diff --git a/.travis.yml b/.travis.yml
index 845ac9bbd8e..bf693c4a668 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -9,6 +9,7 @@ addons:
     packages:
     - gcc-4.9
     - g++-4.9
+    - realpath
     - wget
 
 branches:
diff --git a/Jenkinsfile b/Jenkinsfile
index 6c68a795da0..41f633decff 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,6 +1,6 @@
 #!groovy
 
-@Library('testutils@stable-3e4d089')
+@Library('testutils@stable-0ee5fd9')
 
 import org.istio.testutils.Utilities
 import org.istio.testutils.GitUtilities
@@ -33,6 +33,8 @@ def presubmit(gitUtils, bazel) {
       sh('script/check-style')
     }
     bazel.updateBazelRc()
+    // TODO(sebastienvas): Fix Jenkins to build without cleaning
+    sh('bazel clean')
     stage('Bazel Fetch') {
       bazel.fetch('-k //...')
     }
diff --git a/WORKSPACE b/WORKSPACE
index 6f387192fb9..1608142c1cf 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -45,30 +45,32 @@ load(
 
 mixer_client_repositories()
 
-# Workaround for Bazel > 0.4.0 since it needs newer protobuf.bzl from:
-# https://github.com/google/protobuf/pull/2246
-# Do not use this git_repository for anything else than protobuf.bzl
-new_git_repository(
-    name = "protobuf_bzl",
-    # Injecting an empty BUILD file to prevent using any build target
-    build_file_content = "",
-    commit = "05090726144b6e632c50f47720ff51049bfcbef6",
-    remote = "https://github.com/google/protobuf.git",
-)
-
 load(
     "@mixerclient_git//:repositories.bzl",
     "mixerapi_repositories",
 )
 
-mixerapi_repositories(protobuf_repo="@protobuf_bzl//")
+mixerapi_repositories()
 
-load(
-    "//src/envoy:repositories.bzl",
-    "envoy_repositories",
+load("//src/envoy:repositories.bzl", "lightstep_repositories")
+
+lightstep_repositories()
+
+# Bind BoringSSL for Envoy
+bind(
+    name = "ssl",
+    actual = "@boringssl//:ssl",
 )
 
-envoy_repositories()
+git_repository(
+    name = "envoy",
+    remote = "https://github.com/lyft/envoy.git",
+    commit = "060cb67f0772a425a8ceaf30d28421967d69c0c6",
+)
+
+load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
+
+envoy_dependencies(skip_targets=["googletest", "protobuf", "protoc", "lightstep", "ssl"])
 
 new_http_archive(
     name = "docker_ubuntu",
diff --git a/repositories.bzl b/repositories.bzl
index 15cc38c29ed..1d971747adc 100644
--- a/repositories.bzl
+++ b/repositories.bzl
@@ -17,7 +17,7 @@
 def boringssl_repositories(bind=True):
     native.git_repository(
         name = "boringssl",
-        commit = "12c35d69008ae6b8486e435447445240509f7662",  # 2016-10-24
+        commit = "16efcb2dba4690b9940d9b95ef703f1bbd07494d",  # 2017-03-20
         remote = "https://boringssl.googlesource.com/boringssl",
     )
 
diff --git a/src/envoy/mixer/config.h b/src/envoy/mixer/config.h
index f09f4251f45..01404955747 100644
--- a/src/envoy/mixer/config.h
+++ b/src/envoy/mixer/config.h
@@ -15,7 +15,9 @@
 
 #pragma once
 
-#include "precompiled/precompiled.h"
+#include <map>
+#include <string>
+#include <vector>
 
 #include "envoy/json/json_object.h"
 #include "include/attribute.h"
diff --git a/src/envoy/mixer/http_control.h b/src/envoy/mixer/http_control.h
index c473facef3c..f16b447cc7b 100644
--- a/src/envoy/mixer/http_control.h
+++ b/src/envoy/mixer/http_control.h
@@ -15,7 +15,7 @@
 
 #pragma once
 
-#include "precompiled/precompiled.h"
+#include <memory>
 
 #include "common/common/logger.h"
 #include "common/http/headers.h"
diff --git a/src/envoy/mixer/http_filter.cc b/src/envoy/mixer/http_filter.cc
index 9f8e4ffb75c..28894a1a9ce 100644
--- a/src/envoy/mixer/http_filter.cc
+++ b/src/envoy/mixer/http_filter.cc
@@ -13,8 +13,6 @@
  * limitations under the License.
  */
 
