diff --git a/.github/workflows/_cache.yml b/.github/workflows/_cache.yml
index a30cf01df779..e86e3ddb4417 100644
--- a/.github/workflows/_cache.yml
+++ b/.github/workflows/_cache.yml
@@ -48,13 +48,13 @@ jobs:
   docker:
     runs-on: ${{ inputs.runs-on || 'ubuntu-24.04' }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       id: appauth
       name: Appauth (mutex lock)
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/docker/cache/prime@actions-v0.2.36
       id: docker
       name: Prime Docker cache (${{ inputs.image-tag }}${{ inputs.cache-suffix }})
       with:
@@ -62,7 +62,7 @@ jobs:
         key-suffix: ${{ inputs.cache-suffix }}
         lock-token: ${{ steps.appauth.outputs.token }}
         lock-repository: ${{ inputs.lock-repository }}
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: data
       name: Cache data
       with:
@@ -70,7 +70,7 @@ jobs:
         input: |
           cached: ${{ steps.docker.outputs.cached }}
           key: ${{ inputs.image-tag }}${{ inputs.cache-suffix }}
-    - uses: envoyproxy/toolshed/gh-actions/json/table@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/json/table@actions-v0.2.36
       name: Summary
       with:
         json: ${{ steps.data.outputs.value }}
diff --git a/.github/workflows/_check_coverage.yml b/.github/workflows/_check_coverage.yml
index 561c7759db7d..1de9fecb0b5d 100644
--- a/.github/workflows/_check_coverage.yml
+++ b/.github/workflows/_check_coverage.yml
@@ -34,6 +34,7 @@ jobs:
       # bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       concurrency-suffix: -${{ matrix.target }}
+      diskspace-hack: ${{ matrix.diskspace-hack || false }}
       error-match: |
         ERROR
         error:
@@ -50,5 +51,6 @@ jobs:
         include:
         - target: coverage
           name: Coverage
+          diskspace-hack: true
         - target: fuzz_coverage
           name: Fuzz coverage
diff --git a/.github/workflows/_finish.yml b/.github/workflows/_finish.yml
index 62a7a884b05e..e1c2ef4326b1 100644
--- a/.github/workflows/_finish.yml
+++ b/.github/workflows/_finish.yml
@@ -36,7 +36,7 @@ jobs:
       actions: read
       contents: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       name: Incoming data
       id: needs
       with:
@@ -87,7 +87,7 @@ jobs:
                    summary: "Check has finished",
                    text: $text}}}}
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       name: Print summary
       with:
         input: ${{ toJSON(steps.needs.outputs.value).summary-title }}
@@ -95,13 +95,13 @@ jobs:
           "## \(.)"
         options: -Rr
         output-path: GITHUB_STEP_SUMMARY
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.36
       name: Update check
       with:
         action: update
diff --git a/.github/workflows/_load.yml b/.github/workflows/_load.yml
index 5c06e9c99c24..cca4813c6caa 100644
--- a/.github/workflows/_load.yml
+++ b/.github/workflows/_load.yml
@@ -107,7 +107,7 @@ jobs:
     # Handle any failure in triggering job
     # Remove any `checks` we dont care about
     # Prepare a check request
-    - uses: envoyproxy/toolshed/gh-actions/github/env/load@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/env/load@actions-v0.2.36
       name: Load env
       id: data
       with:
@@ -118,13 +118,13 @@ jobs:
         GH_TOKEN: ${{ github.token }}
 
     #  Update the check
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.36
       name: Update check
       if: ${{ fromJSON(steps.data.outputs.data).data.check.action == 'RUN' }}
       with:
@@ -132,7 +132,7 @@ jobs:
         checks: ${{ toJSON(fromJSON(steps.data.outputs.data).checks) }}
         token: ${{ steps.appauth.outputs.token }}
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       name: Print request summary
       with:
         input: |
@@ -152,7 +152,7 @@ jobs:
           | $summary.summary as $summary
           | "${{ inputs.template-request-summary }}"
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: request-output
       name: Load request
       with:
diff --git a/.github/workflows/_load_env.yml b/.github/workflows/_load_env.yml
index 6c9f4f7d5ded..bc95b73246c1 100644
--- a/.github/workflows/_load_env.yml
+++ b/.github/workflows/_load_env.yml
@@ -63,18 +63,18 @@ jobs:
       request: ${{ steps.env.outputs.data }}
       trusted: true
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       id: checkout
       name: Checkout Envoy repository
     - name: Generate environment variables
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/env@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/env@actions-v0.2.36
       id: env
       with:
         branch-name: ${{ inputs.branch-name }}
@@ -86,7 +86,7 @@ jobs:
 
