diff --git a/apis/projectcontour/v1alpha1/extensionservice.go b/apis/projectcontour/v1alpha1/extensionservice.go
index 5fc4a3f85b4..f2b041e83e1 100644
--- a/apis/projectcontour/v1alpha1/extensionservice.go
+++ b/apis/projectcontour/v1alpha1/extensionservice.go
@@ -80,7 +80,7 @@ type ExtensionServiceSpec struct {
 	// Values may be h2 or h2c. If omitted, protocol-selection falls back on Service annotations.
 	//
 	// +optional
-	// +kubebuilder:validation:Enum=h1,h2;h2c
+	// +kubebuilder:validation:Enum=h1;h2;h2c
 	Protocol *string `json:"protocol,omitempty"`
 
 	// The policy for load balancing GRPC service requests. Note that the
diff --git a/examples/contour/01-crds.yaml b/examples/contour/01-crds.yaml
index 5db4f122a02..7c301091870 100644
--- a/examples/contour/01-crds.yaml
+++ b/examples/contour/01-crds.yaml
@@ -640,6 +640,21 @@ spec:
                       timeout.
                     pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$
                     type: string
+                  serverURI:
+                    description: ServerURI sets the URI of the external HTTP authorization
+                      server to which authorization requests must be sent. Only required
+                      for http services.
+                    type: string
+                  serviceAPIType:
+                    default: grpc
+                    description: ServiceAPIType defines the external authorization
+                      service API type. It indicates the protocol implemented by the
+                      external server, specifying whether it's a raw HTTP authorization
+                      server or a gRPC authorization server.
+                    enum:
+                    - http
+                    - grpc
+                    type: string
                   withRequestBody:
                     description: WithRequestBody specifies configuration for sending
                       the client request's body to authorization server.
@@ -4300,6 +4315,21 @@ spec:
                           no timeout.
                         pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$
                         type: string
+                      serverURI:
+                        description: ServerURI sets the URI of the external HTTP authorization
+                          server to which authorization requests must be sent. Only
+                          required for http services.
+                        type: string
+                      serviceAPIType:
+                        default: grpc
+                        description: ServiceAPIType defines the external authorization
+                          service API type. It indicates the protocol implemented
+                          by the external server, specifying whether it's a raw HTTP
+                          authorization server or a gRPC authorization server.
+                        enum:
+                        - http
+                        - grpc
+                        type: string
                       withRequestBody:
                         description: WithRequestBody specifies configuration for sending
                           the client request's body to authorization server.
@@ -4961,6 +4991,7 @@ spec:
                   used to reach this Service. Values may be h2 or h2c. If omitted,
                   protocol-selection falls back on Service annotations.
                 enum:
+                - h1
                 - h2
                 - h2c
                 type: string
@@ -7224,6 +7255,21 @@ spec:
                           no timeout.
                         pattern: ^(((\d*(\.\d*)?h)|(\d*(\.\d*)?m)|(\d*(\.\d*)?s)|(\d*(\.\d*)?ms)|(\d*(\.\d*)?us)|(\d*(\.\d*)?µs)|(\d*(\.\d*)?ns))+|infinity|infinite)$
                         type: string
+                      serverURI:
+                        description: ServerURI sets the URI of the external HTTP authorization
+                          server to which authorization requests must be sent. Only
+                          required for http services.
+                        type: string
+                      serviceAPIType:
+                        default: grpc
+                        description: ServiceAPIType defines the external authorization
+                          service API type. It indicates the protocol implemented
+                          by the external server, specifying whether it's a raw HTTP
+                          authorization server or a gRPC authorization server.
+                        enum:
+                        - http
+                        - grpc
+                        type: string
                       withRequestBody:
                         description: WithRequestBody specifies configuration for sending
                           the client request's body to authorization server.