diff --git a/.bazelrc b/.bazelrc
index 75a93323f7c..a0bfbcb421d 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -2,6 +2,11 @@
 # Envoy specific Bazel build/test options.
 
 build --workspace_status_command=tools/bazel_get_workspace_status
+# Bazel doesn't need more than 200MB of memory based on memory profiling:
+# https://docs.bazel.build/versions/master/skylark/performance.html#memory-profiling
+# Limiting JVM heapsize here to let it do GC more when approaching the limit to
+# leave room for compiler/linker.
+startup --host_jvm_args=-Xmx512m
 
 # Basic ASAN/UBSAN that works for gcc
 build:asan --define ENVOY_CONFIG_ASAN=1
@@ -18,6 +23,7 @@ build:asan --define signal_trace=disabled
 # Clang 5.0 ASAN
 build:clang-asan --define ENVOY_CONFIG_ASAN=1
 build:clang-asan --copt -D__SANITIZE_ADDRESS__
+build:clang-asan --copt -DADDRESS_SANITIZER=1
 build:clang-asan --copt -fsanitize=address,undefined
 build:clang-asan --linkopt -fsanitize=address,undefined
 build:clang-asan --copt -fno-sanitize=vptr
@@ -29,12 +35,14 @@ build:clang-asan --build_tag_filters=-no_asan
 build:clang-asan --test_tag_filters=-no_asan
 build:clang-asan --define signal_trace=disabled
 build:clang-asan --test_env=ASAN_SYMBOLIZER_PATH
+build:clang-asan --linkopt -fuse-ld=lld
 
 # Clang 5.0 TSAN
 build:clang-tsan --define ENVOY_CONFIG_TSAN=1
 build:clang-tsan --copt -fsanitize=thread
 build:clang-tsan --linkopt -fsanitize=thread
 build:clang-tsan --define tcmalloc=disabled
+build:clang-tsan --linkopt -fuse-ld=lld
 
 # Clang 5.0 MSAN - broken today since we need to rebuild lib[std]c++ and external deps with MSAN
 # support (see https://github.com/envoyproxy/envoy/issues/443).
diff --git a/.circleci/config.yml b/.circleci/config.yml
index b91adec4b24..5731eb3c377 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,9 +3,10 @@ version: 2
 jobs:
   build:
     docker:
-      - image: istio/ci:go1.10-bazel0.18-clang6.0
+      - image: istio/ci:go1.11-bazel0.22-clang7
     environment:
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
     resource_class: xlarge
     steps:
       - checkout
@@ -30,9 +31,10 @@ jobs:
           destination: /proxy/bin
   linux_asan:
     docker:
-      - image: istio/ci:go1.10-bazel0.18-clang6.0
+      - image: istio/ci:go1.11-bazel0.22-clang7
     environment:
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
     resource_class: xlarge
     steps:
       - checkout
@@ -49,9 +51,10 @@ jobs:
             - /home/circleci/.cache/bazel
   linux_tsan:
     docker:
-      - image: istio/ci:go1.10-bazel0.18-clang6.0
+      - image: istio/ci:go1.11-bazel0.22-clang7
     environment:
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
     resource_class: xlarge
     steps:
       - checkout
@@ -71,7 +74,8 @@ jobs:
       xcode: "9.3.0"
     environment:
       - BAZEL_STARTUP_ARGS: "--output_base /Users/distiller/.cache/bazel"
-      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
+      - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
+      - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
       - CC: clang
       - CXX: clang++
     steps:
diff --git a/Makefile b/Makefile
index a73ee832f09..667ee3fb0bb 100644
--- a/Makefile
+++ b/Makefile
@@ -23,19 +23,20 @@ BAZEL_TEST_ARGS ?=
 HUB ?=
 TAG ?=
 ifeq "$(origin CC)" "default"
-CC := clang-6.0
+CC := clang-7
 endif
 ifeq "$(origin CXX)" "default"
-CXX := clang++-6.0
+CXX := clang++-7
 endif
+PATH := /usr/lib/llvm-7/bin:$(PATH)
 
 build:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) //...
+	PATH=$(PATH) CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) //...
 	@bazel shutdown
 
 # Build only envoy - fast
 build_envoy:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) //src/envoy:envoy
+	PATH=$(PATH) CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) build $(BAZEL_BUILD_ARGS) //src/envoy:envoy
 	@bazel shutdown
 
 clean:
@@ -43,15 +44,15 @@ clean:
 	@bazel shutdown
 
 test:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) //...
+	PATH=$(PATH) CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) //...
 	@bazel shutdown
 
 test_asan:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-asan //...
+	PATH=$(PATH) CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-asan //...
 	@bazel shutdown
 
 test_tsan:
-	CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-tsan //...
+	PATH=$(PATH) CC=$(CC) CXX=$(CXX) bazel $(BAZEL_STARTUP_ARGS) test $(BAZEL_TEST_ARGS) --config=clang-tsan //...
 	@bazel shutdown
 
 check:
diff --git a/WORKSPACE b/WORKSPACE
index e0b9d48b9e4..a42fc7344bf 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -35,9 +35,9 @@ bind(
 # When updating envoy sha manually please update the sha in istio.deps file also
 #
 # Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/COMMIT.tar.gz && sha256sum COMMIT.tar.gz`
-ENVOY_SHA = "b3be5713f2100ab5c40316e73ce34581245bd26a"
+ENVOY_SHA = "925810d00b0d3095a8e67fd4e04e0f597ed188bb"
 
-ENVOY_SHA256 = "79629284ae143d66b873c08883dc6382fac2e8ed45f6f3521f7e7282b6650216"
+ENVOY_SHA256 = "26d1f14e881455546cf0e222ec92a8e1e5f65cb2c5761d63c66598b39cd9c47d"
 
 http_archive(
     name = "envoy",
@@ -50,6 +50,10 @@ load("@envoy//bazel:repositories.bzl", "envoy_dependencies")
 
 envoy_dependencies()
 
+load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependencies")
+
+rules_foreign_cc_dependencies()
+
 load("@envoy//bazel:cc_configure.bzl", "cc_configure")
 
 cc_configure()
diff --git a/istio.deps b/istio.deps
index 840e51dd3de..92aae64403b 100644
--- a/istio.deps
+++ b/istio.deps
@@ -11,6 +11,6 @@
 		"name": "ENVOY_SHA",
 		"repoName": "envoyproxy/envoy",
 		"file": "WORKSPACE",
-		"lastStableSHA": "b3be5713f2100ab5c40316e73ce34581245bd26a"
+		"lastStableSHA": "925810d00b0d3095a8e67fd4e04e0f597ed188bb"
 	}
 ]
diff --git a/script/release-binary b/script/release-binary
index ebde3fc43c3..bd1cb424049 100755
--- a/script/release-binary
+++ b/script/release-binary
@@ -19,8 +19,8 @@
 set -ex
 
 # Use clang for the release builds.
-CC=${CC:-clang-6.0}
-CXX=${CXX:-clang++-6.0}
+CC=${CC:-clang-7}
+CXX=${CXX:-clang++-7}
 
 # The bucket name to store proxy binary
 DST="gs://istio-build/proxy"