CVE-2024-40632: Insufficient Information (NVD-CWE-noinfo)
value: Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-15T22:15Z
Repository: https://github.com/linkerd/linkerd2
Language: YAML
Files changed: charts/linkerd-control-plane/README.md, charts/linkerd-control-plane/values.yaml, charts/partials/templates/_proxy.tpl, cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml, cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml, cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml, cli/cmd/testdata/inject_contour.golden.yml, cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml, cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml, cli/cmd/testdata/inject_emojivoto_list.golden.yml, cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml, cli/cmd/testdata/inject_emojivoto_pod.golden.yml, cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml, cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml, cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml, cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml, cli/cmd/testdata/inject_gettest_deployment.good.golden.yml, cli/cmd/testdata/inject_tap_deployment_debug.golden.yml, cli/cmd/testdata/install_controlplane_tracing_output.golden, cli/cmd/testdata/install_custom_domain.golden, cli/cmd/testdata/install_custom_registry.golden, cli/cmd/testdata/install_default.golden, cli/cmd/testdata/install_default_override_dst_get_nets.golden, cli/cmd/testdata/install_default_token.golden, cli/cmd/testdata/install_gid_output.golden, cli/cmd/testdata/install_ha_output.golden, cli/cmd/testdata/install_ha_with_overrides_output.golden, cli/cmd/testdata/install_heartbeat_disabled_output.golden, cli/cmd/testdata/install_helm_control_plane_output.golden, cli/cmd/testdata/install_helm_control_plane_output_ha.golden, cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden, cli/cmd/testdata/install_helm_output_ha_labels.golden, cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden, cli/cmd/testdata/install_no_init_container.golden, cli/cmd/testdata/install_output.golden, cli/cmd/testdata/install_proxy_ignores.golden, cli/cmd/testdata/install_values_file.golden, controller/proxy-injector/fake/data/pod-with-debug.patch.json, controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json, controller/proxy-injector/fake/data/pod.patch.json, pkg/charts/linkerd2/values.go, pkg/inject/inject.go, pkg/k8s/labels.go
Commit date: 2024-06-14 09:55:15 -0700
Commit message: feat!: Add config to disable proxy /shutdown admin endpoint (#12705)

The proxy may expose a /shutdown HTTP endpoint on its admin server that may be used by `linkerd-await --shutdown` to trigger proxy shutdown after a process completes. If an application has an SSRF vulnerability, however, an attacker could use this endpoint to trigger proxy shutdown, causing a denial of service. This admin endpoint is only useful with linkerd-await; and this functionality is supplanted by Kubernetes Native Sidecars.

To address this potential issue, this change disables the proxy's admin endpoint by default. A helm value is introduced to support enabling the admin endpoint cluster-wide; and the `config.linkerd.io/proxy-admin-shutdown: enabled` annotation may be set to enable it the admin endpoint on an individual workload.

