diff --git a/.bazelrc b/.bazelrc
index 8ab0f03af..e891044d5 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -55,9 +55,11 @@ common --experimental_allow_tags_propagation
 
 # Enable position independent code (this is the default on macOS and Windows)
 # (Workaround for https://github.com/bazelbuild/rules_foreign_cc/issues/421)
+build:linux --copt=-fdebug-types-section
 build:linux --copt=-fPIC
 build:linux --copt=-Wno-deprecated-declarations
-build:linux --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
+build:linux --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
+build:linux --cxxopt=-fsized-deallocation --host_cxxopt=-fsized-deallocation # needed to compile CEL on Envoy 1.30.x and above
 build:linux --conlyopt=-fexceptions
 build:linux --fission=dbg,opt
 build:linux --features=per_object_debug_info
@@ -117,7 +119,7 @@ build:clang-asan --linkopt --rtlib=compiler-rt
 build:clang-asan --linkopt --unwindlib=libgcc
 
 # macOS
-build:macos --cxxopt=-std=c++17 --host_cxxopt=-std=c++17
+build:macos --cxxopt=-std=c++20 --host_cxxopt=-std=c++20
 build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --host_action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --define tcmalloc=disabled
diff --git a/.bazelversion b/.bazelversion
index 91e4a9f26..f22d756da 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-6.3.2
+6.5.0
diff --git a/bazel/extensions/extensions_build_config.bzl b/bazel/extensions/extensions_build_config.bzl
index f8542194c..fc5bebee9 100644
--- a/bazel/extensions/extensions_build_config.bzl
+++ b/bazel/extensions/extensions_build_config.bzl
@@ -7,6 +7,7 @@ EXTENSIONS = {
 
     "envoy.access_loggers.file":                        "//source/extensions/access_loggers/file:config",
     "envoy.access_loggers.extension_filters.cel":       "//source/extensions/access_loggers/filters/cel:config",
+    "envoy.access_loggers.fluentd"  :                   "//source/extensions/access_loggers/fluentd:config",
     "envoy.access_loggers.http_grpc":                   "//source/extensions/access_loggers/grpc:http_config",
     "envoy.access_loggers.tcp_grpc":                    "//source/extensions/access_loggers/grpc:tcp_config",
     "envoy.access_loggers.open_telemetry":              "//source/extensions/access_loggers/open_telemetry:config",
@@ -114,6 +115,11 @@ EXTENSIONS = {
 
     # "envoy.matching.actions.format_string":             "//source/extensions/matching/actions/format_string:config",
 
+    #
+    # StringMatchers
+    #
+#    "envoy.string_matcher.lua":                         "//source/extensions/string_matcher/lua:config",
+
     #
     # HTTP filters
     #
@@ -132,6 +138,7 @@ EXTENSIONS = {
     "envoy.filters.http.cors":                          "//source/extensions/filters/http/cors:config",
     "envoy.filters.http.composite":                     "//source/extensions/filters/http/composite:config",
     # "envoy.filters.http.connect_grpc_bridge":           "//source/extensions/filters/http/connect_grpc_bridge:config",
+    "envoy.filters.http.credential_injector":           "//source/extensions/filters/http/credential_injector:config",
     "envoy.filters.http.csrf":                          "//source/extensions/filters/http/csrf:config",
     # "envoy.filters.http.custom_response":               "//source/extensions/filters/http/custom_response:factory",
     "envoy.filters.http.decompressor":                  "//source/extensions/filters/http/decompressor:config",
@@ -276,6 +283,7 @@ EXTENSIONS = {
     #
 
     "envoy.tracers.opentelemetry.samplers.always_on":         "//source/extensions/tracers/opentelemetry/samplers/always_on:config",
+#    "envoy.tracers.opentelemetry.samplers.dynatrace":         "//source/extensions/tracers/opentelemetry/samplers/dynatrace:config",
 
     #
     # Transport sockets
@@ -288,6 +296,7 @@ EXTENSIONS = {
     "envoy.transport_sockets.tap":                      "//source/extensions/transport_sockets/tap:config",
     "envoy.transport_sockets.starttls":                 "//source/extensions/transport_sockets/starttls:config",
     "envoy.transport_sockets.tcp_stats":                "//source/extensions/transport_sockets/tcp_stats:config",
+    "envoy.transport_sockets.tls":                      "//source/extensions/transport_sockets/tls:config",
     "envoy.transport_sockets.internal_upstream":        "//source/extensions/transport_sockets/internal_upstream:config",
 
