diff --git a/.bazelrc b/.bazelrc
index bced9359e230f..65d2fc272e7ba 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -45,12 +45,6 @@ build --incompatible_merge_fixed_and_default_shell_env
 # A workaround for slow ICU download.
 build --http_timeout_scaling=6.0
 
-# Pass CC, CXX and LLVM_CONFIG variables from the environment.
-# We assume they have stable values, so this won't cause action cache misses.
-build --action_env=CC --host_action_env=CC
-build --action_env=CXX --host_action_env=CXX
-build --action_env=LLVM_CONFIG --host_action_env=LLVM_CONFIG
-
 # Allow stamped caches to bust when local filesystem changes.
 # Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
 build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
@@ -99,13 +93,14 @@ build:linux --cxxopt=-fsized-deallocation --host_cxxopt=-fsized-deallocation
 build:linux --conlyopt=-fexceptions
 build:linux --fission=dbg,opt
 build:linux --features=per_object_debug_info
-build:linux --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold
 
 # macOS
 build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --host_action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --define tcmalloc=disabled
 build:macos --cxxopt=-Wno-nullability-completeness
+build:macos --@toolchains_llvm//toolchain/config:compiler-rt=false
+build:macos --@toolchains_llvm//toolchain/config:libunwind=false
 
 
 #############################################################################
@@ -114,15 +109,14 @@ build:macos --cxxopt=-Wno-nullability-completeness
 
 # Common flags for Clang (shared between all clang variants)
 common:clang-common --linkopt=-fuse-ld=lld
-common:clang-common --action_env=BAZEL_COMPILER=clang
-common:clang-common --action_env=LDFLAGS="-fuse-ld=lld"
-common:clang-common --action_env=CC=clang --host_action_env=CC=clang
-common:clang-common --action_env=CXX=clang++ --host_action_env=CXX=clang++
+common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
+common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false
 
 # Clang with libc++ (default)
 common:clang --config=clang-common
 common:clang --config=libc++
 common:clang --host_platform=@clang_platform
+common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 # Clang installed to non-standard location (ie not /opt/llvm/)
 common:clang-local --config=clang-common
@@ -147,6 +141,8 @@ build:gcc --cxxopt=-Wno-dangling-reference
 build:gcc --cxxopt=-Wno-nonnull-compare
 build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
 build:gcc --host_platform=@envoy//bazel/rbe/toolchains:rbe_linux_gcc_platform
+build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
+build:gcc --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold
 
 # libc++ - default for clang
 common:libc++ --action_env=CXXFLAGS=-stdlib=libc++
diff --git a/.github/config.yml b/.github/config.yml
index 5e83c33d7052e..a2d30e3ea7fad 100644
--- a/.github/config.yml
+++ b/.github/config.yml
@@ -1,19 +1,19 @@
 agent-ubuntu: ubuntu-24.04
 build-image:
   # Authoritative configuration for build image/s
-  repo: docker.io/envoyproxy/envoy-build-ubuntu
+  repo: docker.io/envoyproxy/envoy-build
   repo-gcr: gcr.io/envoy-ci/envoy-build
-  # Until toolchains land, these all just point to the main image or the mobile one
-  sha: faefd182b53aa2148382b3aaf4a8253f0981b77cb6e6104c7bdda6aa3e3ea2ca
-  sha-ci: faefd182b53aa2148382b3aaf4a8253f0981b77cb6e6104c7bdda6aa3e3ea2ca
-  sha-devtools: faefd182b53aa2148382b3aaf4a8253f0981b77cb6e6104c7bdda6aa3e3ea2ca
-  sha-docker: faefd182b53aa2148382b3aaf4a8253f0981b77cb6e6104c7bdda6aa3e3ea2ca
-  sha-gcc: faefd182b53aa2148382b3aaf4a8253f0981b77cb6e6104c7bdda6aa3e3ea2ca
-  sha-mobile: 224feb2b7d513bf7f2ac0c7c529db1cb46398952f31b7d46e51211642d0b2ba0
-  sha-worker: faefd182b53aa2148382b3aaf4a8253f0981b77cb6e6104c7bdda6aa3e3ea2ca
+  # default ci caching (ci)
+  sha: 5fcc9d3e10f1a0e628250b44b4c39bde1bdfc6cb8fe6075838a732c2ba04ef42
+  sha-ci: 5fcc9d3e10f1a0e628250b44b4c39bde1bdfc6cb8fe6075838a732c2ba04ef42
+  sha-devtools: fa69c24f030ce114371de36b2b74ede3370ca70463c7bbcc35e82db900bf2566
+  sha-docker: 82a823b14ac45da97942d24a649ff5b9db35ebb640999c449d391f4b88711e83
+  sha-gcc: c8a21f4efd097f063edd94c6473f33fd8b2346d4b2e3105b8d029287ba919cb5
+  sha-mobile: 04ae4e9abd445f2cfd4cbad24dfcdef85144cd150e5f268ce6f5aade92fdd4d4
+  sha-worker: 3d28abae22d41631f14cf3264694dd294fe9f9a924fcc35b202d27afb59db7ad
   # TODO: remove this dupe (currently used by ci request handler)
-  mobile-sha: 224feb2b7d513bf7f2ac0c7c529db1cb46398952f31b7d46e51211642d0b2ba0
-  tag: abd41d4081d77bacbb246c9b952d49f816a9ee2f
+  mobile-sha: 04ae4e9abd445f2cfd4cbad24dfcdef85144cd150e5f268ce6f5aade92fdd4d4
+  tag: e0b4993c78551c1638ac00cf21d36313fe35d81d
 
 config:
   envoy:
@@ -401,7 +401,7 @@ tables:
     title: Build image
     table-title: Container image/s (as used in this CI run)
     filter: |
-      "https://hub.docker.com/r/envoyproxy/envoy-build-ubuntu/tags?page=1&name=" as $dockerLink
+      "https://hub.docker.com/r/envoyproxy/envoy-build/tags?page=1&name=" as $dockerLink
       | .request["build-image"]
       | del(.changed)
       | with_entries(
@@ -413,7 +413,7 @@ tables:
     title: Build image (current)
     table-title: Current or previous container image
     filter: |
-      "https://hub.docker.com/r/envoyproxy/envoy-build-ubuntu/tags?page=1&name=" as $dockerLink
+      "https://hub.docker.com/r/envoyproxy/envoy-build/tags?page=1&name=" as $dockerLink
       | if .request["build-image"].changed then
           .request["build-image-current"]
           | with_entries(
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
index 0240b9dd98d33..afe5ba46c852f 100644
--- a/.github/workflows/codeql-daily.yml
+++ b/.github/workflows/codeql-daily.yml
@@ -74,10 +74,10 @@ jobs:
 