Signed-off-by: Alex Leong <alex@buoyant.io>
Diff: diff --git a/charts/linkerd-control-plane/README.md b/charts/linkerd-control-plane/README.md
index f69488440..47f44c1f7 100644
--- a/charts/linkerd-control-plane/README.md
+++ b/charts/linkerd-control-plane/README.md
@@ -239,10 +239,11 @@ Kubernetes: `>=1.22.0-0`
 | proxy.cores | int | `0` | The `cpu.limit` and `cores` should be kept in sync. The value of `cores` must be an integer and should typically be set by rounding up from the limit. E.g. if cpu.limit is '1500m', cores should be 2. |
 | proxy.defaultInboundPolicy | string | "all-unauthenticated" | The default allow policy to use when no `Server` selects a pod.  One of: "all-authenticated", "all-unauthenticated", "cluster-authenticated", "cluster-unauthenticated", "deny" |
 | proxy.disableInboundProtocolDetectTimeout | bool | `false` | When set to true, disables the protocol detection timeout on the inbound side of the proxy by setting it to a very high value |
 | proxy.disableOutboundProtocolDetectTimeout | bool | `false` | When set to true, disables the protocol detection timeout on the outbound side of the proxy by setting it to a very high value |
 | proxy.enableExternalProfiles | bool | `false` | Enable service profiles for non-Kubernetes services |
+| proxy.enableShutdownEndpoint | bool | `false` | Enables the proxy's /shutdown admin endpoint |
 | proxy.gid | int | `-1` | Optional customisation of the group id under which the proxy runs (the group ID will be omitted if lower than 0) |
 | proxy.image.name | string | `"cr.l5d.io/linkerd/proxy"` | Docker image for the proxy |
 | proxy.image.pullPolicy | string | imagePullPolicy | Pull policy for the proxy container image |
 | proxy.image.version | string | linkerdVersion | Tag for the proxy container image |
 | proxy.inbound.server.http2.keepAliveInterval | string | `"10s"` | The interval at which PINGs are issued to remote HTTP/2 clients. |
diff --git a/charts/linkerd-control-plane/values.yaml b/charts/linkerd-control-plane/values.yaml
index 07188fe22..72214320b 100644
--- a/charts/linkerd-control-plane/values.yaml
+++ b/charts/linkerd-control-plane/values.yaml
@@ -147,10 +147,12 @@ proxy:
     # @default -- imagePullPolicy
     pullPolicy: ""
     # -- Tag for the proxy container image
     # @default -- linkerdVersion
     version: ""
+  # -- Enables the proxy's /shutdown admin endpoint
+  enableShutdownEndpoint: false
   # -- Log level for the proxy
   logLevel: warn,linkerd=info,hickory=error
   # -- Log format (`plain` or `json`) for the proxy
   logFormat: plain
   # -- (`off` or `insecure`) If set to `off`, will prevent the proxy from
diff --git a/charts/partials/templates/_proxy.tpl b/charts/partials/templates/_proxy.tpl
index ea9363f49..a6bfdb9a2 100644
--- a/charts/partials/templates/_proxy.tpl
+++ b/charts/partials/templates/_proxy.tpl
@@ -29,10 +29,12 @@ env:
 {{ end -}}
 {{ if .Values.proxy.requireTLSOnInboundPorts -}}
 - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
   value: {{.Values.proxy.requireTLSOnInboundPorts | quote}}
 {{ end -}}
+- name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+  value: {{.Values.proxy.enableShutdownEndpoint | quote}}
 - name: LINKERD2_PROXY_LOG
   value: "{{.Values.proxy.logLevel}}{{ if not (eq .Values.proxy.logHTTPHeaders "insecure") }},linkerd_proxy_http::client[{headers}]=off{{ end }}"
 - name: LINKERD2_PROXY_LOG_FORMAT
   value: {{.Values.proxy.logFormat | quote}}
 - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
index 43048d681..7512beced 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx.yaml
@@ -30,10 +30,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
index 24151e38a..2cef3d0cb 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_nginx_redis.yaml
@@ -30,10 +30,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -265,10 +267,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
index a16217902..84d60d3eb 100644
--- a/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
+++ b/cli/cmd/testdata/inject-filepath/expected/injected_redis.yaml
@@ -30,10 +30,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_contour.golden.yml b/cli/cmd/testdata/inject_contour.golden.yml
index 5e6d74f59..1eadf9825 100644
--- a/cli/cmd/testdata/inject_contour.golden.yml
+++ b/cli/cmd/testdata/inject_contour.golden.yml
@@ -38,10 +38,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
index f5457a0d2..601c0c69c 100644
--- a/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_already_injected.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -278,10 +280,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -524,10 +528,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -770,10 +776,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
index 4ece96572..dc73ff638 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
index 69423717f..173f2c388 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_access_log.golden.yml
@@ -33,10 +33,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
index 57a244c8d..c9fe281ce 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_automountServiceAccountToken_false.golden.yml
@@ -33,10 +33,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
index 492b96f78..abb4dcb2c 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_capabilities.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
index 3edb05d76..9a0f93a64 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_config_overrides.golden.yml
@@ -42,10 +42,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_CORES
           value: "1"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
index d06fcb2ec..77de4b77e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_controller_name.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -278,10 +280,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
index 283d71818..65a195bea 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_debug.golden.yml
@@ -33,10 +33,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
index 09080b512..9ee818825 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_empty_resources.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
index f9814cbb7..6fb718c6d 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_hostNetwork_false.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
index af8dd8e8b..0e9b29186 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_native_sidecar.golden.yml