     #
@@ -339,7 +348,6 @@ EXTENSIONS = {
     "envoy.wasm.runtime.null":                          "//source/extensions/wasm_runtime/null:config",
     "envoy.wasm.runtime.v8":                            "//source/extensions/wasm_runtime/v8:config",
     "envoy.wasm.runtime.wamr":                          "//source/extensions/wasm_runtime/wamr:config",
-    "envoy.wasm.runtime.wavm":                          "//source/extensions/wasm_runtime/wavm:config",
     "envoy.wasm.runtime.wasmtime":                      "//source/extensions/wasm_runtime/wasmtime:config",
 
     #
@@ -388,6 +396,12 @@ EXTENSIONS = {
     # "envoy.http.custom_response.redirect_policy":             "//source/extensions/http/custom_response/redirect_policy:redirect_policy_lib",
     # "envoy.http.custom_response.local_response_policy":       "//source/extensions/http/custom_response/local_response_policy:local_response_policy_lib",
 
+    #
+    # Injected credentials
+    #
+
+    "envoy.http.injected_credentials.generic":              "//source/extensions/http/injected_credentials/generic:config",
+
     #
     # QUIC extensions
     #
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 8b69a73c2..0b9bf6358 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -2,9 +2,9 @@ REPOSITORY_LOCATIONS = dict(
     # can't have more than one comment between envoy line and commit line in 
     # order to accommodate `check_extensions_build_config.sh`
     envoy = dict(
-        # envoy 1.29.3 with backported ext_proc updates
-        commit = "e2dab93e60e93b56fa63632fb9cfa64930fc5240", # v1.29.3-fork1
-        remote = "https://github.com/solo-io/envoy-fork",
+        # envoy v1.30.1
+        commit = "816188b86a0a52095b116b107f576324082c7c02",
+        remote = "https://github.com/envoyproxy/envoy",
     ),
     inja = dict(
         # Includes unmerged modifications for
diff --git a/changelog/v1.29.3-patch2/base64url.yaml b/changelog/v1.30.1-patch1/base64url.yaml
similarity index 100%
rename from changelog/v1.29.3-patch2/base64url.yaml
rename to changelog/v1.30.1-patch1/base64url.yaml
diff --git a/changelog/v1.29.3-patch2/lambda-json-parsing-fix.yaml b/changelog/v1.30.1-patch1/lambda-json-parsing-fix.yaml
similarity index 100%
rename from changelog/v1.29.3-patch2/lambda-json-parsing-fix.yaml
rename to changelog/v1.30.1-patch1/lambda-json-parsing-fix.yaml
diff --git a/changelog/v1.30.1-patch1/update-to-upstream-envoy-v1.30.yaml b/changelog/v1.30.1-patch1/update-to-upstream-envoy-v1.30.yaml
new file mode 100644
index 000000000..c70f66398
--- /dev/null
+++ b/changelog/v1.30.1-patch1/update-to-upstream-envoy-v1.30.yaml
@@ -0,0 +1,10 @@
+changelog:
+- type: DEPENDENCY_BUMP
+  dependencyOwner: envoyproxy
+  dependencyRepo: envoy
+  dependencyTag: v1.30.1
+  resolvesIssue: false
+  description: >-
+    Update Envoy to v1.30.1 and switch back off our fork
+  issueLink: https://github.com/solo-io/envoy-gloo-ee/issues/768 
+
diff --git a/ci/cloudbuild.yaml b/ci/cloudbuild.yaml
index b416cfa65..88ae2cf17 100644
--- a/ci/cloudbuild.yaml
+++ b/ci/cloudbuild.yaml
@@ -1,5 +1,5 @@
 steps:
-- name: 'envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33'
+- name: 'envoyproxy/envoy-build-ubuntu:f94a38f62220a2b017878b790b6ea98a0f6c5f9c'
   id: 'do_ci'
   args: ['ci/do_ci.sh', 'release', '//test/extensions/...', '//test/common/...', '//test/integration/...']
   volumes:
diff --git a/source/common/matcher/BUILD b/source/common/matcher/BUILD
index 0c0eb99ba..2fe07a78f 100644
--- a/source/common/matcher/BUILD
+++ b/source/common/matcher/BUILD
@@ -19,8 +19,10 @@ envoy_cc_library(
     deps = [
         "@envoy//source/common/router:config_lib",
         "@envoy//source/common/http:header_utility_lib",
+        "@envoy//envoy/common:regex_interface",
         "@envoy_api//envoy/api/v2/route:pkg_cc_proto",
         "@envoy_api//envoy/config/route/v3:pkg_cc_proto",
+        "//source/common/regex:regex_lib",
     ],
 )
 
diff --git a/source/common/matcher/solo_matcher.cc b/source/common/matcher/solo_matcher.cc
index f320e494d..0fa831923 100644
--- a/source/common/matcher/solo_matcher.cc
+++ b/source/common/matcher/solo_matcher.cc
@@ -1,7 +1,9 @@
 #include "source/common/matcher/solo_matcher.h"
 
