diff --git a/WORKSPACE b/WORKSPACE
index 06f9612f9d5..f25385eb3b6 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -37,7 +37,7 @@ bind(
     actual = "//external:ssl",
 )
 
-ENVOY_SHA = "6cb0983a1ce74c55aaf0124bd2227be8f9efa2de"  # Sep 26, 2017 (use github to download tclap instead of sourceforge)
+ENVOY_SHA = "8ff8c57b82ee42a3534093c53f80051516cb3c03"  # Oct 24, 2017
 
 http_archive(
     name = "envoy",
@@ -47,7 +47,17 @@ http_archive(
 
 load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
 
-envoy_dependencies()
+envoy_dependencies(repository="@envoy")
+
+bind(
+    name = "cc_wkt_protos",
+    actual = "@com_google_protobuf_cc//:cc_wkt_protos",
+)
+
+bind(
+    name = "cc_wkt_protos_genproto",
+    actual = "@com_google_protobuf_cc//:cc_wkt_protos_genproto",
+)
 
 load("@envoy//bazel:cc_configure.bzl", "cc_configure")
 
diff --git a/src/envoy/auth/integration_test/http_filter_integration_test.cc b/src/envoy/auth/integration_test/http_filter_integration_test.cc
index abbcbd6ad41..891027257d3 100644
--- a/src/envoy/auth/integration_test/http_filter_integration_test.cc
+++ b/src/envoy/auth/integration_test/http_filter_integration_test.cc
@@ -74,11 +74,13 @@ class JwtVerificationFilterIntegrationTest
       const Http::HeaderMap& headers) {
     std::map<std::string, std::string> ret;
     headers.iterate(
-        [](const Http::HeaderEntry& entry, void* context) -> void {
+        [](const Http::HeaderEntry& entry,
+           void* context) -> Http::HeaderMap::Iterate {
           auto ret = static_cast<std::map<std::string, std::string>*>(context);
           Http::LowerCaseString lower_key{entry.key().c_str()};
           (*ret)[std::string(lower_key.get())] =
               std::string(entry.value().c_str());
+          return Http::HeaderMap::Iterate::Continue;
         },
         &ret);
     return ret;
@@ -122,7 +124,8 @@ class JwtVerificationFilterIntegrationTest
 
     fake_upstream_connection_issuer =
         fake_upstreams_[1]->waitForHttpConnection(*dispatcher_);
-    request_stream_issuer = fake_upstream_connection_issuer->waitForNewStream();
+    request_stream_issuer =
+        fake_upstream_connection_issuer->waitForNewStream(*dispatcher_);
     request_stream_issuer->waitForEndStream(*dispatcher_);
 
     // Mock a response from an issuer server.
@@ -140,7 +143,7 @@ class JwtVerificationFilterIntegrationTest
       fake_upstream_connection_backend =
           fake_upstreams_[0]->waitForHttpConnection(*dispatcher_);
       request_stream_backend =
-          fake_upstream_connection_backend->waitForNewStream();
+          fake_upstream_connection_backend->waitForNewStream(*dispatcher_);
       request_stream_backend->waitForEndStream(*dispatcher_);
 
       EXPECT_TRUE(request_stream_backend->complete());
diff --git a/src/envoy/mixer/BUILD b/src/envoy/mixer/BUILD
index 31e597e4dd7..768836183ab 100644
--- a/src/envoy/mixer/BUILD
+++ b/src/envoy/mixer/BUILD
@@ -16,7 +16,6 @@
 #
 
 load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
-load("@protobuf_bzl//:protobuf.bzl", "cc_proto_library")
 load(
     "@envoy//bazel:envoy_build_system.bzl",
     "envoy_proto_library",
@@ -26,13 +25,9 @@ load(
     "envoy_linkopts",
 )
 
-cc_proto_library(
+envoy_proto_library(
     name = "string_map_proto",
     srcs = ["string_map.proto"],
-    default_runtime = "//external:protobuf",
-    linkstatic = 1,
-    protoc = "//external:protoc",
-    visibility = ["//visibility:public"],
 )
 
