diff --git a/networking/v1alpha3/workload_group.proto b/networking/v1alpha3/workload_group.proto
index 898533e901..3c1c661d0b 100644
--- a/networking/v1alpha3/workload_group.proto
+++ b/networking/v1alpha3/workload_group.proto
@@ -82,6 +82,7 @@ option go_package = "istio.io/api/networking/v1alpha3";
 // <!-- crd generation tags
 // +cue-gen:WorkloadGroup:groupName:networking.istio.io
 // +cue-gen:WorkloadGroup:versions:v1beta1,v1alpha3,v1
+// +cue-gen:WorkloadGroup:annotations:helm.sh/resource-policy=keep
 // +cue-gen:WorkloadGroup:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
 // +cue-gen:WorkloadGroup:subresource:status
 // +cue-gen:WorkloadGroup:scope:Namespaced