diff --git a/.github/workflows/pr-workflow.yaml b/.github/workflows/pr-workflow.yaml
index 15cf202..56f81e9 100644
--- a/.github/workflows/pr-workflow.yaml
+++ b/.github/workflows/pr-workflow.yaml
@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   linter:
diff --git a/api/routing/v1alpha1/envoybootstrapconfig_types.go b/api/routing/v1alpha1/envoybootstrapconfig_types.go
index 34d85c0..4623c37 100644
--- a/api/routing/v1alpha1/envoybootstrapconfig_types.go
+++ b/api/routing/v1alpha1/envoybootstrapconfig_types.go
@@ -49,6 +49,21 @@ type EnvoyBootstrapConfigSpec struct {
 	// +kubebuilder:default=false
 	// +optional
 	MultiAZ bool `json:"multiAZ,omitempty"`
+	// LoadBalancerService identifies the Kubernetes Service backing this Envoy
+	// fleet's cloud load balancer.
+	// +optional
+	LoadBalancerService *LoadBalancerServiceReference `json:"loadBalancerService,omitempty"`
+}
+
+// LoadBalancerServiceReference identifies a Kubernetes Service that exposes an
+// Envoy fleet through a cloud load balancer.
+type LoadBalancerServiceReference struct {
+	// Name is the Service name.
+	Name string `json:"name"`
+	// Namespace is the Service namespace.
+	// If empty, defaults to the namespace where the EnvoyBootstrapConfig is created.
+	// +optional
+	Namespace string `json:"namespace"`
 }
 
 // EnvoyBootstrapConfigStatus defines the observed state of EnvoyBootstrapConfig.
diff --git a/api/routing/v1alpha1/zz_generated.deepcopy.go b/api/routing/v1alpha1/zz_generated.deepcopy.go
index 0a0c3b6..44529ff 100644
--- a/api/routing/v1alpha1/zz_generated.deepcopy.go
+++ b/api/routing/v1alpha1/zz_generated.deepcopy.go
@@ -106,6 +106,11 @@ func (in *EnvoyBootstrapConfigSpec) DeepCopyInto(out *EnvoyBootstrapConfigSpec)
 		*out = new(string)
 		**out = **in
 	}
+	if in.LoadBalancerService != nil {
+		in, out := &in.LoadBalancerService, &out.LoadBalancerService
+		*out = new(LoadBalancerServiceReference)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyBootstrapConfigSpec.
@@ -140,6 +145,21 @@ func (in *EnvoyBootstrapConfigStatus) DeepCopy() *EnvoyBootstrapConfigStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LoadBalancerServiceReference) DeepCopyInto(out *LoadBalancerServiceReference) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoadBalancerServiceReference.
+func (in *LoadBalancerServiceReference) DeepCopy() *LoadBalancerServiceReference {
+	if in == nil {
+		return nil
+	}
+	out := new(LoadBalancerServiceReference)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *QdrantClusterRouting) DeepCopyInto(out *QdrantClusterRouting) {
 	*out = *in
diff --git a/charts/qdrant-kubernetes-api/templates/routing-crds/routing.qdrant.io_envoybootstrapconfigs.yaml b/charts/qdrant-kubernetes-api/templates/routing-crds/routing.qdrant.io_envoybootstrapconfigs.yaml
index fd5aab4..1e72fc3 100644
--- a/charts/qdrant-kubernetes-api/templates/routing-crds/routing.qdrant.io_envoybootstrapconfigs.yaml
+++ b/charts/qdrant-kubernetes-api/templates/routing-crds/routing.qdrant.io_envoybootstrapconfigs.yaml
@@ -65,6 +65,22 @@ spec:
                   When set the Envoy runs in dedicated mode for this cluster.
                   When nil it runs in shared mode.
                 type: string
+              loadBalancerService:
+                description: |-
+                  LoadBalancerService identifies the Kubernetes Service backing this Envoy
+                  fleet's cloud load balancer.
+                properties:
+                  name:
+                    description: Name is the Service name.
+                    type: string
+                  namespace:
+                    description: |-
+                      Namespace is the Service namespace.
+                      If empty, defaults to the namespace where the EnvoyBootstrapConfig is created.
+                    type: string
+                required:
+                - name
+                type: object
               multiAZ:
                 default: false
                 description: |-
diff --git a/docs/api.md b/docs/api.md
index 63e83e1..1418cb3 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -1740,10 +1740,29 @@ _Appears in:_
 | `clusterID` _string_ | ClusterID identifies the Qdrant cluster this Envoy instance serves.<br />When set the Envoy runs in dedicated mode for this cluster.<br />When nil it runs in shared mode. |  | Optional: \{\} <br /> |
 | `proxyProtocolEnabled` _boolean_ | ProxyProtocolEnabled enables the PROXY protocol on Envoy listeners. | false | Optional: \{\} <br /> |
 | `multiAZ` _boolean_ | MultiAZ marks this Envoy fleet as the multi-AZ load balancer. When true,<br />the route-manager advertises this fact to Envoy via node metadata so that<br />zone-aware routing decisions can be made per-cluster via<br />QdrantClusterRouting.spec.multiAZ. | false | Optional: \{\} <br /> |
+| `loadBalancerService` _[LoadBalancerServiceReference](#loadbalancerservicereference)_ | LoadBalancerService identifies the Kubernetes Service backing this Envoy<br />fleet's cloud load balancer. |  | Optional: \{\} <br /> |
 
 
 
 
+#### LoadBalancerServiceReference
+
+
+
+LoadBalancerServiceReference identifies a Kubernetes Service that exposes an
+Envoy fleet through a cloud load balancer.
+
+
+
+_Appears in:_
+- [EnvoyBootstrapConfigSpec](#envoybootstrapconfigspec)
+
+| Field | Description | Default | Validation |
+| --- | --- | --- | --- |
+| `name` _string_ | Name is the Service name. |  |  |
+| `namespace` _string_ | Namespace is the Service namespace.<br />If empty, defaults to the namespace where the EnvoyBootstrapConfig is created. |  | Optional: \{\} <br /> |
+
+
 #### QdrantClusterRouting