Repository: envoyproxy/gateway

Issue:
Add an Enterprise or Support section to the documentation site
*Description*:
Add an Enterprise or Support section to the documentation site, similar to other CNCF projects like Fluentd, Cilium and OPA.

The purpose of the section is to help adopters who want to get Enterprise support and/or training for Envoy Gateway.
If listed on this section of the Envoy Gateway docs, it should be made clear if the vendor is providing support for 100% upstream version of EG. 

*Relevant Links*:
https://www.fluentd.org/enterprise_services
https://cilium.io/enterprise/
https://www.openpolicyagent.org/support/


Hints from issue comments:
@Manoramsharma: @missBerg Your idea of introducing an Enterprise section is excellent. I can work on this if someone provides a complete list of our adopters, so I can ensure the section is comprehensive and accurate.@github-actions: This issue has been automatically marked as stale because it has not had activity in the last 30 days.

Solution patch:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1b06e1c85..9e2d0ad5f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -96,7 +96,7 @@ jobs:
           zip -r egctl_${{ env.release_tag }}_windows_amd64.zip bin/windows/amd64/egctl
 
       - name: Upload Release Manifests
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8  # v2.3.2
+        uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836  # v2.3.3
         with:
           files: |
             release-artifacts/install.yaml
diff --git a/VERSION b/VERSION
index 53b5bbb12..a503124bd 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-v1.5.1
+v1.5.2
diff --git a/api/v1alpha1/authorization_types.go b/api/v1alpha1/authorization_types.go
index 0ba7cf9c8..168cd77da 100644
--- a/api/v1alpha1/authorization_types.go
+++ b/api/v1alpha1/authorization_types.go
@@ -190,7 +190,7 @@ type JWTClaim struct {
 	// If multiple values are specified, one of the values must match for the rule to match.
 	//
 	// +kubebuilder:validation:MinItems=1
-	// +kubebuilder:validation:MaxItems=16
+	// +kubebuilder:validation:MaxItems=128
 	Values []string `json:"values"`
 }
 
diff --git a/api/v1alpha1/oidc_types.go b/api/v1alpha1/oidc_types.go
index 23f84ae2b..be39467eb 100644
--- a/api/v1alpha1/oidc_types.go
+++ b/api/v1alpha1/oidc_types.go
@@ -130,6 +130,12 @@ type OIDC struct {
 	// +optional
 	DefaultRefreshTokenTTL *gwapiv1.Duration `json:"defaultRefreshTokenTTL,omitempty"`
 
+	// Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
+	// This option should only be used in secure environments where token encryption is not required.
+	// Default is false (tokens are encrypted).
+	// +optional
+	DisableTokenEncryption *bool `json:"disableTokenEncryption,omitempty"`
+
 	// Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless
 	// explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.
 	//
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 9884d1df7..e00a54f44 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -4836,6 +4836,11 @@ func (in *OIDC) DeepCopyInto(out *OIDC) {
 		*out = new(v1.Duration)
 		**out = **in
 	}
+	if in.DisableTokenEncryption != nil {
+		in, out := &in.DisableTokenEncryption, &out.DisableTokenEncryption
+		*out = new(bool)
+		**out = **in
+	}
 	if in.PassThroughAuthHeader != nil {
 		in, out := &in.PassThroughAuthHeader, &out.PassThroughAuthHeader
 		*out = new(bool)
diff --git a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
index ed62618c3..aeb431d0e 100644
--- a/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -340,7 +340,7 @@ spec:
                                           If multiple values are specified, one of the values must match for the rule to match.
                                         items:
                                           type: string
-                                        maxItems: 16
+                                        maxItems: 128
                                         minItems: 1
                                         type: array
                                     required:
@@ -4013,6 +4013,12 @@ spec:
                     required:
                     - headers
                     type: object
+                  disableTokenEncryption:
+                    description: |-
+                      Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
+                      This option should only be used in secure environments where token encryption is not required.
+                      Default is false (tokens are encrypted).
+                    type: boolean
                   forwardAccessToken:
                     description: |-
                       ForwardAccessToken indicates whether the Envoy should forward the access token
diff --git a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
index 2a5654e44..1d0965158 100644
--- a/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
+++ b/charts/gateway-helm/crds/generated/gateway.envoyproxy.io_securitypolicies.yaml
@@ -339,7 +339,7 @@ spec:
                                           If multiple values are specified, one of the values must match for the rule to match.
                                         items:
                                           type: string
-                                        maxItems: 16
+                                        maxItems: 128
                                         minItems: 1
                                         type: array
                                     required:
@@ -4012,6 +4012,12 @@ spec:
                     required:
                     - headers
                     type: object
+                  disableTokenEncryption:
+                    description: |-
+                      Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
+                      This option should only be used in secure environments where token encryption is not required.
+                      Default is false (tokens are encrypted).
+                    type: boolean
                   forwardAccessToken:
                     description: |-
                       ForwardAccessToken indicates whether the Envoy should forward the access token
diff --git a/examples/extension-server/go.mod b/examples/extension-server/go.mod
index 0a99b42e2..7bd3adbe8 100644
--- a/examples/extension-server/go.mod
+++ b/examples/extension-server/go.mod
@@ -4,8 +4,8 @@ go 1.24.7
 
 require (
 	github.com/envoyproxy/gateway v1.3.1
-	github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d
-	github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d
+	github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f
+	github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f
 	github.com/urfave/cli/v2 v2.27.7
 	google.golang.org/grpc v1.75.0
 	google.golang.org/protobuf v1.36.8
diff --git a/examples/extension-server/go.sum b/examples/extension-server/go.sum
index d1aa29d2e..e85fdaec8 100644
--- a/examples/extension-server/go.sum
+++ b/examples/extension-server/go.sum
@@ -12,10 +12,10 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d h1:zRd3ucqzZ2stiYb7j8+RBP48kFcFLUkDsjbr0hZg1/E=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d/go.mod h1:whHrEUXbTAzBJlzd3Gz4us5zEFP1gL6o3LbfA+a/xbg=
-github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d h1:mbxMT8XP3hEorIeTp4Yvcz5qKzE2n2q4IMU3SxuikaQ=
-github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f h1:36vvJBe/wXWfD7qrTb1WnbPVPMxNFDfEygztH8wgebw=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f/go.mod h1:PTY7yDlLxB4bW7rEOO7e79uTDr9yXzpuI1QGIDfxEzc=
+github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f h1:4efYrIQgVRwCmwCveby6ck+VpxqzibdOL1Out1rJqqc=
+github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f/go.mod h1:2LcmvJoXsDSrsGZIxGM0Gah9ykiwTn/kgjyQdnNH8Jc=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
diff --git a/go.mod b/go.mod
index 1343c6f17..a84e8a02e 100644
--- a/go.mod
+++ b/go.mod
@@ -18,9 +18,9 @@ require (
 	github.com/docker/cli v28.3.3+incompatible
 	github.com/docker/docker v28.3.3+incompatible
 	github.com/dominikbraun/graph v0.23.0
-	github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d
+	github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f
 	github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403
-	github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d
+	github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f
 	github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549
 	github.com/envoyproxy/ratelimit v1.4.1-0.20230427142404-e2a87f41d3a7
 	github.com/evanphx/json-patch v5.9.11+incompatible
diff --git a/go.sum b/go.sum
index 6013a5fc5..c3d1f8102 100644
--- a/go.sum
+++ b/go.sum
@@ -171,12 +171,12 @@ github.com/emicklei/go-restful/v3 v3.12.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRr
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d h1:zRd3ucqzZ2stiYb7j8+RBP48kFcFLUkDsjbr0hZg1/E=
-github.com/envoyproxy/go-control-plane v0.13.5-0.20250622153809-434b6986176d/go.mod h1:whHrEUXbTAzBJlzd3Gz4us5zEFP1gL6o3LbfA+a/xbg=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f h1:36vvJBe/wXWfD7qrTb1WnbPVPMxNFDfEygztH8wgebw=
+github.com/envoyproxy/go-control-plane v0.13.5-0.20250929230642-07d3df27ff4f/go.mod h1:PTY7yDlLxB4bW7rEOO7e79uTDr9yXzpuI1QGIDfxEzc=
 github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403 h1:5wPocL1bGYhA4TtKZwcdVI5fsXo1JatkbcxPBcFQswc=
 github.com/envoyproxy/go-control-plane/contrib v1.32.5-0.20250430092421-68a532e11403/go.mod h1:Xkwx/TGvEKRCL2mitdiuQWOD1ECvfM5krWWVo2vI2Zk=
-github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d h1:mbxMT8XP3hEorIeTp4Yvcz5qKzE2n2q4IMU3SxuikaQ=
-github.com/envoyproxy/go-control-plane/envoy v1.32.5-0.20250622153809-434b6986176d/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs=
+github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f h1:4efYrIQgVRwCmwCveby6ck+VpxqzibdOL1Out1rJqqc=
+github.com/envoyproxy/go-control-plane/envoy v1.35.1-0.20250929230642-07d3df27ff4f/go.mod h1:2LcmvJoXsDSrsGZIxGM0Gah9ykiwTn/kgjyQdnNH8Jc=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549 h1:5K0vH5H4dtCIO8+w/yq6vDaMcGn9RoPrHfmPAFAztwU=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.1-0.20250805143705-d51f8590a549/go.mod h1:KxtyvDAPIEkqUUvF9ooo5gSGVOtQ08wUTnQe5LsJC6c=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
diff --git a/internal/gatewayapi/backend.go b/internal/gatewayapi/backend.go
index d1772428a..c3c1c8220 100644
--- a/internal/gatewayapi/backend.go
+++ b/internal/gatewayapi/backend.go
@@ -20,7 +20,7 @@ import (
 )
 
 func (t *Translator) ProcessBackends(backends []*egv1a1.Backend, backendTLSPolicies []*gwapiv1a3.BackendTLSPolicy) []*egv1a1.Backend {
-	var res []*egv1a1.Backend
+	res := make([]*egv1a1.Backend, 0, len(backends))
 	for _, backend := range backends {
 		// Ensure Backends are enabled
 		if !t.BackendEnabled {
diff --git a/internal/gatewayapi/backendtlspolicy.go b/internal/gatewayapi/backendtlspolicy.go
index 2d37278e3..45fc18839 100644
--- a/internal/gatewayapi/backendtlspolicy.go
+++ b/internal/gatewayapi/backendtlspolicy.go
@@ -257,7 +257,7 @@ func getBackendTLSPolicy(
 
 func getBackendTLSBundle(backendTLSPolicy *gwapiv1a3.BackendTLSPolicy, resources *resource.Resources) (*ir.TLSUpstreamConfig, error) {
 	// Translate SubjectAltNames from gwapiv1a3 to ir
-	var subjectAltNames []ir.SubjectAltName
+	subjectAltNames := make([]ir.SubjectAltName, 0, len(backendTLSPolicy.Spec.Validation.SubjectAltNames))
 	for _, san := range backendTLSPolicy.Spec.Validation.SubjectAltNames {
 		var subjectAltName ir.SubjectAltName
 		switch san.Type {
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index 8d090423f..8618b8d1f 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -39,13 +39,17 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
 	routes []RouteContext,
 	xdsIR resource.XdsIRMap,
 ) []*egv1a1.BackendTrafficPolicy {
-	res := make([]*egv1a1.BackendTrafficPolicy, 0, len(resources.BackendTrafficPolicies))
-
 	backendTrafficPolicies := resources.BackendTrafficPolicies
 	// BackendTrafficPolicies are already sorted by the provider layer
 
+	routeMapSize := len(routes)
+	gatewayMapSize := len(gateways)
+	policyMapSize := len(backendTrafficPolicies)
+
+	res := make([]*egv1a1.BackendTrafficPolicy, 0, policyMapSize)
+
 	// First build a map out of the routes and gateways for faster lookup since users might have thousands of routes or more.
-	routeMap := map[policyTargetRouteKey]*policyRouteTargetContext{}
+	routeMap := make(map[policyTargetRouteKey]*policyRouteTargetContext, routeMapSize)
 	for _, route := range routes {
 		key := policyTargetRouteKey{
 			Kind:      string(route.GetRouteType()),
@@ -55,19 +59,19 @@ func (t *Translator) ProcessBackendTrafficPolicies(resources *resource.Resources
 		routeMap[key] = &policyRouteTargetContext{RouteContext: route}
 	}
 
-	gatewayMap := map[types.NamespacedName]*policyGatewayTargetContext{}
+	gatewayMap := make(map[types.NamespacedName]*policyGatewayTargetContext, gatewayMapSize)
 	for _, gw := range gateways {
 		key := utils.NamespacedName(gw)
 		gatewayMap[key] = &policyGatewayTargetContext{GatewayContext: gw}
 	}
 
 	// Map of Gateway to the routes attached to it
-	gatewayRouteMap := make(map[string]sets.Set[string])
+	gatewayRouteMap := make(map[string]sets.Set[string], gatewayMapSize)
 
-	handledPolicies := make(map[types.NamespacedName]*egv1a1.BackendTrafficPolicy)
+	handledPolicies := make(map[types.NamespacedName]*egv1a1.BackendTrafficPolicy, policyMapSize)
 
-	gatewayPolicyMap := make(map[types.NamespacedName]*egv1a1.BackendTrafficPolicy)
-	gatewayPolicyMerged := make(map[types.NamespacedName]sets.Set[string])
+	gatewayPolicyMap := make(map[types.NamespacedName]*egv1a1.BackendTrafficPolicy, gatewayMapSize)
+	gatewayPolicyMerged := make(map[types.NamespacedName]sets.Set[string], gatewayMapSize)
 
 	// Translate
 	// 1. First translate Policies targeting xRoutes
diff --git a/internal/gatewayapi/envoyextensionpolicy.go b/internal/gatewayapi/envoyextensionpolicy.go
index cd7a442b2..ca52cff72 100644
--- a/internal/gatewayapi/envoyextensionpolicy.go
+++ b/internal/gatewayapi/envoyextensionpolicy.go
@@ -615,12 +615,12 @@ func (t *Translator) translateEnvoyExtensionPolicyForGateway(
 }
 
 func (t *Translator) buildLuas(policy *egv1a1.EnvoyExtensionPolicy, resources *resource.Resources, envoyProxy *egv1a1.EnvoyProxy) ([]ir.Lua, error) {
-	var luaIRList []ir.Lua
-
 	if policy == nil {
 		return nil, nil
 	}
 
+	luaIRList := make([]ir.Lua, 0, len(policy.Spec.Lua))
+
 	for idx, ep := range policy.Spec.Lua {
 		name := irConfigNameForLua(policy, idx)
 		luaIR, err := t.buildLua(name, policy, ep, resources, envoyProxy)
@@ -684,15 +684,16 @@ func getLuaBodyFromLocalObjectReference(valueRef *gwapiv1.LocalObjectReference,
 
 func (t *Translator) buildExtProcs(policy *egv1a1.EnvoyExtensionPolicy, resources *resource.Resources, envoyProxy *egv1a1.EnvoyProxy) ([]ir.ExtProc, error, bool) {
 	var (
-		extProcIRList []ir.ExtProc
-		failOpen      bool
-		errs          error
+		failOpen bool
+		errs     error
 	)
 
 	if policy == nil {
 		return nil, nil, failOpen
 	}
 
+	extProcIRList := make([]ir.ExtProc, 0, len(policy.Spec.ExtProc))
+
 	hasFailClose := false
 	for idx, ep := range policy.Spec.ExtProc {
 		name := irConfigNameForExtProc(policy, idx)
@@ -828,15 +829,16 @@ func (t *Translator) buildWasms(
 	resources *resource.Resources,
 ) ([]ir.Wasm, error, bool) {
 	var (
-		wasmIRList []ir.Wasm
-		failOpen   bool
-		errs       error
+		failOpen bool
+		errs     error
 	)
 
 	if len(policy.Spec.Wasm) == 0 {
-		return wasmIRList, nil, failOpen
+		return nil, nil, failOpen
 	}
 
