diff --git a/CODEOWNERS b/CODEOWNERS
index 36637fadd4166..30e8ac333d9b4 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -279,7 +279,8 @@ extensions/filters/http/oauth2 @derekargueta @snowp
 /*/extensions/filters/http/common @UNOWNED @UNOWNED
 /*/extensions/filters/network/common @UNOWNED @UNOWNED
 /*/extensions/clusters/original_dst @UNOWNED @UNOWNED
-
+/*/extensions/clusters/logical_dns/ @UNOWNED @UNOWNED
+/*/extensions/clusters/common/ @UNOWNED @UNOWNED
 
 # URL Pattern Match and Rewrite Library
 /*/extensions/path/uri_template_lib @alyssawilk @yanjunxiang-google
diff --git a/changelogs/current.yaml b/changelogs/current.yaml
index af22abbd41c79..9f435e1b1d1aa 100644
--- a/changelogs/current.yaml
+++ b/changelogs/current.yaml
@@ -4,7 +4,7 @@ behavior_changes:
 # *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
 - area: build
   change: |
-    moved the original_dst cluster to extensions. If you use this cluster and override extensions_build_config.bzl you will now need to include it explicitly.
+    moved the original_dst and logical_dns clusters to extensions. If you use either of these cluster and override extensions_build_config.bzl you will now need to include it explicitly.
 
 minor_behavior_changes:
 # *Changes that may cause incompatibilities for some users, but should not for most*
diff --git a/docs/root/intro/arch_overview/upstream/service_discovery.rst b/docs/root/intro/arch_overview/upstream/service_discovery.rst
index 1d55210c27a6e..c5dab4b9fa832 100644
--- a/docs/root/intro/arch_overview/upstream/service_discovery.rst
+++ b/docs/root/intro/arch_overview/upstream/service_discovery.rst
@@ -51,6 +51,7 @@ controls the refresh frequency during failures, and, if not configured, the DNS
 DNS resolving emits :ref:`cluster statistics <config_cluster_manager_cluster_stats>` fields *update_attempt*, *update_success* and *update_failure*.
 
 .. _arch_overview_service_discovery_types_logical_dns:
+.. _extension_envoy.clusters.logical_dns:
 
 Logical DNS
 ^^^^^^^^^^^
diff --git a/source/common/upstream/BUILD b/source/common/upstream/BUILD
index 947bb777f66cf..e9f1622e6d5b6 100644
--- a/source/common/upstream/BUILD
+++ b/source/common/upstream/BUILD
@@ -330,40 +330,6 @@ envoy_cc_library(
     ],
 )
 
-envoy_cc_library(
-    name = "logical_host_lib",
-    srcs = ["logical_host.cc"],
-    hdrs = ["logical_host.h"],
-    deps = [
-        ":upstream_includes",
-        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
-        "@envoy_api//envoy/config/endpoint/v3:pkg_cc_proto",
-    ],
-)
-
-envoy_cc_library(
-    name = "logical_dns_cluster_lib",
-    srcs = ["logical_dns_cluster.cc"],
-    hdrs = ["logical_dns_cluster.h"],
-    deps = [
-        ":cluster_factory_lib",
-        ":logical_host_lib",
-        ":upstream_includes",
-        "//envoy/upstream:cluster_factory_interface",
-        "//source/common/common:dns_utils_lib",
-        "//source/common/common:empty_string",
-        "//source/common/config:utility_lib",
-        "//source/common/network:address_lib",
-        "//source/common/network:utility_lib",
-        "//source/common/protobuf",
-        "//source/common/protobuf:utility_lib",
-        "@envoy_api//envoy/config/cluster/v3:pkg_cc_proto",
-        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
-        "@envoy_api//envoy/config/endpoint/v3:pkg_cc_proto",
-    ],
-    alwayslink = LEGACY_ALWAYSLINK,
-)
-
 envoy_cc_library(
     name = "outlier_detection_lib",
     srcs = ["outlier_detection_impl.cc"],
@@ -519,7 +485,6 @@ envoy_cc_library(
         ":eds_lib",
         ":health_checker_lib",
         # TODO(mattklein123): Move the clusters to extensions so they can be compiled out.
-        ":logical_dns_cluster_lib",
         ":static_cluster_lib",
         ":strict_dns_cluster_lib",
         ":upstream_includes",
diff --git a/source/common/upstream/upstream_impl.cc b/source/common/upstream/upstream_impl.cc
index e27ea8e35b641..6cb3411ad28ea 100644
--- a/source/common/upstream/upstream_impl.cc
+++ b/source/common/upstream/upstream_impl.cc
@@ -51,7 +51,6 @@
 #include "source/common/upstream/cluster_factory_impl.h"
 #include "source/common/upstream/eds.h"
 #include "source/common/upstream/health_checker_impl.h"
-#include "source/common/upstream/logical_dns_cluster.h"
 #include "source/extensions/filters/network/http_connection_manager/config.h"
 #include "source/server/transport_socket_config_impl.h"
 
