diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 4b4f6ba70..a8e294983 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
 	"name": "linkerd2-proxy",
-	"image": "ghcr.io/linkerd/dev:v22",
+	"image": "ghcr.io/linkerd/dev:v23",
 	"extensions": [
 		"DavidAnson.vscode-markdownlint",
 		"NathanRidley.autotrim",
@@ -29,4 +29,4 @@
 	"mounts": [
 		"source=/var/run/docker.sock,target=/var/run/docker-host.sock,type=bind"
 	]
-}
+}
\ No newline at end of file
diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 9fc4dc69a..d818d44d1 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -13,7 +13,7 @@ jobs:
   actionlint:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
-    container: ghcr.io/linkerd/dev:v22-tools
+    container: ghcr.io/linkerd/dev:v23-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Run actionlint
@@ -25,7 +25,7 @@ jobs:
 
   devcontainer-versions:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-tools
+    container: ghcr.io/linkerd/dev:v23-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - name: Scan workflows for other Devcontainer image versions
diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
index d27eae8c1..8ee9cbafe 100644
--- a/.github/workflows/beta.yml
+++ b/.github/workflows/beta.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:
diff --git a/.github/workflows/check-all.yml b/.github/workflows/check-all.yml
index ca22f5fee..e2d561af6 100644
--- a/.github/workflows/check-all.yml
+++ b/.github/workflows/check-all.yml
@@ -25,7 +25,7 @@ jobs:
   check-all:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
diff --git a/.github/workflows/check-each.yml b/.github/workflows/check-each.yml
index 79e6602de..b546c73f6 100644
--- a/.github/workflows/check-each.yml
+++ b/.github/workflows/check-each.yml
@@ -49,7 +49,7 @@ jobs:
     needs: list-changed-crates
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     strategy:
       matrix:
         crate: ${{ fromJson(needs.list-changed-crates.outputs.crates) }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 25f7dad11..ec5d2c57c 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: docker://ghcr.io/linkerd/dev:v22-rust
+      image: docker://ghcr.io/linkerd/dev:v23-rust
       options: --security-opt seccomp=unconfined # 🤷
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index 0ae1f7896..f2874f3b7 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -46,7 +46,7 @@ jobs:
   deprecated:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index a03eeeced..6760a8e80 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -26,7 +26,7 @@ jobs:
   test:
     timeout-minutes: 20
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 1eb90b624..79ce53433 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -21,7 +21,7 @@ jobs:
   clippy:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
@@ -30,7 +30,7 @@ jobs:
   fmt:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just check-fmt
@@ -38,7 +38,7 @@ jobs:
   docs:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 07651de17..cac9eb0b1 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     timeout-minutes: 20
     continue-on-error: true
     steps:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index aa16f6115..e38f52340 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:
   meshtls:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
@@ -42,7 +42,7 @@ jobs:
   unit:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-rust
+    container: ghcr.io/linkerd/dev:v23-rust
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - run: just fetch
diff --git a/.github/workflows/toolchain.yml b/.github/workflows/toolchain.yml
index 1d07f5846..f12ea395a 100644
--- a/.github/workflows/toolchain.yml
+++ b/.github/workflows/toolchain.yml
@@ -30,7 +30,7 @@ jobs:
 
   workflows:
     runs-on: ubuntu-latest
-    container: ghcr.io/linkerd/dev:v22-tools
+    container: ghcr.io/linkerd/dev:v23-tools
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
       - shell: bash
diff --git a/Cargo.lock b/Cargo.lock
index f0bbd098d..434d02059 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1488,6 +1488,7 @@ dependencies = [
  "ipnet",
  "linkerd-http-route",
  "linkerd2-proxy-api",
+ "prost-types",
  "quickcheck",
  "thiserror",
 ]
@@ -1700,9 +1701,9 @@ dependencies = [
 
