diff --git a/.bazelrc b/.bazelrc
index b69e4d494..98273323c 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -88,6 +88,9 @@ common --incompatible_allow_tags_propagation
 common --@rules_python//python/config_settings:bootstrap_impl=script
 build --incompatible_default_to_explicit_init_py
 
+# Protobuf
+common --@com_google_protobuf//bazel/flags:prefer_prebuilt_protoc=true
+
 # We already have absl in the build, define absl=1 to tell googletest to use absl for backtrace.
 build --define absl=1
 
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 7bf411b86..9a93cea0f 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -1,7 +1,7 @@
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-ENVOY_COMMIT = "4d6c488f2889cb7d8a72ab1631d4cf087f356fc8"
-ENVOY_SHA = "954a823603f8422a2b6e22e13a75f1a5dff98bd58a89ecaf6299c7ed9accbe15"
+ENVOY_COMMIT = "ad01ae36a702169140334ebadb2d0fc3be56327e"
+ENVOY_SHA = "3300fd5696b526ffc114e193e1617b3a3acabe52e7b524a23fcd0e6d45963506"
 
 HDR_HISTOGRAM_C_VERSION = "0.11.8"  # June 18th, 2025
 HDR_HISTOGRAM_C_SHA = "bb95351a6a8b242dc9be1f28562761a84d4cf0a874ffc90a9b630770a6468e94"
diff --git a/tools/code_format/config.yaml b/tools/code_format/config.yaml
index 019ea45a0..60693b0a5 100644
--- a/tools/code_format/config.yaml
+++ b/tools/code_format/config.yaml
@@ -176,37 +176,9 @@ paths:
     - source/extensions/content_parsers/json/config.cc
     - source/extensions/content_parsers/json/json_content_parser_impl.cc
     - source/extensions/compression/zstd/common/dictionary_manager.h
-    - source/extensions/filters/http/adaptive_concurrency/controller
-    - source/extensions/filters/http/admission_control/config.cc
-    - source/extensions/filters/http/basic_auth
-    - source/extensions/filters/http/cache
-    - source/extensions/filters/http/common
-    - source/extensions/filters/http/composite
-    - source/extensions/filters/http/dynamic_modules/factory.cc
-    - source/extensions/filters/http/ext_authz
-    - source/extensions/filters/http/ext_proc
-    - source/extensions/filters/http/file_system_buffer
-    - source/extensions/filters/http/filter_chain/filter.cc
-    - source/extensions/filters/http/gcp_authn
-    - source/extensions/filters/http/grpc_field_extraction
-    - source/extensions/filters/http/grpc_json_reverse_transcoder
-    - source/extensions/filters/http/grpc_json_transcoder
-    - source/extensions/filters/http/grpc_stats
-    - source/extensions/filters/http/header_mutation/config.cc
-    - source/extensions/filters/http/health_check
-    - source/extensions/filters/http/json_to_metadata
-    - source/extensions/filters/http/jwt_authn
-    - source/extensions/filters/http/local_ratelimit
-    - source/extensions/filters/http/file_system_buffer
-    - source/extensions/filters/http/on_demand
-    - source/extensions/filters/http/json_to_metadata
-    - source/extensions/filters/http/json_to_metadata
-    - source/extensions/filters/http/thrift_to_metadata
-    - source/extensions/filters/http/lua
-    - source/extensions/filters/http/proto_message_extraction
-    - source/extensions/filters/http/rate_limit_quota
-    - source/extensions/filters/http/oauth2
-    - source/extensions/filters/http/wasm
+    - source/extensions/filters/http/composite/action.cc
+    - source/extensions/filters/http/json_to_metadata/filter.cc
+    - source/extensions/filters/http/oauth2/filter.h
     - source/extensions/filters/network/dubbo_proxy
     - source/extensions/filters/network/common
     - source/extensions/filters/network/redis_proxy