diff --git a/.bazelrc b/.bazelrc
index 88a480bc0b0ff..97b52a4c3ca7c 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -14,6 +14,7 @@ build:asan --copt -fsanitize=address,undefined
 build:asan --linkopt -fsanitize=address,undefined
 build:asan --copt -fno-sanitize=vptr
 build:asan --linkopt -fno-sanitize=vptr
+build:asan --linkopt -fuse-ld=lld
 build:asan --linkopt -ldl
 build:asan --define tcmalloc=disabled
 build:asan --build_tag_filters=-no_asan
@@ -38,7 +39,10 @@ build:macos-asan --copt -D_FORTIFY_SOURCE=0
 build:clang-tsan --define ENVOY_CONFIG_TSAN=1
 build:clang-tsan --copt -fsanitize=thread
 build:clang-tsan --linkopt -fsanitize=thread
+build:clang-tsan --linkopt -fuse-ld=lld
 build:clang-tsan --define tcmalloc=disabled
+# Needed due to https://github.com/libevent/libevent/issues/777
+build:clang-tsan --copt -DEVENT__DISABLE_DEBUG_MODE
 
 # Clang MSAN - broken today since we need to rebuild lib[std]c++ and external deps with MSAN
 # support (see https://github.com/envoyproxy/envoy/issues/443).
diff --git a/bazel/BUILD b/bazel/BUILD
index 90271e7d9699e..62834f28ed52c 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -75,6 +75,11 @@ config_setting(
     values = {"compilation_mode": "dbg"},
 )
 
+config_setting(
+    name = "asan_build",
+    values = {"define": "ENVOY_CONFIG_ASAN=1"},
+)
+
 config_setting(
     name = "coverage_build",
     values = {"define": "ENVOY_CONFIG_COVERAGE=1"},
diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
index 3791c8f3adbdf..fc6a2eac33579 100644
--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
@@ -32,6 +32,13 @@ cc_library(
 configure_make(
     name = "luajit",
     configure_command = "build.py",
+    configure_env_vars = select({
+        # This shouldn't be needed! See
+        # https://github.com/envoyproxy/envoy/issues/6084
+        # TODO(htuch): Remove when #6084 is fixed
+        "//bazel:asan_build": {"ENVOY_CONFIG_ASAN": "1"},
+        "//conditions:default": {},
+    }),
     lib_source = "@com_github_luajit_luajit//:all",
     make_commands = [],
     static_libraries = [
diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 15b025595e7e3..15c65c3672fb4 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -48,7 +48,7 @@ new file mode 100755
 index 0000000..9c71271
 --- /dev/null
 +++ b/build.py
-@@ -0,0 +1,28 @@
+@@ -0,0 +1,35 @@
 +#!/usr/bin/env python
 +
 +import argparse
@@ -73,6 +73,13 @@ index 0000000..9c71271
 +    # fail on it.
 +    os.environ["LSAN_OPTIONS"] = "exitcode=0"
 +
++    # Blacklist LuaJIT from ASAN for now.
++    # TODO(htuch): Remove this when https://github.com/envoyproxy/envoy/issues/6084 is resolved.
++    if "ENVOY_CONFIG_ASAN" in os.environ:
++      os.environ["TARGET_CFLAGS"] += " -fsanitize-blacklist=%s/com_github_luajit_luajit/clang-asan-blacklist.txt" % os.environ["PWD"]
++      with open("clang-asan-blacklist.txt", "w") as f:
++        f.write("fun:*\n")
++
 +    os.system('make V=1 PREFIX="{}" install'.format(args.prefix))
 +
 +main()
diff --git a/bazel/foreign_cc/zlib.patch b/bazel/foreign_cc/zlib.patch
new file mode 100644
index 0000000000000..7d2524ca4ec45
--- /dev/null
+++ b/bazel/foreign_cc/zlib.patch
@@ -0,0 +1,18 @@
+diff --git a/trees.c b/trees.c
+index 50cf4b4..e705576 100644
+--- a/trees.c
++++ b/trees.c
+@@ -870,7 +870,9 @@ void ZLIB_INTERNAL _tr_stored_block(s, buf, stored_len, last)
+     bi_windup(s);        /* align on byte boundary */
+     put_short(s, (ush)stored_len);
+     put_short(s, (ush)~stored_len);
+-    zmemcpy(s->pending_buf + s->pending, (Bytef *)buf, stored_len);
++    if (stored_len > 0) {
++        zmemcpy(s->pending_buf + s->pending, (Bytef *)buf, stored_len);
++    }
+     s->pending += stored_len;
+ #ifdef ZLIB_DEBUG
+     s->compressed_len = (s->compressed_len + 3 + 7) & (ulg)~7L;
+-- 
+2.21.0.593.g511ec345e18-goog
+
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index a6b762243efeb..8fd8f088d1cad 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -319,6 +319,10 @@ def _com_github_madler_zlib():
     http_archive(
         name = "com_github_madler_zlib",
         build_file_content = BUILD_ALL_CONTENT,
+        # The patch is only needed due to https://github.com/madler/zlib/pull/420
+        # TODO(htuch): remove this when zlib #420 merges.
+        patch_args = ["-p1"],
+        patches = ["@envoy//bazel/foreign_cc:zlib.patch"],
         **location
     )
     native.bind(
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index afac13ec52d8a..e4ed8844021df 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -219,10 +219,10 @@ REPOSITORY_LOCATIONS = dict(
         urls = ["https://github.com/bazelbuild/rules_go/releases/download/0.17.1/rules_go-0.17.1.tar.gz"],
     ),
     rules_foreign_cc = dict(
-        sha256 = "e1b67e1fda647c7713baac11752573bfd4c2d45ef09afb4d4de9eb9bd4e5ac76",
-        strip_prefix = "rules_foreign_cc-8648b0446092ef2a34d45b02c8dc4c35c3a8df79",
+        sha256 = "136470a38dcd00c7890230402b43004dc947bf1e3dd0289dd1bd2bfb1e0a3484",
+        strip_prefix = "rules_foreign_cc-e3f4b5e0bc9dac9cf036616c13de25e6cd5051a2",
         # 2019-02-14
-        urls = ["https://github.com/bazelbuild/rules_foreign_cc/archive/8648b0446092ef2a34d45b02c8dc4c35c3a8df79.tar.gz"],
+        urls = ["https://github.com/bazelbuild/rules_foreign_cc/archive/e3f4b5e0bc9dac9cf036616c13de25e6cd5051a2.tar.gz"],
     ),
     six_archive = dict(
         sha256 = "105f8d68616f8248e24bf0e9372ef04d3cc10104f1980f54d57b2ce73a5ad56a",