-#include "precompiled/precompiled.h"
-
 #include "common/common/base64.h"
 #include "common/common/logger.h"
 #include "common/http/headers.h"
diff --git a/src/envoy/mixer/utils.h b/src/envoy/mixer/utils.h
index e94ed91706c..eff9f86b8db 100644
--- a/src/envoy/mixer/utils.h
+++ b/src/envoy/mixer/utils.h
@@ -15,7 +15,8 @@
 
 #pragma once
 
-#include "precompiled/precompiled.h"
+#include <map>
+#include <string>
 
 #include "common/http/headers.h"
 #include "envoy/json/json_object.h"
diff --git a/src/envoy/repositories.bzl b/src/envoy/repositories.bzl
index 3bff4074f50..955fcbf4422 100644
--- a/src/envoy/repositories.bzl
+++ b/src/envoy/repositories.bzl
@@ -14,223 +14,6 @@
 #
 ################################################################################
 #
-
-def libevent_repositories(bind=True):
-    BUILD = """
-genrule(
-    name = "config",
-    srcs = glob([
-        "**/*",
-    ]),
-    outs = [
-        "config.h",
-    ],
-    tools = [
-        "configure",
-    ],
-    cmd = ' '.join([
-        "$(location configure) --enable-shared=no --disable-libevent-regress --disable-openssl",
-        "&& cp config.h $@",
-    ]),
-)
-
-genrule(
-    name = "event-config",
-    srcs = [
-        "config.h",
-        "make-event-config.sed",
-    ],
-    outs = [
-        "include/event2/event-config.h",
-    ],
-    cmd = "sed -f $(location make-event-config.sed) < $(location config.h) > $@",
-)
-
-event_srcs = [
-    "buffer.c",
-    "bufferevent.c",
-    "bufferevent_filter.c",
-    "bufferevent_pair.c",
-    "bufferevent_ratelim.c",
-    "bufferevent_sock.c",
-    "epoll.c",
-    "evdns.c",
-    "event.c",
-    "event_tagging.c",
-    "evmap.c",
-    "evrpc.c",
-    "evthread.c",
-    "evutil.c",
-    "evutil_rand.c",
-    "evutil_time.c",
-    "http.c",
-    "listener.c",
-    "log.c",
-    "poll.c",
-    "select.c",
-    "signal.c",
-    "strlcpy.c",
-    ":event-config",
-] + glob(["*.h"])
-
-
-event_pthread_srcs = [
-    "evthread_pthread.c",
-    ":event-config",
-]
-
-cc_library(
-    name = "event",
-    hdrs = glob(["include/**/*.h"]) + [
-        "arc4random.c",  # arc4random.c is included by evutil_rand.c
-        "bufferevent-internal.h",
-        "defer-internal.h",
-        "evbuffer-internal.h",
-        "event-internal.h",
-        "evthread-internal.h",
-        "http-internal.h",
-        "iocp-internal.h",
-        "ipv6-internal.h",
-        "log-internal.h",
-        "minheap-internal.h",
-        "mm-internal.h",
-        "strlcpy-internal.h",
-        "util-internal.h",
-        "compat/sys/queue.h",
-    ],
-    srcs = event_srcs,
-    includes = [
-        "include",
-        "compat",
-    ],
-    copts = [
-        "-w",
-        "-DHAVE_CONFIG_H",
-    ],
-    visibility = ["//visibility:public"],
-)
-
-cc_library(
-    name = "event_pthreads",
-    srcs = event_pthread_srcs + ["include/event2/thread.h"],
-    hdrs = [
-        "evthread-internal.h",
-        "compat/sys/queue.h",
-    ],
-    copts = [
-        "-w",
-        "-DHAVE_CONFIG_H",
-    ],
-    includes = [
-        "include",
-        "compat",
-    ],
-    deps = [
-        ":event",
-    ],
-    visibility = ["//visibility:public"],
-)"""
-
-    native.new_http_archive(
-        name = "libevent_git",
-        url = "https://github.com/libevent/libevent/releases/download/release-2.1.8-stable/libevent-2.1.8-stable.tar.gz",
-        strip_prefix = "libevent-2.1.8-stable",
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "event",
-            actual = "@libevent_git//:event",
-        )
-
-        native.bind(
-            name = "event_pthreads",
-            actual = "@libevent_git//:event_pthreads",
-        )
-
-
-def spdlog_repositories(bind=True):
-    BUILD = """
-package(default_visibility=["//visibility:public"])
-
-cc_library(
-    name = "spdlog",
-    hdrs = glob([
-        "include/**/*.h",
-        "include/**/*.cc",
-    ]),
-    includes = [
-        "include",
-    ],
-)"""
-
-    native.new_git_repository(
-        name = "spdlog_git",
-        remote = "https://github.com/gabime/spdlog.git",
-        commit = "1f1f6a5f3b424203a429e9cb78e6548037adefa8",
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "spdlog",
-            actual = "@spdlog_git//:spdlog",
-        )
-
-def tclap_repositories(bind=True):
-    BUILD = """
-cc_library(
-    name = "tclap",
-    hdrs = [
-        "include/tclap/Arg.h",
-        "include/tclap/ArgException.h",
-        "include/tclap/ArgTraits.h",
-        "include/tclap/CmdLine.h",
-        "include/tclap/CmdLineInterface.h",
-        "include/tclap/CmdLineOutput.h",
-        "include/tclap/Constraint.h",
-        "include/tclap/DocBookOutput.h",
-        "include/tclap/HelpVisitor.h",
-        "include/tclap/IgnoreRestVisitor.h",
-        "include/tclap/MultiArg.h",
-        "include/tclap/MultiSwitchArg.h",
-        "include/tclap/OptionalUnlabeledTracker.h",
-        "include/tclap/StandardTraits.h",
-        "include/tclap/StdOutput.h",
-        "include/tclap/SwitchArg.h",
-        "include/tclap/UnlabeledMultiArg.h",
-        "include/tclap/UnlabeledValueArg.h",
-        "include/tclap/ValueArg.h",
-        "include/tclap/ValuesConstraint.h",
-        "include/tclap/VersionVisitor.h",
-        "include/tclap/Visitor.h",
-        "include/tclap/XorHandler.h",
-        "include/tclap/ZshCompletionOutput.h",
-    ],
-    defines = [
-        "HAVE_LONG_LONG=1",
-        "HAVE_SSTREAM=1",
-    ],
-    includes = [
-        "include",
-    ],
-    visibility = ["//visibility:public"],
-)"""
-
-    native.new_http_archive(
-        name = "tclap_tar",
-        url = "https://storage.googleapis.com/istio-build-deps/tclap-1.2.1.tar.gz",
-        type = "tar.gz",
-        strip_prefix = "tclap-1.2.1",
-        build_file_content = BUILD,
-    )
-    if bind:
-        native.bind(
-            name = "tclap",
-            actual = "@tclap_tar//:tclap",
-        )
-
 def lightstep_repositories(bind=True):
     BUILD = """
 load("@protobuf_git//:protobuf.bzl", "cc_proto_library")
@@ -319,254 +102,3 @@ cc_proto_library(
             actual = "@lightstep_git//:lightstep_core",
         )
 
