diff --git a/api/envoy/admin/v3alpha/BUILD b/api/envoy/admin/v3alpha/BUILD
index cf79b1948e6e3..a4adccf38ba29 100644
--- a/api/envoy/admin/v3alpha/BUILD
+++ b/api/envoy/admin/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/admin/v2alpha:pkg",
         "//envoy/api/v3alpha:pkg",
         "//envoy/api/v3alpha/auth:pkg",
         "//envoy/api/v3alpha/core:pkg",
diff --git a/api/envoy/api/v3alpha/BUILD b/api/envoy/api/v3alpha/BUILD
index 4420fae251660..02a0a0c6f678e 100644
--- a/api/envoy/api/v3alpha/BUILD
+++ b/api/envoy/api/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/api/v2:pkg",
         "//envoy/api/v3alpha/cluster:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/endpoint:pkg",
diff --git a/api/envoy/api/v3alpha/auth/BUILD b/api/envoy/api/v3alpha/auth/BUILD
index 8fdd93fe31873..58bb35f41f10b 100644
--- a/api/envoy/api/v3alpha/auth/BUILD
+++ b/api/envoy/api/v3alpha/auth/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/api/v2/auth:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/api/v3alpha/cluster/BUILD b/api/envoy/api/v3alpha/cluster/BUILD
index 8fdd93fe31873..6e9045ac08ef0 100644
--- a/api/envoy/api/v3alpha/cluster/BUILD
+++ b/api/envoy/api/v3alpha/cluster/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/api/v2/cluster:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/api/v3alpha/core/BUILD b/api/envoy/api/v3alpha/core/BUILD
index 9ed98f0071019..dce7faf061b9e 100644
--- a/api/envoy/api/v3alpha/core/BUILD
+++ b/api/envoy/api/v3alpha/core/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/api/v2/core:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/api/v3alpha/endpoint/BUILD b/api/envoy/api/v3alpha/endpoint/BUILD
index 8fdd93fe31873..871ffc216a859 100644
--- a/api/envoy/api/v3alpha/endpoint/BUILD
+++ b/api/envoy/api/v3alpha/endpoint/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/api/v2/endpoint:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/api/v3alpha/listener/BUILD b/api/envoy/api/v3alpha/listener/BUILD
index 8fdd93fe31873..a12fbf1d353d3 100644
--- a/api/envoy/api/v3alpha/listener/BUILD
+++ b/api/envoy/api/v3alpha/listener/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/api/v2/listener:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/api/v3alpha/ratelimit/BUILD b/api/envoy/api/v3alpha/ratelimit/BUILD
index 66ca389992cb1..64b64e7310d53 100644
--- a/api/envoy/api/v3alpha/ratelimit/BUILD
+++ b/api/envoy/api/v3alpha/ratelimit/BUILD
@@ -5,5 +5,8 @@ load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
 licenses(["notice"])  # Apache 2
 
 api_proto_package(
-    deps = ["@com_github_cncf_udpa//udpa/api/annotations:pkg"],
+    deps = [
+        "//envoy/api/v2/ratelimit:pkg",
+        "@com_github_cncf_udpa//udpa/api/annotations:pkg",
+    ],
 )
diff --git a/api/envoy/api/v3alpha/route/BUILD b/api/envoy/api/v3alpha/route/BUILD
index d4850e8aaeeeb..1b3360fcfd213 100644
--- a/api/envoy/api/v3alpha/route/BUILD
+++ b/api/envoy/api/v3alpha/route/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/api/v2/route:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "//envoy/type/tracing/v2:pkg",
diff --git a/api/envoy/config/accesslog/v3alpha/BUILD b/api/envoy/config/accesslog/v3alpha/BUILD
index 8fdd93fe31873..27469723132a6 100644
--- a/api/envoy/config/accesslog/v3alpha/BUILD
+++ b/api/envoy/config/accesslog/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/accesslog/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/bootstrap/v3alpha/BUILD b/api/envoy/config/bootstrap/v3alpha/BUILD
index 3cff1740f8bb6..1b8c88b743814 100644
--- a/api/envoy/config/bootstrap/v3alpha/BUILD
+++ b/api/envoy/config/bootstrap/v3alpha/BUILD
@@ -9,6 +9,7 @@ api_proto_package(
         "//envoy/api/v3alpha:pkg",
         "//envoy/api/v3alpha/auth:pkg",
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/bootstrap/v2:pkg",
         "//envoy/config/metrics/v3alpha:pkg",
         "//envoy/config/overload/v3alpha:pkg",
         "//envoy/config/trace/v3alpha:pkg",
diff --git a/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/BUILD b/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/BUILD
