diff --git a/internal/catalog/internal/controllers/endpoints/controller.go b/internal/catalog/internal/controllers/endpoints/controller.go
index 843130fb4a1..5a2f8c7d42c 100644
--- a/internal/catalog/internal/controllers/endpoints/controller.go
+++ b/internal/catalog/internal/controllers/endpoints/controller.go
@@ -311,8 +311,13 @@ func workloadToEndpoint(svc *pbcatalog.Service, data *workloadData) *pbcatalog.E
 			continue
 		}
 
-		if workloadPort.Protocol != svcPort.Protocol {
-			// workload port mismatch - ignore it
+		// If workload protocol is not specified, we will default to service's protocol.
+		// This is because on some platforms (kubernetes), workload protocol is not always
+		// known, and so we need to inherit from the service instead.
+		if workloadPort.Protocol == pbcatalog.Protocol_PROTOCOL_UNSPECIFIED {
+			workloadPort.Protocol = svcPort.Protocol
+		} else if workloadPort.Protocol != svcPort.Protocol {
+			// Otherwise, there's workload port mismatch - ignore it.
 			continue
 		}
 
diff --git a/internal/catalog/internal/controllers/endpoints/controller_test.go b/internal/catalog/internal/controllers/endpoints/controller_test.go
index bc82874d3b3..4ea84191d1d 100644
--- a/internal/catalog/internal/controllers/endpoints/controller_test.go
+++ b/internal/catalog/internal/controllers/endpoints/controller_test.go
@@ -185,6 +185,51 @@ func TestWorkloadToEndpoint_AllAddressesFiltered(t *testing.T) {
 	require.Nil(t, workloadToEndpoint(service, data))
 }
 
+func TestWorkloadToEndpoint_MissingWorkloadProtocol(t *testing.T) {
+	// This test checks that when a workload is missing its protocol,
+	// we will default to service's protocol.
+
+	service := &pbcatalog.Service{
+		Ports: []*pbcatalog.ServicePort{
+			{TargetPort: "test-port", Protocol: pbcatalog.Protocol_PROTOCOL_HTTP},
+		},
+	}
+
+	workload := &pbcatalog.Workload{
+		Addresses: []*pbcatalog.WorkloadAddress{
+			{Host: "127.0.0.1"},
+		},
+		Ports: map[string]*pbcatalog.WorkloadPort{
+			"test-port": {Port: 8080},
+		},
+	}
+
+	data := &workloadData{
+		resource: rtest.Resource(types.WorkloadType, "foo").
+			WithData(t, workload).
+			Build(),
+		workload: workload,
+	}
+
+	expected := &pbcatalog.Endpoint{
+		TargetRef: data.resource.Id,
+		Addresses: []*pbcatalog.WorkloadAddress{
+			{Host: "127.0.0.1", Ports: []string{"test-port"}},
+		},
+		Ports: map[string]*pbcatalog.WorkloadPort{
+			"test-port": {Port: 8080, Protocol: pbcatalog.Protocol_PROTOCOL_HTTP},
+		},
+		// The health is critical because we are not setting the workload's
+		// health status. The tests for determineWorkloadHealth will ensure
+		// that we can properly determine the health status and the overall
+		// controller tests will prove that the integration works as expected.
+		HealthStatus: pbcatalog.Health_HEALTH_CRITICAL,
+		Identity:     workload.Identity,
+	}
+
+	prototest.AssertDeepEqual(t, expected, workloadToEndpoint(service, data))
+}
+
 func TestServiceUnderManagement(t *testing.T) {
 	// This test ensures that we can properly detect when a service
 	// should have endpoints generated for it vs when those endpoints