diff --git a/envoy/stream_info/filter_state.h b/envoy/stream_info/filter_state.h
index 2faa5bb8c089..d664be2adc06 100644
--- a/envoy/stream_info/filter_state.h
+++ b/envoy/stream_info/filter_state.h
@@ -87,52 +87,42 @@ class FilterState {
 
   /**
    * @param data_name the name of the data being looked up (mutable/readonly).
-   * @return a const reference to the stored data.
-   * An exception will be thrown if the data does not exist. This function
-   * will fail if the data stored under |data_name| cannot be dynamically
-   * cast to the type specified.
+   * @return a typed pointer to the stored data or nullptr if the data does not exist or the data
+   * type does not match the expected type.
    */
-  template <typename T> const T& getDataReadOnly(absl::string_view data_name) const {
-    const T* result = dynamic_cast<const T*>(getDataReadOnlyGeneric(data_name));
-    if (!result) {
-      ExceptionUtil::throwEnvoyException(
-          fmt::format("Data stored under {} cannot be coerced to specified type", data_name));
-    }
-    return *result;
+  template <typename T> const T* getDataReadOnly(absl::string_view data_name) const {
+    return dynamic_cast<const T*>(getDataReadOnlyGeneric(data_name));
   }
 
   /**
    * @param data_name the name of the data being looked up (mutable/readonly).
-   * @return a const reference to the stored data.
-   * An exception will be thrown if the data does not exist.
+   * @return a const pointer to the stored data or nullptr if the data does not exist.
    */
   virtual const Object* getDataReadOnlyGeneric(absl::string_view data_name) const PURE;
 
   /**
-   * @param data_name the name of the data being looked up (mutable only).
-   * @return a non-const reference to the stored data if and only if the
-   * underlying data is mutable.
-   * An exception will be thrown if the data does not exist or if it is
-   * immutable. This function will fail if the data stored under
-   * |data_name| cannot be dynamically cast to the type specified.
+   * @param data_name the name of the data being looked up (mutable/readonly).
+   * @return a typed pointer to the stored data or nullptr if the data does not exist or the data
+   * type does not match the expected type.
    */
-  template <typename T> T& getDataMutable(absl::string_view data_name) {
-    T* result = dynamic_cast<T*>(getDataMutableGeneric(data_name));
-    if (!result) {
-      ExceptionUtil::throwEnvoyException(
-          fmt::format("Data stored under {} cannot be coerced to specified type", data_name));
-    }
-    return *result;
+  template <typename T> T* getDataMutable(absl::string_view data_name) {
+    return dynamic_cast<T*>(getDataMutableGeneric(data_name));
   }
 
+  /**
+   * @param data_name the name of the data being looked up (mutable/readonly).
+   * @return a pointer to the stored data or nullptr if the data does not exist.
+   * An exception will be thrown if the data is not mutable.
+   */
+  virtual Object* getDataMutableGeneric(absl::string_view data_name) PURE;
+
   /**
    * @param data_name the name of the data being probed.
    * @return Whether data of the type and name specified exists in the
    * data store.
    */
   template <typename T> bool hasData(absl::string_view data_name) const {
-    return (hasDataWithName(data_name) &&
-            (dynamic_cast<const T*>(getDataReadOnlyGeneric(data_name)) != nullptr));
+    return getDataReadOnly<T>(data_name) != nullptr;
   }
 
   /**
@@ -159,9 +149,6 @@ class FilterState {
    * either the top LifeSpan or the parent is not yet created.
    */
   virtual FilterStateSharedPtr parent() const PURE;
-
-protected:
-  virtual Object* getDataMutableGeneric(absl::string_view data_name) PURE;
 };
 
 } // namespace StreamInfo
diff --git a/source/common/formatter/substitution_formatter.cc b/source/common/formatter/substitution_formatter.cc
index a02dad9d9bad..bda70ea22c3c 100644
--- a/source/common/formatter/substitution_formatter.cc
+++ b/source/common/formatter/substitution_formatter.cc
@@ -1490,10 +1490,7 @@ FilterStateFormatter::FilterStateFormatter(const std::string& key,
 const Envoy::StreamInfo::FilterState::Object*
 FilterStateFormatter::filterState(const StreamInfo::StreamInfo& stream_info) const {
   const StreamInfo::FilterState& filter_state = stream_info.filterState();
-  if (!filter_state.hasDataWithName(key_)) {
-    return nullptr;
-  }
-  return &filter_state.getDataReadOnly<StreamInfo::FilterState::Object>(key_);
+  return filter_state.getDataReadOnly<StreamInfo::FilterState::Object>(key_);
 }
 
 absl::optional<std::string> FilterStateFormatter::format(const Http::RequestHeaderMap&,
diff --git a/source/common/http/hash_policy.cc b/source/common/http/hash_policy.cc
index 40e7e2fbac4a..a12d5730a085 100644
--- a/source/common/http/hash_policy.cc
+++ b/source/common/http/hash_policy.cc
@@ -163,8 +163,8 @@ class FilterStateHashMethod : public HashMethodImplBase {
   evaluate(const Network::Address::Instance*, const RequestHeaderMap&,
            const HashPolicy::AddCookieCallback,
            const StreamInfo::FilterStateSharedPtr filter_state) const override {
-    if (filter_state->hasData<Hashable>(key_)) {
-      return filter_state->getDataReadOnly<Hashable>(key_).hash();
+    if (auto typed_state = filter_state->getDataReadOnly<Hashable>(key_); typed_state != nullptr) {
+      return typed_state->hash();
     }
     return absl::nullopt;
   }
diff --git a/source/common/network/hash_policy.cc b/source/common/network/hash_policy.cc
index 462487f96f93..b04219d92236 100644
--- a/source/common/network/hash_policy.cc
+++ b/source/common/network/hash_policy.cc
@@ -28,8 +28,8 @@ class FilterStateHashMethod : public HashPolicyImpl::HashMethod {
 
   absl::optional<uint64_t> evaluate(const Network::Connection& connection) const override {
     const auto& filter_state = connection.streamInfo().filterState();
-    if (filter_state.hasData<Hashable>(key_)) {
-      return filter_state.getDataReadOnly<Hashable>(key_).hash();
+    if (auto typed_state = filter_state.getDataReadOnly<Hashable>(key_); typed_state != nullptr) {
+      return typed_state->hash();
     }
     return absl::nullopt;
   }
diff --git a/source/common/network/transport_socket_options_impl.cc b/source/common/network/transport_socket_options_impl.cc
index 9990584c39fd..742495173f56 100644
--- a/source/common/network/transport_socket_options_impl.cc
+++ b/source/common/network/transport_socket_options_impl.cc
@@ -67,31 +67,30 @@ TransportSocketOptionsUtility::fromFilterState(const StreamInfo::FilterState& fi
   absl::optional<Network::ProxyProtocolData> proxy_protocol_options;
 
   bool needs_transport_socket_options = false;
-  if (filter_state.hasData<UpstreamServerName>(UpstreamServerName::key())) {
-    const auto& upstream_server_name =
-        filter_state.getDataReadOnly<UpstreamServerName>(UpstreamServerName::key());
-    server_name = upstream_server_name.value();
+  if (auto typed_data = filter_state.getDataReadOnly<UpstreamServerName>(UpstreamServerName::key());
+      typed_data != nullptr) {
+    server_name = typed_data->value();
     needs_transport_socket_options = true;
   }
 
-  if (filter_state.hasData<Network::ApplicationProtocols>(Network::ApplicationProtocols::key())) {
-    const auto& alpn = filter_state.getDataReadOnly<Network::ApplicationProtocols>(
-        Network::ApplicationProtocols::key());
-    application_protocols = alpn.value();
+  if (auto typed_data = filter_state.getDataReadOnly<Network::ApplicationProtocols>(
+          Network::ApplicationProtocols::key());
+      typed_data != nullptr) {
+    application_protocols = typed_data->value();
     needs_transport_socket_options = true;
   }
 