@@ -87,10 +87,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
index d01ee515f..8ad9d8c0e 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_no_init_container.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
index 5c93fb956..9b4443cd2 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_opaque_ports.golden.yml
@@ -33,10 +33,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
index 9a22b219f..3bfdba0ed 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_overridden.golden.yml
@@ -33,10 +33,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
index bb77c23fc..10d709425 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_params.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
index f66265f70..0a490eee1 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_proxyignores.golden.yml
@@ -34,10 +34,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
index 16ace78c3..9b8446390 100644
--- a/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_deployment_udp.golden.yml
@@ -32,10 +32,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_list.golden.yml b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
index 1ec11eb39..6903e9625 100644
--- a/cli/cmd/testdata/inject_emojivoto_list.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list.golden.yml
@@ -34,10 +34,12 @@ items:
                 fieldPath: metadata.namespace
           - name: _pod_nodeName
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
+          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+            value: "false"
           - name: LINKERD2_PROXY_LOG
             value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -279,10 +281,12 @@ items:
                 fieldPath: metadata.namespace
           - name: _pod_nodeName
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
+          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+            value: "false"
           - name: LINKERD2_PROXY_LOG
             value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
index 4b57bf5cf..54b3c6512 100644
--- a/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_list_empty_resources.golden.yml
@@ -34,10 +34,12 @@ items:
                 fieldPath: metadata.namespace
           - name: _pod_nodeName
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
+          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+            value: "false"
           - name: LINKERD2_PROXY_LOG
             value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -279,10 +281,12 @@ items:
                 fieldPath: metadata.namespace
           - name: _pod_nodeName
             valueFrom:
               fieldRef:
                 fieldPath: spec.nodeName
+          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+            value: "false"
           - name: LINKERD2_PROXY_LOG
             value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
           - name: LINKERD2_PROXY_LOG_FORMAT
             value: plain
           - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
index 3dcd4c88d..68d3b574c 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod.golden.yml
@@ -24,10 +24,12 @@ spec:
           fieldPath: metadata.namespace
     - name: _pod_nodeName
       valueFrom:
         fieldRef:
           fieldPath: spec.nodeName
+    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+      value: "false"
     - name: LINKERD2_PROXY_LOG
       value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
index f2b67aa2b..df73a73f9 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_ingress.golden.yml
@@ -25,10 +25,12 @@ spec:
           fieldPath: metadata.namespace
     - name: _pod_nodeName
       valueFrom:
         fieldRef:
           fieldPath: spec.nodeName
+    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+      value: "false"
     - name: LINKERD2_PROXY_LOG
       value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
index 6dbb101c2..1def79ac1 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_proxyignores.golden.yml
@@ -26,10 +26,12 @@ spec:
           fieldPath: metadata.namespace
     - name: _pod_nodeName
       valueFrom:
         fieldRef:
           fieldPath: spec.nodeName
+    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+      value: "false"
     - name: LINKERD2_PROXY_LOG
       value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
index 34f67b1a4..4ac568027 100644
--- a/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_pod_with_requests.golden.yml
@@ -28,10 +28,12 @@ spec:
           fieldPath: metadata.namespace
     - name: _pod_nodeName
       valueFrom:
         fieldRef:
           fieldPath: spec.nodeName
+    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+      value: "false"
     - name: LINKERD2_PROXY_LOG
       value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
     - name: LINKERD2_PROXY_LOG_FORMAT
       value: plain
     - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
index a768c3ef6..d408c9c84 100644
--- a/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
+++ b/cli/cmd/testdata/inject_emojivoto_statefulset.golden.yml
@@ -33,10 +33,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
index 306df44de..217ff2e57 100644
--- a/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
+++ b/cli/cmd/testdata/inject_gettest_deployment.good.golden.yml
@@ -28,10 +28,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -276,10 +278,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
index b3212e6b7..24aa752b1 100644
--- a/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
+++ b/cli/cmd/testdata/inject_tap_deployment_debug.golden.yml
@@ -49,10 +49,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: plain
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_controlplane_tracing_output.golden b/cli/cmd/testdata/install_controlplane_tracing_output.golden
index 1af9f12e4..056acf13f 100644
--- a/cli/cmd/testdata/install_controlplane_tracing_output.golden
+++ b/cli/cmd/testdata/install_controlplane_tracing_output.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -983,10 +984,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1332,10 +1335,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1783,10 +1788,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_custom_domain.golden b/cli/cmd/testdata/install_custom_domain.golden
index c96790e79..cd6fd0279 100644
