diff --git a/envoy/admin/v2alpha/BUILD b/envoy/admin/v2alpha/BUILD
index 3ced653b..a7253df5 100644
--- a/envoy/admin/v2alpha/BUILD
+++ b/envoy/admin/v2alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/service/tap/v2alpha:pkg",
diff --git a/envoy/admin/v2alpha/server_info.proto b/envoy/admin/v2alpha/server_info.proto
index 099e2f03..1052cb62 100644
--- a/envoy/admin/v2alpha/server_info.proto
+++ b/envoy/admin/v2alpha/server_info.proto
@@ -4,6 +4,8 @@ package envoy.admin.v2alpha;
 
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v2alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
@@ -128,9 +130,10 @@ message CommandLineOptions {
   Mode mode = 19;
 
   // max_stats and max_obj_name_len are now unused and have no effect.
-  uint64 max_stats = 20 [deprecated = true];
+  uint64 max_stats = 20 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
-  uint64 max_obj_name_len = 21 [deprecated = true];
+  uint64 max_obj_name_len = 21
+      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // See :option:`--disable-hot-restart` for details.
   bool disable_hot_restart = 22;
diff --git a/envoy/admin/v3alpha/BUILD b/envoy/admin/v3alpha/BUILD
index 32469e85..b724bb8a 100644
--- a/envoy/admin/v3alpha/BUILD
+++ b/envoy/admin/v3alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     deps = [
         "//envoy/admin/v2alpha:pkg",
+        "//envoy/annotations:pkg",
         "//envoy/config/bootstrap/v3alpha:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/tap/v3alpha:pkg",
diff --git a/envoy/admin/v3alpha/server_info.proto b/envoy/admin/v3alpha/server_info.proto
index ccceb4e1..1136a411 100644
--- a/envoy/admin/v3alpha/server_info.proto
+++ b/envoy/admin/v3alpha/server_info.proto
@@ -6,6 +6,8 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
+
 option java_package = "io.envoyproxy.envoy.admin.v3alpha";
 option java_outer_classname = "ServerInfoProto";
 option java_multiple_files = true;
diff --git a/envoy/annotations/deprecation.proto b/envoy/annotations/deprecation.proto
new file mode 100644
index 00000000..813f1050
--- /dev/null
+++ b/envoy/annotations/deprecation.proto
@@ -0,0 +1,21 @@
+syntax = "proto3";
+
+package envoy.annotations;
+
+import "google/protobuf/descriptor.proto";
+
+// Allows tagging proto fields as fatal by default. One Envoy release after
+// deprecation, deprecated fields will be disallowed by default, a state which
+// is reversible with :ref:`runtime overrides <config_runtime_deprecation>`.
+
+// Magic number in this file derived from top 28bit of SHA256 digest of
+// "envoy.annotation.disallowed_by_default"
+extend google.protobuf.FieldOptions {
+  bool disallowed_by_default = 189503207;
+}
+
+// Magic number in this file derived from top 28bit of SHA256 digest of
+// "envoy.annotation.disallowed_by_default_enum"
+extend google.protobuf.EnumValueOptions {
+  bool disallowed_by_default_enum = 70100853;
+}
diff --git a/envoy/api/v2/core/BUILD b/envoy/api/v2/core/BUILD
index 283a3ea6..ca0c7c3f 100644
--- a/envoy/api/v2/core/BUILD
+++ b/envoy/api/v2/core/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/envoy/api/v2/core/config_source.proto b/envoy/api/v2/core/config_source.proto
index 5a082d8b..d5680d2e 100644
--- a/envoy/api/v2/core/config_source.proto
+++ b/envoy/api/v2/core/config_source.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/grpc_service.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -40,7 +41,8 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    UNSUPPORTED_REST_LEGACY = 0 [deprecated = true];
+    UNSUPPORTED_REST_LEGACY = 0
+        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/envoy/api/v2/route/BUILD b/envoy/api/v2/route/BUILD
index b570ccfd..b60e7c4c 100644
--- a/envoy/api/v2/route/BUILD
+++ b/envoy/api/v2/route/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
diff --git a/envoy/api/v2/route/route_components.proto b/envoy/api/v2/route/route_components.proto
index 37f5aa1d..d54a8673 100644
--- a/envoy/api/v2/route/route_components.proto
+++ b/envoy/api/v2/route/route_components.proto
@@ -14,6 +14,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -494,7 +495,8 @@ message CorsPolicy {
     //
     //   **This field is deprecated**. Set the
     //   :ref:`filter_enabled<envoy_api_field_route.CorsPolicy.filter_enabled>` field instead.
-    google.protobuf.BoolValue enabled = 7 [deprecated = true];
+    google.protobuf.BoolValue enabled = 7
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Specifies the % of requests for which the CORS filter is enabled.
     //
@@ -558,7 +560,7 @@ message RouteAction {
     //   **This field is deprecated**. Set the
     //   :ref:`runtime_fraction
     //   <envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_fraction>` field instead.
-    string runtime_key = 2 [deprecated = true];
+    string runtime_key = 2 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // If both :ref:`runtime_key
     // <envoy_api_field_route.RouteAction.RequestMirrorPolicy.runtime_key>` and this field are not
diff --git a/envoy/config/bootstrap/v2/BUILD b/envoy/config/bootstrap/v2/BUILD
index ade70954..4bdaf604 100644
--- a/envoy/config/bootstrap/v2/BUILD
+++ b/envoy/config/bootstrap/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/auth:pkg",
         "//envoy/api/v2/core:pkg",
diff --git a/envoy/config/bootstrap/v2/bootstrap.proto b/envoy/config/bootstrap/v2/bootstrap.proto
index bd33e601..cc12345e 100644
--- a/envoy/config/bootstrap/v2/bootstrap.proto
+++ b/envoy/config/bootstrap/v2/bootstrap.proto
@@ -16,6 +16,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v2";
@@ -119,7 +120,7 @@ message Bootstrap {
   // Configuration for the runtime configuration provider (deprecated). If not
   // specified, a “null” provider will be used which will result in all defaults
   // being used.
-  Runtime runtime = 11 [deprecated = true];
+  Runtime runtime = 11 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
diff --git a/envoy/config/bootstrap/v3alpha/BUILD b/envoy/config/bootstrap/v3alpha/BUILD
index 30bb6946..77e93258 100644
--- a/envoy/config/bootstrap/v3alpha/BUILD
+++ b/envoy/config/bootstrap/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/config/cluster/v3alpha:pkg",
         "//envoy/config/core/v3alpha:pkg",
diff --git a/envoy/config/bootstrap/v3alpha/bootstrap.proto b/envoy/config/bootstrap/v3alpha/bootstrap.proto
index 372dc8d7..9e3aa567 100644
--- a/envoy/config/bootstrap/v3alpha/bootstrap.proto
+++ b/envoy/config/bootstrap/v3alpha/bootstrap.proto
@@ -18,6 +18,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.bootstrap.v3alpha";
diff --git a/envoy/config/core/v3alpha/BUILD b/envoy/config/core/v3alpha/BUILD
index 6cd088f2..59a487d5 100644
--- a/envoy/config/core/v3alpha/BUILD
+++ b/envoy/config/core/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
         "//envoy/type/v3alpha:pkg",
diff --git a/envoy/config/core/v3alpha/config_source.proto b/envoy/config/core/v3alpha/config_source.proto
index 718ca6cc..8628b7d8 100644
--- a/envoy/config/core/v3alpha/config_source.proto
+++ b/envoy/config/core/v3alpha/config_source.proto
@@ -9,6 +9,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.core.v3alpha";
@@ -42,7 +43,8 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 [deprecated = true];
+    DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0
+        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/envoy/config/filter/fault/v2/BUILD b/envoy/config/filter/fault/v2/BUILD
index 3535fe17..e2a45aba 100644
--- a/envoy/config/filter/fault/v2/BUILD
+++ b/envoy/config/filter/fault/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
diff --git a/envoy/config/filter/fault/v2/fault.proto b/envoy/config/filter/fault/v2/fault.proto
index a687b358..02fb5646 100644
--- a/envoy/config/filter/fault/v2/fault.proto
+++ b/envoy/config/filter/fault/v2/fault.proto
@@ -6,6 +6,7 @@ import "envoy/type/percent.proto";
 
