diff --git a/api/envoy/admin/v2alpha/BUILD b/api/envoy/admin/v2alpha/BUILD
index 3ced653bc3282..a7253df510f85 100644
--- a/api/envoy/admin/v2alpha/BUILD
+++ b/api/envoy/admin/v2alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/service/tap/v2alpha:pkg",
diff --git a/api/envoy/admin/v2alpha/server_info.proto b/api/envoy/admin/v2alpha/server_info.proto
index 099e2f03bc8f0..1052cb6296ee8 100644
--- a/api/envoy/admin/v2alpha/server_info.proto
+++ b/api/envoy/admin/v2alpha/server_info.proto
@@ -4,6 +4,8 @@ package envoy.admin.v2alpha;
 
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
@@ -128,9 +130,10 @@ message CommandLineOptions {
   Mode mode = 19;
 
   // max_stats and max_obj_name_len are now unused and have no effect.
-  uint64 max_stats = 20 [deprecated = true];
+  uint64 max_stats = 20 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
-  uint64 max_obj_name_len = 21 [deprecated = true];
+  uint64 max_obj_name_len = 21
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // See :option:`--disable-hot-restart` for details.
   bool disable_hot_restart = 22;
diff --git a/api/envoy/admin/v3alpha/BUILD b/api/envoy/admin/v3alpha/BUILD
index 32469e852fd49..b724bb8ad88fc 100644
--- a/api/envoy/admin/v3alpha/BUILD
+++ b/api/envoy/admin/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/admin/v2alpha:pkg",
+        "//envoy/annotations:pkg",
         "//envoy/config/bootstrap/v3alpha:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/tap/v3alpha:pkg",
diff --git a/api/envoy/admin/v3alpha/server_info.proto b/api/envoy/admin/v3alpha/server_info.proto
index ccceb4e1b180e..1136a4118a0eb 100644
--- a/api/envoy/admin/v3alpha/server_info.proto
+++ b/api/envoy/admin/v3alpha/server_info.proto
@@ -6,6 +6,8 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v3alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
diff --git a/api/envoy/annotations/deprecation.proto b/api/envoy/annotations/deprecation.proto
new file mode 100644
index 0000000000000..813f1050bdeb8
--- /dev/null
+++ b/api/envoy/annotations/deprecation.proto
@@ -0,0 +1,21 @@
+syntax = "proto3";
+
+package envoy.annotations;
+
+import "google/protobuf/descriptor.proto";
+
+// Allows tagging proto fields as fatal by default. One Envoy release after
+// deprecation, deprecated fields will be disallowed by default, a state which
+// is reversible with :ref:`runtime overrides <config_runtime_deprecation>`.
+
+// Magic number in this file derived from top 28bit of SHA256 digest of
+// "envoy.annotation.disallowed_by_default"
+extend google.protobuf.FieldOptions {
+  bool disallowed_by_default = 189503207;
+}
+
+// Magic number in this file derived from top 28bit of SHA256 digest of
+// "envoy.annotation.disallowed_by_default_enum"
+extend google.protobuf.EnumValueOptions {
+  bool disallowed_by_default_enum = 70100853;
+}
diff --git a/api/envoy/api/v2/core/BUILD b/api/envoy/api/v2/core/BUILD
index 283a3ea63358a..ca0c7c3f1e3d2 100644
--- a/api/envoy/api/v2/core/BUILD
+++ b/api/envoy/api/v2/core/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/api/envoy/api/v2/core/config_source.proto b/api/envoy/api/v2/core/config_source.proto
index 5a082d8bc793c..d5680d2e464df 100644
--- a/api/envoy/api/v2/core/config_source.proto
+++ b/api/envoy/api/v2/core/config_source.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/grpc_service.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -40,7 +41,8 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    UNSUPPORTED_REST_LEGACY = 0 [deprecated = true];
+    UNSUPPORTED_REST_LEGACY = 0
+        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/api/envoy/api/v2/route/BUILD b/api/envoy/api/v2/route/BUILD
index b570ccfdeee3a..b60e7c4ceb511 100644
--- a/api/envoy/api/v2/route/BUILD
+++ b/api/envoy/api/v2/route/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
diff --git a/api/envoy/api/v2/route/route_components.proto b/api/envoy/api/v2/route/route_components.proto
index 37f5aa1d5a220..d54a8673952d6 100644
--- a/api/envoy/api/v2/route/route_components.proto
+++ b/api/envoy/api/v2/route/route_components.proto
@@ -14,6 +14,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -494,7 +495,8 @@ message CorsPolicy {
     //
     //   **This field is deprecated**. Set the
     //   :ref:`filter_enabled<envoy_api_field_route.CorsPolicy.filter_enabled>` field instead.
-    google.protobuf.BoolValue enabled = 7 [deprecated = true];
+    google.protobuf.BoolValue enabled = 7
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Specifies the % of requests for which the CORS filter is enabled.
     //
@@ -558,7 +560,7 @@ message RouteAction {
     //   **This field is deprecated**. Set the
     //   :ref:`runtime_fraction
     //   <envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_fraction>` field instead.
-    string runtime_key = 2 [deprecated = true];
+    string runtime_key = 2 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // If both :ref:`runtime_key
     // <envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_key>` and this field are not
diff --git a/api/envoy/config/bootstrap/v2/BUILD b/api/envoy/config/bootstrap/v2/BUILD
index ade7095448153..4bdaf6046a52b 100644
--- a/api/envoy/config/bootstrap/v2/BUILD
+++ b/api/envoy/config/bootstrap/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/auth:pkg",
         "//envoy/api/v2/core:pkg",
diff --git a/api/envoy/config/bootstrap/v2/bootstrap.proto b/api/envoy/config/bootstrap/v2/bootstrap.proto
index bd33e601c7010..cc12345efbae4 100644
--- a/api/envoy/config/bootstrap/v2/bootstrap.proto
+++ b/api/envoy/config/bootstrap/v2/bootstrap.proto
@@ -16,6 +16,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v2";
@@ -119,7 +120,7 @@ message Bootstrap {
   // Configuration for the runtime configuration provider (deprecated). If not
   // specified, a “null” provider will be used which will result in all defaults
   // being used.
-  Runtime runtime = 11 [deprecated = true];
+  Runtime runtime = 11 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
diff --git a/api/envoy/config/bootstrap/v3alpha/BUILD b/api/envoy/config/bootstrap/v3alpha/BUILD
index 30bb6946b9bbc..77e932583bffe 100644
--- a/api/envoy/config/bootstrap/v3alpha/BUILD
+++ b/api/envoy/config/bootstrap/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/config/cluster/v3alpha:pkg",
         "//envoy/config/core/v3alpha:pkg",
diff --git a/api/envoy/config/bootstrap/v3alpha/bootstrap.proto b/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
index 372dc8d7c6ef0..9e3aa5670d5e2 100644
--- a/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
+++ b/api/envoy/config/bootstrap/v3alpha/bootstrap.proto
@@ -18,6 +18,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v3alpha";
diff --git a/api/envoy/config/core/v3alpha/BUILD b/api/envoy/config/core/v3alpha/BUILD
index 6cd088f299f21..59a487d549aec 100644
--- a/api/envoy/config/core/v3alpha/BUILD
+++ b/api/envoy/config/core/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "//envoy/type/v3alpha:pkg",
diff --git a/api/envoy/config/core/v3alpha/config_source.proto b/api/envoy/config/core/v3alpha/config_source.proto
index 718ca6cc191b7..8628b7d85cb4e 100644
--- a/api/envoy/config/core/v3alpha/config_source.proto
+++ b/api/envoy/config/core/v3alpha/config_source.proto
@@ -9,6 +9,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.core.v3alpha";
@@ -42,7 +43,8 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 [deprecated = true];
+    DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0
+        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/api/envoy/config/filter/fault/v2/BUILD b/api/envoy/config/filter/fault/v2/BUILD
index 3535fe17b6823..e2a45aba90ecc 100644
--- a/api/envoy/config/filter/fault/v2/BUILD
+++ b/api/envoy/config/filter/fault/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/fault/v2/fault.proto b/api/envoy/config/filter/fault/v2/fault.proto
index a687b358d5e58..02fb5646dcf13 100644
--- a/api/envoy/config/filter/fault/v2/fault.proto
+++ b/api/envoy/config/filter/fault/v2/fault.proto
@@ -6,6 +6,7 @@ import "envoy/type/percent.proto";
 
