diff --git a/.changelog/21604.txt b/.changelog/21604.txt
new file mode 100644
index 000000000000..f5441403434b
--- /dev/null
+++ b/.changelog/21604.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+api-gateway: **(Enterprise only)** ensure clusters are properly created for JWT providers with a remote URI for the JWKS endpoint
+```
diff --git a/agent/xds/clusters.go b/agent/xds/clusters.go
index f8abdc0e9187..f6a353244704 100644
--- a/agent/xds/clusters.go
+++ b/agent/xds/clusters.go
@@ -148,7 +148,7 @@ func (s *ResourceGenerator) clustersFromSnapshotConnectProxy(cfgSnap *proxycfg.C
 
 	// add clusters for jwt-providers
 	for _, prov := range cfgSnap.JWTProviders {
-		//skip cluster creation for local providers
+		// skip cluster creation for local providers
 		if prov.JSONWebKeySet == nil || prov.JSONWebKeySet.Remote == nil {
 			continue
 		}
@@ -923,7 +923,6 @@ func (s *ResourceGenerator) injectGatewayDestinationAddons(cfgSnap *proxycfg.Con
 			}
 			c.TransportSocket = transportSocket
 		}
-
 	}
 	return nil
 }
@@ -1004,6 +1003,8 @@ func (s *ResourceGenerator) clustersFromSnapshotAPIGateway(cfgSnap *proxycfg.Con
 
 			createdClusters[uid] = true
 		}
+
+		clusters = append(clusters, makeAPIGatewayJWKClusters(s.Logger, cfgSnap)...)
 	}
 	return clusters, nil
 }
@@ -1145,7 +1146,6 @@ func (s *ResourceGenerator) makeUpstreamClusterForPeerService(
 	}
 
 	upstreamsSnapshot, err := cfgSnap.ToConfigSnapshotUpstreams()
-
 	if err != nil {
 		return c, err
 	}
diff --git a/agent/xds/jwt_authn_ce.go b/agent/xds/jwt_authn_ce.go
index f8cf52957dc4..5b08de5e5e89 100644
--- a/agent/xds/jwt_authn_ce.go
+++ b/agent/xds/jwt_authn_ce.go
@@ -8,8 +8,11 @@ package xds
 import (
 	envoy_http_jwt_authn_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/jwt_authn/v3"
 	envoy_http_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"google.golang.org/protobuf/proto"
 
+	"github.com/hashicorp/consul/agent/proxycfg"
 	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/go-hclog"
 )
 
 type GatewayAuthFilterBuilder struct {
@@ -22,3 +25,7 @@ type GatewayAuthFilterBuilder struct {
 func (g *GatewayAuthFilterBuilder) makeGatewayAuthFilters() ([]*envoy_http_v3.HttpFilter, error) {
 	return nil, nil
 }
+
+func makeAPIGatewayJWKClusters(_ hclog.Logger, _ *proxycfg.ConfigSnapshot) []proto.Message {
+	return nil
+}