diff --git a/hieradata/roles/infra/storage/consul.yaml b/hieradata/roles/infra/storage/consul.yaml
index 390e082..ff7c2ea 100644
--- a/hieradata/roles/infra/storage/consul.yaml
+++ b/hieradata/roles/infra/storage/consul.yaml
@@ -57,6 +57,18 @@ profiles::consul::client::node_rules:
   - resource: service
     segment: frr_exporter
     disposition: write
+  - resource: service
+    segment: mesh-gateway
+    disposition: write
+  - resource: service_prefix
+    segment: ''
+    disposition: read
+  - resource: node_prefix
+    segment: ''
+    disposition: read
+  - resource: agent_prefix
+    segment: ''
+    disposition: read
 profiles::consul::prepared_query::rules:
   vault:
     ensure: 'present'
diff --git a/site/profiles/manifests/consul/mesh_gateway.pp b/site/profiles/manifests/consul/mesh_gateway.pp
new file mode 100644
index 0000000..d8e9cf4
--- /dev/null
+++ b/site/profiles/manifests/consul/mesh_gateway.pp
@@ -0,0 +1,48 @@
+# profiles::consul::mesh_gateway
+class profiles::consul::mesh_gateway (
+  Stdlib::IP::Address $address    = $facts['networking']['ip'],
+  Stdlib::Port        $port       = 8443,
+  Stdlib::Port        $http_port  = 8500,
+  Stdlib::Port        $grpc_port  = 8502,
+  Stdlib::Absolutepath $token_file = '/etc/consul.d/mesh-gateway.token',
+) {
+  include profiles::consul::client
+
+  package { 'envoy':
+    ensure => installed,
+  }
+
+  file { $token_file:
+    ensure  => file,
+    owner   => 'consul',
+    group   => 'consul',
+    mode    => '0600',
+    content => Sensitive(fqdn_uuid("${facts['networking']['fqdn']}-${profiles::consul::client::secret_id_salt}")),
+  }
+
+  systemd::unit_file { 'consul-mesh-gateway.service':
+    enable    => true,
+    active    => true,
+    content   => @("UNIT"),
+      [Unit]
+      Description=Consul mesh gateway (envoy)
+      Requires=consul.service
+      After=consul.service
+
+      [Service]
+      User=consul
+      Group=consul
+      ExecStart=/usr/bin/consul connect envoy -gateway=mesh -register -service=mesh-gateway -expose-servers \
+        -address=${address}:${port} -wan-address=${address}:${port} \
+        -http-addr=http://${address}:${http_port} -grpc-addr=http://${address}:${grpc_port} \
+        -token-file=${token_file}
+      Restart=on-failure
+      RestartSec=5
+
+      [Install]
+      WantedBy=multi-user.target
+      | UNIT
+    require   => Package['envoy'],
+    subscribe => File[$token_file],
+  }
+}
diff --git a/site/roles/manifests/infra/storage/consul.pp b/site/roles/manifests/infra/storage/consul.pp
index 143b167..0ea9474 100644
--- a/site/roles/manifests/infra/storage/consul.pp
+++ b/site/roles/manifests/infra/storage/consul.pp
@@ -8,5 +8,6 @@ class roles::infra::storage::consul {
     include profiles::base
     include profiles::base::datavol
     include profiles::consul::server
+    include profiles::consul::mesh_gateway
   }
 }