diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 181d3990bd5a3..af69df878db40 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -9,6 +9,7 @@ echo "building using ${NUM_CPUS} CPUs"
 
 function bazel_release_binary_build() {
   echo "Building..."
+  BUILD_TYPE=opt protobuf_3322_workaround
   cd "${ENVOY_CI_DIR}"
   bazel --batch build ${BAZEL_BUILD_OPTIONS} -c opt //source/exe:envoy-static.stamped
   # Copy the envoy-static binary somewhere that we can access outside of the
@@ -20,6 +21,7 @@ function bazel_release_binary_build() {
 
 function bazel_debug_binary_build() {
   echo "Building..."
+  BUILD_TYPE=dbg protobuf_3322_workaround
   cd "${ENVOY_CI_DIR}"
   bazel --batch build ${BAZEL_BUILD_OPTIONS} -c dbg //source/exe:envoy-static.stamped
   # Copy the envoy-static binary somewhere that we can access outside of the
@@ -29,6 +31,11 @@ function bazel_debug_binary_build() {
     "${ENVOY_DELIVERY_DIR}"/envoy-debug
 }
 
+# See https://github.com/google/protobuf/issues/3322
+function protobuf_3322_workaround() {
+  ln -sf /thirdparty_build_"${BUILD_TYPE}" "${ENVOY_SRCDIR}"/ci/prebuilt/thirdparty_build
+}
+
 if [[ "$1" == "bazel.release" ]]; then
   setup_gcc_toolchain
   echo "bazel release build with tests..."
@@ -55,6 +62,7 @@ elif [[ "$1" == "bazel.debug.server_only" ]]; then
   exit 0
 elif [[ "$1" == "bazel.asan" ]]; then
   setup_clang_toolchain
+  BUILD_TYPE=dbg protobuf_3322_workaround
   echo "bazel ASAN/UBSAN debug build with tests..."
   cd "${ENVOY_FILTER_EXAMPLE_SRCDIR}"
   echo "Building and testing..."
@@ -63,6 +71,7 @@ elif [[ "$1" == "bazel.asan" ]]; then
   exit 0
 elif [[ "$1" == "bazel.tsan" ]]; then
   setup_clang_toolchain
+  BUILD_TYPE=dbg protobuf_3322_workaround
   echo "bazel TSAN debug build with tests..."
   cd "${ENVOY_FILTER_EXAMPLE_SRCDIR}"
   echo "Building and testing..."
@@ -71,6 +80,7 @@ elif [[ "$1" == "bazel.tsan" ]]; then
   exit 0
 elif [[ "$1" == "bazel.dev" ]]; then
   setup_clang_toolchain
+  BUILD_TYPE=dbg protobuf_3322_workaround
   # This doesn't go into CI but is available for developer convenience.
   echo "bazel fastbuild build with tests..."
   cd "${ENVOY_CI_DIR}"
@@ -86,6 +96,10 @@ elif [[ "$1" == "bazel.dev" ]]; then
   exit 0
 elif [[ "$1" == "bazel.coverage" ]]; then
   setup_gcc_toolchain
+  # Technically test/run_envoy_bazel_coverage.sh is doing a -c dbg build, but it
+  # also sets -DNDEBUG, so for protobuf #3322 purposes, we need to setup for
+  # opt.
+  BUILD_TYPE=opt protobuf_3322_workaround
   echo "bazel coverage build with tests..."
   export GCOVR="/thirdparty/gcovr/scripts/gcovr"
   export GCOVR_DIR="${ENVOY_BUILD_DIR}/bazel-envoy"
diff --git a/ci/envoy_build_sha.sh b/ci/envoy_build_sha.sh
index 82e76b80a742f..17c8c78a93e85 100644
--- a/ci/envoy_build_sha.sh
+++ b/ci/envoy_build_sha.sh
@@ -1 +1 @@
-ENVOY_BUILD_SHA=146fb40d0c8b8e48416470b50d60929a3f344711
+ENVOY_BUILD_SHA=373f1151ac4e87e5e2083375c55013d4a67e08b0
diff --git a/test/common/grpc/async_client_impl_test.cc b/test/common/grpc/async_client_impl_test.cc
index 7c957bae86cc9..3c83ad28165ea 100644
--- a/test/common/grpc/async_client_impl_test.cc
+++ b/test/common/grpc/async_client_impl_test.cc
@@ -342,7 +342,8 @@ TEST_F(GrpcAsyncClientImplTest, ReplyNoTrailers) {
 // Validate that send client initial metadata works.
 TEST_F(GrpcAsyncClientImplTest, ClientInitialMetadata) {
   TestMetadata initial_metadata = {
-      {Http::LowerCaseString("foo"), "bar"}, {Http::LowerCaseString("baz"), "blah"},
+      {Http::LowerCaseString("foo"), "bar"},
+      {Http::LowerCaseString("baz"), "blah"},
   };
   auto stream = createStream(initial_metadata);
   expectResetOn(stream.get());
@@ -354,7 +355,8 @@ TEST_F(GrpcAsyncClientImplTest, ServerInitialMetadata) {
   auto stream = createStream(empty_metadata);
   stream->sendRequest();
   TestMetadata initial_metadata = {
-      {Http::LowerCaseString("foo"), "bar"}, {Http::LowerCaseString("baz"), "blah"},
+      {Http::LowerCaseString("foo"), "bar"},
+      {Http::LowerCaseString("baz"), "blah"},
   };
   stream->sendServerInitialMetadata(initial_metadata);
   expectResetOn(stream.get());
@@ -368,7 +370,8 @@ TEST_F(GrpcAsyncClientImplTest, ServerTrailingMetadata) {
   stream->sendServerInitialMetadata(empty_metadata);
   stream->sendReply();
   TestMetadata trailing_metadata = {
-      {Http::LowerCaseString("foo"), "bar"}, {Http::LowerCaseString("baz"), "blah"},
+      {Http::LowerCaseString("foo"), "bar"},
+      {Http::LowerCaseString("baz"), "blah"},
   };
   stream->sendServerTrailers(Status::GrpcStatus::Ok, trailing_metadata);
   expectResetOn(stream.get());
diff --git a/test/common/http/http1/codec_impl_test.cc b/test/common/http/http1/codec_impl_test.cc
index 2881efc3c949c..250f8b3c41feb 100644
--- a/test/common/http/http1/codec_impl_test.cc
+++ b/test/common/http/http1/codec_impl_test.cc
@@ -42,7 +42,10 @@ TEST_F(Http1ServerConnectionImplTest, EmptyHeader) {
   EXPECT_CALL(callbacks_, newStream(_)).WillOnce(ReturnRef(decoder));
 
