diff --git a/api/core/v1alpha/tunnel_types.go b/api/core/v1alpha/tunnel_types.go
index c9643d9f..f35843e3 100644
--- a/api/core/v1alpha/tunnel_types.go
+++ b/api/core/v1alpha/tunnel_types.go
@@ -40,6 +40,12 @@ type TunnelNodeSpec struct {
 	// direction of the Agent).
 	// +optional
 	EgressGateway *EgressGatewaySpec `json:"egressGateway,omitempty"`
+
+	// Specifies the default upstream used when this tunnel is referenced without
+	// an explicit host and port to forward traffic to. If unspecified, the default
+	// upstream is "127.0.0.1:8080".
+	// +optional
+	DefaultUpstream string `json:"defaultUpstream,omitempty"`
 }
 
 type AgentStatus struct {
diff --git a/api/core/v1alpha2/tunnel_types.go b/api/core/v1alpha2/tunnel_types.go
index 958d4a65..c8ccef04 100644
--- a/api/core/v1alpha2/tunnel_types.go
+++ b/api/core/v1alpha2/tunnel_types.go
@@ -45,6 +45,12 @@ type TunnelSpec struct {
 	// in the direction of the agent).
 	// +optional
 	EgressGateway *EgressGatewaySpec `json:"egressGateway,omitempty"`
+
+	// Specifies the default upstream used when this tunnel is referenced without
+	// an explicit host and port to forward traffic to. If unspecified, the default
+	// upstream is "127.0.0.1:8080".
+	// +optional
+	DefaultUpstream string `json:"defaultUpstream,omitempty"`
 }
 
 type TunnelCredentials struct {