diff --git a/cmd/server.go b/cmd/server.go
index 325ba6e..0dde461 100644
--- a/cmd/server.go
+++ b/cmd/server.go
@@ -85,9 +85,31 @@ var (
 
 					m := o.UnstructuredContent()
 
+					spec := m["spec"].(map[string]interface{})
+					resources := spec["resources"].([]interface{})
+
+					for _, res := range resources {
+						res := res.(map[string]interface{})
+						if res["@type"] == "type.googleapis.com/envoy.config.listener.v3.Listener" {
+							filterChains := res["filterChains"].(map[string]interface{})
+							filters := filterChains["filters"].([]interface{})
+							for _, filter := range filters {
+								filter := filter.(map[string]interface{})
+								if filter["name"] == "envoy.filters.network.http_connection_manager" {
+									upgradeConfigs := filter["upgradeConfigs"].([]interface{})
+									upgradeConfigs = append(upgradeConfigs, map[string]interface{}{
+										"upgradeType": "websoctailscale-control-protocolket",
+									})
+									filter["upgradeConfigs"] = upgradeConfigs
+									filter["useRemoteAddress"] = true
+									filter["xffNumTrustedHops"] = 1
+								}
+							}
+						}
+					}
+
 					o.SetUnstructuredContent(m)
 
-					logger.Info("mutating webhook called", zap.Any("object", m))
 					return &kwhmutating.MutatorResult{MutatedObject: obj}, nil
 				})