-def http_parser_repositories(bind=True):
-    BUILD = """
-cc_library(
-    name = "http_parser",
-    srcs = [
-        "http_parser.c",
-    ],
-    hdrs = [
-        "http_parser.h",
-    ],
-    visibility = ["//visibility:public"],
-)"""
-
-    native.new_git_repository(
-        name = "http_parser_git",
-        remote = "https://github.com/nodejs/http-parser.git",
-        commit = "9b0d5b33ebdaacff1dadd06bad4e198b11ff880e",
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "http_parser",
-            actual = "@http_parser_git//:http_parser",
-        )
-
-def rapidjson_repositories(bind=True):
-    BUILD = """
-cc_library(
-    name = "rapidjson",
-    srcs = glob([
-        "include/rapidjson/internal/*.h",
-    ]),
-    hdrs = glob([
-        "include/rapidjson/*.h",
-        "include/rapidjson/error/*.h",
-    ]),
-    includes = ["include"],
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_git_repository(
-        name = "rapidjson_git",
-        remote = "https://github.com/miloyip/rapidjson.git",
-        commit = "f54b0e47a08782a6131cc3d60f94d038fa6e0a51", # v1.1.0
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "rapidjson",
-            actual = "@rapidjson_git//:rapidjson",
-        )
-
-def nghttp2_repositories(bind=True):
-    BUILD = """
-genrule(
-    name = "config",
-    srcs = glob([
-        "**/*",
-    ]),
-    outs = [
-        "config.h",
-    ],
-    tools = [
-        "configure",
-    ],
-    cmd = ' '.join([
-        "$(location configure) --enable-lib-only --enable-shared=no",
-        "&& cp config.h $@",
-    ]),
-)
-
-cc_library(
-    name = "nghttp2",
-    srcs = glob([
-        "lib/*.c",
-        "lib/*.h",
-    ]) + ["config.h"],
-    hdrs = glob([
-        "lib/includes/nghttp2/*.h",
-    ]),
-    copts = [
-        "-DHAVE_CONFIG_H",
-        "-DBUILDING_NGHTTP2",
-        "-Iexternal/nghttp2_tar",
-    ],
-    includes = [
-        ".",
-        "lib/includes",
-    ],
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_http_archive(
-        name = "nghttp2_tar",
-        url = "https://github.com/nghttp2/nghttp2/releases/download/v1.20.0/nghttp2-1.20.0.tar.gz",
-        strip_prefix = "nghttp2-1.20.0",
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "nghttp2",
-            actual = "@nghttp2_tar//:nghttp2",
-        )
-
-def ares_repositories(bind=True):
-    BUILD = """
-cc_library(
-    name = "ares",
-    srcs = [
-        "ares__close_sockets.c",
-        "ares__get_hostent.c",
-        "ares__read_line.c",
-        "ares__timeval.c",
-        "ares_cancel.c",
-        "ares_create_query.c",
-        "ares_data.c",
-        "ares_destroy.c",
-        "ares_expand_name.c",
-        "ares_expand_string.c",
-        "ares_fds.c",
-        "ares_free_hostent.c",
-        "ares_free_string.c",
-        "ares_getenv.c",
-        "ares_gethostbyaddr.c",
-        "ares_gethostbyname.c",
-        "ares_getnameinfo.c",
-        "ares_getopt.c",
-        "ares_getsock.c",
-        "ares_init.c",
-        "ares_library_init.c",
-        "ares_llist.c",
-        "ares_mkquery.c",
-        "ares_nowarn.c",
-        "ares_options.c",
-        "ares_parse_a_reply.c",
