diff --git a/api/getambassador.io/v2/Host.proto b/api/getambassador.io/v2/Host.proto
index c753cd0414..65e35548c6 100644
--- a/api/getambassador.io/v2/Host.proto
+++ b/api/getambassador.io/v2/Host.proto
@@ -64,7 +64,7 @@ message HostSpec {
   // Only one of `tlsConfig` or `tls` can be specified
   oneof tlsConfig {
     // Name of the TLSContext the Host resource is linked with
-    string tlsContext = 9;
+    k8s.io.api.core.v1.LocalObjectReference tlsContext = 9;
 
     // TLS config
     TLSConfig tls = 10;
diff --git a/docs/topics/running/tls/index.md b/docs/topics/running/tls/index.md
index f954e3b35c..1104195f11 100644
--- a/docs/topics/running/tls/index.md
+++ b/docs/topics/running/tls/index.md
@@ -135,7 +135,8 @@ spec:
     authority: none
   tlsSecret:
     name: min-secret
-  tlsContext: min-tls-context
+  tlsContext:
+    name: min-tls-context
 ```
 
 **Note**: Any `hosts` or `secret` in the `TLSContext` must be the compatible with the `Host` to which it is
diff --git a/python/ambassador/ir/irhost.py b/python/ambassador/ir/irhost.py
index d4049ca563..06e74423d5 100644
--- a/python/ambassador/ir/irhost.py
+++ b/python/ambassador/ir/irhost.py
@@ -70,7 +70,8 @@ def setup(self, ir: 'IR', aconf: Config) -> bool:
                     implicit_tls_exists = ir.has_tls_context(ctx_name)
                     self.logger.debug(f"TLSContext with name {ctx_name} exists in the cluster?: {implicit_tls_exists}")
 
-                    host_tls_context_name = self.get('tlsContext', None)
+                    host_tls_context_obj = self.get('tlsContext', {})
+                    host_tls_context_name = host_tls_context_obj.get('name', None)
                     self.logger.debug(f"Found TLSContext: {host_tls_context_name}")
 
                     host_tls_config = self.get('tls', None)
diff --git a/python/tests/t_hosts.py b/python/tests/t_hosts.py
index dc0e4fb00a..4172f4c50a 100644
--- a/python/tests/t_hosts.py
+++ b/python/tests/t_hosts.py
@@ -267,7 +267,8 @@ def manifests(self) -> str:
       hostname: {self.path.fqdn}
   tlsSecret:
     name: {self.name.k8s}-secret
-  tlsContext: {self.path.k8s}-separate-tls-context
+  tlsContext:
+    name: {self.path.k8s}-separate-tls-context
 ---
 apiVersion: getambassador.io/v2
 kind: TLSContext