 [[package]]
 name = "linkerd2-proxy-api"
-version = "0.6.0"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6af1b0893c92d50e1af9a9342df7bd1ba73b9ef2abce700e170f2b2d4c84ac72"
+checksum = "9461e1bf61263ffa493117f2177c15a470b4b66f6b58c74e548401293f9ea639"
 dependencies = [
  "h2",
  "http",
@@ -1977,9 +1978,9 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.10.4"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71adf41db68aa0daaefc69bb30bcd68ded9b9abaad5d1fbb6304c4fb390e083e"
+checksum = "399c3c31cdec40583bb68f0b18403400d01ec4289c383aa047560439952c4dd7"
 dependencies = [
  "bytes",
  "prost-derive",
@@ -1987,13 +1988,11 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.10.4"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae5a4388762d5815a9fc0dea33c56b021cdc8dde0c55e0c9ca57197254b0cab"
+checksum = "7f835c582e6bd972ba8347313300219fed5bfa52caf175298d860b61ff6069bb"
 dependencies = [
  "bytes",
- "cfg-if",
- "cmake",
  "heck",
  "itertools",
  "lazy_static",
@@ -2009,9 +2008,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.10.0"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df35198f0777b75e9ff669737c6da5136b59dba33cf5a010a6d1cc4d56defc6f"
+checksum = "7345d5f0e08c0536d7ac7229952590239e77abf0a0100a1b1d890add6ea96364"
 dependencies = [
  "anyhow",
  "itertools",
@@ -2022,9 +2021,9 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.10.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "926681c118ae6e512a3ccefd4abbe5521a14f4cc1e207356d4d00c0b7f2006fd"
+checksum = "4dfaa718ad76a44b3415e6c4d53b17c8f99160dcb3a99b10470fce8ad43f6e3e"
 dependencies = [
  "bytes",
  "prost",
@@ -2472,9 +2471,9 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.7.2"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5be9d60db39854b30b835107500cf0aca0b0d14d6e1c3de124217c23a29c2ddb"
+checksum = "498f271adc46acce75d66f639e4d35b31b2394c295c82496727dafa16d465dd2"
 dependencies = [
  "async-stream",
  "async-trait",
@@ -2497,9 +2496,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.7.2"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9263bf4c9bfaae7317c1c2faf7f18491d2fe476f70c414b73bf5d445b00ffa1"
+checksum = "2fbcd2800e34e743b9ae795867d5f77b535d3a3be69fd731e39145719752df8c"
 dependencies = [
  "prettyplease",
  "proc-macro2",
@@ -2508,6 +2507,13 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tools"
+version = "0.1.0"
+dependencies = [
+ "tonic-build",
+]
+
 [[package]]
 name = "tower"
 version = "0.4.13"
diff --git a/Cargo.toml b/Cargo.toml
index 3438a2ee7..763c7214a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -64,6 +64,7 @@ members = [
     "linkerd/transport-metrics",
     "linkerd2-proxy",
     "opencensus-proto",
+    "tools"
 ]
 
 # Debug symbols end up chewing up several GB of disk space, so better to just
diff --git a/linkerd/app/Cargo.toml b/linkerd/app/Cargo.toml
index 12acfe6e4..f103ca7aa 100644
--- a/linkerd/app/Cargo.toml
+++ b/linkerd/app/Cargo.toml
@@ -28,6 +28,6 @@ regex = "1"
 thiserror = "1"
 tokio = { version = "1", features = ["rt"] }
 tokio-stream = { version = "0.1", features = ["time", "sync"] }
-tonic = { version = "0.7", default-features = false, features = ["prost"] }
+tonic = { version = "0.8", default-features = false, features = ["prost"] }
 tower = "0.4"
 tracing = "0.1"
diff --git a/linkerd/app/core/Cargo.toml b/linkerd/app/core/Cargo.toml
index 8af6f5b77..5c6cb1706 100644
--- a/linkerd/app/core/Cargo.toml
+++ b/linkerd/app/core/Cargo.toml
@@ -63,7 +63,7 @@ serde_json = "1"
 thiserror = "1"
 tokio = { version = "1", features = ["macros", "sync", "parking_lot"] }
 tokio-stream = { version = "0.1", features = ["time"] }
-tonic = { version = "0.7", default-features = false, features = ["prost"] }
+tonic = { version = "0.8", default-features = false, features = ["prost"] }
 tracing = "0.1"
 parking_lot = "0.12"
 pin-project = "1"
diff --git a/linkerd/app/inbound/Cargo.toml b/linkerd/app/inbound/Cargo.toml
index 32674ed91..4cbc8fd76 100644
--- a/linkerd/app/inbound/Cargo.toml
+++ b/linkerd/app/inbound/Cargo.toml
@@ -18,12 +18,12 @@ linkerd-cache = { path = "../../cache" }
 linkerd-http-access-log = { path = "../../http-access-log" }
 linkerd-server-policy = { path = "../../server-policy", features = ["proto"] }
 linkerd-tonic-watch = { path = "../../tonic-watch" }
-linkerd2-proxy-api = { version = "0.6", features = ["inbound"] }
+linkerd2-proxy-api = { version = "0.7", features = ["inbound"] }
 once_cell = "1"
 parking_lot = "0.12"
 thiserror = "1"
 tokio = { version = "1", features = ["sync"] }
-tonic = { version = "0.7", default-features = false }
+tonic = { version = "0.8", default-features = false }
 tower = { version = "0.4", features = ["util"] }
 tracing = "0.1"
 