+#include "envoy/common/regex.h"
 #include "source/common/common/logger.h"
 #include "source/common/common/regex.h"
+#include "source/common/regex/regex.h"
 #include "source/common/router/config_impl.h"
 
 #include "absl/strings/match.h"
@@ -19,15 +21,16 @@ namespace {
 class BaseMatcherImpl : public Matcher,
                         public Logger::Loggable<Logger::Id::filter> {
 public:
-  BaseMatcherImpl(const RouteMatch &match)
+  BaseMatcherImpl(const RouteMatch &match,
+                  Server::Configuration::CommonFactoryContext &context)
       : case_sensitive_(
             PROTOBUF_GET_WRAPPED_OR_DEFAULT(match, case_sensitive, true)),
-        config_headers_(
-            Http::HeaderUtility::buildHeaderDataVector(match.headers())) {
+        config_headers_(Http::HeaderUtility::buildHeaderDataVector(
+            match.headers(), context)) {
     for (const auto &query_parameter : match.query_parameters()) {
       config_query_parameters_.push_back(
           std::make_unique<Router::ConfigUtility::QueryParameterMatcher>(
-              query_parameter));
+              query_parameter, context));
     }
   }
 
@@ -38,9 +41,8 @@ class BaseMatcherImpl : public Matcher,
 
     matches &= Http::HeaderUtility::matchHeaders(headers, config_headers_);
     if (!config_query_parameters_.empty()) {
-      auto query_parameters =
-          Http::Utility::QueryParamsMulti::parseQueryString(
-              headers.Path()->value().getStringView());
+      auto query_parameters = Http::Utility::QueryParamsMulti::parseQueryString(
+          headers.Path()->value().getStringView());
       matches &= ConfigUtility::matchQueryParams(query_parameters,
                                                  config_query_parameters_);
     }
@@ -61,8 +63,9 @@ class BaseMatcherImpl : public Matcher,
  */
 class PrefixMatcherImpl : public BaseMatcherImpl {
 public:
-  PrefixMatcherImpl(const ::RouteMatch &match)
-      : BaseMatcherImpl(match), prefix_(match.prefix()) {}
+  PrefixMatcherImpl(const ::RouteMatch &match,
+                    Server::Configuration::CommonFactoryContext &context)
+      : BaseMatcherImpl(match, context), prefix_(match.prefix()) {}
 
   bool matches(const Http::RequestHeaderMap &headers) const override {
     if (BaseMatcherImpl::matchRoute(headers) &&
@@ -87,8 +90,9 @@ class PrefixMatcherImpl : public BaseMatcherImpl {
  */
 class PathMatcherImpl : public BaseMatcherImpl {
 public:
-  PathMatcherImpl(const ::RouteMatch &match)
-      : BaseMatcherImpl(match), path_(match.path()) {}
+  PathMatcherImpl(const ::RouteMatch &match,
+                  Server::Configuration::CommonFactoryContext &context)
+      : BaseMatcherImpl(match, context), path_(match.path()) {}
 
   bool matches(const Http::RequestHeaderMap &headers) const override {
     if (BaseMatcherImpl::matchRoute(headers)) {
@@ -112,15 +116,54 @@ class PathMatcherImpl : public BaseMatcherImpl {
   const std::string path_;
 };
 
+class CompiledStdMatcher : public Regex::CompiledMatcher {
+public:
+  CompiledStdMatcher(std::regex &&regex) : regex_(std::move(regex)) {}
+
+  // CompiledMatcher
+  bool match(absl::string_view value) const override {
+    try {
+      return std::regex_match(value.begin(), value.end(), regex_);
+    } catch (const std::regex_error &e) {
+      return false;
+    }
+  }
+
+  // CompiledMatcher
+  std::string replaceAll(absl::string_view value,
+                         absl::string_view substitution) const override {
+    try {
+      return std::regex_replace(std::string(value), regex_,
+                                std::string(substitution));
+    } catch (const std::regex_error &e) {
+      return std::string(value);
+    }
+  }
+
+private:
+  const std::regex regex_;
+};
+
+class StdRegexEngine : public Regex::Engine {
+public:
+  Regex::CompiledMatcherPtr matcher(const std::string &regex) const override {
+    return std::make_unique<CompiledStdMatcher>(
+        Solo::Regex::Utility::parseStdRegex(regex));
+  }
+};
+
 /**
  * Perform a match against any path with a regex rule.
  * TODO(mattklein123): This code needs dedup with RegexRouteEntryImpl.
  */
 class RegexMatcherImpl : public BaseMatcherImpl {
 public:
-  RegexMatcherImpl(const RouteMatch &match) : BaseMatcherImpl(match) {
+  RegexMatcherImpl(const RouteMatch &match,
+                   Server::Configuration::CommonFactoryContext &context)
+      : BaseMatcherImpl(match, context) {
     ASSERT(match.path_specifier_case() == RouteMatch::kSafeRegex);
-    regex_ = Regex::Utility::parseRegex(match.safe_regex());
+    auto engine = Envoy::MatcherCopy::StdRegexEngine();
+    regex_ = Regex::Utility::parseRegex(match.safe_regex(), engine);
     regex_str_ = match.safe_regex().regex();
   }
 