-        "ares_parse_aaaa_reply.c",
-        "ares_parse_mx_reply.c",
-        "ares_parse_naptr_reply.c",
-        "ares_parse_ns_reply.c",
-        "ares_parse_ptr_reply.c",
-        "ares_parse_soa_reply.c",
-        "ares_parse_srv_reply.c",
-        "ares_parse_txt_reply.c",
-        "ares_platform.c",
-        "ares_process.c",
-        "ares_query.c",
-        "ares_search.c",
-        "ares_send.c",
-        "ares_strcasecmp.c",
-        "ares_strdup.c",
-        "ares_strerror.c",
-        "ares_timeout.c",
-        "ares_version.c",
-        "ares_writev.c",
-        "bitncmp.c",
-        "inet_net_pton.c",
-        "inet_ntop.c",
-        "windows_port.c",
-    ],
-    hdrs = [
-        "ares_config.h",
-        "ares.h",
-        "ares_build.h",
-        "ares_data.h",
-        "ares_dns.h",
-        "ares_getenv.h",
-        "ares_getopt.h",
-        "ares_inet_net_pton.h",
-        "ares_iphlpapi.h",
-        "ares_ipv6.h",
-        "ares_library_init.h",
-        "ares_llist.h",
-        "ares_nowarn.h",
-        "ares_platform.h",
-        "ares_private.h",
-        "ares_rules.h",
-        "ares_setup.h",
-        "ares_strcasecmp.h",
-        "ares_strdup.h",
-        "ares_version.h",
-        "ares_writev.h",
-        "bitncmp.h",
-        "nameser.h",
-        "setup_once.h",
-    ],
-    copts = [
-        "-DHAVE_CONFIG_H",
-    ],
-    includes = ["."],
-    visibility = ["//visibility:public"],
-)
-
-genrule(
-    name = "config",
-    srcs = glob(["**/*"]),
-    outs = ["ares_config.h"],
-    cmd = "pushd external/cares_git ; ./buildconf ; ./configure ; cp ares_config.h ../../$@",
-    visibility = ["//visibility:public"],
-)
-
-genrule(
-    name = "ares_build",
-    srcs = [
-        "ares_build.h.dist",
-    ],
-    outs = [
-        "ares_build.h",
-    ],
-    cmd = "cp $(SRCS) $@",
-    visibility = ["//visibility:public"],
-)
-"""
-
-    native.new_git_repository(
-        name = "cares_git",
-        remote = "https://github.com/c-ares/c-ares.git",
-        commit = "7691f773af79bf75a62d1863fd0f13ebf9dc51b1", # v1.12.0
-        build_file_content = BUILD,
-    )
-
-    if bind:
-        native.bind(
-            name = "ares",
-            actual = "@cares_git//:ares",
-        )
-
-def envoy_repositories(bind=True):
-    libevent_repositories(bind)
-    spdlog_repositories(bind)
-    tclap_repositories(bind)
-    lightstep_repositories(bind)
-    http_parser_repositories(bind)
-    rapidjson_repositories(bind)
-    nghttp2_repositories(bind)
-    ares_repositories(bind)
-    # @boringssl is defined in //:repositories.bzl, but bound to libssl for
-    # grpc. Rebind to what envoy expects here.
-    native.bind(
-        name = "ssl",
-        actual = "@boringssl//:ssl",
-    )
-    native.git_repository(
-        name = "envoy",
-        remote = "https://github.com/lyft/envoy.git",
-        commit = "bf3f23ad439ee83b91015dc4d0d7cb53b14bf1bc",
-    )
diff --git a/src/envoy/transcoding/config.cc b/src/envoy/transcoding/config.cc
index a201b2f8489..7609210fd5f 100644
--- a/src/envoy/transcoding/config.cc
+++ b/src/envoy/transcoding/config.cc
@@ -14,6 +14,8 @@
  */
 #include "src/envoy/transcoding/config.h"
 