index 8532021c60f34..5139f97c5286d 100644
--- a/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/BUILD
+++ b/api/envoy/config/cluster/dynamic_forward_proxy/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/config/cluster/dynamic_forward_proxy/v2alpha:pkg",
         "//envoy/config/common/dynamic_forward_proxy/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/common/dynamic_forward_proxy/v3alpha/BUILD b/api/envoy/config/common/dynamic_forward_proxy/v3alpha/BUILD
index 98dd2e684f4c6..e15472012089d 100644
--- a/api/envoy/config/common/dynamic_forward_proxy/v3alpha/BUILD
+++ b/api/envoy/config/common/dynamic_forward_proxy/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha:pkg",
+        "//envoy/config/common/dynamic_forward_proxy/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/common/tap/v3alpha/BUILD b/api/envoy/config/common/tap/v3alpha/BUILD
index 656ef4626f7b4..ed474065f808b 100644
--- a/api/envoy/config/common/tap/v3alpha/BUILD
+++ b/api/envoy/config/common/tap/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/common/tap/v2alpha:pkg",
         "//envoy/service/tap/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/accesslog/v3alpha/BUILD b/api/envoy/config/filter/accesslog/v3alpha/BUILD
index 46548ca534fe7..ce38548688c97 100644
--- a/api/envoy/config/filter/accesslog/v3alpha/BUILD
+++ b/api/envoy/config/filter/accesslog/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/route:pkg",
+        "//envoy/config/filter/accesslog/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/fault/v3alpha/BUILD b/api/envoy/config/filter/fault/v3alpha/BUILD
index 9ed98f0071019..e0f1d153ef1ec 100644
--- a/api/envoy/config/filter/fault/v3alpha/BUILD
+++ b/api/envoy/config/filter/fault/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/config/filter/fault/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/BUILD b/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/BUILD
index 1f043ce20048e..edb3205ea3751 100644
--- a/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/adaptive_concurrency/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/http/adaptive_concurrency/v2alpha:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/csrf/v3alpha/BUILD b/api/envoy/config/filter/http/csrf/v3alpha/BUILD
index 6cc0b8618c819..643050484631d 100644
--- a/api/envoy/config/filter/http/csrf/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/csrf/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/http/csrf/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/BUILD b/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/BUILD
index 8532021c60f34..f4b45e7bd7baf 100644
--- a/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/dynamic_forward_proxy/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/config/common/dynamic_forward_proxy/v3alpha:pkg",
+        "//envoy/config/filter/http/dynamic_forward_proxy/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/http/ext_authz/v3alpha/BUILD b/api/envoy/config/filter/http/ext_authz/v3alpha/BUILD
index c8e4619a28013..cc78943e600dd 100644
--- a/api/envoy/config/filter/http/ext_authz/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/ext_authz/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/http/ext_authz/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
diff --git a/api/envoy/config/filter/http/fault/v3alpha/BUILD b/api/envoy/config/filter/http/fault/v3alpha/BUILD
index be3272a3e830e..a017aea7d76b0 100644
--- a/api/envoy/config/filter/http/fault/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/fault/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/route:pkg",
         "//envoy/config/filter/fault/v3alpha:pkg",
+        "//envoy/config/filter/http/fault/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/health_check/v3alpha/BUILD b/api/envoy/config/filter/http/health_check/v3alpha/BUILD
index 7b2d3ee272f68..bbee67c442939 100644
--- a/api/envoy/config/filter/http/health_check/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/health_check/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/route:pkg",
