diff --git a/api/core/v1alpha/backend_types.go b/api/core/v1alpha/backend_types.go
index 77a22d7e..dbc026ad 100644
--- a/api/core/v1alpha/backend_types.go
+++ b/api/core/v1alpha/backend_types.go
@@ -68,6 +68,10 @@ type BackendEndpoint struct {
 	// +kubebuilder:validation:Format=ipv6
 	// +optional
 	IP string `json:"ip,omitempty"`
+
+	// Connect tunnels for this backend.
+	// +optional
+	Tunnel *TunnelRef `json:"tunnel,omitempty"`
 }
 
 type DynamicProxySpec struct {
diff --git a/api/core/v1alpha/tunnel_types.go b/api/core/v1alpha/tunnel_types.go
index 4ad50f0d..f36f159d 100644
--- a/api/core/v1alpha/tunnel_types.go
+++ b/api/core/v1alpha/tunnel_types.go
@@ -26,13 +26,13 @@ type TunnelNode struct {
 }
 
 type TunnelNodeSpec struct {
-	Peers []TunnelNodePeer `json:"peers,omitempty"`
+	Peers []TunnelRef `json:"peers,omitempty"`
 }
 
-type TunnelNodePeer struct {
-	// TunnelNodeRef is a reference to a TunnelNode that this node should peer with.
+type TunnelRef struct {
+	// TunnelNodeRef is a reference to an individual TunnelNode.
 	TunnelNodeRef *TunnelNodeRef `json:"tunnelNodeRef,omitempty"`
-	// LabelSelector is a label selector that selects the peers to peer with.
+	// LabelSelector is a label selector to dynamically select multiple TunnelNode objects.
 	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`
 }
 
diff --git a/api/core/v1alpha/zz_generated.deepcopy.go b/api/core/v1alpha/zz_generated.deepcopy.go
index 181fe66d..aec49ebb 100644
--- a/api/core/v1alpha/zz_generated.deepcopy.go
+++ b/api/core/v1alpha/zz_generated.deepcopy.go
@@ -171,6 +171,11 @@ func (in *Backend) DeepCopyObject() runtime.Object {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *BackendEndpoint) DeepCopyInto(out *BackendEndpoint) {
 	*out = *in
+	if in.Tunnel != nil {
+		in, out := &in.Tunnel, &out.Tunnel
+		*out = new(TunnelRef)
+		(*in).DeepCopyInto(*out)
+	}
 	return
 }
 
@@ -223,7 +228,9 @@ func (in *BackendSpec) DeepCopyInto(out *BackendSpec) {
 	if in.Endpoints != nil {
 		in, out := &in.Endpoints, &out.Endpoints
 		*out = make([]BackendEndpoint, len(*in))
-		copy(*out, *in)
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
 	}
 	if in.DynamicProxy != nil {
 		in, out := &in.DynamicProxy, &out.DynamicProxy
@@ -937,32 +944,6 @@ func (in *TunnelNodeList) DeepCopyObject() runtime.Object {
 	return nil
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TunnelNodePeer) DeepCopyInto(out *TunnelNodePeer) {
-	*out = *in
-	if in.TunnelNodeRef != nil {
-		in, out := &in.TunnelNodeRef, &out.TunnelNodeRef
-		*out = new(TunnelNodeRef)
-		**out = **in
-	}
-	if in.LabelSelector != nil {
-		in, out := &in.LabelSelector, &out.LabelSelector
-		*out = new(v1.LabelSelector)
-		(*in).DeepCopyInto(*out)
-	}
-	return
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TunnelNodePeer.
-func (in *TunnelNodePeer) DeepCopy() *TunnelNodePeer {
-	if in == nil {
-		return nil
-	}
-	out := new(TunnelNodePeer)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *TunnelNodeRef) DeepCopyInto(out *TunnelNodeRef) {
 	*out = *in
@@ -984,7 +965,7 @@ func (in *TunnelNodeSpec) DeepCopyInto(out *TunnelNodeSpec) {
 	*out = *in
 	if in.Peers != nil {
 		in, out := &in.Peers, &out.Peers
-		*out = make([]TunnelNodePeer, len(*in))
+		*out = make([]TunnelRef, len(*in))
 		for i := range *in {
 			(*in)[i].DeepCopyInto(&(*out)[i])
 		}
@@ -1017,3 +998,29 @@ func (in *TunnelNodeStatus) DeepCopy() *TunnelNodeStatus {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TunnelRef) DeepCopyInto(out *TunnelRef) {
+	*out = *in
+	if in.TunnelNodeRef != nil {
+		in, out := &in.TunnelNodeRef, &out.TunnelNodeRef
+		*out = new(TunnelNodeRef)
+		**out = **in
+	}
+	if in.LabelSelector != nil {
+		in, out := &in.LabelSelector, &out.LabelSelector
+		*out = new(v1.LabelSelector)
+		(*in).DeepCopyInto(*out)
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TunnelRef.
+func (in *TunnelRef) DeepCopy() *TunnelRef {
+	if in == nil {
+		return nil
+	}
+	out := new(TunnelRef)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/api/generated/zz_generated.openapi.go b/api/generated/zz_generated.openapi.go
index b7dcea77..ccc2e0cb 100644
--- a/api/generated/zz_generated.openapi.go
+++ b/api/generated/zz_generated.openapi.go
@@ -70,10 +70,10 @@ func GetOpenAPIDefinitions(ref common.ReferenceCallback) map[string]common.OpenA
 		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.ProxyStatus":                          schema_apoxy_cli_api_core_v1alpha_ProxyStatus(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNode":                           schema_apoxy_cli_api_core_v1alpha_TunnelNode(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeList":                       schema_apoxy_cli_api_core_v1alpha_TunnelNodeList(ref),
-		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodePeer":                       schema_apoxy_cli_api_core_v1alpha_TunnelNodePeer(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeRef":                        schema_apoxy_cli_api_core_v1alpha_TunnelNodeRef(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeSpec":                       schema_apoxy_cli_api_core_v1alpha_TunnelNodeSpec(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeStatus":                     schema_apoxy_cli_api_core_v1alpha_TunnelNodeStatus(ref),
+		"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelRef":                            schema_apoxy_cli_api_core_v1alpha_TunnelRef(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/extensions/v1alpha1.EdgeFunction":                  schema_apoxy_cli_api_extensions_v1alpha1_EdgeFunction(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/extensions/v1alpha1.EdgeFunctionCodeSource":        schema_apoxy_cli_api_extensions_v1alpha1_EdgeFunctionCodeSource(ref),
 		"github.com/apoxy-dev/apoxy-cli/api/extensions/v1alpha1.EdgeFunctionList":              schema_apoxy_cli_api_extensions_v1alpha1_EdgeFunctionList(ref),
@@ -1023,9 +1023,17 @@ func schema_apoxy_cli_api_core_v1alpha_BackendEndpoint(ref common.ReferenceCallb
 							Format:      "",
 						},
 					},
+					"tunnel": {
+						SchemaProps: spec.SchemaProps{
+							Description: "Connect tunnels for this backend.",
+							Ref:         ref("github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelRef"),
+						},
+					},
 				},
 			},
 		},
+		Dependencies: []string{
+			"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelRef"},
 	}
 }
 