diff --git a/linkerd/app/integration/Cargo.toml b/linkerd/app/integration/Cargo.toml
index ea3aaf6d9..89f64240c 100644
--- a/linkerd/app/integration/Cargo.toml
+++ b/linkerd/app/integration/Cargo.toml
@@ -33,7 +33,7 @@ hyper = { version = "0.14", features = [
 linkerd-app = { path = "..", features = ["allow-loopback"] }
 linkerd-app-core = { path = "../core" }
 linkerd-metrics = { path = "../../metrics", features = ["test_util"] }
-linkerd2-proxy-api = { version = "0.6", features = [
+linkerd2-proxy-api = { version = "0.7", features = [
     "destination",
     "arbitrary",
 ] }
@@ -47,7 +47,7 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 tokio-rustls = "0.23"
 rustls-pemfile = "1.0"
 tower = { version = "0.4", default-features = false }
-tonic = { version = "0.7", default-features = false }
+tonic = { version = "0.8", default-features = false }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", default-features = false, features = [
     "fmt",
diff --git a/linkerd/app/integration/src/controller.rs b/linkerd/app/integration/src/controller.rs
index 19fb32f58..b8de4c21d 100644
--- a/linkerd/app/integration/src/controller.rs
+++ b/linkerd/app/integration/src/controller.rs
@@ -528,8 +528,11 @@ pub fn retry_budget(
     retry_ratio: f32,
     min_retries_per_second: u32,
 ) -> pb::RetryBudget {
+    let ttl = ttl
+        .try_into()
+        .expect("retry budget TTL duration cannot be converted to protobuf");
     pb::RetryBudget {
-        ttl: Some(ttl.into()),
+        ttl: Some(ttl),
         retry_ratio,
         min_retries_per_second,
     }
@@ -607,7 +610,10 @@ impl RouteBuilder {
     }
 
     pub fn timeout(mut self, dur: Duration) -> Self {
-        self.route.timeout = Some(dur.into());
+        let dur = dur
+            .try_into()
+            .expect("timeout duration cannot be converted to protobuf");
+        self.route.timeout = Some(dur);
         self
     }
 }
diff --git a/linkerd/http-route/Cargo.toml b/linkerd/http-route/Cargo.toml
index 1914f21e9..41507714e 100644
--- a/linkerd/http-route/Cargo.toml
+++ b/linkerd/http-route/Cargo.toml
@@ -17,7 +17,7 @@ tracing = "0.1"
 url = "2"
 
 [dependencies.linkerd2-proxy-api]
-version = "0.6"
+version = "0.7"
 features = ["http-route", "grpc-route"]
 optional = true
 