+        "//envoy/config/filter/http/health_check/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/ip_tagging/v3alpha/BUILD b/api/envoy/config/filter/http/ip_tagging/v3alpha/BUILD
index 8fdd93fe31873..498b920f0e24f 100644
--- a/api/envoy/config/filter/http/ip_tagging/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/ip_tagging/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/http/ip_tagging/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/http/jwt_authn/v3alpha/BUILD b/api/envoy/config/filter/http/jwt_authn/v3alpha/BUILD
index fdae5d92145f6..da0b567756fce 100644
--- a/api/envoy/config/filter/http/jwt_authn/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/jwt_authn/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/route:pkg",
+        "//envoy/config/filter/http/jwt_authn/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/http/rate_limit/v3alpha/BUILD b/api/envoy/config/filter/http/rate_limit/v3alpha/BUILD
index ad669d667a6f3..b9c559dd1ef19 100644
--- a/api/envoy/config/filter/http/rate_limit/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/rate_limit/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/config/filter/http/rate_limit/v2:pkg",
         "//envoy/config/ratelimit/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/rbac/v3alpha/BUILD b/api/envoy/config/filter/http/rbac/v3alpha/BUILD
index d2c2e81cff97c..75f557f23b22d 100644
--- a/api/envoy/config/filter/http/rbac/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/rbac/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/config/filter/http/rbac/v2:pkg",
         "//envoy/config/rbac/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/http/router/v3alpha/BUILD b/api/envoy/config/filter/http/router/v3alpha/BUILD
index faca4b97ea663..f968fcc4056ed 100644
--- a/api/envoy/config/filter/http/router/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/router/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/config/filter/accesslog/v3alpha:pkg",
+        "//envoy/config/filter/http/router/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/http/tap/v3alpha/BUILD b/api/envoy/config/filter/http/tap/v3alpha/BUILD
index cb4a1c5ddfa2a..0a1528ac5bfb5 100644
--- a/api/envoy/config/filter/http/tap/v3alpha/BUILD
+++ b/api/envoy/config/filter/http/tap/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/config/common/tap/v3alpha:pkg",
+        "//envoy/config/filter/http/tap/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/network/client_ssl_auth/v3alpha/BUILD b/api/envoy/config/filter/network/client_ssl_auth/v3alpha/BUILD
index 8fdd93fe31873..6d6c31a0fd906 100644
--- a/api/envoy/config/filter/network/client_ssl_auth/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/client_ssl_auth/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/network/client_ssl_auth/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/network/dubbo_proxy/v3alpha/BUILD b/api/envoy/config/filter/network/dubbo_proxy/v3alpha/BUILD
index 0e33ea4c7acce..ddec432b7497a 100644
--- a/api/envoy/config/filter/network/dubbo_proxy/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/dubbo_proxy/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/route:pkg",
+        "//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
diff --git a/api/envoy/config/filter/network/ext_authz/v3alpha/BUILD b/api/envoy/config/filter/network/ext_authz/v3alpha/BUILD
index 8fdd93fe31873..a681ae9284f9e 100644
--- a/api/envoy/config/filter/network/ext_authz/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/ext_authz/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/network/ext_authz/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/network/http_connection_manager/v3alpha/BUILD b/api/envoy/config/filter/network/http_connection_manager/v3alpha/BUILD
index 2af4ce5073649..49d7cdc1ea2e7 100644
--- a/api/envoy/config/filter/network/http_connection_manager/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/http_connection_manager/v3alpha/BUILD
@@ -9,6 +9,7 @@ api_proto_package(
         "//envoy/api/v3alpha:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/config/filter/accesslog/v3alpha:pkg",