+	wasmIRList := make([]ir.Wasm, 0, len(policy.Spec.Wasm))
+
 	if t.WasmCache == nil {
 		return nil, fmt.Errorf("wasm cache is not initialized"), failOpen
 	}
diff --git a/internal/gatewayapi/ext_service.go b/internal/gatewayapi/ext_service.go
index 7e56c2f45..82e6f7369 100644
--- a/internal/gatewayapi/ext_service.go
+++ b/internal/gatewayapi/ext_service.go
@@ -34,7 +34,6 @@ func (t *Translator) translateExtServiceBackendRefs(
 ) (*ir.RouteDestination, error) {
 	var (
 		rs  *ir.RouteDestination
-		ds  []*ir.DestinationSetting
 		err error
 	)
 
@@ -42,6 +41,8 @@ func (t *Translator) translateExtServiceBackendRefs(
 		return nil, errors.New("no backendRefs found for external service")
 	}
 
+	ds := make([]*ir.DestinationSetting, 0, len(backendRefs))
+
 	pnn := utils.NamespacedName(policy)
 	destName := irIndexedExtServiceDestinationName(pnn, policy.GetObjectKind().GroupVersionKind().Kind, configType, index)
 	for i, backendRef := range backendRefs {
diff --git a/internal/gatewayapi/filters.go b/internal/gatewayapi/filters.go
index 946225048..722cb8b55 100644
--- a/internal/gatewayapi/filters.go
+++ b/internal/gatewayapi/filters.go
@@ -1033,17 +1033,17 @@ func (t *Translator) processCORSFilter(
 		}
 	}
 
-	var allowMethods []string
+	allowMethods := make([]string, 0, len(corsFilter.AllowMethods))
 	for _, method := range corsFilter.AllowMethods {
 		allowMethods = append(allowMethods, string(method))
 	}
 
-	var allowHeaders []string
+	allowHeaders := make([]string, 0, len(corsFilter.AllowHeaders))
 	for _, header := range corsFilter.AllowHeaders {
 		allowHeaders = append(allowHeaders, string(header))
 	}
 
-	var exposeHeaders []string
+	exposeHeaders := make([]string, 0, len(corsFilter.ExposeHeaders))
 	for _, header := range corsFilter.ExposeHeaders {
 		exposeHeaders = append(exposeHeaders, string(header))
 	}
diff --git a/internal/gatewayapi/helpers.go b/internal/gatewayapi/helpers.go
index 3ff008ece..aa0eeaa87 100644
--- a/internal/gatewayapi/helpers.go
+++ b/internal/gatewayapi/helpers.go
@@ -460,7 +460,7 @@ func IsMergeGatewaysEnabled(resources *resource.Resources) bool {
 }
 
 func protocolSliceToStringSlice(protocols []gwapiv1.ProtocolType) []string {
-	var protocolStrings []string
+	protocolStrings := make([]string, 0, len(protocols))
 	for _, protocol := range protocols {
 		protocolStrings = append(protocolStrings, string(protocol))
 	}
diff --git a/internal/gatewayapi/route.go b/internal/gatewayapi/route.go
index ff837a3e5..3ef0456d0 100644
--- a/internal/gatewayapi/route.go
+++ b/internal/gatewayapi/route.go
@@ -52,7 +52,7 @@ type RoutesTranslator interface {
 }
 
 func (t *Translator) ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) []*HTTPRouteContext {
-	var relevantHTTPRoutes []*HTTPRouteContext
+	relevantHTTPRoutes := make([]*HTTPRouteContext, 0, len(httpRoutes))
 
 	// HTTPRoutes are already sorted by the provider layer
 
@@ -79,7 +79,7 @@ func (t *Translator) ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways
 }
 
 func (t *Translator) ProcessGRPCRoutes(grpcRoutes []*gwapiv1.GRPCRoute, gateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) []*GRPCRouteContext {
-	var relevantGRPCRoutes []*GRPCRouteContext
+	relevantGRPCRoutes := make([]*GRPCRouteContext, 0, len(grpcRoutes))
 
 	// GRPCRoutes are already sorted by the provider layer
 
@@ -387,7 +387,11 @@ func (t *Translator) processHTTPRouteRule(
 	rule *gwapiv1.HTTPRouteRule,
 	routeRuleMetadata *ir.ResourceMetadata,
 ) ([]*ir.HTTPRoute, status.Error) {
-	var ruleRoutes []*ir.HTTPRoute
+	capacity := len(rule.Matches)
+	if capacity == 0 {
+		capacity = 1
+	}
+	ruleRoutes := make([]*ir.HTTPRoute, 0, capacity)
 
 	// If no matches are specified, the implementation MUST match every HTTP request.
 	if len(rule.Matches) == 0 {
@@ -642,7 +646,8 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 	pattern := getStatPattern(grpcRoute, parentRef, t.GatewayControllerName)
 
 	// compute matches, filters, backends
-	for ruleIdx, rule := range grpcRoute.Spec.Rules {
+	for ruleIdx := range grpcRoute.Spec.Rules {
+		rule := &grpcRoute.Spec.Rules[ruleIdx]
 		httpFiltersContext, err := t.ProcessGRPCFilters(parentRef, grpcRoute, rule.Filters, resources)
 		if err != nil {
 			errs.Add(status.NewRouteStatusError(
@@ -654,7 +659,7 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 		// A rule is matched if any one of its matches
 		// is satisfied (i.e. a logical "OR"), so generate
 		// a unique Xds IR HTTPRoute per match.
-		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, &rule)
+		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, rule)
 		if err != nil {
 			errs.Add(status.NewRouteStatusError(
 				fmt.Errorf("failed to process route rule %d: %w", ruleIdx, err),
@@ -740,7 +745,11 @@ func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRe
 }
 
 func (t *Translator) processGRPCRouteRule(grpcRoute *GRPCRouteContext, ruleIdx int, httpFiltersContext *HTTPFiltersContext, rule *gwapiv1.GRPCRouteRule) ([]*ir.HTTPRoute, status.Error) {
-	var ruleRoutes []*ir.HTTPRoute
+	capacity := len(rule.Matches)
+	if capacity == 0 {
+		capacity = 1
+	}
+	ruleRoutes := make([]*ir.HTTPRoute, 0, capacity)
 
 	// If no matches are specified, the implementation MUST match every gRPC request.
 	if len(rule.Matches) == 0 {
@@ -924,7 +933,7 @@ func filterEGPrefix(in map[string]string) map[string]string {
 }
 
 func (t *Translator) ProcessTLSRoutes(tlsRoutes []*gwapiv1a2.TLSRoute, gateways []*GatewayContext, resources *resource.Resources, xdsIR resource.XdsIRMap) []*TLSRouteContext {
-	var relevantTLSRoutes []*TLSRouteContext
+	relevantTLSRoutes := make([]*TLSRouteContext, 0, len(tlsRoutes))
 	// TLSRoutes are already sorted by the provider layer
 
 	for _, tls := range tlsRoutes {
@@ -1069,7 +1078,7 @@ func (t *Translator) processTLSRouteParentRefs(tlsRoute *TLSRouteContext, resour
 func (t *Translator) ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *resource.Resources,
 	xdsIR resource.XdsIRMap,
 ) []*UDPRouteContext {
-	var relevantUDPRoutes []*UDPRouteContext
+	relevantUDPRoutes := make([]*UDPRouteContext, 0, len(udpRoutes))
 	// UDPRoutes are already sorted by the provider layer
 
 	for _, u := range udpRoutes {
@@ -1219,7 +1228,7 @@ func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resour
 func (t *Translator) ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *resource.Resources,
 	xdsIR resource.XdsIRMap,
 ) []*TCPRouteContext {
-	var relevantTCPRoutes []*TCPRouteContext
+	relevantTCPRoutes := make([]*TCPRouteContext, 0, len(tcpRoutes))
 	// TCPRoutes are already sorted by the provider layer
 
 	for _, tcp := range tcpRoutes {
@@ -1978,10 +1987,7 @@ func (t *Translator) processBackendDestinationSetting(
 	protocol ir.AppProtocol,
 	resources *resource.Resources,
 ) *ir.DestinationSetting {
-	var (
-		dstEndpoints []*ir.DestinationEndpoint
-		dstAddrType  *ir.DestinationAddressType
-	)
+	var dstAddrType *ir.DestinationAddressType
 
 	addrTypeMap := make(map[ir.DestinationAddressType]int)
 	backend := resources.GetBackend(backendNamespace, string(backendRef.Name))
@@ -1998,6 +2004,8 @@ func (t *Translator) processBackendDestinationSetting(
 		return ds
 	}
 
+	dstEndpoints := make([]*ir.DestinationEndpoint, 0, len(backend.Spec.Endpoints))
+
 	for _, bep := range backend.Spec.Endpoints {
 		var irde *ir.DestinationEndpoint
 		switch {
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index ee9e3f5a4..90211a079 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -883,7 +883,7 @@ func (t *Translator) buildJWT(
 		return nil, err
 	}
 
-	var providers []ir.JWTProvider
+	providers := make([]ir.JWTProvider, 0, len(policy.Spec.JWT.Providers))
 	for i, p := range policy.Spec.JWT.Providers {
 		provider := ir.JWTProvider{
 			Name:           p.Name,
@@ -1095,17 +1095,18 @@ func (t *Translator) buildOIDC(
 	envoyProxy *egv1a1.EnvoyProxy,
 ) (*ir.OIDC, error) {
 	var (
-		oidc                  = policy.Spec.OIDC
-		provider              *ir.OIDCProvider
-		clientID              string
-		clientSecret          *corev1.Secret
-		redirectURL           = defaultRedirectURL
-		redirectPath          = defaultRedirectPath
-		logoutPath            = defaultLogoutPath
-		forwardAccessToken    = defaultForwardAccessToken
-		refreshToken          = defaultRefreshToken
-		passThroughAuthHeader = defaultPassThroughAuthHeader
-		err                   error
+		oidc                   = policy.Spec.OIDC
+		provider               *ir.OIDCProvider
+		clientID               string
+		clientSecret           *corev1.Secret
+		redirectURL            = defaultRedirectURL
+		redirectPath           = defaultRedirectPath
+		logoutPath             = defaultLogoutPath
+		forwardAccessToken     = defaultForwardAccessToken
+		refreshToken           = defaultRefreshToken
+		passThroughAuthHeader  = defaultPassThroughAuthHeader
+		disableTokenEncryption = false
+		err                    error
 	)
 
 	if provider, err = t.buildOIDCProvider(policy, resources, envoyProxy); err != nil {
@@ -1172,6 +1173,9 @@ func (t *Translator) buildOIDC(
 	if oidc.PassThroughAuthHeader != nil {
 		passThroughAuthHeader = *oidc.PassThroughAuthHeader
 	}
+	if oidc.DisableTokenEncryption != nil {
+		disableTokenEncryption = *oidc.DisableTokenEncryption
+	}
 
 	// Generate a unique cookie suffix for oauth filters.
 	// This is to avoid cookie name collision when multiple security policies are applied
@@ -1193,24 +1197,25 @@ func (t *Translator) buildOIDC(
 	}
 
 	irOIDC := &ir.OIDC{
-		Name:                  irConfigName(policy),
-		Provider:              *provider,
-		ClientID:              clientID,
-		ClientSecret:          clientSecretBytes,
-		Scopes:                scopes,
-		Resources:             oidc.Resources,
-		RedirectURL:           redirectURL,
-		RedirectPath:          redirectPath,
-		LogoutPath:            logoutPath,
-		ForwardAccessToken:    forwardAccessToken,
-		RefreshToken:          refreshToken,
-		CookieSuffix:          suffix,
-		CookieNameOverrides:   policy.Spec.OIDC.CookieNames,
-		CookieDomain:          policy.Spec.OIDC.CookieDomain,
-		CookieConfig:          policy.Spec.OIDC.CookieConfig,
-		HMACSecret:            hmacData,
-		PassThroughAuthHeader: passThroughAuthHeader,
-		DenyRedirect:          oidc.DenyRedirect,
+		Name:                   irConfigName(policy),
+		Provider:               *provider,
+		ClientID:               clientID,
+		ClientSecret:           clientSecretBytes,
+		Scopes:                 scopes,
+		Resources:              oidc.Resources,
+		RedirectURL:            redirectURL,
+		RedirectPath:           redirectPath,
+		LogoutPath:             logoutPath,
+		ForwardAccessToken:     forwardAccessToken,
+		RefreshToken:           refreshToken,
+		CookieSuffix:           suffix,
+		CookieNameOverrides:    policy.Spec.OIDC.CookieNames,
+		CookieDomain:           policy.Spec.OIDC.CookieDomain,
+		CookieConfig:           policy.Spec.OIDC.CookieConfig,
+		HMACSecret:             hmacData,
+		PassThroughAuthHeader:  passThroughAuthHeader,
+		DisableTokenEncryption: disableTokenEncryption,
+		DenyRedirect:           oidc.DenyRedirect,
 	}
 
 	if oidc.DefaultTokenTTL != nil {
diff --git a/internal/gatewayapi/status/gatewayclass.go b/internal/gatewayapi/status/gatewayclass.go
index c09031d21..703c42a12 100644
--- a/internal/gatewayapi/status/gatewayclass.go
+++ b/internal/gatewayapi/status/gatewayclass.go
@@ -83,7 +83,7 @@ func getSupportedFeatures(gatewaySuite *suite.ConformanceOptions, skippedTests [
 		})
 	}
 
-	var featureList []gwapiv1.SupportedFeature
+	featureList := make([]gwapiv1.SupportedFeature, 0, len(ret))
 	for feature := range ret {
 		featureList = append(featureList, feature)
 	}
diff --git a/internal/gatewayapi/tls.go b/internal/gatewayapi/tls.go
index 9d7d864fc..20ea5c0cd 100644
--- a/internal/gatewayapi/tls.go
+++ b/internal/gatewayapi/tls.go
@@ -18,8 +18,8 @@ import (
 // is not malformed and can be properly parsed
 func validateTLSSecretsData(secrets []*corev1.Secret) ([]*x509.Certificate, error) {
 	var publicKeyAlgorithm string
-	var certs []*x509.Certificate
 	var parseErr error
+	certs := make([]*x509.Certificate, 0, len(secrets))
 
 	pkaSecretSet := make(map[string]string)
 	for _, secret := range secrets {
diff --git a/internal/gatewayapi/translator.go b/internal/gatewayapi/translator.go
index b3a2139e3..cf7a682ef 100644
--- a/internal/gatewayapi/translator.go
+++ b/internal/gatewayapi/translator.go
@@ -14,6 +14,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/ptr"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
 	gwapiv1a3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
@@ -131,33 +132,70 @@ func newTranslateResult(gateways []*GatewayContext,
 		InfraIR: infraIR,
 	}
 
