diff --git a/.bazelrc b/.bazelrc
index a12024ea..5075cc8e 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -174,6 +174,7 @@ build:asan --linkopt='-L/opt/llvm/lib/clang/18/lib/x86_64-unknown-linux-gnu'
 build:macos --action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --host_action_env=PATH=/opt/homebrew/bin:/opt/local/bin:/usr/local/bin:/usr/bin:/bin
 build:macos --define tcmalloc=disabled
+build:macos --cxxopt=-Wno-nullability-completeness
 
 # macOS ASAN/UBSAN
 build:macos-asan --config=asan
@@ -560,6 +561,8 @@ common:remote-envoy-engflow --config=rbe-envoy-engflow
 common:remote-cache-envoy-engflow --config=common-envoy-engflow
 common:remote-cache-envoy-engflow --config=cache-envoy-engflow
 
+common:cves --//tools/dependency:cve-data=//tools/dependency:cve-data-dir
+
 # Specifies the rustfmt.toml for all rustfmt_test targets.
 build --@rules_rust//rust/settings:rustfmt.toml=//:rustfmt.toml
 
@@ -585,6 +588,21 @@ common:debug --config=debug-sandbox
 common:debug --config=debug-coverage
 common:debug --config=debug-tests
 
+#############################################################################
+# compat: Compatibility with main branch repo settings
+#############################################################################
+common:bes --config=bes-envoy-engflow
+common:rbe --config=remote-envoy-engflow
+
+common:engflow-common --google_default_credentials=false
+common:engflow-common --grpc_keepalive_time=60s
+common:engflow-common --grpc_keepalive_timeout=30s
+common:engflow-common --remote_cache_compression
+
+common:remote-cache --config=engflow-common
+common:remote-cache --remote_cache=grpcs://mordenite.cluster.engflow.com
+common:remote-cache --remote_timeout=3600s
+
 try-import %workspace%/repo.bazelrc
 try-import %workspace%/clang.bazelrc
 try-import %workspace%/user.bazelrc
diff --git a/.bazelversion b/.bazelversion
index 93c8ddab..5942a0d3 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-7.6.0
+7.7.1
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index f2604120..14ffaf9b 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -2,8 +2,8 @@ REPOSITORY_LOCATIONS = dict(
     # can't have more than one comment between envoy line and commit line in
     # order to accommodate `check_extensions_build_config.sh`
     envoy = dict(
-        # envoy v1.35.8
-        commit = "80ca1d92145aa946d9f5c36fe830fc1182e13c85",
+        # envoy v1.35.9
+        commit = "75e220883447543d35571aecae826d7b1a2646b9",
         remote = "https://github.com/envoyproxy/envoy",
     ),
     inja = dict(
diff --git a/changelog/v1.35.9-patch1/bump-envoy-v1.35.9.yaml b/changelog/v1.35.9-patch1/bump-envoy-v1.35.9.yaml
new file mode 100644
index 00000000..d1269fa1
--- /dev/null
+++ b/changelog/v1.35.9-patch1/bump-envoy-v1.35.9.yaml
@@ -0,0 +1,9 @@
+changelog:
+  - type: DEPENDENCY_BUMP
+    dependencyOwner: envoyproxy
+    dependencyRepo: envoy
+    dependencyTag: v1.35.9
+    resolvesIssue: false
+    description: >-
+      Bumps Envoy to v1.35.9
+      https://www.envoyproxy.io/docs/envoy/v1.35.9/version_history/v1.35/v1.35.9