+        "//envoy/config/filter/network/http_connection_manager/v2:pkg",
         "//envoy/type/tracing/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
diff --git a/api/envoy/config/filter/network/mongo_proxy/v3alpha/BUILD b/api/envoy/config/filter/network/mongo_proxy/v3alpha/BUILD
index fbcac905634a7..cee6b4ce08675 100644
--- a/api/envoy/config/filter/network/mongo_proxy/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/mongo_proxy/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/config/filter/fault/v3alpha:pkg",
+        "//envoy/config/filter/network/mongo_proxy/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/network/rate_limit/v3alpha/BUILD b/api/envoy/config/filter/network/rate_limit/v3alpha/BUILD
index 1f993d4bb8770..db64de0c7e8b0 100644
--- a/api/envoy/config/filter/network/rate_limit/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/rate_limit/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/ratelimit:pkg",
+        "//envoy/config/filter/network/rate_limit/v2:pkg",
         "//envoy/config/ratelimit/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/network/rbac/v3alpha/BUILD b/api/envoy/config/filter/network/rbac/v3alpha/BUILD
index d2c2e81cff97c..7ba3a49cab063 100644
--- a/api/envoy/config/filter/network/rbac/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/rbac/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/config/filter/network/rbac/v2:pkg",
         "//envoy/config/rbac/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/network/redis_proxy/v3alpha/BUILD b/api/envoy/config/filter/network/redis_proxy/v3alpha/BUILD
index 8fdd93fe31873..5ce1854d41e18 100644
--- a/api/envoy/config/filter/network/redis_proxy/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/redis_proxy/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/network/redis_proxy/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/network/tcp_proxy/v3alpha/BUILD b/api/envoy/config/filter/network/tcp_proxy/v3alpha/BUILD
index bffffdeaa41aa..3a33df73cd903 100644
--- a/api/envoy/config/filter/network/tcp_proxy/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/tcp_proxy/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/config/filter/accesslog/v3alpha:pkg",
+        "//envoy/config/filter/network/tcp_proxy/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/network/thrift_proxy/v3alpha/BUILD b/api/envoy/config/filter/network/thrift_proxy/v3alpha/BUILD
index fdae5d92145f6..20cf51545d06f 100644
--- a/api/envoy/config/filter/network/thrift_proxy/v3alpha/BUILD
+++ b/api/envoy/config/filter/network/thrift_proxy/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/route:pkg",
+        "//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/filter/thrift/rate_limit/v3alpha/BUILD b/api/envoy/config/filter/thrift/rate_limit/v3alpha/BUILD
index ad669d667a6f3..ea605f3044e19 100644
--- a/api/envoy/config/filter/thrift/rate_limit/v3alpha/BUILD
+++ b/api/envoy/config/filter/thrift/rate_limit/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/config/filter/thrift/rate_limit/v2alpha1:pkg",
         "//envoy/config/ratelimit/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/grpc_credential/v3alpha/BUILD b/api/envoy/config/grpc_credential/v3alpha/BUILD
index 8fdd93fe31873..12283c82e5102 100644
--- a/api/envoy/config/grpc_credential/v3alpha/BUILD
+++ b/api/envoy/config/grpc_credential/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/grpc_credential/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/metrics/v3alpha/BUILD b/api/envoy/config/metrics/v3alpha/BUILD
index 6cc0b8618c819..8a31c8e8e6805 100644
--- a/api/envoy/config/metrics/v3alpha/BUILD
+++ b/api/envoy/config/metrics/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/metrics/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/config/overload/v3alpha/BUILD b/api/envoy/config/overload/v3alpha/BUILD
index 66ca389992cb1..9a513b8504940 100644
--- a/api/envoy/config/overload/v3alpha/BUILD
+++ b/api/envoy/config/overload/v3alpha/BUILD
@@ -5,5 +5,8 @@ load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