     - name: Build
       run: |
-       bazel/setup_clang.sh "$(realpath bin/clang18.1.8)"
        bazelisk shutdown
        bazel build \
            -c fastbuild \
+           --repo_env=BAZEL_LLVM_PATH="$(realpath bin/clang18.1.8)" \
            --spawn_strategy=local \
            --discard_analysis_cache \
            --nouse_action_cache \
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index 29d348e116512..6b57c415031eb 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -110,16 +110,15 @@ jobs:
 
     - name: Build
       run: |
-        bazel/setup_clang.sh "$(realpath bin/clang18.1.8)"
-        PATH=$(bin/clang18.1.8/bin/llvm-config --bindir):$local_clang:$PATH
         bazel shutdown
         bazel build \
             -c fastbuild \
+            --repo_env=BAZEL_LLVM_PATH="$(realpath bin/clang18.1.8)" \
             --spawn_strategy=local \
             --discard_analysis_cache \
             --nouse_action_cache \
             --features="-layering_check" \
-            --config=clang-local \
+            --config=clang \
             --config=ci \
             ${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}
         echo -e "Built targets...\n${BUILD_TARGETS:-${MINIMAL_BUILD_TARGET}}"
diff --git a/.github/workflows/envoy-dependency.yml b/.github/workflows/envoy-dependency.yml
index e1d89ac0405bc..9edb20a25babd 100644
--- a/.github/workflows/envoy-dependency.yml
+++ b/.github/workflows/envoy-dependency.yml
@@ -187,15 +187,14 @@ jobs:
       id: build-images
       uses: envoyproxy/toolshed/gh-actions/docker/shas@actions-v0.3.34
       with:
-        # Until toolchains land, these all just point to the main image or the mobile one
         images: |
-           sha: docker.io/envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
-           sha-ci: docker.io/envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
-           sha-devtools: docker.io/envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
-           sha-docker: docker.io/envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
-           sha-gcc: docker.io/envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
-           sha-mobile: docker.io/envoyproxy/envoy-build-ubuntu:mobile-${{ steps.build-tools.outputs.tag }}
-           sha-worker: docker.io/envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
+           sha: docker.io/envoyproxy/envoy-build:devtools-${{ steps.build-tools.outputs.tag }}
+           sha-ci: docker.io/envoyproxy/envoy-build:ci-${{ steps.build-tools.outputs.tag }}
+           sha-devtools: docker.io/envoyproxy/envoy-build:devtools-${{ steps.build-tools.outputs.tag }}
+           sha-docker: docker.io/envoyproxy/envoy-build:docker-${{ steps.build-tools.outputs.tag }}
+           sha-gcc: docker.io/envoyproxy/envoy-build:gcc-${{ steps.build-tools.outputs.tag }}
+           sha-mobile: docker.io/envoyproxy/envoy-build:mobile-${{ steps.build-tools.outputs.tag }}
+           sha-worker: docker.io/envoyproxy/envoy-build:worker-${{ steps.build-tools.outputs.tag }}
 
     - run: |
         SHA_REPLACE=(
diff --git a/api/bazel/repository_locations.bzl b/api/bazel/repository_locations.bzl
index a3142cefe818b..223c7d7db78f7 100644
--- a/api/bazel/repository_locations.bzl
+++ b/api/bazel/repository_locations.bzl
@@ -176,6 +176,8 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         urls = ["https://github.com/envoyproxy/toolshed/archive/bazel-v{version}.tar.gz"],
         use_category = ["build", "controlplane", "dataplane_core"],
         implied_untracked_deps = [
+            "sysroot_linux_amd64",
+            "sysroot_linux_arm64",
             "tsan_libs",
             "msan_libs",
         ],
diff --git a/api/tools/data/tap2pcap_h2_ipv4.txt b/api/tools/data/tap2pcap_h2_ipv4.txt
index ac8785ac1e495..76fdcf7dbefaf 100644
--- a/api/tools/data/tap2pcap_h2_ipv4.txt
+++ b/api/tools/data/tap2pcap_h2_ipv4.txt
@@ -1,6 +1,6 @@
-    1   0.000000    127.0.0.1 → 127.0.0.1    HTTP2 157 Magic, SETTINGS[0], WINDOW_UPDATE[0], HEADERS[1]: GET /
-    2   0.013713    127.0.0.1 → 127.0.0.1    HTTP2 91 SETTINGS[0], SETTINGS[0], WINDOW_UPDATE[0]
-    3   0.013821    127.0.0.1 → 127.0.0.1    HTTP2 63 SETTINGS[0]
-    4   0.128649    127.0.0.1 → 127.0.0.1    HTTP2 5586 HEADERS[1]: 200 OK
-    5   0.130007    127.0.0.1 → 127.0.0.1    HTTP2 7573 DATA[1]
-    6   0.131045    127.0.0.1 → 127.0.0.1    HTTP2 3152 DATA[1], DATA[1] (text/html)
+    1 0.000000000    127.0.0.1 → 127.0.0.1    HTTP2 157 Magic, SETTINGS[0], WINDOW_UPDATE[0], HEADERS[1]: GET /
+    2 0.013713000    127.0.0.1 → 127.0.0.1    HTTP2 91 SETTINGS[0], SETTINGS[0], WINDOW_UPDATE[0]
+    3 0.013821000    127.0.0.1 → 127.0.0.1    HTTP2 63 SETTINGS[0]
+    4 0.128649000    127.0.0.1 → 127.0.0.1    HTTP2 5586 HEADERS[1]: 200 OK
+    5 0.130007000    127.0.0.1 → 127.0.0.1    HTTP2 7573 DATA[1]
+    6 0.131045000    127.0.0.1 → 127.0.0.1    HTTP2 3152 DATA[1], DATA[1] (text/html)
diff --git a/api/tools/tap2pcap.py b/api/tools/tap2pcap.py
index 1f77325684c19..a08d6780786cb 100644
--- a/api/tools/tap2pcap.py
+++ b/api/tools/tap2pcap.py
@@ -73,7 +73,7 @@ def tap2pcap(tap_path, pcap_path):
         pass
 
