diff --git a/.changelog/10475.txt b/.changelog/10475.txt
new file mode 100644
index 000000000..30fd82326
--- /dev/null
+++ b/.changelog/10475.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+structs: prevent service-defaults upstream configs from using wildcard names or namespaces
+```
diff --git a/agent/structs/config_entry.go b/agent/structs/config_entry.go
index f6a2b25f4..d88e8ae03 100644
--- a/agent/structs/config_entry.go
+++ b/agent/structs/config_entry.go
@@ -789,6 +789,12 @@ func (cfg UpstreamConfig) validate(named bool) error {
 		if cfg.Name == "" {
 			return fmt.Errorf("Name is required")
 		}
+		if cfg.Name == WildcardSpecifier {
+			return fmt.Errorf("Wildcard name is not supported")
+		}
+		if cfg.EnterpriseMeta.NamespaceOrDefault() == WildcardSpecifier {
+			return fmt.Errorf("Wildcard namespace is not supported")
+		}
 	} else {
 		if cfg.Name != "" {
 			return fmt.Errorf("Name must be empty")