diff --git a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/source/multiple-workload-addresses-without-ports.golden b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/source/multiple-workload-addresses-without-ports.golden
index 0625a4ea79d5..3316d7161ead 100644
--- a/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/source/multiple-workload-addresses-without-ports.golden
+++ b/internal/mesh/internal/controllers/sidecarproxy/builder/testdata/source/multiple-workload-addresses-without-ports.golden
@@ -108,17 +108,16 @@
                 }
               }
             },
-            "l7": {
-              "route": {
-                "name": "public_listener:http"
+            "l4": {
+              "cluster": {
+                "name": "local_app:tcp"
               },
               "statPrefix": "public_listener",
-              "staticRoute": true,
               "trafficPermissions": {}
             },
             "match": {
               "alpnProtocols": [
-                "consul~http"
+                "consul~tcp"
               ]
             }
           },
@@ -134,9 +133,8 @@
               }
             },
             "l7": {
-              "protocol": "L7_PROTOCOL_HTTP2",
               "route": {
-                "name": "public_listener:http2"
+                "name": "public_listener:http"
               },
               "statPrefix": "public_listener",
               "staticRoute": true,
@@ -144,7 +142,7 @@
             },
             "match": {
               "alpnProtocols": [
-                "consul~http2"
+                "consul~http"
               ]
             }
           },
@@ -160,9 +158,9 @@
               }
             },
             "l7": {
-              "protocol": "L7_PROTOCOL_GRPC",
+              "protocol": "L7_PROTOCOL_HTTP2",
               "route": {
-                "name": "public_listener:grpc"
+                "name": "public_listener:http2"
               },
               "statPrefix": "public_listener",
               "staticRoute": true,
@@ -170,7 +168,7 @@
             },
             "match": {
               "alpnProtocols": [
-                "consul~grpc"
+                "consul~http2"
               ]
             }
           },
@@ -185,16 +183,18 @@
                 }
               }
             },
-            "l4": {
-              "cluster": {
-                "name": "local_app:tcp"
+            "l7": {
+              "protocol": "L7_PROTOCOL_GRPC",
+              "route": {
+                "name": "public_listener:grpc"
               },
               "statPrefix": "public_listener",
+              "staticRoute": true,
               "trafficPermissions": {}
             },
             "match": {
               "alpnProtocols": [
-                "consul~tcp"
+                "consul~grpc"
               ]
             }
           }
diff --git a/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-with-specific-ports.golden b/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-with-specific-ports.golden
index ed61c110782b..153c87306fd8 100644
--- a/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-with-specific-ports.golden
+++ b/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-with-specific-ports.golden
@@ -113,12 +113,11 @@
               }
             }
           },
-          "l7": {
-            "route": {
-              "name": "public_listener:http"
+          "l4": {
+            "cluster": {
+              "name": "local_app:tcp"
             },
             "statPrefix": "public_listener",
-            "staticRoute": true,
             "trafficPermissions": {
               "allowPermissions": [
                 {
@@ -135,7 +134,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~http"
+              "consul~tcp"
             ]
           }
         },
@@ -151,9 +150,8 @@
             }
           },
           "l7": {
-            "protocol": "L7_PROTOCOL_HTTP2",
             "route": {
-              "name": "public_listener:http2"
+              "name": "public_listener:http"
             },
             "statPrefix": "public_listener",
             "staticRoute": true,
@@ -173,7 +171,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~http2"
+              "consul~http"
             ]
           }
         },
@@ -189,9 +187,9 @@
             }
           },
           "l7": {
-            "protocol": "L7_PROTOCOL_GRPC",
+            "protocol": "L7_PROTOCOL_HTTP2",
             "route": {
-              "name": "public_listener:grpc"
+              "name": "public_listener:http2"
             },
             "statPrefix": "public_listener",
             "staticRoute": true,
@@ -211,7 +209,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~grpc"
+              "consul~http2"
             ]
           }
         },
@@ -226,11 +224,13 @@
               }
             }
           },
-          "l4": {
-            "cluster": {
-              "name": "local_app:tcp"
+          "l7": {
+            "protocol": "L7_PROTOCOL_GRPC",
+            "route": {
+              "name": "public_listener:grpc"
             },
             "statPrefix": "public_listener",
+            "staticRoute": true,
             "trafficPermissions": {
               "allowPermissions": [