     text2pcap_args = [
-        'text2pcap', '-D', '-t', '%Y-%m-%d %H:%M:%S.', '-6' if ipv6 else '-4',
+        'text2pcap', '-D', '-t', '%Y-%m-%d %H:%M:%S.%f', '-6' if ipv6 else '-4',
         '%s,%s' % (remote_address, local_address), '-T',
         '%d,%d' % (remote_port, local_port), '-', pcap_path
     ]
diff --git a/api/tools/tap2pcap_test.py b/api/tools/tap2pcap_test.py
index 93d96b7f214ca..4ce6a8a8ae409 100644
--- a/api/tools/tap2pcap_test.py
+++ b/api/tools/tap2pcap_test.py
@@ -37,6 +37,6 @@
         expected_output = f.read()
     if actual_output != expected_output:
         print('Mismatch')
-        print('Expected: %s' % expected_output)
-        print('Actual: %s' % actual_output)
+        print('Expected:\n %s' % expected_output)
+        print('Actual:\n %s' % actual_output)
         sys.exit(1)
diff --git a/bazel/dependency_imports_extra.bzl b/bazel/dependency_imports_extra.bzl
index de302800d2e8e..7cf1fa82940dc 100644
--- a/bazel/dependency_imports_extra.bzl
+++ b/bazel/dependency_imports_extra.bzl
@@ -1,5 +1,7 @@
 load("@dynamic_modules_rust_sdk_crate_index//:defs.bzl", "crate_repositories")
+load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
 
 # Dependencies that rely on a first stage of envoy_dependency_imports() in dependency_imports.bzl.
 def envoy_dependency_imports_extra():
     crate_repositories()
+    llvm_register_toolchains()
diff --git a/bazel/envoy_test.bzl b/bazel/envoy_test.bzl
index d6d0f8dca17d5..4b2a7a049edbe 100644
--- a/bazel/envoy_test.bzl
+++ b/bazel/envoy_test.bzl
@@ -182,7 +182,10 @@ def envoy_cc_test(
     cc_test(
         name = name,
         srcs = srcs,
-        data = data,
+        data = data + select({
+            "%s//bazel:asan_build" % repository: ["@llvm_toolchain_llvm//:symbolizer"],
+            "//conditions:default": [],
+        }),
         copts = envoy_copts(repository, test = True) + copts + envoy_pch_copts(repository, "//test:test_pch"),
         additional_linker_inputs = envoy_exported_symbols_input(),
         linkopts = _envoy_test_linkopts() + linkopts,
@@ -201,7 +204,10 @@ def envoy_cc_test(
         shard_count = shard_count,
         size = size,
         flaky = flaky,
-        env = env,
+        env = env | select({
+            "%s//bazel:asan_build" % repository: {"ASAN_SYMBOLIZER_PATH": "$(location @llvm_toolchain_llvm//:symbolizer)"},
+            "//conditions:default": {},
+        }),
         exec_properties = exec_properties,
     )
 
diff --git a/bazel/external/boringssl_fips.BUILD b/bazel/external/boringssl_fips.BUILD
index 91fbddfb06c30..6d8e0edd8944f 100644
--- a/bazel/external/boringssl_fips.BUILD
+++ b/bazel/external/boringssl_fips.BUILD
@@ -50,7 +50,10 @@ genrule(
         "@fips_ninja//:configure.py",
     ],
     outs = ["ninja"],
-    cmd = select(ninja_build_command()),
+    cmd = select(ninja_build_command(
+        SUPPORTED_ARCHES,
+        STDLIBS,
+    )),
     toolchains = [
         "@rules_python//python:current_py_toolchain",
         "@bazel_tools//tools/cpp:current_cc_toolchain",
@@ -58,7 +61,17 @@ genrule(
     tools = [
         "@bazel_tools//tools/cpp:current_cc_toolchain",
         "@rules_python//python:current_py_toolchain",
-    ],
+    ] + select({
+        "@platforms//cpu:x86_64": [
+            "@sysroot_linux_amd64//:WORKSPACE",
+            "@sysroot_linux_amd64//:sysroot",
+        ],
+        "@platforms//cpu:aarch64": [
+            "@sysroot_linux_arm64//:WORKSPACE",
+            "@sysroot_linux_arm64//:sysroot",
+        ],
+        "//conditions:default": [],
+    }),
 )
 
 genrule(
@@ -92,12 +105,16 @@ genrule(
             "@fips_cmake_linux_x86_64//:bin/cmake",
             "@fips_go_linux_amd64//:all",
             "@fips_go_linux_amd64//:bin/go",
+            "@sysroot_linux_amd64//:WORKSPACE",
+            "@sysroot_linux_amd64//:sysroot",
         ],
         "@platforms//cpu:aarch64": [
             "@fips_cmake_linux_aarch64//:all",
             "@fips_cmake_linux_aarch64//:bin/cmake",
             "@fips_go_linux_arm64//:all",
             "@fips_go_linux_arm64//:bin/go",
+            "@sysroot_linux_arm64//:WORKSPACE",
+            "@sysroot_linux_arm64//:sysroot",
         ],
         "//conditions:default": [],
     }),
diff --git a/bazel/external/fips_build.bzl b/bazel/external/fips_build.bzl
index a000d868877b3..9537c3261203a 100644
--- a/bazel/external/fips_build.bzl
+++ b/bazel/external/fips_build.bzl
@@ -5,15 +5,19 @@ BUILD_COMMAND = """
 set -eo pipefail
 
 # c++
+SYSROOT="$$(realpath $$(dirname "$(location %s)"))"
 export CC="$$(realpath $(CC))"
 # bazel doesnt expose CXX so we have to construct it (or use foreign_cc)
 if [[ "%s" == "libc++" ]]; then
-    export CXXFLAGS="-stdlib=libc++"
-    export LDFLAGS="-fuse-ld=lld -stdlib=libc++ -lc++ -lc++abi -lm -pthread"
+    export CXXFLAGS="-stdlib=libc++ --sysroot=$${SYSROOT}"
+    export LDFLAGS="-fuse-ld=lld -stdlib=libc++ -lc++ -lc++abi -lm -pthread --sysroot=$${SYSROOT}"
 else
-    export CXXFLAGS=""
-    export LDFLAGS="-fuse-ld=lld -lstdc++ -lm -pthread"
+    export CXXFLAGS="--sysroot=$${SYSROOT}"
+    export LDFLAGS="-fuse-ld=lld -lstdc++ -lm -pthread --sysroot=$${SYSROOT}"
 fi
+export CGO_CFLAGS="--sysroot=$${SYSROOT}"
+export CGO_CXXFLAGS="$${CXXFLAGS}"
+export CGO_LDFLAGS="$${LDFLAGS}"
 