diff --git a/source/extensions/clusters/common/BUILD b/source/extensions/clusters/common/BUILD
new file mode 100644
index 0000000000000..cf520569c34b4
--- /dev/null
+++ b/source/extensions/clusters/common/BUILD
@@ -0,0 +1,20 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_library",
+    "envoy_extension_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_extension_package()
+
+envoy_cc_library(
+    name = "logical_host_lib",
+    srcs = ["logical_host.cc"],
+    hdrs = ["logical_host.h"],
+    deps = [
+        "//source/common/upstream:upstream_includes",
+        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3:pkg_cc_proto",
+    ],
+)
diff --git a/source/common/upstream/logical_host.cc b/source/extensions/clusters/common/logical_host.cc
similarity index 93%
rename from source/common/upstream/logical_host.cc
rename to source/extensions/clusters/common/logical_host.cc
index 688573e4bb88f..0504e2f10443b 100644
--- a/source/common/upstream/logical_host.cc
+++ b/source/extensions/clusters/common/logical_host.cc
@@ -1,4 +1,4 @@
-#include "source/common/upstream/logical_host.h"
+#include "source/extensions/clusters/common/logical_host.h"
 
 namespace Envoy {
 namespace Upstream {
diff --git a/source/common/upstream/logical_host.h b/source/extensions/clusters/common/logical_host.h
similarity index 100%
rename from source/common/upstream/logical_host.h
rename to source/extensions/clusters/common/logical_host.h
diff --git a/source/extensions/clusters/dynamic_forward_proxy/BUILD b/source/extensions/clusters/dynamic_forward_proxy/BUILD
index d249ed3f0cab2..c9db7ed8b5e3c 100644
--- a/source/extensions/clusters/dynamic_forward_proxy/BUILD
+++ b/source/extensions/clusters/dynamic_forward_proxy/BUILD
@@ -15,7 +15,7 @@ envoy_cc_extension(
     deps = [
         "//source/common/network:transport_socket_options_lib",
         "//source/common/upstream:cluster_factory_lib",
-        "//source/common/upstream:logical_host_lib",
+        "//source/extensions/clusters/common:logical_host_lib",
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_interface",
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_manager_impl",
         "//source/extensions/transport_sockets/tls/cert_validator:cert_validator_lib",
diff --git a/source/extensions/clusters/dynamic_forward_proxy/cluster.h b/source/extensions/clusters/dynamic_forward_proxy/cluster.h
index 1cd876e6b916f..938163a5a7d03 100644
--- a/source/extensions/clusters/dynamic_forward_proxy/cluster.h
+++ b/source/extensions/clusters/dynamic_forward_proxy/cluster.h
@@ -7,7 +7,7 @@
 #include "envoy/http/conn_pool.h"
 
