diff --git a/GNUmakefile b/GNUmakefile
index 268a9aae23..57017bbd97 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -231,6 +231,14 @@ go-mod-tidy:
 	@cd sdk && go mod tidy
 	@cd api && go mod tidy
 	@go mod tidy
+	@cd test/integration/consul-container && go mod tidy
+	@cd test/integration/connect/envoy/test-sds-server && go mod tidy
+	@cd proto-public && go mod tidy
+	@cd internal/tools/proto-gen-rpc-glue && go mod tidy
+	@cd internal/tools/proto-gen-rpc-glue/e2e && go mod tidy
+	@cd internal/tools/proto-gen-rpc-glue/e2e/consul && go mod tidy
+	@cd internal/tools/protoc-gen-consul-rate-limit && go mod tidy
+
 
 test-internal:
 	@echo "--> Running go test"
diff --git a/agent/agent_test.go b/agent/agent_test.go
index db7d457402..d6dd2cc5fc 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -23,7 +23,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/protobuf/jsonpb"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/google/tcpproxy"
@@ -37,6 +36,7 @@ import (
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/time/rate"
 	"google.golang.org/grpc"
+	"google.golang.org/protobuf/encoding/protojson"
 	"gopkg.in/square/go-jose.v2/jwt"
 
 	"github.com/hashicorp/consul/agent/cache"
@@ -5290,13 +5290,12 @@ func TestAutoConfig_Integration(t *testing.T) {
 		// check that the on disk certs match expectations
 		data, err := os.ReadFile(filepath.Join(client.DataDir, "auto-config.json"))
 		require.NoError(r, err)
-		rdr := strings.NewReader(string(data))
 
 		var resp pbautoconf.AutoConfigResponse
-		pbUnmarshaler := &jsonpb.Unmarshaler{
-			AllowUnknownFields: false,
+		pbUnmarshaler := &protojson.UnmarshalOptions{
+			DiscardUnknown: false,
 		}
-		require.NoError(r, pbUnmarshaler.Unmarshal(rdr, &resp), "data: %s", data)
+		require.NoError(r, pbUnmarshaler.Unmarshal(data, &resp), "data: %s", data)
 
 		actual, err := tls.X509KeyPair([]byte(resp.Certificate.CertPEM), []byte(resp.Certificate.PrivateKeyPEM))
 		require.NoError(r, err)
diff --git a/agent/auto-config/auto_config_test.go b/agent/auto-config/auto_config_test.go
index e5047e8efc..4834fcaac5 100644
--- a/agent/auto-config/auto_config_test.go
+++ b/agent/auto-config/auto_config_test.go
@@ -308,9 +308,9 @@ func TestInitialConfiguration_restored(t *testing.T) {
 		Certificate:         mustTranslateIssuedCertToProtobuf(t, cert),
 		ExtraCACertificates: extraCACerts,
 	}
-	data, err := pbMarshaler.MarshalToString(response)
+	data, err := pbMarshaler.Marshal(response)
 	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(persistedFile, []byte(data), 0600))
+	require.NoError(t, os.WriteFile(persistedFile, data, 0600))
 
 	// recording the initial configuration even when restoring is going to update
 	// the agent token in the token store
diff --git a/agent/auto-config/persist.go b/agent/auto-config/persist.go
index cbb0d21516..f75c0f376b 100644
--- a/agent/auto-config/persist.go
+++ b/agent/auto-config/persist.go
@@ -4,10 +4,9 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strings"
 
-	"github.com/golang/protobuf/jsonpb"
 	"github.com/hashicorp/consul/proto/pbautoconf"
+	"google.golang.org/protobuf/encoding/protojson"
 )
 
 const (
@@ -17,15 +16,15 @@ const (
 )
 
 var (
-	pbMarshaler = &jsonpb.Marshaler{
-		OrigName:     false,
-		EnumsAsInts:  false,
-		Indent:       "   ",
-		EmitDefaults: true,
+	pbMarshaler = &protojson.MarshalOptions{
+		UseProtoNames:   false,
+		UseEnumNumbers:  false,
+		Indent:          "   ",
+		EmitUnpopulated: true,
 	}
 
-	pbUnmarshaler = &jsonpb.Unmarshaler{
-		AllowUnknownFields: false,
+	pbUnmarshaler = &protojson.UnmarshalOptions{
+		DiscardUnknown: false,
 	}
 )
 
@@ -40,10 +39,8 @@ func (ac *AutoConfig) readPersistedAutoConfig() (*pbautoconf.AutoConfigResponse,
 
 	content, err := os.ReadFile(path)
 	if err == nil {
-		rdr := strings.NewReader(string(content))
-
 		var resp pbautoconf.AutoConfigResponse
-		if err := pbUnmarshaler.Unmarshal(rdr, &resp); err != nil {
+		if err := pbUnmarshaler.Unmarshal(content, &resp); err != nil {
 			return nil, fmt.Errorf("failed to decode persisted auto-config data: %w", err)
 		}
 
@@ -67,14 +64,14 @@ func (ac *AutoConfig) persistAutoConfig(resp *pbautoconf.AutoConfigResponse) err
 		return nil
 	}
 
-	serialized, err := pbMarshaler.MarshalToString(resp)
+	serialized, err := pbMarshaler.Marshal(resp)
 	if err != nil {
 		return fmt.Errorf("failed to encode auto-config response as JSON: %w", err)
 	}
 
 	path := filepath.Join(ac.config.DataDir, autoConfigFileName)
 
-	err = os.WriteFile(path, []byte(serialized), 0660)
+	err = os.WriteFile(path, serialized, 0660)
 	if err != nil {
 		return fmt.Errorf("failed to write auto-config configurations: %w", err)
 	}
diff --git a/agent/cache/watch_test.go b/agent/cache/watch_test.go
index 0fddcad1d5..ecd1cc9f3b 100644
--- a/agent/cache/watch_test.go
+++ b/agent/cache/watch_test.go
@@ -9,9 +9,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
diff --git a/agent/consul/fsm/commands_oss_test.go b/agent/consul/fsm/commands_oss_test.go
index 061c4a9cc6..8c0321588a 100644
--- a/agent/consul/fsm/commands_oss_test.go
+++ b/agent/consul/fsm/commands_oss_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-raftchunking"
 	raftchunkingtypes "github.com/hashicorp/go-raftchunking/types"
 	"github.com/hashicorp/go-uuid"
@@ -17,6 +16,7 @@ import (
 	"github.com/mitchellh/mapstructure"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/structs"
diff --git a/agent/consul/leader_peering_test.go b/agent/consul/leader_peering_test.go
index afc8af28a7..4be6326c09 100644
--- a/agent/consul/leader_peering_test.go
+++ b/agent/consul/leader_peering_test.go
@@ -21,6 +21,7 @@ import (
 	"google.golang.org/grpc/codes"
 	grpcstatus "google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/connect"
@@ -138,7 +139,7 @@ func TestLeader_PeeringSync_Lifecycle_ClientDeletion(t *testing.T) {
 		Name:                "my-peer-acceptor",
 		State:               pbpeering.PeeringState_DELETING,
 		PeerServerAddresses: p.Peering.PeerServerAddresses,
-		DeletedAt:           structs.TimeToProto(time.Now()),
+		DeletedAt:           timestamppb.New(time.Now()),
 	}
 	require.NoError(t, dialer.fsm.State().PeeringWrite(2000, &pbpeering.PeeringWriteRequest{Peering: deleted}))
 	dialer.logger.Trace("deleted peering for my-peer-acceptor")
@@ -448,7 +449,7 @@ func TestLeader_PeeringSync_Lifecycle_ServerDeletion(t *testing.T) {
 		ID:        p.Peering.PeerID,
 		Name:      "my-peer-dialer",
 		State:     pbpeering.PeeringState_DELETING,
-		DeletedAt: structs.TimeToProto(time.Now()),
+		DeletedAt: timestamppb.New(time.Now()),
 	}
 
 	require.NoError(t, acceptor.fsm.State().PeeringWrite(2000, &pbpeering.PeeringWriteRequest{Peering: deleted}))
@@ -622,7 +623,7 @@ func TestLeader_Peering_DeferredDeletion(t *testing.T) {
 			ID:        peerID,
 			Name:      peerName,
 			State:     pbpeering.PeeringState_DELETING,
-			DeletedAt: structs.TimeToProto(time.Now()),
+			DeletedAt: timestamppb.New(time.Now()),
 		},
 	}))
 
@@ -1501,7 +1502,7 @@ func TestLeader_Peering_NoDeletionWhenPeeringDisabled(t *testing.T) {
 			ID:        peerID,
 			Name:      peerName,
 			State:     pbpeering.PeeringState_DELETING,
-			DeletedAt: structs.TimeToProto(time.Now()),
+			DeletedAt: timestamppb.New(time.Now()),
 		},
 	}))
 
diff --git a/agent/consul/peering_backend_test.go b/agent/consul/peering_backend_test.go
index e933bcffa0..b7a725409b 100644
--- a/agent/consul/peering_backend_test.go
+++ b/agent/consul/peering_backend_test.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	gogrpc "google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/stretchr/testify/require"
 
@@ -394,7 +395,7 @@ func TestPeeringBackend_GetDialAddresses(t *testing.T) {
 
 						// Mark as deleted
 						State:     pbpeering.PeeringState_DELETING,
-						DeletedAt: structs.TimeToProto(time.Now()),
+						DeletedAt: timestamppb.New(time.Now()),
 					},
 				}))
 			},
diff --git a/agent/consul/state/peering.go b/agent/consul/state/peering.go
index c1d87ccddd..32e6045004 100644
--- a/agent/consul/state/peering.go
+++ b/agent/consul/state/peering.go
@@ -6,8 +6,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-memdb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/configentry"
diff --git a/agent/consul/state/peering_test.go b/agent/consul/state/peering_test.go
index f1337923e4..2c2caaab9a 100644
--- a/agent/consul/state/peering_test.go
+++ b/agent/consul/state/peering_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/hashicorp/go-memdb"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/connect"
@@ -980,7 +981,7 @@ func TestStore_Peering_Watch(t *testing.T) {
 				ID:        testFooPeerID,
 				Name:      "foo",
 				State:     pbpeering.PeeringState_DELETING,
-				DeletedAt: structs.TimeToProto(time.Now()),
+				DeletedAt: timestamppb.New(time.Now()),
 			},
 		})
 		require.NoError(t, err)
@@ -1007,7 +1008,7 @@ func TestStore_Peering_Watch(t *testing.T) {
 			ID:        testBarPeerID,
 			Name:      "bar",
 			State:     pbpeering.PeeringState_DELETING,
-			DeletedAt: structs.TimeToProto(time.Now()),
+			DeletedAt: timestamppb.New(time.Now()),
 		},
 		})
 		require.NoError(t, err)
@@ -1109,7 +1110,7 @@ func TestStore_PeeringList_Watch(t *testing.T) {
 				ID:        testFooPeerID,
 				Name:      "foo",
 				State:     pbpeering.PeeringState_DELETING,
-				DeletedAt: structs.TimeToProto(time.Now()),
+				DeletedAt: timestamppb.New(time.Now()),
 				Partition: structs.NodeEnterpriseMetaInDefaultPartition().PartitionOrEmpty(),
 			},
 		}))
@@ -1402,7 +1403,7 @@ func TestStore_PeeringWrite(t *testing.T) {
 					Name:                "baz",
 					State:               pbpeering.PeeringState_DELETING,
 					PeerServerAddresses: []string{"localhost:8502"},
-					DeletedAt:           structs.TimeToProto(testTime),
+					DeletedAt:           timestamppb.New(testTime),
 					Partition:           structs.NodeEnterpriseMetaInDefaultPartition().PartitionOrEmpty(),
 				},
 			},
@@ -1411,7 +1412,7 @@ func TestStore_PeeringWrite(t *testing.T) {
 					ID:        testBazPeerID,
 					Name:      "baz",
 					State:     pbpeering.PeeringState_DELETING,
-					DeletedAt: structs.TimeToProto(testTime),
+					DeletedAt: timestamppb.New(testTime),
 					Remote: &pbpeering.RemoteInfo{
 						Partition:  "part1",
 						Datacenter: "datacenter1",
@@ -1428,7 +1429,7 @@ func TestStore_PeeringWrite(t *testing.T) {
 					Name:                "baz",
 					State:               pbpeering.PeeringState_DELETING,
 					PeerServerAddresses: []string{"localhost:8502"},
-					DeletedAt:           structs.TimeToProto(time.Now()),
+					DeletedAt:           timestamppb.New(time.Now()),
 					Partition:           structs.NodeEnterpriseMetaInDefaultPartition().PartitionOrEmpty(),
 				},
 			},
@@ -1438,7 +1439,7 @@ func TestStore_PeeringWrite(t *testing.T) {
 					Name: "baz",
 					// Still marked as deleting at the original testTime
 					State:     pbpeering.PeeringState_DELETING,
-					DeletedAt: structs.TimeToProto(testTime),
+					DeletedAt: timestamppb.New(testTime),
 					Remote: &pbpeering.RemoteInfo{
 						Partition:  "part1",
 						Datacenter: "datacenter1",
@@ -1501,7 +1502,7 @@ func TestStore_PeeringWrite(t *testing.T) {
 					Name:                "foo",
 					PeerServerAddresses: []string{"localhost:8502"},
 					State:               pbpeering.PeeringState_DELETING,
-					DeletedAt:           structs.TimeToProto(time.Now()),
+					DeletedAt:           timestamppb.New(time.Now()),
 					Partition:           structs.NodeEnterpriseMetaInDefaultPartition().PartitionOrEmpty(),
 				},
 			},
@@ -1533,7 +1534,7 @@ func TestStore_PeeringDelete(t *testing.T) {
 				ID:        testFooPeerID,
 				Name:      "foo",
 				State:     pbpeering.PeeringState_DELETING,
-				DeletedAt: structs.TimeToProto(time.Now()),
+				DeletedAt: timestamppb.New(time.Now()),
 			},
 		}))
 
@@ -2206,7 +2207,7 @@ func TestStateStore_PeeringsForService(t *testing.T) {
 					ID:        tp.peering.ID,
 					Name:      tp.peering.Name,
 					State:     pbpeering.PeeringState_DELETING,
-					DeletedAt: structs.TimeToProto(time.Now()),
+					DeletedAt: timestamppb.New(time.Now()),
 				}
 				require.NoError(t, s.PeeringWrite(lastIdx, &pbpeering.PeeringWriteRequest{Peering: &copied}))
 			}
@@ -2649,7 +2650,7 @@ func TestStore_TrustBundleListByService(t *testing.T) {
 				ID:        peerID1,
 				Name:      "peer1",
 				State:     pbpeering.PeeringState_DELETING,
-				DeletedAt: structs.TimeToProto(time.Now()),
+				DeletedAt: timestamppb.New(time.Now()),
 			},
 		}))
 
