diff --git a/.azure-pipelines/linux.yml b/.azure-pipelines/linux.yml
index 4bb64ea59faad..725e299b19cb3 100644
--- a/.azure-pipelines/linux.yml
+++ b/.azure-pipelines/linux.yml
@@ -1,7 +1,7 @@
 resources:
   containers:
   - container: envoy-build
-    image: envoyproxy/envoy-build:d0cefa7f071dbd4ef24399c2db8656c3a5d8c3ef
+    image: envoyproxy/envoy-build:8246167b9d238797cbc6c03dccc9e3921c37617d
 
 jobs:
 - job: EnvoyFullTest
@@ -10,7 +10,7 @@ jobs:
     vmImage: 'Ubuntu 16.04'
   container: envoy-build
   steps:
-  # bazel.dev isn't for CI purpose but we use it here to experiment with Azure Pipeline 
+  # bazel.dev isn't for CI purpose but we use it here to experiment with Azure Pipeline
   # as it builds faster, before Azure can provision larger VM or we can use RBE.
   - script: ci/do_ci.sh bazel.dev
     env:
diff --git a/.circleci/config.yml b/.circleci/config.yml
index d3458d108886e..69c8a7ed7437f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,7 @@ executors:
   ubuntu-build:
     description: "A regular build executor based on ubuntu image"
     docker:
-      - image: envoyproxy/envoy-build:d0cefa7f071dbd4ef24399c2db8656c3a5d8c3ef
+      - image: envoyproxy/envoy-build:8246167b9d238797cbc6c03dccc9e3921c37617d
     resource_class: xlarge
     working_directory: /source
 
diff --git a/bazel/external/boringssl_fips.genrule_cmd b/bazel/external/boringssl_fips.genrule_cmd
index d498d2ffd3db5..cff25f0f084ee 100644
--- a/bazel/external/boringssl_fips.genrule_cmd
+++ b/bazel/external/boringssl_fips.genrule_cmd
@@ -65,7 +65,7 @@ PLATFORM="linux"
 
 curl -sLO https://github.com/ninja-build/ninja/releases/download/v"$$VERSION"/ninja-"$$PLATFORM".zip \
   && echo "$$SHA256" ninja-"$$PLATFORM".zip | sha256sum --check
-unzip ninja-"$$PLATFORM".zip
+unzip -o ninja-"$$PLATFORM".zip
 
 export PATH="$$PWD:$$PATH"