diff --git a/api/envoy/config/trace/v3/opencensus.proto b/api/envoy/config/trace/v3/opencensus.proto
index 86a986a24e43..a3399fa7a375 100644
--- a/api/envoy/config/trace/v3/opencensus.proto
+++ b/api/envoy/config/trace/v3/opencensus.proto
@@ -48,70 +48,109 @@ message OpenCensusConfig {
   reserved 7;
 
   // Configures tracing, e.g. the sampler, max number of annotations, etc.
-  opencensus.proto.trace.v1.TraceConfig trace_config = 1
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  opencensus.proto.trace.v1.TraceConfig trace_config = 1 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // Enables the stdout exporter if set to true. This is intended for debugging
   // purposes.
-  bool stdout_exporter_enabled = 2
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  bool stdout_exporter_enabled = 2 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // Enables the Stackdriver exporter if set to true. The project_id must also
   // be set.
-  bool stackdriver_exporter_enabled = 3
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  bool stackdriver_exporter_enabled = 3 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // The Cloud project_id to use for Stackdriver tracing.
-  string stackdriver_project_id = 4
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  string stackdriver_project_id = 4 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // (optional) By default, the Stackdriver exporter will connect to production
   // Stackdriver. If stackdriver_address is non-empty, it will instead connect
   // to this address, which is in the gRPC format:
   // https://github.com/grpc/grpc/blob/master/doc/naming.md
-  string stackdriver_address = 10
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  string stackdriver_address = 10 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // (optional) The gRPC server that hosts Stackdriver tracing service. Only
   // Google gRPC is supported. If :ref:`target_uri <envoy_v3_api_field_config.core.v3.GrpcService.GoogleGrpc.target_uri>`
   // is not provided, the default production Stackdriver address will be used.
-  core.v3.GrpcService stackdriver_grpc_service = 13
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  core.v3.GrpcService stackdriver_grpc_service = 13 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // Enables the Zipkin exporter if set to true. The url and service name must
   // also be set. This is deprecated, prefer to use Envoy's :ref:`native Zipkin
   // tracer <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  bool zipkin_exporter_enabled = 5
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  bool zipkin_exporter_enabled = 5 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // The URL to Zipkin, e.g. "http://127.0.0.1:9411/api/v2/spans". This is
   // deprecated, prefer to use Envoy's :ref:`native Zipkin tracer
   // <envoy_v3_api_msg_config.trace.v3.ZipkinConfig>`.
-  string zipkin_url = 6
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  string zipkin_url = 6 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // Enables the OpenCensus Agent exporter if set to true. The ocagent_address or
   // ocagent_grpc_service must also be set.
-  bool ocagent_exporter_enabled = 11
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  bool ocagent_exporter_enabled = 11 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // The address of the OpenCensus Agent, if its exporter is enabled, in gRPC
   // format: https://github.com/grpc/grpc/blob/master/doc/naming.md
   // [#comment:TODO: deprecate this field]
-  string ocagent_address = 12
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  string ocagent_address = 12 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // (optional) The gRPC server hosted by the OpenCensus Agent. Only Google gRPC is supported.
   // This is only used if the ocagent_address is left empty.
-  core.v3.GrpcService ocagent_grpc_service = 14
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  core.v3.GrpcService ocagent_grpc_service = 14 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // List of incoming trace context headers we will accept. First one found
   // wins.
-  repeated TraceContext incoming_trace_context = 8
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  repeated TraceContext incoming_trace_context = 8 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 
   // List of outgoing trace context headers we will produce.
-  repeated TraceContext outgoing_trace_context = 9
-      [deprecated = true, (envoy.annotations.deprecated_at_minor_version) = "3.0"];
+  repeated TraceContext outgoing_trace_context = 9 [
+    deprecated = true,
+    (envoy.annotations.deprecated_at_minor_version) = "3.0",
+    (envoy.annotations.disallowed_by_default) = true
+  ];
 }
diff --git a/changelogs/current.yaml b/changelogs/current.yaml
index 6b1c5e70098f..27acbb9d5213 100644
--- a/changelogs/current.yaml
+++ b/changelogs/current.yaml
@@ -79,3 +79,8 @@ new_features:
     for disabling appending of the ``-shadow`` suffix to the shadowed host/authority header.
 
 deprecated:
+- area: tracing
+  change: |
+    Disable OpenCensus by default, as it is
+    `no longer supported/maintained upstream <https://opentelemetry.io/blog/2023/sunsetting-opencensus/>`_.
+    This extension can be replaced with the OpenTelemetry tracer and collector.