diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index af68d701b7c4..c52b924271ef 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -19,14 +19,7 @@ def _repository_impl(ctxt):
     result = ctxt.execute(
         ["./repositories.sh"] + ctxt.attr.recipes,
         environment = environment,
-        # Ideally we would print progress, but instead this hangs on "INFO: Loading
-        # complete.  Analyzing.." today, see
-        # https://github.com/bazelbuild/bazel/issues/1289. We could set quiet=False
-        # as well to indicate progress, but that isn't supported in versions folks
-        # are using right now (0.4.5).
-        # TODO(htuch): Revisit this when everyone is on newer Bazel versions.
-        #
-        # quiet = False,
+        quiet = False,
     )
     print("External dep build exited with return code: %d" % result.return_code)
     print(result.stdout)
@@ -34,6 +27,15 @@ def _repository_impl(ctxt):
     if result.return_code != 0:
         fail("External dep build failed")
 
+def _protobuf_repository_impl(ctxt):
+    deps_path = ctxt.attr.envoy_deps_path
+    if not deps_path.endswith("/"):
+        deps_path += "/"
+    ctxt.symlink(Label(deps_path + "thirdparty/protobuf:protobuf.bzl"), "protobuf.bzl")
+    ctxt.symlink(Label(deps_path + "thirdparty/protobuf:BUILD"), "BUILD")
+    ctxt.symlink(ctxt.path(Label(deps_path + "thirdparty/protobuf:BUILD")).dirname.get_child("src"),
+                 "src")
+
 def py_jinja2_dep():
     BUILD = """
 py_library(
@@ -126,17 +128,6 @@ def envoy_api_deps(skip_targets):
     )
 
 def envoy_dependencies(path = "@envoy_deps//", skip_protobuf_bzl = False, skip_targets = []):
-    if not skip_protobuf_bzl:
-        native.git_repository(
-            name = "protobuf_bzl",
-            # Using a non-canonical repository/branch here. This is a workaround to the lack of
-            # merge on https://github.com/google/protobuf/pull/2508, which is needed for supporting
-            # arbitrary CC compiler locations from the environment. The branch is
-            # https://github.com/htuch/protobuf/tree/v3.2.0-default-shell-env, which is the 3.2.0
-            # release with the above mentioned PR cherry picked.
-            commit = "d490587268931da78c942a6372ef57bb53db80da",
-            remote = REPO_LOCATIONS["protobuf"],
-        )
     native.bind(
         name = "cc_wkt_protos",
         actual = "@protobuf_bzl//:cc_wkt_protos",
@@ -173,6 +164,22 @@ def envoy_dependencies(path = "@envoy_deps//", skip_protobuf_bzl = False, skip_t
         recipes = recipes.to_list(),
     )
 
+    protobuf_repository = repository_rule(
+        implementation = _protobuf_repository_impl,
+        attrs = {
+            "envoy_deps_path": attr.string(),
+        },
+    )
+
+    # If the WORKSPACE hasn't already supplied @protobuf_bzl and told us to skip it, we need to map in the
+    # full repo into @protobuf_bzl so that we can depend on this in envoy_build_system.bzl and for things
+    # like @protobuf_bzl//:cc_wkt_protos in envoy-api. We do this by some evil symlink stuff.
+    if not skip_protobuf_bzl:
+        protobuf_repository(
+            name = "protobuf_bzl",
+            envoy_deps_path = path,
+        )
+
     for t in TARGET_RECIPES:
         if t not in skip_targets:
             native.bind(
diff --git a/ci/WORKSPACE b/ci/WORKSPACE
index 02fb621548a2..53b0f2678d8d 100644
--- a/ci/WORKSPACE
+++ b/ci/WORKSPACE
@@ -5,12 +5,6 @@ load("//bazel:cc_configure.bzl", "cc_configure")
 
 envoy_dependencies(
     path = "//ci/prebuilt",
-    skip_protobuf_bzl = True,
-)
-
-local_repository(
-    name = "protobuf_bzl",
-    path = "/thirdparty/protobuf",
 )
 
 cc_configure()
diff --git a/ci/WORKSPACE.filter.example b/ci/WORKSPACE.filter.example
index 9bbf71d7ed37..5f590be46d68 100644
--- a/ci/WORKSPACE.filter.example
+++ b/ci/WORKSPACE.filter.example
@@ -10,12 +10,6 @@ load("//bazel:cc_configure.bzl", "cc_configure")
 
 envoy_dependencies(
     path = "@envoy//ci/prebuilt",
-    skip_protobuf_bzl = True,
-)
-
-local_repository(
-    name = "protobuf_bzl",
-    path = "/thirdparty/protobuf",
 )
 
 cc_configure()
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index af69df878db4..181d3990bd5a 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -9,7 +9,6 @@ echo "building using ${NUM_CPUS} CPUs"
 
 function bazel_release_binary_build() {
   echo "Building..."
-  BUILD_TYPE=opt protobuf_3322_workaround
   cd "${ENVOY_CI_DIR}"
   bazel --batch build ${BAZEL_BUILD_OPTIONS} -c opt //source/exe:envoy-static.stamped
   # Copy the envoy-static binary somewhere that we can access outside of the
@@ -21,7 +20,6 @@ function bazel_release_binary_build() {
 
 function bazel_debug_binary_build() {
   echo "Building..."
-  BUILD_TYPE=dbg protobuf_3322_workaround
   cd "${ENVOY_CI_DIR}"
   bazel --batch build ${BAZEL_BUILD_OPTIONS} -c dbg //source/exe:envoy-static.stamped
   # Copy the envoy-static binary somewhere that we can access outside of the
@@ -31,11 +29,6 @@ function bazel_debug_binary_build() {
     "${ENVOY_DELIVERY_DIR}"/envoy-debug
 }
 
