diff --git a/api/envoy/annotations/deprecation.proto b/api/envoy/annotations/deprecation.proto
index 7f9b64e32b09..ce02ab98a8dc 100644
--- a/api/envoy/annotations/deprecation.proto
+++ b/api/envoy/annotations/deprecation.proto
@@ -5,18 +5,29 @@ package envoy.annotations;
 import "google/protobuf/descriptor.proto";
 
 // [#protodoc-title: Deprecation]
-// Allows tagging proto fields as fatal by default. One Envoy release after
-// deprecation, deprecated fields will be disallowed by default, a state which
-// is reversible with :ref:`runtime overrides <config_runtime_deprecation>`.
+// Adds annotations for deprecated fields and enums to allow tagging proto
+// fields as fatal by default and the minor version on which the field was
+// deprecated. One Envoy release after deprecation, deprecated fields will be
+// disallowed by default, a state which is reversible with
+// :ref:`runtime overrides <config_runtime_deprecation>`.
 
 // Magic number in this file derived from top 28bit of SHA256 digest of
-// "envoy.annotation.disallowed_by_default"
+// "envoy.annotation.disallowed_by_default" and "envoy.annotation.deprecated_at_minor_version"
 extend google.protobuf.FieldOptions {
   bool disallowed_by_default = 189503207;
+
+  // The API major and minor version on which the field was deprecated
+  // (e.g., "3.5" for major version 3 and minor version 5).
+  string deprecated_at_minor_version = 157299826;
 }
 
 // Magic number in this file derived from top 28bit of SHA256 digest of
-// "envoy.annotation.disallowed_by_default_enum"
+// "envoy.annotation.disallowed_by_default_enum" and
+// "envoy.annotation.deprecated_at_minor_version_eum"
 extend google.protobuf.EnumValueOptions {
   bool disallowed_by_default_enum = 70100853;
+
+  // The API major and minor version on which the enum value was deprecated
+  // (e.g., "3.5" for major version 3 and minor version 5).
+  string deprecated_at_minor_version_enum = 181198657;
 }
diff --git a/api/envoy/config/bootstrap/v3/BUILD b/api/envoy/config/bootstrap/v3/BUILD
index aaaf9eb7575f..48e8fb522c99 100644
--- a/api/envoy/config/bootstrap/v3/BUILD
+++ b/api/envoy/config/bootstrap/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/bootstrap/v2:pkg",
         "//envoy/config/cluster/v3:pkg",
diff --git a/api/envoy/config/bootstrap/v3/bootstrap.proto b/api/envoy/config/bootstrap/v3/bootstrap.proto
index b54828dfb2e2..19784ab2a351 100644
--- a/api/envoy/config/bootstrap/v3/bootstrap.proto
+++ b/api/envoy/config/bootstrap/v3/bootstrap.proto
@@ -21,6 +21,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
@@ -187,7 +188,8 @@ message Bootstrap {
   // Optional watchdog configuration.
   // This is for a single watchdog configuration for the entire system.
   // Deprecated in favor of *watchdogs* which has finer granularity.
-  Watchdog watchdog = 8 [deprecated = true];
+  Watchdog watchdog = 8
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional watchdogs configuration.
   // This is used for specifying different watchdogs for the different subsystems.
@@ -199,7 +201,8 @@ message Bootstrap {
   // .. attention::
   //  This field has been deprecated in favor of :ref:`HttpConnectionManager.Tracing.provider
   //  <envoy_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider>`.
-  trace.v3.Tracing tracing = 9 [deprecated = true];
+  trace.v3.Tracing tracing = 9
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
@@ -308,7 +311,8 @@ message Admin {
   // access log is desired specify ‘/dev/null’. This is only required if
   // :ref:`address <envoy_api_field_config.bootstrap.v3.Admin.address>` is set.
   // Deprecated in favor of *access_log* which offers more options.
-  string access_log_path = 1 [deprecated = true];
+  string access_log_path = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The cpu profiler output path for the administration server. If no profile
   // path is specified, the default is ‘/var/log/envoy/envoy.prof’.
diff --git a/api/envoy/config/cluster/v3/BUILD b/api/envoy/config/cluster/v3/BUILD
index d2e9c8c55c48..92530e0fa197 100644
--- a/api/envoy/config/cluster/v3/BUILD
+++ b/api/envoy/config/cluster/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/cluster:pkg",
         "//envoy/config/core/v3:pkg",
diff --git a/api/envoy/config/cluster/v3/cluster.proto b/api/envoy/config/cluster/v3/cluster.proto
index efc08ae0700a..bd441dea49a0 100644
--- a/api/envoy/config/cluster/v3/cluster.proto
+++ b/api/envoy/config/cluster/v3/cluster.proto
@@ -21,6 +21,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/collection_entry.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
@@ -758,7 +759,8 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.UpstreamHttpProtocolOptions upstream_http_protocol_options = 46 [deprecated = true];
+  core.v3.UpstreamHttpProtocolOptions upstream_http_protocol_options = 46
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Additional options when handling HTTP requests upstream. These options will be applicable to
   // both HTTP1 and HTTP2 requests.
@@ -770,7 +772,8 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.HttpProtocolOptions common_http_protocol_options = 29 [deprecated = true];
+  core.v3.HttpProtocolOptions common_http_protocol_options = 29
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Additional options when handling HTTP1 requests.
   // This has been deprecated in favor of http_protocol_options fields in the in the
@@ -780,7 +783,8 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.Http1ProtocolOptions http_protocol_options = 13 [deprecated = true];
+  core.v3.Http1ProtocolOptions http_protocol_options = 13
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Even if default HTTP2 protocol options are desired, this field must be
   // set so that Envoy will assume that the upstream supports HTTP/2 when
@@ -795,8 +799,11 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.Http2ProtocolOptions http2_protocol_options = 14
-      [deprecated = true, (udpa.annotations.security).configure_for_untrusted_upstream = true];
+  core.v3.Http2ProtocolOptions http2_protocol_options = 14 [
+    deprecated = true,
+    (udpa.annotations.security).configure_for_untrusted_upstream = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0"
+  ];
 
   // The extension_protocol_options field is used to provide extension-specific protocol options
   // for upstream connections. The key should match the extension filter name, such as
@@ -932,7 +939,8 @@ message Cluster {
   // <envoy_api_msg_extensions.upstreams.http.v3.HttpProtocolOptions>` message.
   // http_protocol_options can be set via the cluster's
   // :ref:`extension_protocol_options<envoy_api_field_config.cluster.v3.Cluster.typed_extension_protocol_options>`.
-  ClusterProtocolSelection protocol_selection = 26 [deprecated = true];
+  ClusterProtocolSelection protocol_selection = 26
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional options for upstream connections.
   UpstreamConnectionOptions upstream_connection_options = 30;
@@ -993,7 +1001,8 @@ message Cluster {
   //
   //   This field has been deprecated in favor of `timeout_budgets`, part of
   //   :ref:`track_cluster_stats <envoy_api_field_config.cluster.v3.Cluster.track_cluster_stats>`.
-  bool track_timeout_budgets = 47 [deprecated = true];
+  bool track_timeout_budgets = 47
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional customization and configuration of upstream connection pool, and upstream type.
   //
diff --git a/api/envoy/config/core/v3/base.proto b/api/envoy/config/core/v3/base.proto
index 6d51212fe804..f5e677caf959 100644
--- a/api/envoy/config/core/v3/base.proto
+++ b/api/envoy/config/core/v3/base.proto
@@ -14,6 +14,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/context_params.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -204,7 +205,8 @@ message Node {
   // for filtering :ref:`listeners <config_listeners>` to be returned. For example,
   // if there is a listener bound to port 80, the list can optionally contain the
   // SocketAddress `(0.0.0.0,80)`. The field is optional and just a hint.
-  repeated Address listening_addresses = 11 [deprecated = true];
+  repeated Address listening_addresses = 11
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // Metadata provides additional inputs to filters based on matched listeners,
diff --git a/api/envoy/config/core/v3/config_source.proto b/api/envoy/config/core/v3/config_source.proto
index 9de03625dce2..c83e9125c701 100644
--- a/api/envoy/config/core/v3/config_source.proto
+++ b/api/envoy/config/core/v3/config_source.proto
@@ -27,10 +27,10 @@ enum ApiVersion {
   // When not specified, we assume v2, to ease migration to Envoy's stable API
   // versioning. If a client does not support v2 (e.g. due to deprecation), this
   // is an invalid value.
-  AUTO = 0 [deprecated = true];
+  AUTO = 0 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v2 API.
-  V2 = 1 [deprecated = true];
+  V2 = 1 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v3 API.
   V3 = 2;
diff --git a/api/envoy/config/core/v3/protocol.proto b/api/envoy/config/core/v3/protocol.proto
index ac2a4907b2ef..a666d9a762f6 100644
--- a/api/envoy/config/core/v3/protocol.proto
+++ b/api/envoy/config/core/v3/protocol.proto
@@ -8,6 +8,7 @@ import "envoy/type/v3/percent.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -361,7 +362,8 @@ message Http2ProtocolOptions {
   // <envoy_v3_api_field_config.core.v3.Http2ProtocolOptions.override_stream_error_on_invalid_http_message>`
   //
   // See `RFC7540, sec. 8.1 <https://tools.ietf.org/html/rfc7540#section-8.1>`_ for details.
-  bool stream_error_on_invalid_http_messaging = 12 [deprecated = true];
+  bool stream_error_on_invalid_http_messaging = 12
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Allows invalid HTTP messaging and headers. When this option is disabled (default), then
   // the whole HTTP/2 connection is terminated upon receiving invalid HEADERS frame. However,
diff --git a/api/envoy/config/core/v3/substitution_format_string.proto b/api/envoy/config/core/v3/substitution_format_string.proto
index 5d9c5b2ecd04..85eeabe66219 100644
--- a/api/envoy/config/core/v3/substitution_format_string.proto
+++ b/api/envoy/config/core/v3/substitution_format_string.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v3/extension.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "validate/validate.proto";
 
@@ -41,7 +42,8 @@ message SubstitutionFormatString {
     //   upstream connect error:503:path=/foo
     //
     // Deprecated in favor of :ref:`text_format_source <envoy_v3_api_field_config.core.v3.SubstitutionFormatString.text_format_source>`. To migrate text format strings, use the :ref:`inline_string <envoy_v3_api_field_config.core.v3.DataSource.inline_string>` field.
-    string text_format = 1 [deprecated = true];
+    string text_format = 1
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Specify a format with command operators to form a JSON string.
     // Its details is described in :ref:`format dictionary<config_access_log_format_dictionaries>`.
diff --git a/api/envoy/config/core/v4alpha/config_source.proto b/api/envoy/config/core/v4alpha/config_source.proto
index 121a20e6ed85..3f761c7e6930 100644
--- a/api/envoy/config/core/v4alpha/config_source.proto
+++ b/api/envoy/config/core/v4alpha/config_source.proto
@@ -31,7 +31,8 @@ enum ApiVersion {
   // When not specified, we assume v2, to ease migration to Envoy's stable API
   // versioning. If a client does not support v2 (e.g. due to deprecation), this
   // is an invalid value.
-  DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 [deprecated = true];
+  DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v3 API.
   V3 = 2;
diff --git a/api/envoy/config/listener/v3/BUILD b/api/envoy/config/listener/v3/BUILD
index 31cd086745a8..bea12662c0d7 100644
--- a/api/envoy/config/listener/v3/BUILD
+++ b/api/envoy/config/listener/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/listener:pkg",
         "//envoy/config/accesslog/v3:pkg",
diff --git a/api/envoy/config/listener/v3/listener.proto b/api/envoy/config/listener/v3/listener.proto
index 390bc89850a4..fe2b5b77151b 100644
--- a/api/envoy/config/listener/v3/listener.proto
+++ b/api/envoy/config/listener/v3/listener.proto
@@ -15,6 +15,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/collection_entry.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -133,7 +134,8 @@ message Listener {
   core.v3.Metadata metadata = 6;
 
   // [#not-implemented-hide:]
-  DeprecatedV1 deprecated_v1 = 7 [deprecated = true];
+  DeprecatedV1 deprecated_v1 = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The type of draining to perform at a listener-wide level.
   DrainType drain_type = 8;
diff --git a/api/envoy/config/listener/v3/listener_components.proto b/api/envoy/config/listener/v3/listener_components.proto
index dc9332cf87a7..55ffcd6490ec 100644
--- a/api/envoy/config/listener/v3/listener_components.proto
+++ b/api/envoy/config/listener/v3/listener_components.proto
@@ -11,6 +11,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -230,7 +231,8 @@ message FilterChain {
   // This field is deprecated. Add a
   // :ref:`PROXY protocol listener filter <config_listener_filters_proxy_protocol>`
   // explicitly instead.
-  google.protobuf.BoolValue use_proxy_proto = 4 [deprecated = true];
+  google.protobuf.BoolValue use_proxy_proto = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // [#not-implemented-hide:] filter chain metadata.
   core.v3.Metadata metadata = 5;
diff --git a/api/envoy/config/rbac/v3/BUILD b/api/envoy/config/rbac/v3/BUILD
index 06aa27115658..bf5d6038a261 100644
--- a/api/envoy/config/rbac/v3/BUILD
+++ b/api/envoy/config/rbac/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/rbac/v2:pkg",
         "//envoy/config/route/v3:pkg",
diff --git a/api/envoy/config/rbac/v3/rbac.proto b/api/envoy/config/rbac/v3/rbac.proto
index 65884a919fc6..11fc66ee0c16 100644
--- a/api/envoy/config/rbac/v3/rbac.proto
+++ b/api/envoy/config/rbac/v3/rbac.proto
@@ -11,6 +11,7 @@ import "envoy/type/matcher/v3/string.proto";
 import "google/api/expr/v1alpha1/checked.proto";
 import "google/api/expr/v1alpha1/syntax.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -259,7 +260,8 @@ message Principal {
 
     // A CIDR block that describes the downstream IP.
     // This address will honor proxy protocol, but will not honor XFF.
-    core.v3.CidrRange source_ip = 5 [deprecated = true];
+    core.v3.CidrRange source_ip = 5
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // A CIDR block that describes the downstream remote/origin address.
     // Note: This is always the physical peer even if the
diff --git a/api/envoy/config/route/v3/route_components.proto b/api/envoy/config/route/v3/route_components.proto
index 9c83bee9ca95..e5946adafb19 100644
--- a/api/envoy/config/route/v3/route_components.proto
+++ b/api/envoy/config/route/v3/route_components.proto
@@ -1022,7 +1022,8 @@ message RouteAction {
   // request.
   //
   // This field is deprecated. Please use :ref:`vh_rate_limits <envoy_v3_api_field_extensions.filters.http.ratelimit.v3.RateLimitPerRoute.vh_rate_limits>`
-  google.protobuf.BoolValue include_vh_rate_limits = 14 [deprecated = true];
+  google.protobuf.BoolValue include_vh_rate_limits = 14
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Specifies a list of hash policies to use for ring hash load balancing. Each
   // hash policy is evaluated individually and the combined result is used to
@@ -1061,7 +1062,8 @@ message RouteAction {
   //    :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`,
   //    :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the
   //    :ref:`retry overview <arch_overview_http_routing_retry>`.
-  google.protobuf.Duration max_grpc_timeout = 23 [deprecated = true];
+  google.protobuf.Duration max_grpc_timeout = 23
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Deprecated by :ref:`grpc_timeout_header_offset <envoy_api_field_config.route.v3.RouteAction.MaxStreamDuration.grpc_timeout_header_offset>`.
   // If present, Envoy will adjust the timeout provided by the `grpc-timeout` header by subtracting
@@ -1071,7 +1073,8 @@ message RouteAction {
   // The offset will only be applied if the provided grpc_timeout is greater than the offset. This
   // ensures that the offset will only ever decrease the timeout and never set it to 0 (meaning
   // infinity).
-  google.protobuf.Duration grpc_timeout_offset = 28 [deprecated = true];
+  google.protobuf.Duration grpc_timeout_offset = 28
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   repeated UpgradeConfig upgrade_configs = 25;
 
@@ -1081,7 +1084,8 @@ message RouteAction {
   // <envoy_api_field_config.route.v3.InternalRedirectPolicy.redirect_response_codes>`.
   InternalRedirectPolicy internal_redirect_policy = 34;
 
-  InternalRedirectAction internal_redirect_action = 26 [deprecated = true];
+  InternalRedirectAction internal_redirect_action = 26
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // An internal redirect is handled, iff the number of previous internal redirects that a
   // downstream request has encountered is lower than this value, and
@@ -1097,7 +1101,8 @@ message RouteAction {
   // will pass the redirect back to downstream.
   //
   // If not specified, at most one redirect will be followed.
-  google.protobuf.UInt32Value max_internal_redirects = 31 [deprecated = true];
+  google.protobuf.UInt32Value max_internal_redirects = 31
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Indicates that the route has a hedge policy. Note that if this is set,
   // it'll take precedence over the virtual host level hedge policy entirely
@@ -1751,8 +1756,11 @@ message RateLimit {
       //
       // .. attention::
       //   This field has been deprecated in favor of the :ref:`metadata <envoy_api_field_config.route.v3.RateLimit.Action.metadata>` field
-      DynamicMetaData dynamic_metadata = 7
-          [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+      DynamicMetaData dynamic_metadata = 7 [
+        deprecated = true,
+        (envoy.annotations.deprecated_at_minor_version) = "3.0",
+        (envoy.annotations.disallowed_by_default) = true
+      ];
 
