diff --git a/pkg/xds/envoy/listeners/fault_injection_configurer_test.go b/pkg/xds/envoy/listeners/fault_injection_configurer_test.go
index f60373c3b176..acafa4377a71 100644
--- a/pkg/xds/envoy/listeners/fault_injection_configurer_test.go
+++ b/pkg/xds/envoy/listeners/fault_injection_configurer_test.go
@@ -68,7 +68,7 @@ var _ = Describe("FaultInjectionConfigurer", func() {
                       safeRegexMatch:
                         googleRe2: 
                           maxProgramSize: 500
-                        regex: '&tag1=[^&]*value1[,&].*&tag2=[^&]*value2[,&].*'
+                        regex: '.*&tag1=[^&]*value1[,&].*&tag2=[^&]*value2[,&].*'
                 - name: envoy.router
                 statPrefix: stats`,
 		}),
@@ -114,7 +114,7 @@ var _ = Describe("FaultInjectionConfigurer", func() {
                       safeRegexMatch:
                         googleRe2: 
                           maxProgramSize: 500
-                        regex: '(&tag1=[^&]*value1m1[,&].*&tag2=[^&]*value2m1[,&].*|&tag1=[^&]*value1m2[,&].*&tag2=[^&]*value2m2[,&].*)'
+                        regex: '(.*&tag1=[^&]*value1m1[,&].*&tag2=[^&]*value2m1[,&].*|.*&tag1=[^&]*value1m2[,&].*&tag2=[^&]*value2m2[,&].*)'
                 - name: envoy.router
                 statPrefix: stats`,
 		}),
diff --git a/pkg/xds/envoy/tags/match.go b/pkg/xds/envoy/tags/match.go
index 928596894380..44edf045c3af 100644
--- a/pkg/xds/envoy/tags/match.go
+++ b/pkg/xds/envoy/tags/match.go
@@ -21,6 +21,7 @@ func MatchingRegex(tags mesh_proto.SingleValueTagSet) (re string) {
 		expr := keyIsEqual + value + `.*`
 		re += expr
 	}
+	re = `.*` + re
 	return
 }
 
diff --git a/pkg/xds/envoy/tags/match_test.go b/pkg/xds/envoy/tags/match_test.go
index d5c2679ca5b6..5ebb915f50e6 100644
--- a/pkg/xds/envoy/tags/match_test.go
+++ b/pkg/xds/envoy/tags/match_test.go
@@ -11,6 +11,14 @@ import (
 	"github.com/Kong/kuma/pkg/xds/envoy/tags"
 )
 
+func strictMatch(re *regexp.Regexp, s string) bool {
+	idx := re.FindStringIndex(s)
+	if idx == nil {
+		return false
+	}
+	return idx[0] == 0 && idx[1] == len(s)
+}
+
 var _ = Describe("MatchingRegex", func() {
 
 	type testCase struct {
@@ -27,7 +35,7 @@ var _ = Describe("MatchingRegex", func() {
 			// then
 			Expect(err).ToNot(HaveOccurred())
 			// when
-			matched := re.MatchString(tags.Serialize(given.serviceTags))
+			matched := strictMatch(re, tags.Serialize(given.serviceTags))
 			// then
 			Expect(matched).To(Equal(given.expected))
 		},
@@ -42,6 +50,18 @@ var _ = Describe("MatchingRegex", func() {
 			},
 			expected: true,
 		}),
+		Entry("match 3 one-value tags", testCase{
+			serviceTags: mesh_proto.MultiValueTagSet{
+				"tag1": {"value1": true},
+				"tag2": {"value2": true},
+				"tag3": {"value3": true},
+			},
+			selector: mesh_proto.SingleValueTagSet{
+				"tag2": "value2",
+				"tag3": "value3",
+			},
+			expected: true,
+		}),
 		Entry("match without middle tag2", testCase{
 			serviceTags: mesh_proto.MultiValueTagSet{
 				"tag1": {"value1": true, "value2": true},
@@ -142,7 +162,7 @@ var _ = Describe("RegexOR", func() {
 			Expect(err).ToNot(HaveOccurred())
 
 			for i, service := range given.servicesTags {
-				matched := re.MatchString(tags.Serialize(service))
+				matched := strictMatch(re, tags.Serialize(service))
 				Expect(matched).To(Equal(given.expected[i]))
 			}
 		},
diff --git a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
index bea83c412064..100b82c8eefd 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/3-envoy-config.golden.yaml
@@ -53,7 +53,7 @@ resources:
                           safeRegexMatch:
                             googleRe2:
                               maxProgramSize: 500
-                            regex: '&service=[^&]*frontend[,&].*'
+                            regex: '.*&service=[^&]*frontend[,&].*'
                   - name: envoy.router
                 routeConfig:
                   name: inbound:backend1
diff --git a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
index 1b720e5f31de..dbee357b69a4 100644
--- a/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/inbound-proxy/4-envoy-config.golden.yaml
@@ -55,7 +55,7 @@ resources:
                           safeRegexMatch:
                             googleRe2:
                               maxProgramSize: 500
-                            regex: '&service=[^&]*frontend[,&].*'
+                            regex: '.*&service=[^&]*frontend[,&].*'
                   - name: envoy.router
                 routeConfig:
                   name: inbound:backend1