diff --git a/.changelog/10069.txt b/.changelog/10069.txt
new file mode 100644
index 0000000000..22ab253994
--- /dev/null
+++ b/.changelog/10069.txt
@@ -0,0 +1,3 @@
+```release-note:breaking-change
+connect: Disallow wildcard as name for service-defaults. 
+```
\ No newline at end of file
diff --git a/agent/structs/config_entry.go b/agent/structs/config_entry.go
index 2491ed9462..192bd5626d 100644
--- a/agent/structs/config_entry.go
+++ b/agent/structs/config_entry.go
@@ -157,6 +157,9 @@ func (e *ServiceConfigEntry) Validate() error {
 	if e.Name == "" {
 		return fmt.Errorf("Name is required")
 	}
+	if e.Name == WildcardSpecifier {
+		return fmt.Errorf("service-defaults name must be the name of a service, and not a wildcard")
+	}
 
 	validationErr := validateConfigEntryMeta(e.Meta)
 
diff --git a/agent/structs/config_entry_test.go b/agent/structs/config_entry_test.go
index 97ebecfd9b..b1d987297b 100644
--- a/agent/structs/config_entry_test.go
+++ b/agent/structs/config_entry_test.go
@@ -1699,6 +1699,13 @@ func TestServiceConfigEntry_Validate(t *testing.T) {
 		expect    *ServiceConfigEntry
 		expectErr string
 	}{
+		{
+			name: "wildcard name is not allowed",
+			input: &ServiceConfigEntry{
+				Name: WildcardSpecifier,
+			},
+			expectErr: `must be the name of a service, and not a wildcard`,
+		},
 		{
 			name: "upstream config override no name",
 			input: &ServiceConfigEntry{