 # ninja
 NINJA_BINDIR=$$(realpath $$(dirname $(location :ninja_bin)))
@@ -58,13 +62,15 @@ OUT_FILE=$$(realpath $@)
 PYTHON_BIN=$$(realpath $(PYTHON3))
 export CC="$$(realpath $(CC))"
 export CXX="$$(realpath $(CC))"
+export AR="$$(realpath $(AR))"
+SYSROOT="$$(realpath $$(dirname "$(location %s)"))"
 # bazel doesnt expose CXX so we have to construct it (or use foreign_cc)
 if [[ "%s" == "libc++" ]]; then
-    export CXXFLAGS="-stdlib=libc++"
-    export LDFLAGS="-fuse-ld=lld -stdlib=libc++ -lc++ -lc++abi -lm -pthread"
+    export CXXFLAGS="-stdlib=libc++ --sysroot=$${SYSROOT}"
+    export LDFLAGS="-fuse-ld=lld -stdlib=libc++ -lc++ -lc++abi -lm -pthread --sysroot=$${SYSROOT}"
 else
-    export CXXFLAGS=""
-    export LDFLAGS="-fuse-ld=lld -lstdc++ -lm -pthread"
+    export CXXFLAGS="--sysroot=$${SYSROOT}"
+    export LDFLAGS="-fuse-ld=lld -lstdc++ -lm -pthread --sysroot=$${SYSROOT}"
 fi
 cd $$SRC_DIR
 OUTPUT=$$(mktemp)
@@ -76,20 +82,21 @@ fi
 cp ninja $$OUT_FILE
 """
 
-def _create_boringssl_fips_build_config(lib, arch, arch_alias):
+def _create_build_config(prefix, lib, arch, arch_alias):
     """Create the config_setting_group combination."""
     conditions = ["@platforms//cpu:%s" % arch]
     if lib == "libc++":
         conditions += ["@envoy//bazel:libc++_enabled"]
     selects.config_setting_group(
-        name = "%s_%s" % (arch, lib),
+        name = "%s_%s_%s" % (prefix, arch, lib),
         match_all = conditions,
     )
 
 def _create_boringssl_fips_build_command(lib, arch, arch_alias):
     """Create the command."""
-    _create_boringssl_fips_build_config(lib, arch, arch_alias)
+    _create_build_config("boringssl", lib, arch, arch_alias)
     return BUILD_COMMAND % (
+        "@sysroot_linux_%s//:WORKSPACE" % arch_alias,
         lib,
         "@fips_cmake_linux_%s" % arch,
         "@fips_go_linux_%s" % arch_alias,
@@ -98,7 +105,7 @@ def _create_boringssl_fips_build_command(lib, arch, arch_alias):
 def boringssl_fips_build_command(arches, libs):
     """Create conditional commands from the cartesian product of possible arches/stdlib."""
     return {
-        ":%s_%s" % (arch, lib): _create_boringssl_fips_build_command(
+        ":boringssl_%s_%s" % (arch, lib): _create_boringssl_fips_build_command(
             lib,
             arch,
             arch_alias,
@@ -107,9 +114,22 @@ def boringssl_fips_build_command(arches, libs):
         for lib in libs
     }
 
-def ninja_build_command():
+def _create_ninja_build_command(lib, arch, arch_alias):
+    """Create the command."""
+    _create_build_config("ninja", lib, arch, arch_alias)
+    return NINJA_BUILD_COMMAND % (
+        "@sysroot_linux_%s//:WORKSPACE" % arch_alias,
+        lib,
+    )
+
+def ninja_build_command(arches, libs):
     """Create the ninja command conditioned to correct stdlib."""
     return {
-        "@envoy//bazel:libc++_enabled": NINJA_BUILD_COMMAND % "libc++",
-        "//conditions:default": NINJA_BUILD_COMMAND % "libstdc++",
+        ":ninja_%s_%s" % (arch, lib): _create_ninja_build_command(
+            lib,
+            arch,
+            arch_alias,
+        )
+        for arch, arch_alias in arches.items()
+        for lib in libs
     }
diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
index 7f198f5e745f3..fab82a5acf567 100644
--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
@@ -30,9 +30,9 @@ configure_make(
     configure_in_place = True,
     env = select({
         "//bazel:clang_build": {
-            "AR": "$(AR)",
-            "LD": "$(LD)",
-            "RANLIB": "$(AR) -s",
+            "AR": "$$EXT_BUILD_ROOT/$(AR)",
+            "LD": "$$EXT_BUILD_ROOT/$(LD)",
+            "RANLIB": "$$EXT_BUILD_ROOT/$(AR) -s",
         },
         "//conditions:default": {},
     }),
@@ -82,7 +82,7 @@ configure_make(
     configure_in_place = True,
     configure_options = ["--disable-ssl --disable-gssapi --disable-zstd --disable-curl && cp Makefile.config src/.. && cp config.h src/.."],
     env = {
-        "AR": "$(AR)",
+        "AR": "$$EXT_BUILD_ROOT/$(AR)",
     },
     lib_source = "@confluentinc_librdkafka//:all",
     out_static_libs = [
diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 7665836277693..9e490c1544edc 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -56,7 +56,7 @@ new file mode 100755
 index 00000000..3b4f8eca
 --- /dev/null
 +++ b/luajit_build.sh
-@@ -0,0 +1,61 @@
+@@ -0,0 +1,68 @@
 +#!/bin/bash
 +
 +set -e
@@ -97,6 +97,13 @@ index 00000000..3b4f8eca
 +    export TARGET_LDFLAGS="${LDFLAGS:-} -fno-function-sections -fno-data-sections"
 +    export CFLAGS=""
 +else
++    # macOS: extract sysroot from CFLAGS and pass to HOST_CFLAGS/HOST_LDFLAGS for building host tools
++    SYSROOT_FLAG=$(echo "$CFLAGS" | grep -o -- '--sysroot=[^ ]*' || :)
++    if [[ -n "${SYSROOT_FLAG}" ]]; then
++        export HOST_CFLAGS="${SYSROOT_FLAG}"
++        export HOST_LDFLAGS="${SYSROOT_FLAG}"
++        EXTRA_MAKE_ARGS+=("HOST_CFLAGS=${HOST_CFLAGS}" "HOST_LDFLAGS=${HOST_LDFLAGS}")
++    fi
 +    export TARGET_LDFLAGS="${CFLAGS:-} -fno-function-sections -fno-data-sections"
 +    export CFLAGS=""
 +    export LDFLAGS=""
diff --git a/bazel/platforms/rbe/BUILD b/bazel/platforms/rbe/BUILD
index 9d5f8c366516b..4c887afdac8dc 100644
--- a/bazel/platforms/rbe/BUILD
+++ b/bazel/platforms/rbe/BUILD
@@ -21,7 +21,7 @@ platform(
         docker_network = "standard",
         docker_privileged = True,
     ),
-    parents = ["//bazel/rbe/toolchains/configs/linux/clang/config:platform"],
+    parents = ["//bazel/platforms:linux_x64"],
 )
 
 platform(
@@ -34,5 +34,5 @@ platform(
     ) | {
         "Pool": "arm",
     },
-    parents = ["//bazel/rbe/toolchains/configs/linux/clang/config:platform-arm64"],
+    parents = ["//bazel/platforms:linux_arm64"],
 )
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 93866d3f3e7ce..28679e45220ba 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -226,6 +226,8 @@ def envoy_dependencies(skip_targets = []):
     # Unconditional, since we use this only for compiler-agnostic fuzzing utils.
     _org_llvm_releases_compiler_rt()
 
