diff --git a/source/common/tcp_proxy/tcp_proxy.cc b/source/common/tcp_proxy/tcp_proxy.cc
index 31efb90c282b..972772c59975 100644
--- a/source/common/tcp_proxy/tcp_proxy.cc
+++ b/source/common/tcp_proxy/tcp_proxy.cc
@@ -219,14 +219,12 @@ UpstreamDrainManager& Config::drainManager() {
   return upstream_drain_manager_slot_->getTyped<UpstreamDrainManager>();
 }
 
-Filter::Filter(ConfigSharedPtr config, Upstream::ClusterManager& cluster_manager)
+Filter::Filter(Config& config, Upstream::ClusterManager& cluster_manager)
     : config_(config), cluster_manager_(cluster_manager), downstream_callbacks_(*this),
-      upstream_callbacks_(new UpstreamCallbacks(this)) {
-  ASSERT(config != nullptr);
-}
+      upstream_callbacks_(new UpstreamCallbacks(this)) {}
 
 Filter::~Filter() {
-  for (const auto& access_log : config_->accessLogs()) {
+  for (const auto& access_log : config_.accessLogs()) {
     access_log->log(nullptr, nullptr, nullptr, getStreamInfo());
   }
 
@@ -254,13 +252,13 @@ void Filter::initialize(Network::ReadFilterCallbacks& callbacks, bool set_connec
   // established.
   read_callbacks_->connection().readDisable(true);
 
-  config_->stats().downstream_cx_total_.inc();
+  config_.stats().downstream_cx_total_.inc();
   if (set_connection_stats) {
     read_callbacks_->connection().setConnectionStats(
-        {config_->stats().downstream_cx_rx_bytes_total_,
-         config_->stats().downstream_cx_rx_bytes_buffered_,
-         config_->stats().downstream_cx_tx_bytes_total_,
-         config_->stats().downstream_cx_tx_bytes_buffered_, nullptr, nullptr});
+        {config_.stats().downstream_cx_rx_bytes_total_,
+         config_.stats().downstream_cx_rx_bytes_buffered_,
+         config_.stats().downstream_cx_tx_bytes_total_,
+         config_.stats().downstream_cx_tx_bytes_buffered_, nullptr, nullptr});
   }
 }
 
@@ -295,9 +293,9 @@ void Filter::readDisableDownstream(bool disable) {
   read_callbacks_->connection().readDisable(disable);
 
   if (disable) {
-    config_->stats().downstream_flow_control_paused_reading_total_.inc();
+    config_.stats().downstream_flow_control_paused_reading_total_.inc();
   } else {
-    config_->stats().downstream_flow_control_resumed_reading_total_.inc();
+    config_.stats().downstream_flow_control_resumed_reading_total_.inc();
   }
 }
 
@@ -395,7 +393,7 @@ Network::FilterStatus Filter::initializeUpstreamConnection() {
                    cluster_name);
   } else {
     ENVOY_CONN_LOG(debug, "Cluster not found {}", read_callbacks_->connection(), cluster_name);
-    config_->stats().downstream_cx_no_route_.inc();
+    config_.stats().downstream_cx_no_route_.inc();
     getStreamInfo().setResponseFlag(StreamInfo::ResponseFlag::NoRouteFound);
     onInitFailure(UpstreamFailureReason::NoRoute);
     return Network::FilterStatus::StopIteration;
@@ -413,7 +411,7 @@ Network::FilterStatus Filter::initializeUpstreamConnection() {
     return Network::FilterStatus::StopIteration;
   }
 
-  const uint32_t max_connect_attempts = config_->maxConnectAttempts();
+  const uint32_t max_connect_attempts = config_.maxConnectAttempts();
   if (connect_attempts_ >= max_connect_attempts) {
     getStreamInfo().setResponseFlag(StreamInfo::ResponseFlag::UpstreamRetryLimitExceeded);
     cluster->stats().upstream_cx_connect_attempts_exceeded_.inc();
@@ -461,7 +459,7 @@ bool Filter::maybeTunnel(Upstream::ThreadLocalCluster& cluster) {
     return false;
   }
 
-  generic_conn_pool_ = factory->createGenericConnPool(cluster, config_->tunnelingConfig(), this,
+  generic_conn_pool_ = factory->createGenericConnPool(cluster, config_.tunnelingConfig(), this,
                                                       *upstream_callbacks_);
   if (generic_conn_pool_) {
     connecting_ = true;
@@ -561,10 +559,10 @@ Network::FilterStatus Filter::onData(Buffer::Instance& data, bool end_stream) {
 }
 
 Network::FilterStatus Filter::onNewConnection() {
-  if (config_->maxDownstreamConnectionDuration()) {
+  if (config_.maxDownstreamConnectionDuration()) {
     connection_duration_timer_ = read_callbacks_->connection().dispatcher().createTimer(
         [this]() -> void { onMaxDownstreamConnectionDuration(); });
-    connection_duration_timer_->enableTimer(config_->maxDownstreamConnectionDuration().value());
+    connection_duration_timer_->enableTimer(config_.maxDownstreamConnectionDuration().value());
   }
   return initializeUpstreamConnection();
 }
@@ -574,9 +572,9 @@ void Filter::onDownstreamEvent(Network::ConnectionEvent event) {
     Tcp::ConnectionPool::ConnectionDataPtr conn_data(upstream_->onDownstreamEvent(event));
     if (conn_data != nullptr &&
         conn_data->connection().state() != Network::Connection::State::Closed) {
-      config_->drainManager().add(config_->sharedConfig(), std::move(conn_data),
-                                  std::move(upstream_callbacks_), std::move(idle_timer_),
-                                  read_callbacks_->upstreamHost());
+      config_.drainManager().add(config_.sharedConfig(), std::move(conn_data),
+                                 std::move(upstream_callbacks_), std::move(idle_timer_),
+                                 read_callbacks_->upstreamHost());
     }
     if (event != Network::ConnectionEvent::Connected) {
       upstream_.reset();
@@ -640,7 +638,7 @@ void Filter::onUpstreamConnection() {
   ENVOY_CONN_LOG(debug, "TCP:onUpstreamEvent(), requestedServerName: {}",
                  read_callbacks_->connection(), getStreamInfo().requestedServerName());
 
-  if (config_->idleTimeout()) {
+  if (config_.idleTimeout()) {
     // The idle_timer_ can be moved to a Drainer, so related callbacks call into
     // the UpstreamCallbacks, which has the same lifetime as the timer, and can dispatch
     // the call to either TcpProxy or to Drainer, depending on the current state.
@@ -662,7 +660,7 @@ void Filter::onUpstreamConnection() {
 
 void Filter::onIdleTimeout() {
   ENVOY_CONN_LOG(debug, "Session timed out", read_callbacks_->connection());
-  config_->stats().idle_timeout_.inc();
+  config_.stats().idle_timeout_.inc();
 
   // This results in also closing the upstream connection.
   read_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
@@ -671,14 +669,14 @@ void Filter::onIdleTimeout() {
 void Filter::onMaxDownstreamConnectionDuration() {
   ENVOY_CONN_LOG(debug, "max connection duration reached", read_callbacks_->connection());
   getStreamInfo().setResponseFlag(StreamInfo::ResponseFlag::DurationTimeout);
-  config_->stats().max_downstream_connection_duration_.inc();
+  config_.stats().max_downstream_connection_duration_.inc();
   read_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
 }
 
 void Filter::resetIdleTimer() {
   if (idle_timer_ != nullptr) {
-    ASSERT(config_->idleTimeout());
-    idle_timer_->enableTimer(config_->idleTimeout().value());
+    ASSERT(config_.idleTimeout());
+    idle_timer_->enableTimer(config_.idleTimeout().value());
   }
 }
 
diff --git a/source/common/tcp_proxy/tcp_proxy.h b/source/common/tcp_proxy/tcp_proxy.h
index 3ffa00e71a61..276ed306a9cc 100644
--- a/source/common/tcp_proxy/tcp_proxy.h
+++ b/source/common/tcp_proxy/tcp_proxy.h
@@ -245,7 +245,7 @@ class Filter : public Network::ReadFilter,
                protected Logger::Loggable<Logger::Id::filter>,
                public GenericConnectionPoolCallbacks {
 public:
-  Filter(ConfigSharedPtr config, Upstream::ClusterManager& cluster_manager);
+  Filter(Config& config, Upstream::ClusterManager& cluster_manager);
   ~Filter() override;
 
   // Network::ReadFilter
@@ -264,7 +264,7 @@ class Filter : public Network::ReadFilter,
   // Upstream::LoadBalancerContext
   const Router::MetadataMatchCriteria* metadataMatchCriteria() override;
   absl::optional<uint64_t> computeHashKey() override {
-    auto hash_policy = config_->hashPolicy();
+    auto hash_policy = config_.hashPolicy();
     if (hash_policy) {
       return hash_policy->generateHash(
           downstreamConnection()->addressProvider().remoteAddress().get(),
@@ -337,7 +337,7 @@ class Filter : public Network::ReadFilter,
 
   // Callbacks for different error and success states during connection establishment
   virtual RouteConstSharedPtr pickRoute() {
-    return config_->getRouteFromEntries(read_callbacks_->connection());
+    return config_.getRouteFromEntries(read_callbacks_->connection());
   }
 
   virtual void onInitFailure(UpstreamFailureReason) {
@@ -357,7 +357,7 @@ class Filter : public Network::ReadFilter,
   void disableIdleTimer();
   void onMaxDownstreamConnectionDuration();
 
-  const ConfigSharedPtr config_;
+  Config& config_;
   Upstream::ClusterManager& cluster_manager_;
   Network::ReadFilterCallbacks* read_callbacks_{};
 
diff --git a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc
index bceb77b412ae..b79113da9e1d 100644
--- a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc
+++ b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.cc
@@ -53,7 +53,7 @@ ClientSslAuthConfigSharedPtr ClientSslAuthConfig::create(
   return new_config;
 }
 
-const AllowedPrincipals& ClientSslAuthConfig::allowedPrincipals() {
+const AllowedPrincipals& ClientSslAuthConfig::allowedPrincipals() const {
   return tls_->getTyped<AllowedPrincipals>();
 }
 
@@ -98,7 +98,7 @@ Network::FilterStatus ClientSslAuthFilter::onNewConnection() {
   // If this is not an SSL connection, do no further checking. High layers should redirect, etc.
   // if SSL is required.
   if (!read_callbacks_->connection().ssl()) {
-    config_->stats().auth_no_ssl_.inc();
+    config_.stats().auth_no_ssl_.inc();
     return Network::FilterStatus::Continue;
   } else {
     // Otherwise we need to wait for handshake to be complete before proceeding.
@@ -112,21 +112,21 @@ void ClientSslAuthFilter::onEvent(Network::ConnectionEvent event) {
   }
 
   ASSERT(read_callbacks_->connection().ssl());
-  if (config_->ipAllowlist().contains(
+  if (config_.ipAllowlist().contains(
           *read_callbacks_->connection().addressProvider().remoteAddress())) {
-    config_->stats().auth_ip_allowlist_.inc();
+    config_.stats().auth_ip_allowlist_.inc();
     read_callbacks_->continueReading();
     return;
   }
 
-  if (!config_->allowedPrincipals().allowed(
+  if (!config_.allowedPrincipals().allowed(
           read_callbacks_->connection().ssl()->sha256PeerCertificateDigest())) {
-    config_->stats().auth_digest_no_match_.inc();
+    config_.stats().auth_digest_no_match_.inc();
     read_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
     return;
   }
 
-  config_->stats().auth_digest_match_.inc();
+  config_.stats().auth_digest_match_.inc();
   read_callbacks_->continueReading();
 }
 
diff --git a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
index 53422e5f48d8..7176313c8a7c 100644
--- a/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
+++ b/source/extensions/filters/network/client_ssl_auth/client_ssl_auth.h
@@ -80,8 +80,8 @@ class ClientSslAuthConfig : public Http::RestApiFetcher {
          ThreadLocal::SlotAllocator& tls, Upstream::ClusterManager& cm,
          Event::Dispatcher& dispatcher, Stats::Scope& scope, Random::RandomGenerator& random);
 
-  const AllowedPrincipals& allowedPrincipals();
-  const Network::Address::IpList& ipAllowlist() { return ip_allowlist_; }
+  const AllowedPrincipals& allowedPrincipals() const;
+  const Network::Address::IpList& ipAllowlist() const { return ip_allowlist_; }
   GlobalStats& stats() { return stats_; }
 
 private:
@@ -108,7 +108,7 @@ class ClientSslAuthConfig : public Http::RestApiFetcher {
  */
 class ClientSslAuthFilter : public Network::ReadFilter, public Network::ConnectionCallbacks {
 public:
-  ClientSslAuthFilter(ClientSslAuthConfigSharedPtr config) : config_(config) {}
+  ClientSslAuthFilter(ClientSslAuthConfig& config) : config_(config) {}
 
