diff --git a/build_container/build_container_windows.ps1 b/build_container/build_container_windows.ps1
index e986e6a7..8669239f 100644
--- a/build_container/build_container_windows.ps1
+++ b/build_container/build_container_windows.ps1
@@ -55,10 +55,10 @@ DownloadAndCheck C:\tools\bazel\bazel.exe `
 AddToPath C:\tools\bazel
 
 # VS 2019 Build Tools
-# Pinned to version downloaded on 5/9/2020 via https://aka.ms/vs/16/release/vs_buildtools.exe
+# Pinned to version downloaded on 6/3/2020 via https://aka.ms/vs/16/release/vs_buildtools.exe
 DownloadAndCheck $env:TEMP\vs_buildtools.exe `
-                 https://download.visualstudio.microsoft.com/download/pr/ac28b571-7709-4635-83d0-6277d6102ecb/ae0caec52ee10d6efc9b855bec5b934cf8054a638e08372e0de4f6351a25ea5d/vs_BuildTools.exe `
-                 ae0caec52ee10d6efc9b855bec5b934cf8054a638e08372e0de4f6351a25ea5d
+                 https://download.visualstudio.microsoft.com/download/pr/17a0244e-301e-4801-a919-f630bc21177d/9821a63671d5768de1920147a2637f0e079c3b1804266c1383f61bb95e2cc18b/vs_BuildTools.exe `
+                 9821a63671d5768de1920147a2637f0e079c3b1804266c1383f61bb95e2cc18b
 echo @"
 {
   "version": "1.0",
diff --git a/toolchains/rbe_toolchains_config.bzl b/toolchains/rbe_toolchains_config.bzl
index 7e827e4a..01b1d7db 100644
--- a/toolchains/rbe_toolchains_config.bzl
+++ b/toolchains/rbe_toolchains_config.bzl
@@ -5,6 +5,8 @@ load("@envoy_build_tools//toolchains:configs/windows/versions.bzl", _generated_t
 
 _ENVOY_BUILD_IMAGE_REGISTRY = "gcr.io"
 
+_ENVOY_BUILD_IMAGE_TAG = "12b3d2c2ffa582507e5d6dd34632b2b990f1b195"
+
 _ENVOY_BUILD_IMAGE_REPOSITORY_LINUX = "envoy-ci/envoy-build"
 _ENVOY_BUILD_IMAGE_DIGEST_LINUX = "sha256:151854af4b9da07f1384c2d5a157bee4a3b5d9d5ce40c978a94ffc426990830e"
 _CONFIGS_OUTPUT_BASE_LINUX = "toolchains/configs/linux"
diff --git a/toolchains/regenerate.sh b/toolchains/regenerate.sh
index 9d4e3e4d..aa635770 100755
--- a/toolchains/regenerate.sh
+++ b/toolchains/regenerate.sh
@@ -12,10 +12,16 @@ if ! docker pull ${DOCKER_IMAGE}; then
   exit 0
 fi
 
+# If we are committing changes, pull before modifying to ensure no conflicts
+if [[ "true" == "${COMMIT_TOOLCHAINS}" ]]; then
+  git pull origin refs/heads/master --ff-only
+fi
+
 UCASE_OS_FAMILY=`echo ${OS_FAMILY} | tr "[:lower:]" "[:upper:]"`
 DOCKER_REPODIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ${DOCKER_IMAGE} | grep -oE 'sha256:[0-9a-f]{64}')
 
 sed -i -E "s#(_ENVOY_BUILD_IMAGE_DIGEST_${UCASE_OS_FAMILY} =) \"sha256:[0-9a-f]{64}\"#\1 \"${DOCKER_REPODIGEST}\"#" toolchains/rbe_toolchains_config.bzl
+sed -i -E "s#(_ENVOY_BUILD_IMAGE_TAG =) \"[0-9a-f]{40}\"#\1 \"${CONTAINER_TAG}\"#" toolchains/rbe_toolchains_config.bzl
 
 mkdir -p "${RBE_AUTOCONF_ROOT}/toolchains/configs/${OS_FAMILY}"
 rm -rf "${RBE_AUTOCONF_ROOT}/toolchains/configs/${OS_FAMILY}/*"
@@ -47,8 +53,6 @@ if [[ -z "$(git diff HEAD --name-only)" ]]; then
 fi
 
 if [[ "true" == "${COMMIT_TOOLCHAINS}" ]]; then
-  git pull origin refs/heads/master --ff-only
-
   COMMIT_MSG="Regenerate ${OS_FAMILY} toolchains from $(git rev-parse HEAD)
 
   [skip ci]