 #include "source/common/upstream/cluster_factory_impl.h"
-#include "source/common/upstream/logical_host.h"
+#include "source/extensions/clusters/common/logical_host.h"
 #include "source/extensions/common/dynamic_forward_proxy/dns_cache.h"
 
 namespace Envoy {
diff --git a/source/extensions/clusters/logical_dns/BUILD b/source/extensions/clusters/logical_dns/BUILD
new file mode 100644
index 0000000000000..fe4b358b31a26
--- /dev/null
+++ b/source/extensions/clusters/logical_dns/BUILD
@@ -0,0 +1,33 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_extension",
+    "envoy_extension_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_extension_package()
+
+envoy_cc_extension(
+    name = "logical_dns_cluster_lib",
+    srcs = ["logical_dns_cluster.cc"],
+    hdrs = ["logical_dns_cluster.h"],
+    # prevously considered core code.
+    visibility = ["//visibility:public"],
+    deps = [
+        "//envoy/upstream:cluster_factory_interface",
+        "//source/common/common:dns_utils_lib",
+        "//source/common/common:empty_string",
+        "//source/common/config:utility_lib",
+        "//source/common/network:address_lib",
+        "//source/common/network:utility_lib",
+        "//source/common/protobuf",
+        "//source/common/protobuf:utility_lib",
+        "//source/common/upstream:cluster_factory_lib",
+        "//source/common/upstream:upstream_includes",
+        "//source/extensions/clusters/common:logical_host_lib",
+        "@envoy_api//envoy/config/cluster/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/endpoint/v3:pkg_cc_proto",
+    ],
+)
diff --git a/source/common/upstream/logical_dns_cluster.cc b/source/extensions/clusters/logical_dns/logical_dns_cluster.cc
similarity index 99%
rename from source/common/upstream/logical_dns_cluster.cc
rename to source/extensions/clusters/logical_dns/logical_dns_cluster.cc
index 12067608a3b5f..ace5cd9e64d23 100644
--- a/source/common/upstream/logical_dns_cluster.cc
+++ b/source/extensions/clusters/logical_dns/logical_dns_cluster.cc
@@ -1,4 +1,4 @@
-#include "source/common/upstream/logical_dns_cluster.h"
+#include "source/extensions/clusters/logical_dns/logical_dns_cluster.h"
 
 #include <chrono>
 #include <list>
diff --git a/source/common/upstream/logical_dns_cluster.h b/source/extensions/clusters/logical_dns/logical_dns_cluster.h
similarity index 98%
rename from source/common/upstream/logical_dns_cluster.h
rename to source/extensions/clusters/logical_dns/logical_dns_cluster.h
index b4ad16113ebe5..533899afe17cd 100644
--- a/source/common/upstream/logical_dns_cluster.h
+++ b/source/extensions/clusters/logical_dns/logical_dns_cluster.h
@@ -12,8 +12,8 @@
 
 #include "source/common/common/empty_string.h"
 #include "source/common/upstream/cluster_factory_impl.h"
-#include "source/common/upstream/logical_host.h"
 #include "source/common/upstream/upstream_impl.h"
+#include "source/extensions/clusters/common/logical_host.h"
 
 namespace Envoy {
 namespace Upstream {
diff --git a/source/extensions/extensions_build_config.bzl b/source/extensions/extensions_build_config.bzl
index 544329f8e3274..8c08f8f6752f8 100644
--- a/source/extensions/extensions_build_config.bzl
+++ b/source/extensions/extensions_build_config.bzl
@@ -21,6 +21,7 @@ EXTENSIONS = {
     "envoy.clusters.dynamic_forward_proxy":             "//source/extensions/clusters/dynamic_forward_proxy:cluster",
     "envoy.clusters.redis":                             "//source/extensions/clusters/redis:redis_cluster",
     "envoy.clusters.original_dst":                      "//source/extensions/clusters/original_dst:original_dst_cluster_lib",
+    "envoy.clusters.logical_dns":                       "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
 
