diff --git a/.circleci/config.yml b/.circleci/config.yml
index 916d9f30083f9..decf0b22f3471 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,7 @@ executors:
   ubuntu-build:
     description: "A regular build executor based on ubuntu image"
     docker:
-      - image: envoyproxy/envoy-build:d1646d643b492ea070c96d0b67caf5bb2c8ca854
+      - image: envoyproxy/envoy-build:111781fa2823535762e9c514db0c5c41a119b4b1
     resource_class: xlarge
     working_directory: /source
 
diff --git a/WORKSPACE b/WORKSPACE
index 68768438acd01..ecd0a358f1639 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -5,6 +5,10 @@ load("//bazel:cc_configure.bzl", "cc_configure")
 
 envoy_dependencies()
 
+load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependencies")
+
+rules_foreign_cc_dependencies()
+
 cc_configure()
 
 load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
diff --git a/bazel/EXTERNAL_DEPS.md b/bazel/EXTERNAL_DEPS.md
index 89bfc08a1413b..e6d2c67545e6c 100644
--- a/bazel/EXTERNAL_DEPS.md
+++ b/bazel/EXTERNAL_DEPS.md
@@ -17,6 +17,18 @@ build process.
    `external_deps` attribute.
 3. `bazel test //test/...`
 
+# Adding external dependencies to Envoy (external CMake)
+
+This is the preferred style of adding dependencies that use CMake for their build system.
+
+1. Define a the source Bazel repository in [`bazel/repositories.bzl`](repositories.bzl), in the
+   `envoy_dependencies()` function.
+2. Add a `cmake_external` rule to [`bazel/foreign_cc/BUILD`](bazel/foreign_cc/BUILD). This will
+   reference the source repository in step 1.
+3. Reference your new external dependency in some `envoy_cc_library` via the name bound in step 1
+   `external_deps` attribute.
+4. `bazel test //test/...`
+
 # Adding external dependencies to Envoy (genrule repository)
 
 This is the newer style of adding dependencies with no upstream Bazel configs.
@@ -44,8 +56,9 @@ to binaries, libraries, headers, etc.
 
 # Adding external dependencies to Envoy (build recipe)
 
-This is the older style of adding dependencies. It uses shell scripts to build
-and install dependencies into a shared directory prefix.
+This is the older style of adding dependencies. It uses shell scripts to build and install
+dependencies into a shared directory prefix. This should no longer be used unless there are
+extenuating circumstances.
 
 1. Add a build recipe X in [`ci/build_container/build_recipes`](../ci/build_container/build_recipes)
    for developer-local and CI external dependency build flows.
diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
new file mode 100644
index 0000000000000..4754703329b9a
--- /dev/null
+++ b/bazel/foreign_cc/BUILD
@@ -0,0 +1,83 @@
+licenses(["notice"])  # Apache 2
+
+load("//bazel:envoy_build_system.bzl", "envoy_package")
+load("@rules_foreign_cc//tools/build_defs:cmake.bzl", "cmake_external")
+
+envoy_package()
+
+cmake_external(
+    name = "ares",
+    cache_entries = {
+        "CARES_SHARED": "no",
+        "CARES_STATIC": "on",
+        "CMAKE_BUILD_TYPE": "RelWithDebInfo",
+    },
+    cmake_options = ["-GNinja"],
+    lib_source = "@com_github_c_ares_c_ares//:all",
+    make_commands = [
+        "ninja",
+        "ninja install",
+    ],
+    static_libraries = ["libcares.a"],
+)
+
+cmake_external(
+    name = "event",
+    cache_entries = {
+        "EVENT__DISABLE_OPENSSL": "on",
+        "EVENT__DISABLE_REGRESS": "on",
+        "CMAKE_BUILD_TYPE": "Release",
+    },
+    cmake_options = ["-GNinja"],
+    lib_source = "@com_github_libevent_libevent//:all",
+    make_commands = [
+        "ninja",
+        "ninja install",
+    ],
+    static_libraries = ["libevent.a"],
+)
+
+cmake_external(
+    name = "nghttp2",
+    cache_entries = {
+        "ENABLE_STATIC_LIB": "on",
+        "ENABLE_LIB_ONLY": "on",
+        "CMAKE_BUILD_TYPE": "RelWithDebInfo",
+    },
+    cmake_options = ["-GNinja"],
+    lib_source = "@com_github_nghttp2_nghttp2//:all",
+    make_commands = [
+        "ninja",
+        "ninja install",
+    ],
+    static_libraries = ["libnghttp2.a"],
+)
+
+cmake_external(
+    name = "yaml",
+    cache_entries = {
+        "YAML_CPP_BUILD_TESTS": "off",
+        "CMAKE_BUILD_TYPE": "RelWithDebInfo",
+    },
+    cmake_options = ["-GNinja"],
+    lib_source = "@com_github_jbeder_yaml_cpp//:all",
+    make_commands = [
+        "ninja",
+        "ninja install",
+    ],
+    static_libraries = ["libyaml-cpp.a"],
+)
+
+cmake_external(
+    name = "zlib",
+    cache_entries = {
+        "CMAKE_BUILD_TYPE": "RelWithDebInfo",
+    },
+    cmake_options = ["-GNinja"],
+    lib_source = "@com_github_madler_zlib//:all",
+    make_commands = [
+        "ninja",
+        "ninja install",
+    ],
+    static_libraries = ["libz.a"],
+)
diff --git a/bazel/foreign_cc/nghttp2.patch b/bazel/foreign_cc/nghttp2.patch
new file mode 100644
index 0000000000000..4cc4ea7b32ae0
--- /dev/null
+++ b/bazel/foreign_cc/nghttp2.patch
@@ -0,0 +1,12 @@
+diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
+index 17e422b2..e58070f5 100644
+--- a/lib/CMakeLists.txt
++++ b/lib/CMakeLists.txt
+@@ -52,6 +52,7 @@
+     COMPILE_FLAGS "${WARNCFLAGS}"
+     VERSION ${LT_VERSION} SOVERSION ${LT_SOVERSION}
+     ARCHIVE_OUTPUT_NAME nghttp2
++    ARCHIVE_OUTPUT_DIRECTORY static
+   )
+   target_compile_definitions(nghttp2_static PUBLIC "-DNGHTTP2_STATICLIB")
+   if(ENABLE_STATIC_LIB)
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index c3c8bb2535ea6..3b6fa8f7b3b7c 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -15,6 +15,10 @@ PPC_SKIP_TARGETS = {"luajit": "envoy.filters.http.lua"}
 # go version for rules_go
 GO_VERSION = "1.10.4"
 