-	for _, gateway := range gateways {
-		translateResult.Gateways = append(translateResult.Gateways, gateway.Gateway)
+	if n := len(gateways); n > 0 {
+		translateResult.Gateways = make([]*gwapiv1.Gateway, n)
+		for i, gateway := range gateways {
+			translateResult.Gateways[i] = gateway.Gateway
+		}
 	}
-	for _, httpRoute := range httpRoutes {
-		translateResult.HTTPRoutes = append(translateResult.HTTPRoutes, httpRoute.HTTPRoute)
+
+	if n := len(httpRoutes); n > 0 {
+		translateResult.HTTPRoutes = make([]*gwapiv1.HTTPRoute, n)
+		for i, httpRoute := range httpRoutes {
+			translateResult.HTTPRoutes[i] = httpRoute.HTTPRoute
+		}
 	}
-	for _, grpcRoute := range grpcRoutes {
-		translateResult.GRPCRoutes = append(translateResult.GRPCRoutes, grpcRoute.GRPCRoute)
+
+	if n := len(grpcRoutes); n > 0 {
+		translateResult.GRPCRoutes = make([]*gwapiv1.GRPCRoute, n)
+		for i, grpcRoute := range grpcRoutes {
+			translateResult.GRPCRoutes[i] = grpcRoute.GRPCRoute
+		}
 	}
-	for _, tlsRoute := range tlsRoutes {
-		translateResult.TLSRoutes = append(translateResult.TLSRoutes, tlsRoute.TLSRoute)
+
+	if n := len(tlsRoutes); n > 0 {
+		translateResult.TLSRoutes = make([]*gwapiv1a2.TLSRoute, n)
+		for i, tlsRoute := range tlsRoutes {
+			translateResult.TLSRoutes[i] = tlsRoute.TLSRoute
+		}
 	}
-	for _, tcpRoute := range tcpRoutes {
-		translateResult.TCPRoutes = append(translateResult.TCPRoutes, tcpRoute.TCPRoute)
+
+	if n := len(tcpRoutes); n > 0 {
+		translateResult.TCPRoutes = make([]*gwapiv1a2.TCPRoute, n)
+		for i, tcpRoute := range tcpRoutes {
+			translateResult.TCPRoutes[i] = tcpRoute.TCPRoute
+		}
 	}
-	for _, udpRoute := range udpRoutes {
-		translateResult.UDPRoutes = append(translateResult.UDPRoutes, udpRoute.UDPRoute)
+
+	if n := len(udpRoutes); n > 0 {
+		translateResult.UDPRoutes = make([]*gwapiv1a2.UDPRoute, n)
+		for i, udpRoute := range udpRoutes {
+			translateResult.UDPRoutes[i] = udpRoute.UDPRoute
+		}
 	}
 
-	translateResult.ClientTrafficPolicies = append(translateResult.ClientTrafficPolicies, clientTrafficPolicies...)
-	translateResult.BackendTrafficPolicies = append(translateResult.BackendTrafficPolicies, backendTrafficPolicies...)
-	translateResult.SecurityPolicies = append(translateResult.SecurityPolicies, securityPolicies...)
-	translateResult.BackendTLSPolicies = append(translateResult.BackendTLSPolicies, backendTLSPolicies...)
-	translateResult.EnvoyExtensionPolicies = append(translateResult.EnvoyExtensionPolicies, envoyExtensionPolicies...)
-	translateResult.ExtensionServerPolicies = append(translateResult.ExtensionServerPolicies, extPolicies...)
+	if len(clientTrafficPolicies) > 0 {
+		translateResult.ClientTrafficPolicies = clientTrafficPolicies
+	}
+	if len(backendTrafficPolicies) > 0 {
+		translateResult.BackendTrafficPolicies = backendTrafficPolicies
+	}
+	if len(securityPolicies) > 0 {
+		translateResult.SecurityPolicies = securityPolicies
+	}
+	if len(backendTLSPolicies) > 0 {
+		translateResult.BackendTLSPolicies = backendTLSPolicies
+	}
+	if len(envoyExtensionPolicies) > 0 {
+		translateResult.EnvoyExtensionPolicies = envoyExtensionPolicies
+	}
+	if len(extPolicies) > 0 {
+		translateResult.ExtensionServerPolicies = extPolicies
+	}
+	if len(backends) > 0 {
+		translateResult.Backends = backends
+	}
 
-	translateResult.Backends = append(translateResult.Backends, backends...)
 	return translateResult
 }
 
diff --git a/internal/infrastructure/kubernetes/resource/resource.go b/internal/infrastructure/kubernetes/resource/resource.go
index e3ebf06a1..94fbbcedc 100644
--- a/internal/infrastructure/kubernetes/resource/resource.go
+++ b/internal/infrastructure/kubernetes/resource/resource.go
@@ -6,8 +6,6 @@
 package resource
 
 import (
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/utils/ptr"
@@ -50,14 +48,6 @@ func ExpectedServiceSpec(service *egv1a1.KubernetesServiceSpec) corev1.ServiceSp
 	return serviceSpec
 }
 
-// CompareSvc compares the Service resource and ignores specific fields that may have been modified by other actors.
-func CompareSvc(currentSvc, originalSvc *corev1.Service) bool {
-	return cmp.Equal(currentSvc.Spec, originalSvc.Spec,
-		cmpopts.IgnoreFields(corev1.ServicePort{}, "NodePort"),
-		cmpopts.IgnoreFields(corev1.ServiceSpec{}, "ClusterIP", "ClusterIPs"),
-		cmpopts.IgnoreFields(metav1.ObjectMeta{}, "Finalizers"))
-}
-
 // ExpectedContainerEnv returns expected container envs.
 func ExpectedContainerEnv(container *egv1a1.KubernetesContainerSpec, env []corev1.EnvVar) []corev1.EnvVar {
 	amendFunc := func(envVar corev1.EnvVar) {
diff --git a/internal/ir/xds.go b/internal/ir/xds.go
index bd333839e..b5ca40d7b 100644
--- a/internal/ir/xds.go
+++ b/internal/ir/xds.go
@@ -1161,6 +1161,9 @@ type OIDC struct {
 	// may not be able to handle OIDC redirects and wish to directly supply a token instead.
 	PassThroughAuthHeader bool `json:"passThroughAuthHeader,omitempty"`
 
+	// DisableTokenEncryption disables encryption of ID and access tokens stored in cookies.
+	DisableTokenEncryption bool `json:"disableTokenEncryption,omitempty"`
+
 	// Any request that matches any of the provided matchers won't be redirected to OAuth server when tokens are not valid.
 	// Automatic access token refresh will be performed for these requests, if enabled.
 	// This behavior can be useful for AJAX requests.
diff --git a/internal/provider/file/resources.go b/internal/provider/file/resources.go
index 576d9665a..8f9524305 100644
--- a/internal/provider/file/resources.go
+++ b/internal/provider/file/resources.go
@@ -16,7 +16,7 @@ import (
 
 // loadFromFilesAndDirs loads resources from specific files and directories.
 func loadFromFilesAndDirs(files, dirs []string) ([]*resource.Resources, error) {
-	var rs []*resource.Resources
+	rs := make([]*resource.Resources, 0, len(files)+len(dirs))
 
 	for _, file := range files {
 		r, err := loadFromFile(file)
@@ -61,7 +61,7 @@ func loadFromDir(path string) ([]*resource.Resources, error) {
 		return nil, err
 	}
 
-	var rs []*resource.Resources
+	rs := make([]*resource.Resources, 0, len(entries))
 	for _, entry := range entries {
 		// Ignoring subdirectories and all hidden files and directories.
 		if entry.IsDir() || strings.HasPrefix(entry.Name(), ".") {
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 9dc537c2e..360772aba 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"sync"
 	"time"
 
 	"github.com/telepresenceio/watchable"
@@ -68,6 +69,7 @@ type gatewayAPIReconciler struct {
 	namespaceLabel       *metav1.LabelSelector
 	envoyGateway         *egv1a1.EnvoyGateway
 	mergeGateways        sets.Set[string]
+	mergeGatewaysMu      sync.RWMutex
 	resources            *message.ProviderResources
 	subscriptions        *subscriptions
 	extGVKs              []schema.GroupVersionKind
@@ -93,6 +95,24 @@ type gatewayAPIReconciler struct {
 	clusterTrustBundleExits bool
 }
 
+// isGatewayClassMerged reports whether the supplied GatewayClass has mergeGateways enabled.
+func (r *gatewayAPIReconciler) isGatewayClassMerged(name string) bool {
+	r.mergeGatewaysMu.RLock()
+	defer r.mergeGatewaysMu.RUnlock()
+	return r.mergeGateways.Has(name)
+}
+
+// setGatewayClassMerge toggles mergeGateways tracking for the supplied GatewayClass.
+func (r *gatewayAPIReconciler) setGatewayClassMerge(name string, merged bool) {
+	r.mergeGatewaysMu.Lock()
+	defer r.mergeGatewaysMu.Unlock()
+	if merged {
+		r.mergeGateways.Insert(name)
+		return
+	}
+	r.mergeGateways.Delete(name)
+}
+
 type subscriptions struct {
 	gatewayClassStatuses         <-chan watchable.Snapshot[types.NamespacedName, *gwapiv1.GatewayClassStatus]
 	gatewayStatuses              <-chan watchable.Snapshot[types.NamespacedName, *gwapiv1.GatewayStatus]
@@ -277,6 +297,18 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		return reconcile.Result{}, err
 	}
 
+	// 1. gets all GatewayClass statuses and put it in a set
+	// 2. deletes the reconciled gateway classes names from the set
+	// 3. deletes the remaining from watchable (representing non-existent gateway classes)
+	gcStatusToDelete := r.loadGatewayClassStatusToDelete()
+
+	defer func() {
+		for _, key := range gcStatusToDelete.UnsortedList() {
+			r.log.Info("delete from GatewayClass statuses", "key", key)
+			r.resources.GatewayClassStatuses.Delete(key)
+		}
+	}()
+
 	// The gatewayclass was already deleted/finalized and there are stale queue entries.
 	if managedGCs == nil {
 		r.resources.GatewayAPIResources.Delete(string(r.classController))
@@ -359,6 +391,7 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 
 		// it's safe here to append gwcResource to gwcResources
 		gwcResources = append(gwcResources, gwcResource)
+		gcStatusToDelete.Delete(utils.NamespacedName(managedGC))
 		// process global resources
 		// add the OIDC HMAC Secret to the resourceTree
 		if err = r.processOIDCHMACSecret(ctx, gwcResource, gwcResourceMapping); err != nil {
@@ -493,11 +526,7 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 		}
 
 		if gwcResource.EnvoyProxyForGatewayClass != nil && gwcResource.EnvoyProxyForGatewayClass.Spec.MergeGateways != nil {
-			if *gwcResource.EnvoyProxyForGatewayClass.Spec.MergeGateways {
-				r.mergeGateways.Insert(managedGC.Name)
-			} else {
-				r.mergeGateways.Delete(managedGC.Name)
-			}
+			r.setGatewayClassMerge(managedGC.Name, *gwcResource.EnvoyProxyForGatewayClass.Spec.MergeGateways)
 		}
 
 		if len(gwcResource.Gateways) == 0 {
@@ -544,6 +573,15 @@ func (r *gatewayAPIReconciler) Reconcile(ctx context.Context, _ reconcile.Reques
 	return reconcile.Result{}, nil
 }
 
+func (r *gatewayAPIReconciler) loadGatewayClassStatusToDelete() sets.Set[types.NamespacedName] {
+	res := sets.New[types.NamespacedName]()
+	for key := range r.resources.GatewayClassStatuses.LoadAll() {
+		res.Insert(key)
+	}
+
+	return res
+}
+
 func (r *gatewayAPIReconciler) processEnvoyProxySecretRef(ctx context.Context, gwcResource *resource.Resources) error {
 	if gwcResource.EnvoyProxyForGatewayClass == nil || gwcResource.EnvoyProxyForGatewayClass.Spec.BackendTLS == nil || gwcResource.EnvoyProxyForGatewayClass.Spec.BackendTLS.ClientCertificateRef == nil {
 		return nil
@@ -603,46 +641,49 @@ func (r *gatewayAPIReconciler) processBackendRefs(ctx context.Context, gwcResour
 	// All other errors are just logged and ignored - these errors result in missing referenced backend resources
 	// in the resource tree, which is acceptable as the Gateway API translation layer will handle them.
 	// The Gateway API translation layer will surface these errors in the status of the resources referencing them.
-	for backendRef := range resourceMappings.allAssociatedBackendRefs {
+	for _, backendRef := range resourceMappings.allAssociatedBackendRefs {
 		backendRefKind := gatewayapi.KindDerefOr(backendRef.Kind, resource.KindService)
-		r.log.Info("processing Backend", "kind", backendRefKind, "namespace", string(*backendRef.Namespace),
-			"name", string(backendRef.Name))
-
+		backendNs, backendName := string(*backendRef.Namespace), string(backendRef.Name)
+		logger := r.log.WithValues("kind", backendRefKind, "namespace", backendNs,
+			"name", backendName)
+		logger.Info("processing Backend")
+		nn := types.NamespacedName{Namespace: backendNs, Name: backendName}
 		var endpointSliceLabelKey string
 		switch backendRefKind {
 		case resource.KindService:
 			service := new(corev1.Service)
-			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, service)
+			err := r.client.Get(ctx, nn, service)
 			if err != nil {
 				if isTransientError(err) {
 					return err
 				}
-				r.log.Error(err, "failed to get Service", "namespace", string(*backendRef.Namespace),
-					"name", string(backendRef.Name))
+				logger.Error(err, "failed to get Service")
 			} else {
 				resourceMappings.allAssociatedNamespaces.Insert(service.Namespace)
-				gwcResource.Services = append(gwcResource.Services, service)
-				r.log.Info("added Service to resource tree", "namespace", string(*backendRef.Namespace),
-					"name", string(backendRef.Name))
+				svcKey := utils.NamespacedName(service).String()
+				if !resourceMappings.allAssociatedServices.Has(svcKey) {
+					resourceMappings.allAssociatedServices.Insert(svcKey)
+					gwcResource.Services = append(gwcResource.Services, service)
+					logger.Info("added Service to resource tree")
+				}
 			}
 			endpointSliceLabelKey = discoveryv1.LabelServiceName
 
 		case resource.KindServiceImport:
 			serviceImport := new(mcsapiv1a1.ServiceImport)
-			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, serviceImport)
+			err := r.client.Get(ctx, nn, serviceImport)
 			if err != nil {
 				if isTransientError(err) {
 					return err
 				}
-				r.log.Error(err, "failed to get ServiceImport", "namespace", string(*backendRef.Namespace),
-					"name", string(backendRef.Name))
+				logger.Error(err, "failed to get ServiceImport")
 			} else {
 				resourceMappings.allAssociatedNamespaces.Insert(serviceImport.Namespace)
 				key := utils.NamespacedName(serviceImport).String()
 				if !resourceMappings.allAssociatedServiceImports.Has(key) {
 					resourceMappings.allAssociatedServiceImports.Insert(key)
 					gwcResource.ServiceImports = append(gwcResource.ServiceImports, serviceImport)
-					r.log.Info("added ServiceImport to resource tree", "namespace", string(*backendRef.Namespace),
+					logger.Info("added ServiceImport to resource tree", "namespace", string(*backendRef.Namespace),
 						"name", string(backendRef.Name))
 				}
 			}
@@ -650,27 +691,23 @@ func (r *gatewayAPIReconciler) processBackendRefs(ctx context.Context, gwcResour
 
 		case egv1a1.KindBackend:
 			if r.backendAPIDisabled() {
-				r.log.V(6).Info("skipping Backend processing as Backend API is disabled.")
+				logger.V(6).Info("skipping Backend processing as Backend API is disabled.")
 				continue
 			}
 			backend := new(egv1a1.Backend)
-			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, backend)
+			err := r.client.Get(ctx, nn, backend)
 			if err != nil {
 				if isTransientError(err) {
 					return err
 				}
-				r.log.Error(err, "failed to get Backend",
-					"namespace", string(*backendRef.Namespace),
-					"name", string(backendRef.Name))
+				logger.Error(err, "failed to get Backend")
 			} else {
 				resourceMappings.allAssociatedNamespaces.Insert(backend.Namespace)
 				key := utils.NamespacedName(backend).String()
 				if !resourceMappings.allAssociatedBackends.Has(key) {
 					resourceMappings.allAssociatedBackends.Insert(key)
 					gwcResource.Backends = append(gwcResource.Backends, backend)
-					r.log.Info("added Backend to resource tree",
-						"namespace", string(*backendRef.Namespace),
-						"name", string(backendRef.Name))
+					logger.Info("added Backend to resource tree")
 				}
 			}
 
