diff --git a/metropolis/node/ports.go b/metropolis/node/ports.go
index e7adfb7..c90e7dc 100644
--- a/metropolis/node/ports.go
+++ b/metropolis/node/ports.go
@@ -37,6 +37,9 @@
 	// KubernetesAPIPort is the TCP port on which the Kubernetes API is
 	// exposed.
 	KubernetesAPIPort Port = 6443
+	// KubernetesAPIWrappedPort is the TCP port on which the Metropolis
+	// authenticating proxy for the Kubernetes API is exposed.
+	KubernetesAPIWrappedPort Port = 6444
 	// DebuggerPort is the port on which the delve debugger runs (on debug
 	// builds only). Not to be confused with DebugServicePort.
 	DebuggerPort Port = 2345
@@ -54,6 +57,8 @@
 		return "wireguard"
 	case KubernetesAPIPort:
 		return "kubernetes-api"
+	case KubernetesAPIWrappedPort:
+		return "kubernetes-api-wrapped"
 	case DebuggerPort:
 		return "delve"
 	}