diff --git a/pkg/config/images.go b/pkg/config/images.go
index cc96853e2..690385064 100644
--- a/pkg/config/images.go
+++ b/pkg/config/images.go
@@ -74,7 +74,17 @@ func overrideK0sImages(cfg *k0sv1beta1.ClusterConfig) {
 	cfg.Spec.Images.Pause.Image = helpers.AddonImageFromComponentName("pause")
 	cfg.Spec.Images.Pause.Version = Metadata.Images["pause"]
 
-	// TODO (salah): uncomment when upstream PR for digest support is released: https://github.com/k0sproject/k0s/pull/4792
+	// TODO (salah): remove the following and uncomment when upstream PR for digest support is released: https://github.com/k0sproject/k0s/pull/4792
+	if cfg.Spec.Network != nil &&
+		cfg.Spec.Network.NodeLocalLoadBalancing != nil &&
+		cfg.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy != nil &&
+		cfg.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image != nil &&
+		cfg.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image.Image != "" {
+		cfg.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image.Image = fmt.Sprintf(
+			"proxy.replicated.com/anonymous/%s",
+			cfg.Spec.Network.NodeLocalLoadBalancing.EnvoyProxy.Image.Image,
+		)
+	}
 	// if cfg.Spec.Network == nil {
 	// 	cfg.Spec.Network = &k0sv1beta1.Network{}
 	// }
diff --git a/pkg/config/images_test.go b/pkg/config/images_test.go
index 7d8d26368..018ef29aa 100644
--- a/pkg/config/images_test.go
+++ b/pkg/config/images_test.go
@@ -26,19 +26,20 @@ func TestListK0sImages(t *testing.T) {
 		}
 	}
 	if !foundKubeRouter {
-		t.Errorf("ListK0sImages() = %v, want to contain kube-router", original)
+		t.Errorf("airgap.GetImageURIs() = %v, want to contain kube-router", original)
 	}
 	if !foundCNINode {
-		t.Errorf("ListK0sImages() = %v, want to contain kube-router", original)
+		t.Errorf("airgap.GetImageURIs() = %v, want to contain kube-router", original)
 	}
 	if !foundKonnectivity {
-		t.Errorf("ListK0sImages() = %v, want to contain apiserver-network-proxy-agent", original)
+		t.Errorf("airgap.GetImageURIs() = %v, want to contain apiserver-network-proxy-agent", original)
 	}
 
 	filtered := ListK0sImages(RenderK0sConfig())
 	if len(filtered) == 0 {
 		t.Errorf("ListK0sImages() = %v, want not empty", filtered)
 	}
+	var foundEnvoyProxy bool
 	for _, image := range filtered {
 		if strings.Contains(image, "kube-router") {
 			t.Errorf("ListK0sImages() = %v, want not to contain kube-router", filtered)
@@ -52,5 +53,14 @@ func TestListK0sImages(t *testing.T) {
 		if strings.Contains(image, constant.KubePauseContainerImage) {
 			t.Errorf("ListK0sImages() = %v, want the ec pause image", filtered)
 		}
+		if strings.Contains(image, "envoy-distroless") {
+			foundEnvoyProxy = true
+			if !strings.HasPrefix(image, "proxy.replicated.com/anonymous/") {
+				t.Errorf("ListK0sImages() = %v, want envoy-distroless to be proxied", filtered)
+			}
+		}
+	}
+	if !foundEnvoyProxy {
+		t.Errorf("ListK0sImages() = %v, want to contain envoy-distroless", filtered)
 	}
 }