diff --git a/.bazelci/presubmit.yml b/.bazelci/presubmit.yml
index d3134e9..38ecfb8 100644
--- a/.bazelci/presubmit.yml
+++ b/.bazelci/presubmit.yml
@@ -28,8 +28,8 @@
     - "//container/debian8/builders/rbe-debian8:toolchain-test"
     - "//container/ubuntu16_04/builders/rbe-ubuntu16_04:toolchain-test"
     - "//container/experimental/rbe-debian9:toolchain-test"
-    - "//container/ubuntu16_04/builders/bazel:bazel_0.15.0-test"
-    - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.15.0_docker_gcloud-test"
+    - "//container/ubuntu16_04/builders/bazel:bazel_0.16.1-test"
+    - "//container/ubuntu16_04/builders/bazel_docker_gcloud:bazel_0.16.1_docker_gcloud-test"
     test_flags:
     - "--test_output=errors"
     - "--verbose_failures"
diff --git a/configs/debian8_clang/0.3.0/toolchain.bazelrc b/configs/debian8_clang/0.3.0/toolchain.bazelrc
index 6fdf25f..af63d57 100644
--- a/configs/debian8_clang/0.3.0/toolchain.bazelrc
+++ b/configs/debian8_clang/0.3.0/toolchain.bazelrc
@@ -21,7 +21,7 @@
 build:remote --host_platform=@bazel_toolchains//configs/debian8_clang/0.3.0:rbe_debian8
 build:remote --platforms=@bazel_toolchains//configs/debian8_clang/0.3.0:rbe_debian8
 
-# Experimental configs for sanitizers, use --config=remote,remote-xxsan,remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
diff --git a/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc b/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc
index 965e064..0afcd52 100644
--- a/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc
+++ b/configs/ubuntu16_04_clang/1.0/toolchain.bazelrc
@@ -21,7 +21,7 @@
 build:remote --host_platform=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
 build:remote --platforms=@bazel_toolchains//configs/ubuntu16_04_clang/1.0:rbe_ubuntu1604
 
-# Experimental configs for sanitizers, use --config=remote,remote-xxsan,remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never
diff --git a/container/build.py b/container/build.py
index c0ff1bc..21ca837 100644
--- a/container/build.py
+++ b/container/build.py
@@ -80,7 +80,7 @@
 import subprocess
 import sys
 
-LATEST_BAZEL_VERSION = "0.16.0"
+LATEST_BAZEL_VERSION = "0.16.1"
 
 SUPPORTED_TYPES = [
     "rbe-debian8", "rbe-debian9", "rbe-ubuntu16_04", "ubuntu16_04-bazel",
diff --git a/container/ubuntu16_04/layers/bazel/BUILD b/container/ubuntu16_04/layers/bazel/BUILD
index 9b3492b..3880450 100644
--- a/container/ubuntu16_04/layers/bazel/BUILD
+++ b/container/ubuntu16_04/layers/bazel/BUILD
@@ -19,7 +19,11 @@
 load("//container/rules:docker_toolchains.bzl", "language_tool_layer")
 load("//container/rules:docker_toolchains.bzl", "toolchain_container")
 load("@base_images_docker//util:run.bzl", "container_run_and_extract")
-load("//container/ubuntu16_04/layers/bazel:version.bzl", "BAZEL_VERSION_SHA256S")
+load(
+    "//container/ubuntu16_04/layers/bazel:version.bzl",
+    "BAZEL_VERSION_SHA256S",
+    "BAZEL_VERSION_TO_CONFIG_VERSION",
+)
 
 exports_files(glob(["*.yaml"]))
 
@@ -37,12 +41,21 @@
     ],
 )
 
