diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
index 10b3448c00eea..24642c945f389 100644
--- a/bazel/envoy_internal.bzl
+++ b/bazel/envoy_internal.bzl
@@ -13,6 +13,7 @@ def envoy_copts(repository, test = False):
         "-Wold-style-cast",
         "-Wformat",
         "-Wformat-security",
+        "-Wrange-loop-analysis",
         "-Wvla",
     ]
 
diff --git a/source/extensions/filters/http/common/compressor/compressor.cc b/source/extensions/filters/http/common/compressor/compressor.cc
index 4e0a1b48ce9be..e8e6042951982 100644
--- a/source/extensions/filters/http/common/compressor/compressor.cc
+++ b/source/extensions/filters/http/common/compressor/compressor.cc
@@ -224,7 +224,7 @@ CompressorFilter::chooseEncoding(const Http::ResponseHeaderMap& headers) const {
   }
 
   // Find all encodings accepted by the user agent and adjust the list of allowed compressors.
-  for (const auto token : StringUtil::splitToken(*accept_encoding_, ",", false /* keep_empty */)) {
+  for (const auto& token : StringUtil::splitToken(*accept_encoding_, ",", false /* keep_empty */)) {
     EncPair pair =
         std::make_pair(StringUtil::trim(StringUtil::cropRight(token, ";")), static_cast<float>(1));
     const auto params = StringUtil::cropLeft(token, ";");
diff --git a/source/extensions/retry/priority/previous_priorities/previous_priorities.cc b/source/extensions/retry/priority/previous_priorities/previous_priorities.cc
index 96dc7c540b25f..5318eb1f13472 100644
--- a/source/extensions/retry/priority/previous_priorities/previous_priorities.cc
+++ b/source/extensions/retry/priority/previous_priorities/previous_priorities.cc
@@ -51,9 +51,7 @@ bool PreviousPrioritiesRetryPriority::adjustForAttemptedPriorities(
   // This allows us to fall back to the unmodified priority load when we run out of priorities
   // instead of failing to route requests.
   if (total_availability == 0) {
-    for (auto&& excluded_priority : excluded_priorities_) {
-      excluded_priority = false;
-    }
+    std::fill(excluded_priorities_.begin(), excluded_priorities_.end(), false);
     attempted_hosts_.clear();
     total_availability =
         adjustedAvailability(adjusted_per_priority_health, adjusted_per_priority_degraded);
diff --git a/test/tools/router_check/coverage.cc b/test/tools/router_check/coverage.cc
index f079f0319fd72..6b23e93453bf9 100644
--- a/test/tools/router_check/coverage.cc
+++ b/test/tools/router_check/coverage.cc
@@ -5,7 +5,7 @@
 namespace Envoy {
 double RouteCoverage::report() {
   uint64_t route_weight = 0;
-  for (const auto& covered_field : coverageFields()) {
+  for (const auto&& covered_field : coverageFields()) {
     if (covered_field) {
       route_weight += 1;
     }