@@ -2689,7 +2690,7 @@ func TestStateStore_Peering_ListDeleted(t *testing.T) {
 			Name:        "foo",
 			Partition:   acl.DefaultPartitionName,
 			ID:          testFooPeerID,
-			DeletedAt:   structs.TimeToProto(time.Now()),
+			DeletedAt:   timestamppb.New(time.Now()),
 			CreateIndex: 1,
 			ModifyIndex: 1,
 		})
@@ -2708,7 +2709,7 @@ func TestStateStore_Peering_ListDeleted(t *testing.T) {
 			Name:        "baz",
 			Partition:   acl.DefaultPartitionName,
 			ID:          testBazPeerID,
-			DeletedAt:   structs.TimeToProto(time.Now()),
+			DeletedAt:   timestamppb.New(time.Now()),
 			CreateIndex: 3,
 			ModifyIndex: 3,
 		})
diff --git a/agent/grpc-external/services/peerstream/replication.go b/agent/grpc-external/services/peerstream/replication.go
index 908c6d2457..20ceac1489 100644
--- a/agent/grpc-external/services/peerstream/replication.go
+++ b/agent/grpc-external/services/peerstream/replication.go
@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/golang/protobuf/proto"
 	"google.golang.org/genproto/googleapis/rpc/code"
+	"google.golang.org/protobuf/proto"
 	newproto "google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 
diff --git a/agent/grpc-external/services/peerstream/stream_resources.go b/agent/grpc-external/services/peerstream/stream_resources.go
index d0f7c7470d..c9c077776f 100644
--- a/agent/grpc-external/services/peerstream/stream_resources.go
+++ b/agent/grpc-external/services/peerstream/stream_resources.go
@@ -10,12 +10,12 @@ import (
 	"time"
 
 	"github.com/armon/go-metrics"
-	"github.com/golang/protobuf/jsonpb"
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-hclog"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	grpcstatus "google.golang.org/grpc/status"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/connect"
 	external "github.com/hashicorp/consul/agent/grpc-external"
@@ -765,12 +765,15 @@ func logTraceProto(logger hclog.Logger, pb proto.Message, received bool) {
 		pbToLog = clone
 	}
 
-	m := jsonpb.Marshaler{
+	m := protojson.MarshalOptions{
 		Indent: "  ",
 	}
-	out, err := m.MarshalToString(pbToLog)
+	out := ""
+	outBytes, err := m.Marshal(pbToLog)
 	if err != nil {
 		out = "<ERROR: " + err.Error() + ">"
+	} else {
+		out = string(outBytes)
 	}
 
 	logger.Trace("replication message", "direction", dir, "protobuf", out)
diff --git a/agent/grpc-external/services/peerstream/stream_test.go b/agent/grpc-external/services/peerstream/stream_test.go
index 81961d611b..b21f35bcce 100644
--- a/agent/grpc-external/services/peerstream/stream_test.go
+++ b/agent/grpc-external/services/peerstream/stream_test.go
@@ -11,13 +11,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-uuid"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/genproto/googleapis/rpc/code"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 	newproto "google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 
diff --git a/agent/grpc-external/services/peerstream/subscription_manager.go b/agent/grpc-external/services/peerstream/subscription_manager.go
index e8a4e48b4d..0f9174dd85 100644
--- a/agent/grpc-external/services/peerstream/subscription_manager.go
+++ b/agent/grpc-external/services/peerstream/subscription_manager.go
@@ -8,9 +8,9 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-memdb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/ipaddr"
 	"github.com/hashicorp/consul/lib/retry"
diff --git a/agent/grpc-external/services/peerstream/subscription_state.go b/agent/grpc-external/services/peerstream/subscription_state.go
index a99edae08f..54b4a84a3a 100644
--- a/agent/grpc-external/services/peerstream/subscription_state.go
+++ b/agent/grpc-external/services/peerstream/subscription_state.go
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-hclog"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/cache"
 	"github.com/hashicorp/consul/agent/structs"
@@ -166,15 +166,15 @@ func (p *pendingPayload) Add(id string, correlationID string, raw interface{}) e
 
 func hashProtobuf(res proto.Message) (string, error) {
 	h := sha256.New()
-	buffer := proto.NewBuffer(nil)
-	buffer.SetDeterministic(true)
+	marshaller := proto.MarshalOptions{
+		Deterministic: true,
+	}
 
-	err := buffer.Marshal(res)
+	data, err := marshaller.Marshal(res)
 	if err != nil {
 		return "", err
 	}
-	h.Write(buffer.Bytes())
-	buffer.Reset()
+	h.Write(data)
 
 	return hex.EncodeToString(h.Sum(nil)), nil
 }
diff --git a/agent/grpc-external/services/peerstream/subscription_state_test.go b/agent/grpc-external/services/peerstream/subscription_state_test.go
index b1846da5f5..253def99a9 100644
--- a/agent/grpc-external/services/peerstream/subscription_state_test.go
+++ b/agent/grpc-external/services/peerstream/subscription_state_test.go
@@ -5,9 +5,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-hclog"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/cache"
diff --git a/agent/grpc-internal/services/subscribe/subscribe_test.go b/agent/grpc-internal/services/subscribe/subscribe_test.go
index 5d367c87e5..749be4b5e8 100644
--- a/agent/grpc-internal/services/subscribe/subscribe_test.go
+++ b/agent/grpc-internal/services/subscribe/subscribe_test.go
@@ -8,7 +8,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/duration"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/hashicorp/go-hclog"
 	"github.com/hashicorp/go-uuid"
@@ -17,6 +16,7 @@ import (
 	gogrpc "google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/consul/rate"
@@ -268,10 +268,10 @@ func TestServer_Subscribe_IntegrationWithBackend(t *testing.T) {
 								RaftIndex:      raftIndex(ids, "update", "update"),
 								EnterpriseMeta: pbcommon.DefaultEnterpriseMeta,
 								Definition: &pbservice.HealthCheckDefinition{
-									Interval:                       &duration.Duration{},
-									Timeout:                        &duration.Duration{},
-									DeregisterCriticalServiceAfter: &duration.Duration{},
-									TTL:                            &duration.Duration{},
+									Interval:                       &durationpb.Duration{},
+									Timeout:                        &durationpb.Duration{},
+									DeregisterCriticalServiceAfter: &durationpb.Duration{},
+									TTL:                            &durationpb.Duration{},
 								},
 							},
 						},
@@ -654,10 +654,10 @@ func TestServer_Subscribe_IntegrationWithBackend_ForwardToDC(t *testing.T) {
 								RaftIndex:      raftIndex(ids, "update", "update"),
 								EnterpriseMeta: pbcommon.DefaultEnterpriseMeta,
 								Definition: &pbservice.HealthCheckDefinition{
-									Interval:                       &duration.Duration{},
-									Timeout:                        &duration.Duration{},
-									DeregisterCriticalServiceAfter: &duration.Duration{},
-									TTL:                            &duration.Duration{},
+									Interval:                       &durationpb.Duration{},
+									Timeout:                        &durationpb.Duration{},
+									DeregisterCriticalServiceAfter: &durationpb.Duration{},
+									TTL:                            &durationpb.Duration{},
 								},
 							},
 						},
diff --git a/agent/grpc-middleware/testutil/testservice/buf.gen.yaml b/agent/grpc-middleware/testutil/testservice/buf.gen.yaml
new file mode 100644
index 0000000000..c654680d4e
--- /dev/null
+++ b/agent/grpc-middleware/testutil/testservice/buf.gen.yaml
@@ -0,0 +1,19 @@
+version: v1
+managed:
+  enabled: true
+  go_package_prefix:
+    default: github.com/hashicorp/consul/agent/grpc-middleware/testutil/testservice
+plugins:
+  - name: go
+    out: .
+    opt:
+      - paths=source_relative
+  - name: go-grpc
+    out: .
+    opt:
+      - paths=source_relative
+      - require_unimplemented_servers=false
+  - name: go-binary
+    out: .
+    opt:
+      - paths=source_relative
diff --git a/agent/grpc-middleware/testutil/testservice/simple.pb.binary.go b/agent/grpc-middleware/testutil/testservice/simple.pb.binary.go
index da258818d0..1814a991a3 100644
--- a/agent/grpc-middleware/testutil/testservice/simple.pb.binary.go
+++ b/agent/grpc-middleware/testutil/testservice/simple.pb.binary.go
@@ -1,10 +1,10 @@
 // Code generated by protoc-gen-go-binary. DO NOT EDIT.
-// source: agent/grpc-middleware/testutil/testservice/simple.pb.binary.go
+// source: agent/grpc-middleware/testutil/testservice/simple.proto
 
 package testservice
 
 import (
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 // MarshalBinary implements encoding.BinaryMarshaler
diff --git a/agent/grpc-middleware/testutil/testservice/simple.pb.go b/agent/grpc-middleware/testutil/testservice/simple.pb.go
index 25aa074f75..96a36fdb53 100644
--- a/agent/grpc-middleware/testutil/testservice/simple.pb.go
+++ b/agent/grpc-middleware/testutil/testservice/simple.pb.go
@@ -1,17 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.23.0
-// 	protoc        v3.15.8
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
 // source: agent/grpc-middleware/testutil/testservice/simple.proto
 
 package testservice
 
 import (
-	context "context"
-	proto "github.com/golang/protobuf/proto"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -25,10 +20,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 type Req struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -40,7 +31,7 @@ type Req struct {
 func (x *Req) Reset() {
 	*x = Req{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_agent_grpc_private_internal_testservice_simple_proto_msgTypes[0]
+		mi := &file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -53,7 +44,7 @@ func (x *Req) String() string {
 func (*Req) ProtoMessage() {}
 
 func (x *Req) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_grpc_private_internal_testservice_simple_proto_msgTypes[0]
+	mi := &file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -66,7 +57,7 @@ func (x *Req) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Req.ProtoReflect.Descriptor instead.
 func (*Req) Descriptor() ([]byte, []int) {
-	return file_agent_grpc_private_internal_testservice_simple_proto_rawDescGZIP(), []int{0}
+	return file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *Req) GetDatacenter() string {
@@ -88,7 +79,7 @@ type Resp struct {
 func (x *Resp) Reset() {
 	*x = Resp{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_agent_grpc_private_internal_testservice_simple_proto_msgTypes[1]
+		mi := &file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -101,7 +92,7 @@ func (x *Resp) String() string {
 func (*Resp) ProtoMessage() {}
 
 func (x *Resp) ProtoReflect() protoreflect.Message {
-	mi := &file_agent_grpc_private_internal_testservice_simple_proto_msgTypes[1]
+	mi := &file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -114,7 +105,7 @@ func (x *Resp) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Resp.ProtoReflect.Descriptor instead.
 func (*Resp) Descriptor() ([]byte, []int) {
-	return file_agent_grpc_private_internal_testservice_simple_proto_rawDescGZIP(), []int{1}
+	return file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *Resp) GetServerName() string {
@@ -131,48 +122,62 @@ func (x *Resp) GetDatacenter() string {
 	return ""
 }
 
-var File_agent_grpc_private_internal_testservice_simple_proto protoreflect.FileDescriptor
+var File_agent_grpc_middleware_testutil_testservice_simple_proto protoreflect.FileDescriptor
 
-var file_agent_grpc_private_internal_testservice_simple_proto_rawDesc = []byte{
-	0x0a, 0x34, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2f, 0x70, 0x72, 0x69,
-	0x76, 0x61, 0x74, 0x65, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x74, 0x65,
-	0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x73, 0x69, 0x6d, 0x70, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x74, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x22, 0x25, 0x0a, 0x03, 0x52, 0x65, 0x71, 0x12, 0x1e, 0x0a, 0x0a, 0x44, 0x61,
-	0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
-	0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x22, 0x46, 0x0a, 0x04, 0x52, 0x65,
-	0x73, 0x70, 0x12, 0x1e, 0x0a, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74,
-	0x65, 0x72, 0x32, 0x6d, 0x0a, 0x06, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x12, 0x32, 0x0a, 0x09,
-	0x53, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x12, 0x10, 0x2e, 0x74, 0x65, 0x73, 0x74,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x74, 0x65,
-	0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00,
-	0x12, 0x2f, 0x0a, 0x04, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x10, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x74, 0x65, 0x73,
-	0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x22, 0x00, 0x30,
-	0x01, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+var file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDesc = []byte{
+	0x0a, 0x37, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2d, 0x6d, 0x69, 0x64,
+	0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x75, 0x74, 0x69, 0x6c,
+	0x2f, 0x74, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f, 0x73, 0x69, 0x6d,
+	0x70, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0b, 0x74, 0x65, 0x73, 0x74, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x25, 0x0a, 0x03, 0x52, 0x65, 0x71, 0x12, 0x1e, 0x0a,
+	0x0a, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x22, 0x46, 0x0a,
+	0x04, 0x52, 0x65, 0x73, 0x70, 0x12, 0x1e, 0x0a, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x44, 0x61, 0x74, 0x61, 0x63, 0x65, 0x6e,
+	0x74, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x44, 0x61, 0x74, 0x61, 0x63,
+	0x65, 0x6e, 0x74, 0x65, 0x72, 0x32, 0x6d, 0x0a, 0x06, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65, 0x12,
+	0x32, 0x0a, 0x09, 0x53, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x12, 0x10, 0x2e, 0x74,
+	0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x1a, 0x11,
+	0x2e, 0x74, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73,
+	0x70, 0x22, 0x00, 0x12, 0x2f, 0x0a, 0x04, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x10, 0x2e, 0x74, 0x65,
+	0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e,
+	0x74, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x70,
+	0x22, 0x00, 0x30, 0x01, 0x42, 0xdd, 0x01, 0x0a, 0x0f, 0x63, 0x6f, 0x6d, 0x2e, 0x74, 0x65, 0x73,
+	0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x0b, 0x53, 0x69, 0x6d, 0x70, 0x6c, 0x65,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x71, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f,
+	0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2d,
+	0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x75,
+	0x74, 0x69, 0x6c, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2f,
+	0x61, 0x67, 0x65, 0x6e, 0x74, 0x2f, 0x67, 0x72, 0x70, 0x63, 0x2d, 0x6d, 0x69, 0x64, 0x64, 0x6c,
+	0x65, 0x77, 0x61, 0x72, 0x65, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x75, 0x74, 0x69, 0x6c, 0x2f, 0x74,
+	0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0xa2, 0x02, 0x03, 0x54, 0x58, 0x58,
+	0xaa, 0x02, 0x0b, 0x54, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0xca, 0x02,
+	0x0b, 0x54, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0xe2, 0x02, 0x17, 0x54,
+	0x65, 0x73, 0x74, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0b, 0x54, 0x65, 0x73, 0x74, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
-	file_agent_grpc_private_internal_testservice_simple_proto_rawDescOnce sync.Once
-	file_agent_grpc_private_internal_testservice_simple_proto_rawDescData = file_agent_grpc_private_internal_testservice_simple_proto_rawDesc
+	file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescOnce sync.Once
+	file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescData = file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDesc
 )
 