     #
     # Compression
diff --git a/source/extensions/extensions_metadata.yaml b/source/extensions/extensions_metadata.yaml
index e6a548b2f6291..df0e0b46246be 100644
--- a/source/extensions/extensions_metadata.yaml
+++ b/source/extensions/extensions_metadata.yaml
@@ -95,6 +95,11 @@ envoy.clusters.redis:
   - envoy.clusters
   security_posture: requires_trusted_downstream_and_upstream
   status: stable
+envoy.clusters.logical_dns:
+  categories:
+  - envoy.clusters
+  security_posture: robust_to_untrusted_downstream_and_upstream
+  status: stable
 envoy.compression.brotli.compressor:
   categories:
   - envoy.compression.compressor
diff --git a/test/common/upstream/BUILD b/test/common/upstream/BUILD
index a7ff4bf10d1ba..b7eb8622b1a04 100644
--- a/test/common/upstream/BUILD
+++ b/test/common/upstream/BUILD
@@ -72,6 +72,7 @@ envoy_cc_test(
         ":test_cluster_manager",
         "//source/common/router:context_lib",
         "//source/common/upstream:load_balancer_factory_base_lib",
+        "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
         "//source/extensions/clusters/original_dst:original_dst_cluster_lib",
         "//source/extensions/network/dns_resolver/cares:config",
         "//source/extensions/transport_sockets/tls:config",
@@ -443,33 +444,6 @@ envoy_cc_test(
     ],
 )
 
-envoy_cc_test(
-    name = "logical_dns_cluster_test",
-    srcs = ["logical_dns_cluster_test.cc"],
-    deps = [
-        ":utility_lib",
-        "//source/common/event:dispatcher_lib",
-        "//source/common/network:utility_lib",
-        "//source/common/upstream:logical_dns_cluster_lib",
-        "//source/common/upstream:upstream_lib",
-        "//source/extensions/transport_sockets/raw_buffer:config",
-        "//source/server:transport_socket_config_lib",
-        "//test/mocks:common_lib",
-        "//test/mocks/local_info:local_info_mocks",
-        "//test/mocks/network:network_mocks",
-        "//test/mocks/protobuf:protobuf_mocks",
-        "//test/mocks/runtime:runtime_mocks",
-        "//test/mocks/server:admin_mocks",
-        "//test/mocks/server:instance_mocks",
-        "//test/mocks/ssl:ssl_mocks",
-        "//test/mocks/thread_local:thread_local_mocks",
-        "//test/mocks/upstream:cluster_manager_mocks",
-        "//test/test_common:utility_lib",
-        "@envoy_api//envoy/config/cluster/v3:pkg_cc_proto",
-        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
-    ],
-)
-
 envoy_cc_test(
     name = "outlier_detection_impl_test",
     srcs = ["outlier_detection_impl_test.cc"],
diff --git a/test/exe/BUILD b/test/exe/BUILD
index b795c808f325e..e05a7d4a365ec 100644
--- a/test/exe/BUILD
+++ b/test/exe/BUILD
@@ -69,6 +69,7 @@ envoy_cc_test(
         "//source/common/api:api_lib",
         "//source/exe:envoy_main_common_with_core_extensions_lib",
         "//source/exe:platform_impl_lib",
+        "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
         "//test/mocks/runtime:runtime_mocks",
         "//test/test_common:contention_lib",
         "//test/test_common:environment_lib",
diff --git a/test/extensions/clusters/logical_dns/BUILD b/test/extensions/clusters/logical_dns/BUILD
new file mode 100644
index 0000000000000..2c1b6a44d4439
--- /dev/null
+++ b/test/extensions/clusters/logical_dns/BUILD
@@ -0,0 +1,36 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_test",
+    "envoy_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_cc_test(
+    name = "logical_dns_cluster_test",
+    srcs = ["logical_dns_cluster_test.cc"],
+    deps = [
+        "//source/common/event:dispatcher_lib",
+        "//source/common/network:utility_lib",
+        "//source/common/upstream:upstream_lib",
+        "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
+        "//source/extensions/transport_sockets/raw_buffer:config",
+        "//source/server:transport_socket_config_lib",
+        "//test/common/upstream:utility_lib",
+        "//test/mocks:common_lib",
+        "//test/mocks/local_info:local_info_mocks",
+        "//test/mocks/network:network_mocks",
+        "//test/mocks/protobuf:protobuf_mocks",
+        "//test/mocks/runtime:runtime_mocks",
+        "//test/mocks/server:admin_mocks",
+        "//test/mocks/server:instance_mocks",
+        "//test/mocks/ssl:ssl_mocks",
+        "//test/mocks/thread_local:thread_local_mocks",
+        "//test/mocks/upstream:cluster_manager_mocks",
+        "//test/test_common:utility_lib",
+        "@envoy_api//envoy/config/cluster/v3:pkg_cc_proto",
+        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+    ],
+)
diff --git a/test/common/upstream/logical_dns_cluster_test.cc b/test/extensions/clusters/logical_dns/logical_dns_cluster_test.cc
similarity index 99%
rename from test/common/upstream/logical_dns_cluster_test.cc
rename to test/extensions/clusters/logical_dns/logical_dns_cluster_test.cc
index 467e31e55c1b6..3ff653b172564 100644
--- a/test/common/upstream/logical_dns_cluster_test.cc
+++ b/test/extensions/clusters/logical_dns/logical_dns_cluster_test.cc
@@ -12,7 +12,7 @@
 
