diff --git a/charts/linkerd-crds/templates/workload/external-workload.yaml b/charts/linkerd-crds/templates/workload/external-workload.yaml
index e022d856c1394..da07365e23a4f 100644
--- a/charts/linkerd-crds/templates/workload/external-workload.yaml
+++ b/charts/linkerd-crds/templates/workload/external-workload.yaml
@@ -46,17 +46,8 @@ spec:
             type: object
           spec:
             properties:
-              workloadIPs:
-                type: array
-                description: workloadIPs contains a list of IP addresses that
-                  can be used to send traffic to the workload.
-                items:
-                  type: object
-                  properties:
-                    ip:
-                      type: string
               meshTls:
-                description: tls describes mesh TLS settings associated with an
+                description: meshTls describes TLS settings associated with an
                   external workload.
                 properties:
                   identity:
@@ -95,10 +86,20 @@ spec:
                       description: protocol exposed by the port. Must be UDP or
                         TCP. Defaults to TCP.
                       type: string
+                      default: "TCP"
+              workloadIPs:
+                type: array
+                description: workloadIPs contains a list of IP addresses that
+                  can be used to send traffic to the workload.
+                items:
+                  type: object
+                  properties:
+                    ip:
+                      type: string
             type: object
             required:
-            - workloadIPs
             - ports
+            - workloadIPs
           status:
             type: object
             properties: