diff --git a/.changelog/16889.txt b/.changelog/16889.txt
new file mode 100644
index 000000000000..67a859a430ae
--- /dev/null
+++ b/.changelog/16889.txt
@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update supported envoy versions to 1.22.11, 1.23.8, 1.24.6, 1.25.4
+```
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 878d6fd59492..346adac7474f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -22,10 +22,10 @@ references:
     BASH_ENV: .circleci/bash_env.sh
     GO_VERSION: 1.20.1
   envoy-versions: &supported_envoy_versions
-    - &default_envoy_version "1.22.7"
-    - "1.23.4"
-    - "1.24.2"
-    - "1.25.1"
+    - &default_envoy_version "1.22.11"
+    - "1.23.8"
+    - "1.24.6"
+    - "1.25.4"
   nomad-versions: &supported_nomad_versions
     - &default_nomad_version "1.3.3"
     - "1.2.10"
diff --git a/envoyextensions/xdscommon/envoy_versioning_test.go b/envoyextensions/xdscommon/envoy_versioning_test.go
index a8d511d19859..96f6f305d4fa 100644
--- a/envoyextensions/xdscommon/envoy_versioning_test.go
+++ b/envoyextensions/xdscommon/envoy_versioning_test.go
@@ -139,10 +139,10 @@ func TestDetermineSupportedProxyFeaturesFromString(t *testing.T) {
 	}
 	*/
 	for _, v := range []string{
-		"1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.22.4", "1.22.5",
-		"1.23.0", "1.23.1", "1.23.2", "1.23.3", "1.23.4",
-		"1.24.0", "1.24.1", "1.24.2",
-		"1.25.0", "1.25.1",
+		"1.22.0", "1.22.1", "1.22.2", "1.22.3", "1.22.4", "1.22.5", "1.22.6", "1.22.7", "1.22.8", "1.22.9", "1.22.10", "1.22.11",
+		"1.23.0", "1.23.1", "1.23.2", "1.23.3", "1.23.4", "1.23.5", "1.23.6", "1.23.7", "1.23.8",
+		"1.24.0", "1.24.1", "1.24.2", "1.24.3", "1.24.4", "1.24.5", "1.24.6",
+		"1.25.0", "1.25.1", "1.25.2", "1.25.3", "1.25.4",
 	} {
 		cases[v] = testcase{expect: SupportedProxyFeatures{}}
 	}
diff --git a/envoyextensions/xdscommon/proxysupport.go b/envoyextensions/xdscommon/proxysupport.go
index 0777c919764a..c4a96e818154 100644
--- a/envoyextensions/xdscommon/proxysupport.go
+++ b/envoyextensions/xdscommon/proxysupport.go
@@ -12,10 +12,10 @@ import "strings"
 //
 // see: https://www.consul.io/docs/connect/proxies/envoy#supported-versions
 var EnvoyVersions = []string{
-	"1.25.1",
-	"1.24.2",
-	"1.23.4",
-	"1.22.5",
+	"1.25.4",
+	"1.24.6",
+	"1.23.8",
+	"1.22.11",
 }
 
 // UnsupportedEnvoyVersions lists any unsupported Envoy versions (mainly minor versions) that fall
diff --git a/website/content/docs/connect/proxies/envoy.mdx b/website/content/docs/connect/proxies/envoy.mdx
index ded6c3de58d0..15b7856a0826 100644
--- a/website/content/docs/connect/proxies/envoy.mdx
+++ b/website/content/docs/connect/proxies/envoy.mdx
@@ -39,13 +39,13 @@ Consul supports **four major Envoy releases** at the beginning of each major Con
 
 | Consul Version      | Compatible Envoy Versions                                                          |
 | ------------------- | -----------------------------------------------------------------------------------|
-| 1.15.x              | 1.25.1, 1.24.2, 1.23.4, 1.22.5                                                     |
+| 1.15.x              | 1.25.4, 1.24.6, 1.23.8, 1.22.11                                                     |
 | 1.14.x              | 1.24.0, 1.23.1, 1.22.5, 1.21.5                                                     |
 | 1.13.x              | 1.23.1, 1.22.5, 1.21.5, 1.20.7                                                     |
 
 ### Envoy and Consul Dataplane
 
-The Consul dataplane component was introduced in Consul v1.14 as a way to manage Envoy proxies without the use of Consul clients. Each new minor version of Consul is released with a new minor version of Consul dataplane, which packages both Envoy and the `consul-dataplane` binary in a single container image. For backwards compatability reasons, each new minor version of Consul will also support the previous minor version of Consul dataplane to allow for seamless upgrades. In addition, each minor version of Consul will support the next minor version of Consul dataplane to allow for extended dataplane support via newer versions of Envoy.  
+The Consul dataplane component was introduced in Consul v1.14 as a way to manage Envoy proxies without the use of Consul clients. Each new minor version of Consul is released with a new minor version of Consul dataplane, which packages both Envoy and the `consul-dataplane` binary in a single container image. For backwards compatability reasons, each new minor version of Consul will also support the previous minor version of Consul dataplane to allow for seamless upgrades. In addition, each minor version of Consul will support the next minor version of Consul dataplane to allow for extended dataplane support via newer versions of Envoy.
 
 | Consul Version      | Consul Dataplane Version (Bundled Envoy Version)  |
 | ------------------- | ------------------------------------------------- |
@@ -124,7 +124,7 @@ Connect to a local Consul client agent and run the [`consul connect envoy` comma
 
 If you experience issues when bootstrapping Envoy proxies from the CLI, use the
 `-enable-config-gen-logging` flag to enable debug message logging. These logs can
-help you troubleshoot issues that occur during the bootstrapping process. 
+help you troubleshoot issues that occur during the bootstrapping process.
 For more information about available flags and parameters, refer to the
 [`consul connect envoy CLI` reference](/consul/commands/connect/envoy).
 
@@ -336,7 +336,7 @@ defaults that are inherited by all services.
 
 - `local_idle_timeout_ms` - In milliseconds, the idle timeout for HTTP requests
   to the local application instance. Applies to HTTP based protocols only. If not
-  specified, inherits the Envoy default for route idle timeouts (15s). A value of 0 
+  specified, inherits the Envoy default for route idle timeouts (15s). A value of 0
   disables request timeouts.
 
 - `max_inbound_connections` - The maximum number of concurrent inbound connections