-func file_agent_grpc_private_internal_testservice_simple_proto_rawDescGZIP() []byte {
-	file_agent_grpc_private_internal_testservice_simple_proto_rawDescOnce.Do(func() {
-		file_agent_grpc_private_internal_testservice_simple_proto_rawDescData = protoimpl.X.CompressGZIP(file_agent_grpc_private_internal_testservice_simple_proto_rawDescData)
+func file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescGZIP() []byte {
+	file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescOnce.Do(func() {
+		file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescData = protoimpl.X.CompressGZIP(file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescData)
 	})
-	return file_agent_grpc_private_internal_testservice_simple_proto_rawDescData
+	return file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDescData
 }
 
-var file_agent_grpc_private_internal_testservice_simple_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
-var file_agent_grpc_private_internal_testservice_simple_proto_goTypes = []interface{}{
+var file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_agent_grpc_middleware_testutil_testservice_simple_proto_goTypes = []interface{}{
 	(*Req)(nil),  // 0: testservice.Req
 	(*Resp)(nil), // 1: testservice.Resp
 }
-var file_agent_grpc_private_internal_testservice_simple_proto_depIdxs = []int32{
+var file_agent_grpc_middleware_testutil_testservice_simple_proto_depIdxs = []int32{
 	0, // 0: testservice.Simple.Something:input_type -> testservice.Req
 	0, // 1: testservice.Simple.Flow:input_type -> testservice.Req
 	1, // 2: testservice.Simple.Something:output_type -> testservice.Resp
@@ -184,13 +189,13 @@ var file_agent_grpc_private_internal_testservice_simple_proto_depIdxs = []int32{
 	0, // [0:0] is the sub-list for field type_name
 }
 
-func init() { file_agent_grpc_private_internal_testservice_simple_proto_init() }
-func file_agent_grpc_private_internal_testservice_simple_proto_init() {
-	if File_agent_grpc_private_internal_testservice_simple_proto != nil {
+func init() { file_agent_grpc_middleware_testutil_testservice_simple_proto_init() }
+func file_agent_grpc_middleware_testutil_testservice_simple_proto_init() {
+	if File_agent_grpc_middleware_testutil_testservice_simple_proto != nil {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_agent_grpc_private_internal_testservice_simple_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Req); i {
 			case 0:
 				return &v.state
@@ -202,7 +207,7 @@ func file_agent_grpc_private_internal_testservice_simple_proto_init() {
 				return nil
 			}
 		}
-		file_agent_grpc_private_internal_testservice_simple_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Resp); i {
 			case 0:
 				return &v.state
@@ -219,162 +224,18 @@ func file_agent_grpc_private_internal_testservice_simple_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_agent_grpc_private_internal_testservice_simple_proto_rawDesc,
+			RawDescriptor: file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDesc,
 			NumEnums:      0,
 			NumMessages:   2,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
-		GoTypes:           file_agent_grpc_private_internal_testservice_simple_proto_goTypes,
-		DependencyIndexes: file_agent_grpc_private_internal_testservice_simple_proto_depIdxs,
-		MessageInfos:      file_agent_grpc_private_internal_testservice_simple_proto_msgTypes,
+		GoTypes:           file_agent_grpc_middleware_testutil_testservice_simple_proto_goTypes,
+		DependencyIndexes: file_agent_grpc_middleware_testutil_testservice_simple_proto_depIdxs,
+		MessageInfos:      file_agent_grpc_middleware_testutil_testservice_simple_proto_msgTypes,
 	}.Build()
-	File_agent_grpc_private_internal_testservice_simple_proto = out.File
-	file_agent_grpc_private_internal_testservice_simple_proto_rawDesc = nil
-	file_agent_grpc_private_internal_testservice_simple_proto_goTypes = nil
-	file_agent_grpc_private_internal_testservice_simple_proto_depIdxs = nil
-}
-
-// Reference imports to suppress errors if they are not otherwise used.
-var _ context.Context
-var _ grpc.ClientConnInterface
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
-
-// SimpleClient is the client API for Simple service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://godoc.org/google.golang.org/grpc#ClientConn.NewStream.
-type SimpleClient interface {
-	Something(ctx context.Context, in *Req, opts ...grpc.CallOption) (*Resp, error)
-	Flow(ctx context.Context, in *Req, opts ...grpc.CallOption) (Simple_FlowClient, error)
-}
-
-type simpleClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewSimpleClient(cc grpc.ClientConnInterface) SimpleClient {
-	return &simpleClient{cc}
-}
-
-func (c *simpleClient) Something(ctx context.Context, in *Req, opts ...grpc.CallOption) (*Resp, error) {
-	out := new(Resp)
-	err := c.cc.Invoke(ctx, "/testservice.Simple/Something", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *simpleClient) Flow(ctx context.Context, in *Req, opts ...grpc.CallOption) (Simple_FlowClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Simple_serviceDesc.Streams[0], "/testservice.Simple/Flow", opts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &simpleFlowClient{stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-type Simple_FlowClient interface {
-	Recv() (*Resp, error)
-	grpc.ClientStream
-}
-
-type simpleFlowClient struct {
-	grpc.ClientStream
-}
-
-func (x *simpleFlowClient) Recv() (*Resp, error) {
-	m := new(Resp)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-// SimpleServer is the server API for Simple service.
-type SimpleServer interface {
-	Something(context.Context, *Req) (*Resp, error)
-	Flow(*Req, Simple_FlowServer) error
-}
-
-// UnimplementedSimpleServer can be embedded to have forward compatible implementations.
-type UnimplementedSimpleServer struct {
-}
-
-func (*UnimplementedSimpleServer) Something(context.Context, *Req) (*Resp, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Something not implemented")
-}
-func (*UnimplementedSimpleServer) Flow(*Req, Simple_FlowServer) error {
-	return status.Errorf(codes.Unimplemented, "method Flow not implemented")
-}
-
-func RegisterSimpleServer(s *grpc.Server, srv SimpleServer) {
-	s.RegisterService(&_Simple_serviceDesc, srv)
-}
-
-func _Simple_Something_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(Req)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(SimpleServer).Something(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/testservice.Simple/Something",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(SimpleServer).Something(ctx, req.(*Req))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Simple_Flow_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(Req)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(SimpleServer).Flow(m, &simpleFlowServer{stream})
-}
-
-type Simple_FlowServer interface {
-	Send(*Resp) error
-	grpc.ServerStream
-}
-
-type simpleFlowServer struct {
-	grpc.ServerStream
-}
-
-func (x *simpleFlowServer) Send(m *Resp) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-var _Simple_serviceDesc = grpc.ServiceDesc{
-	ServiceName: "testservice.Simple",
-	HandlerType: (*SimpleServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "Something",
-			Handler:    _Simple_Something_Handler,
-		},
-	},
-	Streams: []grpc.StreamDesc{
-		{
-			StreamName:    "Flow",
-			Handler:       _Simple_Flow_Handler,
-			ServerStreams: true,
-		},
-	},
-	Metadata: "agent/grpc-internal/internal/testservice/simple.proto",
+	File_agent_grpc_middleware_testutil_testservice_simple_proto = out.File
+	file_agent_grpc_middleware_testutil_testservice_simple_proto_rawDesc = nil
+	file_agent_grpc_middleware_testutil_testservice_simple_proto_goTypes = nil
+	file_agent_grpc_middleware_testutil_testservice_simple_proto_depIdxs = nil
 }
diff --git a/agent/grpc-middleware/testutil/testservice/simple_grpc.pb.go b/agent/grpc-middleware/testutil/testservice/simple_grpc.pb.go
new file mode 100644
index 0000000000..39aac241d4
--- /dev/null
+++ b/agent/grpc-middleware/testutil/testservice/simple_grpc.pb.go
@@ -0,0 +1,167 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.2.0
+// - protoc             (unknown)
+// source: agent/grpc-middleware/testutil/testservice/simple.proto
+
+package testservice
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+// SimpleClient is the client API for Simple service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type SimpleClient interface {
+	Something(ctx context.Context, in *Req, opts ...grpc.CallOption) (*Resp, error)
+	Flow(ctx context.Context, in *Req, opts ...grpc.CallOption) (Simple_FlowClient, error)
+}
+
+type simpleClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewSimpleClient(cc grpc.ClientConnInterface) SimpleClient {
+	return &simpleClient{cc}
+}
+
+func (c *simpleClient) Something(ctx context.Context, in *Req, opts ...grpc.CallOption) (*Resp, error) {
+	out := new(Resp)
+	err := c.cc.Invoke(ctx, "/testservice.Simple/Something", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *simpleClient) Flow(ctx context.Context, in *Req, opts ...grpc.CallOption) (Simple_FlowClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Simple_ServiceDesc.Streams[0], "/testservice.Simple/Flow", opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &simpleFlowClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type Simple_FlowClient interface {
+	Recv() (*Resp, error)
+	grpc.ClientStream
+}
+
+type simpleFlowClient struct {
+	grpc.ClientStream
+}
+
+func (x *simpleFlowClient) Recv() (*Resp, error) {
+	m := new(Resp)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// SimpleServer is the server API for Simple service.
+// All implementations should embed UnimplementedSimpleServer
+// for forward compatibility
+type SimpleServer interface {
+	Something(context.Context, *Req) (*Resp, error)
+	Flow(*Req, Simple_FlowServer) error
+}
+
+// UnimplementedSimpleServer should be embedded to have forward compatible implementations.
+type UnimplementedSimpleServer struct {
+}
+
+func (UnimplementedSimpleServer) Something(context.Context, *Req) (*Resp, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Something not implemented")
+}
+func (UnimplementedSimpleServer) Flow(*Req, Simple_FlowServer) error {
+	return status.Errorf(codes.Unimplemented, "method Flow not implemented")
+}
+
+// UnsafeSimpleServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to SimpleServer will
+// result in compilation errors.
+type UnsafeSimpleServer interface {
+	mustEmbedUnimplementedSimpleServer()
+}
+
+func RegisterSimpleServer(s grpc.ServiceRegistrar, srv SimpleServer) {
+	s.RegisterService(&Simple_ServiceDesc, srv)
+}
+
+func _Simple_Something_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(Req)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SimpleServer).Something(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/testservice.Simple/Something",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SimpleServer).Something(ctx, req.(*Req))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Simple_Flow_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(Req)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(SimpleServer).Flow(m, &simpleFlowServer{stream})
+}
+
+type Simple_FlowServer interface {
+	Send(*Resp) error
+	grpc.ServerStream
+}
+
+type simpleFlowServer struct {
+	grpc.ServerStream
+}
+
+func (x *simpleFlowServer) Send(m *Resp) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+// Simple_ServiceDesc is the grpc.ServiceDesc for Simple service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Simple_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "testservice.Simple",
+	HandlerType: (*SimpleServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Something",
+			Handler:    _Simple_Something_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Flow",
+			Handler:       _Simple_Flow_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "agent/grpc-middleware/testutil/testservice/simple.proto",
+}
diff --git a/agent/rpc/peering/service.go b/agent/rpc/peering/service.go
index 45cbb98de5..37a316410e 100644
--- a/agent/rpc/peering/service.go
+++ b/agent/rpc/peering/service.go
@@ -16,6 +16,7 @@ import (
 	"google.golang.org/grpc/codes"
 	grpcstatus "google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/hashicorp/consul/lib/retry"
 
@@ -879,7 +880,7 @@ func (s *Server) PeeringDelete(ctx context.Context, req *pbpeering.PeeringDelete
 			State:                 pbpeering.PeeringState_DELETING,
 			ManualServerAddresses: existing.ManualServerAddresses,
 			PeerServerAddresses:   existing.PeerServerAddresses,
-			DeletedAt:             structs.TimeToProto(time.Now().UTC()),
+			DeletedAt:             timestamppb.New(time.Now().UTC()),
 
 			// PartitionOrEmpty is used to avoid writing "default" in OSS.
 			Partition: entMeta.PartitionOrEmpty(),
diff --git a/agent/structs/structs.go b/agent/structs/structs.go
index 4915c21bc6..a590cb7452 100644
--- a/agent/structs/structs.go
+++ b/agent/structs/structs.go
@@ -14,12 +14,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes/duration"
-	"github.com/golang/protobuf/ptypes/timestamp"
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/serf/coordinate"
 	"github.com/mitchellh/hashstructure"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
@@ -2854,11 +2852,12 @@ func EncodeProtoInterface(t MessageType, message interface{}) ([]byte, error) {
 }
 
 func EncodeProto(t MessageType, pb proto.Message) ([]byte, error) {
-	data := make([]byte, proto.Size(pb)+1)
-	data[0] = uint8(t)
+	data := make([]byte, 0, proto.Size(pb)+1)
+	data = append(data, uint8(t))
 
-	buf := proto.NewBuffer(data[1:1])
-	if err := buf.Marshal(pb); err != nil {
+	var err error
+	data, err = proto.MarshalOptions{}.MarshalAppend(data, pb)
+	if err != nil {
 		return nil, err
 	}
 
@@ -2957,24 +2956,28 @@ func (m MessageType) String() string {
 
 }
 
-func DurationToProto(d time.Duration) *duration.Duration {
+// This should only be used for conversions generated by MOG
+func DurationToProto(d time.Duration) *durationpb.Duration {
 	return durationpb.New(d)
 }
 
-func DurationFromProto(d *duration.Duration) time.Duration {
+// This should only be used for conversions generated by MOG
+func DurationFromProto(d *durationpb.Duration) time.Duration {
 	return d.AsDuration()
 }
 
-func TimeFromProto(s *timestamp.Timestamp) time.Time {
+// This should only be used for conversions generated by MOG
+func TimeFromProto(s *timestamppb.Timestamp) time.Time {
 	return s.AsTime()
 }
 
-func TimeToProto(s time.Time) *timestamp.Timestamp {
+// This should only be used for conversions generated by MOG
+func TimeToProto(s time.Time) *timestamppb.Timestamp {
 	return timestamppb.New(s)
 }
 
 // IsZeroProtoTime returns true if the time is the minimum protobuf timestamp
 // (the Unix epoch).
-func IsZeroProtoTime(t *timestamp.Timestamp) bool {
+func IsZeroProtoTime(t *timestamppb.Timestamp) bool {
 	return t.Seconds == 0 && t.Nanos == 0
 }
diff --git a/agent/structs/structs_ext_test.go b/agent/structs/structs_ext_test.go
new file mode 100644
index 0000000000..185f586906
--- /dev/null
+++ b/agent/structs/structs_ext_test.go
@@ -0,0 +1,23 @@
+package structs_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/consul/proto/pbpeering"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEncodeDecodeProto(t *testing.T) {
+	arg := pbpeering.SecretsWriteRequest{
+		PeerID: "bbd26d02-a831-47b6-8a20-d16a99f56def",
+	}
+	buf, err := structs.EncodeProto(structs.PeeringSecretsWriteType, &arg)
+	require.NoError(t, err)
+
+	var out pbpeering.SecretsWriteRequest
+
+	err = structs.DecodeProto(buf[1:], &out)
+	require.NoError(t, err)
+	require.Equal(t, arg.PeerID, out.PeerID)
+}
diff --git a/agent/xds/builtin_extension_oss_test.go b/agent/xds/builtin_extension_oss_test.go
index d85c11aebe..ed71104a2a 100644
--- a/agent/xds/builtin_extension_oss_test.go
+++ b/agent/xds/builtin_extension_oss_test.go
@@ -12,9 +12,9 @@ import (
 	envoy_endpoint_v3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
-	"github.com/golang/protobuf/proto"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
diff --git a/agent/xds/builtinextensions/lambda/copied.go b/agent/xds/builtinextensions/lambda/copied.go
index 7a6ef32b26..59e9f5f5b5 100644
--- a/agent/xds/builtinextensions/lambda/copied.go
+++ b/agent/xds/builtinextensions/lambda/copied.go
@@ -5,10 +5,9 @@ import (
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"google.golang.org/protobuf/types/known/anypb"
 
