diff --git a/include/grpc/grpc.h b/include/grpc/grpc.h
index 101fc88d8f642f0cc8f95390d9e475ada116b1bd..145052b6d3c6878ec0b8bae61193b5eca9c1cb33 100644
--- a/include/grpc/grpc.h
+++ b/include/grpc/grpc.h
@@ -134,6 +134,14 @@ typedef struct {
 /** Secondary user agent: goes at the end of the user-agent metadata
     sent on each request */
 #define GRPC_ARG_SECONDARY_USER_AGENT_STRING "grpc.secondary_user_agent"
+/* The caller of the secure_channel_create functions may override the target
+   name used for SSL host name checking using this channel argument which is of
+   type GRPC_ARG_STRING. This *should* be used for testing only.
+   If this argument is not specified, the name used for SSL host name checking
+   will be the target parameter (assuming that the secure channel is an SSL
+   channel). If this parameter is specified and the underlying is not an SSL
+   channel, it will just be ignored. */
+#define GRPC_SSL_TARGET_NAME_OVERRIDE_ARG "grpc.ssl_target_name_override"
 
 /** Connectivity state of a channel. */
 typedef enum {
diff --git a/include/grpc/grpc_security.h b/include/grpc/grpc_security.h
index 7f8f4d4a053e770d348292469466b0647a867985..de565b2d2fcc8ca0f1be9a1cb099bd37db0ec48c 100644
--- a/include/grpc/grpc_security.h
+++ b/include/grpc/grpc_security.h
@@ -142,15 +142,6 @@ grpc_credentials *grpc_iam_credentials_create(const char *authorization_token,
 
 /* --- Secure channel creation. --- */
 
-/* The caller of the secure_channel_create functions may override the target
-   name used for SSL host name checking using this channel argument which is of
-   type GRPC_ARG_STRING. This *should* be used for testing only.
-   If this argument is not specified, the name used for SSL host name checking
-   will be the target parameter (assuming that the secure channel is an SSL
-   channel). If this parameter is specified and the underlying is not an SSL
-   channel, it will just be ignored. */
-#define GRPC_SSL_TARGET_NAME_OVERRIDE_ARG "grpc.ssl_target_name_override"
-
 /* Creates a secure channel using the passed-in credentials. */
 grpc_channel *grpc_secure_channel_create(grpc_credentials *creds,
                                          const char *target,
diff --git a/src/core/surface/channel.c b/src/core/surface/channel.c
index 78eeed1f5988efc842bcbaa9acaff682af27be0e..586402e21c3bbe493d8ba58695b321b8e57fd2a5 100644
--- a/src/core/surface/channel.c
+++ b/src/core/surface/channel.c
@@ -141,9 +141,28 @@ grpc_channel *grpc_channel_create_from_filters(
           gpr_log(GPR_ERROR, "%s: must be an string",
                   GRPC_ARG_DEFAULT_AUTHORITY);
         } else {
+          if (channel->default_authority) {
+            /* setting this takes precedence over anything else */
+            GRPC_MDELEM_UNREF(channel->default_authority);
+          }
           channel->default_authority = grpc_mdelem_from_strings(
               mdctx, ":authority", args->args[i].value.string);
         }
+      } else if (0 ==
+                 strcmp(args->args[i].key, GRPC_SSL_TARGET_NAME_OVERRIDE_ARG)) {
+        if (args->args[i].type != GRPC_ARG_STRING) {
+          gpr_log(GPR_ERROR, "%s: must be an string",
+                  GRPC_SSL_TARGET_NAME_OVERRIDE_ARG);
+        } else {
+          if (channel->default_authority) {
+            /* other ways of setting this (notably ssl) take precedence */
+            gpr_log(GPR_ERROR, "%s: default host already set some other way",
+                    GRPC_ARG_DEFAULT_AUTHORITY);
+          } else {
+            channel->default_authority = grpc_mdelem_from_strings(
+                mdctx, ":authority", args->args[i].value.string);
+          }
+        }
       }
     }
   }