diff --git a/WORKSPACE b/WORKSPACE
index df79e1513d1..24dde36c79a 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2026-03-24
-ENVOY_SHA = "07700f6c1b5f03be0a6ebc4f4efdbb308e314e79"
+# Commit date: 2026-03-25
+ENVOY_SHA = "6874e47bb1fc2cbcdcb27c92be737152bec0bd42"
 
-ENVOY_SHA256 = "1eb0b82f54a79f28578a5b92c5aa8eb49188022b5c25490448721e4b00e4d382"
+ENVOY_SHA256 = "2eae786d6ce139b4f22a114e719ddf46507863efa832f49206546f7d8dbd1d67"
 
 ENVOY_ORG = "envoyproxy"
 
diff --git a/source/extensions/filters/http/istio_stats/istio_stats.cc b/source/extensions/filters/http/istio_stats/istio_stats.cc
index 825d8561235..bd3e2d619fd 100644
--- a/source/extensions/filters/http/istio_stats/istio_stats.cc
+++ b/source/extensions/filters/http/istio_stats/istio_stats.cc
@@ -1000,15 +1000,15 @@ class IstioStatsFilter : public Http::PassThroughFilter,
       service_host_name = "PassthroughCluster";
     } else {
       const auto cluster_info = info.upstreamClusterInfo();
-      if (cluster_info && cluster_info.value()) {
-        const auto& cluster_name = cluster_info.value()->name();
+      if (cluster_info) {
+        const auto& cluster_name = cluster_info->name();
         if (cluster_name == "BlackHoleCluster" || cluster_name == "PassthroughCluster" ||
             cluster_name == "InboundPassthroughCluster" ||
             cluster_name == "InboundPassthroughClusterIpv4" ||
             cluster_name == "InboundPassthroughClusterIpv6") {
           service_host_name = cluster_name;
         } else {
-          const auto& filter_metadata = cluster_info.value()->metadata().filter_metadata();
+          const auto& filter_metadata = cluster_info->metadata().filter_metadata();
           const auto& it = filter_metadata.find("istio");
           if (it != filter_metadata.end()) {
             const auto& services_it = it->second.fields().find("services");
diff --git a/source/extensions/filters/http/peer_metadata/filter.cc b/source/extensions/filters/http/peer_metadata/filter.cc
index 240a85142dc..e952d542db1 100644
--- a/source/extensions/filters/http/peer_metadata/filter.cc
+++ b/source/extensions/filters/http/peer_metadata/filter.cc
@@ -456,14 +456,14 @@ bool MXPropagationMethod::skipMXHeaders(const bool skip_external_clusters,
                                         const StreamInfo::StreamInfo& info) const {
   // We skip metadata in two cases.
   // 1. skip_external_clusters is enabled, and we detect the upstream as external.
-  const auto& cluster_info = info.upstreamClusterInfo();
-  if (cluster_info && cluster_info.value()) {
-    const auto& cluster_name = cluster_info.value()->name();
+  const auto cluster_info = info.upstreamClusterInfo();
+  if (cluster_info) {
+    const auto& cluster_name = cluster_info->name();
     // PassthroughCluster is always considered external
     if (skip_external_clusters && cluster_name == "PassthroughCluster") {
       return true;
     }
-    const auto& filter_metadata = cluster_info.value()->metadata().filter_metadata();
+    const auto& filter_metadata = cluster_info->metadata().filter_metadata();
     const auto& it = filter_metadata.find("istio");
     // Otherwise, cluster must be tagged as external
     if (it != filter_metadata.end()) {
diff --git a/source/extensions/filters/http/peer_metadata/filter_test.cc b/source/extensions/filters/http/peer_metadata/filter_test.cc
index dac13163b26..fb0087c7a26 100644
--- a/source/extensions/filters/http/peer_metadata/filter_test.cc
+++ b/source/extensions/filters/http/peer_metadata/filter_test.cc
@@ -581,7 +581,7 @@ TEST_F(PeerMetadataTest, UpstreamMXPropagationSkip) {
         istio:
           external: true
     )EOF");
-  ON_CALL(stream_info_, upstreamClusterInfo()).WillByDefault(testing::Return(cluster_info_));
+  stream_info_.upstream_cluster_info_ = cluster_info_;
   ON_CALL(*cluster_info_, metadata()).WillByDefault(ReturnRef(metadata));
   initialize(R"EOF(
     upstream_propagation:
@@ -598,7 +598,7 @@ TEST_F(PeerMetadataTest, UpstreamMXPropagationSkipPassthrough) {
   std::shared_ptr<Upstream::MockClusterInfo> cluster_info_{
       std::make_shared<NiceMock<Upstream::MockClusterInfo>>()};
   cluster_info_->name_ = "PassthroughCluster";
-  ON_CALL(stream_info_, upstreamClusterInfo()).WillByDefault(testing::Return(cluster_info_));
+  stream_info_.upstream_cluster_info_ = cluster_info_;
   initialize(R"EOF(
     upstream_propagation:
       - istio_headers: