diff --git a/changelogs/unreleased/6846-rajatvig-small.md b/changelogs/unreleased/6846-rajatvig-small.md
new file mode 100644
index 00000000000..05bc7628eae
--- /dev/null
+++ b/changelogs/unreleased/6846-rajatvig-small.md
@@ -0,0 +1 @@
+Set `allow_connect` to true on `Http2ProtocolOptions` on the Listener when websockets are enabled.
diff --git a/internal/envoy/v3/listener.go b/internal/envoy/v3/listener.go
index 213a71af9bf..29dfaab9e08 100644
--- a/internal/envoy/v3/listener.go
+++ b/internal/envoy/v3/listener.go
@@ -556,10 +556,10 @@ func (b *httpConnectionManagerBuilder) Get() *envoy_config_listener_v3.Filter {
 		cm.CommonHttpProtocolOptions.MaxRequestsPerConnection = wrapperspb.UInt32(*b.maxRequestsPerConnection)
 	}
 
+	http2Options := &envoy_config_core_v3.Http2ProtocolOptions{}
+
 	if b.http2MaxConcurrentStreams != nil {
-		cm.Http2ProtocolOptions = &envoy_config_core_v3.Http2ProtocolOptions{
-			MaxConcurrentStreams: wrapperspb.UInt32(*b.http2MaxConcurrentStreams),
-		}
+		http2Options.MaxConcurrentStreams = wrapperspb.UInt32(*b.http2MaxConcurrentStreams)
 	}
 
 	if b.enableWebsockets {
@@ -568,6 +568,12 @@ func (b *httpConnectionManagerBuilder) Get() *envoy_config_listener_v3.Filter {
 				UpgradeType: "websocket",
 			},
 		)
+		http2Options.AllowConnect = true
+	}
+
+	// Assign http2Options only if it has been modified
+	if b.http2MaxConcurrentStreams != nil {
+		cm.Http2ProtocolOptions = http2Options
 	}
 
 	return &envoy_config_listener_v3.Filter{