 licenses(["notice"])  # Apache 2
 
 api_proto_package(
-    deps = ["@com_github_cncf_udpa//udpa/api/annotations:pkg"],
+    deps = [
+        "//envoy/config/overload/v2alpha:pkg",
+        "@com_github_cncf_udpa//udpa/api/annotations:pkg",
+    ],
 )
diff --git a/api/envoy/config/ratelimit/v3alpha/BUILD b/api/envoy/config/ratelimit/v3alpha/BUILD
index 8fdd93fe31873..b483bc5d85f69 100644
--- a/api/envoy/config/ratelimit/v3alpha/BUILD
+++ b/api/envoy/config/ratelimit/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/ratelimit/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/config/rbac/v3alpha/BUILD b/api/envoy/config/rbac/v3alpha/BUILD
index 5beae73591ec7..9cbb9fa701e6f 100644
--- a/api/envoy/config/rbac/v3alpha/BUILD
+++ b/api/envoy/config/rbac/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/route:pkg",
+        "//envoy/config/rbac/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
         "@com_google_googleapis//google/api/expr/v1alpha1:syntax_proto",
diff --git a/api/envoy/config/trace/v3alpha/BUILD b/api/envoy/config/trace/v3alpha/BUILD
index 09e9cfe42b869..6a7348ee2a56e 100644
--- a/api/envoy/config/trace/v3alpha/BUILD
+++ b/api/envoy/config/trace/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/trace/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
         "@opencensus_proto//opencensus/proto/trace/v1:trace_config_proto",
     ],
diff --git a/api/envoy/config/transport_socket/tap/v3alpha/BUILD b/api/envoy/config/transport_socket/tap/v3alpha/BUILD
index d32027a9d8988..26046f675d239 100644
--- a/api/envoy/config/transport_socket/tap/v3alpha/BUILD
+++ b/api/envoy/config/transport_socket/tap/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/config/common/tap/v3alpha:pkg",
+        "//envoy/config/transport_socket/tap/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/data/accesslog/v3alpha/BUILD b/api/envoy/data/accesslog/v3alpha/BUILD
index 8fdd93fe31873..cd63e8ba1cdbd 100644
--- a/api/envoy/data/accesslog/v3alpha/BUILD
+++ b/api/envoy/data/accesslog/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/data/accesslog/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/data/core/v3alpha/BUILD b/api/envoy/data/core/v3alpha/BUILD
index 8fdd93fe31873..2287a17df53b8 100644
--- a/api/envoy/data/core/v3alpha/BUILD
+++ b/api/envoy/data/core/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/data/core/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/data/tap/v3alpha/BUILD b/api/envoy/data/tap/v3alpha/BUILD
index 8fdd93fe31873..4839e9ee53317 100644
--- a/api/envoy/data/tap/v3alpha/BUILD
+++ b/api/envoy/data/tap/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/data/tap/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/service/accesslog/v3alpha/BUILD b/api/envoy/service/accesslog/v3alpha/BUILD
index 8edc40838be77..aa367fc801171 100644
--- a/api/envoy/service/accesslog/v3alpha/BUILD
+++ b/api/envoy/service/accesslog/v3alpha/BUILD
@@ -9,6 +9,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/data/accesslog/v3alpha:pkg",
+        "//envoy/service/accesslog/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/service/auth/v3alpha/BUILD b/api/envoy/service/auth/v3alpha/BUILD
index 6a51136430535..4637f77aeea5d 100644
--- a/api/envoy/service/auth/v3alpha/BUILD
+++ b/api/envoy/service/auth/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     has_services = True,
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/service/auth/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/service/discovery/v3alpha/BUILD b/api/envoy/service/discovery/v3alpha/BUILD
index 0e09dda883401..7600fd864eb77 100644
--- a/api/envoy/service/discovery/v3alpha/BUILD
+++ b/api/envoy/service/discovery/v3alpha/BUILD
@@ -10,6 +10,7 @@ api_proto_package(
         "//envoy/api/v3alpha:pkg",
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/endpoint:pkg",
+        "//envoy/service/discovery/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/service/load_stats/v3alpha/BUILD b/api/envoy/service/load_stats/v3alpha/BUILD
index d690f61edf235..4fe1584839b8d 100644
--- a/api/envoy/service/load_stats/v3alpha/BUILD