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -35,7 +36,7 @@ message FaultDelay {
   reserved 2;
 
   // Unused and deprecated. Will be removed in the next release.
-  FaultDelayType type = 1 [deprecated = true];
+  FaultDelayType type = 1 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   oneof fault_delay_secifier {
     option (validate.required) = true;
diff --git a/api/envoy/config/filter/http/ext_authz/v2/BUILD b/api/envoy/config/filter/http/ext_authz/v2/BUILD
index 311b712bf4649..1eb9a92e34aa7 100644
--- a/api/envoy/config/filter/http/ext_authz/v2/BUILD
+++ b/api/envoy/config/filter/http/ext_authz/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
diff --git a/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto b/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
index 6c016d9269bbd..94a87f3dde3cd 100644
--- a/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
+++ b/api/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
@@ -8,6 +8,7 @@ import "envoy/api/v2/core/http_uri.proto";
 import "envoy/type/http_status.proto";
 import "envoy/type/matcher/string.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -50,7 +51,7 @@ message ExtAuthz {
   // useful when transitioning from alpha to release versions assuming that both definitions are
   // semantically compatible. Deprecation note: This field is deprecated and should only be used for
   // version upgrade. See release notes for more details.
-  bool use_alpha = 4 [deprecated = true];
+  bool use_alpha = 4 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Enables filter to buffer the client request body and send it within the authorization request.
   // A ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
diff --git a/api/envoy/config/filter/network/redis_proxy/v2/BUILD b/api/envoy/config/filter/network/redis_proxy/v2/BUILD
index 69168ad0cf246..55aaeb318f351 100644
--- a/api/envoy/config/filter/network/redis_proxy/v2/BUILD
+++ b/api/envoy/config/filter/network/redis_proxy/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
diff --git a/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto b/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
index f78abdb03481d..c7d7bf7e40575 100644
--- a/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
+++ b/api/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/base.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -162,7 +163,8 @@ message RedisProxy {
     //   This field is deprecated. Use a :ref:`catch_all
     //   route<envoy_api_field_config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.catch_all_route>`
     //   instead.
-    string catch_all_cluster = 3 [deprecated = true];
+    string catch_all_cluster = 3
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Optional catch-all route to forward commands that doesn't match any of the routes. The
     // catch-all route becomes required when no routes are specified.
@@ -181,7 +183,7 @@ message RedisProxy {
   //   This field is deprecated. Use a :ref:`catch_all
   //   route<envoy_api_field_config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.catch_all_route>`
   //   instead.
-  string cluster = 2 [deprecated = true];
+  string cluster = 2 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Network settings for the connection pool to the upstream clusters.
   ConnPoolSettings settings = 3 [(validate.rules).message = {required: true}];
diff --git a/api/envoy/config/route/v3alpha/BUILD b/api/envoy/config/route/v3alpha/BUILD
index 8b724d7e81295..ffdcc0e309fdc 100644
--- a/api/envoy/config/route/v3alpha/BUILD
+++ b/api/envoy/config/route/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/route:pkg",
         "//envoy/config/core/v3alpha:pkg",
diff --git a/api/envoy/config/route/v3alpha/route_components.proto b/api/envoy/config/route/v3alpha/route_components.proto
index 56d5cf777fdc7..c9f1232991c4e 100644
--- a/api/envoy/config/route/v3alpha/route_components.proto
+++ b/api/envoy/config/route/v3alpha/route_components.proto
@@ -16,6 +16,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.route.v3alpha";
diff --git a/api/envoy/extensions/filters/common/fault/v3alpha/BUILD b/api/envoy/extensions/filters/common/fault/v3alpha/BUILD
index 57f3af3bcbc0d..26a3a595c93b2 100644
--- a/api/envoy/extensions/filters/common/fault/v3alpha/BUILD
+++ b/api/envoy/extensions/filters/common/fault/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/filter/fault/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/api/envoy/extensions/filters/common/fault/v3alpha/fault.proto b/api/envoy/extensions/filters/common/fault/v3alpha/fault.proto
index f556de47dce03..bdedd6d43ecde 100644
--- a/api/envoy/extensions/filters/common/fault/v3alpha/fault.proto
+++ b/api/envoy/extensions/filters/common/fault/v3alpha/fault.proto
@@ -8,6 +8,7 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.common.fault.v3alpha";
diff --git a/api/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD b/api/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
index c1165f396f62b..d2cfecf097838 100644
--- a/api/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
+++ b/api/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/filter/http/ext_authz/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
diff --git a/api/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto b/api/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
index d4367e5de6017..ce9e764baccb3 100644
--- a/api/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
+++ b/api/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
@@ -10,6 +10,7 @@ import "envoy/type/v3alpha/http_status.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3alpha";
diff --git a/api/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD b/api/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
index 66299959db23a..73bce7c73fac7 100644
--- a/api/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
+++ b/api/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/filter/network/redis_proxy/v2:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/api/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto b/api/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
index fbce339cbd63c..9b60aaccd5948 100644
--- a/api/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
+++ b/api/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
@@ -9,6 +9,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.network.redis_proxy.v3alpha";
diff --git a/docs/root/configuration/operations/runtime.rst b/docs/root/configuration/operations/runtime.rst
index 47ebcfe7400cc..3d405269991f3 100644
--- a/docs/root/configuration/operations/runtime.rst
+++ b/docs/root/configuration/operations/runtime.rst
@@ -225,6 +225,8 @@ Lines starting with ``#`` as the first character are treated as comments.
 Comments can be used to provide context on an existing value. Comments are also useful in an
 otherwise empty file to keep a placeholder for deployment in a time of need.
 
+.. _config_runtime_deprecation:
+
 Using runtime overrides for deprecated features
 -----------------------------------------------
 
@@ -238,13 +240,12 @@ increments the :ref:`deprecated_feature_use <runtime_stats>` runtime stat.
 Users are encouraged to go to :ref:`deprecated <deprecated>` to see how to
 migrate to the new code path and make sure it is suitable for their use case.
 
