diff --git a/bazel/BUILD b/bazel/BUILD
index 8b682d020d17a..4f9688f10fdce 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -21,3 +21,8 @@ config_setting(
     name = "debug_symbols",
     values = {"define": "debug_symbols=yes"},
 )
+
+config_setting(
+    name = "disable_tcmalloc",
+    values = {"define": "tcmalloc=disabled"},
+)
diff --git a/bazel/envoy_build_system.bzl b/bazel/envoy_build_system.bzl
index 52326a78a275e..450fca605cd5c 100644
--- a/bazel/envoy_build_system.bzl
+++ b/bazel/envoy_build_system.bzl
@@ -16,6 +16,9 @@ ENVOY_COPTS = [
     "//bazel:opt_build": [],
     "//bazel:fastbuild_build": [],
     "//bazel:dbg_build": ["-ggdb3"],
+}) + select({
+    "//bazel:disable_tcmalloc": [],
+    "//conditions:default": ["-DTCMALLOC"],
 }) + select({
     # Allow debug symbols to be added to opt/fastbuild as well.
     "//bazel:debug_symbols": ["-ggdb3"],
@@ -26,6 +29,22 @@ ENVOY_COPTS = [
 def envoy_external_dep_path(dep):
     return "//external:%s" % dep
 
+# Dependencies on tcmalloc_and_profiler should be wrapped with this function.
+def tcmalloc_external_dep():
+    return select({
+        "//bazel:disable_tcmalloc": None,
+        "//conditions:default": envoy_external_dep_path("tcmalloc_and_profiler"),
+    })
+
+# As above, but wrapped in list form for adding to dep lists. This smell seems needed as
+# SelectorValue values have to match the attribute type. See
+# https://github.com/bazelbuild/bazel/issues/2273.
+def tcmalloc_external_deps():
+    return select({
+        "//bazel:disable_tcmalloc": [],
+        "//conditions:default": [envoy_external_dep_path("tcmalloc_and_profiler")],
+    })
+
 # Transform the package path (e.g. include/envoy/common) into a path for
 # exporting the package headers at (e.g. envoy/common). Source files can then
 # include using this path scheme (e.g. #include "envoy/common/time.h").
@@ -41,8 +60,11 @@ def envoy_cc_library(name,
                      copts = [],
                      visibility = None,
                      external_deps = [],
+                     tcmalloc_dep = None,
                      repository = "",
                      deps = []):
+    if tcmalloc_dep:
+        deps += tcmalloc_external_deps()
     native.cc_library(
         name = name,
         srcs = srcs,
@@ -77,6 +99,7 @@ def envoy_cc_binary(name,
         ],
         linkstatic = 1,
         visibility = visibility,
+        malloc = tcmalloc_external_dep(),
         deps = deps + [
             repository + "//source/precompiled:precompiled_includes",
         ],
@@ -108,6 +131,7 @@ def envoy_cc_test(name,
         copts = ENVOY_COPTS,
         linkopts = ["-pthread"],
         linkstatic = 1,
+        malloc = tcmalloc_external_dep(),
         deps = [
             ":" + name + "_lib",
             repository + "//test:main"
diff --git a/bazel/target_recipes.bzl b/bazel/target_recipes.bzl
index 42ad772c22832..111348f623ac8 100644
--- a/bazel/target_recipes.bzl
+++ b/bazel/target_recipes.bzl
@@ -11,7 +11,7 @@ TARGET_RECIPES = {
     # that is external to Bazel.
     "gcovr": "gcovr",
     "googletest": "googletest",
-    "gperftools": "gperftools",
+    "tcmalloc_and_profiler": "gperftools",
     "http_parser": "http-parser",
     "lightstep": "lightstep",
     "nghttp2": "nghttp2",
diff --git a/ci/prebuilt/BUILD b/ci/prebuilt/BUILD
index 1fae694e09672..fa02d6a4a5bee 100644
--- a/ci/prebuilt/BUILD
+++ b/ci/prebuilt/BUILD
@@ -106,3 +106,10 @@ cc_library(
     hdrs = glob(["thirdparty/tclap-1.2.1/include/**/*.h"]),
     includes = ["thirdparty/tclap-1.2.1/include"],
 )
+
+cc_library(
+    name = "tcmalloc_and_profiler",
+    srcs = ["thirdparty_build/lib/libtcmalloc_and_profiler.a"],
+    hdrs = glob(["thirdparty_build/include/gperftools/**/*.h"]),
+    strip_include_prefix = "thirdparty_build/include",
+)
diff --git a/source/common/memory/BUILD b/source/common/memory/BUILD
index a004b3fd4012c..e9a5b2550e48d 100644
--- a/source/common/memory/BUILD
+++ b/source/common/memory/BUILD
@@ -6,4 +6,5 @@ envoy_cc_library(
     name = "stats_lib",
     srcs = ["stats.cc"],
     hdrs = ["stats.h"],
+    tcmalloc_dep = 1,
 )
diff --git a/source/common/profiler/BUILD b/source/common/profiler/BUILD
index 2e4c2df25e74b..1e81fae9d3b72 100644
--- a/source/common/profiler/BUILD
+++ b/source/common/profiler/BUILD
@@ -6,4 +6,5 @@ envoy_cc_library(
     name = "profiler_lib",
     srcs = ["profiler.cc"],
     hdrs = ["profiler.h"],
+    tcmalloc_dep = 1,
 )
diff --git a/tools/bazel.rc b/tools/bazel.rc
index b82582678dcac..0d29ea903ec6d 100644
--- a/tools/bazel.rc
+++ b/tools/bazel.rc
@@ -3,3 +3,4 @@
 build:asan --copt -fsanitize=address
 build:asan --linkopt -fsanitize=address
 build:asan --linkopt -ldl
+build:asan --define tcmalloc=disabled