--- a/cli/cmd/testdata/install_custom_domain.golden
+++ b/cli/cmd/testdata/install_custom_domain.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1331,10 +1334,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1781,10 +1786,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_custom_registry.golden b/cli/cmd/testdata/install_custom_registry.golden
index 9a577a260..3c584f041 100644
--- a/cli/cmd/testdata/install_custom_registry.golden
+++ b/cli/cmd/testdata/install_custom_registry.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: my.custom.registry/linkerd-io/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1331,10 +1334,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1781,10 +1786,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_default.golden b/cli/cmd/testdata/install_default.golden
index c96790e79..cd6fd0279 100644
--- a/cli/cmd/testdata/install_default.golden
+++ b/cli/cmd/testdata/install_default.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1331,10 +1334,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1781,10 +1786,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_default_override_dst_get_nets.golden b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
index b5aa60f1f..5f7b4d938 100644
--- a/cli/cmd/testdata/install_default_override_dst_get_nets.golden
+++ b/cli/cmd/testdata/install_default_override_dst_get_nets.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1331,10 +1334,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1781,10 +1786,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_default_token.golden b/cli/cmd/testdata/install_default_token.golden
index c3c226241..ed80487e1 100644
--- a/cli/cmd/testdata/install_default_token.golden
+++ b/cli/cmd/testdata/install_default_token.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1322,10 +1325,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1763,10 +1768,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_gid_output.golden b/cli/cmd/testdata/install_gid_output.golden
index 38398fae5..fcb299049 100755
--- a/cli/cmd/testdata/install_gid_output.golden
+++ b/cli/cmd/testdata/install_gid_output.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: 4321
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -983,10 +984,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1335,10 +1338,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1792,10 +1797,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_ha_output.golden b/cli/cmd/testdata/install_ha_output.golden
index 705f152ad..8b401bd92 100644
--- a/cli/cmd/testdata/install_ha_output.golden
+++ b/cli/cmd/testdata/install_ha_output.golden
@@ -691,10 +691,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -1059,10 +1060,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1448,10 +1451,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1934,10 +1939,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_ha_with_overrides_output.golden b/cli/cmd/testdata/install_ha_with_overrides_output.golden
index 104f85403..bf83fe918 100644
--- a/cli/cmd/testdata/install_ha_with_overrides_output.golden
+++ b/cli/cmd/testdata/install_ha_with_overrides_output.golden
@@ -691,10 +691,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -1059,10 +1060,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1448,10 +1451,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1934,10 +1939,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_heartbeat_disabled_output.golden b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
index fae26e94a..1fb3aa9fe 100644
--- a/cli/cmd/testdata/install_heartbeat_disabled_output.golden
+++ b/cli/cmd/testdata/install_heartbeat_disabled_output.golden
@@ -595,10 +595,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -913,10 +914,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1262,10 +1265,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1652,10 +1657,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_control_plane_output.golden b/cli/cmd/testdata/install_helm_control_plane_output.golden
index daa6266f2..7d8ae0c62 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output.golden
@@ -641,10 +641,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -955,10 +956,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1306,10 +1309,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1760,10 +1765,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
index cd07e0102..816cd88b4 100644
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha.golden
@@ -668,10 +668,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -1032,10 +1033,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1423,10 +1426,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1913,10 +1918,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
index a217d5a5b..c7c6ec105 100755
--- a/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
+++ b/cli/cmd/testdata/install_helm_control_plane_output_ha_with_gid.golden
@@ -668,10 +668,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: 4231
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -1033,10 +1034,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1427,10 +1430,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1924,10 +1929,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_output_ha_labels.golden b/cli/cmd/testdata/install_helm_output_ha_labels.golden
index 31980bd89..1b28b8c0b 100644
--- a/cli/cmd/testdata/install_helm_output_ha_labels.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_labels.golden
@@ -672,10 +672,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -1040,10 +1041,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1435,10 +1438,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1933,10 +1938,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
index cbdf31faa..448fdbe06 100644
--- a/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
+++ b/cli/cmd/testdata/install_helm_output_ha_namespace_selector.golden
@@ -663,10 +663,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -1022,10 +1023,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1413,10 +1416,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1903,10 +1908,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_no_init_container.golden b/cli/cmd/testdata/install_no_init_container.golden
index e2b182045..7c4a90d57 100644
