diff --git a/datawire-envoy-1.31.yaml b/datawire-envoy-1.31.yaml
new file mode 100644
index 00000000000..7bafaea426a
--- /dev/null
+++ b/datawire-envoy-1.31.yaml
@@ -0,0 +1,84 @@
+package:
+  name: datawire-envoy-1.31
+  version: 1.31.2
+  epoch: 0
+  description: Ambassador fork of Envoy Proxy.
+  copyright:
+    - license: Apache-2.0
+  resources:
+    cpu: 20
+    memory: 50Gi
+  dependencies:
+    provides:
+      - datawire-envoy=${{package.full-version}}
+
+environment:
+  contents:
+    packages:
+      - bash
+      - bazel-6
+      - binutils
+      - build-base
+      - busybox
+      - ca-certificates-bundle
+      - clang~15
+      - cmake
+      - coreutils
+      - git
+      - libtool
+      - llvm-libcxx-15
+      - llvm-libcxx-15-dev
+      - llvm-libcxxabi-15
+      - llvm-lld-15
+      - llvm15
+      - llvm15-cmake-default
+      - llvm15-dev
+      - llvm15-tools
+      - openjdk-11
+      - patch
+      - python3-dev
+      - samurai
+      - wolfi-baselayout
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/datawire/envoy
+      tag: v${{package.version}}
+      expected-commit: 07c86f395d7787eb6bdbc787bf775e1f7ddbb2e8
+      destination: envoy
+
+  - runs: |
+      export JAVA_HOME=/usr/lib/jvm/java-11-openjdk
+      mkdir -p .cache/bazel/_bazel_root
+
+      cd envoy
+      # The Python interpreter complains about being run as root, there's a flag to pass to disable that warning.
+      sed -i 's/envoy_dependencies_extra()/envoy_dependencies_extra(ignore_root_user_error=True)/g' WORKSPACE
+
+      ./bazel/setup_clang.sh /usr
+      echo "build --config=libc++" >> user.bazelrc
+
+      bazel build --verbose_failures -c opt envoy
+
+      mkdir -p ${{targets.destdir}}/usr/bin/
+      mv bazel-bin/source/exe/envoy-static ${{targets.destdir}}/usr/bin/envoy
+
+      # We no longer need this cache dir, which has some writable files.
+      rm -rf ../.cache/bazel/_bazel_root
+
+  - uses: strip
+
+update:
+  enabled: true
+  github:
+    identifier: datawire/envoy
+    strip-prefix: v
+    use-tag: true
+    tag-filter-prefix: v1.31
+
+test:
+  pipeline:
+    # AUTOGENERATED
+    - runs: |
+        envoy --version