diff --git a/.github/workflows/env.yml b/.github/workflows/env.yml
index a0caaa67cfb6..27149302a3d6 100644
--- a/.github/workflows/env.yml
+++ b/.github/workflows/env.yml
@@ -3,42 +3,48 @@ name: Environment
 on:
   workflow_call:
     outputs:
+      build_image_ubuntu:
+        value: ${{ jobs.repo.outputs.build_image_ubuntu }}
+      build_image_ubuntu_mobile:
+        value: ${{ jobs.repo.outputs.build_image_ubuntu_mobile }}
       mobile_android_build:
-        value: ${{ jobs.mobile.outputs.mobile_android_build }}
+        value: ${{ jobs.repo.outputs.mobile_android_build }}
       mobile_android_build_all:
-        value: ${{ jobs.mobile.outputs.mobile_android_build_all }}
+        value: ${{ jobs.repo.outputs.mobile_android_build_all }}
       mobile_android_tests:
-        value: ${{ jobs.mobile.outputs.mobile_android_tests }}
+        value: ${{ jobs.repo.outputs.mobile_android_tests }}
       mobile_asan:
-        value: ${{ jobs.mobile.outputs.mobile_asan }}
+        value: ${{ jobs.repo.outputs.mobile_asan }}
       mobile_cc_tests:
-        value: ${{ jobs.mobile.outputs.mobile_cc_tests }}
+        value: ${{ jobs.repo.outputs.mobile_cc_tests }}
       mobile_compile_time_options:
-        value: ${{ jobs.mobile.outputs.mobile_compile_time_options }}
+        value: ${{ jobs.repo.outputs.mobile_compile_time_options }}
       mobile_coverage:
-        value: ${{ jobs.mobile.outputs.mobile_coverage }}
+        value: ${{ jobs.repo.outputs.mobile_coverage }}
       mobile_formatting:
-        value: ${{ jobs.mobile.outputs.mobile_formatting }}
+        value: ${{ jobs.repo.outputs.mobile_formatting }}
       mobile_ios_build:
-        value: ${{ jobs.mobile.outputs.mobile_ios_build }}
+        value: ${{ jobs.repo.outputs.mobile_ios_build }}
       mobile_ios_build_all:
-        value: ${{ jobs.mobile.outputs.mobile_ios_build_all }}
+        value: ${{ jobs.repo.outputs.mobile_ios_build_all }}
       mobile_ios_tests:
-        value: ${{ jobs.mobile.outputs.mobile_ios_tests }}
+        value: ${{ jobs.repo.outputs.mobile_ios_tests }}
       mobile_release_validation:
-        value: ${{ jobs.mobile.outputs.mobile_release_validation }}
+        value: ${{ jobs.repo.outputs.mobile_release_validation }}
       mobile_tsan:
-        value: ${{ jobs.mobile.outputs.mobile_tsan }}
+        value: ${{ jobs.repo.outputs.mobile_tsan }}
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-env
   cancel-in-progress: true
 
 jobs:
-  mobile:
+  repo:
     if: github.repository == 'envoyproxy/envoy'
     runs-on: ubuntu-20.04
     outputs:
+      build_image_ubuntu: ${{ steps.build_image.outputs.build_image_ubuntu }}
+      build_image_ubuntu_mobile: ${{ steps.build_image.outputs.build_image_ubuntu_mobile }}
       mobile_android_build: ${{ steps.should_run.outputs.mobile_android_build }}
       mobile_android_build_all: ${{ steps.should_run.outputs.mobile_android_build_all }}
       mobile_android_tests: ${{ steps.should_run.outputs.mobile_android_tests }}
@@ -58,6 +64,21 @@ jobs:
         fetch-depth: 0
     - name: Add safe directory
       run: git config --global --add safe.directory /__w/envoy/envoy
+
+    - id: build_image
+      name: 'Check current build images'
+      run: |
+        {
+            echo "build_image_ubuntu=${BUILD_IMAGE_UBUNTU_REPO}:${BUILD_IMAGE_UBUNTU}@sha256:${BUILD_IMAGE_UBUNTU_SHA}"
+            echo "build_image_ubuntu_mobile=${BUILD_IMAGE_UBUNTU_REPO}:mobile-${BUILD_IMAGE_UBUNTU}@sha256:${BUILD_IMAGE_UBUNTU_MOBILE_SHA}"
+        } >> "$GITHUB_OUTPUT"
+      env:
+        # TODO(phlax): derive these from a config file
+        BUILD_IMAGE_UBUNTU_REPO: envoyproxy/envoy-build-ubuntu
+        BUILD_IMAGE_UBUNTU: 41c5a05d708972d703661b702a63ef5060125c33
+        BUILD_IMAGE_UBUNTU_SHA: 50337314a150ed12447c87c1622eac6f611a069888722fb9a426e21ed161cc26
+        BUILD_IMAGE_UBUNTU_MOBILE_SHA: ca26ff05bd3f3a09468242faaf38ae48315e57f0a87c102352162f95ac620e6f
+
     - id: should_run
       name: 'Check what to run'
       run: |
diff --git a/.github/workflows/mobile-android_build.yml b/.github/workflows/mobile-android_build.yml
index 8f5c71a7d978..f791676c9084 100644
--- a/.github/workflows/mobile-android_build.yml
+++ b/.github/workflows/mobile-android_build.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 90
     container:
-      image: envoyproxy/envoy-build-ubuntu:mobile-41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu_mobile }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++
diff --git a/.github/workflows/mobile-android_tests.yml b/.github/workflows/mobile-android_tests.yml
index 9baf8b9922a7..93129f5b9e86 100644
--- a/.github/workflows/mobile-android_tests.yml
+++ b/.github/workflows/mobile-android_tests.yml
@@ -83,7 +83,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 90
     container:
