diff --git a/source/common/protobuf/utility.cc b/source/common/protobuf/utility.cc
index 33185a00fc5e..4df4964b768f 100644
--- a/source/common/protobuf/utility.cc
+++ b/source/common/protobuf/utility.cc
@@ -192,7 +192,11 @@ void MessageUtil::checkForDeprecation(const Protobuf::Message& message, Runtime:
       continue;
     }
 
+#ifdef ENVOY_DISABLE_DEPRECATED_FEATURES
+    bool warn_only = false;
+#else
     bool warn_only = true;
+#endif
     absl::string_view filename = filenameFromPath(field->file()->name());
     // Allow runtime to be null both to not crash if this is called before server initialization,
     // and so proto validation works in context where runtime singleton is not set up (e.g.
diff --git a/test/common/router/config_impl_test.cc b/test/common/router/config_impl_test.cc
index ebed75c45251..ff6aeb4555d6 100644
--- a/test/common/router/config_impl_test.cc
+++ b/test/common/router/config_impl_test.cc
@@ -116,7 +116,8 @@ class ConfigImplTestBase {
 
 class RouteMatcherTest : public testing::Test, public ConfigImplTestBase {};
 
-TEST_F(RouteMatcherTest, TestRoutes) {
+// TODO(alyssawilk) go through all these tests and update or duplicate.
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(TestRoutes)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: www2
@@ -617,7 +618,7 @@ TEST_F(RouteMatcherTest, TestRoutesWithWildcardAndDefaultOnly) {
             config.route(genHeaders("example.com", "/", "GET"), 0)->routeEntry()->clusterName());
 }
 
-TEST_F(RouteMatcherTest, TestRoutesWithInvalidRegex) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(TestRoutesWithInvalidRegex)) {
   std::string invalid_route = R"EOF(
 virtual_hosts:
   - name: regex
@@ -1077,7 +1078,7 @@ name: foo
   }
 }
 
-TEST_F(RouteMatcherTest, Priority) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(Priority)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: local_service
@@ -1164,7 +1165,7 @@ TEST_F(RouteMatcherTest, NoAutoRewriteAndAutoRewriteHeader) {
                EnvoyException);
 }
 
-TEST_F(RouteMatcherTest, HeaderMatchedRouting) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(HeaderMatchedRouting)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: local_service
@@ -1288,7 +1289,7 @@ TEST_F(RouteMatcherTest, HeaderMatchedRouting) {
 }
 
 // Verify the fixes for https://github.com/envoyproxy/envoy/issues/2406
-TEST_F(RouteMatcherTest, InvalidHeaderMatchedRoutingConfig) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(InvalidHeaderMatchedRoutingConfig)) {
   std::string value_with_regex_chars = R"EOF(
 virtual_hosts:
   - name: local_service
@@ -1323,7 +1324,7 @@ TEST_F(RouteMatcherTest, InvalidHeaderMatchedRoutingConfig) {
       EnvoyException, "Invalid regex");
 }
 
-TEST_F(RouteMatcherTest, QueryParamMatchedRouting) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(QueryParamMatchedRouting)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: local_service
@@ -1438,7 +1439,7 @@ TEST_F(RouteMatcherTest, QueryParamMatchedRouting) {
 }
 
 // Verify the fixes for https://github.com/envoyproxy/envoy/issues/2406
-TEST_F(RouteMatcherTest, InvalidQueryParamMatchedRoutingConfig) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(InvalidQueryParamMatchedRoutingConfig)) {
   std::string value_with_regex_chars = R"EOF(
 virtual_hosts:
   - name: local_service
@@ -2249,7 +2250,7 @@ TEST_F(RouteMatcherTest, ClusterNotFoundResponseCodeConfig404) {
             config.route(headers, 0)->routeEntry()->clusterNotFoundResponseCode());
 }
 
-TEST_F(RouteMatcherTest, Shadow) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(Shadow)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: www2
@@ -2307,7 +2308,7 @@ TEST_F(RouteMatcherTest, Shadow) {
 
 class RouteConfigurationV2 : public testing::Test, public ConfigImplTestBase {};
 
-TEST_F(RouteConfigurationV2, RequestMirrorPolicy) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RequestMirrorPolicy)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -4264,7 +4265,7 @@ TEST_F(RoutePropertyTest, excludeVHRateLimits) {
   EXPECT_TRUE(config_ptr->route(headers, 0)->routeEntry()->includeVirtualHostRateLimits());
 }
 
