diff --git a/bazel/README.md b/bazel/README.md
index 6980607d8c885..ed966d685b30c 100644
--- a/bazel/README.md
+++ b/bazel/README.md
@@ -721,13 +721,18 @@ https://github.com/bazelbuild/bazel/issues/2805.
 
 # Coverage builds
 
-To generate coverage results, make sure you are using a clang toolchain and have `llvm-cov` and
+To generate coverage results, make sure you are using a Clang toolchain and have `llvm-cov` and
 `llvm-profdata` in your `PATH`. Then run:
 
 ```
 test/run_envoy_bazel_coverage.sh
 ```
 
+**Note** that it is important to ensure that the versions of `clang`, `llvm-cov` and `llvm-profdata`
+are consistent and that they match the most recent Clang/LLVM toolchain version in use by Envoy (see
+the [build container
+toolchain](https://github.com/envoyproxy/envoy-build-tools/blob/master/build_container/build_container_ubuntu.sh) for reference).
+
 The summary results are printed to the standard output and the full coverage
 report is available in `generated/coverage/coverage.html`.
 
diff --git a/test/run_envoy_bazel_coverage.sh b/test/run_envoy_bazel_coverage.sh
index 48d8b47a57341..5e99411773c2a 100755
--- a/test/run_envoy_bazel_coverage.sh
+++ b/test/run_envoy_bazel_coverage.sh
@@ -2,6 +2,29 @@
 
 set -e
 
+LLVM_VERSION="10.0.0"
+CLANG_VERSION=$(clang --version | grep version | sed -e 's/\ *clang version \(.*\)\ /\1/')
+LLVM_COV_VERSION=$(llvm-cov --version | grep version | sed -e 's/\ *LLVM version \(.*\)/\1/')
+LLVM_PROFDATA_VERSION=$(llvm-profdata show --version | grep version | sed -e 's/\ *LLVM version \(.*\)/\1/')
+
+if [ "${CLANG_VERSION}" != "${LLVM_VERSION}" ]
+then
+  echo "clang version ${CLANG_VERSION} does not match expected ${LLVM_VERSION}"
+  exit 1
+fi
+
+if [ "${LLVM_COV_VERSION}" != "${LLVM_VERSION}" ]
+then
+  echo "llvm-cov version ${LLVM_COV_VERSION} does not match expected ${LLVM_VERSION}"
+  exit 1
+fi
+
+if [ "${LLVM_PROFDATA_VERSION}" != "${LLVM_VERSION}" ]
+then
+  echo "llvm-profdata version ${LLVM_PROFDATA_VERSION} does not match expected ${LLVM_VERSION}"
+  exit 1
+fi
+
 [[ -z "${SRCDIR}" ]] && SRCDIR="${PWD}"
 [[ -z "${VALIDATE_COVERAGE}" ]] && VALIDATE_COVERAGE=true
 [[ -z "${FUZZ_COVERAGE}" ]] && FUZZ_COVERAGE=false