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.36
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}
diff --git a/.github/workflows/_precheck_publish.yml b/.github/workflows/_precheck_publish.yml
index 86181a7bc3d6..2c4f0c456abc 100644
--- a/.github/workflows/_precheck_publish.yml
+++ b/.github/workflows/_precheck_publish.yml
@@ -39,6 +39,7 @@ jobs:
         error:
         Error:
       target: ${{ matrix.target }}
+      target-suffix: ${{ matrix.target-suffix }}
       trusted: ${{ inputs.trusted }}
     strategy:
       fail-fast: false
@@ -46,10 +47,12 @@ jobs:
         include:
         - target: release.test_only
           name: Release (x64)
+          target-suffix: x64
           arch: x64
           rbe: true
         - target: release.test_only
           name: Release (arm64)
+          target-suffix: arm64
           arch: arm64
           bazel-extra: >-
             --config=common-envoy-engflow
diff --git a/.github/workflows/_publish_build.yml b/.github/workflows/_publish_build.yml
index e89c92c650d7..f03d887a6fd1 100644
--- a/.github/workflows/_publish_build.yml
+++ b/.github/workflows/_publish_build.yml
@@ -41,6 +41,7 @@ jobs:
     with:
       bazel-extra: ${{ matrix.bazel-extra }}
       target: ${{ matrix.target }}
+      target-suffix: ${{ matrix.arch }}
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       cache-build-image-key-suffix: ${{ matrix.arch == 'arm64' && format('-{0}', matrix.arch) || '' }}
       concurrency-suffix: -${{ matrix.arch }}
@@ -91,6 +92,7 @@ jobs:
       downloads: |
         release.${{ matrix.arch }}: release/${{ matrix.arch }}/bin/
       target: ${{ matrix.target }}
+      target-suffix: ${{ matrix.arch }}
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
       cache-build-image-key-suffix: ${{ matrix.cache-build-image-key-suffix }}
       concurrency-suffix: -${{ matrix.arch }}
diff --git a/.github/workflows/_publish_publish.yml b/.github/workflows/_publish_publish.yml
index 36bb5f0fd455..169a7516463b 100644
--- a/.github/workflows/_publish_publish.yml
+++ b/.github/workflows/_publish_publish.yml
@@ -71,12 +71,12 @@ jobs:
     needs:
     - publish
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       id: appauth
       with:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: ${{ secrets.ENVOY_CI_SYNC_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.36
       with:
         ref: main
         repository: ${{ fromJSON(inputs.request).request.version.dev && 'envoyproxy/envoy-website' || 'envoyproxy/archive' }}
diff --git a/.github/workflows/_publish_verify.yml b/.github/workflows/_publish_verify.yml
index d4838c34422d..2f95ee550401 100644
--- a/.github/workflows/_publish_verify.yml
+++ b/.github/workflows/_publish_verify.yml
@@ -99,10 +99,11 @@ jobs:
         export NO_BUILD_SETUP=1
         export ENVOY_DOCKER_IN_DOCKER=1
       target: ${{ matrix.target }}
+      target-suffix: ${{ matrix.arch }}
       trusted: ${{ inputs.trusted }}
       steps-pre: |
         - run: |
-            echo ARCH=${{ matrix.arch || 'x64' }} >> $GITHUB_ENV
+            echo ARCH=${{ matrix.arch }} >> $GITHUB_ENV
             echo DEB_ARCH=${{ matrix.arch == 'arm64' && 'arm64' || 'amd64' }} >> $GITHUB_ENV
           shell: bash
         - run: |
@@ -124,6 +125,7 @@ jobs:
 
         - name: verify_distro_x64
           target: verify_distro
+          arch: x64
           rbe: true
 