-TEST_F(RoutePropertyTest, TestVHostCorsConfig) {
+TEST_F(RoutePropertyTest, DEPRECATED_FEATURE_TEST(TestVHostCorsConfig)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
   - name: "default"
@@ -4326,7 +4327,7 @@ TEST_F(RoutePropertyTest, TestVHostCorsConfig) {
   EXPECT_EQ(cors_policy->allowCredentials(), true);
 }
 
-TEST_F(RoutePropertyTest, TestRouteCorsConfig) {
+TEST_F(RoutePropertyTest, DEPRECATED_FEATURE_TEST(TestRouteCorsConfig)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
   - name: "default"
@@ -4379,7 +4380,7 @@ TEST_F(RoutePropertyTest, TestRouteCorsConfig) {
   EXPECT_EQ(cors_policy->allowCredentials(), true);
 }
 
-TEST_F(RoutePropertyTest, TestVHostCorsLegacyConfig) {
+TEST_F(RoutePropertyTest, DEPRECATED_FEATURE_TEST(TestVHostCorsLegacyConfig)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: default
@@ -4418,7 +4419,7 @@ TEST_F(RoutePropertyTest, TestVHostCorsLegacyConfig) {
   EXPECT_EQ(cors_policy->allowCredentials(), true);
 }
 
-TEST_F(RoutePropertyTest, TestRouteCorsLegacyConfig) {
+TEST_F(RoutePropertyTest, DEPRECATED_FEATURE_TEST(TestRouteCorsLegacyConfig)) {
   const std::string yaml = R"EOF(
 virtual_hosts:
 - name: default
@@ -4909,7 +4910,7 @@ name: foo
       Envoy::EnvoyException, "Cannot create a Baz when metadata is empty.");
 }
 
-TEST_F(RouteConfigurationV2, RouteConfigGetters) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RouteConfigGetters)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -4948,7 +4949,7 @@ name: foo
   EXPECT_EQ("foo", route_entry->virtualHost().routeConfig().name());
 }
 
-TEST_F(RouteConfigurationV2, RouteTracingConfig) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RouteTracingConfig)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -5003,7 +5004,7 @@ name: foo
 }
 
 // Test to check Prefix Rewrite for redirects
-TEST_F(RouteConfigurationV2, RedirectPrefixRewrite) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RedirectPrefixRewrite)) {
   std::string RedirectPrefixRewrite = R"EOF(
 name: AllRedirects
 virtual_hosts:
@@ -5190,7 +5191,7 @@ name: AllRedirects
   }
 }
 
-TEST_F(RouteMatcherTest, HeaderMatchedRoutingV2) {
+TEST_F(RouteMatcherTest, DEPRECATED_FEATURE_TEST(HeaderMatchedRoutingV2)) {
   const std::string yaml = R"EOF(
 name: foo
 virtual_hosts:
@@ -5365,7 +5366,8 @@ name: foo
   }
 }
 
-TEST_F(RouteConfigurationV2, RegexPrefixWithNoRewriteWorksWhenPathChanged) {
+TEST_F(RouteConfigurationV2,
+       DEPRECATED_FEATURE_TEST(RegexPrefixWithNoRewriteWorksWhenPathChanged)) {
 
   // Setup regex route entry. the regex is trivial, that's ok as we only want to test that
   // path change works.
@@ -5396,7 +5398,7 @@ name: RegexNoMatch
   }
 }
 
-TEST_F(RouteConfigurationV2, NoIdleTimeout) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(NoIdleTimeout)) {
   const std::string NoIdleTimeout = R"EOF(
 name: NoIdleTimeout
 virtual_hosts:
@@ -5414,7 +5416,7 @@ name: NoIdleTimeout
   EXPECT_EQ(absl::nullopt, route_entry->idleTimeout());
 }
 
-TEST_F(RouteConfigurationV2, ZeroIdleTimeout) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(ZeroIdleTimeout)) {
   const std::string ZeroIdleTimeout = R"EOF(
 name: ZeroIdleTimeout
 virtual_hosts:
@@ -5433,7 +5435,7 @@ name: ZeroIdleTimeout
   EXPECT_EQ(0, route_entry->idleTimeout().value().count());
 }
 