+#include <fstream>
+
 #include "contrib/endpoints/src/grpc/transcoding/json_request_translator.h"
 #include "contrib/endpoints/src/grpc/transcoding/response_to_json_translator.h"
 #include "envoy/common/exception.h"
diff --git a/src/envoy/transcoding/config.h b/src/envoy/transcoding/config.h
index e61ed297caa..67ef3084a76 100644
--- a/src/envoy/transcoding/config.h
+++ b/src/envoy/transcoding/config.h
@@ -15,8 +15,6 @@
 
 #pragma once
 
-#include "precompiled/precompiled.h"
-
 #include "common/common/logger.h"
 #include "contrib/endpoints/src/grpc/transcoding/request_message_translator.h"
 #include "contrib/endpoints/src/grpc/transcoding/transcoder.h"
@@ -61,4 +59,4 @@ class Config : public Logger::Loggable<Logger::Id::config> {
 typedef std::shared_ptr<Config> ConfigSharedPtr;
 
 }  // namespace Transcoding
-}  // namespace Grpc
\ No newline at end of file
+}  // namespace Grpc
diff --git a/src/envoy/transcoding/envoy_input_stream.h b/src/envoy/transcoding/envoy_input_stream.h
index 3e204e21eec..c4d110ee29b 100644
--- a/src/envoy/transcoding/envoy_input_stream.h
+++ b/src/envoy/transcoding/envoy_input_stream.h
@@ -15,8 +15,6 @@
 
 #pragma once
 
-#include "precompiled/precompiled.h"
-
 #include "common/buffer/buffer_impl.h"
 #include "contrib/endpoints/src/grpc/transcoding/transcoder_input_stream.h"
 
@@ -48,4 +46,4 @@ class EnvoyInputStream
   bool finished_{false};
 };
 
-}  // namespace Grpc
\ No newline at end of file
+}  // namespace Grpc
diff --git a/src/envoy/transcoding/filter.cc b/src/envoy/transcoding/filter.cc
index 8748cddd02b..d14e8cbe4f2 100644
--- a/src/envoy/transcoding/filter.cc
+++ b/src/envoy/transcoding/filter.cc
@@ -12,8 +12,6 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-#include "precompiled/precompiled.h"
-
 #include "common/buffer/buffer_impl.h"
 #include "common/http/headers.h"
 #include "contrib/endpoints/src/grpc/transcoding/json_request_translator.h"