+# Make all contents of an external repository accessible under a filegroup.  Used for external HTTP
+# archives, e.g. cares.
+BUILD_ALL_CONTENT = """filegroup(name = "all", srcs = glob(["**"]), visibility = ["//visibility:public"])"""
+
 def _repository_impl(name, **kwargs):
     # `existing_rule_keys` contains the names of repositories that have already
     # been defined in the Bazel workspace. By skipping repos with existing keys,
@@ -265,6 +269,9 @@ def envoy_dependencies(path = "@envoy_deps//", skip_targets = []):
     if "envoy_build_config" not in native.existing_rules().keys():
         _default_envoy_build_config(name = "envoy_build_config")
 
+    # Setup rules_foreign_cc
+    _foreign_cc_dependencies()
+
     # Binding to an alias pointing to the selected version of BoringSSL:
     # - BoringSSL FIPS from @boringssl_fips//:ssl,
     # - non-FIPS BoringSSL from @boringssl//:ssl.
@@ -281,6 +288,7 @@ def envoy_dependencies(path = "@envoy_deps//", skip_targets = []):
     _com_google_absl()
     _com_github_bombela_backward()
     _com_github_circonus_labs_libcircllhist()
+    _com_github_c_ares_c_ares()
     _com_github_cyan4973_xxhash()
     _com_github_eile_tclap()
     _com_github_fmtlib_fmt()
@@ -291,8 +299,13 @@ def envoy_dependencies(path = "@envoy_deps//", skip_targets = []):
     _com_lightstep_tracer_cpp()
     _com_github_datadog_dd_opentracing_cpp()
     _com_github_grpc_grpc()
+    _com_github_google_benchmark()
     _com_github_google_jwt_verify()
+    _com_github_jbeder_yaml_cpp()
+    _com_github_libevent_libevent()
+    _com_github_madler_zlib()
     _com_github_nanopb_nanopb()
+    _com_github_nghttp2_nghttp2()
     _com_github_nodejs_http_parser()
     _com_github_tencent_rapidjson()
     _com_google_googletest()
@@ -341,6 +354,18 @@ def _com_github_circonus_labs_libcircllhist():
         actual = "@com_github_circonus_labs_libcircllhist//:libcircllhist",
     )
 
+def _com_github_c_ares_c_ares():
+    location = REPOSITORY_LOCATIONS["com_github_c_ares_c_ares"]
+    http_archive(
+        name = "com_github_c_ares_c_ares",
+        build_file_content = BUILD_ALL_CONTENT,
+        **location
+    )
+    native.bind(
+        name = "ares",
+        actual = "//bazel/foreign_cc:ares",
+    )
+
 def _com_github_cyan4973_xxhash():
     _repository_impl(
         name = "com_github_cyan4973_xxhash",
@@ -401,6 +426,17 @@ def _com_github_gcovr_gcovr():
         actual = "@com_github_gcovr_gcovr//:gcovr",
     )
 
+def _com_github_google_benchmark():
+    location = REPOSITORY_LOCATIONS["com_github_google_benchmark"]
+    http_archive(
+        name = "com_github_google_benchmark",
+        **location
+    )
+    native.bind(
+        name = "benchmark",
+        actual = "@com_github_google_benchmark//:benchmark",
+    )
+
 def _com_github_google_libprotobuf_mutator():
     _repository_impl(
         name = "com_github_google_libprotobuf_mutator",
@@ -411,6 +447,57 @@ def _com_github_google_libprotobuf_mutator():
         actual = "@com_github_google_libprotobuf_mutator//:libprotobuf_mutator",
     )
 
