diff --git a/.circleci/Dockerfile b/.circleci/Dockerfile
index 8b89f92fe3db..2db4a7fc99b3 100644
--- a/.circleci/Dockerfile
+++ b/.circleci/Dockerfile
@@ -14,7 +14,7 @@ RUN sudo sh -c 'echo "deb http://apt.llvm.org/stretch/ llvm-toolchain-stretch-7
 
 RUN sudo apt-get update && \
     sudo apt-get -y install \
-    wget software-properties-common make cmake python python-pip pkg-config \
+    wget software-properties-common make python python-pip pkg-config \
     zlib1g-dev bash-completion bc libtool automake zip time g++-6 gcc-6 \
     clang-7 clang-format-7 clang-tidy-7 lld-7 libc++-7-dev libc++abi-7-dev \
     rsync ninja-build
@@ -32,6 +32,13 @@ RUN cd /tmp && \
     sudo chown -R circleci /usr/local/go && \
     sudo ln -s /usr/local/go/bin/go /usr/local/bin
 
+# instead of "apt-get -y install cmake", pin cmake version to 3.8.0
+RUN cd /tmp && \
+    wget https://github.com/Kitware/CMake/releases/download/v3.8.0/cmake-3.8.0-Linux-x86_64.tar.gz && \
+    sudo tar -C /usr/local/ -xzf cmake-3.8.0-Linux-x86_64.tar.gz && \
+    sudo chown -R circleci /usr/local/cmake-3.8.0-Linux-x86_64 && \
+    sudo ln -s /usr/local/cmake-3.8.0-Linux-x86_64/bin/cmake /usr/local/bin
+
 RUN bazel version
 
 # For circleci unit test integration, "go test -v 2>&1 | go-junit-report > report.xml"
diff --git a/.circleci/Makefile b/.circleci/Makefile
index eb109596c9ef..8b848c62fb34 100644
--- a/.circleci/Makefile
+++ b/.circleci/Makefile
@@ -2,7 +2,7 @@ HUB ?=
 PROJECT ?= istio
 
 # Using same naming convention as istio/istio
-VERSION ?= go1.11-bazel0.22-clang7
+VERSION ?= go1.11-bazel0.22-clang7-cmake3.8.0
 IMG ?= ci
 
 # Build a local image, can be used for testing with circleci command line.
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5731eb3c3778..fc5926b9d0d5 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -3,7 +3,7 @@ version: 2
 jobs:
   build:
     docker:
-      - image: istio/ci:go1.11-bazel0.22-clang7
+      - image: istio/ci:go1.11-bazel0.22-clang7-cmake3.8.0
     environment:
       - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
@@ -31,7 +31,7 @@ jobs:
           destination: /proxy/bin
   linux_asan:
     docker:
-      - image: istio/ci:go1.11-bazel0.22-clang7
+      - image: istio/ci:go1.11-bazel0.22-clang7-cmake3.8.0
     environment:
       - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
@@ -51,7 +51,7 @@ jobs:
             - /home/circleci/.cache/bazel
   linux_tsan:
     docker:
-      - image: istio/ci:go1.11-bazel0.22-clang7
+      - image: istio/ci:go1.11-bazel0.22-clang7-cmake3.8.0
     environment:
       - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
@@ -76,12 +76,16 @@ jobs:
       - BAZEL_STARTUP_ARGS: "--output_base /Users/distiller/.cache/bazel"
       - BAZEL_BUILD_ARGS: "--local_resources=12288,5,1"
       - BAZEL_TEST_ARGS: "--test_env=ENVOY_IP_TEST_VERSIONS=v4only --test_output=all --local_resources=12288,5,1 --local_test_jobs=8"
+      - BAZEL_VERSION: "0.25.0"
       - CC: clang
       - CXX: clang++
     steps:
       - run: sudo ntpdate -vu time.apple.com
-      - run: brew install bazel cmake coreutils go libtool ninja wget
+      - run: brew install cmake coreutils go libtool ninja wget
       - checkout
+      - run: wget https://github.com/bazelbuild/bazel/releases/download/$BAZEL_VERSION/bazel-$BAZEL_VERSION-installer-darwin-x86_64.sh
+      - run: chmod +x bazel-$BAZEL_VERSION-installer-darwin-x86_64.sh
+      - run: sudo ./bazel-$BAZEL_VERSION-installer-darwin-x86_64.sh
       - restore_cache:
           keys:
             - macos_fastbuild-bazel-cache-{{ checksum "WORKSPACE" }}
diff --git a/WORKSPACE b/WORKSPACE
index 4b394c4fff98..44e4caccecae 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -34,20 +34,20 @@ bind(
 
 # When updating envoy sha manually please update the sha in istio.deps file also
 #
-# Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/COMMIT.tar.gz && sha256sum COMMIT.tar.gz`
-# envoy commit date  05/16/2019
+# Determine SHA256 `wget https://github.com/envoyproxy/envoy-wasm/archive/COMMIT.tar.gz && sha256sum COMMIT.tar.gz`
+# envoy-wasm commit date  05/30/2019
 # bazel version: 0.25.0
-ENVOY_SHA = "829b905ca0fdc85233c3969247e53a62a52ac627"
+ENVOY_SHA = "81b3ee8bf4ff343e376ed290c07a95b708af707c"
 
-ENVOY_SHA256 = "a5d4bae1dc4495dfa50700f574ae4106715d720dee288b72d00267efcff26a83"
+ENVOY_SHA256 = "2888f5be49aa4e9681a3497e5c617d655a04ed4e3707ff10b78eec826f4e8649"
 
 LOCAL_ENVOY_PROJECT = "/PATH/TO/ENVOY"
 
 http_archive(
     name = "envoy",
     sha256 = ENVOY_SHA256,
-    strip_prefix = "envoy-" + ENVOY_SHA,
-    url = "https://github.com/envoyproxy/envoy/archive/" + ENVOY_SHA + ".tar.gz",
+    strip_prefix = "envoy-wasm-" + ENVOY_SHA,
+    url = "https://github.com/envoyproxy/envoy-wasm/archive/" + ENVOY_SHA + ".tar.gz",
 )
 
 # TODO(silentdai) Use bazel args to select envoy between local or http