         - name: verify_distro_arm64
diff --git a/.github/workflows/_request.yml b/.github/workflows/_request.yml
index 1b44ae81019a..d13845e63688 100644
--- a/.github/workflows/_request.yml
+++ b/.github/workflows/_request.yml
@@ -40,14 +40,14 @@ jobs:
       env: ${{ steps.data.outputs.value }}
       config: ${{ steps.config.outputs.config }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -60,7 +60,7 @@ jobs:
     # *ALL* variables collected should be treated as untrusted and should be sanitized before
     # use
     - name: Generate environment variables from commit
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/request@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/request@actions-v0.2.36
       id: env
       with:
         branch-name: ${{ steps.checkout.outputs.branch-name }}
@@ -71,7 +71,7 @@ jobs:
         vars: ${{ toJSON(vars) }}
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.36
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}
@@ -87,7 +87,7 @@ jobs:
         target-branch: ${{ fromJSON(steps.env.outputs.data).request.target-branch }}
 
     - name: Environment data
-      uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: data
       with:
         input: |
diff --git a/.github/workflows/_run.yml b/.github/workflows/_run.yml
index 3a907421cd2f..1c9766d19dc2 100644
--- a/.github/workflows/_run.yml
+++ b/.github/workflows/_run.yml
@@ -90,15 +90,16 @@ on:
         type: string
         default: |
           - run: |
-              echo "disk space at beginning of build:"
-              df -h
+              # disk space at beginning of build
+              df -h > "${TMP_REPORT}/df-pre"
             shell: bash
       report-post:
         type: string
         default: |
           - run: |
-              echo "disk space at end of build:"
-              df -h
+              # disk space at end of build
+              df -h > "${TMP_REPORT}/df-post"
+              (du -ch "%{{ inputs.temp-dir || runner.temp }}" | grep -E "[0-9]{2,}M|[0-9]G" || :) > "${TMP_REPORT}/du-post"
             shell: bash
       request:
         type: string
@@ -123,15 +124,15 @@ on:
         type: string
       steps-post:
         type: string
-        default: |
-          - run: |
-              du -ch "%{{ inputs.temp-dir || runner.temp }}" | grep -E "[0-9]{2,}M|[0-9]G" || :
-            shell: bash
       steps-post-name:
         type: string
       target:
         type: string
         required: true
+      target-name:
+        type: string
+      target-suffix:
+        type: string
       temp-dir:
         type: string
       timeout-minutes:
@@ -173,10 +174,10 @@ jobs:
       packages: read
     if: ${{ ! inputs.skip }}
     runs-on: ${{ inputs.runs-on || fromJSON(inputs.request).config.ci.agent-ubuntu }}
-    name: ${{ inputs.command }} ${{ inputs.target }}
+    name: ${{ inputs.target-suffix && format('[{0}] ', inputs.target-suffix) || '' }}${{ inputs.command }} ${{ inputs.target }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: started
       name: Create timestamp
       with:
@@ -184,7 +185,7 @@ jobs:
         filter: |
           now
     # This controls which input vars are exposed to the run action (and related steps)
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       name: Context
       id: context
       with:
@@ -205,12 +206,12 @@ jobs:
           | . * {$config, $check}
     - if: ${{ inputs.cache-build-image }}
       name: Restore Docker cache ${{ inputs.cache-build-image && format('({0})', inputs.cache-build-image) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.2.36
       with:
         image_tag: ${{ inputs.cache-build-image }}
         key-suffix: ${{ inputs.cache-build-image-key-suffix }}
 
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       id: appauth
       name: Appauth
       if: ${{ inputs.trusted }}
@@ -221,7 +222,7 @@ jobs:
         # - the workaround is to allow the token to be passed through.
         token: ${{ github.token }}
         token-ok: true
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -238,7 +239,7 @@ jobs:
         token: ${{ inputs.trusted && steps.appauth.outputs.token || github.token }}
 
     # This is currently only use by mobile-docs and can be removed once they are updated to the newer website
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       id: checkout-extra
       name: Checkout extra repository (for publishing)
       if: ${{ inputs.checkout-extra }}
@@ -247,7 +248,7 @@ jobs:
         ssh-key: ${{ inputs.trusted && inputs.ssh-key-extra || '' }}
 