diff --git a/linkerd/opencensus/Cargo.toml b/linkerd/opencensus/Cargo.toml
index 1e744cdf0..04f4909c4 100644
--- a/linkerd/opencensus/Cargo.toml
+++ b/linkerd/opencensus/Cargo.toml
@@ -13,7 +13,7 @@ http-body = "0.4"
 linkerd-error = { path = "../error" }
 linkerd-metrics = { path = "../metrics" }
 opencensus-proto = { path = "../../opencensus-proto" }
-tonic = { version = "0.7", default-features = false, features = ["prost", "codegen"] }
+tonic = { version = "0.8", default-features = false, features = ["prost", "codegen"] }
 tokio = { version = "1", features = ["macros", "sync", "time"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 tracing = "0.1"
diff --git a/linkerd/proxy/api-resolve/Cargo.toml b/linkerd/proxy/api-resolve/Cargo.toml
index b8e8fa575..3bc3dbcf3 100644
--- a/linkerd/proxy/api-resolve/Cargo.toml
+++ b/linkerd/proxy/api-resolve/Cargo.toml
@@ -14,14 +14,14 @@ async-stream = "0.3"
 futures = { version = "0.3", default-features = false }
 linkerd-addr = { path = "../../addr" }
 linkerd-error = { path = "../../error" }
-linkerd2-proxy-api = { version = "0.6", features = ["destination"] }
+linkerd2-proxy-api = { version = "0.7", features = ["destination"] }
 linkerd-proxy-core = { path = "../core" }
 linkerd-stack = { path = "../../stack" }
 linkerd-tls = { path = "../../tls" }
 http = "0.2"
 http-body = "0.4"
 pin-project = "1"
-prost = "0.10"
-tonic = { version = "0.7", default-features = false }
+prost = "0.11"
+tonic = { version = "0.8", default-features = false }
 tower = { version = "0.4", default-features = false }
 tracing = "0.1"
diff --git a/linkerd/proxy/identity-client/Cargo.toml b/linkerd/proxy/identity-client/Cargo.toml
index bc3aedfc2..ca35db5c6 100644
--- a/linkerd/proxy/identity-client/Cargo.toml
+++ b/linkerd/proxy/identity-client/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [dependencies]
 futures = { version = "0.3", default-features = false }
-linkerd2-proxy-api = { version = "0.6", features = ["identity"] }
+linkerd2-proxy-api = { version = "0.7", features = ["identity"] }
 linkerd-error = { path = "../../error" }
 linkerd-identity = { path = "../../identity" }
 linkerd-metrics = { path = "../../metrics" }
@@ -17,6 +17,6 @@ parking_lot = "0.12"
 pin-project = "1"
 thiserror = "1"
 tokio = { version = "1", features = ["time", "sync"] }
-tonic = { version = "0.7", default-features = false }
+tonic = { version = "0.8", default-features = false }
 tracing = "0.1"
 http-body = "0.4"
diff --git a/linkerd/proxy/tap/Cargo.toml b/linkerd/proxy/tap/Cargo.toml
index 2efeb05fd..ef40b7f61 100644
--- a/linkerd/proxy/tap/Cargo.toml
+++ b/linkerd/proxy/tap/Cargo.toml
@@ -11,7 +11,7 @@ http = "0.2"
 hyper = { version = "0.14", features = ["http1", "http2"] }
 futures = { version = "0.3", default-features = false }
 ipnet = "2.5"
-linkerd2-proxy-api = { version = "0.6", features = ["tap"] }
+linkerd2-proxy-api = { version = "0.7", features = ["tap"] }
 linkerd-conditional = { path = "../../conditional" }
 linkerd-error = { path = "../../error" }
 linkerd-meshtls = { path = "../../meshtls" }
@@ -20,15 +20,15 @@ linkerd-proxy-http = { path = "../http" }
 linkerd-stack = { path = "../../stack" }
 linkerd-tls = { path = "../../tls" }
 parking_lot = "0.12"
+prost-types = "0.11"
 rand = { version = "0.8" }
 thiserror = "1"
 tokio = { version = "1", features = ["time"] }
 tower = { version = "0.4", default-features = false }
-tonic = { version = "0.7", default-features = false }
+tonic = { version = "0.8", default-features = false }
 tracing = "0.1"
 pin-project = "1"
 
 [dev-dependencies]
-linkerd2-proxy-api = { version = "0.6", features = ["arbitrary"] }
-prost-types = "0.10"
+linkerd2-proxy-api = { version = "0.7", features = ["arbitrary"] }
 quickcheck = { version = "1", default-features = false }
diff --git a/linkerd/proxy/tap/src/grpc/server.rs b/linkerd/proxy/tap/src/grpc/server.rs
index 947ca0b37..625019c1d 100644
--- a/linkerd/proxy/tap/src/grpc/server.rs
+++ b/linkerd/proxy/tap/src/grpc/server.rs
@@ -367,7 +367,7 @@ impl iface::TapResponse for TapResponse {
         let since_request_init = response_init_at.saturating_duration_since(self.request_init_at);
         let init = api::tap_event::http::Event::ResponseInit(api::tap_event::http::ResponseInit {
             id: Some(self.tap.id.clone()),
-            since_request_init: Some(since_request_init.into()),
+            since_request_init: pb_duration(since_request_init),
             http_status: rsp.status().as_u16().into(),
             headers,
         });
@@ -401,7 +401,7 @@ impl iface::TapResponse for TapResponse {
         let since_request_init = response_end_at.saturating_duration_since(self.request_init_at);
         let end = api::tap_event::http::Event::ResponseEnd(api::tap_event::http::ResponseEnd {
             id: Some(self.tap.id.clone()),
-            since_request_init: Some(since_request_init.into()),
+            since_request_init: pb_duration(since_request_init),
             since_response_init: None,
             response_bytes: 0,
             eos: Some(api::Eos {
@@ -470,8 +470,8 @@ impl TapResponsePayload {
         let since_response_init = response_end_at.saturating_duration_since(self.response_init_at);
         let end = api::tap_event::http::ResponseEnd {
             id: Some(self.tap.id),
-            since_request_init: Some(since_request_init.into()),
-            since_response_init: Some(since_response_init.into()),
+            since_request_init: pb_duration(since_request_init),
+            since_response_init: pb_duration(since_response_init),
             response_bytes: self.response_bytes as u64,
             eos: Some(api::Eos { end }),
             trailers,
@@ -587,3 +587,10 @@ fn headers_to_pb(
             .collect(),
     }
 }
+
+fn pb_duration(duration: std::time::Duration) -> Option<prost_types::Duration> {
+    duration
+        .try_into()
+        .map_err(|error| warn!(%error, ?duration, "Failed to convert duration to protobuf"))
+        .ok()
+}
diff --git a/linkerd/server-policy/Cargo.toml b/linkerd/server-policy/Cargo.toml
index 78d086b5a..980c0b5ce 100644
--- a/linkerd/server-policy/Cargo.toml
+++ b/linkerd/server-policy/Cargo.toml
@@ -7,13 +7,14 @@ edition = "2021"
 publish = false
 