@@ -140,50 +183,23 @@ class RegexMatcherImpl : public BaseMatcherImpl {
   }
 
 private:
-
-static Regex::CompiledMatcherPtr parseStdRegexAsCompiledMatcher(const std::string& regex,
-                                 std::regex::flag_type flags = std::regex::optimize);
   Regex::CompiledMatcherPtr regex_;
   // raw regex string, for logging.
   std::string regex_str_;
 };
 
-class CompiledStdMatcher : public Regex::CompiledMatcher {
-public:
-  CompiledStdMatcher(std::regex&& regex) : regex_(std::move(regex)) {}
-
-  // CompiledMatcher
-  bool match(absl::string_view value) const override {
-    try {
-      return std::regex_match(value.begin(), value.end(), regex_);
-    } catch (const std::regex_error& e) {
-      return false;
-    }
-  }
-
-  // CompiledMatcher
-  std::string replaceAll(absl::string_view value, absl::string_view substitution) const override {
-    try {
-      return std::regex_replace(std::string(value), regex_, std::string(substitution));
-    } catch (const std::regex_error& e) {
-      return std::string(value);
-    }
-  }
-
-private:
-  const std::regex regex_;
-};
-
 } // namespace
 
-MatcherConstPtr Matcher::create(const RouteMatch &match) {
+MatcherConstPtr
+Matcher::create(const RouteMatch &match,
+                Server::Configuration::CommonFactoryContext &context) {
   switch (match.path_specifier_case()) {
   case RouteMatch::PathSpecifierCase::kPrefix:
-    return std::make_shared<PrefixMatcherImpl>(match);
+    return std::make_shared<PrefixMatcherImpl>(match, context);
   case RouteMatch::PathSpecifierCase::kPath:
-    return std::make_shared<PathMatcherImpl>(match);
+    return std::make_shared<PathMatcherImpl>(match, context);
   case RouteMatch::PathSpecifierCase::kSafeRegex:
-    return std::make_shared<RegexMatcherImpl>(match);
+    return std::make_shared<RegexMatcherImpl>(match, context);
   // path specifier is required.
   case RouteMatch::PathSpecifierCase::PATH_SPECIFIER_NOT_SET:
   default:
@@ -191,5 +207,5 @@ MatcherConstPtr Matcher::create(const RouteMatch &match) {
   }
 }
 
-} // namespace Matcher
+} // namespace MatcherCopy
 } // namespace Envoy
diff --git a/source/common/matcher/solo_matcher.h b/source/common/matcher/solo_matcher.h
index e42f88681..23890a464 100644
--- a/source/common/matcher/solo_matcher.h
+++ b/source/common/matcher/solo_matcher.h
@@ -2,6 +2,7 @@
 
 #include "envoy/config/route/v3/route.pb.h"
 #include "envoy/http/header_map.h"
+#include "envoy/server/factory_context.h"
 
 namespace Envoy {
 namespace MatcherCopy {
@@ -34,7 +35,8 @@ class Matcher {
    */
 
   static MatcherConstPtr
-  create(const ::envoy::config::route::v3::RouteMatch &match);
+  create(const ::envoy::config::route::v3::RouteMatch &match,
+         Server::Configuration::CommonFactoryContext& context);
 };
 
 } // namespace Matcher
diff --git a/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.cc b/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.cc
index d256661fe..b666c13de 100644
--- a/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.cc
+++ b/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.cc
@@ -41,7 +41,7 @@ AWSLambdaFilterConfigFactory::createFilterFactoryFromProtoTyped(
       };
 }
 
