diff --git a/WORKSPACE b/WORKSPACE
index 29f3fafcaaa..26ee77115b1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2026-04-18
-ENVOY_SHA = "5d0b81cb3ae67b0ef23c689a2c67799cbfbcde52"
+# Commit date: 2026-04-20
+ENVOY_SHA = "1622bbc2cf9afecf244e921051da38e8207d3898"
 
-ENVOY_SHA256 = "cd621857c478848d70eac73479920bac7cddc22f78c465bfda712dcd4a379fd3"
+ENVOY_SHA256 = "999b272b46b8779a7db702c0958394d7d4666a8d2ed3a50481042b1e9bec4ac1"
 
 ENVOY_ORG = "envoyproxy"