diff --git a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc
index 1b2d7400f771..bc90bf5072d4 100644
--- a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc
+++ b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.cc
@@ -25,19 +25,19 @@ AdaptiveConcurrencyFilterConfig::AdaptiveConcurrencyFilterConfig(
     : stats_prefix_(std::move(stats_prefix)), time_source_(time_source),
       adaptive_concurrency_feature_(proto_config.enabled(), runtime) {}
 
-AdaptiveConcurrencyFilter::AdaptiveConcurrencyFilter(
-    AdaptiveConcurrencyFilterConfigSharedPtr config, ConcurrencyControllerSharedPtr controller)
-    : config_(std::move(config)), controller_(std::move(controller)) {}
+AdaptiveConcurrencyFilter::AdaptiveConcurrencyFilter(AdaptiveConcurrencyFilterConfig& config,
+                                                     Controller::ConcurrencyController& controller)
+    : config_(config), controller_(controller) {}
 
 Http::FilterHeadersStatus AdaptiveConcurrencyFilter::decodeHeaders(Http::RequestHeaderMap&, bool) {
   // In addition to not sampling if the filter is disabled, health checks should also not be sampled
   // by the concurrency controller since they may potentially bias the sample aggregate to lower
   // latency measurements.
-  if (!config_->filterEnabled() || decoder_callbacks_->streamInfo().healthCheck()) {
+  if (!config_.filterEnabled() || decoder_callbacks_->streamInfo().healthCheck()) {
     return Http::FilterHeadersStatus::Continue;
   }
 
-  if (controller_->forwardingDecision() == Controller::RequestForwardingAction::Block) {
+  if (controller_.forwardingDecision() == Controller::RequestForwardingAction::Block) {
     decoder_callbacks_->sendLocalReply(Http::Code::ServiceUnavailable, "reached concurrency limit",
                                        nullptr, absl::nullopt, "reached_concurrency_limit");
     return Http::FilterHeadersStatus::StopIteration;
@@ -45,9 +45,9 @@ Http::FilterHeadersStatus AdaptiveConcurrencyFilter::decodeHeaders(Http::Request
 
   // When the deferred_sample_task_ object is destroyed, the request start time is sampled. This
   // occurs either when encoding is complete or during destruction of this filter object.
-  const auto now = config_->timeSource().monotonicTime();
+  const auto now = config_.timeSource().monotonicTime();
   deferred_sample_task_ =
-      std::make_unique<Cleanup>([this, now]() { controller_->recordLatencySample(now); });
+      std::make_unique<Cleanup>([this, now]() { controller_.recordLatencySample(now); });
 
   return Http::FilterHeadersStatus::Continue;
 }
@@ -62,7 +62,7 @@ void AdaptiveConcurrencyFilter::onDestroy() {
     // TODO (tonya11en): Return some RAII handle from the concurrency controller that performs this
     // logic as part of its lifecycle.
     deferred_sample_task_->cancel();
-    controller_->cancelLatencySample();
+    controller_.cancelLatencySample();
   }
 }
 
diff --git a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h
index 7424e1d3bdba..7cfddad24b25 100644
--- a/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h
+++ b/source/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter.h
@@ -53,8 +53,8 @@ using ConcurrencyControllerSharedPtr = std::shared_ptr<Controller::ConcurrencyCo
 class AdaptiveConcurrencyFilter : public Http::PassThroughFilter,
                                   Logger::Loggable<Logger::Id::filter> {
 public:
-  AdaptiveConcurrencyFilter(AdaptiveConcurrencyFilterConfigSharedPtr config,
-                            ConcurrencyControllerSharedPtr controller);
+  AdaptiveConcurrencyFilter(AdaptiveConcurrencyFilterConfig& config,
+                            Controller::ConcurrencyController& controller);
 
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap&, bool) override;
@@ -64,8 +64,8 @@ class AdaptiveConcurrencyFilter : public Http::PassThroughFilter,
   void onDestroy() override;
 
 private:
-  AdaptiveConcurrencyFilterConfigSharedPtr config_;
-  const ConcurrencyControllerSharedPtr controller_;
+  AdaptiveConcurrencyFilterConfig& config_;
+  Controller::ConcurrencyController& controller_;
   std::unique_ptr<Cleanup> deferred_sample_task_;
 };
 
diff --git a/source/extensions/filters/http/adaptive_concurrency/config.cc b/source/extensions/filters/http/adaptive_concurrency/config.cc
index 45783f034de1..d0664da6d648 100644
--- a/source/extensions/filters/http/adaptive_concurrency/config.cc
+++ b/source/extensions/filters/http/adaptive_concurrency/config.cc
@@ -18,24 +18,23 @@ Http::FilterFactoryCb AdaptiveConcurrencyFilterFactory::createFilterFactoryFromP
 
   auto acc_stats_prefix = stats_prefix + "adaptive_concurrency.";
 
-  std::shared_ptr<Controller::ConcurrencyController> controller;
   using Proto = envoy::extensions::filters::http::adaptive_concurrency::v3::AdaptiveConcurrency;
   ASSERT(config.concurrency_controller_config_case() ==
          Proto::ConcurrencyControllerConfigCase::kGradientControllerConfig);
   auto gradient_controller_config =
       Controller::GradientControllerConfig(config.gradient_controller_config(), context.runtime());
-  controller = std::make_shared<Controller::GradientController>(
+  auto controller = std::make_shared<Controller::GradientController>(
       std::move(gradient_controller_config), context.dispatcher(), context.runtime(),
       acc_stats_prefix + "gradient_controller.", context.scope(), context.api().randomGenerator(),
       context.timeSource());
 
-  AdaptiveConcurrencyFilterConfigSharedPtr filter_config(
-      new AdaptiveConcurrencyFilterConfig(config, context.runtime(), std::move(acc_stats_prefix),
-                                          context.scope(), context.timeSource()));
+  auto filter_config = std::make_shared<AdaptiveConcurrencyFilterConfig>(
+      config, context.runtime(), std::move(acc_stats_prefix), context.scope(),
+      context.timeSource());
 
   return [filter_config, controller](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamFilter(
-        std::make_shared<AdaptiveConcurrencyFilter>(filter_config, controller));
+        std::make_shared<AdaptiveConcurrencyFilter>(*filter_config, *controller));
   };
 }
 
diff --git a/source/extensions/filters/http/admission_control/admission_control.cc b/source/extensions/filters/http/admission_control/admission_control.cc
index 9329e10ab351..e868e91f32c9 100644
--- a/source/extensions/filters/http/admission_control/admission_control.cc
+++ b/source/extensions/filters/http/admission_control/admission_control.cc
@@ -56,13 +56,13 @@ double AdmissionControlFilterConfig::successRateThreshold() const {
   return std::min<double>(pct, 100.0) / 100.0;
 }
 
-AdmissionControlFilter::AdmissionControlFilter(AdmissionControlFilterConfigSharedPtr config,
+AdmissionControlFilter::AdmissionControlFilter(AdmissionControlFilterConfig& config,
                                                const std::string& stats_prefix)
-    : config_(std::move(config)), stats_(generateStats(config_->scope(), stats_prefix)),
-      record_request_(true) {}
+    : config_(config), stats_(generateStats(config_.scope(), stats_prefix)), record_request_(true) {
+}
 
 Http::FilterHeadersStatus AdmissionControlFilter::decodeHeaders(Http::RequestHeaderMap&, bool) {
-  if (!config_->filterEnabled() || decoder_callbacks_->streamInfo().healthCheck()) {
+  if (!config_.filterEnabled() || decoder_callbacks_->streamInfo().healthCheck()) {
     // We must forego recording the success/failure of this request during encoding.
     record_request_ = false;
     return Http::FilterHeadersStatus::Continue;
@@ -104,11 +104,11 @@ Http::FilterHeadersStatus AdmissionControlFilter::encodeHeaders(Http::ResponseHe
     }
 
     const uint32_t status = enumToInt(grpc_status.value());
-    successful_response = config_->responseEvaluator().isGrpcSuccess(status);
+    successful_response = config_.responseEvaluator().isGrpcSuccess(status);
   } else {
     // HTTP response.
     const uint64_t http_status = Http::Utility::getResponseStatus(headers);
-    successful_response = config_->responseEvaluator().isHttpSuccess(http_status);
+    successful_response = config_.responseEvaluator().isHttpSuccess(http_status);
   }
 
   if (successful_response) {
@@ -125,8 +125,7 @@ AdmissionControlFilter::encodeTrailers(Http::ResponseTrailerMap& trailers) {
   if (expect_grpc_status_in_trailer_) {
     absl::optional<GrpcStatus> grpc_status = Grpc::Common::getGrpcStatus(trailers, false);
 
-    if (grpc_status.has_value() &&
-        config_->responseEvaluator().isGrpcSuccess(grpc_status.value())) {
+    if (grpc_status.has_value() && config_.responseEvaluator().isGrpcSuccess(grpc_status.value())) {
       recordSuccess();
     } else {
       recordFailure();
@@ -139,19 +138,19 @@ AdmissionControlFilter::encodeTrailers(Http::ResponseTrailerMap& trailers) {
 bool AdmissionControlFilter::shouldRejectRequest() const {
   // This formula is documented in the admission control filter documentation:
   // https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/admission_control_filter.html
-  const auto request_counts = config_->getController().requestCounts();
+  const auto request_counts = config_.getController().requestCounts();
   const double total_requests = request_counts.requests;
   const double successful_requests = request_counts.successes;
-  double probability = total_requests - successful_requests / config_->successRateThreshold();
+  double probability = total_requests - successful_requests / config_.successRateThreshold();
   probability = probability / (total_requests + 1);
-  const auto aggression = config_->aggression();
+  const auto aggression = config_.aggression();
   if (aggression != 1.0) {
     probability = std::pow(probability, 1.0 / aggression);
   }
 
   // Choosing an accuracy of 4 significant figures for the probability.
   static constexpr uint64_t accuracy = 1e4;
-  auto r = config_->random().random();
+  auto r = config_.random().random();
   return (accuracy * std::max(probability, 0.0)) > (r % accuracy);
 }
 
diff --git a/source/extensions/filters/http/admission_control/admission_control.h b/source/extensions/filters/http/admission_control/admission_control.h
index 7b4e83de80c7..e86f53f984cf 100644
--- a/source/extensions/filters/http/admission_control/admission_control.h
+++ b/source/extensions/filters/http/admission_control/admission_control.h
@@ -86,8 +86,7 @@ using AdmissionControlFilterConfigSharedPtr = std::shared_ptr<const AdmissionCon
 class AdmissionControlFilter : public Http::PassThroughFilter,
                                protected Logger::Loggable<Logger::Id::filter> {
 public:
-  AdmissionControlFilter(AdmissionControlFilterConfigSharedPtr config,
-                         const std::string& stats_prefix);
+  AdmissionControlFilter(AdmissionControlFilterConfig& config, const std::string& stats_prefix);
 
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap&, bool) override;
@@ -106,15 +105,15 @@ class AdmissionControlFilter : public Http::PassThroughFilter,
 
   void recordSuccess() {
     stats_.rq_success_.inc();
-    config_->getController().recordSuccess();
+    config_.getController().recordSuccess();
   }
 
   void recordFailure() {
     stats_.rq_failure_.inc();
-    config_->getController().recordFailure();
+    config_.getController().recordFailure();
   }
 
-  const AdmissionControlFilterConfigSharedPtr config_;
+  AdmissionControlFilterConfig& config_;
   AdmissionControlStats stats_;
   bool expect_grpc_status_in_trailer_{false};
 
diff --git a/source/extensions/filters/http/admission_control/config.cc b/source/extensions/filters/http/admission_control/config.cc
index 27b7f9f1eb25..058761cab345 100644
--- a/source/extensions/filters/http/admission_control/config.cc
+++ b/source/extensions/filters/http/admission_control/config.cc
@@ -46,13 +46,12 @@ Http::FilterFactoryCb AdmissionControlFilterFactory::createFilterFactoryFromProt
     NOT_REACHED_GCOVR_EXCL_LINE;
   }
 
-  AdmissionControlFilterConfigSharedPtr filter_config =
-      std::make_shared<AdmissionControlFilterConfig>(
-          config, context.runtime(), context.api().randomGenerator(), context.scope(),
-          std::move(tls), std::move(response_evaluator));
+  auto filter_config = std::make_shared<AdmissionControlFilterConfig>(
+      config, context.runtime(), context.api().randomGenerator(), context.scope(), std::move(tls),
+      std::move(response_evaluator));
 
   return [filter_config, prefix](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<AdmissionControlFilter>(filter_config, prefix));
+    callbacks.addStreamFilter(std::make_shared<AdmissionControlFilter>(*filter_config, prefix));
   };
 }
 
diff --git a/source/extensions/filters/http/aws_lambda/aws_lambda_filter.h b/source/extensions/filters/http/aws_lambda/aws_lambda_filter.h
index 82bfdaf85cf2..37fd46031742 100644
--- a/source/extensions/filters/http/aws_lambda/aws_lambda_filter.h
+++ b/source/extensions/filters/http/aws_lambda/aws_lambda_filter.h
@@ -125,7 +125,7 @@ class Filter : public Http::PassThroughFilter, Logger::Loggable<Logger::Id::filt
   // Convert the JSON response to a standard HTTP response.
   void dejsonizeResponse(Http::ResponseHeaderMap& headers, const Buffer::Instance& body,
                          Buffer::Instance& out);
-  const FilterSettings settings_;
+  const FilterSettings& settings_;
   FilterStats stats_;
   Http::RequestHeaderMap* request_headers_ = nullptr;
   Http::ResponseHeaderMap* response_headers_ = nullptr;
diff --git a/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.cc b/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.cc
index 5c4ff37272bf..056bd5e604cd 100644
--- a/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.cc
+++ b/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.cc
@@ -13,7 +13,7 @@ FilterConfigImpl::FilterConfigImpl(Extensions::Common::Aws::SignerPtr&& signer,
     : signer_(std::move(signer)), stats_(Filter::generateStats(stats_prefix, scope)),
       host_rewrite_(host_rewrite) {}
 
-Filter::Filter(const std::shared_ptr<FilterConfig>& config) : config_(config) {}
+Filter::Filter(FilterConfig& config) : config_(config) {}
 
 Extensions::Common::Aws::Signer& FilterConfigImpl::signer() { return *signer_; }
 
@@ -27,17 +27,17 @@ FilterStats Filter::generateStats(const std::string& prefix, Stats::Scope& scope
 }
 
 Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers, bool) {
-  const auto& host_rewrite = config_->hostRewrite();
+  const auto& host_rewrite = config_.hostRewrite();
   if (!host_rewrite.empty()) {
     headers.setHost(host_rewrite);
   }
 
   try {
-    config_->signer().sign(headers);
-    config_->stats().signing_added_.inc();
+    config_.signer().sign(headers);
+    config_.stats().signing_added_.inc();
   } catch (const EnvoyException& e) {
     ENVOY_LOG(debug, "signing failed: {}", e.what());
-    config_->stats().signing_failed_.inc();
+    config_.stats().signing_failed_.inc();
   }
 
   return Http::FilterHeadersStatus::Continue;
diff --git a/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.h b/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.h
index ecd22a7b0b4d..8186805e4a4e 100644
--- a/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.h
+++ b/source/extensions/filters/http/aws_request_signing/aws_request_signing_filter.h
@@ -77,7 +77,7 @@ class FilterConfigImpl : public FilterConfig {
  */
 class Filter : public Http::PassThroughDecoderFilter, Logger::Loggable<Logger::Id::filter> {
 public:
-  Filter(const std::shared_ptr<FilterConfig>& config);
+  Filter(FilterConfig& config);
 
   static FilterStats generateStats(const std::string& prefix, Stats::Scope& scope);
 
@@ -85,7 +85,7 @@ class Filter : public Http::PassThroughDecoderFilter, Logger::Loggable<Logger::I
                                           bool end_stream) override;
 
 private:
-  std::shared_ptr<FilterConfig> config_;
+  FilterConfig& config_;
 };
 
 } // namespace AwsRequestSigningFilter
diff --git a/source/extensions/filters/http/aws_request_signing/config.cc b/source/extensions/filters/http/aws_request_signing/config.cc
index b637f3bfd178..fea90d24fde7 100644
--- a/source/extensions/filters/http/aws_request_signing/config.cc
+++ b/source/extensions/filters/http/aws_request_signing/config.cc
@@ -28,8 +28,7 @@ Http::FilterFactoryCb AwsRequestSigningFilterFactory::createFilterFactoryFromPro
   auto filter_config = std::make_shared<FilterConfigImpl>(std::move(signer), stats_prefix,
                                                           context.scope(), config.host_rewrite());
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    auto filter = std::make_shared<Filter>(filter_config);
-    callbacks.addStreamDecoderFilter(filter);
+    callbacks.addStreamDecoderFilter(std::make_shared<Filter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/buffer/buffer_filter.cc b/source/extensions/filters/http/buffer/buffer_filter.cc
index eeb4c81304fa..2a0048797300 100644
--- a/source/extensions/filters/http/buffer/buffer_filter.cc
+++ b/source/extensions/filters/http/buffer/buffer_filter.cc
@@ -36,14 +36,14 @@ BufferFilterConfig::BufferFilterConfig(
     const envoy::extensions::filters::http::buffer::v3::Buffer& proto_config)
     : settings_(proto_config) {}
 
-BufferFilter::BufferFilter(BufferFilterConfigSharedPtr config)
-    : config_(config), settings_(config->settings()) {}
+BufferFilter::BufferFilter(BufferFilterConfig& config)
+    : config_(config), settings_(config.settings()) {}
 
 void BufferFilter::initConfig() {
   ASSERT(!config_initialized_);
   config_initialized_ = true;
 
-  settings_ = config_->settings();
+  settings_ = config_.settings();
 
   if (!callbacks_->route() || !callbacks_->route()->routeEntry()) {
     return;
diff --git a/source/extensions/filters/http/buffer/buffer_filter.h b/source/extensions/filters/http/buffer/buffer_filter.h
index bc0750374a64..a32d80d4306c 100644
--- a/source/extensions/filters/http/buffer/buffer_filter.h
+++ b/source/extensions/filters/http/buffer/buffer_filter.h
@@ -48,7 +48,7 @@ using BufferFilterConfigSharedPtr = std::shared_ptr<BufferFilterConfig>;
  */
 class BufferFilter : public Http::StreamDecoderFilter {
 public:
-  BufferFilter(BufferFilterConfigSharedPtr config);
+  BufferFilter(BufferFilterConfig& config);
 
   // Http::StreamFilterBase
   void onDestroy() override {}
@@ -64,7 +64,7 @@ class BufferFilter : public Http::StreamDecoderFilter {
   void initConfig();
   void maybeAddContentLength();
 
-  BufferFilterConfigSharedPtr config_;
+  BufferFilterConfig& config_;
   const BufferFilterSettings* settings_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
   Http::RequestHeaderMap* request_headers_{};
diff --git a/source/extensions/filters/http/buffer/config.cc b/source/extensions/filters/http/buffer/config.cc
index 23c18ed50c7d..110c02478561 100644
--- a/source/extensions/filters/http/buffer/config.cc
+++ b/source/extensions/filters/http/buffer/config.cc
@@ -22,7 +22,7 @@ Http::FilterFactoryCb BufferFilterFactory::createFilterFactoryFromProtoTyped(
 
   BufferFilterConfigSharedPtr filter_config(new BufferFilterConfig(proto_config));
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamDecoderFilter(std::make_shared<BufferFilter>(filter_config));
+    callbacks.addStreamDecoderFilter(std::make_shared<BufferFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/common/compressor/compressor.cc b/source/extensions/filters/http/common/compressor/compressor.cc
index c14c42ed6eca..9f2e4a0965e2 100644
--- a/source/extensions/filters/http/common/compressor/compressor.cc
+++ b/source/extensions/filters/http/common/compressor/compressor.cc
@@ -40,7 +40,7 @@ const std::vector<std::string>& defaultContentEncoding() {
 
 // List of CompressorFilterConfig objects registered for a stream.
 struct CompressorRegistry : public StreamInfo::FilterState::Object {
-  std::list<CompressorFilterConfigSharedPtr> filter_configs_;
+  std::list<std::reference_wrapper<CompressorFilterConfig>> filter_configs_;
 };
 
 // Key to per stream CompressorRegistry objects.
@@ -138,8 +138,7 @@ CompressorFilterConfig::ResponseDirectionConfig::commonConfig(
   return config;
 }
 
-CompressorFilter::CompressorFilter(const CompressorFilterConfigSharedPtr config)
-    : config_(std::move(config)) {}
+CompressorFilter::CompressorFilter(CompressorFilterConfig& config) : config_(config) {}
 
 Http::FilterHeadersStatus CompressorFilter::decodeHeaders(Http::RequestHeaderMap& headers,
                                                           bool end_stream) {
@@ -150,21 +149,21 @@ Http::FilterHeadersStatus CompressorFilter::decodeHeaders(Http::RequestHeaderMap
     accept_encoding_ = std::make_unique<std::string>(accept_encoding->value().getStringView());
   }
 
-  const auto& response_config = config_->responseDirectionConfig();
+  const auto& response_config = config_.responseDirectionConfig();
   if (response_config.compressionEnabled() && response_config.removeAcceptEncodingHeader()) {
     headers.removeInline(accept_encoding_handle.handle());
   }
 
-  const auto& request_config = config_->requestDirectionConfig();
+  const auto& request_config = config_.requestDirectionConfig();
   if (!end_stream && request_config.compressionEnabled() &&
       request_config.isMinimumContentLength(headers) &&
       request_config.isContentTypeAllowed(headers) &&
       !headers.getInline(request_content_encoding_handle.handle()) &&
       isTransferEncodingAllowed(headers)) {
     headers.removeContentLength();
-    headers.setInline(request_content_encoding_handle.handle(), config_->contentEncoding());
+    headers.setInline(request_content_encoding_handle.handle(), config_.contentEncoding());
     request_config.stats().compressed_.inc();
-    request_compressor_ = config_->makeCompressor();
+    request_compressor_ = config_.makeCompressor();
   } else {
     request_config.stats().not_compressed_.inc();
   }
@@ -174,7 +173,7 @@ Http::FilterHeadersStatus CompressorFilter::decodeHeaders(Http::RequestHeaderMap
 
 Http::FilterDataStatus CompressorFilter::decodeData(Buffer::Instance& data, bool end_stream) {
   if (request_compressor_ != nullptr) {
-    compressAndUpdateStats(request_compressor_, config_->requestDirectionConfig().stats(), data,
+    compressAndUpdateStats(request_compressor_, config_.requestDirectionConfig().stats(), data,
                            end_stream);
   }
   return Http::FilterDataStatus::Continue;
@@ -186,7 +185,7 @@ Http::FilterTrailersStatus CompressorFilter::decodeTrailers(Http::RequestTrailer
     // The presence of trailers means the stream is ended, but decodeData()
     // is never called with end_stream=true, thus let the compression library know
     // that the stream is ended.
-    compressAndUpdateStats(request_compressor_, config_->requestDirectionConfig().stats(),
+    compressAndUpdateStats(request_compressor_, config_.requestDirectionConfig().stats(),
                            empty_buffer, true);
     decoder_callbacks_->addDecodedData(empty_buffer, true);
   }
@@ -218,7 +217,7 @@ void CompressorFilter::setDecoderFilterCallbacks(Http::StreamDecoderFilterCallba
 
 Http::FilterHeadersStatus CompressorFilter::encodeHeaders(Http::ResponseHeaderMap& headers,
                                                           bool end_stream) {
-  const auto& config = config_->responseDirectionConfig();
+  const auto& config = config_.responseDirectionConfig();
   const bool isEnabledAndContentLengthBigEnough =
       config.compressionEnabled() && config.isMinimumContentLength(headers);
   const bool isCompressible = isEnabledAndContentLengthBigEnough &&
@@ -229,10 +228,10 @@ Http::FilterHeadersStatus CompressorFilter::encodeHeaders(Http::ResponseHeaderMa
       isCompressible && isTransferEncodingAllowed(headers)) {
     sanitizeEtagHeader(headers);
     headers.removeContentLength();
-    headers.setInline(response_content_encoding_handle.handle(), config_->contentEncoding());
+    headers.setInline(response_content_encoding_handle.handle(), config_.contentEncoding());
     config.stats().compressed_.inc();
     // Finally instantiate the compressor.
-    response_compressor_ = config_->makeCompressor();
+    response_compressor_ = config_.makeCompressor();
   } else {
     config.stats().not_compressed_.inc();
   }
@@ -249,7 +248,7 @@ Http::FilterHeadersStatus CompressorFilter::encodeHeaders(Http::ResponseHeaderMa
 