-Upstream::ProtocolOptionsConfigConstSharedPtr
+absl::StatusOr<Upstream::ProtocolOptionsConfigConstSharedPtr>
 AWSLambdaFilterConfigFactory::createProtocolOptionsConfig(
     const Protobuf::Message &config,
     Server::Configuration::ProtocolOptionsFactoryContext &) {
diff --git a/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.h b/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.h
index cfdd58ce5..123a8c8b1 100644
--- a/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.h
+++ b/source/extensions/filters/http/aws_lambda/aws_lambda_filter_config_factory.h
@@ -23,7 +23,7 @@ class AWSLambdaFilterConfigFactory
   AWSLambdaFilterConfigFactory()
       : FactoryBase(SoloHttpFilterNames::get().AwsLambda) {}
 
-  Upstream::ProtocolOptionsConfigConstSharedPtr createProtocolOptionsConfig(
+  absl::StatusOr<Upstream::ProtocolOptionsConfigConstSharedPtr> createProtocolOptionsConfig(
       const Protobuf::Message &config,
       Server::Configuration::ProtocolOptionsFactoryContext &) override;
   ProtobufTypes::MessagePtr createEmptyProtocolOptionsProto() override;
diff --git a/source/extensions/filters/http/aws_lambda/config.cc b/source/extensions/filters/http/aws_lambda/config.cc
index 6f8ae3d70..514ecbdae 100644
--- a/source/extensions/filters/http/aws_lambda/config.cc
+++ b/source/extensions/filters/http/aws_lambda/config.cc
@@ -194,12 +194,18 @@ void AWSLambdaConfigImpl::AWSLambdaStsRefresher::init(Event::Dispatcher &dispatc
     } else {
         ENVOY_LOG(debug, "{}: STS enabled without time based refresh",__func__);
     }
-    file_watcher_->addWatch(
+    absl::Status result = file_watcher_->addWatch(
         parent_->token_file_, Filesystem::Watcher::Events::Modified,
         [shared_this](uint32_t) {
           // Force timer callback to happen immediately to pick up the change.
           shared_this->timer_->enableTimer(std::chrono::milliseconds::zero());
+          return absl::OkStatus();
         });
+    // the result of the above function MUST NOT be ignored (see [[nodiscard]]).
+    // since we don't expect an error to occur, we'll just log a message for now
+    if (!result.ok()) {
+      ENVOY_LOG(error, "Unexpected error occurred on file watcher timer: {}", result.message());
+    }
 }
 
 /*
diff --git a/source/extensions/filters/http/nats/streaming/nats_streaming_filter.cc b/source/extensions/filters/http/nats/streaming/nats_streaming_filter.cc
index 099a2d50c..35a035968 100644
--- a/source/extensions/filters/http/nats/streaming/nats_streaming_filter.cc
+++ b/source/extensions/filters/http/nats/streaming/nats_streaming_filter.cc
@@ -116,12 +116,12 @@ void NatsStreamingFilter::onResponse() { onCompletion(Http::Code::OK, ""); }
 
 void NatsStreamingFilter::onFailure() {
   onCompletion(Http::Code::InternalServerError, "nats streaming filter abort",
-               StreamInfo::ResponseFlag::NoHealthyUpstream);
+               StreamInfo::CoreResponseFlag::NoHealthyUpstream);
 }
 
 void NatsStreamingFilter::onTimeout() {
   onCompletion(Http::Code::RequestTimeout, "nats streaming filter timeout",
-               StreamInfo::ResponseFlag::UpstreamRequestTimeout);
+               StreamInfo::CoreResponseFlag::UpstreamRequestTimeout);
 }
 
 void NatsStreamingFilter::retrieveRouteSpecificFilterConfig() {
diff --git a/source/extensions/filters/http/transformation/transformation_filter_config.cc b/source/extensions/filters/http/transformation/transformation_filter_config.cc
index dfac33d88..14c477d7f 100644
--- a/source/extensions/filters/http/transformation/transformation_filter_config.cc
+++ b/source/extensions/filters/http/transformation/transformation_filter_config.cc
@@ -31,7 +31,7 @@ void TransformationFilterConfig::addTransformationLegacy(
   if (rule.has_route_transformations()) {
     transformer_pair = createTransformations(rule.route_transformations(), context.serverFactoryContext());
   }
-  transformer_pairs_.emplace_back(MatcherCopy::Matcher::create(rule.match()),
+  transformer_pairs_.emplace_back(MatcherCopy::Matcher::create(rule.match(), context.serverFactoryContext()),
                                   transformer_pair);
 }
 
