diff --git a/envoy/config/filter/http/ext_authz/v2/BUILD b/envoy/config/filter/http/ext_authz/v2/BUILD
index a22408bb..b1d02437 100644
--- a/envoy/config/filter/http/ext_authz/v2/BUILD
+++ b/envoy/config/filter/http/ext_authz/v2/BUILD
@@ -9,6 +9,7 @@ api_proto_library_internal(
         "//envoy/api/v2/core:base",
         "//envoy/api/v2/core:grpc_service",
         "//envoy/api/v2/core:http_uri",
+        "//envoy/type:http_status",
         "//envoy/type/matcher:string",
     ],
 )
diff --git a/envoy/config/filter/http/ext_authz/v2/ext_authz.proto b/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
index 4c9b4d9c..8e2ea766 100644
--- a/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
+++ b/envoy/config/filter/http/ext_authz/v2/ext_authz.proto
@@ -11,6 +11,7 @@ import "envoy/api/v2/core/base.proto";
 import "envoy/api/v2/core/grpc_service.proto";
 import "envoy/api/v2/core/http_uri.proto";
 
+import "envoy/type/http_status.proto";
 import "envoy/type/matcher/string.proto";
 
 import "validate/validate.proto";
@@ -67,6 +68,10 @@ message ExtAuthz {
   // altering another client request header.
   //
   bool clear_route_cache = 6;
+
+  // Sets the HTTP status that is returned to the client when there is a network error between the
+  // filter and the authorization server. The default status is HTTP 403 Forbidden.
+  envoy.type.HttpStatus status_on_error = 7;
 }
 
 // Configuration for buffering the request data.