diff --git a/.bazelrc b/.bazelrc
index 2c12247f25f..2414b9cdf51 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,7 +14,8 @@ build:remote --remote_timeout=7200
 # ========================================
 
 # Enable libc++ and C++20 by default.
-build:linux --config=clang-local
+build --repo_env=BAZEL_LLVM_PATH=/usr/lib/llvm
+build:linux --config=clang
 
 # put /usr/local/bin before /usr/bin to avoid picking up wrong python3.6 when building envoy.tls.key_providers.cryptomb
 build:linux --action_env=PATH=/usr/lib/llvm/bin:/usr/local/bin:/bin:/usr/bin
@@ -50,15 +51,16 @@ build:debug -c dbg
 build --cxxopt -Wformat
 build --cxxopt -Wformat-security
 
-build:clang --host_action_env=CC=
-build:clang --host_action_env=CXX=
+# build:clang --host_action_env=CC=
+# build:clang --host_action_env=CXX=
 
 # CI sanitizer configuration
 #
+build:clang-asan-ci --config=clang
 build:clang-asan-ci --config=asan
 build:clang-asan-ci --linkopt='-L/usr/lib/llvm/lib/x86_64-unknown-linux-gnu'
 build:clang-asan-ci --linkopt='-Wl,-rpath,/usr/lib/llvm/lib/x86_64-unknown-linux-gnu'
-build:clang-asan-ci --linkopt='-L/usr/lib/llvm/lib/clang/14.0.0/lib/x86_64-unknown-linux-gnu'
+build:clang-asan-ci --linkopt='-L/usr/lib/llvm/lib/clang/18/lib/x86_64-unknown-linux-gnu'
 
 build:clang-tsan-ci --config=tsan
 build:clang-tsan-ci --linkopt=-L/opt/libcxx_tsan/lib
diff --git a/Makefile.core.mk b/Makefile.core.mk
index a8d71344ac5..f0a436475b1 100644
--- a/Makefile.core.mk
+++ b/Makefile.core.mk
@@ -53,7 +53,7 @@ TEST_ENVOY_TARGET ?= //:envoy
 TEST_ENVOY_DEBUG ?= trace
 
 build:
-	bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) $(BAZEL_CONFIG_CURRENT) -- $(BAZEL_TARGETS)
+	bazel $(BAZEL_STARTUP_ARGS) build --config=clang $(BAZEL_BUILD_ARGS) $(BAZEL_CONFIG_CURRENT) -- $(BAZEL_TARGETS)
 
 build_envoy: BAZEL_CONFIG_CURRENT = $(BAZEL_CONFIG_REL)
 build_envoy: BAZEL_TARGETS = //:envoy
diff --git a/WORKSPACE b/WORKSPACE
index 5668d248e92..1dd62647ec8 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-12-02
-ENVOY_SHA = "44b00e0264cfcdbbc593998a407b3f957ec28c77"
+# Commit date: 2025-12-05
+ENVOY_SHA = "df7ddf53f997efd9e080f5940bd996ee9827405b"
 
-ENVOY_SHA256 = "1c8bc33cf9b758604042212d69d8bc37f41991facc43ed139d070b6b94aeddb0"
+ENVOY_SHA256 = "481954044392c767e58b5971f3f0e53baa1707b62f20fca63794fefd279b9c90"
 
 ENVOY_ORG = "envoyproxy"
 
@@ -70,10 +70,6 @@ load("@envoy//bazel:python_dependencies.bzl", "envoy_python_dependencies")
 
 envoy_python_dependencies()
 
-load("@base_pip3//:requirements.bzl", "install_deps")
-
-install_deps()
-
 load("@envoy//bazel:dependency_imports.bzl", "envoy_dependency_imports")
 
 envoy_dependency_imports()
@@ -82,6 +78,32 @@ load("@envoy//bazel:repo.bzl", "envoy_repo")
 
 envoy_repo()
 
-load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
+# load("@envoy//bazel:toolchains.bzl", "envoy_toolchains")
+
+# envoy_toolchains()
+
+# this's workaround for use local LLVM toolchain
+load("@envoy_repo//:compiler.bzl", "LLVM_PATH")
+load("@envoy_toolshed//repository:utils.bzl", "arch_alias")
+load("@toolchains_llvm//toolchain:rules.bzl", "llvm_toolchain")
+
+# register_toolchains("@envoy//bazel/rbe/toolchains/configs/linux/gcc/config:cc-toolchain")
+
+arch_alias(
+    name = "clang_platform",
+    aliases = {
+        "amd64": "@envoy//bazel/platforms/rbe:linux_x64",
+        "aarch64": "@envoy//bazel/platforms/rbe:linux_arm64",
+    },
+)
+
+llvm_toolchain(
+    name = "llvm_toolchain",
+    cxx_standard = {"": "c++20"},
+    llvm_version = "18.1.8",
+    toolchain_roots = {"": "/usr/lib/llvm"}
+)
+
+load("@llvm_toolchain//:toolchains.bzl", "llvm_register_toolchains")
 
