diff --git a/.changelog/11109.txt b/.changelog/11109.txt
new file mode 100644
index 000000000..a19c7b2bf
--- /dev/null
+++ b/.changelog/11109.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix upstream listener escape hatch for prepared queries
+```
\ No newline at end of file
diff --git a/agent/xds/listeners.go b/agent/xds/listeners.go
index 2f41a9c08..43510b204 100644
--- a/agent/xds/listeners.go
+++ b/agent/xds/listeners.go
@@ -252,6 +252,20 @@ func (s *ResourceGenerator) listenersFromSnapshotConnectProxy(cfgSnap *proxycfg.
 			// default config if there is an error so it's safe to continue.
 			s.Logger.Warn("failed to parse", "upstream", u.Identifier(), "error", err)
 		}
+
+		// If escape hatch is present, create a listener from it and move on to the next
+		if cfg.EnvoyListenerJSON != "" {
+			upstreamListener, err := makeListenerFromUserConfig(cfg.EnvoyListenerJSON)
+			if err != nil {
+				s.Logger.Error("failed to parse envoy_listener_json",
+					"upstream", u.Identifier(),
+					"error", err)
+				continue
+			}
+			resources = append(resources, upstreamListener)
+			continue
+		}
+
 		upstreamListener := makeListener(id, u, envoy_core_v3.TrafficDirection_OUTBOUND)
 
 		filterChain, err := s.makeUpstreamFilterChainForDiscoveryChain(
diff --git a/agent/xds/listeners_test.go b/agent/xds/listeners_test.go
index e7cd5e6a5..977343578 100644
--- a/agent/xds/listeners_test.go
+++ b/agent/xds/listeners_test.go
@@ -159,20 +159,30 @@ func TestListenersFromSnapshot(t *testing.T) {
 			name:   "custom-upstream",
 			create: proxycfg.TestConfigSnapshot,
 			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Upstreams[0].Config["envoy_listener_json"] =
-					customListenerJSON(t, customListenerJSONOptions{
-						Name: "custom-upstream",
-					})
+				for i := range snap.Proxy.Upstreams {
+					if snap.Proxy.Upstreams[i].Config == nil {
+						snap.Proxy.Upstreams[i].Config = map[string]interface{}{}
+					}
+					snap.Proxy.Upstreams[i].Config["envoy_listener_json"] =
+						customListenerJSON(t, customListenerJSONOptions{
+							Name: snap.Proxy.Upstreams[i].Identifier() + ":custom-upstream",
+						})
+				}
 			},
 		},
 		{
 			name:   "custom-upstream-ignored-with-disco-chain",
 			create: proxycfg.TestConfigSnapshotDiscoveryChainWithFailover,
 			setup: func(snap *proxycfg.ConfigSnapshot) {
-				snap.Proxy.Upstreams[0].Config["envoy_listener_json"] =
-					customListenerJSON(t, customListenerJSONOptions{
-						Name: "custom-upstream",
-					})
+				for i := range snap.Proxy.Upstreams {
+					if snap.Proxy.Upstreams[i].Config == nil {
+						snap.Proxy.Upstreams[i].Config = map[string]interface{}{}
+					}
+					snap.Proxy.Upstreams[i].Config["envoy_listener_json"] =
+						customListenerJSON(t, customListenerJSONOptions{
+							Name: snap.Proxy.Upstreams[i].Identifier() + ":custom-upstream",
+						})
+				}
 			},
 		},
 		{
diff --git a/agent/xds/testdata/listeners/custom-upstream.envoy-1-18-x.golden b/agent/xds/testdata/listeners/custom-upstream.envoy-1-18-x.golden
index e79324c90..62e02591d 100644
--- a/agent/xds/testdata/listeners/custom-upstream.envoy-1-18-x.golden
+++ b/agent/xds/testdata/listeners/custom-upstream.envoy-1-18-x.golden
@@ -3,7 +3,7 @@
   "resources": [
     {
       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "custom-upstream",
+      "name": "db:custom-upstream",
       "address": {
         "socketAddress": {
           "address": "11.11.11.11",
@@ -27,11 +27,11 @@
     },
     {
       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "prepared_query:geo-cache:127.10.10.10:8181",
+      "name": "prepared_query:geo-cache:custom-upstream",
       "address": {
         "socketAddress": {
-          "address": "127.10.10.10",
-          "portValue": 8181
+          "address": "11.11.11.11",
+          "portValue": 11111
         }
       },
       "filterChains": [
@@ -41,14 +41,13 @@
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
-                "statPrefix": "upstream.prepared_query_geo-cache",
-                "cluster": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
+                "statPrefix": "foo-stats",
+                "cluster": "random-cluster"
               }
             }
           ]
         }
-      ],
-      "trafficDirection": "OUTBOUND"
+      ]
     },
     {
       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
diff --git a/agent/xds/testdata/listeners/custom-upstream.v2compat.envoy-1-16-x.golden b/agent/xds/testdata/listeners/custom-upstream.v2compat.envoy-1-16-x.golden
index 48db9c913..87642adbc 100644
--- a/agent/xds/testdata/listeners/custom-upstream.v2compat.envoy-1-16-x.golden
+++ b/agent/xds/testdata/listeners/custom-upstream.v2compat.envoy-1-16-x.golden
@@ -3,7 +3,7 @@
   "resources": [
     {
       "@type": "type.googleapis.com/envoy.api.v2.Listener",
-      "name": "custom-upstream",
+      "name": "db:custom-upstream",
       "address": {
         "socketAddress": {
           "address": "11.11.11.11",
@@ -27,11 +27,11 @@
     },
     {
       "@type": "type.googleapis.com/envoy.api.v2.Listener",
-      "name": "prepared_query:geo-cache:127.10.10.10:8181",
+      "name": "prepared_query:geo-cache:custom-upstream",
       "address": {
         "socketAddress": {
-          "address": "127.10.10.10",
-          "portValue": 8181
+          "address": "11.11.11.11",
+          "portValue": 11111
         }
       },
       "filterChains": [
@@ -41,14 +41,13 @@
               "name": "envoy.filters.network.tcp_proxy",
               "typedConfig": {
                 "@type": "type.googleapis.com/envoy.config.filter.network.tcp_proxy.v2.TcpProxy",
-                "statPrefix": "upstream.prepared_query_geo-cache",
-                "cluster": "geo-cache.default.dc1.query.11111111-2222-3333-4444-555555555555.consul"
+                "statPrefix": "foo-stats",
+                "cluster": "random-cluster"
               }
             }
           ]
         }
-      ],
-      "trafficDirection": "OUTBOUND"
+      ]
     },
     {
       "@type": "type.googleapis.com/envoy.api.v2.Listener",