+def _com_github_jbeder_yaml_cpp():
+    location = REPOSITORY_LOCATIONS["com_github_jbeder_yaml_cpp"]
+    http_archive(
+        name = "com_github_jbeder_yaml_cpp",
+        build_file_content = BUILD_ALL_CONTENT,
+        **location
+    )
+    native.bind(
+        name = "yaml_cpp",
+        actual = "//bazel/foreign_cc:yaml",
+    )
+
+def _com_github_libevent_libevent():
+    location = REPOSITORY_LOCATIONS["com_github_libevent_libevent"]
+    http_archive(
+        name = "com_github_libevent_libevent",
+        build_file_content = BUILD_ALL_CONTENT,
+        **location
+    )
+    native.bind(
+        name = "event",
+        actual = "//bazel/foreign_cc:event",
+    )
+
+def _com_github_madler_zlib():
+    location = REPOSITORY_LOCATIONS["com_github_madler_zlib"]
+    http_archive(
+        name = "com_github_madler_zlib",
+        build_file_content = BUILD_ALL_CONTENT,
+        **location
+    )
+    native.bind(
+        name = "zlib",
+        actual = "//bazel/foreign_cc:zlib",
+    )
+
+def _com_github_nghttp2_nghttp2():
+    location = REPOSITORY_LOCATIONS["com_github_nghttp2_nghttp2"]
+    http_archive(
+        name = "com_github_nghttp2_nghttp2",
+        build_file_content = BUILD_ALL_CONTENT,
+        patch_args = ["-p1"],
+        patch_cmds = ["find . -name '*.sh' -exec sed -i.orig '1s|#!/usr/bin/env sh\$|/bin/sh\$|' {} +"],
+        patches = ["//bazel/foreign_cc:nghttp2.patch"],
+        **location
+    )
+    native.bind(
+        name = "nghttp2",
+        actual = "//bazel/foreign_cc:nghttp2",
+    )
+
 def _io_opentracing_cpp():
     _repository_impl("io_opentracing_cpp")
     native.bind(
@@ -641,6 +728,9 @@ def _com_github_google_jwt_verify():
         actual = "@com_github_google_jwt_verify//:jwt_verify_lib",
     )
 
