diff --git a/ci/README.md b/ci/README.md
index 34eb652ad476d..49f865d663e09 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -4,7 +4,7 @@ Two flavors of Envoy Docker images, based on Ubuntu and Alpine Linux, are built.
 
 ## Ubuntu envoy image
 The Ubuntu based Envoy Docker image at [`lyft/envoy-build:<hash>`](https://hub.docker.com/r/lyft/envoy-build/) is used for Travis CI checks,
-where `<hash>` is specified in [ci_steps.sh](https://github.com/lyft/envoy/blob/master/ci/ci_steps.sh). Developers
+where `<hash>` is specified in [`envoy_build_sha.sh`](https://github.com/lyft/envoy/blob/master/ci/envoy_build_sha.sh). Developers
 may work with `lyft/envoy-build:latest` to provide a self-contained environment for building Envoy binaries and
 running tests that reflects the latest built Ubuntu Envoy image. Moreover, the Docker image
 at [`lyft/envoy:<hash>`](https://hub.docker.com/r/lyft/envoy/) is an image that has an Envoy binary at `/usr/local/bin/envoy`. The `<hash>`
diff --git a/ci/build_container/README.md b/ci/build_container/README.md
index 41539d5767f3c..693eaec05d669 100644
--- a/ci/build_container/README.md
+++ b/ci/build_container/README.md
@@ -3,5 +3,5 @@ checks if the commit has changed the `ci/build_container` directory. If there ar
 image. The image is pushed to dockerhub under `latest` and under the commit sha.
 
 After the PR that changes `ci/build_container` has been merged, and the new image gets pushed,
-a second PR is needed to update `ci/ci_steps.sh`. In order to pull the new tagged version of
-the build image, change ENVOY_BUILD_SHA [here](https://github.com/lyft/envoy/blob/master/ci/ci_steps.sh#L2). Any PRs that depend on this image change will have to merge master after the change to ci/ci_steps.sh has been merged to master.
\ No newline at end of file
+a second PR is needed to update `ci/envoy_build_sha.sh`. In order to pull the new tagged version of
+the build image, change ENVOY_BUILD_SHA [here](https://github.com/lyft/envoy/blob/master/ci/envoy_build_sha.sh). Any PRs that depend on this image change will have to merge master after the change to `ci/envoy_build_sha.sh` has been merged to master.
diff --git a/ci/ci_steps.sh b/ci/ci_steps.sh
index 5d553365d03ed..1ea445b65921c 100755
--- a/ci/ci_steps.sh
+++ b/ci/ci_steps.sh
@@ -1,9 +1,10 @@
 #!/bin/bash
-ENVOY_BUILD_SHA=cd7f513444fb24270175f0c961996d184b764f32
 
 # Script that lists all the steps take by the CI system when doing Envoy builds.
 set -e
 
+. ./ci/envoy_build_sha.sh
+
 # Lint travis file.
 travis lint .travis.yml --skip-completion-check
 
diff --git a/ci/envoy_build_sha.sh b/ci/envoy_build_sha.sh
new file mode 100644
index 0000000000000..dc854c42ec6b8
--- /dev/null
+++ b/ci/envoy_build_sha.sh
@@ -0,0 +1 @@
+ENVOY_BUILD_SHA=cd7f513444fb24270175f0c961996d184b764f32
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index af87536cfb4d6..af5aca3b14b7e 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -2,6 +2,8 @@
 
 set -e
 
+. ci/envoy_build_sha.sh
+
 # When running docker on a Mac, root user permissions are required.
 if [[ "$OSTYPE" == "darwin"* ]]; then
 	USER=root
@@ -11,15 +13,12 @@ else
 	USER_GROUP=$(id -g)
 fi
 
-# The IMAGE_ID can be set to an arbitrary image ID (found with 'docker images').
-[[ -z "${IMAGE_ID}" ]] && IMAGE_ID="latest"
+# The IMAGE_ID defaults to the CI hash but can be set to an arbitrary image ID (found with 'docker
+# images').
+[[ -z "${IMAGE_ID}" ]] && IMAGE_ID="${ENVOY_BUILD_SHA}"
 [[ -z "${ENVOY_DOCKER_BUILD_DIR}" ]] && ENVOY_DOCKER_BUILD_DIR=/tmp/envoy-docker-build
 
 mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
-# When not operating on an existing image ID, fetch latest.
-if [[ "${IMAGE_ID}" == "latest" ]]
-then
-  docker pull lyft/envoy-build:latest
-fi
+# Since we specify an explicit hash, docker-run will pull from the remote repo if missing.
 docker run -t -i -u "${USER}":"${USER_GROUP}" -v "${ENVOY_DOCKER_BUILD_DIR}":/build \
   -v "$PWD":/source lyft/envoy-build:"${IMAGE_ID}" /bin/bash -c "cd source && $*"