diff --git a/e2e/internal/kuberesource/parts.go b/e2e/internal/kuberesource/parts.go
index 9430433392..d7b60c34c7 100644
--- a/e2e/internal/kuberesource/parts.go
+++ b/e2e/internal/kuberesource/parts.go
@@ -127,6 +127,26 @@ func (p *PortForwarderConfig) WithForwardTarget(host string, port int32) *PortFo
 	return p
 }
 
+func AddPortForwarders(resources []any) []any {
+	var out []any
+	for _, resource := range resources {
+		switch obj := resource.(type) {
+		case *applycorev1.ServiceApplyConfiguration:
+			port := *obj.Spec.Ports[0].Port
+			namespace := ""
+			if obj.Namespace != nil {
+				namespace = *obj.Namespace
+			}
+			fwd := PortForwarder(*obj.Name, namespace).
+				WithListenPort(port).
+				WithForwardTarget(*obj.Name, port)
+			out = append(out, fwd.PodApplyConfiguration)
+		}
+		out = append(out, resource)
+	}
+	return out
+}
+
 // CoordinatorConfig wraps applyappsv1.DeploymentApplyConfiguration for a coordinator.
 type CoordinatorConfig struct {
 	*applyappsv1.DeploymentApplyConfiguration
diff --git a/e2e/internal/kuberesource/sets.go b/e2e/internal/kuberesource/sets.go
index 2a2dcd5df4..37a1cc624f 100644
--- a/e2e/internal/kuberesource/sets.go
+++ b/e2e/internal/kuberesource/sets.go
@@ -49,6 +49,7 @@ func Simple() ([]any, error) {
 	namespace := Namespace(ns)
 	coordinator := Coordinator(ns).DeploymentApplyConfiguration
 	coordinatorService := ServiceForDeployment(coordinator)
+	// TODO(burgerdev): forwarder should be added on demand by resourcegen
 	coordinatorForwarder := PortForwarder("coordinator", ns).
 		WithListenPort(1313).
 		WithForwardTarget("coordinator", 1313).
@@ -207,16 +208,6 @@ func OpenSSL() ([]any, error) {
 
 	frontendService := ServiceForDeployment(frontend)
 
-	portforwarderCoordinator := PortForwarder("coordinator", ns).
-		WithListenPort(1313).
-		WithForwardTarget("coordinator", 1313).
-		PodApplyConfiguration
-
-	portforwarderOpenSSLFrontend := PortForwarder("openssl-frontend", ns).
-		WithListenPort(443).
-		WithForwardTarget("openssl-frontend", 443).
-		PodApplyConfiguration
-
 	resources := []any{
 		namespace,
 		coordinator,
@@ -226,8 +217,6 @@ func OpenSSL() ([]any, error) {
 		client,
 		frontend,
 		frontendService,
-		portforwarderCoordinator,
-		portforwarderOpenSSLFrontend,
 	}
 
 	return resources, nil
@@ -562,22 +551,10 @@ func Emojivoto(smMode serviceMeshMode) ([]any, error) {
 		WithAPIVersion("v1").
 		WithKind("ServiceAccount")
 
-	portforwarderCoordinator := PortForwarder("coordinator", ns).
-		WithListenPort(1313).
-		WithForwardTarget("coordinator", 1313).
-		PodApplyConfiguration
-
-	portforwarderemojivotoWeb := PortForwarder("emojivoto-web", ns).
-		WithListenPort(8080).
-		WithForwardTarget("web-svc", 443).
-		PodApplyConfiguration
-
 	resources := []any{
 		emoji,
 		emojiService,
 		emojiserviceAccount,
-		portforwarderCoordinator,
-		portforwarderemojivotoWeb,
 		voteBot,
 		voting,
 		votingService,
diff --git a/e2e/openssl/openssl_test.go b/e2e/openssl/openssl_test.go
index 85b5ff513d..4fe3877a08 100644
--- a/e2e/openssl/openssl_test.go
+++ b/e2e/openssl/openssl_test.go
@@ -36,6 +36,7 @@ func TestOpenSSL(t *testing.T) {
 
 	resources, err := kuberesource.OpenSSL()
 	require.NoError(t, err)
+	resources = kuberesource.AddPortForwarders(resources)
 
 	ct.Init(t, resources)
 	require.True(t, t.Run("generate", ct.Generate), "contrast generate needs to succeed for subsequent tests")
diff --git a/e2e/servicemesh/servicemesh_test.go b/e2e/servicemesh/servicemesh_test.go
index f3371eadf3..5e7841ee30 100644
--- a/e2e/servicemesh/servicemesh_test.go
+++ b/e2e/servicemesh/servicemesh_test.go
@@ -37,6 +37,8 @@ func TestIngressEgress(t *testing.T) {
 	coordinatorService := kuberesource.ServiceForDeployment(coordinator)
 	resources = append(resources, coordinator, coordinatorService)
 
+	resources = kuberesource.AddPortForwarders(resources)
+
 	ct.Init(t, resources)
 
 	require.True(t, t.Run("generate", ct.Generate), "contrast generate needs to succeed for subsequent tests")
@@ -69,7 +71,7 @@ func TestIngressEgress(t *testing.T) {
 			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
 			defer cancel()
 
-			web, cancelPortForward, err := ct.Kubeclient.PortForwardPod(ctx, ct.Namespace, "port-forwarder-emojivoto-web", "8080")
+			web, cancelPortForward, err := ct.Kubeclient.PortForwardPod(ctx, ct.Namespace, "port-forwarder-web-svc", "443")
 			require.NoError(err)
 			t.Cleanup(cancelPortForward)