diff --git a/pkg/identity/cache.go b/pkg/identity/cache.go
index <HASH>..<HASH> 100644
--- a/pkg/identity/cache.go
+++ b/pkg/identity/cache.go
@@ -120,9 +120,15 @@ func LookupReservedIdentity(lbls labels.Labels) *Identity {
 	return nil
 }
 
+var unknownIdentity = NewIdentity(IdentityUnknown, labels.Labels{labels.IDNameUnknown: labels.NewLabel(labels.IDNameUnknown, "", labels.LabelSourceReserved)})
+
 // LookupIdentityByID returns the identity by ID. This function will first
 // search through the local cache and fall back to querying the kvstore.
 func LookupIdentityByID(id NumericIdentity) *Identity {
+	if id == IdentityUnknown {
+		return unknownIdentity
+	}
+
 	if identity, ok := reservedIdentityCache[id]; ok {
 		return identity
 	}
diff --git a/pkg/labels/labels.go b/pkg/labels/labels.go
index <HASH>..<HASH> 100644
--- a/pkg/labels/labels.go
+++ b/pkg/labels/labels.go
@@ -47,6 +47,10 @@ const (
 	// IDNameInit is the label used to identify any endpoint that has not
 	// received any labels yet.
 	IDNameInit = "init"
+
+	// IDNameUnknown is the label used to to idenfity an endpoint with an
+	// unknown identity.
+	IDNameUnknown = "unknown"
 )
 
 // OpLabels represents the the possible types.
identity: Resolve unknown identity to label reserved:unknown

```
$ cilium identity get 0
ID   LABELS
0    reserved:unknown
```

Fixes: #<I>