diff --git a/WORKSPACE b/WORKSPACE
index 05f5e291d..2a2934da3 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -30,7 +30,7 @@ ISTIO_PROXY = "2c9c1af3d6ac5ab4d295444c30acd42599edfcb3"
 
 git_repository(
     name = "nginx",
-    commit = "cfce863dbe786e61e0e7a33376906b337da70c19",
+    commit = "1ff432d2828e6536cd50d917046b85eafc43ed71", # 1.11.9
     remote = "https://nginx.googlesource.com/nginx",
 )
 
diff --git a/src/nginx/main/testdata/copyright-expected b/src/nginx/main/testdata/copyright-expected
index 56c20ab86..c2a5bdf48 100644
--- a/src/nginx/main/testdata/copyright-expected
+++ b/src/nginx/main/testdata/copyright-expected
@@ -286,9 +286,9 @@ NGINX license:
 ==============
 
 /*
- * Copyright (C) 2002-2016 Igor Sysoev
- * Copyright (C) 2011-2016 Nginx, Inc.
- * Copyright (C) 2015-2016 Google Inc.
+ * Copyright (C) 2002-2017 Igor Sysoev
+ * Copyright (C) 2011-2017 Nginx, Inc.
+ * Copyright (C) 2015-2017 Google Inc.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/third_party/BUILD b/third_party/BUILD
index 0e66d782c..c052b5df1 100644
--- a/third_party/BUILD
+++ b/third_party/BUILD
@@ -38,6 +38,8 @@ perl_library(
 # Nginx test suite containing all of the integration tests
 # included with Nginx.
 
+# limit_req.t is excluded due to https://nginx-review.googlesource.com/#/c/2522/
+
 # ssl_sni_reneg.t is excluded from the test suite because boring ssl
 # does not support renegotiation feature required by the test.
 
@@ -46,7 +48,10 @@ nginx_suite(
     tags = ["exclusive"],
     tests = glob(
         ["nginx-tests/*.t"],
-        exclude = ["nginx-tests/ssl_sni_reneg.t"],
+        exclude = [
+            "nginx-tests/limit_req.t",
+            "nginx-tests/ssl_sni_reneg.t",
+        ],
     ),
     deps = [
         ":nginx_test",
diff --git a/third_party/nginx-tests b/third_party/nginx-tests
index 62a669ea0..d82df5645 160000
--- a/third_party/nginx-tests
+++ b/third_party/nginx-tests
@@ -1 +1 @@
-Subproject commit 62a669ea06e0140e1fb8014c9e5830691082e281
+Subproject commit d82df564586ca57405f7a65c8f4587f05d754c88