 Http::FilterDataStatus CompressorFilter::encodeData(Buffer::Instance& data, bool end_stream) {
   if (response_compressor_ != nullptr) {
-    compressAndUpdateStats(response_compressor_, config_->responseDirectionConfig().stats(), data,
+    compressAndUpdateStats(response_compressor_, config_.responseDirectionConfig().stats(), data,
                            end_stream);
   }
   return Http::FilterDataStatus::Continue;
@@ -261,7 +260,7 @@ Http::FilterTrailersStatus CompressorFilter::encodeTrailers(Http::ResponseTraile
     // The presence of trailers means the stream is ended, but encodeData()
     // is never called with end_stream=true, thus let the compression library know
     // that the stream is ended.
-    compressAndUpdateStats(response_compressor_, config_->responseDirectionConfig().stats(),
+    compressAndUpdateStats(response_compressor_, config_.responseDirectionConfig().stats(),
                            empty_buffer, true);
     encoder_callbacks_->addEncodedData(empty_buffer, true);
   }
@@ -299,7 +298,7 @@ CompressorFilter::chooseEncoding(const Http::ResponseHeaderMap& headers) const {
   // Find all compressors enabled for the filter chain.
   std::map<std::string, uint32_t> allowed_compressors;
   uint32_t registration_count{0};
-  for (const auto& filter_config :
+  for (CompressorFilterConfig& filter_config :
        decoder_callbacks_->streamInfo()
            .filterState()
            ->getDataReadOnly<CompressorRegistry>(compressorRegistryKey())
@@ -314,10 +313,10 @@ CompressorFilter::chooseEncoding(const Http::ResponseHeaderMap& headers) const {
     // If "gzip" is not excluded from the decision process then it will take precedence over
     // "deflate" and the resulting response won't be compressed at all.
     if (!content_type_value.empty() &&
-        !filter_config->responseDirectionConfig().contentTypeValues().empty()) {
+        !filter_config.responseDirectionConfig().contentTypeValues().empty()) {
       auto iter =
-          filter_config->responseDirectionConfig().contentTypeValues().find(content_type_value);
-      if (iter == filter_config->responseDirectionConfig().contentTypeValues().end()) {
+          filter_config.responseDirectionConfig().contentTypeValues().find(content_type_value);
+      if (iter == filter_config.responseDirectionConfig().contentTypeValues().end()) {
         // Skip adding this filter to the list of allowed compressors.
         continue;
       }
@@ -327,9 +326,9 @@ CompressorFilter::chooseEncoding(const Http::ResponseHeaderMap& headers) const {
     // case when there are two gzip filters using different compression levels for different content
     // sizes. In such case we ignore duplicates (or different filters for the same encoding)
     // registered last.
-    auto enc = allowed_compressors.find(filter_config->contentEncoding());
+    auto enc = allowed_compressors.find(filter_config.contentEncoding());
     if (enc == allowed_compressors.end()) {
-      allowed_compressors.insert({filter_config->contentEncoding(), registration_count});
+      allowed_compressors.insert({filter_config.contentEncoding(), registration_count});
       ++registration_count;
     }
   }
@@ -416,15 +415,15 @@ CompressorFilter::chooseEncoding(const Http::ResponseHeaderMap& headers) const {
 // the Accept-Encoding header.
 bool CompressorFilter::shouldCompress(const CompressorFilter::EncodingDecision& decision) const {
   const bool should_compress =
-      absl::EqualsIgnoreCase(config_->contentEncoding(), decision.encoding());
-  const ResponseCompressorStats& stats = config_->responseDirectionConfig().responseStats();
+      absl::EqualsIgnoreCase(config_.contentEncoding(), decision.encoding());
+  const ResponseCompressorStats& stats = config_.responseDirectionConfig().responseStats();
 
   switch (decision.stat()) {
   case CompressorFilter::EncodingDecision::HeaderStat::ValidCompressor:
     if (should_compress) {
       stats.header_compressor_used_.inc();
       // TODO(rojkov): Remove this increment when the gzip-specific stat is gone.
-      if (absl::EqualsIgnoreCase("gzip", config_->contentEncoding())) {
+      if (absl::EqualsIgnoreCase("gzip", config_.contentEncoding())) {
         stats.header_gzip_.inc();
       }
     } else {
@@ -449,7 +448,7 @@ bool CompressorFilter::shouldCompress(const CompressorFilter::EncodingDecision&
 
 bool CompressorFilter::isAcceptEncodingAllowed(const Http::ResponseHeaderMap& headers) const {
   if (accept_encoding_ == nullptr) {
-    config_->responseDirectionConfig().responseStats().no_accept_header_.inc();
+    config_.responseDirectionConfig().responseStats().no_accept_header_.inc();
     return false;
   }
 
@@ -485,10 +484,10 @@ bool CompressorFilterConfig::DirectionConfig::isContentTypeAllowed(
 }
 
 bool CompressorFilter::isEtagAllowed(Http::ResponseHeaderMap& headers) const {
-  const bool is_etag_allowed = !(config_->responseDirectionConfig().disableOnEtagHeader() &&
+  const bool is_etag_allowed = !(config_.responseDirectionConfig().disableOnEtagHeader() &&
                                  headers.getInline(etag_handle.handle()));
   if (!is_etag_allowed) {
-    config_->responseDirectionConfig().responseStats().not_compressed_etag_.inc();
+    config_.responseDirectionConfig().responseStats().not_compressed_etag_.inc();
   }
   return is_etag_allowed;
 }
@@ -528,7 +527,7 @@ bool CompressorFilter::isTransferEncodingAllowed(Http::RequestOrResponseHeaderMa
                                  Http::Headers::get().TransferEncodingValues.Compress) ||
           // or with a custom non-standard compression provided by an external
           // compression library.
-          absl::EqualsIgnoreCase(trimmed_value, config_->contentEncoding())) {
+          absl::EqualsIgnoreCase(trimmed_value, config_.contentEncoding())) {
         return false;
       }
     }
diff --git a/source/extensions/filters/http/common/compressor/compressor.h b/source/extensions/filters/http/common/compressor/compressor.h
index c18cc1aaccf9..0389be1727b1 100644
--- a/source/extensions/filters/http/common/compressor/compressor.h
+++ b/source/extensions/filters/http/common/compressor/compressor.h
@@ -168,7 +168,7 @@ using CompressorFilterConfigSharedPtr = std::shared_ptr<CompressorFilterConfig>;
  */
 class CompressorFilter : public Http::PassThroughFilter {
 public:
-  explicit CompressorFilter(const CompressorFilterConfigSharedPtr config);
+  explicit CompressorFilter(CompressorFilterConfig& config);
 
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap& headers,
@@ -210,7 +210,7 @@ class CompressorFilter : public Http::PassThroughFilter {
 
   Envoy::Compression::Compressor::CompressorPtr response_compressor_;
   Envoy::Compression::Compressor::CompressorPtr request_compressor_;
-  const CompressorFilterConfigSharedPtr config_;
+  CompressorFilterConfig& config_;
   std::unique_ptr<std::string> accept_encoding_;
 };
 
diff --git a/source/extensions/filters/http/compressor/config.cc b/source/extensions/filters/http/compressor/config.cc
index aff3ca5afe4c..65a95f74e91d 100644
--- a/source/extensions/filters/http/compressor/config.cc
+++ b/source/extensions/filters/http/compressor/config.cc
@@ -37,7 +37,7 @@ Http::FilterFactoryCb CompressorFilterFactory::createFilterFactoryFromProtoTyped
       std::make_shared<CompressorFilterConfig>(proto_config, stats_prefix, context.scope(),
                                                context.runtime(), std::move(compressor_factory));
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<Common::Compressors::CompressorFilter>(config));
+    callbacks.addStreamFilter(std::make_shared<Common::Compressors::CompressorFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/cors/config.cc b/source/extensions/filters/http/cors/config.cc
index 4a97416e714c..4f2ca2336970 100644
--- a/source/extensions/filters/http/cors/config.cc
+++ b/source/extensions/filters/http/cors/config.cc
@@ -15,7 +15,7 @@ Http::FilterFactoryCb CorsFilterFactory::createFilterFactoryFromProtoTyped(
   CorsFilterConfigSharedPtr config =
       std::make_shared<CorsFilterConfig>(stats_prefix, context.scope());
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<CorsFilter>(config));
+    callbacks.addStreamFilter(std::make_shared<CorsFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/cors/cors_filter.cc b/source/extensions/filters/http/cors/cors_filter.cc
index e936b16c8f24..bf180307c78e 100644
--- a/source/extensions/filters/http/cors/cors_filter.cc
+++ b/source/extensions/filters/http/cors/cors_filter.cc
@@ -40,8 +40,8 @@ Http::RegisterCustomInlineHeader<Http::CustomInlineHeaderRegistry::Type::Respons
 CorsFilterConfig::CorsFilterConfig(const std::string& stats_prefix, Stats::Scope& scope)
     : stats_(generateStats(stats_prefix + "cors.", scope)) {}
 
-CorsFilter::CorsFilter(CorsFilterConfigSharedPtr config)
-    : policies_({{nullptr, nullptr}}), config_(std::move(config)) {}
+CorsFilter::CorsFilter(CorsFilterConfig& config)
+    : policies_({{nullptr, nullptr}}), config_(config) {}
 
 // This handles the CORS preflight request as described in
 // https://www.w3.org/TR/cors/#resource-preflight-requests
@@ -66,11 +66,11 @@ Http::FilterHeadersStatus CorsFilter::decodeHeaders(Http::RequestHeaderMap& head
   }
 
   if (!isOriginAllowed(origin_->value())) {
-    config_->stats().origin_invalid_.inc();
+    config_.stats().origin_invalid_.inc();
     return Http::FilterHeadersStatus::Continue;
   }
 
-  config_->stats().origin_valid_.inc();
+  config_.stats().origin_valid_.inc();
   if (shadowEnabled() && !enabled()) {
     return Http::FilterHeadersStatus::Continue;
   }
diff --git a/source/extensions/filters/http/cors/cors_filter.h b/source/extensions/filters/http/cors/cors_filter.h
index 6603469055a7..79bc1a92be7b 100644
--- a/source/extensions/filters/http/cors/cors_filter.h
+++ b/source/extensions/filters/http/cors/cors_filter.h
@@ -44,7 +44,7 @@ using CorsFilterConfigSharedPtr = std::shared_ptr<CorsFilterConfig>;
 
 class CorsFilter : public Http::StreamFilter {
 public:
-  CorsFilter(CorsFilterConfigSharedPtr config);
+  CorsFilter(CorsFilterConfig& config);
 
   // Http::StreamFilterBase
   void onDestroy() override {}
@@ -98,7 +98,7 @@ class CorsFilter : public Http::StreamFilter {
   bool is_cors_request_{};
   const Http::HeaderEntry* origin_{};
 
-  CorsFilterConfigSharedPtr config_;
+  CorsFilterConfig& config_;
 };
 
 } // namespace Cors
diff --git a/source/extensions/filters/http/csrf/config.cc b/source/extensions/filters/http/csrf/config.cc
index 34e1fbd92f74..d66af2f0a20a 100644
--- a/source/extensions/filters/http/csrf/config.cc
+++ b/source/extensions/filters/http/csrf/config.cc
@@ -17,7 +17,7 @@ Http::FilterFactoryCb CsrfFilterFactory::createFilterFactoryFromProtoTyped(
   CsrfFilterConfigSharedPtr config =
       std::make_shared<CsrfFilterConfig>(policy, stats_prefix, context.scope(), context.runtime());
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamDecoderFilter(std::make_shared<CsrfFilter>(config));
+    callbacks.addStreamDecoderFilter(std::make_shared<CsrfFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/csrf/csrf_filter.cc b/source/extensions/filters/http/csrf/csrf_filter.cc
index 01fe2f38127a..4cbc742f166f 100644
--- a/source/extensions/filters/http/csrf/csrf_filter.cc
+++ b/source/extensions/filters/http/csrf/csrf_filter.cc
@@ -88,7 +88,7 @@ CsrfFilterConfig::CsrfFilterConfig(
     const std::string& stats_prefix, Stats::Scope& scope, Runtime::Loader& runtime)
     : stats_(generateStats(stats_prefix, scope)), policy_(generatePolicy(policy, runtime)) {}
 
-CsrfFilter::CsrfFilter(const CsrfFilterConfigSharedPtr config) : config_(config) {}
+CsrfFilter::CsrfFilter(CsrfFilterConfig& config) : config_(config) {}
 
 Http::FilterHeadersStatus CsrfFilter::decodeHeaders(Http::RequestHeaderMap& headers, bool) {
   determinePolicy();
@@ -105,16 +105,16 @@ Http::FilterHeadersStatus CsrfFilter::decodeHeaders(Http::RequestHeaderMap& head
   const auto source_origin = sourceOriginValue(headers);
   if (source_origin.empty()) {
     is_valid = false;
-    config_->stats().missing_source_origin_.inc();
+    config_.stats().missing_source_origin_.inc();
   }
 
   if (!isValid(source_origin, headers)) {
     is_valid = false;
-    config_->stats().request_invalid_.inc();
+    config_.stats().request_invalid_.inc();
   }
 
   if (is_valid == true) {
-    config_->stats().request_valid_.inc();
+    config_.stats().request_valid_.inc();
     return Http::FilterHeadersStatus::Continue;
   }
 
@@ -134,7 +134,7 @@ void CsrfFilter::determinePolicy() {
   if (policy != nullptr) {
     policy_ = policy;
   } else {
-    policy_ = config_->policy();
+    policy_ = config_.policy();
   }
 }
 
diff --git a/source/extensions/filters/http/csrf/csrf_filter.h b/source/extensions/filters/http/csrf/csrf_filter.h
index 69e88ff858b0..31c4936ae2ca 100644
--- a/source/extensions/filters/http/csrf/csrf_filter.h
+++ b/source/extensions/filters/http/csrf/csrf_filter.h
@@ -90,7 +90,7 @@ using CsrfFilterConfigSharedPtr = std::shared_ptr<CsrfFilterConfig>;
 
 class CsrfFilter : public Http::StreamDecoderFilter {
 public:
-  CsrfFilter(CsrfFilterConfigSharedPtr config);
+  CsrfFilter(CsrfFilterConfig& config);
 
   // Http::StreamFilterBase
   void onDestroy() override {}
@@ -113,7 +113,7 @@ class CsrfFilter : public Http::StreamDecoderFilter {
   bool isValid(const absl::string_view source_origin, Http::RequestHeaderMap& headers);
 
   Http::StreamDecoderFilterCallbacks* callbacks_{};
-  CsrfFilterConfigSharedPtr config_;
+  CsrfFilterConfig& config_;
   const CsrfPolicy* policy_;
 };
 
diff --git a/source/extensions/filters/http/decompressor/config.cc b/source/extensions/filters/http/decompressor/config.cc
index fb52ae85c216..4c416df46777 100644
--- a/source/extensions/filters/http/decompressor/config.cc
+++ b/source/extensions/filters/http/decompressor/config.cc
@@ -33,7 +33,7 @@ Http::FilterFactoryCb DecompressorFilterFactory::createFilterFactoryFromProtoTyp
       proto_config, stats_prefix, context.scope(), context.runtime(),
       std::move(decompressor_factory));
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<DecompressorFilter>(filter_config));
+    callbacks.addStreamFilter(std::make_shared<DecompressorFilter>(*filter_config));
   };
 }
 
@@ -45,4 +45,4 @@ REGISTER_FACTORY(DecompressorFilterFactory, Server::Configuration::NamedHttpFilt
 } // namespace Decompressor
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/source/extensions/filters/http/decompressor/decompressor_filter.cc b/source/extensions/filters/http/decompressor/decompressor_filter.cc
index e4ef982714e5..91014d26c3e5 100644
--- a/source/extensions/filters/http/decompressor/decompressor_filter.cc
+++ b/source/extensions/filters/http/decompressor/decompressor_filter.cc
@@ -58,20 +58,20 @@ DecompressorFilterConfig::ResponseDirectionConfig::ResponseDirectionConfig(
     const std::string& stats_prefix, Stats::Scope& scope, Runtime::Loader& runtime)
     : DirectionConfig(proto_config.common_config(), stats_prefix + "response.", scope, runtime) {}
 
-DecompressorFilter::DecompressorFilter(DecompressorFilterConfigSharedPtr config)
-    : config_(std::move(config)), request_byte_tracker_(config_->trailersCompressedBytesString(),
-                                                        config_->trailersUncompressedBytesString()),
-      response_byte_tracker_(config_->trailersCompressedBytesString(),
-                             config_->trailersUncompressedBytesString()) {}
+DecompressorFilter::DecompressorFilter(DecompressorFilterConfig& config)
+    : config_(config), request_byte_tracker_(config_.trailersCompressedBytesString(),
+                                             config_.trailersUncompressedBytesString()),
+      response_byte_tracker_(config_.trailersCompressedBytesString(),
+                             config_.trailersUncompressedBytesString()) {}
 
 Http::FilterHeadersStatus DecompressorFilter::decodeHeaders(Http::RequestHeaderMap& headers,
                                                             bool end_stream) {
   // Two responsibilities on the request side:
   //   1. If response decompression is enabled (and advertisement is enabled), then advertise to
   //      the upstream that this hop is able to decompress responses via the Accept-Encoding header.
-  if (config_->responseDirectionConfig().decompressionEnabled() &&
-      config_->requestDirectionConfig().advertiseAcceptEncoding()) {
-    headers.appendInline(accept_encoding_handle.handle(), config_->contentEncoding(), ",");
+  if (config_.responseDirectionConfig().decompressionEnabled() &&
+      config_.requestDirectionConfig().advertiseAcceptEncoding()) {
+    headers.appendInline(accept_encoding_handle.handle(), config_.contentEncoding(), ",");
     ENVOY_STREAM_LOG(debug,
                      "DecompressorFilter::decodeHeaders advertise Accept-Encoding with value '{}'",
                      *decoder_callbacks_, headers.getInlineValue(accept_encoding_handle.handle()));
@@ -84,7 +84,7 @@ Http::FilterHeadersStatus DecompressorFilter::decodeHeaders(Http::RequestHeaderM
   ENVOY_STREAM_LOG(debug, "DecompressorFilter::decodeHeaders: {}", *decoder_callbacks_, headers);
 
   //   2. Setup request decompression if all checks comply.
-  return maybeInitDecompress(config_->requestDirectionConfig(), request_decompressor_,
+  return maybeInitDecompress(config_.requestDirectionConfig(), request_decompressor_,
                              *decoder_callbacks_, headers);
 };
 
@@ -94,7 +94,7 @@ Http::FilterDataStatus DecompressorFilter::decodeData(Buffer::Instance& data, bo
     if (end_stream) {
       trailers = HeaderMapOptRef(std::ref(decoder_callbacks_->addDecodedTrailers()));
     }
-    decompress(config_->requestDirectionConfig(), request_decompressor_, *decoder_callbacks_, data,
+    decompress(config_.requestDirectionConfig(), request_decompressor_, *decoder_callbacks_, data,
                request_byte_tracker_, trailers);
   }
   return Http::FilterDataStatus::Continue;
@@ -116,7 +116,7 @@ Http::FilterHeadersStatus DecompressorFilter::encodeHeaders(Http::ResponseHeader
   }
   ENVOY_STREAM_LOG(debug, "DecompressorFilter::encodeHeaders: {}", *encoder_callbacks_, headers);
 
-  return maybeInitDecompress(config_->responseDirectionConfig(), response_decompressor_,
+  return maybeInitDecompress(config_.responseDirectionConfig(), response_decompressor_,
                              *encoder_callbacks_, headers);
 }
 
@@ -126,8 +126,8 @@ Http::FilterDataStatus DecompressorFilter::encodeData(Buffer::Instance& data, bo
     if (end_stream) {
       trailers = HeaderMapOptRef(std::ref(encoder_callbacks_->addEncodedTrailers()));
     }
-    decompress(config_->responseDirectionConfig(), response_decompressor_, *encoder_callbacks_,
-               data, response_byte_tracker_, trailers);
+    decompress(config_.responseDirectionConfig(), response_decompressor_, *encoder_callbacks_, data,
+               response_byte_tracker_, trailers);
   }
   return Http::FilterDataStatus::Continue;
 }
@@ -191,4 +191,4 @@ DecompressorFilter::getContentEncodingHandle() {
 } // namespace Decompressor
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/source/extensions/filters/http/decompressor/decompressor_filter.h b/source/extensions/filters/http/decompressor/decompressor_filter.h
index 83ad541ce76e..a982c6000da8 100644
--- a/source/extensions/filters/http/decompressor/decompressor_filter.h
+++ b/source/extensions/filters/http/decompressor/decompressor_filter.h
@@ -126,7 +126,7 @@ using DecompressorFilterConfigSharedPtr = std::shared_ptr<DecompressorFilterConf
 class DecompressorFilter : public Http::PassThroughFilter,
                            public Logger::Loggable<Logger::Id::filter> {
 public:
-  DecompressorFilter(DecompressorFilterConfigSharedPtr config);
+  DecompressorFilter(DecompressorFilterConfig& config);
 
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap&, bool) override;
@@ -169,7 +169,7 @@ class DecompressorFilter : public Http::PassThroughFilter,
     if (direction_config.decompressionEnabled() && !hasCacheControlNoTransform(headers) &&
         contentEncodingMatches(headers)) {
       direction_config.stats().decompressed_.inc();
-      decompressor = config_->makeDecompressor();
+      decompressor = config_.makeDecompressor();
 
       // Update headers.
       headers.removeContentLength();
@@ -215,7 +215,7 @@ class DecompressorFilter : public Http::PassThroughFilter,
     if (headers.getInline(handle)) {
       absl::string_view coding =
           StringUtil::trim(StringUtil::cropRight(headers.getInlineValue(handle), ","));
-      return StringUtil::CaseInsensitiveCompare()(config_->contentEncoding(), coding);
+      return StringUtil::CaseInsensitiveCompare()(config_.contentEncoding(), coding);
     }
     return false;
   }
@@ -232,7 +232,7 @@ class DecompressorFilter : public Http::PassThroughFilter,
     }
   }
 
-  DecompressorFilterConfigSharedPtr config_;
+  DecompressorFilterConfig& config_;
   Compression::Decompressor::DecompressorPtr request_decompressor_{};
   Compression::Decompressor::DecompressorPtr response_decompressor_{};
   ByteTracker request_byte_tracker_;
@@ -242,4 +242,4 @@ class DecompressorFilter : public Http::PassThroughFilter,
 } // namespace Decompressor
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/config.cc b/source/extensions/filters/http/dynamic_forward_proxy/config.cc
index 1907801bfa1d..3862952e97ef 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/config.cc
+++ b/source/extensions/filters/http/dynamic_forward_proxy/config.cc
@@ -20,7 +20,7 @@ Http::FilterFactoryCb DynamicForwardProxyFilterFactory::createFilterFactoryFromP
   ProxyFilterConfigSharedPtr filter_config(std::make_shared<ProxyFilterConfig>(
       proto_config, cache_manager_factory, context.clusterManager()));
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamDecoderFilter(std::make_shared<ProxyFilter>(filter_config));
+    callbacks.addStreamDecoderFilter(std::make_shared<ProxyFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc
index 3aaa47ac2c34..0347e4a16d30 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc
+++ b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.cc
@@ -54,7 +54,7 @@ Http::FilterHeadersStatus ProxyFilter::decodeHeaders(Http::RequestHeaderMap& hea
   }
 
   Upstream::ThreadLocalCluster* cluster =
-      config_->clusterManager().getThreadLocalCluster(route_entry->clusterName());
+      config_.clusterManager().getThreadLocalCluster(route_entry->clusterName());
   if (!cluster) {
     return Http::FilterHeadersStatus::Continue;
   }
@@ -74,7 +74,7 @@ Http::FilterHeadersStatus ProxyFilter::decodeHeaders(Http::RequestHeaderMap& hea
   const bool should_use_dns_cache_circuit_breakers =
       Runtime::runtimeFeatureEnabled("envoy.reloadable_features.enable_dns_cache_circuit_breakers");
 
-  circuit_breaker_ = config_->cache().canCreateDnsRequest(
+  circuit_breaker_ = config_.cache().canCreateDnsRequest(
       !should_use_dns_cache_circuit_breakers
           ? absl::make_optional(std::reference_wrapper<ResourceLimit>(
                 cluster_info_->resourceManager(route_entry->priority()).pendingRequests()))
@@ -124,8 +124,8 @@ Http::FilterHeadersStatus ProxyFilter::decodeHeaders(Http::RequestHeaderMap& hea
   //                     not obvious to the user if something is misconfigured. We should see if
   //                     we can do better here, perhaps by checking the cache to see if anything
   //                     else is attached to it or something else?
-  auto result = config_->cache().loadDnsCacheEntry(headers.Host()->value().getStringView(),
-                                                   default_port, *this);
+  auto result = config_.cache().loadDnsCacheEntry(headers.Host()->value().getStringView(),
+                                                  default_port, *this);
   cache_load_handle_ = std::move(result.handle_);
   if (cache_load_handle_ == nullptr) {
     circuit_breaker_.reset();
diff --git a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h
index 8a786d14d75c..baace73d97c7 100644
--- a/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h
+++ b/source/extensions/filters/http/dynamic_forward_proxy/proxy_filter.h
@@ -47,7 +47,7 @@ class ProxyFilter
       public Extensions::Common::DynamicForwardProxy::DnsCache::LoadDnsCacheEntryCallbacks,
       Logger::Loggable<Logger::Id::forward_proxy> {
 public:
-  ProxyFilter(const ProxyFilterConfigSharedPtr& config) : config_(config) {}
+  ProxyFilter(ProxyFilterConfig& config) : config_(config) {}
 