       // Rate limit on metadata.
       MetaData metadata = 8;
diff --git a/api/envoy/config/route/v4alpha/BUILD b/api/envoy/config/route/v4alpha/BUILD
index 569a1a438e07..89fa4149b879 100644
--- a/api/envoy/config/route/v4alpha/BUILD
+++ b/api/envoy/config/route/v4alpha/BUILD
@@ -6,7 +6,6 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
-        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/route/v3:pkg",
         "//envoy/type/matcher/v4alpha:pkg",
diff --git a/api/envoy/config/route/v4alpha/route_components.proto b/api/envoy/config/route/v4alpha/route_components.proto
index 034820fcdc63..c70494a82efe 100644
--- a/api/envoy/config/route/v4alpha/route_components.proto
+++ b/api/envoy/config/route/v4alpha/route_components.proto
@@ -16,7 +16,6 @@ import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
-import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
diff --git a/api/envoy/config/tap/v3/BUILD b/api/envoy/config/tap/v3/BUILD
index 243e51df1d70..416ccc0f9403 100644
--- a/api/envoy/config/tap/v3/BUILD
+++ b/api/envoy/config/tap/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/common/matcher/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/route/v3:pkg",
diff --git a/api/envoy/config/tap/v3/common.proto b/api/envoy/config/tap/v3/common.proto
index a8324a6ebc1a..42189d2aa425 100644
--- a/api/envoy/config/tap/v3/common.proto
+++ b/api/envoy/config/tap/v3/common.proto
@@ -9,6 +9,7 @@ import "envoy/config/route/v3/route_components.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -32,7 +33,8 @@ message TapConfig {
   // Exactly one of :ref:`match <envoy_api_field_config.tap.v3.TapConfig.match>` and
   // :ref:`match_config <envoy_api_field_config.tap.v3.TapConfig.match_config>` must be set. If both
   // are set, the :ref:`match <envoy_api_field_config.tap.v3.TapConfig.match>` will be used.
-  MatchPredicate match_config = 1 [deprecated = true];
+  MatchPredicate match_config = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The match configuration. If the configuration matches the data source being tapped, a tap will
   // occur, with the result written to the configured output.
diff --git a/api/envoy/config/trace/v3/opencensus.proto b/api/envoy/config/trace/v3/opencensus.proto
index 6ffce02392f6..ee2241e729a8 100644
--- a/api/envoy/config/trace/v3/opencensus.proto
+++ b/api/envoy/config/trace/v3/opencensus.proto
@@ -6,6 +6,7 @@ import "envoy/config/core/v3/grpc_service.proto";
 
 import "opencensus/proto/trace/v1/trace_config.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -73,12 +74,14 @@ message OpenCensusConfig {
   // Enables the Zipkin exporter if set to true. The url and service name must
   // also be set. This is deprecated, prefer to use Envoy's :ref:`native Zipkin
   // tracer <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  bool zipkin_exporter_enabled = 5 [deprecated = true];
+  bool zipkin_exporter_enabled = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The URL to Zipkin, e.g. "http://127.0.0.1:9411/api/v2/spans". This is
   // deprecated, prefer to use Envoy's :ref:`native Zipkin tracer
   // <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  string zipkin_url = 6 [deprecated = true];
+  string zipkin_url = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Enables the OpenCensus Agent exporter if set to true. The ocagent_address or
   // ocagent_grpc_service must also be set.
diff --git a/api/envoy/extensions/access_loggers/file/v3/BUILD b/api/envoy/extensions/access_loggers/file/v3/BUILD
index 627b855a467e..20cbee8b9463 100644
--- a/api/envoy/extensions/access_loggers/file/v3/BUILD
+++ b/api/envoy/extensions/access_loggers/file/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v2:pkg",
         "//envoy/config/core/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/api/envoy/extensions/access_loggers/file/v3/file.proto b/api/envoy/extensions/access_loggers/file/v3/file.proto
index f17a2e7f4ca9..d44a658276a5 100644
--- a/api/envoy/extensions/access_loggers/file/v3/file.proto
+++ b/api/envoy/extensions/access_loggers/file/v3/file.proto
@@ -6,6 +6,7 @@ import "envoy/config/core/v3/substitution_format_string.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -35,13 +36,14 @@ message FileAccessLog {
     // :ref:`default format <config_access_log_default_format>`.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    string format = 2 [deprecated = true];
+    string format = 2 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Access log :ref:`format dictionary<config_access_log_format_dictionaries>`. All values
     // are rendered as strings.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    google.protobuf.Struct json_format = 3 [deprecated = true];
+    google.protobuf.Struct json_format = 3
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Access log :ref:`format dictionary<config_access_log_format_dictionaries>`. Values are
     // rendered as strings, numbers, or boolean values as appropriate. Nested JSON objects may
@@ -49,7 +51,8 @@ message FileAccessLog {
     // documentation for a specific command operator for details.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    google.protobuf.Struct typed_json_format = 4 [deprecated = true];
+    google.protobuf.Struct typed_json_format = 4
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Configuration to form access log data and format.
     // If not specified, use :ref:`default format <config_access_log_default_format>`.
diff --git a/api/envoy/extensions/filters/http/compressor/v3/BUILD b/api/envoy/extensions/filters/http/compressor/v3/BUILD
index f78b65b76163..cf5fc2a635de 100644
--- a/api/envoy/extensions/filters/http/compressor/v3/BUILD
+++ b/api/envoy/extensions/filters/http/compressor/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/filter/http/compressor/v2:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/api/envoy/extensions/filters/http/compressor/v3/compressor.proto b/api/envoy/extensions/filters/http/compressor/v3/compressor.proto
index ed347cc439eb..1c08706b055c 100644
--- a/api/envoy/extensions/filters/http/compressor/v3/compressor.proto
+++ b/api/envoy/extensions/filters/http/compressor/v3/compressor.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v3/extension.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -66,18 +67,21 @@ message Compressor {
   }
 
   // Minimum response length, in bytes, which will trigger compression. The default value is 30.
-  google.protobuf.UInt32Value content_length = 1 [deprecated = true];
+  google.protobuf.UInt32Value content_length = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Set of strings that allows specifying which mime-types yield compression; e.g.,
   // application/json, text/html, etc. When this field is not defined, compression will be applied
   // to the following mime-types: "application/javascript", "application/json",
   // "application/xhtml+xml", "image/svg+xml", "text/css", "text/html", "text/plain", "text/xml"
   // and their synonyms.
-  repeated string content_type = 2 [deprecated = true];
+  repeated string content_type = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // If true, disables compression when the response contains an etag header. When it is false, the
   // filter will preserve weak etags and remove the ones that require strong validation.
-  bool disable_on_etag_header = 3 [deprecated = true];
+  bool disable_on_etag_header = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // If true, removes accept-encoding from the request headers before dispatching it to the upstream
   // so that responses do not get compressed before reaching the filter.
@@ -86,11 +90,13 @@ message Compressor {
   //
   //    To avoid interfering with other compression filters in the same chain use this option in
   //    the filter closest to the upstream.
-  bool remove_accept_encoding_header = 4 [deprecated = true];
+  bool remove_accept_encoding_header = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Runtime flag that controls whether the filter is enabled or not. If set to false, the
   // filter will operate as a pass-through filter. If not specified, defaults to enabled.
-  config.core.v3.RuntimeFeatureFlag runtime_enabled = 5 [deprecated = true];
+  config.core.v3.RuntimeFeatureFlag runtime_enabled = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // A compressor library to use for compression. Currently only
   // :ref:`envoy.compression.gzip.compressor<envoy_api_msg_extensions.compression.gzip.compressor.v3.Gzip>`
diff --git a/api/envoy/service/auth/v3/BUILD b/api/envoy/service/auth/v3/BUILD
index b965364ab176..0774dda23e42 100644
--- a/api/envoy/service/auth/v3/BUILD
+++ b/api/envoy/service/auth/v3/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/service/auth/v2:pkg",
         "//envoy/type/v3:pkg",
diff --git a/api/envoy/service/auth/v3/external_auth.proto b/api/envoy/service/auth/v3/external_auth.proto
index 4860be38c4b7..b627fcb31475 100644
--- a/api/envoy/service/auth/v3/external_auth.proto
+++ b/api/envoy/service/auth/v3/external_auth.proto
@@ -9,6 +9,7 @@ import "envoy/type/v3/http_status.proto";
 import "google/protobuf/struct.proto";
 import "google/rpc/status.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -95,7 +96,8 @@ message OkHttpResponse {
   // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`. Until it is removed,
   // setting this field overrides :ref:`CheckResponse.dynamic_metadata
   // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`.
-  google.protobuf.Struct dynamic_metadata = 3 [deprecated = true];
+  google.protobuf.Struct dynamic_metadata = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // This field allows the authorization service to send HTTP response headers
   // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>`
diff --git a/api/envoy/service/health/v3/BUILD b/api/envoy/service/health/v3/BUILD
index e3e214b25d3f..30ba155208b5 100644
--- a/api/envoy/service/health/v3/BUILD
+++ b/api/envoy/service/health/v3/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/cluster/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/endpoint/v3:pkg",
diff --git a/api/envoy/service/health/v3/hds.proto b/api/envoy/service/health/v3/hds.proto
index dc6168ecffb2..b8c231d062a7 100644
--- a/api/envoy/service/health/v3/hds.proto
+++ b/api/envoy/service/health/v3/hds.proto
@@ -10,6 +10,7 @@ import "envoy/config/endpoint/v3/endpoint_components.proto";
 import "google/api/annotations.proto";
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -129,7 +130,8 @@ message EndpointHealthResponse {
       "envoy.service.discovery.v2.EndpointHealthResponse";
 
   // Deprecated - Flat list of endpoint health information.
-  repeated EndpointHealth endpoints_health = 1 [deprecated = true];
+  repeated EndpointHealth endpoints_health = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Organize Endpoint health information by cluster.
   repeated ClusterEndpointsHealth cluster_endpoints_health = 2;
diff --git a/api/envoy/service/status/v3/BUILD b/api/envoy/service/status/v3/BUILD
index 57db4bd70ce3..a73963967ef7 100644
--- a/api/envoy/service/status/v3/BUILD
+++ b/api/envoy/service/status/v3/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     has_services = True,
     deps = [
         "//envoy/admin/v3:pkg",
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/service/status/v2:pkg",
         "//envoy/type/matcher/v3:pkg",
diff --git a/api/envoy/service/status/v3/csds.proto b/api/envoy/service/status/v3/csds.proto
index d442748c4727..3a1c748fc81b 100644
--- a/api/envoy/service/status/v3/csds.proto
+++ b/api/envoy/service/status/v3/csds.proto
@@ -8,6 +8,7 @@ import "envoy/type/matcher/v3/node.proto";
 
 import "google/api/annotations.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -102,7 +103,8 @@ message PerXdsConfig {
   //   This field is deprecated. Use :ref:`ClientResourceStatus
   //   <envoy_v3_api_enum_admin.v3.ClientResourceStatus>` for per-resource
   //   config status instead.
-  ClientConfigStatus client_status = 7 [deprecated = true];
+  ClientConfigStatus client_status = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   oneof per_xds_config {
     admin.v3.ListenersConfigDump listener_config = 2;
diff --git a/api/envoy/type/matcher/v3/BUILD b/api/envoy/type/matcher/v3/BUILD
index 478959713c86..a117fd27e4ff 100644
--- a/api/envoy/type/matcher/v3/BUILD
+++ b/api/envoy/type/matcher/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type/matcher:pkg",
         "//envoy/type/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/api/envoy/type/matcher/v3/regex.proto b/api/envoy/type/matcher/v3/regex.proto
index f5913c460c46..3e7bb477ecbf 100644
--- a/api/envoy/type/matcher/v3/regex.proto
+++ b/api/envoy/type/matcher/v3/regex.proto
@@ -4,6 +4,7 @@ package envoy.type.matcher.v3;
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -43,7 +44,8 @@ message RegexMatcher {
     //
     // This field is deprecated; regexp validation should be performed on the management server
     // instead of being done by each individual client.
-    google.protobuf.UInt32Value max_program_size = 1 [deprecated = true];
+    google.protobuf.UInt32Value max_program_size = 1
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   oneof engine_type {
diff --git a/generated_api_shadow/envoy/admin/v3/server_info.proto b/generated_api_shadow/envoy/admin/v3/server_info.proto
index 7257453bc725..917afc06eb0e 100644
--- a/generated_api_shadow/envoy/admin/v3/server_info.proto
+++ b/generated_api_shadow/envoy/admin/v3/server_info.proto
@@ -192,9 +192,15 @@ message CommandLineOptions {
   // See :option:`--enable-core-dump` for details.
   bool enable_core_dump = 37;
 
-  uint64 hidden_envoy_deprecated_max_stats = 20
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
-
-  uint64 hidden_envoy_deprecated_max_obj_name_len = 21
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  uint64 hidden_envoy_deprecated_max_stats = 20 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
+
+  uint64 hidden_envoy_deprecated_max_obj_name_len = 21 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
diff --git a/generated_api_shadow/envoy/annotations/deprecation.proto b/generated_api_shadow/envoy/annotations/deprecation.proto
index 813f1050bdeb..ce02ab98a8dc 100644
--- a/generated_api_shadow/envoy/annotations/deprecation.proto
+++ b/generated_api_shadow/envoy/annotations/deprecation.proto
@@ -4,18 +4,30 @@ package envoy.annotations;
 
 import "google/protobuf/descriptor.proto";
 
-// Allows tagging proto fields as fatal by default. One Envoy release after
-// deprecation, deprecated fields will be disallowed by default, a state which
-// is reversible with :ref:`runtime overrides <config_runtime_deprecation>`.
+// [#protodoc-title: Deprecation]
+// Adds annotations for deprecated fields and enums to allow tagging proto
+// fields as fatal by default and the minor version on which the field was
+// deprecated. One Envoy release after deprecation, deprecated fields will be
+// disallowed by default, a state which is reversible with
+// :ref:`runtime overrides <config_runtime_deprecation>`.
 
 // Magic number in this file derived from top 28bit of SHA256 digest of
-// "envoy.annotation.disallowed_by_default"
+// "envoy.annotation.disallowed_by_default" and "envoy.annotation.deprecated_at_minor_version"
 extend google.protobuf.FieldOptions {
   bool disallowed_by_default = 189503207;
+
+  // The API major and minor version on which the field was deprecated
+  // (e.g., "3.5" for major version 3 and minor version 5).
+  string deprecated_at_minor_version = 157299826;
 }
 
 // Magic number in this file derived from top 28bit of SHA256 digest of
-// "envoy.annotation.disallowed_by_default_enum"
+// "envoy.annotation.disallowed_by_default_enum" and
+// "envoy.annotation.deprecated_at_minor_version_eum"
 extend google.protobuf.EnumValueOptions {
   bool disallowed_by_default_enum = 70100853;
+
+  // The API major and minor version on which the enum value was deprecated
+  // (e.g., "3.5" for major version 3 and minor version 5).
+  string deprecated_at_minor_version_enum = 181198657;
 }
diff --git a/generated_api_shadow/envoy/config/accesslog/v3/BUILD b/generated_api_shadow/envoy/config/accesslog/v3/BUILD
index 27f7828529fd..af60e4e1966f 100644
--- a/generated_api_shadow/envoy/config/accesslog/v3/BUILD
+++ b/generated_api_shadow/envoy/config/accesslog/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/filter/accesslog/v2:pkg",
         "//envoy/config/route/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/accesslog/v3/accesslog.proto b/generated_api_shadow/envoy/config/accesslog/v3/accesslog.proto
index d331e6eb1b54..0c53fe5d8245 100644
--- a/generated_api_shadow/envoy/config/accesslog/v3/accesslog.proto
+++ b/generated_api_shadow/envoy/config/accesslog/v3/accesslog.proto
@@ -11,6 +11,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -39,7 +40,8 @@ message AccessLog {
   oneof config_type {
     google.protobuf.Any typed_config = 4;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 3 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 3
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
@@ -318,6 +320,7 @@ message ExtensionFilter {
   oneof config_type {
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
diff --git a/generated_api_shadow/envoy/config/bootstrap/v3/bootstrap.proto b/generated_api_shadow/envoy/config/bootstrap/v3/bootstrap.proto
index 0270944a93a5..100ca31aa16c 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v3/bootstrap.proto
+++ b/generated_api_shadow/envoy/config/bootstrap/v3/bootstrap.proto
@@ -186,7 +186,8 @@ message Bootstrap {
   // Optional watchdog configuration.
   // This is for a single watchdog configuration for the entire system.
   // Deprecated in favor of *watchdogs* which has finer granularity.
-  Watchdog watchdog = 8 [deprecated = true];
+  Watchdog watchdog = 8
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional watchdogs configuration.
   // This is used for specifying different watchdogs for the different subsystems.
@@ -198,7 +199,8 @@ message Bootstrap {
   // .. attention::
   //  This field has been deprecated in favor of :ref:`HttpConnectionManager.Tracing.provider
   //  <envoy_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.Tracing.provider>`.
-  trace.v3.Tracing tracing = 9 [deprecated = true];
+  trace.v3.Tracing tracing = 9
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
@@ -292,8 +294,11 @@ message Bootstrap {
   // [#not-implemented-hide:]
   map<string, core.v3.TypedExtensionConfig> certificate_provider_instances = 25;
 
-  Runtime hidden_envoy_deprecated_runtime = 11
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  Runtime hidden_envoy_deprecated_runtime = 11 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // Administration interface :ref:`operations documentation
@@ -310,7 +315,8 @@ message Admin {
   // access log is desired specify ‘/dev/null’. This is only required if
   // :ref:`address <envoy_api_field_config.bootstrap.v3.Admin.address>` is set.
   // Deprecated in favor of *access_log* which offers more options.
-  string access_log_path = 1 [deprecated = true];
+  string access_log_path = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The cpu profiler output path for the administration server. If no profile
   // path is specified, the default is ‘/var/log/envoy/envoy.prof’.
diff --git a/generated_api_shadow/envoy/config/bootstrap/v4alpha/BUILD b/generated_api_shadow/envoy/config/bootstrap/v4alpha/BUILD
index 6d1ebdc39392..b1604d76d220 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/config/bootstrap/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v4alpha:pkg",
         "//envoy/config/bootstrap/v3:pkg",
         "//envoy/config/cluster/v4alpha:pkg",
diff --git a/generated_api_shadow/envoy/config/bootstrap/v4alpha/bootstrap.proto b/generated_api_shadow/envoy/config/bootstrap/v4alpha/bootstrap.proto
index e32f723ec18c..232e3135c4f0 100644
--- a/generated_api_shadow/envoy/config/bootstrap/v4alpha/bootstrap.proto
+++ b/generated_api_shadow/envoy/config/bootstrap/v4alpha/bootstrap.proto
@@ -21,6 +21,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -183,7 +184,8 @@ message Bootstrap {
   // Optional watchdog configuration.
   // This is for a single watchdog configuration for the entire system.
   // Deprecated in favor of *watchdogs* which has finer granularity.
-  Watchdog hidden_envoy_deprecated_watchdog = 8 [deprecated = true];
+  Watchdog hidden_envoy_deprecated_watchdog = 8
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional watchdogs configuration.
   // This is used for specifying different watchdogs for the different subsystems.
@@ -195,7 +197,8 @@ message Bootstrap {
   // .. attention::
   //  This field has been deprecated in favor of :ref:`HttpConnectionManager.Tracing.provider
   //  <envoy_api_field_extensions.filters.network.http_connection_manager.v4alpha.HttpConnectionManager.Tracing.provider>`.
-  trace.v4alpha.Tracing hidden_envoy_deprecated_tracing = 9 [deprecated = true];
+  trace.v4alpha.Tracing hidden_envoy_deprecated_tracing = 9
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Configuration for the runtime configuration provider. If not
   // specified, a “null” provider will be used which will result in all defaults
@@ -304,7 +307,8 @@ message Admin {
   // access log is desired specify ‘/dev/null’. This is only required if
   // :ref:`address <envoy_api_field_config.bootstrap.v4alpha.Admin.address>` is set.
   // Deprecated in favor of *access_log* which offers more options.
-  string hidden_envoy_deprecated_access_log_path = 1 [deprecated = true];
+  string hidden_envoy_deprecated_access_log_path = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The cpu profiler output path for the administration server. If no profile
   // path is specified, the default is ‘/var/log/envoy/envoy.prof’.
diff --git a/generated_api_shadow/envoy/config/cluster/v3/cluster.proto b/generated_api_shadow/envoy/config/cluster/v3/cluster.proto
index ef6801a300d9..7044c50f3b83 100644
--- a/generated_api_shadow/envoy/config/cluster/v3/cluster.proto
+++ b/generated_api_shadow/envoy/config/cluster/v3/cluster.proto
@@ -113,8 +113,11 @@ message Cluster {
     // configuring this.]
     LOAD_BALANCING_POLICY_CONFIG = 7;
 
-    hidden_envoy_deprecated_ORIGINAL_DST_LB = 4
-        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
+    hidden_envoy_deprecated_ORIGINAL_DST_LB = 4 [
+      deprecated = true,
+      (envoy.annotations.disallowed_by_default_enum) = true,
+      (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"
+    ];
   }
 
   // When V4_ONLY is selected, the DNS resolver will only perform a lookup for
@@ -757,7 +760,8 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.UpstreamHttpProtocolOptions upstream_http_protocol_options = 46 [deprecated = true];
+  core.v3.UpstreamHttpProtocolOptions upstream_http_protocol_options = 46
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Additional options when handling HTTP requests upstream. These options will be applicable to
   // both HTTP1 and HTTP2 requests.
@@ -769,7 +773,8 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.HttpProtocolOptions common_http_protocol_options = 29 [deprecated = true];
+  core.v3.HttpProtocolOptions common_http_protocol_options = 29
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Additional options when handling HTTP1 requests.
   // This has been deprecated in favor of http_protocol_options fields in the in the
@@ -779,7 +784,8 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.Http1ProtocolOptions http_protocol_options = 13 [deprecated = true];
+  core.v3.Http1ProtocolOptions http_protocol_options = 13
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Even if default HTTP2 protocol options are desired, this field must be
   // set so that Envoy will assume that the upstream supports HTTP/2 when
@@ -794,8 +800,11 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v3.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v3.Http2ProtocolOptions http2_protocol_options = 14
-      [deprecated = true, (udpa.annotations.security).configure_for_untrusted_upstream = true];
+  core.v3.Http2ProtocolOptions http2_protocol_options = 14 [
+    deprecated = true,
+    (udpa.annotations.security).configure_for_untrusted_upstream = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0"
+  ];
 
