diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
index bac100bfca96..4b2cd0631cf7 100644
--- a/.azure-pipelines/pipelines.yml
+++ b/.azure-pipelines/pipelines.yml
@@ -407,7 +407,7 @@ stages:
       - job: test
         timeoutInMinutes: 180
         pool:
-          vmImage: "macos-latest"
+          vmImage: "macos-10.15"
         steps:
           - script: ./ci/mac_ci_setup.sh
             displayName: "Install dependencies"
@@ -441,7 +441,7 @@ stages:
       - job: release
         timeoutInMinutes: 120
         pool:
-          vmImage: "windows-latest"
+          vmImage: "windows-2019"
         steps:
           - task: Cache@2
             inputs:
@@ -476,7 +476,7 @@ stages:
       - job: clang_cl
         timeoutInMinutes: 120
         pool:
-          vmImage: "windows-latest"
+          vmImage: "windows-2019"
         steps:
           - task: Cache@2
             inputs:
@@ -512,7 +512,7 @@ stages:
         dependsOn: ["release"]
         timeoutInMinutes: 120
         pool:
-          vmImage: "windows-latest"
+          vmImage: "windows-2019"
         steps:
           - task: DownloadBuildArtifacts@0
             inputs:
diff --git a/ci/docker_ci.sh b/ci/docker_ci.sh
index da8aa4910106..0e76da1bb874 100755
--- a/ci/docker_ci.sh
+++ b/ci/docker_ci.sh
@@ -141,7 +141,7 @@ for BUILD_TYPE in "${BUILD_TYPES[@]}"; do
     build_images "${BUILD_TYPE}" "$image_tag"
 
     if ! is_windows; then
-        if [[ "$BUILD_TYPE" == "" || "$BUILD_TYPE" == "-alpine" ]]; then
+        if [[ "$BUILD_TYPE" == "" || "$BUILD_TYPE" == "-alpine" || "$BUILD_TYPE" == "-google-vrp" ]]; then
             # verify_examples expects the base and alpine images, and for them to be named `-dev`
             dev_image="envoyproxy/envoy${BUILD_TYPE}-dev:latest"
             docker tag "$image_tag" "$dev_image"
diff --git a/ci/mac_ci_steps.sh b/ci/mac_ci_steps.sh
index 5dfda616406c..ba075a4e9ae6 100755
--- a/ci/mac_ci_steps.sh
+++ b/ci/mac_ci_steps.sh
@@ -36,16 +36,23 @@ BAZEL_BUILD_OPTIONS=(
 # is somewhat more deterministic (rather than interleaving the build
 # and test steps).
 
+DEFAULT_TEST_TARGETS=(
+  "//test/integration:integration_test"
+  "//test/integration:protocol_integration_test"
+  "//test/integration:tcp_proxy_integration_test"
+  "//test/integration:extension_discovery_integration_test"
+  "//test/integration:listener_lds_integration_test")
+
 if [[ $# -gt 0 ]]; then
-  TEST_TARGETS=$*
+  TEST_TARGETS=("$@")
 else
-  TEST_TARGETS='//test/integration/...'
+  TEST_TARGETS=("${DEFAULT_TEST_TARGETS[@]}")
 fi
 
-if [[ "$TEST_TARGETS" == "//test/..." || "$TEST_TARGETS" == "//test/integration/..." ]]; then
+if [[ "${TEST_TARGETS[*]}" == "${DEFAULT_TEST_TARGETS[*]}" ]]; then
   bazel build "${BAZEL_BUILD_OPTIONS[@]}" //source/exe:envoy-static
 fi
-bazel test "${BAZEL_BUILD_OPTIONS[@]}" "${TEST_TARGETS}"
+bazel test "${BAZEL_BUILD_OPTIONS[@]}" "${TEST_TARGETS[@]}"
 
 # Additionally run macOS specific test suites
 bazel test "${BAZEL_BUILD_OPTIONS[@]}" //test/common/network:apple_dns_impl_test
diff --git a/examples/cache/service.py b/examples/cache/service.py
index 66c6963c03a6..c60b430e01f2 100644
--- a/examples/cache/service.py
+++ b/examples/cache/service.py
@@ -34,7 +34,10 @@ def get(service_number, response_id):
 
     # response.make_conditional() will change the response to a 304 response
     # if a 'if-none-match' header exists in the request and matches the etag
-    return response.make_conditional(request)
+    conditional_response = response.make_conditional(request)
+    # hacky workaround for flask's dodgy header handling
+    del conditional_response.headers["Date"]
+    return conditional_response
 
 
 if __name__ == "__main__":