   // Http::PassThroughDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap& headers,
@@ -58,7 +58,7 @@ class ProxyFilter
   void onLoadDnsCacheComplete() override;
 
 private:
-  const ProxyFilterConfigSharedPtr config_;
+  ProxyFilterConfig& config_;
   Upstream::ClusterInfoConstSharedPtr cluster_info_;
   Upstream::ResourceAutoIncDecPtr circuit_breaker_;
   Extensions::Common::DynamicForwardProxy::DnsCache::LoadDnsCacheEntryHandlePtr cache_load_handle_;
diff --git a/source/extensions/filters/http/dynamo/dynamo_filter.cc b/source/extensions/filters/http/dynamo/dynamo_filter.cc
index 4be293580b8b..3f82d076885d 100644
--- a/source/extensions/filters/http/dynamo/dynamo_filter.cc
+++ b/source/extensions/filters/http/dynamo/dynamo_filter.cc
@@ -63,7 +63,7 @@ void DynamoFilter::onDecodeComplete(const Buffer::Instance& data) {
       table_descriptor_ = RequestParser::parseTable(operation_, *json_body);
     } catch (const Json::Exception& jsonEx) {
       // Body parsing failed. This should not happen, just put a stat for that.
-      stats_->incCounter({stats_->invalid_req_body_});
+      stats_.incCounter({stats_.invalid_req_body_});
     }
   }
 }
@@ -90,7 +90,7 @@ void DynamoFilter::onEncodeComplete(const Buffer::Instance& data) {
       }
     } catch (const Json::Exception&) {
       // Body parsing failed. This should not happen, just put a stat for that.
-      stats_->incCounter({stats_->invalid_resp_body_});
+      stats_.incCounter({stats_.invalid_resp_body_});
     }
   }
 }
@@ -155,15 +155,15 @@ void DynamoFilter::chargeBasicStats(uint64_t status) {
   if (!operation_.empty()) {
     chargeStatsPerEntity(operation_, "operation", status);
   } else {
-    stats_->incCounter({stats_->operation_missing_});
+    stats_.incCounter({stats_.operation_missing_});
   }
 
   if (!table_descriptor_.table_name.empty()) {
     chargeStatsPerEntity(table_descriptor_.table_name, "table", status);
   } else if (table_descriptor_.is_single_table) {
-    stats_->incCounter({stats_->table_missing_});
+    stats_.incCounter({stats_.table_missing_});
   } else {
-    stats_->incCounter({stats_->multiple_tables_});
+    stats_.incCounter({stats_.multiple_tables_});
   }
 }
 
@@ -173,10 +173,10 @@ void DynamoFilter::chargeStatsPerEntity(const std::string& entity, const std::st
       time_source_.monotonicTime() - start_decode_);
 
   size_t group_index = DynamoStats::groupIndex(status);
-  Stats::StatNameDynamicPool dynamic(stats_->symbolTable());
+  Stats::StatNameDynamicPool dynamic(stats_.symbolTable());
 
   const Stats::StatName entity_type_name =
-      stats_->getBuiltin(entity_type, stats_->unknown_entity_type_);
+      stats_.getBuiltin(entity_type, stats_.unknown_entity_type_);
   const Stats::StatName entity_name = dynamic.add(entity);
 
   // TODO(jmarantz): Consider using a similar mechanism to common/http/codes.cc
@@ -184,18 +184,18 @@ void DynamoFilter::chargeStatsPerEntity(const std::string& entity, const std::st
   const Stats::StatName total_name = dynamic.add(absl::StrCat("upstream_rq_total_", status));
   const Stats::StatName time_name = dynamic.add(absl::StrCat("upstream_rq_time_", status));
 
-  stats_->incCounter({entity_type_name, entity_name, stats_->upstream_rq_total_});
-  const Stats::StatName total_group = stats_->upstream_rq_total_groups_[group_index];
-  stats_->incCounter({entity_type_name, entity_name, total_group});
-  stats_->incCounter({entity_type_name, entity_name, total_name});
-
-  stats_->recordHistogram({entity_type_name, entity_name, stats_->upstream_rq_time_},
-                          Stats::Histogram::Unit::Milliseconds, latency.count());
-  const Stats::StatName time_group = stats_->upstream_rq_time_groups_[group_index];
-  stats_->recordHistogram({entity_type_name, entity_name, time_group},
-                          Stats::Histogram::Unit::Milliseconds, latency.count());
-  stats_->recordHistogram({entity_type_name, entity_name, time_name},
-                          Stats::Histogram::Unit::Milliseconds, latency.count());
+  stats_.incCounter({entity_type_name, entity_name, stats_.upstream_rq_total_});
+  const Stats::StatName total_group = stats_.upstream_rq_total_groups_[group_index];
+  stats_.incCounter({entity_type_name, entity_name, total_group});
+  stats_.incCounter({entity_type_name, entity_name, total_name});
+
+  stats_.recordHistogram({entity_type_name, entity_name, stats_.upstream_rq_time_},
+                         Stats::Histogram::Unit::Milliseconds, latency.count());
+  const Stats::StatName time_group = stats_.upstream_rq_time_groups_[group_index];
+  stats_.recordHistogram({entity_type_name, entity_name, time_group},
+                         Stats::Histogram::Unit::Milliseconds, latency.count());
+  stats_.recordHistogram({entity_type_name, entity_name, time_name},
+                         Stats::Histogram::Unit::Milliseconds, latency.count());
 }
 
 void DynamoFilter::chargeUnProcessedKeysStats(const Json::Object& json_body) {
@@ -203,9 +203,8 @@ void DynamoFilter::chargeUnProcessedKeysStats(const Json::Object& json_body) {
   // complete apart of the batch operation. Only the table names will be logged for errors.
   std::vector<std::string> unprocessed_tables = RequestParser::parseBatchUnProcessedKeys(json_body);
   for (const std::string& unprocessed_table : unprocessed_tables) {
-    Stats::StatNameDynamicStorage storage(unprocessed_table, stats_->symbolTable());
-    stats_->incCounter(
-        {stats_->error_, storage.statName(), stats_->batch_failure_unprocessed_keys_});
+    Stats::StatNameDynamicStorage storage(unprocessed_table, stats_.symbolTable());
+    stats_.incCounter({stats_.error_, storage.statName(), stats_.batch_failure_unprocessed_keys_});
   }
 }
 
@@ -213,15 +212,15 @@ void DynamoFilter::chargeFailureSpecificStats(const Json::Object& json_body) {
   std::string error_type = RequestParser::parseErrorType(json_body);
 
   if (!error_type.empty()) {
-    Stats::StatNameDynamicPool dynamic(stats_->symbolTable());
+    Stats::StatNameDynamicPool dynamic(stats_.symbolTable());
     if (table_descriptor_.table_name.empty()) {
-      stats_->incCounter({stats_->error_, stats_->no_table_, dynamic.add(error_type)});
+      stats_.incCounter({stats_.error_, stats_.no_table_, dynamic.add(error_type)});
     } else {
-      stats_->incCounter(
-          {stats_->error_, dynamic.add(table_descriptor_.table_name), dynamic.add(error_type)});
+      stats_.incCounter(
+          {stats_.error_, dynamic.add(table_descriptor_.table_name), dynamic.add(error_type)});
     }
   } else {
-    stats_->incCounter({stats_->empty_response_body_});
+    stats_.incCounter({stats_.empty_response_body_});
   }
 }
 
diff --git a/source/extensions/filters/http/dynamo/dynamo_filter.h b/source/extensions/filters/http/dynamo/dynamo_filter.h
index d341c801cad6..001c6d157ade 100644
--- a/source/extensions/filters/http/dynamo/dynamo_filter.h
+++ b/source/extensions/filters/http/dynamo/dynamo_filter.h
@@ -25,7 +25,7 @@ namespace Dynamo {
  */
 class DynamoFilter : public Http::StreamFilter {
 public:
-  DynamoFilter(Runtime::Loader& runtime, const DynamoStatsSharedPtr& stats, TimeSource& time_source)
+  DynamoFilter(Runtime::Loader& runtime, DynamoStatsS& stats, TimeSource& time_source)
       : runtime_(runtime), stats_(stats), time_source_(time_source) {
     enabled_ = runtime_.snapshot().featureEnabled("dynamodb.filter_enabled", 100);
   }
@@ -68,7 +68,7 @@ class DynamoFilter : public Http::StreamFilter {
   void chargeTablePartitionIdStats(const Json::Object& json_body);
 
   Runtime::Loader& runtime_;
-  const DynamoStatsSharedPtr stats_;
+  DynamoStats& stats_;
 
   bool enabled_{};
   std::string operation_{};
diff --git a/source/extensions/filters/http/ext_authz/config.cc b/source/extensions/filters/http/ext_authz/config.cc
index 5446cb7a55c2..954e42a59f15 100644
--- a/source/extensions/filters/http/ext_authz/config.cc
+++ b/source/extensions/filters/http/ext_authz/config.cc
@@ -40,7 +40,7 @@ Http::FilterFactoryCb ExtAuthzFilterConfig::createFilterFactoryFromProtoTyped(
       auto client = std::make_unique<Extensions::Filters::Common::ExtAuthz::RawHttpClientImpl>(
           context.clusterManager(), client_config);
       callbacks.addStreamDecoderFilter(Http::StreamDecoderFilterSharedPtr{
-          std::make_shared<Filter>(filter_config, std::move(client))});
+          std::make_shared<Filter>(*filter_config, std::move(client))});
     };
   } else if (proto_config.grpc_service().has_google_grpc()) {
     // Google gRPC client.
@@ -66,7 +66,7 @@ Http::FilterFactoryCb ExtAuthzFilterConfig::createFilterFactoryFromProtoTyped(
           async_client_cache->getAsyncClient(), std::chrono::milliseconds(timeout_ms),
           transport_api_version);
       callbacks.addStreamDecoderFilter(Http::StreamDecoderFilterSharedPtr{
-          std::make_shared<Filter>(filter_config, std::move(client))});
+          std::make_shared<Filter>(*filter_config, std::move(client))});
     };
   } else {
     // Envoy gRPC client.
@@ -89,7 +89,7 @@ Http::FilterFactoryCb ExtAuthzFilterConfig::createFilterFactoryFromProtoTyped(
           async_client_factory->create(), std::chrono::milliseconds(timeout_ms),
           transport_api_version);
       callbacks.addStreamDecoderFilter(Http::StreamDecoderFilterSharedPtr{
-          std::make_shared<Filter>(filter_config, std::move(client))});
+          std::make_shared<Filter>(*filter_config, std::move(client))});
     };
   }
 
diff --git a/source/extensions/filters/http/ext_authz/ext_authz.cc b/source/extensions/filters/http/ext_authz/ext_authz.cc
index 37247272d879..2d7765110c3d 100644
--- a/source/extensions/filters/http/ext_authz/ext_authz.cc
+++ b/source/extensions/filters/http/ext_authz/ext_authz.cc
@@ -54,7 +54,7 @@ void Filter::initiateCall(const Http::RequestHeaderMap& headers,
   // If metadata_context_namespaces is specified, pass matching metadata to the ext_authz service.
   envoy::config::core::v3::Metadata metadata_context;
   const auto& request_metadata = callbacks_->streamInfo().dynamicMetadata().filter_metadata();
-  for (const auto& context_key : config_->metadataContextNamespaces()) {
+  for (const auto& context_key : config_.metadataContextNamespaces()) {
     const auto& metadata_it = request_metadata.find(context_key);
     if (metadata_it != request_metadata.end()) {
       (*metadata_context.mutable_filter_metadata())[metadata_it->first] = metadata_it->second;
@@ -63,8 +63,8 @@ void Filter::initiateCall(const Http::RequestHeaderMap& headers,
 
   Filters::Common::ExtAuthz::CheckRequestUtils::createHttpCheck(
       callbacks_, headers, std::move(context_extensions), std::move(metadata_context),
-      check_request_, config_->maxRequestBytes(), config_->packAsBytes(),
-      config_->includePeerCertificate());
+      check_request_, config_.maxRequestBytes(), config_.packAsBytes(),
+      config_.includePeerCertificate());
 
   ENVOY_STREAM_LOG(trace, "ext_authz filter calling authorization server", *callbacks_);
   state_ = State::Calling;
@@ -84,13 +84,13 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
     return Http::FilterHeadersStatus::Continue;
   }
 
-  if (!config_->filterEnabled(callbacks_->streamInfo().dynamicMetadata())) {
+  if (!config_.filterEnabled(callbacks_->streamInfo().dynamicMetadata())) {
     stats_.disabled_.inc();
-    if (config_->denyAtDisable()) {
+    if (config_.denyAtDisable()) {
       ENVOY_STREAM_LOG(trace, "ext_authz filter is disabled. Deny the request.", *callbacks_);
       callbacks_->streamInfo().setResponseFlag(
           StreamInfo::ResponseFlag::UnauthorizedExternalService);
-      callbacks_->sendLocalReply(config_->statusOnError(), EMPTY_STRING, nullptr, absl::nullopt,
+      callbacks_->sendLocalReply(config_.statusOnError(), EMPTY_STRING, nullptr, absl::nullopt,
                                  RcDetails::get().AuthzError);
       return Http::FilterHeadersStatus::StopIteration;
     }
@@ -98,14 +98,14 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
   }
 
   request_headers_ = &headers;
-  buffer_data_ = config_->withRequestBody() && !per_route_flags.skip_request_body_buffering_ &&
+  buffer_data_ = config_.withRequestBody() && !per_route_flags.skip_request_body_buffering_ &&
                  !(end_stream || Http::Utility::isWebSocketUpgradeRequest(headers) ||
                    Http::Utility::isH2UpgradeRequest(headers));
 
   if (buffer_data_) {
     ENVOY_STREAM_LOG(debug, "ext_authz filter is buffering the request", *callbacks_);
-    if (!config_->allowPartialMessage()) {
-      callbacks_->setDecoderBufferLimit(config_->maxRequestBytes());
+    if (!config_.allowPartialMessage()) {
+      callbacks_->setDecoderBufferLimit(config_.maxRequestBytes());
     }
     return Http::FilterHeadersStatus::StopIteration;
   }
@@ -173,7 +173,7 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
     // Any changes to request headers can affect how the request is going to be
     // routed. If we are changing the headers we also need to clear the route
     // cache.
-    if (config_->clearRouteCache() &&
+    if (config_.clearRouteCache() &&
         (!response->headers_to_set.empty() || !response->headers_to_append.empty() ||
          !response->headers_to_remove.empty())) {
       ENVOY_STREAM_LOG(debug, "ext_authz is clearing route cache", *callbacks_);
@@ -225,7 +225,7 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
     }
 
     if (cluster_) {
-      config_->incCounter(cluster_->statsScope(), config_->ext_authz_ok_);
+      config_.incCounter(cluster_->statsScope(), config_.ext_authz_ok_);
     }
     stats_.ok_.inc();
     continueDecoding();
@@ -238,9 +238,9 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
     stats_.denied_.inc();
 
     if (cluster_) {
-      config_->incCounter(cluster_->statsScope(), config_->ext_authz_denied_);
+      config_.incCounter(cluster_->statsScope(), config_.ext_authz_denied_);
 
-      Http::CodeStats::ResponseStatInfo info{config_->scope(),
+      Http::CodeStats::ResponseStatInfo info{config_.scope(),
                                              cluster_->statsScope(),
                                              empty_stat_name,
                                              enumToInt(response->status_code),
@@ -250,7 +250,7 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
                                              empty_stat_name,
                                              empty_stat_name,
                                              false};
-      config_->httpContext().codeStats().chargeResponseStat(info);
+      config_.httpContext().codeStats().chargeResponseStat(info);
     }
 
     callbacks_->sendLocalReply(
@@ -278,23 +278,23 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
 
   case CheckStatus::Error: {
     if (cluster_) {
-      config_->incCounter(cluster_->statsScope(), config_->ext_authz_error_);
+      config_.incCounter(cluster_->statsScope(), config_.ext_authz_error_);
     }
     stats_.error_.inc();
-    if (config_->failureModeAllow()) {
+    if (config_.failureModeAllow()) {
       ENVOY_STREAM_LOG(trace, "ext_authz filter allowed the request with error", *callbacks_);
       stats_.failure_mode_allowed_.inc();
       if (cluster_) {
-        config_->incCounter(cluster_->statsScope(), config_->ext_authz_failure_mode_allowed_);
+        config_.incCounter(cluster_->statsScope(), config_.ext_authz_failure_mode_allowed_);
       }
       continueDecoding();
     } else {
       ENVOY_STREAM_LOG(
           trace, "ext_authz filter rejected the request with an error. Response status code: {}",
-          *callbacks_, enumToInt(config_->statusOnError()));
+          *callbacks_, enumToInt(config_.statusOnError()));
       callbacks_->streamInfo().setResponseFlag(
           StreamInfo::ResponseFlag::UnauthorizedExternalService);
-      callbacks_->sendLocalReply(config_->statusOnError(), EMPTY_STRING, nullptr, absl::nullopt,
+      callbacks_->sendLocalReply(config_.statusOnError(), EMPTY_STRING, nullptr, absl::nullopt,
                                  RcDetails::get().AuthzError);
     }
     break;
@@ -308,8 +308,8 @@ void Filter::onComplete(Filters::Common::ExtAuthz::ResponsePtr&& response) {
 
 bool Filter::isBufferFull() const {
   const auto* buffer = callbacks_->decodingBuffer();
-  if (config_->allowPartialMessage() && buffer != nullptr) {
-    return buffer->length() >= config_->maxRequestBytes();
+  if (config_.allowPartialMessage() && buffer != nullptr) {
+    return buffer->length() >= config_.maxRequestBytes();
   }
   return false;
 }
diff --git a/source/extensions/filters/http/ext_authz/ext_authz.h b/source/extensions/filters/http/ext_authz/ext_authz.h
index db93fa3d2eea..daa73faad93b 100644
--- a/source/extensions/filters/http/ext_authz/ext_authz.h
+++ b/source/extensions/filters/http/ext_authz/ext_authz.h
@@ -232,8 +232,8 @@ class Filter : public Logger::Loggable<Logger::Id::filter>,
                public Http::StreamDecoderFilter,
                public Filters::Common::ExtAuthz::RequestCallbacks {
 public:
-  Filter(const FilterConfigSharedPtr& config, Filters::Common::ExtAuthz::ClientPtr&& client)
-      : config_(config), client_(std::move(client)), stats_(config->stats()) {}
+  Filter(FilterConfig& config, Filters::Common::ExtAuthz::ClientPtr&& client)
+      : config_(config), client_(std::move(client)), stats_(config.stats()) {}
 
   // Http::StreamFilterBase
   void onDestroy() override;
@@ -273,7 +273,7 @@ class Filter : public Logger::Loggable<Logger::Id::filter>,
   enum class FilterReturn { ContinueDecoding, StopDecoding };
 
   Http::HeaderMapPtr getHeaderMap(const Filters::Common::ExtAuthz::ResponsePtr& response);
-  FilterConfigSharedPtr config_;
+  FilterConfig& config_;
   Filters::Common::ExtAuthz::ClientPtr client_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
   Http::RequestHeaderMap* request_headers_;
diff --git a/source/extensions/filters/http/ext_proc/config.cc b/source/extensions/filters/http/ext_proc/config.cc
index 7db245641a54..d7c8d730ca59 100644
--- a/source/extensions/filters/http/ext_proc/config.cc
+++ b/source/extensions/filters/http/ext_proc/config.cc
@@ -24,7 +24,7 @@ Http::FilterFactoryCb ExternalProcessingFilterConfig::createFilterFactoryFromPro
         context.clusterManager().grpcAsyncClientManager(), grpc_service, context.scope());
 
     callbacks.addStreamFilter(
-        Http::StreamFilterSharedPtr{std::make_shared<Filter>(filter_config, std::move(client))});
+        Http::StreamFilterSharedPtr{std::make_shared<Filter>(*filter_config, std::move(client))});
   };
 }
 
@@ -34,4 +34,4 @@ REGISTER_FACTORY(ExternalProcessingFilterConfig,
 } // namespace ExternalProcessing
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/source/extensions/filters/http/ext_proc/ext_proc.cc b/source/extensions/filters/http/ext_proc/ext_proc.cc
index 874b35cf0ef4..f54c5032338b 100644
--- a/source/extensions/filters/http/ext_proc/ext_proc.cc
+++ b/source/extensions/filters/http/ext_proc/ext_proc.cc
@@ -34,7 +34,7 @@ void Filter::onDestroy() { closeStream(); }
 FilterHeadersStatus Filter::decodeHeaders(RequestHeaderMap& headers, bool end_of_stream) {
   // We're at the start, so start the stream and send a headers message
   request_headers_ = &headers;
-  stream_ = client_->start(*this, config_->grpcTimeout());
+  stream_ = client_->start(*this, config_.grpcTimeout());
   stats_.streams_started_.inc();
   ProcessingRequest req;
   auto* headers_req = req.mutable_request_headers();
@@ -90,7 +90,7 @@ void Filter::onGrpcError(Grpc::Status::GrpcStatus status) {
   ENVOY_LOG(debug, "Received gRPC error on stream: {}", status);
   stream_closed_ = true;
   stats_.streams_failed_.inc();
-  if (config_->failureModeAllow()) {
+  if (config_.failureModeAllow()) {
     // Ignore this and treat as a successful close
     onGrpcClose();
     stats_.failure_mode_allowed_.inc();
@@ -150,4 +150,4 @@ void Filter::sendImmediateResponse(const ImmediateResponse& response) {
 } // namespace ExternalProcessing
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/source/extensions/filters/http/ext_proc/ext_proc.h b/source/extensions/filters/http/ext_proc/ext_proc.h
index 299780f3e05a..fcfd4a37d02a 100644
--- a/source/extensions/filters/http/ext_proc/ext_proc.h
+++ b/source/extensions/filters/http/ext_proc/ext_proc.h
@@ -78,8 +78,8 @@ class Filter : public Logger::Loggable<Logger::Id::filter>,
   };
 
 public:
-  Filter(const FilterConfigSharedPtr& config, ExternalProcessorClientPtr&& client)
-      : config_(config), client_(std::move(client)), stats_(config->stats()) {}
+  Filter(const FilterConfig& config, ExternalProcessorClientPtr&& client)
+      : config_(config), client_(std::move(client)), stats_(config.stats()) {}
 
   void onDestroy() override;
 
@@ -103,7 +103,7 @@ class Filter : public Logger::Loggable<Logger::Id::filter>,
   void closeStream();
   void sendImmediateResponse(const envoy::service::ext_proc::v3alpha::ImmediateResponse& response);
 
-  const FilterConfigSharedPtr config_;
+  const FilterConfig& config_;
   const ExternalProcessorClientPtr client_;
   ExtProcFilterStats stats_;
 
@@ -123,4 +123,4 @@ class Filter : public Logger::Loggable<Logger::Id::filter>,
 } // namespace ExternalProcessing
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/source/extensions/filters/http/fault/config.cc b/source/extensions/filters/http/fault/config.cc
index 3810eaddfdb4..2bd67d729f95 100644
--- a/source/extensions/filters/http/fault/config.cc
+++ b/source/extensions/filters/http/fault/config.cc
@@ -14,10 +14,10 @@ namespace Fault {
 Http::FilterFactoryCb FaultFilterFactory::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::fault::v3::HTTPFault& config,
     const std::string& stats_prefix, Server::Configuration::FactoryContext& context) {
-  FaultFilterConfigSharedPtr filter_config(new FaultFilterConfig(
-      config, context.runtime(), stats_prefix, context.scope(), context.timeSource()));
+  auto filter_config = std::make_shared<FaultFilterConfig>(config, context.runtime(), stats_prefix,
+                                                           context.scope(), context.timeSource());
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<FaultFilter>(filter_config));
+    callbacks.addStreamFilter(std::make_shared<FaultFilter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/fault/fault_filter.cc b/source/extensions/filters/http/fault/fault_filter.cc
index 4b98e5583a89..44ae86c43e10 100644
--- a/source/extensions/filters/http/fault/fault_filter.cc
+++ b/source/extensions/filters/http/fault/fault_filter.cc
@@ -93,7 +93,7 @@ void FaultFilterConfig::incCounter(Stats::StatName downstream_cluster, Stats::St
       .inc();
 }
 