-	"github.com/golang/protobuf/ptypes"
-
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 )
 
 // This is copied from xds and not put into the shared package because I'm not
@@ -22,7 +21,7 @@ func makeUpstreamTLSTransportSocket(tlsContext *envoy_tls_v3.UpstreamTlsContext)
 }
 
 func makeTransportSocket(name string, config proto.Message) (*envoy_core_v3.TransportSocket, error) {
-	any, err := ptypes.MarshalAny(config)
+	any, err := anypb.New(config)
 	if err != nil {
 		return nil, err
 	}
@@ -35,7 +34,7 @@ func makeTransportSocket(name string, config proto.Message) (*envoy_core_v3.Tran
 }
 
 func makeEnvoyHTTPFilter(name string, cfg proto.Message) (*envoy_http_v3.HttpFilter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -47,7 +46,7 @@ func makeEnvoyHTTPFilter(name string, cfg proto.Message) (*envoy_http_v3.HttpFil
 }
 
 func makeFilter(name string, cfg proto.Message) (*envoy_listener_v3.Filter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
diff --git a/agent/xds/builtinextensions/lambda/lambda.go b/agent/xds/builtinextensions/lambda/lambda.go
index cdbae360b3..9dea16ac0b 100644
--- a/agent/xds/builtinextensions/lambda/lambda.go
+++ b/agent/xds/builtinextensions/lambda/lambda.go
@@ -13,8 +13,8 @@ import (
 	envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 	envoy_resource_v3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
-	pstruct "github.com/golang/protobuf/ptypes/struct"
 	"github.com/mitchellh/mapstructure"
+	pstruct "google.golang.org/protobuf/types/known/structpb"
 
 	"github.com/hashicorp/consul/agent/xds/builtinextensiontemplate"
 	"github.com/hashicorp/consul/agent/xds/xdscommon"
diff --git a/agent/xds/builtinextensions/lua/copied.go b/agent/xds/builtinextensions/lua/copied.go
index fdc6ba9b76..f9d14b94cc 100644
--- a/agent/xds/builtinextensions/lua/copied.go
+++ b/agent/xds/builtinextensions/lua/copied.go
@@ -6,9 +6,8 @@ import (
 	envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 
-	"github.com/golang/protobuf/ptypes"
-
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 // This is copied from xds and not put into the shared package because I'm not
@@ -22,7 +21,7 @@ func makeUpstreamTLSTransportSocket(tlsContext *envoy_tls_v3.UpstreamTlsContext)
 }
 
 func makeTransportSocket(name string, config proto.Message) (*envoy_core_v3.TransportSocket, error) {
-	any, err := ptypes.MarshalAny(config)
+	any, err := anypb.New(config)
 	if err != nil {
 		return nil, err
 	}
@@ -35,7 +34,7 @@ func makeTransportSocket(name string, config proto.Message) (*envoy_core_v3.Tran
 }
 
 func makeEnvoyHTTPFilter(name string, cfg proto.Message) (*envoy_http_v3.HttpFilter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -47,7 +46,7 @@ func makeEnvoyHTTPFilter(name string, cfg proto.Message) (*envoy_http_v3.HttpFil
 }
 
 func makeFilter(name string, cfg proto.Message) (*envoy_listener_v3.Filter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
diff --git a/agent/xds/builtinextensiontemplate/template.go b/agent/xds/builtinextensiontemplate/template.go
index 774b0b7ed3..b2d1b14a2b 100644
--- a/agent/xds/builtinextensiontemplate/template.go
+++ b/agent/xds/builtinextensiontemplate/template.go
@@ -7,8 +7,8 @@ import (
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-multierror"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/xds/xdscommon"
 	"github.com/hashicorp/consul/api"
diff --git a/agent/xds/clusters.go b/agent/xds/clusters.go
index f892bdd5fe..5aecd37dc1 100644
--- a/agent/xds/clusters.go
+++ b/agent/xds/clusters.go
@@ -15,13 +15,12 @@ import (
 	envoy_matcher_v3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
 	envoy_type_v3 "github.com/envoyproxy/go-control-plane/envoy/type/v3"
 
-	"github.com/golang/protobuf/jsonpb"
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes/any"
-	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/hashicorp/go-hclog"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
@@ -862,7 +861,7 @@ func (s *ResourceGenerator) configIngressUpstreamCluster(c *envoy_cluster_v3.Clu
 
 	// Specail handling for failover peering service, which has set MaxEjectionPercent
 	if c.OutlierDetection != nil && c.OutlierDetection.MaxEjectionPercent != nil {
-		outlierDetection.MaxEjectionPercent = &wrappers.UInt32Value{Value: c.OutlierDetection.MaxEjectionPercent.Value}
+		outlierDetection.MaxEjectionPercent = &wrapperspb.UInt32Value{Value: c.OutlierDetection.MaxEjectionPercent.Value}
 	}
 
 	c.OutlierDetection = outlierDetection
@@ -971,7 +970,7 @@ func (s *ResourceGenerator) makeUpstreamClusterForPeerService(
 	// don't take into account service resolvers, splitters and routers. Setting
 	// MaxEjectionPercent too 100% gives outlier detection the power to eject the
 	// entire cluster.
-	outlierDetection.MaxEjectionPercent = &wrappers.UInt32Value{Value: 100}
+	outlierDetection.MaxEjectionPercent = &wrapperspb.UInt32Value{Value: 100}
 
 	s.Logger.Trace("generating cluster for", "cluster", clusterName)
 	if c == nil {
@@ -1494,8 +1493,8 @@ func injectSANMatcher(tlsContext *envoy_tls_v3.CommonTlsContext, matchStrings ..
 // from rather than our slight variant in JSON/hcl.
 func makeClusterFromUserConfig(configJSON string) (*envoy_cluster_v3.Cluster, error) {
 	// Type field is present so decode it as a types.Any
-	var any any.Any
-	err := jsonpb.UnmarshalString(configJSON, &any)
+	var any anypb.Any
+	err := protojson.Unmarshal([]byte(configJSON), &any)
 	if err != nil {
 		return nil, err
 	}
@@ -1823,7 +1822,7 @@ func injectLBToCluster(ec *structs.LoadBalancer, c *envoy_cluster_v3.Cluster) er
 		if ec.LeastRequestConfig != nil {
 			c.LbConfig = &envoy_cluster_v3.Cluster_LeastRequestLbConfig_{
 				LeastRequestLbConfig: &envoy_cluster_v3.Cluster_LeastRequestLbConfig{
-					ChoiceCount: &wrappers.UInt32Value{Value: ec.LeastRequestConfig.ChoiceCount},
+					ChoiceCount: &wrapperspb.UInt32Value{Value: ec.LeastRequestConfig.ChoiceCount},
 				},
 			}
 		}
@@ -1839,8 +1838,8 @@ func injectLBToCluster(ec *structs.LoadBalancer, c *envoy_cluster_v3.Cluster) er
 		if ec.RingHashConfig != nil {
 			c.LbConfig = &envoy_cluster_v3.Cluster_RingHashLbConfig_{
 				RingHashLbConfig: &envoy_cluster_v3.Cluster_RingHashLbConfig{
-					MinimumRingSize: &wrappers.UInt64Value{Value: ec.RingHashConfig.MinimumRingSize},
-					MaximumRingSize: &wrappers.UInt64Value{Value: ec.RingHashConfig.MaximumRingSize},
+					MinimumRingSize: &wrapperspb.UInt64Value{Value: ec.RingHashConfig.MinimumRingSize},
+					MaximumRingSize: &wrapperspb.UInt64Value{Value: ec.RingHashConfig.MaximumRingSize},
 				},
 			}
 		}
diff --git a/agent/xds/clusters_test.go b/agent/xds/clusters_test.go
index f094363631..c5fe91b4a2 100644
--- a/agent/xds/clusters_test.go
+++ b/agent/xds/clusters_test.go
@@ -9,9 +9,9 @@ import (
 
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 
-	"github.com/golang/protobuf/ptypes/wrappers"
 	testinf "github.com/mitchellh/go-testing-interface"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
@@ -927,8 +927,8 @@ func TestEnvoyLBConfig_InjectToCluster(t *testing.T) {
 				LbPolicy: envoy_cluster_v3.Cluster_RING_HASH,
 				LbConfig: &envoy_cluster_v3.Cluster_RingHashLbConfig_{
 					RingHashLbConfig: &envoy_cluster_v3.Cluster_RingHashLbConfig{
-						MinimumRingSize: &wrappers.UInt64Value{Value: 3},
-						MaximumRingSize: &wrappers.UInt64Value{Value: 7},
+						MinimumRingSize: &wrapperspb.UInt64Value{Value: 3},
+						MaximumRingSize: &wrapperspb.UInt64Value{Value: 7},
 					},
 				},
 			},
@@ -945,7 +945,7 @@ func TestEnvoyLBConfig_InjectToCluster(t *testing.T) {
 				LbPolicy: envoy_cluster_v3.Cluster_LEAST_REQUEST,
 				LbConfig: &envoy_cluster_v3.Cluster_LeastRequestLbConfig_{
 					LeastRequestLbConfig: &envoy_cluster_v3.Cluster_LeastRequestLbConfig{
-						ChoiceCount: &wrappers.UInt32Value{Value: 3},
+						ChoiceCount: &wrapperspb.UInt32Value{Value: 3},
 					},
 				},
 			},
diff --git a/agent/xds/config.go b/agent/xds/config.go
index 760b1251c6..39c4596f71 100644
--- a/agent/xds/config.go
+++ b/agent/xds/config.go
@@ -6,8 +6,8 @@ import (
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 	"google.golang.org/protobuf/types/known/durationpb"
 
-	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/mitchellh/mapstructure"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/lib/decode"
@@ -190,15 +190,15 @@ func ToOutlierDetection(p *structs.PassiveHealthCheck, override *structs.Passive
 			od.Interval = durationpb.New(p.Interval)
 		}
 		if p.MaxFailures != 0 {
-			od.Consecutive_5Xx = &wrappers.UInt32Value{Value: p.MaxFailures}
+			od.Consecutive_5Xx = &wrapperspb.UInt32Value{Value: p.MaxFailures}
 		}
 
 		if p.EnforcingConsecutive5xx != nil {
 			// NOTE: EnforcingConsecutive5xx must be great than 0 for ingress-gateway
 			if *p.EnforcingConsecutive5xx != 0 {
-				od.EnforcingConsecutive_5Xx = &wrappers.UInt32Value{Value: *p.EnforcingConsecutive5xx}
+				od.EnforcingConsecutive_5Xx = &wrapperspb.UInt32Value{Value: *p.EnforcingConsecutive5xx}
 			} else if allowZero {
-				od.EnforcingConsecutive_5Xx = &wrappers.UInt32Value{Value: *p.EnforcingConsecutive5xx}
+				od.EnforcingConsecutive_5Xx = &wrapperspb.UInt32Value{Value: *p.EnforcingConsecutive5xx}
 			}
 		}
 	}
@@ -212,15 +212,15 @@ func ToOutlierDetection(p *structs.PassiveHealthCheck, override *structs.Passive
 		od.Interval = durationpb.New(override.Interval)
 	}
 	if override.MaxFailures != 0 {
-		od.Consecutive_5Xx = &wrappers.UInt32Value{Value: override.MaxFailures}
+		od.Consecutive_5Xx = &wrapperspb.UInt32Value{Value: override.MaxFailures}
 	}
 
 	if override.EnforcingConsecutive5xx != nil {
 		// NOTE: EnforcingConsecutive5xx must be great than 0 for ingress-gateway
 		if *override.EnforcingConsecutive5xx != 0 {
-			od.EnforcingConsecutive_5Xx = &wrappers.UInt32Value{Value: *override.EnforcingConsecutive5xx}
+			od.EnforcingConsecutive_5Xx = &wrapperspb.UInt32Value{Value: *override.EnforcingConsecutive5xx}
 		} else if allowZero {
-			od.EnforcingConsecutive_5Xx = &wrappers.UInt32Value{Value: *override.EnforcingConsecutive5xx}
+			od.EnforcingConsecutive_5Xx = &wrapperspb.UInt32Value{Value: *override.EnforcingConsecutive5xx}
 		}
 	}
 
diff --git a/agent/xds/delta.go b/agent/xds/delta.go
index 2f46e0b977..6c0c0d31ae 100644
--- a/agent/xds/delta.go
+++ b/agent/xds/delta.go
@@ -16,11 +16,11 @@ import (
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	envoy_discovery_v3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
 
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes"
 	"github.com/hashicorp/go-hclog"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
 
 	external "github.com/hashicorp/consul/agent/grpc-external"
 	"github.com/hashicorp/consul/agent/proxycfg"
@@ -898,7 +898,7 @@ func (t *xDSDeltaType) createDeltaResponse(
 			if !ok {
 				return nil, nil, fmt.Errorf("unknown name for type url %q: %s", t.typeURL, name)
 			}
-			any, err := ptypes.MarshalAny(res)
+			any, err := anypb.New(res)
 			if err != nil {
 				return nil, nil, err
 			}
@@ -1016,15 +1016,13 @@ func hashResourceMap(resources map[string]proto.Message) (map[string]string, err
 // hashResource will take a resource and create a SHA256 hash sum out of the marshaled bytes
 func hashResource(res proto.Message) (string, error) {
 	h := sha256.New()
-	buffer := proto.NewBuffer(nil)
-	buffer.SetDeterministic(true)
+	marshaller := proto.MarshalOptions{Deterministic: true}
 
-	err := buffer.Marshal(res)
+	data, err := marshaller.Marshal(res)
 	if err != nil {
 		return "", err
 	}
-	h.Write(buffer.Bytes())
-	buffer.Reset()
+	h.Write(data)
 
 	return hex.EncodeToString(h.Sum(nil)), nil
 }
diff --git a/agent/xds/delta_test.go b/agent/xds/delta_test.go
index 803c19a781..44a3a20be5 100644
--- a/agent/xds/delta_test.go
+++ b/agent/xds/delta_test.go
@@ -9,11 +9,11 @@ import (
 
 	envoy_discovery_v3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/stretchr/testify/require"
 	rpcstatus "google.golang.org/genproto/googleapis/rpc/status"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/acl"
 	"github.com/hashicorp/consul/agent/grpc-external/limiter"
diff --git a/agent/xds/endpoints.go b/agent/xds/endpoints.go
index 4251dd0194..1f3966de46 100644
--- a/agent/xds/endpoints.go
+++ b/agent/xds/endpoints.go
@@ -8,8 +8,8 @@ import (
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 	envoy_core_v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	envoy_endpoint_v3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-bexpr"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
diff --git a/agent/xds/golden_test.go b/agent/xds/golden_test.go
index 11ab299d4e..f00b606096 100644
--- a/agent/xds/golden_test.go
+++ b/agent/xds/golden_test.go
@@ -7,10 +7,10 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/golang/protobuf/jsonpb"
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-version"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
 )
 