-In the second phase the message and filename will be added to
-:repo:`runtime_features.cc <source/common/runtime/runtime_features.cc>`
-and use of that configuration field will cause the config to be rejected by default. 
-This fail-by-default mode can be overridden in runtime configuration by setting
-envoy.deprecated_features.filename.proto:fieldname or envoy.deprecated_features.filename.proto:enum_value
+In the second phase the field will be tagged as disallowed_by_default
+and use of that configuration field will cause the config to be rejected by default.
+This disallowed mode can be overridden in runtime configuration by setting
+envoy.deprecated_features:full_fieldname or envoy.deprecated_features:full_enum_value
 to true. For example, for a deprecated field
-``Foo.Bar.Eep`` in ``baz.proto`` set ``envoy.deprecated_features.baz.proto:Eep`` to
+``Foo.Bar.Eep`` set ``envoy.deprecated_features:Foo.bar.Eep`` to
 ``true``. Use of this override is **strongly discouraged**.
 Fatal-by-default configuration indicates that the removal of the old code paths is imminent. It is
 far better for both Envoy users and for Envoy contributors if any bugs or feature gaps with the new
diff --git a/generated_api_shadow/envoy/admin/v2alpha/BUILD b/generated_api_shadow/envoy/admin/v2alpha/BUILD
index 3ced653bc3282..a7253df510f85 100644
--- a/generated_api_shadow/envoy/admin/v2alpha/BUILD
+++ b/generated_api_shadow/envoy/admin/v2alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/service/tap/v2alpha:pkg",
diff --git a/generated_api_shadow/envoy/admin/v2alpha/server_info.proto b/generated_api_shadow/envoy/admin/v2alpha/server_info.proto
index 099e2f03bc8f0..1052cb6296ee8 100644
--- a/generated_api_shadow/envoy/admin/v2alpha/server_info.proto
+++ b/generated_api_shadow/envoy/admin/v2alpha/server_info.proto
@@ -4,6 +4,8 @@ package envoy.admin.v2alpha;
 
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
@@ -128,9 +130,10 @@ message CommandLineOptions {
   Mode mode = 19;
 
   // max_stats and max_obj_name_len are now unused and have no effect.
-  uint64 max_stats = 20 [deprecated = true];
+  uint64 max_stats = 20 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
-  uint64 max_obj_name_len = 21 [deprecated = true];
+  uint64 max_obj_name_len = 21
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // See :option:`--disable-hot-restart` for details.
   bool disable_hot_restart = 22;
diff --git a/generated_api_shadow/envoy/admin/v3alpha/BUILD b/generated_api_shadow/envoy/admin/v3alpha/BUILD
index 32469e852fd49..b724bb8ad88fc 100644
--- a/generated_api_shadow/envoy/admin/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/admin/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/admin/v2alpha:pkg",
+        "//envoy/annotations:pkg",
         "//envoy/config/bootstrap/v3alpha:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/tap/v3alpha:pkg",
diff --git a/generated_api_shadow/envoy/admin/v3alpha/server_info.proto b/generated_api_shadow/envoy/admin/v3alpha/server_info.proto
index 5fcaf5a63a057..b2db7402c3f22 100644
--- a/generated_api_shadow/envoy/admin/v3alpha/server_info.proto
+++ b/generated_api_shadow/envoy/admin/v3alpha/server_info.proto
@@ -6,6 +6,8 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v3alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
@@ -135,9 +137,11 @@ message CommandLineOptions {
   Mode mode = 19;
 
   // max_stats and max_obj_name_len are now unused and have no effect.
-  uint64 hidden_envoy_deprecated_max_stats = 20 [deprecated = true];
+  uint64 hidden_envoy_deprecated_max_stats = 20
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
-  uint64 hidden_envoy_deprecated_max_obj_name_len = 21 [deprecated = true];
+  uint64 hidden_envoy_deprecated_max_obj_name_len = 21
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // See :option:`--disable-hot-restart` for details.
   bool disable_hot_restart = 22;
diff --git a/generated_api_shadow/envoy/annotations/deprecation.proto b/generated_api_shadow/envoy/annotations/deprecation.proto
new file mode 100644
index 0000000000000..813f1050bdeb8
--- /dev/null
+++ b/generated_api_shadow/envoy/annotations/deprecation.proto
@@ -0,0 +1,21 @@
+syntax = "proto3";
+
+package envoy.annotations;
+
+import "google/protobuf/descriptor.proto";
+
+// Allows tagging proto fields as fatal by default. One Envoy release after
+// deprecation, deprecated fields will be disallowed by default, a state which
+// is reversible with :ref:`runtime overrides <config_runtime_deprecation>`.
+
+// Magic number in this file derived from top 28bit of SHA256 digest of
+// "envoy.annotation.disallowed_by_default"
+extend google.protobuf.FieldOptions {
+  bool disallowed_by_default = 189503207;
+}
+
+// Magic number in this file derived from top 28bit of SHA256 digest of
+// "envoy.annotation.disallowed_by_default_enum"
+extend google.protobuf.EnumValueOptions {
+  bool disallowed_by_default_enum = 70100853;
+}
diff --git a/generated_api_shadow/envoy/api/v2/core/BUILD b/generated_api_shadow/envoy/api/v2/core/BUILD
index 283a3ea63358a..ca0c7c3f1e3d2 100644
--- a/generated_api_shadow/envoy/api/v2/core/BUILD
+++ b/generated_api_shadow/envoy/api/v2/core/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/api/v2/core/config_source.proto b/generated_api_shadow/envoy/api/v2/core/config_source.proto
index 5a082d8bc793c..d5680d2e464df 100644
--- a/generated_api_shadow/envoy/api/v2/core/config_source.proto
+++ b/generated_api_shadow/envoy/api/v2/core/config_source.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/grpc_service.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -40,7 +41,8 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    UNSUPPORTED_REST_LEGACY = 0 [deprecated = true];
+    UNSUPPORTED_REST_LEGACY = 0
+        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/generated_api_shadow/envoy/api/v2/route/BUILD b/generated_api_shadow/envoy/api/v2/route/BUILD
index b570ccfdeee3a..b60e7c4ceb511 100644
--- a/generated_api_shadow/envoy/api/v2/route/BUILD
+++ b/generated_api_shadow/envoy/api/v2/route/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
diff --git a/generated_api_shadow/envoy/api/v2/route/route_components.proto b/generated_api_shadow/envoy/api/v2/route/route_components.proto
index 37f5aa1d5a220..d54a8673952d6 100644
--- a/generated_api_shadow/envoy/api/v2/route/route_components.proto
+++ b/generated_api_shadow/envoy/api/v2/route/route_components.proto
@@ -14,6 +14,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -494,7 +495,8 @@ message CorsPolicy {
     //
     //   **This field is deprecated**. Set the
     //   :ref:`filter_enabled<envoy_api_field_route.CorsPolicy.filter_enabled>` field instead.
-    google.protobuf.BoolValue enabled = 7 [deprecated = true];
+    google.protobuf.BoolValue enabled = 7
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Specifies the % of requests for which the CORS filter is enabled.
     //
@@ -558,7 +560,7 @@ message RouteAction {
     //   **This field is deprecated**. Set the
     //   :ref:`runtime_fraction
     //   <envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_fraction>` field instead.
-    string runtime_key = 2 [deprecated = true];
+    string runtime_key = 2 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // If both :ref:`runtime_key
     // <envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_key>` and this field are not
diff --git a/generated_api_shadow/envoy/config/bootstrap/v2/BUILD b/generated_api_shadow/envoy/config/bootstrap/v2/BUILD
index ade7095448153..4bdaf6046a52b 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v2/BUILD
+++ b/generated_api_shadow/envoy/config/bootstrap/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/auth:pkg",
         "//envoy/api/v2/core:pkg",
diff --git a/generated_api_shadow/envoy/config/bootstrap/v2/bootstrap.proto b/generated_api_shadow/envoy/config/bootstrap/v2/bootstrap.proto
index bd33e601c7010..cc12345efbae4 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v2/bootstrap.proto
+++ b/generated_api_shadow/envoy/config/bootstrap/v2/bootstrap.proto
@@ -16,6 +16,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v2";
@@ -119,7 +120,7 @@ message Bootstrap {
   // Configuration for the runtime configuration provider (deprecated). If not
   // specified, a “null” provider will be used which will result in all defaults
   // being used.
-  Runtime runtime = 11 [deprecated = true];
+  Runtime runtime = 11 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
diff --git a/generated_api_shadow/envoy/config/bootstrap/v3alpha/BUILD b/generated_api_shadow/envoy/config/bootstrap/v3alpha/BUILD
index 30bb6946b9bbc..77e932583bffe 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/config/bootstrap/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/config/cluster/v3alpha:pkg",
         "//envoy/config/core/v3alpha:pkg",
diff --git a/generated_api_shadow/envoy/config/bootstrap/v3alpha/bootstrap.proto b/generated_api_shadow/envoy/config/bootstrap/v3alpha/bootstrap.proto
index f0e718721c195..932bb3b16aa73 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v3alpha/bootstrap.proto
+++ b/generated_api_shadow/envoy/config/bootstrap/v3alpha/bootstrap.proto
@@ -18,6 +18,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v3alpha";
@@ -128,7 +129,8 @@ message Bootstrap {
   // Configuration for the runtime configuration provider (deprecated). If not
   // specified, a “null” provider will be used which will result in all defaults
   // being used.
-  Runtime hidden_envoy_deprecated_runtime = 11 [deprecated = true];
+  Runtime hidden_envoy_deprecated_runtime = 11
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
diff --git a/generated_api_shadow/envoy/config/core/v3alpha/BUILD b/generated_api_shadow/envoy/config/core/v3alpha/BUILD
index 6cd088f299f21..59a487d549aec 100644
--- a/generated_api_shadow/envoy/config/core/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/config/core/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "//envoy/type/v3alpha:pkg",
diff --git a/generated_api_shadow/envoy/config/core/v3alpha/config_source.proto b/generated_api_shadow/envoy/config/core/v3alpha/config_source.proto
index b9c58a30ae8d0..12c7e75539644 100644
--- a/generated_api_shadow/envoy/config/core/v3alpha/config_source.proto
+++ b/generated_api_shadow/envoy/config/core/v3alpha/config_source.proto
@@ -9,6 +9,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.core.v3alpha";
@@ -42,7 +43,8 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY = 0 [deprecated = true];
+    hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY = 0
+        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/generated_api_shadow/envoy/config/filter/fault/v2/BUILD b/generated_api_shadow/envoy/config/filter/fault/v2/BUILD
index 3535fe17b6823..e2a45aba90ecc 100644
--- a/generated_api_shadow/envoy/config/filter/fault/v2/BUILD
+++ b/generated_api_shadow/envoy/config/filter/fault/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
diff --git a/generated_api_shadow/envoy/config/filter/fault/v2/fault.proto b/generated_api_shadow/envoy/config/filter/fault/v2/fault.proto
index a687b358d5e58..02fb5646dcf13 100644
--- a/generated_api_shadow/envoy/config/filter/fault/v2/fault.proto
+++ b/generated_api_shadow/envoy/config/filter/fault/v2/fault.proto
@@ -6,6 +6,7 @@ import "envoy/type/percent.proto";
 