-  if (filter_state.hasData<UpstreamSubjectAltNames>(UpstreamSubjectAltNames::key())) {
-    const auto& upstream_subject_alt_names =
-        filter_state.getDataReadOnly<UpstreamSubjectAltNames>(UpstreamSubjectAltNames::key());
-    subject_alt_names = upstream_subject_alt_names.value();
+  if (auto typed_data =
+          filter_state.getDataReadOnly<UpstreamSubjectAltNames>(UpstreamSubjectAltNames::key());
+      typed_data != nullptr) {
+    subject_alt_names = typed_data->value();
     needs_transport_socket_options = true;
   }
 
-  if (filter_state.hasData<ProxyProtocolFilterState>(ProxyProtocolFilterState::key())) {
-    const auto& proxy_protocol_filter_state =
-        filter_state.getDataReadOnly<ProxyProtocolFilterState>(ProxyProtocolFilterState::key());
-    proxy_protocol_options.emplace(proxy_protocol_filter_state.value());
+  if (auto typed_data =
+          filter_state.getDataReadOnly<ProxyProtocolFilterState>(ProxyProtocolFilterState::key());
+      typed_data != nullptr) {
+    proxy_protocol_options.emplace(typed_data->value());
     needs_transport_socket_options = true;
   }
 
diff --git a/source/common/router/config_impl.cc b/source/common/router/config_impl.cc
index 83206ad2e7ce..664daa288312 100644
--- a/source/common/router/config_impl.cc
+++ b/source/common/router/config_impl.cc
@@ -676,11 +676,12 @@ void RouteEntryImplBase::finalizeRequestHeaders(Http::RequestHeaderMap& headers,
   // Restore the port if this was a CONNECT request.
   // Note this will restore the port for HTTP/2 CONNECT-upgrades as well as as HTTP/1.1 style
   // CONNECT requests.
-  if (stream_info.filterState().hasData<OriginalConnectPort>(OriginalConnectPort::key()) &&
-      Http::HeaderUtility::getPortStart(headers.getHostValue()) == absl::string_view::npos) {
-    const OriginalConnectPort& original_port =
-        stream_info.filterState().getDataReadOnly<OriginalConnectPort>(OriginalConnectPort::key());
-    headers.setHost(absl::StrCat(headers.getHostValue(), ":", original_port.value()));
+  if (Http::HeaderUtility::getPortStart(headers.getHostValue()) == absl::string_view::npos) {
+    if (auto typed_state = stream_info.filterState().getDataReadOnly<OriginalConnectPort>(
+            OriginalConnectPort::key());
+        typed_state != nullptr) {
+      headers.setHost(absl::StrCat(headers.getHostValue(), ":", typed_state->value()));
+    }
   }
 
   if (!host_rewrite_.empty()) {
diff --git a/source/common/router/header_formatter.cc b/source/common/router/header_formatter.cc
index 7959e17aebc4..2062cdc7956e 100644
--- a/source/common/router/header_formatter.cc
+++ b/source/common/router/header_formatter.cc
@@ -179,13 +179,10 @@ parsePerRequestStateField(absl::string_view param_str) {
   return [param](const Envoy::StreamInfo::StreamInfo& stream_info) -> std::string {
     const Envoy::StreamInfo::FilterState& filter_state = stream_info.filterState();
 
-    // No such value means don't output anything.
-    if (!filter_state.hasDataWithName(param)) {
-      return std::string();
-    }
+    auto typed_state = filter_state.getDataReadOnly<StringAccessor>(param);
 
     // Value exists but isn't string accessible is a contract violation; throw an error.
-    if (!filter_state.hasData<StringAccessor>(param)) {
+    if (typed_state == nullptr) {
       ENVOY_LOG_MISC(debug,
                      "Invalid header information: PER_REQUEST_STATE value \"{}\" "
                      "exists but is not string accessible",
@@ -193,7 +190,7 @@ parsePerRequestStateField(absl::string_view param_str) {
       return std::string();
     }
 
-    return std::string(filter_state.getDataReadOnly<StringAccessor>(param).asString());
+    return std::string(typed_state->asString());
   };
 }
 
diff --git a/source/common/router/router.cc b/source/common/router/router.cc
index 5a27b6d27283..678d71c198a4 100644
--- a/source/common/router/router.cc
+++ b/source/common/router/router.cc
@@ -385,10 +385,7 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
   // we should append cluster and host headers to the response, and whether to forward the request
   // upstream.
   const StreamInfo::FilterStateSharedPtr& filter_state = callbacks_->streamInfo().filterState();
-  const DebugConfig* debug_config =
-      filter_state->hasData<DebugConfig>(DebugConfig::key())
-          ? &(filter_state->getDataReadOnly<DebugConfig>(DebugConfig::key()))
-          : nullptr;
+  const DebugConfig* debug_config = filter_state->getDataReadOnly<DebugConfig>(DebugConfig::key());
 
   // TODO: Maybe add a filter API for this.
   grpc_request_ = Grpc::Common::isGrpcRequestHeaders(headers);
@@ -567,24 +564,18 @@ Http::FilterHeadersStatus Filter::decodeHeaders(Http::RequestHeaderMap& headers,
   transport_socket_options_ = Network::TransportSocketOptionsUtility::fromFilterState(
       *callbacks_->streamInfo().filterState());
 
-  auto has_options_from_downstream =
-      downstreamConnection() && downstreamConnection()
-                                    ->streamInfo()
-                                    .filterState()
-                                    .hasData<Network::UpstreamSocketOptionsFilterState>(
-                                        Network::UpstreamSocketOptionsFilterState::key());
-
-  if (has_options_from_downstream) {
-    auto downstream_options = downstreamConnection()
-                                  ->streamInfo()
-                                  .filterState()
-                                  .getDataReadOnly<Network::UpstreamSocketOptionsFilterState>(
-                                      Network::UpstreamSocketOptionsFilterState::key())
-                                  .value();
-    if (!upstream_options_) {
-      upstream_options_ = std::make_shared<Network::Socket::Options>();
+  if (auto downstream_connection = downstreamConnection(); downstream_connection != nullptr) {
+    if (auto typed_state = downstream_connection->streamInfo()
+                               .filterState()
+                               .getDataReadOnly<Network::UpstreamSocketOptionsFilterState>(
+                                   Network::UpstreamSocketOptionsFilterState::key());
+        typed_state != nullptr) {
+      auto downstream_options = typed_state->value();
+      if (!upstream_options_) {
+        upstream_options_ = std::make_shared<Network::Socket::Options>();
+      }
+      Network::Socket::appendOptions(upstream_options_, downstream_options);
     }
-    Network::Socket::appendOptions(upstream_options_, downstream_options);
   }
 
   if (upstream_options_ && callbacks_->getUpstreamSocketOptions()) {
@@ -1609,15 +1600,20 @@ bool Filter::convertRequestHeadersForInternalRedirect(Http::RequestHeaderMap& do
   const StreamInfo::FilterStateSharedPtr& filter_state = callbacks_->streamInfo().filterState();
   // Make sure that performing the redirect won't result in exceeding the configured number of
   // redirects allowed for this route.
-  if (!filter_state->hasData<StreamInfo::UInt32Accessor>(NumInternalRedirectsFilterStateName)) {
-    filter_state->setData(
-        NumInternalRedirectsFilterStateName, std::make_shared<StreamInfo::UInt32AccessorImpl>(0),
-        StreamInfo::FilterState::StateType::Mutable, StreamInfo::FilterState::LifeSpan::Request);
+  StreamInfo::UInt32Accessor* num_internal_redirect{};
+
+  if (num_internal_redirect = filter_state->getDataMutable<StreamInfo::UInt32Accessor>(
+          NumInternalRedirectsFilterStateName);
+      num_internal_redirect == nullptr) {
+    auto state = std::make_shared<StreamInfo::UInt32AccessorImpl>(0);
+    num_internal_redirect = state.get();
+
+    filter_state->setData(NumInternalRedirectsFilterStateName, std::move(state),
+                          StreamInfo::FilterState::StateType::Mutable,
+                          StreamInfo::FilterState::LifeSpan::Request);
   }
-  StreamInfo::UInt32Accessor& num_internal_redirect =
-      filter_state->getDataMutable<StreamInfo::UInt32Accessor>(NumInternalRedirectsFilterStateName);
 