                 {
@@ -247,7 +247,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~tcp"
+              "consul~grpc"
             ]
           }
         }
diff --git a/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-without-ports.golden b/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-without-ports.golden
index 7af9b70c021a..b5d20a1a4c66 100644
--- a/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-without-ports.golden
+++ b/internal/mesh/internal/controllers/xds/testdata/source/multiple-workload-addresses-without-ports.golden
@@ -113,17 +113,16 @@
               }
             }
           },
-          "l7": {
-            "route": {
-              "name": "public_listener:http"
+          "l4": {
+            "cluster": {
+              "name": "local_app:tcp"
             },
             "statPrefix": "public_listener",
-            "staticRoute": true,
             "trafficPermissions": {}
           },
           "match": {
             "alpnProtocols": [
-              "consul~http"
+              "consul~tcp"
             ]
           }
         },
@@ -139,9 +138,8 @@
             }
           },
           "l7": {
-            "protocol": "L7_PROTOCOL_HTTP2",
             "route": {
-              "name": "public_listener:http2"
+              "name": "public_listener:http"
             },
             "statPrefix": "public_listener",
             "staticRoute": true,
@@ -149,7 +147,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~http2"
+              "consul~http"
             ]
           }
         },
@@ -165,9 +163,9 @@
             }
           },
           "l7": {
-            "protocol": "L7_PROTOCOL_GRPC",
+            "protocol": "L7_PROTOCOL_HTTP2",
             "route": {
-              "name": "public_listener:grpc"
+              "name": "public_listener:http2"
             },
             "statPrefix": "public_listener",
             "staticRoute": true,
@@ -175,7 +173,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~grpc"
+              "consul~http2"
             ]
           }
         },
@@ -190,16 +188,18 @@
               }
             }
           },
-          "l4": {
-            "cluster": {
-              "name": "local_app:tcp"
+          "l7": {
+            "protocol": "L7_PROTOCOL_GRPC",
+            "route": {
+              "name": "public_listener:grpc"
             },
             "statPrefix": "public_listener",
+            "staticRoute": true,
             "trafficPermissions": {}
           },
           "match": {
             "alpnProtocols": [
-              "consul~tcp"
+              "consul~grpc"
             ]
           }
         }
diff --git a/internal/mesh/internal/controllers/xds/testdata/source/single-workload-address-without-ports.golden b/internal/mesh/internal/controllers/xds/testdata/source/single-workload-address-without-ports.golden
index b5d20a1a4c66..013ddaf47e6f 100644
--- a/internal/mesh/internal/controllers/xds/testdata/source/single-workload-address-without-ports.golden
+++ b/internal/mesh/internal/controllers/xds/testdata/source/single-workload-address-without-ports.golden
@@ -113,16 +113,18 @@
               }
             }
           },
-          "l4": {
-            "cluster": {
-              "name": "local_app:tcp"
+          "l7": {
+            "protocol": "L7_PROTOCOL_GRPC",
+            "route": {
+              "name": "public_listener:grpc"
             },
             "statPrefix": "public_listener",
+            "staticRoute": true,
             "trafficPermissions": {}
           },
           "match": {
             "alpnProtocols": [
-              "consul~tcp"
+              "consul~grpc"
             ]
           }
         },
@@ -137,17 +139,16 @@
               }
             }
           },
-          "l7": {
-            "route": {
-              "name": "public_listener:http"
+          "l4": {
+            "cluster": {
+              "name": "local_app:tcp"
             },
             "statPrefix": "public_listener",
-            "staticRoute": true,
             "trafficPermissions": {}
           },
           "match": {
             "alpnProtocols": [
-              "consul~http"
+              "consul~tcp"
             ]
           }
         },
@@ -163,9 +164,8 @@
             }
           },
           "l7": {
-            "protocol": "L7_PROTOCOL_HTTP2",
             "route": {
-              "name": "public_listener:http2"
+              "name": "public_listener:http"
             },
             "statPrefix": "public_listener",
             "staticRoute": true,
@@ -173,7 +173,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~http2"
+              "consul~http"
             ]
           }
         },
@@ -189,9 +189,9 @@
             }
           },
           "l7": {
-            "protocol": "L7_PROTOCOL_GRPC",
+            "protocol": "L7_PROTOCOL_HTTP2",
             "route": {
-              "name": "public_listener:grpc"
+              "name": "public_listener:http2"
             },
             "statPrefix": "public_listener",
             "staticRoute": true,
@@ -199,7 +199,7 @@
           },
           "match": {
             "alpnProtocols": [
-              "consul~grpc"
+              "consul~http2"
             ]
           }
         }