diff --git a/.bazelrc b/.bazelrc
index 2c12247f25f..f77abf6d4ea 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,13 +14,17 @@ build:remote --remote_timeout=7200
 # ========================================
 
 # Enable libc++ and C++20 by default.
-build:linux --config=clang-local
+build:linux --config=clang
 
 # put /usr/local/bin before /usr/bin to avoid picking up wrong python3.6 when building envoy.tls.key_providers.cryptomb
-build:linux --action_env=PATH=/usr/lib/llvm/bin:/usr/local/bin:/bin:/usr/bin
+build:linux --action_env=PATH=/usr/local/bin:/bin:/usr/bin
 
 # Need for CI image to pickup docker-credential-gcloud, PATH is fixed in rbe-toolchain-* configs.
 build:remote-ci --action_env=PATH=/usr/local/google-cloud-sdk/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/llvm/bin
+# These flags reduce bazel memory consumption at the cost of slower incremental builds
+# CI builds are not incremental, since we build with a clean state, so the performance impact is not
+# relevant for CI
+build:remote-ci --discard_analysis_cache --nokeep_state_after_build --notrack_incremental_state
 
 # Enable path normalization by default.
 # See: https://github.com/envoyproxy/envoy/pull/6519
@@ -50,9 +54,6 @@ build:debug -c dbg
 build --cxxopt -Wformat
 build --cxxopt -Wformat-security
 
-build:clang --host_action_env=CC=
-build:clang --host_action_env=CXX=
-
 # CI sanitizer configuration
 #
 build:clang-asan-ci --config=asan
diff --git a/WORKSPACE b/WORKSPACE
index 5668d248e92..94342387773 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-12-02
-ENVOY_SHA = "44b00e0264cfcdbbc593998a407b3f957ec28c77"
+# Commit date: 2025-12-12
+ENVOY_SHA = "8af856ea730c1738cd9e4b8db7d439bdbb121bd1"
 
-ENVOY_SHA256 = "1c8bc33cf9b758604042212d69d8bc37f41991facc43ed139d070b6b94aeddb0"
+ENVOY_SHA256 = "3c178d4d8178455264080e9ded92881cfb2c521d2e2acff33ddfb0827a0471f9"
 
 ENVOY_ORG = "envoyproxy"
 
@@ -64,7 +64,10 @@ envoy_bazel_dependencies()
 
 load("@envoy//bazel:repositories_extra.bzl", "envoy_dependencies_extra")
 
-envoy_dependencies_extra(ignore_root_user_error = True)
+envoy_dependencies_extra(
+    glibc_version = "2.28",
+    ignore_root_user_error = True,
+)
 
 load("@envoy//bazel:python_dependencies.bzl", "envoy_python_dependencies")
 
@@ -85,3 +88,7 @@ envoy_repo()
 load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
 
 envoy_toolchains()
+
+load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
+
+llvm_register_toolchains()
diff --git a/envoy.bazelrc b/envoy.bazelrc
index bced9359e23..a3a991e8b8d 100644
--- a/envoy.bazelrc
+++ b/envoy.bazelrc
@@ -11,7 +11,7 @@
 # The number 3G is chosen heuristically to both support large VM and small VM with RBE.
 # Startup options cannot be selected via config.
 # TODO: Adding just to test android
-startup --host_jvm_args=-Xmx3g
+startup --host_jvm_args=-Xmx4g
 startup --host_jvm_args="-DBAZEL_TRACK_SOURCE_DIRECTORIES=1"
 
 
@@ -45,12 +45,6 @@ build --incompatible_merge_fixed_and_default_shell_env
 # A workaround for slow ICU download.
 build --http_timeout_scaling=6.0
 
-# Pass CC, CXX and LLVM_CONFIG variables from the environment.
-# We assume they have stable values, so this won't cause action cache misses.
-build --action_env=CC --host_action_env=CC
-build --action_env=CXX --host_action_env=CXX
-build --action_env=LLVM_CONFIG --host_action_env=LLVM_CONFIG
-
 # Allow stamped caches to bust when local filesystem changes.
 # Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
 build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
@@ -99,7 +93,6 @@ build:linux --cxxopt=-fsized-deallocation --host_cxxopt=-fsized-deallocation
 build:linux --conlyopt=-fexceptions
 build:linux --fission=dbg,opt
 build:linux --features=per_object_debug_info
-build:linux --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold
 
 # macOS
 build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
@@ -114,15 +107,14 @@ build:macos --cxxopt=-Wno-nullability-completeness
 
 # Common flags for Clang (shared between all clang variants)
 common:clang-common --linkopt=-fuse-ld=lld
-common:clang-common --action_env=BAZEL_COMPILER=clang
-common:clang-common --action_env=LDFLAGS="-fuse-ld=lld"
-common:clang-common --action_env=CC=clang --host_action_env=CC=clang
-common:clang-common --action_env=CXX=clang++ --host_action_env=CXX=clang++
+common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
+common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false
 
 # Clang with libc++ (default)
 common:clang --config=clang-common
 common:clang --config=libc++
 common:clang --host_platform=@clang_platform
+common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 # Clang installed to non-standard location (ie not /opt/llvm/)
 common:clang-local --config=clang-common