-  if (num_internal_redirect.value() >= policy.maxInternalRedirects()) {
+  if (num_internal_redirect->value() >= policy.maxInternalRedirects()) {
     ENVOY_STREAM_LOG(trace, "Internal redirect failed: redirect limits exceeded.", *callbacks_);
     config_.stats_.passthrough_internal_redirect_too_many_redirects_.inc();
     return false;
@@ -1681,7 +1677,7 @@ bool Filter::convertRequestHeadersForInternalRedirect(Http::RequestHeaderMap& do
     callbacks_->modifyDecodingBuffer([](Buffer::Instance& data) { data.drain(data.length()); });
   }
 
-  num_internal_redirect.increment();
+  num_internal_redirect->increment();
   restore_original_headers.cancel();
   // Preserve the original request URL for the second pass.
   downstream_headers.setEnvoyOriginalUrl(absl::StrCat(scheme_is_http
diff --git a/source/common/stream_info/filter_state_impl.cc b/source/common/stream_info/filter_state_impl.cc
index d5a42eb75c18..626a1b5fd7e2 100644
--- a/source/common/stream_info/filter_state_impl.cc
+++ b/source/common/stream_info/filter_state_impl.cc
@@ -47,13 +47,13 @@ bool FilterStateImpl::hasDataWithName(absl::string_view data_name) const {
 
 const FilterState::Object*
 FilterStateImpl::getDataReadOnlyGeneric(absl::string_view data_name) const {
-  const auto& it = data_storage_.find(data_name);
+  const auto it = data_storage_.find(data_name);
 
   if (it == data_storage_.end()) {
     if (parent_) {
-      return &(parent_->getDataReadOnly<FilterState::Object>(data_name));
+      return parent_->getDataReadOnlyGeneric(data_name);
     }
-    throw EnvoyException("FilterState::getDataReadOnly<T> called for unknown data name.");
+    return nullptr;
   }
 
   const FilterStateImpl::FilterObject* current = it->second.get();
@@ -65,9 +65,9 @@ FilterState::Object* FilterStateImpl::getDataMutableGeneric(absl::string_view da
 
   if (it == data_storage_.end()) {
     if (parent_) {
-      return &(parent_->getDataMutable<FilterState::Object>(data_name));
+      return parent_->getDataMutableGeneric(data_name);
     }
-    throw EnvoyException("FilterState::getDataMutable<T> called for unknown data name.");
+    return nullptr;
   }
 
   FilterStateImpl::FilterObject* current = it->second.get();
diff --git a/source/common/tcp_proxy/tcp_proxy.cc b/source/common/tcp_proxy/tcp_proxy.cc
index 4ce38e576ea6..9c69aa08ecd1 100644
--- a/source/common/tcp_proxy/tcp_proxy.cc
+++ b/source/common/tcp_proxy/tcp_proxy.cc
@@ -132,13 +132,11 @@ Config::Config(const envoy::extensions::filters::network::tcp_proxy::v3::TcpProx
 
 RouteConstSharedPtr Config::getRegularRouteFromEntries(Network::Connection& connection) {
   // First check if the per-connection state to see if we need to route to a pre-selected cluster
-  if (connection.streamInfo().filterState()->hasData<PerConnectionCluster>(
-          PerConnectionCluster::key())) {
-    const PerConnectionCluster& per_connection_cluster =
-        connection.streamInfo().filterState()->getDataReadOnly<PerConnectionCluster>(
-            PerConnectionCluster::key());
-
-    return std::make_shared<const SimpleRouteImpl>(*this, per_connection_cluster.value());
+  if (const auto* per_connection_cluster =
+          connection.streamInfo().filterState()->getDataReadOnly<PerConnectionCluster>(
+              PerConnectionCluster::key());
+      per_connection_cluster != nullptr) {
+    return std::make_shared<const SimpleRouteImpl>(*this, per_connection_cluster->value());
   }
 
   if (default_route_ != nullptr) {
@@ -363,7 +361,7 @@ Network::FilterStatus Filter::initializeUpstreamConnection() {
     return Network::FilterStatus::StopIteration;
   }
 
-  if (downstreamConnection()) {
+  if (auto downstream_connection = downstreamConnection(); downstream_connection != nullptr) {
     if (!read_callbacks_->connection()
              .streamInfo()
              .filterState()
@@ -371,29 +369,24 @@ Network::FilterStatus Filter::initializeUpstreamConnection() {
                  Network::ProxyProtocolFilterState::key())) {
       read_callbacks_->connection().streamInfo().filterState()->setData(
           Network::ProxyProtocolFilterState::key(),
-          std::make_unique<Network::ProxyProtocolFilterState>(Network::ProxyProtocolData{
-              downstreamConnection()->connectionInfoProvider().remoteAddress(),
-              downstreamConnection()->connectionInfoProvider().localAddress()}),
+          std::make_shared<Network::ProxyProtocolFilterState>(Network::ProxyProtocolData{
+              downstream_connection->connectionInfoProvider().remoteAddress(),
+              downstream_connection->connectionInfoProvider().localAddress()}),
           StreamInfo::FilterState::StateType::ReadOnly,
           StreamInfo::FilterState::LifeSpan::Connection);
     }
     transport_socket_options_ = Network::TransportSocketOptionsUtility::fromFilterState(
-        downstreamConnection()->streamInfo().filterState());
-
-    auto has_options_from_downstream =
-        downstreamConnection() && downstreamConnection()
-                                      ->streamInfo()
-                                      .filterState()
-                                      .hasData<Network::UpstreamSocketOptionsFilterState>(
-                                          Network::UpstreamSocketOptionsFilterState::key());
-    if (has_options_from_downstream) {
-      auto downstream_options = downstreamConnection()
-                                    ->streamInfo()
-                                    .filterState()
-                                    .getDataReadOnly<Network::UpstreamSocketOptionsFilterState>(
-                                        Network::UpstreamSocketOptionsFilterState::key())
-                                    .value();
-      upstream_options_ = std::make_shared<Network::Socket::Options>();
+        downstream_connection->streamInfo().filterState());
+
+    if (auto typed_state = downstream_connection->streamInfo()
+                               .filterState()
+                               .getDataReadOnly<Network::UpstreamSocketOptionsFilterState>(
+                                   Network::UpstreamSocketOptionsFilterState::key());
+        typed_state != nullptr) {
+      auto downstream_options = typed_state->value();
+      if (!upstream_options_) {
+        upstream_options_ = std::make_shared<Network::Socket::Options>();
+      }
       Network::Socket::appendOptions(upstream_options_, downstream_options);
     }
   }
diff --git a/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc b/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc
index d381e06ca219..c0b1fbd93171 100644
--- a/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc
+++ b/source/extensions/access_loggers/grpc/grpc_access_log_utils.cc
@@ -278,10 +278,8 @@ void Utility::extractCommonAccessLogProperties(
   }
 
