diff --git a/WORKSPACE b/WORKSPACE
index 4cc22baa7eb..2131b14ccca 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -38,10 +38,10 @@ bind(
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
 # Note: this is needed by release builder to resolve envoy dep sha to tag.
-# Commit date: 2021-03-06
-ENVOY_SHA = "ca60583f1c4dfc3547b4efac9ecac7e0bcc20eee"
+# Commit date: 2021-03-08
+ENVOY_SHA = "f2a517cb05f0cf53544ab31272fd1bcb4e7922ce"
 
-ENVOY_SHA256 = "54c277d82c39f10e4d2d08c5232650aed995e3559698a68e488d208535d0a2a3"
+ENVOY_SHA256 = "2fc0c709f6885b87862ebe5ee22349005257444ba64ca8043b323fddadf88543"
 
 ENVOY_ORG = "envoyproxy"
 
diff --git a/envoy.bazelrc b/envoy.bazelrc
index c7a6e779b7c..74d5f76babe 100644
--- a/envoy.bazelrc
+++ b/envoy.bazelrc
@@ -246,7 +246,7 @@ build:remote-clang-cl --config=rbe-toolchain-clang-cl
 
 # Docker sandbox
 # NOTE: Update this from https://github.com/envoyproxy/envoy-build-tools/blob/main/toolchains/rbe_toolchains_config.bzl#L8
-build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:d9b1f1cbb24b2cecca768feaa9fa3c6e6660a948
+build:docker-sandbox --experimental_docker_image=envoyproxy/envoy-build-ubuntu:e33c93e6d79804bf95ff80426d10bdcc9096c785
 build:docker-sandbox --spawn_strategy=docker
 build:docker-sandbox --strategy=Javac=docker
 build:docker-sandbox --strategy=Closure=docker