   // Network::ReadFilter
   Network::FilterStatus onData(Buffer::Instance& data, bool end_stream) override;
@@ -124,7 +124,7 @@ class ClientSslAuthFilter : public Network::ReadFilter, public Network::Connecti
   void onBelowWriteBufferLowWatermark() override {}
 
 private:
-  ClientSslAuthConfigSharedPtr config_;
+  ClientSslAuthConfig& config_;
   Network::ReadFilterCallbacks* read_callbacks_{};
 };
 
diff --git a/source/extensions/filters/network/client_ssl_auth/config.cc b/source/extensions/filters/network/client_ssl_auth/config.cc
index 23a5d8dfa6c2..8e3623cf6006 100644
--- a/source/extensions/filters/network/client_ssl_auth/config.cc
+++ b/source/extensions/filters/network/client_ssl_auth/config.cc
@@ -22,7 +22,7 @@ Network::FilterFactoryCb ClientSslAuthConfigFactory::createFilterFactoryFromProt
       proto_config, context.threadLocal(), context.clusterManager(), context.dispatcher(),
       context.scope(), context.api().randomGenerator()));
   return [filter_config](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addReadFilter(std::make_shared<ClientSslAuthFilter>(filter_config));
+    filter_manager.addReadFilter(std::make_shared<ClientSslAuthFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/network/ext_authz/config.cc b/source/extensions/filters/network/ext_authz/config.cc
index 65e852f6a181..27db59cd8d55 100644
--- a/source/extensions/filters/network/ext_authz/config.cc
+++ b/source/extensions/filters/network/ext_authz/config.cc
@@ -38,7 +38,7 @@ Network::FilterFactoryCb ExtAuthzConfigFactory::createFilterFactoryFromProtoType
         async_client_factory->create(), std::chrono::milliseconds(timeout_ms),
         transport_api_version);
     filter_manager.addReadFilter(Network::ReadFilterSharedPtr{
-        std::make_shared<Filter>(ext_authz_config, std::move(client))});
+        std::make_shared<Filter>(*ext_authz_config, std::move(client))});
   };
 }
 
diff --git a/source/extensions/filters/network/ext_authz/ext_authz.cc b/source/extensions/filters/network/ext_authz/ext_authz.cc
index f19cd3bb0eb9..f75193b2abf7 100644
--- a/source/extensions/filters/network/ext_authz/ext_authz.cc
+++ b/source/extensions/filters/network/ext_authz/ext_authz.cc
@@ -23,11 +23,11 @@ InstanceStats Config::generateStats(const std::string& name, Stats::Scope& scope
 
 void Filter::callCheck() {
   Filters::Common::ExtAuthz::CheckRequestUtils::createTcpCheck(filter_callbacks_, check_request_,
-                                                               config_->includePeerCertificate());
+                                                               config_.includePeerCertificate());
 
   status_ = Status::Calling;
-  config_->stats().active_.inc();
-  config_->stats().total_.inc();
+  config_.stats().active_.inc();
+  config_.stats().total_.inc();
 
   calling_check_ = true;
   client_->check(*this, check_request_, Tracing::NullSpan::instance(),
@@ -37,7 +37,7 @@ void Filter::callCheck() {
 
 Network::FilterStatus Filter::onData(Buffer::Instance&, bool /* end_stream */) {
   if (!filterEnabled(filter_callbacks_->connection().streamInfo().dynamicMetadata())) {
-    config_->stats().disabled_.inc();
+    config_.stats().disabled_.inc();
     return Network::FilterStatus::Continue;
   }
 
@@ -62,40 +62,40 @@ void Filter::onEvent(Network::ConnectionEvent event) {
       // Make sure that any pending request in the client is cancelled. This will be NOP if the
       // request already completed.
       client_->cancel();
-      config_->stats().active_.dec();
+      config_.stats().active_.dec();
     }
   }
 }
 
 void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
   status_ = Status::Complete;
-  config_->stats().active_.dec();
+  config_.stats().active_.dec();
 
   switch (response->status) {
   case Filters::Common::ExtAuthz::CheckStatus::OK:
-    config_->stats().ok_.inc();
+    config_.stats().ok_.inc();
     break;
   case Filters::Common::ExtAuthz::CheckStatus::Error:
-    config_->stats().error_.inc();
+    config_.stats().error_.inc();
     break;
   case Filters::Common::ExtAuthz::CheckStatus::Denied:
-    config_->stats().denied_.inc();
+    config_.stats().denied_.inc();
     break;
   }
 
   // Fail open only if configured to do so and if the check status was a error.
   if (response->status == Filters::Common::ExtAuthz::CheckStatus::Denied ||
       (response->status == Filters::Common::ExtAuthz::CheckStatus::Error &&
-       !config_->failureModeAllow())) {
-    config_->stats().cx_closed_.inc();
+       !config_.failureModeAllow())) {
+    config_.stats().cx_closed_.inc();
     filter_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
   } else {
     // Let the filter chain continue.
     filter_return_ = FilterReturn::Continue;
-    if (config_->failureModeAllow() &&
+    if (config_.failureModeAllow() &&
         response->status == Filters::Common::ExtAuthz::CheckStatus::Error) {
       // Status is Error and yet we are configured to allow traffic. Click a counter.
-      config_->stats().failure_mode_allowed_.inc();
+      config_.stats().failure_mode_allowed_.inc();
     }
 
     if (!response->dynamic_metadata.fields().empty()) {
diff --git a/source/extensions/filters/network/ext_authz/ext_authz.h b/source/extensions/filters/network/ext_authz/ext_authz.h
index 89aa7b36892d..05124acf77b3 100644
--- a/source/extensions/filters/network/ext_authz/ext_authz.h
+++ b/source/extensions/filters/network/ext_authz/ext_authz.h
@@ -87,7 +87,7 @@ class Filter : public Network::ReadFilter,
                public Network::ConnectionCallbacks,
                public Filters::Common::ExtAuthz::RequestCallbacks {
 public:
-  Filter(ConfigSharedPtr config, Filters::Common::ExtAuthz::ClientPtr&& client)
+  Filter(Config& config, Filters::Common::ExtAuthz::ClientPtr&& client)
       : config_(config), client_(std::move(client)) {}
   ~Filter() override = default;
 
@@ -119,10 +119,10 @@ class Filter : public Network::ReadFilter,
   void callCheck();
 
   bool filterEnabled(const envoy::config::core::v3::Metadata& metadata) {
-    return config_->filterEnabledMetadata(metadata);
+    return config_.filterEnabledMetadata(metadata);
   }
 
-  ConfigSharedPtr config_;
+  Config& config_;
   Filters::Common::ExtAuthz::ClientPtr client_;
   Network::ReadFilterCallbacks* filter_callbacks_{};
   Status status_{Status::NotStarted};
diff --git a/source/extensions/filters/network/local_ratelimit/config.cc b/source/extensions/filters/network/local_ratelimit/config.cc
index e8b7e05d3d68..65dbb7433089 100644
--- a/source/extensions/filters/network/local_ratelimit/config.cc
+++ b/source/extensions/filters/network/local_ratelimit/config.cc
@@ -16,7 +16,7 @@ Network::FilterFactoryCb LocalRateLimitConfigFactory::createFilterFactoryFromPro
   ConfigSharedPtr filter_config(
       new Config(proto_config, context.dispatcher(), context.scope(), context.runtime()));
   return [filter_config](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addReadFilter(std::make_shared<Filter>(filter_config));
+    filter_manager.addReadFilter(std::make_shared<Filter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc b/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc
index 287679763927..ea653b860e94 100644
--- a/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc
+++ b/source/extensions/filters/network/local_ratelimit/local_ratelimit.cc
@@ -32,13 +32,13 @@ LocalRateLimitStats Config::generateStats(const std::string& prefix, Stats::Scop
 bool Config::canCreateConnection() { return rate_limiter_.requestAllowed(descriptors_); }
 
 Network::FilterStatus Filter::onNewConnection() {
-  if (!config_->enabled()) {
+  if (!config_.enabled()) {
     ENVOY_CONN_LOG(trace, "local_rate_limit: runtime disabled", read_callbacks_->connection());
     return Network::FilterStatus::Continue;
   }
 
-  if (!config_->canCreateConnection()) {
-    config_->stats().rate_limited_.inc();
+  if (!config_.canCreateConnection()) {
+    config_.stats().rate_limited_.inc();
     ENVOY_CONN_LOG(trace, "local_rate_limit: rate limiting connection",
                    read_callbacks_->connection());
     read_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
diff --git a/source/extensions/filters/network/local_ratelimit/local_ratelimit.h b/source/extensions/filters/network/local_ratelimit/local_ratelimit.h
index f8ac07272459..196aa5e9af3d 100644
--- a/source/extensions/filters/network/local_ratelimit/local_ratelimit.h
+++ b/source/extensions/filters/network/local_ratelimit/local_ratelimit.h
@@ -60,7 +60,7 @@ using ConfigSharedPtr = std::shared_ptr<Config>;
  */
 class Filter : public Network::ReadFilter, Logger::Loggable<Logger::Id::filter> {
 public:
-  Filter(const ConfigSharedPtr& config) : config_(config) {}
+  Filter(Config& config) : config_(config) {}
 
   // Network::ReadFilter
   Network::FilterStatus onData(Buffer::Instance&, bool) override {
@@ -72,7 +72,7 @@ class Filter : public Network::ReadFilter, Logger::Loggable<Logger::Id::filter>
   }
 
 private:
-  const ConfigSharedPtr config_;
+  Config& config_;
   Network::ReadFilterCallbacks* read_callbacks_{};
 };
 
diff --git a/source/extensions/filters/network/mongo_proxy/config.cc b/source/extensions/filters/network/mongo_proxy/config.cc
index ecdc60644888..1875fd21f1b0 100644
--- a/source/extensions/filters/network/mongo_proxy/config.cc
+++ b/source/extensions/filters/network/mongo_proxy/config.cc
@@ -46,7 +46,7 @@ Network::FilterFactoryCb MongoProxyFilterConfigFactory::createFilterFactoryFromP
           stats](Network::FilterManager& filter_manager) -> void {
     filter_manager.addFilter(std::make_shared<ProdProxyFilter>(
         stat_prefix, context.scope(), context.runtime(), access_log, fault_config,
-        context.drainDecision(), context.dispatcher().timeSource(), emit_dynamic_metadata, stats));
+        context.drainDecision(), context.dispatcher().timeSource(), emit_dynamic_metadata, *stats));
   };
 }
 
diff --git a/source/extensions/filters/network/mongo_proxy/proxy.cc b/source/extensions/filters/network/mongo_proxy/proxy.cc
index 789d6e8df91d..6af65019137c 100644
--- a/source/extensions/filters/network/mongo_proxy/proxy.cc
+++ b/source/extensions/filters/network/mongo_proxy/proxy.cc
@@ -58,7 +58,7 @@ ProxyFilter::ProxyFilter(const std::string& stat_prefix, Stats::Scope& scope,
                          Runtime::Loader& runtime, AccessLogSharedPtr access_log,
                          const Filters::Common::Fault::FaultDelayConfigSharedPtr& fault_config,
                          const Network::DrainDecision& drain_decision, TimeSource& time_source,
-                         bool emit_dynamic_metadata, const MongoStatsSharedPtr& mongo_stats)
+                         bool emit_dynamic_metadata, MongoStats& mongo_stats)
     : stats_(generateStats(stat_prefix, scope)), runtime_(runtime), drain_decision_(drain_decision),
       access_log_(access_log), fault_config_(fault_config), time_source_(time_source),
       emit_dynamic_metadata_(emit_dynamic_metadata), mongo_stats_(mongo_stats) {
@@ -144,22 +144,22 @@ void ProxyFilter::decodeQuery(QueryMessagePtr&& message) {
   ActiveQueryPtr active_query(new ActiveQuery(*this, *message));
   if (!active_query->query_info_.command().empty()) {
     // First field key is the operation.
-    mongo_stats_->incCounter({mongo_stats_->cmd_,
-                              mongo_stats_->getBuiltin(active_query->query_info_.command(),
-                                                       mongo_stats_->unknown_command_),
-                              mongo_stats_->total_});
+    mongo_stats_.incCounter({mongo_stats_.cmd_,
+                             mongo_stats_.getBuiltin(active_query->query_info_.command(),
+                                                     mongo_stats_.unknown_command_),
+                             mongo_stats_.total_});
   } else {
     // Normal query, get stats on a per collection basis first.
     QueryMessageInfo::QueryType query_type = active_query->query_info_.type();
     Stats::ElementVec names;
     names.reserve(6); // 2 entries are added by chargeQueryStats().
-    names.push_back(mongo_stats_->collection_);
+    names.push_back(mongo_stats_.collection_);
     names.push_back(Stats::DynamicName(active_query->query_info_.collection()));
     chargeQueryStats(names, query_type);
 
     // Callsite stats if we have it.
     if (!active_query->query_info_.callsite().empty()) {
-      names.push_back(mongo_stats_->callsite_);
+      names.push_back(mongo_stats_.callsite_);
       names.push_back(Stats::DynamicName(active_query->query_info_.callsite()));
       chargeQueryStats(names, query_type);
     }
@@ -185,17 +185,17 @@ void ProxyFilter::chargeQueryStats(Stats::ElementVec& names,
   // state it had on entry. Both of these variations by appending {"query", "total"}.
   size_t orig_size = names.size();
   ASSERT(names.capacity() - orig_size >= 2); // Ensures the caller has reserved() enough memory.
-  names.push_back(mongo_stats_->query_);
-  names.push_back(mongo_stats_->total_);
-  mongo_stats_->incCounter(names);
+  names.push_back(mongo_stats_.query_);
+  names.push_back(mongo_stats_.total_);
+  mongo_stats_.incCounter(names);
 
