diff --git a/.circleci/Dockerfile b/.circleci/Dockerfile
index 0c36441d10c..6e958b641ab 100644
--- a/.circleci/Dockerfile
+++ b/.circleci/Dockerfile
@@ -20,7 +20,7 @@ RUN sudo apt-get update && \
     rsync ninja-build
 
 # ~100M, depends on g++, zlib1g-dev, bash-completions
-RUN curl -Lo /tmp/bazel.deb https://github.com/bazelbuild/bazel/releases/download/0.27.0/bazel_0.27.0-linux-x86_64.deb && \
+RUN curl -Lo /tmp/bazel.deb https://github.com/bazelbuild/bazel/releases/download/0.28.0/bazel_0.28.0-linux-x86_64.deb && \
     sudo dpkg -i /tmp/bazel.deb && rm /tmp/bazel.deb
 
 
diff --git a/.circleci/Makefile b/.circleci/Makefile
index d2fe112b3f4..07ca669f786 100644
--- a/.circleci/Makefile
+++ b/.circleci/Makefile
@@ -2,7 +2,7 @@ HUB ?=
 PROJECT ?= istio
 
 # Using same naming convention as istio/istio
-VERSION ?= go1.11-bazel0.27-clang8-cmake3.8.0
+VERSION ?= go1.11-bazel0.28-clang8-cmake3.8.0
 IMG ?= ci
 
 # Build a local image, can be used for testing with circleci command line.
diff --git a/.circleci/config.yml b/.circleci/config.yml
index bcc4fc39706..22afe5a3598 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,7 +3,7 @@ version: 2
 jobs:
   build:
     docker:
-      - image: istio/ci:go1.11-bazel0.27-clang8-cmake3.8.0
+      - image: istio/ci:go1.11-bazel0.28-clang8-cmake3.8.0
     environment:
       - BAZEL_BUILD_ARGS: "--local_ram_resources=12288 --local_cpu_resources=8 --verbose_failures --test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
     resource_class: xlarge
@@ -30,7 +30,7 @@ jobs:
           destination: /proxy/bin
   linux_asan:
     docker:
-      - image: istio/ci:go1.11-bazel0.27-clang8-cmake3.8.0
+      - image: istio/ci:go1.11-bazel0.28-clang8-cmake3.8.0
     environment:
       - BAZEL_BUILD_ARGS: "--local_ram_resources=12288 --local_cpu_resources=8 --verbose_failures --test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
     resource_class: xlarge
@@ -49,7 +49,7 @@ jobs:
             - /home/circleci/.cache/bazel
   linux_tsan:
     docker:
-      - image: istio/ci:go1.11-bazel0.27-clang8-cmake3.8.0
+      - image: istio/ci:go1.11-bazel0.28-clang8-cmake3.8.0
     environment:
       - BAZEL_BUILD_ARGS: "--local_ram_resources=12288 --local_cpu_resources=8 --verbose_failures --test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
     resource_class: xlarge
@@ -72,7 +72,7 @@ jobs:
     environment:
       - BAZEL_STARTUP_ARGS: "--output_base /Users/distiller/.cache/bazel"
       - BAZEL_BUILD_ARGS: "--local_ram_resources=12288 --local_cpu_resources=8 --verbose_failures --test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all"
-      - BAZEL_VERSION: "0.27.0"
+      - BAZEL_VERSION: "0.28.0"
       - CC: clang
       - CXX: clang++
     steps:
diff --git a/WORKSPACE b/WORKSPACE
index 2a87fbb0671..b67b453975c 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -39,11 +39,11 @@ bind(
 # When updating envoy sha manually please update the sha in istio.deps file also
 #
 # Determine SHA256 `wget https://github.com/envoyproxy/envoy-wasm/archive/COMMIT.tar.gz && sha256sum COMMIT.tar.gz`
-# envoy-wasm commit date  07/11/2019
-# bazel version: 0.27.0
-ENVOY_SHA = "cdece58fd46f6060cb32e5b0e87052c7bcd7bfa5"
+# envoy-wasm commit date: 07/18/2019
+# bazel version: 0.28.0
+ENVOY_SHA = "cea33f136d22e36e3a18dc93e672a871d4333517"
 
-ENVOY_SHA256 = "7b4ac7cf79810a29593939b5eee82d3714bdfe665a3b7f098d1e95404868b33b"
+ENVOY_SHA256 = "ca9cda606a32e83b0eba2403813a12c1935c76a4b6f0b6c2652b20c8efbecdf9"
 
 LOCAL_ENVOY_PROJECT = "/PATH/TO/ENVOY"
 
@@ -73,10 +73,6 @@ load("@rules_foreign_cc//:workspace_definitions.bzl", "rules_foreign_cc_dependen
 
 rules_foreign_cc_dependencies()
 
-load("@envoy//bazel:cc_configure.bzl", "cc_configure")
-
-cc_configure()
-
 load("@envoy_api//bazel:repositories.bzl", "api_dependencies")
 
 api_dependencies()
diff --git a/istio.deps b/istio.deps
index e251a98c539..949735f79cd 100644
--- a/istio.deps
+++ b/istio.deps
@@ -11,6 +11,6 @@
 		"name": "ENVOY_SHA",
 		"repoName": "envoyproxy/envoy-wasm",
 		"file": "WORKSPACE",
-		"lastStableSHA": "cdece58fd46f6060cb32e5b0e87052c7bcd7bfa5"
+		"lastStableSHA": "cea33f136d22e36e3a18dc93e672a871d4333517"
 	}
 ]