     - name: Import GPG key
-      uses: envoyproxy/toolshed/gh-actions/gpg/import@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/gpg/import@actions-v0.2.36
       if: ${{ inputs.import-gpg }}
       with:
         key: ${{ secrets.gpg-key }}
@@ -280,7 +281,7 @@ jobs:
         echo "BAZEL_BUILD_EXTRA_OPTIONS=${BAZEL_BUILD_EXTRA_OPTIONS}" >> "$GITHUB_ENV"
         echo "GCP_SERVICE_ACCOUNT_KEY_PATH=${GCP_SERVICE_ACCOUNT_KEY_PATH}" >> "$GITHUB_ENV"
 
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.36
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:
         args: ${{ inputs.args != '--' && inputs.args || inputs.target }}
@@ -297,6 +298,11 @@ jobs:
         fail-match: ${{ inputs.fail-match }}
         notice-match: ${{ inputs.notice-match }}
         output-path: ${{ inputs.output-path }}
+        report-name: >-
+          ci-report-${{
+            inputs.target-suffix
+            && format('{0}-', inputs.target-suffix)
+            || '' }}${{ inputs.target-name || inputs.target }}.json
         report-pre: ${{ inputs.report-pre }}
         report-post: ${{ inputs.report-post }}
         source: ${{ inputs.source }}
diff --git a/.github/workflows/_start.yml b/.github/workflows/_start.yml
index 9b475214da3b..a5c32521f946 100644
--- a/.github/workflows/_start.yml
+++ b/.github/workflows/_start.yml
@@ -54,7 +54,7 @@ jobs:
   start:
     runs-on: ubuntu-22.04
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.36
       id: check-config
       name: Prepare check data
       with:
@@ -77,13 +77,13 @@ jobs:
           | .skipped.output.summary = "${{ inputs.skipped-summary }}"
           | .skipped.output.text = ""
 
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.36
       name: Start checks
       id: checks
       with:
@@ -94,7 +94,7 @@ jobs:
 
           ${{ fromJSON(inputs.env).summary.summary }}
         token: ${{ steps.appauth.outputs.token }}
-    - uses: envoyproxy/toolshed/gh-actions/json/table@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/json/table@actions-v0.2.36
       name: Summary
       with:
         collapse-open: true
@@ -118,7 +118,7 @@ jobs:
         output-path: GITHUB_STEP_SUMMARY
         title: Checks started/skipped
 
-    - uses: envoyproxy/toolshed/gh-actions/github/env/save@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/env/save@actions-v0.2.36
       name: Save env
       id: data
       with:
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
index 15562a019983..5101ab9d19c1 100644
--- a/.github/workflows/codeql-daily.yml
+++ b/.github/workflows/codeql-daily.yml
@@ -30,7 +30,7 @@ jobs:
       uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
     - name: Free disk space
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.36
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index 10e4eb95e3ab..ff5dad1275f0 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -61,7 +61,7 @@ jobs:
 
     - name: Free disk space
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.36
 
     - name: Initialize CodeQL
       if: ${{ env.BUILD_TARGETS != '' }}
diff --git a/.github/workflows/command.yml b/.github/workflows/command.yml
index 99f78cc63d4f..15109d4c29bb 100644
--- a/.github/workflows/command.yml
+++ b/.github/workflows/command.yml
@@ -28,7 +28,7 @@ jobs:
          && github.actor != 'dependabot[bot]'
       }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/github/command@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/command@actions-v0.2.36
       name: Parse command from comment
       id: command
       with:
@@ -37,14 +37,14 @@ jobs:
           ^/(retest)
 