 envoy_cc_library(
@@ -77,7 +72,6 @@ envoy_cc_library(
     deps = [
         ":string_map_proto",
         "//external:mixer_client_lib",
-        "@envoy//source/common/grpc:rpc_channel_lib",
         "@envoy//source/exe:envoy_common_lib",
     ],
 )
diff --git a/src/envoy/mixer/grpc_transport.cc b/src/envoy/mixer/grpc_transport.cc
index b7226d6ed8e..455f947b959 100644
--- a/src/envoy/mixer/grpc_transport.cc
+++ b/src/envoy/mixer/grpc_transport.cc
@@ -59,7 +59,7 @@ GrpcTransport<RequestType, ResponseType>::GrpcTransport(
       response_(response),
       on_done_(on_done),
       request_(async_client_->send(
-          descriptor(), request, *this,
+          descriptor(), request, *this, Tracing::NullSpan::instance(),
           Optional<std::chrono::milliseconds>(kGrpcRequestTimeoutMs))) {
   ENVOY_LOG(debug, "Sending {} request: {}", descriptor().name(),
             request.DebugString());
@@ -83,7 +83,7 @@ void GrpcTransport<RequestType, ResponseType>::onCreateInitialMetadata(
 
 template <class RequestType, class ResponseType>
 void GrpcTransport<RequestType, ResponseType>::onSuccess(
-    std::unique_ptr<ResponseType>&& response) {
+    std::unique_ptr<ResponseType>&& response, Tracing::Span&) {
   ENVOY_LOG(debug, "{} response: {}", descriptor().name(),
             response->DebugString());
   response->Swap(response_);
@@ -93,7 +93,8 @@ void GrpcTransport<RequestType, ResponseType>::onSuccess(
 
 template <class RequestType, class ResponseType>
 void GrpcTransport<RequestType, ResponseType>::onFailure(
-    Grpc::Status::GrpcStatus status, const std::string& message) {
+    Grpc::Status::GrpcStatus status, const std::string& message,
+    Tracing::Span&) {
   ENVOY_LOG(debug, "{} failed with code: {}, {}", descriptor().name(), status,
             message);
   on_done_(Status(static_cast<StatusCode>(status), message));
diff --git a/src/envoy/mixer/grpc_transport.h b/src/envoy/mixer/grpc_transport.h
index b7d821847ac..207e7ed868d 100644
--- a/src/envoy/mixer/grpc_transport.h
+++ b/src/envoy/mixer/grpc_transport.h
@@ -21,7 +21,6 @@
 #include "common/common/logger.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/grpc/async_client.h"
-#include "envoy/grpc/rpc_channel.h"
 
 #include "envoy/upstream/cluster_manager.h"
 #include "include/client.h"
@@ -53,10 +52,11 @@ class GrpcTransport : public Grpc::AsyncRequestCallbacks<ResponseType>,
   // Grpc::AsyncRequestCallbacks<ResponseType>
   void onCreateInitialMetadata(Http::HeaderMap& metadata) override;
 
-  void onSuccess(std::unique_ptr<ResponseType>&& response) override;
+  void onSuccess(std::unique_ptr<ResponseType>&& response,
+                 Tracing::Span& span) override;
 
-  void onFailure(Grpc::Status::GrpcStatus status,
-                 const std::string& message) override;
+  void onFailure(Grpc::Status::GrpcStatus status, const std::string& message,
+                 Tracing::Span& span) override;
 
  private:
   static const google::protobuf::MethodDescriptor& descriptor();
diff --git a/src/envoy/mixer/mixer_control.cc b/src/envoy/mixer/mixer_control.cc
index f56b2b98eac..9daf25a94e4 100644
--- a/src/envoy/mixer/mixer_control.cc
+++ b/src/envoy/mixer/mixer_control.cc
@@ -125,10 +125,11 @@ void SetInt64Attribute(const std::string& name, uint64_t value,
 std::map<std::string, std::string> ExtractHeaders(const HeaderMap& header_map) {
   std::map<std::string, std::string> headers;
   header_map.iterate(
-      [](const HeaderEntry& header, void* context) {
+      [](const HeaderEntry& header, void* context) -> HeaderMap::Iterate {
         std::map<std::string, std::string>* header_map =
             static_cast<std::map<std::string, std::string>*>(context);
         (*header_map)[header.key().c_str()] = header.value().c_str();
+        return HeaderMap::Iterate::Continue;
       },
       &headers);
   return headers;
diff --git a/src/envoy/mixer/repositories.bzl b/src/envoy/mixer/repositories.bzl
index dbe50cbeb31..c1359b63a63 100644
--- a/src/envoy/mixer/repositories.bzl
+++ b/src/envoy/mixer/repositories.bzl
@@ -15,7 +15,7 @@
 ################################################################################
 #
 
-MIXER_CLIENT = "1291823457147c2c8f50d1770f1571f7e14f63a2"
+MIXER_CLIENT = "24ceb040f516279dfd56879608b68564a9ef5422"
 
 def mixer_client_repositories(bind=True):
     native.git_repository(