-FaultFilter::FaultFilter(FaultFilterConfigSharedPtr config) : config_(config) {}
+FaultFilter::FaultFilter(FaultFilterConfig& config) : config_(config) {}
 
 FaultFilter::~FaultFilter() {
   ASSERT(delay_timer_ == nullptr);
@@ -109,7 +109,7 @@ Http::FilterHeadersStatus FaultFilter::decodeHeaders(Http::RequestHeaderMap& hea
   // NOTE: We should not use runtime when reading from route-level
   // faults. In other words, runtime is supported only when faults are
   // configured at the filter level.
-  fault_settings_ = config_->settings();
+  fault_settings_ = config_.settings();
   if (decoder_callbacks_->route() && decoder_callbacks_->route()->routeEntry()) {
     const std::string& name = Extensions::HttpFilters::HttpFilterNames::get().Fault;
     const auto* route_entry = decoder_callbacks_->route()->routeEntry();
@@ -136,7 +136,7 @@ Http::FilterHeadersStatus FaultFilter::decodeHeaders(Http::RequestHeaderMap& hea
     downstream_cluster_ = std::string(headers.getEnvoyDownstreamServiceClusterValue());
     if (!downstream_cluster_.empty()) {
       downstream_cluster_storage_ = std::make_unique<Stats::StatNameDynamicStorage>(
-          downstream_cluster_, config_->scope().symbolTable());
+          downstream_cluster_, config_.scope().symbolTable());
     }
 
     downstream_cluster_delay_percent_key_ =
@@ -206,7 +206,7 @@ void FaultFilter::maybeSetupResponseRateLimit(const Http::RequestHeaderMap& requ
     return;
   }
 
-  config_->stats().response_rl_injected_.inc();
+  config_.stats().response_rl_injected_.inc();
 
   response_limiter_ = std::make_unique<StreamRateLimiter>(
       rate_kbps.value(), encoder_callbacks_->encoderBufferLimit(),
@@ -215,19 +215,19 @@ void FaultFilter::maybeSetupResponseRateLimit(const Http::RequestHeaderMap& requ
       [this](Buffer::Instance& data, bool end_stream) {
         encoder_callbacks_->injectEncodedDataToFilterChain(data, end_stream);
       },
-      [this] { encoder_callbacks_->continueEncoding(); }, config_->timeSource(),
+      [this] { encoder_callbacks_->continueEncoding(); }, config_.timeSource(),
       decoder_callbacks_->dispatcher(), decoder_callbacks_->scope());
 }
 
 bool FaultFilter::faultOverflow() {
-  const uint64_t max_faults = config_->runtime().snapshot().getInteger(
+  const uint64_t max_faults = config_.runtime().snapshot().getInteger(
       fault_settings_->maxActiveFaultsRuntime(), fault_settings_->maxActiveFaults().has_value()
                                                      ? fault_settings_->maxActiveFaults().value()
                                                      : std::numeric_limits<uint64_t>::max());
   // Note: Since we don't compare/swap here this is a fuzzy limit which is similar to how the
   // other circuit breakers work.
-  if (config_->stats().active_faults_.value() >= max_faults) {
-    config_->stats().faults_overflow_.inc();
+  if (config_.stats().active_faults_.value() >= max_faults) {
+    config_.stats().faults_overflow_.inc();
     return true;
   }
 
@@ -241,11 +241,11 @@ bool FaultFilter::isDelayEnabled(const Http::RequestHeaderMap& request_headers)
   }
 
   if (!downstream_cluster_delay_percent_key_.empty()) {
-    return config_->runtime().snapshot().featureEnabled(
-        downstream_cluster_delay_percent_key_, request_delay->percentage(&request_headers));
+    return config_.runtime().snapshot().featureEnabled(downstream_cluster_delay_percent_key_,
+                                                       request_delay->percentage(&request_headers));
   }
-  return config_->runtime().snapshot().featureEnabled(fault_settings_->delayPercentRuntime(),
-                                                      request_delay->percentage(&request_headers));
+  return config_.runtime().snapshot().featureEnabled(fault_settings_->delayPercentRuntime(),
+                                                     request_delay->percentage(&request_headers));
 }
 
 bool FaultFilter::isAbortEnabled(const Http::RequestHeaderMap& request_headers) {
@@ -255,11 +255,11 @@ bool FaultFilter::isAbortEnabled(const Http::RequestHeaderMap& request_headers)
   }
 
   if (!downstream_cluster_abort_percent_key_.empty()) {
-    return config_->runtime().snapshot().featureEnabled(
-        downstream_cluster_abort_percent_key_, request_abort->percentage(&request_headers));
+    return config_.runtime().snapshot().featureEnabled(downstream_cluster_abort_percent_key_,
+                                                       request_abort->percentage(&request_headers));
   }
-  return config_->runtime().snapshot().featureEnabled(fault_settings_->abortPercentRuntime(),
-                                                      request_abort->percentage(&request_headers));
+  return config_.runtime().snapshot().featureEnabled(fault_settings_->abortPercentRuntime(),
+                                                     request_abort->percentage(&request_headers));
 }
 
 bool FaultFilter::isResponseRateLimitEnabled(const Http::RequestHeaderMap& request_headers) {
@@ -268,7 +268,7 @@ bool FaultFilter::isResponseRateLimitEnabled(const Http::RequestHeaderMap& reque
   }
 
   // TODO(mattklein123): Allow runtime override via downstream cluster similar to the other keys.
-  return config_->runtime().snapshot().featureEnabled(
+  return config_.runtime().snapshot().featureEnabled(
       fault_settings_->responseRateLimitPercentRuntime(),
       fault_settings_->responseRateLimit()->percentage(&request_headers));
 }
@@ -289,10 +289,10 @@ FaultFilter::delayDuration(const Http::RequestHeaderMap& request_headers) {
   }
 
   std::chrono::milliseconds duration =
-      std::chrono::milliseconds(config_->runtime().snapshot().getInteger(
+      std::chrono::milliseconds(config_.runtime().snapshot().getInteger(
           fault_settings_->delayDurationRuntime(), config_duration.value().count()));
   if (!downstream_cluster_delay_duration_key_.empty()) {
-    duration = std::chrono::milliseconds(config_->runtime().snapshot().getInteger(
+    duration = std::chrono::milliseconds(config_.runtime().snapshot().getInteger(
         downstream_cluster_delay_duration_key_, duration.count()));
   }
 
@@ -334,11 +334,11 @@ FaultFilter::abortHttpStatus(const Http::RequestHeaderMap& request_headers) {
   }
 
   auto default_http_status_code = static_cast<uint64_t>(http_status.value());
-  auto runtime_http_status_code = config_->runtime().snapshot().getInteger(
+  auto runtime_http_status_code = config_.runtime().snapshot().getInteger(
       fault_settings_->abortHttpStatusRuntime(), default_http_status_code);
 
   if (!downstream_cluster_abort_http_status_key_.empty()) {
-    runtime_http_status_code = config_->runtime().snapshot().getInteger(
+    runtime_http_status_code = config_.runtime().snapshot().getInteger(
         downstream_cluster_abort_http_status_key_, default_http_status_code);
   }
 
@@ -353,11 +353,11 @@ FaultFilter::abortGrpcStatus(const Http::RequestHeaderMap& request_headers) {
   }
 
   auto default_grpc_status_code = static_cast<uint64_t>(grpc_status.value());
-  auto runtime_grpc_status_code = config_->runtime().snapshot().getInteger(
+  auto runtime_grpc_status_code = config_.runtime().snapshot().getInteger(
       fault_settings_->abortGrpcStatusRuntime(), default_grpc_status_code);
 
   if (!downstream_cluster_abort_grpc_status_key_.empty()) {
-    runtime_grpc_status_code = config_->runtime().snapshot().getInteger(
+    runtime_grpc_status_code = config_.runtime().snapshot().getInteger(
         downstream_cluster_abort_grpc_status_key_, default_grpc_status_code);
   }
 
@@ -367,19 +367,19 @@ FaultFilter::abortGrpcStatus(const Http::RequestHeaderMap& request_headers) {
 void FaultFilter::recordDelaysInjectedStats() {
   // Downstream specific stats.
   if (!downstream_cluster_.empty()) {
-    config_->incDelays(downstream_cluster_storage_->statName());
+    config_.incDelays(downstream_cluster_storage_->statName());
   }
 
-  config_->stats().delays_injected_.inc();
+  config_.stats().delays_injected_.inc();
 }
 
 void FaultFilter::recordAbortsInjectedStats() {
   // Downstream specific stats.
   if (!downstream_cluster_.empty()) {
-    config_->incAborts(downstream_cluster_storage_->statName());
+    config_.incAborts(downstream_cluster_storage_->statName());
   }
 
-  config_->stats().aborts_injected_.inc();
+  config_.stats().aborts_injected_.inc();
 }
 
 Http::FilterDataStatus FaultFilter::decodeData(Buffer::Instance&, bool) {
@@ -418,7 +418,7 @@ bool FaultFilter::tryIncActiveFaults() {
   }
 
   // TODO(mattklein123): Consider per-fault type active fault gauges.
-  config_->stats().active_faults_.inc();
+  config_.stats().active_faults_.inc();
   fault_active_ = true;
 
   return true;
@@ -430,7 +430,7 @@ void FaultFilter::onDestroy() {
     response_limiter_->destroy();
   }
   if (fault_active_) {
-    config_->stats().active_faults_.dec();
+    config_.stats().active_faults_.dec();
   }
 }
 
diff --git a/source/extensions/filters/http/fault/fault_filter.h b/source/extensions/filters/http/fault/fault_filter.h
index e1ff4d275937..563e9dbdaa41 100644
--- a/source/extensions/filters/http/fault/fault_filter.h
+++ b/source/extensions/filters/http/fault/fault_filter.h
@@ -213,7 +213,7 @@ using AbortHttpAndGrpcStatus =
  */
 class FaultFilter : public Http::StreamFilter, Logger::Loggable<Logger::Id::filter> {
 public:
-  FaultFilter(FaultFilterConfigSharedPtr config);
+  FaultFilter(FaultFilterConfig& config);
   ~FaultFilter() override;
 
   // Http::StreamFilterBase
@@ -270,7 +270,7 @@ class FaultFilter : public Http::StreamFilter, Logger::Loggable<Logger::Id::filt
   bool maybeSetupDelay(const Http::RequestHeaderMap& request_headers);
   void maybeSetupResponseRateLimit(const Http::RequestHeaderMap& request_headers);
 
-  FaultFilterConfigSharedPtr config_;
+  FaultFilterConfig& config_;
   Http::StreamDecoderFilterCallbacks* decoder_callbacks_{};
   Http::StreamEncoderFilterCallbacks* encoder_callbacks_{};
   Event::TimerPtr delay_timer_;
diff --git a/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc b/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc
index 8dfbc0dc0dc4..9be40b75d261 100644
--- a/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc
+++ b/source/extensions/filters/http/grpc_stats/grpc_stats_filter.cc
@@ -144,16 +144,16 @@ using ConfigConstSharedPtr = std::shared_ptr<const Config>;
 
 class GrpcStatsFilter : public Http::PassThroughFilter {
 public:
-  GrpcStatsFilter(ConfigConstSharedPtr config) : config_(config) {}
+  GrpcStatsFilter(const Config& config) : config_(config) {}
 
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap& headers, bool) override {
     grpc_request_ = Grpc::Common::isGrpcRequestHeaders(headers);
     if (grpc_request_) {
       cluster_ = decoder_callbacks_->clusterInfo();
       if (cluster_) {
-        if (config_->stats_for_all_methods_) {
+        if (config_.stats_for_all_methods_) {
           // Get dynamically-allocated Context::RequestStatNames from the context.
-          request_names_ = config_->context_.resolveDynamicServiceAndMethod(headers.Path());
+          request_names_ = config_.context_.resolveDynamicServiceAndMethod(headers.Path());
           do_stat_tracking_ = request_names_.has_value();
         } else {
           // This case handles both proto_config.stats_for_all_methods() == false,
@@ -178,8 +178,8 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
             // an empty optional; each of the `charge` functions on the context
             // will interpret an empty optional for this value to mean that the
             // service.method prefix on the stat should be omitted.
-            if (config_->allowlist_) {
-              request_names_ = config_->allowlist_->lookup(*request_names);
+            if (config_.allowlist_) {
+              request_names_ = config_.allowlist_->lookup(*request_names);
             }
           }
         }
@@ -194,7 +194,7 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
       if (delta > 0) {
         maybeWriteFilterState();
         if (doStatTracking()) {
-          config_->context_.chargeRequestMessageStat(*cluster_, request_names_, delta);
+          config_.context_.chargeRequestMessageStat(*cluster_, request_names_, delta);
         }
       }
     }
@@ -205,8 +205,8 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
                                           bool end_stream) override {
     grpc_response_ = Grpc::Common::isGrpcResponseHeaders(headers, end_stream);
     if (doStatTracking()) {
-      config_->context_.chargeStat(*cluster_, Grpc::Context::Protocol::Grpc, request_names_,
-                                   headers.GrpcStatus());
+      config_.context_.chargeStat(*cluster_, Grpc::Context::Protocol::Grpc, request_names_,
+                                  headers.GrpcStatus());
       if (end_stream) {
         maybeChargeUpstreamStat();
       }
@@ -220,7 +220,7 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
       if (delta > 0) {
         maybeWriteFilterState();
         if (doStatTracking()) {
-          config_->context_.chargeResponseMessageStat(*cluster_, request_names_, delta);
+          config_.context_.chargeResponseMessageStat(*cluster_, request_names_, delta);
         }
       }
     }
@@ -229,8 +229,8 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
 
   Http::FilterTrailersStatus encodeTrailers(Http::ResponseTrailerMap& trailers) override {
     if (doStatTracking()) {
-      config_->context_.chargeStat(*cluster_, Grpc::Context::Protocol::Grpc, request_names_,
-                                   trailers.GrpcStatus());
+      config_.context_.chargeStat(*cluster_, Grpc::Context::Protocol::Grpc, request_names_,
+                                  trailers.GrpcStatus());
       maybeChargeUpstreamStat();
     }
     return Http::FilterTrailersStatus::Continue;
@@ -239,7 +239,7 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
   bool doStatTracking() const { return do_stat_tracking_; }
 
   void maybeWriteFilterState() {
-    if (!config_->emit_filter_state_) {
+    if (!config_.emit_filter_state_) {
       return;
     }
     if (filter_object_ == nullptr) {
@@ -255,19 +255,19 @@ class GrpcStatsFilter : public Http::PassThroughFilter {
   }
 
   void maybeChargeUpstreamStat() {
-    if (config_->enable_upstream_stats_ &&
+    if (config_.enable_upstream_stats_ &&
         decoder_callbacks_->streamInfo().lastUpstreamTxByteSent().has_value() &&
         decoder_callbacks_->streamInfo().lastUpstreamRxByteReceived().has_value()) {
       std::chrono::milliseconds chrono_duration =
           std::chrono::duration_cast<std::chrono::milliseconds>(
               decoder_callbacks_->streamInfo().lastUpstreamRxByteReceived().value() -
               decoder_callbacks_->streamInfo().lastUpstreamTxByteSent().value());
-      config_->context_.chargeUpstreamStat(*cluster_, request_names_, chrono_duration);
+      config_.context_.chargeUpstreamStat(*cluster_, request_names_, chrono_duration);
     }
   }
 
 private:
-  ConfigConstSharedPtr config_;
+  const Config& config_;
   GrpcStatsObject* filter_object_{};
   bool do_stat_tracking_{false};
   bool grpc_request_{false};
@@ -284,10 +284,10 @@ Http::FilterFactoryCb GrpcStatsFilterConfigFactory::createFilterFactoryFromProto
     const envoy::extensions::filters::http::grpc_stats::v3::FilterConfig& proto_config,
     const std::string&, Server::Configuration::FactoryContext& factory_context) {
 
-  ConfigConstSharedPtr config = std::make_shared<const Config>(proto_config, factory_context);
+  auto config = std::make_shared<const Config>(proto_config, factory_context);
 
   return [config](Http::FilterChainFactoryCallbacks& callbacks) {
-    callbacks.addStreamFilter(std::make_shared<GrpcStatsFilter>(config));
+    callbacks.addStreamFilter(std::make_shared<GrpcStatsFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/gzip/config.cc b/source/extensions/filters/http/gzip/config.cc
index e4344b8c9e35..a5cd9b96d7d8 100644
--- a/source/extensions/filters/http/gzip/config.cc
+++ b/source/extensions/filters/http/gzip/config.cc
@@ -32,7 +32,7 @@ Http::FilterFactoryCb GzipFilterFactory::createFilterFactoryFromProtoTyped(
   Common::Compressors::CompressorFilterConfigSharedPtr config = std::make_shared<GzipFilterConfig>(
       proto_config, stats_prefix, context.scope(), context.runtime());
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<Common::Compressors::CompressorFilter>(config));
+    callbacks.addStreamFilter(std::make_shared<Common::Compressors::CompressorFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/header_to_metadata/config.cc b/source/extensions/filters/http/header_to_metadata/config.cc
index e51104c658da..95298e0730a0 100644
--- a/source/extensions/filters/http/header_to_metadata/config.cc
+++ b/source/extensions/filters/http/header_to_metadata/config.cc
@@ -18,11 +18,11 @@ namespace HeaderToMetadataFilter {
 Http::FilterFactoryCb HeaderToMetadataConfig::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::header_to_metadata::v3::Config& proto_config,
     const std::string&, Server::Configuration::FactoryContext&) {
-  ConfigSharedPtr filter_config(std::make_shared<Config>(proto_config));
+  auto filter_config = std::make_shared<Config>(proto_config);
 
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamFilter(
-        Http::StreamFilterSharedPtr{new HeaderToMetadataFilter(filter_config)});
+        Http::StreamFilterSharedPtr{new HeaderToMetadataFilter(*filter_config)});
   };
 }
 
diff --git a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc
index 2d5358f89aeb..372d1c67678f 100644
--- a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc
+++ b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.cc
@@ -119,15 +119,15 @@ bool Config::configToVector(const ProtobufRepeatedRule& proto_rules,
   return true;
 }
 
-HeaderToMetadataFilter::HeaderToMetadataFilter(const ConfigSharedPtr config) : config_(config) {}
+HeaderToMetadataFilter::HeaderToMetadataFilter(const Config& config) : config_(config) {}
 
 HeaderToMetadataFilter::~HeaderToMetadataFilter() = default;
 
 Http::FilterHeadersStatus HeaderToMetadataFilter::decodeHeaders(Http::RequestHeaderMap& headers,
                                                                 bool) {
-  const auto* config = getConfig();
-  if (config->doRequest()) {
-    writeHeaderToMetadata(headers, config->requestRules(), *decoder_callbacks_);
+  const auto& config = getConfig();
+  if (config.doRequest()) {
+    writeHeaderToMetadata(headers, config.requestRules(), *decoder_callbacks_);
   }
 
   return Http::FilterHeadersStatus::Continue;
@@ -140,9 +140,9 @@ void HeaderToMetadataFilter::setDecoderFilterCallbacks(
 
 Http::FilterHeadersStatus HeaderToMetadataFilter::encodeHeaders(Http::ResponseHeaderMap& headers,
                                                                 bool) {
-  const auto* config = getConfig();
-  if (config->doResponse()) {
-    writeHeaderToMetadata(headers, config->responseRules(), *encoder_callbacks_);
+  const auto& config = getConfig();
+  if (config.doResponse()) {
+    writeHeaderToMetadata(headers, config.responseRules(), *encoder_callbacks_);
   }
   return Http::FilterHeadersStatus::Continue;
 }
@@ -261,20 +261,14 @@ void HeaderToMetadataFilter::writeHeaderToMetadata(Http::HeaderMap& headers,
 }
 
 // TODO(rgs1): this belongs in one of the filter interfaces, see issue #10164.
-const Config* HeaderToMetadataFilter::getConfig() const {
-  // Cached config pointer.
-  if (effective_config_) {
-    return effective_config_;
-  }
-
-  effective_config_ = Http::Utility::resolveMostSpecificPerFilterConfig<Config>(
+const Config& HeaderToMetadataFilter::getConfig() const {
+  auto* config = Http::Utility::resolveMostSpecificPerFilterConfig<Config>(
       HttpFilterNames::get().HeaderToMetadata, decoder_callbacks_->route());
-  if (effective_config_) {
-    return effective_config_;
+  if (config) {
+    return *config;
   }
 
-  effective_config_ = config_.get();
-  return effective_config_;
+  return config_;
 }
 
 } // namespace HeaderToMetadataFilter
diff --git a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h
index a9bb0476f966..f5a40bb00954 100644
--- a/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h
+++ b/source/extensions/filters/http/header_to_metadata/header_to_metadata_filter.h
@@ -134,7 +134,7 @@ using ConfigSharedPtr = std::shared_ptr<Config>;
 class HeaderToMetadataFilter : public Http::StreamFilter,
                                public Logger::Loggable<Logger::Id::filter> {
 public:
-  HeaderToMetadataFilter(const ConfigSharedPtr config);
+  HeaderToMetadataFilter(const Config& config);
   ~HeaderToMetadataFilter() override;
 
   // Http::StreamFilterBase
@@ -171,8 +171,7 @@ class HeaderToMetadataFilter : public Http::StreamFilter,
 
   using StructMap = std::map<std::string, ProtobufWkt::Struct>;
 
-  const ConfigSharedPtr config_;
-  mutable const Config* effective_config_{nullptr};
+  const Config& config_;
   Http::StreamDecoderFilterCallbacks* decoder_callbacks_{};
   Http::StreamEncoderFilterCallbacks* encoder_callbacks_{};
 
@@ -192,7 +191,7 @@ class HeaderToMetadataFilter : public Http::StreamFilter,
                    ValueEncode) const;
   void applyKeyValue(std::string&&, const Rule&, const KeyValuePair&, StructMap&);
   const std::string& decideNamespace(const std::string& nspace) const;
-  const Config* getConfig() const;
+  const Config& getConfig() const;
 };
 
 } // namespace HeaderToMetadataFilter
diff --git a/source/extensions/filters/http/health_check/config.cc b/source/extensions/filters/http/health_check/config.cc
index 7baa31b01daa..cb846901c58f 100644
--- a/source/extensions/filters/http/health_check/config.cc
+++ b/source/extensions/filters/http/health_check/config.cc
@@ -49,7 +49,7 @@ Http::FilterFactoryCb HealthCheckFilterConfig::createFilterFactoryFromProtoTyped
   return [&context, pass_through_mode, cache_manager, header_match_data,
           cluster_min_healthy_percentages](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamFilter(std::make_shared<HealthCheckFilter>(context, pass_through_mode,
-                                                                  cache_manager, header_match_data,
+                                                                  cache_manager, *header_match_data,
                                                                   cluster_min_healthy_percentages));
   };
 }
diff --git a/source/extensions/filters/http/health_check/health_check.cc b/source/extensions/filters/http/health_check/health_check.cc
index ed1fe45cb240..44fce26a5ff6 100644
--- a/source/extensions/filters/http/health_check/health_check.cc
+++ b/source/extensions/filters/http/health_check/health_check.cc
@@ -52,7 +52,7 @@ void HealthCheckCacheManager::onTimer() {
 
 Http::FilterHeadersStatus HealthCheckFilter::decodeHeaders(Http::RequestHeaderMap& headers,
                                                            bool end_stream) {
-  if (Http::HeaderUtility::matchHeaders(headers, *header_match_data_)) {
+  if (Http::HeaderUtility::matchHeaders(headers, header_match_data_)) {
     health_check_request_ = true;
     callbacks_->streamInfo().healthCheck(true);
 
diff --git a/source/extensions/filters/http/health_check/health_check.h b/source/extensions/filters/http/health_check/health_check.h
index d11f0d3a80a9..d67bfc585b42 100644
--- a/source/extensions/filters/http/health_check/health_check.h
+++ b/source/extensions/filters/http/health_check/health_check.h
@@ -62,10 +62,10 @@ class HealthCheckFilter : public Http::StreamFilter {
 public:
   HealthCheckFilter(Server::Configuration::FactoryContext& context, bool pass_through_mode,
                     HealthCheckCacheManagerSharedPtr cache_manager,
-                    HeaderDataVectorSharedPtr header_match_data,
+                    const std::vector<Http::HeaderUtility::HeaderDataPtr>& header_match_data,
                     ClusterMinHealthyPercentagesConstSharedPtr cluster_min_healthy_percentages)
       : context_(context), pass_through_mode_(pass_through_mode), cache_manager_(cache_manager),
-        header_match_data_(std::move(header_match_data)),
+        header_match_data_(header_match_data),
         cluster_min_healthy_percentages_(cluster_min_healthy_percentages) {}
 