   // The extension_protocol_options field is used to provide extension-specific protocol options
   // for upstream connections. The key should match the extension filter name, such as
@@ -931,7 +940,8 @@ message Cluster {
   // <envoy_api_msg_extensions.upstreams.http.v3.HttpProtocolOptions>` message.
   // http_protocol_options can be set via the cluster's
   // :ref:`extension_protocol_options<envoy_api_field_config.cluster.v3.Cluster.typed_extension_protocol_options>`.
-  ClusterProtocolSelection protocol_selection = 26 [deprecated = true];
+  ClusterProtocolSelection protocol_selection = 26
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional options for upstream connections.
   UpstreamConnectionOptions upstream_connection_options = 30;
@@ -992,7 +1002,8 @@ message Cluster {
   //
   //   This field has been deprecated in favor of `timeout_budgets`, part of
   //   :ref:`track_cluster_stats <envoy_api_field_config.cluster.v3.Cluster.track_cluster_stats>`.
-  bool track_timeout_budgets = 47 [deprecated = true];
+  bool track_timeout_budgets = 47
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional customization and configuration of upstream connection pool, and upstream type.
   //
@@ -1024,13 +1035,21 @@ message Cluster {
   // connection pool for every downstream connection
   bool connection_pool_per_downstream_connection = 51;
 
-  repeated core.v3.Address hidden_envoy_deprecated_hosts = 7 [deprecated = true];
+  repeated core.v3.Address hidden_envoy_deprecated_hosts = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext hidden_envoy_deprecated_tls_context =
-      11 [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
-
-  map<string, google.protobuf.Struct> hidden_envoy_deprecated_extension_protocol_options = 35
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+      11 [
+        deprecated = true,
+        (envoy.annotations.deprecated_at_minor_version) = "3.0",
+        (envoy.annotations.disallowed_by_default) = true
+      ];
+
+  map<string, google.protobuf.Struct> hidden_envoy_deprecated_extension_protocol_options = 35 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // [#not-implemented-hide:] Extensible load balancing policy configuration.
@@ -1064,7 +1083,8 @@ message LoadBalancingPolicy {
 
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   // Each client will iterate over the list in order and stop at the first policy that it
diff --git a/generated_api_shadow/envoy/config/cluster/v4alpha/BUILD b/generated_api_shadow/envoy/config/cluster/v4alpha/BUILD
index 02eb1b191725..2bac8db17256 100644
--- a/generated_api_shadow/envoy/config/cluster/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/config/cluster/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/cluster/v3:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/endpoint/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/cluster/v4alpha/cluster.proto b/generated_api_shadow/envoy/config/cluster/v4alpha/cluster.proto
index 4cd136d07dd6..a97ade452560 100644
--- a/generated_api_shadow/envoy/config/cluster/v4alpha/cluster.proto
+++ b/generated_api_shadow/envoy/config/cluster/v4alpha/cluster.proto
@@ -21,6 +21,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/collection_entry.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -768,7 +769,7 @@ message Cluster {
   // <envoy_api_field_extensions.upstreams.http.v4alpha.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
   core.v4alpha.UpstreamHttpProtocolOptions hidden_envoy_deprecated_upstream_http_protocol_options =
-      46 [deprecated = true];
+      46 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Additional options when handling HTTP requests upstream. These options will be applicable to
   // both HTTP1 and HTTP2 requests.
@@ -781,7 +782,7 @@ message Cluster {
   // <envoy_api_field_extensions.upstreams.http.v4alpha.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
   core.v4alpha.HttpProtocolOptions hidden_envoy_deprecated_common_http_protocol_options = 29
-      [deprecated = true];
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Additional options when handling HTTP1 requests.
   // This has been deprecated in favor of http_protocol_options fields in the in the
@@ -792,7 +793,7 @@ message Cluster {
   // <envoy_api_field_extensions.upstreams.http.v4alpha.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
   core.v4alpha.Http1ProtocolOptions hidden_envoy_deprecated_http_protocol_options = 13
-      [deprecated = true];
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Even if default HTTP2 protocol options are desired, this field must be
   // set so that Envoy will assume that the upstream supports HTTP/2 when
@@ -807,8 +808,11 @@ message Cluster {
   // See ref:`upstream_http_protocol_options
   // <envoy_api_field_extensions.upstreams.http.v4alpha.HttpProtocolOptions.upstream_http_protocol_options>`
   // for example usage.
-  core.v4alpha.Http2ProtocolOptions hidden_envoy_deprecated_http2_protocol_options = 14
-      [deprecated = true, (udpa.annotations.security).configure_for_untrusted_upstream = true];
+  core.v4alpha.Http2ProtocolOptions hidden_envoy_deprecated_http2_protocol_options = 14 [
+    deprecated = true,
+    (udpa.annotations.security).configure_for_untrusted_upstream = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0"
+  ];
 
   // The extension_protocol_options field is used to provide extension-specific protocol options
   // for upstream connections. The key should match the extension filter name, such as
@@ -944,7 +948,8 @@ message Cluster {
   // <envoy_api_msg_extensions.upstreams.http.v4alpha.HttpProtocolOptions>` message.
   // http_protocol_options can be set via the cluster's
   // :ref:`extension_protocol_options<envoy_api_field_config.cluster.v4alpha.Cluster.typed_extension_protocol_options>`.
-  ClusterProtocolSelection hidden_envoy_deprecated_protocol_selection = 26 [deprecated = true];
+  ClusterProtocolSelection hidden_envoy_deprecated_protocol_selection = 26
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional options for upstream connections.
   UpstreamConnectionOptions upstream_connection_options = 30;
@@ -1005,7 +1010,8 @@ message Cluster {
   //
   //   This field has been deprecated in favor of `timeout_budgets`, part of
   //   :ref:`track_cluster_stats <envoy_api_field_config.cluster.v4alpha.Cluster.track_cluster_stats>`.
-  bool hidden_envoy_deprecated_track_timeout_budgets = 47 [deprecated = true];
+  bool hidden_envoy_deprecated_track_timeout_budgets = 47
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Optional customization and configuration of upstream connection pool, and upstream type.
   //
diff --git a/generated_api_shadow/envoy/config/core/v3/base.proto b/generated_api_shadow/envoy/config/core/v3/base.proto
index dffced8edd55..3f2697a6fcd9 100644
--- a/generated_api_shadow/envoy/config/core/v3/base.proto
+++ b/generated_api_shadow/envoy/config/core/v3/base.proto
@@ -14,6 +14,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/context_params.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -200,9 +201,11 @@ message Node {
   // for filtering :ref:`listeners <config_listeners>` to be returned. For example,
   // if there is a listener bound to port 80, the list can optionally contain the
   // SocketAddress `(0.0.0.0,80)`. The field is optional and just a hint.
-  repeated Address listening_addresses = 11 [deprecated = true];
+  repeated Address listening_addresses = 11
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
-  string hidden_envoy_deprecated_build_version = 5 [deprecated = true];
+  string hidden_envoy_deprecated_build_version = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // Metadata provides additional inputs to filters based on matched listeners,
@@ -404,7 +407,8 @@ message TransportSocket {
   oneof config_type {
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
diff --git a/generated_api_shadow/envoy/config/core/v3/config_source.proto b/generated_api_shadow/envoy/config/core/v3/config_source.proto
index 650ccd1af27f..ec284d40aa17 100644
--- a/generated_api_shadow/envoy/config/core/v3/config_source.proto
+++ b/generated_api_shadow/envoy/config/core/v3/config_source.proto
@@ -27,10 +27,10 @@ enum ApiVersion {
   // When not specified, we assume v2, to ease migration to Envoy's stable API
   // versioning. If a client does not support v2 (e.g. due to deprecation), this
   // is an invalid value.
-  AUTO = 0 [deprecated = true];
+  AUTO = 0 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v2 API.
-  V2 = 1 [deprecated = true];
+  V2 = 1 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v3 API.
   V3 = 2;
@@ -46,8 +46,11 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY = 0
-        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
+    hidden_envoy_deprecated_UNSUPPORTED_REST_LEGACY = 0 [
+      deprecated = true,
+      (envoy.annotations.disallowed_by_default_enum) = true,
+      (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"
+    ];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/generated_api_shadow/envoy/config/core/v3/grpc_service.proto b/generated_api_shadow/envoy/config/core/v3/grpc_service.proto
index 648a972031ca..6bc05009e42f 100644
--- a/generated_api_shadow/envoy/config/core/v3/grpc_service.proto
+++ b/generated_api_shadow/envoy/config/core/v3/grpc_service.proto
@@ -10,6 +10,7 @@ import "google/protobuf/empty.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/sensitive.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -124,7 +125,8 @@ message GrpcService {
         oneof config_type {
           google.protobuf.Any typed_config = 3;
 
-          google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+          google.protobuf.Struct hidden_envoy_deprecated_config = 2
+              [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
         }
       }
 
diff --git a/generated_api_shadow/envoy/config/core/v3/health_check.proto b/generated_api_shadow/envoy/config/core/v3/health_check.proto
index 2e72212d31f1..1927877b28f6 100644
--- a/generated_api_shadow/envoy/config/core/v3/health_check.proto
+++ b/generated_api_shadow/envoy/config/core/v3/health_check.proto
@@ -124,10 +124,14 @@ message HealthCheck {
     // <arch_overview_health_checking_identity>` for more information.
     type.matcher.v3.StringMatcher service_name_matcher = 11;
 
-    string hidden_envoy_deprecated_service_name = 5 [deprecated = true];
-
-    bool hidden_envoy_deprecated_use_http2 = 7
-        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+    string hidden_envoy_deprecated_service_name = 5
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+
+    bool hidden_envoy_deprecated_use_http2 = 7 [
+      deprecated = true,
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
+      (envoy.annotations.disallowed_by_default) = true
+    ];
   }
 
   message TcpHealthCheck {
@@ -191,7 +195,8 @@ message HealthCheck {
     oneof config_type {
       google.protobuf.Any typed_config = 3;
 
-      google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+      google.protobuf.Struct hidden_envoy_deprecated_config = 2
+          [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
     }
   }
 
diff --git a/generated_api_shadow/envoy/config/core/v3/protocol.proto b/generated_api_shadow/envoy/config/core/v3/protocol.proto
index ac2a4907b2ef..a666d9a762f6 100644
--- a/generated_api_shadow/envoy/config/core/v3/protocol.proto
+++ b/generated_api_shadow/envoy/config/core/v3/protocol.proto
@@ -8,6 +8,7 @@ import "envoy/type/v3/percent.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -361,7 +362,8 @@ message Http2ProtocolOptions {
   // <envoy_v3_api_field_config.core.v3.Http2ProtocolOptions.override_stream_error_on_invalid_http_message>`
   //
   // See `RFC7540, sec. 8.1 <https://tools.ietf.org/html/rfc7540#section-8.1>`_ for details.
-  bool stream_error_on_invalid_http_messaging = 12 [deprecated = true];
+  bool stream_error_on_invalid_http_messaging = 12
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Allows invalid HTTP messaging and headers. When this option is disabled (default), then
   // the whole HTTP/2 connection is terminated upon receiving invalid HEADERS frame. However,
diff --git a/generated_api_shadow/envoy/config/core/v3/substitution_format_string.proto b/generated_api_shadow/envoy/config/core/v3/substitution_format_string.proto
index 5d9c5b2ecd04..85eeabe66219 100644
--- a/generated_api_shadow/envoy/config/core/v3/substitution_format_string.proto
+++ b/generated_api_shadow/envoy/config/core/v3/substitution_format_string.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v3/extension.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "validate/validate.proto";
 
@@ -41,7 +42,8 @@ message SubstitutionFormatString {
     //   upstream connect error:503:path=/foo
     //
     // Deprecated in favor of :ref:`text_format_source <envoy_v3_api_field_config.core.v3.SubstitutionFormatString.text_format_source>`. To migrate text format strings, use the :ref:`inline_string <envoy_v3_api_field_config.core.v3.DataSource.inline_string>` field.
-    string text_format = 1 [deprecated = true];
+    string text_format = 1
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Specify a format with command operators to form a JSON string.
     // Its details is described in :ref:`format dictionary<config_access_log_format_dictionaries>`.
diff --git a/generated_api_shadow/envoy/config/core/v4alpha/base.proto b/generated_api_shadow/envoy/config/core/v4alpha/base.proto
index 675cab5957d1..f8749144f07d 100644
--- a/generated_api_shadow/envoy/config/core/v4alpha/base.proto
+++ b/generated_api_shadow/envoy/config/core/v4alpha/base.proto
@@ -14,6 +14,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/context_params.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -203,7 +204,8 @@ message Node {
   // for filtering :ref:`listeners <config_listeners>` to be returned. For example,
   // if there is a listener bound to port 80, the list can optionally contain the
   // SocketAddress `(0.0.0.0,80)`. The field is optional and just a hint.
-  repeated Address hidden_envoy_deprecated_listening_addresses = 11 [deprecated = true];
+  repeated Address hidden_envoy_deprecated_listening_addresses = 11
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // Metadata provides additional inputs to filters based on matched listeners,
diff --git a/generated_api_shadow/envoy/config/core/v4alpha/config_source.proto b/generated_api_shadow/envoy/config/core/v4alpha/config_source.proto
index e5a7381181b9..4f7521c2de87 100644
--- a/generated_api_shadow/envoy/config/core/v4alpha/config_source.proto
+++ b/generated_api_shadow/envoy/config/core/v4alpha/config_source.proto
@@ -27,10 +27,12 @@ enum ApiVersion {
   // When not specified, we assume v2, to ease migration to Envoy's stable API
   // versioning. If a client does not support v2 (e.g. due to deprecation), this
   // is an invalid value.
-  hidden_envoy_deprecated_AUTO = 0 [deprecated = true];
+  hidden_envoy_deprecated_AUTO = 0
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v2 API.
-  hidden_envoy_deprecated_V2 = 1 [deprecated = true];
+  hidden_envoy_deprecated_V2 = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"];
 
   // Use xDS v3 API.
   V3 = 2;
@@ -47,8 +49,11 @@ message ApiConfigSource {
   enum ApiType {
     // Ideally this would be 'reserved 0' but one can't reserve the default
     // value. Instead we throw an exception if this is ever used.
-    hidden_envoy_deprecated_DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0
-        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
+    hidden_envoy_deprecated_DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 [
+      deprecated = true,
+      (envoy.annotations.disallowed_by_default_enum) = true,
+      (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"
+    ];
 
     // REST-JSON v2 API. The `canonical JSON encoding
     // <https://developers.google.com/protocol-buffers/docs/proto3#json>`_ for
diff --git a/generated_api_shadow/envoy/config/core/v4alpha/protocol.proto b/generated_api_shadow/envoy/config/core/v4alpha/protocol.proto
index 0fa01f030a86..72e00ac0ff90 100644
--- a/generated_api_shadow/envoy/config/core/v4alpha/protocol.proto
+++ b/generated_api_shadow/envoy/config/core/v4alpha/protocol.proto
@@ -8,6 +8,7 @@ import "envoy/type/v3/percent.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -367,7 +368,8 @@ message Http2ProtocolOptions {
   // <envoy_v3_api_field_config.core.v3.Http2ProtocolOptions.override_stream_error_on_invalid_http_message>`
   //
   // See `RFC7540, sec. 8.1 <https://tools.ietf.org/html/rfc7540#section-8.1>`_ for details.
-  bool hidden_envoy_deprecated_stream_error_on_invalid_http_messaging = 12 [deprecated = true];
+  bool hidden_envoy_deprecated_stream_error_on_invalid_http_messaging = 12
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Allows invalid HTTP messaging and headers. When this option is disabled (default), then
   // the whole HTTP/2 connection is terminated upon receiving invalid HEADERS frame. However,
diff --git a/generated_api_shadow/envoy/config/core/v4alpha/substitution_format_string.proto b/generated_api_shadow/envoy/config/core/v4alpha/substitution_format_string.proto
index c52202579212..c58e7dabf6b7 100644
--- a/generated_api_shadow/envoy/config/core/v4alpha/substitution_format_string.proto
+++ b/generated_api_shadow/envoy/config/core/v4alpha/substitution_format_string.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v4alpha/extension.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -45,7 +46,8 @@ message SubstitutionFormatString {
     //   upstream connect error:503:path=/foo
     //
     // Deprecated in favor of :ref:`text_format_source <envoy_v3_api_field_config.core.v3.SubstitutionFormatString.text_format_source>`. To migrate text format strings, use the :ref:`inline_string <envoy_v3_api_field_config.core.v3.DataSource.inline_string>` field.
-    string hidden_envoy_deprecated_text_format = 1 [deprecated = true];
+    string hidden_envoy_deprecated_text_format = 1
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Specify a format with command operators to form a JSON string.
     // Its details is described in :ref:`format dictionary<config_access_log_format_dictionaries>`.
diff --git a/generated_api_shadow/envoy/config/endpoint/v3/BUILD b/generated_api_shadow/envoy/config/endpoint/v3/BUILD
index 420cd0878233..7cde9465f091 100644
--- a/generated_api_shadow/envoy/config/endpoint/v3/BUILD
+++ b/generated_api_shadow/envoy/config/endpoint/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/endpoint:pkg",
         "//envoy/config/core/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/endpoint/v3/endpoint.proto b/generated_api_shadow/envoy/config/endpoint/v3/endpoint.proto
index 2e1f8ac87cfc..9192bff18cb5 100644
--- a/generated_api_shadow/envoy/config/endpoint/v3/endpoint.proto
+++ b/generated_api_shadow/envoy/config/endpoint/v3/endpoint.proto
@@ -8,6 +8,7 @@ import "envoy/type/v3/percent.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -97,7 +98,8 @@ message ClusterLoadAssignment {
     // Defaults to 0 which means endpoints never go stale.
     google.protobuf.Duration endpoint_stale_after = 4 [(validate.rules).duration = {gt {}}];
 
-    bool hidden_envoy_deprecated_disable_overprovisioning = 5 [deprecated = true];
+    bool hidden_envoy_deprecated_disable_overprovisioning = 5
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   // Name of the cluster. This will be the :ref:`service_name
diff --git a/generated_api_shadow/envoy/config/listener/v3/BUILD b/generated_api_shadow/envoy/config/listener/v3/BUILD
index 605660eec4dc..3367a7bd5c59 100644
--- a/generated_api_shadow/envoy/config/listener/v3/BUILD
+++ b/generated_api_shadow/envoy/config/listener/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2:pkg",
         "//envoy/api/v2/listener:pkg",
         "//envoy/config/accesslog/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/listener/v3/listener.proto b/generated_api_shadow/envoy/config/listener/v3/listener.proto
index 390bc89850a4..fe2b5b77151b 100644
--- a/generated_api_shadow/envoy/config/listener/v3/listener.proto
+++ b/generated_api_shadow/envoy/config/listener/v3/listener.proto
@@ -15,6 +15,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/collection_entry.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -133,7 +134,8 @@ message Listener {
   core.v3.Metadata metadata = 6;
 