+def _foreign_cc_dependencies():
+    _repository_impl("rules_foreign_cc")
+
 def _apply_dep_blacklist(ctxt, recipes):
     newlist = []
     skip_list = []
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 95e8d4b09deda..99a2c1c6c251b 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -31,6 +31,11 @@ REPOSITORY_LOCATIONS = dict(
         strip_prefix = "backward-cpp-1.4",
         urls = ["https://github.com/bombela/backward-cpp/archive/v1.4.tar.gz"],
     ),
+    com_github_c_ares_c_ares = dict(
+        sha256 = "7deb7872cbd876c29036d5f37e30c4cbc3cc068d59d8b749ef85bb0736649f04",
+        strip_prefix = "c-ares-cares-1_15_0",
+        urls = ["https://github.com/c-ares/c-ares/archive/cares-1_15_0.tar.gz"],
+    ),
     com_github_circonus_labs_libcircllhist = dict(
         sha256 = "9949e2864b8ad00ee5c3e9c1c3c01e51b6b68bb442a919652fc66b9776477987",
         strip_prefix = "libcircllhist-fd8a14463739d247b414825cc56ca3946792a3b9",
@@ -83,6 +88,11 @@ REPOSITORY_LOCATIONS = dict(
         strip_prefix = "nanopb-0.3.9.2",
         urls = ["https://github.com/nanopb/nanopb/archive/0.3.9.2.tar.gz"],
     ),
+    com_github_nghttp2_nghttp2 = dict(
+        sha256 = "cb70261634c33dc5adbe780afcfc5dab17838ee303631a02b983c6a217bc16ba",
+        strip_prefix = "nghttp2-1.35.1",
+        urls = ["https://github.com/nghttp2/nghttp2/releases/download/v1.35.1/nghttp2-1.35.1.tar.gz"],
+    ),
     io_opentracing_cpp = dict(
         sha256 = "015c4187f7a6426a2b5196f0ccd982aa87f010cf61f507ae3ce5c90523f92301",
         strip_prefix = "opentracing-cpp-1.5.1",
@@ -104,6 +114,27 @@ REPOSITORY_LOCATIONS = dict(
         strip_prefix = "dd-opentracing-cpp-0.4.1",
         urls = ["https://github.com/DataDog/dd-opentracing-cpp/archive/v0.4.1.tar.gz"],
     ),
+    com_github_google_benchmark = dict(
+        # TODO (moderation) change back to tarball method on next benchmark release
+        sha256 = "0de43b6eaddd356f1d6cd164f73f37faf2f6c96fd684e1f7ea543ce49c1d144e",
+        strip_prefix = "benchmark-505be96ab23056580a3a2315abba048f4428b04e",
+        urls = ["https://github.com/google/benchmark/archive/505be96ab23056580a3a2315abba048f4428b04e.tar.gz"],
+    ),
+    com_github_libevent_libevent = dict(
+        sha256 = "316ddb401745ac5d222d7c529ef1eada12f58f6376a66c1118eee803cb70f83d",
+        strip_prefix = "libevent-release-2.1.8-stable",
+        urls = ["https://github.com/libevent/libevent/archive/release-2.1.8-stable.tar.gz"],
+    ),
+    com_github_madler_zlib = dict(
+        sha256 = "629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff",
+        strip_prefix = "zlib-1.2.11",
+        urls = ["https://github.com/madler/zlib/archive/v1.2.11.tar.gz"],
+    ),
+    com_github_jbeder_yaml_cpp = dict(
+        sha256 = "53dcffd55f3433b379fcc694f45c54898711c0e29159a7bd02e82a3e0253bac3",
+        strip_prefix = "yaml-cpp-0f9a586ca1dc29c2ecb8dd715a315b93e3f40f79",
+        urls = ["https://github.com/jbeder/yaml-cpp/archive/0f9a586ca1dc29c2ecb8dd715a315b93e3f40f79.tar.gz"],
+    ),
     com_github_msgpack_msgpack_c = dict(
         sha256 = "bda49f996a73d2c6080ff0523e7b535917cd28c8a79c3a5da54fc29332d61d1e",
         strip_prefix = "msgpack-c-cpp-3.1.1",
@@ -187,6 +218,11 @@ REPOSITORY_LOCATIONS = dict(
         sha256 = "7be7dc01f1e0afdba6c8eb2b43d2fa01c743be1b9273ab1eaf6c233df078d705",
         urls = ["https://github.com/bazelbuild/rules_go/releases/download/0.16.5/rules_go-0.16.5.tar.gz"],
     ),
+    rules_foreign_cc = dict(
+        sha256 = "78cbd1a8134b2f0ead8e637228d8ac1ac7c0ab3f0fbcd149a85e55330697d9a3",
+        strip_prefix = "rules_foreign_cc-216ded8acb95d81e312b228dce3c39872c7a7c34",
+        urls = ["https://github.com/bazelbuild/rules_foreign_cc/archive/216ded8acb95d81e312b228dce3c39872c7a7c34.tar.gz"],
+    ),
     six_archive = dict(
         sha256 = "105f8d68616f8248e24bf0e9372ef04d3cc10104f1980f54d57b2ce73a5ad56a",
         urls = ["https://pypi.python.org/packages/source/s/six/six-1.10.0.tar.gz#md5=34eed507548117b2ab523ab14b2f8b55"],
diff --git a/bazel/target_recipes.bzl b/bazel/target_recipes.bzl
index 9065d60c8c681..95dc4ca964d5c 100644
--- a/bazel/target_recipes.bzl
+++ b/bazel/target_recipes.bzl
@@ -2,13 +2,7 @@
 # target in //ci/prebuilt/BUILD to the underlying build recipe in
 # ci/build_container/build_recipes.
 TARGET_RECIPES = {
-    "ares": "cares",
-    "benchmark": "benchmark",
-    "event": "libevent",
     "tcmalloc_and_profiler": "gperftools",
     "tcmalloc_debug": "gperftools",
     "luajit": "luajit",
-    "nghttp2": "nghttp2",
-    "yaml_cpp": "yaml-cpp",
-    "zlib": "zlib",
 }
diff --git a/ci/WORKSPACE b/ci/WORKSPACE
index 1aa826563aaf5..2f2197641d11f 100644
--- a/ci/WORKSPACE
+++ b/ci/WORKSPACE
@@ -13,6 +13,11 @@ envoy_dependencies(
     path = "@envoy//ci/prebuilt",
 )
 
+# TODO(htuch): Roll this into envoy_dependencies()
+load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependencies")
+
+rules_foreign_cc_dependencies()
+
 cc_configure()
 
 load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
diff --git a/ci/WORKSPACE.filter.example b/ci/WORKSPACE.filter.example
index 632e35eac78d7..c528e921e3e68 100644
--- a/ci/WORKSPACE.filter.example
+++ b/ci/WORKSPACE.filter.example
@@ -11,6 +11,9 @@ load("//bazel:cc_configure.bzl", "cc_configure")
 envoy_dependencies(
     path = "@envoy//ci/prebuilt",
 )
+# TODO(htuch): Roll this into envoy_dependencies()
+load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependencies")
+rules_foreign_cc_dependencies()
 
 cc_configure()
 