   // Http::StreamFilterBase
@@ -106,7 +106,7 @@ class HealthCheckFilter : public Http::StreamFilter {
   bool health_check_request_{};
   bool pass_through_mode_{};
   HealthCheckCacheManagerSharedPtr cache_manager_;
-  const HeaderDataVectorSharedPtr header_match_data_;
+  const std::vector<Http::HeaderUtility::HeaderDataPtr>& header_match_data_;
   ClusterMinHealthyPercentagesConstSharedPtr cluster_min_healthy_percentages_;
 };
 
diff --git a/source/extensions/filters/http/ip_tagging/config.cc b/source/extensions/filters/http/ip_tagging/config.cc
index 4b66bb2d34a0..a7e1debc0546 100644
--- a/source/extensions/filters/http/ip_tagging/config.cc
+++ b/source/extensions/filters/http/ip_tagging/config.cc
@@ -17,11 +17,11 @@ Http::FilterFactoryCb IpTaggingFilterFactory::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::ip_tagging::v3::IPTagging& proto_config,
     const std::string& stat_prefix, Server::Configuration::FactoryContext& context) {
 
-  IpTaggingFilterConfigSharedPtr config(
-      new IpTaggingFilterConfig(proto_config, stat_prefix, context.scope(), context.runtime()));
+  auto config = std::make_shared<IpTaggingFilterConfig>(proto_config, stat_prefix, context.scope(),
+                                                        context.runtime());
 
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamDecoderFilter(std::make_shared<IpTaggingFilter>(config));
+    callbacks.addStreamDecoderFilter(std::make_shared<IpTaggingFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/ip_tagging/ip_tagging_filter.cc b/source/extensions/filters/http/ip_tagging/ip_tagging_filter.cc
index ed68cbe77144..935f4d1267eb 100644
--- a/source/extensions/filters/http/ip_tagging/ip_tagging_filter.cc
+++ b/source/extensions/filters/http/ip_tagging/ip_tagging_filter.cc
@@ -60,7 +60,7 @@ void IpTaggingFilterConfig::incCounter(Stats::StatName name) {
   scope_.counterFromStatName(Stats::StatName(storage.get())).inc();
 }
 
-IpTaggingFilter::IpTaggingFilter(IpTaggingFilterConfigSharedPtr config) : config_(config) {}
+IpTaggingFilter::IpTaggingFilter(IpTaggingFilterConfig& config) : config_(config) {}
 
 IpTaggingFilter::~IpTaggingFilter() = default;
 
@@ -71,14 +71,14 @@ Http::FilterHeadersStatus IpTaggingFilter::decodeHeaders(Http::RequestHeaderMap&
                                    (headers.EnvoyInternalRequest()->value() ==
                                     Http::Headers::get().EnvoyInternalRequestValues.True.c_str());
 
-  if ((is_internal_request && config_->requestType() == FilterRequestType::EXTERNAL) ||
-      (!is_internal_request && config_->requestType() == FilterRequestType::INTERNAL) ||
-      !config_->runtime().snapshot().featureEnabled("ip_tagging.http_filter_enabled", 100)) {
+  if ((is_internal_request && config_.requestType() == FilterRequestType::EXTERNAL) ||
+      (!is_internal_request && config_.requestType() == FilterRequestType::INTERNAL) ||
+      !config_.runtime().snapshot().featureEnabled("ip_tagging.http_filter_enabled", 100)) {
     return Http::FilterHeadersStatus::Continue;
   }
 
   std::vector<std::string> tags =
-      config_->trie().getData(callbacks_->streamInfo().downstreamAddressProvider().remoteAddress());
+      config_.trie().getData(callbacks_->streamInfo().downstreamAddressProvider().remoteAddress());
 
   if (!tags.empty()) {
     const std::string tags_join = absl::StrJoin(tags, ",");
@@ -91,12 +91,12 @@ Http::FilterHeadersStatus IpTaggingFilter::decodeHeaders(Http::RequestHeaderMap&
     // If there are use cases with a large set of tags, a way to opt into these stats
     // should be exposed and other observability options like logging tags need to be implemented.
     for (const std::string& tag : tags) {
-      config_->incHit(tag);
+      config_.incHit(tag);
     }
   } else {
-    config_->incNoHit();
+    config_.incNoHit();
   }
-  config_->incTotal();
+  config_.incTotal();
   return Http::FilterHeadersStatus::Continue;
 }
 
diff --git a/source/extensions/filters/http/ip_tagging/ip_tagging_filter.h b/source/extensions/filters/http/ip_tagging/ip_tagging_filter.h
index a37c5b9006a8..b21bdede32c9 100644
--- a/source/extensions/filters/http/ip_tagging/ip_tagging_filter.h
+++ b/source/extensions/filters/http/ip_tagging/ip_tagging_filter.h
@@ -81,7 +81,7 @@ using IpTaggingFilterConfigSharedPtr = std::shared_ptr<IpTaggingFilterConfig>;
  */
 class IpTaggingFilter : public Http::StreamDecoderFilter {
 public:
-  IpTaggingFilter(IpTaggingFilterConfigSharedPtr config);
+  IpTaggingFilter(IpTaggingFilterConfig& config);
   ~IpTaggingFilter() override;
 
   // Http::StreamFilterBase
@@ -95,7 +95,7 @@ class IpTaggingFilter : public Http::StreamDecoderFilter {
   void setDecoderFilterCallbacks(Http::StreamDecoderFilterCallbacks& callbacks) override;
 
 private:
-  IpTaggingFilterConfigSharedPtr config_;
+  IpTaggingFilterConfig& config_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
 };
 
diff --git a/source/extensions/filters/http/jwt_authn/filter.cc b/source/extensions/filters/http/jwt_authn/filter.cc
index 343ebc1cbeff..05d3ab8368ff 100644
--- a/source/extensions/filters/http/jwt_authn/filter.cc
+++ b/source/extensions/filters/http/jwt_authn/filter.cc
@@ -40,8 +40,7 @@ std::string generateRcDetails(absl::string_view error_msg) {
 
 } // namespace
 
-Filter::Filter(FilterConfigSharedPtr config)
-    : stats_(config->stats()), config_(std::move(config)) {}
+Filter::Filter(FilterConfig& config) : stats_(config.stats()), config_(config) {}
 
 void Filter::onDestroy() {
   ENVOY_LOG(debug, "Called Filter : {}", __func__);
@@ -56,7 +55,7 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
   state_ = Calling;
   stopped_ = false;
 
-  if (config_->bypassCorsPreflightRequest() && isCorsPreflightRequest(headers)) {
+  if (config_.bypassCorsPreflightRequest() && isCorsPreflightRequest(headers)) {
     // The CORS preflight doesn't include user credentials, bypass regardless of JWT requirements.
     // See http://www.w3.org/TR/cors/#cross-origin-request-with-preflight.
     ENVOY_LOG(debug, "CORS preflight request bypassed regardless of JWT requirements");
@@ -71,7 +70,7 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
           HttpFilterNames::get().JwtAuthn, decoder_callbacks_->route());
   if (per_route_config != nullptr) {
     std::string error_msg;
-    std::tie(verifier, error_msg) = config_->findPerRouteVerifier(*per_route_config);
+    std::tie(verifier, error_msg) = config_.findPerRouteVerifier(*per_route_config);
     if (!error_msg.empty()) {
       stats_.denied_.inc();
       state_ = Responded;
@@ -81,7 +80,7 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
       return Http::FilterHeadersStatus::StopIteration;
     }
   } else {
-    verifier = config_->findVerifier(headers, *decoder_callbacks_->streamInfo().filterState());
+    verifier = config_.findVerifier(headers, *decoder_callbacks_->streamInfo().filterState());
   }
 
   if (verifier == nullptr) {
diff --git a/source/extensions/filters/http/jwt_authn/filter.h b/source/extensions/filters/http/jwt_authn/filter.h
index 732eb1ca913d..9c9eca9ab3f4 100644
--- a/source/extensions/filters/http/jwt_authn/filter.h
+++ b/source/extensions/filters/http/jwt_authn/filter.h
@@ -19,7 +19,7 @@ class Filter : public Http::StreamDecoderFilter,
                public Verifier::Callbacks,
                public Logger::Loggable<Logger::Id::jwt> {
 public:
-  Filter(FilterConfigSharedPtr config);
+  Filter(FilterConfig& config);
 
   // Http::StreamFilterBase
   void onDestroy() override;
@@ -47,7 +47,7 @@ class Filter : public Http::StreamDecoderFilter,
   // Mark if request has been stopped.
   bool stopped_ = false;
   // Filter config object.
-  FilterConfigSharedPtr config_;
+  FilterConfig& config_;
   // Verify context for current request.
   ContextSharedPtr context_;
 };
diff --git a/source/extensions/filters/http/jwt_authn/filter_factory.cc b/source/extensions/filters/http/jwt_authn/filter_factory.cc
index b99bab8132a3..9cb4aa2a54d0 100644
--- a/source/extensions/filters/http/jwt_authn/filter_factory.cc
+++ b/source/extensions/filters/http/jwt_authn/filter_factory.cc
@@ -47,7 +47,7 @@ FilterFactory::createFilterFactoryFromProtoTyped(const JwtAuthentication& proto_
   validateJwtConfig(proto_config, context.api());
   auto filter_config = FilterConfigImpl::create(proto_config, prefix, context);
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamDecoderFilter(std::make_shared<Filter>(filter_config));
+    callbacks.addStreamDecoderFilter(std::make_shared<Filter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/kill_request/kill_request_filter.h b/source/extensions/filters/http/kill_request/kill_request_filter.h
index 82243f819b7a..4a383bd1a859 100644
--- a/source/extensions/filters/http/kill_request/kill_request_filter.h
+++ b/source/extensions/filters/http/kill_request/kill_request_filter.h
@@ -82,7 +82,7 @@ class KillRequestFilter : public Http::StreamFilter, Logger::Loggable<Logger::Id
   // equaling true.
   bool isKillRequestEnabled();
 
-  const envoy::extensions::filters::http::kill_request::v3::KillRequest kill_request_;
+  const envoy::extensions::filters::http::kill_request::v3::KillRequest& kill_request_;
   Random::RandomGenerator& random_generator_;
 };
 
diff --git a/source/extensions/filters/http/local_ratelimit/config.cc b/source/extensions/filters/http/local_ratelimit/config.cc
index a5e629d88055..fa069a14e9b0 100644
--- a/source/extensions/filters/http/local_ratelimit/config.cc
+++ b/source/extensions/filters/http/local_ratelimit/config.cc
@@ -16,10 +16,10 @@ namespace LocalRateLimitFilter {
 Http::FilterFactoryCb LocalRateLimitFilterConfig::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::local_ratelimit::v3::LocalRateLimit& proto_config,
     const std::string&, Server::Configuration::FactoryContext& context) {
-  FilterConfigSharedPtr filter_config = std::make_shared<FilterConfig>(
+  auto filter_config = std::make_shared<FilterConfig>(
       proto_config, context.localInfo(), context.dispatcher(), context.scope(), context.runtime());
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<Filter>(filter_config));
+    callbacks.addStreamFilter(std::make_shared<Filter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc b/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc
index 263d77849dc2..730737c70278 100644
--- a/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc
+++ b/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc
@@ -69,36 +69,36 @@ bool FilterConfig::enforced() const {
 }
 
 Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers, bool) {
-  const auto* config = getConfig();
+  const auto& config = getConfig();
 
-  if (!config->enabled()) {
+  if (!config.enabled()) {
     return Http::FilterHeadersStatus::Continue;
   }
 
-  config->stats().enabled_.inc();
+  config.stats().enabled_.inc();
 
   std::vector<RateLimit::LocalDescriptor> descriptors;
-  if (config->hasDescriptors()) {
+  if (config.hasDescriptors()) {
     populateDescriptors(descriptors, headers);
   }
 
-  if (config->requestAllowed(descriptors)) {
-    config->stats().ok_.inc();
+  if (config.requestAllowed(descriptors)) {
+    config.stats().ok_.inc();
     return Http::FilterHeadersStatus::Continue;
   }
 
-  config->stats().rate_limited_.inc();
+  config.stats().rate_limited_.inc();
 
-  if (!config->enforced()) {
+  if (!config.enforced()) {
     return Http::FilterHeadersStatus::Continue;
   }
 
-  config->stats().enforced_.inc();
+  config.stats().enforced_.inc();
 
   decoder_callbacks_->sendLocalReply(
-      config->status(), "local_rate_limited",
-      [this, config](Http::HeaderMap& headers) {
-        config->responseHeadersParser().evaluateHeaders(headers, decoder_callbacks_->streamInfo());
+      config.status(), "local_rate_limited",
+      [this, &config](Http::HeaderMap& headers) {
+        config.responseHeadersParser().evaluateHeaders(headers, decoder_callbacks_->streamInfo());
       },
       absl::nullopt, "local_rate_limited");
   decoder_callbacks_->streamInfo().setResponseFlag(StreamInfo::ResponseFlag::RateLimited);
@@ -115,27 +115,27 @@ void Filter::populateDescriptors(std::vector<RateLimit::LocalDescriptor>& descri
 
   const Router::RouteEntry* route_entry = route->routeEntry();
   // Get all applicable rate limit policy entries for the route.
-  const auto* config = getConfig();
+  const auto& config = getConfig();
   for (const Router::RateLimitPolicyEntry& rate_limit :
-       route_entry->rateLimitPolicy().getApplicableRateLimit(config->stage())) {
+       route_entry->rateLimitPolicy().getApplicableRateLimit(config.stage())) {
     const std::string& disable_key = rate_limit.disableKey();
 
     if (!disable_key.empty()) {
       continue;
     }
-    rate_limit.populateLocalDescriptors(descriptors, config->localInfo().clusterName(), headers,
+    rate_limit.populateLocalDescriptors(descriptors, config.localInfo().clusterName(), headers,
                                         decoder_callbacks_->streamInfo());
   }
 }
 
-const FilterConfig* Filter::getConfig() const {
+const FilterConfig& Filter::getConfig() const {
   const auto* config = Http::Utility::resolveMostSpecificPerFilterConfig<FilterConfig>(
       "envoy.filters.http.local_ratelimit", decoder_callbacks_->route());
   if (config) {
-    return config;
+    return *config;
   }
 
-  return config_.get();
+  return config_;
 }
 
 } // namespace LocalRateLimitFilter
diff --git a/source/extensions/filters/http/local_ratelimit/local_ratelimit.h b/source/extensions/filters/http/local_ratelimit/local_ratelimit.h
index cffbc399c05d..5885e7ed6841 100644
--- a/source/extensions/filters/http/local_ratelimit/local_ratelimit.h
+++ b/source/extensions/filters/http/local_ratelimit/local_ratelimit.h
@@ -95,7 +95,7 @@ using FilterConfigSharedPtr = std::shared_ptr<FilterConfig>;
  */
 class Filter : public Http::PassThroughFilter {
 public:
-  Filter(FilterConfigSharedPtr config) : config_(config) {}
+  Filter(const FilterConfig& config) : config_(config) {}
 
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap& headers,
@@ -107,8 +107,8 @@ class Filter : public Http::PassThroughFilter {
   void populateDescriptors(std::vector<RateLimit::LocalDescriptor>& descriptors,
                            Http::RequestHeaderMap& headers);
 
-  const FilterConfig* getConfig() const;
-  FilterConfigSharedPtr config_;
+  const FilterConfig& getConfig() const;
+  const FilterConfig& config_;
 };
 
 } // namespace LocalRateLimitFilter
diff --git a/source/extensions/filters/http/lua/config.cc b/source/extensions/filters/http/lua/config.cc
index dbe71ad944b4..2a58395b8b79 100644
--- a/source/extensions/filters/http/lua/config.cc
+++ b/source/extensions/filters/http/lua/config.cc
@@ -14,10 +14,10 @@ namespace Lua {
 Http::FilterFactoryCb LuaFilterConfig::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::lua::v3::Lua& proto_config, const std::string&,
     Server::Configuration::FactoryContext& context) {
-  FilterConfigConstSharedPtr filter_config(new FilterConfig{
-      proto_config, context.threadLocal(), context.clusterManager(), context.api()});
+  const auto filter_config = std::make_shared<FilterConfig>(
+      proto_config, context.threadLocal(), context.clusterManager(), context.api());
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamFilter(std::make_shared<Filter>(filter_config));
+    callbacks.addStreamFilter(std::make_shared<Filter>(*filter_config));
   };
 }
 
diff --git a/source/extensions/filters/http/lua/lua_filter.h b/source/extensions/filters/http/lua/lua_filter.h
index 95c42c066be6..0e4a55e36a36 100644
--- a/source/extensions/filters/http/lua/lua_filter.h
+++ b/source/extensions/filters/http/lua/lua_filter.h
@@ -394,7 +394,7 @@ class FilterConfigPerRoute : public Router::RouteSpecificFilterConfig {
 
 namespace {
 
-PerLuaCodeSetup* getPerLuaCodeSetup(const FilterConfig* filter_config,
+PerLuaCodeSetup* getPerLuaCodeSetup(const FilterConfig& filter_config,
                                     Http::StreamFilterCallbacks* callbacks) {
   const FilterConfigPerRoute* config_per_route = nullptr;
   if (callbacks && callbacks->route()) {
@@ -407,13 +407,11 @@ PerLuaCodeSetup* getPerLuaCodeSetup(const FilterConfig* filter_config,
       return nullptr;
     }
     if (!config_per_route->name().empty()) {
-      ASSERT(filter_config);
-      return filter_config->perLuaCodeSetup(config_per_route->name());
+      return filter_config.perLuaCodeSetup(config_per_route->name());
     }
     return config_per_route->perLuaCodeSetup();
   }
-  ASSERT(filter_config);
-  return filter_config->perLuaCodeSetup(GLOBAL_SCRIPT_NAME);
+  return filter_config.perLuaCodeSetup(GLOBAL_SCRIPT_NAME);
 }
 
 } // namespace
@@ -425,9 +423,9 @@ PerLuaCodeSetup* getPerLuaCodeSetup(const FilterConfig* filter_config,
  */
 class Filter : public Http::StreamFilter, Logger::Loggable<Logger::Id::lua> {
 public:
-  Filter(FilterConfigConstSharedPtr config) : config_(config) {}
+  Filter(const FilterConfig& config) : config_(config) {}
 
-  Upstream::ClusterManager& clusterManager() { return config_->cluster_manager_; }
+  Upstream::ClusterManager& clusterManager() { return config_.cluster_manager_; }
   void scriptError(const Filters::Common::Lua::LuaException& e);
   virtual void scriptLog(spdlog::level::level_enum level, const char* message);
 
@@ -437,7 +435,7 @@ class Filter : public Http::StreamFilter, Logger::Loggable<Logger::Id::lua> {
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap& headers,
                                           bool end_stream) override {
-    PerLuaCodeSetup* setup = getPerLuaCodeSetup(config_.get(), decoder_callbacks_.callbacks_);
+    PerLuaCodeSetup* setup = getPerLuaCodeSetup(config_, decoder_callbacks_.callbacks_);
     const int function_ref = setup ? setup->requestFunctionRef() : LUA_REFNIL;
     return doHeaders(request_stream_wrapper_, request_coroutine_, decoder_callbacks_, function_ref,
                      setup, headers, end_stream);
@@ -458,7 +456,7 @@ class Filter : public Http::StreamFilter, Logger::Loggable<Logger::Id::lua> {
   }
   Http::FilterHeadersStatus encodeHeaders(Http::ResponseHeaderMap& headers,
                                           bool end_stream) override {
-    PerLuaCodeSetup* setup = getPerLuaCodeSetup(config_.get(), decoder_callbacks_.callbacks_);
+    PerLuaCodeSetup* setup = getPerLuaCodeSetup(config_, decoder_callbacks_.callbacks_);
     const int function_ref = setup ? setup->responseFunctionRef() : LUA_REFNIL;
     return doHeaders(response_stream_wrapper_, response_coroutine_, encoder_callbacks_,
                      function_ref, setup, headers, end_stream);
@@ -531,7 +529,7 @@ class Filter : public Http::StreamFilter, Logger::Loggable<Logger::Id::lua> {
   Http::FilterDataStatus doData(StreamHandleRef& handle, Buffer::Instance& data, bool end_stream);
   Http::FilterTrailersStatus doTrailers(StreamHandleRef& handle, Http::HeaderMap& trailers);
 
-  FilterConfigConstSharedPtr config_;
+  const FilterConfig& config_;
   DecoderCallbacks decoder_callbacks_{*this};
   EncoderCallbacks encoder_callbacks_{*this};
   StreamHandleRef request_stream_wrapper_;
diff --git a/source/extensions/filters/http/oauth2/config.cc b/source/extensions/filters/http/oauth2/config.cc
index d51d798874e5..573c210b068f 100644
--- a/source/extensions/filters/http/oauth2/config.cc
+++ b/source/extensions/filters/http/oauth2/config.cc
@@ -75,7 +75,7 @@ Http::FilterFactoryCb OAuth2Config::createFilterFactoryFromProtoTyped(
         std::unique_ptr<OAuth2Client> oauth_client =
             std::make_unique<OAuth2ClientImpl>(cluster_manager, config->oauthTokenEndpoint());
         callbacks.addStreamDecoderFilter(
-            std::make_shared<OAuth2Filter>(config, std::move(oauth_client), context.timeSource()));
+            std::make_shared<OAuth2Filter>(*config, std::move(oauth_client), context.timeSource()));
       };
 }
 
diff --git a/source/extensions/filters/http/oauth2/filter.cc b/source/extensions/filters/http/oauth2/filter.cc
index aa1396ec9302..b62932b3f1ef 100644
--- a/source/extensions/filters/http/oauth2/filter.cc
+++ b/source/extensions/filters/http/oauth2/filter.cc
@@ -135,11 +135,10 @@ bool OAuth2CookieValidator::timestampIsValid() const {
 
 bool OAuth2CookieValidator::isValid() const { return hmacIsValid() && timestampIsValid(); }
 
-OAuth2Filter::OAuth2Filter(FilterConfigSharedPtr config,
-                           std::unique_ptr<OAuth2Client>&& oauth_client, TimeSource& time_source)
+OAuth2Filter::OAuth2Filter(FilterConfig& config, std::unique_ptr<OAuth2Client>&& oauth_client,
+                           TimeSource& time_source)
     : validator_(std::make_shared<OAuth2CookieValidator>(time_source)),
-      oauth_client_(std::move(oauth_client)), config_(std::move(config)),
-      time_source_(time_source) {
+      oauth_client_(std::move(oauth_client)), config_(config), time_source_(time_source) {
 
   oauth_client_->setCallbacks(*this);
 }
@@ -193,7 +192,7 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
   const absl::string_view path_str = path_header->value().getStringView();
 
   // We should check if this is a sign out request.
-  if (config_->signoutPath().match(path_header->value().getStringView())) {
+  if (config_.signoutPath().match(path_header->value().getStringView())) {
     return signOutUser(headers);
   }
 
@@ -204,7 +203,7 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
     // correctly but cause a race condition on future requests that have their location set
     // to the callback path.
 
