diff --git a/agent/envoyextensions/registered_extensions.go b/agent/envoyextensions/registered_extensions.go
index d9721b320b17..cef7598da35d 100644
--- a/agent/envoyextensions/registered_extensions.go
+++ b/agent/envoyextensions/registered_extensions.go
@@ -32,11 +32,13 @@ var extensionConstructors = map[string]extensionConstructor{
 // given config. Returns an error if the extension does not exist, or if the extension fails
 // to be constructed properly.
 func ConstructExtension(ext api.EnvoyExtension) (extensioncommon.EnvoyExtender, error) {
-	constructor, ok := extensionConstructors[ext.Name]
-	if !ok {
-		return nil, fmt.Errorf("name %q is not a built-in extension", ext.Name)
+	if constructor, ok := extensionConstructors[ext.Name]; ok {
+		return constructor(ext)
 	}
-	return constructor(ext)
+	if constructor, ok := enterpriseExtensionConstructors[ext.Name]; ok {
+		return constructor(ext)
+	}
+	return nil, fmt.Errorf("name %q is not a built-in extension", ext.Name)
 }
 
 // ValidateExtensions will attempt to construct each instance of the given envoy extension configurations
diff --git a/agent/envoyextensions/registered_extensions_ce.go b/agent/envoyextensions/registered_extensions_ce.go
new file mode 100644
index 000000000000..4b9e07e50ba4
--- /dev/null
+++ b/agent/envoyextensions/registered_extensions_ce.go
@@ -0,0 +1,8 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !consulent
+
+package envoyextensions
+
+var enterpriseExtensionConstructors = map[string]extensionConstructor{}
diff --git a/envoyextensions/extensioncommon/resources.go b/envoyextensions/extensioncommon/resources.go
index 989c35dba739..c5febfb6dd30 100644
--- a/envoyextensions/extensioncommon/resources.go
+++ b/envoyextensions/extensioncommon/resources.go
@@ -411,8 +411,8 @@ func getSNI(chain *envoy_listener_v3.FilterChain) string {
 }
 
 // GetHTTPConnectionManager returns the Envoy HttpConnectionManager filter from the list of network filters.
-// It also returns the index within the list of filters where the connection manager was found in case the caller
-// needs this information.
+// It also returns the index within the list of filters where the connection manager was found in case the
+// caller needs to overwrite the original filter.
 // It returns a non-nil error if the HttpConnectionManager is not found.
 func GetHTTPConnectionManager(filters ...*envoy_listener_v3.Filter) (*envoy_http_v3.HttpConnectionManager, int, error) {
 	for idx, filter := range filters {
@@ -491,9 +491,11 @@ func InsertHTTPFilter(filters []*envoy_listener_v3.Filter, filter *envoy_http_v3
 	if err != nil {
 		return filters, errors.New("failed to insert new HTTP connection manager filter")
 	}
-	filters[idx] = newHttpConMan
+	filtersCopy := make([]*envoy_listener_v3.Filter, len(filters))
+	copy(filtersCopy, filters)
+	filtersCopy[idx] = newHttpConMan
 
-	return filters, nil
+	return filtersCopy, nil
 }
 
 // InsertNetworkFilter inserts the given network filter into the filter chain in the location
diff --git a/proto/private/prototest/testing.go b/proto/private/prototest/testing.go
index 6b6e81a4a174..32839a78aa80 100644
--- a/proto/private/prototest/testing.go
+++ b/proto/private/prototest/testing.go
@@ -13,12 +13,12 @@ type TestingT interface {
 	Fatalf(string, ...any)
 }
 
-func AssertDeepEqual(t TestingT, x, y interface{}, opts ...cmp.Option) {
+func AssertDeepEqual(t TestingT, exp, got interface{}, opts ...cmp.Option) {
 	t.Helper()
 
 	opts = append(opts, protocmp.Transform())
 
-	if diff := cmp.Diff(x, y, opts...); diff != "" {
+	if diff := cmp.Diff(exp, got, opts...); diff != "" {
 		t.Fatalf("assertion failed: values are not equal\n--- expected\n+++ actual\n%v", diff)
 	}
 }