+++ b/api/envoy/service/load_stats/v3alpha/BUILD
@@ -9,6 +9,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/endpoint:pkg",
+        "//envoy/service/load_stats/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/service/metrics/v3alpha/BUILD b/api/envoy/service/metrics/v3alpha/BUILD
index b0341682b3d6a..5ddeef26b1788 100644
--- a/api/envoy/service/metrics/v3alpha/BUILD
+++ b/api/envoy/service/metrics/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     has_services = True,
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/service/metrics/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
         "@prometheus_metrics_model//:client_model",
     ],
diff --git a/api/envoy/service/ratelimit/v3alpha/BUILD b/api/envoy/service/ratelimit/v3alpha/BUILD
index 2708f92cf05c7..08f1c32c524c2 100644
--- a/api/envoy/service/ratelimit/v3alpha/BUILD
+++ b/api/envoy/service/ratelimit/v3alpha/BUILD
@@ -9,6 +9,7 @@ api_proto_package(
     deps = [
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/ratelimit:pkg",
+        "//envoy/service/ratelimit/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/service/tap/v3alpha/BUILD b/api/envoy/service/tap/v3alpha/BUILD
index f50fa7d19ef98..865bf1f690963 100644
--- a/api/envoy/service/tap/v3alpha/BUILD
+++ b/api/envoy/service/tap/v3alpha/BUILD
@@ -11,6 +11,7 @@ api_proto_package(
         "//envoy/api/v3alpha/core:pkg",
         "//envoy/api/v3alpha/route:pkg",
         "//envoy/data/tap/v3alpha:pkg",
+        "//envoy/service/tap/v2alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
 )
diff --git a/api/envoy/service/trace/v3alpha/BUILD b/api/envoy/service/trace/v3alpha/BUILD
index 62d9d9416e408..e987d2084e163 100644
--- a/api/envoy/service/trace/v3alpha/BUILD
+++ b/api/envoy/service/trace/v3alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     has_services = True,
     deps = [
         "//envoy/api/v3alpha/core:pkg",
+        "//envoy/service/trace/v2:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
         "@opencensus_proto//opencensus/proto/trace/v1:trace_proto",
     ],
diff --git a/api/envoy/type/matcher/v3alpha/BUILD b/api/envoy/type/matcher/v3alpha/BUILD
index 9ed98f0071019..0300ae19bfcb6 100644
--- a/api/envoy/type/matcher/v3alpha/BUILD
+++ b/api/envoy/type/matcher/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/type/matcher:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/api/annotations:pkg",
     ],
diff --git a/api/envoy/type/v3alpha/BUILD b/api/envoy/type/v3alpha/BUILD
index 66ca389992cb1..87dc6cd3776aa 100644
--- a/api/envoy/type/v3alpha/BUILD
+++ b/api/envoy/type/v3alpha/BUILD
@@ -5,5 +5,8 @@ load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
 licenses(["notice"])  # Apache 2
 
 api_proto_package(
-    deps = ["@com_github_cncf_udpa//udpa/api/annotations:pkg"],
+    deps = [
+        "//envoy/type:pkg",
+        "@com_github_cncf_udpa//udpa/api/annotations:pkg",
+    ],
 )
diff --git a/source/extensions/filters/http/ip_tagging/BUILD b/source/extensions/filters/http/ip_tagging/BUILD
index 4729cdd983d76..d6baea069e27a 100644
--- a/source/extensions/filters/http/ip_tagging/BUILD
+++ b/source/extensions/filters/http/ip_tagging/BUILD
@@ -39,7 +39,6 @@ envoy_cc_extension(
         "//source/extensions/filters/http:well_known_names",
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/ip_tagging:ip_tagging_filter_lib",
-        "@envoy_api//envoy/config/filter/http/ip_tagging/v2:pkg_cc_proto",
         "@envoy_api//envoy/config/filter/http/ip_tagging/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/extensions/filters/http/ip_tagging/config.h b/source/extensions/filters/http/ip_tagging/config.h
index 33585288dea20..24cbe630a8271 100644
--- a/source/extensions/filters/http/ip_tagging/config.h
+++ b/source/extensions/filters/http/ip_tagging/config.h
@@ -1,6 +1,5 @@
 #pragma once
 
-#include "envoy/config/filter/http/ip_tagging/v2/ip_tagging.pb.h" // For proto descriptors only
 #include "envoy/config/filter/http/ip_tagging/v3alpha/ip_tagging.pb.h"
 #include "envoy/config/filter/http/ip_tagging/v3alpha/ip_tagging.pb.validate.h"
 