   for (const auto& key : config.filter_state_objects_to_log()) {
-    if (stream_info.filterState().hasDataWithName(key)) {
-      const auto& obj =
-          stream_info.filterState().getDataReadOnly<StreamInfo::FilterState::Object>(key);
-      ProtobufTypes::MessagePtr serialized_proto = obj.serializeAsProto();
+    if (auto state = stream_info.filterState().getDataReadOnlyGeneric(key); state != nullptr) {
+      ProtobufTypes::MessagePtr serialized_proto = state->serializeAsProto();
       if (serialized_proto != nullptr) {
         auto& filter_state_objects = *common_access_log.mutable_filter_state_objects();
         ProtobufWkt::Any& any = filter_state_objects[key];
diff --git a/source/extensions/common/wasm/context.cc b/source/extensions/common/wasm/context.cc
index fb22c6f0594c..6ab86eea3797 100644
--- a/source/extensions/common/wasm/context.cc
+++ b/source/extensions/common/wasm/context.cc
@@ -447,19 +447,18 @@ Context::findValue(absl::string_view name, Protobuf::Arena* arena, bool last) co
   if (part_token == property_tokens.end()) {
     if (info) {
       std::string key = absl::StrCat(CelStateKeyPrefix, name);
-      const CelState* state;
-      if (info->filterState().hasData<CelState>(key)) {
-        state = &info->filterState().getDataReadOnly<CelState>(key);
-      } else if (info->upstreamInfo().has_value() &&
-                 info->upstreamInfo().value().get().upstreamFilterState() &&
-                 info->upstreamInfo().value().get().upstreamFilterState()->hasData<CelState>(key)) {
-        state =
-            &info->upstreamInfo().value().get().upstreamFilterState()->getDataReadOnly<CelState>(
-                key);
-      } else {
-        return {};
+      const CelState* state = info->filterState().getDataReadOnly<CelState>(key);
+      if (state == nullptr) {
+        if (info->upstreamInfo().has_value() &&
+            info->upstreamInfo().value().get().upstreamFilterState() != nullptr) {
+          state =
+              info->upstreamInfo().value().get().upstreamFilterState()->getDataReadOnly<CelState>(
+                  key);
+        }
+      }
+      if (state != nullptr) {
+        return state->exprValue(arena, last);
       }
-      return state->exprValue(arena, last);
     }
     return {};
   }
@@ -1128,10 +1127,8 @@ WasmResult Context::setProperty(std::string_view path, std::string_view value) {
   }
   std::string key;
   absl::StrAppend(&key, CelStateKeyPrefix, toAbslStringView(path));
-  CelState* state;
-  if (stream_info->filterState()->hasData<CelState>(key)) {
-    state = &stream_info->filterState()->getDataMutable<CelState>(key);
-  } else {
+  CelState* state = stream_info->filterState()->getDataMutable<CelState>(key);
+  if (state == nullptr) {
     const auto& it = rootContext()->state_prototypes_.find(toAbslStringView(path));
     const CelStatePrototype& prototype =
         it == rootContext()->state_prototypes_.end()
diff --git a/source/extensions/filters/common/expr/context.cc b/source/extensions/filters/common/expr/context.cc
index b2c4ed14eae3..9c4f08faf773 100644
--- a/source/extensions/filters/common/expr/context.cc
+++ b/source/extensions/filters/common/expr/context.cc
@@ -276,8 +276,8 @@ absl::optional<CelValue> FilterStateWrapper::operator[](CelValue key) const {
     return {};
   }
   auto value = key.StringOrDie().value();
-  if (filter_state_.hasDataWithName(value)) {
-    const StreamInfo::FilterState::Object* object = filter_state_.getDataReadOnlyGeneric(value);
+  if (const StreamInfo::FilterState::Object* object = filter_state_.getDataReadOnlyGeneric(value);
+      object != nullptr) {
     const CelState* cel_state = dynamic_cast<const CelState*>(object);
     if (cel_state) {
       return cel_state->exprValue(arena_, false);
diff --git a/source/extensions/filters/common/rbac/matchers/upstream_ip_port.cc b/source/extensions/filters/common/rbac/matchers/upstream_ip_port.cc
index 11396b754fee..6ca70ac28a8a 100644
--- a/source/extensions/filters/common/rbac/matchers/upstream_ip_port.cc
+++ b/source/extensions/filters/common/rbac/matchers/upstream_ip_port.cc
@@ -33,8 +33,9 @@ UpstreamIpPortMatcher::UpstreamIpPortMatcher(
 bool UpstreamIpPortMatcher::matches(const Network::Connection&,
                                     const Envoy::Http::RequestHeaderMap&,
                                     const StreamInfo::StreamInfo& info) const {
-
-  if (!info.filterState().hasDataWithName(StreamInfo::UpstreamAddress::key())) {
+  auto address_obj = info.filterState().getDataReadOnly<StreamInfo::UpstreamAddress>(
+      StreamInfo::UpstreamAddress::key());
+  if (address_obj == nullptr) {
     ENVOY_LOG_EVERY_POW_2(
         warn,
         "Did not find filter state with key: {}. Do you have a filter in the filter chain "
@@ -44,12 +45,8 @@ bool UpstreamIpPortMatcher::matches(const Network::Connection&,
     return false;
   }
 
-  const StreamInfo::UpstreamAddress& address_obj =
-      info.filterState().getDataReadOnly<StreamInfo::UpstreamAddress>(
-          StreamInfo::UpstreamAddress::key());
-
   if (cidr_) {
-    if (cidr_->isInRange(*address_obj.address_)) {
+    if (cidr_->isInRange(*address_obj->address_)) {
       ENVOY_LOG(debug, "UpstreamIpPort matcher for cidr range: {} evaluated to: true",
                 cidr_->asString());
 
@@ -61,7 +58,7 @@ bool UpstreamIpPortMatcher::matches(const Network::Connection&,
   }
 
   if (port_) {
-    const auto port = address_obj.address_->ip()->port();
+    const auto port = address_obj->address_->ip()->port();
     if (port >= port_->start() && port <= port_->end()) {
       ENVOY_LOG(debug, "UpstreamIpPort matcher for port range: {{}, {}} evaluated to: true",
                 port_->start(), port_->end());
diff --git a/source/extensions/filters/http/compressor/compressor_filter.cc b/source/extensions/filters/http/compressor/compressor_filter.cc
index a5941c2e15d7..dcc9ea31de25 100644
--- a/source/extensions/filters/http/compressor/compressor_filter.cc
+++ b/source/extensions/filters/http/compressor/compressor_filter.cc
@@ -214,9 +214,8 @@ void CompressorFilter::setDecoderFilterCallbacks(Http::StreamDecoderFilterCallba
   // to be used for a request, with e.g. "Accept-Encoding: deflate;q=0.75, gzip;q=0.5", and caches
   // it in the state. All other compression filters in the sequence use the cached decision.
   const StreamInfo::FilterStateSharedPtr& filter_state = callbacks.streamInfo().filterState();
-  if (filter_state->hasData<CompressorRegistry>(key)) {
-    CompressorRegistry& registry = filter_state->getDataMutable<CompressorRegistry>(key);
-    registry.filter_configs_.push_back(config_);
+  if (auto registry = filter_state->getDataMutable<CompressorRegistry>(key); registry != nullptr) {
+    registry->filter_configs_.push_back(config_);
   } else {
     auto registry_ptr = std::make_unique<CompressorRegistry>();
     registry_ptr->filter_configs_.push_back(config_);
@@ -309,11 +308,13 @@ CompressorFilter::chooseEncoding(const Http::ResponseHeaderMap& headers) const {
   // Find all compressors enabled for the filter chain.
   std::map<std::string, uint32_t> allowed_compressors;
   uint32_t registration_count{0};
-  for (const auto& filter_config :
-       decoder_callbacks_->streamInfo()
-           .filterState()
-           ->getDataReadOnly<CompressorRegistry>(compressorRegistryKey())
-           .filter_configs_) {
+
+  auto typed_state =
+      decoder_callbacks_->streamInfo().filterState()->getDataReadOnly<CompressorRegistry>(
+          compressorRegistryKey());
+  ASSERT(typed_state != nullptr);
+
+  for (const auto& filter_config : (*typed_state).filter_configs_) {
     // A compressor filter may be limited to compress certain Content-Types. If the response's
     // content type doesn't match the list of content types this filter is enabled for then
     // it must be excluded from the decision process.
@@ -464,10 +465,10 @@ bool CompressorFilter::isAcceptEncodingAllowed(const Http::ResponseHeaderMap& he
   // Check if we have already cached our decision on encoding.
   const StreamInfo::FilterStateSharedPtr& filter_state =
       decoder_callbacks_->streamInfo().filterState();
-  if (filter_state->hasData<CompressorFilter::EncodingDecision>(encoding_decision_key)) {
-    const CompressorFilter::EncodingDecision& decision =
-        filter_state->getDataReadOnly<CompressorFilter::EncodingDecision>(encoding_decision_key);
-    return shouldCompress(decision);
+  if (auto typed_state =
+          filter_state->getDataReadOnly<CompressorFilter::EncodingDecision>(encoding_decision_key);
+      typed_state != nullptr) {
+    return shouldCompress(*typed_state);
   }
 
