diff --git a/envoy/extensions/filters/network/client_ssl_auth/v3/client_ssl_auth.proto b/envoy/extensions/filters/network/client_ssl_auth/v3/client_ssl_auth.proto
index 29cd0493..b3af267a 100644
--- a/envoy/extensions/filters/network/client_ssl_auth/v3/client_ssl_auth.proto
+++ b/envoy/extensions/filters/network/client_ssl_auth/v3/client_ssl_auth.proto
@@ -29,7 +29,8 @@ message ClientSSLAuth {
   // the authentication service. The filter will connect to the service every 60s to fetch the list
   // of principals. The service must support the expected :ref:`REST API
   // <config_network_filters_client_ssl_auth_rest_api>`.
-  string auth_api_cluster = 1 [(validate.rules).string = {min_bytes: 1}];
+  string auth_api_cluster = 1
+      [(validate.rules).string = {min_bytes: 1 well_known_regex: HTTP_HEADER_VALUE strict: false}];
 
   // The prefix to use when emitting :ref:`statistics
   // <config_network_filters_client_ssl_auth_stats>`.