diff --git a/internal/mesh/internal/controllers/sidecarproxy/builder/destination_builder.go b/internal/mesh/internal/controllers/sidecarproxy/builder/destination_builder.go
index dc22bd6316a..b683620667b 100644
--- a/internal/mesh/internal/controllers/sidecarproxy/builder/destination_builder.go
+++ b/internal/mesh/internal/controllers/sidecarproxy/builder/destination_builder.go
@@ -241,7 +241,7 @@ func (b *Builder) buildDestination(
 
 		rb := lb.addL7Router("", effectiveProtocol)
 		if destination.Explicit == nil {
-			rb.addIPMatch(destination.VirtualIPs)
+			rb.addIPAndPortMatch(destination.VirtualIPs, virtualPortNumber)
 		}
 		rb.buildRouter()
 	} else {
diff --git a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-multiple-implicit-destinations-tproxy.golden b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-multiple-implicit-destinations-tproxy.golden
index d2d81556854..d082eb568c3 100644
--- a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-multiple-implicit-destinations-tproxy.golden
+++ b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-multiple-implicit-destinations-tproxy.golden
@@ -223,14 +223,12 @@
             }
           },
           {
-            "l4": {
-              "cluster": {
-                "name": "tcp2.api-app.default.dc1.internal.foo.consul"
-              },
-              "statPrefix": "upstream.tcp2.api-app.default.default.dc1"
+            "l7": {
+              "name": "outbound_listener",
+              "statPrefix": "upstream."
             },
             "match": {
-              "destinationPort": 8081,
+              "destinationPort": 8080,
               "prefixRanges": [
                 {
                   "addressPrefix": "1.1.1.1",
@@ -240,14 +238,12 @@
             }
           },
           {
-            "l4": {
-              "cluster": {
-                "name": "tcp2.api-app2.default.dc1.internal.foo.consul"
-              },
-              "statPrefix": "upstream.tcp2.api-app2.default.default.dc1"
+            "l7": {
+              "name": "outbound_listener",
+              "statPrefix": "upstream."
             },
             "match": {
-              "destinationPort": 8081,
+              "destinationPort": 8080,
               "prefixRanges": [
                 {
                   "addressPrefix": "2.2.2.2",
@@ -261,11 +257,14 @@
             }
           },
           {
-            "l7": {
-              "name": "outbound_listener",
-              "statPrefix": "upstream."
+            "l4": {
+              "cluster": {
+                "name": "tcp2.api-app.default.dc1.internal.foo.consul"
+              },
+              "statPrefix": "upstream.tcp2.api-app.default.default.dc1"
             },
             "match": {
+              "destinationPort": 8081,
               "prefixRanges": [
                 {
                   "addressPrefix": "1.1.1.1",
@@ -275,11 +274,14 @@
             }
           },
           {
-            "l7": {
-              "name": "outbound_listener",
-              "statPrefix": "upstream."
+            "l4": {
+              "cluster": {
+                "name": "tcp2.api-app2.default.dc1.internal.foo.consul"
+              },
+              "statPrefix": "upstream.tcp2.api-app2.default.default.dc1"
             },
             "match": {
+              "destinationPort": 8081,
               "prefixRanges": [
                 {
                   "addressPrefix": "2.2.2.2",
diff --git a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-tproxy.golden b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-tproxy.golden
index 9a7a326d145..fe01e993240 100644
--- a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-tproxy.golden
+++ b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-tproxy.golden
@@ -121,14 +121,12 @@
             }
           },
           {
-            "l4": {
-              "cluster": {
-                "name": "tcp2.api-app.default.dc1.internal.foo.consul"
-              },
-              "statPrefix": "upstream.tcp2.api-app.default.default.dc1"
+            "l7": {
+              "name": "outbound_listener",
+              "statPrefix": "upstream."
             },
             "match": {
-              "destinationPort": 8081,
+              "destinationPort": 8080,
               "prefixRanges": [
                 {
                   "addressPrefix": "1.1.1.1",
@@ -138,11 +136,14 @@
             }
           },
           {
-            "l7": {
-              "name": "outbound_listener",
-              "statPrefix": "upstream."
+            "l4": {
+              "cluster": {
+                "name": "tcp2.api-app.default.dc1.internal.foo.consul"
+              },
+              "statPrefix": "upstream.tcp2.api-app.default.default.dc1"
             },
             "match": {
+              "destinationPort": 8081,
               "prefixRanges": [
                 {
                   "addressPrefix": "1.1.1.1",
diff --git a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-with-multiple-workloads-tproxy.golden b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-with-multiple-workloads-tproxy.golden
index 9a7a326d145..fe01e993240 100644
--- a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-with-multiple-workloads-tproxy.golden
+++ b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/destination/multiport-l4-single-implicit-destination-with-multiple-workloads-tproxy.golden
@@ -121,14 +121,12 @@
             }
           },
           {
-            "l4": {
-              "cluster": {
-                "name": "tcp2.api-app.default.dc1.internal.foo.consul"
-              },
-              "statPrefix": "upstream.tcp2.api-app.default.default.dc1"
+            "l7": {
+              "name": "outbound_listener",
+              "statPrefix": "upstream."
             },
             "match": {
-              "destinationPort": 8081,
+              "destinationPort": 8080,
               "prefixRanges": [
                 {
                   "addressPrefix": "1.1.1.1",
@@ -138,11 +136,14 @@
             }
           },
           {
-            "l7": {
-              "name": "outbound_listener",
-              "statPrefix": "upstream."
+            "l4": {
+              "cluster": {
+                "name": "tcp2.api-app.default.dc1.internal.foo.consul"
+              },
+              "statPrefix": "upstream.tcp2.api-app.default.default.dc1"
             },
             "match": {
+              "destinationPort": 8081,
               "prefixRanges": [
                 {
                   "addressPrefix": "1.1.1.1",