   TestHeaderMapImpl expected_headers{
-      {"Test", ""}, {"Hello", "World"}, {":path", "/"}, {":method", "GET"},
+      {"Test", ""},
+      {"Hello", "World"},
+      {":path", "/"},
+      {":method", "GET"},
   };
   EXPECT_CALL(decoder, decodeHeaders_(HeaderMapEqual(&expected_headers), true)).Times(1);
 
diff --git a/test/integration/tcp_proxy_integration_test.cc b/test/integration/tcp_proxy_integration_test.cc
index 48705282080a1..ef5f97076a3b2 100644
--- a/test/integration/tcp_proxy_integration_test.cc
+++ b/test/integration/tcp_proxy_integration_test.cc
@@ -53,7 +53,8 @@ TEST_P(TcpProxyIntegrationTest, TcpProxyDownstreamDisconnect) {
       [&]() -> void { fake_upstream_connection->waitForData(5); },
       [&]() -> void { fake_upstream_connection->write("world"); },
       [&]() -> void { tcp_client->waitForData("world"); },
-      [&]() -> void { tcp_client->write("hello"); }, [&]() -> void { tcp_client->close(); },
+      [&]() -> void { tcp_client->write("hello"); },
+      [&]() -> void { tcp_client->close(); },
       [&]() -> void { fake_upstream_connection->waitForData(10); },
       [&]() -> void { fake_upstream_connection->waitForDisconnect(); },