-# See https://github.com/google/protobuf/issues/3322
-function protobuf_3322_workaround() {
-  ln -sf /thirdparty_build_"${BUILD_TYPE}" "${ENVOY_SRCDIR}"/ci/prebuilt/thirdparty_build
-}
-
 if [[ "$1" == "bazel.release" ]]; then
   setup_gcc_toolchain
   echo "bazel release build with tests..."
@@ -62,7 +55,6 @@ elif [[ "$1" == "bazel.debug.server_only" ]]; then
   exit 0
 elif [[ "$1" == "bazel.asan" ]]; then
   setup_clang_toolchain
-  BUILD_TYPE=dbg protobuf_3322_workaround
   echo "bazel ASAN/UBSAN debug build with tests..."
   cd "${ENVOY_FILTER_EXAMPLE_SRCDIR}"
   echo "Building and testing..."
@@ -71,7 +63,6 @@ elif [[ "$1" == "bazel.asan" ]]; then
   exit 0
 elif [[ "$1" == "bazel.tsan" ]]; then
   setup_clang_toolchain
-  BUILD_TYPE=dbg protobuf_3322_workaround
   echo "bazel TSAN debug build with tests..."
   cd "${ENVOY_FILTER_EXAMPLE_SRCDIR}"
   echo "Building and testing..."
@@ -80,7 +71,6 @@ elif [[ "$1" == "bazel.tsan" ]]; then
   exit 0
 elif [[ "$1" == "bazel.dev" ]]; then
   setup_clang_toolchain
-  BUILD_TYPE=dbg protobuf_3322_workaround
   # This doesn't go into CI but is available for developer convenience.
   echo "bazel fastbuild build with tests..."
   cd "${ENVOY_CI_DIR}"
@@ -96,10 +86,6 @@ elif [[ "$1" == "bazel.dev" ]]; then
   exit 0
 elif [[ "$1" == "bazel.coverage" ]]; then
   setup_gcc_toolchain
-  # Technically test/run_envoy_bazel_coverage.sh is doing a -c dbg build, but it
-  # also sets -DNDEBUG, so for protobuf #3322 purposes, we need to setup for
-  # opt.
-  BUILD_TYPE=opt protobuf_3322_workaround
   echo "bazel coverage build with tests..."
   export GCOVR="/thirdparty/gcovr/scripts/gcovr"
   export GCOVR_DIR="${ENVOY_BUILD_DIR}/bazel-envoy"
diff --git a/ci/envoy_build_sha.sh b/ci/envoy_build_sha.sh
index 17c8c78a93e8..52155b3507bc 100644
--- a/ci/envoy_build_sha.sh
+++ b/ci/envoy_build_sha.sh
@@ -1 +1 @@
-ENVOY_BUILD_SHA=373f1151ac4e87e5e2083375c55013d4a67e08b0
+ENVOY_BUILD_SHA=a49b57007b6459209deee02059bd5ec7d0575762
diff --git a/test/coverage/gen_build.sh b/test/coverage/gen_build.sh
index 490156a1ab6c..b21fd0685058 100755
--- a/test/coverage/gen_build.sh
+++ b/test/coverage/gen_build.sh
@@ -23,9 +23,11 @@ set -e
 # E.g., "//envoy-lyft/test/..."
 [ -z "${EXTRA_QUERY_PATHS}" ] && EXTRA_QUERY_PATHS=""
 
-TARGETS=$("${BAZEL_BIN}" query ${BAZEL_QUERY_OPTIONS} "attr('tags', 'coverage_test_lib', ${REPOSITORY}//test/...)")
+rm -f "${BUILD_PATH}"
+
+TARGETS=$("${BAZEL_BIN}" query ${BAZEL_QUERY_OPTIONS} "attr('tags', 'coverage_test_lib', ${REPOSITORY}//test/...)" | grep "^//")
 if [ -n "${EXTRA_QUERY_PATHS}" ]; then
-  TARGETS="$TARGETS $("${BAZEL_BIN}" query ${BAZEL_QUERY_OPTIONS} "attr('tags', 'coverage_test_lib', ${EXTRA_QUERY_PATHS})")"
+  TARGETS="$TARGETS $("${BAZEL_BIN}" query ${BAZEL_QUERY_OPTIONS} "attr('tags', 'coverage_test_lib', ${EXTRA_QUERY_PATHS})" | grep "^//")"
 fi
 
 (