@@ -52,7 +52,13 @@ TransformationFilterConfig::TransformationFilterConfig(
 class ResponseMatcherImpl : public ResponseMatcher {
 public:
   ResponseMatcherImpl(
-      const envoy::api::v2::filter::http::ResponseMatcher &match);
+      const envoy::api::v2::filter::http::ResponseMatcher &match,
+      Server::Configuration::ServerFactoryContext& context)
+    : headers_(Http::HeaderUtility::buildHeaderDataVector(match.headers(), context)) {
+    if (match.has_response_code_details()) {
+      response_code_details_match_.emplace(match.response_code_details(), context);
+    }
+  }
   bool matches(const Http::ResponseHeaderMap &headers,
                const StreamInfo::StreamInfo &stream_info) const override;
 
@@ -61,14 +67,6 @@ class ResponseMatcherImpl : public ResponseMatcher {
   absl::optional<Matchers::StringMatcherImpl<envoy::type::matcher::v3::StringMatcher>> response_code_details_match_;
 };
 
-ResponseMatcherImpl::ResponseMatcherImpl(
-    const envoy::api::v2::filter::http::ResponseMatcher &match)
-    : headers_(Http::HeaderUtility::buildHeaderDataVector(match.headers())) {
-  if (match.has_response_code_details()) {
-    response_code_details_match_.emplace(match.response_code_details());
-  }
-}
-
 bool ResponseMatcherImpl::matches(
     const Http::ResponseHeaderMap &headers,
     const StreamInfo::StreamInfo &stream_info) const {
@@ -91,8 +89,9 @@ bool ResponseMatcherImpl::matches(
 }
 
 ResponseMatcherConstPtr ResponseMatcher::create(
-    const envoy::api::v2::filter::http::ResponseMatcher &match) {
-  return std::make_unique<const ResponseMatcherImpl>(match);
+    const envoy::api::v2::filter::http::ResponseMatcher &match,
+    Server::Configuration::ServerFactoryContext& context) {
+  return std::make_unique<const ResponseMatcherImpl>(match, context);
 }
 
 RouteTransformationFilterConfig::RouteTransformationFilterConfig(
@@ -144,7 +143,7 @@ void PerStageRouteTransformationFilterConfig::setMatcher(Envoy::Matcher::MatchTr
 
 void PerStageRouteTransformationFilterConfig::addTransformation(
     const envoy::api::v2::filter::http::RouteTransformations_RouteTransformation
-        &transformation, Server::Configuration::CommonFactoryContext &context) {
+        &transformation, Server::Configuration::ServerFactoryContext &context) {
   using envoy::api::v2::filter::http::RouteTransformations_RouteTransformation;
   // create either request or response one.
   switch (transformation.match_case()) {
@@ -155,7 +154,7 @@ void PerStageRouteTransformationFilterConfig::addTransformation(
     MatcherCopy::MatcherConstPtr matcher;
 
     if (request_match.has_match()) {
-      matcher = MatcherCopy::Matcher::create(request_match.match());
+      matcher = MatcherCopy::Matcher::create(request_match.match(), context);
     }
 
     bool clear_route_cache = request_match.clear_route_cache();
@@ -193,7 +192,7 @@ void PerStageRouteTransformationFilterConfig::addTransformation(
     auto &&response_match = transformation.response_match();
     ResponseMatcherConstPtr matcher;
     if (response_match.has_match()) {
-      matcher = ResponseMatcher::create(response_match.match());
+      matcher = ResponseMatcher::create(response_match.match(), context);
     }
     auto &&transformation = response_match.response_transformation();
     try {
diff --git a/source/extensions/filters/http/transformation/transformation_filter_config.h b/source/extensions/filters/http/transformation/transformation_filter_config.h
index 61cb09d02..e573254a2 100644
--- a/source/extensions/filters/http/transformation/transformation_filter_config.h
+++ b/source/extensions/filters/http/transformation/transformation_filter_config.h
@@ -30,7 +30,8 @@ class ResponseMatcher {
    * defined.
    */
   static ResponseMatcherConstPtr
-  create(const envoy::api::v2::filter::http::ResponseMatcher &match);
+  create(const envoy::api::v2::filter::http::ResponseMatcher &match,
+         Server::Configuration::ServerFactoryContext& context);
 };
 
 using TransformationConfigProto =
@@ -73,7 +74,7 @@ class PerStageRouteTransformationFilterConfig : public TransformConfig {
   void addTransformation(
       const envoy::api::v2::filter::http::
           RouteTransformations_RouteTransformation &transformations,
-          Server::Configuration::CommonFactoryContext &context);
+          Server::Configuration::ServerFactoryContext &context);
   void setMatcher(Envoy::Matcher::MatchTreeSharedPtr<Http::HttpMatchingData> matcher);
 