 // update allows golden files to be updated based on the current output.
@@ -133,10 +133,10 @@ func loadTestResource(t *testing.T, name string) string {
 
 func protoToJSON(t *testing.T, pb proto.Message) string {
 	t.Helper()
-	m := jsonpb.Marshaler{
+	m := protojson.MarshalOptions{
 		Indent: "  ",
 	}
-	gotJSON, err := m.MarshalToString(pb)
+	gotJSON, err := m.Marshal(pb)
 	require.NoError(t, err)
-	return gotJSON
+	return string(gotJSON)
 }
diff --git a/agent/xds/listeners.go b/agent/xds/listeners.go
index 7586860db2..ed8889a299 100644
--- a/agent/xds/listeners.go
+++ b/agent/xds/listeners.go
@@ -27,12 +27,10 @@ import (
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 	envoy_type_v3 "github.com/envoyproxy/go-control-plane/envoy/type/v3"
 
-	"github.com/golang/protobuf/jsonpb"
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes"
-	"github.com/golang/protobuf/ptypes/any"
-	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/hashicorp/go-hclog"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
@@ -672,7 +670,7 @@ func makeFilterChainMatchFromAddrs(addrs map[string]struct{}) *envoy_listener_v3
 		}
 		ranges = append(ranges, &envoy_core_v3.CidrRange{
 			AddressPrefix: addr,
-			PrefixLen:     &wrappers.UInt32Value{Value: pfxLen},
+			PrefixLen:     &wrapperspb.UInt32Value{Value: pfxLen},
 		})
 	}
 
@@ -694,11 +692,11 @@ func makeFilterChainMatchFromAddressWithPort(address string, port int) *envoy_li
 		if address != "" {
 			return &envoy_listener_v3.FilterChainMatch{
 				ServerNames:     []string{address},
-				DestinationPort: &wrappers.UInt32Value{Value: uint32(port)},
+				DestinationPort: &wrapperspb.UInt32Value{Value: uint32(port)},
 			}
 		}
 		return &envoy_listener_v3.FilterChainMatch{
-			DestinationPort: &wrappers.UInt32Value{Value: uint32(port)},
+			DestinationPort: &wrapperspb.UInt32Value{Value: uint32(port)},
 		}
 	}
 
@@ -708,12 +706,12 @@ func makeFilterChainMatchFromAddressWithPort(address string, port int) *envoy_li
 	}
 	ranges = append(ranges, &envoy_core_v3.CidrRange{
 		AddressPrefix: address,
-		PrefixLen:     &wrappers.UInt32Value{Value: pfxLen},
+		PrefixLen:     &wrapperspb.UInt32Value{Value: pfxLen},
 	})
 
 	return &envoy_listener_v3.FilterChainMatch{
 		PrefixRanges:    ranges,
-		DestinationPort: &wrappers.UInt32Value{Value: uint32(port)},
+		DestinationPort: &wrapperspb.UInt32Value{Value: uint32(port)},
 	}
 }
 
@@ -967,9 +965,9 @@ func makePipeListener(opts makeListenerOpts) *envoy_listener_v3.Listener {
 // any config generated by other systems will likely be in canonical protobuf
 // from rather than our slight variant in JSON/hcl.
 func makeListenerFromUserConfig(configJSON string) (*envoy_listener_v3.Listener, error) {
-	// Type field is present so decode it as a any.Any
-	var any any.Any
-	if err := jsonpb.UnmarshalString(configJSON, &any); err != nil {
+	// Type field is present so decode it as a anypb.Any
+	var any anypb.Any
+	if err := protojson.Unmarshal([]byte(configJSON), &any); err != nil {
 		return nil, err
 	}
 	var l envoy_listener_v3.Listener
@@ -1045,7 +1043,7 @@ func extractRdsResourceNames(listener *envoy_listener_v3.Listener) ([]string, er
 			}
 
 			var hcm envoy_http_v3.HttpConnectionManager
-			if err := ptypes.UnmarshalAny(tc.TypedConfig, &hcm); err != nil {
+			if err := tc.TypedConfig.UnmarshalTo(&hcm); err != nil {
 				return nil, err
 			}
 
@@ -1108,7 +1106,7 @@ func injectHTTPFilterOnFilterChains(
 			)
 		}
 
-		if err := ptypes.UnmarshalAny(tc.TypedConfig, &hcm); err != nil {
+		if err := tc.TypedConfig.UnmarshalTo(&hcm); err != nil {
 			return err
 		}
 
@@ -1208,7 +1206,7 @@ func createDownstreamTransportSocketForConnectTLS(cfgSnap *proxycfg.ConfigSnapsh
 
 	return makeDownstreamTLSTransportSocket(&envoy_tls_v3.DownstreamTlsContext{
 		CommonTlsContext:         tlsContext,
-		RequireClientCertificate: &wrappers.BoolValue{Value: true},
+		RequireClientCertificate: &wrapperspb.BoolValue{Value: true},
 	})
 }
 
@@ -1216,7 +1214,7 @@ func createDownstreamTransportSocketForConnectTLS(cfgSnap *proxycfg.ConfigSnapsh
 // With cluster peering we expect peered clusters to have independent certificate authorities.
 // This means that we cannot use a single set of root CA certificates to validate client certificates for mTLS,
 // but rather we need to validate against different roots depending on the trust domain of the certificate presented.
-func makeSpiffeValidatorConfig(trustDomain, roots string, peerBundles []*pbpeering.PeeringTrustBundle) (*any.Any, error) {
+func makeSpiffeValidatorConfig(trustDomain, roots string, peerBundles []*pbpeering.PeeringTrustBundle) (*anypb.Any, error) {
 	// Store the trust bundle for the local trust domain.
 	bundles := map[string]string{trustDomain: roots}
 
@@ -1251,7 +1249,7 @@ func makeSpiffeValidatorConfig(trustDomain, roots string, peerBundles []*pbpeeri
 	sort.Slice(cfg.TrustDomains, func(i int, j int) bool {
 		return cfg.TrustDomains[i].Name < cfg.TrustDomains[j].Name
 	})
-	return ptypes.MarshalAny(cfg)
+	return anypb.New(cfg)
 }
 
 func (s *ResourceGenerator) makeInboundListener(cfgSnap *proxycfg.ConfigSnapshot, name string) (proto.Message, error) {
@@ -1522,15 +1520,15 @@ func (s *ResourceGenerator) makeExposedCheckListener(cfgSnap *proxycfg.ConfigSna
 
 		ranges := make([]*envoy_core_v3.CidrRange, 0, 3)
 		ranges = append(ranges,
-			&envoy_core_v3.CidrRange{AddressPrefix: "127.0.0.1", PrefixLen: &wrappers.UInt32Value{Value: 8}},
-			&envoy_core_v3.CidrRange{AddressPrefix: advertise, PrefixLen: &wrappers.UInt32Value{Value: uint32(advertiseLen)}},
+			&envoy_core_v3.CidrRange{AddressPrefix: "127.0.0.1", PrefixLen: &wrapperspb.UInt32Value{Value: 8}},
+			&envoy_core_v3.CidrRange{AddressPrefix: advertise, PrefixLen: &wrapperspb.UInt32Value{Value: uint32(advertiseLen)}},
 		)
 
 		if ok, err := kernelSupportsIPv6(); err != nil {
 			return nil, err
 		} else if ok {
 			ranges = append(ranges,
-				&envoy_core_v3.CidrRange{AddressPrefix: "::1", PrefixLen: &wrappers.UInt32Value{Value: 128}},
+				&envoy_core_v3.CidrRange{AddressPrefix: "::1", PrefixLen: &wrapperspb.UInt32Value{Value: 128}},
 			)
 		}
 
@@ -1711,7 +1709,7 @@ func (s *ResourceGenerator) makeFilterChainTerminatingGateway(cfgSnap *proxycfg.
 			cfgSnap.RootPEMs(),
 			makeTLSParametersFromProxyTLSConfig(cfgSnap.MeshConfigTLSIncoming()),
 		),
-		RequireClientCertificate: &wrappers.BoolValue{Value: true},
+		RequireClientCertificate: &wrapperspb.BoolValue{Value: true},
 	}
 	transportSocket, err := makeDownstreamTLSTransportSocket(tlsContext)
 	if err != nil {
@@ -2369,9 +2367,9 @@ func makeStatPrefix(prefix, filterName string) string {
 }
 
 func makeTracingFromUserConfig(configJSON string) (*envoy_http_v3.HttpConnectionManager_Tracing, error) {
-	// Type field is present so decode it as a any.Any
-	var any any.Any
-	if err := jsonpb.UnmarshalString(configJSON, &any); err != nil {
+	// Type field is present so decode it as a anypb.Any
+	var any anypb.Any
+	if err := protojson.Unmarshal([]byte(configJSON), &any); err != nil {
 		return nil, err
 	}
 	var t envoy_http_v3.HttpConnectionManager_Tracing
@@ -2490,7 +2488,7 @@ func makeHTTPFilter(opts listenerFilterOpts) (*envoy_listener_v3.Filter, error)
 	if opts.forwardClientDetails {
 		cfg.ForwardClientCertDetails = opts.forwardClientPolicy
 		cfg.SetCurrentClientCertDetails = &envoy_http_v3.HttpConnectionManager_SetCurrentClientCertDetails{
-			Subject: &wrappers.BoolValue{Value: true},
+			Subject: &wrapperspb.BoolValue{Value: true},
 			Cert:    true,
 			Chain:   true,
 			Dns:     true,
@@ -2541,7 +2539,7 @@ func makeHTTPFilter(opts listenerFilterOpts) (*envoy_listener_v3.Filter, error)
 }
 
 func makeEnvoyListenerFilter(name string, cfg proto.Message) (*envoy_listener_v3.ListenerFilter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -2552,7 +2550,7 @@ func makeEnvoyListenerFilter(name string, cfg proto.Message) (*envoy_listener_v3
 }
 
 func makeFilter(name string, cfg proto.Message) (*envoy_listener_v3.Filter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -2564,7 +2562,7 @@ func makeFilter(name string, cfg proto.Message) (*envoy_listener_v3.Filter, erro
 }
 
 func makeEnvoyHTTPFilter(name string, cfg proto.Message) (*envoy_http_v3.HttpFilter, error) {
-	any, err := ptypes.MarshalAny(cfg)
+	any, err := anypb.New(cfg)
 	if err != nil {
 		return nil, err
 	}
@@ -2631,7 +2629,7 @@ func makeUpstreamTLSTransportSocket(tlsContext *envoy_tls_v3.UpstreamTlsContext)
 }
 
 func makeTransportSocket(name string, config proto.Message) (*envoy_core_v3.TransportSocket, error) {
-	any, err := ptypes.MarshalAny(config)
+	any, err := anypb.New(config)
 	if err != nil {
 		return nil, err
 	}
diff --git a/agent/xds/listeners_ingress.go b/agent/xds/listeners_ingress.go
index ddea1f5c0c..6083529849 100644
--- a/agent/xds/listeners_ingress.go
+++ b/agent/xds/listeners_ingress.go
@@ -7,9 +7,9 @@ import (
 	envoy_listener_v3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
 
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes/duration"
-	"github.com/golang/protobuf/ptypes/wrappers"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
@@ -174,7 +174,7 @@ func makeDownstreamTLSContextFromSnapshotListenerConfig(cfgSnap *proxycfg.Config
 
 		downstreamContext = &envoy_tls_v3.DownstreamTlsContext{
 			CommonTlsContext:         tlsContext,
-			RequireClientCertificate: &wrappers.BoolValue{Value: false},
+			RequireClientCertificate: &wrapperspb.BoolValue{Value: false},
 		}
 	}
 
@@ -356,7 +356,7 @@ func makeSDSOverrideFilterChains(cfgSnap *proxycfg.ConfigSnapshot,
 
 		tlsContext := &envoy_tls_v3.DownstreamTlsContext{
 			CommonTlsContext:         commonTlsContext,
-			RequireClientCertificate: &wrappers.BoolValue{Value: false},
+			RequireClientCertificate: &wrapperspb.BoolValue{Value: false},
 		}
 
 		transportSocket, err := makeDownstreamTLSTransportSocket(tlsContext)
@@ -414,7 +414,7 @@ func makeTLSCertificateSdsSecretConfigsFromSDS(sdsCfg structs.GatewayTLSSDSConfi
 										ClusterName: sdsCfg.ClusterName,
 									},
 								},
-								Timeout: &duration.Duration{Seconds: 5},
+								Timeout: &durationpb.Duration{Seconds: 5},
 							},
 						},
 					},
diff --git a/agent/xds/protocol_trace.go b/agent/xds/protocol_trace.go
index 7ac626f49e..1a9687f712 100644
--- a/agent/xds/protocol_trace.go
+++ b/agent/xds/protocol_trace.go
@@ -3,9 +3,9 @@ package xds
 import (
 	envoy_discovery_v3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
 
-	"github.com/golang/protobuf/jsonpb"
-	"github.com/golang/protobuf/proto"
 	"github.com/mitchellh/copystructure"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
 )
 
 func (s *ResourceGenerator) logTraceRequest(msg string, pb proto.Message) {
@@ -40,12 +40,16 @@ func (s *ResourceGenerator) logTraceProto(msg string, pb proto.Message, response
 		}
 	}
 
-	m := jsonpb.Marshaler{
+	m := protojson.MarshalOptions{
 		Indent: "  ",
 	}
-	out, err := m.MarshalToString(pb)
+
+	out := ""
+	outBytes, err := m.Marshal(pb)
 	if err != nil {
 		out = "<ERROR: " + err.Error() + ">"
+	} else {
+		out = string(outBytes)
 	}
 
 	s.Logger.Trace(msg, "direction", dir, "protobuf", out)
diff --git a/agent/xds/resources.go b/agent/xds/resources.go
index 31a5769ab7..5c065862a3 100644
--- a/agent/xds/resources.go
+++ b/agent/xds/resources.go
@@ -3,8 +3,8 @@ package xds
 import (
 	"fmt"
 
-	"github.com/golang/protobuf/proto"
 	"github.com/hashicorp/go-hclog"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/xds/xdscommon"
diff --git a/agent/xds/response.go b/agent/xds/response.go
index 716666d194..06948d7fe3 100644
--- a/agent/xds/response.go
+++ b/agent/xds/response.go
@@ -5,18 +5,18 @@ import (
 	envoy_discovery_v3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
 	envoy_matcher_v3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
 
