diff --git a/install/helm/gloo/templates/7-gateway-proxy-deployment.yaml b/install/helm/gloo/templates/7-gateway-proxy-deployment.yaml
index f9b82cd8421..0c7743fa9af 100644
--- a/install/helm/gloo/templates/7-gateway-proxy-deployment.yaml
+++ b/install/helm/gloo/templates/7-gateway-proxy-deployment.yaml
@@ -178,6 +178,10 @@ spec:
         {{- if $spec.envoyLogLevel }}
           - --log-level {{ $spec.envoyLogLevel }}
         {{- end}}
+        {{- if (($spec.podTemplate.resources).limits).cpu }}
+          - --concurrency
+          - $(ENVOY_CONCURRENCY)
+        {{- end }}
           {{- with $spec.extraEnvoyArgs}}
             {{- range . }}
           - {{ . | quote }}
@@ -189,6 +193,13 @@ spec:
 {{ toYaml $spec.kind.deployment.customEnv | indent 8 }}
 {{- end }}
 {{- end }}
+        {{- if (($spec.podTemplate.resources).limits).cpu }}
+        - name: ENVOY_CONCURRENCY
+          valueFrom:
+            resourceFieldRef:
+              resource: limits.cpu
+              divisor: "1"
+        {{- end }}
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
@@ -399,7 +410,18 @@ spec:
         - --dnsRefreshRate
         - 300s
         - --controlPlaneBootstrap=false
+        {{- if (($global.glooMtls.envoySidecarResources).limits).cpu }}
+        - --concurrency
+        - $(ENVOY_CONCURRENCY)
+        {{- end }}
         env:
+{{- if (($global.glooMtls.envoySidecarResources).limits).cpu }}
+          - name: ENVOY_CONCURRENCY
+            valueFrom:
+              resourceFieldRef:
+                resource: limits.cpu
+                divisor: "1"
+{{- end }}
           - name: OUTPUT_CERTS
             value: "/etc/istio-certs"
           - name: JWT_POLICY
diff --git a/install/test/helm_test.go b/install/test/helm_test.go
index 324c6b44c9f..e5331e97a36 100644
--- a/install/test/helm_test.go
+++ b/install/test/helm_test.go
@@ -63,6 +63,18 @@ func GetLogLevelEnvVar(level string) corev1.EnvVar {
 	}
 }
 
+func GetEnvoyConcurrencyEnvVar() corev1.EnvVar {
+	return corev1.EnvVar{
+		Name: "ENVOY_CONCURRENCY",
+		ValueFrom: &corev1.EnvVarSource{
+			ResourceFieldRef: &corev1.ResourceFieldSelector{
+				Resource: string(corev1.ResourceLimitsCPU),
+				Divisor:  resource.MustParse("1"),
+			},
+		},
+	}
+}
+
 func GetTestExtraEnvVar() corev1.EnvVar {
 	return corev1.EnvVar{
 		Name:  "TEST_EXTRA_ENV_VAR",
@@ -3584,6 +3596,15 @@ spec:
 								corev1.ResourceCPU:    resource.MustParse("5m"),
 							},
 						}
+						gatewayProxyDeployment.Spec.Template.Spec.Containers[0].Args = append(
+							gatewayProxyDeployment.Spec.Template.Spec.Containers[0].Args,
+							"--concurrency",
+							"$(ENVOY_CONCURRENCY)",
+						)
+						gatewayProxyDeployment.Spec.Template.Spec.Containers[0].Env = append(
+							[]corev1.EnvVar{GetEnvoyConcurrencyEnvVar()},
+							gatewayProxyDeployment.Spec.Template.Spec.Containers[0].Env...,
+						)
 						testManifest.ExpectDeploymentAppsV1(gatewayProxyDeployment)
 					})
 
@@ -4639,6 +4660,12 @@ spec:
 									Expect(container.Resources.Limits.Cpu().String()).To(Equal(expectedVals[3]),
 										"deployment/container %s/%s had incorrect limit cpu: expected %s, got %s",
 										deployment.GetName(), container.Name, expectedVals[3], container.Resources.Limits.Cpu().String())
+
+									if container.Name == "istio-proxy" {
+										Expect(container.Args).To(ContainElement("--concurrency"))
+										Expect(container.Args).To(ContainElement("$(ENVOY_CONCURRENCY)"))
+										expectEnvVarExists(container, GetEnvoyConcurrencyEnvVar())
+									}
 								}
 							}
 						}