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -35,7 +36,7 @@ message FaultDelay {
   reserved 2;
 
   // Unused and deprecated. Will be removed in the next release.
-  FaultDelayType type = 1 [deprecated = true];
+  FaultDelayType type = 1 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   oneof fault_delay_secifier {
     option (validate.required) = true;
diff --git a/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/BUILD b/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/BUILD
index 311b712bf4649..1eb9a92e34aa7 100644
--- a/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/BUILD
+++ b/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
diff --git a/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/ext_authz.proto b/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
index 6c016d9269bbd..94a87f3dde3cd 100644
--- a/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
+++ b/generated_api_shadow/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
@@ -8,6 +8,7 @@ import "envoy/api/v2/core/http_uri.proto";
 import "envoy/type/http_status.proto";
 import "envoy/type/matcher/string.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -50,7 +51,7 @@ message ExtAuthz {
   // useful when transitioning from alpha to release versions assuming that both definitions are
   // semantically compatible. Deprecation note: This field is deprecated and should only be used for
   // version upgrade. See release notes for more details.
-  bool use_alpha = 4 [deprecated = true];
+  bool use_alpha = 4 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Enables filter to buffer the client request body and send it within the authorization request.
   // A ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
diff --git a/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/BUILD b/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/BUILD
index 69168ad0cf246..55aaeb318f351 100644
--- a/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/BUILD
+++ b/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
diff --git a/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto b/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
index f78abdb03481d..c7d7bf7e40575 100644
--- a/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
+++ b/generated_api_shadow/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/base.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -162,7 +163,8 @@ message RedisProxy {
     //   This field is deprecated. Use a :ref:`catch_all
     //   route<envoy_api_field_config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.catch_all_route>`
     //   instead.
-    string catch_all_cluster = 3 [deprecated = true];
+    string catch_all_cluster = 3
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Optional catch-all route to forward commands that doesn't match any of the routes. The
     // catch-all route becomes required when no routes are specified.
@@ -181,7 +183,7 @@ message RedisProxy {
   //   This field is deprecated. Use a :ref:`catch_all
   //   route<envoy_api_field_config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.catch_all_route>`
   //   instead.
-  string cluster = 2 [deprecated = true];
+  string cluster = 2 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Network settings for the connection pool to the upstream clusters.
   ConnPoolSettings settings = 3 [(validate.rules).message = {required: true}];
diff --git a/generated_api_shadow/envoy/config/route/v3alpha/BUILD b/generated_api_shadow/envoy/config/route/v3alpha/BUILD
index 8b724d7e81295..ffdcc0e309fdc 100644
--- a/generated_api_shadow/envoy/config/route/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/config/route/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/route:pkg",
         "//envoy/config/core/v3alpha:pkg",
diff --git a/generated_api_shadow/envoy/config/route/v3alpha/route_components.proto b/generated_api_shadow/envoy/config/route/v3alpha/route_components.proto
index b1437d738d893..f7bd526225e15 100644
--- a/generated_api_shadow/envoy/config/route/v3alpha/route_components.proto
+++ b/generated_api_shadow/envoy/config/route/v3alpha/route_components.proto
@@ -16,6 +16,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.route.v3alpha";
@@ -521,7 +522,8 @@ message CorsPolicy {
     //   **This field is deprecated**. Set the
     //   :ref:`filter_enabled<envoy_api_field_config.route.v3alpha.CorsPolicy.filter_enabled>` field
     //   instead.
-    google.protobuf.BoolValue hidden_envoy_deprecated_enabled = 7 [deprecated = true];
+    google.protobuf.BoolValue hidden_envoy_deprecated_enabled = 7
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Specifies the % of requests for which the CORS filter is enabled.
     //
@@ -591,7 +593,8 @@ message RouteAction {
     //   :ref:`runtime_fraction
     //   <envoy_api_field_config.route.v3alpha.RouteAction.RequestMirrorPolicy.runtime_fraction>`
     //   field instead.
-    string hidden_envoy_deprecated_runtime_key = 2 [deprecated = true];
+    string hidden_envoy_deprecated_runtime_key = 2
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // If both :ref:`runtime_key
     // <envoy_api_field_config.route.v3alpha.RouteAction.RequestMirrorPolicy.runtime_key>` and this
diff --git a/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/BUILD b/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/BUILD
index 57f3af3bcbc0d..26a3a595c93b2 100644
--- a/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/filter/fault/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/fault.proto b/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/fault.proto
index 742da13ded9cb..bc8ba2b1190e9 100644
--- a/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/fault.proto
+++ b/generated_api_shadow/envoy/extensions/filters/common/fault/v3alpha/fault.proto
@@ -8,6 +8,7 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.common.fault.v3alpha";
@@ -39,7 +40,8 @@ message FaultDelay {
   reserved 2;
 
