diff --git a/prow/cluster/jobs/istio/common-files/istio.common-files.master.gen.yaml b/prow/cluster/jobs/istio/common-files/istio.common-files.master.gen.yaml
index 27204ea43b7..dcee7bf7361 100644
--- a/prow/cluster/jobs/istio/common-files/istio.common-files.master.gen.yaml
+++ b/prow/cluster/jobs/istio/common-files/istio.common-files.master.gen.yaml
@@ -118,7 +118,7 @@ postsubmits:
       - command:
         - ../test-infra/tools/automator/automator.sh
         - --org=istio
-        - --repo=istio,api,tools,release-builder,pkg,client-go,proxy
+        - --repo=istio,api,tools,release-builder,pkg,client-go,proxy,ztunnel
         - '--title=Automator: update common-files@$AUTOMATOR_SRC_BRANCH in $AUTOMATOR_ORG/$AUTOMATOR_REPO@$AUTOMATOR_BRANCH'
         - --labels=auto-merge,release-notes-none
         - --strict
diff --git a/prow/cluster/jobs/istio/ztunnel/istio.ztunnel.master.gen.yaml b/prow/cluster/jobs/istio/ztunnel/istio.ztunnel.master.gen.yaml
new file mode 100644
index 00000000000..ef8a771de06
--- /dev/null
+++ b/prow/cluster/jobs/istio/ztunnel/istio.ztunnel.master.gen.yaml
@@ -0,0 +1,86 @@
+# THIS FILE IS AUTOGENERATED. See prow/config/README.md
+postsubmits:
+  istio/ztunnel:
+  - annotations:
+      testgrid-alert-email: istio-oncall@googlegroups.com
+      testgrid-dashboards: istio_ztunnel_postsubmit
+      testgrid-num-failures-to-alert: "1"
+    branches:
+    - ^master$
+    decorate: true
+    name: test_ztunnel_postsubmit
+    path_alias: istio.io/ztunnel
+    spec:
+      containers:
+      - command:
+        - make
+        - presubmit
+        env:
+        - name: BUILD_WITH_CONTAINER
+          value: "0"
+        image: gcr.io/istio-testing/build-tools:master-370c3316bcb3444f0c07806ff731edd0e8fc2041
+        name: ""
+        resources:
+          limits:
+            cpu: "3"
+            memory: 24Gi
+          requests:
+            cpu: "1"
+            memory: 3Gi
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /home/prow/go/pkg
+          name: build-cache
+          subPath: gomod
+      nodeSelector:
+        kubernetes.io/arch: amd64
+        testing: test-pool
+      volumes:
+      - hostPath:
+          path: /var/tmp/prow/cache
+          type: DirectoryOrCreate
+        name: build-cache
+presubmits:
+  istio/ztunnel:
+  - always_run: true
+    annotations:
+      testgrid-dashboards: istio_ztunnel
+    branches:
+    - ^master$
+    decorate: true
+    name: test_ztunnel
+    path_alias: istio.io/ztunnel
+    rerun_command: /test test
+    spec:
+      containers:
+      - command:
+        - make
+        - presubmit
+        env:
+        - name: BUILD_WITH_CONTAINER
+          value: "0"
+        image: gcr.io/istio-testing/build-tools:master-370c3316bcb3444f0c07806ff731edd0e8fc2041
+        name: ""
+        resources:
+          limits:
+            cpu: "3"
+            memory: 24Gi
+          requests:
+            cpu: "1"
+            memory: 3Gi
+        securityContext:
+          privileged: true
+        volumeMounts:
+        - mountPath: /home/prow/go/pkg
+          name: build-cache
+          subPath: gomod
+      nodeSelector:
+        kubernetes.io/arch: amd64
+        testing: test-pool
+      volumes:
+      - hostPath:
+          path: /var/tmp/prow/cache
+          type: DirectoryOrCreate
+        name: build-cache
+    trigger: ((?m)^/test( | .* )test,?($|\s.*))|((?m)^/test( | .* )test_ztunnel,?($|\s.*))
diff --git a/prow/config.yaml b/prow/config.yaml
index ba91cbc0b63..8b8fe8438d7 100644
--- a/prow/config.yaml
+++ b/prow/config.yaml
@@ -280,6 +280,8 @@ branch-protection:
           branches: *blocked_branches
         release-builder:
           branches: *blocked_branches
+        ztunnel:
+          branches: *blocked_branches
         istio:
           branches:
             <<: *blocked_branches
@@ -399,6 +401,7 @@ tide:
     - istio/cri
     - istio/client-go
     - istio/release-builder
+    - istio/ztunnel
     missingLabels: &istio_tide_missing_labels
     - do-not-merge
     - do-not-merge/hold
@@ -421,6 +424,7 @@ tide:
     - istio/cri
     - istio/client-go
     - istio/release-builder
+    - istio/ztunnel
     labels:
     - auto-merge
     missingLabels: *istio_tide_missing_labels
diff --git a/prow/config/jobs/common-files.yaml b/prow/config/jobs/common-files.yaml
index 7ae315aa4ea..b1c3b6ee4e5 100644
--- a/prow/config/jobs/common-files.yaml
+++ b/prow/config/jobs/common-files.yaml
@@ -28,7 +28,7 @@ jobs:
     command:
     - ../test-infra/tools/automator/automator.sh
     - --org=istio
-    - --repo=istio,api,tools,release-builder,pkg,client-go,proxy
+    - --repo=istio,api,tools,release-builder,pkg,client-go,proxy,ztunnel
     - "--title=Automator: update common-files@$AUTOMATOR_SRC_BRANCH in $AUTOMATOR_ORG/$AUTOMATOR_REPO@$AUTOMATOR_BRANCH"
     - --labels=auto-merge,release-notes-none
     - --strict
diff --git a/prow/config/jobs/ztunnel.yaml b/prow/config/jobs/ztunnel.yaml
new file mode 100644
index 00000000000..a8facc9bcd7
--- /dev/null
+++ b/prow/config/jobs/ztunnel.yaml
@@ -0,0 +1,7 @@
+org: istio
+repo: ztunnel
+image: gcr.io/istio-testing/build-tools:master-370c3316bcb3444f0c07806ff731edd0e8fc2041
+
+jobs:
+  - name: test
+    command: [make, presubmit]
diff --git a/testgrid/config.yaml b/testgrid/config.yaml
index 4d767aed150..b660c216200 100644
--- a/testgrid/config.yaml
+++ b/testgrid/config.yaml
@@ -27,6 +27,8 @@ dashboards:
 - name: istio_proxy
 - name: istio_proxy_periodic
 - name: istio_proxy_postsubmit
+- name: istio_ztunnel
+- name: istio_ztunnel_postsubmit
 - name: istio_release-builder_periodic
 - name: istio_release-1.16_istio
 - name: istio_release-1.16_api
@@ -295,6 +297,7 @@ dashboard_groups:
   - istio_bots_postsubmit
   - istio_client-go_postsubmit
   - istio_cri_postsubmit
+  - istio_ztunnel_postsubmit
   - istio_common-files_postsubmit
   - istio_community_postsubmit
   - istio_istio.io_postsubmit
@@ -307,6 +310,7 @@ dashboard_groups:
   - istio_bots
   - istio_client-go
   - istio_cri
+  - istio_ztunnel
   - istio_common-files
   - istio_community
   - istio_envoy