+# Generate bazel.bazelrc files for all supported versions.
+[genrule(
+    name = "generate_bazel_%s_bazelrc" % bazel_version,
+    srcs = ["bazel.bazelrc.tpl"],
+    outs = ["bazel-%s.bazelrc" % bazel_version],
+    cmd = "sed 's|{_BAZEL_CONFIG_VERSION}|" + BAZEL_VERSION_TO_CONFIG_VERSION.get(bazel_version) + "|' <$< >$@",
+) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
+
 # Create image with Bazel installer for all supported versions.
 [toolchain_container(
     name = "bazel_%s_installer_image" % bazel_version,
     base = "@ubuntu16_04//image",
     files = [
         "@bazel_%s_installer//file" % bazel_version.replace(".", ""),
+        ":bazel-%s.bazelrc" % bazel_version,
     ],
     packages = [
         "unzip",
@@ -53,9 +66,10 @@
 [container_run_and_extract(
     name = "bazel_%s_tar" % bazel_version,
     commands = [
-        "chmod +x /bazel-" + bazel_version + "-installer-linux-x86_64.sh",
-        "/bazel-" + bazel_version + "-installer-linux-x86_64.sh",
-        "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/*",
+        "mv /bazel-%s.bazelrc /etc/bazel.bazelrc" % bazel_version,
+        "chmod +x /bazel-%s-installer-linux-x86_64.sh" % bazel_version,
+        "/bazel-%s-installer-linux-x86_64.sh" % bazel_version,
+        "tar cvf /bazel.tar --mtime='1970-01-01' /usr/local/bin/bazel /usr/local/lib/bazel/* /etc/bazel.bazelrc",
     ],
     extract_file = "/bazel.tar",
     image = ":bazel_%s_installer_image.tar" % bazel_version,
@@ -73,5 +87,6 @@
     name = "generate_bazel_%s_yaml" % bazel_version,
     srcs = ["bazel.yaml.tpl"],
     outs = ["bazel_%s.yaml" % bazel_version],
-    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|' <$< >$@",
+    cmd = "sed 's|{_BAZEL_VERSION}|" + bazel_version + "|; " +
+          "s|{_BAZEL_CONFIG_VERSION}|" + BAZEL_VERSION_TO_CONFIG_VERSION.get(bazel_version) + "|' <$< >$@",
 ) for bazel_version, _ in BAZEL_VERSION_SHA256S.items()]
diff --git a/container/ubuntu16_04/layers/bazel/bazel.bazelrc.tpl b/container/ubuntu16_04/layers/bazel/bazel.bazelrc.tpl
new file mode 100644
index 0000000..e84faed
--- /dev/null
+++ b/container/ubuntu16_04/layers/bazel/bazel.bazelrc.tpl
@@ -0,0 +1,31 @@
+# Copyright 2016 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Experimental configs for sanitizers, use --config=xxsan --config=<asan/tsan/msan> (in that order)
+# See https://github.com/bazelbuild/bazel/issues/5291.
+build:xxsan --copt=-gmlt
+build:xxsan --strip=never
+
+build:asan --copt=-fsanitize=address
+build:asan --linkopt=-fsanitize=address
+
+build:tsan --copt=-fsanitize=thread
+build:tsan --linkopt=-fsanitize=thread
+
+build:msan --copt=-fsanitize=memory
+build:msan --linkopt=-fsanitize=memory
+build:msan --cxxopt=--stdlib=libc++
+build:msan --copt=-fsanitize-memory-track-origins
+build:msan --host_crosstool_top=@bazel_toolchains//configs/ubuntu16_04_clang/1.0/bazel_{_BAZEL_CONFIG_VERSION}/default:toolchain
+build:msan --crosstool_top=@bazel_toolchains//configs/ubuntu16_04_clang/1.0/bazel_{_BAZEL_CONFIG_VERSION}/msan:toolchain
diff --git a/container/ubuntu16_04/layers/bazel/bazel.yaml.tpl b/container/ubuntu16_04/layers/bazel/bazel.yaml.tpl
index e391955..456d58f 100644
--- a/container/ubuntu16_04/layers/bazel/bazel.yaml.tpl
+++ b/container/ubuntu16_04/layers/bazel/bazel.yaml.tpl
@@ -5,3 +5,13 @@
   command: 'bazel'
   args: ['version']
   expectedOutput: ['Build label: {_BAZEL_VERSION}']
+
+fileExistenceTests:
+- name: 'bazelrc'
+  path: '/etc/bazel.bazelrc'
+  shouldExist: true
+
+fileContentTests:
+- name: 'bazelrc-content'
+  path: '/etc/bazel.bazelrc'
+  expectedContents: ['.*--host_crosstool_top=@bazel_toolchains//configs/ubuntu16_04_clang/1.0/bazel_{_BAZEL_CONFIG_VERSION}/default:toolchain.*']
diff --git a/container/ubuntu16_04/layers/bazel/version.bzl b/container/ubuntu16_04/layers/bazel/version.bzl
index ebb381f..8508798 100644
--- a/container/ubuntu16_04/layers/bazel/version.bzl
+++ b/container/ubuntu16_04/layers/bazel/version.bzl
@@ -2,5 +2,18 @@
     "0.14.1": "7b14e4fc76bf85c4abf805833e99f560f124a3b96d56e0712c693e94e19d1376",
     "0.15.0": "7f6748b48a7ea6bdf00b0e1967909ce2181ebe6f377638aa454a7d09a0e3ea7b",
     "0.15.2": "13eae0f09565cf17fc1c9ce1053b9eac14c11e726a2215a79ebaf5bdbf435241",
-    "0.16.0": "bdef5499ea21baa69e707391b463105b32c4a2fbf1ab045da53f4023c1a033be",
+    "0.16.1": "17ab70344645359fd4178002f367885e9019ae7507c9c1ade8220f3628383444",
+}
+
+# This is the map from supported Bazel versions to the Bazel version used to
+# generate the published toolchain configs that the former should be used with.
+# This is needed because, in most cases, patch updates in Bazel do not result in
+# changes in toolchain configs, so we do not publish duplicated toolchain
+# configs. So, for example, Bazel 0.15.2 should still use published toolchain
+# configs generated with Bazel 0.15.0.
+BAZEL_VERSION_TO_CONFIG_VERSION = {
+    "0.14.1": "0.14.1",
+    "0.15.0": "0.15.0",
+    "0.15.2": "0.15.0",
+    "0.16.1": "0.16.1",
 }
diff --git a/release/toolchain.bazelrc.tpl b/release/toolchain.bazelrc.tpl
index f055c77..c255d16 100644
--- a/release/toolchain.bazelrc.tpl
+++ b/release/toolchain.bazelrc.tpl
@@ -21,7 +21,7 @@
 build:remote --host_platform=@bazel_toolchains//${PACKAGE}/${CONFIG_VERSION}:${PLATFORM}
 build:remote --platforms=@bazel_toolchains//${PACKAGE}/${CONFIG_VERSION}:${PLATFORM}
 
-# Experimental configs for sanitizers, use --config=remote,remote-xxsan,remote-<asan/tsan/msan> (in that order)
+# Experimental configs for sanitizers, use --config=remote --config=remote-xxsan --config=remote-<asan/tsan/msan> (in that order)
 # See https://github.com/bazelbuild/bazel/issues/5291.
 build:remote-xxsan --copt=-gmlt
 build:remote-xxsan --strip=never