   // Unused and deprecated. Will be removed in the next release.
-  FaultDelayType hidden_envoy_deprecated_type = 1 [deprecated = true];
+  FaultDelayType hidden_envoy_deprecated_type = 1
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   oneof fault_delay_secifier {
     option (validate.required) = true;
diff --git a/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD b/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
index c1165f396f62b..d2cfecf097838 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/filter/http/ext_authz/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto b/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
index 3e0aa10d1543d..3e006b78e5403 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
+++ b/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
@@ -10,6 +10,7 @@ import "envoy/type/v3alpha/http_status.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3alpha";
@@ -52,7 +53,8 @@ message ExtAuthz {
   // useful when transitioning from alpha to release versions assuming that both definitions are
   // semantically compatible. Deprecation note: This field is deprecated and should only be used for
   // version upgrade. See release notes for more details.
-  bool hidden_envoy_deprecated_use_alpha = 4 [deprecated = true];
+  bool hidden_envoy_deprecated_use_alpha = 4
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Enables filter to buffer the client request body and send it within the authorization request.
   // A ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
diff --git a/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD b/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
index 66299959db23a..73bce7c73fac7 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/filter/network/redis_proxy/v2:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto b/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
index f925c67bf6f62..87861ff5b39b6 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
+++ b/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
@@ -9,6 +9,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.network.redis_proxy.v3alpha";
@@ -177,7 +178,8 @@ message RedisProxy {
     //   This field is deprecated. Use a :ref:`catch_all
     //   route<envoy_api_field_extensions.filters.network.redis_proxy.v3alpha.RedisProxy.PrefixRoutes.catch_all_route>`
     //   instead.
-    string hidden_envoy_deprecated_catch_all_cluster = 3 [deprecated = true];
+    string hidden_envoy_deprecated_catch_all_cluster = 3
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Optional catch-all route to forward commands that doesn't match any of the routes. The
     // catch-all route becomes required when no routes are specified.
@@ -196,7 +198,8 @@ message RedisProxy {
   //   This field is deprecated. Use a :ref:`catch_all
   //   route<envoy_api_field_extensions.filters.network.redis_proxy.v3alpha.RedisProxy.PrefixRoutes.catch_all_route>`
   //   instead.
-  string hidden_envoy_deprecated_cluster = 2 [deprecated = true];
+  string hidden_envoy_deprecated_cluster = 2
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Network settings for the connection pool to the upstream clusters.
   ConnPoolSettings settings = 3 [(validate.rules).message = {required: true}];
diff --git a/include/envoy/runtime/runtime.h b/include/envoy/runtime/runtime.h
index 40b9c308ee3f6..26ce3df3032ef 100644
--- a/include/envoy/runtime/runtime.h
+++ b/include/envoy/runtime/runtime.h
@@ -103,13 +103,18 @@ class Snapshot {
 
   using OverrideLayerConstPtr = std::unique_ptr<const OverrideLayer>;
 
-  // Returns true if a deprecated feature is allowed.
-  //
-  // Fundamentally, deprecated features are boolean values.
-  // They are allowed by default or with explicit configuration to "true" via runtime configuration.
-  // They can be disallowed either by inclusion in the hard-coded disallowed_features[] list, or by
-  // configuration of "false" in runtime config.
-  virtual bool deprecatedFeatureEnabled(const std::string& key) const PURE;
+  /**
+   * Returns true if a deprecated feature is allowed.
+   *
+   * Fundamentally, deprecated features are boolean values.
+   * They are allowed by default or with explicit configuration to "true" via runtime configuration.
+   * They can be disallowed either by inclusion in the hard-coded disallowed_features[] list, or by
+   * configuration of "false" in runtime config.
+   * @param key supplies the key to lookup.
+   * @param default_value supplies the default value that will be used if either the key
+   *        does not exist or it is not a boolean.
+   */
+  virtual bool deprecatedFeatureEnabled(const std::string& key, bool default_enabled) const PURE;
 
   // Returns true if a runtime feature is enabled.
   //
diff --git a/source/common/protobuf/BUILD b/source/common/protobuf/BUILD
index 981fc375cb9f7..b552b4795f58c 100644
--- a/source/common/protobuf/BUILD
+++ b/source/common/protobuf/BUILD
@@ -68,6 +68,7 @@ envoy_cc_library(
         "//source/common/common:utility_lib",
         "//source/common/config:api_type_oracle_lib",
         "//source/common/config:version_converter_lib",
+        "@envoy_api//envoy/annotations:pkg_cc_proto",
         "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/source/common/protobuf/utility.cc b/source/common/protobuf/utility.cc
index 97bc51663a053..24ff6d2158eec 100644
--- a/source/common/protobuf/utility.cc
+++ b/source/common/protobuf/utility.cc
@@ -3,6 +3,7 @@
 #include <limits>
 #include <numeric>
 
+#include "envoy/annotations/deprecation.pb.h"
 #include "envoy/protobuf/message_validator.h"
 #include "envoy/type/v3alpha/percent.pb.h"
 
@@ -339,12 +340,13 @@ void checkForDeprecatedNonRepeatedEnumValue(const Protobuf::Message& message,
 #ifdef ENVOY_DISABLE_DEPRECATED_FEATURES
   bool warn_only = false;
 #else
-  bool warn_only = true;
+  bool warn_only = !enum_value_descriptor->options().GetExtension(
+      envoy::annotations::disallowed_by_default_enum);
 #endif
 
-  if (runtime && !runtime->snapshot().deprecatedFeatureEnabled(absl::StrCat(
-                     "envoy.deprecated_features.", filename, ":", enum_value_descriptor->name()))) {
-    warn_only = false;
+  if (runtime) {
+    warn_only = runtime->snapshot().deprecatedFeatureEnabled(
+        absl::StrCat("envoy.deprecated_features:", enum_value_descriptor->full_name()), warn_only);
   }
 
   if (warn_only) {
@@ -400,15 +402,14 @@ void checkForUnexpectedFields(const Protobuf::Message& message,
 #ifdef ENVOY_DISABLE_DEPRECATED_FEATURES
     bool warn_only = false;
 #else
-    bool warn_only = true;
+    bool warn_only = !field->options().GetExtension(envoy::annotations::disallowed_by_default);
 #endif
     // Allow runtime to be null both to not crash if this is called before server initialization,
     // and so proto validation works in context where runtime singleton is not set up (e.g.
     // standalone config validation utilities)
-    if (runtime && field->options().deprecated() &&
-        !runtime->snapshot().deprecatedFeatureEnabled(
-            absl::StrCat("envoy.deprecated_features.", filename, ":", field->name()))) {
-      warn_only = false;
+    if (runtime && field->options().deprecated()) {
+      warn_only = runtime->snapshot().deprecatedFeatureEnabled(
+          absl::StrCat("envoy.deprecated_features:", field->full_name()), warn_only);
     }
 
     // If this field is deprecated, warn or throw an error.
diff --git a/source/common/runtime/runtime_features.cc b/source/common/runtime/runtime_features.cc
index 2b105c842a8b1..0f2432524e26d 100644
--- a/source/common/runtime/runtime_features.cc
+++ b/source/common/runtime/runtime_features.cc
@@ -49,40 +49,7 @@ constexpr const char* disabled_runtime_features[] = {
     "envoy.reloadable_features.http2_protocol_options.stream_error_on_invalid_http_messaging",
 };
 
