diff --git a/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch b/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
deleted file mode 100644
index 7982cb746d9f..000000000000
--- a/pkgs/by-name/en/envoy/0002-nixpkgs-use-system-Go.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
-Date: Mon, 22 Apr 2024 11:58:00 +0200
-Subject: [PATCH] nixpkgs: use system Go
-
-Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
-Signed-off-by: Luke Granger-Brown <git@lukegb.com>
----
- bazel/dependency_imports.bzl | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
-index ecfe356b3f9c44dbc00877e57b72a675e9e5baf0..10be4b0b3f65e486c1dc8419337a5cf823431774 100644
---- a/bazel/dependency_imports.bzl
-+++ b/bazel/dependency_imports.bzl
-@@ -24,7 +24,7 @@ load("@rules_rust//rust:defs.bzl", "rust_common")
- load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_register_toolchains", "rust_repository_set")
- 
- # go version for rules_go
--GO_VERSION = "1.24.6"
-+GO_VERSION = "host"
- 
- JQ_VERSION = "1.7"
- YQ_VERSION = "4.24.4"
diff --git a/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch b/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
index e8113b102ee7..3253721c8973 100644
--- a/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
+++ b/pkgs/by-name/en/envoy/0003-nixpkgs-use-system-C-C-toolchains.patch
@@ -13,10 +13,11 @@ diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
 index 10be4b0b3f65e486c1dc8419337a5cf823431774..b0badb3ccab3b112043bd8616770f8014238d396 100644
 --- a/bazel/dependency_imports.bzl
 +++ b/bazel/dependency_imports.bzl
-@@ -38,7 +38,11 @@ def envoy_dependency_imports(
+@@ -40,7 +40,11 @@ def envoy_dependency_imports(
          yq_version = YQ_VERSION,
          buf_sha = BUF_SHA,
          buf_version = BUF_VERSION):
+     compatibility_proxy_repo()
 -    rules_foreign_cc_dependencies()
 +    rules_foreign_cc_dependencies(
 +        register_default_tools=False,  # no prebuilt toolchains
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 738f1b5fd606..78fa316439da 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -12,7 +12,6 @@
   rustPlatform,
   cmake,
   gn,
-  go_1_24,
   openjdk11_headless,
   ninja,
   patchelf,
@@ -39,9 +38,9 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.35.2";
-    rev = "2c2cd7efd119a5c9028b68a97d88a540248f8d18";
-    hash = "sha256-HhjIewZMOr9hzcnFPIckfK5PIozqdypSdmYgvb7ccds=";
+    version = "1.36.2";
+    rev = "dc2d3098ae5641555f15c71d5bb5ce0060a8015c";
+    hash = "sha256-ll7gn3y2dUW3kMtbUTjfi7ZTviE87S30ptiRlCPec9Q=";
   };
 
   # these need to be updated for any changes to fetchAttrs
@@ -50,8 +49,8 @@ let
       depsHash
     else
       {
-        x86_64-linux = "sha256-xBSSDxvp6VjZt+Fc62/eP5Z2WWfpkAGl1Z+PupyDpg4=";
-        aarch64-linux = "sha256-2g8x12zkyZyjkv5NubG4bVmiLiN8uoEZ33e6Azd1guw=";
+        x86_64-linux = "sha256-AqXGk6IZ85TFNO7v8KFJOe8Caf1x4xQh/VuhaUq9rB4=";
+        aarch64-linux = "sha256-l70j1UcVNHGrzzvcqdeLDJUuaLkoLNM2yWCHKY4EShs=";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -76,9 +75,6 @@ buildBazelPackage rec {
       # use system Python, not bazel-fetched binary Python
       ./0001-nixpkgs-use-system-Python.patch
 
-      # use system Go, not bazel-fetched binary Go
-      ./0002-nixpkgs-use-system-Go.patch
-
       # use system C/C++ tools
       ./0003-nixpkgs-use-system-C-C-toolchains.patch
 
@@ -124,7 +120,6 @@ buildBazelPackage rec {
     cmake
     python3
     gn
-    go_1_24
     jdk
     ninja
     patchelf
@@ -178,6 +173,10 @@ buildBazelPackage rec {
       rm -r $bazelOut/external/local_jdk
       rm -r $bazelOut/external/bazel_gazelle_go_repository_tools/bin
 
+      # CMake 4.1 drops compatibility with <3.5; bump libevent's floor to avoid configure failure.
+      sed -i 's/cmake_minimum_required(VERSION 3\\.1.2 FATAL_ERROR)/cmake_minimum_required(VERSION 3.5 FATAL_ERROR)/' \
+        $bazelOut/external/com_github_libevent_libevent/CMakeLists.txt
+
       # Remove compiled python
       find $bazelOut -name '*.pyc' -delete
 
@@ -200,6 +199,7 @@ buildBazelPackage rec {
     dontUseNinjaInstall = true;
     bazel = null;
     preConfigure = ''
+      export CMAKE_POLICY_VERSION_MINIMUM=3.5
       echo "common --repository_cache=\"$bazelOut/external/repository_cache\"" >> .bazelrc
       echo "common --repository_disable_download" >> .bazelrc