-    if (config_->redirectPathMatcher().match(path_str)) {
+    if (config_.redirectPathMatcher().match(path_str)) {
       Http::Utility::QueryParams query_parameters = Http::Utility::parseQueryString(path_str);
 
       const auto state =
@@ -215,7 +214,7 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
         return Http::FilterHeadersStatus::StopIteration;
       }
       // Avoid infinite redirect storm
-      if (config_->redirectPathMatcher().match(state_url.pathAndQueryParams())) {
+      if (config_.redirectPathMatcher().match(state_url.pathAndQueryParams())) {
         sendUnauthorizedResponse();
         return Http::FilterHeadersStatus::StopIteration;
       }
@@ -231,7 +230,7 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
   }
 
   // Save the request headers for later modification if needed.
-  if (config_->forwardBearerToken()) {
+  if (config_.forwardBearerToken()) {
     request_headers_ = &headers;
   }
 
@@ -249,7 +248,7 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
   //
   // The following conditional could be replaced with a regex pattern-match,
   // if we're concerned about strict matching against the callback path.
-  if (!config_->redirectPathMatcher().match(path_str)) {
+  if (!config_.redirectPathMatcher().match(path_str)) {
     Http::ResponseHeaderMapPtr response_headers{Http::createHeaderMap<Http::ResponseHeaderMapImpl>(
         {{Http::Headers::get().Status, std::to_string(enumToInt(Http::Code::Found))}})};
 
@@ -268,7 +267,7 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
     const std::string state_path = absl::StrCat(base_path, headers.Path()->value().getStringView());
     const std::string escaped_state = Http::Utility::PercentEncoding::encode(state_path, ":/=&?");
 
-    Formatter::FormatterImpl formatter(config_->redirectUri());
+    Formatter::FormatterImpl formatter(config_.redirectUri());
     const auto redirect_uri = formatter.format(headers, *Http::ResponseHeaderMapImpl::create(),
                                                *Http::ResponseTrailerMapImpl::create(),
                                                decoder_callbacks_->streamInfo(), "");
@@ -276,12 +275,12 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
         Http::Utility::PercentEncoding::encode(redirect_uri, ":/=&?");
 
     const std::string new_url =
-        fmt::format(AuthorizationEndpointFormat, config_->authorizationEndpoint(),
-                    config_->clientId(), escaped_redirect_uri, escaped_state);
+        fmt::format(AuthorizationEndpointFormat, config_.authorizationEndpoint(),
+                    config_.clientId(), escaped_redirect_uri, escaped_state);
     response_headers->setLocation(new_url);
     decoder_callbacks_->encodeHeaders(std::move(response_headers), true, REDIRECT_FOR_CREDENTIALS);
 
-    config_->stats().oauth_unauthorized_rq_.inc();
+    config_.stats().oauth_unauthorized_rq_.inc();
 
     return Http::FilterHeadersStatus::StopIteration;
   }
@@ -311,11 +310,11 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
     return Http::FilterHeadersStatus::StopIteration;
   }
 
-  Formatter::FormatterImpl formatter(config_->redirectUri());
+  Formatter::FormatterImpl formatter(config_.redirectUri());
   const auto redirect_uri = formatter.format(headers, *Http::ResponseHeaderMapImpl::create(),
                                              *Http::ResponseTrailerMapImpl::create(),
                                              decoder_callbacks_->streamInfo(), "");
-  oauth_client_->asyncGetAccessToken(auth_code_, config_->clientId(), config_->clientSecret(),
+  oauth_client_->asyncGetAccessToken(auth_code_, config_.clientId(), config_.clientSecret(),
                                      redirect_uri);
 
   // pause while we await the next step from the OAuth server
@@ -327,16 +326,16 @@ Http::FilterHeadersStatus OAuth2Filter::decodeHeaders(Http::RequestHeaderMap& he
 bool OAuth2Filter::canSkipOAuth(Http::RequestHeaderMap& headers) const {
   // We can skip OAuth if the supplied HMAC cookie is valid. Apply the OAuth details as headers
   // if we successfully validate the cookie.
-  validator_->setParams(headers, config_->tokenSecret());
+  validator_->setParams(headers, config_.tokenSecret());
   if (validator_->isValid()) {
-    config_->stats().oauth_success_.inc();
-    if (config_->forwardBearerToken() && !validator_->token().empty()) {
+    config_.stats().oauth_success_.inc();
+    if (config_.forwardBearerToken() && !validator_->token().empty()) {
       setBearerToken(headers, validator_->token());
     }
     return true;
   }
 
-  for (const auto& matcher : config_->passThroughMatchers()) {
+  for (const auto& matcher : config_.passThroughMatchers()) {
     if (matcher.matchesHeaders(headers)) {
       return true;
     }
@@ -378,16 +377,16 @@ void OAuth2Filter::finishFlow() {
   // We have fully completed the entire OAuth flow, whether through Authorization header or from
   // user redirection to the auth server.
   if (found_bearer_token_) {
-    if (config_->forwardBearerToken()) {
+    if (config_.forwardBearerToken()) {
       setBearerToken(*request_headers_, access_token_);
     }
-    config_->stats().oauth_success_.inc();
+    config_.stats().oauth_success_.inc();
     decoder_callbacks_->continueDecoding();
     return;
   }
 
   std::string token_payload;
-  if (config_->forwardBearerToken()) {
+  if (config_.forwardBearerToken()) {
     token_payload = absl::StrCat(host_, new_expires_, access_token_);
   } else {
     token_payload = absl::StrCat(host_, new_expires_);
@@ -395,7 +394,7 @@ void OAuth2Filter::finishFlow() {
 
   auto& crypto_util = Envoy::Common::Crypto::UtilitySingleton::get();
 
-  auto token_secret = config_->tokenSecret();
+  auto token_secret = config_.tokenSecret();
   std::vector<uint8_t> token_secret_vec(token_secret.begin(), token_secret.end());
   const std::string pre_encoded_token =
       Hex::encode(crypto_util.getSha256Hmac(token_secret_vec, token_payload));
@@ -423,7 +422,7 @@ void OAuth2Filter::finishFlow() {
 
   // If opted-in, we also create a new Bearer cookie for the authorization token provided by the
   // auth server.
-  if (config_->forwardBearerToken()) {
+  if (config_.forwardBearerToken()) {
     response_headers->addReferenceKey(Http::Headers::get().SetCookie,
                                       absl::StrCat("BearerToken=", access_token_, cookie_tail));
   }
@@ -431,12 +430,12 @@ void OAuth2Filter::finishFlow() {
   response_headers->setLocation(state_);
 
   decoder_callbacks_->encodeHeaders(std::move(response_headers), true, REDIRECT_LOGGED_IN);
-  config_->stats().oauth_success_.inc();
+  config_.stats().oauth_success_.inc();
   decoder_callbacks_->continueDecoding();
 }
 
 void OAuth2Filter::sendUnauthorizedResponse() {
-  config_->stats().oauth_failure_.inc();
+  config_.stats().oauth_failure_.inc();
   decoder_callbacks_->sendLocalReply(Http::Code::Unauthorized, UnauthorizedBodyMessage, nullptr,
                                      absl::nullopt, EMPTY_STRING);
 }
diff --git a/source/extensions/filters/http/oauth2/filter.h b/source/extensions/filters/http/oauth2/filter.h
index eae64214ee09..d882d58f192a 100644
--- a/source/extensions/filters/http/oauth2/filter.h
+++ b/source/extensions/filters/http/oauth2/filter.h
@@ -186,7 +186,7 @@ class OAuth2CookieValidator : public CookieValidator {
  */
 class OAuth2Filter : public Http::PassThroughDecoderFilter, public FilterCallbacks {
 public:
-  OAuth2Filter(FilterConfigSharedPtr config, std::unique_ptr<OAuth2Client>&& oauth_client,
+  OAuth2Filter(FilterConfig& config, std::unique_ptr<OAuth2Client>&& oauth_client,
                TimeSource& time_source);
 
   // Http::PassThroughDecoderFilter
@@ -216,7 +216,7 @@ class OAuth2Filter : public Http::PassThroughDecoderFilter, public FilterCallbac
   Http::RequestHeaderMap* request_headers_{nullptr};
 
   std::unique_ptr<OAuth2Client> oauth_client_;
-  FilterConfigSharedPtr config_;
+  FilterConfig& config_;
   TimeSource& time_source_;
 
   // Determines whether or not the current request can skip the entire OAuth flow (HMAC is valid,
diff --git a/source/extensions/filters/http/original_src/original_src.h b/source/extensions/filters/http/original_src/original_src.h
index 032f93ee6304..db0d2808fcf2 100644
--- a/source/extensions/filters/http/original_src/original_src.h
+++ b/source/extensions/filters/http/original_src/original_src.h
@@ -33,7 +33,7 @@ class OriginalSrcFilter : public Http::StreamDecoderFilter, Logger::Loggable<Log
   void setDecoderFilterCallbacks(Http::StreamDecoderFilterCallbacks& callbacks) override;
 
 private:
-  Config config_;
+  const Config& config_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
 };
 
diff --git a/source/extensions/filters/http/ratelimit/config.cc b/source/extensions/filters/http/ratelimit/config.cc
index 912604d37aac..08081f5481d5 100644
--- a/source/extensions/filters/http/ratelimit/config.cc
+++ b/source/extensions/filters/http/ratelimit/config.cc
@@ -22,16 +22,15 @@ Http::FilterFactoryCb RateLimitFilterConfig::createFilterFactoryFromProtoTyped(
     const envoy::extensions::filters::http::ratelimit::v3::RateLimit& proto_config,
     const std::string&, Server::Configuration::FactoryContext& context) {
   ASSERT(!proto_config.domain().empty());
-  FilterConfigSharedPtr filter_config(new FilterConfig(proto_config, context.localInfo(),
-                                                       context.scope(), context.runtime(),
-                                                       context.httpContext()));
+  auto filter_config = std::make_shared<FilterConfig>(
+      proto_config, context.localInfo(), context.scope(), context.runtime(), context.httpContext());
   const std::chrono::milliseconds timeout =
       std::chrono::milliseconds(PROTOBUF_GET_MS_OR_DEFAULT(proto_config, timeout, 20));
 
   return [proto_config, &context, timeout,
           filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamFilter(std::make_shared<Filter>(
-        filter_config,
+        *filter_config,
         Filters::Common::RateLimit::rateLimitClient(
             context, proto_config.rate_limit_service().grpc_service(), timeout,
             Config::Utility::getAndCheckTransportVersion(proto_config.rate_limit_service()))));
diff --git a/source/extensions/filters/http/ratelimit/ratelimit.cc b/source/extensions/filters/http/ratelimit/ratelimit.cc
index 07c11b088e2d..44e55a5604c4 100644
--- a/source/extensions/filters/http/ratelimit/ratelimit.cc
+++ b/source/extensions/filters/http/ratelimit/ratelimit.cc
@@ -30,8 +30,8 @@ using RcDetails = ConstSingleton<RcDetailsValues>;
 
 void Filter::initiateCall(const Http::RequestHeaderMap& headers) {
   const bool is_internal_request = Http::HeaderUtility::isEnvoyInternalRequest(headers);
-  if ((is_internal_request && config_->requestType() == FilterRequestType::External) ||
-      (!is_internal_request && config_->requestType() == FilterRequestType::Internal)) {
+  if ((is_internal_request && config_.requestType() == FilterRequestType::External) ||
+      (!is_internal_request && config_.requestType() == FilterRequestType::Internal)) {
     return;
   }
 
@@ -73,14 +73,14 @@ void Filter::initiateCall(const Http::RequestHeaderMap& headers) {
   if (!descriptors.empty()) {
     state_ = State::Calling;
     initiating_call_ = true;
-    client_->limit(*this, config_->domain(), descriptors, callbacks_->activeSpan(),
+    client_->limit(*this, config_.domain(), descriptors, callbacks_->activeSpan(),
                    callbacks_->streamInfo());
     initiating_call_ = false;
   }
 }
 
 Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers, bool) {
-  if (!config_->runtime().snapshot().featureEnabled("ratelimit.http_filter_enabled", 100)) {
+  if (!config_.runtime().snapshot().featureEnabled("ratelimit.http_filter_enabled", 100)) {
     return Http::FilterHeadersStatus::Continue;
   }
 
@@ -150,7 +150,7 @@ void Filter::complete(Filters::Common::RateLimit::LimitStatus status,
   response_headers_to_add_ = std::move(response_headers_to_add);
   Http::HeaderMapPtr req_headers_to_add = std::move(request_headers_to_add);
   Stats::StatName empty_stat_name;
-  Filters::Common::RateLimit::StatNames& stat_names = config_->statNames();
+  Filters::Common::RateLimit::StatNames& stat_names = config_.statNames();
 
   if (dynamic_metadata != nullptr && !dynamic_metadata->fields().empty()) {
     callbacks_->streamInfo().setDynamicMetadata(HttpFilterNames::get().RateLimit,
@@ -166,7 +166,7 @@ void Filter::complete(Filters::Common::RateLimit::LimitStatus status,
     break;
   case Filters::Common::RateLimit::LimitStatus::OverLimit:
     cluster_->statsScope().counterFromStatName(stat_names.over_limit_).inc();
-    Http::CodeStats::ResponseStatInfo info{config_->scope(),
+    Http::CodeStats::ResponseStatInfo info{config_.scope(),
                                            cluster_->statsScope(),
                                            empty_stat_name,
                                            enumToInt(Http::Code::TooManyRequests),
@@ -177,7 +177,7 @@ void Filter::complete(Filters::Common::RateLimit::LimitStatus status,
                                            empty_stat_name,
                                            false};
     httpContext().codeStats().chargeResponseStat(info);
-    if (config_->enableXEnvoyRateLimitedHeader()) {
+    if (config_.enableXEnvoyRateLimitedHeader()) {
       if (response_headers_to_add_ == nullptr) {
         response_headers_to_add_ = Http::ResponseHeaderMapImpl::create();
       }
@@ -187,7 +187,7 @@ void Filter::complete(Filters::Common::RateLimit::LimitStatus status,
     break;
   }
 
-  if (config_->enableXRateLimitHeaders()) {
+  if (config_.enableXRateLimitHeaders()) {
     Http::ResponseHeaderMapPtr rate_limit_headers =
         XRateLimitHeaderUtils::create(std::move(descriptor_statuses));
     if (response_headers_to_add_ == nullptr) {
@@ -199,17 +199,17 @@ void Filter::complete(Filters::Common::RateLimit::LimitStatus status,
   }
 
   if (status == Filters::Common::RateLimit::LimitStatus::OverLimit &&
-      config_->runtime().snapshot().featureEnabled("ratelimit.http_filter_enforcing", 100)) {
+      config_.runtime().snapshot().featureEnabled("ratelimit.http_filter_enforcing", 100)) {
     state_ = State::Responded;
     callbacks_->sendLocalReply(
         Http::Code::TooManyRequests, response_body,
         [this](Http::HeaderMap& headers) {
           populateResponseHeaders(headers, /*from_local_reply=*/true);
         },
-        config_->rateLimitedGrpcStatus(), RcDetails::get().RateLimited);
+        config_.rateLimitedGrpcStatus(), RcDetails::get().RateLimited);
     callbacks_->streamInfo().setResponseFlag(StreamInfo::ResponseFlag::RateLimited);
   } else if (status == Filters::Common::RateLimit::LimitStatus::Error) {
-    if (config_->failureModeAllow()) {
+    if (config_.failureModeAllow()) {
       cluster_->statsScope().counterFromStatName(stat_names.failure_mode_allowed_).inc();
       if (!initiating_call_) {
         appendRequestHeaders(req_headers_to_add);
@@ -231,14 +231,14 @@ void Filter::populateRateLimitDescriptors(const Router::RateLimitPolicy& rate_li
                                           std::vector<RateLimit::Descriptor>& descriptors,
                                           const Http::RequestHeaderMap& headers) const {
   for (const Router::RateLimitPolicyEntry& rate_limit :
-       rate_limit_policy.getApplicableRateLimit(config_->stage())) {
+       rate_limit_policy.getApplicableRateLimit(config_.stage())) {
     const std::string& disable_key = rate_limit.disableKey();
     if (!disable_key.empty() &&
-        !config_->runtime().snapshot().featureEnabled(
+        !config_.runtime().snapshot().featureEnabled(
             fmt::format("ratelimit.{}.http_filter_enabled", disable_key), 100)) {
       continue;
     }
-    rate_limit.populateDescriptors(descriptors, config_->localInfo().clusterName(), headers,
+    rate_limit.populateDescriptors(descriptors, config_.localInfo().clusterName(), headers,
                                    callbacks_->streamInfo());
   }
 }
diff --git a/source/extensions/filters/http/ratelimit/ratelimit.h b/source/extensions/filters/http/ratelimit/ratelimit.h
index fc0341e050e3..abe15248bce6 100644
--- a/source/extensions/filters/http/ratelimit/ratelimit.h
+++ b/source/extensions/filters/http/ratelimit/ratelimit.h
@@ -122,7 +122,7 @@ class FilterConfigPerRoute : public Router::RouteSpecificFilterConfig {
  */
 class Filter : public Http::StreamFilter, public Filters::Common::RateLimit::RequestCallbacks {
 public:
-  Filter(FilterConfigSharedPtr config, Filters::Common::RateLimit::ClientPtr&& client)
+  Filter(FilterConfig& config, Filters::Common::RateLimit::ClientPtr&& client)
       : config_(config), client_(std::move(client)) {}
 
   // Http::StreamFilterBase
@@ -161,11 +161,11 @@ class Filter : public Http::StreamFilter, public Filters::Common::RateLimit::Req
   void appendRequestHeaders(Http::HeaderMapPtr& request_headers_to_add);
   VhRateLimitOptions getVirtualHostRateLimitOption(const Router::RouteConstSharedPtr& route);
 
-  Http::Context& httpContext() { return config_->httpContext(); }
+  Http::Context& httpContext() { return config_.httpContext(); }
 
   enum class State { NotStarted, Calling, Complete, Responded };
 
-  FilterConfigSharedPtr config_;
+  FilterConfig& config_;
   Filters::Common::RateLimit::ClientPtr client_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
   State state_{State::NotStarted};
diff --git a/source/extensions/filters/http/rbac/config.cc b/source/extensions/filters/http/rbac/config.cc
index 4ead41107d5c..8771130b9e37 100644
--- a/source/extensions/filters/http/rbac/config.cc
+++ b/source/extensions/filters/http/rbac/config.cc
@@ -19,7 +19,7 @@ Http::FilterFactoryCb RoleBasedAccessControlFilterConfigFactory::createFilterFac
                                                                      context.scope());
 
   return [config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    callbacks.addStreamDecoderFilter(std::make_shared<RoleBasedAccessControlFilter>(config));
+    callbacks.addStreamDecoderFilter(std::make_shared<RoleBasedAccessControlFilter>(*config));
   };
 }
 
diff --git a/source/extensions/filters/http/rbac/rbac_filter.cc b/source/extensions/filters/http/rbac/rbac_filter.cc
index 9f50eea99de2..0d1d9457ab25 100644
--- a/source/extensions/filters/http/rbac/rbac_filter.cc
+++ b/source/extensions/filters/http/rbac/rbac_filter.cc
@@ -69,7 +69,7 @@ RoleBasedAccessControlFilter::decodeHeaders(Http::RequestHeaderMap& headers, boo
 
   std::string effective_policy_id;
   const auto shadow_engine =
-      config_->engine(callbacks_->route(), Filters::Common::RBAC::EnforcementMode::Shadow);
+      config_.engine(callbacks_->route(), Filters::Common::RBAC::EnforcementMode::Shadow);
 
   if (shadow_engine != nullptr) {
     std::string shadow_resp_code =
@@ -78,11 +78,11 @@ RoleBasedAccessControlFilter::decodeHeaders(Http::RequestHeaderMap& headers, boo
                                     &effective_policy_id)) {
       ENVOY_LOG(debug, "shadow allowed, matched policy {}",
                 effective_policy_id.empty() ? "none" : effective_policy_id);
-      config_->stats().shadow_allowed_.inc();
+      config_.stats().shadow_allowed_.inc();
     } else {
       ENVOY_LOG(debug, "shadow denied, matched policy {}",
                 effective_policy_id.empty() ? "none" : effective_policy_id);
-      config_->stats().shadow_denied_.inc();
+      config_.stats().shadow_denied_.inc();
       shadow_resp_code =
           Filters::Common::RBAC::DynamicMetadataKeysSingleton::get().EngineResultDenied;
     }
@@ -103,7 +103,7 @@ RoleBasedAccessControlFilter::decodeHeaders(Http::RequestHeaderMap& headers, boo
   }
 
   const auto engine =
-      config_->engine(callbacks_->route(), Filters::Common::RBAC::EnforcementMode::Enforced);
+      config_.engine(callbacks_->route(), Filters::Common::RBAC::EnforcementMode::Enforced);
   if (engine != nullptr) {
     std::string effective_policy_id;
     bool allowed = engine->handleAction(*callbacks_->connection(), headers,
@@ -111,14 +111,14 @@ RoleBasedAccessControlFilter::decodeHeaders(Http::RequestHeaderMap& headers, boo
     const std::string log_policy_id = effective_policy_id.empty() ? "none" : effective_policy_id;
     if (allowed) {
       ENVOY_LOG(debug, "enforced allowed, matched policy {}", log_policy_id);
-      config_->stats().allowed_.inc();
+      config_.stats().allowed_.inc();
       return Http::FilterHeadersStatus::Continue;
     } else {
       ENVOY_LOG(debug, "enforced denied, matched policy {}", log_policy_id);
       callbacks_->sendLocalReply(Http::Code::Forbidden, "RBAC: access denied", nullptr,
                                  absl::nullopt,
                                  Filters::Common::RBAC::responseDetail(log_policy_id));
-      config_->stats().denied_.inc();
+      config_.stats().denied_.inc();
       return Http::FilterHeadersStatus::StopIteration;
     }
   }
diff --git a/source/extensions/filters/http/rbac/rbac_filter.h b/source/extensions/filters/http/rbac/rbac_filter.h
index fe7369e34e6b..a01d941abd11 100644
--- a/source/extensions/filters/http/rbac/rbac_filter.h
+++ b/source/extensions/filters/http/rbac/rbac_filter.h
@@ -70,8 +70,7 @@ using RoleBasedAccessControlFilterConfigSharedPtr =
 class RoleBasedAccessControlFilter : public Http::StreamDecoderFilter,
                                      public Logger::Loggable<Logger::Id::rbac> {
 public:
-  RoleBasedAccessControlFilter(RoleBasedAccessControlFilterConfigSharedPtr config)
-      : config_(config) {}
+  RoleBasedAccessControlFilter(RoleBasedAccessControlFilterConfig& config) : config_(config) {}
 
   // Http::StreamDecoderFilter
   Http::FilterHeadersStatus decodeHeaders(Http::RequestHeaderMap& headers,
@@ -93,7 +92,7 @@ class RoleBasedAccessControlFilter : public Http::StreamDecoderFilter,
   void onDestroy() override {}
 
 private:
-  RoleBasedAccessControlFilterConfigSharedPtr config_;
+  RoleBasedAccessControlFilterConfig& config_;
   Http::StreamDecoderFilterCallbacks* callbacks_{};
 };
 
diff --git a/source/extensions/filters/http/squash/config.cc b/source/extensions/filters/http/squash/config.cc
index 34dd36353a13..a354aa10a988 100644
--- a/source/extensions/filters/http/squash/config.cc
+++ b/source/extensions/filters/http/squash/config.cc
@@ -18,12 +18,11 @@ Http::FilterFactoryCb SquashFilterConfigFactory::createFilterFactoryFromProtoTyp
     const envoy::extensions::filters::http::squash::v3::Squash& proto_config, const std::string&,
     Server::Configuration::FactoryContext& context) {
 
-  SquashFilterConfigSharedPtr config = std::make_shared<SquashFilterConfig>(
-      SquashFilterConfig(proto_config, context.clusterManager()));
+  auto config = std::make_shared<SquashFilterConfig>(proto_config, context.clusterManager());
 
   return [&context, config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
     callbacks.addStreamDecoderFilter(
-        std::make_shared<SquashFilter>(config, context.clusterManager()));
+        std::make_shared<SquashFilter>(*config, context.clusterManager()));
   };
 }
 
diff --git a/source/extensions/filters/http/squash/squash_filter.cc b/source/extensions/filters/http/squash/squash_filter.cc
index bca43dceb5a3..481a342b4d28 100644
--- a/source/extensions/filters/http/squash/squash_filter.cc
+++ b/source/extensions/filters/http/squash/squash_filter.cc
@@ -123,7 +123,7 @@ std::string SquashFilterConfig::replaceEnv(const std::string& attachment_templat
   return s;
 }
 
-SquashFilter::SquashFilter(SquashFilterConfigSharedPtr config, Upstream::ClusterManager& cm)
+SquashFilter::SquashFilter(SquashFilterConfig& config, Upstream::ClusterManager& cm)
     : config_(config), is_squashing_(false), attachment_poll_period_timer_(nullptr),
       attachment_timeout_timer_(nullptr), in_flight_request_(nullptr),
       create_attachment_callback_(std::bind(&SquashFilter::onCreateAttachmentSuccess, this, _1),
@@ -149,14 +149,14 @@ Http::FilterHeadersStatus SquashFilter::decodeHeaders(Http::RequestHeaderMap& he
   request->headers().setReferencePath(POST_ATTACHMENT_PATH);
   request->headers().setReferenceHost(SERVER_AUTHORITY);
   request->headers().setReferenceMethod(Http::Headers::get().MethodValues.Post);
-  request->body().add(config_->attachmentJson());
+  request->body().add(config_.attachmentJson());
 
   is_squashing_ = true;
-  const auto thread_local_cluster = cm_.getThreadLocalCluster(config_->clusterName());
+  const auto thread_local_cluster = cm_.getThreadLocalCluster(config_.clusterName());
   if (thread_local_cluster != nullptr) {
     in_flight_request_ = thread_local_cluster->httpAsyncClient().send(
         std::move(request), create_attachment_callback_,
-        Http::AsyncClient::RequestOptions().setTimeout(config_->requestTimeout()));
+        Http::AsyncClient::RequestOptions().setTimeout(config_.requestTimeout()));
   }
 
   if (in_flight_request_ == nullptr) {
@@ -167,8 +167,7 @@ Http::FilterHeadersStatus SquashFilter::decodeHeaders(Http::RequestHeaderMap& he
 
   attachment_timeout_timer_ =
       decoder_callbacks_->dispatcher().createTimer([this]() -> void { doneSquashing(); });
-  attachment_timeout_timer_->enableTimer(config_->attachmentTimeout(),
-                                         &decoder_callbacks_->scope());
+  attachment_timeout_timer_->enableTimer(config_.attachmentTimeout(), &decoder_callbacks_->scope());
   // Check if the timer expired inline.
   if (!is_squashing_) {
     return Http::FilterHeadersStatus::Continue;
@@ -266,7 +265,7 @@ void SquashFilter::scheduleRetry() {
     attachment_poll_period_timer_ =
         decoder_callbacks_->dispatcher().createTimer([this]() -> void { pollForAttachment(); });
   }
-  attachment_poll_period_timer_->enableTimer(config_->attachmentPollPeriod(),
+  attachment_poll_period_timer_->enableTimer(config_.attachmentPollPeriod(),
                                              &decoder_callbacks_->scope());
 }
 