-// This is a list of configuration fields which are disallowed by default in Envoy
-//
-// By default, use of proto fields marked as deprecated in their api/.../*.proto file will result
-// in a logged warning, so that Envoy users have a warning that they are using deprecated fields.
-//
-// During the Envoy release cycle, the maintainer team runs a script which will upgrade currently
-// deprecated features to be disallowed (adding them to the list below) at which point use of said
-// feature will cause a hard-failure (ProtoValidationException) instead of a logged warning.
-//
-// The release cycle after a feature has been marked disallowed, it is officially removable, and
-// the maintainer team will run a script creating a tracking issue for proto and code clean up.
-constexpr const char* disallowed_features[] = {
-    // Acts as both a test entry for deprecated.proto and a marker for the Envoy
-    // deprecation scripts.
-    "envoy.deprecated_features.deprecated.proto:is_deprecated_fatal",
-    // 1.10.0
-    "envoy.deprecated_features.config_source.proto:UNSUPPORTED_REST_LEGACY",
-    "envoy.deprecated_features.ext_authz.proto:use_alpha",
-    "envoy.deprecated_features.fault.proto:type",
-    "envoy.deprecated_features.route.proto:enabled",
-    "envoy.deprecated_features.route.proto:runtime_key",
-    // 1.11.0
-    "envoy.deprecated_features.bootstrap.proto:runtime",
-    "envoy.deprecated_features.redis_proxy.proto:catch_all_cluster",
-    "envoy.deprecated_features.redis_proxy.proto:cluster",
-    "envoy.deprecated_features.server_info.proto:max_obj_name_len",
-    "envoy.deprecated_features.server_info.proto:max_stats",
-    "envoy.deprecated_features.v1_filter_json_config",
-};
-
 RuntimeFeatures::RuntimeFeatures() {
-  for (auto& feature : disallowed_features) {
-    disallowed_features_.insert(feature);
-  }
   for (auto& feature : runtime_features) {
     enabled_features_.insert(feature);
   }
diff --git a/source/common/runtime/runtime_features.h b/source/common/runtime/runtime_features.h
index 56ffb73f4d917..e8c7b2bc48513 100644
--- a/source/common/runtime/runtime_features.h
+++ b/source/common/runtime/runtime_features.h
@@ -13,13 +13,6 @@ class RuntimeFeatures {
 public:
   RuntimeFeatures();
 
-  // This tracks proto configured features, to determine if a given deprecated
-  // feature is still allowed, or has been made fatal-by-default per the Envoy
-  // deprecation process.
-  bool disallowedByDefault(absl::string_view feature) const {
-    return disallowed_features_.find(feature) != disallowed_features_.end();
-  }
-
   // This tracks config-guarded code paths, to determine if a given
   // runtime-guarded-code-path has the new code run by default or the old code.
   bool enabledByDefault(absl::string_view feature) const {
@@ -32,7 +25,6 @@ class RuntimeFeatures {
 private:
   friend class RuntimeFeaturesPeer;
 
-  absl::flat_hash_set<std::string> disallowed_features_;
   absl::flat_hash_set<std::string> enabled_features_;
   absl::flat_hash_set<std::string> disabled_features_;
 };
diff --git a/source/common/runtime/runtime_impl.cc b/source/common/runtime/runtime_impl.cc
index da79775f19b8e..f10d053b8957d 100644
--- a/source/common/runtime/runtime_impl.cc
+++ b/source/common/runtime/runtime_impl.cc
@@ -199,12 +199,10 @@ std::string RandomGeneratorImpl::uuid() {
   return std::string(uuid, UUID_LENGTH);
 }
 
-bool SnapshotImpl::deprecatedFeatureEnabled(const std::string& key) const {
-  const bool default_allowed = !RuntimeFeaturesDefaults::get().disallowedByDefault(key);
-
-  // If the value is not explicitly set as a runtime boolean, the default value is based on
-  // disallowedByDefault.
-  if (!getBoolean(key, default_allowed)) {
+bool SnapshotImpl::deprecatedFeatureEnabled(const std::string& key, bool default_value) const {
+  // If the value is not explicitly set as a runtime boolean, trust the proto annotations passed as
+  // default_value.
+  if (!getBoolean(key, default_value)) {
     // If either disallowed by default or configured off, the feature is not enabled.
     return false;
   }
diff --git a/source/common/runtime/runtime_impl.h b/source/common/runtime/runtime_impl.h
index 8737793f120c1..3631b6e10738b 100644
--- a/source/common/runtime/runtime_impl.h
+++ b/source/common/runtime/runtime_impl.h
@@ -81,7 +81,7 @@ class SnapshotImpl : public Snapshot,
                std::vector<OverrideLayerConstPtr>&& layers);
 
   // Runtime::Snapshot
-  bool deprecatedFeatureEnabled(const std::string& key) const override;
+  bool deprecatedFeatureEnabled(const std::string& key, bool default_value) const override;
   bool runtimeFeatureEnabled(absl::string_view key) const override;
   bool featureEnabled(const std::string& key, uint64_t default_value, uint64_t random_value,
                       uint64_t num_buckets) const override;
diff --git a/test/common/protobuf/utility_test.cc b/test/common/protobuf/utility_test.cc
index 7546efd5c0b45..7e54f3d89d29c 100644
--- a/test/common/protobuf/utility_test.cc
+++ b/test/common/protobuf/utility_test.cc
@@ -791,7 +791,8 @@ TEST_P(DeprecatedFieldsTest,
 
   // Now create a new snapshot with this feature allowed.
   Runtime::LoaderSingleton::getExisting()->mergeValues(
-      {{"envoy.deprecated_features.deprecated.proto:is_deprecated_fatal", "TrUe "}});
+      {{"envoy.deprecated_features:envoy.test.deprecation_test.Base.is_deprecated_fatal",
+        "TrUe "}});
 
   // Now the same deprecation check should only trigger a warning.
   EXPECT_LOG_CONTAINS(
@@ -811,7 +812,7 @@ TEST_P(DeprecatedFieldsTest, DEPRECATED_FEATURE_TEST(DisallowViaRuntime)) {
 
   // Now create a new snapshot with this feature disallowed.
   Runtime::LoaderSingleton::getExisting()->mergeValues(
-      {{"envoy.deprecated_features.deprecated.proto:is_deprecated", " false"}});
+      {{"envoy.deprecated_features:envoy.test.deprecation_test.Base.is_deprecated", " false"}});
 
   EXPECT_THROW_WITH_REGEX(
       checkForDeprecation(base), ProtoValidationException,
@@ -919,13 +920,27 @@ TEST_P(DeprecatedFieldsTest, DEPRECATED_FEATURE_TEST(RuntimeOverrideEnumDefault)
   base.mutable_enum_container();
 
   Runtime::LoaderSingleton::getExisting()->mergeValues(
-      {{"envoy.deprecated_features.deprecated.proto:DEPRECATED_DEFAULT", "false"}});
+      {{"envoy.deprecated_features:envoy.test.deprecation_test.Base.DEPRECATED_DEFAULT", "false"}});
 
   // Make sure this is set up right.
   EXPECT_THROW_WITH_REGEX(checkForDeprecation(base), ProtoValidationException,
                           "Using the default now-deprecated value DEPRECATED_DEFAULT");
 }
 