   // And now replace "total" with either "scatter_get" or "multi_get" if depending on query_type.
   if (query_type == QueryMessageInfo::QueryType::ScatterGet) {
-    names.back() = mongo_stats_->scatter_get_;
-    mongo_stats_->incCounter(names);
+    names.back() = mongo_stats_.scatter_get_;
+    mongo_stats_.incCounter(names);
   } else if (query_type == QueryMessageInfo::QueryType::MultiGet) {
-    names.back() = mongo_stats_->multi_get_;
-    mongo_stats_->incCounter(names);
+    names.back() = mongo_stats_.multi_get_;
+    mongo_stats_.incCounter(names);
   }
   names.resize(orig_size);
 }
@@ -222,15 +222,15 @@ void ProxyFilter::decodeReply(ReplyMessagePtr&& message) {
     }
 
     if (!active_query.query_info_.command().empty()) {
-      Stats::ElementVec names{mongo_stats_->cmd_,
-                              mongo_stats_->getBuiltin(active_query.query_info_.command(),
-                                                       mongo_stats_->unknown_command_)};
+      Stats::ElementVec names{mongo_stats_.cmd_,
+                              mongo_stats_.getBuiltin(active_query.query_info_.command(),
+                                                      mongo_stats_.unknown_command_)};
       chargeReplyStats(active_query, names, *message);
     } else {
       // Collection stats first.
-      Stats::ElementVec names{mongo_stats_->collection_,
+      Stats::ElementVec names{mongo_stats_.collection_,
                               Stats::DynamicName(active_query.query_info_.collection()),
-                              mongo_stats_->query_};
+                              mongo_stats_.query_};
       chargeReplyStats(active_query, names, *message);
 
       // Callsite stats if we have it.
@@ -238,9 +238,9 @@ void ProxyFilter::decodeReply(ReplyMessagePtr&& message) {
         // Currently, names == {"collection", collection, "query"} and we are going
         // to mutate the array to {"collection", collection, "callsite", callsite, "query"}.
         ASSERT(names.size() == 3);
-        names.back() = mongo_stats_->callsite_; // Replaces "query".
+        names.back() = mongo_stats_.callsite_; // Replaces "query".
         names.push_back(Stats::DynamicName(active_query.query_info_.callsite()));
-        names.push_back(mongo_stats_->query_);
+        names.push_back(mongo_stats_.query_);
         chargeReplyStats(active_query, names, *message);
       }
     }
@@ -300,16 +300,16 @@ void ProxyFilter::chargeReplyStats(ActiveQuery& active_query, Stats::ElementVec&
   // that was passed in. Here we overwrite the passed-in names, but we restore
   // names to its original state upon return.
   const size_t orig_size = names.size();
-  names.push_back(mongo_stats_->reply_num_docs_);
-  mongo_stats_->recordHistogram(names, Stats::Histogram::Unit::Unspecified,
-                                message.documents().size());
-  names[orig_size] = mongo_stats_->reply_size_;
-  mongo_stats_->recordHistogram(names, Stats::Histogram::Unit::Bytes, reply_documents_byte_size);
-  names[orig_size] = mongo_stats_->reply_time_ms_;
-  mongo_stats_->recordHistogram(names, Stats::Histogram::Unit::Milliseconds,
-                                std::chrono::duration_cast<std::chrono::milliseconds>(
-                                    time_source_.monotonicTime() - active_query.start_time_)
-                                    .count());
+  names.push_back(mongo_stats_.reply_num_docs_);
+  mongo_stats_.recordHistogram(names, Stats::Histogram::Unit::Unspecified,
+                               message.documents().size());
+  names[orig_size] = mongo_stats_.reply_size_;
+  mongo_stats_.recordHistogram(names, Stats::Histogram::Unit::Bytes, reply_documents_byte_size);
+  names[orig_size] = mongo_stats_.reply_time_ms_;
+  mongo_stats_.recordHistogram(names, Stats::Histogram::Unit::Milliseconds,
+                               std::chrono::duration_cast<std::chrono::milliseconds>(
+                                   time_source_.monotonicTime() - active_query.start_time_)
+                                   .count());
   names.resize(orig_size);
 }
 
diff --git a/source/extensions/filters/network/mongo_proxy/proxy.h b/source/extensions/filters/network/mongo_proxy/proxy.h
index 773d4714aa7f..75686d0a9cf7 100644
--- a/source/extensions/filters/network/mongo_proxy/proxy.h
+++ b/source/extensions/filters/network/mongo_proxy/proxy.h
@@ -110,7 +110,7 @@ class ProxyFilter : public Network::Filter,
               AccessLogSharedPtr access_log,
               const Filters::Common::Fault::FaultDelayConfigSharedPtr& fault_config,
               const Network::DrainDecision& drain_decision, TimeSource& time_system,
-              bool emit_dynamic_metadata, const MongoStatsSharedPtr& stats);
+              bool emit_dynamic_metadata, MongoStats& stats);
   ~ProxyFilter() override;
 
   virtual DecoderPtr createDecoder(DecoderCallbacks& callbacks) PURE;
@@ -197,7 +197,7 @@ class ProxyFilter : public Network::Filter,
   Event::TimerPtr drain_close_timer_;
   TimeSource& time_source_;
   const bool emit_dynamic_metadata_;
-  MongoStatsSharedPtr mongo_stats_;
+  MongoStats& mongo_stats_;
 };
 
 class ProdProxyFilter : public ProxyFilter {
diff --git a/source/extensions/filters/network/mysql_proxy/mysql_config.cc b/source/extensions/filters/network/mysql_proxy/mysql_config.cc
index f2c536e9fd64..0baae8635087 100644
--- a/source/extensions/filters/network/mysql_proxy/mysql_config.cc
+++ b/source/extensions/filters/network/mysql_proxy/mysql_config.cc
@@ -31,7 +31,7 @@ NetworkFilters::MySQLProxy::MySQLConfigFactory::createFilterFactoryFromProtoType
   MySQLFilterConfigSharedPtr filter_config(
       std::make_shared<MySQLFilterConfig>(stat_prefix, context.scope()));
   return [filter_config](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addFilter(std::make_shared<MySQLFilter>(filter_config));
+    filter_manager.addFilter(std::make_shared<MySQLFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/network/mysql_proxy/mysql_filter.cc b/source/extensions/filters/network/mysql_proxy/mysql_filter.cc
index d3fa62e55fc8..885470088a5a 100644
--- a/source/extensions/filters/network/mysql_proxy/mysql_filter.cc
+++ b/source/extensions/filters/network/mysql_proxy/mysql_filter.cc
@@ -16,7 +16,7 @@ namespace MySQLProxy {
 MySQLFilterConfig::MySQLFilterConfig(const std::string& stat_prefix, Stats::Scope& scope)
     : scope_(scope), stats_(generateStats(stat_prefix, scope)) {}
 
-MySQLFilter::MySQLFilter(MySQLFilterConfigSharedPtr config) : config_(std::move(config)) {}
+MySQLFilter::MySQLFilter(MySQLFilterConfig& config) : config_(config) {}
 
 void MySQLFilter::initializeReadFilterCallbacks(Network::ReadFilterCallbacks& callbacks) {
   read_callbacks_ = &callbacks;
@@ -58,7 +58,7 @@ void MySQLFilter::doDecode(Buffer::Instance& buffer) {
     decoder_->onData(buffer);
   } catch (EnvoyException& e) {
     ENVOY_LOG(info, "mysql_proxy: decoding error: {}", e.what());
-    config_->stats_.decoder_errors_.inc();
+    config_.stats_.decoder_errors_.inc();
     sniffing_ = false;
     read_buffer_.drain(read_buffer_.length());
     write_buffer_.drain(write_buffer_.length());
@@ -69,31 +69,31 @@ DecoderPtr MySQLFilter::createDecoder(DecoderCallbacks& callbacks) {
   return std::make_unique<DecoderImpl>(callbacks);
 }
 
-void MySQLFilter::onProtocolError() { config_->stats_.protocol_errors_.inc(); }
+void MySQLFilter::onProtocolError() { config_.stats_.protocol_errors_.inc(); }
 
 void MySQLFilter::onNewMessage(MySQLSession::State state) {
   if (state == MySQLSession::State::ChallengeReq) {
-    config_->stats_.login_attempts_.inc();
+    config_.stats_.login_attempts_.inc();
   }
 }
 
 void MySQLFilter::onClientLogin(ClientLogin& client_login) {
   if (client_login.isSSLRequest()) {
-    config_->stats_.upgraded_to_ssl_.inc();
+    config_.stats_.upgraded_to_ssl_.inc();
   }
 }
 
 void MySQLFilter::onClientLoginResponse(ClientLoginResponse& client_login_resp) {
   if (client_login_resp.getRespCode() == MYSQL_RESP_AUTH_SWITCH) {
-    config_->stats_.auth_switch_request_.inc();
+    config_.stats_.auth_switch_request_.inc();
   } else if (client_login_resp.getRespCode() == MYSQL_RESP_ERR) {
-    config_->stats_.login_failures_.inc();
+    config_.stats_.login_failures_.inc();
   }
 }
 
 void MySQLFilter::onMoreClientLoginResponse(ClientLoginResponse& client_login_resp) {
   if (client_login_resp.getRespCode() == MYSQL_RESP_ERR) {
-    config_->stats_.login_failures_.inc();
+    config_.stats_.login_failures_.inc();
   }
 }
 
@@ -115,17 +115,17 @@ void MySQLFilter::onCommand(Command& command) {
                  command.getData());
 
   if (!result) {
-    config_->stats_.queries_parse_error_.inc();
+    config_.stats_.queries_parse_error_.inc();
     return;
   }
-  config_->stats_.queries_parsed_.inc();
+  config_.stats_.queries_parsed_.inc();
 
   read_callbacks_->connection().streamInfo().setDynamicMetadata(
       NetworkFilterNames::get().MySQLProxy, metadata);
 }
 
 Network::FilterStatus MySQLFilter::onNewConnection() {
-  config_->stats_.sessions_.inc();
+  config_.stats_.sessions_.inc();
   return Network::FilterStatus::Continue;
 }
 
diff --git a/source/extensions/filters/network/mysql_proxy/mysql_filter.h b/source/extensions/filters/network/mysql_proxy/mysql_filter.h
index daabb165dde6..6ddfc91e9fc1 100644
--- a/source/extensions/filters/network/mysql_proxy/mysql_filter.h
+++ b/source/extensions/filters/network/mysql_proxy/mysql_filter.h
@@ -69,7 +69,7 @@ using MySQLFilterConfigSharedPtr = std::shared_ptr<MySQLFilterConfig>;
  */
 class MySQLFilter : public Network::Filter, DecoderCallbacks, Logger::Loggable<Logger::Id::filter> {
 public:
-  MySQLFilter(MySQLFilterConfigSharedPtr config);
+  MySQLFilter(MySQLFilterConfig& config);
   ~MySQLFilter() override = default;
 
   // Network::ReadFilter
@@ -97,7 +97,7 @@ class MySQLFilter : public Network::Filter, DecoderCallbacks, Logger::Loggable<L
 
 private:
   Network::ReadFilterCallbacks* read_callbacks_{};
-  MySQLFilterConfigSharedPtr config_;
+  MySQLFilterConfig& config_;
   Buffer::OwnedImpl read_buffer_;
   Buffer::OwnedImpl write_buffer_;
   std::unique_ptr<Decoder> decoder_;
diff --git a/source/extensions/filters/network/postgres_proxy/config.cc b/source/extensions/filters/network/postgres_proxy/config.cc
index 14180bc201b1..30af2c916407 100644
--- a/source/extensions/filters/network/postgres_proxy/config.cc
+++ b/source/extensions/filters/network/postgres_proxy/config.cc
@@ -20,7 +20,7 @@ NetworkFilters::PostgresProxy::PostgresConfigFactory::createFilterFactoryFromPro
   PostgresFilterConfigSharedPtr filter_config(
       std::make_shared<PostgresFilterConfig>(stat_prefix, enable_sql, context.scope()));
   return [filter_config](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addFilter(std::make_shared<PostgresFilter>(filter_config));
+    filter_manager.addFilter(std::make_shared<PostgresFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/network/postgres_proxy/postgres_filter.cc b/source/extensions/filters/network/postgres_proxy/postgres_filter.cc
index bc20b37ba338..07f29651bdee 100644
--- a/source/extensions/filters/network/postgres_proxy/postgres_filter.cc
+++ b/source/extensions/filters/network/postgres_proxy/postgres_filter.cc
@@ -16,7 +16,7 @@ PostgresFilterConfig::PostgresFilterConfig(const std::string& stat_prefix, bool
     : enable_sql_parsing_(enable_sql_parsing), scope_{scope}, stats_{generateStats(stat_prefix,
                                                                                    scope)} {}
 