--- a/cli/cmd/testdata/install_no_init_container.golden
+++ b/cli/cmd/testdata/install_no_init_container.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1324,10 +1327,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1767,10 +1772,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_output.golden b/cli/cmd/testdata/install_output.golden
index b6ea96abe..13a2868b2 100644
--- a/cli/cmd/testdata/install_output.golden
+++ b/cli/cmd/testdata/install_output.golden
@@ -630,10 +630,11 @@ data:
       control: null
       defaultInboundPolicy: default-allow-policy
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: 2102
       image:
         name: ProxyImageName
         pullPolicy: ImagePullPolicy
@@ -932,10 +933,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1272,10 +1275,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1723,10 +1728,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_proxy_ignores.golden b/cli/cmd/testdata/install_proxy_ignores.golden
index 333402cd7..ffc464a9f 100644
--- a/cli/cmd/testdata/install_proxy_ignores.golden
+++ b/cli/cmd/testdata/install_proxy_ignores.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1331,10 +1334,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1781,10 +1786,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/cli/cmd/testdata/install_values_file.golden b/cli/cmd/testdata/install_values_file.golden
index 7aaf06c21..6d0f81acc 100644
--- a/cli/cmd/testdata/install_values_file.golden
+++ b/cli/cmd/testdata/install_values_file.golden
@@ -664,10 +664,11 @@ data:
           lifetime: 1h
       defaultInboundPolicy: all-unauthenticated
       disableInboundProtocolDetectTimeout: false
       disableOutboundProtocolDetectTimeout: false
       enableExternalProfiles: false
+      enableShutdownEndpoint: false
       experimentalEnv: null
       gid: -1
       image:
         name: cr.l5d.io/linkerd/proxy
         pullPolicy: ""
@@ -982,10 +983,12 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
         - name: LINKERD2_PROXY_INBOUND_PORTS_REQUIRE_TLS
           value: "8080"
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1331,10 +1334,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
@@ -1781,10 +1786,12 @@ spec:
               fieldPath: metadata.namespace
         - name: _pod_nodeName
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
+        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
+          value: "false"
         - name: LINKERD2_PROXY_LOG
           value: "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         - name: LINKERD2_PROXY_LOG_FORMAT
           value: "plain"
         - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
diff --git a/controller/proxy-injector/fake/data/pod-with-debug.patch.json b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
index 06cf4d225..ba82e0c71 100644
--- a/controller/proxy-injector/fake/data/pod-with-debug.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-debug.patch.json
@@ -177,10 +177,14 @@
             "fieldRef": {
               "fieldPath": "spec.nodeName"
             }
           }
         },
+        {
+          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
+          "value": "false"
+        },
         {
           "name": "LINKERD2_PROXY_LOG",
           "value": "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         },
         {
diff --git a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
index deceb9772..a814c6617 100644
--- a/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
+++ b/controller/proxy-injector/fake/data/pod-with-ns-annotations.patch.json
@@ -163,10 +163,14 @@
             "fieldRef": {
               "fieldPath": "spec.nodeName"
             }
           }
         },
+        {
+          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
+          "value": "false"
+        },
         {
           "name": "LINKERD2_PROXY_LOG",
           "value": "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         },
         {
diff --git a/controller/proxy-injector/fake/data/pod.patch.json b/controller/proxy-injector/fake/data/pod.patch.json
index 067c1dee6..d6cead305 100644
--- a/controller/proxy-injector/fake/data/pod.patch.json
+++ b/controller/proxy-injector/fake/data/pod.patch.json
@@ -153,10 +153,14 @@
             "fieldRef": {
               "fieldPath": "spec.nodeName"
             }
           }
         },
+        {
+          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
+          "value": "false"
+        },
         {
           "name": "LINKERD2_PROXY_LOG",
           "value": "warn,linkerd=info,hickory=error,linkerd_proxy_http::client[{headers}]=off"
         },
         {
diff --git a/pkg/charts/linkerd2/values.go b/pkg/charts/linkerd2/values.go
index 6371b388a..2949c418e 100644
--- a/pkg/charts/linkerd2/values.go
+++ b/pkg/charts/linkerd2/values.go
@@ -113,10 +113,11 @@ type (
 		Capabilities *Capabilities `json:"capabilities"`
 		// This should match .Resources.CPU.Limit, but must be a whole number
 		Cores                                int64            `json:"cores,omitempty"`
 		EnableExternalProfiles               bool             `json:"enableExternalProfiles"`
 		Image                                *Image           `json:"image"`
+		EnableShutdownEndpoint               bool             `json:"enableShutdownEndpoint"`
 		LogLevel                             string           `json:"logLevel"`
 		LogFormat                            string           `json:"logFormat"`
 		LogHTTPHeaders                       string           `json:"logHTTPHeaders"`
 		SAMountPath                          *VolumeMountPath `json:"saMountPath"`
 		Ports                                *Ports           `json:"ports"`
diff --git a/pkg/inject/inject.go b/pkg/inject/inject.go
index 8325a5f34..0168edbd7 100644
--- a/pkg/inject/inject.go
+++ b/pkg/inject/inject.go
@@ -52,10 +52,11 @@ var (
 		k8s.ProxyOutboundPortAnnotation,
 		k8s.ProxyPodInboundPortsAnnotation,
 		k8s.ProxyCPULimitAnnotation,
 		k8s.ProxyCPURequestAnnotation,
 		k8s.ProxyImageAnnotation,
+		k8s.ProxyAdminShutdownAnnotation,
 		k8s.ProxyLogFormatAnnotation,
 		k8s.ProxyLogLevelAnnotation,
 		k8s.ProxyLogHTTPHeaders,
 		k8s.ProxyMemoryLimitAnnotation,
 		k8s.ProxyMemoryRequestAnnotation,
@@ -249,10 +250,18 @@ func applyAnnotationOverrides(values *l5dcharts.Values, annotations map[string]s
 