   // [#not-implemented-hide:]
-  DeprecatedV1 deprecated_v1 = 7 [deprecated = true];
+  DeprecatedV1 deprecated_v1 = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The type of draining to perform at a listener-wide level.
   DrainType drain_type = 8;
diff --git a/generated_api_shadow/envoy/config/listener/v3/listener_components.proto b/generated_api_shadow/envoy/config/listener/v3/listener_components.proto
index 211fd20ea5b1..3091295ddffc 100644
--- a/generated_api_shadow/envoy/config/listener/v3/listener_components.proto
+++ b/generated_api_shadow/envoy/config/listener/v3/listener_components.proto
@@ -13,6 +13,7 @@ import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -47,7 +48,8 @@ message Filter {
     // [#not-implemented-hide:]
     core.v3.ExtensionConfigSource config_discovery = 5;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
@@ -228,7 +230,8 @@ message FilterChain {
   // This field is deprecated. Add a
   // :ref:`PROXY protocol listener filter <config_listener_filters_proxy_protocol>`
   // explicitly instead.
-  google.protobuf.BoolValue use_proxy_proto = 4 [deprecated = true];
+  google.protobuf.BoolValue use_proxy_proto = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // [#not-implemented-hide:] filter chain metadata.
   core.v3.Metadata metadata = 5;
@@ -257,7 +260,8 @@ message FilterChain {
   OnDemandConfiguration on_demand_configuration = 8;
 
   envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
-      hidden_envoy_deprecated_tls_context = 2 [deprecated = true];
+      hidden_envoy_deprecated_tls_context = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // Listener filter chain match configuration. This is a recursive structure which allows complex
@@ -338,7 +342,8 @@ message ListenerFilter {
     // [#extension-category: envoy.filters.listener,envoy.filters.udp_listener]
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   // Optional match predicate used to disable the filter. The filter is enabled when this field is empty.
diff --git a/generated_api_shadow/envoy/config/listener/v3/udp_listener_config.proto b/generated_api_shadow/envoy/config/listener/v3/udp_listener_config.proto
index f358ca7c9cd4..8c89ad0032ac 100644
--- a/generated_api_shadow/envoy/config/listener/v3/udp_listener_config.proto
+++ b/generated_api_shadow/envoy/config/listener/v3/udp_listener_config.proto
@@ -7,6 +7,7 @@ import "envoy/config/listener/v3/quic_config.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -38,7 +39,8 @@ message UdpListenerConfig {
   QuicProtocolOptions quic_options = 7;
 
   oneof config_type {
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
diff --git a/generated_api_shadow/envoy/config/listener/v4alpha/BUILD b/generated_api_shadow/envoy/config/listener/v4alpha/BUILD
index 005a92722c4e..6b67fe7e4cdd 100644
--- a/generated_api_shadow/envoy/config/listener/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/config/listener/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v4alpha:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/listener/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/listener/v4alpha/listener.proto b/generated_api_shadow/envoy/config/listener/v4alpha/listener.proto
index fe208d046dd7..1fd4b7fc7ef7 100644
--- a/generated_api_shadow/envoy/config/listener/v4alpha/listener.proto
+++ b/generated_api_shadow/envoy/config/listener/v4alpha/listener.proto
@@ -15,6 +15,7 @@ import "google/protobuf/wrappers.proto";
 
 import "xds/core/v3/collection_entry.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/security.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -138,7 +139,8 @@ message Listener {
   core.v4alpha.Metadata metadata = 6;
 
   // [#not-implemented-hide:]
-  DeprecatedV1 hidden_envoy_deprecated_deprecated_v1 = 7 [deprecated = true];
+  DeprecatedV1 hidden_envoy_deprecated_deprecated_v1 = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The type of draining to perform at a listener-wide level.
   DrainType drain_type = 8;
diff --git a/generated_api_shadow/envoy/config/listener/v4alpha/listener_components.proto b/generated_api_shadow/envoy/config/listener/v4alpha/listener_components.proto
index 8ea1e133fa15..ecc3bae75257 100644
--- a/generated_api_shadow/envoy/config/listener/v4alpha/listener_components.proto
+++ b/generated_api_shadow/envoy/config/listener/v4alpha/listener_components.proto
@@ -11,6 +11,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -234,7 +235,8 @@ message FilterChain {
   // This field is deprecated. Add a
   // :ref:`PROXY protocol listener filter <config_listener_filters_proxy_protocol>`
   // explicitly instead.
-  google.protobuf.BoolValue hidden_envoy_deprecated_use_proxy_proto = 4 [deprecated = true];
+  google.protobuf.BoolValue hidden_envoy_deprecated_use_proxy_proto = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // [#not-implemented-hide:] filter chain metadata.
   core.v4alpha.Metadata metadata = 5;
diff --git a/generated_api_shadow/envoy/config/metrics/v3/BUILD b/generated_api_shadow/envoy/config/metrics/v3/BUILD
index 6de4af36aa4b..8e9c73c09e11 100644
--- a/generated_api_shadow/envoy/config/metrics/v3/BUILD
+++ b/generated_api_shadow/envoy/config/metrics/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/metrics/v2:pkg",
         "//envoy/type/matcher/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/metrics/v3/stats.proto b/generated_api_shadow/envoy/config/metrics/v3/stats.proto
index cc0e6d4ce24d..8c25109fd1f6 100644
--- a/generated_api_shadow/envoy/config/metrics/v3/stats.proto
+++ b/generated_api_shadow/envoy/config/metrics/v3/stats.proto
@@ -9,6 +9,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -37,7 +38,8 @@ message StatsSink {
   oneof config_type {
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
diff --git a/generated_api_shadow/envoy/config/overload/v3/BUILD b/generated_api_shadow/envoy/config/overload/v3/BUILD
index 9fdea99c648d..9a222edfc8e6 100644
--- a/generated_api_shadow/envoy/config/overload/v3/BUILD
+++ b/generated_api_shadow/envoy/config/overload/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/overload/v2alpha:pkg",
         "//envoy/type/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/config/overload/v3/overload.proto b/generated_api_shadow/envoy/config/overload/v3/overload.proto
index 4b88b27def09..1211e1cd49dd 100644
--- a/generated_api_shadow/envoy/config/overload/v3/overload.proto
+++ b/generated_api_shadow/envoy/config/overload/v3/overload.proto
@@ -8,6 +8,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -38,7 +39,8 @@ message ResourceMonitor {
   oneof config_type {
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
diff --git a/generated_api_shadow/envoy/config/rbac/v3/BUILD b/generated_api_shadow/envoy/config/rbac/v3/BUILD
index 06aa27115658..bf5d6038a261 100644
--- a/generated_api_shadow/envoy/config/rbac/v3/BUILD
+++ b/generated_api_shadow/envoy/config/rbac/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/rbac/v2:pkg",
         "//envoy/config/route/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/rbac/v3/rbac.proto b/generated_api_shadow/envoy/config/rbac/v3/rbac.proto
index 65884a919fc6..11fc66ee0c16 100644
--- a/generated_api_shadow/envoy/config/rbac/v3/rbac.proto
+++ b/generated_api_shadow/envoy/config/rbac/v3/rbac.proto
@@ -11,6 +11,7 @@ import "envoy/type/matcher/v3/string.proto";
 import "google/api/expr/v1alpha1/checked.proto";
 import "google/api/expr/v1alpha1/syntax.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -259,7 +260,8 @@ message Principal {
 
     // A CIDR block that describes the downstream IP.
     // This address will honor proxy protocol, but will not honor XFF.
-    core.v3.CidrRange source_ip = 5 [deprecated = true];
+    core.v3.CidrRange source_ip = 5
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // A CIDR block that describes the downstream remote/origin address.
     // Note: This is always the physical peer even if the
diff --git a/generated_api_shadow/envoy/config/rbac/v4alpha/BUILD b/generated_api_shadow/envoy/config/rbac/v4alpha/BUILD
index f5683a61a286..ddf34cc1032b 100644
--- a/generated_api_shadow/envoy/config/rbac/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/config/rbac/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/rbac/v3:pkg",
         "//envoy/config/route/v4alpha:pkg",
diff --git a/generated_api_shadow/envoy/config/rbac/v4alpha/rbac.proto b/generated_api_shadow/envoy/config/rbac/v4alpha/rbac.proto
index 78d9ae7e3234..f6b1079380c7 100644
--- a/generated_api_shadow/envoy/config/rbac/v4alpha/rbac.proto
+++ b/generated_api_shadow/envoy/config/rbac/v4alpha/rbac.proto
@@ -11,6 +11,7 @@ import "envoy/type/matcher/v4alpha/string.proto";
 import "google/api/expr/v1alpha1/checked.proto";
 import "google/api/expr/v1alpha1/syntax.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -258,7 +259,8 @@ message Principal {
 
     // A CIDR block that describes the downstream IP.
     // This address will honor proxy protocol, but will not honor XFF.
-    core.v4alpha.CidrRange hidden_envoy_deprecated_source_ip = 5 [deprecated = true];
+    core.v4alpha.CidrRange hidden_envoy_deprecated_source_ip = 5
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // A CIDR block that describes the downstream remote/origin address.
     // Note: This is always the physical peer even if the
diff --git a/generated_api_shadow/envoy/config/route/v3/route_components.proto b/generated_api_shadow/envoy/config/route/v3/route_components.proto
index 118973b5874a..b98ad53e08d8 100644
--- a/generated_api_shadow/envoy/config/route/v3/route_components.proto
+++ b/generated_api_shadow/envoy/config/route/v3/route_components.proto
@@ -187,7 +187,7 @@ message VirtualHost {
   google.protobuf.UInt32Value per_request_buffer_limit_bytes = 18;
 
   map<string, google.protobuf.Struct> hidden_envoy_deprecated_per_filter_config = 12
-      [deprecated = true];
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // A filter-defined action type.
@@ -296,7 +296,7 @@ message Route {
   google.protobuf.UInt32Value per_request_buffer_limit_bytes = 16;
 
   map<string, google.protobuf.Struct> hidden_envoy_deprecated_per_filter_config = 8
-      [deprecated = true];
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // Compared to the :ref:`cluster <envoy_api_field_config.route.v3.RouteAction.cluster>` field that specifies a
@@ -375,7 +375,7 @@ message WeightedCluster {
     map<string, google.protobuf.Any> typed_per_filter_config = 10;
 
     map<string, google.protobuf.Struct> hidden_envoy_deprecated_per_filter_config = 8
-        [deprecated = true];
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   // Specifies one or more upstream clusters associated with the route.
@@ -463,6 +463,7 @@ message RouteMatch {
     string hidden_envoy_deprecated_regex = 3 [
       deprecated = true,
       (validate.rules).string = {max_bytes: 1024},
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
       (envoy.annotations.disallowed_by_default) = true
     ];
   }
@@ -548,8 +549,11 @@ message CorsPolicy {
     // specified, Envoy will lookup the runtime key to get the percentage of requests to filter.
     core.v3.RuntimeFractionalPercent filter_enabled = 9;
 
-    google.protobuf.BoolValue hidden_envoy_deprecated_enabled = 7
-        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+    google.protobuf.BoolValue hidden_envoy_deprecated_enabled = 7 [
+      deprecated = true,
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
+      (envoy.annotations.disallowed_by_default) = true
+    ];
   }
 
   // Specifies the % of requests for which the CORS policies will be evaluated and tracked, but not
@@ -563,11 +567,17 @@ message CorsPolicy {
   // and track the request's *Origin* to determine if it's valid but will not enforce any policies.
   core.v3.RuntimeFractionalPercent shadow_enabled = 10;
 
-  repeated string hidden_envoy_deprecated_allow_origin = 1
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  repeated string hidden_envoy_deprecated_allow_origin = 1 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
-  repeated string hidden_envoy_deprecated_allow_origin_regex = 8
-      [deprecated = true, (validate.rules).repeated = {items {string {max_bytes: 1024}}}];
+  repeated string hidden_envoy_deprecated_allow_origin_regex = 8 [
+    deprecated = true,
+    (validate.rules).repeated = {items {string {max_bytes: 1024}}},
+    (envoy.annotations.deprecated_at_minor_version) = "3.0"
+  ];
 }
 
 // [#next-free-field: 37]
@@ -623,8 +633,11 @@ message RouteAction {
     // Determines if the trace span should be sampled. Defaults to true.
     google.protobuf.BoolValue trace_sampled = 4;
 
-    string hidden_envoy_deprecated_runtime_key = 2
-        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+    string hidden_envoy_deprecated_runtime_key = 2 [
+      deprecated = true,
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
+      (envoy.annotations.disallowed_by_default) = true
+    ];
   }
 
   // Specifies the route's hashing policy if the upstream cluster uses a hashing :ref:`load balancer
@@ -1032,7 +1045,8 @@ message RouteAction {
   // request.
   //
   // This field is deprecated. Please use :ref:`vh_rate_limits <envoy_v3_api_field_extensions.filters.http.ratelimit.v3.RateLimitPerRoute.vh_rate_limits>`
-  google.protobuf.BoolValue include_vh_rate_limits = 14 [deprecated = true];
+  google.protobuf.BoolValue include_vh_rate_limits = 14
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Specifies a list of hash policies to use for ring hash load balancing. Each
   // hash policy is evaluated individually and the combined result is used to
@@ -1071,7 +1085,8 @@ message RouteAction {
   //    :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`,
   //    :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the
   //    :ref:`retry overview <arch_overview_http_routing_retry>`.
-  google.protobuf.Duration max_grpc_timeout = 23 [deprecated = true];
+  google.protobuf.Duration max_grpc_timeout = 23
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Deprecated by :ref:`grpc_timeout_header_offset <envoy_api_field_config.route.v3.RouteAction.MaxStreamDuration.grpc_timeout_header_offset>`.
   // If present, Envoy will adjust the timeout provided by the `grpc-timeout` header by subtracting
@@ -1081,7 +1096,8 @@ message RouteAction {
   // The offset will only be applied if the provided grpc_timeout is greater than the offset. This
   // ensures that the offset will only ever decrease the timeout and never set it to 0 (meaning
   // infinity).
-  google.protobuf.Duration grpc_timeout_offset = 28 [deprecated = true];
+  google.protobuf.Duration grpc_timeout_offset = 28
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   repeated UpgradeConfig upgrade_configs = 25;
 
@@ -1091,7 +1107,8 @@ message RouteAction {
   // <envoy_api_field_config.route.v3.InternalRedirectPolicy.redirect_response_codes>`.
   InternalRedirectPolicy internal_redirect_policy = 34;
 
-  InternalRedirectAction internal_redirect_action = 26 [deprecated = true];
+  InternalRedirectAction internal_redirect_action = 26
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // An internal redirect is handled, iff the number of previous internal redirects that a
   // downstream request has encountered is lower than this value, and
@@ -1107,7 +1124,8 @@ message RouteAction {
   // will pass the redirect back to downstream.
   //
   // If not specified, at most one redirect will be followed.
-  google.protobuf.UInt32Value max_internal_redirects = 31 [deprecated = true];
+  google.protobuf.UInt32Value max_internal_redirects = 31
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Indicates that the route has a hedge policy. Note that if this is set,
   // it'll take precedence over the virtual host level hedge policy entirely
@@ -1117,7 +1135,8 @@ message RouteAction {
   // Specifies the maximum stream duration for this route.
   MaxStreamDuration max_stream_duration = 36;
 
-  RequestMirrorPolicy hidden_envoy_deprecated_request_mirror_policy = 10 [deprecated = true];
+  RequestMirrorPolicy hidden_envoy_deprecated_request_mirror_policy = 10
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
 
 // HTTP retry :ref:`architecture overview <arch_overview_http_routing_retry>`.
@@ -1140,7 +1159,8 @@ message RetryPolicy {
     oneof config_type {
       google.protobuf.Any typed_config = 3;
 
-      google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+      google.protobuf.Struct hidden_envoy_deprecated_config = 2
+          [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
     }
   }
 
@@ -1154,7 +1174,8 @@ message RetryPolicy {
     oneof config_type {
       google.protobuf.Any typed_config = 3;
 
-      google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+      google.protobuf.Struct hidden_envoy_deprecated_config = 2
+          [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
     }
   }
 
@@ -1559,11 +1580,15 @@ message VirtualCluster {
   string hidden_envoy_deprecated_pattern = 1 [
     deprecated = true,
     (validate.rules).string = {max_bytes: 1024},
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
     (envoy.annotations.disallowed_by_default) = true
   ];
 
-  core.v3.RequestMethod hidden_envoy_deprecated_method = 3
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  core.v3.RequestMethod hidden_envoy_deprecated_method = 3 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // Global rate limiting :ref:`architecture overview <arch_overview_global_rate_limit>`.
@@ -1764,8 +1789,11 @@ message RateLimit {
       //
       // .. attention::
       //   This field has been deprecated in favor of the :ref:`metadata <envoy_api_field_config.route.v3.RateLimit.Action.metadata>` field
-      DynamicMetaData dynamic_metadata = 7
-          [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+      DynamicMetaData dynamic_metadata = 7 [
+        deprecated = true,
+        (envoy.annotations.deprecated_at_minor_version) = "3.0",
+        (envoy.annotations.disallowed_by_default) = true
+      ];
 
       // Rate limit on metadata.
       MetaData metadata = 8;
@@ -1910,6 +1938,7 @@ message HeaderMatcher {
     string hidden_envoy_deprecated_regex_match = 5 [
       deprecated = true,
       (validate.rules).string = {max_bytes: 1024},
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
       (envoy.annotations.disallowed_by_default) = true
     ];
   }
@@ -1942,11 +1971,17 @@ message QueryParameterMatcher {
     bool present_match = 6;
   }
 
-  string hidden_envoy_deprecated_value = 3
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  string hidden_envoy_deprecated_value = 3 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
-  google.protobuf.BoolValue hidden_envoy_deprecated_regex = 4
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  google.protobuf.BoolValue hidden_envoy_deprecated_regex = 4 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // HTTP Internal Redirect :ref:`architecture overview <arch_overview_internal_redirects>`.
diff --git a/generated_api_shadow/envoy/config/route/v4alpha/route_components.proto b/generated_api_shadow/envoy/config/route/v4alpha/route_components.proto
index ec52cb00d78f..6924bc80e38e 100644
--- a/generated_api_shadow/envoy/config/route/v4alpha/route_components.proto
+++ b/generated_api_shadow/envoy/config/route/v4alpha/route_components.proto
@@ -1030,7 +1030,8 @@ message RouteAction {
   // request.
   //
   // This field is deprecated. Please use :ref:`vh_rate_limits <envoy_v3_api_field_extensions.filters.http.ratelimit.v3.RateLimitPerRoute.vh_rate_limits>`
-  google.protobuf.BoolValue hidden_envoy_deprecated_include_vh_rate_limits = 14 [deprecated = true];
+  google.protobuf.BoolValue hidden_envoy_deprecated_include_vh_rate_limits = 14
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Specifies a list of hash policies to use for ring hash load balancing. Each
   // hash policy is evaluated individually and the combined result is used to
@@ -1069,7 +1070,8 @@ message RouteAction {
   //    :ref:`config_http_filters_router_x-envoy-upstream-rq-timeout-ms`,
   //    :ref:`config_http_filters_router_x-envoy-upstream-rq-per-try-timeout-ms`, and the
   //    :ref:`retry overview <arch_overview_http_routing_retry>`.
-  google.protobuf.Duration hidden_envoy_deprecated_max_grpc_timeout = 23 [deprecated = true];
+  google.protobuf.Duration hidden_envoy_deprecated_max_grpc_timeout = 23
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Deprecated by :ref:`grpc_timeout_header_offset <envoy_api_field_config.route.v4alpha.RouteAction.MaxStreamDuration.grpc_timeout_header_offset>`.
   // If present, Envoy will adjust the timeout provided by the `grpc-timeout` header by subtracting
@@ -1079,7 +1081,8 @@ message RouteAction {
   // The offset will only be applied if the provided grpc_timeout is greater than the offset. This
   // ensures that the offset will only ever decrease the timeout and never set it to 0 (meaning
   // infinity).
-  google.protobuf.Duration hidden_envoy_deprecated_grpc_timeout_offset = 28 [deprecated = true];
+  google.protobuf.Duration hidden_envoy_deprecated_grpc_timeout_offset = 28
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   repeated UpgradeConfig upgrade_configs = 25;
 