@@ -2280,32 +2288,6 @@ func schema_apoxy_cli_api_core_v1alpha_TunnelNodeList(ref common.ReferenceCallba
 	}
 }
 
-func schema_apoxy_cli_api_core_v1alpha_TunnelNodePeer(ref common.ReferenceCallback) common.OpenAPIDefinition {
-	return common.OpenAPIDefinition{
-		Schema: spec.Schema{
-			SchemaProps: spec.SchemaProps{
-				Type: []string{"object"},
-				Properties: map[string]spec.Schema{
-					"tunnelNodeRef": {
-						SchemaProps: spec.SchemaProps{
-							Description: "TunnelNodeRef is a reference to a TunnelNode that this node should peer with.",
-							Ref:         ref("github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeRef"),
-						},
-					},
-					"labelSelector": {
-						SchemaProps: spec.SchemaProps{
-							Description: "LabelSelector is a label selector that selects the peers to peer with.",
-							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector"),
-						},
-					},
-				},
-			},
-		},
-		Dependencies: []string{
-			"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeRef", "k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector"},
-	}
-}
-
 func schema_apoxy_cli_api_core_v1alpha_TunnelNodeRef(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{
@@ -2338,7 +2320,7 @@ func schema_apoxy_cli_api_core_v1alpha_TunnelNodeSpec(ref common.ReferenceCallba
 								Schema: &spec.Schema{
 									SchemaProps: spec.SchemaProps{
 										Default: map[string]interface{}{},
-										Ref:     ref("github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodePeer"),
+										Ref:     ref("github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelRef"),
 									},
 								},
 							},
@@ -2348,7 +2330,7 @@ func schema_apoxy_cli_api_core_v1alpha_TunnelNodeSpec(ref common.ReferenceCallba
 			},
 		},
 		Dependencies: []string{
-			"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodePeer"},
+			"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelRef"},
 	}
 }
 
@@ -2392,6 +2374,32 @@ func schema_apoxy_cli_api_core_v1alpha_TunnelNodeStatus(ref common.ReferenceCall
 	}
 }
 
+func schema_apoxy_cli_api_core_v1alpha_TunnelRef(ref common.ReferenceCallback) common.OpenAPIDefinition {
+	return common.OpenAPIDefinition{
+		Schema: spec.Schema{
+			SchemaProps: spec.SchemaProps{
+				Type: []string{"object"},
+				Properties: map[string]spec.Schema{
+					"tunnelNodeRef": {
+						SchemaProps: spec.SchemaProps{
+							Description: "TunnelNodeRef is a reference to an individual TunnelNode.",
+							Ref:         ref("github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeRef"),
+						},
+					},
+					"labelSelector": {
+						SchemaProps: spec.SchemaProps{
+							Description: "LabelSelector is a label selector to dynamically select multiple TunnelNode objects.",
+							Ref:         ref("k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector"),
+						},
+					},
+				},
+			},
+		},
+		Dependencies: []string{
+			"github.com/apoxy-dev/apoxy-cli/api/core/v1alpha.TunnelNodeRef", "k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelector"},
+	}
+}
+
 func schema_apoxy_cli_api_extensions_v1alpha1_EdgeFunction(ref common.ReferenceCallback) common.OpenAPIDefinition {
 	return common.OpenAPIDefinition{
 		Schema: spec.Schema{