 [features]
-proto = ["linkerd-http-route/proto", "linkerd2-proxy-api"]
+proto = ["linkerd-http-route/proto", "linkerd2-proxy-api", "prost-types"]
 
 [dependencies]
 ipnet = "2"
 http = "0.2"
 linkerd-http-route = { path = "../http-route" }
-linkerd2-proxy-api = { version = "0.6", features = ["inbound"], optional = true }
+linkerd2-proxy-api = { version = "0.7", features = ["inbound"], optional = true }
+prost-types = { version = "0.11", optional = true }
 thiserror = "1"
 
 [dev-dependencies]
diff --git a/linkerd/server-policy/src/lib.rs b/linkerd/server-policy/src/lib.rs
index 4b6912a84..bee142475 100644
--- a/linkerd/server-policy/src/lib.rs
+++ b/linkerd/server-policy/src/lib.rs
@@ -74,7 +74,6 @@ pub mod proto {
     use super::*;
     use crate::meta::proto::InvalidMeta;
     use linkerd2_proxy_api::inbound as api;
-    use std::time::Duration;
 
     #[derive(Debug, thiserror::Error)]
     pub enum InvalidServer {
@@ -82,7 +81,7 @@ pub mod proto {
         MissingDetectTimeout,
 
         #[error("invalid protocol detection timeout: {0:?}")]
-        NegativeDetectTimeout(Duration),
+        InvalidTimeout(#[from] prost_types::DurationError),
 
         #[error("missing protocol detection timeout")]
         MissingProxyProtocol,
@@ -159,8 +158,7 @@ pub mod proto {
                     http: mk_routes!(http, http_routes, authorizations.clone())?,
                     timeout: timeout
                         .ok_or(InvalidServer::MissingDetectTimeout)?
-                        .try_into()
-                        .map_err(InvalidServer::NegativeDetectTimeout)?,
+                        .try_into()?,
                     tcp_authorizations: authorizations,
                 },
 
diff --git a/linkerd/service-profiles/Cargo.toml b/linkerd/service-profiles/Cargo.toml
index c984ad9e6..a4fec8432 100644
--- a/linkerd/service-profiles/Cargo.toml
+++ b/linkerd/service-profiles/Cargo.toml
@@ -22,18 +22,18 @@ linkerd-http-box = { path = "../http-box" }
 linkerd-proxy-api-resolve = { path = "../proxy/api-resolve" }
 linkerd-stack = { path = "../stack" }
 linkerd-tonic-watch = { path = "../tonic-watch" }
-linkerd2-proxy-api = { version = "0.6", features = ["destination"] }
+linkerd2-proxy-api = { version = "0.7", features = ["destination"] }
 rand = { version = "0.8", features = ["small_rng"] }
 regex = "1"
 tokio = { version = "1", features = ["macros", "rt", "sync", "time"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
-tonic = { version = "0.7", default-features = false }
+tonic = { version = "0.8", default-features = false }
 tower = { version = "0.4.13", features = ["ready-cache", "retry", "util"] }
 thiserror = "1"
 tracing = "0.1"
 pin-project = "1"
+prost-types = "0.11"
 