+// Make sure the runtime overrides for allowing fatal enums work.
+TEST_P(DeprecatedFieldsTest, DEPRECATED_FEATURE_TEST(FatalEnum)) {
+  envoy::test::deprecation_test::Base base;
+  base.mutable_enum_container()->set_deprecated_enum(
+      envoy::test::deprecation_test::Base::DEPRECATED_FATAL);
+  EXPECT_THROW_WITH_REGEX(checkForDeprecation(base), ProtoValidationException,
+                          "Using deprecated value DEPRECATED_FATAL");
+
+  Runtime::LoaderSingleton::getExisting()->mergeValues(
+      {{"envoy.deprecated_features:envoy.test.deprecation_test.Base.DEPRECATED_FATAL", "true"}});
+
+  checkForDeprecation(base);
+}
+
 class TimestampUtilTest : public testing::Test, public ::testing::WithParamInterface<int64_t> {};
 
 TEST_P(TimestampUtilTest, SystemClockToTimestampTest) {
diff --git a/test/common/router/BUILD b/test/common/router/BUILD
index 35797d4442a1d..bfcf87ea89774 100644
--- a/test/common/router/BUILD
+++ b/test/common/router/BUILD
@@ -32,6 +32,7 @@ envoy_cc_test_library(
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
         "//test/test_common:registry_lib",
+        "//test/test_common:test_runtime_lib",
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/config/route/v3alpha:pkg_cc_proto",
         "@envoy_api//envoy/type/v3alpha:pkg_cc_proto",
diff --git a/test/common/router/config_impl_test.cc b/test/common/router/config_impl_test.cc
index 27597eae99639..cb1e85db809c5 100644
--- a/test/common/router/config_impl_test.cc
+++ b/test/common/router/config_impl_test.cc
@@ -25,6 +25,7 @@
 #include "test/test_common/environment.h"
 #include "test/test_common/printers.h"
 #include "test/test_common/registry.h"
+#include "test/test_common/test_runtime.h"
 #include "test/test_common/utility.h"
 
 #include "gmock/gmock.h"
@@ -2786,6 +2787,11 @@ class RouteConfigurationV2 : public testing::Test, public ConfigImplTestBase {};
 
 // When removing runtime_key: this test can be removed.
 TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RequestMirrorPolicy)) {
+  TestScopedRuntime scoped_runtime;
+  Runtime::LoaderSingleton::getExisting()->mergeValues(
+      {{"envoy.deprecated_features:envoy.config.route.v3alpha.RouteAction.RequestMirrorPolicy."
+        "hidden_envoy_deprecated_runtime_key",
+        "true"}});
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
diff --git a/test/common/runtime/runtime_impl_test.cc b/test/common/runtime/runtime_impl_test.cc
index 02482e6c7e61f..5425c058ba345 100644
--- a/test/common/runtime/runtime_impl_test.cc
+++ b/test/common/runtime/runtime_impl_test.cc
@@ -233,13 +233,8 @@ TEST_F(DiskLoaderImplTest, All) {
   EXPECT_EQ(false, snapshot->runtimeFeatureEnabled("envoy.reloadable_features.test_feature_false"));
 
   // Deprecation
-#ifdef ENVOY_DISABLE_DEPRECATED_FEATURES
-  EXPECT_EQ(false, snapshot->deprecatedFeatureEnabled("random_string_should_be_enabled"));
-#else
-  EXPECT_EQ(true, snapshot->deprecatedFeatureEnabled("random_string_should_be_enabled"));
-#endif
   EXPECT_EQ(false, snapshot->deprecatedFeatureEnabled(
-                       "envoy.deprecated_features.deprecated.proto:is_deprecated_fatal"));
+                       "envoy.deprecated_features.deprecated.proto:is_deprecated_fatal", false));
 
   // Feature defaults via helper function.
   EXPECT_EQ(false, runtimeFeatureEnabled("envoy.reloadable_features.test_feature_false"));
diff --git a/test/common/runtime/utility.h b/test/common/runtime/utility.h
index f21cc42b457f6..e442e8940e009 100644
--- a/test/common/runtime/utility.h
+++ b/test/common/runtime/utility.h
@@ -17,11 +17,6 @@ class RuntimeFeaturesPeer {
     const_cast<Runtime::RuntimeFeatures*>(&Runtime::RuntimeFeaturesDefaults::get())
         ->enabled_features_.erase(feature);
   }
-  static void setAllFeaturesAllowed() {
-    for (const std::string& feature : RuntimeFeaturesDefaults::get().disallowed_features_) {
-      Runtime::LoaderSingleton::getExisting()->mergeValues({{feature, "true"}});
-    }
-  }
 };
 
 } // namespace Runtime
diff --git a/test/config_test/config_test.cc b/test/config_test/config_test.cc
index 6563c8235046c..52d70ac6e7dcb 100644
--- a/test/config_test/config_test.cc
+++ b/test/config_test/config_test.cc
@@ -74,14 +74,9 @@ class ConfigTest {
     // in production runtime is not setup until after the bootstrap config is loaded. This seems
     // better for configuration tests.
     ScopedRuntimeInjector scoped_runtime(server_.runtime());
-    ON_CALL(server_.runtime_loader_.snapshot_, deprecatedFeatureEnabled(_))
-        .WillByDefault(Invoke([](const std::string& key) {
-          if (Runtime::RuntimeFeaturesDefaults::get().disallowedByDefault(key)) {
-            return false;
-          } else {
-            return true;
-          }
-        }));
+    ON_CALL(server_.runtime_loader_.snapshot_, deprecatedFeatureEnabled(_, _))
+        .WillByDefault(
+            Invoke([](const std::string&, bool default_value) { return default_value; }));
 
     envoy::config::bootstrap::v3alpha::Bootstrap bootstrap;
     Server::InstanceUtil::loadBootstrapConfig(
diff --git a/test/extensions/filters/network/redis_proxy/BUILD b/test/extensions/filters/network/redis_proxy/BUILD
index 97bfc8a4cba75..77c846dea3bca 100644
--- a/test/extensions/filters/network/redis_proxy/BUILD
+++ b/test/extensions/filters/network/redis_proxy/BUILD
@@ -97,6 +97,7 @@ envoy_extension_cc_test(
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/network/redis_proxy:config",
         "//test/mocks/server:server_mocks",
+        "//test/test_common:test_runtime_lib",
         "@envoy_api//envoy/extensions/filters/network/redis_proxy/v3alpha:pkg_cc_proto",
     ],
 )
diff --git a/test/extensions/filters/network/redis_proxy/config_test.cc b/test/extensions/filters/network/redis_proxy/config_test.cc
index e3c6f9eaded50..2537ca368b3fd 100644
--- a/test/extensions/filters/network/redis_proxy/config_test.cc
+++ b/test/extensions/filters/network/redis_proxy/config_test.cc
@@ -6,6 +6,7 @@
 #include "extensions/filters/network/redis_proxy/config.h"
 
 #include "test/mocks/server/mocks.h"
+#include "test/test_common/test_runtime.h"
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
@@ -69,6 +70,14 @@ settings: {}
 
 TEST(RedisProxyFilterConfigFactoryTest,
      DEPRECATED_FEATURE_TEST(RedisProxyCorrectProtoLegacyCluster)) {
+  TestScopedRuntime scoped_runtime;
+  Runtime::LoaderSingleton::getExisting()->mergeValues(
+      {{"envoy.deprecated_features:envoy.config.filter.network.redis_proxy.v2.RedisProxy.cluster",
+        "true"},
+       {"envoy.deprecated_features:envoy.extensions.filters.network.redis_proxy.v3alpha.RedisProxy."
+        "hidden_envoy_deprecated_cluster",
+        "true"}});
+
   const std::string yaml = R"EOF(
 cluster: fake_cluster
 stat_prefix: foo
@@ -89,6 +98,14 @@ stat_prefix: foo
 
