diff --git a/.azure-pipelines/linux.yml b/.azure-pipelines/linux.yml
index 844e75387ccc..5b942f53ed8f 100644
--- a/.azure-pipelines/linux.yml
+++ b/.azure-pipelines/linux.yml
@@ -1,7 +1,7 @@
 resources:
   containers:
   - container: envoy-build
-    image: envoyproxy/envoy-build:ec38ecb88fd1abe55ab1daa2f6bd239ffccc9d98
+    image: envoyproxy/envoy-build:d0cefa7f071dbd4ef24399c2db8656c3a5d8c3ef
 
 jobs:
 - job: BuildEnvoy
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 76df3f26138f..d3458d108886 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,7 @@ executors:
   ubuntu-build:
     description: "A regular build executor based on ubuntu image"
     docker:
-      - image: envoyproxy/envoy-build:ec38ecb88fd1abe55ab1daa2f6bd239ffccc9d98
+      - image: envoyproxy/envoy-build:d0cefa7f071dbd4ef24399c2db8656c3a5d8c3ef
     resource_class: xlarge
     working_directory: /source
 
diff --git a/api/tools/BUILD b/api/tools/BUILD
index b2848aee130d..e90cfa0eef29 100644
--- a/api/tools/BUILD
+++ b/api/tools/BUILD
@@ -4,6 +4,7 @@ py_binary(
     name = "tap2pcap",
     srcs = ["tap2pcap.py"],
     licenses = ["notice"],  # Apache 2
+    python_version = "PY2",
     visibility = ["//visibility:public"],
     deps = [
         "//envoy/data/tap/v2alpha:wrapper_py",
@@ -17,6 +18,7 @@ py_test(
         "data/tap2pcap_h2_ipv4.pb_text",
         "data/tap2pcap_h2_ipv4.txt",
     ],
+    python_version = "PY2",
     # Don't run this by default, since we don't want to force local dependency on Wireshark/tshark,
     # will explicitly invoke in CI.
     tags = ["manual"],
diff --git a/bazel/external/gcovr.BUILD b/bazel/external/gcovr.BUILD
index 57ee8e7fb971..0215a25da848 100644
--- a/bazel/external/gcovr.BUILD
+++ b/bazel/external/gcovr.BUILD
@@ -10,6 +10,7 @@ par_binary(
     name = "gcovr",
     srcs = [":renamed_gcovr.py"],
     main = ":renamed_gcovr.py",
+    python_version = "PY2",
     visibility = ["//visibility:public"],
 )
 
diff --git a/bazel/gen_compilation_database.sh b/bazel/gen_compilation_database.sh
index 29afd5aba8f1..d642ddfd285d 100755
--- a/bazel/gen_compilation_database.sh
+++ b/bazel/gen_compilation_database.sh
@@ -1,7 +1,6 @@
 #!/bin/bash
 
-#TODO(lizan): revert to released version once new version is released
-RELEASE_VERSION=d5a0ee259aa356886618eafae17ca05ebf79d6c2
+RELEASE_VERSION=0.3.5
 
 if [[ ! -d bazel-compilation-database-${RELEASE_VERSION} ]]; then
   curl -L https://github.com/grailbio/bazel-compilation-database/archive/${RELEASE_VERSION}.tar.gz | tar -xz
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 9960796a9b88..5818d9108a59 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -63,9 +63,9 @@ REPOSITORY_LOCATIONS = dict(
         urls = ["https://github.com/gabime/spdlog/archive/v1.3.1.tar.gz"],
     ),
     com_github_gcovr_gcovr = dict(
-        sha256 = "8a60ba6242d67a58320e9e16630d80448ef6d5284fda5fb3eff927b63c8b04a2",
-        strip_prefix = "gcovr-3.3",
-        urls = ["https://github.com/gcovr/gcovr/archive/3.3.tar.gz"],
+        sha256 = "1c52a71f245adfe1b45e30fbe5015337fe66546f17f40038b3969b7b42acceed",
+        strip_prefix = "gcovr-3.4",
+        urls = ["https://github.com/gcovr/gcovr/archive/3.4.tar.gz"],
     ),
     com_github_google_libprotobuf_mutator = dict(
         sha256 = "97b3639630040f41c45f45838ab00b78909e6b4cb69c8028e01302bea5b79495",
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index d55381c86de0..e048a8abe920 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -246,7 +246,7 @@ elif [[ "$CI_TARGET" == "bazel.coverage" ]]; then
 
   # gcovr is a pain to run with `bazel run`, so package it up into a
   # relocatable and hermetic-ish .par file.
-  bazel build @com_github_gcovr_gcovr//:gcovr.par
+  bazel build --python_version=PY2 @com_github_gcovr_gcovr//:gcovr.par
   export GCOVR="/tmp/gcovr.par"
   cp -f "${ENVOY_SRCDIR}/bazel-bin/external/com_github_gcovr_gcovr/gcovr.par" ${GCOVR}
 
diff --git a/tools/protodoc/BUILD b/tools/protodoc/BUILD
index 55a5fd529f9d..8e428b5d24fd 100644
--- a/tools/protodoc/BUILD
+++ b/tools/protodoc/BUILD
@@ -3,6 +3,7 @@ licenses(["notice"])  # Apache 2
 py_binary(
     name = "protodoc",
     srcs = ["protodoc.py"],
+    python_version = "PY2",
     visibility = ["//visibility:public"],
     deps = [
         "@com_envoyproxy_protoc_gen_validate//validate:validate_py",
diff --git a/tools/socket_passing.py b/tools/socket_passing.py
index 22f57cf59aeb..ee30db34ad01 100755
--- a/tools/socket_passing.py
+++ b/tools/socket_passing.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python2.7
+#!/usr/bin/env python3
 
 # This tool is a helper script that queries the admin address for all listener
 # addresses after envoy startup. (The admin address is written out to a file by
@@ -10,7 +10,7 @@
 from collections import OrderedDict
 
 import argparse
-import httplib
+import http.client
 import json
 import os.path
 import re
@@ -29,12 +29,12 @@ def GenerateNewConfig(original_yaml, admin_address, updated_json):
   with open(original_yaml, 'r') as original_file:
     sys.stdout.write('Admin address is ' + admin_address + '\n')
     try:
-      admin_conn = httplib.HTTPConnection(admin_address)
+      admin_conn = http.client.HTTPConnection(admin_address)
       admin_conn.request('GET', '/listeners?format=json')
       admin_response = admin_conn.getresponse()
       if not admin_response.status == 200:
         return False
-      discovered_listeners = json.loads(admin_response.read())
+      discovered_listeners = json.loads(admin_response.read().decode('utf-8'))
     except Exception as e:
       sys.stderr.write('Cannot connect to admin: %s\n' % e)
       return False