   // No cached decision found, so decide now.
diff --git a/source/extensions/filters/http/jwt_authn/filter_config.h b/source/extensions/filters/http/jwt_authn/filter_config.h
index b2508e4aa704..ea1af8389115 100644
--- a/source/extensions/filters/http/jwt_authn/filter_config.h
+++ b/source/extensions/filters/http/jwt_authn/filter_config.h
@@ -88,13 +88,14 @@ class FilterConfigImpl : public Logger::Loggable<Logger::Id::jwt>,
         return pair.verifier_.get();
       }
     }
-    if (!filter_state_name_.empty() && !filter_state_verifiers_.empty() &&
-        filter_state.hasData<Router::StringAccessor>(filter_state_name_)) {
-      const auto& state = filter_state.getDataReadOnly<Router::StringAccessor>(filter_state_name_);
-      ENVOY_LOG(debug, "use filter state value {} to find verifier.", state.asString());
-      const auto& it = filter_state_verifiers_.find(state.asString());
-      if (it != filter_state_verifiers_.end()) {
-        return it->second.get();
+    if (!filter_state_name_.empty() && !filter_state_verifiers_.empty()) {
+      if (auto state = filter_state.getDataReadOnly<Router::StringAccessor>(filter_state_name_);
+          state != nullptr) {
+        ENVOY_LOG(debug, "use filter state value {} to find verifier.", state->asString());
+        const auto& it = filter_state_verifiers_.find(state->asString());
+        if (it != filter_state_verifiers_.end()) {
+          return it->second.get();
+        }
       }
     }
     return nullptr;
diff --git a/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc b/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc
index b216b15075af..5dc4a1c3286a 100644
--- a/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc
+++ b/source/extensions/filters/http/local_ratelimit/local_ratelimit.cc
@@ -1,5 +1,6 @@
 #include "source/extensions/filters/http/local_ratelimit/local_ratelimit.h"
 
+#include <memory>
 #include <string>
 #include <vector>
 
@@ -126,21 +127,22 @@ const Filters::Common::LocalRateLimit::LocalRateLimiterImpl& Filter::getPerConne
   const auto* config = getConfig();
   ASSERT(config->rateLimitPerConnection());
 
-  if (!decoder_callbacks_->streamInfo().filterState()->hasData<PerConnectionRateLimiter>(
-          PerConnectionRateLimiter::key())) {
+  auto typed_state =
+      decoder_callbacks_->streamInfo().filterState()->getDataReadOnly<PerConnectionRateLimiter>(
+          PerConnectionRateLimiter::key());
+
+  if (typed_state == nullptr) {
+    auto limiter = std::make_shared<PerConnectionRateLimiter>(
+        config->fillInterval(), config->maxTokens(), config->tokensPerFill(),
+        decoder_callbacks_->dispatcher(), config->descriptors());
+
     decoder_callbacks_->streamInfo().filterState()->setData(
-        PerConnectionRateLimiter::key(),
-        std::make_unique<PerConnectionRateLimiter>(
-            config->fillInterval(), config->maxTokens(), config->tokensPerFill(),
-            decoder_callbacks_->dispatcher(), config->descriptors()),
-        StreamInfo::FilterState::StateType::ReadOnly,
+        PerConnectionRateLimiter::key(), limiter, StreamInfo::FilterState::StateType::ReadOnly,
         StreamInfo::FilterState::LifeSpan::Connection);
+    return limiter->value();
   }
 
-  return decoder_callbacks_->streamInfo()
-      .filterState()
-      ->getDataReadOnly<PerConnectionRateLimiter>(PerConnectionRateLimiter::key())
-      .value();
+  return typed_state->value();
 }
 
 void Filter::populateDescriptors(std::vector<RateLimit::LocalDescriptor>& descriptors,
diff --git a/source/extensions/filters/listener/original_dst/original_dst.cc b/source/extensions/filters/listener/original_dst/original_dst.cc
index 9364b55c7976..c20dddf726ad 100644
--- a/source/extensions/filters/listener/original_dst/original_dst.cc
+++ b/source/extensions/filters/listener/original_dst/original_dst.cc
@@ -58,7 +58,7 @@ Network::FilterStatus OriginalDstFilter::onAccept(Network::ListenerFilterCallbac
           filter_state
               .getDataMutable<Network::UpstreamSocketOptionsFilterState>(
                   Network::UpstreamSocketOptionsFilterState::key())
-              .addOption(
+              ->addOption(
                   Network::SocketOptionFactory::buildWFPRedirectRecordsOptions(*redirect_records));
         }
       }
diff --git a/source/extensions/internal_redirect/previous_routes/previous_routes.cc b/source/extensions/internal_redirect/previous_routes/previous_routes.cc
index 5194255b5d49..a85031ffbb41 100644
--- a/source/extensions/internal_redirect/previous_routes/previous_routes.cc
+++ b/source/extensions/internal_redirect/previous_routes/previous_routes.cc
@@ -42,9 +42,9 @@ bool PreviousRoutesPredicate::acceptTargetRoute(StreamInfo::FilterState& filter_
                          StreamInfo::FilterState::StateType::Mutable,
                          StreamInfo::FilterState::LifeSpan::Request);
   }
-  auto& predicate_state =
+  auto predicate_state =
       filter_state.getDataMutable<PreviousRoutesPredicateState>(filter_state_name);
-  return predicate_state.insertRouteIfNotPresent(route_name);
+  return predicate_state->insertRouteIfNotPresent(route_name);
 }
 
 } // namespace InternalRedirect
diff --git a/test/common/router/header_formatter_test.cc b/test/common/router/header_formatter_test.cc
index e9d0db7f7ab0..da215e945c76 100644
--- a/test/common/router/header_formatter_test.cc
+++ b/test/common/router/header_formatter_test.cc
@@ -820,7 +820,7 @@ TEST_F(StreamInfoHeaderFormatterTest, TestFormatWithPerRequestStateVariable) {
   filter_state->setData("testing", std::make_unique<StringAccessorImpl>("test_value"),
                         StreamInfo::FilterState::StateType::ReadOnly,
                         StreamInfo::FilterState::LifeSpan::FilterChain);
-  EXPECT_EQ("test_value", filter_state->getDataReadOnly<StringAccessor>("testing").asString());
+  EXPECT_EQ("test_value", filter_state->getDataReadOnly<StringAccessor>("testing")->asString());
 
