptor*
 ApiTypeOracle::getEarlierVersionDescriptor(const std::string& message_type) {
   const auto previous_message_string = getEarlierVersionMessageTypeName(message_type);
@@ -12,6 +22,10 @@ ApiTypeOracle::getEarlierVersionDescriptor(const std::string& message_type) {
     const Protobuf::Descriptor* earlier_desc =
         Protobuf::DescriptorPool::generated_pool()->FindMessageTypeByName(
             previous_message_string.value());
+    auto itr = excludeV2ProtoSet().find(earlier_desc->full_name());
+    if (itr != excludeV2ProtoSet().end()) {
+      return nullptr;
+    }
     return earlier_desc;
   } else {
     return nullptr;
diff --git a/source/common/config/api_type_oracle.h b/source/common/config/api_type_oracle.h
index ab5e75b113d78..2f356ee0009f6 100644
--- a/source/common/config/api_type_oracle.h
+++ b/source/common/config/api_type_oracle.h
@@ -1,5 +1,6 @@
 #pragma once
 
+#include "common/common/macros.h"
 #include "common/protobuf/protobuf.h"
 #include "common/protobuf/type_util.h"
 
diff --git a/source/common/protobuf/utility.cc b/source/common/protobuf/utility.cc
index abea1a600c80c..6a4dbc6a2ca61 100644
--- a/source/common/protobuf/utility.cc
+++ b/source/common/protobuf/utility.cc
@@ -23,6 +23,7 @@
 #include "yaml-cpp/yaml.h"
 
 using namespace std::chrono_literals;
+using namespace Envoy::Config;
 
 namespace Envoy {
 namespace {
diff --git a/test/common/config/BUILD b/test/common/config/BUILD
index 80a2bfa5b6d5c..1f5e2346d593b 100644
--- a/test/common/config/BUILD
+++ b/test/common/config/BUILD
@@ -22,6 +22,7 @@ envoy_cc_test(
     deps = [
         "//source/common/config:api_type_oracle_lib",
         "@envoy_api//envoy/config/filter/http/ip_tagging/v2:pkg_cc_proto",
+        "@envoy_api//envoy/config/health_checker/redis/v2:pkg_cc_proto",
         "@envoy_api//envoy/extensions/filters/http/ip_tagging/v3:pkg_cc_proto",
     ],
 )
diff --git a/test/common/config/api_type_oracle_test.cc b/test/common/config/api_type_oracle_test.cc
index a2454953c3bb8..4b066b6b2a5b5 100644
--- a/test/common/config/api_type_oracle_test.cc
+++ b/test/common/config/api_type_oracle_test.cc
@@ -1,4 +1,5 @@
 #include "envoy/config/filter/http/ip_tagging/v2/ip_tagging.pb.h"
+#include "envoy/config/health_checker/redis/v2/redis.pb.h"
 #include "envoy/extensions/filters/http/ip_tagging/v3/ip_tagging.pb.h"
 
 #include "common/config/api_type_oracle.h"
@@ -13,6 +14,7 @@ namespace {
 
 TEST(ApiTypeOracleTest, All) {
   envoy::config::filter::http::ip_tagging::v2::IPTagging v2_config;
+  envoy::config::health_checker::redis::v2::Redis v2_excludeconfig;
   envoy::extensions::filters::http::ip_tagging::v3::IPTagging v3_config;
   ProtobufWkt::Any non_api_type;
 
@@ -20,6 +22,8 @@ TEST(ApiTypeOracleTest, All) {
             ApiTypeOracle::getEarlierVersionDescriptor(non_api_type.GetDescriptor()->full_name()));
   EXPECT_EQ(nullptr,
             ApiTypeOracle::getEarlierVersionDescriptor(v2_config.GetDescriptor()->full_name()));
+  EXPECT_EQ(nullptr, ApiTypeOracle::getEarlierVersionDescriptor(
+                         v2_excludeconfig.GetDescriptor()->full_name()));
   const auto* desc =
       ApiTypeOracle::getEarlierVersionDescriptor(v3_config.GetDescriptor()->full_name());
   EXPECT_EQ(envoy::config::filter::http::ip_tagging::v2::IPTagging::descriptor()->full_name(),