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes/any"
-	"github.com/golang/protobuf/ptypes/wrappers"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 )
 
 func createResponse(typeURL string, version, nonce string, resources []proto.Message) (*envoy_discovery_v3.DiscoveryResponse, error) {
-	anys := make([]*any.Any, 0, len(resources))
+	anys := make([]*anypb.Any, 0, len(resources))
 	for _, r := range resources {
 		if r == nil {
 			continue
 		}
-		if any, ok := r.(*any.Any); ok {
+		if any, ok := r.(*anypb.Any); ok {
 			anys = append(anys, any)
 			continue
 		}
@@ -24,7 +24,7 @@ func createResponse(typeURL string, version, nonce string, resources []proto.Mes
 		if err != nil {
 			return nil, err
 		}
-		anys = append(anys, &any.Any{
+		anys = append(anys, &anypb.Any{
 			TypeUrl: typeURL,
 			Value:   data,
 		})
@@ -62,12 +62,12 @@ func makeAddress(ip string, port int) *envoy_core_v3.Address {
 	}
 }
 
-func makeUint32Value(n int) *wrappers.UInt32Value {
-	return &wrappers.UInt32Value{Value: uint32(n)}
+func makeUint32Value(n int) *wrapperspb.UInt32Value {
+	return &wrapperspb.UInt32Value{Value: uint32(n)}
 }
 
-func makeBoolValue(n bool) *wrappers.BoolValue {
-	return &wrappers.BoolValue{Value: n}
+func makeBoolValue(n bool) *wrapperspb.BoolValue {
+	return &wrapperspb.BoolValue{Value: n}
 }
 
 func makeEnvoyRegexMatch(patt string) *envoy_matcher_v3.RegexMatcher {
diff --git a/agent/xds/routes.go b/agent/xds/routes.go
index 2931e2d770..fc6febf059 100644
--- a/agent/xds/routes.go
+++ b/agent/xds/routes.go
@@ -12,7 +12,7 @@ import (
 	envoy_route_v3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	envoy_matcher_v3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
 
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/durationpb"
 
 	"github.com/hashicorp/consul/agent/connect"
diff --git a/agent/xds/xds_protocol_helpers_test.go b/agent/xds/xds_protocol_helpers_test.go
index b905035df4..876cd0019d 100644
--- a/agent/xds/xds_protocol_helpers_test.go
+++ b/agent/xds/xds_protocol_helpers_test.go
@@ -25,13 +25,12 @@ import (
 	envoy_type_v3 "github.com/envoyproxy/go-control-plane/envoy/type/v3"
 
 	"github.com/armon/go-metrics"
-	"github.com/golang/protobuf/proto"
-	"github.com/golang/protobuf/ptypes"
-	"github.com/golang/protobuf/ptypes/wrappers"
 	"github.com/mitchellh/copystructure"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
@@ -272,7 +271,7 @@ func xdsNewTransportSocket(
 
 	var tlsContext proto.Message
 	if downstream {
-		var requireClientCertPB *wrappers.BoolValue
+		var requireClientCertPB *wrapperspb.BoolValue
 		if requireClientCert {
 			requireClientCertPB = makeBoolValue(true)
 		}
@@ -288,7 +287,7 @@ func xdsNewTransportSocket(
 		}
 	}
 
-	any, err := ptypes.MarshalAny(tlsContext)
+	any, err := anypb.New(tlsContext)
 	require.NoError(t, err)
 
 	return &envoy_core_v3.TransportSocket{
@@ -347,7 +346,7 @@ func makeTestResource(t *testing.T, raw interface{}) *envoy_discovery_v3.Resourc
 		}
 	case proto.Message:
 
-		any, err := ptypes.MarshalAny(res)
+		any, err := anypb.New(res)
 		require.NoError(t, err)
 
 		return &envoy_discovery_v3.Resource{
@@ -468,7 +467,7 @@ func makeTestCluster(t *testing.T, snap *proxycfg.ConfigSnapshot, fixtureName st
 				},
 			},
 		}
-		typedExtensionProtocolOptionsEncoded, err := ptypes.MarshalAny(typedExtensionProtocolOptions)
+		typedExtensionProtocolOptionsEncoded, err := anypb.New(typedExtensionProtocolOptions)
 		require.NoError(t, err)
 		c.TypedExtensionProtocolOptions = map[string]*anypb.Any{
 			"envoy.extensions.upstreams.http.v3.HttpProtocolOptions": typedExtensionProtocolOptionsEncoded,
diff --git a/agent/xds/xdscommon/xdscommon.go b/agent/xds/xdscommon/xdscommon.go
index 26670b4b6f..2c40428524 100644
--- a/agent/xds/xdscommon/xdscommon.go
+++ b/agent/xds/xdscommon/xdscommon.go
@@ -1,7 +1,7 @@
 package xdscommon
 
 import (
-	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/hashicorp/consul/agent/connect"
 	"github.com/hashicorp/consul/agent/proxycfg"
diff --git a/agent/xds/z_xds_packages_test.go b/agent/xds/z_xds_packages_test.go
index b102dcb3ad..5644508e6c 100644
--- a/agent/xds/z_xds_packages_test.go
+++ b/agent/xds/z_xds_packages_test.go
@@ -3,9 +3,9 @@ package xds
 import (
 	"testing"
 
-	"github.com/golang/protobuf/jsonpb"
-	"github.com/golang/protobuf/ptypes/any"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 func TestUnusedExtensions(t *testing.T) {
@@ -45,8 +45,8 @@ func TestUnusedExtensions(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			var any any.Any
-			require.NoError(t, jsonpb.UnmarshalString(tc.input, &any))
+			var any anypb.Any
+			require.NoError(t, protojson.Unmarshal([]byte(tc.input), &any))
 			require.Equal(t, tc.name, any.TypeUrl)
 		})
 	}
diff --git a/build-support/scripts/devtools.sh b/build-support/scripts/devtools.sh
index b5c0e52cd3..14002497da 100755
--- a/build-support/scripts/devtools.sh
+++ b/build-support/scripts/devtools.sh
@@ -68,14 +68,13 @@ function proto_tools_install {
     local mockery_version
 
     mockery_version="$(make --no-print-directory print-MOCKERY_VERSION)"
-    protoc_gen_go_version="$(grep github.com/golang/protobuf go.mod | awk '{print $2}')"
+    protoc_gen_go_version="$(grep google.golang.org/protobuf go.mod | awk '{print $2}')"
     protoc_gen_go_grpc_version="$(make --no-print-directory print-PROTOC_GEN_GO_GRPC_VERSION)"
     mog_version="$(make --no-print-directory print-MOG_VERSION)"
     protoc_go_inject_tag_version="$(make --no-print-directory print-PROTOC_GO_INJECT_TAG_VERSION)"
     buf_version="$(make --no-print-directory print-BUF_VERSION)"
     protoc_gen_go_binary_version="$(make --no-print-directory print-PROTOC_GEN_GO_BINARY_VERSION)"
 
-
     # echo "go: ${protoc_gen_go_version}"
     # echo "mog: ${mog_version}"
     # echo "tag: ${protoc_go_inject_tag_version}"
@@ -94,9 +93,9 @@ function proto_tools_install {
 
     install_versioned_tool \
         'protoc-gen-go' \
-        'github.com/golang/protobuf' \
+        'google.golang.org/protobuf' \
         "${protoc_gen_go_version}" \
-        'github.com/golang/protobuf/protoc-gen-go'
+        'google.golang.org/protobuf/cmd/protoc-gen-go'
 
     install_versioned_tool \
         'protoc-gen-go-grpc' \
diff --git a/build-support/scripts/protobuf.sh b/build-support/scripts/protobuf.sh
index 40213627c0..7b815d355e 100755
--- a/build-support/scripts/protobuf.sh
+++ b/build-support/scripts/protobuf.sh
@@ -91,6 +91,7 @@ function postprocess_protobuf_code {
     fi
 
     local proto_go_path="${proto_path%%.proto}.pb.go"
+    local proto_go_grpc_path="${proto_path%%.proto}_grpc.pb.go"
     local proto_go_bin_path="${proto_path%%.proto}.pb.binary.go"
     local proto_go_rpcglue_path="${proto_path%%.proto}.rpcglue.pb.go"
 
@@ -104,10 +105,11 @@ function postprocess_protobuf_code {
     local build_tags
     build_tags="$(head -n 2 "${proto_path}" | grep '^//go:build\|// +build' || true)"
     if test -n "${build_tags}"; then
-       for file in "${proto_go_bin_path}" "${proto_go_grpc_path}"
+       for file in "${proto_go_path}" "${proto_go_bin_path}" "${proto_go_grpc_path}"
        do
             if test -f "${file}"
             then
+                echo "Adding build tags to ${file}"
                 echo -e "${build_tags}\n" >> "${file}.new"
                 cat "${file}" >> "${file}.new"
                 mv "${file}.new" "${file}"
diff --git a/go.mod b/go.mod
index 0d7d0ebe79..f4d9d2f52d 100644
--- a/go.mod
+++ b/go.mod
@@ -46,7 +46,7 @@ require (
 	github.com/hashicorp/go-immutable-radix v1.3.0
 	github.com/hashicorp/go-memdb v1.3.4
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/go-raftchunking v0.6.2
+	github.com/hashicorp/go-raftchunking v0.7.0
 	github.com/hashicorp/go-sockaddr v1.0.2
 	github.com/hashicorp/go-syslog v1.0.0
 	github.com/hashicorp/go-uuid v1.0.2
@@ -68,13 +68,13 @@ require (
 	github.com/kr/text v0.2.0
 	github.com/miekg/dns v1.1.41
 	github.com/mitchellh/cli v1.1.0
-	github.com/mitchellh/copystructure v1.0.0
+	github.com/mitchellh/copystructure v1.2.0
 	github.com/mitchellh/go-testing-interface v1.14.0
 	github.com/mitchellh/hashstructure v0.0.0-20170609045927-2bca23e0e452
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/mitchellh/mapstructure v1.4.3
 	github.com/mitchellh/pointerstructure v1.2.1
-	github.com/mitchellh/reflectwalk v1.0.1
+	github.com/mitchellh/reflectwalk v1.0.2
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pkg/errors v0.9.1
 	github.com/prometheus/client_golang v1.4.0
diff --git a/go.sum b/go.sum
index 5132c306e0..cfcbfe8ae4 100644
--- a/go.sum
+++ b/go.sum
@@ -311,8 +311,9 @@ github.com/go-ozzo/ozzo-validation v3.6.0+incompatible/go.mod h1:gsEKFIVnabGBt6m
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
 github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
 github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
@@ -493,8 +494,8 @@ github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
-github.com/hashicorp/go-raftchunking v0.6.2 h1:imj6CVkwXj6VzgXZQvzS+fSrkbFCzlJ2t00F3PacnuU=
-github.com/hashicorp/go-raftchunking v0.6.2/go.mod h1:cGlg3JtDy7qy6c/3Bu660Mic1JF+7lWqIwCFSb08fX0=
+github.com/hashicorp/go-raftchunking v0.7.0 h1:APNMnCXmTOhumkFv/GpJIbq7HteWF7EnGZ3875lRN0Y=
+github.com/hashicorp/go-raftchunking v0.7.0/go.mod h1:Dg/eBOaJzE0jYKNwNLs5IA5j0OSmL5HoCUiMy3mDmrI=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.6.7 h1:8/CAEZt/+F7kR7GevNHulKkUjLht3CPmn7egmhieNKo=
@@ -535,7 +536,6 @@ github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4
 github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0 h1:kBpVVl1sl3MaSrs97e0+pDQhSrqJv9gVbSUrPpVfl1w=
 github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0/go.mod h1:6pdNz0vo0mF0GvhwDG56O3N18qBrAz/XRIcfINfTbwo=
 github.com/hashicorp/raft v1.1.0/go.mod h1:4Ak7FSPnuvmb0GV6vgIAJ4vYT4bek9bb6Q+7HVbyzqM=
-github.com/hashicorp/raft v1.1.1/go.mod h1:vPAJM8Asw6u8LxC3eJCUZmRP/E4QmUGE1R7g7k8sG/8=
 github.com/hashicorp/raft v1.2.0/go.mod h1:vPAJM8Asw6u8LxC3eJCUZmRP/E4QmUGE1R7g7k8sG/8=
 github.com/hashicorp/raft v1.3.11 h1:p3v6gf6l3S797NnK5av3HcczOC1T5CLoaRvg0g9ys4A=
 github.com/hashicorp/raft v1.3.11/go.mod h1:J8naEwc6XaaCfts7+28whSeRvCqTd6e20BlCU3LtEO4=
@@ -672,8 +672,9 @@ github.com/mitchellh/cli v1.1.0 h1:tEElEatulEHDeedTxwckzyYMA5c86fbmNIUL1hBIiTg=
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
@@ -696,8 +697,8 @@ github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
 github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
 github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
-github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
diff --git a/internal/tools/proto-gen-rpc-glue/e2e/consul/agent/structs/structs.go b/internal/tools/proto-gen-rpc-glue/e2e/consul/agent/structs/structs.go
index 4d77413983..3021dd00d6 100644
--- a/internal/tools/proto-gen-rpc-glue/e2e/consul/agent/structs/structs.go
+++ b/internal/tools/proto-gen-rpc-glue/e2e/consul/agent/structs/structs.go
@@ -3,9 +3,8 @@ package structs
 import (
 	"time"
 
-	"github.com/golang/protobuf/ptypes"
-	"github.com/golang/protobuf/ptypes/duration"
-	"github.com/golang/protobuf/ptypes/timestamp"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 type QueryOptions struct {
@@ -30,28 +29,24 @@ const (
 	QueryBackendStreaming
 )
 
-func DurationToProto(d time.Duration) *duration.Duration {
-	return ptypes.DurationProto(d)
+func DurationToProto(d time.Duration) *durationpb.Duration {
+	return durationpb.New(d)
 }
 
-func DurationFromProto(d *duration.Duration) time.Duration {
-	ret, _ := ptypes.Duration(d)
-	return ret
-
+func DurationFromProto(d *durationpb.Duration) time.Duration {
+	return d.AsDuration()
 }
 
-func TimeFromProto(s *timestamp.Timestamp) time.Time {
-	ret, _ := ptypes.Timestamp(s)
-	return ret
+func TimeFromProto(s *timestamppb.Timestamp) time.Time {
+	return s.AsTime()
 }
 
-func TimeToProto(s time.Time) *timestamp.Timestamp {
-	ret, _ := ptypes.TimestampProto(s)
-	return ret
+func TimeToProto(s time.Time) *timestamppb.Timestamp {
+	return timestamppb.New(s)
 }
 