 #include "source/common/network/utility.h"
 #include "source/common/singleton/manager_impl.h"
-#include "source/common/upstream/logical_dns_cluster.h"
+#include "source/extensions/clusters/logical_dns/logical_dns_cluster.h"
 #include "source/server/transport_socket_config_impl.h"
 
 #include "test/common/upstream/utility.h"
diff --git a/test/extensions/clusters/redis/redis_cluster_test.cc b/test/extensions/clusters/redis/redis_cluster_test.cc
index b4042cec5771d..0b8d769deb8fd 100644
--- a/test/extensions/clusters/redis/redis_cluster_test.cc
+++ b/test/extensions/clusters/redis/redis_cluster_test.cc
@@ -14,7 +14,6 @@
 
 #include "source/common/network/utility.h"
 #include "source/common/singleton/manager_impl.h"
-#include "source/common/upstream/logical_dns_cluster.h"
 #include "source/extensions/clusters/redis/redis_cluster.h"
 
 #include "test/common/upstream/utility.h"
diff --git a/test/integration/BUILD b/test/integration/BUILD
index fac2cb27fafd4..89db298d0b476 100644
--- a/test/integration/BUILD
+++ b/test/integration/BUILD
@@ -589,6 +589,7 @@ envoy_cc_test_library(
         ":http_protocol_integration_lib",
         ":socket_interface_swap_lib",
         "//source/common/http:header_map_lib",
+        "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
         "//source/extensions/filters/http/buffer:config",
         "//test/common/http/http2:http2_frame",
         "//test/integration/filters:add_invalid_data_filter_lib",
diff --git a/test/server/config_validation/BUILD b/test/server/config_validation/BUILD
index 667b656c2e9f8..788109be2f3e8 100644
--- a/test/server/config_validation/BUILD
+++ b/test/server/config_validation/BUILD
@@ -51,6 +51,7 @@ envoy_cc_test(
     ],
     env = {"EXAMPLE_CONFIGS_TAR_PATH": "envoy/configs/example_configs.tar"},
     deps = [
+        "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
         "//source/extensions/clusters/original_dst:original_dst_cluster_lib",
         "//source/extensions/filters/http/router:config",
         "//source/extensions/filters/listener/original_dst:config",
diff --git a/tools/code_format/config.yaml b/tools/code_format/config.yaml
index b3eacbb5186d3..b4067ba84ed7e 100644
--- a/tools/code_format/config.yaml
+++ b/tools/code_format/config.yaml
@@ -291,6 +291,7 @@ unsorted_flags:
 # PLEASE DO NOT ADD FILES TO THIS LIST WITHOUT SENIOR MAINTAINER APPROVAL
 visibility_excludes:
 - source/extensions/clusters/original_dst/
+- source/extensions/clusters/logical_dns/
 - source/extensions/early_data/BUILD
 - source/extensions/filters/http/buffer/BUILD
 - source/extensions/filters/network/common/BUILD