diff --git a/ci/build_container/build_recipes/benchmark.sh b/ci/build_container/build_recipes/benchmark.sh
deleted file mode 100644
index 19a1f7ce02c5f..0000000000000
--- a/ci/build_container/build_recipes/benchmark.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/bin/bash
-
-set -e
-
-# use commit where cmake 3.6 feature removed. Unblocks Ubuntu 16.xx or below builds
-# TODO (moderation) change back to tarball method on next benchmark release
-export COMMIT="505be96ab23056580a3a2315abba048f4428b04e"
-
-git clone https://github.com/google/benchmark.git
-(cd benchmark; git reset --hard "$COMMIT")
-mkdir build
-
-cd build
-
-cmake -G "Ninja" ../benchmark \
-  -DCMAKE_BUILD_TYPE=RELEASE \
-  -DBENCHMARK_ENABLE_GTEST_TESTS=OFF
-ninja
-
-benchmark_lib="libbenchmark.a"
-if [[ "${OS}" == "Windows_NT" ]]; then
-  benchmark_lib="benchmark.lib"
-fi
-
-cp "src/$benchmark_lib" "$THIRDPARTY_BUILD"/lib
-cd ../benchmark
-
-INCLUDE_DIR="$THIRDPARTY_BUILD/include/testing/base/public"
-mkdir -p "$INCLUDE_DIR"
-cp include/benchmark/benchmark.h "$INCLUDE_DIR"
diff --git a/ci/build_container/build_recipes/cares.sh b/ci/build_container/build_recipes/cares.sh
deleted file mode 100755
index 7d18b39e21c0b..0000000000000
--- a/ci/build_container/build_recipes/cares.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash
-
-set -e
-
-TAG=cares-1_15_0
-VERSION=c-ares-1.15.0
-SHA256=6cdb97871f2930530c97deb7cf5c8fa4be5a0b02c7cea6e7c7667672a39d6852
-
-# cares is fussy over whether -D appears inside CFLAGS vs. CPPFLAGS, oss-fuzz
-# sets CFLAGS with -D, so we need to impedance match here. In turn, macOS automake
-# is fussy about newlines in CFLAGS/CPPFLAGS, so translate them into spaces.
-CPPFLAGS="$(for f in $CXXFLAGS; do if [[ $f =~ -D.* ]]; then echo $f; fi; done | tr '\n' ' ')"
-CFLAGS="$(for f in $CXXFLAGS; do if [[ ! $f =~ -D.* ]]; then echo $f; fi; done | tr '\n' ' ')"
-
-curl https://github.com/c-ares/c-ares/releases/download/"$TAG"/"$VERSION".tar.gz -sLo "$VERSION".tar.gz \
-  && echo "$SHA256" "$VERSION".tar.gz | sha256sum --check
-tar xf "$VERSION".tar.gz
-cd "$VERSION"
-
-mkdir build
-cd build
-
-build_type=RelWithDebInfo
-if [[ "${OS}" == "Windows_NT" ]]; then
-  # On Windows, every object file in the final executable needs to be compiled to use the
-  # same version of the C Runtime Library. If Envoy is built with '-c dbg', then it will
-  # use the Debug C Runtime Library. Setting CMAKE_BUILD_TYPE to Debug will cause c-ares
-  # to use the debug version as well
-  # TODO: when '-c fastbuild' and '-c opt' work for Windows builds, set this appropriately
-  build_type=Debug
-fi
-
-cmake -G "Ninja" -DCMAKE_INSTALL_PREFIX="$THIRDPARTY_BUILD" \
-  -DCARES_SHARED=no \
-  -DCARES_STATIC=on \
-  -DCMAKE_BUILD_TYPE="$build_type" \
-  ..
-ninja
-ninja install
-
-if [[ "${OS}" == "Windows_NT" ]]; then
-  cp "CMakeFiles/c-ares.dir/c-ares.pdb" "$THIRDPARTY_BUILD/lib/c-ares.pdb"
-fi
diff --git a/ci/build_container/build_recipes/libevent.sh b/ci/build_container/build_recipes/libevent.sh
deleted file mode 100755
index 7ae3f2b4c09b9..0000000000000
--- a/ci/build_container/build_recipes/libevent.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-set -e
-
-VERSION=2.1.8-stable
-SHA256=316ddb401745ac5d222d7c529ef1eada12f58f6376a66c1118eee803cb70f83d
-
-# Maintainer provided source tarball does not contain cmake content so using Github tarball.
-curl https://github.com/libevent/libevent/archive/release-"$VERSION".tar.gz -sLo libevent-release-"$VERSION".tar.gz \
-  && echo "$SHA256" libevent-release-"$VERSION".tar.gz | sha256sum --check
-tar xf libevent-release-"$VERSION".tar.gz
-cd libevent-release-"$VERSION"
-
-mkdir build
-cd build
-
-# libevent defaults CMAKE_BUILD_TYPE to Release
-build_type=Release
-if [[ "${OS}" == "Windows_NT" ]]; then
-  # On Windows, every object file in the final executable needs to be compiled to use the
-  # same version of the C Runtime Library. If Envoy is built with '-c dbg', then it will
-  # use the Debug C Runtime Library. Setting CMAKE_BUILD_TYPE to Debug will cause libevent
-  # to use the debug version as well
-  # TODO: when '-c fastbuild' and '-c opt' work for Windows builds, set this appropriately
-  build_type=Debug
-fi
-
-cmake -G "Ninja" \
-  -DCMAKE_INSTALL_PREFIX="$THIRDPARTY_BUILD" \
-  -DEVENT__DISABLE_OPENSSL:BOOL=on \
-  -DEVENT__DISABLE_REGRESS:BOOL=on \
-  -DCMAKE_BUILD_TYPE="$build_type" \
-  ..
-ninja
-ninja install
-
-if [[ "${OS}" == "Windows_NT" ]]; then
-  cp "CMakeFiles/event.dir/event.pdb" "$THIRDPARTY_BUILD/lib/event.pdb"
-fi
diff --git a/ci/build_container/build_recipes/nghttp2.sh b/ci/build_container/build_recipes/nghttp2.sh
deleted file mode 100755
index 5af4bd8c85cc7..0000000000000
--- a/ci/build_container/build_recipes/nghttp2.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/bin/bash
-
-set -e
-
-VERSION=1.35.1
-SHA256=cb70261634c33dc5adbe780afcfc5dab17838ee303631a02b983c6a217bc16ba
-
-curl https://github.com/nghttp2/nghttp2/releases/download/v"$VERSION"/nghttp2-"$VERSION".tar.gz -sLo nghttp2-"$VERSION".tar.gz \
-  && echo "$SHA256" nghttp2-"$VERSION".tar.gz | sha256sum --check
-tar xf nghttp2-"$VERSION".tar.gz
-cd nghttp2-"$VERSION"
-
-# Allow nghttp2 to build as static lib on Windows
-# TODO: remove once https://github.com/nghttp2/nghttp2/pull/1198 is merged
-cat > nghttp2_cmakelists.diff << 'EOF'
-diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt
-index 17e422b2..e58070f5 100644
---- a/lib/CMakeLists.txt
-+++ b/lib/CMakeLists.txt
-@@ -56,6 +56,7 @@ if(HAVE_CUNIT OR ENABLE_STATIC_LIB)
-     COMPILE_FLAGS "${WARNCFLAGS}"
-     VERSION ${LT_VERSION} SOVERSION ${LT_SOVERSION}
-     ARCHIVE_OUTPUT_NAME nghttp2
-+    ARCHIVE_OUTPUT_DIRECTORY static
-   )
-   target_compile_definitions(nghttp2_static PUBLIC "-DNGHTTP2_STATICLIB")
-   if(ENABLE_STATIC_LIB)
-EOF
-
-if [[ "${OS}" == "Windows_NT" ]]; then
-  git apply nghttp2_cmakelists.diff
-fi
-
-mkdir build
-cd build
-
-cmake -G "Ninja" -DCMAKE_INSTALL_PREFIX="$THIRDPARTY_BUILD" \
-  -DCMAKE_INSTALL_LIBDIR="$THIRDPARTY_BUILD/lib" \
-  -DENABLE_STATIC_LIB=on \
-  -DENABLE_LIB_ONLY=on \
-  ..
-ninja
-ninja install
-
-if [[ "${OS}" == "Windows_NT" ]]; then
-  cp "lib/CMakeFiles/nghttp2_static.dir/nghttp2_static.pdb" "$THIRDPARTY_BUILD/lib/nghttp2_static.pdb"
-fi
diff --git a/ci/build_container/build_recipes/yaml-cpp.sh b/ci/build_container/build_recipes/yaml-cpp.sh
deleted file mode 100755
index 59253e93798ff..0000000000000
--- a/ci/build_container/build_recipes/yaml-cpp.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-
-set -e
-
-# Pin to this commit to pick up fix for building on Visual Studio 15.8
-COMMIT=0f9a586ca1dc29c2ecb8dd715a315b93e3f40f79 # 2018-06-30
-SHA256=53dcffd55f3433b379fcc694f45c54898711c0e29159a7bd02e82a3e0253bac3
-
-curl https://github.com/jbeder/yaml-cpp/archive/"$COMMIT".tar.gz -sLo yaml-cpp-"$COMMIT".tar.gz \
-  && echo "$SHA256" yaml-cpp-"$COMMIT".tar.gz | sha256sum --check
-tar xf yaml-cpp-"$COMMIT".tar.gz
-cd yaml-cpp-"$COMMIT"
-
-mkdir build
-cd build
-
-build_type=RelWithDebInfo
-if [[ "${OS}" == "Windows_NT" ]]; then
-  # On Windows, every object file in the final executable needs to be compiled to use the
-  # same version of the C Runtime Library. If Envoy is built with '-c dbg', then it will
-  # use the Debug C Runtime Library. Setting CMAKE_BUILD_TYPE to Debug will cause yaml-cpp
-  # to use the debug version as well
-  # TODO: when '-c fastbuild' and '-c opt' work for Windows builds, set this appropriately
-  build_type=Debug
-fi
-
-cmake -G "Ninja" -DCMAKE_INSTALL_PREFIX:PATH="$THIRDPARTY_BUILD" \
-  -DCMAKE_CXX_FLAGS:STRING="${CXXFLAGS} ${CPPFLAGS}" \
-  -DCMAKE_C_FLAGS:STRING="${CFLAGS} ${CPPFLAGS}" \
-  -DYAML_CPP_BUILD_TESTS=off \
-  -DCMAKE_BUILD_TYPE="$build_type" \
-  ..
-ninja install
-
-if [[ "${OS}" == "Windows_NT" ]]; then
-  cp "CMakeFiles/yaml-cpp.dir/yaml-cpp.pdb" "$THIRDPARTY_BUILD/lib/yaml-cpp.pdb"
-fi
diff --git a/ci/build_container/build_recipes/zlib.sh b/ci/build_container/build_recipes/zlib.sh
deleted file mode 100644
index c29aeee7dea81..0000000000000
--- a/ci/build_container/build_recipes/zlib.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/bash
-
-set -e
-
-VERSION=1.2.11
-SHA256=629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff
-
-curl https://github.com/madler/zlib/archive/v"$VERSION".tar.gz -sLo zlib-"$VERSION".tar.gz \
-  && echo "$SHA256" zlib-"$VERSION".tar.gz | sha256sum --check
-tar xf zlib-"$VERSION".tar.gz
-cd zlib-"$VERSION"
-
-mkdir build
-cd build
-
-cmake -G "Ninja" -DCMAKE_INSTALL_PREFIX:PATH="$THIRDPARTY_BUILD" ..
-ninja
-ninja install
-
-if [[ "${OS}" == "Windows_NT" ]]; then
-  cp "CMakeFiles/zlibstatic.dir/zlibstatic.pdb" "$THIRDPARTY_BUILD/lib/zlibstatic.pdb"
-fi
diff --git a/ci/prebuilt/BUILD b/ci/prebuilt/BUILD
index 526ca60619efb..090fe800f14c3 100644
--- a/ci/prebuilt/BUILD
+++ b/ci/prebuilt/BUILD
@@ -7,36 +7,6 @@ config_setting(
     values = {"cpu": "x64_windows"},
 )
 