-TEST_F(RouteConfigurationV2, ExplicitIdleTimeout) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(ExplicitIdleTimeout)) {
   const std::string ExplicitIdleTimeout = R"EOF(
 name: ExplicitIdleTimeout
 virtual_hosts:
@@ -5453,7 +5455,7 @@ name: ExplicitIdleTimeout
   EXPECT_EQ(7 * 1000, route_entry->idleTimeout().value().count());
 }
 
-TEST_F(RouteConfigurationV2, RetriableStatusCodes) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RetriableStatusCodes)) {
   const std::string ExplicitIdleTimeout = R"EOF(
 name: RetriableStatusCodes
 virtual_hosts:
@@ -5475,7 +5477,7 @@ name: RetriableStatusCodes
   EXPECT_EQ(expected_codes, retry_policy.retriableStatusCodes());
 }
 
-TEST_F(RouteConfigurationV2, UpgradeConfigs) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(UpgradeConfigs)) {
   const std::string UpgradeYaml = R"EOF(
 name: RetriableStatusCodes
 virtual_hosts:
@@ -5499,7 +5501,7 @@ name: RetriableStatusCodes
   EXPECT_FALSE(upgrade_map.find("disabled")->second);
 }
 
-TEST_F(RouteConfigurationV2, DuplicateUpgradeConfigs) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(DuplicateUpgradeConfigs)) {
   const std::string yaml = R"EOF(
 name: RetriableStatusCodes
 virtual_hosts:
@@ -5522,7 +5524,7 @@ name: RetriableStatusCodes
 
 // Verifies that we're creating a new instance of the retry plugins on each call instead of always
 // returning the same one.
-TEST_F(RouteConfigurationV2, RetryPluginsAreNotReused) {
+TEST_F(RouteConfigurationV2, DEPRECATED_FEATURE_TEST(RetryPluginsAreNotReused)) {
   const std::string ExplicitIdleTimeout = R"EOF(
 name: RetriableStatusCodes
 virtual_hosts:
diff --git a/test/config/integration/server.yaml b/test/config/integration/server.yaml
index 88d34049619b..95a9a439efa4 100644
--- a/test/config/integration/server.yaml
+++ b/test/config/integration/server.yaml
@@ -168,10 +168,19 @@ stats_sinks:
     "@type": type.googleapis.com/envoy.config.metrics.v2.StatsdSink
     tcp_cluster_name: statsd
 watchdog: {}
-runtime:
-  symlink_root: "{{ test_tmpdir }}/test/common/runtime/test_data/current"
-  subdirectory: envoy
-  override_subdirectory: envoy_override
+layered_runtime:
+  layers:
+    - name: root
+      disk_layer:
+        symlink_root: "{{ test_tmpdir }}/test/common/runtime/test_data/current"
+        subdirectory: envoy
+    - name: override
+      disk_layer:
+        symlink_root: "{{ test_tmpdir }}/test/common/runtime/test_data/current"
+        subdirectory: envoy_override
+        append_service_cluster: true
+    - name: admin
+      admin_layer: {}
 admin:
   access_log_path: "/dev/null"
   profile_path: "{{ test_tmpdir }}/envoy.prof"
diff --git a/test/config_test/example_configs_test.cc b/test/config_test/example_configs_test.cc
index 6da6d5e55f0a..fef29e44112c 100644
--- a/test/config_test/example_configs_test.cc
+++ b/test/config_test/example_configs_test.cc
@@ -5,7 +5,7 @@
 #include "gtest/gtest.h"
 
 namespace Envoy {
-TEST(ExampleConfigsTest, All) {
+TEST(ExampleConfigsTest, DEPRECATED_FEATURE_TEST(All)) {
   TestEnvironment::exec(
       {TestEnvironment::runfilesPath("test/config_test/example_configs_test_setup.sh")});
 
diff --git a/test/extensions/filters/http/cors/cors_filter_integration_test.cc b/test/extensions/filters/http/cors/cors_filter_integration_test.cc
index b313d6162497..06a9120c8c4a 100644
--- a/test/extensions/filters/http/cors/cors_filter_integration_test.cc
+++ b/test/extensions/filters/http/cors/cors_filter_integration_test.cc
@@ -195,6 +195,33 @@ TEST_P(CorsFilterIntegrationTest, DEPRECATED_FEATURE_TEST(TestCorsDisabled)) {
       });
 }
 