 	if override, ok := annotations[k8s.ProxyPodInboundPortsAnnotation]; ok {
 		values.Proxy.PodInboundPorts = override
 	}
 
+	if override, ok := annotations[k8s.ProxyAdminShutdownAnnotation]; ok {
+		if override == k8s.Enabled || override == k8s.Disabled {
+			values.Proxy.EnableShutdownEndpoint = override == k8s.Enabled
+		} else {
+			log.Warnf("unrecognized value used for the %s annotation, valid values are: [%s, %s]", k8s.ProxyAdminShutdownAnnotation, k8s.Enabled, k8s.Disabled)
+		}
+	}
+
 	if override, ok := annotations[k8s.ProxyLogLevelAnnotation]; ok {
 		values.Proxy.LogLevel = override
 	}
 
 	if override, ok := annotations[k8s.ProxyLogHTTPHeaders]; ok {
diff --git a/pkg/k8s/labels.go b/pkg/k8s/labels.go
index f26d2d38d..ee2558992 100644
--- a/pkg/k8s/labels.go
+++ b/pkg/k8s/labels.go
@@ -207,10 +207,14 @@ const (
 	ProxyUIDAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-uid"
 
 	// ProxyGIDAnnotation can be used to override the GID config.
 	ProxyGIDAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-gid"
 
+	// ProxyAdminShutdownAnnotation can be used to override the
+	// LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED config.
+	ProxyAdminShutdownAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-admin-shutdown"
+
 	// ProxyLogLevelAnnotation can be used to override the log level config.
 	ProxyLogLevelAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-log-level"
 
 	// ProxyLogHTTPHeaders can be used to override if the proxy is permitted to log HTTP headers.
 	ProxyLogHTTPHeaders = ProxyConfigAnnotationsPrefix + "/proxy-log-http-headers"

Fixed code: | proxy.enableShutdownEndpoint | bool | `false` | Enables the proxy's /shutdown admin endpoint |
  # -- Enables the proxy's /shutdown admin endpoint
  enableShutdownEndpoint: false
- name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
  value: {{.Values.proxy.enableShutdownEndpoint | quote}}
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
          - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
            value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
    - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
      value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
      enableShutdownEndpoint: false
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        - name: LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED
          value: "false"
        {
          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
          "value": "false"
        },
        {
          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
          "value": "false"
        },
        {
          "name": "LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED",
          "value": "false"
        },
		EnableShutdownEndpoint               bool             `json:"enableShutdownEndpoint"`
		k8s.ProxyAdminShutdownAnnotation,
	if override, ok := annotations[k8s.ProxyAdminShutdownAnnotation]; ok {
		if override == k8s.Enabled || override == k8s.Disabled {
			values.Proxy.EnableShutdownEndpoint = override == k8s.Enabled
		} else {
			log.Warnf("unrecognized value used for the %s annotation, valid values are: [%s, %s]", k8s.ProxyAdminShutdownAnnotation, k8s.Enabled, k8s.Disabled)
		}
	}

	// ProxyAdminShutdownAnnotation can be used to override the
	// LINKERD2_PROXY_SHUTDOWN_ENDPOINT_ENABLED config.
	ProxyAdminShutdownAnnotation = ProxyConfigAnnotationsPrefix + "/proxy-admin-shutdown"