@@ -702,8 +739,7 @@ func (r *gatewayAPIReconciler) processBackendRefs(ctx context.Context, gwcResour
 						if isTransientError(err) {
 							return err
 						}
-						r.log.Error(err,
-							"failed to process CACertificateRef for Backend",
+						logger.Error(err, "failed to process CACertificateRef for Backend",
 							"backend", backend, "caCertificateRef", caCertRef.Name)
 					}
 				}
@@ -727,9 +763,7 @@ func (r *gatewayAPIReconciler) processBackendRefs(ctx context.Context, gwcResour
 					if extRefFilter, exists := resourceMappings.extensionRefFilters[key]; exists {
 						resourceMappings.extensionRefFilters[key] = extRefFilter
 						gwcResource.ExtensionRefFilters = append(gwcResource.ExtensionRefFilters, extRefFilter)
-						r.log.Info("added custom backend resource to resource tree",
-							"kind", backendRefKind, "namespace", string(*backendRef.Namespace),
-							"name", string(backendRef.Name))
+						logger.Info("added custom backend resource to resource tree")
 					}
 				}
 			}
@@ -748,15 +782,14 @@ func (r *gatewayAPIReconciler) processBackendRefs(ctx context.Context, gwcResour
 				if isTransientError(err) {
 					return err
 				}
-				r.log.Error(err, "failed to get EndpointSlices", "namespace", string(*backendRef.Namespace),
-					backendRefKind, string(backendRef.Name))
+				logger.Error(err, "failed to get EndpointSlices")
 			} else {
 				for i := range endpointSliceList.Items {
 					endpointSlice := &endpointSliceList.Items[i]
 					key := utils.NamespacedName(endpointSlice).String()
 					if !resourceMappings.allAssociatedEndpointSlices.Has(key) {
 						resourceMappings.allAssociatedEndpointSlices.Insert(key)
-						r.log.Info("added EndpointSlice to resource tree",
+						logger.Info("added EndpointSlice to resource tree",
 							"namespace", endpointSlice.Namespace,
 							"name", endpointSlice.Name)
 						gwcResource.EndpointSlices = append(gwcResource.EndpointSlices, endpointSlice)
@@ -957,7 +990,7 @@ func (r *gatewayAPIReconciler) processSecurityPolicyObjectRefs(
 }
 
 func getBackendRefs(backendCluster egv1a1.BackendCluster) []gwapiv1.BackendObjectReference {
-	var backendRefs []gwapiv1.BackendObjectReference
+	backendRefs := make([]gwapiv1.BackendObjectReference, 0, 1+len(backendCluster.BackendRefs))
 	if backendCluster.BackendRef != nil {
 		backendRefs = append(backendRefs, *backendCluster.BackendRef)
 	}
@@ -969,6 +1002,27 @@ func getBackendRefs(backendCluster egv1a1.BackendCluster) []gwapiv1.BackendObjec
 	return backendRefs
 }
 
+func backendRefKey(ref *gwapiv1.BackendObjectReference) utils.NamespacedNameWithGroupKind {
+	if ref == nil {
+		return utils.NamespacedNameWithGroupKind{}
+	}
+	namespace := gatewayapi.NamespaceDerefOr(ref.Namespace, "")
+	group := gatewayapi.GroupDerefOr(ref.Group, "")
+	kind := gatewayapi.KindDerefOr(ref.Kind, resource.KindService)
+	return utils.NamespacedNameWithGroupKind{
+		NamespacedName: types.NamespacedName{Namespace: namespace, Name: string(ref.Name)},
+		GroupKind:      schema.GroupKind{Group: group, Kind: kind},
+	}
+}
+
+func (rm *resourceMappings) insertBackendRef(ref gwapiv1.BackendObjectReference) {
+	key := backendRefKey(&ref)
+	if _, exists := rm.allAssociatedBackendRefs[key]; exists {
+		return
+	}
+	rm.allAssociatedBackendRefs[key] = ref
+}
+
 // processBackendRef adds the referenced BackendRef to the resourceMap for later processBackendRefs.
 // If BackendRef exists in a different namespace and there is a ReferenceGrant, adds ReferenceGrant to the resourceTree.
 func (r *gatewayAPIReconciler) processBackendRef(
@@ -981,12 +1035,14 @@ func (r *gatewayAPIReconciler) processBackendRef(
 	backendRef gwapiv1.BackendObjectReference,
 ) error {
 	backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, ownerNS)
-	resourceMap.allAssociatedBackendRefs.Insert(gwapiv1.BackendObjectReference{
+	normalizedRef := gwapiv1.BackendObjectReference{
 		Group:     backendRef.Group,
 		Kind:      backendRef.Kind,
 		Namespace: gatewayapi.NamespacePtr(backendNamespace),
 		Name:      backendRef.Name,
-	})
+		Port:      backendRef.Port,
+	}
+	resourceMap.insertBackendRef(normalizedRef)
 
 	if backendNamespace != ownerNS {
 		from := ObjectKindNamespacedName{
@@ -1383,7 +1439,7 @@ func (r *gatewayAPIReconciler) processGateways(ctx context.Context, managedGC *g
 	}
 
 	mergedGateways := false
-	if r.mergeGateways.Has(managedGC.Name) {
+	if r.isGatewayClassMerged(managedGC.Name) {
 		mergedGateways = true
 		// processGatewayClassParamsRef has been called for this GatewayClass, its EnvoyProxy should exist in resourceTree
 		r.processServiceClusterForGatewayClass(resourceTree.EnvoyProxyForGatewayClass, managedGC, resourceMap)
@@ -1521,7 +1577,7 @@ func (r *gatewayAPIReconciler) processServiceClusterForGatewayClass(ep *egv1a1.E
 		}
 	}
 
-	resourceMap.allAssociatedBackendRefs.Insert(gwapiv1.BackendObjectReference{
+	resourceMap.insertBackendRef(gwapiv1.BackendObjectReference{
 		Kind:      ptr.To(gwapiv1.Kind("Service")),
 		Namespace: gatewayapi.NamespacePtr(proxySvcNamespace),
 		Name:      gwapiv1.ObjectName(proxySvcName),
@@ -1550,7 +1606,7 @@ func (r *gatewayAPIReconciler) processServiceClusterForGateway(ep *egv1a1.EnvoyP
 		}
 	}
 
-	resourceMap.allAssociatedBackendRefs.Insert(gwapiv1.BackendObjectReference{
+	resourceMap.insertBackendRef(gwapiv1.BackendObjectReference{
 		Kind:      ptr.To(gwapiv1.Kind("Service")),
 		Namespace: gatewayapi.NamespacePtr(proxySvcNamespace),
 		Name:      gwapiv1.ObjectName(proxySvcName),
@@ -2461,12 +2517,14 @@ func (r *gatewayAPIReconciler) processEnvoyProxy(ep *egv1a1.EnvoyProxy, resource
 
 		for _, backendRef := range backendRefs {
 			backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, ep.Namespace)
-			resourceMap.allAssociatedBackendRefs.Insert(gwapiv1.BackendObjectReference{
+			normalizedRef := gwapiv1.BackendObjectReference{
 				Group:     backendRef.Group,
 				Kind:      backendRef.Kind,
 				Namespace: gatewayapi.NamespacePtr(backendNamespace),
 				Name:      backendRef.Name,
-			})
+				Port:      backendRef.Port,
+			}
+			resourceMap.insertBackendRef(normalizedRef)
 		}
 	}
 
diff --git a/internal/provider/kubernetes/controller_offline.go b/internal/provider/kubernetes/controller_offline.go
index 6bf273a5b..d55528b76 100644
--- a/internal/provider/kubernetes/controller_offline.go
+++ b/internal/provider/kubernetes/controller_offline.go
@@ -28,7 +28,7 @@ import (
 // OfflineGatewayAPIReconciler can be used for non-kuberetes provider.
 // It can let other providers to have the same reconcile logic without rely on apiserver.
 type OfflineGatewayAPIReconciler struct {
-	gatewayAPIReconciler
+	*gatewayAPIReconciler
 
 	Client client.Client
 }
@@ -63,7 +63,7 @@ func NewOfflineGatewayAPIController(
 	}
 
 	cli := newOfflineGatewayAPIClient()
-	r := gatewayAPIReconciler{
+	r := &gatewayAPIReconciler{
 		client:            cli,
 		log:               cfg.Logger,
 		classController:   gwapiv1.GatewayController(cfg.EnvoyGateway.Gateway.ControllerName),
diff --git a/internal/provider/kubernetes/indexers.go b/internal/provider/kubernetes/indexers.go
index 2b9b5efdb..03d4b13f9 100644
--- a/internal/provider/kubernetes/indexers.go
+++ b/internal/provider/kubernetes/indexers.go
@@ -70,7 +70,7 @@ func addReferenceGrantIndexers(ctx context.Context, mgr manager.Manager) error {
 
 func getReferenceGrantIndexerFunc(rawObj client.Object) []string {
 	refGrant := rawObj.(*gwapiv1b1.ReferenceGrant)
-	var referredServices []string
+	referredServices := make([]string, 0, len(refGrant.Spec.To))
 	for _, target := range refGrant.Spec.To {
 		referredServices = append(referredServices, string(target.Kind))
 	}
@@ -587,8 +587,8 @@ func secretSecurityPolicyIndexFunc(rawObj client.Object) []string {
 	securityPolicy := rawObj.(*egv1a1.SecurityPolicy)
 
 	var (
-		secretReferences []gwapiv1.SecretObjectReference
-		values           []string
+		secretReferences = make([]gwapiv1.SecretObjectReference, 0, 4) // OIDC (2) + APIKeyAuth + BasicAuth
+		values           = make([]string, 0, 4)
 	)
 
 	if securityPolicy.Spec.OIDC != nil {
@@ -619,8 +619,8 @@ func backendSecurityPolicyIndexFunc(rawObj client.Object) []string {
 	securityPolicy := rawObj.(*egv1a1.SecurityPolicy)
 
 	var (
-		backendRefs []gwapiv1.BackendObjectReference
-		values      []string
+		backendRefs = make([]gwapiv1.BackendObjectReference, 0, 2) // HTTP + GRPC
+		values      = make([]string, 0, 2)
 	)
 
 	if securityPolicy.Spec.ExtAuth != nil {
diff --git a/internal/provider/kubernetes/predicates.go b/internal/provider/kubernetes/predicates.go
index b169cd4b7..eda05b00e 100644
--- a/internal/provider/kubernetes/predicates.go
+++ b/internal/provider/kubernetes/predicates.go
@@ -391,7 +391,7 @@ func (r *gatewayAPIReconciler) validateServiceForReconcile(obj client.Object) bo
 
 	// Merged gateways will have only this label, update status of all Gateways under found GatewayClass.
 	gcName, ok := labels[gatewayapi.OwningGatewayClassLabel]
-	if ok && r.mergeGateways.Has(gcName) {
+	if ok && r.isGatewayClassMerged(gcName) {
 		if err := r.updateStatusForGatewaysUnderGatewayClass(ctx, gcName); err != nil {
 			r.log.Info("no Gateways found under GatewayClass", "name", gcName)
 			return false
@@ -629,7 +629,7 @@ func (r *gatewayAPIReconciler) validateObjectForReconcile(obj client.Object) boo
 
 	// Merged gateways will have only this label, update status of all Gateways under found GatewayClass.
 	gcName, ok := labels[gatewayapi.OwningGatewayClassLabel]
-	if ok && r.mergeGateways.Has(gcName) {
+	if ok && r.isGatewayClassMerged(gcName) {
 		if err := r.updateStatusForGatewaysUnderGatewayClass(ctx, gcName); err != nil {
 			r.log.Info("no Gateways found under GatewayClass", "name", gcName)
 			return false
@@ -651,9 +651,11 @@ func envoyObjectNamespace(r *gatewayAPIReconciler, gateway *gwapiv1.Gateway) str
 // envoyObjectForGateway returns the Envoy Deployment or DaemonSet, returning nil if neither exists.
 func (r *gatewayAPIReconciler) envoyObjectForGateway(ctx context.Context, gateway *gwapiv1.Gateway) (client.Object, error) {
 	// Helper func to list and return the first object from results
+	merged := r.isGatewayClassMerged(string(gateway.Spec.GatewayClassName))
+
 	listResource := func(list client.ObjectList) (client.Object, error) {
 		if err := r.client.List(ctx, list, &client.ListOptions{
-			LabelSelector: labels.SelectorFromSet(gatewayapi.OwnerLabels(gateway, r.mergeGateways.Has(string(gateway.Spec.GatewayClassName)))),
+			LabelSelector: labels.SelectorFromSet(gatewayapi.OwnerLabels(gateway, merged)),
 			Namespace:     envoyObjectNamespace(r, gateway),
 		}); err != nil {
 			if !kerrors.IsNotFound(err) {
@@ -685,7 +687,8 @@ func (r *gatewayAPIReconciler) envoyObjectForGateway(ctx context.Context, gatewa
 // envoyServiceForGateway returns the Envoy service, returning nil if the service doesn't exist.
 func (r *gatewayAPIReconciler) envoyServiceForGateway(ctx context.Context, gateway *gwapiv1.Gateway) (*corev1.Service, error) {
 	var services corev1.ServiceList
-	labelSelector := labels.SelectorFromSet(labels.Set(gatewayapi.OwnerLabels(gateway, r.mergeGateways.Has(string(gateway.Spec.GatewayClassName)))))
+	merged := r.isGatewayClassMerged(string(gateway.Spec.GatewayClassName))
+	labelSelector := labels.SelectorFromSet(labels.Set(gatewayapi.OwnerLabels(gateway, merged)))
 	if err := r.client.List(ctx, &services, &client.ListOptions{
 		LabelSelector: labelSelector,
 		Namespace:     envoyObjectNamespace(r, gateway),
@@ -943,7 +946,7 @@ func (r *gatewayAPIReconciler) isProxyServiceCluster(labels map[string]string) b
 	}
 
