diff --git a/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.pb.go b/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.pb.go
index 5bbe1dfc2d..66d735378c 100755
--- a/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.pb.go
+++ b/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.pb.go
@@ -100,7 +100,9 @@ type PostgresProxy struct {
 	// Postgres filter is able to read Postgres payload in clear-text. It happens when
 	// a client established a clear-text connection to Envoy or when a client established
 	// SSL connection to Envoy and Postgres filter is configured to terminate SSL.
-	// Defaults to SSL_DISABLE.
+	// In order for upstream encryption to work, the corresponding cluster must be configured to use
+	// :ref:`starttls transport socket <envoy_v3_api_msg_extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig>`.
+	// Defaults to ``SSL_DISABLE``.
 	UpstreamSsl PostgresProxy_SSLMode `protobuf:"varint,4,opt,name=upstream_ssl,json=upstreamSsl,proto3,enum=envoy.extensions.filters.network.postgres_proxy.v3alpha.PostgresProxy_SSLMode" json:"upstream_ssl,omitempty"`
 }
 
diff --git a/envoy/COMMIT b/envoy/COMMIT
index 86b0e650a6..aa9477b924 100644
--- a/envoy/COMMIT
+++ b/envoy/COMMIT
@@ -1 +1 @@
-1fe0dd5b9e0d33e59917247552f918adc835e596
+59e0d299ee4715bde3d84171bfaeac5f478dd4b1