+TEST_P(CorsFilterIntegrationTest, DEPRECATED_FEATURE_TEST(TestLegacyCorsDisabled)) {
+  config_helper_.addConfigModifier(
+      [&](envoy::config::filter::network::http_connection_manager::v2::HttpConnectionManager& hcm)
+          -> void {
+        auto* route_config = hcm.mutable_route_config();
+        auto* virtual_host = route_config->mutable_virtual_hosts(0);
+        auto* route = virtual_host->add_routes();
+        route->mutable_match()->set_prefix("/legacy-no-cors");
+        route->mutable_route()->set_cluster("cluster_0");
+        route->mutable_route()->mutable_cors()->mutable_enabled()->set_value(false);
+      });
+  testNormalRequest(
+      Http::TestHeaderMapImpl{
+          {":method", "OPTIONS"},
+          {":path", "/legacy-no-cors/test"},
+          {":scheme", "http"},
+          {":authority", "test-host"},
+          {"access-control-request-method", "GET"},
+          {"origin", "test-origin"},
+      },
+      Http::TestHeaderMapImpl{
+          {"server", "envoy"},
+          {"content-length", "0"},
+          {":status", "200"},
+      });
+}
+
 TEST_P(CorsFilterIntegrationTest, DEPRECATED_FEATURE_TEST(TestEncodeHeaders)) {
   testNormalRequest(
       Http::TestHeaderMapImpl{
diff --git a/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc b/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc
index bd9de61eeb2a..f93f40b47f5d 100644
--- a/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc
+++ b/test/extensions/filters/network/dubbo_proxy/conn_manager_test.cc
@@ -1156,7 +1156,8 @@ TEST_F(ConnectionManagerTest, PendingMessageEnd) {
   EXPECT_EQ(1U, store_.gauge("test.request_active", Stats::Gauge::ImportMode::Accumulate).value());
 }
 
-TEST_F(ConnectionManagerTest, Routing) {
+// TODO(alyssawilk) update.
+TEST_F(ConnectionManagerTest, DEPRECATED_FEATURE_TEST(Routing)) {
   const std::string yaml = R"EOF(
 stat_prefix: test
 protocol_type: Dubbo
diff --git a/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc b/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc
index ad648d51fdc4..398743469bcb 100644
--- a/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc
+++ b/test/extensions/filters/network/dubbo_proxy/route_matcher_test.cc
@@ -38,7 +38,8 @@ parseDubboProxyFromV2Yaml(const std::string& yaml) {
 
 } // namespace
 
-TEST(DubboRouteMatcherTest, RouteByServiceNameWithAnyMethod) {
+// TODO(alyssawilk) update.
+TEST(DubboRouteMatcherTest, DEPRECATED_FEATURE_TEST(RouteByServiceNameWithAnyMethod)) {
   {
     const std::string yaml = R"EOF(
 name: local_route
@@ -291,7 +292,8 @@ interface: org.apache.dubbo.demo.DemoService
   EXPECT_EQ("user_service_dubbo_server", matcher.route(metadata, 0)->routeEntry()->clusterName());
 }
 
-TEST(DubboRouteMatcherTest, RouteByMethodWithRegexMatch) {
+// TODO(alyssawilk) update.
+TEST(DubboRouteMatcherTest, DEPRECATED_FEATURE_TEST(RouteByMethodWithRegexMatch)) {
   const std::string yaml = R"EOF(
 name: local_route
 interface: org.apache.dubbo.demo.DemoService
diff --git a/test/extensions/filters/network/redis_proxy/config_test.cc b/test/extensions/filters/network/redis_proxy/config_test.cc
index ff348c9c1a06..8c34fb502fd7 100644
--- a/test/extensions/filters/network/redis_proxy/config_test.cc
+++ b/test/extensions/filters/network/redis_proxy/config_test.cc
@@ -40,7 +40,9 @@ TEST(RedisProxyFilterConfigFactoryTest, NoUpstreamDefined) {
 
 TEST(RedisProxyFilterConfigFactoryTest, RedisProxyNoSettings) {
   const std::string yaml = R"EOF(
-cluster: fake_cluster
+prefix_routes:
+  catch_all_route:
+    cluster: fake_cluster
 stat_prefix: foo
   )EOF";
 