 	gcName, ok := labels[gatewayapi.OwningGatewayClassLabel]
-	if ok && r.mergeGateways.Has(gcName) {
+	if ok && r.isGatewayClassMerged(gcName) {
 		return true
 	}
 
diff --git a/internal/provider/kubernetes/resource.go b/internal/provider/kubernetes/resource.go
index 524cd235d..1a1c03c9e 100644
--- a/internal/provider/kubernetes/resource.go
+++ b/internal/provider/kubernetes/resource.go
@@ -20,6 +20,8 @@ type resourceMappings struct {
 	allAssociatedReferenceGrants sets.Set[string]
 	// Set for storing ServiceImports' NamespacedNames.
 	allAssociatedServiceImports sets.Set[string]
+	// Set for storing Services' NamespacedNames.
+	allAssociatedServices sets.Set[string]
 	// Set for storing EndpointSlices' NamespacedNames.
 	allAssociatedEndpointSlices sets.Set[string]
 	// Set for storing Backends' NamespacedNames.
@@ -44,8 +46,8 @@ type resourceMappings struct {
 	allAssociatedTCPRoutes sets.Set[string]
 	// Set for storing UDPRoutes' NamespacedNames attaching to various Gateway objects.
 	allAssociatedUDPRoutes sets.Set[string]
-	// Set for storing backendRefs' BackendObjectReference referred by various Route objects.
-	allAssociatedBackendRefs sets.Set[gwapiv1.BackendObjectReference]
+	// Map caching BackendObjectReferences keyed by their normalized identifier.
+	allAssociatedBackendRefs map[utils.NamespacedNameWithGroupKind]gwapiv1.BackendObjectReference
 	// Set for storing ClientTrafficPolicies' NamespacedNames referred by various Route objects.
 	allAssociatedClientTrafficPolicies sets.Set[string]
 	// Set for storing BackendTrafficPolicies' NamespacedNames referred by various Route objects.
@@ -75,6 +77,7 @@ func newResourceMapping() *resourceMappings {
 		allAssociatedGateways:                   sets.New[string](),
 		allAssociatedReferenceGrants:            sets.New[string](),
 		allAssociatedServiceImports:             sets.New[string](),
+		allAssociatedServices:                   sets.New[string](),
 		allAssociatedEndpointSlices:             sets.New[string](),
 		allAssociatedBackends:                   sets.New[string](),
 		allAssociatedSecrets:                    sets.New[string](),
@@ -87,7 +90,7 @@ func newResourceMapping() *resourceMappings {
 		allAssociatedGRPCRoutes:                 sets.New[string](),
 		allAssociatedTCPRoutes:                  sets.New[string](),
 		allAssociatedUDPRoutes:                  sets.New[string](),
-		allAssociatedBackendRefs:                sets.New[gwapiv1.BackendObjectReference](),
+		allAssociatedBackendRefs:                make(map[utils.NamespacedNameWithGroupKind]gwapiv1.BackendObjectReference),
 		allAssociatedClientTrafficPolicies:      sets.New[string](),
 		allAssociatedBackendTrafficPolicies:     sets.New[string](),
 		allAssociatedSecurityPolicies:           sets.New[string](),
diff --git a/internal/provider/kubernetes/routes.go b/internal/provider/kubernetes/routes.go
index 42b83deed..37dd5b460 100644
--- a/internal/provider/kubernetes/routes.go
+++ b/internal/provider/kubernetes/routes.go
@@ -306,7 +306,7 @@ func (r *gatewayAPIReconciler) processHTTPRouteFilter(
 	resourceMap *resourceMappings,
 	resourceTree *resource.Resources,
 ) error {
-	var extGKs []schema.GroupKind
+	extGKs := make([]schema.GroupKind, 0, len(r.extGVKs))
 	for _, gvk := range r.extGVKs {
 		extGKs = append(extGKs, gvk.GroupKind())
 	}
diff --git a/internal/provider/kubernetes/secrets.go b/internal/provider/kubernetes/secrets.go
index e8c0f4311..402147db9 100644
--- a/internal/provider/kubernetes/secrets.go
+++ b/internal/provider/kubernetes/secrets.go
@@ -91,8 +91,8 @@ func CertsToSecret(namespace string, certs *crypto.Certificates) []corev1.Secret
 // them if they do.
 func CreateOrUpdateSecrets(ctx context.Context, client client.Client, secrets []corev1.Secret, update bool) ([]corev1.Secret, error) {
 	var (
-		tidySecrets     []corev1.Secret
-		existingSecrets []string
+		tidySecrets     = make([]corev1.Secret, 0, len(secrets))
+		existingSecrets = make([]string, 0, len(secrets))
 	)
 
 	for i := range secrets {
diff --git a/internal/provider/kubernetes/status.go b/internal/provider/kubernetes/status.go
index a0e4f0ef7..286583bf7 100644
--- a/internal/provider/kubernetes/status.go
+++ b/internal/provider/kubernetes/status.go
@@ -8,7 +8,6 @@ package kubernetes
 import (
 	"context"
 	"fmt"
-	"reflect"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/types"
@@ -18,7 +17,7 @@ import (
 	gwapiv1a3 "sigs.k8s.io/gateway-api/apis/v1alpha3"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
-	"github.com/envoyproxy/gateway/internal/gatewayapi/resource"
+	"github.com/envoyproxy/gateway/internal/gatewayapi"
 	"github.com/envoyproxy/gateway/internal/gatewayapi/status"
 	"github.com/envoyproxy/gateway/internal/message"
 	"github.com/envoyproxy/gateway/internal/utils"
@@ -581,7 +580,7 @@ func mergeRouteParentStatus(ns string, old, new []gwapiv1.RouteParentStatus) []g
 	for _, oldP := range old {
 		found := -1
 		for newI, newP := range new {
-			if isParentRefEqual(oldP.ParentRef, newP.ParentRef, ns) {
+			if gatewayapi.IsParentRefEqual(oldP.ParentRef, newP.ParentRef, ns) {
 				found = newI
 				break
 			}
@@ -600,7 +599,7 @@ func mergeRouteParentStatus(ns string, old, new []gwapiv1.RouteParentStatus) []g
 	for _, newP := range new {
 		found := false
 		for _, mergedP := range merged {
-			if isParentRefEqual(newP.ParentRef, mergedP.ParentRef, ns) {
+			if gatewayapi.IsParentRefEqual(newP.ParentRef, mergedP.ParentRef, ns) {
 				found = true
 				break
 			}
@@ -613,34 +612,6 @@ func mergeRouteParentStatus(ns string, old, new []gwapiv1.RouteParentStatus) []g
 	return merged
 }
 
-func isParentRefEqual(ref1, ref2 gwapiv1.ParentReference, routeNS string) bool {
-	defaultGroup := (*gwapiv1.Group)(&gwapiv1.GroupVersion.Group)
-	if ref1.Group == nil {
-		ref1.Group = defaultGroup
-	}
-	if ref2.Group == nil {
-		ref2.Group = defaultGroup
-	}
-
-	defaultKind := gwapiv1.Kind(resource.KindGateway)
-	if ref1.Kind == nil {
-		ref1.Kind = &defaultKind
-	}
-	if ref2.Kind == nil {
-		ref2.Kind = &defaultKind
-	}
-
-	// If the parent's namespace is not set, default to the namespace of the Route.
-	defaultNS := gwapiv1.Namespace(routeNS)
-	if ref1.Namespace == nil {
-		ref1.Namespace = &defaultNS
-	}
-	if ref2.Namespace == nil {
-		ref2.Namespace = &defaultNS
-	}
-	return reflect.DeepEqual(ref1, ref2)
-}
-
 func (r *gatewayAPIReconciler) updateStatusForGateway(ctx context.Context, gtw *gwapiv1.Gateway) {
 	// nil check for unit tests.
 	if r.statusUpdater == nil {
diff --git a/internal/utils/jsonpatch/jsonpathtopointer.go b/internal/utils/jsonpatch/jsonpathtopointer.go
index 3898fb079..b1c325249 100644
--- a/internal/utils/jsonpatch/jsonpathtopointer.go
+++ b/internal/utils/jsonpatch/jsonpathtopointer.go
@@ -15,7 +15,7 @@ import (
 )
 
 func ConvertPathToPointers(jsonDoc []byte, jsonPath, path string) ([]string, error) {
-	var jsonPointers []string
+	jsonPointers := make([]string, 0, 4) // reasonable default for most json path queries
 
 	jObj, err := oj.Parse(jsonDoc)
 	if err != nil {
diff --git a/internal/utils/slice/slice.go b/internal/utils/slice/slice.go
index cc75f9f0e..68e077d21 100644
--- a/internal/utils/slice/slice.go
+++ b/internal/utils/slice/slice.go
@@ -18,12 +18,18 @@ func ContainsString(slice []string, s string) bool {
 // RemoveString returns a newly created []string that contains all items from slice that
 // are not equal to s.
 func RemoveString(slice []string, s string) []string {
-	var newSlice []string
+	if slice == nil {
+		return nil
+	}
+	newSlice := make([]string, 0, len(slice))
 	for _, item := range slice {
 		if item == s {
 			continue
 		}
 		newSlice = append(newSlice, item)
 	}
+	if len(newSlice) == 0 {
+		return nil
+	}
 	return newSlice
 }
diff --git a/internal/xds/cache/snapshotcache.go b/internal/xds/cache/snapshotcache.go
index 61b923f22..33c4cad18 100644
--- a/internal/xds/cache/snapshotcache.go
+++ b/internal/xds/cache/snapshotcache.go
@@ -90,7 +90,13 @@ func (s *snapshotCache) GenerateNewSnapshot(irKey string, resources types.XdsRes
 	}
 	xdsSnapshotCreateTotal.WithSuccess().Increment()
 
-	s.lastSnapshot[irKey] = snapshot
+	// Delete snapshot from cache if resources are nil
+	if resources == nil {
+		delete(s.lastSnapshot, irKey)
+	} else {
+		// Update snapshot in cache
+		s.lastSnapshot[irKey] = snapshot
+	}
 
 	for _, node := range s.getNodeIDs(irKey) {
 		s.log.Debugf("Generating a snapshot with Node %s", node)
@@ -407,7 +413,7 @@ func (s *snapshotCache) GetIrKeys() []string {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	var irKeys []string
+	irKeys := make([]string, 0, len(s.lastSnapshot))
 	for key := range s.lastSnapshot {
 		irKeys = append(irKeys, key)
 	}
diff --git a/internal/xds/extensions/extensions.gen.go b/internal/xds/extensions/extensions.gen.go
index 33c4ee6c1..0ef2ad09f 100644
--- a/internal/xds/extensions/extensions.gen.go
+++ b/internal/xds/extensions/extensions.gen.go
@@ -69,6 +69,8 @@ import (
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/stream/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/wasm/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/internal_listener/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/aggregate/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/common/dns/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/clusters/dns/v3"
@@ -103,6 +105,7 @@ import (
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/basic_auth/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/buffer/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/cache/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/cache_v2/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/cdn_loop/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/composite/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/compressor/v3"
@@ -178,6 +181,7 @@ import (
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/ratelimit/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/rbac/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/redis_proxy/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/reverse_tunnel/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/set_filter_state/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/sni_cluster/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/sni_dynamic_forward_proxy/v3"
@@ -198,11 +202,25 @@ import (
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/formatter/req_without_query/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/geoip_providers/common/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/geoip_providers/maxmind/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/access_token/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/file_based_metadata/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/google_compute_engine/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/google_iam/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/google_refresh_token/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/service_account_jwt_access/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/call_credentials/sts_service/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/google_default/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/insecure/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/local/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/tls/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/grpc_service/channel_credentials/xds/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/health_check/event_sinks/file/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/health_checkers/redis/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/health_checkers/thrift/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/cache/file_system_http_cache/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/cache/simple_http_cache/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/cache_v2/file_system_http_cache/v3"
+	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/cache_v2/simple_http_cache/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/custom_response/local_response_policy/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/custom_response/redirect_policy/v3"
 	_ "github.com/envoyproxy/go-control-plane/envoy/extensions/http/early_header_mutation/header_mutation/v3"
diff --git a/internal/xds/runner/runner.go b/internal/xds/runner/runner.go
index 5105d6d41..44b04f75f 100644
--- a/internal/xds/runner/runner.go
+++ b/internal/xds/runner/runner.go
@@ -9,6 +9,7 @@ import (
 	"context"
 	"crypto/tls"
 	"fmt"
+	"math/rand"
 	"net"
 	"strconv"
 	"time"
@@ -63,8 +64,16 @@ const (
 	// defaultKubernetesIssuer is the default issuer URL for Kubernetes.
 	// This is used for validating Service Account JWT tokens.
 	defaultKubernetesIssuer = "https://kubernetes.default.svc.cluster.local"
+
+	defaultMaxConnectionAgeGrace = 2 * time.Minute
 )
 
+var maxConnectionAgeValues = []time.Duration{
+	10 * time.Hour,
+	11 * time.Hour,
+	12 * time.Hour,
+}
+
 type Config struct {
 	config.Server
 	grpc              *grpc.Server
@@ -90,6 +99,20 @@ func (r *Runner) Name() string {
 	return string(egv1a1.LogComponentXdsRunner)
 }
 
+func defaultServerKeepaliveParams() keepalive.ServerParameters {
+	return keepalive.ServerParameters{
+		MaxConnectionAge:      getRandomMaxConnectionAge(),
+		MaxConnectionAgeGrace: defaultMaxConnectionAgeGrace,
+	}
+}
+
+// getRandomMaxConnectionAge picks a random maxConnectionAge value
+// to spread out envoy proxy connections over multiple envoy gateway replicas
+func getRandomMaxConnectionAge() time.Duration {
+	rnd := rand.New(rand.NewSource(time.Now().UnixNano())) //nolint:gosec
+	return maxConnectionAgeValues[rnd.Intn(len(maxConnectionAgeValues))]
+}
+
 // Close implements Runner interface.
 func (r *Runner) Close() error { return nil }
 
@@ -107,14 +130,22 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 	}
 	r.Logger.Info("loaded TLS certificate and key")
 
-	grpcOpts := []grpc.ServerOption{
-		grpc.Creds(credentials.NewTLS(tlsConfig)),
-		grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
-			MinTime:             15 * time.Second,
-			PermitWithoutStream: true,
-		}),
+	keepaliveParams := defaultServerKeepaliveParams()
+	r.Logger.Info("configured gRPC keepalive defaults", "maxConnectionAge", keepaliveParams.MaxConnectionAge, "maxConnectionAgeGrace", keepaliveParams.MaxConnectionAgeGrace)
+
+	enforcementPolicy := keepalive.EnforcementPolicy{
+		MinTime:             15 * time.Second,
+		PermitWithoutStream: true,
+	}
+
+	baseKeepaliveOptions := []grpc.ServerOption{
+		grpc.KeepaliveEnforcementPolicy(enforcementPolicy),
+		grpc.KeepaliveParams(keepaliveParams),
 	}
 