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -35,7 +36,7 @@ message FaultDelay {
   reserved 2;
 
   // Unused and deprecated. Will be removed in the next release.
-  FaultDelayType type = 1 [deprecated = true];
+  FaultDelayType type = 1 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   oneof fault_delay_secifier {
     option (validate.required) = true;
diff --git a/envoy/config/filter/http/ext_authz/v2/BUILD b/envoy/config/filter/http/ext_authz/v2/BUILD
index 311b712b..1eb9a92e 100644
--- a/envoy/config/filter/http/ext_authz/v2/BUILD
+++ b/envoy/config/filter/http/ext_authz/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "//envoy/type:pkg",
         "//envoy/type/matcher:pkg",
diff --git a/envoy/config/filter/http/ext_authz/v2/ext_authz.proto b/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
index 6c016d92..94a87f3d 100644
--- a/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
+++ b/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
@@ -8,6 +8,7 @@ import "envoy/api/v2/core/http_uri.proto";
 import "envoy/type/http_status.proto";
 import "envoy/type/matcher/string.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -50,7 +51,7 @@ message ExtAuthz {
   // useful when transitioning from alpha to release versions assuming that both definitions are
   // semantically compatible. Deprecation note: This field is deprecated and should only be used for
   // version upgrade. See release notes for more details.
-  bool use_alpha = 4 [deprecated = true];
+  bool use_alpha = 4 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Enables filter to buffer the client request body and send it within the authorization request.
   // A ``x-envoy-auth-partial-body: false|true`` metadata header will be added to the authorization
diff --git a/envoy/config/filter/network/redis_proxy/v2/BUILD b/envoy/config/filter/network/redis_proxy/v2/BUILD
index 69168ad0..55aaeb31 100644
--- a/envoy/config/filter/network/redis_proxy/v2/BUILD
+++ b/envoy/config/filter/network/redis_proxy/v2/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/core:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
     ],
diff --git a/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto b/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
index f78abdb0..c7d7bf7e 100644
--- a/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
+++ b/envoy/config/filter/network/redis_proxy/v2/redis_proxy.proto
@@ -7,6 +7,7 @@ import "envoy/api/v2/core/base.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "validate/validate.proto";
 