@@ -276,11 +275,11 @@ void SquashFilter::pollForAttachment() {
   request->headers().setReferencePath(debug_attachment_path_);
   request->headers().setReferenceHost(SERVER_AUTHORITY);
 
-  const auto thread_local_cluster = cm_.getThreadLocalCluster(config_->clusterName());
+  const auto thread_local_cluster = cm_.getThreadLocalCluster(config_.clusterName());
   if (thread_local_cluster != nullptr) {
     in_flight_request_ = thread_local_cluster->httpAsyncClient().send(
         std::move(request), check_attachment_callback_,
-        Http::AsyncClient::RequestOptions().setTimeout(config_->requestTimeout()));
+        Http::AsyncClient::RequestOptions().setTimeout(config_.requestTimeout()));
   } else {
     scheduleRetry();
   }
diff --git a/source/extensions/filters/http/squash/squash_filter.h b/source/extensions/filters/http/squash/squash_filter.h
index d654e7f22088..d0ffe4d06a7d 100644
--- a/source/extensions/filters/http/squash/squash_filter.h
+++ b/source/extensions/filters/http/squash/squash_filter.h
@@ -78,7 +78,7 @@ class AsyncClientCallbackShim : public Http::AsyncClient::Callbacks {
 class SquashFilter : public Http::StreamDecoderFilter,
                      protected Logger::Loggable<Logger::Id::filter> {
 public:
-  SquashFilter(SquashFilterConfigSharedPtr config, Upstream::ClusterManager& cm);
+  SquashFilter(SquashFilterConfig& config, Upstream::ClusterManager& cm);
   ~SquashFilter() override;
 
   // Http::StreamFilterBase
@@ -108,7 +108,7 @@ class SquashFilter : public Http::StreamDecoderFilter,
   // Creates a JSON from the message body.
   Json::ObjectSharedPtr getJsonBody(Http::ResponseMessagePtr&& m);
 
-  const SquashFilterConfigSharedPtr config_;
+  const SquashFilterConfig& config_;
 
   // Current state of the squash filter. If is_squashing_ is true, Hold the request while we
   // communicate with the squash server to attach a debugger. If it is false, let the request
diff --git a/source/extensions/filters/http/tap/config.cc b/source/extensions/filters/http/tap/config.cc
index 1137022a7ff1..d6c7e540d443 100644
--- a/source/extensions/filters/http/tap/config.cc
+++ b/source/extensions/filters/http/tap/config.cc
@@ -30,7 +30,7 @@ Http::FilterFactoryCb TapFilterFactory::createFilterFactoryFromProtoTyped(
       proto_config, stats_prefix, std::make_unique<HttpTapConfigFactoryImpl>(), context.scope(),
       context.admin(), context.singletonManager(), context.threadLocal(), context.dispatcher()));
   return [filter_config](Http::FilterChainFactoryCallbacks& callbacks) -> void {
-    auto filter = std::make_shared<Filter>(filter_config);
+    auto filter = std::make_shared<Filter>(*filter_config);
     callbacks.addStreamFilter(filter);
     callbacks.addAccessLogHandler(filter);
   };
diff --git a/source/extensions/filters/http/tap/tap_filter.cc b/source/extensions/filters/http/tap/tap_filter.cc
index 3e7cf36c193b..b5ddc5eab63f 100644
--- a/source/extensions/filters/http/tap/tap_filter.cc
+++ b/source/extensions/filters/http/tap/tap_filter.cc
@@ -72,7 +72,7 @@ Http::FilterTrailersStatus Filter::encodeTrailers(Http::ResponseTrailerMap& trai
 void Filter::log(const Http::RequestHeaderMap*, const Http::ResponseHeaderMap*,
                  const Http::ResponseTrailerMap*, const StreamInfo::StreamInfo&) {
   if (tapper_ != nullptr && tapper_->onDestroyLog()) {
-    config_->stats().rq_tapped_.inc();
+    config_.stats().rq_tapped_.inc();
   }
 }
 
diff --git a/source/extensions/filters/http/tap/tap_filter.h b/source/extensions/filters/http/tap/tap_filter.h
index 585d1af8b81f..c073a75496c3 100644
--- a/source/extensions/filters/http/tap/tap_filter.h
+++ b/source/extensions/filters/http/tap/tap_filter.h
@@ -75,7 +75,7 @@ class FilterConfigImpl : public FilterConfig, public Extensions::Common::Tap::Ex
  */
 class Filter : public Http::StreamFilter, public AccessLog::Instance {
 public:
-  Filter(FilterConfigSharedPtr config) : config_(std::move(config)) {}
+  Filter(FilterConfig& config) : config_(config) {}
 
   static FilterStats generateStats(const std::string& prefix, Stats::Scope& scope);
 
@@ -88,7 +88,7 @@ class Filter : public Http::StreamFilter, public AccessLog::Instance {
   Http::FilterDataStatus decodeData(Buffer::Instance& data, bool end_stream) override;
   Http::FilterTrailersStatus decodeTrailers(Http::RequestTrailerMap& trailers) override;
   void setDecoderFilterCallbacks(Http::StreamDecoderFilterCallbacks& callbacks) override {
-    HttpTapConfigSharedPtr config = config_->currentConfig();
+    HttpTapConfigSharedPtr config = config_.currentConfig();
     tapper_ = config ? config->createPerRequestTapper(callbacks.streamId()) : nullptr;
   }
 
@@ -112,7 +112,7 @@ class Filter : public Http::StreamFilter, public AccessLog::Instance {
            const StreamInfo::StreamInfo& stream_info) override;
 
 private:
-  FilterConfigSharedPtr config_;
+  FilterConfig& config_;
   HttpPerRequestTapperPtr tapper_;
 };
 
diff --git a/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc b/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc
index e05cbea0ce56..7b46931e83b1 100644
--- a/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc
+++ b/test/extensions/filters/http/adaptive_concurrency/adaptive_concurrency_filter_test.cc
@@ -40,10 +40,10 @@ class AdaptiveConcurrencyFilterTest : public testing::Test {
 
   void SetUp() override {
     const envoy::extensions::filters::http::adaptive_concurrency::v3::AdaptiveConcurrency config;
-    auto config_ptr = std::make_shared<AdaptiveConcurrencyFilterConfig>(
-        config, runtime_, "testprefix.", stats_, time_system_);
+    config_ = std::make_shared<AdaptiveConcurrencyFilterConfig>(config, runtime_, "testprefix.",
+                                                                stats_, time_system_);
 
-    filter_ = std::make_unique<AdaptiveConcurrencyFilter>(config_ptr, controller_);
+    filter_ = std::make_unique<AdaptiveConcurrencyFilter>(*config_, *controller_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
     filter_->setEncoderFilterCallbacks(encoder_callbacks_);
   }
@@ -63,6 +63,7 @@ class AdaptiveConcurrencyFilterTest : public testing::Test {
   std::shared_ptr<MockConcurrencyController> controller_{new MockConcurrencyController()};
   NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
   NiceMock<Http::MockStreamEncoderFilterCallbacks> encoder_callbacks_;
+  std::shared_ptr<AdaptiveConcurrencyFilterConfig> config_;
   std::unique_ptr<AdaptiveConcurrencyFilter> filter_;
 };
 
@@ -88,7 +89,7 @@ TEST_F(AdaptiveConcurrencyFilterTest, TestEnableOverriddenFromRuntime) {
 
   auto config_ptr = std::make_shared<AdaptiveConcurrencyFilterConfig>(
       config, runtime_, "testprefix.", stats_, time_system_);
-  filter_ = std::make_unique<AdaptiveConcurrencyFilter>(config_ptr, controller_);
+  filter_ = std::make_unique<AdaptiveConcurrencyFilter>(*config_ptr, *controller_);
   filter_->setDecoderFilterCallbacks(decoder_callbacks_);
   filter_->setEncoderFilterCallbacks(encoder_callbacks_);
 
@@ -158,7 +159,7 @@ TEST_F(AdaptiveConcurrencyFilterTest, TestNanosValidationPass) {
 
   auto config_ptr = std::make_shared<AdaptiveConcurrencyFilterConfig>(
       config, runtime_, "testprefix.", stats_, time_system_);
-  filter_ = std::make_unique<AdaptiveConcurrencyFilter>(config_ptr, controller_);
+  filter_ = std::make_unique<AdaptiveConcurrencyFilter>(*config_ptr, *controller_);
   filter_->setDecoderFilterCallbacks(decoder_callbacks_);
   filter_->setEncoderFilterCallbacks(encoder_callbacks_);
 
@@ -207,7 +208,7 @@ TEST_F(AdaptiveConcurrencyFilterTest, TestEnableConfiguredInProto) {
 
   auto config_ptr = std::make_shared<AdaptiveConcurrencyFilterConfig>(
       config, runtime_, "testprefix.", stats_, time_system_);
-  filter_ = std::make_unique<AdaptiveConcurrencyFilter>(config_ptr, controller_);
+  filter_ = std::make_unique<AdaptiveConcurrencyFilter>(*config_ptr, *controller_);
   filter_->setDecoderFilterCallbacks(decoder_callbacks_);
   filter_->setEncoderFilterCallbacks(encoder_callbacks_);
 
diff --git a/test/extensions/filters/http/admission_control/admission_control_filter_test.cc b/test/extensions/filters/http/admission_control/admission_control_filter_test.cc
index 847c0c0bb8a9..1d6065f686ea 100644
--- a/test/extensions/filters/http/admission_control/admission_control_filter_test.cc
+++ b/test/extensions/filters/http/admission_control/admission_control_filter_test.cc
@@ -76,7 +76,7 @@ class AdmissionControlTest : public testing::Test {
   }
 
   void setupFilter(std::shared_ptr<AdmissionControlFilterConfig> config) {
-    filter_ = std::make_shared<AdmissionControlFilter>(config, "test_prefix.");
+    filter_ = std::make_shared<AdmissionControlFilter>(*config, "test_prefix.");
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
   }
 
diff --git a/test/extensions/filters/http/aws_request_signing/aws_request_signing_filter_test.cc b/test/extensions/filters/http/aws_request_signing/aws_request_signing_filter_test.cc
index 9fb6968faed7..594337a5181d 100644
--- a/test/extensions/filters/http/aws_request_signing/aws_request_signing_filter_test.cc
+++ b/test/extensions/filters/http/aws_request_signing/aws_request_signing_filter_test.cc
@@ -31,7 +31,7 @@ class AwsRequestSigningFilterTest : public testing::Test {
 public:
   void setup() {
     filter_config_ = std::make_shared<MockFilterConfig>();
-    filter_ = std::make_unique<Filter>(filter_config_);
+    filter_ = std::make_unique<Filter>(*filter_config_);
   }
 
   std::shared_ptr<MockFilterConfig> filter_config_;
diff --git a/test/extensions/filters/http/buffer/buffer_filter_test.cc b/test/extensions/filters/http/buffer/buffer_filter_test.cc
index 34ce1e2211b6..74b23e62819a 100644
--- a/test/extensions/filters/http/buffer/buffer_filter_test.cc
+++ b/test/extensions/filters/http/buffer/buffer_filter_test.cc
@@ -35,7 +35,7 @@ class BufferFilterTest : public testing::Test {
     return std::make_shared<BufferFilterConfig>(proto_config);
   }
 
-  BufferFilterTest() : config_(setupConfig()), filter_(config_) {
+  BufferFilterTest() : config_(setupConfig()), filter_(*config_) {
     filter_.setDecoderFilterCallbacks(callbacks_);
   }
 
diff --git a/test/extensions/filters/http/common/compressor/compressor_filter_speed_test.cc b/test/extensions/filters/http/common/compressor/compressor_filter_speed_test.cc
index 9056ddc0ac3d..7afccf1f53c8 100644
--- a/test/extensions/filters/http/common/compressor/compressor_filter_speed_test.cc
+++ b/test/extensions/filters/http/common/compressor/compressor_filter_speed_test.cc
@@ -106,7 +106,7 @@ static Result compressWith(std::vector<Buffer::OwnedImpl>&& chunks, CompressionP
   ON_CALL(runtime.snapshot_, featureEnabled("test.filter_enabled", 100))
       .WillByDefault(Return(true));
 
-  auto filter = std::make_unique<CompressorFilter>(config);
+  auto filter = std::make_unique<CompressorFilter>(*config);
   filter->setDecoderFilterCallbacks(decoder_callbacks);
 
   Http::TestRequestHeaderMapImpl headers = {{":method", "get"}, {"accept-encoding", "gzip"}};
diff --git a/test/extensions/filters/http/common/compressor/compressor_filter_test.cc b/test/extensions/filters/http/common/compressor/compressor_filter_test.cc
index c8b4b79093e7..c73bf1a17100 100644
--- a/test/extensions/filters/http/common/compressor/compressor_filter_test.cc
+++ b/test/extensions/filters/http/common/compressor/compressor_filter_test.cc
@@ -71,9 +71,11 @@ class CompressorFilterTest : public testing::Test {
     TestUtility::loadFromJson(json, compressor);
     config_ =
         std::make_shared<TestCompressorFilterConfig>(compressor, "test.", stats_, runtime_, "test");
-    filter_ = std::make_unique<CompressorFilter>(config_);
-    filter_->setDecoderFilterCallbacks(decoder_callbacks_);
-    filter_->setEncoderFilterCallbacks(encoder_callbacks_);
+    filter_ = std::make_unique<CompressorFilter>(*config_);
+    decoder_callbacks_ = std::make_shared<NiceMock<Http::MockStreamDecoderFilterCallbacks>>();
+    encoder_callbacks_ = std::make_shared<NiceMock<Http::MockStreamEncoderFilterCallbacks>>();
+    filter_->setDecoderFilterCallbacks(*decoder_callbacks_);
+    filter_->setEncoderFilterCallbacks(*encoder_callbacks_);
   }
 
   void verifyCompressedData() {
@@ -106,7 +108,7 @@ class CompressorFilterTest : public testing::Test {
     EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->decodeData(data_, false));
     if (with_compression) {
       if (with_trailers) {
-        EXPECT_CALL(decoder_callbacks_, addDecodedData(_, true))
+        EXPECT_CALL(*decoder_callbacks_, addDecodedData(_, true))
             .WillOnce(Invoke([&](Buffer::Instance& data, bool) { data_.move(data); }));
         Http::TestRequestTrailerMapImpl trailers;
         EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->decodeTrailers(trailers));
@@ -150,7 +152,7 @@ class CompressorFilterTest : public testing::Test {
       EXPECT_EQ("test", headers.get_("content-encoding"));
       EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->encodeData(data_, !with_trailers));
       if (with_trailers) {
-        EXPECT_CALL(encoder_callbacks_, addEncodedData(_, true))
+        EXPECT_CALL(*encoder_callbacks_, addEncodedData(_, true))
             .WillOnce(Invoke([&](Buffer::Instance& data, bool) { data_.move(data); }));
         Http::TestResponseTrailerMapImpl trailers;
         EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->encodeTrailers(trailers));
@@ -165,15 +167,15 @@ class CompressorFilterTest : public testing::Test {
     }
   }
 
+  Stats::TestUtil::TestStore stats_;
+  NiceMock<Runtime::MockLoader> runtime_;
   std::shared_ptr<TestCompressorFilterConfig> config_;
-  std::unique_ptr<CompressorFilter> filter_;
+  std::shared_ptr<NiceMock<Http::MockStreamDecoderFilterCallbacks>> decoder_callbacks_;
+  std::shared_ptr<NiceMock<Http::MockStreamEncoderFilterCallbacks>> encoder_callbacks_;
   Buffer::OwnedImpl data_;
   std::string expected_str_;
   std::string response_stats_prefix_{};
-  Stats::TestUtil::TestStore stats_;
-  NiceMock<Runtime::MockLoader> runtime_;
-  NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
-  NiceMock<Http::MockStreamEncoderFilterCallbacks> encoder_callbacks_;
+  std::unique_ptr<CompressorFilter> filter_;
 };
 
 // Test if Runtime Feature is Disabled
@@ -653,10 +655,10 @@ class MultipleFiltersTest : public testing::Test {
 }
 )EOF",
                               compressor);
-    auto config1 = std::make_shared<TestCompressorFilterConfig>(compressor, "test1.", stats1_,
-                                                                runtime_, "test1");
-    config1->setExpectedCompressCalls(0);
-    filter1_ = std::make_unique<CompressorFilter>(config1);
+    config1_ = std::make_shared<TestCompressorFilterConfig>(compressor, "test1.", stats1_, runtime_,
+                                                            "test1");
+    config1_->setExpectedCompressCalls(0);
+    filter1_ = std::make_unique<CompressorFilter>(*config1_);
 
     TestUtility::loadFromJson(R"EOF(
 {
@@ -669,15 +671,17 @@ class MultipleFiltersTest : public testing::Test {
 }
 )EOF",
                               compressor);
-    auto config2 = std::make_shared<TestCompressorFilterConfig>(compressor, "test2.", stats2_,
-                                                                runtime_, "test2");
-    config2->setExpectedCompressCalls(0);
-    filter2_ = std::make_unique<CompressorFilter>(config2);
+    config2_ = std::make_shared<TestCompressorFilterConfig>(compressor, "test2.", stats2_, runtime_,
+                                                            "test2");
+    config2_->setExpectedCompressCalls(0);
+    filter2_ = std::make_unique<CompressorFilter>(*config2_);
   }
 
   NiceMock<Runtime::MockLoader> runtime_;
   Stats::TestUtil::TestStore stats1_;
   Stats::TestUtil::TestStore stats2_;
+  std::shared_ptr<TestCompressorFilterConfig> config1_;
+  std::shared_ptr<TestCompressorFilterConfig> config2_;
   std::unique_ptr<CompressorFilter> filter1_;
   std::unique_ptr<CompressorFilter> filter2_;
 };
@@ -767,7 +771,7 @@ TEST(LegacyTest, GzipStats) {
   auto config =
       std::make_shared<TestCompressorFilterConfig>(compressor, "test.", stats, runtime, "gzip");
   config->setExpectedCompressCalls(0);
-  auto gzip_filter = std::make_unique<CompressorFilter>(config);
+  auto gzip_filter = std::make_unique<CompressorFilter>(*config);
   NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks;
   gzip_filter->setDecoderFilterCallbacks(decoder_callbacks);
   Http::TestRequestHeaderMapImpl req_headers{{":method", "get"},
diff --git a/test/extensions/filters/http/cors/cors_filter_test.cc b/test/extensions/filters/http/cors/cors_filter_test.cc
index 1c49f88eed1b..fd7ee1f2beb1 100644
--- a/test/extensions/filters/http/cors/cors_filter_test.cc
+++ b/test/extensions/filters/http/cors/cors_filter_test.cc
@@ -39,7 +39,7 @@ Matchers::StringMatcherPtr makeStdRegexStringMatcher(const std::string& regex) {
 
 class CorsFilterTest : public testing::Test {
 public:
-  CorsFilterTest() : config_(new CorsFilterConfig("test.", stats_)), filter_(config_) {
+  CorsFilterTest() : config_(new CorsFilterConfig("test.", stats_)), filter_(*config_) {
     cors_policy_ = std::make_unique<Router::TestCorsPolicy>();
     cors_policy_->enabled_ = true;
     cors_policy_->shadow_enabled_ = false;
diff --git a/test/extensions/filters/http/csrf/csrf_filter_test.cc b/test/extensions/filters/http/csrf/csrf_filter_test.cc
index c2e864d40ad1..e0a16b467e6e 100644
--- a/test/extensions/filters/http/csrf/csrf_filter_test.cc
+++ b/test/extensions/filters/http/csrf/csrf_filter_test.cc
@@ -47,7 +47,7 @@ class CsrfFilterTest : public testing::Test {
     return std::make_shared<CsrfFilterConfig>(policy, "test", stats_, runtime_);
   }
 
-  CsrfFilterTest() : config_(setupConfig()), filter_(config_) {}
+  CsrfFilterTest() : config_(setupConfig()), filter_(*config_) {}
 
   void SetUp() override {
     setRoutePolicy(config_->policy());
diff --git a/test/extensions/filters/http/decompressor/decompressor_filter_test.cc b/test/extensions/filters/http/decompressor/decompressor_filter_test.cc
index bd8f8891d3ec..2b5a3591456d 100644
--- a/test/extensions/filters/http/decompressor/decompressor_filter_test.cc
+++ b/test/extensions/filters/http/decompressor/decompressor_filter_test.cc
@@ -44,7 +44,7 @@ class DecompressorFilterTest : public testing::TestWithParam<bool> {
     decompressor_factory_ = decompressor_factory.get();
     config_ = std::make_shared<DecompressorFilterConfig>(decompressor, "test.", stats_, runtime_,
                                                          std::move(decompressor_factory));
-    filter_ = std::make_unique<DecompressorFilter>(config_);
+    filter_ = std::make_unique<DecompressorFilter>(*config_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
     filter_->setEncoderFilterCallbacks(encoder_callbacks_);
   }
@@ -207,10 +207,10 @@ class DecompressorFilterTest : public testing::TestWithParam<bool> {
   }
 
   Compression::Decompressor::MockDecompressorFactory* decompressor_factory_{};
-  DecompressorFilterConfigSharedPtr config_;
-  std::unique_ptr<DecompressorFilter> filter_;
   Stats::TestUtil::TestStore stats_;
   NiceMock<Runtime::MockLoader> runtime_;
+  DecompressorFilterConfigSharedPtr config_;
+  std::unique_ptr<DecompressorFilter> filter_;
   NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
   NiceMock<Http::MockStreamEncoderFilterCallbacks> encoder_callbacks_;
 };
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
index 6af89ae829ec..b630da3f6691 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
+++ b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
@@ -43,7 +43,7 @@ class ProxyFilterTest : public testing::Test,
     envoy::extensions::filters::http::dynamic_forward_proxy::v3::FilterConfig proto_config;
     EXPECT_CALL(*dns_cache_manager_, getCache(_));
     filter_config_ = std::make_shared<ProxyFilterConfig>(proto_config, *this, cm_);
-    filter_ = std::make_unique<ProxyFilter>(filter_config_);
+    filter_ = std::make_unique<ProxyFilter>(*filter_config_);
     filter_->setDecoderFilterCallbacks(callbacks_);
 
     // Allow for an otherwise strict mock.
@@ -172,7 +172,7 @@ TEST_F(ProxyFilterTest, CircuitBreakerOverflow) {
             filter_->decodeHeaders(request_headers_, false));
 
   // Create a second filter for a 2nd request.
-  auto filter2 = std::make_unique<ProxyFilter>(filter_config_);
+  auto filter2 = std::make_unique<ProxyFilter>(*filter_config_);
   filter2->setDecoderFilterCallbacks(callbacks_);
   EXPECT_CALL(callbacks_, route());
   EXPECT_CALL(cm_, getThreadLocalCluster(_));
@@ -211,7 +211,7 @@ TEST_F(ProxyFilterTest, CircuitBreakerOverflowWithDnsCacheResourceManager) {
             filter_->decodeHeaders(request_headers_, false));
 