+    _toolchains_llvm()
+
     _cc_deps()
     _go_deps(skip_targets)
     _rust_deps()
@@ -804,6 +806,9 @@ def _com_github_wamr():
         build_file_content = BUILD_ALL_CONTENT,
     )
 
+def _toolchains_llvm():
+    external_http_archive(name = "toolchains_llvm")
+
 def _com_github_wasmtime():
     external_http_archive(
         name = "com_github_wasmtime",
diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
index 8520185029bdf..b4a0a26d91305 100644
--- a/bazel/repositories_extra.bzl
+++ b/bazel/repositories_extra.bzl
@@ -2,9 +2,11 @@ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
 load("@com_google_protobuf//bazel/private:proto_bazel_features.bzl", "proto_bazel_features")
 load("@emsdk//:deps.bzl", emsdk_deps = "deps")
 load("@envoy_examples//bazel:env.bzl", "envoy_examples_env")
+load("@envoy_toolshed//sysroot:sysroot.bzl", "setup_sysroots")
 load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime/remote:crates.bzl", "crate_repositories")
 load("@rules_cc//cc:extensions.bzl", "compatibility_proxy_repo")
 load("@rules_python//python:repositories.bzl", "py_repositories", "python_register_toolchains")
+load("@toolchains_llvm//toolchain:deps.bzl", "bazel_toolchain_dependencies")
 load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
 
 def _python_minor_version(python_version):
@@ -19,6 +21,8 @@ def envoy_dependencies_extra(
         python_version = PYTHON_VERSION,
         ignore_root_user_error = False):
     compatibility_proxy_repo()
+    bazel_toolchain_dependencies()
+    setup_sysroots()
     emsdk_deps()
     raze_fetch_remote_crates()
     crate_repositories()
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 766e84a9f3848..f55bedaee6311 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -117,6 +117,8 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         urls = ["https://github.com/envoyproxy/toolshed/archive/bazel-v{version}.tar.gz"],
         use_category = ["build", "controlplane", "dataplane_core"],
         implied_untracked_deps = [
+            "sysroot_linux_amd64",
+            "sysroot_linux_arm64",
             "tsan_libs",
             "msan_libs",
         ],
@@ -1681,6 +1683,22 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         license = "Apache-2.0",
         license_url = "https://github.com/maxmind/libmaxminddb/blob/{version}/LICENSE",
     ),
+    toolchains_llvm = dict(
+        project_name = "LLVM toolchain for Bazel",
+        project_desc = "LLVM toolchain for Bazel",
+        project_url = "https://github.com/bazel-contrib/toolchains_llvm",
+        version = "fb29f3d53757790dad17b90df0794cea41f1e183",
+        sha256 = "1a8bbb65dcb7decfe4513c1efc9f3e6b5b501608600af5c068e32724f724ea17",
+        strip_prefix = "toolchains_llvm-{version}",
+        # TODO: switch back to versions
+        # URLS = ["https://github.com/bazel-contrib/toolchains_llvm/releases/download/v{version}/toolchains_llvm-v{version}.tar.gz"],
+        urls = ["https://github.com/bazel-contrib/toolchains_llvm/archive/{version}.tar.gz"],
+        implied_untracked_deps = ["llvm_toolchain_llvm"],
+        release_date = "2025-11-26",
+        use_category = ["build", "dataplane_core", "controlplane"],
+        license = "Apache-2.0",
+        license_url = "https://github.com/bazel-contrib/toolchains_llvm/blob/v{version}/LICENSE",
+    ),
     com_github_lz4_lz4 = dict(
         project_name = "LZ4",
         project_desc = "Extremely Fast Compression algorithm",
diff --git a/bazel/setup_clang.sh b/bazel/setup_clang.sh
deleted file mode 100755
index a13be8f074436..0000000000000
--- a/bazel/setup_clang.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-BAZELRC_FILE="${BAZELRC_FILE:-./clang.bazelrc}"
-
-LLVM_PREFIX=$1
-LLVM_CONFIG="${LLVM_PREFIX}/bin/llvm-config"
-
-if [[ ! -e "${LLVM_CONFIG}" ]]; then
-  echo "Error: cannot find local llvm-config in ${LLVM_PREFIX}."
-  exit 1
-fi
-
-LLVM_VERSION="$("${LLVM_CONFIG}" --version)"
-LLVM_LIBDIR="$("${LLVM_CONFIG}" --libdir)"
-LLVM_TARGET="$("${LLVM_CONFIG}" --host-target)"
-LLVM_BINDIR=$("${LLVM_CONFIG}" --bindir)
-PATH="$LLVM_BINDIR:${PATH}"
-
-RT_LIBRARY_PATH="${LLVM_LIBDIR}/clang/${LLVM_VERSION}/lib/${LLVM_TARGET}"
-
-cat <<EOF > "${BAZELRC_FILE}"
-# Generated file, do not edit. If you want to disable clang, just delete this file.
-build:clang --host_action_env=PATH=${PATH} --action_env=PATH=${PATH}
-build:clang --host_action_env=CC="${LLVM_BINDIR}/clang" --action_env=CC="${LLVM_BINDIR}/clang"
-build:clang --host_action_env=CXX="${LLVM_BINDIR}/clang++" --action_env=CC="${LLVM_BINDIR}/clang++"
-build:clang --define="LLVM_DIRECTORY=${LLVM_PREFIX}"
-build:clang --action_env="LLVM_DIRECTORY=${LLVM_PREFIX}"
-
-build:clang --action_env=LLVM_CONFIG=${LLVM_CONFIG} --host_action_env=LLVM_CONFIG=${LLVM_CONFIG}
-build:clang --repo_env=LLVM_CONFIG=${LLVM_CONFIG}
-build:clang --linkopt=-L${LLVM_LIBDIR}
-build:clang --linkopt=-Wl,-rpath,${LLVM_LIBDIR}
-
-build:asan --linkopt=-L${RT_LIBRARY_PATH}
-EOF
diff --git a/bazel/toolchains.bzl b/bazel/toolchains.bzl
index 1dd9c62d4d946..aa296862d799c 100644
--- a/bazel/toolchains.bzl
+++ b/bazel/toolchains.bzl
@@ -1,9 +1,8 @@
 load("@envoy_repo//:compiler.bzl", "LLVM_PATH")
 load("@envoy_toolshed//repository:utils.bzl", "arch_alias")
+load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
 