 TEST(RedisProxyFilterConfigFactoryTest,
      DEPRECATED_FEATURE_TEST(RedisProxyCorrectProtoLegacyCatchAllCluster)) {
+  TestScopedRuntime scoped_runtime;
+  Runtime::LoaderSingleton::getExisting()->mergeValues(
+      {{"envoy.deprecated_features:envoy.config.filter.network.redis_proxy.v2.RedisProxy."
+        "PrefixRoutes.catch_all_cluster",
+        "true"},
+       {"envoy.deprecated_features:envoy.extensions.filters.network.redis_proxy.v3alpha.RedisProxy."
+        "PrefixRoutes.hidden_envoy_deprecated_catch_all_cluster",
+        "true"}});
   const std::string yaml = R"EOF(
 prefix_routes:
   catch_all_cluster: fake_cluster
diff --git a/test/integration/server.cc b/test/integration/server.cc
index 50554b867ab6c..f61df5eedc1c2 100644
--- a/test/integration/server.cc
+++ b/test/integration/server.cc
@@ -182,13 +182,11 @@ void IntegrationTestServer::threadRoutine(
 }
 
 void IntegrationTestServer::onRuntimeCreated() {
-  // Override runtime values to by default allow all disallowed features.
-  //
-  // Per #6288 we explicitly want to allow end to end testing of disallowed features until the code
-  // is removed from Envoy.
-  //
-  // This will revert as the runtime is torn down with the test Envoy server.
-  Runtime::RuntimeFeaturesPeer::setAllFeaturesAllowed();
+  // TODO(alyssawilk) improve this.
+  Runtime::LoaderSingleton::getExisting()->mergeValues(
+      {{"envoy.deprecated_features:envoy.config.route.v3alpha.CorsPolicy."
+        "hidden_envoy_deprecated_enabled",
+        "true"}});
 }
 
 void IntegrationTestServerImpl::createAndRunEnvoyServer(
diff --git a/test/mocks/runtime/mocks.h b/test/mocks/runtime/mocks.h
index 3ed731f903db5..82e486f6c4706 100644
--- a/test/mocks/runtime/mocks.h
+++ b/test/mocks/runtime/mocks.h
@@ -41,7 +41,7 @@ class MockSnapshot : public Snapshot {
     }
   }
 
-  MOCK_CONST_METHOD1(deprecatedFeatureEnabled, bool(const std::string& key));
+  MOCK_CONST_METHOD2(deprecatedFeatureEnabled, bool(const std::string& key, bool default_value));
   MOCK_CONST_METHOD1(runtimeFeatureEnabled, bool(absl::string_view key));
   MOCK_CONST_METHOD2(featureEnabled, bool(const std::string& key, uint64_t default_value));
   MOCK_CONST_METHOD3(featureEnabled,
diff --git a/test/proto/BUILD b/test/proto/BUILD
index d2aa8efa62491..7af0abc86c222 100644
--- a/test/proto/BUILD
+++ b/test/proto/BUILD
@@ -14,6 +14,7 @@ exports_files(["bookstore.proto"])
 envoy_proto_library(
     name = "deprecated_proto",
     srcs = [":deprecated.proto"],
+    deps = ["@envoy_api//envoy/annotations:pkg"],
 )
 
 envoy_proto_library(
diff --git a/test/proto/deprecated.proto b/test/proto/deprecated.proto
index ddc3849890a0d..8e5638b73deb0 100644
--- a/test/proto/deprecated.proto
+++ b/test/proto/deprecated.proto
@@ -2,14 +2,18 @@ syntax = "proto3";
 
 package envoy.test.deprecation_test;
 
+import "envoy/annotations/deprecation.proto";
+
 message Base {
   string not_deprecated = 1;
   string is_deprecated = 2 [deprecated = true];
-  string is_deprecated_fatal = 3 [deprecated = true];
+  string is_deprecated_fatal = 3
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
   message InnerMessage {
     string inner_not_deprecated = 1;
     string inner_deprecated = 2 [deprecated = true];
-    string inner_deprecated_fatal = 3 [deprecated = true];
+    string inner_deprecated_fatal = 3
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
   }
   InnerMessage deprecated_message = 4 [deprecated = true];
   InnerMessage not_deprecated_message = 5;
@@ -22,6 +26,7 @@ message Base {
     DEPRECATED_DEFAULT = 0 [deprecated = true];
     NOT_DEPRECATED = 1;
     DEPRECATED_NOT_DEFAULT = 2 [deprecated = true];
+    DEPRECATED_FATAL = 3 [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
   }
   message InnerMessageWithDeprecationEnum {
     DeprecationEnum deprecated_enum = 1;
diff --git a/test/server/server_fuzz_test.cc b/test/server/server_fuzz_test.cc
index c00876caad6b2..cb65c8872b352 100644
--- a/test/server/server_fuzz_test.cc
+++ b/test/server/server_fuzz_test.cc
@@ -65,13 +65,9 @@ makeHermeticPathsAndPorts(Fuzz::PerTestEnvironment& test_env,
   return output;
 }
 
-class AllFeaturesHooks : public DefaultListenerHooks {
-  void onRuntimeCreated() override { Runtime::RuntimeFeaturesPeer::setAllFeaturesAllowed(); }
-};
-
 DEFINE_PROTO_FUZZER(const envoy::config::bootstrap::v3alpha::Bootstrap& input) {
   testing::NiceMock<MockOptions> options;
-  AllFeaturesHooks hooks;
+  DefaultListenerHooks hooks;
   testing::NiceMock<MockHotRestart> restart;
   Stats::TestIsolatedStoreImpl stats_store;
   Thread::MutexBasicLockable fakelock;
diff --git a/tools/proto_sync.py b/tools/proto_sync.py
index b623eb23ef57b..58f3c6ca24d9a 100755
--- a/tools/proto_sync.py
+++ b/tools/proto_sync.py
@@ -280,7 +280,10 @@ def Sync(api_root, mode, labels, shadow):
     GenerateCurrentApiDir(api_root_path, current_api_dir)
 
     # These support files are handled manually.
-    for f in ['envoy/annotations/resource.proto', 'envoy/annotations/BUILD']:
+    for f in [
+        'envoy/annotations/resource.proto', 'envoy/annotations/deprecation.proto',
+        'envoy/annotations/BUILD'
+    ]:
       copy_dst_dir = pathlib.Path(dst_dir, os.path.dirname(f))
       copy_dst_dir.mkdir(exist_ok=True)
       shutil.copy(str(pathlib.Path(api_root, f)), str(copy_dst_dir))
diff --git a/tools/protoxform/protoxform.py b/tools/protoxform/protoxform.py
index 8ce04fcc4376e..289110e88cdce 100755
--- a/tools/protoxform/protoxform.py
+++ b/tools/protoxform/protoxform.py
@@ -33,6 +33,7 @@
 # this also serves as whitelist of extended options.
 from google.api import annotations_pb2 as _
 from validate import validate_pb2 as _
+from envoy.annotations import deprecation_pb2 as _
 from envoy.annotations import resource_pb2
 from udpa.annotations import migrate_pb2
 
@@ -207,7 +208,10 @@ def CamelCase(s):
     if idx in file_proto.public_dependency:
       public_imports.append(d)
       continue
-    elif d in ['envoy/annotations/resource.proto', 'udpa/annotations/migrate.proto']:
+    elif d in [
+        'envoy/annotations/resource.proto', 'envoy/annotations/deprecation.proto',
+        'udpa/annotations/migrate.proto'
+    ]:
       infra_imports.append(d)
     elif d.startswith('envoy/'):
       # We ignore existing envoy/ imports, since these are computed explicitly