diff --git a/.changelog/10423.txt b/.changelog/10423.txt
new file mode 100644
index 000000000..6192dde8f
--- /dev/null
+++ b/.changelog/10423.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+proxycfg: reference to entry in map should not panic.
+```
diff --git a/agent/proxycfg/state.go b/agent/proxycfg/state.go
index 65fe1fb78..ba1a347ad 100644
--- a/agent/proxycfg/state.go
+++ b/agent/proxycfg/state.go
@@ -846,8 +846,7 @@ func (s *state) handleUpdateConnectProxy(ctx context.Context, u cache.UpdateEven
 
 		// Clean up data from services that were not in the update
 		for sn := range snap.ConnectProxy.WatchedUpstreams {
-			upstream := snap.ConnectProxy.UpstreamConfig[sn]
-			if upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
+			if upstream, ok := snap.ConnectProxy.UpstreamConfig[sn]; ok && upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
 				continue
 			}
 			if _, ok := seenServices[sn]; !ok {
@@ -855,8 +854,7 @@ func (s *state) handleUpdateConnectProxy(ctx context.Context, u cache.UpdateEven
 			}
 		}
 		for sn := range snap.ConnectProxy.WatchedUpstreamEndpoints {
-			upstream := snap.ConnectProxy.UpstreamConfig[sn]
-			if upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
+			if upstream, ok := snap.ConnectProxy.UpstreamConfig[sn]; ok && upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
 				continue
 			}
 			if _, ok := seenServices[sn]; !ok {
@@ -864,8 +862,7 @@ func (s *state) handleUpdateConnectProxy(ctx context.Context, u cache.UpdateEven
 			}
 		}
 		for sn := range snap.ConnectProxy.WatchedGateways {
-			upstream := snap.ConnectProxy.UpstreamConfig[sn]
-			if upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
+			if upstream, ok := snap.ConnectProxy.UpstreamConfig[sn]; ok && upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
 				continue
 			}
 			if _, ok := seenServices[sn]; !ok {
@@ -873,8 +870,7 @@ func (s *state) handleUpdateConnectProxy(ctx context.Context, u cache.UpdateEven
 			}
 		}
 		for sn := range snap.ConnectProxy.WatchedGatewayEndpoints {
-			upstream := snap.ConnectProxy.UpstreamConfig[sn]
-			if upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
+			if upstream, ok := snap.ConnectProxy.UpstreamConfig[sn]; ok && upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
 				continue
 			}
 			if _, ok := seenServices[sn]; !ok {
@@ -882,8 +878,7 @@ func (s *state) handleUpdateConnectProxy(ctx context.Context, u cache.UpdateEven
 			}
 		}
 		for sn, cancelFn := range snap.ConnectProxy.WatchedDiscoveryChains {
-			upstream := snap.ConnectProxy.UpstreamConfig[sn]
-			if upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
+			if upstream, ok := snap.ConnectProxy.UpstreamConfig[sn]; ok && upstream.Datacenter != "" && upstream.Datacenter != s.source.Datacenter {
 				continue
 			}
 			if _, ok := seenServices[sn]; !ok {