diff --git a/charts/consul/templates/crd-ingressgateways.yaml b/charts/consul/templates/crd-ingressgateways.yaml
index f14789e83d..1a241a9cfb 100644
--- a/charts/consul/templates/crd-ingressgateways.yaml
+++ b/charts/consul/templates/crd-ingressgateways.yaml
@@ -57,6 +57,19 @@ spec:
           spec:
             description: IngressGatewaySpec defines the desired state of IngressGateway.
             properties:
+              defaults:
+                description: Defaults is default configuration for all upstream services
+                properties:
+                  maxConcurrentRequests:
+                    format: int32
+                    type: integer
+                  maxConnections:
+                    format: int32
+                    type: integer
+                  maxPendingRequests:
+                    format: int32
+                    type: integer
+                type: object
               listeners:
                 description: Listeners declares what ports the ingress gateway should
                   listen on, and what services to associated to those ports.
@@ -98,6 +111,15 @@ spec:
                             items:
                               type: string
                             type: array
+                          maxConcurrentRequests:
+                            format: int32
+                            type: integer
+                          maxConnections:
+                            format: int32
+                            type: integer
+                          maxPendingRequests:
+                            format: int32
+                            type: integer
                           name:
                             description: "Name declares the service to which traffic
                               should be forwarded. \n This can either be a specific
diff --git a/control-plane/api/v1alpha1/ingressgateway_types.go b/control-plane/api/v1alpha1/ingressgateway_types.go
index 7251608223..6051c4664b 100644
--- a/control-plane/api/v1alpha1/ingressgateway_types.go
+++ b/control-plane/api/v1alpha1/ingressgateway_types.go
@@ -57,6 +57,15 @@ type IngressGatewaySpec struct {
 	// Listeners declares what ports the ingress gateway should listen on, and
 	// what services to associated to those ports.
 	Listeners []IngressListener `json:"listeners,omitempty"`
+
+	// Defaults is default configuration for all upstream services
+	Defaults *IngressServiceConfig `json:"defaults,omitempty"`
+}
+
+type IngressServiceConfig struct {
+	MaxConnections        *uint32 `json:"maxConnections,omitempty"`
+	MaxPendingRequests    *uint32 `json:"maxPendingRequests,omitempty"`
+	MaxConcurrentRequests *uint32 `json:"maxConcurrentRequests,omitempty"`
 }
 
 type GatewayTLSConfig struct {
@@ -144,6 +153,10 @@ type IngressService struct {
 	// Allow HTTP header manipulation to be configured.
 	RequestHeaders  *HTTPHeaderModifiers `json:"requestHeaders,omitempty"`
 	ResponseHeaders *HTTPHeaderModifiers `json:"responseHeaders,omitempty"`
+
+	MaxConnections        *uint32 `json:"maxConnections,omitempty"`
+	MaxPendingRequests    *uint32 `json:"maxPendingRequests,omitempty"`
+	MaxConcurrentRequests *uint32 `json:"maxConcurrentRequests,omitempty"`
 }
 
 func (in *IngressGateway) GetObjectMeta() metav1.ObjectMeta {
diff --git a/control-plane/api/v1alpha1/zz_generated.deepcopy.go b/control-plane/api/v1alpha1/zz_generated.deepcopy.go
index 8e96bdf0c2..37cab374e5 100644
--- a/control-plane/api/v1alpha1/zz_generated.deepcopy.go
+++ b/control-plane/api/v1alpha1/zz_generated.deepcopy.go
@@ -383,6 +383,11 @@ func (in *IngressGatewaySpec) DeepCopyInto(out *IngressGatewaySpec) {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
 	}
+	if in.Defaults != nil {
+		in, out := &in.Defaults, &out.Defaults
+		*out = new(IngressServiceConfig)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressGatewaySpec.
@@ -445,6 +450,21 @@ func (in *IngressService) DeepCopyInto(out *IngressService) {
 		*out = new(HTTPHeaderModifiers)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.MaxConnections != nil {
+		in, out := &in.MaxConnections, &out.MaxConnections
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxPendingRequests != nil {
+		in, out := &in.MaxPendingRequests, &out.MaxPendingRequests
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxConcurrentRequests != nil {
+		in, out := &in.MaxConcurrentRequests, &out.MaxConcurrentRequests
+		*out = new(uint32)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressService.
@@ -457,6 +477,36 @@ func (in *IngressService) DeepCopy() *IngressService {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *IngressServiceConfig) DeepCopyInto(out *IngressServiceConfig) {
+	*out = *in
+	if in.MaxConnections != nil {
+		in, out := &in.MaxConnections, &out.MaxConnections
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxPendingRequests != nil {
+		in, out := &in.MaxPendingRequests, &out.MaxPendingRequests
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxConcurrentRequests != nil {
+		in, out := &in.MaxConcurrentRequests, &out.MaxConcurrentRequests
+		*out = new(uint32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IngressServiceConfig.
+func (in *IngressServiceConfig) DeepCopy() *IngressServiceConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(IngressServiceConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *IntentionDestination) DeepCopyInto(out *IntentionDestination) {
 	*out = *in
diff --git a/control-plane/config/crd/bases/consul.hashicorp.com_ingressgateways.yaml b/control-plane/config/crd/bases/consul.hashicorp.com_ingressgateways.yaml
index 6378ee4213..9934e9c0d9 100644
--- a/control-plane/config/crd/bases/consul.hashicorp.com_ingressgateways.yaml
+++ b/control-plane/config/crd/bases/consul.hashicorp.com_ingressgateways.yaml
@@ -50,6 +50,19 @@ spec:
           spec:
             description: IngressGatewaySpec defines the desired state of IngressGateway.
             properties:
+              defaults:
+                description: Defaults is default configuration for all upstream services
+                properties:
+                  maxConcurrentRequests:
+                    format: int32
+                    type: integer
+                  maxConnections:
+                    format: int32
+                    type: integer
+                  maxPendingRequests:
+                    format: int32
+                    type: integer
+                type: object
               listeners:
                 description: Listeners declares what ports the ingress gateway should
                   listen on, and what services to associated to those ports.
@@ -91,6 +104,15 @@ spec:
                             items:
                               type: string
                             type: array
+                          maxConcurrentRequests:
+                            format: int32
+                            type: integer
+                          maxConnections:
+                            format: int32
+                            type: integer
+                          maxPendingRequests:
+                            format: int32
+                            type: integer
                           name:
                             description: "Name declares the service to which traffic
                               should be forwarded. \n This can either be a specific