-envoy_toolchains()
+llvm_register_toolchains()
diff --git a/envoy.bazelrc b/envoy.bazelrc
index bced9359e23..4fa35b1474a 100644
--- a/envoy.bazelrc
+++ b/envoy.bazelrc
@@ -45,12 +45,6 @@ build --incompatible_merge_fixed_and_default_shell_env
 # A workaround for slow ICU download.
 build --http_timeout_scaling=6.0
 
-# Pass CC, CXX and LLVM_CONFIG variables from the environment.
-# We assume they have stable values, so this won't cause action cache misses.
-build --action_env=CC --host_action_env=CC
-build --action_env=CXX --host_action_env=CXX
-build --action_env=LLVM_CONFIG --host_action_env=LLVM_CONFIG
-
 # Allow stamped caches to bust when local filesystem changes.
 # Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
 build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
@@ -99,13 +93,14 @@ build:linux --cxxopt=-fsized-deallocation --host_cxxopt=-fsized-deallocation
 build:linux --conlyopt=-fexceptions
 build:linux --fission=dbg,opt
 build:linux --features=per_object_debug_info
-build:linux --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold
 
 # macOS
 build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --host_action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --define tcmalloc=disabled
 build:macos --cxxopt=-Wno-nullability-completeness
+build:macos --@toolchains_llvm//toolchain/config:compiler-rt=false
+build:macos --@toolchains_llvm//toolchain/config:libunwind=false
 
 
 #############################################################################
@@ -114,15 +109,14 @@ build:macos --cxxopt=-Wno-nullability-completeness
 
 # Common flags for Clang (shared between all clang variants)
 common:clang-common --linkopt=-fuse-ld=lld
-common:clang-common --action_env=BAZEL_COMPILER=clang
-common:clang-common --action_env=LDFLAGS="-fuse-ld=lld"
-common:clang-common --action_env=CC=clang --host_action_env=CC=clang
-common:clang-common --action_env=CXX=clang++ --host_action_env=CXX=clang++
+common:clang-common --@toolchains_llvm//toolchain/config:compiler-rt=false
+common:clang-common --@toolchains_llvm//toolchain/config:libunwind=false
 
 # Clang with libc++ (default)
 common:clang --config=clang-common
 common:clang --config=libc++
 common:clang --host_platform=@clang_platform
+common:clang --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 
 # Clang installed to non-standard location (ie not /opt/llvm/)
 common:clang-local --config=clang-common
@@ -147,6 +141,8 @@ build:gcc --cxxopt=-Wno-dangling-reference
 build:gcc --cxxopt=-Wno-nonnull-compare
 build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
 build:gcc --host_platform=@envoy//bazel/rbe/toolchains:rbe_linux_gcc_platform
+build:gcc --linkopt=-fuse-ld=gold --host_linkopt=-fuse-ld=gold
+build:gcc --action_env=BAZEL_LINKOPTS=-lm:-fuse-ld=gold
 
 # libc++ - default for clang
 common:libc++ --action_env=CXXFLAGS=-stdlib=libc++
@@ -395,6 +391,9 @@ build:remote --strategy=Javac=remote,sandboxed,local
 build:remote --strategy=Closure=remote,sandboxed,local
 build:remote --strategy=Genrule=remote,sandboxed,local
 build:remote --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
+# This flag may be more generally useful - it sets foreign_cc builds -jauto.
+# It is only set here because if it were the default it risks OOMing on local builds.
+build:remote --@envoy//bazel/foreign_cc:parallel_builds
 
 ## RBE (Engflow Envoy)
 
diff --git a/scripts/release-binary.sh b/scripts/release-binary.sh
index b2419a6407e..274b0cc5691 100755
--- a/scripts/release-binary.sh
+++ b/scripts/release-binary.sh
@@ -124,6 +124,9 @@ do
       BAZEL_OUT="$(bazel info ${BAZEL_BUILD_ARGS} output_path)/${ARCH_NAME}-opt/bin"
       ;;
     "asan")
+        echo "ASAN RELEASE TEST"
+        cat WORKSPACE
+
       # Asan is skipped on ARM64
       if [[ "$(uname -m)" != "aarch64" ]]; then
         # NOTE: libc++ is dynamically linked in this build.