+	grpcOpts := append([]grpc.ServerOption{}, baseKeepaliveOptions...)
+	grpcOpts = append(grpcOpts, grpc.Creds(credentials.NewTLS(tlsConfig)))
+
 	// When GatewayNamespaceMode is enabled, we will use sTLS and Service Account JWT tokens to authenticate envoy proxy infra and xds server.
 	if r.EnvoyGateway.GatewayNamespaceMode() {
 		r.Logger.Info("gatewayNamespaceMode is enabled, setting up JWTAuthInterceptor and sTLS server")
@@ -135,14 +166,11 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 			return fmt.Errorf("failed to create TLS credentials: %w", err)
 		}
 
-		grpcOpts = []grpc.ServerOption{
-			grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
-				MinTime:             15 * time.Second,
-				PermitWithoutStream: true,
-			}),
+		grpcOpts = append([]grpc.ServerOption{}, baseKeepaliveOptions...)
+		grpcOpts = append(grpcOpts,
 			grpc.Creds(creds),
 			grpc.StreamInterceptor(jwtInterceptor.Stream()),
-		}
+		)
 	}
 
 	r.grpc = grpc.NewServer(grpcOpts...)
diff --git a/internal/xds/translator/accesslog.go b/internal/xds/translator/accesslog.go
index e51853f27..5cd7ef611 100644
--- a/internal/xds/translator/accesslog.go
+++ b/internal/xds/translator/accesslog.go
@@ -373,7 +373,11 @@ func celAccessLogFilter(expr string) (*accesslog.AccessLogFilter, error) {
 
 func buildAccessLogFilter(exprs []string, withNoRouteMatchFilter bool) (*accesslog.AccessLogFilter, error) {
 	// add filter for access logs
-	var filters []*accesslog.AccessLogFilter
+	capacity := len(exprs)
+	if withNoRouteMatchFilter {
+		capacity++
+	}
+	filters := make([]*accesslog.AccessLogFilter, 0, capacity)
 	for _, expr := range exprs {
 		fl, err := celAccessLogFilter(expr)
 		if err != nil {
diff --git a/internal/xds/translator/authorization.go b/internal/xds/translator/authorization.go
index 7a94453fb..e2e53f5ea 100644
--- a/internal/xds/translator/authorization.go
+++ b/internal/xds/translator/authorization.go
@@ -153,9 +153,9 @@ func buildRBACPerRoute(authorization *ir.Authorization) (*rbacv3.RBACPerRoute, e
 		rbac        *rbacv3.RBACPerRoute
 		allowAction *anypb.Any
 		denyAction  *anypb.Any
-		matcherList []*matcherv3.Matcher_MatcherList_FieldMatcher
 		err         error
 	)
+	matcherList := make([]*matcherv3.Matcher_MatcherList_FieldMatcher, 0, len(authorization.Rules))
 
 	allow := &rbacconfigv3.Action{
 		Name:   "ALLOW",
@@ -625,7 +625,7 @@ func buildHeaderPredicate(name string, values []string, ignoreCase bool) ([]*mat
 		return nil, err
 	}
 
-	var predicates []*matcherv3.Matcher_MatcherList_Predicate
+	predicates := make([]*matcherv3.Matcher_MatcherList_Predicate, 0, len(values))
 	for _, value := range values {
 		predicates = append(predicates, &matcherv3.Matcher_MatcherList_Predicate{
 			MatchType: &matcherv3.Matcher_MatcherList_Predicate_SinglePredicate_{
diff --git a/internal/xds/translator/cluster.go b/internal/xds/translator/cluster.go
index 0d3e387c1..48d4c4d86 100644
--- a/internal/xds/translator/cluster.go
+++ b/internal/xds/translator/cluster.go
@@ -725,7 +725,6 @@ func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.Destin
 }
 
 func buildZonalLocalities(metadata *corev3.Metadata, ds *ir.DestinationSetting) []*endpointv3.LocalityLbEndpoints {
-	var localities []*endpointv3.LocalityLbEndpoints
 	zonalEndpoints := make(map[string][]*endpointv3.LbEndpoint)
 	for _, irEp := range ds.Endpoints {
 		healthStatus := corev3.HealthStatus_UNKNOWN
@@ -748,6 +747,7 @@ func buildZonalLocalities(metadata *corev3.Metadata, ds *ir.DestinationSetting)
 		zonalEndpoints[zone] = append(zonalEndpoints[zone], lbEndpoint)
 	}
 
+	localities := make([]*endpointv3.LocalityLbEndpoints, 0, len(zonalEndpoints))
 	for zone, endPts := range zonalEndpoints {
 		locality := &endpointv3.LocalityLbEndpoints{
 			Locality: &corev3.Locality{
@@ -1249,7 +1249,7 @@ func buildHTTP2Settings(opts *ir.HTTP2Settings) *corev3.Http2ProtocolOptions {
 // buildEndpointOverrideLoadBalancingPolicy builds the Envoy LoadBalancingPolicy for EndpointOverride
 func buildEndpointOverrideLoadBalancingPolicy(loadBalancer *ir.LoadBalancer) (*clusterv3.LoadBalancingPolicy, error) {
 	// Build override host sources from EndpointOverride
-	var overrideHostSources []*override_hostv3.OverrideHost_OverrideHostSource
+	overrideHostSources := make([]*override_hostv3.OverrideHost_OverrideHostSource, 0, len(loadBalancer.EndpointOverride.ExtractFrom))
 
 	for _, source := range loadBalancer.EndpointOverride.ExtractFrom {
 		overrideSource := &override_hostv3.OverrideHost_OverrideHostSource{}
diff --git a/internal/xds/translator/cors.go b/internal/xds/translator/cors.go
index b53a12002..5aff0a80e 100644
--- a/internal/xds/translator/cors.go
+++ b/internal/xds/translator/cors.go
@@ -125,7 +125,6 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, _ *ir.HTTPL
 	}
 
 	var (
-		allowOrigins     []*matcherv3.StringMatcher
 		allowMethods     string
 		allowHeaders     string
 		exposeHeaders    string
@@ -144,6 +143,7 @@ func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, _ *ir.HTTPL
 
 	//nolint:gocritic
 
+	allowOrigins := make([]*matcherv3.StringMatcher, 0, len(c.AllowOrigins))
 	for _, origin := range c.AllowOrigins {
 		allowOrigins = append(allowOrigins, buildXdsStringMatcher(origin))
 	}
diff --git a/internal/xds/translator/extauth.go b/internal/xds/translator/extauth.go
index 194999d4a..3fb3ce4cc 100644
--- a/internal/xds/translator/extauth.go
+++ b/internal/xds/translator/extauth.go
@@ -107,7 +107,7 @@ func extAuthConfig(extAuth *ir.ExtAuth) (*extauthv3.ExtAuthz, error) {
 		config.ClearRouteCache = *extAuth.RecomputeRoute
 	}
 
-	var headersToExtAuth []*matcherv3.StringMatcher
+	headersToExtAuth := make([]*matcherv3.StringMatcher, 0, len(extAuth.HeadersToExtAuth))
 	for _, header := range extAuth.HeadersToExtAuth {
 		headersToExtAuth = append(headersToExtAuth, &matcherv3.StringMatcher{
 			MatchPattern: &matcherv3.StringMatcher_Exact{
@@ -164,9 +164,8 @@ func extAuthConfig(extAuth *ir.ExtAuth) (*extauthv3.ExtAuthz, error) {
 
 func httpService(http *ir.HTTPExtAuthService, timeout *durationpb.Duration) *extauthv3.HttpService {
 	var (
-		uri              string
-		headersToBackend []*matcherv3.StringMatcher
-		service          *extauthv3.HttpService
+		uri     string
+		service *extauthv3.HttpService
 	)
 
 	service = &extauthv3.HttpService{
@@ -191,6 +190,7 @@ func httpService(http *ir.HTTPExtAuthService, timeout *durationpb.Duration) *ext
 		Timeout: timeout,
 	}
 
+	headersToBackend := make([]*matcherv3.StringMatcher, 0, len(http.HeadersToBackend))
 	for _, header := range http.HeadersToBackend {
 		headersToBackend = append(headersToBackend, &matcherv3.StringMatcher{
 			MatchPattern: &matcherv3.StringMatcher_Exact{
diff --git a/internal/xds/translator/header_mutation.go b/internal/xds/translator/header_mutation.go
index 286014339..689c57824 100644
--- a/internal/xds/translator/header_mutation.go
+++ b/internal/xds/translator/header_mutation.go
@@ -92,7 +92,7 @@ func buildHeaderMutationFilter(headers *ir.HeaderSettings) (*hcmv3.HttpFilter, e
 }
 
 func buildHeaderMutationRules(addHeaders []ir.AddHeader, removeHeaders []string) []*mutation_rulesv3.HeaderMutation {
-	var mutationRules []*mutation_rulesv3.HeaderMutation
+	mutationRules := make([]*mutation_rulesv3.HeaderMutation, 0, len(addHeaders)+len(removeHeaders))
 
 	for _, header := range addHeaders {
 		var appendAction corev3.HeaderValueOption_HeaderAppendAction
diff --git a/internal/xds/translator/local_ratelimit.go b/internal/xds/translator/local_ratelimit.go
index e98809928..7a7d16ab1 100644
--- a/internal/xds/translator/local_ratelimit.go
+++ b/internal/xds/translator/local_ratelimit.go
@@ -198,8 +198,8 @@ func (*localRateLimit) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute, h
 func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
 	[]*routev3.RateLimit, []*rlv3.LocalRateLimitDescriptor,
 ) {
-	var rateLimits []*routev3.RateLimit
-	var descriptors []*rlv3.LocalRateLimitDescriptor
+	rateLimits := make([]*routev3.RateLimit, 0, len(local.Rules))
+	descriptors := make([]*rlv3.LocalRateLimitDescriptor, 0, len(local.Rules))
 
 	// Rules are ORed
 	for rIdx, rule := range local.Rules {
diff --git a/internal/xds/translator/oidc.go b/internal/xds/translator/oidc.go
index 66691cc0f..14c6c3e22 100644
--- a/internal/xds/translator/oidc.go
+++ b/internal/xds/translator/oidc.go
@@ -184,6 +184,7 @@ func oauth2Config(securityFeatures *ir.SecurityFeatures) (*oauth2v3.OAuth2, erro
 			Resources:  oidc.Resources,
 
 			PreserveAuthorizationHeader: preserveAuthorizationHeader,
+			DisableTokenEncryption:      oidc.DisableTokenEncryption,
 		},
 	}
 
diff --git a/internal/xds/translator/ratelimit.go b/internal/xds/translator/ratelimit.go
index 9f8501c5d..be4570948 100644
--- a/internal/xds/translator/ratelimit.go
+++ b/internal/xds/translator/ratelimit.go
@@ -126,6 +126,12 @@ func createRateLimitFilter(t *Translator, irListener *ir.HTTPListener, domain, f
 		rateLimitFilterProto.Timeout = durationpb.New(t.GlobalRateLimit.Timeout)
 	}
 
+	// Disable the x-envoy-ratelimited header unless envoy headers are explicitly enabled.
+	rateLimitFilterProto.DisableXEnvoyRatelimitedHeader = true
+	if irListener.Headers != nil && irListener.Headers.EnableEnvoyHeaders {
+		rateLimitFilterProto.DisableXEnvoyRatelimitedHeader = false
+	}
+
 	// Configure the X-RateLimit headers based on the listener's header settings
 	if irListener.Headers != nil && irListener.Headers.DisableRateLimitHeaders {
 		rateLimitFilterProto.EnableXRatelimitHeaders = ratelimitfilterv3.RateLimit_OFF
diff --git a/internal/xds/translator/session_persistence.go b/internal/xds/translator/session_persistence.go
index f68a18a80..8f958d30d 100644
--- a/internal/xds/translator/session_persistence.go
+++ b/internal/xds/translator/session_persistence.go
@@ -178,7 +178,7 @@ func routePathToCookiePath(path *ir.StringMatch) string {
 // https://gateway-api.sigs.k8s.io/geps/gep-1619/#path
 func getLongestNonRegexPrefix(path string) string {
 	parts := strings.Split(path, "/")
-	var longestNonRegexPrefix []string
+	longestNonRegexPrefix := make([]string, 0, len(parts))
 	for _, part := range parts {
 		if part == "*" || strings.Contains(part, "*") {
 			break
diff --git a/release-notes/current.yaml b/release-notes/current.yaml
index aa9e22b35..1516d01d0 100644
--- a/release-notes/current.yaml
+++ b/release-notes/current.yaml
@@ -14,6 +14,7 @@ new features: |
   Added support for late response headers in ClientTrafficPolicy.
   Added max connection/stream duration and max requests per connection to ClientTrafficPolicy.
   Added cacheDuration for remoteJWKS in SecurityPolicy.
+  Added support for DisableTokenEncryption in OIDC authn to disable encryption of ID and access tokens stored in cookies.
 
 bug fixes: |
   Fixed %ROUTE_KIND% operator to be lower-cased when used by clusterStatName in EnvoyProxy API.
@@ -30,6 +31,7 @@ bug fixes: |
   Fixed validation for grpc routes with extension ref filters.
   Fixed service account token handling in GatewayNamespaceMode to use SDS for properly refreshing expired token.
   Fixed handling of regex meta characters in prefix match replace for URL rewrite.
+  Disabled the default emission of `x-envoy-ratelimited` headers from the rate limit filter; re-enable with the `enableEnvoyHeaders` setting in ClientTrafficPolicy.
 