     # /retest
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       if: ${{ steps.command.outputs.command == 'retest' }}
       id: appauth-retest
       name: Appauth (retest)
       with:
         key: ${{ secrets.ENVOY_CI_APP_KEY }}
         app_id: ${{ secrets.ENVOY_CI_APP_ID }}
-    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.2.36
       if: ${{ steps.command.outputs.command == 'retest' }}
       name: Retest
       with:
diff --git a/.github/workflows/envoy-dependency.yml b/.github/workflows/envoy-dependency.yml
index 916894ac4c2e..933dad42184a 100644
--- a/.github/workflows/envoy-dependency.yml
+++ b/.github/workflows/envoy-dependency.yml
@@ -53,16 +53,16 @@ jobs:
     steps:
     - id: appauth
       name: Appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       with:
         app_id: ${{ secrets.ENVOY_CI_DEP_APP_ID }}
         key: ${{ secrets.ENVOY_CI_DEP_APP_KEY }}
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       with:
         token: ${{ steps.appauth.outputs.token }}
-    - uses: envoyproxy/toolshed/gh-actions/bson@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/bson@actions-v0.2.36
       id: update
       name: Update dependency (${{ inputs.dependency }})
       with:
@@ -97,13 +97,13 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - uses: envoyproxy/toolshed/gh-actions/upload/diff@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/upload/diff@actions-v0.2.36
       name: Upload diff
       with:
         name: ${{ inputs.dependency }}-${{ steps.update.outputs.output }}
     - name: Create a PR
       if: ${{ inputs.pr }}
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.36
       with:
         base: main
         body: |
@@ -134,11 +134,11 @@ jobs:
     steps:
     - id: appauth
       name: Appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       with:
         app_id: ${{ secrets.ENVOY_CI_DEP_APP_ID }}
         key: ${{ secrets.ENVOY_CI_DEP_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -180,7 +180,7 @@ jobs:
 
     - name: Check Docker SHAs
       id: build-images
-      uses: envoyproxy/toolshed/gh-actions/docker/shas@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/docker/shas@actions-v0.2.36
       with:
         images: |
            sha: envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
@@ -209,7 +209,7 @@ jobs:
       name: Update SHAs
       working-directory: envoy
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.36
       with:
         base: main
         body: Created by Envoy dependency bot
diff --git a/.github/workflows/envoy-macos.yml b/.github/workflows/envoy-macos.yml
index 9182073581bd..9859cab5aae5 100644
--- a/.github/workflows/envoy-macos.yml
+++ b/.github/workflows/envoy-macos.yml
@@ -52,6 +52,7 @@ jobs:
       steps-post:
       steps-pre: ${{ matrix.steps-pre }}
       target: ${{ matrix.target }}
+      target-name: ${{ matrix.target-name }}
       timeout-minutes: 90
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
     strategy:
@@ -60,6 +61,7 @@ jobs:
         include:
         - target: ci/mac_ci_steps.sh
           name: macOS
+          target-name: mac_ci_steps
           source: |
             source ./ci/mac_ci_setup.sh
             _BAZEL_BUILD_EXTRA_OPTIONS=(
diff --git a/.github/workflows/envoy-release.yml b/.github/workflows/envoy-release.yml
index 104df712e7e1..865b7f42ffbb 100644
--- a/.github/workflows/envoy-release.yml
+++ b/.github/workflows/envoy-release.yml
@@ -55,14 +55,14 @@ jobs:
     steps:
     - id: appauth
       name: App auth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       with:
         app_id: ${{ secrets.ENVOY_CI_PUBLISH_APP_ID }}
         key: ${{ secrets.ENVOY_CI_PUBLISH_APP_KEY }}
 
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       with:
         committer-name: ${{ env.COMMITTER_NAME }}
         committer-email: ${{ env.COMMITTER_EMAIL }}
@@ -83,10 +83,10 @@ jobs:
       name: Check changelog summary
     - if: ${{ inputs.author }}
       name: Validate signoff email
-      uses: envoyproxy/toolshed/gh-actions/email/validate@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/email/validate@actions-v0.2.36
       with:
         email: ${{ inputs.author }}
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.36
       name: Create release
       with:
         source: |
@@ -111,7 +111,7 @@ jobs:
       name: Release version
       id: release
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.36
       with:
         base: ${{ github.ref_name }}
         commit: false
@@ -136,20 +136,20 @@ jobs:
     steps:
     - id: appauth
       name: App auth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       with:
         app_id: ${{ secrets.ENVOY_CI_PUBLISH_APP_ID }}
         key: ${{ secrets.ENVOY_CI_PUBLISH_APP_KEY }}
 
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       with:
         committer-name: ${{ env.COMMITTER_NAME }}
         committer-email: ${{ env.COMMITTER_EMAIL }}
         strip-prefix: release/
         token: ${{ steps.appauth.outputs.token }}
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.36
       name: Sync version histories
       with:
         command: >-
@@ -159,7 +159,7 @@ jobs:
           --
           --signoff="${{ env.COMMITTER_NAME }} <${{ env.COMMITTER_EMAIL }}>"
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.36
       with:
         append-commit-message: true
         base: ${{ github.ref_name }}
@@ -189,13 +189,13 @@ jobs:
     steps:
     - id: appauth
       name: App auth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       with:
         app_id: ${{ secrets.ENVOY_CI_PUBLISH_APP_ID }}
         key: ${{ secrets.ENVOY_CI_PUBLISH_APP_KEY }}
 
     - name: Checkout repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.36
       with:
         committer-name: ${{ env.COMMITTER_NAME }}
         committer-email: ${{ env.COMMITTER_EMAIL }}
diff --git a/.github/workflows/envoy-sync.yml b/.github/workflows/envoy-sync.yml
index 197387b0ff4e..185867583126 100644
--- a/.github/workflows/envoy-sync.yml
+++ b/.github/workflows/envoy-sync.yml
@@ -34,12 +34,12 @@ jobs:
         - data-plane-api
         - mobile-website
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       id: appauth
       with:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: ${{ secrets.ENVOY_CI_SYNC_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.36
       with:
         repository: "envoyproxy/${{ matrix.downstream }}"
         ref: main
@@ -61,12 +61,12 @@ jobs:
         downstream:
         - envoy-openssl
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.36
       id: appauth
       with:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: ${{ secrets.ENVOY_CI_SYNC_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.35
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.36
       with:
         repository: "envoyproxy/${{ matrix.downstream }}"
         ref: release/v1.28
diff --git a/.github/workflows/garbage.yml b/.github/workflows/garbage.yml
index 01783dfd5a70..d6e0af919edb 100644
--- a/.github/workflows/garbage.yml
+++ b/.github/workflows/garbage.yml
@@ -33,7 +33,7 @@ jobs:
           pool-id: 17
     steps:
     - name: Remove dead AZP agents (${{ matrix.target }})
-      uses: envoyproxy/toolshed/gh-actions/azp/agent-cleanup@actions-v0.2.35
+      uses: envoyproxy/toolshed/gh-actions/azp/agent-cleanup@actions-v0.2.36
       with:
         azp-org: cncf
         azp-token: ${{ secrets.AZP_TOKEN }}
diff --git a/source/common/formatter/substitution_formatter.h b/source/common/formatter/substitution_formatter.h
index c2f13903881c..f33f07471f48 100644
--- a/source/common/formatter/substitution_formatter.h
+++ b/source/common/formatter/substitution_formatter.h
@@ -245,7 +245,7 @@ template <class FormatterContext> class FormatterBaseImpl : public FormatterBase
 };
 
 // Helper class to write value to output buffer in JSON style.
-// NOTE: This helper class has duplicated logic with the Json::Streamer class but
+// NOTE: This helper class has duplicated logic with the Json::BufferStreamer class but
 // provides lower level of APIs to operate on the output buffer (like control the
 // delimiters). This is designed for special scenario of substitution formatter and
 // is not intended to be used by other parts of the code.
diff --git a/source/common/json/json_streamer.h b/source/common/json/json_streamer.h
index 49239326e681..f63d1d439db7 100644
--- a/source/common/json/json_streamer.h
+++ b/source/common/json/json_streamer.h
@@ -454,7 +454,7 @@ template <class OutputBufferType> class StreamerBase {
 /**
  * A Streamer that streams to a Buffer::Instance.
  */
-using Streamer = StreamerBase<BufferOutput>;
+using BufferStreamer = StreamerBase<BufferOutput>;
 
 } // namespace Json
 } // namespace Envoy
diff --git a/source/server/admin/stats_html_render.cc b/source/server/admin/stats_html_render.cc
index f86c84861f88..954b685222f5 100644
--- a/source/server/admin/stats_html_render.cc
+++ b/source/server/admin/stats_html_render.cc
@@ -78,7 +78,7 @@ void StatsHtmlRender::noStats(Buffer::Instance& response, absl::string_view type
 void StatsHtmlRender::generate(Buffer::Instance& response, const std::string& name,
                                const Stats::ParentHistogram& histogram) {
   if (json_histograms_) {
-    Json::Streamer streamer(response);
+    Json::BufferStreamer streamer(response);
 
