diff --git a/.changelog/16888.txt b/.changelog/16888.txt
new file mode 100644
index 000000000000..4cea20517ae0
--- /dev/null
+++ b/.changelog/16888.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update supported envoy versions to 1.21.6, 1.22.11, 1.23.8, 1.24.6
+```
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 333517d0e787..411426b815d0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -12,10 +12,10 @@ parameters:
 
 references:
   envoy-versions: &supported_envoy_versions
-    - &default_envoy_version "1.22.7"
-    - "1.23.4"
-    - "1.24.2"
-    - "1.25.1"
+    - &default_envoy_version "1.21.6"
+    - "1.22.11"
+    - "1.23.8"
+    - "1.24.6"
   nomad-versions: &supported_nomad_versions
     - &default_nomad_version "1.3.3"
     - "1.2.10"
diff --git a/agent/xds/envoy_versioning_test.go b/agent/xds/envoy_versioning_test.go
index d90ade4a0f1c..ca1ea4e07347 100644
--- a/agent/xds/envoy_versioning_test.go
+++ b/agent/xds/envoy_versioning_test.go
@@ -136,10 +136,10 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 	}
 	*/
 	for _, v := range []string{
-		"1.21.0", "1.21.1", "1.21.2", "1.21.3", "1.21.4", "1.21.5",
-		"1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.22.4", "1.22.5",
-		"1.23.0", "1.23.1", "1.23.2",
-		"1.24.0",
+		"1.21.0", "1.21.1", "1.21.2", "1.21.3", "1.21.4", "1.21.5", "1.21.6",
+		"1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.22.4", "1.22.5", "1.22.6", "1.22.7", "1.22.8", "1.22.9", "1.22.10", "1.22.11",
+		"1.23.0", "1.23.1", "1.23.2", "1.23.3", "1.23.4", "1.23.5", "1.23.6", "1.23.7", "1.23.8",
+		"1.24.0", "1.24.1", "1.24.2", "1.24.3", "1.24.4", "1.24.5", "1.24.6",
 	} {
 		cases[v] = testcase{expect: supportedProxyFeatures{}}
 	}
diff --git a/agent/xds/proxysupport/proxysupport.go b/agent/xds/proxysupport/proxysupport.go
index 62bd1d39d768..a0b7e77b620a 100644
--- a/agent/xds/proxysupport/proxysupport.go
+++ b/agent/xds/proxysupport/proxysupport.go
@@ -7,8 +7,8 @@ package proxysupport
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
-	"1.24.0",
-	"1.23.2",
-	"1.22.5",
-	"1.21.5",
+	"1.24.6",
+	"1.23.8",
+	"1.22.11",
+	"1.21.6",
 }
diff --git a/website/content/docs/connect/proxies/envoy.mdx b/website/content/docs/connect/proxies/envoy.mdx
index 6ac741aab1ad..37e672921fe3 100644
--- a/website/content/docs/connect/proxies/envoy.mdx
+++ b/website/content/docs/connect/proxies/envoy.mdx
@@ -39,7 +39,7 @@ Consul supports **four major Envoy releases** at the beginning of each major Con
 
 | Consul Version      | Compatible Envoy Versions                                                          |
 | ------------------- | -----------------------------------------------------------------------------------|
-| 1.14.x              | 1.24.0, 1.23.1, 1.22.5, 1.21.5                                                     |
+| 1.14.x              | 1.24.6, 1.23.8, 1.22.11, 1.21.6                                                     |
 | 1.13.x              | 1.23.1, 1.22.5, 1.21.5, 1.20.7                                                     |
 | 1.12.x              | 1.22.5, 1.21.5, 1.20.7, 1.19.5                                                     |
 
@@ -126,7 +126,7 @@ Connect to a local Consul client agent and run the [`consul connect envoy` comma
 
 If you experience issues when bootstrapping Envoy proxies from the CLI, use the
 `-enable-config-gen-logging` flag to enable debug message logging. These logs can
-help you troubleshoot issues that occur during the bootstrapping process. 
+help you troubleshoot issues that occur during the bootstrapping process.
 For more information about available flags and parameters, refer to the
 [`consul connect envoy CLI` reference](/consul/commands/connect/envoy).
 
@@ -338,7 +338,7 @@ defaults that are inherited by all services.
 
 - `local_idle_timeout_ms` - In milliseconds, the idle timeout for HTTP requests
   to the local application instance. Applies to HTTP based protocols only. If not
-  specified, inherits the Envoy default for route idle timeouts (15s). A value of 0 
+  specified, inherits the Envoy default for route idle timeouts (15s). A value of 0
   disables request timeouts.
 
 - `max_inbound_connections` - The maximum number of concurrent inbound connections