diff --git a/.bazelrc b/.bazelrc
index 3f5539fea9f6..12682a9881d5 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -374,7 +374,7 @@ build:compile-time-options --@envoy//source/extensions/filters/http/kill_request
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:246094216be818bc56f1f7f30d3c08b5209ab125@sha256:551e17bd99f7c889e35317d46f7a047e777addb0398f8434a0d80e5f0955acd0
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:b3e896d5f17dd2b3fb6d66436c3c4bcf3a6e6186@sha256:be5632275fb957cc0f56a0a2e9a3c99d4533fb9d7caaa4e9f3f47dfec0c12e21
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker
@@ -543,7 +543,7 @@ common:bes-envoy-engflow --bes_timeout=3600s
 common:bes-envoy-engflow --bes_upload_mode=fully_async
 common:bes-envoy-engflow --nolegacy_important_outputs
 common:rbe-envoy-engflow --remote_executor=grpcs://mordenite.cluster.engflow.com
-common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:12f8590ef6a4b7c1780f8b41e2b80f460b0129597e4a9ec39fbee33fbbddc4da
+common:rbe-envoy-engflow --remote_default_exec_properties=container-image=docker://gcr.io/envoy-ci/envoy-build@sha256:1e7e8903c83b409fe0fd8f669adf9ff0c60d67f001fa44c6710da6b66283450b
 common:rbe-envoy-engflow --jobs=200
 common:rbe-envoy-engflow --define=engflow_rbe=true
 
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 00b43f78cda9..224f8f2a561d 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/envoy-ci/envoy-build:246094216be818bc56f1f7f30d3c08b5209ab125@sha256:12f8590ef6a4b7c1780f8b41e2b80f460b0129597e4a9ec39fbee33fbbddc4da
+FROM gcr.io/envoy-ci/envoy-build:b3e896d5f17dd2b3fb6d66436c3c4bcf3a6e6186@sha256:1e7e8903c83b409fe0fd8f669adf9ff0c60d67f001fa44c6710da6b66283450b
 
 ARG USERNAME=vscode
 ARG USER_UID=501
diff --git a/.github/config.yml b/.github/config.yml
index 35aaaad7c093..23dc77a31436 100644
--- a/.github/config.yml
+++ b/.github/config.yml
@@ -2,11 +2,11 @@ agent-ubuntu: ubuntu-24.04
 build-image:
   # Authoritative configuration for build image/s
   repo: envoyproxy/envoy-build-ubuntu
-  sha: 551e17bd99f7c889e35317d46f7a047e777addb0398f8434a0d80e5f0955acd0
-  mobile-sha: 2e3102ce8265c85f1d57c5838a4343e6b27cc6d448df2423b6e33d6bdd0f2e45
+  sha: be5632275fb957cc0f56a0a2e9a3c99d4533fb9d7caaa4e9f3f47dfec0c12e21
+  mobile-sha: 66d5f0bdd55b855ddab436b743cc515d7b20a2419300782fb8e4852c8ea4b6bb
   # this is authoritative, but is not currently used in github ci
-  gcr-sha: 12f8590ef6a4b7c1780f8b41e2b80f460b0129597e4a9ec39fbee33fbbddc4da
-  tag: 246094216be818bc56f1f7f30d3c08b5209ab125
+  gcr-sha: 1e7e8903c83b409fe0fd8f669adf9ff0c60d67f001fa44c6710da6b66283450b
+  tag: b3e896d5f17dd2b3fb6d66436c3c4bcf3a6e6186
 
 config:
   envoy:
diff --git a/bazel/rbe/toolchains/configs/linux/clang/config/BUILD b/bazel/rbe/toolchains/configs/linux/clang/config/BUILD
index 5c3fe58b2e3d..16bb6dfe7d2a 100755
--- a/bazel/rbe/toolchains/configs/linux/clang/config/BUILD
+++ b/bazel/rbe/toolchains/configs/linux/clang/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:12f8590ef6a4b7c1780f8b41e2b80f460b0129597e4a9ec39fbee33fbbddc4da",
+        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:1e7e8903c83b409fe0fd8f669adf9ff0c60d67f001fa44c6710da6b66283450b",
         "OSFamily": "Linux",
     },
     parents = ["@local_config_platform//:host"],
diff --git a/bazel/rbe/toolchains/configs/linux/clang_libcxx/config/BUILD b/bazel/rbe/toolchains/configs/linux/clang_libcxx/config/BUILD
index 1786fff8f68e..6d5a93b9ab98 100755
--- a/bazel/rbe/toolchains/configs/linux/clang_libcxx/config/BUILD
+++ b/bazel/rbe/toolchains/configs/linux/clang_libcxx/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:12f8590ef6a4b7c1780f8b41e2b80f460b0129597e4a9ec39fbee33fbbddc4da",
+        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:1e7e8903c83b409fe0fd8f669adf9ff0c60d67f001fa44c6710da6b66283450b",
         "OSFamily": "Linux",
     },
     parents = ["@local_config_platform//:host"],
diff --git a/bazel/rbe/toolchains/configs/linux/gcc/config/BUILD b/bazel/rbe/toolchains/configs/linux/gcc/config/BUILD
index 7c53503b9936..ed3fbc8bb3e5 100755
--- a/bazel/rbe/toolchains/configs/linux/gcc/config/BUILD
+++ b/bazel/rbe/toolchains/configs/linux/gcc/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:12f8590ef6a4b7c1780f8b41e2b80f460b0129597e4a9ec39fbee33fbbddc4da",
+        "container-image": "docker://gcr.io/envoy-ci/envoy-build@sha256:1e7e8903c83b409fe0fd8f669adf9ff0c60d67f001fa44c6710da6b66283450b",
         "OSFamily": "Linux",
     },
     parents = ["@local_config_platform//:host"],
diff --git a/mobile/third_party/rbe_configs/config/BUILD b/mobile/third_party/rbe_configs/config/BUILD
index 3d1c7ac718de..1de0cc37bd5a 100644
--- a/mobile/third_party/rbe_configs/config/BUILD
+++ b/mobile/third_party/rbe_configs/config/BUILD
@@ -42,7 +42,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://envoyproxy/envoy-build-ubuntu:mobile-246094216be818bc56f1f7f30d3c08b5209ab125@sha256:2e3102ce8265c85f1d57c5838a4343e6b27cc6d448df2423b6e33d6bdd0f2e45",
+        "container-image": "docker://envoyproxy/envoy-build-ubuntu:mobile-b3e896d5f17dd2b3fb6d66436c3c4bcf3a6e6186@sha256:66d5f0bdd55b855ddab436b743cc515d7b20a2419300782fb8e4852c8ea4b6bb",
         "OSFamily": "Linux",
         "Pool": "linux",
     },
@@ -57,7 +57,7 @@ platform(
         "@bazel_tools//tools/cpp:clang",
     ],
     exec_properties = {
-        "container-image": "docker://envoyproxy/envoy-build-ubuntu:mobile-246094216be818bc56f1f7f30d3c08b5209ab125@sha256:2e3102ce8265c85f1d57c5838a4343e6b27cc6d448df2423b6e33d6bdd0f2e45",
+        "container-image": "docker://envoyproxy/envoy-build-ubuntu:mobile-b3e896d5f17dd2b3fb6d66436c3c4bcf3a6e6186@sha256:66d5f0bdd55b855ddab436b743cc515d7b20a2419300782fb8e4852c8ea4b6bb",
         "OSFamily": "Linux",
         "Pool": "linux",
         # Necessary to workaround https://github.com/google/sanitizers/issues/916, otherwise, dangling threads in the