 [dev-dependencies]
-linkerd2-proxy-api = { version = "0.6", features = ["arbitrary"] }
-prost-types = "0.10"
+linkerd2-proxy-api = { version = "0.7", features = ["arbitrary"] }
 quickcheck = { version = "1", default-features = false }
diff --git a/linkerd/service-profiles/src/proto.rs b/linkerd/service-profiles/src/proto.rs
index 99ae648d4..fc5a6e69d 100644
--- a/linkerd/service-profiles/src/proto.rs
+++ b/linkerd/service-profiles/src/proto.rs
@@ -77,13 +77,16 @@ fn set_route_retry(route: &mut http::Route, retry_budget: Option<&Arc<Budget>>)
     route.set_retries(budget);
 }
 
-fn set_route_timeout(route: &mut http::Route, timeout: Result<Duration, Duration>) {
+fn set_route_timeout(
+    route: &mut http::Route,
+    timeout: Result<Duration, prost_types::DurationError>,
+) {
     match timeout {
         Ok(dur) => {
             route.set_timeout(dur);
         }
-        Err(_) => {
-            warn!("route timeout is negative: {:?}", route);
+        Err(error) => {
+            warn!(%error, "error setting timeout for route");
         }
     }
 }
diff --git a/linkerd/tonic-watch/Cargo.toml b/linkerd/tonic-watch/Cargo.toml
index 98ba4874d..0e9cdad0d 100644
--- a/linkerd/tonic-watch/Cargo.toml
+++ b/linkerd/tonic-watch/Cargo.toml
@@ -13,7 +13,7 @@ Provides a utility for creating robust watches from a service that returns a str
 futures = { version = "0.3", default-features = false }
 linkerd-error = { path = "../error" }
 linkerd-stack = { path = "../stack" }
-tonic = { version = "0.7", default-features = false }
+tonic = { version = "0.8", default-features = false }
 tokio = { version = "1", features = ["macros", "rt", "sync", "time"] }
 tracing = "0.1"
 
diff --git a/linkerd/transport-header/Cargo.toml b/linkerd/transport-header/Cargo.toml
index 44f99dadb..363655937 100644
--- a/linkerd/transport-header/Cargo.toml
+++ b/linkerd/transport-header/Cargo.toml
@@ -14,7 +14,7 @@ linkerd-dns-name = { path = "../dns/name" }
 linkerd-error = { path = "../error" }
 linkerd-io = { path = "../io" }
 linkerd-stack = { path = "../stack" }
-prost = "0.10"
+prost = "0.11"
 tokio = { version = "1", features = ["time"] }
 tracing = "0.1"
 
@@ -23,6 +23,6 @@ arbitrary = { version = "1", features = ["derive"] }
 libfuzzer-sys = { version = "0.4", features = ["arbitrary-derive"] }
 
 [dev-dependencies]
-prost-build = { version = "0.10", default-features = false }
+prost-build = { version = "0.11", default-features = false }
 tokio = { version = "1", features = ["macros"] }
 tokio-test = "0.4"
diff --git a/opencensus-proto/Cargo.toml b/opencensus-proto/Cargo.toml
index 8da7f4b2a..2465dc73b 100644
--- a/opencensus-proto/Cargo.toml
+++ b/opencensus-proto/Cargo.toml
@@ -13,16 +13,16 @@ Vendored from https://github.com/census-instrumentation/opencensus-proto/.
 
 [dependencies]
 bytes = "1"
-prost = "0.10"
-prost-types = "0.10"
+prost = "0.11"
+prost-types = "0.11"
 
 [dependencies.tonic]
-version = "0.7"
+version = "0.8"
 default-features = false
 features = ["prost", "codegen"]
 
 [dev-dependencies.tonic-build]
-version = "0.7"
+version = "0.8"
 default-features = false
 features = ["prost"]
 
diff --git a/opencensus-proto/src/gen/opencensus.proto.agent.common.v1.rs b/opencensus-proto/src/gen/opencensus.proto.agent.common.v1.rs
index 8a70a6ad7..80599bc28 100644
--- a/opencensus-proto/src/gen/opencensus.proto.agent.common.v1.rs
+++ b/opencensus-proto/src/gen/opencensus.proto.agent.common.v1.rs
@@ -61,6 +61,27 @@ pub mod library_info {
         Ruby = 9,
         WebJs = 10,
     }
+    impl Language {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                Language::Unspecified => "LANGUAGE_UNSPECIFIED",
+                Language::Cpp => "CPP",
+                Language::CSharp => "C_SHARP",
+                Language::Erlang => "ERLANG",
+                Language::GoLang => "GO_LANG",
+                Language::Java => "JAVA",
+                Language::NodeJs => "NODE_JS",
+                Language::Php => "PHP",
+                Language::Python => "PYTHON",
+                Language::Ruby => "RUBY",
+                Language::WebJs => "WEB_JS",
+            }
+        }
+    }
 }
 /// Additional service information.
 #[derive(Clone, PartialEq, ::prost::Message)]
diff --git a/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs b/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs
index fe221fcdd..a44a0fd25 100644
--- a/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs
+++ b/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs
@@ -44,6 +44,7 @@ pub struct ExportTraceServiceResponse {
 pub mod trace_service_client {
     #![allow(unused_variables, dead_code, missing_docs, clippy::let_unit_value)]
     use tonic::codegen::*;
+    use tonic::codegen::http::Uri;
     /// Service that can be used to push spans and configs between one Application
     /// instrumented with OpenCensus and an agent, or between an agent and a
     /// central collector or config service (in this case spans and configs are
@@ -63,6 +64,10 @@ pub mod trace_service_client {
             let inner = tonic::client::Grpc::new(inner);
             Self { inner }
         }
+        pub fn with_origin(inner: T, origin: Uri) -> Self {
+            let inner = tonic::client::Grpc::with_origin(inner, origin);
+            Self { inner }
+        }
         pub fn with_interceptor<F>(
             inner: T,
             interceptor: F,
@@ -82,19 +87,19 @@ pub mod trace_service_client {
         {
             TraceServiceClient::new(InterceptedService::new(inner, interceptor))
         }
-        /// Compress requests with `gzip`.
+        /// Compress requests with the given encoding.
         ///
         /// This requires the server to support it otherwise it might respond with an
         /// error.
         #[must_use]
-        pub fn send_gzip(mut self) -> Self {
-            self.inner = self.inner.send_gzip();
+        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
+            self.inner = self.inner.send_compressed(encoding);
             self
         }
-        /// Enable decompressing responses with `gzip`.
+        /// Enable decompressing responses.
         #[must_use]
-        pub fn accept_gzip(mut self) -> Self {
-            self.inner = self.inner.accept_gzip();
+        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
+            self.inner = self.inner.accept_compressed(encoding);
             self
         }
         /// After initialization, this RPC must be kept alive for the entire life of
diff --git a/opencensus-proto/src/gen/opencensus.proto.trace.v1.rs b/opencensus-proto/src/gen/opencensus.proto.trace.v1.rs
index 5b83f5c9b..3c9752961 100644
--- a/opencensus-proto/src/gen/opencensus.proto.trace.v1.rs
+++ b/opencensus-proto/src/gen/opencensus.proto.trace.v1.rs
@@ -149,10 +149,10 @@ pub mod span {
         /// or the Boolean values `true` or `false`. Note, global attributes like 
         /// server name can be set as tags using resource API. Examples of attributes:
         ///
-        ///     "/http/user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
-        ///     "/http/server_latency": 300
-        ///     "abc.com/myattribute": true
-        ///     "abc.com/score": 10.239
+        ///      "/http/user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36"
+        ///      "/http/server_latency": 300
+        ///      "abc.com/myattribute": true
+        ///      "abc.com/score": 10.239
         #[prost(map="string, message", tag="1")]
         pub attribute_map: ::std::collections::HashMap<::prost::alloc::string::String, super::AttributeValue>,
         /// The number of attributes that were discarded. Attributes can be discarded
@@ -218,6 +218,19 @@ pub mod span {
                 /// Indicates a received message.
                 Received = 2,
             }
+            impl Type {
+                /// String value of the enum field names used in the ProtoBuf definition.
+                ///
+                /// The values are not transformed in any way and thus are considered stable
+                /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+                pub fn as_str_name(&self) -> &'static str {
+                    match self {
+                        Type::Unspecified => "TYPE_UNSPECIFIED",
+                        Type::Sent => "SENT",
+                        Type::Received => "RECEIVED",
+                    }
+                }
+            }
         }
         /// A `TimeEvent` can contain either an `Annotation` object or a
         /// `MessageEvent` object, but not both.
@@ -286,6 +299,19 @@ pub mod span {
             /// The linked span is a parent of the current span.
             ParentLinkedSpan = 2,
         }
+        impl Type {
+            /// String value of the enum field names used in the ProtoBuf definition.
+            ///
+            /// The values are not transformed in any way and thus are considered stable
+            /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+            pub fn as_str_name(&self) -> &'static str {
+                match self {
+                    Type::Unspecified => "TYPE_UNSPECIFIED",
+                    Type::ChildLinkedSpan => "CHILD_LINKED_SPAN",
+                    Type::ParentLinkedSpan => "PARENT_LINKED_SPAN",
+                }
+            }
+        }
     }
     /// A collection of links, which are references from this span to a span
     /// in the same or different trace.
@@ -313,6 +339,19 @@ pub mod span {
         /// other remote request.
         Client = 2,
     }
+    impl SpanKind {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                SpanKind::Unspecified => "SPAN_KIND_UNSPECIFIED",
+                SpanKind::Server => "SERVER",
+                SpanKind::Client => "CLIENT",
+            }
+        }
+    }
 }
 /// The `Status` type defines a logical error model that is suitable for different
 /// programming environments, including REST APIs and RPC APIs. This proto's fields
@@ -509,6 +548,19 @@ pub mod constant_sampler {
         AlwaysOn = 1,
         AlwaysParent = 2,
     }
+    impl ConstantDecision {
+        /// String value of the enum field names used in the ProtoBuf definition.
+        ///
+        /// The values are not transformed in any way and thus are considered stable
+        /// (if the ProtoBuf definition does not change) and safe for programmatic use.
+        pub fn as_str_name(&self) -> &'static str {
+            match self {
+                ConstantDecision::AlwaysOff => "ALWAYS_OFF",
+                ConstantDecision::AlwaysOn => "ALWAYS_ON",
+                ConstantDecision::AlwaysParent => "ALWAYS_PARENT",
+            }
+        }
+    }
 }
 /// Sampler that tries to sample with a rate per time window.
 #[derive(Clone, PartialEq, ::prost::Message)]
diff --git a/opencensus-proto/tests/bootstrap.rs b/opencensus-proto/tests/bootstrap.rs
index 5079ec70c..0b5509eee 100644
--- a/opencensus-proto/tests/bootstrap.rs
+++ b/opencensus-proto/tests/bootstrap.rs
@@ -28,12 +28,15 @@ fn generate(out_dir: &std::path::Path) {
         "opencensus/proto/trace/v1/trace_config.proto",
         "opencensus/proto/trace/v1/trace.proto",
     ];
-    tonic_build::configure()
+    if let Err(error) = tonic_build::configure()
         .build_client(true)
         .build_server(false)
+        .emit_rerun_if_changed(false)
         .out_dir(out_dir)
         .compile(iface_files, &["."])
-        .expect("failed to compile protobuf");
+    {
+        panic!("failed to compile protobuf: {error}")
+    }
 }
 
