diff --git a/.bazelversion b/.bazelversion
index ba7f754d0c..18bb4182dd 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-7.4.0
+7.5.0
diff --git a/WORKSPACE b/WORKSPACE
index bd456a5055..6b027837c1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -22,10 +22,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # 1. Determine SHA256 `wget https://github.com/envoyproxy/envoy/archive/$COMMIT.tar.gz && sha256sum $COMMIT.tar.gz`
 # 2. Update .bazelversion, envoy.bazelrc and .bazelrc if needed.
 #
-# Commit date: 2025-01-22
-ENVOY_SHA = "10d38a8f6a2ce1be491ce6064589a6acc5c1673f"
+# Commit date: 2025-02-03
+ENVOY_SHA = "057f7e0223d1985fd3b8f1adb1f6191454d963de"
 
-ENVOY_SHA256 = "6379a533ebb42db7f51a46c7100577a3087c3c0ea07e03d90041eceb16072ba6"
+ENVOY_SHA256 = "8cc62d21f6cbb4316c922955d1e2d3fcdd381f6bb74b7319c9c13f0967806c0b"
 
 ENVOY_ORG = "envoyproxy"
 
diff --git a/bazel/extension_config/extensions_build_config.bzl b/bazel/extension_config/extensions_build_config.bzl
index 7459388dcf..8dc04a0ad0 100644
--- a/bazel/extension_config/extensions_build_config.bzl
+++ b/bazel/extension_config/extensions_build_config.bzl
@@ -357,7 +357,7 @@ ENVOY_EXTENSIONS = {
     # QUIC extensions
     #
 
-    "envoy.quic.deterministic_connection_id_generator": "//source/extensions/quic/connection_id_generator:envoy_deterministic_connection_id_generator_config",
+    "envoy.quic.deterministic_connection_id_generator": "//source/extensions/quic/connection_id_generator/deterministic:envoy_deterministic_connection_id_generator_config",
     "envoy.quic.crypto_stream.server.quiche":           "//source/extensions/quic/crypto_stream:envoy_quic_default_crypto_server_stream",
     "envoy.quic.proof_source.filter_chain":             "//source/extensions/quic/proof_source:envoy_quic_default_proof_source",
 
@@ -513,7 +513,7 @@ ISTIO_ENABLED_CONTRIB_EXTENSIONS = [
     "envoy.filters.network.postgres_proxy",
     "envoy.filters.network.sip_proxy",
     "envoy.filters.sip.router",
-    "envoy.tls.key_providers.cryptomb",
+    # "envoy.tls.key_providers.cryptomb", # TODO: reenabled this later.
     "envoy.tls.key_providers.qat",
     "envoy.network.connection_balance.dlb",
 ]
diff --git a/envoy.bazelrc b/envoy.bazelrc
index 180ef0d0e4..591b74efbb 100644
--- a/envoy.bazelrc
+++ b/envoy.bazelrc
@@ -28,6 +28,8 @@ build --define envoy_mobile_listener=enabled
 build --experimental_repository_downloader_retries=2
 build --enable_platform_specific_config
 build --incompatible_merge_fixed_and_default_shell_env
+# A workaround for slow ICU download.
+build --http_timeout_scaling=6.0
 
 # Pass CC, CXX and LLVM_CONFIG variables from the environment.
 # We assume they have stable values, so this won't cause action cache misses.