 // IsZeroProtoTime returns true if the time is the minimum protobuf timestamp
 // (the Unix epoch).
-func IsZeroProtoTime(t *timestamp.Timestamp) bool {
+func IsZeroProtoTime(t *timestamppb.Timestamp) bool {
 	return t.Seconds == 0 && t.Nanos == 0
 }
diff --git a/internal/tools/proto-gen-rpc-glue/e2e/consul/go.mod b/internal/tools/proto-gen-rpc-glue/e2e/consul/go.mod
index 78852ba84c..478c87099b 100644
--- a/internal/tools/proto-gen-rpc-glue/e2e/consul/go.mod
+++ b/internal/tools/proto-gen-rpc-glue/e2e/consul/go.mod
@@ -2,4 +2,4 @@ module github.com/hashicorp/consul
 
 go 1.13
 
-require github.com/golang/protobuf v1.3.5
+require google.golang.org/protobuf v1.28.1
diff --git a/internal/tools/proto-gen-rpc-glue/e2e/consul/go.sum b/internal/tools/proto-gen-rpc-glue/e2e/consul/go.sum
index 6124ed3e45..00f5993c95 100644
--- a/internal/tools/proto-gen-rpc-glue/e2e/consul/go.sum
+++ b/internal/tools/proto-gen-rpc-glue/e2e/consul/go.sum
@@ -1,2 +1,8 @@
-github.com/golang/protobuf v1.3.5 h1:F768QJ1E9tib+q5Sc8MkdJi1RxLTbRcTf8LJV56aRls=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
diff --git a/internal/tools/proto-gen-rpc-glue/e2e/consul/proto/pbcommon/common.pb.go b/internal/tools/proto-gen-rpc-glue/e2e/consul/proto/pbcommon/common.pb.go
index a04042cac7..c5303c923a 100644
--- a/internal/tools/proto-gen-rpc-glue/e2e/consul/proto/pbcommon/common.pb.go
+++ b/internal/tools/proto-gen-rpc-glue/e2e/consul/proto/pbcommon/common.pb.go
@@ -5,8 +5,8 @@ package pbcommon
 
 import (
 	fmt "fmt"
-	proto "github.com/golang/protobuf/proto"
-	duration "github.com/golang/protobuf/ptypes/duration"
+	proto "google.golang.org/protobuf/proto"
+	duration "google.golang.org/protobuf/types/known/durationpb"
 	math "math"
 )
 
diff --git a/internal/tools/proto-gen-rpc-glue/e2e/go.mod b/internal/tools/proto-gen-rpc-glue/e2e/go.mod
index 222f9f9c1a..d3d031c002 100644
--- a/internal/tools/proto-gen-rpc-glue/e2e/go.mod
+++ b/internal/tools/proto-gen-rpc-glue/e2e/go.mod
@@ -4,4 +4,7 @@ go 1.13
 
 replace github.com/hashicorp/consul => ./consul
 
-require github.com/hashicorp/consul v1.11.4
+require (
+	github.com/hashicorp/consul v1.11.4
+	google.golang.org/protobuf v1.28.1 // indirect
+)
diff --git a/internal/tools/proto-gen-rpc-glue/e2e/go.sum b/internal/tools/proto-gen-rpc-glue/e2e/go.sum
index 6124ed3e45..ca65ab6a32 100644
--- a/internal/tools/proto-gen-rpc-glue/e2e/go.sum
+++ b/internal/tools/proto-gen-rpc-glue/e2e/go.sum
@@ -1,2 +1,9 @@
-github.com/golang/protobuf v1.3.5 h1:F768QJ1E9tib+q5Sc8MkdJi1RxLTbRcTf8LJV56aRls=
 github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
+google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
diff --git a/internal/tools/protoc-gen-consul-rate-limit/go.mod b/internal/tools/protoc-gen-consul-rate-limit/go.mod
index 519235b455..c1c40938e2 100644
--- a/internal/tools/protoc-gen-consul-rate-limit/go.mod
+++ b/internal/tools/protoc-gen-consul-rate-limit/go.mod
@@ -8,5 +8,3 @@ require (
 	github.com/hashicorp/consul/proto-public v0.0.0-00010101000000-000000000000
 	google.golang.org/protobuf v1.28.1
 )
-
-require github.com/golang/protobuf v1.5.0 // indirect
diff --git a/internal/tools/protoc-gen-consul-rate-limit/go.sum b/internal/tools/protoc-gen-consul-rate-limit/go.sum
index a6b84d3f3e..00f5993c95 100644
--- a/internal/tools/protoc-gen-consul-rate-limit/go.sum
+++ b/internal/tools/protoc-gen-consul-rate-limit/go.sum
@@ -1,4 +1,3 @@
-github.com/golang/protobuf v1.5.0 h1:LUVKkCeviFUMKqHa4tXIIij/lbhnMbP7Fn5wKdKkRh4=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
diff --git a/proto-public/annotations/ratelimit/ratelimit.pb.go b/proto-public/annotations/ratelimit/ratelimit.pb.go
index 360c1e35fd..80d21fb41c 100644
--- a/proto-public/annotations/ratelimit/ratelimit.pb.go
+++ b/proto-public/annotations/ratelimit/ratelimit.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto-public/annotations/ratelimit/ratelimit.proto
 
diff --git a/proto-public/go.mod b/proto-public/go.mod
index 9870dccfb5..33a1de3850 100644
--- a/proto-public/go.mod
+++ b/proto-public/go.mod
@@ -3,14 +3,19 @@ module github.com/hashicorp/consul/proto-public
 go 1.19
 
 require (
-	github.com/golang/protobuf v1.5.0
+	github.com/stretchr/testify v1.5.1
 	google.golang.org/grpc v1.37.1
 	google.golang.org/protobuf v1.27.1
 )
 
 require (
+	github.com/davecgh/go-spew v1.1.0 // indirect
+	github.com/golang/protobuf v1.5.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/stretchr/objx v0.1.0 // indirect
 	golang.org/x/net v0.0.0-20190311183353-d8887717615a // indirect
 	golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a // indirect
 	golang.org/x/text v0.3.0 // indirect
 	google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 // indirect
+	gopkg.in/yaml.v2 v2.2.2 // indirect
 )
diff --git a/proto-public/go.sum b/proto-public/go.sum
index 59e6e6727b..212cecb78b 100644
--- a/proto-public/go.sum
+++ b/proto-public/go.sum
@@ -3,6 +3,7 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -29,9 +30,12 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/stretchr/objx v0.1.0 h1:4G4v2dO3VZwixGIRoQ5Lfboy6nUhCyYzaqnIAPPhYs4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -82,7 +86,9 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
diff --git a/proto-public/pbacl/acl.pb.go b/proto-public/pbacl/acl.pb.go
index 130032ac39..2fb7cd0344 100644
--- a/proto-public/pbacl/acl.pb.go
+++ b/proto-public/pbacl/acl.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto-public/pbacl/acl.proto
 
diff --git a/proto-public/pbconnectca/ca.pb.go b/proto-public/pbconnectca/ca.pb.go
index 79cd0bb794..6b487f2c5a 100644
--- a/proto-public/pbconnectca/ca.pb.go
+++ b/proto-public/pbconnectca/ca.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto-public/pbconnectca/ca.proto
 
diff --git a/proto-public/pbdataplane/dataplane.pb.go b/proto-public/pbdataplane/dataplane.pb.go
index 0297f1add4..716f9f6eb5 100644
--- a/proto-public/pbdataplane/dataplane.pb.go
+++ b/proto-public/pbdataplane/dataplane.pb.go
@@ -2,7 +2,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto-public/pbdataplane/dataplane.proto
 
diff --git a/proto-public/pbdns/dns.pb.go b/proto-public/pbdns/dns.pb.go
index 7b7c5c579b..9c90b58249 100644
--- a/proto-public/pbdns/dns.pb.go
+++ b/proto-public/pbdns/dns.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto-public/pbdns/dns.proto
 
diff --git a/proto-public/pbserverdiscovery/serverdiscovery.pb.go b/proto-public/pbserverdiscovery/serverdiscovery.pb.go
index 95264605a3..47a6d4c8d4 100644
--- a/proto-public/pbserverdiscovery/serverdiscovery.pb.go
+++ b/proto-public/pbserverdiscovery/serverdiscovery.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto-public/pbserverdiscovery/serverdiscovery.proto
 
diff --git a/proto/pbacl/acl.pb.go b/proto/pbacl/acl.pb.go
index a04466a01b..4306669213 100644
--- a/proto/pbacl/acl.pb.go
+++ b/proto/pbacl/acl.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbacl/acl.proto
 
diff --git a/proto/pbautoconf/auto_config.pb.go b/proto/pbautoconf/auto_config.pb.go
index 3a186af48f..3af70821fb 100644
--- a/proto/pbautoconf/auto_config.pb.go
+++ b/proto/pbautoconf/auto_config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbautoconf/auto_config.proto
 
diff --git a/proto/pbcommon/common.go b/proto/pbcommon/common.go
index ea7c7399b4..892c53887a 100644
--- a/proto/pbcommon/common.go
+++ b/proto/pbcommon/common.go
@@ -4,6 +4,7 @@ import (
 	"time"
 
 	"github.com/hashicorp/consul/agent/structs"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
 )
 
 // IsRead is always true for QueryOption
@@ -36,7 +37,7 @@ func (q *QueryOptions) SetMinQueryIndex(minQueryIndex uint64) {
 
 // SetMaxQueryTime is needed to implement the structs.QueryOptionsCompat interface
 func (q *QueryOptions) SetMaxQueryTime(maxQueryTime time.Duration) {
-	q.MaxQueryTime = structs.DurationToProto(maxQueryTime)
+	q.MaxQueryTime = durationpb.New(maxQueryTime)
 }
 
 // SetAllowStale is needed to implement the structs.QueryOptionsCompat interface
@@ -56,12 +57,12 @@ func (q *QueryOptions) SetUseCache(useCache bool) {
 
 // SetMaxStaleDuration is needed to implement the structs.QueryOptionsCompat interface
 func (q *QueryOptions) SetMaxStaleDuration(maxStaleDuration time.Duration) {
-	q.MaxStaleDuration = structs.DurationToProto(maxStaleDuration)
+	q.MaxStaleDuration = durationpb.New(maxStaleDuration)
 }
 
 // SetMaxAge is needed to implement the structs.QueryOptionsCompat interface
 func (q *QueryOptions) SetMaxAge(maxAge time.Duration) {
-	q.MaxAge = structs.DurationToProto(maxAge)
+	q.MaxAge = durationpb.New(maxAge)
 }
 
 // SetMustRevalidate is needed to implement the structs.QueryOptionsCompat interface
@@ -71,7 +72,7 @@ func (q *QueryOptions) SetMustRevalidate(mustRevalidate bool) {
 
 // SetStaleIfError is needed to implement the structs.QueryOptionsCompat interface
 func (q *QueryOptions) SetStaleIfError(staleIfError time.Duration) {
-	q.StaleIfError = structs.DurationToProto(staleIfError)
+	q.StaleIfError = durationpb.New(staleIfError)
 }
 
 func (q *QueryOptions) HasTimedOut(start time.Time, rpcHoldTimeout, maxQueryTime, defaultQueryTime time.Duration) (bool, error) {
@@ -82,7 +83,7 @@ func (q *QueryOptions) HasTimedOut(start time.Time, rpcHoldTimeout, maxQueryTime
 
 // BlockingTimeout implements pool.BlockableQuery
 func (q *QueryOptions) BlockingTimeout(maxQueryTime, defaultQueryTime time.Duration) time.Duration {
-	maxTime := structs.DurationFromProto(q.MaxQueryTime)
+	maxTime := q.MaxQueryTime.AsDuration()
 	o := structs.QueryOptions{
 		MaxQueryTime:  maxTime,
 		MinQueryIndex: q.MinQueryIndex,
@@ -157,7 +158,7 @@ func (td *TargetDatacenter) RequestDatacenter() string {
 
 // SetLastContact is needed to implement the structs.QueryMetaCompat interface
 func (q *QueryMeta) SetLastContact(lastContact time.Duration) {
-	q.LastContact = structs.DurationToProto(lastContact)
+	q.LastContact = durationpb.New(lastContact)
 }
 
 // SetKnownLeader is needed to implement the structs.QueryMetaCompat interface
diff --git a/proto/pbcommon/common.pb.go b/proto/pbcommon/common.pb.go
index a8994d32a9..c43d58f2ea 100644
--- a/proto/pbcommon/common.pb.go
+++ b/proto/pbcommon/common.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbcommon/common.proto
 
diff --git a/proto/pbconfig/config.pb.go b/proto/pbconfig/config.pb.go
index ed4b9b1e3b..589985d171 100644
--- a/proto/pbconfig/config.pb.go
+++ b/proto/pbconfig/config.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbconfig/config.proto
 
diff --git a/proto/pbconfigentry/config_entry.go b/proto/pbconfigentry/config_entry.go
index 54194d3f90..4a7c0e0c6a 100644
--- a/proto/pbconfigentry/config_entry.go
+++ b/proto/pbconfigentry/config_entry.go
@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/timestamp"
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
@@ -151,14 +150,14 @@ func enterpriseMetaFromStructs(m acl.EnterpriseMeta) *pbcommon.EnterpriseMeta {
 	return pbcommon.NewEnterpriseMetaFromStructs(m)
 }
 
-func timeFromStructs(t *time.Time) *timestamp.Timestamp {
+func timeFromStructs(t *time.Time) *timestamppb.Timestamp {
 	if t == nil {
 		return nil
 	}
 	return timestamppb.New(*t)
 }
 
-func timeToStructs(ts *timestamp.Timestamp) *time.Time {
+func timeToStructs(ts *timestamppb.Timestamp) *time.Time {
 	if ts == nil {
 		return nil
 	}
diff --git a/proto/pbconfigentry/config_entry.pb.go b/proto/pbconfigentry/config_entry.pb.go
index e8ca24fca4..3ce79dc075 100644
--- a/proto/pbconfigentry/config_entry.pb.go
+++ b/proto/pbconfigentry/config_entry.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbconfigentry/config_entry.proto
 
diff --git a/proto/pbconnect/connect.pb.go b/proto/pbconnect/connect.pb.go
index e9fb79fc70..4d6ac71f3a 100644
--- a/proto/pbconnect/connect.pb.go
+++ b/proto/pbconnect/connect.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbconnect/connect.proto
 
diff --git a/proto/pboperator/operator.pb.go b/proto/pboperator/operator.pb.go
index 67433e2280..1b9cd0f5ce 100644
--- a/proto/pboperator/operator.pb.go
+++ b/proto/pboperator/operator.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pboperator/operator.proto
 
diff --git a/proto/pbpeering/peering.go b/proto/pbpeering/peering.go
index dea15031ef..3481b37a40 100644
--- a/proto/pbpeering/peering.go
+++ b/proto/pbpeering/peering.go
@@ -7,10 +7,10 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/golang/protobuf/ptypes/timestamp"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/hashicorp/consul/agent/structs"
 	"github.com/hashicorp/consul/api"
@@ -299,19 +299,19 @@ func NewEstablishRequestFromAPI(req *api.PeeringEstablishRequest) *EstablishRequ
 	return t
 }
 
-func TimePtrFromProto(s *timestamp.Timestamp) *time.Time {
+func TimePtrFromProto(s *timestamppb.Timestamp) *time.Time {
 	if s == nil {
 		return nil
 	}
-	t := structs.TimeFromProto(s)
+	t := s.AsTime()
 	return &t
 }
 