@@ -1089,7 +1092,8 @@ message RouteAction {
   // <envoy_api_field_config.route.v4alpha.InternalRedirectPolicy.redirect_response_codes>`.
   InternalRedirectPolicy internal_redirect_policy = 34;
 
-  InternalRedirectAction hidden_envoy_deprecated_internal_redirect_action = 26 [deprecated = true];
+  InternalRedirectAction hidden_envoy_deprecated_internal_redirect_action = 26
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // An internal redirect is handled, iff the number of previous internal redirects that a
   // downstream request has encountered is lower than this value, and
@@ -1106,7 +1110,7 @@ message RouteAction {
   //
   // If not specified, at most one redirect will be followed.
   google.protobuf.UInt32Value hidden_envoy_deprecated_max_internal_redirects = 31
-      [deprecated = true];
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Indicates that the route has a hedge policy. Note that if this is set,
   // it'll take precedence over the virtual host level hedge policy entirely
@@ -1773,8 +1777,11 @@ message RateLimit {
       //
       // .. attention::
       //   This field has been deprecated in favor of the :ref:`metadata <envoy_api_field_config.route.v4alpha.RateLimit.Action.metadata>` field
-      DynamicMetaData hidden_envoy_deprecated_dynamic_metadata = 7
-          [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+      DynamicMetaData hidden_envoy_deprecated_dynamic_metadata = 7 [
+        deprecated = true,
+        (envoy.annotations.deprecated_at_minor_version) = "3.0",
+        (envoy.annotations.disallowed_by_default) = true
+      ];
 
       // Rate limit on metadata.
       MetaData metadata = 8;
diff --git a/generated_api_shadow/envoy/config/tap/v3/BUILD b/generated_api_shadow/envoy/config/tap/v3/BUILD
index 243e51df1d70..416ccc0f9403 100644
--- a/generated_api_shadow/envoy/config/tap/v3/BUILD
+++ b/generated_api_shadow/envoy/config/tap/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/common/matcher/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/route/v3:pkg",
diff --git a/generated_api_shadow/envoy/config/tap/v3/common.proto b/generated_api_shadow/envoy/config/tap/v3/common.proto
index a8324a6ebc1a..42189d2aa425 100644
--- a/generated_api_shadow/envoy/config/tap/v3/common.proto
+++ b/generated_api_shadow/envoy/config/tap/v3/common.proto
@@ -9,6 +9,7 @@ import "envoy/config/route/v3/route_components.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -32,7 +33,8 @@ message TapConfig {
   // Exactly one of :ref:`match <envoy_api_field_config.tap.v3.TapConfig.match>` and
   // :ref:`match_config <envoy_api_field_config.tap.v3.TapConfig.match_config>` must be set. If both
   // are set, the :ref:`match <envoy_api_field_config.tap.v3.TapConfig.match>` will be used.
-  MatchPredicate match_config = 1 [deprecated = true];
+  MatchPredicate match_config = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The match configuration. If the configuration matches the data source being tapped, a tap will
   // occur, with the result written to the configured output.
diff --git a/generated_api_shadow/envoy/config/tap/v4alpha/BUILD b/generated_api_shadow/envoy/config/tap/v4alpha/BUILD
index f226f8b207e4..95c7990fbc47 100644
--- a/generated_api_shadow/envoy/config/tap/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/config/tap/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/common/matcher/v4alpha:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/route/v4alpha:pkg",
diff --git a/generated_api_shadow/envoy/config/tap/v4alpha/common.proto b/generated_api_shadow/envoy/config/tap/v4alpha/common.proto
index 05b8fe0ac0dd..0deb5b48d27b 100644
--- a/generated_api_shadow/envoy/config/tap/v4alpha/common.proto
+++ b/generated_api_shadow/envoy/config/tap/v4alpha/common.proto
@@ -9,6 +9,7 @@ import "envoy/config/route/v4alpha/route_components.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -31,7 +32,8 @@ message TapConfig {
   // Exactly one of :ref:`match <envoy_api_field_config.tap.v4alpha.TapConfig.match>` and
   // :ref:`match_config <envoy_api_field_config.tap.v4alpha.TapConfig.match_config>` must be set. If both
   // are set, the :ref:`match <envoy_api_field_config.tap.v4alpha.TapConfig.match>` will be used.
-  MatchPredicate hidden_envoy_deprecated_match_config = 1 [deprecated = true];
+  MatchPredicate hidden_envoy_deprecated_match_config = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The match configuration. If the configuration matches the data source being tapped, a tap will
   // occur, with the result written to the configured output.
diff --git a/generated_api_shadow/envoy/config/trace/v3/http_tracer.proto b/generated_api_shadow/envoy/config/trace/v3/http_tracer.proto
index 80bd8a8ec4a9..a936524a4d8c 100644
--- a/generated_api_shadow/envoy/config/trace/v3/http_tracer.proto
+++ b/generated_api_shadow/envoy/config/trace/v3/http_tracer.proto
@@ -5,6 +5,7 @@ package envoy.config.trace.v3;
 import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -49,7 +50,8 @@ message Tracing {
     oneof config_type {
       google.protobuf.Any typed_config = 3;
 
-      google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+      google.protobuf.Struct hidden_envoy_deprecated_config = 2
+          [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
     }
   }
 
diff --git a/generated_api_shadow/envoy/config/trace/v3/opencensus.proto b/generated_api_shadow/envoy/config/trace/v3/opencensus.proto
index 6ffce02392f6..ee2241e729a8 100644
--- a/generated_api_shadow/envoy/config/trace/v3/opencensus.proto
+++ b/generated_api_shadow/envoy/config/trace/v3/opencensus.proto
@@ -6,6 +6,7 @@ import "envoy/config/core/v3/grpc_service.proto";
 
 import "opencensus/proto/trace/v1/trace_config.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -73,12 +74,14 @@ message OpenCensusConfig {
   // Enables the Zipkin exporter if set to true. The url and service name must
   // also be set. This is deprecated, prefer to use Envoy's :ref:`native Zipkin
   // tracer <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  bool zipkin_exporter_enabled = 5 [deprecated = true];
+  bool zipkin_exporter_enabled = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The URL to Zipkin, e.g. "http://127.0.0.1:9411/api/v2/spans". This is
   // deprecated, prefer to use Envoy's :ref:`native Zipkin tracer
   // <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  string zipkin_url = 6 [deprecated = true];
+  string zipkin_url = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Enables the OpenCensus Agent exporter if set to true. The ocagent_address or
   // ocagent_grpc_service must also be set.
diff --git a/generated_api_shadow/envoy/config/trace/v3/zipkin.proto b/generated_api_shadow/envoy/config/trace/v3/zipkin.proto
index d337ff5571f1..61d3f0805fd3 100644
--- a/generated_api_shadow/envoy/config/trace/v3/zipkin.proto
+++ b/generated_api_shadow/envoy/config/trace/v3/zipkin.proto
@@ -33,8 +33,11 @@ message ZipkinConfig {
     // Hence the motivation of adding HTTP_JSON_V1 as the default is to avoid a breaking change when
     // user upgrading Envoy with this change. Furthermore, we also immediately deprecate this field,
     // since in Zipkin realm this v1 version is considered to be not preferable anymore.]
-    hidden_envoy_deprecated_HTTP_JSON_V1 = 0
-        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
+    hidden_envoy_deprecated_HTTP_JSON_V1 = 0 [
+      deprecated = true,
+      (envoy.annotations.disallowed_by_default_enum) = true,
+      (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"
+    ];
 
     // Zipkin API v2, JSON over HTTP.
     HTTP_JSON = 1;
diff --git a/generated_api_shadow/envoy/extensions/access_loggers/file/v3/BUILD b/generated_api_shadow/envoy/extensions/access_loggers/file/v3/BUILD
index 627b855a467e..20cbee8b9463 100644
--- a/generated_api_shadow/envoy/extensions/access_loggers/file/v3/BUILD
+++ b/generated_api_shadow/envoy/extensions/access_loggers/file/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v2:pkg",
         "//envoy/config/core/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/access_loggers/file/v3/file.proto b/generated_api_shadow/envoy/extensions/access_loggers/file/v3/file.proto
index f17a2e7f4ca9..d44a658276a5 100644
--- a/generated_api_shadow/envoy/extensions/access_loggers/file/v3/file.proto
+++ b/generated_api_shadow/envoy/extensions/access_loggers/file/v3/file.proto
@@ -6,6 +6,7 @@ import "envoy/config/core/v3/substitution_format_string.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -35,13 +36,14 @@ message FileAccessLog {
     // :ref:`default format <config_access_log_default_format>`.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    string format = 2 [deprecated = true];
+    string format = 2 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Access log :ref:`format dictionary<config_access_log_format_dictionaries>`. All values
     // are rendered as strings.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    google.protobuf.Struct json_format = 3 [deprecated = true];
+    google.protobuf.Struct json_format = 3
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Access log :ref:`format dictionary<config_access_log_format_dictionaries>`. Values are
     // rendered as strings, numbers, or boolean values as appropriate. Nested JSON objects may
@@ -49,7 +51,8 @@ message FileAccessLog {
     // documentation for a specific command operator for details.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    google.protobuf.Struct typed_json_format = 4 [deprecated = true];
+    google.protobuf.Struct typed_json_format = 4
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Configuration to form access log data and format.
     // If not specified, use :ref:`default format <config_access_log_default_format>`.
diff --git a/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/BUILD b/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/BUILD
index c44559b4e763..7d52fd1c2b1c 100644
--- a/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/extensions/access_loggers/file/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/file.proto b/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/file.proto
index afdcfd9e5011..1a2ceff22288 100644
--- a/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/file.proto
+++ b/generated_api_shadow/envoy/extensions/access_loggers/file/v4alpha/file.proto
@@ -6,6 +6,7 @@ import "envoy/config/core/v4alpha/substitution_format_string.proto";
 
 import "google/protobuf/struct.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -35,13 +36,15 @@ message FileAccessLog {
     // :ref:`default format <config_access_log_default_format>`.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    string hidden_envoy_deprecated_format = 2 [deprecated = true];
+    string hidden_envoy_deprecated_format = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Access log :ref:`format dictionary<config_access_log_format_dictionaries>`. All values
     // are rendered as strings.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    google.protobuf.Struct hidden_envoy_deprecated_json_format = 3 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_json_format = 3
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Access log :ref:`format dictionary<config_access_log_format_dictionaries>`. Values are
     // rendered as strings, numbers, or boolean values as appropriate. Nested JSON objects may
@@ -49,7 +52,8 @@ message FileAccessLog {
     // documentation for a specific command operator for details.
     // This field is deprecated.
     // Please use :ref:`log_format <envoy_v3_api_field_extensions.access_loggers.file.v3.FileAccessLog.log_format>`.
-    google.protobuf.Struct hidden_envoy_deprecated_typed_json_format = 4 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_typed_json_format = 4
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
     // Configuration to form access log data and format.
     // If not specified, use :ref:`default format <config_access_log_default_format>`.
diff --git a/generated_api_shadow/envoy/extensions/filters/common/fault/v3/fault.proto b/generated_api_shadow/envoy/extensions/filters/common/fault/v3/fault.proto
index f8df4c3d16e6..f1bdb571c480 100644
--- a/generated_api_shadow/envoy/extensions/filters/common/fault/v3/fault.proto
+++ b/generated_api_shadow/envoy/extensions/filters/common/fault/v3/fault.proto
@@ -58,8 +58,11 @@ message FaultDelay {
   // The percentage of operations/connections/requests on which the delay will be injected.
   type.v3.FractionalPercent percentage = 4;
 
-  FaultDelayType hidden_envoy_deprecated_type = 1
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  FaultDelayType hidden_envoy_deprecated_type = 1 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // Describes a rate limit to be applied.
diff --git a/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/BUILD b/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/BUILD
index f78b65b76163..cf5fc2a635de 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/filter/http/compressor/v2:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/compressor.proto b/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/compressor.proto
index ed347cc439eb..1c08706b055c 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/compressor.proto
+++ b/generated_api_shadow/envoy/extensions/filters/http/compressor/v3/compressor.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v3/extension.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -66,18 +67,21 @@ message Compressor {
   }
 
   // Minimum response length, in bytes, which will trigger compression. The default value is 30.
-  google.protobuf.UInt32Value content_length = 1 [deprecated = true];
+  google.protobuf.UInt32Value content_length = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Set of strings that allows specifying which mime-types yield compression; e.g.,
   // application/json, text/html, etc. When this field is not defined, compression will be applied
   // to the following mime-types: "application/javascript", "application/json",
   // "application/xhtml+xml", "image/svg+xml", "text/css", "text/html", "text/plain", "text/xml"
   // and their synonyms.
-  repeated string content_type = 2 [deprecated = true];
+  repeated string content_type = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // If true, disables compression when the response contains an etag header. When it is false, the
   // filter will preserve weak etags and remove the ones that require strong validation.
-  bool disable_on_etag_header = 3 [deprecated = true];
+  bool disable_on_etag_header = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // If true, removes accept-encoding from the request headers before dispatching it to the upstream
   // so that responses do not get compressed before reaching the filter.
@@ -86,11 +90,13 @@ message Compressor {
   //
   //    To avoid interfering with other compression filters in the same chain use this option in
   //    the filter closest to the upstream.
-  bool remove_accept_encoding_header = 4 [deprecated = true];
+  bool remove_accept_encoding_header = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Runtime flag that controls whether the filter is enabled or not. If set to false, the
   // filter will operate as a pass-through filter. If not specified, defaults to enabled.
-  config.core.v3.RuntimeFeatureFlag runtime_enabled = 5 [deprecated = true];
+  config.core.v3.RuntimeFeatureFlag runtime_enabled = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // A compressor library to use for compression. Currently only
   // :ref:`envoy.compression.gzip.compressor<envoy_api_msg_extensions.compression.gzip.compressor.v3.Gzip>`
diff --git a/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/BUILD b/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/BUILD
index 251b6da666af..b8bf9faed35f 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/extensions/filters/http/compressor/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/compressor.proto b/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/compressor.proto
index 419e690051e3..419d37d18018 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/compressor.proto
+++ b/generated_api_shadow/envoy/extensions/filters/http/compressor/v4alpha/compressor.proto
@@ -7,6 +7,7 @@ import "envoy/config/core/v4alpha/extension.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -75,18 +76,21 @@ message Compressor {
   }
 
   // Minimum response length, in bytes, which will trigger compression. The default value is 30.
-  google.protobuf.UInt32Value hidden_envoy_deprecated_content_length = 1 [deprecated = true];
+  google.protobuf.UInt32Value hidden_envoy_deprecated_content_length = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Set of strings that allows specifying which mime-types yield compression; e.g.,
   // application/json, text/html, etc. When this field is not defined, compression will be applied
   // to the following mime-types: "application/javascript", "application/json",
   // "application/xhtml+xml", "image/svg+xml", "text/css", "text/html", "text/plain", "text/xml"
   // and their synonyms.
-  repeated string hidden_envoy_deprecated_content_type = 2 [deprecated = true];
+  repeated string hidden_envoy_deprecated_content_type = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // If true, disables compression when the response contains an etag header. When it is false, the
   // filter will preserve weak etags and remove the ones that require strong validation.
-  bool hidden_envoy_deprecated_disable_on_etag_header = 3 [deprecated = true];
+  bool hidden_envoy_deprecated_disable_on_etag_header = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // If true, removes accept-encoding from the request headers before dispatching it to the upstream
   // so that responses do not get compressed before reaching the filter.
@@ -95,12 +99,13 @@ message Compressor {
   //
   //    To avoid interfering with other compression filters in the same chain use this option in
   //    the filter closest to the upstream.
-  bool hidden_envoy_deprecated_remove_accept_encoding_header = 4 [deprecated = true];
+  bool hidden_envoy_deprecated_remove_accept_encoding_header = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Runtime flag that controls whether the filter is enabled or not. If set to false, the
   // filter will operate as a pass-through filter. If not specified, defaults to enabled.
   config.core.v4alpha.RuntimeFeatureFlag hidden_envoy_deprecated_runtime_enabled = 5
-      [deprecated = true];
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // A compressor library to use for compression. Currently only
   // :ref:`envoy.compression.gzip.compressor<envoy_api_msg_extensions.compression.gzip.compressor.v3.Gzip>`
diff --git a/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto b/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto
index 81be512556f1..5eec89b6c9d3 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto
+++ b/generated_api_shadow/envoy/extensions/filters/http/ext_authz/v3/ext_authz.proto
@@ -136,8 +136,11 @@ message ExtAuthz {
   //
   string stat_prefix = 13;
 
-  bool hidden_envoy_deprecated_use_alpha = 4
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  bool hidden_envoy_deprecated_use_alpha = 4 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // Configuration for buffering the request data.
diff --git a/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/BUILD b/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/BUILD
index 419af66fc5b4..f2b3cf9034a0 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/filter/http/gzip/v2:pkg",
         "//envoy/extensions/filters/http/compressor/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/gzip.proto b/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/gzip.proto
index 3f63ef878f0c..0578903dad51 100644
--- a/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/gzip.proto
+++ b/generated_api_shadow/envoy/extensions/filters/http/gzip/v3/gzip.proto
@@ -6,6 +6,7 @@ import "envoy/extensions/filters/http/compressor/v3/compressor.proto";
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -76,11 +77,15 @@ message Gzip {
   // https://github.com/envoyproxy/envoy/issues/8448 for context on this filter's performance.
   google.protobuf.UInt32Value chunk_size = 11 [(validate.rules).uint32 = {lte: 65536 gte: 4096}];
 
-  google.protobuf.UInt32Value hidden_envoy_deprecated_content_length = 2 [deprecated = true];
+  google.protobuf.UInt32Value hidden_envoy_deprecated_content_length = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
-  repeated string hidden_envoy_deprecated_content_type = 6 [deprecated = true];
+  repeated string hidden_envoy_deprecated_content_type = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
-  bool hidden_envoy_deprecated_disable_on_etag_header = 7 [deprecated = true];
+  bool hidden_envoy_deprecated_disable_on_etag_header = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
-  bool hidden_envoy_deprecated_remove_accept_encoding_header = 8 [deprecated = true];
+  bool hidden_envoy_deprecated_remove_accept_encoding_header = 8
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
diff --git a/generated_api_shadow/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto b/generated_api_shadow/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
index 24e9b0b85632..df419eefb8e7 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
+++ b/generated_api_shadow/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
@@ -164,10 +164,12 @@ message HttpConnectionManager {
     OperationName hidden_envoy_deprecated_operation_name = 1 [
       deprecated = true,
       (validate.rules).enum = {defined_only: true},
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
       (envoy.annotations.disallowed_by_default) = true
     ];
 
-    repeated string hidden_envoy_deprecated_request_headers_for_tags = 2 [deprecated = true];
+    repeated string hidden_envoy_deprecated_request_headers_for_tags = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   message InternalAddressConfig {
@@ -635,8 +637,11 @@ message HttpConnectionManager {
   // for details.
   PathNormalizationOptions path_normalization_options = 43;
 