 # Enhancements that improve performance.
 performance improvements: |
diff --git a/release-notes/v1.5.2.yaml b/release-notes/v1.5.2.yaml
new file mode 100644
index 000000000..d94898b00
--- /dev/null
+++ b/release-notes/v1.5.2.yaml
@@ -0,0 +1,30 @@
+date: October 2, 2025
+
+# Changes that are expected to cause an incompatibility with previous versions, such as deletions or modifications to existing APIs.
+breaking changes: |
+
+# Updates addressing vulnerabilities, security flaws, or compliance requirements.
+security updates: |
+  Updated distroless image to resolve glibc CVEs.
+  Bumped Go version to 1.24.7.
+
+# New features or capabilities added in this release.
+new features: |
+
+bug fixes: |
+  Fixed service account token handling in GatewayNamespaceMode to use SDS for properly refreshing expired token.
+  Fixed preserve route parent status for multi-parent routes.
+  Fixed weighted cluster generation in RouteAction when URLRewrite filter is applied.
+  Fixed handling of regex meta characters in prefix match replace for URL rewrite.
+  Disabled the default emission of `x-envoy-ratelimited` headers from the rate limit filter; re-enable with the `enableEnvoyHeaders` setting in ClientTrafficPolicy.
+  Fixed race condition when accessing `mergeGateways` set.
+
+# Enhancements that improve performance.
+performance improvements: |
+  Optimized memory usage of control plane.
+
+# Deprecated features or APIs.
+deprecations: |
+
+# Other notable changes not covered by the above sections.
+Other changes: |
diff --git a/site/content/en/_index.md b/site/content/en/_index.md
index ea6874b93..bdd3a90c2 100644
--- a/site/content/en/_index.md
+++ b/site/content/en/_index.md
@@ -138,3 +138,5 @@ no_list: true
 {{< adopters >}}
 
 {{< ecosystem >}}
+
+{{< enterprise_support >}}
diff --git a/site/content/en/contributions/ENTERPRISE_SUPPORT.md b/site/content/en/contributions/ENTERPRISE_SUPPORT.md
new file mode 100644
index 000000000..99bdc1dda
--- /dev/null
+++ b/site/content/en/contributions/ENTERPRISE_SUPPORT.md
@@ -0,0 +1,45 @@
+---
+title: "Enterprise Support"
+description: "Professional enterprise support for Envoy Gateway"
+---
+
+# Enterprise Support for Envoy Gateway
+
+[Envoy Gateway](https://gateway.envoyproxy.io) is a sub-project of [Envoy](https://www.envoyproxy.io),
+a [graduated CNCF project](https://www.cncf.io/projects/envoy/) under the [Cloud Native Computing Foundation (CNCF)](https://www.cncf.io),
+which is a part of the [Linux Foundation](https://www.linuxfoundation.org), a 501(c)(6) nonprofit organization.
+
+## Professional Support & Services
+
+While Envoy Gateway is open source and free to use, many organizations benefit from professional support, training, and consulting services to accelerate adoption and ensure production success.
+
+## Why Choose Enterprise Support?
+
+🛡️ **Production Assurance** – Get expert guidance for mission-critical deployments with guaranteed response times and SLAs  
+🚀 **Faster Implementation** – Leverage professional services to accelerate your API gateway rollout and avoid common pitfalls  
+📚 **Training & Best Practices** – Access comprehensive training programs and learn proven deployment patterns from experts  
+🔧 **Custom Solutions** – Get help with complex integrations, custom policies, and advanced use cases  
+
+## How to List Your Company
+
+If your organization provides enterprise support, training, or consulting services for Envoy Gateway:
+
+1. **Fork the repository** – Clone the [Envoy Gateway website repository](https://github.com/envoyproxy/gateway) to your local machine.  
+2. **Upload your logo** - Add a hi-resolution logo file (SVG or PNG format) in `site/static/logos`.
+3. **Update the enterprise file** – Add your company details in `site/data/enterprise_support.yaml`.
+4. **Submit a Pull Request (PR)** – Open a PR with your changes, and the Envoy Gateway maintainers will review and merge it.
+
+### Example Entry
+
+```yaml
+- name:        Your Company Name
+  logo:        /logos/your-company-logo.png
+  url:         https://your-company.com
+  description: Brief description of your Envoy Gateway support services, training programs, or consulting offerings.
+```
+
+🔹 By submitting your information, you confirm that your company provides legitimate enterprise support services for Envoy Gateway. This listing does not imply an official endorsement or partnership.
+
+🔹 Need to update or remove your listing later? Simply submit a PR or contact the Envoy Gateway maintainers.
+
+Partner with trusted providers to ensure your Envoy Gateway deployment success! 🚀
\ No newline at end of file
diff --git a/site/content/en/news/releases/notes/v1.5.2.md b/site/content/en/news/releases/notes/v1.5.2.md
new file mode 100644
index 000000000..4d0c0d560
--- /dev/null
+++ b/site/content/en/news/releases/notes/v1.5.2.md
@@ -0,0 +1,34 @@
+---
+title: "v1.5.2"
+publishdate: 2025-10-02
+---
+
+Date: October 2, 2025
+
+## Breaking changes
+- 
+
+## Security updates
+- Updated distroless image to resolve glibc CVEs.
+- Bumped Go version to 1.24.7.
+
+## New features
+- 
+
+## Bug fixes
+- Fixed service account token handling in GatewayNamespaceMode to use SDS for properly refreshing expired token.
+- Fixed preserve route parent status for multi-parent routes.
+- Fixed weighted cluster generation in RouteAction when URLRewrite filter is applied.
+- Fixed handling of regex meta characters in prefix match replace for URL rewrite.
+- Disabled the default emission of `x-envoy-ratelimited` headers from the rate limit filter; re-enable with the `enableEnvoyHeaders` setting in ClientTrafficPolicy.
+- Fixed race condition when accessing `mergeGateways` set.
+
+## Performance improvements
+- Optimized memory usage of control plane.
+
+## Deprecations
+- 
+
+## Other changes
+- 
+
diff --git a/site/data/enterprise_support.yaml b/site/data/enterprise_support.yaml
new file mode 100644
index 000000000..84cb8a3c7
--- /dev/null
+++ b/site/data/enterprise_support.yaml
@@ -0,0 +1 @@
+adopters: []
diff --git a/site/layouts/shortcodes/enterprise_support.html b/site/layouts/shortcodes/enterprise_support.html
new file mode 100644
index 000000000..d6b815889
--- /dev/null
+++ b/site/layouts/shortcodes/enterprise_support.html
@@ -0,0 +1,20 @@
+{{ $adopters := .Site.Data.enterprise_support.adopters }}
+<section class="adopters-section">
+  <h2 class="text-center mb-5">Enterprise Support</h2>
+  <div class="adopters-list">
+    {{ range $adopters }}
+    <a class="adopter" href="{{ .url }}" target="_blank" rel="noopener noreferrer">
+      <img src="{{ .logo | relURL }}" alt="{{ .name }} logo" loading="lazy">
+      <div class="adopter-info">
+        <p>{{ .description }}</p>
+      </div>
+    </a>
+    {{ end }}
+    <a class="adopter" href="https://github.com/envoyproxy/gateway/blob/main/site/content/en/contributions/ENTERPRISE_SUPPORT.md" target="_blank" rel="noopener noreferrer">
+      <img src="/img/add-your-logo-here.svg" alt="Add your logo here!" loading="lazy">
+      <div class="adopter-info">
+        <p>Provide enterprise support for Envoy Gateway? You can add your company here! Click to learn more.</p>
+      </div>
+    </a>
+  </div>
+</section>
\ No newline at end of file
diff --git a/site/layouts/shortcodes/helm-version.html b/site/layouts/shortcodes/helm-version.html
index 16f362aa2..410a9639a 100644
--- a/site/layouts/shortcodes/helm-version.html
+++ b/site/layouts/shortcodes/helm-version.html
@@ -15,8 +15,8 @@
 {{- "v1.4.4" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "v1.5") -}}
-{{- "v1.5.1" -}}
+{{- "v1.5.2" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "docs") -}}
-{{- "v1.5.1" -}}
+{{- "v1.5.2" -}}
 {{- end -}}
diff --git a/site/layouts/shortcodes/yaml-version.html b/site/layouts/shortcodes/yaml-version.html
index a64e5fac6..3e6a7d651 100644
--- a/site/layouts/shortcodes/yaml-version.html
+++ b/site/layouts/shortcodes/yaml-version.html
@@ -15,8 +15,8 @@
 {{- "v1.4.4" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "v1.5") -}}
-{{- "v1.5.1" -}}
+{{- "v1.5.2" -}}
 {{- end -}}
 {{- with (strings.HasPrefix $pagePrefix "docs") -}}
-{{- "v1.5.1" -}}
+{{- "v1.5.2" -}}
 {{- end -}}
diff --git a/tools/linter/golangci-lint/.golangci.yml b/tools/linter/golangci-lint/.golangci.yml
index c8c6b8218..416543bd0 100644
--- a/tools/linter/golangci-lint/.golangci.yml
+++ b/tools/linter/golangci-lint/.golangci.yml
@@ -42,6 +42,7 @@ linters:
     - gosec
     - importas
     - misspell
+    - prealloc
     - revive
     - staticcheck
     - testifylint



Test patch:
diff --git a/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml b/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
index b7e57c2ca..ed3d14678 100644
--- a/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
@@ -189,6 +189,7 @@ xds:
                     typedConfig:
                       '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
                       domain: eag-ratelimit
+                      disableXEnvoyRatelimitedHeader: true
                       failureModeDeny: true
                       rateLimitService:
                         grpcService:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc.in.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc.in.yaml
index 5a69a72b7..fe3e092cb 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc.in.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc.in.yaml
@@ -128,3 +128,4 @@ securityPolicies:
       refreshToken: true
       defaultRefreshTokenTTL: 48h
       cookieDomain: "example.com"
+      disableTokenEncryption: true
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
index 82169c485..f902860e3 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
@@ -157,6 +157,7 @@ securityPolicies:
       cookieDomain: example.com
       defaultRefreshTokenTTL: 48h
       defaultTokenTTL: 1h
+      disableTokenEncryption: true
       forwardAccessToken: true
       logoutPath: /foo/logout
       provider:
@@ -314,6 +315,7 @@ xdsIR:
             cookieSuffix: 5f93c2e4
             defaultRefreshTokenTTL: 48h0m0s
             defaultTokenTTL: 1h0m0s
+            disableTokenEncryption: true
             forwardAccessToken: true
             hmacSecret: '[redacted]'
             logoutPath: /foo/logout
diff --git a/internal/infrastructure/kubernetes/resource/resource_test.go b/internal/infrastructure/kubernetes/resource/resource_test.go
index 52c1d73f6..93142da14 100644
--- a/internal/infrastructure/kubernetes/resource/resource_test.go
+++ b/internal/infrastructure/kubernetes/resource/resource_test.go
@@ -11,8 +11,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	corev1 "k8s.io/api/core/v1"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
 
 	egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
@@ -163,194 +161,6 @@ func TestGetSelector(t *testing.T) {
 	}
 }
 
-func TestCompareSvc(t *testing.T) {
-	cases := []struct {
-		ExpectRet   bool
-		NewSvc      *corev1.Service
-		OriginalSvc *corev1.Service
-	}{
-		{
-			// Only Spec.Ports[*].NodePort and ClusterType is different
-			ExpectRet: true,
-			NewSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							NodePort:   30000,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "NodePort",
-				},
-			},
-			OriginalSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							NodePort:   30001,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "NodePort",
-				},
-			},
-		},
-		{
-			// Only Spec.Ports[*].Port is different
-			ExpectRet: false,
-			NewSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "ClusterIP",
-				},
-			},
-			OriginalSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       90,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "ClusterIP",
-				},
-			},
-		},
-		{
-			// only Spec.ClusterIP is different, NewSvc's ClusterIP is nil build by ResourceRender
-			ExpectRet: true,
-			NewSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					ClusterIP: "",
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "ClusterIP",
-				},
-			},
-			OriginalSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					ClusterIP: "192.168.1.1",
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "ClusterIP",
-				},
-			},
-		},
-		{
-			// Finalizers field differs
-			ExpectRet: true,
-			NewSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:       "my-service",
-					Namespace:  "default",
-					Finalizers: []string{"service.k8s.aws/resources"},
-				},
-				Spec: corev1.ServiceSpec{
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "ClusterIP",
-				},
-			},
-			OriginalSvc: &corev1.Service{
-				ObjectMeta: metav1.ObjectMeta{
-					Name:      "my-service",
-					Namespace: "default",
-				},
-				Spec: corev1.ServiceSpec{
-					Ports: []corev1.ServicePort{
-						{
-							Name:       "http",
-							Port:       80,
-							TargetPort: intstr.FromInt(8080),
-						},
-					},
-					Selector: map[string]string{
-						"app": "my-app",
-					},
-					Type: "ClusterIP",
-				},
-			},
-		},
-	}
-
-	for _, tc := range cases {
-		t.Run("", func(t *testing.T) {
-			assert.Equal(t, tc.ExpectRet, CompareSvc(tc.NewSvc, tc.OriginalSvc), "expectedCompareSvcReturn(%v)", tc.ExpectRet)
-		})
-	}
-}
-
 func TestExpectedProxyContainerEnv(t *testing.T) {
 	type args struct {
 		container *egv1a1.KubernetesContainerSpec
diff --git a/internal/provider/kubernetes/controller_test.go b/internal/provider/kubernetes/controller_test.go
index d8799ffde..9a978495a 100644
--- a/internal/provider/kubernetes/controller_test.go
+++ b/internal/provider/kubernetes/controller_test.go
@@ -303,7 +303,7 @@ func TestProcessBackendRefsWithCustomBackends(t *testing.T) {
 
 			// Create resource mappings
 			resourceMappings := &resourceMappings{
-				allAssociatedBackendRefs:                sets.New[gwapiv1.BackendObjectReference](),
+				allAssociatedBackendRefs:                make(map[utils.NamespacedNameWithGroupKind]gwapiv1.BackendObjectReference),
 				allAssociatedNamespaces:                 sets.New[string](),
 				allAssociatedBackendRefExtensionFilters: sets.New[utils.NamespacedNameWithGroupKind](),
 				extensionRefFilters:                     tc.existingExtFilters,
@@ -311,7 +311,7 @@ func TestProcessBackendRefsWithCustomBackends(t *testing.T) {
 
 			// Add backend refs to the mapping
 			for _, backendRef := range tc.backendRefs {
-				resourceMappings.allAssociatedBackendRefs.Insert(backendRef)
+				resourceMappings.insertBackendRef(backendRef)
 			}
 
 			// Create empty resource tree
@@ -1303,11 +1303,14 @@ func TestProcessServiceClusterForGatewayClass(t *testing.T) {
 
 			r.processServiceClusterForGatewayClass(tc.envoyProxy, tc.gatewayClass, resourceMap)
 
-			require.Contains(t, resourceMap.allAssociatedBackendRefs, gwapiv1.BackendObjectReference{
-				Kind:      ptr.To(gwapiv1.Kind("Service")),
+			expectedRef := gwapiv1.BackendObjectReference{
+				Kind:      ptr.To(gwapiv1.Kind(resource.KindService)),
 				Namespace: gatewayapi.NamespacePtr(r.namespace),
 				Name:      gwapiv1.ObjectName(tc.expectedSvcName),
-			})
+			}
+			key := backendRefKey(&expectedRef)
+			require.Contains(t, resourceMap.allAssociatedBackendRefs, key)
+			require.Equal(t, expectedRef, resourceMap.allAssociatedBackendRefs[key])
 		})
 	}
 }
@@ -1457,11 +1460,14 @@ func TestProcessServiceClusterForGateway(t *testing.T) {
 
 			r.processServiceClusterForGateway(tc.envoyProxy, tc.gateway, resourceMap)
 
-			require.Contains(t, resourceMap.allAssociatedBackendRefs, gwapiv1.BackendObjectReference{
-				Kind:      ptr.To(gwapiv1.Kind("Service")),
+			expectedRef := gwapiv1.BackendObjectReference{
+				Kind:      ptr.To(gwapiv1.Kind(resource.KindService)),
 				Namespace: gatewayapi.NamespacePtr(tc.expectedSvcNamespace),
 				Name:      gwapiv1.ObjectName(tc.expectedSvcName),
-			})
+			}
+			key := backendRefKey(&expectedRef)
+			require.Contains(t, resourceMap.allAssociatedBackendRefs, key)
+			require.Equal(t, expectedRef, resourceMap.allAssociatedBackendRefs[key])
 		})
 	}
 }
@@ -1481,6 +1487,23 @@ func newGatewayAPIReconciler(logger logging.Logger) *gatewayAPIReconciler {
 	}
 }
 
