diff --git a/agent/structs/connect_proxy_config.go b/agent/structs/connect_proxy_config.go
index a2e32c1c7..780b5fcbb 100644
--- a/agent/structs/connect_proxy_config.go
+++ b/agent/structs/connect_proxy_config.go
@@ -249,7 +249,8 @@ type Upstream struct {
 	MeshGateway MeshGatewayConfig `json:",omitempty"`
 
 	// IngressHosts are a list of hosts that should route to this upstream from
-	// an ingress gateway
+	// an ingress gateway. This cannot and should not be set by a user, it is
+	// used internally to store the association of hosts to an upstream service.
 	IngressHosts []string `json:"-" bexpr:"-"`
 }
 
diff --git a/agent/structs/connect_proxy_config_test.go b/agent/structs/connect_proxy_config_test.go
index bc1dd0f50..252111334 100644
--- a/agent/structs/connect_proxy_config_test.go
+++ b/agent/structs/connect_proxy_config_test.go
@@ -100,6 +100,8 @@ func TestUpstream_MarshalJSON(t *testing.T) {
 				DestinationName: "foo",
 				Datacenter:      "dc1",
 				LocalBindPort:   1234,
+				// Test IngressHosts does not marshal
+				IngressHosts: []string{"test.example.com"},
 			},
 			want: `{
 				"DestinationType": "service",
@@ -179,6 +181,22 @@ func TestUpstream_UnmarshalJSON(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "ingress-hosts-do-not-unmarshal",
+			json: `{
+				"DestinationType": "service",
+				"DestinationName": "foo",
+				"Datacenter": "dc1",
+				"IngressHosts": ["asdf"]
+			}`,
+			want: Upstream{
+				DestinationType: UpstreamDestTypeService,
+				DestinationName: "foo",
+				Datacenter:      "dc1",
+				IngressHosts:    nil, // Make sure this doesn't get parsed
+			},
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {