diff --git a/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java b/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java
index 073c7b35..476a1143 100644
--- a/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java
+++ b/server/src/test/java/io/envoyproxy/controlplane/server/EnvoyContainer.java
@@ -24,7 +24,7 @@ class EnvoyContainer extends GenericContainer<EnvoyContainer> {
   EnvoyContainer(String config, Supplier<Integer> controlPlanePortSupplier) {
     // this version is changed automatically by /tools/update-sha.sh:57
     // if you change it make sure to reflect changes there
-    super("envoyproxy/envoy:v1.37.1");
+    super("envoyproxy/envoy:v1.37.2");
     this.config = config;
     this.controlPlanePortSupplier = controlPlanePortSupplier;
   }
diff --git a/tools/API_SHAS b/tools/API_SHAS
index 4ae2ef4f..81a1e0d4 100644
--- a/tools/API_SHAS
+++ b/tools/API_SHAS
@@ -1,9 +1,9 @@
 # Update the versions here and run update-api.sh
 
 # envoy (source: SHA from https://github.com/envoyproxy/envoy)
-ENVOY_SHA="5ef4e4cea57f63e7e2970b9c1ad696278db927d6"
+ENVOY_SHA="5afe27fb338b16d5bb06b3a7198bcd581b4e3dee"
 
-# dependencies (source: https://github.com/envoyproxy/envoy/blob/5ef4e4cea57f63e7e2970b9c1ad696278db927d6/api/bazel/repository_locations.bzl)
+# dependencies (source: https://github.com/envoyproxy/envoy/blob/5afe27fb338b16d5bb06b3a7198bcd581b4e3dee/api/bazel/repository_locations.bzl)
 GOOGLEAPIS_SHA="fd52b5754b2b268bc3a22a10f29844f206abb327"  # 2024-09-16
 PGV_VERSION="1.3.0"  # 2025-12-04
 PROMETHEUS_SHA="0.6.2"  # 2025-04-11
diff --git a/tools/envoy_release b/tools/envoy_release
index 094f172c..e55d33a1 100644
--- a/tools/envoy_release
+++ b/tools/envoy_release
@@ -1 +1 @@
-v1.37.1
+v1.37.2