diff --git a/WORKSPACE b/WORKSPACE
index 642a1bddc10..a8b7e6e146e 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-03-26
-ENVOY_SHA = "d4b45a2901e3aef9c3a906d6b99473729fb41282"
+# Commit date: 2025-04-11
+ENVOY_SHA = "dc84fe53b5293da9475f12baa173e6cdc0baf238"
 
-ENVOY_SHA256 = "fc1735e3544e5200c51b07635deec5cd739ac1775b29992be66e46e01cb2d273"
+ENVOY_SHA256 = "8b7f76708b3e9fc5aa83f90e211033f7a2054df725fc47cd4191e6dc21fe7771"
 
 ENVOY_ORG = "envoyproxy"