 def envoy_toolchains():
-    native.register_toolchains("@envoy//bazel/rbe/toolchains/configs/linux/clang/config:cc-toolchain")
-    native.register_toolchains("@envoy//bazel/rbe/toolchains/configs/linux/clang/config:cc-toolchain-arm64")
     native.register_toolchains("@envoy//bazel/rbe/toolchains/configs/linux/gcc/config:cc-toolchain")
     arch_alias(
         name = "clang_platform",
@@ -12,3 +11,13 @@ def envoy_toolchains():
             "aarch64": "@envoy//bazel/platforms/rbe:linux_arm64",
         },
     )
+    llvm_toolchain(
+        name = "llvm_toolchain",
+        llvm_version = "18.1.8",
+        cxx_standard = {"": "c++20"},
+        sysroot = {
+            "linux-x86_64": "@sysroot_linux_amd64//:sysroot",
+            "linux-aarch64": "@sysroot_linux_arm64//:sysroot",
+        },
+        toolchain_roots = {"": LLVM_PATH} if LLVM_PATH else {},
+    )
diff --git a/ci/build_setup.sh b/ci/build_setup.sh
index bf70036437f5f..392761bd9a322 100755
--- a/ci/build_setup.sh
+++ b/ci/build_setup.sh
@@ -11,8 +11,6 @@ if [[ -n "$NO_BUILD_SETUP" ]]; then
     return
 fi
 
-CURRENT_SCRIPT_DIR="$(realpath "$(dirname "${BASH_SOURCE[0]}")")"
-
 export PPROF_PATH=/thirdparty_build/bin/pprof
 
 if [[ -z "${NUM_CPUS}" ]]; then
@@ -54,8 +52,6 @@ export BUILD_DIR
 
 # Environment setup.
 export ENVOY_TEST_TMPDIR="${ENVOY_TEST_TMPDIR:-$BUILD_DIR/tmp}"
-export LLVM_ROOT="${LLVM_ROOT:-/opt/llvm}"
-export PATH=${LLVM_ROOT}/bin:${PATH}
 
 if [[ -f "/etc/redhat-release" ]]; then
   BAZEL_BUILD_EXTRA_OPTIONS+=("--copt=-DENVOY_IGNORE_GLIBCXX_USE_CXX11_ABI_ERROR=1")
@@ -122,19 +118,6 @@ export BAZEL_STARTUP_OPTION_LIST
 export BAZEL_BUILD_OPTION_LIST
 export BAZEL_GLOBAL_OPTION_LIST
 
-if [[ -z "${ENVOY_RBE}" ]]; then
-    if [[ -e "${LLVM_ROOT}" ]]; then
-        "${CURRENT_SCRIPT_DIR}/../bazel/setup_clang.sh" "${LLVM_ROOT}"
-    else
-        echo "LLVM_ROOT not found, not setting up llvm."
-    fi
-fi
-
-# TODO: remove
-BAZEL_BUILD_OPTIONS+=(
-    "--define=LLVM_DIRECTORY=${LLVM_ROOT}"
-    "--action_env=LLVM_DIRECTORY=${LLVM_ROOT}")
-
 [[ "${BAZEL_EXPUNGE}" == "1" ]] && bazel clean "${BAZEL_BUILD_OPTIONS[@]}" --expunge
 
 if [[ "${ENVOY_BUILD_ARCH}" == "x86_64" ]]; then
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index b456c9330ae54..f89b9ac38dcb5 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -183,7 +183,6 @@ function bazel_contrib_binary_build() {
 function bazel_envoy_api_build() {
     setup_clang_toolchain
     export CLANG_TOOLCHAIN_SETUP=1
-    export LLVM_CONFIG="${LLVM_ROOT}"/bin/llvm-config
     echo "Run protoxform test"
     bazel run "${BAZEL_BUILD_OPTIONS[@]}" \
         --//tools/api_proto_plugin:default_type_db_target=//tools/testdata/protoxform:fix_protos \
diff --git a/ci/docker-compose.yml b/ci/docker-compose.yml
index 4d7fd9e96db94..c65ae7db11c8e 100644
--- a/ci/docker-compose.yml
+++ b/ci/docker-compose.yml
@@ -75,15 +75,19 @@ x-envoy-build-base: &envoy-build-base
   - "/bin/bash"
   - "-c"
   - |
-    groupadd --gid ${DOCKER_GID:-${USER_GID:-$(id -g)}} -f envoygroup
-    useradd -o \
-        --uid ${USER_UID:-$(id -u)} \
-        --gid ${DOCKER_GID:-${USER_GID:-$(id -g)}} \
-        --no-create-home \
-        -s /bin/bash \
-        --home-dir /build envoybuild
-    usermod -a -G pcap envoybuild
-    chown envoybuild:envoygroup /build
+    set -e
+
+    if [[ -n "${USER_GID:-}" ]]; then
+        groupmod -g "$USER_GID" envoybuild >/dev/null
+    fi
+    if [[ -n "${USER_UID:-}" ]]; then
+        usermod -u "$USER_UID" envoybuild >/dev/null
+    fi
+    usermod -d /build envoybuild >/dev/null
+    if [[ -f /.build-id ]]; then
+        build_id="$(cat /.build-id)"
+        echo "Envoy build image: $${build_id}"
+    fi
     chown envoybuild /proc/self/fd/2 2>/dev/null || true
     [[ -e /entrypoint-extra.sh ]] && /entrypoint-extra.sh
     sudo -EHs -u envoybuild bash -c 'cd ${ENVOY_DOCKER_SOURCE_DIR:-/source} && exec ${DOCKER_COMMAND:-bash}'
@@ -112,3 +116,4 @@ services:
     - ${SOURCE_DIR:-..}:/source
     - /var/run/docker.sock:/var/run/docker.sock
     - ${SHARED_TMP_DIR:-/tmp/bazel-shared}:${SHARED_TMP_DIR:-/tmp/bazel-shared}
+    - ${ENVOY_ENTRYPOINT_EXTRA:-./docker-entrypoint-extra.sh}:/entrypoint-extra.sh
diff --git a/ci/docker-entrypoint-extra.sh b/ci/docker-entrypoint-extra.sh
new file mode 100755
index 0000000000000..891f79b4023c3
--- /dev/null
+++ b/ci/docker-entrypoint-extra.sh
@@ -0,0 +1,13 @@
+#!/bin/bash -e
+
+if [[ ! -S /var/run/docker.sock ]]; then
+    echo "No Docker socket available" >&2
+    exit 1
+fi
+SOCKET_GID=$(stat -c '%g' /var/run/docker.sock)
+if ! getent group "$SOCKET_GID" > /dev/null; then
+    # Create a group with the same GID as the socket
+    groupmod -g "$SOCKET_GID" docker \
+        || (delgroup docker && addgroup -g "$SOCKET_GID" docker)
+    gpasswd -a envoybuild docker
+fi
diff --git a/ci/matrix/docker-compose.yml b/ci/matrix/docker-compose.yml
index 5d54acc8114c7..fb3bbd474be8a 100644
--- a/ci/matrix/docker-compose.yml
+++ b/ci/matrix/docker-compose.yml
@@ -27,10 +27,6 @@ x-llvm-setup: &llvm-setup |
   add-apt-repository -y ppa:ubuntu-toolchain-r/test
   apt-get update --error-on=any
   apt-get -qq install -y libtinfo5 wget xz-utils libgcc-s1 libgcc-13-dev
-  mkdir -p /opt/llvm
-  cd /opt/llvm
-  wget -q https://github.com/llvm/llvm-project/releases/download/llvmorg-18.1.8/clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz
-  tar -xf clang+llvm-18.1.8-x86_64-linux-gnu-ubuntu-18.04.tar.xz --strip-components 1
 