     // If this is the first histogram we are rendering, then we need to first
     // generate the supported-percentiles array sand save it in a constant.
diff --git a/source/server/admin/stats_render.cc b/source/server/admin/stats_render.cc
index ad46c3f39b8c..4e7652c8a57f 100644
--- a/source/server/admin/stats_render.cc
+++ b/source/server/admin/stats_render.cc
@@ -156,7 +156,7 @@ void StatsJsonRender::generate(Buffer::Instance& response, const std::string& na
   switch (histogram_buckets_mode_) {
   case Utility::HistogramBucketsMode::Unset:
   case Utility::HistogramBucketsMode::Summary: {
-    Json::Streamer::MapPtr map = json_->histogram_array_->addMap();
+    Json::BufferStreamer::MapPtr map = json_->histogram_array_->addMap();
     map->addEntries({{"name", name}});
     map->addKey("values");
     populatePercentiles(histogram, *map);
@@ -186,10 +186,10 @@ void StatsJsonRender::generate(Buffer::Instance& response, const std::string& na
   drainIfNeeded(response);
 }
 
-void StatsJsonRender::populateSupportedPercentiles(Json::Streamer::Array& array) {
+void StatsJsonRender::populateSupportedPercentiles(Json::BufferStreamer::Array& array) {
   Stats::HistogramStatisticsImpl empty_statistics;
   std::vector<double> supported = empty_statistics.supportedQuantiles();
-  std::vector<Json::Streamer::Value> views(supported.size());
+  std::vector<Json::BufferStreamer::Value> views(supported.size());
   for (uint32_t i = 0, n = supported.size(); i < n; ++i) {
     views[i] = supported[i] * 100;
   }
@@ -197,8 +197,8 @@ void StatsJsonRender::populateSupportedPercentiles(Json::Streamer::Array& array)
 }
 
 void StatsJsonRender::populatePercentiles(const Stats::ParentHistogram& histogram,
-                                          Json::Streamer::Map& map) {
-  Json::Streamer::ArrayPtr array = map.addArray();
+                                          Json::BufferStreamer::Map& map) {
+  Json::BufferStreamer::ArrayPtr array = map.addArray();
   std::vector<double> totals = histogram.cumulativeStatistics().computedQuantiles(),
                       intervals = histogram.intervalStatistics().computedQuantiles();
   uint32_t min_size = std::min(totals.size(), intervals.size());
@@ -238,7 +238,7 @@ void StatsJsonRender::renderHistogramStart() {
 
 void StatsJsonRender::generateHistogramDetail(const std::string& name,
                                               const Stats::ParentHistogram& histogram,
-                                              Json::Streamer::Map& map) {
+                                              Json::BufferStreamer::Map& map) {
   // Now we produce the stream-able histogram records, without using the json intermediate
   // representation or serializer.
   map.addEntries({{"name", name}});
@@ -251,8 +251,8 @@ void StatsJsonRender::generateHistogramDetail(const std::string& name,
 }
 
 void StatsJsonRender::populateBucketsVerbose(
-    const std::vector<Stats::ParentHistogram::Bucket>& buckets, Json::Streamer::Map& map) {
-  Json::Streamer::ArrayPtr buckets_array = map.addArray();
+    const std::vector<Stats::ParentHistogram::Bucket>& buckets, Json::BufferStreamer::Map& map) {
+  Json::BufferStreamer::ArrayPtr buckets_array = map.addArray();
   for (const Stats::ParentHistogram::Bucket& bucket : buckets) {
     buckets_array->addMap()->addEntries(
         {{"lower_bound", bucket.lower_bound_}, {"width", bucket.width_}, {"count", bucket.count_}});
@@ -281,12 +281,12 @@ void StatsJsonRender::collectBuckets(const std::string& name,
   size_t min_size =
       std::min({interval_buckets.size(), cumulative_buckets.size(), supported_buckets.size()});
 