-PostgresFilter::PostgresFilter(PostgresFilterConfigSharedPtr config) : config_{config} {
+PostgresFilter::PostgresFilter(PostgresFilterConfig& config) : config_{config} {
   if (!decoder_) {
     decoder_ = createDecoder(this);
   }
@@ -55,108 +55,108 @@ DecoderPtr PostgresFilter::createDecoder(DecoderCallbacks* callbacks) {
 }
 
 void PostgresFilter::incMessagesBackend() {
-  config_->stats_.messages_.inc();
-  config_->stats_.messages_backend_.inc();
+  config_.stats_.messages_.inc();
+  config_.stats_.messages_backend_.inc();
 }
 
 void PostgresFilter::incMessagesFrontend() {
-  config_->stats_.messages_.inc();
-  config_->stats_.messages_frontend_.inc();
+  config_.stats_.messages_.inc();
+  config_.stats_.messages_frontend_.inc();
 }
 
 void PostgresFilter::incMessagesUnknown() {
-  config_->stats_.messages_.inc();
-  config_->stats_.messages_unknown_.inc();
+  config_.stats_.messages_.inc();
+  config_.stats_.messages_unknown_.inc();
 }
 
 void PostgresFilter::incSessionsEncrypted() {
-  config_->stats_.sessions_.inc();
-  config_->stats_.sessions_encrypted_.inc();
+  config_.stats_.sessions_.inc();
+  config_.stats_.sessions_encrypted_.inc();
 }
 
 void PostgresFilter::incSessionsUnencrypted() {
-  config_->stats_.sessions_.inc();
-  config_->stats_.sessions_unencrypted_.inc();
+  config_.stats_.sessions_.inc();
+  config_.stats_.sessions_unencrypted_.inc();
 }
 
 void PostgresFilter::incTransactions() {
   if (!decoder_->getSession().inTransaction()) {
-    config_->stats_.transactions_.inc();
+    config_.stats_.transactions_.inc();
   }
 }
 
 void PostgresFilter::incTransactionsCommit() {
   if (!decoder_->getSession().inTransaction()) {
-    config_->stats_.transactions_commit_.inc();
+    config_.stats_.transactions_commit_.inc();
   }
 }
 
 void PostgresFilter::incTransactionsRollback() {
   if (decoder_->getSession().inTransaction()) {
-    config_->stats_.transactions_rollback_.inc();
+    config_.stats_.transactions_rollback_.inc();
   }
 }
 
 void PostgresFilter::incNotices(NoticeType type) {
-  config_->stats_.notices_.inc();
+  config_.stats_.notices_.inc();
   switch (type) {
   case DecoderCallbacks::NoticeType::Warning:
-    config_->stats_.notices_warning_.inc();
+    config_.stats_.notices_warning_.inc();
     break;
   case DecoderCallbacks::NoticeType::Notice:
-    config_->stats_.notices_notice_.inc();
+    config_.stats_.notices_notice_.inc();
     break;
   case DecoderCallbacks::NoticeType::Debug:
-    config_->stats_.notices_debug_.inc();
+    config_.stats_.notices_debug_.inc();
     break;
   case DecoderCallbacks::NoticeType::Info:
-    config_->stats_.notices_info_.inc();
+    config_.stats_.notices_info_.inc();
     break;
   case DecoderCallbacks::NoticeType::Log:
-    config_->stats_.notices_log_.inc();
+    config_.stats_.notices_log_.inc();
     break;
   case DecoderCallbacks::NoticeType::Unknown:
-    config_->stats_.notices_unknown_.inc();
+    config_.stats_.notices_unknown_.inc();
     break;
   }
 }
 
 void PostgresFilter::incErrors(ErrorType type) {
-  config_->stats_.errors_.inc();
+  config_.stats_.errors_.inc();
   switch (type) {
   case DecoderCallbacks::ErrorType::Error:
-    config_->stats_.errors_error_.inc();
+    config_.stats_.errors_error_.inc();
     break;
   case DecoderCallbacks::ErrorType::Fatal:
-    config_->stats_.errors_fatal_.inc();
+    config_.stats_.errors_fatal_.inc();
     break;
   case DecoderCallbacks::ErrorType::Panic:
-    config_->stats_.errors_panic_.inc();
+    config_.stats_.errors_panic_.inc();
     break;
   case DecoderCallbacks::ErrorType::Unknown:
-    config_->stats_.errors_unknown_.inc();
+    config_.stats_.errors_unknown_.inc();
     break;
   }
 }
 
 void PostgresFilter::incStatements(StatementType type) {
-  config_->stats_.statements_.inc();
+  config_.stats_.statements_.inc();
 
   switch (type) {
   case DecoderCallbacks::StatementType::Insert:
-    config_->stats_.statements_insert_.inc();
+    config_.stats_.statements_insert_.inc();
     break;
   case DecoderCallbacks::StatementType::Delete:
-    config_->stats_.statements_delete_.inc();
+    config_.stats_.statements_delete_.inc();
     break;
   case DecoderCallbacks::StatementType::Select:
-    config_->stats_.statements_select_.inc();
+    config_.stats_.statements_select_.inc();
     break;
   case DecoderCallbacks::StatementType::Update:
-    config_->stats_.statements_update_.inc();
+    config_.stats_.statements_update_.inc();
     break;
   case DecoderCallbacks::StatementType::Other:
-    config_->stats_.statements_other_.inc();
+    config_.stats_.statements_other_.inc();
     break;
   case DecoderCallbacks::StatementType::Noop:
     break;
@@ -164,19 +164,19 @@ void PostgresFilter::incStatements(StatementType type) {
 }
 
 void PostgresFilter::processQuery(const std::string& sql) {
-  if (config_->enable_sql_parsing_) {
+  if (config_.enable_sql_parsing_) {
     ProtobufWkt::Struct metadata;
 
     auto result = Common::SQLUtils::SQLUtils::setMetadata(sql, decoder_->getAttributes(), metadata);
 
     if (!result) {
-      config_->stats_.statements_parse_error_.inc();
+      config_.stats_.statements_parse_error_.inc();
       ENVOY_CONN_LOG(trace, "postgres_proxy: cannot parse SQL: {}", read_callbacks_->connection(),
                      sql.c_str());
       return;
     }
 
-    config_->stats_.statements_parsed_.inc();
+    config_.stats_.statements_parsed_.inc();
     ENVOY_CONN_LOG(trace, "postgres_proxy: query processed {}", read_callbacks_->connection(),
                    sql.c_str());
 
diff --git a/source/extensions/filters/network/postgres_proxy/postgres_filter.h b/source/extensions/filters/network/postgres_proxy/postgres_filter.h
index f3ef83a6abce..531e66e709e2 100644
--- a/source/extensions/filters/network/postgres_proxy/postgres_filter.h
+++ b/source/extensions/filters/network/postgres_proxy/postgres_filter.h
@@ -81,7 +81,7 @@ class PostgresFilter : public Network::Filter,
                        DecoderCallbacks,
                        Logger::Loggable<Logger::Id::filter> {
 public:
-  PostgresFilter(PostgresFilterConfigSharedPtr config);
+  PostgresFilter(PostgresFilterConfig& config);
   ~PostgresFilter() override = default;
 
   // Network::ReadFilter
@@ -114,13 +114,13 @@ class PostgresFilter : public Network::Filter,
   // Routines used during integration and unit tests
   uint32_t getFrontendBufLength() const { return frontend_buffer_.length(); }
   uint32_t getBackendBufLength() const { return backend_buffer_.length(); }
-  const PostgresProxyStats& getStats() const { return config_->stats_; }
+  const PostgresProxyStats& getStats() const { return config_.stats_; }
   Network::Connection& connection() const { return read_callbacks_->connection(); }
-  const PostgresFilterConfigSharedPtr& getConfig() const { return config_; }
+  PostgresFilterConfig& getConfig() const { return config_; }
 
 private:
   Network::ReadFilterCallbacks* read_callbacks_{};
-  PostgresFilterConfigSharedPtr config_;
+  PostgresFilterConfig& config_;
   Buffer::OwnedImpl frontend_buffer_;
   Buffer::OwnedImpl backend_buffer_;
   std::unique_ptr<Decoder> decoder_;
diff --git a/source/extensions/filters/network/ratelimit/config.cc b/source/extensions/filters/network/ratelimit/config.cc
index b60bd47e54d9..01b533c614aa 100644
--- a/source/extensions/filters/network/ratelimit/config.cc
+++ b/source/extensions/filters/network/ratelimit/config.cc
@@ -33,10 +33,10 @@ Network::FilterFactoryCb RateLimitConfigFactory::createFilterFactoryFromProtoTyp
   return [proto_config, &context, timeout,
           filter_config](Network::FilterManager& filter_manager) -> void {
     filter_manager.addReadFilter(std::make_shared<Filter>(
-        filter_config, Filters::Common::RateLimit::rateLimitClient(
-                           context, proto_config.rate_limit_service().grpc_service(), timeout,
-                           Envoy::Config::Utility::getAndCheckTransportVersion(
-                               proto_config.rate_limit_service()))));
+        *filter_config, Filters::Common::RateLimit::rateLimitClient(
+                            context, proto_config.rate_limit_service().grpc_service(), timeout,
+                            Envoy::Config::Utility::getAndCheckTransportVersion(
+                                proto_config.rate_limit_service()))));
   };
 }
 
diff --git a/source/extensions/filters/network/ratelimit/ratelimit.cc b/source/extensions/filters/network/ratelimit/ratelimit.cc
index 1ac7accd7d11..0f95016132db 100644
--- a/source/extensions/filters/network/ratelimit/ratelimit.cc
+++ b/source/extensions/filters/network/ratelimit/ratelimit.cc
@@ -42,16 +42,16 @@ Network::FilterStatus Filter::onData(Buffer::Instance&, bool) {
 
 Network::FilterStatus Filter::onNewConnection() {
   if (status_ == Status::NotStarted &&
-      !config_->runtime().snapshot().featureEnabled("ratelimit.tcp_filter_enabled", 100)) {
+      !config_.runtime().snapshot().featureEnabled("ratelimit.tcp_filter_enabled", 100)) {
     status_ = Status::Complete;
   }
 
   if (status_ == Status::NotStarted) {
     status_ = Status::Calling;
-    config_->stats().active_.inc();
-    config_->stats().total_.inc();
+    config_.stats().active_.inc();
+    config_.stats().total_.inc();
     calling_limit_ = true;
-    client_->limit(*this, config_->domain(), config_->descriptors(), Tracing::NullSpan::instance(),
+    client_->limit(*this, config_.domain(), config_.descriptors(), Tracing::NullSpan::instance(),
                    filter_callbacks_->connection().streamInfo());
     calling_limit_ = false;
   }
@@ -67,7 +67,7 @@ void Filter::onEvent(Network::ConnectionEvent event) {
       event == Network::ConnectionEvent::LocalClose) {
     if (status_ == Status::Calling) {
       client_->cancel();
-      config_->stats().active_.dec();
+      config_.stats().active_.dec();
     }
   }
 }
@@ -82,32 +82,32 @@ void Filter::complete(Filters::Common::RateLimit::LimitStatus status,
   }
 
   status_ = Status::Complete;
-  config_->stats().active_.dec();
+  config_.stats().active_.dec();
 
   switch (status) {
   case Filters::Common::RateLimit::LimitStatus::OK:
-    config_->stats().ok_.inc();
+    config_.stats().ok_.inc();
     break;
   case Filters::Common::RateLimit::LimitStatus::Error:
-    config_->stats().error_.inc();
+    config_.stats().error_.inc();
     break;
   case Filters::Common::RateLimit::LimitStatus::OverLimit:
-    config_->stats().over_limit_.inc();
+    config_.stats().over_limit_.inc();
     break;
   }
 
   if (status == Filters::Common::RateLimit::LimitStatus::OverLimit &&
-      config_->runtime().snapshot().featureEnabled("ratelimit.tcp_filter_enforcing", 100)) {
-    config_->stats().cx_closed_.inc();
+      config_.runtime().snapshot().featureEnabled("ratelimit.tcp_filter_enforcing", 100)) {
+    config_.stats().cx_closed_.inc();
     filter_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
   } else if (status == Filters::Common::RateLimit::LimitStatus::Error) {
-    if (config_->failureModeAllow()) {
-      config_->stats().failure_mode_allowed_.inc();
+    if (config_.failureModeAllow()) {
+      config_.stats().failure_mode_allowed_.inc();
       if (!calling_limit_) {
         filter_callbacks_->continueReading();
       }
     } else {
-      config_->stats().cx_closed_.inc();
+      config_.stats().cx_closed_.inc();
       filter_callbacks_->connection().close(Network::ConnectionCloseType::NoFlush);
     }
   } else {
diff --git a/source/extensions/filters/network/ratelimit/ratelimit.h b/source/extensions/filters/network/ratelimit/ratelimit.h
index 168be8008ff5..071594a43565 100644
--- a/source/extensions/filters/network/ratelimit/ratelimit.h
+++ b/source/extensions/filters/network/ratelimit/ratelimit.h
@@ -74,7 +74,7 @@ class Filter : public Network::ReadFilter,
                public Network::ConnectionCallbacks,
                public Filters::Common::RateLimit::RequestCallbacks {
 public:
-  Filter(ConfigSharedPtr config, Filters::Common::RateLimit::ClientPtr&& client)
+  Filter(Config& config, Filters::Common::RateLimit::ClientPtr&& client)
       : config_(config), client_(std::move(client)) {}
 
   // Network::ReadFilter
@@ -101,7 +101,7 @@ class Filter : public Network::ReadFilter,
 private:
   enum class Status { NotStarted, Calling, Complete };
 