diff --git a/tools/proto_sync.py b/tools/proto_sync.py
index 24531c66ab434..2fc2cc82b2d0a 100755
--- a/tools/proto_sync.py
+++ b/tools/proto_sync.py
@@ -3,6 +3,7 @@
 # Diff or copy protoxform artifacts from Bazel cache back to the source tree.
 
 import os
+import pathlib
 import re
 import shutil
 import string
@@ -43,6 +44,7 @@
 
 IMPORT_REGEX = re.compile('import "(.*)";')
 SERVICE_REGEX = re.compile('service \w+ {')
+PREVIOUS_MESSAGE_TYPE_REGEX = re.compile(r'previous_message_type\s+=\s+"([^"]*)";')
 
 
 class ProtoSyncError(Exception):
@@ -167,6 +169,26 @@ def GetImportDeps(proto_path):
   return imports
 
 
+def GetPreviousMessageTypeDeps(proto_path):
+  """Obtain the Bazel dependencies for the previous version of messages in a .proto file.
+
+  We need to link in earlier proto descriptors to support Envoy reflection upgrades.
+
+  Args:
+    proto_path: path to .proto.
+
+  Returns:
+    A list of Bazel targets reflecting the previous message types in the .proto at proto_path.
+  """
+  contents = pathlib.Path(proto_path).read_text(encoding='utf8')
+  matches = re.findall(PREVIOUS_MESSAGE_TYPE_REGEX, contents)
+  deps = []
+  for m in matches:
+    target = '//%s:pkg' % '/'.join(s for s in m.split('.') if s and s[0].islower())
+    deps.append(target)
+  return deps
+
+
 def HasServices(proto_path):
   """Does a .proto file have any service definitions?
 
@@ -194,17 +216,19 @@ def BuildFileContents(root, files):
     A string containing the canonical BUILD file content for root.
   """
   import_deps = set(sum([GetImportDeps(os.path.join(root, f)) for f in files], []))
+  history_deps = set(sum([GetPreviousMessageTypeDeps(os.path.join(root, f)) for f in files], []))
+  deps = import_deps.union(history_deps)
   has_services = any(HasServices(os.path.join(root, f)) for f in files)
   fields = []
   if has_services:
     fields.append('    has_services = True,')
-  if import_deps:
-    if len(import_deps) == 1:
-      formatted_deps = '"%s"' % list(import_deps)[0]
+  if deps:
+    if len(deps) == 1:
+      formatted_deps = '"%s"' % list(deps)[0]
     else:
       formatted_deps = '\n' + '\n'.join(
           '        "%s",' % dep
-          for dep in sorted(import_deps, key=lambda s: s.replace(':', '!'))) + '\n    '
+          for dep in sorted(deps, key=lambda s: s.replace(':', '!'))) + '\n    '
     fields.append('    deps = [%s],' % formatted_deps)
   formatted_fields = '\n' + '\n'.join(fields) + '\n' if fields else ''
   return BUILD_FILE_TEMPLATE.substitute(fields=formatted_fields)
@@ -217,9 +241,6 @@ def SyncBuildFiles(cmd):
     cmd: 'check' or 'fix'.
   """
   for root, dirs, files in os.walk('api/'):
-    # Skip support files.
-    if root == 'api/versioning':
-      continue
     is_proto_dir = any(f.endswith('.proto') for f in files)
     if not is_proto_dir:
       continue