@@ -51,7 +53,9 @@ stat_prefix: foo
 
 TEST(RedisProxyFilterConfigFactoryTest, RedisProxyNoOpTimeout) {
   const std::string yaml = R"EOF(
-cluster: fake_cluster
+prefix_routes:
+  catch_all_route:
+    cluster: fake_cluster
 stat_prefix: foo
 settings: {}
   )EOF";
@@ -61,7 +65,8 @@ settings: {}
                           ProtoValidationException, "embedded message failed validation");
 }
 
-TEST(RedisProxyFilterConfigFactoryTest, RedisProxyCorrectProto) {
+TEST(RedisProxyFilterConfigFactoryTest,
+     DEPRECATED_FEATURE_TEST(RedisProxyCorrectProtoLegacyCluster)) {
   const std::string yaml = R"EOF(
 cluster: fake_cluster
 stat_prefix: foo
@@ -80,9 +85,53 @@ stat_prefix: foo
   cb(connection);
 }
 
+TEST(RedisProxyFilterConfigFactoryTest,
+     DEPRECATED_FEATURE_TEST(RedisProxyCorrectProtoLegacyCatchAllCluster)) {
+  const std::string yaml = R"EOF(
+prefix_routes:
+  catch_all_cluster: fake_cluster
+stat_prefix: foo
+settings:
+  op_timeout: 0.02s
+  )EOF";
+
+  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config{};
+  TestUtility::loadFromYamlAndValidate(yaml, proto_config);
+  NiceMock<Server::Configuration::MockFactoryContext> context;
+  RedisProxyFilterConfigFactory factory;
+  Network::FilterFactoryCb cb = factory.createFilterFactoryFromProto(proto_config, context);
+  EXPECT_TRUE(factory.isTerminalFilter());
+  Network::MockConnection connection;
+  EXPECT_CALL(connection, addReadFilter(_));
+  cb(connection);
+}
+
+TEST(RedisProxyFilterConfigFactoryTest, RedisProxyCorrectProto) {
+  const std::string yaml = R"EOF(
+prefix_routes:
+  catch_all_route:
+    cluster: fake_cluster
+stat_prefix: foo
+settings:
+  op_timeout: 0.02s
+  )EOF";
+
+  envoy::config::filter::network::redis_proxy::v2::RedisProxy proto_config{};
+  TestUtility::loadFromYamlAndValidate(yaml, proto_config);
+  NiceMock<Server::Configuration::MockFactoryContext> context;
+  RedisProxyFilterConfigFactory factory;
+  Network::FilterFactoryCb cb = factory.createFilterFactoryFromProto(proto_config, context);
+  EXPECT_TRUE(factory.isTerminalFilter());
+  Network::MockConnection connection;
+  EXPECT_CALL(connection, addReadFilter(_));
+  cb(connection);
+}
+
 TEST(RedisProxyFilterConfigFactoryTest, RedisProxyEmptyProto) {
   const std::string yaml = R"EOF(
-cluster: fake_cluster
+prefix_routes:
+  catch_all_route:
+    cluster: fake_cluster
 stat_prefix: foo
 settings:
   op_timeout: 0.02s
diff --git a/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc b/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc
index d29c89833022..c7efe51ec11c 100644
--- a/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc
+++ b/test/extensions/filters/network/thrift_proxy/route_matcher_test.cc
@@ -331,7 +331,8 @@ name: config
   EXPECT_EQ("cluster1", route->routeEntry()->clusterName());
 }
 
-TEST(ThriftRouteMatcherTest, RouteByRegexHeaderMatcher) {
+// TODO(alyssawilk) update.
+TEST(ThriftRouteMatcherTest, DEPRECATED_FEATURE_TEST(RouteByRegexHeaderMatcher)) {
   const std::string yaml = R"EOF(
 name: config
 routes:
diff --git a/test/integration/integration_admin_test.cc b/test/integration/integration_admin_test.cc
index 43c3a867bfd6..41085b762d9c 100644
--- a/test/integration/integration_admin_test.cc
+++ b/test/integration/integration_admin_test.cc
@@ -542,21 +542,21 @@ TEST_P(StatsMatcherIntegrationTest, ExcludePrefixServerDot) {
   EXPECT_THAT(response_->body(), testing::Not(testing::HasSubstr("server.")));
 }
 