   // Create a second filter for a 2nd request.
-  auto filter2 = std::make_unique<ProxyFilter>(filter_config_);
+  auto filter2 = std::make_unique<ProxyFilter>(*filter_config_);
   filter2->setDecoderFilterCallbacks(callbacks_);
   EXPECT_CALL(callbacks_, route());
   EXPECT_CALL(cm_, getThreadLocalCluster(_));
diff --git a/test/extensions/filters/http/ext_authz/ext_authz_test.cc b/test/extensions/filters/http/ext_authz/ext_authz_test.cc
index 677349a277ea..1e364d75358a 100644
--- a/test/extensions/filters/http/ext_authz/ext_authz_test.cc
+++ b/test/extensions/filters/http/ext_authz/ext_authz_test.cc
@@ -61,7 +61,7 @@ template <class T> class HttpFilterTestBase : public T {
     config_.reset(
         new FilterConfig(proto_config, stats_store_, runtime_, http_context_, "ext_authz_prefix"));
     client_ = new Filters::Common::ExtAuthz::MockClient();
-    filter_ = std::make_unique<Filter>(config_, Filters::Common::ExtAuthz::ClientPtr{client_});
+    filter_ = std::make_unique<Filter>(*config_, Filters::Common::ExtAuthz::ClientPtr{client_});
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
     addr_ = std::make_shared<Network::Address::Ipv4Instance>("1.2.3.4", 1111);
   }
diff --git a/test/extensions/filters/http/ext_proc/filter_test.cc b/test/extensions/filters/http/ext_proc/filter_test.cc
index bbd43d1f240d..9bac9a4a1564 100644
--- a/test/extensions/filters/http/ext_proc/filter_test.cc
+++ b/test/extensions/filters/http/ext_proc/filter_test.cc
@@ -49,7 +49,7 @@ class HttpFilterTest : public testing::Test {
       TestUtility::loadFromYaml(yaml, proto_config);
     }
     config_.reset(new FilterConfig(proto_config, 200ms, stats_store_, ""));
-    filter_ = std::make_unique<Filter>(config_, std::move(client_));
+    filter_ = std::make_unique<Filter>(*config_, std::move(client_));
     filter_->setEncoderFilterCallbacks(encoder_callbacks_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
   }
@@ -564,4 +564,4 @@ TEST_F(HttpFilterTest, OutOfOrder) {
 } // namespace ExternalProcessing
 } // namespace HttpFilters
 } // namespace Extensions
-} // namespace Envoy
\ No newline at end of file
+} // namespace Envoy
diff --git a/test/extensions/filters/http/fault/fault_filter_test.cc b/test/extensions/filters/http/fault/fault_filter_test.cc
index 63707e4d96e9..1c2e9875dd4d 100644
--- a/test/extensions/filters/http/fault/fault_filter_test.cc
+++ b/test/extensions/filters/http/fault/fault_filter_test.cc
@@ -124,7 +124,7 @@ class FaultFilterTest : public testing::Test {
 
   void SetUpTest(const envoy::extensions::filters::http::fault::v3::HTTPFault fault) {
     config_ = std::make_shared<FaultFilterConfig>(fault, runtime_, "prefix.", stats_, time_system_);
-    filter_ = std::make_unique<FaultFilter>(config_);
+    filter_ = std::make_unique<FaultFilter>(*config_);
     filter_->setDecoderFilterCallbacks(decoder_filter_callbacks_);
     filter_->setEncoderFilterCallbacks(encoder_filter_callbacks_);
     EXPECT_CALL(decoder_filter_callbacks_.dispatcher_, setTrackedObject(_)).Times(AnyNumber());
diff --git a/test/extensions/filters/http/grpc_stats/config_test.cc b/test/extensions/filters/http/grpc_stats/config_test.cc
index 5a405dbfe847..e4c02fb5d4ef 100644
--- a/test/extensions/filters/http/grpc_stats/config_test.cc
+++ b/test/extensions/filters/http/grpc_stats/config_test.cc
@@ -27,12 +27,12 @@ class GrpcStatsFilterConfigTest : public testing::Test {
 protected:
   void initialize() {
     GrpcStatsFilterConfigFactory factory;
-    Http::FilterFactoryCb cb = factory.createFilterFactoryFromProto(config_, "stats", context_);
+    cb_ = factory.createFilterFactoryFromProto(config_, "stats", context_);
     Http::MockFilterChainFactoryCallbacks filter_callback;
 
     ON_CALL(filter_callback, addStreamFilter(_)).WillByDefault(testing::SaveArg<0>(&filter_));
     EXPECT_CALL(filter_callback, addStreamFilter(_));
-    cb(filter_callback);
+    cb_(filter_callback);
 
     ON_CALL(decoder_callbacks_, streamInfo()).WillByDefault(testing::ReturnRef(stream_info_));
 
@@ -62,12 +62,13 @@ class GrpcStatsFilterConfigTest : public testing::Test {
     EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->encodeTrailers(response_trailers));
   }
 
-  envoy::extensions::filters::http::grpc_stats::v3::FilterConfig config_;
-  NiceMock<Server::Configuration::MockFactoryContext> context_;
-  Http::StreamFilterSharedPtr filter_;
-  NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
   NiceMock<StreamInfo::MockStreamInfo> stream_info_;
   NiceMock<Stats::MockIsolatedStatsStore> stats_store_;
+  NiceMock<Server::Configuration::MockFactoryContext> context_;
+  envoy::extensions::filters::http::grpc_stats::v3::FilterConfig config_;
+  Http::FilterFactoryCb cb_;
+  NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
+  Http::StreamFilterSharedPtr filter_;
 };
 
 TEST_F(GrpcStatsFilterConfigTest, StatsHttp2HeaderOnlyResponse) {
diff --git a/test/extensions/filters/http/gzip/gzip_filter_test.cc b/test/extensions/filters/http/gzip/gzip_filter_test.cc
index 980c3b1beab3..8d24c3944d84 100644
--- a/test/extensions/filters/http/gzip/gzip_filter_test.cc
+++ b/test/extensions/filters/http/gzip/gzip_filter_test.cc
@@ -46,9 +46,11 @@ class GzipFilterTest : public testing::Test {
     envoy::extensions::filters::http::gzip::v3::Gzip gzip;
     TestUtility::loadFromJson(json, gzip);
     config_ = std::make_shared<GzipFilterConfig>(gzip, "test.", stats_, runtime_);
-    filter_ = std::make_unique<Common::Compressors::CompressorFilter>(config_);
-    filter_->setEncoderFilterCallbacks(encoder_callbacks_);
-    filter_->setDecoderFilterCallbacks(decoder_callbacks_);
+    filter_ = std::make_unique<Common::Compressors::CompressorFilter>(*config_);
+    encoder_callbacks_ = std::make_shared<NiceMock<Http::MockStreamEncoderFilterCallbacks>>();
+    decoder_callbacks_ = std::make_shared<NiceMock<Http::MockStreamDecoderFilterCallbacks>>();
+    filter_->setEncoderFilterCallbacks(*encoder_callbacks_);
+    filter_->setDecoderFilterCallbacks(*decoder_callbacks_);
   }
 
   void verifyCompressedData(const uint32_t content_length) {
@@ -87,7 +89,7 @@ class GzipFilterTest : public testing::Test {
     EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->encodeData(data_, !with_trailers));
     if (with_trailers) {
       Buffer::OwnedImpl trailers_buffer;
-      EXPECT_CALL(encoder_callbacks_, addEncodedData(_, true))
+      EXPECT_CALL(*encoder_callbacks_, addEncodedData(_, true))
           .WillOnce(Invoke([&](Buffer::Instance& data, bool) { data_.move(data); }));
       Http::TestResponseTrailerMapImpl trailers;
       EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->encodeTrailers(trailers));
@@ -158,17 +160,17 @@ class GzipFilterTest : public testing::Test {
     EXPECT_EQ(1, stats_.counter("test.gzip.not_compressed").value());
   }
 
+  Stats::IsolatedStoreImpl stats_store_;
+  Stats::TestUtil::TestStore stats_;
+  NiceMock<Runtime::MockLoader> runtime_;
   std::shared_ptr<GzipFilterConfig> config_;
   std::unique_ptr<Common::Compressors::CompressorFilter> filter_;
   Buffer::OwnedImpl data_;
-  Stats::IsolatedStoreImpl stats_store_;
   Compression::Gzip::Decompressor::ZlibDecompressorImpl decompressor_{stats_store_, "test"};
   Buffer::OwnedImpl decompressed_data_;
   std::string expected_str_;
-  Stats::TestUtil::TestStore stats_;
-  NiceMock<Runtime::MockLoader> runtime_;
-  NiceMock<Http::MockStreamEncoderFilterCallbacks> encoder_callbacks_;
-  NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
+  std::shared_ptr<NiceMock<Http::MockStreamEncoderFilterCallbacks>> encoder_callbacks_;
+  std::shared_ptr<NiceMock<Http::MockStreamDecoderFilterCallbacks>> decoder_callbacks_;
 };
 
 // Test if Runtime Feature is Disabled
diff --git a/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc b/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc
index 9a88da9ee050..1eff66598112 100644
--- a/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc
+++ b/test/extensions/filters/http/header_to_metadata/header_to_metadata_filter_test.cc
@@ -75,13 +75,11 @@ class HeaderToMetadataTest : public testing::Test {
     envoy::extensions::filters::http::header_to_metadata::v3::Config config;
     TestUtility::loadFromYaml(yaml, config);
     config_ = std::make_shared<Config>(config);
-    filter_ = std::make_shared<HeaderToMetadataFilter>(config_);
+    filter_ = std::make_shared<HeaderToMetadataFilter>(*config_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
     filter_->setEncoderFilterCallbacks(encoder_callbacks_);
   }
 
-  const Config* getConfig() { return filter_->getConfig(); }
-
   ConfigSharedPtr config_;
   std::shared_ptr<HeaderToMetadataFilter> filter_;
   NiceMock<Http::MockStreamDecoderFilterCallbacks> decoder_callbacks_;
@@ -153,24 +151,6 @@ TEST_F(HeaderToMetadataTest, PerRouteOverride) {
   filter_->onDestroy();
 }
 
-TEST_F(HeaderToMetadataTest, ConfigIsCached) {
-  // Global config is empty.
-  initializeFilter("{}");
-  Http::TestRequestHeaderMapImpl incoming_headers{{"X-VERSION", "0xdeadbeef"}};
-  std::map<std::string, std::string> expected = {{"version", "0xdeadbeef"}};
-
-  // Setup per route config.
-  envoy::extensions::filters::http::header_to_metadata::v3::Config config_proto;
-  TestUtility::loadFromYaml(request_config_yaml, config_proto);
-  Config per_route_config(config_proto, true);
-  EXPECT_CALL(decoder_callbacks_.route_->route_entry_.virtual_host_,
-              perFilterConfig(HttpFilterNames::get().HeaderToMetadata))
-      .WillOnce(Return(&per_route_config));
-
-  EXPECT_TRUE(getConfig()->doRequest());
-  EXPECT_TRUE(getConfig()->doRequest());
-}
-
 /**
  * X-version not set, the on missing value should be set.
  */
diff --git a/test/extensions/filters/http/health_check/health_check_test.cc b/test/extensions/filters/http/health_check/health_check_test.cc
index 959aeff11a82..ffcb7b7494ca 100644
--- a/test/extensions/filters/http/health_check/health_check_test.cc
+++ b/test/extensions/filters/http/health_check/health_check_test.cc
@@ -53,7 +53,7 @@ class HealthCheckFilterTest : public testing::Test {
     matcher.set_exact_match("/healthcheck");
     header_data_->emplace_back(std::make_unique<Http::HeaderUtility::HeaderData>(matcher));
     filter_ = std::make_unique<HealthCheckFilter>(context_, pass_through, cache_manager_,
-                                                  header_data_, cluster_min_healthy_percentages);
+                                                  *header_data_, cluster_min_healthy_percentages);
     filter_->setDecoderFilterCallbacks(callbacks_);
   }
 
diff --git a/test/extensions/filters/http/ip_tagging/ip_tagging_filter_test.cc b/test/extensions/filters/http/ip_tagging/ip_tagging_filter_test.cc
index d6af41e9a4f2..2af9bf0b4c55 100644
--- a/test/extensions/filters/http/ip_tagging/ip_tagging_filter_test.cc
+++ b/test/extensions/filters/http/ip_tagging/ip_tagging_filter_test.cc
@@ -45,7 +45,7 @@ request_type: internal
     envoy::extensions::filters::http::ip_tagging::v3::IPTagging config;
     TestUtility::loadFromYaml(yaml, config);
     config_ = std::make_shared<IpTaggingFilterConfig>(config, "prefix.", stats_, runtime_);
-    filter_ = std::make_unique<IpTaggingFilter>(config_);
+    filter_ = std::make_unique<IpTaggingFilter>(*config_);
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
   }
 
diff --git a/test/extensions/filters/http/jwt_authn/filter_test.cc b/test/extensions/filters/http/jwt_authn/filter_test.cc
index 8983d94aafd2..7754fb604272 100644
--- a/test/extensions/filters/http/jwt_authn/filter_test.cc
+++ b/test/extensions/filters/http/jwt_authn/filter_test.cc
@@ -57,7 +57,7 @@ class FilterTest : public testing::Test {
     mock_config_ = ::std::make_shared<NiceMock<MockFilterConfig>>();
 
     mock_verifier_ = std::make_unique<MockVerifier>();
-    filter_ = std::make_unique<Filter>(mock_config_);
+    filter_ = std::make_unique<Filter>(*mock_config_);
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
 
     mock_route_ = std::make_shared<NiceMock<Envoy::Router::MockRoute>>();
diff --git a/test/extensions/filters/http/local_ratelimit/filter_test.cc b/test/extensions/filters/http/local_ratelimit/filter_test.cc
index 0c9f2507e016..82238cac7b9e 100644
--- a/test/extensions/filters/http/local_ratelimit/filter_test.cc
+++ b/test/extensions/filters/http/local_ratelimit/filter_test.cc
@@ -57,7 +57,7 @@ class FilterTest : public testing::Test {
     TestUtility::loadFromYaml(yaml, config);
     config_ = std::make_shared<FilterConfig>(config, local_info_, dispatcher_, stats_, runtime_,
                                              per_route);
-    filter_ = std::make_shared<Filter>(config_);
+    filter_ = std::make_shared<Filter>(*config_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
   }
   void setup(const std::string& yaml, const bool enabled = true, const bool enforced = true) {
diff --git a/test/extensions/filters/http/lua/lua_filter_test.cc b/test/extensions/filters/http/lua/lua_filter_test.cc
index 55fb35aca76f..f0da6fda6ccd 100644
--- a/test/extensions/filters/http/lua/lua_filter_test.cc
+++ b/test/extensions/filters/http/lua/lua_filter_test.cc
@@ -98,7 +98,7 @@ class LuaHttpFilterTest : public testing::Test {
   }
 
   void setupFilter() {
-    filter_ = std::make_unique<TestFilter>(config_);
+    filter_ = std::make_unique<TestFilter>(*config_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
     filter_->setEncoderFilterCallbacks(encoder_callbacks_);
   }
@@ -614,7 +614,7 @@ TEST_F(LuaHttpFilterTest, ThreadEnvironments) {
   Http::TestRequestHeaderMapImpl request_headers{{":path", "/"}};
   EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(request_headers, true));
 
-  TestFilter filter2(config_);
+  TestFilter filter2(*config_);
   EXPECT_CALL(filter2, scriptLog(spdlog::level::err,
                                  StrEq("[string \"...\"]:6: object used outside of proper scope")));
   filter2.decodeHeaders(request_headers, true);
diff --git a/test/extensions/filters/http/oauth2/filter_test.cc b/test/extensions/filters/http/oauth2/filter_test.cc
index dd5fafd64670..df9d9e6a0eec 100644
--- a/test/extensions/filters/http/oauth2/filter_test.cc
+++ b/test/extensions/filters/http/oauth2/filter_test.cc
@@ -110,7 +110,7 @@ class OAuth2Test : public testing::Test {
     config_ = std::make_shared<FilterConfig>(p, factory_context_.cluster_manager_, secret_reader,
                                              scope_, "test.");
 
-    filter_ = std::make_shared<OAuth2Filter>(config_, std::move(oauth_client_ptr), test_time_);
+    filter_ = std::make_shared<OAuth2Filter>(*config_, std::move(oauth_client_ptr), test_time_);
     filter_->setDecoderFilterCallbacks(decoder_callbacks_);
     validator_ = std::make_shared<MockOAuth2CookieValidator>();
     filter_->validator_ = validator_;
diff --git a/test/extensions/filters/http/ratelimit/ratelimit_test.cc b/test/extensions/filters/http/ratelimit/ratelimit_test.cc
index 1dccd4f06538..1db84108d680 100644
--- a/test/extensions/filters/http/ratelimit/ratelimit_test.cc
+++ b/test/extensions/filters/http/ratelimit/ratelimit_test.cc
@@ -59,7 +59,7 @@ class HttpRateLimitFilterTest : public testing::Test {
                                              http_context_);
 
     client_ = new Filters::Common::RateLimit::MockClient();
-    filter_ = std::make_unique<Filter>(config_, Filters::Common::RateLimit::ClientPtr{client_});
+    filter_ = std::make_unique<Filter>(*config_, Filters::Common::RateLimit::ClientPtr{client_});
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
     filter_callbacks_.route_->route_entry_.rate_limit_policy_.rate_limit_policy_entry_.clear();
     filter_callbacks_.route_->route_entry_.rate_limit_policy_.rate_limit_policy_entry_.emplace_back(
diff --git a/test/extensions/filters/http/rbac/rbac_filter_test.cc b/test/extensions/filters/http/rbac/rbac_filter_test.cc
index 9f7a181da239..22a673473b32 100644
--- a/test/extensions/filters/http/rbac/rbac_filter_test.cc
+++ b/test/extensions/filters/http/rbac/rbac_filter_test.cc
@@ -54,12 +54,13 @@ class RoleBasedAccessControlFilterTest : public testing::Test {
   }
 
   RoleBasedAccessControlFilterTest()
-      : config_(setupConfig(envoy::config::rbac::v3::RBAC::ALLOW)), filter_(config_) {}
+      : config_(setupConfig(envoy::config::rbac::v3::RBAC::ALLOW)),
+        filter_(std::make_shared<RoleBasedAccessControlFilter>(*config_)) {}
 
   void SetUp() override {
     EXPECT_CALL(callbacks_, connection()).WillRepeatedly(Return(&connection_));
     EXPECT_CALL(callbacks_, streamInfo()).WillRepeatedly(ReturnRef(req_info_));
-    filter_.setDecoderFilterCallbacks(callbacks_);
+    filter_->setDecoderFilterCallbacks(callbacks_);
   }
 
   void setDestinationPort(uint16_t port) {
@@ -110,7 +111,7 @@ class RoleBasedAccessControlFilterTest : public testing::Test {
   NiceMock<Envoy::StreamInfo::MockStreamInfo> req_info_;
   Stats::IsolatedStoreImpl store_;
   RoleBasedAccessControlFilterConfigSharedPtr config_;
-  RoleBasedAccessControlFilter filter_;
+  std::shared_ptr<RoleBasedAccessControlFilter> filter_;
 
   Network::Address::InstanceConstSharedPtr address_;
   std::string requested_server_name_;
@@ -122,15 +123,15 @@ TEST_F(RoleBasedAccessControlFilterTest, Allowed) {
   setDestinationPort(123);
   setMetadata();
 
-  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_.decodeHeaders(headers_, false));
+  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(headers_, false));
   Http::MetadataMap metadata_map{{"metadata", "metadata"}};
-  EXPECT_EQ(Http::FilterMetadataStatus::Continue, filter_.decodeMetadata(metadata_map));
+  EXPECT_EQ(Http::FilterMetadataStatus::Continue, filter_->decodeMetadata(metadata_map));
   EXPECT_EQ(1U, config_->stats().allowed_.value());
   EXPECT_EQ(1U, config_->stats().shadow_denied_.value());
 
   Buffer::OwnedImpl data("");
-  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_.decodeData(data, false));
-  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_.decodeTrailers(trailers_));
+  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->decodeData(data, false));
+  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->decodeTrailers(trailers_));
 
   checkAccessLogMetadata(LogResult::Undecided);
 }
@@ -140,15 +141,15 @@ TEST_F(RoleBasedAccessControlFilterTest, RequestedServerName) {
   setRequestedServerName("www.cncf.io");
   setMetadata();
 
-  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_.decodeHeaders(headers_, false));
+  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(headers_, false));
   EXPECT_EQ(1U, config_->stats().allowed_.value());
   EXPECT_EQ(0U, config_->stats().denied_.value());
   EXPECT_EQ(0U, config_->stats().shadow_allowed_.value());
   EXPECT_EQ(1U, config_->stats().shadow_denied_.value());
 
   Buffer::OwnedImpl data("");
-  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_.decodeData(data, false));
-  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_.decodeTrailers(trailers_));
+  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->decodeData(data, false));
+  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->decodeTrailers(trailers_));
 
   checkAccessLogMetadata(LogResult::Undecided);
 }
@@ -163,7 +164,7 @@ TEST_F(RoleBasedAccessControlFilterTest, Path) {
       {":scheme", "http"},
       {":authority", "host"},
   };
-  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_.decodeHeaders(headers, false));
+  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(headers, false));
   checkAccessLogMetadata(LogResult::Undecided);
 }
 
@@ -179,7 +180,7 @@ TEST_F(RoleBasedAccessControlFilterTest, Denied) {
   EXPECT_CALL(callbacks_, encodeHeaders_(HeaderMapEqualRef(&response_headers), false));
   EXPECT_CALL(callbacks_, encodeData(_, true));
 
-  EXPECT_EQ(Http::FilterHeadersStatus::StopIteration, filter_.decodeHeaders(headers_, true));
+  EXPECT_EQ(Http::FilterHeadersStatus::StopIteration, filter_->decodeHeaders(headers_, true));
   EXPECT_EQ(1U, config_->stats().denied_.value());
   EXPECT_EQ(1U, config_->stats().shadow_allowed_.value());
 
@@ -205,45 +206,45 @@ TEST_F(RoleBasedAccessControlFilterTest, RouteLocalOverride) {
   EXPECT_CALL(callbacks_.route_->route_entry_, perFilterConfig(HttpFilterNames::get().Rbac))
       .WillRepeatedly(Return(&per_route_config_));
 
-  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_.decodeHeaders(headers_, true));
+  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(headers_, true));
   checkAccessLogMetadata(LogResult::Undecided);
 }
 
 // Log Tests
 TEST_F(RoleBasedAccessControlFilterTest, ShouldLog) {
   config_ = setupConfig(envoy::config::rbac::v3::RBAC::LOG);
-  filter_ = RoleBasedAccessControlFilter(config_);
-  filter_.setDecoderFilterCallbacks(callbacks_);
+  filter_ = std::make_shared<RoleBasedAccessControlFilter>(*config_);
+  filter_->setDecoderFilterCallbacks(callbacks_);
 
   setDestinationPort(123);
   setMetadata();
 
-  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_.decodeHeaders(headers_, false));
+  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(headers_, false));
   EXPECT_EQ(1U, config_->stats().allowed_.value());
   EXPECT_EQ(0U, config_->stats().shadow_denied_.value());
 
   Buffer::OwnedImpl data("");
-  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_.decodeData(data, false));
-  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_.decodeTrailers(trailers_));
+  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->decodeData(data, false));
+  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->decodeTrailers(trailers_));
 
   checkAccessLogMetadata(LogResult::Yes);
 }
 
 TEST_F(RoleBasedAccessControlFilterTest, ShouldNotLog) {
   config_ = setupConfig(envoy::config::rbac::v3::RBAC::LOG);
-  filter_ = RoleBasedAccessControlFilter(config_);
-  filter_.setDecoderFilterCallbacks(callbacks_);
+  filter_ = std::make_shared<RoleBasedAccessControlFilter>(*config_);
+  filter_->setDecoderFilterCallbacks(callbacks_);
 
   setDestinationPort(456);
   setMetadata();
 
-  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_.decodeHeaders(headers_, false));
+  EXPECT_EQ(Http::FilterHeadersStatus::Continue, filter_->decodeHeaders(headers_, false));
   EXPECT_EQ(1U, config_->stats().allowed_.value());
   EXPECT_EQ(0U, config_->stats().shadow_denied_.value());
 
   Buffer::OwnedImpl data("");
-  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_.decodeData(data, false));
-  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_.decodeTrailers(trailers_));
+  EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->decodeData(data, false));
+  EXPECT_EQ(Http::FilterTrailersStatus::Continue, filter_->decodeTrailers(trailers_));
 
   checkAccessLogMetadata(LogResult::No);
 }
diff --git a/test/extensions/filters/http/squash/squash_filter_test.cc b/test/extensions/filters/http/squash/squash_filter_test.cc
index 5cb81564c4be..335696b47f64 100644
--- a/test/extensions/filters/http/squash/squash_filter_test.cc
+++ b/test/extensions/filters/http/squash/squash_filter_test.cc
@@ -169,7 +169,7 @@ class SquashFilterTest : public testing::Test {
     factory_context_.cluster_manager_.initializeThreadLocalClusters({"squash"});
     config_ = std::make_shared<SquashFilterConfig>(p, factory_context_.cluster_manager_);
 
-    filter_ = std::make_shared<SquashFilter>(config_, factory_context_.cluster_manager_);
+    filter_ = std::make_shared<SquashFilter>(*config_, factory_context_.cluster_manager_);
     filter_->setDecoderFilterCallbacks(filter_callbacks_);
   }
 
diff --git a/test/extensions/filters/http/tap/tap_filter_test.cc b/test/extensions/filters/http/tap/tap_filter_test.cc
index 7ed0f1afb77f..9da4b0ebe6f0 100644
--- a/test/extensions/filters/http/tap/tap_filter_test.cc
+++ b/test/extensions/filters/http/tap/tap_filter_test.cc
@@ -47,7 +47,7 @@ class TapFilterTest : public testing::Test {
     }
 
     EXPECT_CALL(*filter_config_, currentConfig()).WillRepeatedly(Return(http_tap_config_));
-    filter_ = std::make_unique<Filter>(filter_config_);
+    filter_ = std::make_unique<Filter>(*filter_config_);
 
     if (has_config) {
       EXPECT_CALL(callbacks_, streamId());