-  ConfigSharedPtr config_;
+  Config& config_;
   Filters::Common::RateLimit::ClientPtr client_;
   Network::ReadFilterCallbacks* filter_callbacks_{};
   Status status_{Status::NotStarted};
diff --git a/source/extensions/filters/network/rbac/config.cc b/source/extensions/filters/network/rbac/config.cc
index f50e490ba378..f09011c453b9 100644
--- a/source/extensions/filters/network/rbac/config.cc
+++ b/source/extensions/filters/network/rbac/config.cc
@@ -81,7 +81,7 @@ RoleBasedAccessControlNetworkFilterConfigFactory::createFilterFactoryFromProtoTy
   RoleBasedAccessControlFilterConfigSharedPtr config(
       std::make_shared<RoleBasedAccessControlFilterConfig>(proto_config, context.scope()));
   return [config](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addReadFilter(std::make_shared<RoleBasedAccessControlFilter>(config));
+    filter_manager.addReadFilter(std::make_shared<RoleBasedAccessControlFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/network/rbac/rbac_filter.cc b/source/extensions/filters/network/rbac/rbac_filter.cc
index ec810a69e0e2..e66941cba079 100644
--- a/source/extensions/filters/network/rbac/rbac_filter.cc
+++ b/source/extensions/filters/network/rbac/rbac_filter.cc
@@ -47,7 +47,7 @@ Network::FilterStatus RoleBasedAccessControlFilter::onData(Buffer::Instance&, bo
   std::string log_policy_id = "none";
   // When the enforcement type is continuous always do the RBAC checks. If it is a one time check,
   // run the check once and skip it for subsequent onData calls.
-  if (config_->enforcementType() ==
+  if (config_.enforcementType() ==
       envoy::extensions::filters::network::rbac::v3::RBAC::CONTINUOUS) {
     shadow_engine_result_ =
         checkEngine(Filters::Common::RBAC::EnforcementMode::Shadow).engine_result_;
@@ -95,7 +95,7 @@ void RoleBasedAccessControlFilter::setDynamicMetadata(std::string shadow_engine_
 }
 
 Result RoleBasedAccessControlFilter::checkEngine(Filters::Common::RBAC::EnforcementMode mode) {
-  const auto engine = config_->engine(mode);
+  const auto engine = config_.engine(mode);
   std::string effective_policy_id;
   if (engine != nullptr) {
     // Check authorization decision and do Action operations
@@ -105,25 +105,25 @@ Result RoleBasedAccessControlFilter::checkEngine(Filters::Common::RBAC::Enforcem
     if (allowed) {
       if (mode == Filters::Common::RBAC::EnforcementMode::Shadow) {
         ENVOY_LOG(debug, "shadow allowed, matched policy {}", log_policy_id);
-        config_->stats().shadow_allowed_.inc();
+        config_.stats().shadow_allowed_.inc();
         setDynamicMetadata(
             Filters::Common::RBAC::DynamicMetadataKeysSingleton::get().EngineResultAllowed,
             effective_policy_id);
       } else if (mode == Filters::Common::RBAC::EnforcementMode::Enforced) {
         ENVOY_LOG(debug, "enforced allowed, matched policy {}", log_policy_id);
-        config_->stats().allowed_.inc();
+        config_.stats().allowed_.inc();
       }
       return Result{Allow, effective_policy_id};
     } else {
       if (mode == Filters::Common::RBAC::EnforcementMode::Shadow) {
         ENVOY_LOG(debug, "shadow denied, matched policy {}", log_policy_id);
-        config_->stats().shadow_denied_.inc();
+        config_.stats().shadow_denied_.inc();
         setDynamicMetadata(
             Filters::Common::RBAC::DynamicMetadataKeysSingleton::get().EngineResultDenied,
             effective_policy_id);
       } else if (mode == Filters::Common::RBAC::EnforcementMode::Enforced) {
         ENVOY_LOG(debug, "enforced denied, matched policy {}", log_policy_id);
-        config_->stats().denied_.inc();
+        config_.stats().denied_.inc();
       }
       return Result{Deny, log_policy_id};
     }
diff --git a/source/extensions/filters/network/rbac/rbac_filter.h b/source/extensions/filters/network/rbac/rbac_filter.h
index f45a938956c3..1dd692fa5324 100644
--- a/source/extensions/filters/network/rbac/rbac_filter.h
+++ b/source/extensions/filters/network/rbac/rbac_filter.h
@@ -60,8 +60,7 @@ class RoleBasedAccessControlFilter : public Network::ReadFilter,
                                      public Logger::Loggable<Logger::Id::rbac> {
 
 public:
-  RoleBasedAccessControlFilter(RoleBasedAccessControlFilterConfigSharedPtr config)
-      : config_(config) {}
+  RoleBasedAccessControlFilter(RoleBasedAccessControlFilterConfig& config) : config_(config) {}
   ~RoleBasedAccessControlFilter() override = default;
 
   // Network::ReadFilter
@@ -74,7 +73,7 @@ class RoleBasedAccessControlFilter : public Network::ReadFilter,
   void setDynamicMetadata(std::string shadow_engine_result, std::string shadow_policy_id);
 
 private:
-  RoleBasedAccessControlFilterConfigSharedPtr config_;
+  RoleBasedAccessControlFilterConfig& config_;
   Network::ReadFilterCallbacks* callbacks_{};
   EngineResult engine_result_{Unknown};
   EngineResult shadow_engine_result_{Unknown};
diff --git a/source/extensions/filters/network/redis_proxy/config.cc b/source/extensions/filters/network/redis_proxy/config.cc
index d10e951e7b85..983137ef5208 100644
--- a/source/extensions/filters/network/redis_proxy/config.cc
+++ b/source/extensions/filters/network/redis_proxy/config.cc
@@ -98,7 +98,7 @@ Network::FilterFactoryCb RedisProxyFilterConfigFactory::createFilterFactoryFromP
     Common::Redis::DecoderFactoryImpl factory;
     filter_manager.addReadFilter(std::make_shared<ProxyFilter>(
         factory, Common::Redis::EncoderPtr{new Common::Redis::EncoderImpl()}, *splitter,
-        filter_config));
+        *filter_config));
   };
 }
 
diff --git a/source/extensions/filters/network/redis_proxy/proxy_filter.cc b/source/extensions/filters/network/redis_proxy/proxy_filter.cc
index 54e029813ef0..db50d39af172 100644
--- a/source/extensions/filters/network/redis_proxy/proxy_filter.cc
+++ b/source/extensions/filters/network/redis_proxy/proxy_filter.cc
@@ -35,27 +35,27 @@ ProxyStats ProxyFilterConfig::generateStats(const std::string& prefix, Stats::Sc
 
 ProxyFilter::ProxyFilter(Common::Redis::DecoderFactory& factory,
                          Common::Redis::EncoderPtr&& encoder, CommandSplitter::Instance& splitter,
-                         ProxyFilterConfigSharedPtr config)
+                         ProxyFilterConfig& config)
     : decoder_(factory.create(*this)), encoder_(std::move(encoder)), splitter_(splitter),
       config_(config) {
-  config_->stats_.downstream_cx_total_.inc();
-  config_->stats_.downstream_cx_active_.inc();
+  config_.stats_.downstream_cx_total_.inc();
+  config_.stats_.downstream_cx_active_.inc();
   connection_allowed_ =
-      config_->downstream_auth_username_.empty() && config_->downstream_auth_password_.empty();
+      config_.downstream_auth_username_.empty() && config_.downstream_auth_password_.empty();
 }
 
 ProxyFilter::~ProxyFilter() {
   ASSERT(pending_requests_.empty());
-  config_->stats_.downstream_cx_active_.dec();
+  config_.stats_.downstream_cx_active_.dec();
 }
 
 void ProxyFilter::initializeReadFilterCallbacks(Network::ReadFilterCallbacks& callbacks) {
   callbacks_ = &callbacks;
   callbacks_->connection().addConnectionCallbacks(*this);
-  callbacks_->connection().setConnectionStats({config_->stats_.downstream_cx_rx_bytes_total_,
-                                               config_->stats_.downstream_cx_rx_bytes_buffered_,
-                                               config_->stats_.downstream_cx_tx_bytes_total_,
-                                               config_->stats_.downstream_cx_tx_bytes_buffered_,
+  callbacks_->connection().setConnectionStats({config_.stats_.downstream_cx_rx_bytes_total_,
+                                               config_.stats_.downstream_cx_rx_bytes_buffered_,
+                                               config_.stats_.downstream_cx_tx_bytes_total_,
+                                               config_.stats_.downstream_cx_tx_bytes_buffered_,
                                                nullptr, nullptr});
 }
 
@@ -85,10 +85,10 @@ void ProxyFilter::onEvent(Network::ConnectionEvent event) {
 
 void ProxyFilter::onAuth(PendingRequest& request, const std::string& password) {
   Common::Redis::RespValuePtr response{new Common::Redis::RespValue()};
-  if (config_->downstream_auth_password_.empty()) {
+  if (config_.downstream_auth_password_.empty()) {
     response->type(Common::Redis::RespType::Error);
     response->asString() = "ERR Client sent AUTH, but no password is set";
-  } else if (password == config_->downstream_auth_password_) {
+  } else if (password == config_.downstream_auth_password_) {
     response->type(Common::Redis::RespType::SimpleString);
     response->asString() = "OK";
     connection_allowed_ = true;
@@ -103,17 +103,17 @@ void ProxyFilter::onAuth(PendingRequest& request, const std::string& password) {
 void ProxyFilter::onAuth(PendingRequest& request, const std::string& username,
                          const std::string& password) {
   Common::Redis::RespValuePtr response{new Common::Redis::RespValue()};
-  if (config_->downstream_auth_username_.empty() && config_->downstream_auth_password_.empty()) {
+  if (config_.downstream_auth_username_.empty() && config_.downstream_auth_password_.empty()) {
     response->type(Common::Redis::RespType::Error);
     response->asString() = "ERR Client sent AUTH, but no username-password pair is set";
-  } else if (config_->downstream_auth_username_.empty() && username == "default" &&
-             password == config_->downstream_auth_password_) {
+  } else if (config_.downstream_auth_username_.empty() && username == "default" &&
+             password == config_.downstream_auth_password_) {
     // empty username and "default" are synonymous in Redis 6 ACLs
     response->type(Common::Redis::RespType::SimpleString);
     response->asString() = "OK";
     connection_allowed_ = true;
-  } else if (username == config_->downstream_auth_username_ &&
-             password == config_->downstream_auth_password_) {
+  } else if (username == config_.downstream_auth_username_ &&
+             password == config_.downstream_auth_password_) {
     response->type(Common::Redis::RespType::SimpleString);
     response->asString() = "OK";
     connection_allowed_ = true;
@@ -142,9 +142,9 @@ void ProxyFilter::onResponse(PendingRequest& request, Common::Redis::RespValuePt
   }
 
   // Check for drain close only if there are no pending responses.
-  if (pending_requests_.empty() && config_->drain_decision_.drainClose() &&
-      config_->runtime_.snapshot().featureEnabled(config_->redis_drain_close_runtime_key_, 100)) {
-    config_->stats_.downstream_cx_drain_close_.inc();
+  if (pending_requests_.empty() && config_.drain_decision_.drainClose() &&
+      config_.runtime_.snapshot().featureEnabled(config_.redis_drain_close_runtime_key_, 100)) {
+    config_.stats_.downstream_cx_drain_close_.inc();
     callbacks_->connection().close(Network::ConnectionCloseType::FlushWrite);
   }
 }
@@ -154,7 +154,7 @@ Network::FilterStatus ProxyFilter::onData(Buffer::Instance& data, bool) {
     decoder_->decode(data);
     return Network::FilterStatus::Continue;
   } catch (Common::Redis::ProtocolError&) {
-    config_->stats_.downstream_cx_protocol_error_.inc();
+    config_.stats_.downstream_cx_protocol_error_.inc();
     Common::Redis::RespValue error;
     error.type(Common::Redis::RespType::Error);
     error.asString() = "downstream protocol error";
@@ -166,12 +166,12 @@ Network::FilterStatus ProxyFilter::onData(Buffer::Instance& data, bool) {
 }
 
 ProxyFilter::PendingRequest::PendingRequest(ProxyFilter& parent) : parent_(parent) {
-  parent.config_->stats_.downstream_rq_total_.inc();
-  parent.config_->stats_.downstream_rq_active_.inc();
+  parent.config_.stats_.downstream_rq_total_.inc();
+  parent.config_.stats_.downstream_rq_active_.inc();
 }
 
 ProxyFilter::PendingRequest::~PendingRequest() {
-  parent_.config_->stats_.downstream_rq_active_.dec();
+  parent_.config_.stats_.downstream_rq_active_.dec();
 }
 
 } // namespace RedisProxy
diff --git a/source/extensions/filters/network/redis_proxy/proxy_filter.h b/source/extensions/filters/network/redis_proxy/proxy_filter.h
index 103e7c33c9e6..df756f4b28e6 100644
--- a/source/extensions/filters/network/redis_proxy/proxy_filter.h
+++ b/source/extensions/filters/network/redis_proxy/proxy_filter.h
@@ -75,7 +75,7 @@ class ProxyFilter : public Network::ReadFilter,
                     public Network::ConnectionCallbacks {
 public:
   ProxyFilter(Common::Redis::DecoderFactory& factory, Common::Redis::EncoderPtr&& encoder,
-              CommandSplitter::Instance& splitter, ProxyFilterConfigSharedPtr config);
+              CommandSplitter::Instance& splitter, ProxyFilterConfig& config);
   ~ProxyFilter() override;
 
