diff --git a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
index d99e00661f5..948d15c7c05 100644
--- a/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
+++ b/content/rancher/v2.x/en/cluster-admin/tools/istio/setup/enable-istio-in-namespace/_index.md
@@ -21,4 +21,25 @@ This namespace setting will only affect new workloads in the namespace. Any pree
 
 To verify that Istio is enabled, deploy a hello-world workload in the namespace. Go to the workload and click the pod name. In the **Containers** section, you should see the `istio-proxy` container.
 
+### Excluding Workloads from Being Injected with the Istio Sidecar
+
+If you need to exclude a workload from getting injected with the Istio sidecar, use the following annotation on the workload:
+
+```
+sidecar.istio.io/inject: “false”
+```
+
+To add the annotation to a workload,
+
+1. From the **Global** view, open the project that has the workload that should not have the sidecar.
+1. Click **Resources > Workloads.**
+1. Go to the workload that should not have the sidecar and click **Ellipsis (...) > Edit.**
+1. Click **Show Advanced Options.** Then expand the **Labels & Annotations** section.
+1. Click **Add Annotation.**
+1. In the **Key** field, enter `sidecar.istio.io/inject`.
+1. In the **Value** field, enter `false`.
+1. Click **Save.**
+
+**Result:** The Istio sidecar will not be injected into the workload.
+
 ### [Next: Set up Taints and Tolerations]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/tools/istio/setup/node-selectors)
\ No newline at end of file