+func TestProcessBackendRefDeduplicatesLogicalBackend(t *testing.T) {
+	logger := logging.DefaultLogger(os.Stdout, egv1a1.LogLevelInfo)
+	r := newGatewayAPIReconciler(logger)
+	resourceTree := resource.NewResources()
+	resourceMap := newResourceMapping()
+
+	backendRef := gwapiv1.BackendObjectReference{
+		Namespace: gatewayapi.NamespacePtr("default"),
+		Name:      "svc",
+	}
+
+	require.NoError(t, r.processBackendRef(t.Context(), resourceMap, resourceTree, resource.KindHTTPRoute, "default", "route-a", backendRef))
+	require.NoError(t, r.processBackendRef(t.Context(), resourceMap, resourceTree, resource.KindHTTPRoute, "default", "route-b", backendRef))
+
+	require.Len(t, resourceMap.allAssociatedBackendRefs, 1)
+}
+
 func TestProcessBackendRefs(t *testing.T) {
 	ns := "default"
 	ctb := test.GetClusterTrustBundle("fake-ctb")
@@ -1584,7 +1607,7 @@ func TestProcessBackendRefs(t *testing.T) {
 			resourceTree := resource.NewResources()
 			resourceMap := newResourceMapping()
 			backend := tc.backend
-			resourceMap.allAssociatedBackendRefs.Insert(gwapiv1.BackendObjectReference{
+			resourceMap.insertBackendRef(gwapiv1.BackendObjectReference{
 				Kind:      gatewayapi.KindPtr(resource.KindBackend),
 				Namespace: gatewayapi.NamespacePtr(backend.Namespace),
 				Name:      gwapiv1.ObjectName(backend.Name),
diff --git a/internal/provider/kubernetes/kubernetes_test.go b/internal/provider/kubernetes/kubernetes_test.go
index 81d91536b..25288b579 100644
--- a/internal/provider/kubernetes/kubernetes_test.go
+++ b/internal/provider/kubernetes/kubernetes_test.go
@@ -1412,13 +1412,9 @@ func TestNamespaceSelectorProvider(t *testing.T) {
 		return resources.GatewayAPIResources.Len() != 0
 	}, defaultWait, defaultTick)
 
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		return res != nil && len(res.Gateways) == 1
-	}, defaultWait, defaultTick)
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.Gateways) == 1
+	})
 
 	_, ok := resources.GatewayStatuses.Load(types.NamespacedName{Name: "non-watched-gateway", Namespace: nonWatchedNS.Name})
 	require.Equal(t, false, ok)
@@ -1560,54 +1556,28 @@ func TestNamespaceSelectorProvider(t *testing.T) {
 		require.NoError(t, cli.Delete(ctx, nonWatchedUDPRoute))
 	}()
 
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		// The service number dependes on the service created and the backendRef
-		return res != nil && len(res.Services) == 5
-	}, defaultWait, defaultTick)
-
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		return res != nil && len(res.HTTPRoutes) == 1
-	}, defaultWait, defaultTick)
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.Services) == 1
+	})
 
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		return res != nil && len(res.TCPRoutes) == 1
-	}, defaultWait, defaultTick)
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.HTTPRoutes) == 1
+	})
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.TCPRoutes) == 1
+	})
 
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		return res != nil && len(res.TLSRoutes) == 1
-	}, defaultWait, defaultTick)
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.TLSRoutes) == 1
+	})
 
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		return res != nil && len(res.UDPRoutes) == 1
-	}, defaultWait, defaultTick)
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.UDPRoutes) == 1
+	})
 
-	require.Eventually(t, func() bool {
-		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gc.Name)
-		if !ok {
-			return false
-		}
-		return res != nil && len(res.GRPCRoutes) == 1
-	}, defaultWait, defaultTick)
+	requireResourceReady(t, resources, gc.Name, func(r *resource.Resources) bool {
+		return len(r.GRPCRoutes) == 1
+	})
 }
 
 func waitUntilGatewayClassResourcesAreReady(resources *message.ProviderResources, gatewayClassName string) (*resource.Resources, bool) {
@@ -1618,3 +1588,13 @@ func waitUntilGatewayClassResourcesAreReady(resources *message.ProviderResources
 
 	return res, true
 }
+
+func requireResourceReady(t *testing.T, resources *message.ProviderResources, gatewayClassName string, cmpFunc func(r *resource.Resources) bool) {
+	require.Eventually(t, func() bool {
+		res, ok := waitUntilGatewayClassResourcesAreReady(resources, gatewayClassName)
+		if !ok {
+			return false
+		}
+		return cmpFunc(res)
+	}, defaultWait, defaultTick)
+}
diff --git a/internal/provider/kubernetes/routes_test.go b/internal/provider/kubernetes/routes_test.go
index 8d69fd9c4..f3b6261c6 100644
--- a/internal/provider/kubernetes/routes_test.go
+++ b/internal/provider/kubernetes/routes_test.go
@@ -1302,7 +1302,7 @@ func TestProcessHTTPRoutesWithCustomBackends(t *testing.T) {
 			// Verify results
 			require.NoError(t, err)
 			require.Len(t, resourceMap.extensionRefFilters, tc.expectedExtFiltersCount)
-			require.Equal(t, tc.expectedBackendRefsCount, resourceMap.allAssociatedBackendRefs.Len())
+			require.Len(t, resourceMap.allAssociatedBackendRefs, tc.expectedBackendRefsCount)
 
 			// Verify that HTTPRoutes were processed
 			require.Len(t, resourceTree.HTTPRoutes, 1)
diff --git a/internal/xds/runner/runner_test.go b/internal/xds/runner/runner_test.go
index 154edbdb8..445619bf7 100644
--- a/internal/xds/runner/runner_test.go
+++ b/internal/xds/runner/runner_test.go
@@ -318,7 +318,7 @@ func TestRunner(t *testing.T) {
 	xdsIR.Delete("test")
 	require.Eventually(t, func() bool {
 		// Wait for the IR to be empty after deletion
-		return len(xdsIR.LoadAll()) == 0
+		return !r.cache.SnapshotHasIrKey("test") && len(xdsIR.LoadAll()) == 0
 	}, time.Second*5, time.Millisecond*50)
 }
 
@@ -511,3 +511,35 @@ type xdsHookClientMock struct {
 func (c *xdsHookClientMock) PostHTTPListenerModifyHook(*listenerv3.Listener, []*unstructured.Unstructured) (*listenerv3.Listener, error) {
 	return nil, fmt.Errorf("assuming a network error during the call")
 }
+
+func TestGetRandomMaxConnectionAge(t *testing.T) {
+	// Counter to track how many times each value is returned
+	counts := make(map[time.Duration]int)
+
+	// Call the function 100 times
+	for i := 0; i < 100; i++ {
+		value := getRandomMaxConnectionAge()
+
+		// Verify the value is one of the expected values from maxConnectionAgeValues
+		found := false
+		for _, expected := range maxConnectionAgeValues {
+			if value == expected {
+				found = true
+				break
+			}
+		}
+		assert.True(t, found, "Unexpected value returned: %v", value)
+
+		// Track counts
+		counts[value]++
+	}
+
+	// Verify each known duration gets called at least 10 times
+	for _, expectedValue := range maxConnectionAgeValues {
+		count := counts[expectedValue]
+		assert.GreaterOrEqual(t, count, 10, "Expected value %v to be called at least 10 times, got %d", expectedValue, count)
+	}
+
+	// Verify we got different values (randomness check)
+	assert.Len(t, counts, len(maxConnectionAgeValues), "Should see all possible values")
+}
diff --git a/internal/xds/translator/testdata/in/xds-ir/oidc.yaml b/internal/xds/translator/testdata/in/xds-ir/oidc.yaml
index 0c3c60fd5..8179eecc7 100644
--- a/internal/xds/translator/testdata/in/xds-ir/oidc.yaml
+++ b/internal/xds/translator/testdata/in/xds-ir/oidc.yaml
@@ -92,3 +92,4 @@ http:
           idToken: "CustomIdTokenOverride"
           accessToken: "CustomAccessTokenOverride"
         cookieDomain: "example.com"
+        disableTokenEncryption: true
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
index 4347e1ff7..4aee3acf7 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
@@ -19,6 +19,7 @@
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
             domain: eg-ratelimit
+            disableXEnvoyRatelimitedHeader: true
             failureModeDeny: true
             rateLimitService:
               grpcService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
index 4347e1ff7..4aee3acf7 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
@@ -19,6 +19,7 @@
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
             domain: eg-ratelimit
+            disableXEnvoyRatelimitedHeader: true
             failureModeDeny: true
             rateLimitService:
               grpcService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
index a4d81f0e1..800e15de9 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
@@ -40,6 +40,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml
index 496d62dc6..c223eaf46 100644
--- a/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml
@@ -109,6 +109,7 @@
               - name: test-no-type
                 stringMatch:
                   exact: foobar
+              disableTokenEncryption: true
               preserveAuthorizationHeader: true
               redirectPathMatcher:
                 path:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
index 5848912b9..68136c025 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-disable-headers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-disable-headers.listeners.yaml
index d7dc5d129..af301069a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-disable-headers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-disable-headers.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             rateLimitService:
               grpcService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-endpoint-stats.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-endpoint-stats.listeners.yaml
index 5848912b9..68136c025 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-endpoint-stats.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-endpoint-stats.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-global-shared.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-global-shared.listeners.yaml
index 8576ebeb0..417121f9f 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-global-shared.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-global-shared.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
@@ -27,6 +28,7 @@
         - name: envoy.filters.http.ratelimit/test-namespace/test-policy-1
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: test-namespace/test-policy-1
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
@@ -37,6 +39,7 @@
         - name: envoy.filters.http.ratelimit/test-namespace/test-policy-2
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: test-namespace/test-policy-2
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-headers-and-cidr.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-headers-and-cidr.listeners.yaml
index 5848912b9..68136c025 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-headers-and-cidr.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-headers-and-cidr.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-multi-global-shared.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-multi-global-shared.listeners.yaml
index 8576ebeb0..417121f9f 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-multi-global-shared.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-multi-global-shared.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
@@ -27,6 +28,7 @@
         - name: envoy.filters.http.ratelimit/test-namespace/test-policy-1
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: test-namespace/test-policy-1
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
@@ -37,6 +39,7 @@
         - name: envoy.filters.http.ratelimit/test-namespace/test-policy-2
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: test-namespace/test-policy-2
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
index 5848912b9..68136c025 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
index 5848912b9..68136c025 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
@@ -17,6 +17,7 @@
         - name: envoy.filters.http.ratelimit
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
+            disableXEnvoyRatelimitedHeader: true
             domain: first-listener
             enableXRatelimitHeaders: DRAFT_VERSION_03
             rateLimitService:
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 113e45648..e8d4a8fb9 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -3377,6 +3377,7 @@ _Appears in:_
 | `defaultTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | DefaultTokenTTL is the default lifetime of the id token and access token.<br />Please note that Envoy will always use the expiry time from the response<br />of the authorization server if it is provided. This field is only used when<br />the expiry time is not provided by the authorization.<br />If not specified, defaults to 0. In this case, the "expires_in" field in<br />the authorization response must be set by the authorization server, or the<br />OAuth flow will fail. |
 | `refreshToken` | _boolean_ |  false  |  | RefreshToken indicates whether the Envoy should automatically refresh the<br />id token and access token when they expire.<br />When set to true, the Envoy will use the refresh token to get a new id token<br />and access token when they expire.<br />If not specified, defaults to false. |
 | `defaultRefreshTokenTTL` | _[Duration](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.Duration)_ |  false  |  | DefaultRefreshTokenTTL is the default lifetime of the refresh token.<br />This field is only used when the exp (expiration time) claim is omitted in<br />the refresh token or the refresh token is not JWT.<br />If not specified, defaults to 604800s (one week).<br />Note: this field is only applicable when the "refreshToken" field is set to true. |
+| `disableTokenEncryption` | _boolean_ |  false  |  | Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.<br />This option should only be used in secure environments where token encryption is not required.<br />Default is false (tokens are encrypted). |
 | `passThroughAuthHeader` | _boolean_ |  false  |  | Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless<br />explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.<br />The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC<br />redirects and wish to directly supply a token instead.<br />If not specified, defaults to false. |
 
 
diff --git a/test/e2e/tests/eg_upgrade.go b/test/e2e/tests/eg_upgrade.go
index 9d5301dd5..437fcae6a 100644
--- a/test/e2e/tests/eg_upgrade.go
+++ b/test/e2e/tests/eg_upgrade.go
@@ -52,7 +52,7 @@ var EGUpgradeTest = suite.ConformanceTest{
 			chartPath := "../../../charts/gateway-helm"
 			relName := "eg"
 			depNS := "envoy-gateway-system"
-			lastVersionTag := "v1.5.1" //  the latest prior release
+			lastVersionTag := "v1.5.2" //  the latest prior release
 
 			t.Logf("Upgrading from version: %s", lastVersionTag)
 
diff --git a/test/e2e/tests/udproute.go b/test/e2e/tests/udproute.go
index a63936256..6174917d5 100644
--- a/test/e2e/tests/udproute.go
+++ b/test/e2e/tests/udproute.go
@@ -75,12 +75,12 @@ type GatewayRef struct {
 
 // NewGatewayRef creates a GatewayRef resource.  ListenerNames are optional.
 func NewGatewayRef(nn types.NamespacedName, listenerNames ...string) GatewayRef {
-	var listeners []*gwapiv1.SectionName
-
 	if len(listenerNames) == 0 {
 		listenerNames = append(listenerNames, "")
 	}
 
+	listeners := make([]*gwapiv1.SectionName, 0, len(listenerNames))
+
 	for _, listener := range listenerNames {
 		sectionName := gwapiv1.SectionName(listener)
 		listeners = append(listeners, &sectionName)
diff --git a/test/helm/gateway-crds-helm/all.out.yaml b/test/helm/gateway-crds-helm/all.out.yaml
index 4ec1931a6..d1c42e6fa 100644
--- a/test/helm/gateway-crds-helm/all.out.yaml
+++ b/test/helm/gateway-crds-helm/all.out.yaml
@@ -40154,7 +40154,7 @@ spec:
                                           If multiple values are specified, one of the values must match for the rule to match.
                                         items:
                                           type: string
-                                        maxItems: 16
+                                        maxItems: 128
                                         minItems: 1
                                         type: array
                                     required:
@@ -43827,6 +43827,12 @@ spec:
                     required:
                     - headers
                     type: object
+                  disableTokenEncryption:
+                    description: |-
+                      Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
+                      This option should only be used in secure environments where token encryption is not required.
+                      Default is false (tokens are encrypted).
+                    type: boolean
                   forwardAccessToken:
                     description: |-
                       ForwardAccessToken indicates whether the Envoy should forward the access token
diff --git a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
index 8875240ca..2fb57f82d 100644
--- a/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
+++ b/test/helm/gateway-crds-helm/envoy-gateway-crds.out.yaml
@@ -22842,7 +22842,7 @@ spec:
                                           If multiple values are specified, one of the values must match for the rule to match.
                                         items:
                                           type: string
-                                        maxItems: 16
+                                        maxItems: 128
                                         minItems: 1
                                         type: array
                                     required:
@@ -26515,6 +26515,12 @@ spec:
                     required:
                     - headers
                     type: object
+                  disableTokenEncryption:
+                    description: |-
+                      Disable token encryption. When set to true, both the access token and the ID token will be stored in plain text.
+                      This option should only be used in secure environments where token encryption is not required.
+                      Default is false (tokens are encrypted).
+                    type: boolean
                   forwardAccessToken:
                     description: |-
                       ForwardAccessToken indicates whether the Envoy should forward the access token