   // Network::ReadFilter
@@ -122,7 +122,7 @@ class ProxyFilter : public Network::ReadFilter,
   Common::Redis::DecoderPtr decoder_;
   Common::Redis::EncoderPtr encoder_;
   CommandSplitter::Instance& splitter_;
-  ProxyFilterConfigSharedPtr config_;
+  ProxyFilterConfig& config_;
   Buffer::OwnedImpl encoder_buffer_;
   Network::ReadFilterCallbacks* callbacks_{};
   std::list<PendingRequest> pending_requests_;
diff --git a/source/extensions/filters/network/sni_dynamic_forward_proxy/config.cc b/source/extensions/filters/network/sni_dynamic_forward_proxy/config.cc
index 97924d6086c6..b424ac4b7c0f 100644
--- a/source/extensions/filters/network/sni_dynamic_forward_proxy/config.cc
+++ b/source/extensions/filters/network/sni_dynamic_forward_proxy/config.cc
@@ -25,7 +25,7 @@ SniDynamicForwardProxyNetworkFilterConfigFactory::createFilterFactoryFromProtoTy
       proto_config, cache_manager_factory, context.clusterManager()));
 
   return [filter_config](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addReadFilter(std::make_shared<ProxyFilter>(filter_config));
+    filter_manager.addReadFilter(std::make_shared<ProxyFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.cc b/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.cc
index 0e1136336c00..7263272df69a 100644
--- a/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.cc
+++ b/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.cc
@@ -20,7 +20,7 @@ ProxyFilterConfig::ProxyFilterConfig(
       dns_cache_manager_(cache_manager_factory.get()),
       dns_cache_(dns_cache_manager_->getCache(proto_config.dns_cache_config())) {}
 
-ProxyFilter::ProxyFilter(ProxyFilterConfigSharedPtr config) : config_(std::move(config)) {}
+ProxyFilter::ProxyFilter(ProxyFilterConfig& config) : config_(config) {}
 
 using LoadDnsCacheEntryStatus = Common::DynamicForwardProxy::DnsCache::LoadDnsCacheEntryStatus;
 
@@ -33,7 +33,7 @@ Network::FilterStatus ProxyFilter::onNewConnection() {
     return Network::FilterStatus::Continue;
   }
 
-  circuit_breaker_ = config_->cache().canCreateDnsRequest();
+  circuit_breaker_ = config_.cache().canCreateDnsRequest();
 
   if (circuit_breaker_ == nullptr) {
     ENVOY_CONN_LOG(debug, "pending request overflow", read_callbacks_->connection());
@@ -41,9 +41,9 @@ Network::FilterStatus ProxyFilter::onNewConnection() {
     return Network::FilterStatus::StopIteration;
   }
 
-  uint32_t default_port = config_->port();
+  uint32_t default_port = config_.port();
 
-  auto result = config_->cache().loadDnsCacheEntry(sni, default_port, *this);
+  auto result = config_.cache().loadDnsCacheEntry(sni, default_port, *this);
 
   cache_load_handle_ = std::move(result.handle_);
   if (cache_load_handle_ == nullptr) {
diff --git a/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.h b/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.h
index 65cd7235b71e..722e1fac412c 100644
--- a/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.h
+++ b/source/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter.h
@@ -39,7 +39,7 @@ class ProxyFilter
       public Extensions::Common::DynamicForwardProxy::DnsCache::LoadDnsCacheEntryCallbacks,
       Logger::Loggable<Logger::Id::forward_proxy> {
 public:
-  ProxyFilter(ProxyFilterConfigSharedPtr config);
+  ProxyFilter(ProxyFilterConfig& config);
 
   // Network::ReadFilter
   Network::FilterStatus onData(Buffer::Instance&, bool) override {
@@ -54,7 +54,7 @@ class ProxyFilter
   void onLoadDnsCacheComplete() override;
 
 private:
-  const ProxyFilterConfigSharedPtr config_;
+  ProxyFilterConfig& config_;
   Upstream::ResourceAutoIncDecPtr circuit_breaker_;
   Extensions::Common::DynamicForwardProxy::DnsCache::LoadDnsCacheEntryHandlePtr cache_load_handle_;
   Network::ReadFilterCallbacks* read_callbacks_{};
diff --git a/source/extensions/filters/network/tcp_proxy/config.cc b/source/extensions/filters/network/tcp_proxy/config.cc
index d9ca1049b942..b69ce5493656 100644
--- a/source/extensions/filters/network/tcp_proxy/config.cc
+++ b/source/extensions/filters/network/tcp_proxy/config.cc
@@ -23,7 +23,7 @@ Network::FilterFactoryCb ConfigFactory::createFilterFactoryFromProtoTyped(
       std::make_shared<Envoy::TcpProxy::Config>(proto_config, context));
   return [filter_config, &context](Network::FilterManager& filter_manager) -> void {
     filter_manager.addReadFilter(
-        std::make_shared<Envoy::TcpProxy::Filter>(filter_config, context.clusterManager()));
+        std::make_shared<Envoy::TcpProxy::Filter>(*filter_config, context.clusterManager()));
   };
 }
 
diff --git a/source/extensions/filters/network/zookeeper_proxy/config.cc b/source/extensions/filters/network/zookeeper_proxy/config.cc
index 33016ac1e3fe..1da68630ff22 100644
--- a/source/extensions/filters/network/zookeeper_proxy/config.cc
+++ b/source/extensions/filters/network/zookeeper_proxy/config.cc
@@ -34,7 +34,7 @@ Network::FilterFactoryCb ZooKeeperConfigFactory::createFilterFactoryFromProtoTyp
   auto& time_source = context.dispatcher().timeSource();
 
   return [filter_config, &time_source](Network::FilterManager& filter_manager) -> void {
-    filter_manager.addFilter(std::make_shared<ZooKeeperFilter>(filter_config, time_source));
+    filter_manager.addFilter(std::make_shared<ZooKeeperFilter>(*filter_config, time_source));
   };
 }
 
diff --git a/source/extensions/filters/network/zookeeper_proxy/filter.cc b/source/extensions/filters/network/zookeeper_proxy/filter.cc
index b6c38c0ec297..36a840408c67 100644
--- a/source/extensions/filters/network/zookeeper_proxy/filter.cc
+++ b/source/extensions/filters/network/zookeeper_proxy/filter.cc
@@ -68,8 +68,8 @@ void ZooKeeperFilterConfig::initOpCode(OpCodes opcode, Stats::Counter& counter,
   opcode_info.latency_name_ = stat_name_set_->add(absl::StrCat(name, "_latency"));
 }
 
-ZooKeeperFilter::ZooKeeperFilter(ZooKeeperFilterConfigSharedPtr config, TimeSource& time_source)
-    : config_(std::move(config)), decoder_(createDecoder(*this, time_source)) {}
+ZooKeeperFilter::ZooKeeperFilter(ZooKeeperFilterConfig& config, TimeSource& time_source)
+    : config_(config), decoder_(createDecoder(*this, time_source)) {}
 
 void ZooKeeperFilter::initializeReadFilterCallbacks(Network::ReadFilterCallbacks& callbacks) {
   read_callbacks_ = &callbacks;
@@ -90,7 +90,7 @@ Network::FilterStatus ZooKeeperFilter::onWrite(Buffer::Instance& data, bool) {
 Network::FilterStatus ZooKeeperFilter::onNewConnection() { return Network::FilterStatus::Continue; }
 
 DecoderPtr ZooKeeperFilter::createDecoder(DecoderCallbacks& callbacks, TimeSource& time_source) {
-  return std::make_unique<DecoderImpl>(callbacks, config_->maxPacketBytes(), time_source);
+  return std::make_unique<DecoderImpl>(callbacks, config_.maxPacketBytes(), time_source);
 }
 
 void ZooKeeperFilter::setDynamicMetadata(const std::string& key, const std::string& value) {
@@ -125,45 +125,45 @@ void ZooKeeperFilter::setDynamicMetadata(
 
 void ZooKeeperFilter::onConnect(const bool readonly) {
   if (readonly) {
-    config_->stats_.connect_readonly_rq_.inc();
+    config_.stats_.connect_readonly_rq_.inc();
     setDynamicMetadata("opname", "connect_readonly");
   } else {
-    config_->stats_.connect_rq_.inc();
+    config_.stats_.connect_rq_.inc();
     setDynamicMetadata("opname", "connect");
   }
 }
 
 void ZooKeeperFilter::onDecodeError() {
-  config_->stats_.decoder_error_.inc();
+  config_.stats_.decoder_error_.inc();
   setDynamicMetadata("opname", "error");
 }
 
 void ZooKeeperFilter::onRequestBytes(const uint64_t bytes) {
-  config_->stats_.request_bytes_.add(bytes);
+  config_.stats_.request_bytes_.add(bytes);
   setDynamicMetadata("bytes", std::to_string(bytes));
 }
 
 void ZooKeeperFilter::onResponseBytes(const uint64_t bytes) {
-  config_->stats_.response_bytes_.add(bytes);
+  config_.stats_.response_bytes_.add(bytes);
   setDynamicMetadata("bytes", std::to_string(bytes));
 }
 
 void ZooKeeperFilter::onPing() {
-  config_->stats_.ping_rq_.inc();
+  config_.stats_.ping_rq_.inc();
   setDynamicMetadata("opname", "ping");
 }
 
 void ZooKeeperFilter::onAuthRequest(const std::string& scheme) {
   Stats::Counter& counter = Stats::Utility::counterFromStatNames(
-      config_->scope_, {config_->stat_prefix_, config_->auth_,
-                        config_->stat_name_set_->getBuiltin(absl::StrCat(scheme, "_rq"),
-                                                            config_->unknown_scheme_rq_)});
+      config_.scope_, {config_.stat_prefix_, config_.auth_,
+                       config_.stat_name_set_->getBuiltin(absl::StrCat(scheme, "_rq"),
+                                                          config_.unknown_scheme_rq_)});
   counter.inc();
   setDynamicMetadata("opname", "auth");
 }
 
 void ZooKeeperFilter::onGetDataRequest(const std::string& path, const bool watch) {
-  config_->stats_.getdata_rq_.inc();
+  config_.stats_.getdata_rq_.inc();
   setDynamicMetadata({{"opname", "getdata"}, {"path", path}, {"watch", watch ? "true" : "false"}});
 }
 
@@ -174,19 +174,19 @@ void ZooKeeperFilter::onCreateRequest(const std::string& path, const CreateFlags
   switch (opcode) {
   case OpCodes::Create:
     opname = "create";
-    config_->stats_.create_rq_.inc();
+    config_.stats_.create_rq_.inc();
     break;
   case OpCodes::Create2:
     opname = "create2";
-    config_->stats_.create2_rq_.inc();
+    config_.stats_.create2_rq_.inc();
     break;
   case OpCodes::CreateContainer:
     opname = "createcontainer";
-    config_->stats_.createcontainer_rq_.inc();
+    config_.stats_.createcontainer_rq_.inc();
     break;
   case OpCodes::CreateTtl:
     opname = "createttl";
-    config_->stats_.createttl_rq_.inc();
+    config_.stats_.createttl_rq_.inc();
     break;
   default:
     throw EnvoyException(fmt::format("Unknown opcode: {}", enumToSignedInt(opcode)));
@@ -198,7 +198,7 @@ void ZooKeeperFilter::onCreateRequest(const std::string& path, const CreateFlags
 }
 
 void ZooKeeperFilter::onSetRequest(const std::string& path) {
-  config_->stats_.setdata_rq_.inc();
+  config_.stats_.setdata_rq_.inc();
   setDynamicMetadata({{"opname", "setdata"}, {"path", path}});
 }
 
@@ -207,91 +207,91 @@ void ZooKeeperFilter::onGetChildrenRequest(const std::string& path, const bool w
   std::string opname = "getchildren";
 
   if (v2) {
-    config_->stats_.getchildren2_rq_.inc();
+    config_.stats_.getchildren2_rq_.inc();
     opname = "getchildren2";
   } else {
-    config_->stats_.getchildren_rq_.inc();
+    config_.stats_.getchildren_rq_.inc();
   }
 
   setDynamicMetadata({{"opname", opname}, {"path", path}, {"watch", watch ? "true" : "false"}});
 }
 
 void ZooKeeperFilter::onDeleteRequest(const std::string& path, const int32_t version) {
-  config_->stats_.delete_rq_.inc();
+  config_.stats_.delete_rq_.inc();
   setDynamicMetadata({{"opname", "delete"}, {"path", path}, {"version", std::to_string(version)}});
 }
 
 void ZooKeeperFilter::onExistsRequest(const std::string& path, const bool watch) {
-  config_->stats_.exists_rq_.inc();
+  config_.stats_.exists_rq_.inc();
   setDynamicMetadata({{"opname", "exists"}, {"path", path}, {"watch", watch ? "true" : "false"}});
 }
 
 void ZooKeeperFilter::onGetAclRequest(const std::string& path) {
-  config_->stats_.getacl_rq_.inc();
+  config_.stats_.getacl_rq_.inc();
   setDynamicMetadata({{"opname", "getacl"}, {"path", path}});
 }
 
 void ZooKeeperFilter::onSetAclRequest(const std::string& path, const int32_t version) {
-  config_->stats_.setacl_rq_.inc();
+  config_.stats_.setacl_rq_.inc();
   setDynamicMetadata({{"opname", "setacl"}, {"path", path}, {"version", std::to_string(version)}});
 }
 
 void ZooKeeperFilter::onSyncRequest(const std::string& path) {
-  config_->stats_.sync_rq_.inc();
+  config_.stats_.sync_rq_.inc();
   setDynamicMetadata({{"opname", "sync"}, {"path", path}});
 }
 
 void ZooKeeperFilter::onCheckRequest(const std::string&, const int32_t) {
-  config_->stats_.check_rq_.inc();
+  config_.stats_.check_rq_.inc();
 }
 
