diff --git a/.bazelrc b/.bazelrc
index eeafe30b73294..8a549c6e8dc01 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -61,5 +61,8 @@ build:libc++ --action_env=CXXFLAGS=-stdlib=libc++
 build:libc++ --action_env=PATH
 build:libc++ --define force_libcpp=enabled
 
+# Optimize build for binary size reduction.
+build:sizeopt -c opt --copt -Os
+
 # Test options
 test --test_env=HEAPCHECK=normal --test_env=PPROF_PATH
diff --git a/bazel/README.md b/bazel/README.md
index 6c429f913d029..a949d5cd891c3 100644
--- a/bazel/README.md
+++ b/bazel/README.md
@@ -299,6 +299,13 @@ You can use the `-c <compilation_mode>` flag to control this, e.g.
 bazel build -c opt //source/exe:envoy-static
 ```
 
+To override the compilation mode and optimize the build for binary size, you can
+use the `sizeopt` configuration:
+
+```
+bazel build //source/exe:envoy-static --config=sizeopt
+```
+
 ## Sanitizers
 
 To build and run tests with the gcc compiler's [address sanitizer
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index bab2fa9e8b035..772b4de7b50ba 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -39,39 +39,52 @@ function bazel_with_collection() {
   collect_build_profile $1
 }
 
-function bazel_release_binary_build() {
-  echo "Building..."
-  bazel build ${BAZEL_BUILD_OPTIONS} -c opt //source/exe:envoy-static
-  collect_build_profile release_build
-  # Copy the envoy-static binary somewhere that we can access outside of the
-  # container.
+function cp_binary_for_outside_access() {
+  DELIVERY_LOCATION="$1"
   cp -f \
     "${ENVOY_SRCDIR}"/bazel-bin/source/exe/envoy-static \
-    "${ENVOY_DELIVERY_DIR}"/envoy
+    "${ENVOY_DELIVERY_DIR}"/"${DELIVERY_LOCATION}"
+}
 
+function cp_binary_for_image_build() {
   # TODO(mattklein123): Replace this with caching and a different job which creates images.
-  echo "Copying release binary for image build..."
-  mkdir -p "${ENVOY_SRCDIR}"/build_release
-  cp -f "${ENVOY_DELIVERY_DIR}"/envoy "${ENVOY_SRCDIR}"/build_release
-  mkdir -p "${ENVOY_SRCDIR}"/build_release_stripped
-  strip "${ENVOY_DELIVERY_DIR}"/envoy -o "${ENVOY_SRCDIR}"/build_release_stripped/envoy
+  echo "Copying binary for image build..."
+  mkdir -p "${ENVOY_SRCDIR}"/build_"$1"
+  cp -f "${ENVOY_DELIVERY_DIR}"/envoy "${ENVOY_SRCDIR}"/build_"$1"
+  mkdir -p "${ENVOY_SRCDIR}"/build_"$1"_stripped
+  strip "${ENVOY_DELIVERY_DIR}"/envoy -o "${ENVOY_SRCDIR}"/build_"$1"_stripped/envoy
 }
 
-function bazel_debug_binary_build() {
+function bazel_binary_build() {
+  BINARY_TYPE="$1"
+  if [[ "${BINARY_TYPE}" == "release" ]]; then
+    COMPILE_TYPE="opt"
+  elif [[ "${BINARY_TYPE}" == "debug" ]]; then
+    COMPILE_TYPE="dbg"
+  elif [[ "${BINARY_TYPE}" == "sizeopt" ]]; then
+    # The COMPILE_TYPE variable is redundant in this case and is only here for
+    # readability. It is already set in the .bazelrc config for sizeopt.
+    COMPILE_TYPE="opt"
+    CONFIG_ARGS="--config=sizeopt"
+  elif [[ "${BINARY_TYPE}" == "fastbuild" ]]; then
+    COMPILE_TYPE="fastbuild"
+  fi
+
   echo "Building..."
-  bazel build ${BAZEL_BUILD_OPTIONS} -c dbg //source/exe:envoy-static
-  collect_build_profile debug_build
+  bazel build ${BAZEL_BUILD_OPTIONS} -c "${COMPILE_TYPE}" //source/exe:envoy-static ${CONFIG_ARGS}
+  collect_build_profile "${BINARY_TYPE}"_build
+
   # Copy the envoy-static binary somewhere that we can access outside of the
   # container.
-  cp -f \
-    "${ENVOY_SRCDIR}"/bazel-bin/source/exe/envoy-static \
-    "${ENVOY_DELIVERY_DIR}"/envoy-debug
+  cp_binary_for_outside_access envoy
+
+  cp_binary_for_image_build "${BINARY_TYPE}"
 }
 
 if [[ "$1" == "bazel.release" ]]; then
   setup_clang_toolchain
   echo "bazel release build with tests..."
-  bazel_release_binary_build
+  bazel_binary_build release
 
   if [[ $# -gt 1 ]]; then
     shift
@@ -92,19 +105,31 @@ if [[ "$1" == "bazel.release" ]]; then
 elif [[ "$1" == "bazel.release.server_only" ]]; then
   setup_clang_toolchain
   echo "bazel release build..."
-  bazel_release_binary_build
+  bazel_binary_build release
+  exit 0
+elif [[ "$1" == "bazel.sizeopt.server_only" ]]; then
+  setup_clang_toolchain
+  echo "bazel size optimized build..."
+  bazel_binary_build sizeopt
+  exit 0
+elif [[ "$1" == "bazel.sizeopt" ]]; then
+  setup_clang_toolchain
+  echo "bazel size optimized build with tests..."
+  bazel_binary_build sizeopt
+  echo "Testing..."
+  bazel test ${BAZEL_TEST_OPTIONS} //test/... --config=sizeopt
   exit 0
 elif [[ "$1" == "bazel.debug" ]]; then
   setup_clang_toolchain
   echo "bazel debug build with tests..."
-  bazel_debug_binary_build
+  bazel_binary_build debug
   echo "Testing..."
   bazel test ${BAZEL_TEST_OPTIONS} -c dbg //test/...
   exit 0
 elif [[ "$1" == "bazel.debug.server_only" ]]; then
   setup_clang_toolchain
   echo "bazel debug build..."
-  bazel_debug_binary_build
+  bazel_binary_build debug
   exit 0
 elif [[ "$1" == "bazel.asan" ]]; then
   setup_clang_toolchain
@@ -146,12 +171,8 @@ elif [[ "$1" == "bazel.dev" ]]; then
   # This doesn't go into CI but is available for developer convenience.
   echo "bazel fastbuild build with tests..."
   echo "Building..."
-  bazel build ${BAZEL_BUILD_OPTIONS} -c fastbuild //source/exe:envoy-static
-  # Copy the envoy-static binary somewhere that we can access outside of the
-  # container for developers.
-  cp -f \
-    "${ENVOY_SRCDIR}"/bazel-bin/source/exe/envoy-static \
-    "${ENVOY_DELIVERY_DIR}"/envoy-fastbuild
+  bazel_binary_build fastbuild
+
   echo "Building and testing..."
   bazel test ${BAZEL_TEST_OPTIONS} -c fastbuild //test/...
   exit 0