-cc_library(
-    name = "ares",
-    srcs = select({
-        ":windows_x86_64": ["thirdparty_build/lib/cares.lib"],
-        "//conditions:default": ["thirdparty_build/lib/libcares.a"],
-    }),
-    hdrs = glob(["thirdparty_build/include/ares*.h"]),
-    includes = ["thirdparty_build/include"],
-)
-
-cc_library(
-    name = "benchmark",
-    srcs = select({
-        ":windows_x86_64": ["thirdparty_build/lib/benchmark.lib"],
-        "//conditions:default": ["thirdparty_build/lib/libbenchmark.a"],
-    }),
-    hdrs = ["thirdparty_build/include/testing/base/public/benchmark.h"],
-    includes = ["thirdparty_build/include"],
-)
-
-cc_library(
-    name = "event",
-    srcs = select({
-        ":windows_x86_64": ["thirdparty_build/lib/event.lib"],
-        "//conditions:default": ["thirdparty_build/lib/libevent.a"],
-    }),
-    hdrs = glob(["thirdparty_build/include/event2/**/*.h"]),
-    includes = ["thirdparty_build/include"],
-)
-
 cc_library(
     name = "luajit",
     srcs = select({
@@ -49,16 +19,6 @@ cc_library(
     # the headers get included using -I vs. -isystem which then causes old-style-cast warnings.
 )
 