 void ZooKeeperFilter::onCheckWatchesRequest(const std::string& path, const int32_t) {
-  config_->stats_.checkwatches_rq_.inc();
+  config_.stats_.checkwatches_rq_.inc();
   setDynamicMetadata({{"opname", "checkwatches"}, {"path", path}});
 }
 
 void ZooKeeperFilter::onRemoveWatchesRequest(const std::string& path, const int32_t) {
-  config_->stats_.removewatches_rq_.inc();
+  config_.stats_.removewatches_rq_.inc();
   setDynamicMetadata({{"opname", "removewatches"}, {"path", path}});
 }
 
 void ZooKeeperFilter::onMultiRequest() {
-  config_->stats_.multi_rq_.inc();
+  config_.stats_.multi_rq_.inc();
   setDynamicMetadata("opname", "multi");
 }
 
 void ZooKeeperFilter::onReconfigRequest() {
-  config_->stats_.reconfig_rq_.inc();
+  config_.stats_.reconfig_rq_.inc();
   setDynamicMetadata("opname", "reconfig");
 }
 
 void ZooKeeperFilter::onSetWatchesRequest() {
-  config_->stats_.setwatches_rq_.inc();
+  config_.stats_.setwatches_rq_.inc();
   setDynamicMetadata("opname", "setwatches");
 }
 
 void ZooKeeperFilter::onGetEphemeralsRequest(const std::string& path) {
-  config_->stats_.getephemerals_rq_.inc();
+  config_.stats_.getephemerals_rq_.inc();
   setDynamicMetadata({{"opname", "getephemerals"}, {"path", path}});
 }
 
 void ZooKeeperFilter::onGetAllChildrenNumberRequest(const std::string& path) {
-  config_->stats_.getallchildrennumber_rq_.inc();
+  config_.stats_.getallchildrennumber_rq_.inc();
   setDynamicMetadata({{"opname", "getallchildrennumber"}, {"path", path}});
 }
 
 void ZooKeeperFilter::onCloseRequest() {
-  config_->stats_.close_rq_.inc();
+  config_.stats_.close_rq_.inc();
   setDynamicMetadata("opname", "close");
 }
 
 void ZooKeeperFilter::onConnectResponse(const int32_t proto_version, const int32_t timeout,
                                         const bool readonly,
                                         const std::chrono::milliseconds& latency) {
-  config_->stats_.connect_resp_.inc();
+  config_.stats_.connect_resp_.inc();
 
   Stats::Histogram& histogram = Stats::Utility::histogramFromElements(
-      config_->scope_, {config_->stat_prefix_, config_->connect_latency_},
+      config_.scope_, {config_.stat_prefix_, config_.connect_latency_},
       Stats::Histogram::Unit::Milliseconds);
   histogram.recordValue(latency.count());
 
@@ -303,10 +303,10 @@ void ZooKeeperFilter::onConnectResponse(const int32_t proto_version, const int32
 
 void ZooKeeperFilter::onResponse(const OpCodes opcode, const int32_t xid, const int64_t zxid,
                                  const int32_t error, const std::chrono::milliseconds& latency) {
-  Stats::StatName opcode_latency = config_->unknown_opcode_latency_;
-  auto iter = config_->op_code_map_.find(opcode);
+  Stats::StatName opcode_latency = config_.unknown_opcode_latency_;
+  auto iter = config_.op_code_map_.find(opcode);
   std::string opname = "";
-  if (iter != config_->op_code_map_.end()) {
+  if (iter != config_.op_code_map_.end()) {
     const ZooKeeperFilterConfig::OpCodeInfo& opcode_info = iter->second;
     opcode_info.counter_->inc();
     opname = opcode_info.opname_;
@@ -314,8 +314,7 @@ void ZooKeeperFilter::onResponse(const OpCodes opcode, const int32_t xid, const
   }
 
   Stats::Histogram& histogram = Stats::Utility::histogramFromStatNames(
-      config_->scope_, {config_->stat_prefix_, opcode_latency},
-      Stats::Histogram::Unit::Milliseconds);
+      config_.scope_, {config_.stat_prefix_, opcode_latency}, Stats::Histogram::Unit::Milliseconds);
   histogram.recordValue(latency.count());
 
   setDynamicMetadata({{"opname", opname},
@@ -327,7 +326,7 @@ void ZooKeeperFilter::onResponse(const OpCodes opcode, const int32_t xid, const
 void ZooKeeperFilter::onWatchEvent(const int32_t event_type, const int32_t client_state,
                                    const std::string& path, const int64_t zxid,
                                    const int32_t error) {
-  config_->stats_.watch_event_.inc();
+  config_.stats_.watch_event_.inc();
   setDynamicMetadata({{"opname", "watch_event"},
                       {"event_type", std::to_string(event_type)},
                       {"client_state", std::to_string(client_state)},
diff --git a/source/extensions/filters/network/zookeeper_proxy/filter.h b/source/extensions/filters/network/zookeeper_proxy/filter.h
index dc932764b156..e03895077b63 100644
--- a/source/extensions/filters/network/zookeeper_proxy/filter.h
+++ b/source/extensions/filters/network/zookeeper_proxy/filter.h
@@ -138,7 +138,7 @@ class ZooKeeperFilter : public Network::Filter,
                         DecoderCallbacks,
                         Logger::Loggable<Logger::Id::filter> {
 public:
-  ZooKeeperFilter(ZooKeeperFilterConfigSharedPtr config, TimeSource& time_source);
+  ZooKeeperFilter(ZooKeeperFilterConfig& config, TimeSource& time_source);
 
   // Network::ReadFilter
   Network::FilterStatus onData(Buffer::Instance& data, bool end_stream) override;
@@ -187,7 +187,7 @@ class ZooKeeperFilter : public Network::Filter,
 
 private:
   Network::ReadFilterCallbacks* read_callbacks_{};
-  ZooKeeperFilterConfigSharedPtr config_;
+  ZooKeeperFilterConfig& config_;
   std::unique_ptr<Decoder> decoder_;
 };
 
diff --git a/test/common/network/filter_manager_impl_test.cc b/test/common/network/filter_manager_impl_test.cc
index e8857509a554..f8ad65a8e434 100644
--- a/test/common/network/filter_manager_impl_test.cc
+++ b/test/common/network/filter_manager_impl_test.cc
@@ -363,7 +363,6 @@ TEST_F(NetworkFilterManagerTest, RateLimitAndTcpProxy) {
   NiceMock<Server::Configuration::MockFactoryContext> factory_context;
   NiceMock<MockClientConnection> upstream_connection;
   NiceMock<Tcp::ConnectionPool::MockInstance> conn_pool;
-  FilterManagerImpl manager(connection_);
 
   std::string rl_yaml = R"EOF(
 domain: foo
@@ -389,16 +388,18 @@ stat_prefix: name
                                                               factory_context.runtime_loader_));
   Extensions::Filters::Common::RateLimit::MockClient* rl_client =
       new Extensions::Filters::Common::RateLimit::MockClient();
-  manager.addReadFilter(std::make_shared<Extensions::NetworkFilters::RateLimitFilter::Filter>(
-      rl_config, Extensions::Filters::Common::RateLimit::ClientPtr{rl_client}));
-
-  factory_context.cluster_manager_.initializeThreadLocalClusters({"fake_cluster"});
   envoy::extensions::filters::network::tcp_proxy::v3::TcpProxy tcp_proxy;
   tcp_proxy.set_stat_prefix("name");
   tcp_proxy.set_cluster("fake_cluster");
+  factory_context.cluster_manager_.initializeThreadLocalClusters({"fake_cluster"});
   TcpProxy::ConfigSharedPtr tcp_proxy_config(new TcpProxy::Config(tcp_proxy, factory_context));
+
+  FilterManagerImpl manager(connection_);
+
+  manager.addReadFilter(std::make_shared<Extensions::NetworkFilters::RateLimitFilter::Filter>(
+      *rl_config, Extensions::Filters::Common::RateLimit::ClientPtr{rl_client}));
   manager.addReadFilter(
-      std::make_shared<TcpProxy::Filter>(tcp_proxy_config, factory_context.cluster_manager_));
+      std::make_shared<TcpProxy::Filter>(*tcp_proxy_config, factory_context.cluster_manager_));
 
   Extensions::Filters::Common::RateLimit::RequestCallbacks* request_callbacks{};
   EXPECT_CALL(*rl_client, limit(_, "foo",
diff --git a/test/common/tcp_proxy/tcp_proxy_test.cc b/test/common/tcp_proxy/tcp_proxy_test.cc
index 2202ca0ef11e..0dc64714002b 100644
--- a/test/common/tcp_proxy/tcp_proxy_test.cc
+++ b/test/common/tcp_proxy/tcp_proxy_test.cc
@@ -955,7 +955,7 @@ class TcpProxyTest : public testing::Test {
     }
 
     {
-      filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+      filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
       EXPECT_CALL(filter_callbacks_.connection_, enableHalfClose(true));
       EXPECT_CALL(filter_callbacks_.connection_, readDisable(true));
       filter_->initializeReadFilterCallbacks(filter_callbacks_);
@@ -1108,7 +1108,7 @@ TEST_F(TcpProxyTest, BadFactory) {
   EXPECT_CALL(*upstream_connections_.at(0), dispatcher())
       .WillRepeatedly(ReturnRef(filter_callbacks_.connection_.dispatcher_));
 
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   EXPECT_CALL(filter_callbacks_.connection_, enableHalfClose(true));
   EXPECT_CALL(filter_callbacks_.connection_, readDisable(true));
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
@@ -1368,7 +1368,7 @@ TEST_F(TcpProxyTest, RouteWithMetadataMatch) {
       {Envoy::Config::MetadataFilters::get().ENVOY_LB, metadata_struct});
 
   configure(config);
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
   EXPECT_EQ(Network::FilterStatus::StopIteration, filter_->onNewConnection());
 
@@ -1417,7 +1417,7 @@ TEST_F(TcpProxyTest, WeightedClusterWithMetadataMatch) {
   v2.set_string_value("v2");
   HashedValue hv0(v0), hv1(v1), hv2(v2);
 
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
 
   // Expect filter to try to open a connection to cluster1.
@@ -1483,7 +1483,7 @@ TEST_F(TcpProxyTest, StreamInfoDynamicMetadata) {
   EXPECT_CALL(filter_callbacks_.connection_.stream_info_, dynamicMetadata())
       .WillOnce(ReturnRef(metadata));
 
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
 
   Upstream::LoadBalancerContext* context;
@@ -1537,7 +1537,7 @@ TEST_F(TcpProxyTest, StreamInfoDynamicMetadataAndConfigMerged) {
   EXPECT_CALL(filter_callbacks_.connection_.stream_info_, dynamicMetadata())
       .WillOnce(ReturnRef(metadata));
 
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
 
   Upstream::LoadBalancerContext* context;
@@ -1566,7 +1566,7 @@ TEST_F(TcpProxyTest, StreamInfoDynamicMetadataAndConfigMerged) {
 
 TEST_F(TcpProxyTest, DisconnectBeforeData) {
   configure(defaultConfig());
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
 
   filter_callbacks_.connection_.raiseEvent(Network::ConnectionEvent::RemoteClose);
@@ -1604,7 +1604,7 @@ TEST_F(TcpProxyTest, UpstreamConnectionLimit) {
       0, 0, 0, 0, 0);
 
   // setup sets up expectation for tcpConnForCluster but this test is expected to NOT call that
-  filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+  filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
   // The downstream connection closes if the proxy can't make an upstream connection.
   EXPECT_CALL(filter_callbacks_.connection_, close(Network::ConnectionCloseType::NoFlush));
   filter_->initializeReadFilterCallbacks(filter_callbacks_);
@@ -1963,7 +1963,7 @@ class TcpProxyRoutingTest : public testing::Test {
   void initializeFilter() {
     EXPECT_CALL(filter_callbacks_, connection()).WillRepeatedly(ReturnRef(connection_));
 
-    filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+    filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
   }
 
@@ -2165,7 +2165,7 @@ class TcpProxyHashingTest : public testing::Test {
   void initializeFilter() {
     EXPECT_CALL(filter_callbacks_, connection()).WillRepeatedly(ReturnRef(connection_));
 
-    filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
+    filter_ = std::make_unique<Filter>(*config_, factory_context_.cluster_manager_);
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
   }
 
diff --git a/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc b/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc
index 2b8c8cbcc2ae..d0d3be167019 100644
--- a/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc
+++ b/test/extensions/filters/network/client_ssl_auth/client_ssl_auth_test.cc
@@ -87,7 +87,7 @@ stat_prefix: vpn
 
   void createAuthFilter() {
     filter_callbacks_.connection_.callbacks_.clear();
-    instance_ = std::make_unique<ClientSslAuthFilter>(config_);
+    instance_ = std::make_unique<ClientSslAuthFilter>(*config_);
     instance_->initializeReadFilterCallbacks(filter_callbacks_);
 
     // NOP currently.
diff --git a/test/extensions/filters/network/ext_authz/ext_authz_fuzz_test.cc b/test/extensions/filters/network/ext_authz/ext_authz_fuzz_test.cc
index 37982575ecca..40932d5160b2 100644
--- a/test/extensions/filters/network/ext_authz/ext_authz_fuzz_test.cc
+++ b/test/extensions/filters/network/ext_authz/ext_authz_fuzz_test.cc
@@ -68,7 +68,7 @@ DEFINE_PROTO_FUZZER(const envoy::extensions::filters::network::ext_authz::ExtAut
 