 /// Returns true if the given path contains files that have changed since the
diff --git a/tools/Cargo.toml b/tools/Cargo.toml
new file mode 100644
index 000000000..3cb81e251
--- /dev/null
+++ b/tools/Cargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "tools"
+version = "0.1.0"
+edition = "2021"
+license = "Apache-2.0"
+publish = false
+
+[dependencies.tonic-build]
+version = "0.8"
+default-features = false
+features = ["prost"]
\ No newline at end of file
diff --git a/tools/src/bin/gen-protos.rs b/tools/src/bin/gen-protos.rs
new file mode 100644
index 000000000..4e85f3bff
--- /dev/null
+++ b/tools/src/bin/gen-protos.rs
@@ -0,0 +1,29 @@
+fn main() {
+    let opencensus_dir = {
+        let manifest_dir = std::path::PathBuf::from(std::env!("CARGO_MANIFEST_DIR"));
+        manifest_dir.parent().unwrap().join("opencensus-proto")
+    };
+
+    let out_dir = opencensus_dir.join("src").join("gen");
+
+    let iface_files = {
+        let proto_dir = opencensus_dir.join("opencensus").join("proto");
+        &[
+            proto_dir.join("agent/common/v1/common.proto"),
+            proto_dir.join("agent/trace/v1/trace_service.proto"),
+            proto_dir.join("resource/v1/resource.proto"),
+            proto_dir.join("trace/v1/trace_config.proto"),
+            proto_dir.join("trace/v1/trace.proto"),
+        ]
+    };
+
+    if let Err(error) = tonic_build::configure()
+        .build_client(true)
+        .build_server(false)
+        .emit_rerun_if_changed(false)
+        .out_dir(out_dir)
+        .compile(iface_files, &[opencensus_dir])
+    {
+        eprintln!("\nfailed to compile protos: {}", error);
+    }
+}