diff --git a/kubernetes/customresourcedefinitions.gen.yaml b/kubernetes/customresourcedefinitions.gen.yaml
index 7318e07ffd..eaddf2eb4e 100644
--- a/kubernetes/customresourcedefinitions.gen.yaml
+++ b/kubernetes/customresourcedefinitions.gen.yaml
@@ -11484,6 +11484,11 @@ spec:
                         in addition to the original destination.
                       items:
                         properties:
+                          authority:
+                            description: If set, the Host (`:authority`) header of
+                              the mirrored request is rewritten to this value before
+                              being sent to the mirror destination.
+                            type: string
                           destination:
                             description: Destination specifies the target of the mirror
                               operation.
@@ -11507,6 +11512,23 @@ spec:
                             required:
                             - host
                             type: object
+                          headers:
+                            description: Header manipulation rules applied to the
+                              mirrored request before it is sent to the mirror destination.
+                            properties:
+                              add:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              remove:
+                                items:
+                                  type: string
+                                type: array
+                              set:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
                           percentage:
                             description: Percentage of the traffic to be mirrored
                               by the `destination` field.
@@ -12536,6 +12558,11 @@ spec:
                         in addition to the original destination.
                       items:
                         properties:
+                          authority:
+                            description: If set, the Host (`:authority`) header of
+                              the mirrored request is rewritten to this value before
+                              being sent to the mirror destination.
+                            type: string
                           destination:
                             description: Destination specifies the target of the mirror
                               operation.
@@ -12559,6 +12586,23 @@ spec:
                             required:
                             - host
                             type: object
+                          headers:
+                            description: Header manipulation rules applied to the
+                              mirrored request before it is sent to the mirror destination.
+                            properties:
+                              add:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              remove:
+                                items:
+                                  type: string
+                                type: array
+                              set:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
                           percentage:
                             description: Percentage of the traffic to be mirrored
                               by the `destination` field.
@@ -13588,6 +13632,11 @@ spec:
                         in addition to the original destination.
                       items:
                         properties:
+                          authority:
+                            description: If set, the Host (`:authority`) header of
+                              the mirrored request is rewritten to this value before
+                              being sent to the mirror destination.
+                            type: string
                           destination:
                             description: Destination specifies the target of the mirror
                               operation.
@@ -13611,6 +13660,23 @@ spec:
                             required:
                             - host
                             type: object
+                          headers:
+                            description: Header manipulation rules applied to the
+                              mirrored request before it is sent to the mirror destination.
+                            properties:
+                              add:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                              remove:
+                                items:
+                                  type: string
+                                type: array
+                              set:
+                                additionalProperties:
+                                  type: string
+                                type: object
+                            type: object
                           percentage:
                             description: Percentage of the traffic to be mirrored
                               by the `destination` field.
diff --git a/networking/v1alpha3/virtual_service.pb.go b/networking/v1alpha3/virtual_service.pb.go
index d4db2ab0c6..5154c7835a 100644
--- a/networking/v1alpha3/virtual_service.pb.go
+++ b/networking/v1alpha3/virtual_service.pb.go
@@ -3014,7 +3014,23 @@ type HTTPMirrorPolicy struct {
 	// Percentage of the traffic to be mirrored by the `destination` field.
 	// If this field is absent, all the traffic (100%) will be mirrored.
 	// Max value is 100.
-	Percentage    *Percent `protobuf:"bytes,2,opt,name=percentage,proto3" json:"percentage,omitempty"`
+	Percentage *Percent `protobuf:"bytes,2,opt,name=percentage,proto3" json:"percentage,omitempty"`
+	// If set, the Host (`:authority`) header of the mirrored request is
+	// rewritten to this value before being sent to the mirror destination.
+	// This maps to Envoy's
+	// [host_rewrite_literal](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-requestmirrorpolicy-host-rewrite-literal)
+	// on the mirror policy. When set, Envoy will not append the default
+	// `-shadow` suffix to the Host header.
+	//
+	// +cue-gen:VirtualService:releaseChannel:extended
+	Authority string `protobuf:"bytes,3,opt,name=authority,proto3" json:"authority,omitempty"`
+	// Header manipulation rules applied to the mirrored request before it is
+	// sent to the mirror destination. This maps to Envoy's
+	// [request_headers_mutations](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-requestmirrorpolicy-request-headers-mutations)
+	// on the mirror policy.