   ConfigSharedPtr config = std::make_shared<Config>(proto_config, stats_store);
   std::unique_ptr<Filter> filter =
-      std::make_unique<Filter>(config, Filters::Common::ExtAuthz::ClientPtr{client});
+      std::make_unique<Filter>(*config, Filters::Common::ExtAuthz::ClientPtr{client});
 
   NiceMock<Network::MockReadFilterCallbacks> filter_callbacks;
   filter->initializeReadFilterCallbacks(filter_callbacks);
@@ -117,4 +117,4 @@ DEFINE_PROTO_FUZZER(const envoy::extensions::filters::network::ext_authz::ExtAut
 } // namespace ExtAuthz
 } // namespace NetworkFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/test/extensions/filters/network/ext_authz/ext_authz_test.cc b/test/extensions/filters/network/ext_authz/ext_authz_test.cc
index 053d84d3c04a..e24788520ebe 100644
--- a/test/extensions/filters/network/ext_authz/ext_authz_test.cc
+++ b/test/extensions/filters/network/ext_authz/ext_authz_test.cc
@@ -42,7 +42,7 @@ class ExtAuthzFilterTest : public testing::Test {
     TestUtility::loadFromYaml(yaml, proto_config);
     config_ = std::make_shared<Config>(proto_config, stats_store_);
     client_ = new Filters::Common::ExtAuthz::MockClient();
-    filter_ = std::make_unique<Filter>(config_, Filters::Common::ExtAuthz::ClientPtr{client_});
+    filter_ = std::make_unique<Filter>(*config_, Filters::Common::ExtAuthz::ClientPtr{client_});
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
     addr_ = std::make_shared<Network::Address::PipeInstance>("/test/test.sock");
 
diff --git a/test/extensions/filters/network/local_ratelimit/local_ratelimit_fuzz_test.cc b/test/extensions/filters/network/local_ratelimit/local_ratelimit_fuzz_test.cc
index 5e597bb552ad..c4d30e9a27ea 100644
--- a/test/extensions/filters/network/local_ratelimit/local_ratelimit_fuzz_test.cc
+++ b/test/extensions/filters/network/local_ratelimit/local_ratelimit_fuzz_test.cc
@@ -22,7 +22,7 @@ namespace Extensions {
 namespace NetworkFilters {
 namespace LocalRateLimitFilter {
 struct ActiveFilter {
-  ActiveFilter(const ConfigSharedPtr& config) : filter_(config) {
+  ActiveFilter(const ConfigSharedPtr& config) : filter_(*config) {
     filter_.initializeReadFilterCallbacks(read_filter_callbacks_);
   }
 
diff --git a/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc b/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc
index d764a1bab8ec..8e261fd66443 100644
--- a/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc
+++ b/test/extensions/filters/network/local_ratelimit/local_ratelimit_test.cc
@@ -45,7 +45,7 @@ class LocalRateLimitTestBase : public testing::Test {
 class LocalRateLimitFilterTest : public LocalRateLimitTestBase {
 public:
   struct ActiveFilter {
-    ActiveFilter(const ConfigSharedPtr& config) : filter_(config) {
+    ActiveFilter(const ConfigSharedPtr& config) : filter_(*config) {
       filter_.initializeReadFilterCallbacks(read_filter_callbacks_);
     }
 
diff --git a/test/extensions/filters/network/mongo_proxy/proxy_test.cc b/test/extensions/filters/network/mongo_proxy/proxy_test.cc
index 82c777a0288a..c747691219e9 100644
--- a/test/extensions/filters/network/mongo_proxy/proxy_test.cc
+++ b/test/extensions/filters/network/mongo_proxy/proxy_test.cc
@@ -85,7 +85,7 @@ class MongoProxyFilterTest : public testing::Test {
   void initializeFilter(bool emit_dynamic_metadata = false) {
     filter_ = std::make_unique<TestProxyFilter>(
         "test.", store_, runtime_, access_log_, fault_config_, drain_decision_,
-        dispatcher_.timeSource(), emit_dynamic_metadata, mongo_stats_);
+        dispatcher_.timeSource(), emit_dynamic_metadata, *mongo_stats_);
     filter_->initializeReadFilterCallbacks(read_filter_callbacks_);
     filter_->onNewConnection();
 
diff --git a/test/extensions/filters/network/mysql_proxy/mysql_filter_test.cc b/test/extensions/filters/network/mysql_proxy/mysql_filter_test.cc
index 968db699f72c..f86477b55321 100644
--- a/test/extensions/filters/network/mysql_proxy/mysql_filter_test.cc
+++ b/test/extensions/filters/network/mysql_proxy/mysql_filter_test.cc
@@ -23,7 +23,7 @@ class MySQLFilterTest : public testing::Test, public MySQLTestUtils {
 
   void initialize() {
     config_ = std::make_shared<MySQLFilterConfig>(stat_prefix_, scope_);
-    filter_ = std::make_unique<MySQLFilter>(config_);
+    filter_ = std::make_unique<MySQLFilter>(*config_);
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
   }
 
diff --git a/test/extensions/filters/network/postgres_proxy/postgres_filter_test.cc b/test/extensions/filters/network/postgres_proxy/postgres_filter_test.cc
index 63c9794ccee5..dee92e97008a 100644
--- a/test/extensions/filters/network/postgres_proxy/postgres_filter_test.cc
+++ b/test/extensions/filters/network/postgres_proxy/postgres_filter_test.cc
@@ -32,7 +32,7 @@ class PostgresFilterTest
 public:
   PostgresFilterTest() {
     config_ = std::make_shared<PostgresFilterConfig>(stat_prefix_, true, scope_);
-    filter_ = std::make_unique<PostgresFilter>(config_);
+    filter_ = std::make_unique<PostgresFilter>(*config_);
 
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
   }
@@ -323,7 +323,7 @@ TEST_F(PostgresFilterTest, QueryMessageMetadata) {
   setMetadata();
 
   // Disable creating parsing SQL and creating metadata.
-  filter_->getConfig()->enable_sql_parsing_ = false;
+  filter_->getConfig().enable_sql_parsing_ = false;
   createPostgresMsg(data_, "Q", "SELECT * FROM whatever");
   filter_->onData(data_, false);
 
@@ -334,7 +334,7 @@ TEST_F(PostgresFilterTest, QueryMessageMetadata) {
   ASSERT_THAT(filter_->getStats().statements_parsed_.value(), 0);
 
   // Now enable SQL parsing and creating metadata.
-  filter_->getConfig()->enable_sql_parsing_ = true;
+  filter_->getConfig().enable_sql_parsing_ = true;
   filter_->onData(data_, false);
 
   auto& filter_meta = filter_->connection().streamInfo().dynamicMetadata().filter_metadata().at(
diff --git a/test/extensions/filters/network/ratelimit/ratelimit_test.cc b/test/extensions/filters/network/ratelimit/ratelimit_test.cc
index d0a5741b5c2d..760f12a604c6 100644
--- a/test/extensions/filters/network/ratelimit/ratelimit_test.cc
+++ b/test/extensions/filters/network/ratelimit/ratelimit_test.cc
@@ -45,7 +45,7 @@ class RateLimitFilterTest : public testing::Test {
     TestUtility::loadFromYaml(yaml, proto_config, false, true);
     config_ = std::make_shared<Config>(proto_config, stats_store_, runtime_);
     client_ = new Filters::Common::RateLimit::MockClient();
-    filter_ = std::make_unique<Filter>(config_, Filters::Common::RateLimit::ClientPtr{client_});
+    filter_ = std::make_unique<Filter>(*config_, Filters::Common::RateLimit::ClientPtr{client_});
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
 
     // NOP currently.
diff --git a/test/extensions/filters/network/rbac/filter_test.cc b/test/extensions/filters/network/rbac/filter_test.cc
index 5472131df717..e40d3beae36e 100644
--- a/test/extensions/filters/network/rbac/filter_test.cc
+++ b/test/extensions/filters/network/rbac/filter_test.cc
@@ -59,7 +59,7 @@ class RoleBasedAccessControlNetworkFilterTest : public testing::Test {
     EXPECT_CALL(callbacks_, connection()).WillRepeatedly(ReturnRef(callbacks_.connection_));
     EXPECT_CALL(callbacks_.connection_, streamInfo()).WillRepeatedly(ReturnRef(stream_info_));
 
-    filter_ = std::make_unique<RoleBasedAccessControlFilter>(config_);
+    filter_ = std::make_unique<RoleBasedAccessControlFilter>(*config_);
     filter_->initializeReadFilterCallbacks(callbacks_);
   }
 
@@ -128,7 +128,7 @@ TEST_F(RoleBasedAccessControlNetworkFilterTest, AllowedWithOneTimeEnforcement) {
 
 TEST_F(RoleBasedAccessControlNetworkFilterTest, AllowedWithContinuousEnforcement) {
   config_ = setupConfig(true, true /* continuous enforcement */);
-  filter_ = std::make_unique<RoleBasedAccessControlFilter>(config_);
+  filter_ = std::make_unique<RoleBasedAccessControlFilter>(*config_);
   filter_->initializeReadFilterCallbacks(callbacks_);
   setDestinationPort(123);
 
@@ -160,7 +160,7 @@ TEST_F(RoleBasedAccessControlNetworkFilterTest, RequestedServerName) {
 
 TEST_F(RoleBasedAccessControlNetworkFilterTest, AllowedWithNoPolicy) {
   config_ = setupConfig(false /* with_policy */);
-  filter_ = std::make_unique<RoleBasedAccessControlFilter>(config_);
+  filter_ = std::make_unique<RoleBasedAccessControlFilter>(*config_);
   filter_->initializeReadFilterCallbacks(callbacks_);
   setDestinationPort(0);
 
@@ -196,7 +196,7 @@ TEST_F(RoleBasedAccessControlNetworkFilterTest, Denied) {
 // Log Tests
 TEST_F(RoleBasedAccessControlNetworkFilterTest, ShouldLog) {
   config_ = setupConfig(true, false, envoy::config::rbac::v3::RBAC::LOG);
-  filter_ = std::make_unique<RoleBasedAccessControlFilter>(config_);
+  filter_ = std::make_unique<RoleBasedAccessControlFilter>(*config_);
   filter_->initializeReadFilterCallbacks(callbacks_);
 
   setDestinationPort(123);
@@ -211,7 +211,7 @@ TEST_F(RoleBasedAccessControlNetworkFilterTest, ShouldLog) {
 
 TEST_F(RoleBasedAccessControlNetworkFilterTest, ShouldNotLog) {
   config_ = setupConfig(true, false, envoy::config::rbac::v3::RBAC::LOG);
-  filter_ = std::make_unique<RoleBasedAccessControlFilter>(config_);
+  filter_ = std::make_unique<RoleBasedAccessControlFilter>(*config_);
   filter_->initializeReadFilterCallbacks(callbacks_);
 
   setDestinationPort(456);
diff --git a/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc b/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc
index 1dba30ee201e..7dfedbbb74c8 100644
--- a/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc
+++ b/test/extensions/filters/network/redis_proxy/proxy_filter_test.cc
@@ -131,7 +131,7 @@ class RedisProxyFilterTest : public testing::Test, public Common::Redis::Decoder
     config_ =
         std::make_shared<ProxyFilterConfig>(proto_config, store_, drain_decision_, runtime_, api_);
     filter_ = std::make_unique<ProxyFilter>(*this, Common::Redis::EncoderPtr{encoder_}, splitter_,
-                                            config_);
+                                            *config_);
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
     EXPECT_EQ(Network::FilterStatus::Continue, filter_->onNewConnection());
     EXPECT_EQ(1UL, config_->stats_.downstream_cx_total_.value());
diff --git a/test/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter_test.cc b/test/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter_test.cc
index 01073b5e6c96..bc9fb46c0ef8 100644
--- a/test/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter_test.cc
+++ b/test/extensions/filters/network/sni_dynamic_forward_proxy/proxy_filter_test.cc
@@ -36,7 +36,7 @@ class SniDynamicProxyFilterTest
     proto_config.set_port_value(443);
     EXPECT_CALL(*dns_cache_manager_, getCache(_));
     filter_config_ = std::make_shared<ProxyFilterConfig>(proto_config, *this, cm_);
-    filter_ = std::make_unique<ProxyFilter>(filter_config_);
+    filter_ = std::make_unique<ProxyFilter>(*filter_config_);
     filter_->initializeReadFilterCallbacks(callbacks_);
 
     // Allow for an otherwise strict mock.
diff --git a/test/extensions/filters/network/zookeeper_proxy/filter_test.cc b/test/extensions/filters/network/zookeeper_proxy/filter_test.cc
index 3a6eefd8e28b..9bbaa0b1c6d6 100644
--- a/test/extensions/filters/network/zookeeper_proxy/filter_test.cc
+++ b/test/extensions/filters/network/zookeeper_proxy/filter_test.cc
@@ -32,7 +32,7 @@ class ZooKeeperFilterTest : public testing::Test {
 
   void initialize() {
     config_ = std::make_shared<ZooKeeperFilterConfig>(stat_prefix_, 1048576, scope_);
-    filter_ = std::make_unique<ZooKeeperFilter>(config_, time_system_);
+    filter_ = std::make_unique<ZooKeeperFilter>(*config_, time_system_);
     filter_->initializeReadFilterCallbacks(filter_callbacks_);
   }