-TEST_P(StatsMatcherIntegrationTest, ExcludeRequests) {
+TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(ExcludeRequests)) {
   stats_matcher_.mutable_exclusion_list()->add_patterns()->set_regex(".*requests.*");
   initialize();
   makeRequest();
   EXPECT_THAT(response_->body(), testing::Not(testing::HasSubstr("requests")));
 }
 
-TEST_P(StatsMatcherIntegrationTest, ExcludeExact) {
+TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(ExcludeExact)) {
   stats_matcher_.mutable_exclusion_list()->add_patterns()->set_exact("server.concurrency");
   initialize();
   makeRequest();
   EXPECT_THAT(response_->body(), testing::Not(testing::HasSubstr("server.concurrency")));
 }
 
-TEST_P(StatsMatcherIntegrationTest, ExcludeMultipleExact) {
+TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(ExcludeMultipleExact)) {
   stats_matcher_.mutable_exclusion_list()->add_patterns()->set_exact("server.concurrency");
   stats_matcher_.mutable_exclusion_list()->add_patterns()->set_regex(".*live");
   initialize();
@@ -569,7 +569,7 @@ TEST_P(StatsMatcherIntegrationTest, ExcludeMultipleExact) {
 // `listener_manager.listener_create_success` must be instantiated, because BaseIntegrationTest
 // blocks on its creation (see waitForCounterGe and the suite of waitFor* functions).
 // If this invariant is changed, this test must be rewritten.
-TEST_P(StatsMatcherIntegrationTest, IncludeExact) {
+TEST_P(StatsMatcherIntegrationTest, DEPRECATED_FEATURE_TEST(IncludeExact)) {
   // Stats matching does not play well with LDS, at least in test. See #7215.
   use_lds_ = false;
   stats_matcher_.mutable_inclusion_list()->add_patterns()->set_exact(
diff --git a/test/server/BUILD b/test/server/BUILD
index 7ffe0fcfd36b..e46a0106c687 100644
--- a/test/server/BUILD
+++ b/test/server/BUILD
@@ -261,6 +261,7 @@ envoy_cc_test(
         ":invalid_layered_runtime_duplicate_name.yaml",
         ":invalid_layered_runtime_missing_name.yaml",
         ":invalid_layered_runtime_no_layer_specifier.yaml",
+        ":invalid_legacy_runtime_bootstrap.yaml",
         ":invalid_runtime_bootstrap.yaml",
         ":node_bootstrap.yaml",
         ":node_bootstrap_no_admin_port.yaml",
diff --git a/test/server/invalid_legacy_runtime_bootstrap.yaml b/test/server/invalid_legacy_runtime_bootstrap.yaml
new file mode 100644
index 000000000000..99c67b7d2d9c
--- /dev/null
+++ b/test/server/invalid_legacy_runtime_bootstrap.yaml
@@ -0,0 +1,4 @@
+runtime:
+  base:
+    foo:
+    - bar: baz
diff --git a/test/server/invalid_runtime_bootstrap.yaml b/test/server/invalid_runtime_bootstrap.yaml
index 99c67b7d2d9c..3ed04a71c3b0 100644
--- a/test/server/invalid_runtime_bootstrap.yaml
+++ b/test/server/invalid_runtime_bootstrap.yaml
@@ -1,4 +1,6 @@
-runtime:
-  base:
-    foo:
-    - bar: baz
+layered_runtime:
+  layers:
+    - name: some_static_layer
+      static_layer:
+        foo:
+        - bar: baz
diff --git a/test/server/server_test.cc b/test/server/server_test.cc
index 1b9b0deeee19..ab0d89ebad28 100644
--- a/test/server/server_test.cc
+++ b/test/server/server_test.cc
@@ -575,6 +575,11 @@ TEST_P(ServerInstanceImplTest, RuntimeNoAdminLayer) {
   EXPECT_EQ("No admin layer specified", response_body);
 }
 
+TEST_P(ServerInstanceImplTest, DEPRECATED_FEATURE_TEST(InvalidLegacyBootstrapRuntime)) {
+  EXPECT_THROW_WITH_MESSAGE(initialize("test/server/invalid_runtime_bootstrap.yaml"),
+                            EnvoyException, "Invalid runtime entry value for foo");
+}
+
 // Validate invalid runtime in bootstrap is rejected.
 TEST_P(ServerInstanceImplTest, InvalidBootstrapRuntime) {
   EXPECT_THROW_WITH_MESSAGE(initialize("test/server/invalid_runtime_bootstrap.yaml"),