-cc_library(
-    name = "nghttp2",
-    srcs = select({
-        ":windows_x86_64": ["thirdparty_build/lib/nghttp2.lib"],
-        "//conditions:default": ["thirdparty_build/lib/libnghttp2.a"],
-    }),
-    hdrs = glob(["thirdparty_build/include/nghttp2/**/*.h"]),
-    includes = ["thirdparty_build/include"],
-)
-
 cc_library(
     name = "tcmalloc_and_profiler",
     srcs = ["thirdparty_build/lib/libtcmalloc_and_profiler.a"],
@@ -72,26 +32,3 @@ cc_library(
     hdrs = glob(["thirdparty_build/include/gperftools/**/*.h"]),
     strip_include_prefix = "thirdparty_build/include",
 )
-
-cc_library(
-    name = "yaml_cpp",
-    srcs = select({
-        ":windows_x86_64": glob(["thirdparty_build/lib/libyaml-cpp*.lib"]),
-        "//conditions:default": ["thirdparty_build/lib/libyaml-cpp.a"],
-    }),
-    hdrs = glob(["thirdparty_build/include/yaml-cpp/**/*.h"]),
-    includes = ["thirdparty_build/include"],
-)
-
-cc_library(
-    name = "zlib",
-    srcs = select({
-        ":windows_x86_64": glob(["thirdparty_build/lib/zlibstaticd.lib"]),
-        "//conditions:default": ["thirdparty_build/lib/libz.a"],
-    }),
-    hdrs = [
-        "thirdparty_build/include/zconf.h",
-        "thirdparty_build/include/zlib.h",
-    ],
-    includes = ["thirdparty_build/include"],
-)
diff --git a/test/common/access_log/access_log_formatter_speed_test.cc b/test/common/access_log/access_log_formatter_speed_test.cc
index 32c8f53f90dc4..595f6e1f5c87c 100644
--- a/test/common/access_log/access_log_formatter_speed_test.cc
+++ b/test/common/access_log/access_log_formatter_speed_test.cc
@@ -4,7 +4,7 @@
 #include "test/common/stream_info/test_util.h"
 #include "test/mocks/http/mocks.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace {
 
diff --git a/test/common/buffer/buffer_speed_test.cc b/test/common/buffer/buffer_speed_test.cc
index cc15536366d10..e74203fc802ee 100644
--- a/test/common/buffer/buffer_speed_test.cc
+++ b/test/common/buffer/buffer_speed_test.cc
@@ -2,7 +2,7 @@
 #include "common/common/assert.h"
 
 #include "absl/strings/string_view.h"
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 
diff --git a/test/common/common/utility_speed_test.cc b/test/common/common/utility_speed_test.cc
index 54a2bc5354b9b..878e8c1d9473e 100644
--- a/test/common/common/utility_speed_test.cc
+++ b/test/common/common/utility_speed_test.cc
@@ -7,7 +7,7 @@
 #include "common/common/utility.h"
 