-  google.protobuf.Duration hidden_envoy_deprecated_idle_timeout = 11
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  google.protobuf.Duration hidden_envoy_deprecated_idle_timeout = 11 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // The configuration to customize local reply returned by Envoy.
@@ -908,7 +913,8 @@ message HttpFilter {
     // as for filters provided via the API.
     config.core.v3.ExtensionConfigSource config_discovery = 5;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   // If true, clients that do not support this filter may ignore the
diff --git a/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto b/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto
index dce9f7962f66..271084101a34 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto
+++ b/generated_api_shadow/envoy/extensions/filters/network/redis_proxy/v3/redis_proxy.proto
@@ -178,8 +178,11 @@ message RedisProxy {
     // catch-all route becomes required when no routes are specified.
     Route catch_all_route = 4;
 
-    string hidden_envoy_deprecated_catch_all_cluster = 3
-        [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+    string hidden_envoy_deprecated_catch_all_cluster = 3 [
+      deprecated = true,
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
+      (envoy.annotations.disallowed_by_default) = true
+    ];
   }
 
   // RedisFault defines faults used for fault injection.
@@ -297,8 +300,11 @@ message RedisProxy {
   // AUTH, but no ACL is set" error will be returned.
   config.core.v3.DataSource downstream_auth_username = 7 [(udpa.annotations.sensitive) = true];
 
-  string hidden_envoy_deprecated_cluster = 2
-      [deprecated = true, (envoy.annotations.disallowed_by_default) = true];
+  string hidden_envoy_deprecated_cluster = 2 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
 
 // RedisProtocolOptions specifies Redis upstream protocol options. This object is used in
diff --git a/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/BUILD b/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/BUILD
index 67dc2ebcf9f5..d317ad9266de 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/accesslog/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/filter/network/tcp_proxy/v2:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto b/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto
index 6a9ade97450e..da99bd050387 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto
+++ b/generated_api_shadow/envoy/extensions/filters/network/tcp_proxy/v3/tcp_proxy.proto
@@ -10,6 +10,7 @@ import "envoy/type/v3/hash_policy.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -173,5 +174,6 @@ message TcpProxy {
   google.protobuf.Duration max_downstream_connection_duration = 13
       [(validate.rules).duration = {gte {nanos: 1000000}}];
 
-  DeprecatedV1 hidden_envoy_deprecated_deprecated_v1 = 6 [deprecated = true];
+  DeprecatedV1 hidden_envoy_deprecated_deprecated_v1 = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
diff --git a/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/BUILD b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/BUILD
index ccacc55735af..cdb143507f64 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/BUILD
+++ b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/filter/network/thrift_proxy/v2alpha1:pkg",
         "//envoy/config/route/v3:pkg",
diff --git a/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/thrift_proxy.proto b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/thrift_proxy.proto
index 3083973f3da2..a1e9f7fd6465 100644
--- a/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/thrift_proxy.proto
+++ b/generated_api_shadow/envoy/extensions/filters/network/thrift_proxy/v3/thrift_proxy.proto
@@ -8,6 +8,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -113,7 +114,8 @@ message ThriftFilter {
   oneof config_type {
     google.protobuf.Any typed_config = 3;
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [deprecated = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 }
 
diff --git a/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/BUILD b/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/BUILD
index e43ed53877f4..cedd6b14bf88 100644
--- a/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/trace/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/opencensus.proto b/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/opencensus.proto
index e8ad4b88b8f0..792ff58454c9 100644
--- a/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/opencensus.proto
+++ b/generated_api_shadow/envoy/extensions/tracers/opencensus/v4alpha/opencensus.proto
@@ -6,6 +6,7 @@ import "envoy/config/core/v4alpha/grpc_service.proto";
 
 import "opencensus/proto/trace/v1/trace_config.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -70,12 +71,14 @@ message OpenCensusConfig {
   // Enables the Zipkin exporter if set to true. The url and service name must
   // also be set. This is deprecated, prefer to use Envoy's :ref:`native Zipkin
   // tracer <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  bool hidden_envoy_deprecated_zipkin_exporter_enabled = 5 [deprecated = true];
+  bool hidden_envoy_deprecated_zipkin_exporter_enabled = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // The URL to Zipkin, e.g. "http://127.0.0.1:9411/api/v2/spans". This is
   // deprecated, prefer to use Envoy's :ref:`native Zipkin tracer
   // <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  string hidden_envoy_deprecated_zipkin_url = 6 [deprecated = true];
+  string hidden_envoy_deprecated_zipkin_url = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Enables the OpenCensus Agent exporter if set to true. The ocagent_address or
   // ocagent_grpc_service must also be set.
diff --git a/generated_api_shadow/envoy/extensions/tracers/zipkin/v4alpha/zipkin.proto b/generated_api_shadow/envoy/extensions/tracers/zipkin/v4alpha/zipkin.proto
index 02f37fbef335..f7e11e43ab82 100644
--- a/generated_api_shadow/envoy/extensions/tracers/zipkin/v4alpha/zipkin.proto
+++ b/generated_api_shadow/envoy/extensions/tracers/zipkin/v4alpha/zipkin.proto
@@ -31,8 +31,11 @@ message ZipkinConfig {
     // Hence the motivation of adding HTTP_JSON_V1 as the default is to avoid a breaking change when
     // user upgrading Envoy with this change. Furthermore, we also immediately deprecate this field,
     // since in Zipkin realm this v1 version is considered to be not preferable anymore.]
-    hidden_envoy_deprecated_DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0
-        [deprecated = true, (envoy.annotations.disallowed_by_default_enum) = true];
+    hidden_envoy_deprecated_DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 [
+      deprecated = true,
+      (envoy.annotations.disallowed_by_default_enum) = true,
+      (envoy.annotations.deprecated_at_minor_version_enum) = "3.0"
+    ];
 
     // Zipkin API v2, JSON over HTTP.
     HTTP_JSON = 1;
diff --git a/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/BUILD b/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/BUILD
index 4485559ad11d..47b9b9ae57e9 100644
--- a/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/BUILD
+++ b/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/api/v2/auth:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/type/matcher/v3:pkg",
diff --git a/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/common.proto b/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/common.proto
index 114de3f28fa0..f660d734ee84 100644
--- a/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/common.proto
+++ b/generated_api_shadow/envoy/extensions/transport_sockets/tls/v3/common.proto
@@ -10,6 +10,7 @@ import "google/protobuf/any.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/sensitive.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
@@ -123,8 +124,11 @@ message PrivateKeyProvider {
   oneof config_type {
     google.protobuf.Any typed_config = 3 [(udpa.annotations.sensitive) = true];
 
-    google.protobuf.Struct hidden_envoy_deprecated_config = 2
-        [deprecated = true, (udpa.annotations.sensitive) = true];
+    google.protobuf.Struct hidden_envoy_deprecated_config = 2 [
+      deprecated = true,
+      (udpa.annotations.sensitive) = true,
+      (envoy.annotations.deprecated_at_minor_version) = "3.0"
+    ];
   }
 }
 
@@ -378,5 +382,6 @@ message CertificateValidationContext {
   // [#extension-category: envoy.tls.cert_validator]
   config.core.v3.TypedExtensionConfig custom_validator_config = 12;
 
-  repeated string hidden_envoy_deprecated_verify_subject_alt_name = 4 [deprecated = true];
+  repeated string hidden_envoy_deprecated_verify_subject_alt_name = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 }
diff --git a/generated_api_shadow/envoy/service/auth/v3/BUILD b/generated_api_shadow/envoy/service/auth/v3/BUILD
index b965364ab176..0774dda23e42 100644
--- a/generated_api_shadow/envoy/service/auth/v3/BUILD
+++ b/generated_api_shadow/envoy/service/auth/v3/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/service/auth/v2:pkg",
         "//envoy/type/v3:pkg",
diff --git a/generated_api_shadow/envoy/service/auth/v3/external_auth.proto b/generated_api_shadow/envoy/service/auth/v3/external_auth.proto
index 4860be38c4b7..b627fcb31475 100644
--- a/generated_api_shadow/envoy/service/auth/v3/external_auth.proto
+++ b/generated_api_shadow/envoy/service/auth/v3/external_auth.proto
@@ -9,6 +9,7 @@ import "envoy/type/v3/http_status.proto";
 import "google/protobuf/struct.proto";
 import "google/rpc/status.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -95,7 +96,8 @@ message OkHttpResponse {
   // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`. Until it is removed,
   // setting this field overrides :ref:`CheckResponse.dynamic_metadata
   // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`.
-  google.protobuf.Struct dynamic_metadata = 3 [deprecated = true];
+  google.protobuf.Struct dynamic_metadata = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // This field allows the authorization service to send HTTP response headers
   // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>`
diff --git a/generated_api_shadow/envoy/service/auth/v4alpha/BUILD b/generated_api_shadow/envoy/service/auth/v4alpha/BUILD
index 0c2b40ee253b..5a172e093202 100644
--- a/generated_api_shadow/envoy/service/auth/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/service/auth/v4alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/service/auth/v3:pkg",
         "//envoy/type/v3:pkg",
diff --git a/generated_api_shadow/envoy/service/auth/v4alpha/external_auth.proto b/generated_api_shadow/envoy/service/auth/v4alpha/external_auth.proto
index 451a54bc677b..f2a2cfe6c61c 100644
--- a/generated_api_shadow/envoy/service/auth/v4alpha/external_auth.proto
+++ b/generated_api_shadow/envoy/service/auth/v4alpha/external_auth.proto
@@ -9,6 +9,7 @@ import "envoy/type/v3/http_status.proto";
 import "google/protobuf/struct.proto";
 import "google/rpc/status.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -95,7 +96,8 @@ message OkHttpResponse {
   // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`. Until it is removed,
   // setting this field overrides :ref:`CheckResponse.dynamic_metadata
   // <envoy_v3_api_field_service.auth.v3.CheckResponse.dynamic_metadata>`.
-  google.protobuf.Struct hidden_envoy_deprecated_dynamic_metadata = 3 [deprecated = true];
+  google.protobuf.Struct hidden_envoy_deprecated_dynamic_metadata = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // This field allows the authorization service to send HTTP response headers
   // to the downstream client on success. Note that the :ref:`append field in HeaderValueOption <envoy_v3_api_field_config.core.v3.HeaderValueOption.append>`
diff --git a/generated_api_shadow/envoy/service/health/v3/BUILD b/generated_api_shadow/envoy/service/health/v3/BUILD
index e3e214b25d3f..30ba155208b5 100644
--- a/generated_api_shadow/envoy/service/health/v3/BUILD
+++ b/generated_api_shadow/envoy/service/health/v3/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/cluster/v3:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/config/endpoint/v3:pkg",
diff --git a/generated_api_shadow/envoy/service/health/v3/hds.proto b/generated_api_shadow/envoy/service/health/v3/hds.proto
index dc6168ecffb2..b8c231d062a7 100644
--- a/generated_api_shadow/envoy/service/health/v3/hds.proto
+++ b/generated_api_shadow/envoy/service/health/v3/hds.proto
@@ -10,6 +10,7 @@ import "envoy/config/endpoint/v3/endpoint_components.proto";
 import "google/api/annotations.proto";
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -129,7 +130,8 @@ message EndpointHealthResponse {
       "envoy.service.discovery.v2.EndpointHealthResponse";
 
   // Deprecated - Flat list of endpoint health information.
-  repeated EndpointHealth endpoints_health = 1 [deprecated = true];
+  repeated EndpointHealth endpoints_health = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Organize Endpoint health information by cluster.
   repeated ClusterEndpointsHealth cluster_endpoints_health = 2;
diff --git a/generated_api_shadow/envoy/service/health/v4alpha/BUILD b/generated_api_shadow/envoy/service/health/v4alpha/BUILD
index 60bd19511855..37c2608f7c18 100644
--- a/generated_api_shadow/envoy/service/health/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/service/health/v4alpha/BUILD
@@ -7,6 +7,7 @@ licenses(["notice"])  # Apache 2
 api_proto_package(
     has_services = True,
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/config/cluster/v4alpha:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/config/endpoint/v3:pkg",
diff --git a/generated_api_shadow/envoy/service/health/v4alpha/hds.proto b/generated_api_shadow/envoy/service/health/v4alpha/hds.proto
index 8fb671161fd6..bf3a5133f119 100644
--- a/generated_api_shadow/envoy/service/health/v4alpha/hds.proto
+++ b/generated_api_shadow/envoy/service/health/v4alpha/hds.proto
@@ -10,6 +10,7 @@ import "envoy/config/endpoint/v3/endpoint_components.proto";
 import "google/api/annotations.proto";
 import "google/protobuf/duration.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -134,7 +135,8 @@ message EndpointHealthResponse {
       "envoy.service.health.v3.EndpointHealthResponse";
 
   // Deprecated - Flat list of endpoint health information.
-  repeated EndpointHealth hidden_envoy_deprecated_endpoints_health = 1 [deprecated = true];
+  repeated EndpointHealth hidden_envoy_deprecated_endpoints_health = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   // Organize Endpoint health information by cluster.
   repeated ClusterEndpointsHealth cluster_endpoints_health = 2;
diff --git a/generated_api_shadow/envoy/service/status/v3/BUILD b/generated_api_shadow/envoy/service/status/v3/BUILD
index 57db4bd70ce3..a73963967ef7 100644
--- a/generated_api_shadow/envoy/service/status/v3/BUILD
+++ b/generated_api_shadow/envoy/service/status/v3/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     has_services = True,
     deps = [
         "//envoy/admin/v3:pkg",
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v3:pkg",
         "//envoy/service/status/v2:pkg",
         "//envoy/type/matcher/v3:pkg",
diff --git a/generated_api_shadow/envoy/service/status/v3/csds.proto b/generated_api_shadow/envoy/service/status/v3/csds.proto
index d442748c4727..3a1c748fc81b 100644
--- a/generated_api_shadow/envoy/service/status/v3/csds.proto
+++ b/generated_api_shadow/envoy/service/status/v3/csds.proto
@@ -8,6 +8,7 @@ import "envoy/type/matcher/v3/node.proto";
 
 import "google/api/annotations.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -102,7 +103,8 @@ message PerXdsConfig {
   //   This field is deprecated. Use :ref:`ClientResourceStatus
   //   <envoy_v3_api_enum_admin.v3.ClientResourceStatus>` for per-resource
   //   config status instead.
-  ClientConfigStatus client_status = 7 [deprecated = true];
+  ClientConfigStatus client_status = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   oneof per_xds_config {
     admin.v3.ListenersConfigDump listener_config = 2;
diff --git a/generated_api_shadow/envoy/service/status/v4alpha/BUILD b/generated_api_shadow/envoy/service/status/v4alpha/BUILD
index ddcf51e3b265..7c365494828d 100644
--- a/generated_api_shadow/envoy/service/status/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/service/status/v4alpha/BUILD
@@ -8,6 +8,7 @@ api_proto_package(
     has_services = True,
     deps = [
         "//envoy/admin/v4alpha:pkg",
+        "//envoy/annotations:pkg",
         "//envoy/config/core/v4alpha:pkg",
         "//envoy/service/status/v3:pkg",
         "//envoy/type/matcher/v4alpha:pkg",
diff --git a/generated_api_shadow/envoy/service/status/v4alpha/csds.proto b/generated_api_shadow/envoy/service/status/v4alpha/csds.proto
index 6852f0e5924f..751e06b645ce 100644
--- a/generated_api_shadow/envoy/service/status/v4alpha/csds.proto
+++ b/generated_api_shadow/envoy/service/status/v4alpha/csds.proto
@@ -8,6 +8,7 @@ import "envoy/type/matcher/v4alpha/node.proto";
 
 import "google/api/annotations.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -102,7 +103,8 @@ message PerXdsConfig {
   //   This field is deprecated. Use :ref:`ClientResourceStatus
   //   <envoy_v3_api_enum_admin.v3.ClientResourceStatus>` for per-resource
   //   config status instead.
-  ClientConfigStatus hidden_envoy_deprecated_client_status = 7 [deprecated = true];
+  ClientConfigStatus hidden_envoy_deprecated_client_status = 7
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
 
   oneof per_xds_config {
     admin.v4alpha.ListenersConfigDump listener_config = 2;
diff --git a/generated_api_shadow/envoy/type/matcher/v3/regex.proto b/generated_api_shadow/envoy/type/matcher/v3/regex.proto
index f5913c460c46..3e7bb477ecbf 100644
--- a/generated_api_shadow/envoy/type/matcher/v3/regex.proto
+++ b/generated_api_shadow/envoy/type/matcher/v3/regex.proto
@@ -4,6 +4,7 @@ package envoy.type.matcher.v3;
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -43,7 +44,8 @@ message RegexMatcher {
     //
     // This field is deprecated; regexp validation should be performed on the management server
     // instead of being done by each individual client.
-    google.protobuf.UInt32Value max_program_size = 1 [deprecated = true];
+    google.protobuf.UInt32Value max_program_size = 1
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   oneof engine_type {
diff --git a/generated_api_shadow/envoy/type/matcher/v3/string.proto b/generated_api_shadow/envoy/type/matcher/v3/string.proto
index 2ab13a672083..934b19d71cc1 100644
--- a/generated_api_shadow/envoy/type/matcher/v3/string.proto
+++ b/generated_api_shadow/envoy/type/matcher/v3/string.proto
@@ -61,6 +61,7 @@ message StringMatcher {
     string hidden_envoy_deprecated_regex = 4 [
       deprecated = true,
       (validate.rules).string = {max_bytes: 1024},
+      (envoy.annotations.deprecated_at_minor_version) = "3.0",
       (envoy.annotations.disallowed_by_default) = true
     ];
   }
diff --git a/generated_api_shadow/envoy/type/matcher/v4alpha/BUILD b/generated_api_shadow/envoy/type/matcher/v4alpha/BUILD
index 0d4a45d002ce..37561e92662c 100644
--- a/generated_api_shadow/envoy/type/matcher/v4alpha/BUILD
+++ b/generated_api_shadow/envoy/type/matcher/v4alpha/BUILD
@@ -6,6 +6,7 @@ licenses(["notice"])  # Apache 2
 
 api_proto_package(
     deps = [
+        "//envoy/annotations:pkg",
         "//envoy/type/matcher/v3:pkg",
         "//envoy/type/v3:pkg",
         "@com_github_cncf_udpa//udpa/annotations:pkg",
diff --git a/generated_api_shadow/envoy/type/matcher/v4alpha/regex.proto b/generated_api_shadow/envoy/type/matcher/v4alpha/regex.proto
index 2d0e90028d31..523889b9d3f7 100644
--- a/generated_api_shadow/envoy/type/matcher/v4alpha/regex.proto
+++ b/generated_api_shadow/envoy/type/matcher/v4alpha/regex.proto
@@ -4,6 +4,7 @@ package envoy.type.matcher.v4alpha;
 
 import "google/protobuf/wrappers.proto";
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 import "validate/validate.proto";
@@ -43,7 +44,8 @@ message RegexMatcher {
     //
     // This field is deprecated; regexp validation should be performed on the management server
     // instead of being done by each individual client.
-    google.protobuf.UInt32Value hidden_envoy_deprecated_max_program_size = 1 [deprecated = true];
+    google.protobuf.UInt32Value hidden_envoy_deprecated_max_program_size = 1
+        [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
   }
 
   oneof engine_type {
diff --git a/tools/api_versioning/BUILD b/tools/api_versioning/BUILD
index 632478f87438..2bd520d19b18 100644
--- a/tools/api_versioning/BUILD
+++ b/tools/api_versioning/BUILD
@@ -1,4 +1,4 @@
-load("@rules_python//python:defs.bzl", "py_binary", "py_test")
+load("@rules_python//python:defs.bzl", "py_binary", "py_library", "py_test")
 load(
     "//bazel:envoy_build_system.bzl",
     "envoy_package",
@@ -8,6 +8,20 @@ licenses(["notice"])  # Apache 2
 
 envoy_package()
 