-      image: envoyproxy/envoy-build-ubuntu:mobile-41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu_mobile }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++
diff --git a/.github/workflows/mobile-asan.yml b/.github/workflows/mobile-asan.yml
index e5a9378c262e..e6e72fcb3967 100644
--- a/.github/workflows/mobile-asan.yml
+++ b/.github/workflows/mobile-asan.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 180
     container:
-      image: envoyproxy/envoy-build-ubuntu:mobile-41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu_mobile }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++
diff --git a/.github/workflows/mobile-cc_tests.yml b/.github/workflows/mobile-cc_tests.yml
index c824fc8f6ece..99e1951fde1b 100644
--- a/.github/workflows/mobile-cc_tests.yml
+++ b/.github/workflows/mobile-cc_tests.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 120
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
     steps:
     - uses: actions/checkout@v3
     - name: Add safe directory
diff --git a/.github/workflows/mobile-core.yml b/.github/workflows/mobile-core.yml
index 7c111e04a88b..31383adf4752 100644
--- a/.github/workflows/mobile-core.yml
+++ b/.github/workflows/mobile-core.yml
@@ -11,13 +11,19 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  env:
+    if: ${{ github.repository == 'envoyproxy/envoy' }}
+    uses: ./.github/workflows/env.yml
+    secrets: inherit
+
   unittests:
     if: ${{ github.repository == 'envoyproxy/envoy' }}
+    needs: env
     name: unit_tests
     runs-on: ubuntu-20.04
     timeout-minutes: 120
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
     steps:
     - uses: actions/checkout@v3
     - name: Ensure no listener leaks
diff --git a/.github/workflows/mobile-coverage.yml b/.github/workflows/mobile-coverage.yml
index 8ff027449a9e..f628f2d62134 100644
--- a/.github/workflows/mobile-coverage.yml
+++ b/.github/workflows/mobile-coverage.yml
@@ -26,7 +26,7 @@ jobs:
       run:
         shell: bash
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
     steps:
     - uses: actions/checkout@v3
     - name: Add safe directory
diff --git a/.github/workflows/mobile-docs.yml b/.github/workflows/mobile-docs.yml
index 093b5f29740c..31554d189288 100644
--- a/.github/workflows/mobile-docs.yml
+++ b/.github/workflows/mobile-docs.yml
@@ -11,12 +11,18 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  env:
+    if: ${{ github.repository == 'envoyproxy/envoy' }}
+    uses: ./.github/workflows/env.yml
+    secrets: inherit
+
   docs:
     if: ${{ github.repository == 'envoyproxy/envoy' }}
+    needs: env
     runs-on: ubuntu-20.04
     timeout-minutes: 20
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
     steps:
     - uses: actions/checkout@v3
     - name: Add safe directory
diff --git a/.github/workflows/mobile-format.yml b/.github/workflows/mobile-format.yml
index ac48d4308063..54b57cddbcf4 100644
--- a/.github/workflows/mobile-format.yml
+++ b/.github/workflows/mobile-format.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 45
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
       env:
         CLANG_FORMAT: /opt/llvm/bin/clang-format
         BUILDIFIER_BIN: /usr/local/bin/buildifier
diff --git a/.github/workflows/mobile-perf.yml b/.github/workflows/mobile-perf.yml
index b1c142bf2c1b..9da97dbb0016 100644
--- a/.github/workflows/mobile-perf.yml
+++ b/.github/workflows/mobile-perf.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 120
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 90
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++
@@ -76,7 +76,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 30
     container:
-      image: envoyproxy/envoy-build-ubuntu:41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu }}
     steps:
     - uses: actions/checkout@v3
     - uses: actions/download-artifact@v3
diff --git a/.github/workflows/mobile-tsan.yml b/.github/workflows/mobile-tsan.yml
index 918613f15146..713e9a27d720 100644
--- a/.github/workflows/mobile-tsan.yml
+++ b/.github/workflows/mobile-tsan.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 90
     container:
-      image: envoyproxy/envoy-build-ubuntu:mobile-41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu_mobile }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++
diff --git a/.github/workflows/mobile_release.yml b/.github/workflows/mobile_release.yml
index df91222186e8..e2f6f7b947b6 100644
--- a/.github/workflows/mobile_release.yml
+++ b/.github/workflows/mobile_release.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 120
     container:
-      image: envoyproxy/envoy-build-ubuntu:mobile-41c5a05d708972d703661b702a63ef5060125c33
+      image: ${{ needs.env.outputs.build_image_ubuntu_mobile }}
       env:
         CC: /opt/llvm/bin/clang
         CXX: /opt/llvm/bin/clang++