diff --git a/envoy/config/listener/v3/listener_components.proto b/envoy/config/listener/v3/listener_components.proto
index 88e75e65..8a22fbc9 100644
--- a/envoy/config/listener/v3/listener_components.proto
+++ b/envoy/config/listener/v3/listener_components.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v3/base.proto";
 import "envoy/type/v3/range.proto";
 
 import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -167,10 +168,25 @@ message FilterChainMatch {
 
 // A filter chain wraps a set of match criteria, an option TLS context, a set of filters, and
 // various other parameters.
-// [#next-free-field: 8]
+// [#next-free-field: 9]
 message FilterChain {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.listener.FilterChain";
 
+  // The configuration for on-demand filter chain. If this field is not empty in FilterChain message,
+  // a filter chain will be built on-demand.
+  // On-demand filter chains help speedup the warming up of listeners since the building and initialization of
+  // an on-demand filter chain will be postponed to the arrival of new connection requests that require this filter chain.
+  // Filter chains that are not often used can be set as on-demand.
+  message OnDemandConfiguration {
+    // The timeout to wait for filter chain placeholders to complete rebuilding.
+    // 1. If this field is set to 0, timeout is disabled.
+    // 2. If not specified, a default timeout of 15s is used.
+    // Rebuilding will wait until dependencies are ready, have failed, or this timeout is reached.
+    // Upon failure or timeout, all connections related to this filter chain will be closed.
+    // Rebuilding will start again on the next new connection.
+    google.protobuf.Duration rebuild_timeout = 1;
+  }
+
   reserved 2;
 
   reserved "tls_context";
@@ -206,6 +222,11 @@ message FilterChain {
   // name is provided, Envoy will allocate an internal UUID for the filter chain. If the filter
   // chain is to be dynamically updated or removed via FCDS a unique name must be provided.
   string name = 7;
+
+  // [#not-implemented-hide:] The configuration to specify whether the filter chain will be built on-demand.
+  // If this field is not empty, the filter chain will be built on-demand.
+  // Otherwise, the filter chain will be built normally and block listener warming.
+  OnDemandConfiguration on_demand_configuration = 8;
 }
 
 // Listener filter chain match configuration. This is a recursive structure which allows complex
diff --git a/envoy/config/listener/v4alpha/listener_components.proto b/envoy/config/listener/v4alpha/listener_components.proto
index 6900cde3..61babe8e 100644
--- a/envoy/config/listener/v4alpha/listener_components.proto
+++ b/envoy/config/listener/v4alpha/listener_components.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v4alpha/base.proto";
 import "envoy/type/v3/range.proto";
 
 import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
@@ -167,11 +168,29 @@ message FilterChainMatch {
 
 // A filter chain wraps a set of match criteria, an option TLS context, a set of filters, and
 // various other parameters.
-// [#next-free-field: 8]
+// [#next-free-field: 9]
 message FilterChain {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.config.listener.v3.FilterChain";
 
+  // The configuration for on-demand filter chain. If this field is not empty in FilterChain message,
+  // a filter chain will be built on-demand.
+  // On-demand filter chains help speedup the warming up of listeners since the building and initialization of
+  // an on-demand filter chain will be postponed to the arrival of new connection requests that require this filter chain.
+  // Filter chains that are not often used can be set as on-demand.
+  message OnDemandConfiguration {
+    option (udpa.annotations.versioning).previous_message_type =
+        "envoy.config.listener.v3.FilterChain.OnDemandConfiguration";
+
+    // The timeout to wait for filter chain placeholders to complete rebuilding.
+    // 1. If this field is set to 0, timeout is disabled.
+    // 2. If not specified, a default timeout of 15s is used.
+    // Rebuilding will wait until dependencies are ready, have failed, or this timeout is reached.
+    // Upon failure or timeout, all connections related to this filter chain will be closed.
+    // Rebuilding will start again on the next new connection.
+    google.protobuf.Duration rebuild_timeout = 1;
+  }
+
   reserved 2;
 
   reserved "tls_context";
@@ -207,6 +226,11 @@ message FilterChain {
   // name is provided, Envoy will allocate an internal UUID for the filter chain. If the filter
   // chain is to be dynamically updated or removed via FCDS a unique name must be provided.
   string name = 7;
+
+  // [#not-implemented-hide:] The configuration to specify whether the filter chain will be built on-demand.
+  // If this field is not empty, the filter chain will be built on-demand.
+  // Otherwise, the filter chain will be built normally and block listener warming.
+  OnDemandConfiguration on_demand_configuration = 8;
 }
 
 // Listener filter chain match configuration. This is a recursive structure which allows complex