 #include "absl/strings/string_view.h"
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 static const char TextToTrim[] = "\t  the quick brown fox jumps over the lazy dog\n\r\n";
 static size_t TextToTrimLength = sizeof(TextToTrim) - 1;
diff --git a/test/common/http/codes_speed_test.cc b/test/common/http/codes_speed_test.cc
index d59df3389ce0d..15634d95fd7d6 100644
--- a/test/common/http/codes_speed_test.cc
+++ b/test/common/http/codes_speed_test.cc
@@ -12,7 +12,7 @@
 #include "common/http/codes.h"
 #include "common/stats/isolated_store_impl.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 namespace Http {
diff --git a/test/common/http/header_map_impl_speed_test.cc b/test/common/http/header_map_impl_speed_test.cc
index ae332f7bb897b..b8b67b2c155f2 100644
--- a/test/common/http/header_map_impl_speed_test.cc
+++ b/test/common/http/header_map_impl_speed_test.cc
@@ -1,6 +1,6 @@
 #include "common/http/header_map_impl.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 namespace Http {
diff --git a/test/common/network/address_impl_speed_test.cc b/test/common/network/address_impl_speed_test.cc
index 48c6614d8d344..481bc9a9d9f8a 100644
--- a/test/common/network/address_impl_speed_test.cc
+++ b/test/common/network/address_impl_speed_test.cc
@@ -5,7 +5,7 @@
 #include "common/common/fmt.h"
 #include "common/network/address_impl.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 namespace Network {
diff --git a/test/common/network/lc_trie_speed_test.cc b/test/common/network/lc_trie_speed_test.cc
index 95136c37a709e..632754af8cdee 100644
--- a/test/common/network/lc_trie_speed_test.cc
+++ b/test/common/network/lc_trie_speed_test.cc
@@ -1,7 +1,7 @@
 #include "common/network/lc_trie.h"
 #include "common/network/utility.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace {
 
diff --git a/test/common/stats/symbol_table_speed_test.cc b/test/common/stats/symbol_table_speed_test.cc
index 3d310f8e4a9bb..beefeadc3e94e 100644
--- a/test/common/stats/symbol_table_speed_test.cc
+++ b/test/common/stats/symbol_table_speed_test.cc
@@ -10,7 +10,7 @@
 #include "test/test_common/utility.h"
 
 #include "absl/synchronization/blocking_counter.h"
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 static void BM_CreateRace(benchmark::State& state) {
   Envoy::Thread::ThreadFactory& thread_factory = Envoy::Thread::threadFactoryForTest();
diff --git a/test/common/stats/thread_local_store_speed_test.cc b/test/common/stats/thread_local_store_speed_test.cc
index 520f78fe3a3af..c23bb1e66520f 100644
--- a/test/common/stats/thread_local_store_speed_test.cc
+++ b/test/common/stats/thread_local_store_speed_test.cc
@@ -14,7 +14,7 @@
 #include "test/test_common/simulated_time_system.h"
 #include "test/test_common/utility.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 
diff --git a/test/common/upstream/load_balancer_benchmark.cc b/test/common/upstream/load_balancer_benchmark.cc
index c629c186613bd..cca489a789b4c 100644
--- a/test/common/upstream/load_balancer_benchmark.cc
+++ b/test/common/upstream/load_balancer_benchmark.cc
@@ -10,7 +10,7 @@
 #include "test/common/upstream/utility.h"
 #include "test/mocks/upstream/mocks.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 namespace Upstream {
diff --git a/test/extensions/filters/listener/tls_inspector/tls_inspector_benchmark.cc b/test/extensions/filters/listener/tls_inspector/tls_inspector_benchmark.cc
index 30da358409890..f2bc9964595d2 100644
--- a/test/extensions/filters/listener/tls_inspector/tls_inspector_benchmark.cc
+++ b/test/extensions/filters/listener/tls_inspector/tls_inspector_benchmark.cc
@@ -11,9 +11,9 @@
 #include "test/mocks/stats/mocks.h"
 #include "test/test_common/threadsafe_singleton_injector.h"
 
+#include "benchmark/benchmark.h"
 #include "gtest/gtest.h"
 #include "openssl/ssl.h"
-#include "testing/base/public/benchmark.h"
 
 using testing::_;
 using testing::AtLeast;
diff --git a/test/extensions/filters/network/redis_proxy/command_lookup_speed_test.cc b/test/extensions/filters/network/redis_proxy/command_lookup_speed_test.cc
index be3237e32398a..a84bef53253f1 100644
--- a/test/extensions/filters/network/redis_proxy/command_lookup_speed_test.cc
+++ b/test/extensions/filters/network/redis_proxy/command_lookup_speed_test.cc
@@ -15,7 +15,7 @@
 #include "test/test_common/printers.h"
 #include "test/test_common/simulated_time_system.h"
 
-#include "testing/base/public/benchmark.h"
+#include "benchmark/benchmark.h"
 
 namespace Envoy {
 namespace Extensions {