+	//
+	// +cue-gen:VirtualService:releaseChannel:extended
+	Headers       *Headers_HeaderOperations `protobuf:"bytes,4,opt,name=headers,proto3" json:"headers,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -3063,6 +3079,20 @@ func (x *HTTPMirrorPolicy) GetPercentage() *Percent {
 	return nil
 }
 
+func (x *HTTPMirrorPolicy) GetAuthority() string {
+	if x != nil {
+		return x.Authority
+	}
+	return ""
+}
+
+func (x *HTTPMirrorPolicy) GetHeaders() *Headers_HeaderOperations {
+	if x != nil {
+		return x.Headers
+	}
+	return nil
+}
+
 // PortSelector specifies the number of a port to be used for
 // matching or selection for final routing.
 type PortSelector struct {
@@ -3700,12 +3730,14 @@ const file_networking_v1alpha3_virtual_service_proto_rawDesc = "" +
 	"percentage\x18\x05 \x01(\v2\".istio.networking.v1alpha3.PercentR\n" +
 	"percentageB\f\n" +
 	"\n" +
-	"error_typeJ\x04\b\x01\x10\x02R\apercent\"\xa6\x01\n" +
+	"error_typeJ\x04\b\x01\x10\x02R\apercent\"\x93\x02\n" +
 	"\x10HTTPMirrorPolicy\x12N\n" +
 	"\vdestination\x18\x01 \x01(\v2&.istio.networking.v1alpha3.DestinationB\x04\xe2A\x01\x02R\vdestination\x12B\n" +
 	"\n" +
 	"percentage\x18\x02 \x01(\v2\".istio.networking.v1alpha3.PercentR\n" +
-	"percentage\"2\n" +
+	"percentage\x12\x1c\n" +
+	"\tauthority\x18\x03 \x01(\tR\tauthority\x12M\n" +
+	"\aheaders\x18\x04 \x01(\v23.istio.networking.v1alpha3.Headers.HeaderOperationsR\aheaders\"2\n" +
 	"\fPortSelector\x12\x16\n" +
 	"\x06number\x18\x01 \x01(\rR\x06numberJ\x04\b\x02\x10\x03R\x04name\"\x1f\n" +
 	"\aPercent\x12\x14\n" +
@@ -3821,20 +3853,21 @@ var file_networking_v1alpha3_virtual_service_proto_depIdxs = []int32{
 	36, // 50: istio.networking.v1alpha3.HTTPFaultInjection.abort:type_name -> istio.networking.v1alpha3.HTTPFaultInjection.Abort
 	3,  // 51: istio.networking.v1alpha3.HTTPMirrorPolicy.destination:type_name -> istio.networking.v1alpha3.Destination
 	25, // 52: istio.networking.v1alpha3.HTTPMirrorPolicy.percentage:type_name -> istio.networking.v1alpha3.Percent
-	27, // 53: istio.networking.v1alpha3.Headers.HeaderOperations.set:type_name -> istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry
-	28, // 54: istio.networking.v1alpha3.Headers.HeaderOperations.add:type_name -> istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry
-	19, // 55: istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry.value:type_name -> istio.networking.v1alpha3.StringMatch
-	19, // 56: istio.networking.v1alpha3.HTTPMatchRequest.QueryParamsEntry.value:type_name -> istio.networking.v1alpha3.StringMatch
-	19, // 57: istio.networking.v1alpha3.HTTPMatchRequest.WithoutHeadersEntry.value:type_name -> istio.networking.v1alpha3.StringMatch
-	37, // 58: istio.networking.v1alpha3.HTTPFaultInjection.Delay.fixed_delay:type_name -> google.protobuf.Duration
-	37, // 59: istio.networking.v1alpha3.HTTPFaultInjection.Delay.exponential_delay:type_name -> google.protobuf.Duration
-	25, // 60: istio.networking.v1alpha3.HTTPFaultInjection.Delay.percentage:type_name -> istio.networking.v1alpha3.Percent
-	25, // 61: istio.networking.v1alpha3.HTTPFaultInjection.Abort.percentage:type_name -> istio.networking.v1alpha3.Percent
-	62, // [62:62] is the sub-list for method output_type
-	62, // [62:62] is the sub-list for method input_type
-	62, // [62:62] is the sub-list for extension type_name
-	62, // [62:62] is the sub-list for extension extendee
-	0,  // [0:62] is the sub-list for field type_name
+	26, // 53: istio.networking.v1alpha3.HTTPMirrorPolicy.headers:type_name -> istio.networking.v1alpha3.Headers.HeaderOperations
+	27, // 54: istio.networking.v1alpha3.Headers.HeaderOperations.set:type_name -> istio.networking.v1alpha3.Headers.HeaderOperations.SetEntry
+	28, // 55: istio.networking.v1alpha3.Headers.HeaderOperations.add:type_name -> istio.networking.v1alpha3.Headers.HeaderOperations.AddEntry
+	19, // 56: istio.networking.v1alpha3.HTTPMatchRequest.HeadersEntry.value:type_name -> istio.networking.v1alpha3.StringMatch