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
   ON_CALL(stream_info, filterState()).WillByDefault(ReturnRef(filter_state));
@@ -828,7 +828,7 @@ TEST_F(StreamInfoHeaderFormatterTest, TestFormatWithPerRequestStateVariable) {
 
   testFormatting(stream_info, "PER_REQUEST_STATE(testing)", "test_value");
   testFormatting(stream_info, "PER_REQUEST_STATE(testing2)", "");
-  EXPECT_EQ("test_value", filter_state->getDataReadOnly<StringAccessor>("testing").asString());
+  EXPECT_EQ("test_value", filter_state->getDataReadOnly<StringAccessor>("testing")->asString());
 }
 
 TEST_F(StreamInfoHeaderFormatterTest, TestFormatWithNonStringPerRequestStateVariable) {
@@ -838,7 +838,7 @@ TEST_F(StreamInfoHeaderFormatterTest, TestFormatWithNonStringPerRequestStateVari
   filter_state->setData("testing", std::make_unique<StreamInfo::TestIntAccessor>(1),
                         StreamInfo::FilterState::StateType::ReadOnly,
                         StreamInfo::FilterState::LifeSpan::FilterChain);
-  EXPECT_EQ(1, filter_state->getDataReadOnly<StreamInfo::TestIntAccessor>("testing").access());
+  EXPECT_EQ(1, filter_state->getDataReadOnly<StreamInfo::TestIntAccessor>("testing")->access());
 
   NiceMock<Envoy::StreamInfo::MockStreamInfo> stream_info;
   ON_CALL(stream_info, filterState()).WillByDefault(ReturnRef(filter_state));
diff --git a/test/common/router/router_test.cc b/test/common/router/router_test.cc
index f1e89ee69f3b..d4e90d63e9d7 100644
--- a/test/common/router/router_test.cc
+++ b/test/common/router/router_test.cc
@@ -178,12 +178,12 @@ class RouterTest : public RouterTestBase {
     EXPECT_EQ(server_name,
               stream_info.filterState()
                   ->getDataReadOnly<Network::UpstreamServerName>(Network::UpstreamServerName::key())
-                  .value());
+                  ->value());
     if (should_validate_san) {
       EXPECT_EQ(alt_server_name, stream_info.filterState()
                                      ->getDataReadOnly<Network::UpstreamSubjectAltNames>(
                                          Network::UpstreamSubjectAltNames::key())
-                                     .value()[0]);
+                                     ->value()[0]);
     }
     EXPECT_CALL(cancellable_, cancel(_));
     router_.onDestroy();
@@ -4568,7 +4568,7 @@ TEST_F(RouterTest, InternalRedirectAcceptedWithRequestBody) {
   EXPECT_EQ(1, callbacks_.streamInfo()
                    .filterState()
                    ->getDataMutable<StreamInfo::UInt32Accessor>("num_internal_redirects")
-                   .value());
+                   ->value());
 }
 
 TEST_F(RouterTest, CrossSchemeRedirectRejectedByPolicy) {
@@ -4631,7 +4631,7 @@ TEST_F(RouterTest, HttpInternalRedirectSucceeded) {
   EXPECT_EQ(3, callbacks_.streamInfo()
                    .filterState()
                    ->getDataMutable<StreamInfo::UInt32Accessor>("num_internal_redirects")
-                   .value());
+                   ->value());
 }
 
 TEST_F(RouterTest, InternalRedirectStripsFragment) {
@@ -6008,7 +6008,7 @@ TEST_F(RouterTest, RedirectRecords) {
   router_.downstream_connection_.stream_info_.filterState()
       ->getDataMutable<Network::UpstreamSocketOptionsFilterState>(
           Network::UpstreamSocketOptionsFilterState::key())
-      .addOption(Network::SocketOptionFactory::buildWFPRedirectRecordsOptions(*redirect_records));
+      ->addOption(Network::SocketOptionFactory::buildWFPRedirectRecordsOptions(*redirect_records));
   Http::TestRequestHeaderMapImpl headers;
   HttpTestUtility::addDefaultHeaders(headers);
   headers.setMethod("CONNECT");
diff --git a/test/common/stream_info/filter_state_impl_test.cc b/test/common/stream_info/filter_state_impl_test.cc
index f9e6a538d8e5..8e450c14ee2d 100644
--- a/test/common/stream_info/filter_state_impl_test.cc
+++ b/test/common/stream_info/filter_state_impl_test.cc
@@ -68,7 +68,7 @@ TEST_F(FilterStateImplTest, Simple) {
   EXPECT_EQ(0u, access_count);
   EXPECT_EQ(0u, destruction_count);
 
-  EXPECT_EQ(5, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_name").access());
+  EXPECT_EQ(5, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_name")->access());
   EXPECT_EQ(1u, access_count);
   EXPECT_EQ(0u, destruction_count);
 
@@ -96,10 +96,10 @@ TEST_F(FilterStateImplTest, SameTypes) {
   EXPECT_EQ(0u, access_count_2);
   EXPECT_EQ(0u, destruction_count);
 
-  EXPECT_EQ(ValueOne, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_1").access());
+  EXPECT_EQ(ValueOne, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_1")->access());
   EXPECT_EQ(1u, access_count_1);
   EXPECT_EQ(0u, access_count_2);
-  EXPECT_EQ(ValueTwo, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_2").access());
+  EXPECT_EQ(ValueTwo, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_2")->access());
   EXPECT_EQ(1u, access_count_1);
   EXPECT_EQ(1u, access_count_2);
   resetFilterState();
@@ -112,8 +112,8 @@ TEST_F(FilterStateImplTest, SimpleTypeReadOnly) {
   filter_state().setData("test_2", std::make_unique<SimpleType>(2),
                          FilterState::StateType::ReadOnly, FilterState::LifeSpan::FilterChain);
 
-  EXPECT_EQ(1, filter_state().getDataReadOnly<SimpleType>("test_1").access());
-  EXPECT_EQ(2, filter_state().getDataReadOnly<SimpleType>("test_2").access());
+  EXPECT_EQ(1, filter_state().getDataReadOnly<SimpleType>("test_1")->access());
+  EXPECT_EQ(2, filter_state().getDataReadOnly<SimpleType>("test_2")->access());
 }
 
 TEST_F(FilterStateImplTest, SimpleTypeMutable) {
@@ -122,13 +122,13 @@ TEST_F(FilterStateImplTest, SimpleTypeMutable) {
   filter_state().setData("test_2", std::make_unique<SimpleType>(2), FilterState::StateType::Mutable,
                          FilterState::LifeSpan::FilterChain);
 
-  EXPECT_EQ(1, filter_state().getDataReadOnly<SimpleType>("test_1").access());
-  EXPECT_EQ(2, filter_state().getDataReadOnly<SimpleType>("test_2").access());
+  EXPECT_EQ(1, filter_state().getDataReadOnly<SimpleType>("test_1")->access());
+  EXPECT_EQ(2, filter_state().getDataReadOnly<SimpleType>("test_2")->access());
 
-  filter_state().getDataMutable<SimpleType>("test_1").set(100);
-  filter_state().getDataMutable<SimpleType>("test_2").set(200);
-  EXPECT_EQ(100, filter_state().getDataReadOnly<SimpleType>("test_1").access());
-  EXPECT_EQ(200, filter_state().getDataReadOnly<SimpleType>("test_2").access());
+  filter_state().getDataMutable<SimpleType>("test_1")->set(100);
+  filter_state().getDataMutable<SimpleType>("test_2")->set(200);
+  EXPECT_EQ(100, filter_state().getDataReadOnly<SimpleType>("test_1")->access());
+  EXPECT_EQ(200, filter_state().getDataReadOnly<SimpleType>("test_2")->access());
 }
 