+py_library(
+    name = "utils",
+    srcs = ["utils.py"],
+)
+
+py_test(
+    name = "utils_test",
+    srcs = ["utils_test.py"],
+    python_version = "PY3",
+    srcs_version = "PY3",
+    visibility = ["//visibility:public"],
+    deps = [":utils"],
+)
+
 py_binary(
     name = "generate_api_version_header_bin",
     srcs = ["generate_api_version_header.py"],
@@ -15,6 +29,7 @@ py_binary(
     python_version = "PY3",
     srcs_version = "PY3",
     visibility = ["//visibility:public"],
+    deps = [":utils"],
 )
 
 py_test(
@@ -25,5 +40,6 @@ py_test(
     visibility = ["//visibility:public"],
     deps = [
         ":generate_api_version_header_bin",
+        ":utils",
     ],
 )
diff --git a/tools/api_versioning/generate_api_version_header.py b/tools/api_versioning/generate_api_version_header.py
index 1f9a787cfd22..7d8ab3342983 100644
--- a/tools/api_versioning/generate_api_version_header.py
+++ b/tools/api_versioning/generate_api_version_header.py
@@ -2,12 +2,10 @@
 """Parses a file containing the API version (X.Y.Z format), and outputs (to
 stdout) a C++ header file with the ApiVersion value.
 """
-from collections import namedtuple
-import pathlib
 import string
 import sys
 
-ApiVersion = namedtuple('ApiVersion', ['major', 'minor', 'patch'])
+import utils
 
 FILE_TEMPLATE = string.Template(
     """#pragma once
@@ -31,12 +29,8 @@ def generate_header_file(input_path):
     Returns:
         the header file contents.
     """
-    lines = pathlib.Path(input_path).read_text().splitlines()
-    assert (len(lines) == 1)
-
-    # Mapping each field to int verifies it is a valid version
-    version = ApiVersion(*map(int, lines[0].split('.')))
-    oldest_version = compute_oldest_api_version(version)
+    version = utils.get_api_version(input_path)
+    oldest_version = utils.compute_oldest_api_version(version)
 
     header_file_contents = FILE_TEMPLATE.substitute({
         'major': version.major,
@@ -49,24 +43,6 @@ def generate_header_file(input_path):
     return header_file_contents
 
 
-def compute_oldest_api_version(current_version: ApiVersion):
-    """Computest the oldest API version the client supports. According to the
-    specification (see: api/API_VERSIONING.md), Envoy supports up to 2 most
-    recent minor versions. Therefore if the latest API version "X.Y.Z", Envoy's
-    oldest API version is "X.Y-1.0". Note that the major number is always the
-    same as the latest version, and the patch number is always 0. In addition,
-    the minor number is at least 0, and the oldest api version cannot be set
-    to a previous major number.
-
-    Args:
-        current_version: the current API version.
-
-    Returns:
-        the oldest supported API version.
-    """
-    return ApiVersion(current_version.major, max(current_version.minor - 1, 0), 0)
-
-
 if __name__ == '__main__':
     input_path = sys.argv[1]
     output = generate_header_file(input_path)
diff --git a/tools/api_versioning/generate_api_version_header_test.py b/tools/api_versioning/generate_api_version_header_test.py
index 096ea3ecfaa5..6a324ac85907 100644
--- a/tools/api_versioning/generate_api_version_header_test.py
+++ b/tools/api_versioning/generate_api_version_header_test.py
@@ -1,13 +1,14 @@
 """Tests the api version header file generation.
 """
-import generate_api_version_header
-from generate_api_version_header import ApiVersion
 import os
 import pathlib
 import string
 import tempfile
 import unittest
 
+import generate_api_version_header
+import utils
+
 
 class GenerateApiVersionHeaderTest(unittest.TestCase):
     EXPECTED_TEMPLATE = string.Template(
@@ -34,7 +35,8 @@ def tearDown(self):
 
     # General success pattern when valid file contents is detected.
     def successful_test_template(
-            self, output_string, current_version: ApiVersion, oldest_version: ApiVersion):
+            self, output_string, current_version: utils.ApiVersion,
+            oldest_version: utils.ApiVersion):
         pathlib.Path(self._temp_fname).write_text(output_string)
 
         # Read the string from the file, and parse the version.
@@ -49,45 +51,12 @@ def successful_test_template(
         })
         self.assertEqual(expected_output, output)
 
-    # General failure pattern when invalid file contents is detected.
-    def failed_test_template(self, output_string, assertion_error_type):
-        pathlib.Path(self._temp_fname).write_text(output_string)
-
-        # Read the string from the file, and expect version parsing to fail.
-        with self.assertRaises(
-                assertion_error_type,
-                msg='The call to generate_header_file should have thrown an exception'):
-            generate_api_version_header.generate_header_file(self._temp_fname)
-
     def test_valid_version(self):
-        self.successful_test_template('1.2.3', ApiVersion(1, 2, 3), ApiVersion(1, 1, 0))
+        self.successful_test_template('1.2.3', utils.ApiVersion(1, 2, 3), utils.ApiVersion(1, 1, 0))
 
     def test_valid_version_newline(self):
-        self.successful_test_template('3.2.1\n', ApiVersion(3, 2, 1), ApiVersion(3, 1, 0))
-
-    def test_invalid_version_string(self):
-        self.failed_test_template('1.2.abc3', ValueError)
-
-    def test_invalid_version_partial(self):
-        self.failed_test_template('1.2.', ValueError)
-
-    def test_empty_file(self):
-        # Not writing anything to the file
-        self.failed_test_template('', AssertionError)
-
-    def test_invalid_multiple_lines(self):
-        self.failed_test_template('1.2.3\n1.2.3', AssertionError)
-
-    def test_valid_oldest_api_version(self):
-        expected_latest_oldest_pairs = [(ApiVersion(3, 2, 2), ApiVersion(3, 1, 0)),
-                                        (ApiVersion(4, 5, 30), ApiVersion(4, 4, 0)),
-                                        (ApiVersion(1, 1, 5), ApiVersion(1, 0, 0)),
-                                        (ApiVersion(2, 0, 3), ApiVersion(2, 0, 0))]
-
-        for latest_version, expected_oldest_version in expected_latest_oldest_pairs:
-            self.assertEqual(
-                expected_oldest_version,
-                generate_api_version_header.compute_oldest_api_version(latest_version))
+        self.successful_test_template(
+            '3.2.1\n', utils.ApiVersion(3, 2, 1), utils.ApiVersion(3, 1, 0))
 
 
 if __name__ == '__main__':
diff --git a/tools/api_versioning/utils.py b/tools/api_versioning/utils.py
new file mode 100644
index 000000000000..0c44f111ddc0
--- /dev/null
+++ b/tools/api_versioning/utils.py
@@ -0,0 +1,77 @@
+#!/usr/bin/python
+"""Utility functions for accessing the API version (X.Y.Z format).
+"""
+from collections import namedtuple
+import pathlib
+
+ApiVersion = namedtuple('ApiVersion', ['major', 'minor', 'patch'])
+
+
+# Errors that happen during API version parsing.
+class ApiVersionParsingError(Exception):
+    pass
+
+
+def get_api_version(input_path):
+    """Returns the API version from a given API version input file.
+
+    Args:
+      input_path: the file containing the API version (API_VERSION).
+
+    Returns:
+      a namedtuple containing the major, minor, patch versions.
+
+    Raises:
+      ApiVersionParsingError: If the given file has no lines or more than one line, or if
+          the line doesn't include exactly two dots ('.').
+    """
+    lines = pathlib.Path(input_path).read_text().splitlines()
+    if len(lines) != 1 or lines[0].count('.') != 2:
+        raise ApiVersionParsingError(
+            'Api version file must have a single line of format X.Y.Z, where X, Y, and Z are non-negative integers.'
+        )
+
+    # Mapping each field to int verifies it is a valid version
+    return ApiVersion(*map(int, lines[0].split('.')))
+
+
+def compute_oldest_api_version(current_version: ApiVersion):
+    """Computest the oldest API version the client supports. According to the
+    specification (see: api/API_VERSIONING.md), Envoy supports up to 2 most
+    recent minor versions. Therefore if the latest API version "X.Y.Z", Envoy's
+    oldest API version is "X.Y-1.0". Note that the major number is always the
+    same as the latest version, and the patch number is always 0. In addition,
+    the minor number is at least 0, and the oldest api version cannot be set
+    to a previous major number.
+
+    Args:
+      current_version: the current API version.
+
+    Returns:
+      the oldest supported API version.
+    """
+    return ApiVersion(current_version.major, max(current_version.minor - 1, 0), 0)
+
+
+def is_deprecated_annotation_version(version: str):
+    """Validates that a given version string is of format X.Y, where X and Y are
+    integers, X>0, and Y>=0.
+
+    Args:
+      version: a minor version deprecation annotation value (see api/envoy/annotations/deprecation.proto)
+
+    Returns:
+      True iff the given string represents a valid X.Y version.
+    """
+    if version.count('.') != 1:
+        return False
+    # Validate major and minor parts.
+    try:
+        major, minor = [int(x) for x in version.split('.')]
+        if major <= 0:
+            return False
+        if minor < 0:
+            return False
+    except ValueError:
+        return False
+    return True
diff --git a/tools/api_versioning/utils_test.py b/tools/api_versioning/utils_test.py
new file mode 100644
index 000000000000..3af4e830d2cf
--- /dev/null
+++ b/tools/api_versioning/utils_test.py
@@ -0,0 +1,99 @@
+"""Tests the api version header file generation.
+"""
+import os
+import pathlib
+import tempfile
+import unittest
+
+import utils
+
+
+class UtilsTest(unittest.TestCase):
+
+    def setUp(self):
+        # Using mkstemp instead of NamedTemporaryFile because in windows NT or later
+        # the created NamedTemporaryFile cannot be reopened again (see comment in:
+        # https://docs.python.org/3.9/library/tempfile.html#tempfile.NamedTemporaryFile)
+        self._temp_fd, self._temp_fname = tempfile.mkstemp(text=True)
+
+    def tearDown(self):
+        # Close and delete the temp file.
+        os.close(self._temp_fd)
+        pathlib.Path(self._temp_fname).unlink()
+
+    # General success pattern when valid file contents is detected.
+    def successful_test_template(self, output_string, expected_version: utils.ApiVersion):
+        pathlib.Path(self._temp_fname).write_text(output_string)
+
+        # Read the string from the file, and parse the version.
+        version = utils.get_api_version(self._temp_fname)
+        self.assertEqual(expected_version, version)
+
+    # General failure pattern when invalid file contents is detected.
+    def failed_test_template(self, output_string, assertion_error_type):
+        pathlib.Path(self._temp_fname).write_text(output_string)
+
+        # Read the string from the file, and expect version parsing to fail.
+        with self.assertRaises(assertion_error_type,
+                               msg='The call to get_api_version should have thrown an exception'):
+            utils.get_api_version(self._temp_fname)
+
+    def test_valid_version(self):
+        self.successful_test_template('1.2.3', utils.ApiVersion(1, 2, 3))
+
+    def test_valid_version_newline(self):
+        self.successful_test_template('3.2.1\n', utils.ApiVersion(3, 2, 1))
+
+    def test_invalid_version_string(self):
+        self.failed_test_template('1.2.abc3', ValueError)
+
+    def test_invalid_version_partial(self):
+        self.failed_test_template('1.2.', ValueError)
+
+    def test_invalid_version_partial2(self):
+        self.failed_test_template('1.2', utils.ApiVersionParsingError)
+
+    def test_empty_file(self):
+        # Not writing anything to the file
+        self.failed_test_template('', utils.ApiVersionParsingError)
+
+    def test_invalid_multiple_lines(self):
+        self.failed_test_template('1.2.3\n1.2.3', utils.ApiVersionParsingError)
+
+    def test_valid_oldest_api_version(self):
+        expected_latest_oldest_pairs = [(utils.ApiVersion(3, 2, 2), utils.ApiVersion(3, 1, 0)),
+                                        (utils.ApiVersion(4, 5, 30), utils.ApiVersion(4, 4, 0)),
+                                        (utils.ApiVersion(1, 1, 5), utils.ApiVersion(1, 0, 0)),
+                                        (utils.ApiVersion(2, 0, 3), utils.ApiVersion(2, 0, 0))]
+
+        for latest_version, expected_oldest_version in expected_latest_oldest_pairs:
+            self.assertEqual(
+                expected_oldest_version, utils.compute_oldest_api_version(latest_version))
+
+    def test_valid_deprecated_version_annotation(self):
+        self.assertTrue(utils.is_deprecated_annotation_version('1.2'))
+
+    def test_zero_major_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version('0.2'))
+
+    def test_char_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version('1.2a'))
+
+    def test_patch_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version('1.2.3'))
+
+    def test_negative_minor_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version('1.-2'))
+
+    def test_missing_major_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version('.2'))
+
+    def test_single_number_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version('1'))
+
+    def test_empty_number_deprecated_version_annotation(self):
+        self.assertFalse(utils.is_deprecated_annotation_version(''))
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tools/proto_format/proto_sync.py b/tools/proto_format/proto_sync.py
index 8353d6f4142b..024e8435ed01 100755
--- a/tools/proto_format/proto_sync.py
+++ b/tools/proto_format/proto_sync.py
@@ -120,7 +120,8 @@ def proto_print(src, dst):
     subprocess.check_output([
         'bazel-bin/tools/protoxform/protoprint', src,
         str(dst),
-        './bazel-bin/tools/protoxform/protoprint.runfiles/envoy/tools/type_whisperer/api_type_db.pb_text'
+        './bazel-bin/tools/protoxform/protoprint.runfiles/envoy/tools/type_whisperer/api_type_db.pb_text',
+        'API_VERSION'
     ])
 
 
diff --git a/tools/protoxform/BUILD b/tools/protoxform/BUILD
index 37dac62fe052..5473b9d31d24 100644
--- a/tools/protoxform/BUILD
+++ b/tools/protoxform/BUILD
@@ -57,10 +57,12 @@ py_binary(
     ],
     data = [
         "//:.clang-format",
+        "//:API_VERSION",
         "//tools/type_whisperer:api_type_db.pb_text",
     ],
     visibility = ["//visibility:public"],
     deps = [
+        "//tools/api_versioning:utils",
         "//tools/type_whisperer",
         "//tools/type_whisperer:api_type_db_proto_py_proto",
         "@com_envoyproxy_protoc_gen_validate//validate:validate_py",
diff --git a/tools/protoxform/protoprint.py b/tools/protoxform/protoprint.py
index d7a1beb094ba..38c3b3e11338 100755
--- a/tools/protoxform/protoprint.py
+++ b/tools/protoxform/protoprint.py
@@ -5,7 +5,8 @@
 # See https://github.com/google/protobuf/blob/master/src/google/protobuf/descriptor.proto
 # for the underlying protos mentioned in this file.
 #
-# Usage: protoprint.py <source file path> <type database path>
+# Usage: protoprint.py <source file path> <type database path> <load type db path>
+#                      <api version file path>
 
 from collections import deque
 import copy
@@ -18,21 +19,25 @@
 import sys
 
 from tools.api_proto_plugin import annotations, traverse, visitor
+from tools.api_versioning import utils as api_version_utils
 from tools.protoxform import options as protoxform_options, utils
 from tools.type_whisperer import type_whisperer, types_pb2
 
 from google.protobuf import descriptor_pb2
 from google.protobuf import text_format
 
+from envoy.annotations import deprecation_pb2
 from udpa.annotations import migrate_pb2, status_pb2
 
 PROTO_PACKAGES = (
-    "google.api.annotations", "validate.validate", "envoy.annotations.deprecation",
-    "envoy.annotations.resource", "udpa.annotations.migrate", "udpa.annotations.security",
-    "udpa.annotations.status", "udpa.annotations.versioning", "udpa.annotations.sensitive")
+    "google.api.annotations", "validate.validate", "envoy.annotations.resource",
+    "udpa.annotations.migrate", "udpa.annotations.security", "udpa.annotations.status",
+    "udpa.annotations.versioning", "udpa.annotations.sensitive")
 
 NEXT_FREE_FIELD_MIN = 5
 
+ENVOY_DEPRECATED_UNAVIALABLE_NAME = 'DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE'
+
 
 class ProtoPrintError(Exception):
     """Base error class for the protoprint module."""
@@ -162,13 +167,16 @@ def format_type_context_comments(type_context, annotation_xforms=None):
     return leading, trailing
 
 
-def format_header_from_file(source_code_info, file_proto, empty_file):
+def format_header_from_file(
+        source_code_info, file_proto, empty_file, requires_deprecation_annotation):
     """Format proto header.
 
     Args:
         source_code_info: SourceCodeInfo object.
         file_proto: FileDescriptorProto for file.
         empty_file: are there no message/enum/service defs in file?
+        requires_deprecation_annotation: does the proto have the deprecated version annotation or
+                                         disallowed annotation.
 
     Returns:
         Formatted proto header as a string.
@@ -230,6 +238,10 @@ def camel_case(s):
         options.Extensions[status_pb2.file_status].CopyFrom(
             file_proto.options.Extensions[status_pb2.file_status])
 
+    frozen_proto = file_proto.options.HasExtension(
+        status_pb2.file_status) and file_proto.options.Extensions[
+            status_pb2.file_status].package_version_status == status_pb2.FROZEN
+
     if not empty_file:
         options.Extensions[
             status_pb2.file_status].package_version_status = file_proto.options.Extensions[
@@ -251,6 +263,10 @@ def camel_case(s):
             public_imports.append(d)
             continue
         elif d.startswith('envoy/annotations') or d.startswith('udpa/annotations'):
+            if d == 'envoy/annotations/deprecation.proto' and not frozen_proto:
+                # Skip adding, as deprecation proto should be added if
+                # import_deprecation_proto is True or the proto is frozen.
+                continue
             infra_imports.append(d)
         elif d.startswith('envoy/'):
             # We ignore existing envoy/ imports, since these are computed explicitly
@@ -266,6 +282,9 @@ def camel_case(s):
         else:
             misc_imports.append(d)
 
+    if requires_deprecation_annotation:
+        infra_imports.append('envoy/annotations/deprecation.proto')
+
     if options.HasExtension(status_pb2.file_status):
         infra_imports.append('udpa/annotations/status.proto')
 
@@ -563,6 +582,50 @@ class ProtoFormatVisitor(visitor.Visitor):
     See visitor.Visitor for visitor method docs comments.
     """
 
