diff --git a/repositories/images.bzl b/repositories/images.bzl
index 66183fe..2d15756 100644
--- a/repositories/images.bzl
+++ b/repositories/images.bzl
@@ -121,7 +121,6 @@
 
     if "debian8-clang" not in excludes:
         # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-        # l.gcr.io/google/clang-debian8:r328903
         container_pull(
             name = "debian8-clang",
             digest = toolchain_container_sha256s()["debian8_clang"],
@@ -131,7 +130,6 @@
 
     if "ubuntu16_04-clang" not in excludes:
         # TODO(xingao) Switch to use "marketplace.gcr.io" registry once Buildkite support proper auth.
-        # l.gcr.io/google/clang-ubuntu:r328903
         container_pull(
             name = "ubuntu16_04-clang",
             digest = toolchain_container_sha256s()["ubuntu16_04_clang"],
diff --git a/rules/toolchain_containers.bzl b/rules/toolchain_containers.bzl
index 924fb2f..e590392 100644
--- a/rules/toolchain_containers.bzl
+++ b/rules/toolchain_containers.bzl
@@ -8,12 +8,14 @@
         # gcr.io/cloud-marketplace/google/debian9:latest
         "debian9": "sha256:1d6a9a6d106bd795098f60f4abb7083626354fa6735e81743c7f8cfca11259f0",
         # gcr.io/cloud-marketplace/google/ubuntu16_04:latest
-        "ubuntu16_04": "sha256:9f9775c124417057fd58d28835b42b30f5d0410530256d857b12eae640d0a359",
+        "ubuntu16_04": "sha256:8a12cc26c62e2f9824aada8d13c1f0c2d2847d18191560e1500d651a709d6550",
 
         ###########################################################
         # Python3 images                                          #
         ###########################################################
         # gcr.io/cloud-marketplace/google/python:latest
+        # Pinned to ace668f0f01e5e562ad09c3f128488ec33fa9126313f16505a86ae77865d1696 as it is the
+        # latest *debian8* based python3 image. Newer ones are ubuntu16_04 based.
         "debian8_python3": "sha256:ace668f0f01e5e562ad09c3f128488ec33fa9126313f16505a86ae77865d1696",
         # gcr.io/google-appengine/python:latest
         "ubuntu16_04_python3": "sha256:67fd35064a812fd0ba0a6e9485410f9f2710ebf7b0787a7b350ce6a20f166bfe",
diff --git a/third_party/clang/revision.bzl b/third_party/clang/revision.bzl
index 6551eac..badd7ad 100644
--- a/third_party/clang/revision.bzl
+++ b/third_party/clang/revision.bzl
@@ -1,7 +1,7 @@
-CLANG_REVISION = "r328903"
+CLANG_REVISION = "r337145"
 
-DEBIAN8_CLANG_SHA256 = "8f460b909788ffd8dd467ea4ee106ccd08b4a43408dd98ac8e3938a9b6452bb7"
+DEBIAN8_CLANG_SHA256 = "64c6bd2636b0b6daeddf4ae7e436e9d93f4f82c13d351196ec3bd6438e59c2c1"
 
-DEBIAN9_CLANG_SHA256 = "350f77999033e39a02294406250df819cacb2106daa7b04b5fd6bfe7aa0ab5a1"
+DEBIAN9_CLANG_SHA256 = "7b6fda25446bf15c674f1a6312d493afeeee36757e8f5ba13ea2278104575752"
 
-UBUNTU16_04_CLANG_SHA256 = "f1874c57aa1e34c09595a4a0e03b91d7bf89dd7ad044ff4834b46198ff2e9d14"
+UBUNTU16_04_CLANG_SHA256 = "ab98c63eb09c04112cc992bc95ebc0dcea8c5e9d0760438789be2896cdc69ff8"
diff --git a/third_party/libcxx/revision.bzl b/third_party/libcxx/revision.bzl
index 9d34c97..7f26c1b 100644
--- a/third_party/libcxx/revision.bzl
+++ b/third_party/libcxx/revision.bzl
@@ -1,7 +1,7 @@
-LIBCXX_REVISION = "r328903"
+LIBCXX_REVISION = "r337145"
 
-DEBIAN8_LIBCXX_SHA256 = "d9798333832690577ca740acb3016a803be684ad0ed02e78922424b4b651f8ce"
+DEBIAN8_LIBCXX_SHA256 = "c0b744efabd78b988e9d403ce1f45957008be2016da1473f903c858cbe319cb5"
 
-DEBIAN9_LIBCXX_SHA256 = "66219b838f8d243c071a4c094e13ef78082cd858d87841dd607839a351680b90"
+DEBIAN9_LIBCXX_SHA256 = "6abcf4b8f0c8c76dbe18ec8f56d573a3c310b49ca03bc77da3bb6c9182605e64"
 
-UBUNTU16_04_LIBCXX_SHA256 = "786a35a813e493342a018c04b8fb951a8b34a7d7e377e1ac793db738fc240451"
+UBUNTU16_04_LIBCXX_SHA256 = "b37eaf8348dd8dd529d0c2460a54447f527152e5f6928673da6757ea32aa70a4"