-  Json::Streamer::MapPtr map = json_->histogram_array_->addMap();
+  Json::BufferStreamer::MapPtr map = json_->histogram_array_->addMap();
   map->addEntries({{"name", name}});
   map->addKey("buckets");
-  Json::Streamer::ArrayPtr buckets = map->addArray();
+  Json::BufferStreamer::ArrayPtr buckets = map->addArray();
   for (uint32_t i = 0; i < min_size; ++i) {
-    Json::Streamer::MapPtr bucket_map = buckets->addMap();
+    Json::BufferStreamer::MapPtr bucket_map = buckets->addMap();
     bucket_map->addEntries({{"upper_bound", supported_buckets[i]},
                             {"interval", interval_buckets[i]},
                             {"cumulative", cumulative_buckets[i]}});
diff --git a/source/server/admin/stats_render.h b/source/server/admin/stats_render.h
index 8894c9ee3d13..f78ba42f9ac1 100644
--- a/source/server/admin/stats_render.h
+++ b/source/server/admin/stats_render.h
@@ -83,7 +83,7 @@ class StatsJsonRender : public StatsRender {
    *
    * @param array the json streaming array array to stream into.
    */
-  static void populateSupportedPercentiles(Json::Streamer::Array& array);
+  static void populateSupportedPercentiles(Json::BufferStreamer::Array& array);
 
   /**
    * Streams detail about the provided histogram into the provided JSON map.
@@ -98,7 +98,7 @@ class StatsJsonRender : public StatsRender {
    */
   static void generateHistogramDetail(const std::string& name,
                                       const Stats::ParentHistogram& histogram,
-                                      Json::Streamer::Map& map);
+                                      Json::BufferStreamer::Map& map);
 
 private:
   // Collects the buckets from the specified histogram.
@@ -107,10 +107,10 @@ class StatsJsonRender : public StatsRender {
                       const std::vector<uint64_t>& cumulative_buckets);
 
   static void populateBucketsVerbose(const std::vector<Stats::ParentHistogram::Bucket>& buckets,
-                                     Json::Streamer::Map& map);
+                                     Json::BufferStreamer::Map& map);
   void renderHistogramStart();
   static void populatePercentiles(const Stats::ParentHistogram& histogram,
-                                  Json::Streamer::Map& map);
+                                  Json::BufferStreamer::Map& map);
 
   // This function irons out an API mistake made when defining the StatsRender
   // interface. The issue is that callers can provide a response buffer when
@@ -138,12 +138,12 @@ class StatsJsonRender : public StatsRender {
   // before the output stream is considered complete.
   struct JsonContext {
     explicit JsonContext(Buffer::Instance& response);
-    Json::Streamer streamer_;
-    Json::Streamer::MapPtr stats_map_;
-    Json::Streamer::ArrayPtr stats_array_;
-    Json::Streamer::MapPtr histogram_map1_;
-    Json::Streamer::MapPtr histogram_map2_;
-    Json::Streamer::ArrayPtr histogram_array_;
+    Json::BufferStreamer streamer_;
+    Json::BufferStreamer::MapPtr stats_map_;
+    Json::BufferStreamer::ArrayPtr stats_array_;
+    Json::BufferStreamer::MapPtr histogram_map1_;
+    Json::BufferStreamer::MapPtr histogram_map2_;
+    Json::BufferStreamer::ArrayPtr histogram_array_;
   };
   std::unique_ptr<JsonContext> json_;
   Buffer::Instance& response_;
diff --git a/source/server/server.cc b/source/server/server.cc
index 826c6dc4910c..d29713c65aad 100644
--- a/source/server/server.cc
+++ b/source/server/server.cc
@@ -720,6 +720,8 @@ absl::Status InstanceBase::initializeOrThrow(Network::Address::InstanceConstShar
     auto typed_admin = dynamic_cast<AdminImpl*>(admin_.get());
     RELEASE_ASSERT(typed_admin != nullptr, "Admin implementation is not an AdminImpl.");
     initial_config.initAdminAccessLog(bootstrap_, typed_admin->factoryContext());
+    ENVOY_LOG(info, "Starting admin HTTP server at {}",
+              initial_config.admin().address()->asString());
     admin_->startHttpListener(initial_config.admin().accessLogs(), initial_config.admin().address(),
                               initial_config.admin().socketOptions());
 #else