-func TimePtrToProto(s *time.Time) *timestamp.Timestamp {
+func TimePtrToProto(s *time.Time) *timestamppb.Timestamp {
 	if s == nil {
 		return nil
 	}
-	return structs.TimeToProto(*s)
+	return timestamppb.New(*s)
 }
 
 // DeepCopy returns a copy of the PeeringTrustBundle that can be passed around
diff --git a/proto/pbpeering/peering.pb.go b/proto/pbpeering/peering.pb.go
index e3383423eb..955900c6aa 100644
--- a/proto/pbpeering/peering.pb.go
+++ b/proto/pbpeering/peering.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbpeering/peering.proto
 
diff --git a/proto/pbpeerstream/peerstream.pb.go b/proto/pbpeerstream/peerstream.pb.go
index 966a4b6750..87c79ea343 100644
--- a/proto/pbpeerstream/peerstream.pb.go
+++ b/proto/pbpeerstream/peerstream.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbpeerstream/peerstream.proto
 
diff --git a/proto/pbservice/convert_pbstruct.go b/proto/pbservice/convert_pbstruct.go
index 8b1902942d..1a4db4b888 100644
--- a/proto/pbservice/convert_pbstruct.go
+++ b/proto/pbservice/convert_pbstruct.go
@@ -1,278 +1,36 @@
 package pbservice
 
 import (
-	fmt "fmt"
-	"reflect"
-
-	types "github.com/golang/protobuf/ptypes/struct"
+	"google.golang.org/protobuf/types/known/structpb"
 )
 
-// ProtobufTypesStructToMapStringInterface converts a protobuf/types.Struct into a
+// ProtobufTypesStructToMapStringInterface converts a protobuf/structpb.Struct into a
 // map[string]interface{}.
-func ProtobufTypesStructToMapStringInterface(s *types.Struct) map[string]interface{} {
+func ProtobufTypesStructToMapStringInterface(s *structpb.Struct) map[string]interface{} {
 	if s == nil {
 		return nil
 	}
-	m := make(map[string]interface{}, len(s.Fields))
-	for k, v := range s.Fields {
-		m[k] = interfaceFromPBValue(v)
-	}
-	return m
-}
-
-// interfaceFromPBValue converts a protobuf Value into an interface{}
-func interfaceFromPBValue(v *types.Value) interface{} {
-	if v == nil {
-		return nil
-	}
-	switch k := v.Kind.(type) {
-	case *types.Value_NullValue:
-		return nil
-	case *types.Value_NumberValue:
-		return k.NumberValue
-	case *types.Value_StringValue:
-		return k.StringValue
-	case *types.Value_BoolValue:
-		return k.BoolValue
-	case *types.Value_StructValue:
-		return ProtobufTypesStructToMapStringInterface(k.StructValue)
-	case *types.Value_ListValue:
-		s := make([]interface{}, len(k.ListValue.Values))
-		for i, e := range k.ListValue.Values {
-			s[i] = interfaceFromPBValue(e)
-		}
-		return s
-	default:
-		panic("unknown kind")
-	}
+	return s.AsMap()
 }
 
 // MapStringInterfaceToProtobufTypesStruct converts a map[string]interface{} into a proto.Struct
-func MapStringInterfaceToProtobufTypesStruct(m map[string]interface{}) *types.Struct {
-	if len(m) == 0 {
+func MapStringInterfaceToProtobufTypesStruct(m map[string]interface{}) *structpb.Struct {
+	if len(m) < 1 {
 		return nil
 	}
-
-	fields := make(map[string]*types.Value, len(m))
-	for k, v := range m {
-		fields[k] = interfaceToPBValue(v)
-	}
-	return &types.Struct{Fields: fields}
+	// TODO - handle the error better. It probably requires mog to be able to use alternative method signatures though
+	s, _ := structpb.NewStruct(m)
+	return s
 }
 
 // SliceToPBListValue converts a []interface{} into a proto.ListValue. It's used
 // internally by MapStringInterfaceToProtobufTypesStruct when it encouters slices.
-func SliceToPBListValue(s []interface{}) *types.ListValue {
-	if len(s) == 0 {
+// TODO (remove usage of this struct in favor of structpb.NewListValue)
+func SliceToPBListValue(s []interface{}) *structpb.ListValue {
+	if len(s) < 1 {
 		return nil
 	}
-
-	vals := make([]*types.Value, len(s))
-	for i, v := range s {
-		vals[i] = interfaceToPBValue(v)
-	}
-	return &types.ListValue{Values: vals}
-}
-
-// interfaceToPBValue converts a interface{} into a proto.Value. It attempts to
-// do so by type switch and simple casts where possible but falls back to
-// reflection if necessary.
-func interfaceToPBValue(v interface{}) *types.Value {
-	switch v := v.(type) {
-	case nil:
-		return nil
-	case int:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case int8:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case int32:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case int64:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case uint:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case uint8:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case uint32:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case uint64:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case float32:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v),
-			},
-		}
-	case float64:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: v,
-			},
-		}
-	case string:
-		return &types.Value{
-			Kind: &types.Value_StringValue{
-				StringValue: v,
-			},
-		}
-	case error:
-		return &types.Value{
-			Kind: &types.Value_StringValue{
-				StringValue: v.Error(),
-			},
-		}
-	case map[string]interface{}:
-		return &types.Value{
-			Kind: &types.Value_StructValue{
-				StructValue: MapStringInterfaceToProtobufTypesStruct(v),
-			},
-		}
-	case []interface{}:
-		return &types.Value{
-			Kind: &types.Value_ListValue{
-				ListValue: SliceToPBListValue(v),
-			},
-		}
-	default:
-		return interfaceToPBValueReflect(reflect.ValueOf(v))
-	}
-}
-
-// interfaceToPBValueReflect converts a interface{} into a proto.Value using
-// reflection.
-func interfaceToPBValueReflect(v reflect.Value) *types.Value {
-	switch v.Kind() {
-	case reflect.Interface:
-		return interfaceToPBValue(v.Interface())
-	case reflect.Bool:
-		return &types.Value{
-			Kind: &types.Value_BoolValue{
-				BoolValue: v.Bool(),
-			},
-		}
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v.Int()),
-			},
-		}
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: float64(v.Uint()),
-			},
-		}
-	case reflect.Float32, reflect.Float64:
-		return &types.Value{
-			Kind: &types.Value_NumberValue{
-				NumberValue: v.Float(),
-			},
-		}
-	case reflect.Ptr:
-		if v.IsNil() {
-			return nil
-		}
-		return interfaceToPBValueReflect(reflect.Indirect(v))
-	case reflect.Array, reflect.Slice:
-		size := v.Len()
-		if size == 0 {
-			return nil
-		}
-		values := make([]*types.Value, size)
-		for i := 0; i < size; i++ {
-			values[i] = interfaceToPBValue(v.Index(i))
-		}
-		return &types.Value{
-			Kind: &types.Value_ListValue{
-				ListValue: &types.ListValue{
-					Values: values,
-				},
-			},
-		}
-	case reflect.Struct:
-		t := v.Type()
-		size := v.NumField()
-		if size == 0 {
-			return nil
-		}
-		fields := make(map[string]*types.Value, size)
-		for i := 0; i < size; i++ {
-			name := t.Field(i).Name
-			// Only include public fields. There may be a better way with struct tags
-			// but this works for now.
-			if len(name) > 0 && 'A' <= name[0] && name[0] <= 'Z' {
-				fields[name] = interfaceToPBValue(v.Field(i))
-			}
-		}
-		if len(fields) == 0 {
-			return nil
-		}
-		return &types.Value{
-			Kind: &types.Value_StructValue{
-				StructValue: &types.Struct{
-					Fields: fields,
-				},
-			},
-		}
-	case reflect.Map:
-		keys := v.MapKeys()
-		if len(keys) == 0 {
-			return nil
-		}
-		fields := make(map[string]*types.Value, len(keys))
-		for _, k := range keys {
-			if k.Kind() == reflect.String {
-				fields[k.String()] = interfaceToPBValue(v.MapIndex(k))
-			}
-		}
-		if len(fields) == 0 {
-			return nil
-		}
-		return &types.Value{
-			Kind: &types.Value_StructValue{
-				StructValue: &types.Struct{
-					Fields: fields,
-				},
-			},
-		}
-	default:
-		// Last resort
-		return &types.Value{
-			Kind: &types.Value_StringValue{
-				StringValue: fmt.Sprint(v),
-			},
-		}
-	}
+	// TODO - handle the error better. It probably requires mog to use alt method signatures though
+	val, _ := structpb.NewList(s)
+	return val
 }
diff --git a/proto/pbservice/healthcheck.pb.go b/proto/pbservice/healthcheck.pb.go
index 952c9a5904..31e082b852 100644
--- a/proto/pbservice/healthcheck.pb.go
+++ b/proto/pbservice/healthcheck.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbservice/healthcheck.proto
 
diff --git a/proto/pbservice/node.pb.go b/proto/pbservice/node.pb.go
index 2806d31f58..cebee359f5 100644
--- a/proto/pbservice/node.pb.go
+++ b/proto/pbservice/node.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbservice/node.proto
 
diff --git a/proto/pbservice/service.pb.go b/proto/pbservice/service.pb.go
index d4040f31e2..2cf7956e03 100644
--- a/proto/pbservice/service.pb.go
+++ b/proto/pbservice/service.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbservice/service.proto
 
diff --git a/proto/pbstatus/status.pb.go b/proto/pbstatus/status.pb.go
index b8e34c5492..bdc5b70d79 100644
--- a/proto/pbstatus/status.pb.go
+++ b/proto/pbstatus/status.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbstatus/status.proto
 
diff --git a/proto/pbsubscribe/subscribe.pb.go b/proto/pbsubscribe/subscribe.pb.go
index 51d5bc3c8c..f24b252b75 100644
--- a/proto/pbsubscribe/subscribe.pb.go
+++ b/proto/pbsubscribe/subscribe.pb.go
@@ -3,7 +3,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
+// 	protoc-gen-go v1.28.1
 // 	protoc        (unknown)
 // source: proto/pbsubscribe/subscribe.proto
 
diff --git a/test/integration/consul-container/go.mod b/test/integration/consul-container/go.mod
index 6bd465bf88..456ba5b180 100644
--- a/test/integration/consul-container/go.mod
+++ b/test/integration/consul-container/go.mod
@@ -55,7 +55,6 @@ require (
 	github.com/go-openapi/swag v0.21.1 // indirect
 	github.com/go-openapi/validate v0.21.0 // indirect
 	github.com/go-ozzo/ozzo-validation v3.6.0+incompatible // indirect
-	github.com/go-test/deep v1.0.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
 	github.com/golang/protobuf v1.5.2 // indirect
@@ -79,7 +78,7 @@ require (
 	github.com/hashicorp/go-msgpack v1.1.5 // indirect
 	github.com/hashicorp/go-msgpack/v2 v2.0.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-raftchunking v0.6.2 // indirect
+	github.com/hashicorp/go-raftchunking v0.7.0 // indirect
 	github.com/hashicorp/go-retryablehttp v0.6.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
@@ -112,14 +111,14 @@ require (
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/miekg/dns v1.1.41 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.0 // indirect
 	github.com/mitchellh/hashstructure v0.0.0-20170609045927-2bca23e0e452 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
-	github.com/mitchellh/reflectwalk v1.0.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/sys/mount v0.2.0 // indirect
 	github.com/moby/sys/mountinfo v0.5.0 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
diff --git a/test/integration/consul-container/go.sum b/test/integration/consul-container/go.sum
index f4778af03a..1bd95b303a 100644
--- a/test/integration/consul-container/go.sum
+++ b/test/integration/consul-container/go.sum
@@ -363,8 +363,8 @@ github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/me
 github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-test/deep v1.0.2-0.20181118220953-042da051cf31/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
-github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
 github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
 github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
@@ -528,8 +528,8 @@ github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
-github.com/hashicorp/go-raftchunking v0.6.2 h1:imj6CVkwXj6VzgXZQvzS+fSrkbFCzlJ2t00F3PacnuU=
-github.com/hashicorp/go-raftchunking v0.6.2/go.mod h1:cGlg3JtDy7qy6c/3Bu660Mic1JF+7lWqIwCFSb08fX0=
+github.com/hashicorp/go-raftchunking v0.7.0 h1:APNMnCXmTOhumkFv/GpJIbq7HteWF7EnGZ3875lRN0Y=
+github.com/hashicorp/go-raftchunking v0.7.0/go.mod h1:Dg/eBOaJzE0jYKNwNLs5IA5j0OSmL5HoCUiMy3mDmrI=
 github.com/hashicorp/go-retryablehttp v0.5.3/go.mod h1:9B5zBasrRhHXnJnui7y6sL7es7NDiJgTc6Er0maI1Xs=
 github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.6.7 h1:8/CAEZt/+F7kR7GevNHulKkUjLht3CPmn7egmhieNKo=
@@ -567,7 +567,6 @@ github.com/hashicorp/memberlist v0.5.0/go.mod h1:yvyXLpo0QaGE59Y7hDTsTzDD25JYBZ4
 github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0 h1:kBpVVl1sl3MaSrs97e0+pDQhSrqJv9gVbSUrPpVfl1w=
 github.com/hashicorp/net-rpc-msgpackrpc/v2 v2.0.0/go.mod h1:6pdNz0vo0mF0GvhwDG56O3N18qBrAz/XRIcfINfTbwo=
 github.com/hashicorp/raft v1.1.0/go.mod h1:4Ak7FSPnuvmb0GV6vgIAJ4vYT4bek9bb6Q+7HVbyzqM=
-github.com/hashicorp/raft v1.1.1/go.mod h1:vPAJM8Asw6u8LxC3eJCUZmRP/E4QmUGE1R7g7k8sG/8=
 github.com/hashicorp/raft v1.2.0/go.mod h1:vPAJM8Asw6u8LxC3eJCUZmRP/E4QmUGE1R7g7k8sG/8=
 github.com/hashicorp/raft v1.3.11 h1:p3v6gf6l3S797NnK5av3HcczOC1T5CLoaRvg0g9ys4A=
 github.com/hashicorp/raft v1.3.11/go.mod h1:J8naEwc6XaaCfts7+28whSeRvCqTd6e20BlCU3LtEO4=
@@ -688,8 +687,9 @@ github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceT
 github.com/mitchellh/cli v1.1.0/go.mod h1:xcISNoH86gajksDmfB23e/pu+B+GeFRMYmoHXxx3xhI=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
@@ -712,8 +712,8 @@ github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQ
 github.com/mitchellh/pointerstructure v1.2.1 h1:ZhBBeX8tSlRpu/FFhXH4RC4OJzFlqsQhoHZAz4x7TIw=
 github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8ohIXc3tViBH44KcwB2g4=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
-github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/sys/mount v0.2.0 h1:WhCW5B355jtxndN5ovugJlMFJawbUODuW8fSnEH6SSM=
 github.com/moby/sys/mount v0.2.0/go.mod h1:aAivFE2LB3W4bACsUXChRHQ0qKWsetY4Y9V7sxOougM=