diff --git a/BUILD b/BUILD
index afec159fdba..7dea78a96a7 100644
--- a/BUILD
+++ b/BUILD
@@ -1,6 +1,7 @@
 load(
     "@envoy//bazel:envoy_build_system.bzl",
     "envoy_cc_binary",
+    "envoy_cc_test_binary",
 )
 
 # Copyright 2016 Istio Authors. All Rights Reserved.
@@ -54,3 +55,18 @@ pkg_tar(
     package_dir = "/usr/local/bin/",
     tags = ["manual"],
 )
+
+envoy_cc_test_binary(
+    name = "router_check_tool",
+    repository = "@envoy",
+    srcs = [
+        "@envoy//test/tools/router_check:router_check.cc",
+    ],
+    deps = ISTIO_EXTENSIONS +  [
+        "@envoy//test/tools/router_check:router_check_main_lib",
+        "@envoy//source/extensions/retry/host/previous_hosts:config",
+        "@envoy//source/extensions/retry/host/omit_canary_hosts:config",
+        "@envoy//source/extensions/retry/host/omit_host_metadata:config",
+        "@envoy//source/extensions/filters/http/fault:config",
+    ],
+)
diff --git a/WORKSPACE b/WORKSPACE
index 130a8c12ef5..c98b1772667 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -38,6 +38,8 @@ http_archive(
     sha256 = ENVOY_SHA256,
     strip_prefix = ENVOY_REPO + "-" + ENVOY_SHA,
     url = "https://github.com/" + ENVOY_ORG + "/" + ENVOY_REPO + "/archive/" + ENVOY_SHA + ".tar.gz",
+    patches = ["router_check.patch"],
+    patch_args = ["-p1"],
 )
 
 load("@envoy//bazel:api_binding.bzl", "envoy_api_binding")
diff --git a/external/router_check.patch b/external/router_check.patch
new file mode 100644
index 00000000000..5fa9f89c5f9
--- /dev/null
+++ b/external/router_check.patch
@@ -0,0 +1,14 @@
+diff --git a/test/tools/router_check/router.cc b/test/tools/router_check/router.cc
+index 410caf6cc0..84c9670d77 100644
+--- a/test/tools/router_check/router.cc
++++ b/test/tools/router_check/router.cc
+@@ -137,6 +137,9 @@ RouterCheckTool RouterCheckTool::create(const std::string& router_config_file,
+   assignRuntimeFraction(route_config);
+   auto factory_context =
+       std::make_unique<NiceMock<Server::Configuration::MockServerFactoryContext>>();
++
++  Runtime::maybeSetDeprecatedInts("re2.max_program_size.error_level", 32768); // istio-proxy default
++
+   auto config = *Router::ConfigImpl::create(route_config, *factory_context,
+                                             ProtobufMessage::getNullValidationVisitor(), false);
+   if (!disable_deprecation_check) {
diff --git a/router-check-tool/Dockerfile b/router-check-tool/Dockerfile
new file mode 100644
index 00000000000..39c519ff0cc
--- /dev/null
+++ b/router-check-tool/Dockerfile
@@ -0,0 +1,15 @@
+FROM gcr.io/istio-testing/build-tools-proxy:master-latest as builder
+
+WORKDIR /work/
+
+COPY . /work/
+
+RUN bazel build //:router_check_tool
+
+FROM ubuntu
+
+COPY --from=builder /work/bazel-bin/router_check_tool /usr/local/bin/
+
+USER nobody:nogroup
+
+ENTRYPOINT [ "/usr/local/bin/router_check_tool"]