 services:
   gcc:
@@ -42,10 +38,10 @@ services:
         MATRIX_SETUP: *gcc-setup
     environment:
       <<: *common-env
-      EXPECTED_NO_ARGS: gcc-libstdc++
+      EXPECTED_NO_ARGS: fail
       EXPECTED_GCC: gcc-libstdc++
       EXPECTED_CLANG: fail
-      EXPECTED_GCC_ENV: gcc-libstdc++
+      EXPECTED_GCC_ENV: fail
       EXPECTED_CLANG_ENV: fail
     command:
     - bash
@@ -63,19 +59,16 @@ services:
         MATRIX_SETUP: *llvm-setup
     environment:
       <<: *common-env
-      EXPECTED_NO_ARGS: fail
+      EXPECTED_NO_ARGS: clang-libc++
       EXPECTED_GCC: fail
       EXPECTED_CLANG: clang-libc++
-      EXPECTED_GCC_ENV: fail
-      EXPECTED_CLANG_ENV: fail
+      EXPECTED_GCC_ENV: clang-libc++
+      EXPECTED_CLANG_ENV: clang-libc++
     command:
     - bash
     - -c
     - |
       ! which gcc || (echo "ERROR: gcc found when it shouldn't be" && exit 1)
-      bazel/setup_clang.sh /opt/llvm
-      export PATH=/opt/llvm/bin:$PATH
-      clang --version
       /usr/local/bin/test.sh
 
   all:
@@ -88,22 +81,20 @@ services:
         MATRIX_SETUP_EXTRA: *gcc-setup
     environment:
       <<: *common-env
-      EXPECTED_NO_ARGS: gcc-libstdc++
+      EXPECTED_NO_ARGS: clang-libc++
       EXPECTED_GCC: gcc-libstdc++
       EXPECTED_CLANG: clang-libc++
-      EXPECTED_GCC_ENV: gcc-libstdc++
-      EXPECTED_CLANG_ENV: clang-libstdc++
+      EXPECTED_GCC_ENV: clang-libc++
+      EXPECTED_CLANG_ENV: clang-libc++
     command:
     - bash
     - -c
     - |
-      bazel/setup_clang.sh /opt/llvm
-      export PATH=/opt/llvm/bin:$PATH
       gcc --version
-      clang --version
       /usr/local/bin/test.sh
 
-  # this fails all now, but should start working with hermetic toolchains
+  # this fails due to llvm's dep on shared libtinfo, it
+  # tries to pick the clang toolchain otherwise
   none:
     <<: *common-base
     build:
@@ -120,6 +111,5 @@ services:
     - bash
     - -c
     - |
-      ! which clang || (echo "ERROR: clang found when it shouldn't be" && exit 1)
       ! which gcc || (echo "ERROR: gcc found when it shouldn't be" && exit 1)
       /usr/local/bin/test.sh
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index be5a52cb32980..611f6c77c2c30 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -40,11 +40,14 @@ export DOCKER_COMMAND="${*:-bash}"
 COMPOSE_SERVICE="envoy-build"
 if [[ -n "$MOUNT_GPG_HOME" ]]; then
     COMPOSE_SERVICE="envoy-build-gpg"
+    ENVOY_BUILD_VARIANT=devtools
 elif [[ -n "$ENVOY_DOCKER_IN_DOCKER" ]]; then
     ENVOY_BUILD_VARIANT=docker
     COMPOSE_SERVICE="envoy-build-dind"
 elif [[ -n "$ENVOY_DOCKER_CI" ]]; then
     ENVOY_BUILD_VARIANT=ci
+else
+    ENVOY_BUILD_VARIANT=devtools
 fi
 
 # Source build SHA information
diff --git a/contrib/hyperscan/matching/input_matchers/source/BUILD b/contrib/hyperscan/matching/input_matchers/source/BUILD
index 0aeb0d9e6ae9f..3e8d4409cd773 100644
--- a/contrib/hyperscan/matching/input_matchers/source/BUILD
+++ b/contrib/hyperscan/matching/input_matchers/source/BUILD
@@ -36,8 +36,8 @@ envoy_cmake(
     },
     default_cache_entries = {},
     env = {
-        "NM": "$(NM)",
-        "OBJCOPY": "$(OBJCOPY)",
+        "NM": "$$EXT_BUILD_ROOT/$(NM)",
+        "OBJCOPY": "$$EXT_BUILD_ROOT/$(OBJCOPY)",
     },
     exec_properties = select({
         "//bazel:engflow_rbe_x86_64": {
diff --git a/mobile/.bazelrc b/mobile/.bazelrc
index 696490d7a4a58..d503fe3d8aa03 100644
--- a/mobile/.bazelrc
+++ b/mobile/.bazelrc
@@ -104,7 +104,6 @@ build:mobile-android-publish --fat_apk_cpu=x86,x86_64,armeabi-v7a,arm64-v8a
 #############################################################################
 # Clang toolchain options
 build:mobile-clang --config=libc++
-build:mobile-clang --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 build:mobile-clang --host_platform=@mobile_clang_platform
 