 TEST_F(FilterStateImplTest, NameConflictReadOnly) {
@@ -143,7 +143,7 @@ TEST_F(FilterStateImplTest, NameConflictReadOnly) {
       filter_state().setData("test_1", std::make_unique<SimpleType>(2),
                              FilterState::StateType::Mutable, FilterState::LifeSpan::FilterChain),
       EnvoyException, "FilterState::setData<T> called twice on same ReadOnly state.");
-  EXPECT_EQ(1, filter_state().getDataReadOnly<SimpleType>("test_1").access());
+  EXPECT_EQ(1, filter_state().getDataReadOnly<SimpleType>("test_1")->access());
 }
 
 TEST_F(FilterStateImplTest, NameConflictDifferentTypesReadOnly) {
@@ -174,29 +174,26 @@ TEST_F(FilterStateImplTest, NoNameConflictMutableAndMutable) {
                          FilterState::LifeSpan::FilterChain);
   filter_state().setData("test_2", std::make_unique<SimpleType>(4), FilterState::StateType::Mutable,
                          FilterState::LifeSpan::FilterChain);
-  EXPECT_EQ(4, filter_state().getDataMutable<SimpleType>("test_2").access());
+  EXPECT_EQ(4, filter_state().getDataMutable<SimpleType>("test_2")->access());
 
   // mutable + mutable - different types
   filter_state().setData("test_4", std::make_unique<SimpleType>(7), FilterState::StateType::Mutable,
                          FilterState::LifeSpan::FilterChain);
   filter_state().setData("test_4", std::make_unique<TestStoredTypeTracking>(8, nullptr, nullptr),
                          FilterState::StateType::Mutable, FilterState::LifeSpan::FilterChain);
-  EXPECT_EQ(8, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_4").access());
+  EXPECT_EQ(8, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_4")->access());
 }
 
 TEST_F(FilterStateImplTest, UnknownName) {
-  EXPECT_THROW_WITH_MESSAGE(filter_state().getDataReadOnly<SimpleType>("test_1"), EnvoyException,
-                            "FilterState::getDataReadOnly<T> called for unknown data name.");
-  EXPECT_THROW_WITH_MESSAGE(filter_state().getDataMutable<SimpleType>("test_1"), EnvoyException,
-                            "FilterState::getDataMutable<T> called for unknown data name.");
+  EXPECT_EQ(nullptr, filter_state().getDataReadOnly<SimpleType>("test_1"));
+  EXPECT_EQ(nullptr, filter_state().getDataMutable<SimpleType>("test_1"));
 }
 
 TEST_F(FilterStateImplTest, WrongTypeGet) {
   filter_state().setData("test_name", std::make_unique<TestStoredTypeTracking>(5, nullptr, nullptr),
                          FilterState::StateType::ReadOnly, FilterState::LifeSpan::FilterChain);
-  EXPECT_EQ(5, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_name").access());
-  EXPECT_THROW_WITH_MESSAGE(filter_state().getDataReadOnly<SimpleType>("test_name"), EnvoyException,
-                            "Data stored under test_name cannot be coerced to specified type");
+  EXPECT_EQ(5, filter_state().getDataReadOnly<TestStoredTypeTracking>("test_name")->access());
+  EXPECT_EQ(nullptr, filter_state().getDataReadOnly<SimpleType>("test_name"));
 }
 
 TEST_F(FilterStateImplTest, ErrorAccessingReadOnlyAsMutable) {
@@ -267,11 +264,14 @@ TEST_F(FilterStateImplTest, LifeSpanInitFromParent) {
   EXPECT_THROW_WITH_MESSAGE(
       new_filter_state.getDataMutable<SimpleType>("test_3"), EnvoyException,
       "FilterState::getDataMutable<T> tried to access immutable data as mutable.");
-  EXPECT_EQ(4, new_filter_state.getDataMutable<SimpleType>("test_4").access());
+
+  EXPECT_EQ(4, new_filter_state.getDataMutable<SimpleType>("test_4")->access());
+
   EXPECT_THROW_WITH_MESSAGE(
       new_filter_state.getDataMutable<SimpleType>("test_5"), EnvoyException,
       "FilterState::getDataMutable<T> tried to access immutable data as mutable.");
-  EXPECT_EQ(6, new_filter_state.getDataMutable<SimpleType>("test_6").access());
+
+  EXPECT_EQ(6, new_filter_state.getDataMutable<SimpleType>("test_6")->access());
 }
 
 TEST_F(FilterStateImplTest, LifeSpanInitFromGrandparent) {
@@ -299,7 +299,7 @@ TEST_F(FilterStateImplTest, LifeSpanInitFromGrandparent) {
   EXPECT_THROW_WITH_MESSAGE(
       new_filter_state.getDataMutable<SimpleType>("test_5"), EnvoyException,
       "FilterState::getDataMutable<T> tried to access immutable data as mutable.");
-  EXPECT_EQ(6, new_filter_state.getDataMutable<SimpleType>("test_6").access());
+  EXPECT_EQ(6, new_filter_state.getDataMutable<SimpleType>("test_6")->access());
 }
 
 TEST_F(FilterStateImplTest, LifeSpanInitFromNonParent) {
@@ -363,7 +363,7 @@ TEST_F(FilterStateImplTest, SetSameDataWithDifferentLifeSpan) {
   // Still mutable on the correct LifeSpan.
   filter_state().setData("test_1", std::make_unique<SimpleType>(2), FilterState::StateType::Mutable,
                          FilterState::LifeSpan::Connection);
-  EXPECT_EQ(2, filter_state().getDataMutable<SimpleType>("test_1").access());
+  EXPECT_EQ(2, filter_state().getDataMutable<SimpleType>("test_1")->access());
 
   filter_state().setData("test_2", std::make_unique<SimpleType>(1), FilterState::StateType::Mutable,
                          FilterState::LifeSpan::Request);
@@ -382,7 +382,7 @@ TEST_F(FilterStateImplTest, SetSameDataWithDifferentLifeSpan) {
   // Still mutable on the correct LifeSpan.
   filter_state().setData("test_2", std::make_unique<SimpleType>(2), FilterState::StateType::Mutable,
                          FilterState::LifeSpan::Request);
-  EXPECT_EQ(2, filter_state().getDataMutable<SimpleType>("test_2").access());
+  EXPECT_EQ(2, filter_state().getDataMutable<SimpleType>("test_2")->access());
 }
 
 } // namespace StreamInfo
diff --git a/test/common/stream_info/stream_info_impl_test.cc b/test/common/stream_info/stream_info_impl_test.cc
index bc4b728d63bd..419c9e9d9b2a 100644
--- a/test/common/stream_info/stream_info_impl_test.cc
+++ b/test/common/stream_info/stream_info_impl_test.cc
@@ -181,13 +181,13 @@ TEST_F(StreamInfoImplTest, MiscSettersAndGetters) {
     stream_info.filterState()->setData("test", std::make_unique<TestIntAccessor>(1),
                                        FilterState::StateType::ReadOnly,
                                        FilterState::LifeSpan::FilterChain);
-    EXPECT_EQ(1, stream_info.filterState()->getDataReadOnly<TestIntAccessor>("test").access());
+    EXPECT_EQ(1, stream_info.filterState()->getDataReadOnly<TestIntAccessor>("test")->access());
 
     stream_info.upstreamInfo()->setUpstreamFilterState(stream_info.filterState());
     EXPECT_EQ(1, stream_info.upstreamInfo()
                      ->upstreamFilterState()
                      ->getDataReadOnly<TestIntAccessor>("test")
-                     .access());
+                     ->access());
 
