diff --git a/hack/helm_vars/wire-server/values.yaml.gotmpl b/hack/helm_vars/wire-server/values.yaml.gotmpl
index 6b508ae6310..6c30de324f3 100644
--- a/hack/helm_vars/wire-server/values.yaml.gotmpl
+++ b/hack/helm_vars/wire-server/values.yaml.gotmpl
@@ -245,6 +245,14 @@ galley:
               usersThreshold: 100
               clientsThreshold: 50
             lockStatus: locked
+        mlsE2EId:
+          defaults:
+            status: disabled
+            config:
+              verificationExpiration: 86400
+              acmeDiscoveryUrl: null
+              crlProxy: https://crlproxy.example.com
+            lockStatus: unlocked
         limitedEventFanout:
             defaults:
             status: disabled
diff --git a/integration/test/Test/FeatureFlags.hs b/integration/test/Test/FeatureFlags.hs
index c9a171545b3..1b0e288f882 100644
--- a/integration/test/Test/FeatureFlags.hs
+++ b/integration/test/Test/FeatureFlags.hs
@@ -112,7 +112,11 @@ testMlsE2EConfigCrlProxyNotRequiredInV5 = do
     resp.status `shouldMatchInt` 200
 
   -- Assert that the feature config got updated correctly
-  expectedResponse <- configWithoutCrlProxy & setField "lockStatus" "unlocked" & setField "ttl" "unlimited"
+  expectedResponse <-
+    configWithoutCrlProxy
+      & setField "lockStatus" "unlocked"
+      & setField "ttl" "unlimited"
+      & setField "config.crlProxy" "https://crlproxy.example.com"
   checkFeature "mlsE2EId" owner tid expectedResponse
 
 testSSODisabledByDefault :: HasCallStack => App ()
@@ -346,7 +350,8 @@ testAllFeatures = do
                   "config"
                     .= object
                       [ "verificationExpiration" .= A.Number 86400,
-                        "useProxyOnMobile" .= False
+                        "useProxyOnMobile" .= False,
+                        "crlProxy" .= "https://crlproxy.example.com"
                       ]
                 ],
             "mlsMigration"
@@ -631,7 +636,8 @@ mlsE2EIdConfig = do
           "config"
             .= object
               [ "verificationExpiration" .= A.Number 86400,
-                "useProxyOnMobile" .= False
+                "useProxyOnMobile" .= False,
+                "crlProxy" .= "https://crlproxy.example.com"
               ]
         ]
     mlsE2EIdConfig1 :: Value
@@ -913,7 +919,8 @@ testPatchE2EId = do
             "config"
               .= object
                 [ "verificationExpiration" .= A.Number 86400,
-                  "useProxyOnMobile" .= False
+                  "useProxyOnMobile" .= False,
+                  "crlProxy" .= "https://crlproxy.example.com"
                 ]
           ]
   _testPatch "mlsE2EId" True defCfg (object ["lockStatus" .= "locked"])
diff --git a/services/galley/galley.integration.yaml b/services/galley/galley.integration.yaml
index e7094e4238d..02a8b72388a 100644
--- a/services/galley/galley.integration.yaml
+++ b/services/galley/galley.integration.yaml
@@ -90,6 +90,7 @@ settings:
         config:
           verificationExpiration: 86400
           acmeDiscoveryUrl: null
+          crlProxy: https://crlproxy.example.com
         lockStatus: unlocked
     mlsMigration:
       defaults:
diff --git a/services/galley/src/Galley/Cassandra/GetAllTeamFeatureConfigs.hs b/services/galley/src/Galley/Cassandra/GetAllTeamFeatureConfigs.hs
index 9543527abef..f501f8ad2bd 100644
--- a/services/galley/src/Galley/Cassandra/GetAllTeamFeatureConfigs.hs
+++ b/services/galley/src/Galley/Cassandra/GetAllTeamFeatureConfigs.hs
@@ -372,8 +372,8 @@ instance MakeFeature MlsE2EIdConfig where
             defCfg
               { verificationExpiration =
                   maybe defCfg.verificationExpiration fromIntegral gracePeriod,
-                acmeDiscoveryUrl = acmeDiscoveryUrl,
-                crlProxy = crlProxy,
+                acmeDiscoveryUrl = acmeDiscoveryUrl <|> defCfg.acmeDiscoveryUrl,
+                crlProxy = crlProxy <|> defCfg.crlProxy,
                 useProxyOnMobile = fromMaybe defCfg.useProxyOnMobile useProxyOnMobile
               }
         )