+    def __init__(self, api_version_file_path, frozen_proto):
+        current_api_version = api_version_utils.get_api_version(api_version_file_path)
+        self._deprecated_annotation_version_value = '{}.{}'.format(
+            current_api_version.major, current_api_version.minor)
+        self._requires_deprecation_annotation_import = False
+        self._frozen_proto = frozen_proto
+
+    def _add_deprecation_version(self, field_or_evalue, deprecation_tag, disallowed_tag):
+        """Adds a deprecation version annotation if needed to the given field or enum value.
+        The annotation is added if all the following hold:
+        - The field or enum value are marked as deprecated.
+        - The proto is not frozen.
+        - The field or enum value are not marked as hidden.
+        - The field or enum value do not already have a version annotation.
+        - The field or enum value name is not ENVOY_DEPRECATED_UNAVIALABLE_NAME.
+        If a field or enum value are marked with an annotation, the
+        _requires_deprecation_annotation_import flag is set.
+        The function also validates that if a field or enum value already have the deprecated
+        annotation value, then this value is a valid one ("X.Y" where X and Y are valid major,
+        and minor versions, respectively).
+        """
+        if field_or_evalue.options.deprecated and not self._frozen_proto and \
+                not protoxform_options.has_hide_option(field_or_evalue.options):
+            # If the field or enum value has annotation from deprecation.proto, need to import it.
+            self._requires_deprecation_annotation_import = (
+                self._requires_deprecation_annotation_import
+                or field_or_evalue.options.HasExtension(deprecation_tag)
+                or field_or_evalue.options.HasExtension(disallowed_tag))
+            if field_or_evalue.name != ENVOY_DEPRECATED_UNAVIALABLE_NAME:
+                # If there's a deprecated version annotation, ensure it is valid.
+                if field_or_evalue.options.HasExtension(deprecation_tag):
+                    if not api_version_utils.is_deprecated_annotation_version(
+                            field_or_evalue.options.Extensions[deprecation_tag]):
+                        raise ProtoPrintError(
+                            'Error while parsing "deprecated_at_minor_version_enum" annotation "%s" value for enum value %s.'
+                            % (
+                                field_or_evalue.options.Extensions[deprecation_tag],
+                                field_or_evalue.name))
+                else:
+                    # Add the current version as a deprecated version annotation.
+                    self._requires_deprecation_annotation_import = True
+                    field_or_evalue.options.Extensions[
+                        deprecation_tag] = self._deprecated_annotation_version_value
+
     def visit_service(self, service_proto, type_context):
         leading_comment, trailing_comment = format_type_context_comments(type_context)
         methods = '\n'.join(
@@ -575,6 +638,12 @@ def visit_service(self, service_proto, type_context):
     def visit_enum(self, enum_proto, type_context):
         if protoxform_options.has_hide_option(enum_proto.options):
             return ''
+        # Verify that not hidden deprecated enum values of non-frozen protos have valid version
+        # annotations.
+        for v in enum_proto.value:
+            self._add_deprecation_version(
+                v, deprecation_pb2.deprecated_at_minor_version_enum,
+                deprecation_pb2.disallowed_by_default_enum)
         leading_comment, trailing_comment = format_type_context_comments(type_context)
         formatted_options = format_options(enum_proto.options)
         reserved_fields = format_reserved(enum_proto)
@@ -621,6 +690,11 @@ def visit_message(self, msg_proto, type_context, nested_msgs, nested_enums):
                 fields += '%soneof %s {\n%s%s' % (
                     oneof_leading_comment, oneof_proto.name, oneof_trailing_comment,
                     format_options(oneof_proto.options))
+            # Verify that deprecated fields (that are not hidden and are not of frozen protos)
+            # have a minor version annotation.
+            self._add_deprecation_version(
+                field, deprecation_pb2.deprecated_at_minor_version,
+                deprecation_pb2.disallowed_by_default)
             fields += format_block(
                 format_field(type_context.extend_field(index, field.name), field))
         if oneof_index is not None:
@@ -631,7 +705,9 @@ def visit_message(self, msg_proto, type_context, nested_msgs, nested_enums):
 
     def visit_file(self, file_proto, type_context, services, msgs, enums):
         empty_file = len(services) == 0 and len(enums) == 0 and len(msgs) == 0
-        header = format_header_from_file(type_context.source_code_info, file_proto, empty_file)
+        header = format_header_from_file(
+            type_context.source_code_info, file_proto, empty_file,
+            self._requires_deprecation_annotation_import)
         formatted_services = format_block('\n'.join(services))
         formatted_enums = format_block('\n'.join(enums))
         formatted_msgs = format_block('\n'.join(msgs))
@@ -650,4 +726,8 @@ def visit_file(self, file_proto, type_context, services, msgs, enums):
     text_format.Merge(input_text, file_proto)
     dst_path = pathlib.Path(sys.argv[2])
     utils.load_type_db(sys.argv[3])
-    dst_path.write_bytes(traverse.traverse_file(file_proto, ProtoFormatVisitor()))
+    api_version_file_path = pathlib.Path(sys.argv[4])
+    frozen_proto = file_proto.options.Extensions[
+        status_pb2.file_status].package_version_status == status_pb2.FROZEN
+    dst_path.write_bytes(
+        traverse.traverse_file(file_proto, ProtoFormatVisitor(api_version_file_path, frozen_proto)))
diff --git a/tools/protoxform/protoxform_test_helper.py b/tools/protoxform/protoxform_test_helper.py
index 0d820591ca20..b36134ce3520 100755
--- a/tools/protoxform/protoxform_test_helper.py
+++ b/tools/protoxform/protoxform_test_helper.py
@@ -56,7 +56,8 @@ def proto_print(src, dst):
     print('proto_print %s -> %s' % (src, dst))
     subprocess.check_call([
         'bazel-bin/tools/protoxform/protoprint', src, dst,
-        './bazel-bin/tools/protoxform/protoprint.runfiles/envoy/tools/type_whisperer/api_type_db.pb_text'
+        './bazel-bin/tools/protoxform/protoprint.runfiles/envoy/tools/type_whisperer/api_type_db.pb_text',
+        './tools/testdata/protoxform/TEST_API_VERSION'
     ])
 
 
diff --git a/tools/testdata/protoxform/TEST_API_VERSION b/tools/testdata/protoxform/TEST_API_VERSION
new file mode 100644
index 000000000000..7c69a55dbb18
--- /dev/null
+++ b/tools/testdata/protoxform/TEST_API_VERSION
@@ -0,0 +1 @@
+3.7.0
diff --git a/tools/testdata/protoxform/envoy/active_non_terminal/v2/BUILD b/tools/testdata/protoxform/envoy/active_non_terminal/v2/BUILD
index 00f83f0bf1f7..3031a25f6bb6 100644
--- a/tools/testdata/protoxform/envoy/active_non_terminal/v2/BUILD
+++ b/tools/testdata/protoxform/envoy/active_non_terminal/v2/BUILD
@@ -6,5 +6,8 @@ proto_library(
     name = "freeze_protos",
     srcs = ["active_non_terminal.proto"],
     visibility = ["//visibility:public"],
-    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+    deps = [
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+        "@envoy_api//envoy/annotations:pkg",
+    ],
 )
diff --git a/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto b/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto
index 0e21d4700c62..241084d62a6e 100644
--- a/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto
+++ b/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto
@@ -2,11 +2,12 @@ syntax = "proto3";
 
 package envoy.active_non_terminal.v2;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 message ActiveNonTerminal {
-  int32 foo = 1 [deprecated = true];
+  int32 foo = 1 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
   int32 bar = 2;
 }
diff --git a/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.active_or_frozen.gold b/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.active_or_frozen.gold
index 859456d5bb8d..50b6993f398f 100644
--- a/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.active_or_frozen.gold
+++ b/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.active_or_frozen.gold
@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.active_non_terminal.v2;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 
 option java_package = "io.envoyproxy.envoy.active_non_terminal.v2";
@@ -10,7 +11,7 @@ option java_multiple_files = true;
 option (udpa.annotations.file_status).package_version_status = FROZEN;
 
 message ActiveNonTerminal {
-  int32 foo = 1 [deprecated = true];
+  int32 foo = 1 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
 
   int32 bar = 2;
 }
diff --git a/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.next_major_version_candidate.envoy_internal.gold b/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.next_major_version_candidate.envoy_internal.gold
index e351dc4331e1..34e9f4d7e6ea 100644
--- a/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.next_major_version_candidate.envoy_internal.gold
+++ b/tools/testdata/protoxform/envoy/active_non_terminal/v2/active_non_terminal.proto.next_major_version_candidate.envoy_internal.gold
@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.active_non_terminal.v3;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -14,7 +15,8 @@ message ActiveNonTerminal {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.active_non_terminal.v2.ActiveNonTerminal";
 
-  int32 hidden_envoy_deprecated_foo = 1 [deprecated = true];
+  int32 hidden_envoy_deprecated_foo = 1
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
 
   int32 bar = 2;
 }
diff --git a/tools/testdata/protoxform/envoy/frozen/v2/BUILD b/tools/testdata/protoxform/envoy/frozen/v2/BUILD
index 9226f3e71361..a8556bddea13 100644
--- a/tools/testdata/protoxform/envoy/frozen/v2/BUILD
+++ b/tools/testdata/protoxform/envoy/frozen/v2/BUILD
@@ -4,7 +4,13 @@ licenses(["notice"])  # Apache 2
 
 proto_library(
     name = "freeze_protos",
-    srcs = ["frozen.proto"],
+    srcs = [
+        "frozen.proto",
+        "frozen_versioned_deprecation.proto",
+    ],
     visibility = ["//visibility:public"],
-    deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
+    deps = [
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+        "@envoy_api//envoy/annotations:pkg",
+    ],
 )
diff --git a/tools/testdata/protoxform/envoy/frozen/v2/frozen.proto.next_major_version_candidate.envoy_internal.gold b/tools/testdata/protoxform/envoy/frozen/v2/frozen.proto.next_major_version_candidate.envoy_internal.gold
index fa0b405ec586..f67c7f33a378 100644
--- a/tools/testdata/protoxform/envoy/frozen/v2/frozen.proto.next_major_version_candidate.envoy_internal.gold
+++ b/tools/testdata/protoxform/envoy/frozen/v2/frozen.proto.next_major_version_candidate.envoy_internal.gold
@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.frozen.v3;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -15,5 +16,6 @@ message Frozen {
 
   int32 foo = 1;
 
-  int32 hidden_envoy_deprecated_bar = 2 [deprecated = true];
+  int32 hidden_envoy_deprecated_bar = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
 }
diff --git a/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto
new file mode 100644
index 000000000000..bf5e1efa7301
--- /dev/null
+++ b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto
@@ -0,0 +1,14 @@
+syntax = "proto3";
+
+package envoy.frozen.v2;
+
+import "envoy/annotations/deprecation.proto";
+import "udpa/annotations/status.proto";
+
+option (udpa.annotations.file_status).package_version_status = FROZEN;
+
+message FrozenVersionedDeprecation {
+  int32 foo = 1;
+  int32 bar = 2 [deprecated = true];
+  int32 baz = 3 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.5"];
+}
diff --git a/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.active_or_frozen.gold b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.active_or_frozen.gold
new file mode 100644
index 000000000000..521f4c3eda9a
--- /dev/null
+++ b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.active_or_frozen.gold
@@ -0,0 +1,19 @@
+syntax = "proto3";
+
+package envoy.frozen.v2;
+
+import "envoy/annotations/deprecation.proto";
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.frozen.v2";
+option java_outer_classname = "FrozenVersionedDeprecationProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = FROZEN;
+
+message FrozenVersionedDeprecation {
+  int32 foo = 1;
+
+  int32 bar = 2 [deprecated = true];
+
+  int32 baz = 3 [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.5"];
+}
diff --git a/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.next_major_version_candidate.envoy_internal.gold b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.next_major_version_candidate.envoy_internal.gold
new file mode 100644
index 000000000000..e82dc9bb6cee
--- /dev/null
+++ b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.next_major_version_candidate.envoy_internal.gold
@@ -0,0 +1,25 @@
+syntax = "proto3";
+
+package envoy.frozen.v3;
+
+import "envoy/annotations/deprecation.proto";
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.frozen.v3";
+option java_outer_classname = "FrozenVersionedDeprecationProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSION_CANDIDATE;
+
+message FrozenVersionedDeprecation {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.frozen.v2.FrozenVersionedDeprecation";
+
+  int32 foo = 1;
+
+  int32 hidden_envoy_deprecated_bar = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
+
+  int32 hidden_envoy_deprecated_baz = 3
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.5"];
+}
diff --git a/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.next_major_version_candidate.gold b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.next_major_version_candidate.gold
new file mode 100644
index 000000000000..fa99251cf279
--- /dev/null
+++ b/tools/testdata/protoxform/envoy/frozen/v2/frozen_versioned_deprecation.proto.next_major_version_candidate.gold
@@ -0,0 +1,22 @@
+syntax = "proto3";
+
+package envoy.frozen.v3;
+
+import "udpa/annotations/status.proto";
+import "udpa/annotations/versioning.proto";
+
+option java_package = "io.envoyproxy.envoy.frozen.v3";
+option java_outer_classname = "FrozenVersionedDeprecationProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSION_CANDIDATE;
+
+message FrozenVersionedDeprecation {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.frozen.v2.FrozenVersionedDeprecation";
+
+  reserved 2, 3;
+
+  reserved "bar", "baz";
+
+  int32 foo = 1;
+}
diff --git a/tools/testdata/protoxform/envoy/frozen/v3/BUILD b/tools/testdata/protoxform/envoy/frozen/v3/BUILD
index 9226f3e71361..39fb4eabe723 100644
--- a/tools/testdata/protoxform/envoy/frozen/v3/BUILD
+++ b/tools/testdata/protoxform/envoy/frozen/v3/BUILD
@@ -4,7 +4,10 @@ licenses(["notice"])  # Apache 2
 
 proto_library(
     name = "freeze_protos",
-    srcs = ["frozen.proto"],
+    srcs = [
+        "frozen.proto",
+        "frozen_versioned_deprecation.proto",
+    ],
     visibility = ["//visibility:public"],
     deps = ["@com_github_cncf_udpa//udpa/annotations:pkg"],
 )
diff --git a/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto b/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto
new file mode 100644
index 000000000000..e95fc725c6b7
--- /dev/null
+++ b/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto
@@ -0,0 +1,12 @@
+syntax = "proto3";
+
+package envoy.frozen.v3;
+
+import "udpa/annotations/status.proto";
+
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+message FrozenVersionedDeprecation {
+  int32 foo = 1;
+  reserved 2, 3;
+}
diff --git a/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.active_or_frozen.gold b/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.active_or_frozen.gold
new file mode 100644
index 000000000000..d280f1f632be
--- /dev/null
+++ b/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.active_or_frozen.gold
@@ -0,0 +1,16 @@
+syntax = "proto3";
+
+package envoy.frozen.v3;
+
+import "udpa/annotations/status.proto";
+
+option java_package = "io.envoyproxy.envoy.frozen.v3";
+option java_outer_classname = "FrozenVersionedDeprecationProto";
+option java_multiple_files = true;
+option (udpa.annotations.file_status).package_version_status = ACTIVE;
+
+message FrozenVersionedDeprecation {
+  reserved 2, 3;
+
+  int32 foo = 1;
+}
diff --git a/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.next_major_version_candidate.envoy_internal.gold b/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.next_major_version_candidate.envoy_internal.gold
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.next_major_version_candidate.gold b/tools/testdata/protoxform/envoy/frozen/v3/frozen_versioned_deprecation.proto.next_major_version_candidate.gold
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/tools/testdata/protoxform/envoy/v2/sample.proto b/tools/testdata/protoxform/envoy/v2/sample.proto
index be4b61a9230b..11644f1f46c6 100644
--- a/tools/testdata/protoxform/envoy/v2/sample.proto
+++ b/tools/testdata/protoxform/envoy/v2/sample.proto
@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.v2;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 
@@ -12,6 +13,9 @@ enum SomeEnum {
   FOO = 1;
   BAR = 2 [deprecated = true];
   BAZ = 3 [(udpa.annotations.enum_value_migrate).rename = "WOW"];
+  OLD = 4 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.6"];
+  DEP = 5 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
+  VERY_OLD = 6 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.5"];
 }
 
 message Sample {
@@ -27,4 +31,10 @@ message Sample {
   repeated Entry entries = 1;
   string will_deprecated = 2 [deprecated = true];
   string will_rename_compoent = 3 [(udpa.annotations.field_migrate).rename = "renamed_component"];
+  string old_deprecated = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.6"];
+  string new_deprecated = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
+  string very_old_deprecated = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.5"];
 }
diff --git a/tools/testdata/protoxform/envoy/v2/sample.proto.active_or_frozen.gold b/tools/testdata/protoxform/envoy/v2/sample.proto.active_or_frozen.gold
index 5c5fe19f4997..c20df5a51637 100644
--- a/tools/testdata/protoxform/envoy/v2/sample.proto.active_or_frozen.gold
+++ b/tools/testdata/protoxform/envoy/v2/sample.proto.active_or_frozen.gold
@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.v2;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/migrate.proto";
 import "udpa/annotations/status.proto";
 
@@ -11,12 +12,16 @@ option java_multiple_files = true;
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 enum SomeEnum {
-  DEFAULT = 0 [deprecated = true];
+  DEFAULT = 0 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
   FOO = 1;
-  BAR = 2 [deprecated = true];
+  BAR = 2 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
   BAZ = 3 [(udpa.annotations.enum_value_migrate).rename = "WOW"];
+  OLD = 4 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.6"];
+  DEP = 5 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
+  VERY_OLD = 6 [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.5"];
 }
 
+// [#next-free-field: 7]
 message Sample {
   enum DeprecateEnum {
     option deprecated = true;
@@ -33,7 +38,17 @@ message Sample {
 
   repeated Entry entries = 1;
 
-  string will_deprecated = 2 [deprecated = true];
+  string will_deprecated = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
 
   string will_rename_compoent = 3 [(udpa.annotations.field_migrate).rename = "renamed_component"];
+
+  string old_deprecated = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.6"];
+
+  string new_deprecated = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
+
+  string very_old_deprecated = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.5"];
 }
diff --git a/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.envoy_internal.gold b/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.envoy_internal.gold
index c9dbe1062f91..46cf693236ef 100644
--- a/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.envoy_internal.gold
+++ b/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.envoy_internal.gold
@@ -2,6 +2,7 @@ syntax = "proto3";
 
 package envoy.v3;
 
+import "envoy/annotations/deprecation.proto";
 import "udpa/annotations/status.proto";
 import "udpa/annotations/versioning.proto";
 
@@ -11,12 +12,21 @@ option java_multiple_files = true;
 option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSION_CANDIDATE;
 
 enum SomeEnum {
-  hidden_envoy_deprecated_DEFAULT = 0 [deprecated = true];
+  hidden_envoy_deprecated_DEFAULT = 0
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
   FOO = 1;
-  hidden_envoy_deprecated_BAR = 2 [deprecated = true];
+  hidden_envoy_deprecated_BAR = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
   WOW = 3;
+  hidden_envoy_deprecated_OLD = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.6"];
+  hidden_envoy_deprecated_DEP = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.7"];
+  hidden_envoy_deprecated_VERY_OLD = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version_enum) = "3.5"];
 }
 
+// [#next-free-field: 7]
 message Sample {
   option (udpa.annotations.versioning).previous_message_type = "envoy.v2.Sample";
 
@@ -37,7 +47,17 @@ message Sample {
 
   repeated Entry entries = 1;
 
-  string hidden_envoy_deprecated_will_deprecated = 2 [deprecated = true];
+  string hidden_envoy_deprecated_will_deprecated = 2
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
 
   string renamed_component = 3;
+
+  string hidden_envoy_deprecated_old_deprecated = 4
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.6"];
+
+  string hidden_envoy_deprecated_new_deprecated = 5
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.7"];
+
+  string hidden_envoy_deprecated_very_old_deprecated = 6
+      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.5"];
 }
diff --git a/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.gold b/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.gold
index 61ceb6463d14..0c07d7a04cd0 100644
--- a/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.gold
+++ b/tools/testdata/protoxform/envoy/v2/sample.proto.next_major_version_candidate.gold
@@ -11,15 +11,16 @@ option java_multiple_files = true;
 option (udpa.annotations.file_status).package_version_status = NEXT_MAJOR_VERSION_CANDIDATE;
 
 enum SomeEnum {
-  reserved 2;
+  reserved 2, 4, 5, 6;
 
-  reserved "BAR";
+  reserved "BAR", "OLD", "DEP", "VERY_OLD";
 
   DEPRECATED_AND_UNAVAILABLE_DO_NOT_USE = 0 [deprecated = true];
   FOO = 1;
   WOW = 3;
 }
 
+// [#next-free-field: 7]
 message Sample {
   option (udpa.annotations.versioning).previous_message_type = "envoy.v2.Sample";
 
@@ -31,9 +32,9 @@ message Sample {
     string value = 2;
   }
 
-  reserved 2;
+  reserved 2, 4, 5, 6;
 
-  reserved "will_deprecated";
+  reserved "will_deprecated", "old_deprecated", "new_deprecated", "very_old_deprecated";
 
   repeated Entry entries = 1;