     EXPECT_EQ(absl::nullopt, stream_info.upstreamClusterInfo());
     Upstream::ClusterInfoConstSharedPtr cluster_info(new NiceMock<Upstream::MockClusterInfo>());
diff --git a/test/common/tcp_proxy/tcp_proxy_test.cc b/test/common/tcp_proxy/tcp_proxy_test.cc
index ffb154a72195..4275ebc1cd60 100644
--- a/test/common/tcp_proxy/tcp_proxy_test.cc
+++ b/test/common/tcp_proxy/tcp_proxy_test.cc
@@ -116,7 +116,7 @@ class TcpProxyTest : public TcpProxyTestBase {
             .filterState()
             ->getDataMutable<Network::UpstreamSocketOptionsFilterState>(
                 Network::UpstreamSocketOptionsFilterState::key())
-            .addOption(
+            ->addOption(
                 Network::SocketOptionFactory::buildWFPRedirectRecordsOptions(*redirect_records));
       }
       filter_ = std::make_unique<Filter>(config_, factory_context_.cluster_manager_);
@@ -1072,7 +1072,7 @@ TEST_F(TcpProxyTest, ShareFilterState) {
                 .upstreamInfo()
                 ->upstreamFilterState()
                 ->getDataReadOnly<PerConnectionCluster>("envoy.tcp_proxy.cluster")
-                .value());
+                ->value());
 }
 
 // Tests that filter callback can access downstream and upstream address and ssl properties.
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
index fb292b1fddf3..9610ba8a6c78 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
+++ b/test/extensions/filters/http/dynamic_forward_proxy/proxy_filter_test.cc
@@ -478,13 +478,13 @@ TEST_F(UpstreamResolvedHostFilterStateHelper, UpdateResolvedHostFilterStateMetad
   EXPECT_TRUE(
       callbacks_.streamInfo().downstreamTiming().getValue(ProxyFilter::DNS_END).has_value());
 
-  const StreamInfo::UpstreamAddress& updated_address_obj =
+  const StreamInfo::UpstreamAddress* updated_address_obj =
       filter_state->getDataReadOnly<StreamInfo::UpstreamAddress>(
           StreamInfo::UpstreamAddress::key());
 
   // Verify the data
-  EXPECT_TRUE(updated_address_obj.address_);
-  EXPECT_EQ(updated_address_obj.address_->asStringView(), host_info->address_->asStringView());
+  EXPECT_TRUE(updated_address_obj->address_);
+  EXPECT_EQ(updated_address_obj->address_->asStringView(), host_info->address_->asStringView());
 
   filter_->onDestroy();
 }
diff --git a/test/extensions/filters/http/grpc_stats/config_test.cc b/test/extensions/filters/http/grpc_stats/config_test.cc
index 959a05c076cb..b9d59e371152 100644
--- a/test/extensions/filters/http/grpc_stats/config_test.cc
+++ b/test/extensions/filters/http/grpc_stats/config_test.cc
@@ -364,10 +364,10 @@ TEST_F(GrpcStatsFilterConfigTest, MessageCounts) {
   EXPECT_TRUE(stats_store_.findCounterByString(
       "grpc.lyft.users.BadCompanions.GetBadCompanions.request_message_count"));
 
-  const auto& data =
+  const auto* data =
       stream_info_.filterState()->getDataReadOnly<GrpcStatsObject>("envoy.filters.http.grpc_stats");
-  EXPECT_EQ(2U, data.request_message_count);
-  EXPECT_EQ(0U, data.response_message_count);
+  EXPECT_EQ(2U, data->request_message_count);
+  EXPECT_EQ(0U, data->response_message_count);
 
   Http::TestResponseHeaderMapImpl response_headers{{"content-type", "application/grpc+proto"},
                                                    {":status", "200"}};
@@ -387,8 +387,8 @@ TEST_F(GrpcStatsFilterConfigTest, MessageCounts) {
                     .counterFromString(
                         "grpc.lyft.users.BadCompanions.GetBadCompanions.response_message_count")
                     .value());
-  EXPECT_EQ(2U, data.request_message_count);
-  EXPECT_EQ(2U, data.response_message_count);
+  EXPECT_EQ(2U, data->request_message_count);
+  EXPECT_EQ(2U, data->response_message_count);
 
   EXPECT_EQ(Http::FilterDataStatus::Continue, filter_->encodeData(*b1, true));
   EXPECT_EQ(2U, decoder_callbacks_.clusterInfo()
@@ -401,15 +401,15 @@ TEST_F(GrpcStatsFilterConfigTest, MessageCounts) {
                     .counterFromString(
                         "grpc.lyft.users.BadCompanions.GetBadCompanions.response_message_count")
                     .value());
-  EXPECT_EQ(2U, data.request_message_count);
-  EXPECT_EQ(3U, data.response_message_count);
+  EXPECT_EQ(2U, data->request_message_count);
+  EXPECT_EQ(3U, data->response_message_count);
 
   auto filter_object =
       *dynamic_cast<envoy::extensions::filters::http::grpc_stats::v3::FilterObject*>(
-          data.serializeAsProto().get());
+          data->serializeAsProto().get());
   EXPECT_EQ(2U, filter_object.request_message_count());
   EXPECT_EQ(3U, filter_object.response_message_count());
-  EXPECT_EQ("2,3", data.serializeAsString().value());
+  EXPECT_EQ("2,3", data->serializeAsString().value());
 }
 
 TEST_F(GrpcStatsFilterConfigTest, UpstreamStats) {
diff --git a/test/extensions/filters/http/wasm/wasm_filter_test.cc b/test/extensions/filters/http/wasm/wasm_filter_test.cc
index 8f3f18ba422a..b6652a14964d 100644
--- a/test/extensions/filters/http/wasm/wasm_filter_test.cc
+++ b/test/extensions/filters/http/wasm/wasm_filter_test.cc
@@ -1715,10 +1715,10 @@ TEST_P(WasmHttpFilterTest, Metadata) {
   StreamInfo::MockStreamInfo log_stream_info;
   filter().log(&request_headers, nullptr, nullptr, log_stream_info);
 
-  const auto& result =
+  const auto* result =
       request_stream_info_.filterState()->getDataReadOnly<Filters::Common::Expr::CelState>(
           "wasm.wasm_request_set_key");
-  EXPECT_EQ("wasm_request_set_value", result.value());
+  EXPECT_EQ("wasm_request_set_value", result->value());
 
   filter().onDestroy();
   filter().onDestroy(); // Does nothing.
diff --git a/test/extensions/filters/network/sni_cluster/sni_cluster_test.cc b/test/extensions/filters/network/sni_cluster/sni_cluster_test.cc
index 198bdee67959..a129a04a7ee0 100644
--- a/test/extensions/filters/network/sni_cluster/sni_cluster_test.cc
+++ b/test/extensions/filters/network/sni_cluster/sni_cluster_test.cc
@@ -64,7 +64,7 @@ TEST(SniCluster, SetTcpProxyClusterOnlyIfSniIsPresent) {
     auto per_connection_cluster =
         stream_info.filterState()->getDataReadOnly<TcpProxy::PerConnectionCluster>(
             TcpProxy::PerConnectionCluster::key());
-    EXPECT_EQ(per_connection_cluster.value(), "filter_state_cluster");
+    EXPECT_EQ(per_connection_cluster->value(), "filter_state_cluster");
   }
 }
 
diff --git a/test/per_file_coverage.sh b/test/per_file_coverage.sh
index 2afa38cf6c40..a0da13441a35 100755
--- a/test/per_file_coverage.sh
+++ b/test/per_file_coverage.sh
@@ -32,7 +32,7 @@ declare -a KNOWN_LOW_COVERAGE=(
 "source/exe:92.6"
 "source/extensions/common:95.8"
 "source/extensions/common/tap:94.2"
-"source/extensions/common/wasm:95.2" # flaky: be careful adjusting
+"source/extensions/common/wasm:95.1" # flaky: be careful adjusting
 "source/extensions/common/wasm/ext:92.0"
 "source/extensions/filters/common:96.1"
 "source/extensions/filters/common/expr:96.2"