@@ -162,7 +163,8 @@ message RedisProxy {
     //   This field is deprecated. Use a :ref:`catch_all
     //   route<envoy_api_field_config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.catch_all_route>`
     //   instead.
-    string catch_all_cluster = 3 [deprecated = true];
+    string catch_all_cluster = 3
+        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
     // Optional catch-all route to forward commands that doesn't match any of the routes. The
     // catch-all route becomes required when no routes are specified.
@@ -181,7 +183,7 @@ message RedisProxy {
   //   This field is deprecated. Use a :ref:`catch_all
   //   route<envoy_api_field_config.filter.network.redis_proxy.v2.RedisProxy.PrefixRoutes.catch_all_route>`
   //   instead.
-  string cluster = 2 [deprecated = true];
+  string cluster = 2 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
 
   // Network settings for the connection pool to the upstream clusters.
   ConnPoolSettings settings = 3 [(validate.rules).message = {required: true}];
diff --git a/envoy/config/route/v3alpha/BUILD b/envoy/config/route/v3alpha/BUILD
index 8b724d7e..ffdcc0e3 100644
--- a/envoy/config/route/v3alpha/BUILD
+++ b/envoy/config/route/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/route:pkg",
         "//envoy/config/core/v3alpha:pkg",
diff --git a/envoy/config/route/v3alpha/route_components.proto b/envoy/config/route/v3alpha/route_components.proto
index 56d5cf77..c9f12329 100644
--- a/envoy/config/route/v3alpha/route_components.proto
+++ b/envoy/config/route/v3alpha/route_components.proto
@@ -16,6 +16,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.config.route.v3alpha";
diff --git a/envoy/extensions/filters/common/fault/v3alpha/BUILD b/envoy/extensions/filters/common/fault/v3alpha/BUILD
index 57f3af3b..26a3a595 100644
--- a/envoy/extensions/filters/common/fault/v3alpha/BUILD
+++ b/envoy/extensions/filters/common/fault/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/filter/fault/v2:pkg",
         "//envoy/type/v3alpha:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/envoy/extensions/filters/common/fault/v3alpha/fault.proto b/envoy/extensions/filters/common/fault/v3alpha/fault.proto
index f556de47..bdedd6d4 100644
--- a/envoy/extensions/filters/common/fault/v3alpha/fault.proto
+++ b/envoy/extensions/filters/common/fault/v3alpha/fault.proto
@@ -8,6 +8,7 @@ import "google/protobuf/duration.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.common.fault.v3alpha";
diff --git a/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD b/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
index c1165f39..d2cfecf0 100644
--- a/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
+++ b/envoy/extensions/filters/http/ext_authz/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/filter/http/ext_authz/v2:pkg",
         "//envoy/type/matcher/v3alpha:pkg",
diff --git a/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto b/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
index d4367e5d..ce9e764b 100644
--- a/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
+++ b/envoy/extensions/filters/http/ext_authz/v3alpha/ext_authz.proto
@@ -10,6 +10,7 @@ import "envoy/type/v3alpha/http_status.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.http.ext_authz.v3alpha";
diff --git a/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD b/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
index 66299959..73bce7c7 100644
--- a/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
+++ b/envoy/extensions/filters/network/redis_proxy/v3alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3alpha:pkg",
         "//envoy/config/filter/network/redis_proxy/v2:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto b/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
index fbce339c..9b60aacc 100644
--- a/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
+++ b/envoy/extensions/filters/network/redis_proxy/v3alpha/redis_proxy.proto
@@ -9,6 +9,7 @@ import "google/protobuf/wrappers.proto";
 
 import "udpa/annotations/versioning.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "validate/validate.proto";
 
 option java_package = "io.envoyproxy.envoy.extensions.filters.network.redis_proxy.v3alpha";