+	19, // 57: istio.networking.v1alpha3.HTTPMatchRequest.QueryParamsEntry.value:type_name -> istio.networking.v1alpha3.StringMatch
+	19, // 58: istio.networking.v1alpha3.HTTPMatchRequest.WithoutHeadersEntry.value:type_name -> istio.networking.v1alpha3.StringMatch
+	37, // 59: istio.networking.v1alpha3.HTTPFaultInjection.Delay.fixed_delay:type_name -> google.protobuf.Duration
+	37, // 60: istio.networking.v1alpha3.HTTPFaultInjection.Delay.exponential_delay:type_name -> google.protobuf.Duration
+	25, // 61: istio.networking.v1alpha3.HTTPFaultInjection.Delay.percentage:type_name -> istio.networking.v1alpha3.Percent
+	25, // 62: istio.networking.v1alpha3.HTTPFaultInjection.Abort.percentage:type_name -> istio.networking.v1alpha3.Percent
+	63, // [63:63] is the sub-list for method output_type
+	63, // [63:63] is the sub-list for method input_type
+	63, // [63:63] is the sub-list for extension type_name
+	63, // [63:63] is the sub-list for extension extendee
+	0,  // [0:63] is the sub-list for field type_name
 }
 
 func init() { file_networking_v1alpha3_virtual_service_proto_init() }
diff --git a/networking/v1alpha3/virtual_service.pb.html b/networking/v1alpha3/virtual_service.pb.html
index 637a497cc1..a0db274947 100644
--- a/networking/v1alpha3/virtual_service.pb.html
+++ b/networking/v1alpha3/virtual_service.pb.html
@@ -2370,6 +2370,32 @@ <h2 id="HTTPMirrorPolicy">HTTPMirrorPolicy</h2>
 If this field is absent, all the traffic (100%) will be mirrored.
 Max value is 100.</p>
 
+</td>
+</tr>
+<tr id="HTTPMirrorPolicy-authority">
+<td><div class="field"><div class="name"><code><a href="#HTTPMirrorPolicy-authority">authority</a></code></div>
+<div class="type">string</div>
+</div></td>
+<td>
+<p>If set, the Host (<code>:authority</code>) header of the mirrored request is
+rewritten to this value before being sent to the mirror destination.
+This maps to Envoy&rsquo;s
+<a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-requestmirrorpolicy-host-rewrite-literal">host_rewrite_literal</a>
+on the mirror policy. When set, Envoy will not append the default
+<code>-shadow</code> suffix to the Host header.</p>
+
+</td>
+</tr>
+<tr id="HTTPMirrorPolicy-headers">
+<td><div class="field"><div class="name"><code><a href="#HTTPMirrorPolicy-headers">headers</a></code></div>
+<div class="type"><a href="#Headers-HeaderOperations">HeaderOperations</a></div>
+</div></td>
+<td>
+<p>Header manipulation rules applied to the mirrored request before it is
+sent to the mirror destination. This maps to Envoy&rsquo;s
+<a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-requestmirrorpolicy-request-headers-mutations">request_headers_mutations</a>
+on the mirror policy.</p>
+
 </td>
 </tr>
 </tbody>
diff --git a/networking/v1alpha3/virtual_service.proto b/networking/v1alpha3/virtual_service.proto
index d81ad2d72c..3198e2f1e2 100644
--- a/networking/v1alpha3/virtual_service.proto
+++ b/networking/v1alpha3/virtual_service.proto
@@ -1558,6 +1558,24 @@ message HTTPMirrorPolicy {
   // If this field is absent, all the traffic (100%) will be mirrored.
   // Max value is 100.
   Percent percentage = 2;
+
+  // If set, the Host (`:authority`) header of the mirrored request is
+  // rewritten to this value before being sent to the mirror destination.
+  // This maps to Envoy's
+  // [host_rewrite_literal](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-requestmirrorpolicy-host-rewrite-literal)
+  // on the mirror policy. When set, Envoy will not append the default
+  // `-shadow` suffix to the Host header.
+  //
+  // +cue-gen:VirtualService:releaseChannel:extended
+  string authority = 3;
+
+  // Header manipulation rules applied to the mirrored request before it is
+  // sent to the mirror destination. This maps to Envoy's
+  // [request_headers_mutations](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-requestmirrorpolicy-request-headers-mutations)
+  // on the mirror policy.
+  //
+  // +cue-gen:VirtualService:releaseChannel:extended
+  Headers.HeaderOperations headers = 4;
 }
 
 // PortSelector specifies the number of a port to be used for