   TransformerPairConstSharedPtr
diff --git a/source/extensions/transformers/aws_lambda/api_gateway_transformer.cc b/source/extensions/transformers/aws_lambda/api_gateway_transformer.cc
index 089a03e47..cf24f737f 100644
--- a/source/extensions/transformers/aws_lambda/api_gateway_transformer.cc
+++ b/source/extensions/transformers/aws_lambda/api_gateway_transformer.cc
@@ -33,7 +33,7 @@ void ApiGatewayTransformer::format_error(
   Buffer::Instance &body,
   ApiGatewayError &error,
   Http::StreamFilterCallbacks &stream_filter_callbacks) const {
-    ENVOY_STREAM_LOG(debug, "Returning error with message: " + std::string(error.message), stream_filter_callbacks);
+    ENVOY_STREAM_LOG(debug, "Returning error with message: {}", stream_filter_callbacks, std::string(error.message));
 
     // clear existing response headers
     response_headers.clear();
@@ -65,7 +65,7 @@ void ApiGatewayTransformer::transform(
       try {
         transform_response(response_headers, body, stream_filter_callbacks);
       } catch (const std::exception &e) {
-        ENVOY_STREAM_LOG(debug, "Error transforming response: " + std::string(e.what()), stream_filter_callbacks);
+        ENVOY_STREAM_LOG(debug, "Error transforming response: {}", stream_filter_callbacks, std::string(e.what()));
         ApiGatewayError error = ApiGatewayError{500, "500", "Failed to transform response"};
         format_error(*response_headers, body, error, stream_filter_callbacks);
       }
@@ -87,7 +87,7 @@ void ApiGatewayTransformer::transform_response(
   try {
     json_body = json::parse(bodystring);
   } catch (std::exception& exception){
-    ENVOY_STREAM_LOG(debug, "Error parsing response body as JSON: " + std::string(exception.what()), stream_filter_callbacks);
+    ENVOY_STREAM_LOG(debug, "Error parsing response body as JSON: ", stream_filter_callbacks, std::string(exception.what()));
     ApiGatewayError error = {500, "500", "failed to parse response body as JSON"};
     return ApiGatewayTransformer::format_error(*response_headers, body, error, stream_filter_callbacks);
   }
@@ -98,7 +98,7 @@ void ApiGatewayTransformer::transform_response(
     if (!json_body["statusCode"].is_number_unsigned()) {
       // add duplicate log line to not break tests for now
       ENVOY_STREAM_LOG(debug, "cannot parse non unsigned integer status code", stream_filter_callbacks);
-      ENVOY_STREAM_LOG(debug, "received status code with value: " + json_body["statusCode"].dump(), stream_filter_callbacks);
+      ENVOY_STREAM_LOG(debug, "received status code with value: {}", stream_filter_callbacks, json_body["statusCode"].dump());
       ApiGatewayError error = {500, "500", "cannot parse non unsigned integer status code"};
       return ApiGatewayTransformer::format_error(*response_headers, body, error, stream_filter_callbacks);
     }
@@ -197,12 +197,12 @@ void ApiGatewayTransformer::add_response_header(
   bool append) {
     Envoy::Http::LowerCaseString lower_case_header_key(header_key);
     if (!Http::validHeaderString(lower_case_header_key)) {
-      ENVOY_STREAM_LOG(debug, "failed to write response header with invalid header key: " + std::string(header_key), stream_filter_callbacks);
+      ENVOY_STREAM_LOG(debug, "failed to write response header with invalid header key: {}", stream_filter_callbacks, std::string(header_key));
       return;
     }
 
     if (!Http::validHeaderString(header_value)) {
-      ENVOY_STREAM_LOG(debug, "failed to write response header with invalid header value: " + std::string(header_value), stream_filter_callbacks);
+      ENVOY_STREAM_LOG(debug, "failed to write response header with invalid header value: {}", stream_filter_callbacks,  std::string(header_value));
       return;
     }
     if (append) {
diff --git a/test/extensions/filters/http/transformation/inja_transformer_replace_test.cc b/test/extensions/filters/http/transformation/inja_transformer_replace_test.cc
index ed3f18386..be440e3a6 100644
--- a/test/extensions/filters/http/transformation/inja_transformer_replace_test.cc
+++ b/test/extensions/filters/http/transformation/inja_transformer_replace_test.cc
@@ -35,10 +35,6 @@ namespace Transformation {
 using TransformationTemplate =
     envoy::api::v2::filter::http::TransformationTemplate;
 
-namespace {
-std::function<const std::string &()> empty_body = [] { return EMPTY_STRING; };
-}
-
 class TransformerInstanceTest : public testing::Test {
 protected:
   NiceMock<Random::MockRandomGenerator> rng_;
@@ -300,8 +296,10 @@ TEST(Extraction, NilReplaceWithSubgroupUnset) {
   extractor.set_mode(ExtractionApi::SINGLE_REPLACE);
 
