diff --git a/akka-javasdk/src/main/resources/reference.conf b/akka-javasdk/src/main/resources/reference.conf
index 67f30f081..b32302510 100644
--- a/akka-javasdk/src/main/resources/reference.conf
+++ b/akka-javasdk/src/main/resources/reference.conf
@@ -86,6 +86,15 @@ akka.javasdk {
     pass-along-env-allow = []
   }
 
+  grpc.client {
+    # Specify entries for the full service DNS names to apply
+    # customizations for interacting with external gRPC services
+    # Fixme specify what settings are possible right here
+    # "com.example" {
+    #   use-tls = true
+    # }
+  }
+
   telemetry {
     tracing {
       collector-endpoint = ""
diff --git a/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala b/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala
index 2a797d932..4bb4ea285 100644
--- a/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala
+++ b/akka-javasdk/src/main/scala/akka/javasdk/impl/SdkRunner.scala
@@ -341,21 +341,21 @@ private final class Sdk(
     remoteIdentification.map(ri => RawHeader(ri.headerName, ri.headerValue)),
     sdkSettings)
 
-  private lazy val grpcClientProvider = new GrpcClientProviderImpl(
-    system,
-    sdkSettings,
-    applicationConfig,
-    remoteIdentification.map(ri => GrpcClientProviderImpl.AuthHeaders(ri.headerName, ri.headerValue)))
-
   private lazy val userServiceConfig = {
     // hiding these paths from the config provided to user
     val sensitivePaths = List("akka", "kalix.meta", "kalix.proxy", "kalix.runtime", "system")
-    val sdkConfig = applicationConfig.getConfig("akka.javasdk")
+    val sdkConfig = applicationConfig.getObject("akka.javasdk")
     sensitivePaths
       .foldLeft(applicationConfig) { (conf, toHide) => conf.withoutPath(toHide) }
-      .withFallback(sdkConfig)
+      .withValue("akka.javasdk", sdkConfig)
   }
 
+  private lazy val grpcClientProvider = new GrpcClientProviderImpl(
+    system,
+    sdkSettings,
+    userServiceConfig,
+    remoteIdentification.map(ri => GrpcClientProviderImpl.AuthHeaders(ri.headerName, ri.headerValue)))
+
   // validate service classes before instantiating
   private val validation = componentClasses.foldLeft(Valid: Validation) { case (validations, cls) =>
     validations ++ Validations.validate(cls)
diff --git a/akka-javasdk/src/main/scala/akka/javasdk/impl/grpc/GrpcClientProviderImpl.scala b/akka-javasdk/src/main/scala/akka/javasdk/impl/grpc/GrpcClientProviderImpl.scala
index 0ac01f408..36a311170 100644
--- a/akka-javasdk/src/main/scala/akka/javasdk/impl/grpc/GrpcClientProviderImpl.scala
+++ b/akka-javasdk/src/main/scala/akka/javasdk/impl/grpc/GrpcClientProviderImpl.scala
@@ -16,6 +16,7 @@ import akka.javasdk.grpc.GrpcClientProvider
 import akka.javasdk.impl.Settings
 import akka.javasdk.impl.grpc.GrpcClientProviderImpl.AuthHeaders
 import com.typesafe.config.Config
+import com.typesafe.config.ConfigFactory
 import org.slf4j.LoggerFactory
 
 import java.util.concurrent.ConcurrentHashMap
@@ -66,7 +67,7 @@ private[akka] object GrpcClientProviderImpl {
 private[akka] final class GrpcClientProviderImpl(
     system: ActorSystem[_],
     settings: Settings,
-    applicationConfig: Config,
+    userServiceConfig: Config,
     remoteIdentificationHeader: Option[AuthHeaders])
     extends GrpcClientProvider {
   import GrpcClientProviderImpl._
@@ -92,7 +93,8 @@ private[akka] final class GrpcClientProviderImpl(
   // getGrpcClient(serviceClass, service, port, Some("impersonate-kalix-service" -> impersonate))
 
   private def createNewClientFor(clientKey: ClientKey): AkkaGrpcClient = {
-    val clientSettings =
+    val clientSettings = {
+      // FIXME the old impl would look in config first and always choose that if present
       if (isAkkaService(clientKey.serviceName)) {
         val akkaServiceClientSettings = if (settings.devModeSettings.isDefined) {
           // local service discovery when running locally
@@ -139,8 +141,14 @@ private[akka] final class GrpcClientProviderImpl(
 
         // FIXME we should probably not allow any grpc client setting but a subset?
         // external service, details defined in user config
-        GrpcClientSettings.fromConfig(clientKey.serviceName, applicationConfig)(system)
+        GrpcClientSettings.fromConfig(
+          clientKey.serviceName,
+          userServiceConfig
+            .getConfig("akka.javasdk.grpc.client")
+            // this config overload requires there to be an entry for the name, but then falls back to defaults
+            .withFallback(ConfigFactory.parseString(s""""${clientKey.serviceName}" = {}""")))(system)
       }
+    }
 
     // Java API - static create
     val create =
diff --git a/samples/doc-snippets/src/main/resources/application.conf b/samples/doc-snippets/src/main/resources/application.conf
index 0138d0d17..a1990a69e 100644
--- a/samples/doc-snippets/src/main/resources/application.conf
+++ b/samples/doc-snippets/src/main/resources/application.conf
@@ -1,4 +1,11 @@
 my-app {
   some-feature-flag = true
   environment = "test"
+}
+
+akka.javasdk.grpc.client."hellogrpc.example.com" {
+  # configure external call, to call back to self
+  host = "localhost"
+  port = 9000
+  use-tls = false
 }
\ No newline at end of file