diff --git a/envoy/config/filter/http/cache/v2alpha/cache.proto b/envoy/config/filter/http/cache/v2alpha/cache.proto
index d08b5462..98035c05 100644
--- a/envoy/config/filter/http/cache/v2alpha/cache.proto
+++ b/envoy/config/filter/http/cache/v2alpha/cache.proto
@@ -48,17 +48,14 @@ message CacheConfig {
   // Config specific to the cache storage implementation.
   google.protobuf.Any typed_config = 1 [(validate.rules).any = {required: true}];
 
-  // [#not-implemented-hide:]
-  // <TODO(toddmgreer) implement *vary* headers>
-  //
-  // List of allowed *Vary* headers.
+  // List of matching rules that defines allowed *Vary* headers.
   //
   // The *vary* response header holds a list of header names that affect the
   // contents of a response, as described by
   // https://httpwg.org/specs/rfc7234.html#caching.negotiated.responses.
   //
   // During insertion, *allowed_vary_headers* acts as a allowlist: if a
-  // response's *vary* header mentions any header names that aren't in
+  // response's *vary* header mentions any header names that aren't matched by any rules in
   // *allowed_vary_headers*, that response will not be cached.
   //
   // During lookup, *allowed_vary_headers* controls what request headers will be
diff --git a/envoy/extensions/filters/http/cache/v3alpha/cache.proto b/envoy/extensions/filters/http/cache/v3alpha/cache.proto
index f78b1d24..9260abe9 100644
--- a/envoy/extensions/filters/http/cache/v3alpha/cache.proto
+++ b/envoy/extensions/filters/http/cache/v3alpha/cache.proto
@@ -52,17 +52,14 @@ message CacheConfig {
   // Config specific to the cache storage implementation.
   google.protobuf.Any typed_config = 1 [(validate.rules).any = {required: true}];
 
-  // [#not-implemented-hide:]
-  // <TODO(toddmgreer) implement *vary* headers>
-  //
-  // List of allowed *Vary* headers.
+  // List of matching rules that defines allowed *Vary* headers.
   //
   // The *vary* response header holds a list of header names that affect the
   // contents of a response, as described by
   // https://httpwg.org/specs/rfc7234.html#caching.negotiated.responses.
   //
   // During insertion, *allowed_vary_headers* acts as a allowlist: if a
-  // response's *vary* header mentions any header names that aren't in
+  // response's *vary* header mentions any header names that aren't matched by any rules in
   // *allowed_vary_headers*, that response will not be cached.
   //
   // During lookup, *allowed_vary_headers* controls what request headers will be
diff --git a/envoy/extensions/filters/http/cache/v4alpha/cache.proto b/envoy/extensions/filters/http/cache/v4alpha/cache.proto
index 19921edb..ad9bb4c6 100644
--- a/envoy/extensions/filters/http/cache/v4alpha/cache.proto
+++ b/envoy/extensions/filters/http/cache/v4alpha/cache.proto
@@ -52,17 +52,14 @@ message CacheConfig {
   // Config specific to the cache storage implementation.
   google.protobuf.Any typed_config = 1 [(validate.rules).any = {required: true}];
 
-  // [#not-implemented-hide:]
-  // <TODO(toddmgreer) implement *vary* headers>
-  //
-  // List of allowed *Vary* headers.
+  // List of matching rules that defines allowed *Vary* headers.
   //
   // The *vary* response header holds a list of header names that affect the
   // contents of a response, as described by
   // https://httpwg.org/specs/rfc7234.html#caching.negotiated.responses.
   //
   // During insertion, *allowed_vary_headers* acts as a allowlist: if a
-  // response's *vary* header mentions any header names that aren't in
+  // response's *vary* header mentions any header names that aren't matched by any rules in
   // *allowed_vary_headers*, that response will not be cached.
   //
   // During lookup, *allowed_vary_headers* controls what request headers will be