   NiceMock<Http::MockStreamDecoderFilterCallbacks> callbacks;
-  std::string body("not json body");
-  std::string res(Extractor(extractor).extractDestructive(callbacks, headers, empty_body));
+  std::string empty_body_str{""};
+  GetBodyFunc bodyfunc = [&empty_body_str]() -> const std::string & { return empty_body_str; };
+
+  std::string res(Extractor(extractor).extractDestructive(callbacks, headers, bodyfunc));
 
   EXPECT_EQ("", res);
 }
diff --git a/test/extensions/filters/http/transformation/inja_transformer_test.cc b/test/extensions/filters/http/transformation/inja_transformer_test.cc
index 3b57c9f9b..9afa3d8f4 100644
--- a/test/extensions/filters/http/transformation/inja_transformer_test.cc
+++ b/test/extensions/filters/http/transformation/inja_transformer_test.cc
@@ -1199,21 +1199,20 @@ TEST_F(InjaTransformerTest, ReplaceWithRandomTest_SameReplacementPatternUsesSame
   Http::TestRequestHeaderMapImpl headers{{":method", "GET"}, {":path", "/foo"}};
   TransformationTemplate transformation;
 
-  auto pattern1 = "replace-me";
-  auto test_string1 = "test-1-replace-me";
-  auto pattern2 = "another-replace-me";
-  auto test_string2 = "test-2-another-replace-me";
-  auto pattern3 = "yet-another-replace-me";
-  auto test_string3 = "test-3-yet-another-replace-me";
-
-  const auto* format_string = R"ENDFMT(
-{{{{ replace_with_random("{}", "{}") }}}}
-{{{{ replace_with_random("{}", "{}") }}}}
-{{{{ replace_with_random("{}", "{}") }}}}
-{{{{ replace_with_random("{}", "{}") }}}}
-{{{{ replace_with_random("{}", "{}") }}}}
-{{{{ replace_with_random("{}", "{}") }}}}
-  )ENDFMT";
+  std::string pattern1{"replace-me"};
+  std::string test_string1{"test-1-replace-me"};
+  std::string pattern2{"another-replace-me"};
+  std::string test_string2{"test-2-another-replace-me"};
+  std::string pattern3{"yet-another-replace-me"};
+  std::string test_string3{"test-3-yet-another-replace-me"};
+
+  constexpr static char format_string[] =
+"{{{{ replace_with_random(\"{}\", \"{}\") }}}}\n"
+"{{{{ replace_with_random(\"{}\", \"{}\") }}}}\n"
+"{{{{ replace_with_random(\"{}\", \"{}\") }}}}\n"
+"{{{{ replace_with_random(\"{}\", \"{}\") }}}}\n"
+"{{{{ replace_with_random(\"{}\", \"{}\") }}}}\n"
+"{{{{ replace_with_random(\"{}\", \"{}\") }}}}\n";
 
   auto formatted_string = fmt::format(format_string,
     test_string1, pattern1,
diff --git a/test/tools/router_check/BUILD b/test/tools/router_check/BUILD
new file mode 100644
index 000000000..6e466098e
--- /dev/null
+++ b/test/tools/router_check/BUILD
@@ -0,0 +1,17 @@
+load(
+    "@envoy//bazel:envoy_build_system.bzl",
+    "envoy_cc_test_binary",
+    "envoy_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_cc_test_binary(
+    name = "router_check_tool",
+    srcs = ["router_check.cc"],
+    repository = "@envoy",
+    deps = [],
+)
+
diff --git a/test/tools/router_check/router_check.cc b/test/tools/router_check/router_check.cc
new file mode 100644
index 000000000..7a21a9d16
--- /dev/null
+++ b/test/tools/router_check/router_check.cc
@@ -0,0 +1,11 @@
+// NOLINT(namespace-envoy)
+#include <iostream>
+#include <string>
+
+// This file only exists to get upstream's `do_ci.sh` to pass, as it is
+// hard-coded to build this target
+
+int main(int, char**) {
+  return EXIT_SUCCESS;
+}
+
diff --git a/test/tools/schema_validator/schema_validator.cc b/test/tools/schema_validator/schema_validator.cc
index cd0f31ae2..0966b051b 100644
--- a/test/tools/schema_validator/schema_validator.cc
+++ b/test/tools/schema_validator/schema_validator.cc
@@ -2,6 +2,8 @@
 #include <iostream>
 #include <string>
 
+// This file only exists to get upstream's `do_ci.sh` to pass, as it is
+// hard-coded to build this target
 
 int main(int, char**) {
   return EXIT_SUCCESS;