 
diff --git a/mobile/bazel/envoy_mobile_toolchains.bzl b/mobile/bazel/envoy_mobile_toolchains.bzl
index e072843a11e2b..35e3c29fdc92f 100644
--- a/mobile/bazel/envoy_mobile_toolchains.bzl
+++ b/mobile/bazel/envoy_mobile_toolchains.bzl
@@ -1,3 +1,4 @@
+load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
 load("@rules_detekt//detekt:toolchains.bzl", "rules_detekt_toolchains")
 load("@rules_java//java:repositories.bzl", "rules_java_toolchains")
 load("@rules_kotlin//kotlin:core.bzl", "kt_register_toolchains")
@@ -8,3 +9,4 @@ def envoy_mobile_toolchains():
     kt_register_toolchains()
     rules_detekt_toolchains()
     rules_proto_grpc_toolchains()
+    llvm_register_toolchains()
diff --git a/mobile/bazel/platforms.bzl b/mobile/bazel/platforms.bzl
index 38bfa919cc224..a2979332ec648 100644
--- a/mobile/bazel/platforms.bzl
+++ b/mobile/bazel/platforms.bzl
@@ -1,11 +1,9 @@
 load("@envoy_toolshed//repository:utils.bzl", "arch_alias")
 
 def envoy_mobile_platforms():
-    native.register_toolchains("//third_party/rbe_configs/config:cc-toolchain")
     arch_alias(
         name = "mobile_clang_platform",
         aliases = {
-            "amd64": "@envoy_mobile//third_party/rbe_configs/config:platform",
-            "aarch64": "@envoy_mobile//third_party/rbe_configs/config:platform",
+            "amd64": "@envoy_mobile//bazel/platforms/rbe:linux_x64",
         },
     )
diff --git a/source/extensions/dynamic_modules/sdk/rust/BUILD b/source/extensions/dynamic_modules/sdk/rust/BUILD
index b3eecb438d72a..60ed1e7435fc2 100644
--- a/source/extensions/dynamic_modules/sdk/rust/BUILD
+++ b/source/extensions/dynamic_modules/sdk/rust/BUILD
@@ -13,10 +13,29 @@ envoy_extension_package()
 cargo_build_script(
     name = "build_script",
     srcs = ["build.rs"],
+    build_script_env = select({
+        "@platforms//os:linux": {
+            "LIBCLANG_PATH": "$(location @llvm_toolchain_llvm//:lib/libclang.so)",
+            # Note: We construct the string here before passing it to select
+            "BINDGEN_EXTRA_CLANG_ARGS": " ".join([
+                "-isystem $${pwd}/external/llvm_toolchain_llvm/lib/clang/18/include",
+                "-isystem $${pwd}/external/llvm_toolchain_llvm/include/x86_64-unknown-linux-gnu/c++/v1/",
+                "-isystem $${pwd}/external/llvm_toolchain_llvm/include/aarch64-unknown-linux-gnu/c++/v1/",
+            ]),
+        },
+        "//conditions:default": {},
+    }),
     data = [
         "//source/extensions/dynamic_modules:abi.h",
         "//source/extensions/dynamic_modules:abi_version.h",
-    ],
+    ] + select({
+        "@platforms//os:linux": [
+            "@llvm_toolchain_llvm//:include",
+            "@llvm_toolchain_llvm//:lib",
+            "@llvm_toolchain_llvm//:lib/libclang.so",
+        ],
+        "//conditions:default": [],
+    }),
     edition = "2021",
     deps = all_crate_deps(
         build = True,
diff --git a/test/exe/BUILD b/test/exe/BUILD
index 517b3fffad799..a68d328d112c9 100644
--- a/test/exe/BUILD
+++ b/test/exe/BUILD
@@ -45,7 +45,10 @@ envoy_sh_test(
     coverage = False,
     data = [
         "//source/exe:envoy-static",
-    ],
+    ] + select({
+        "//bazel:clang_build": ["@llvm_toolchain_llvm//:readelf"],
+        "//conditions:default": [],
+    }),
     # Since VS2015 or even earlier, link.exe defaults to PIE generation
     tags = [
         "nofips",
@@ -156,10 +159,11 @@ envoy_cc_test(
     data = [
         "fips_check.sh",
         "//source/extensions:extensions_metadata.yaml",
+        "@llvm_toolchain_llvm//:objdump",
     ],
     env = select({
         "//bazel:clang_build": {
-            "OBJDUMP": "${LLVM_DIRECTORY}/bin/llvm-objdump",
+            "OBJDUMP": "$(location @llvm_toolchain_llvm//:objdump)",
         },
         "//conditions:default": {},
     }),
diff --git a/test/run_envoy_bazel_coverage.sh b/test/run_envoy_bazel_coverage.sh
index 1a68abafba638..327bf841a3219 100755
--- a/test/run_envoy_bazel_coverage.sh
+++ b/test/run_envoy_bazel_coverage.sh
@@ -2,25 +2,6 @@
 
 set -e -o pipefail
 
-LLVM_VERSION=${LLVM_VERSION:-"18.1.8"}
-CLANG_VERSION=$(clang --version | grep version | sed -e 's/\ *clang version \([0-9.]*\).*/\1/')
-LLVM_COV_VERSION=$(llvm-cov --version | grep version | sed -e 's/\ *LLVM version \([0-9.]*\).*/\1/')
-LLVM_PROFDATA_VERSION=$(llvm-profdata show --version | grep version | sed -e 's/\ *LLVM version \(.*\)/\1/')
-
-if [[ -z "$ENVOY_RBE" && "${CLANG_VERSION}" != "${LLVM_VERSION}" ]]; then
-    echo "ERROR: clang version ${CLANG_VERSION} does not match expected ${LLVM_VERSION}" >&2
-    exit 1
-fi
-
-if [[ -z "$ENVOY_RBE" && "${LLVM_COV_VERSION}" != "${LLVM_VERSION}" ]]; then
-    echo "ERROR: llvm-cov version ${LLVM_COV_VERSION} does not match expected ${LLVM_VERSION}" >&2
-    exit 1
-fi
-
-if [[ -z "$ENVOY_RBE" && "${LLVM_PROFDATA_VERSION}" != "${LLVM_VERSION}" ]]; then
-    echo "ERROR: llvm-profdata version ${LLVM_PROFDATA_VERSION} does not match expected ${LLVM_VERSION}" >&2
-    exit 1
-fi
 
 # This is a little hacky
 IS_MOBILE="${IS_MOBILE:-}"